It contains user-specific configuration information for all currently active users on the computer. This means the user logged in at the moment (you) and any other users who have also logged in but have since “switched users.” Each registry key located under the HKEY_USERS hive corresponds to a user on the system and is named with that user’s security identifier, or SID. The registry keys and registry values located under each SID control settings specific to that user, like mapped drives, installed printers, environment variables, desktop background, and much more, and is loaded when the user first logs on.
How to Get to HKEY_USERS
Being a registry hive, it’s easy to find and open via Registry Editor:
Don’t See HKEY_USERS?
If Registry Editor has been used on this computer before, you may need to collapse (minimize) any open registry keys until you see the hive. The easiest way to reach HKEY_USERS when other keys are open is to scroll to the very top of the left side of Registry Editor, and select the arrow or plus sign to the left of any other open registry hives. For example, you might need to collapse HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE in order to see the HKEY_USERS hive.
Registry Subkeys in HKEY_USERS
Here’s an example of what you might find under this hive:
HKEY_USERS.DEFAULTHKEY_USERS\S-1-5-18HKEY_USERS\S-1-5-19HKEY_USERS\S-1-5-20HKEY_USERS\S-1-5-21-0123456789-012345678-0123456789-1004HKEY_USERS\S-1-5-21-0123456789-012345678-0123456789-1004_Classes…
The SIDs you see listed here will certainly differ than the list we included above. While you’ll likely have .DEFAULT, S-1-5-18, S-1-5-19, and S-1-5-20, which correspond to built-in system accounts, your S-1-5-21-xxx keys will be unique to your computer since they correspond to “real” user accounts in Windows.
More on HKEY_USERS & SIDs
The HKEY_CURRENT_USER hive acts as a kind of shortcut to the HKEY_USERS subkey corresponding to your SID. In other words, when you make changes in HKEY_CURRENT_USER, you’re making changes to the keys and values under the key within HKEY_USERS that’s named the same as your SID. For example, if your SID is the following: …HKEY_CURRENT_USER will point to this: Edits can be made in either location since they are one in the same. If you want to change registry data for a user whose SID is not appearing under HKEY_USERS, you can either log in as that user and make the change, or you can load the registry hive of that user manually. See How to Load a Registry Hive if you need help. The HKEY_USERS.DEFAULT subkey is the exact same as the HKEY_USERS\S-1-5-18 subkey. Any changes made to one are automatically and instantly reflected in the other, in the exact same way that the currently logged on user’s SID subkey in HKEY_USERS is identical to the values found in HKEY_CURRENT_USER. It’s also important to know that HKEY_USERS.DEFAULT is used by the LocalSystem account, not a regular user account. It’s common to mistake this key for one that can be edited so that its changes are applied to all the users, considering that it’s called “default,” but this isn’t the case. Two of the other HKEY_USERS subkeys in Windows Registry that are used by system accounts include S-1-5-19 which is for the LocalService account and S-1-5-20 which is used by the NetworkService account.
