Why is (Almost) Everybody Wrong About HKU\.Default?

Helge Klein, 11/19/2007 | 7 Comments | 16,559 Views

Most technical folks have stumbled across the registry hive HKEY_USERS\.Default at some point. Many of them think they know what it is used for. Interestingly, most who do are wrong. The misconception about what HKU\.Default is used for dates back to the good old days when Windows NT 4.0 was still considered "new technology". This misconception has been, and still is, passed on to future generations by means of books, magazine articles, blog entries and geek talk. It is, in my humble opinion, so widespread, that I would bet that 50% of those who think they know the correct meaning are, in fact, wrong.


What Most Think


Supposedly, HKU\.Default is the registry hive of the default user profile. The default user profile (typically located in C:\Documents and Settings\Default User) sits in the user profile base folder and is used as a template for new user profiles. Whenever a user logs on who has an empty or non-existent profile the system basically copies the default user profile to a new folder and makes that the user's new profile. Since every registry setting stored in the default user profile gets copied into every new user profile, many administrators think it is a good idea to modify the default user's registry. I don't. But that is a topic for another article.


Of the many admins that modify the default user profile's registry some are proud enough of this "feat" to publish what they do and how they do it. This is how the myth gets carried on. Type in "HKU\.Default" in the search engine of your choice. Way too many of the results point to registry scripts that try to do exactly what I have described.


The Truth


The settings stored in the registry hive HKU\.Default are used by the logon desktop. That desktop is, of course, shown to give users the ability to log on to their system. Want to have the Num Lock key turned on when users enter their credentials? Go to HKEY_USERS\.DEFAULT\Control Panel\Keyboard and change the value InitialKeyboardIndicators from 0 to 1. Don't believe me? Try it out! The hive HKU\.Default is stored in %SystemRoot%\system32\config\default (no extension). This is a very different location from the default user profile's registry file which is stored in the file NTUSER.DAT inside the profile directory (typically in C:\Documents and Settings\Default User).

+++ Your opportunity +++ Use Profile Migrator the new sepago product that makes migrating user personalities between different platforms a breeze.! Download your free version now!

7 responses for "Why is (Almost) Everybody Wrong About HKU\.Default?"

[...] time ago I wrote about

[...] time ago I wrote about a misconception so common that it might pass as an IT legend - the confusion of HKU.Default [...]

very interesting, but I don't

very interesting, but I don't agree with you
Idetrorce

Idetrorce, what exactly

Idetrorce,

what exactly don't you agree with?

You are wrong. When I search

You are wrong. When I search on "HKU\.Default" all I find are references back to this article! :)

If that is so, then the world

If that is so, then the world is a tiny little bit better now ;-)

Helge is right. Thanks for

Helge is right. Thanks for the article.

http://technet.microsoft.com/

http://technet.microsoft.com/en-us/library/bb490855.aspx

System Profile
--------------
In Windows 2000, when an application or service used the LoadUserProfile API to load a user profile for a process running as the local system, Windows created a profile named %computername%$ , where %computername% is the name of the local computer. This could cause problems for some applications and services, because depending on whether the system profile was loaded, HKEY_CURRENT_USER could in fact resolve to different registries – either HKEY_USERS \S-1-5-18 or HKEY_USERS\.DEFAULT depending on whether another component has loaded the SYSTEM profile.

To avoid this, Windows XP creates a new profile for the system, located in %systemroot%\System32\Config\SystemProfile. This profile is always loaded, and is a link to HKEY_USERS\.DEFAULT. This ensures that system components always have a consistent profile and registry.