10. Permanent Registry Files

• The hives stored in

      C:WINDOWS\system32\config
  

  correspond to the following file names (no extensions used):

  • DEFAULT -- System settings, HKU\.DEFAULT

  • SAM -- Security Account Manager database, contains user account and security settings, HKLM\SAM

  • SECURITY -- System security settings, HKLM\SECURITY

  • SOFTWARE -- All installed programs and associated settings, HKLM\SOFTWARE

  • SYSTEM -- System settings, HKLM\SYSTEM

  • userdiff -- Present only to upgrade existing users from a previous version of WinNT...

    • (userdiff is not really part of any hive.)