This article lists the physical file locations of common Windows Registry Hives as they are mapped to the Windows File system.
The article applies to Windows Vista and above, including Windows 7, Windows 8.0, Windows 8.1, Windows 10 and Windows 11.
Registry Path | Account | File Location |
n/a | Template used to create all new user accounts | C:\Users\Default\NTUSER.DAT |
HKEY_USERS\.DEFAULT | LocalSystem | C:\Windows\System32\Config\DEFAULT
Note: .DEFAULT is an alias / symbolic link to the user account hive SID S-1-5-18 |
HKEY_USERS\S-1-5-18 | LocalSystem | C:\Windows\System32\Config\DEFAULT |
HKEY_USERS\S-1-5-19 | LocalService | C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
Note: Created from scratch based upon the system default user profile as part of Windows setup |
HKEY_USERS\S-1-5-20 | NetworkService | C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
Note: Created from scratch based upon the system default user profile as part of Windows setup |
HKEY_LOCAL_MACHINE\DRIVERS | – | C:\Windows\System32\config\DRIVERS |
HKEY_LOCAL_MACHINE\SAM | – | C:\Windows\System32\config\SAM |
HKEY_LOCAL_MACHINE\SECURITY | – | C:\Windows\System32\config\SECURITY |
HKEY_LOCAL_MACHINE\SOFTWARE | – | C:\Windows\System32\config\SOFTWARE |
HKEY_LOCAL_MACHINE\SYSTEM | – | C:\Windows\System32\config\SYSTEM |