Physical Locations for Registry Hives in the Windows File System

This article lists the physical file locations of common Windows Registry Hives as they are mapped to the Windows File system.

The article applies to Windows Vista and above, including Windows 7, Windows 8.0, Windows 8.1, Windows 10 and Windows 11.

Registry Path Account File Location
n/a Template used to create all new user accounts C:\Users\Default\NTUSER.DAT
HKEY_USERS\.DEFAULT LocalSystem C:\Windows\System32\Config\DEFAULT

Note: .DEFAULT is an alias / symbolic link to the user account hive SID S-1-5-18

HKEY_USERS\S-1-5-18 LocalSystem C:\Windows\System32\Config\DEFAULT
HKEY_USERS\S-1-5-19 LocalService C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT

Note: Created from scratch based upon the system default user profile as part of Windows setup

HKEY_USERS\S-1-5-20 NetworkService C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT

Note: Created from scratch based upon the system default user profile as part of Windows setup

HKEY_LOCAL_MACHINE\DRIVERS C:\Windows\System32\config\DRIVERS
HKEY_LOCAL_MACHINE\SAM C:\Windows\System32\config\SAM
HKEY_LOCAL_MACHINE\SECURITY C:\Windows\System32\config\SECURITY
HKEY_LOCAL_MACHINE\SOFTWARE C:\Windows\System32\config\SOFTWARE
HKEY_LOCAL_MACHINE\SYSTEM C:\Windows\System32\config\SYSTEM