HKEY_USERS (HKU Registry Hive)

Details on the HKEY_USERS Registry Hive

Screenshot of the HKEY_USERS hive in the Windows Registry in Windows 10
HKEY_USERS Registry Hive (Windows 10).

HKEY_USERS, sometimes seen as HKU, is one of many registry hives in the Windows Registry.

HKEY_USERS contains user-specific configuration information for all currently active users on the computer.

Note: By currently active users, I mean the user logged in at the moment (you) and any other users who have also logged in but have since "switched users."

Each registry key located under the HKEY_USERS hive corresponds to a user on the system and is named with that user's security identifier, or SID.

The registry keys and registry values located under each SID control settings specific to that user, like mapped drives, installed printers, environment variables, desktop background, and much more, and is loaded when the user first logs on.

How to Get to HKEY_USERS

HKEY_USERS, being a registry hive, is easy to find and open via Registry Editor:

  1. Open Registry Editor.
  2. Locate HKEY_USERS from the left pane of Registry Editor.
  3. Click or tap on the word HKEY_USERS or expand the hive using the small arrow to the left.

If Registry Editor has been used on this computer before, you may need to collapse any open registry keys until you see the HKEY_USERS hive.

Registry Subkeys in HKEY_USERS

Here is an example of what you might find under the HKEY_USERS hive:

  • HKEY_USERS\.DEFAULT
  • HKEY_USERS\S-1-5-18
  • HKEY_USERS\S-1-5-19
  • HKEY_USERS\S-1-5-20
  • HKEY_USERS\S-1-5-21-0123456789-012345678-0123456789-1004
  • HKEY_USERS\S-1-5-21-0123456789-012345678-0123456789-1004_Classes
  • ...

The SIDs you see listed under HKEY_USERS will certainly differ than the list I included above.

While you'll likely have .DEFAULT, S-1-5-18, S-1-5-19, and S-1-5-20, which correspond to built-in system accounts, your S-1-5-21-xxx keys will be unique to your computer since they correspond to "real" user accounts in Windows.

More on HKEY_USERS & SIDs

The HKEY_CURRENT_USER hive acts as a kind of shortcut to the HKEY_USERS subkey corresponding to your SID.

In other words, when you make changes in HKEY_CURRENT_USER, you're making changes to the keys and values under the key within HKEY_USERS that's named the same as your SID.

For example, if your SID is S-1-5-21-0123456789-012345678-0123456789-1004, HKEY_CURRENT_USER will point to HKEY_USERS\S-1-5-21-0123456789-012345678-0123456789-1004. Edits can be made in either location since they are one in the same.

See How To Find a User's Security Identifier (SID) in Windows for instructions on finding the SID associated with your account.

If you want to change registry data for a user whose SID is not appearing under HKEY_USERS, you can either log in as that user and make the change, or you can load the registry hive of that user manually. See How To Load a Registry Hive if you need help.

The HKEY_USERS\.DEFAULT subkey is used by the LocalSystem account, not a regular user account. It's common to mistake this key for one that can be edited so that its changes are applied to all the users, considering that it's called "default," but this isn't the case.