A Closer Look at HKEY_USERS

HKEY_USERS pulls user information into the Registry editor for the default user and the currently logged-on user. For Windows 95, it only uses the logged-on user if there are user profiles activated. In the case of Windows NT, it always uses both.

Windows 95 gets its information from USER.DAT (in the Windows directory), and Windows NT gets its information from NTUSER.DAT from the WINNT\PROFILES\username\NTUSER.DAT directory.

The .DAT file holds all user-based Registry settings and allows you to configure the user's environment. If you make changes to the default user settings, all new users inherit the same settings. However, the users who have already been created are not affected. To make changes for all users, use System Policy Editor as discussed in previous chapters.

The logged-on user is listed by SID (Security Identifier) in Windows NT rather than by name, and any changes made update that user's NTUSER.DAT. Figure G.1 shows the HKEY_USERS options. In Windows 95, the user is shown as the default user, if no profiles are used, and by name if they are.

Figure G.1. HKEY_USERS allows direct editing of the default user's and the logged-on user's environment.

The logged-on user has two additional keys, for network connections and for printers. These settings are not automatically set up for every user, and they are therefore not in the default user section.

All of the settings in this chapter appear in the following format.

Key Name

Full path=Handle Key\Keyname

Description, specific information, values

Second-Level Key Name

Full path=Handle Key\Keyname\Keyname

Description, specific information, values

Third-Level Key Name

Full path=Handle Key\Keyname\Keyname\Keyname

Description, specific information, values

Additional Level Key Names

Full path=Handle Key\Keyname\Keyname\Keyname\Keyname(\Keyname)

Description, specific information, values

.DEFAULT

HKEY_USERS\.DEFAULT

The settings in this key apply to all new users; their user profiles are created from this profile. It includes all environment, screen, sound, and other user-related functions.

AppEvents

HKEY_USERS\.DEFAULT\AppEvents

This key lists the event labels, descriptions, and sounds for system functions.

EventLabels

HKEY_USERS\.DEFAULT\AppEvents\EventLabels

This key lists strings and corresponding full descriptions for the following Windows functions. In the operating system, the string is used, and then translated with the data in the Registry to make it more readable. The following list shows the event labels:

AppGPFault

Close

EmptyRecycleBin

Maximize

MenuCommand

MenuPopup

Minimize

Open

RestoreDown

RestoreUp

SystemAsterisk

SystemDefault

SystemExclamation

SystemExit

SystemHand

SystemQuestion

SystemStart

Schemes

HKEY_USERS\.DEFAULT\AppEvents\Schemes

The default and current sound schemes are listed in this key and its subkeys. The system plays whatever sound is listed at the time of the event.

Apps

HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps

This key lists the sounds and descriptions of default Windows functions, plus the settings for Explorer, Media Player, and Sound Recorder.

HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\.Default

The default and current sound settings are listed for each of the following Windows events. These settings, as shown in the following list, can be changed here, but are normally changed in Control Panel:

AppGPFault

Close

EmptyRecycleBin

Maximize

MenuCommand

MenuPopup

Minimize

Open

RestoreDown

RestoreUp

SystemAsterisk

SystemDefault

SystemExclamation

SystemExit

SystemHand

SystemQuestion

SystemStart

HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\Explorer

The sound settings for Explorer are set in this key. The only item listed for the default user is the setting for EmptyRecycleBin.

HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\MPlay32

This key contains the default and current sound settings for the opening and closing of Media Player.

HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\SndRec32

This key contains the current sound settings for the opening and closing of Sound Recorder.

Names

HKEY_USERS\.DEFAULT\AppEvents\Schemes\Names

This key holds the descriptions for two strings: .Default and .None. When the operating system sees these two strings in relation to sounds, it replaces them onscreen with Windows NT Default and No Sounds, respectively.

Console

HKEY_USERS\.DEFAULT\Console

This key holds the options, layout, screen color, and font settings for MS-DOS windows.

Control Panel

HKEY_USERS\.DEFAULT\Control Panel

All the settings configured in the Control Panel are held in this key and its subkeys.

