Overview of Registry Rootkeys

 

This table gives an overview of all common registry rootkeys. Some rootkeys are not absolute rootkeys but are symbolic links to subkeys of one of the two main rootkeys HKEY_LOCAL_MACHINE and HKEY_USERS. This explains why only these two registry rootkeys get searched when using the search functionality in Registrar to perform a global search on the entire registry.

Rootkey Abbreviation Type of rootkey Points to
HKEY_LOCAL_MACHINE HKLM absolute -
HKEY_USERS HKU absolute -
HKEY_CLASSES_ROOT HKLM symbolic link HKEY_LOCAL_MACHINE\Software\Classes
HKEY_CURRENT_USER HKCU symbolic link a subkey of HKEY_USERS containing user profile
HKEY_CURRENT_CONFIG HKCC symbolic link HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\ Control\IDConfigDB\Hardware
HKEY_DYN_DATA HKDD virtual rootkey Virtual registry rootkey