Learn about HKEY_LOCAL_MACHINE (HKLM Registry Hive)

HKEY_LOCAL_MACHINE, often abbreviated as HKLM, is one of several registry hives that make up the Windows Registry. This special Registry hive contains most configuration information for the software you have installed, as well as for the Windows operating system itself.

In addition to software configuration data, HKEY_LOCAL_MACHINE hive also contains valuable information about detected device and hardware drivers.

In Windows 10, Windows 8, Windows 7 and Windows Vista, your computer's boot configuration information is also included in this hive.

How to access HKEY_LOCAL_MACHINE

As a registry hive, HKEY_LOCAL_MACHINE is easy to find and open with the Registry Editor tool available in all Windows versions:

1. Open Registry Editor.

2. Locate HKEY_LOCAL_MACHINE on the left side of Registry Editor.

3. Click from HKEY_LOCAL_MACHINE or the small arrow to the left to expand it.

If you or someone else used Registry Editor previously on your computer, you may need to collapse any open registry keys until you find HKEY_LOCAL_MACHINE hive.

Registry subkey in HKEY_LOCAL_MACHINE

The following registry keys are located in HKEY_LOCAL_MACHINE hive:

1. HKEY_LOCAL_MACHINEBCD00000000
2. HKEY_LOCAL_MACHINECOMPONENTS
3. HKEY_LOCAL_MACHINEDRIVERS
4. HKEY_LOCAL_MACHINEHARDWARE
5. HKEY_LOCAL_MACHINESAM
6. HKEY_LOCAL_MACHINESchema
7. HKEY_LOCAL_MACHINESECURITY
8. HKEY_LOCAL_MACHINESOFTWARE
9. HKEY_LOCAL_MACHINESYSTEM

Note : The keys located in HKEY_LOCAL_MACHINE on the computer may vary slightly depending on the version of Windows and your specific computer configuration. For example, newer Windows versions do not include HKEY_LOCAL_MACHINECOMPONENT key .

Subkey HARDWARE contains data related to BIOS, processor and other hardware devices. For example, in HARDWARE is DESCRIPTION> System> BIOS , where you will find the current version and BIOS vendor.

Subkey SOFTWARE is one of the most commonly accessed subkeys from HKLM hive. It is organized alphabetically by the software vendor and is where each program writes data to the registry so that the next time the application is opened, its specific settings can be applied automatically, helping Users do not have to reconfigure the program every time they use it. It is also useful to find the user's SID.

Subkey SOFTWARE also contains a Windows subkey describing the different UI details of the operating system, a subkey Classes detailing which programs are associated with the file extension, etc.

HKLMSOFTWAREWow6432Node is found on 64-bit versions of Windows but is also used by 32-bit applications. It is equivalent to HKLMSOFTWARE but not quite the same, because it is separated for the sole purpose of providing information to 32-bit applications on 64-bit operating systems. WoW64 displays this key for 32-bit applications as "HKLMSOFTWARE".

The subkey hides in HKLM

In most configurations, the following subkeys are hidden keys and therefore cannot be browsed like other keys in the hive HKLM registry:

1. HKEY_LOCAL_MACHINESAM
2. HKEY_LOCAL_MACHINESECURITY

In most cases, these keys appear blank when you open them and / or contain empty subkeys.

Subkey SAM refers to database information Security Accounts Manager (SAM) for domains. In each database are group aliases, users, guest accounts and admin accounts, plus the name used to log in to the domain, cryptographic hash (cryptographic hash function) of each user password, etc .

Subkey SECURITY is used to store the security policy of the current user. It is linked to the security database of the domain where the user is logged in or to the registry hive on the local computer if the user is logged into the local system domain.

To see the contents of the SAM key or SECURITY, Registry Editor must be opened with System Account instead, having greater rights than any other user, even users with admin rights.

Once the Registry Editor has been opened with the appropriate permissions, the HKEY_LOCAL_MACHINESAM and HKEY_LOCAL_MACHINESECURITY keys can be discovered as any other key in the hive.

Some free software utilities, such as Microsoft's PsExec, can open Registry Editor with the appropriate permissions to view these hidden keys.

More information about HKEY_LOCAL_MACHINE

It is interesting to know that HKEY_LOCAL_MACHINE does not actually exist anywhere on the computer, but instead is just a container to display the actual registry data, loaded through the sub-hives in the hive, listed. above.

In other words, HKEY_LOCAL_MACHINE acts as a shortcut to some other data source on your computer.

Since this non-existent property of HKEY_LOCAL_MACHINE, both you and any program you install, cannot create additional keys in HKEY_LOCAL_MACHINE.

HKEY_LOCAL_MACHINE hive is always the same regardless of whether the user on the computer sees it, unlike the hive registry HKEY_CURRENT_USER is reserved for each user viewing when logging on.

Although HKEY_LOCAL_MACHINE is often written as HKLM, this is not really an "official" acronym. This is important because some programs, in many cases, even tools are available directly from Microsoft, do not allow you to initialize the hive name in the registry path. If you get an error while using "HKLM", use the full alternative path and see if it fixes the problem.