HKEY_LOCAL_MACHINE contains the configuration data for the local computer. The information in this database is used by applications, device drivers, and the Windows NT system to determine configuration data for the local computer, regardless of which user is logged on and what software is in use.
HKEY_LOCAL_MACHINE contains five keys, as listed briefly in Table 23.5. The rest of this section describes these keys.
Note
You can read information in any of these keys, but you can add or change information only in the Software and System keys.
Table 23.5 Keys in HKEY_LOCAL_MACHINE
Key name | Contents | |
Hardware | The database that describes the physical hardware in the computer, the way device drivers use that hardware, and mappings and related data that link kernel-mode drivers with user-mode code. All data in this key is recreated each time the system is started. The Description subkey describes the actual computer hardware. The DeviceMap subkey contains miscellaneous data in formats specific to particular classes of drivers. The ResourceMap subkey describes which device drivers claim which hardware resources. The Windows NT Diagnostics program (Winmsdp.exe) can report on its contents in an easy-to-read form. | |
SAM | The directory services database of security information for user and group accounts, and for the domains in Windows NT Server. (SAM is the Security Account Manager, now known as the directory services database.) | |
Security | The database that contains the local security policy, such as specific user rights. This key is used only by the Windows NT security subsystem. | |
Software | The per-computer software database. This key contains data about software installed on the local computer, along with various items of miscellaneous configuration data. | |
System | The database that controls system startup, device driver loading, Windows NT services, and operating system behavior. | |
By convention, if similar data exists under HKEY_CURRENT_USER and under HKEY_LOCAL_MACHINE, the data in HKEY_CURRENT_USER takes precedence. However, values in this key can also extend (rather than replace) data in HKEY_LOCAL_MACHINE. Also, some items (such as device driver loading entries) are meaningless if they occur outside of HKEY_LOCAL_MACHINE.