Accessibility

HKEY_USERS\.DEFAULT\Control Panel\Accessibility

This key holds all the settings for the Accessibility applet in the Control Panel. These subkeys are shown in the following list, but are normally set in the Control Panel, not in a Registry editor: Keyboard Response

MouseKeys

ShowSounds

SoundSentry

StickyKeys

TimeOut

ToggleKeys

Appearance

HKEY_USERS\.DEFAULT\Control Panel\Appearance

This key holds all the settings for the Appearance tab in the Display applet in the Control Panel. These are normally set in the Control Panel, not in a Registry editor.

Schemes

HKEY_USERS\.DEFAULT\Control Panel\Appearance\Schemes

This key lists the schemes available by default, and what each scheme includes as colors and fonts.

Colors

HKEY_USERS\.DEFAULT\Control Panel\Colors

This key holds the settings for each default color in Windows. Each value (the color name) is listed as an RGB (red, green, blue) value. For example, black is 0 0 0, which means the red value is set to 0, the green value is set to 0, and the blue value is set to 0. White is on the opposite end of the spectrum at 255 255 255. Every other color is a combination of those RGB values.

Current

HKEY_USERS\.DEFAULT\Control Panel\Current

This key holds the setting for the current color scheme for the default user.

Cursors

HKEY_USERS\.DEFAULT\Control Panel\Cursors

This key holds the cursor schemes available to the system by default.

Schemes

HKEY_USERS\.DEFAULT\Control Panel\Cursors\Schemes

This key holds the file locations and names that make up the cursor schemes. The schemes listed in the key are shown in the following list:

3D-Bronze

3D-White

Conductor

Dinosaur

Hands 1

Hands 2

Magnified

Old Fashioned

Variations

Windows Animated

Windows Default

Custom Colors

HKEY_USERS\.DEFAULT\Control Panel\Custom Colors

This key holds the settings for up to 16 possible custom colors that can be created in Control Panel. The colors are created by selecting Display | Appearance with Other Colors.

Desktop

HKEY_USERS\.DEFAULT\Control Panel\Desktop

This key holds all the settings for the desktop, its appearance, and how the windows and menus react to user input.

WindowMetrics

HKEY_USERS\.DEFAULT\Control Panel\Desktop\WindowMetrics

Specifics about the windows that appear onscreen are held in this key.

International

HKEY_USERS\.DEFAULT\Control Panel\International

The Control Panel options for International settings are held in this key. These are normally set in Control Panel, not in a Registry editor.

Keyboard

HKEY_USERS\.DEFAULT\Control Panel\Keyboard

This key controls the keyboard options for lock activation, repeat delay, and repeat speed.

MMCPL

HKEY_USERS\.DEFAULT\Control Panel\MMCPL

This is a nonfunctional key relating to the Multimedia Control Panel applet.

Mouse

HKEY_USERS\.DEFAULT\Control Panel\Mouse

This key holds the mouse settings in the corresponding Control Panel applet.

Patterns

HKEY_USERS\.DEFAULT\Control Panel\Patterns

This key holds the default and custom pattern settings from Control Panel | Display |
Background--Pattern.

Screen Saver.3DFlyingObj

HKEY_USERS\.DEFAULT\Control Panel\Screen 

Saver.3DFlyingObj

This key holds the settings for the 3D Flying Objects screen saver as set in Control Panel | Screen Saver | Settings.

Screen Saver.3Dpipes

HKEY_USERS\.DEFAULT\Control Panel\Screen Saver.3Dpipes

This key holds the settings for the 3D Pipes screen saver as set in Control Panel | Screen Saver | Settings.

Screen Saver.Bezier

HKEY_USERS\.DEFAULT\Control Panel\Screen Saver.Bezier

This key holds the settings for the Bezier screen saver as set in Control Panel | Screen Saver | Settings.

Screen Saver.Marquee

HKEY_USERS\.DEFAULT\Control Panel\Screen Saver.Marquee

This key holds the settings for the Marquee screen saver as set in Control Panel | Screen Saver | Settings.

