HKEY_LOCAL_MACHINE contains the configuration data for the local computer. The information in this database is used by applications, device drivers, and the Windows NT system to determine configuration data for the local computer, regardless of which user is logged on and what software is in use.
HKEY_LOCAL_MACHINE contains five subtrees, as listed briefly in the following table. The rest of this section describes these keys.
Note You can read information in any of these keys, but you can only add or change information in the SOFTWARE and SYSTEM keys.
Table 10.4 Subtrees in HKEY_LOCAL_MACHINE
Subtree key name | Contents |
HARDWARE | The database that describes the physical hardware in the computer, the way device drivers use that hardware, and mappings and related data that link kernel-mode drivers with various user-mode code. All data in this subtree is recreated each time the system is started. The Description key describes the actual computer hardware. The DeviceMap key contains miscellaneous data in formats specific to particular classes of drivers. The ResourceMap key describes which device drivers claim which hardware resources. The Windows NT Diagnostics program (WINMSD.EXE) can report on its contents in an easy-to-read form. |
SAM | The security information for user and group accounts, and for the domains in Windows NT Server. (SAM is the Security Account Manager.) |
SECURITY | The database that contains the local security policy, such as specific user rights. This key is used only by the Windows NT security subsystem. |
SOFTWARE | The per-computer software database. This key contains data about software installed on the local computer, along with various items of miscellaneous configuration data. |
SYSTEM | The database that controls system startup, device driver loading, Windows NT services, and operating system behavior. |
By convention, if similar data exists under HKEY_CURRENT_USER and under HKEY_LOCAL_MACHINE, the data in HKEY_CURRENT_USER is considered to take precedence. However, values in this key may also extend (rather than replace) data in HKEY_LOCAL_MACHINE. Also, some items (such as device driver loading entries) are meaningless if they occur outside of HKEY_LOCAL_MACHINE.