HKEY_USERS (HKU Registry Hive)

Details on the HKEY_USERS Registry Hive

Screenshot of the HKEY_USERS hive in the Windows Registry in Windows 10
HKEY_USERS Registry Hive (Windows 10).

HKEY_USERS, sometimes seen as HKU, is one of many registry hives in the Windows Registry.

HKEY_USERS contains user-specific configuration information for all currently active users on the computer.

Note: By currently active users, I mean the user logged in at the moment (you) and any other users who have also logged in but have since "switched users."

Each registry key located under the HKEY_USERS hive corresponds to a user on the system and is named with that user's security identifier, or SID.

The registry keys and registry values located under each SID control settings specific to that user, like mapped drives, installed printers, environment variables, desktop background, and much more, and is loaded when the user first logs on.

How to Get to HKEY_USERS

HKEY_USERS, being a registry hive, is easy to find and open via Registry Editor:

  1. Open Registry Editor.
  2. Locate HKEY_USERS from the left pane of Registry Editor.
  3. Click or tap on the word HKEY_USERS or expand the hive using the small arrow or plus icon to the left.

Important: It's always a good idea to make a back up of any registry keys that you plan on editing. See How to Back up the Windows Registry if you need help backing up the whole registry or specific parts of the registry to a REG file.

Don't See HKEY_USERS?

If Registry Editor has been used on this computer before, you may need to collapse (minimize) any open registry keys until you see the HKEY_USERS hive.

The easiest way to reach the HKEY_USERS hive when other keys are open is to scroll to the very top of the left side of Registry Editor, and click or tap the arrow or plus sign to the left of any other open registry hives.

For example, you might need to collapse HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE in order to see the HKEY_USERS hive.

Registry Subkeys in HKEY_USERS

Here is an example of what you might find under the HKEY_USERS hive:

  • HKEY_USERS\.DEFAULT
  • HKEY_USERS\S-1-5-18
  • HKEY_USERS\S-1-5-19
  • HKEY_USERS\S-1-5-20
  • HKEY_USERS\S-1-5-21-0123456789-012345678-0123456789-1004
  • HKEY_USERS\S-1-5-21-0123456789-012345678-0123456789-1004_Classes
  • ...

The SIDs you see listed under HKEY_USERS will certainly differ than the list I included above.

While you'll likely have .DEFAULT, S-1-5-18, S-1-5-19, and S-1-5-20, which correspond to built-in system accounts, your S-1-5-21-xxx keys will be unique to your computer since they correspond to "real" user accounts in Windows.

More on HKEY_USERS & SIDs

The HKEY_CURRENT_USER hive acts as a kind of shortcut to the HKEY_USERS subkey corresponding to your SID.

In other words, when you make changes in HKEY_CURRENT_USER, you're making changes to the keys and values under the key within HKEY_USERS that's named the same as your SID.

For example, if your SID is S-1-5-21-0123456789-012345678-0123456789-1004, HKEY_CURRENT_USER will point to HKEY_USERS\S-1-5-21-0123456789-012345678-0123456789-1004. Edits can be made in either location since they are one in the same.

See How to Find a User's Security Identifier (SID) in Windows for instructions on finding the SID associated with your account.

If you want to change registry data for a user whose SID is not appearing under HKEY_USERS, you can either log in as that user and make the change, or you can load the registry hive of that user manually. See How to Load a Registry Hive if you need help.

Tip: Remember that since the two are the same, if you're editing your own settings (the settings for the user you're currently logged in as), it's much easier to simply open HKEY_CURRENT_USER than to identify your own SID and then make the changes within HKEY_USERS. Using HKEY_USERS to access the SID folder for a user is usually only useful if you need to edit registry values for a user who isn't currently logged in.

The HKEY_USERS\.DEFAULT subkey is the exact same as the HKEY_USERS\S-1-5-18 subkey. Any changes made to one are automatically and instantly reflected in the other, in the exact same way that the currently logged on user's SID subkey in HKEY_USERS is identical to the values found in HKEY_CURRENT_USER.

It's also important to know that HKEY_USERS\.DEFAULT is used by the LocalSystem account, not a regular user account. It's common to mistake this key for one that can be edited so that its changes are applied to all the users, considering that it's called "default," but this isn't the case.

Two of the other HKEY_USERS subkeys in Windows Registry that are used by system accounts include S-1-5-19 which is for the LocalService account, and S-1-5-20 which is used by the NetworkService account.

Was this page helpful?