Useful tips

Where are registry hives stored?

Where are registry hives stored?

System32\Config
Most of the supporting files for the hives are in the %SystemRoot%\System32\Config directory. These files are updated each time a user logs on.

Where are .REG files located?

Windows\System32\Config
On Windows 10 and Windows 7, the system-wide registry settings are stored in files under C:\Windows\System32\Config\ , while each Windows user account has its own NTUSER. dat file containing its user-specific keys in its C:\Windows\Users\Name directory. You can’t edit these files directly.

Where are user profiles stored by default?

On older versions of Windows, the default location of the default user’s profile was C:\WINNT\Profiles\Default . Then it moved to C:\Documents and Settings\Default User . Now it’s in C:\Users\Default . And the location may have been customized, so in principle it could be anywhere.

How to add registry values to user hive?

Let’s assume you are admin and want to add registry values to the HKEY_CURRENT_USER hive of another user. First you need to mount the user hive of that person. That hive is located in the NTUSER.DAT file inside the user profile of that person.

How to read and write HKEY LOCAL user hive?

Reading and writing values to the HKEY_LOCAL_USER hive in the registry is easy, because this hive is the same for all users. How would you read or write values the HKEY_CURRENT_USER hive for a user that is not you? Let’s assume you are admin and want to add registry values to the HKEY_CURRENT_USER hive of another user.

Where do I find the user hive in PowerShell?

First you need to mount the user hive of that person. That hive is located in the NTUSER.DAT file inside the user profile of that person. As an administrator, this is what you need to run from PowerShell to mount the user hive for a user named UserTobias:

How to load Windows Registry hives in Windows 10?

For more information on loading Windows Registry hives; http://technet.microsoft.com/en-us/library/cc732157.aspx. Browse to the NTUSER.DAT file based on which Windows version you are using and Open it. You will have to have, ‘show hidden and system files’ enabled in the folder options control panel.