Search notes:
Registry: HKEY_USERS
The
keys
under the
registry hive
HKEY_USERS
correspond to the
user account SIDs
of
user accounts
(starting with
S-1-5-21-…
) or a
service
[serivce) (starting with
S-1-5-80-…
)
The currently logged in user's hive
HKEY_CURRENT_USER
is a symbolic link to the respective key under
HKEY_USERS
.
Additionally, there is also a
.DEFAULT
subkey.
Index