Screen Saver.Mystify

HKEY_USERS\.DEFAULT\Control Panel\Screen Saver.Mystify

This key holds the settings for the Mystify screen saver as set in Control Panel | Screen Saver | Settings.

Screen Saver.Stars

HKEY_USERS\.DEFAULT\Control 

Panel\Screen Saver.Stars

This key holds the settings for the Stars screen saver as set in Control Panel | Screen Saver | Settings.

Sound

HKEY_USERS\.DEFAULT\Control Panel\Sound

This key determines whether the system beeps at errors.

Environment

HKEY_USERS\.DEFAULT\Environment

This key holds the environment settings, specifically the temporary file locations.

Keyboard Layout

HKEY_USERS\.DEFAULT\Keyboard Layout

The keyboard layout settings are set for the standard U.S. English QWERTY layout. If you choose to use an alternative layout, such as Dvorak or International, the number listed is different.

WARNING: Do not change the Keyboard Layout setting in the Registry editor.

Software

HKEY_USERS\.DEFAULT\Software

Software settings for installed applications are held in this setting. The default user has only the settings for Microsoft applications.

Microsoft

HKEY_USERS\.DEFAULT\Software\Microsoft

The settings for the Microsoft Windows applications are set in this key. If other Microsoft applications are installed, they update the user's Microsoft key. Items controlled by default are shown in the following list:

Clock

Command Processor

File Manager

Internet Explorer

NetDDE

Ntbackup

RegEdt32

Schedule+

Windows

Windows Help

Windows NT

Windows

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows

This key holds settings that are independent of Windows NT, but are related to Windows. These settings are the same as in Windows 95, using the same drivers and functions.

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion

This key holds settings for the following items:

Explorer

GrpConv

Internet Settings

Multimedia

Policies

Telephony

Windows NT

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT

The Windows NT settings in this key are based on NT functions. Windows NT could not function without these settings, which establish the environment and the procedures for networking, user access, printers, fonts, and much more.

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion

This key holds specific information for the control of the Windows NT 4.0 functions. The following subkeys hold the settings for NT and its properties:

Devices

Extensions

Network

PrinterPorts

Program Manager

TrueType

Windows

Winlogon

Network

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network

This key determines whether settings made on the network are saved for the following items:

Event Viewer

Persistent Connections

Server Manager

User Manager

User Manager for Domains

Program Manager

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Program Manager

This key holds the settings for several items for the 32-bit Program Manager included with Windows NT. The subkeys under Program Manager are listed next:

Common Groups

Restrictions

Settings

Unicode Groups

Winlogon

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

This setting controls the logon functions for Windows NT.

Unicode Program Groups

HKEY_USERS\.DEFAULT\UNICODE Program Groups

The default Unicode program groups are only available when using Program Manager. Explorer does not use them.

S-1-5-21-1658001358-1336221227-1912232085-500 (SID)

HKEY_USERS\S-1-5-21-1658001358-1336221227-1912232085-500

This is the SID for the currently logged-on user. Every user on the network is assigned a SID by User Manager for Domains, and each SID is unique, so depending on who is logged on, this information changes. It is pulled from the NTUSER.DAT file in the user's profile. Generally, the subkeys are more extensive, based on the software installed, the choices made, and the resulting settings.

NOTE: Rather than list a SID for user, the rest of this section will use the placeholder SID.

The main areas of change are in the addition of the Network and Printers keys, and in the Software key and its subkeys. All other settings perform the same functions, though the settings may differ greatly from the default user's settings. Figure G.2 shows the similarity between the default user's options and those for the logged-on user.

Figure G.2. The logged-on user has two additional keys.

Network

HKEY_USERS\SID\Network

This key shows the mapped connections to other systems. For example, if you map drive H: to \\SERVER1\DOCS, it would be shown in a subkey.

Printers

HKEY_USERS\SID\Printers

This key shows all the installed, shared, and connected printers for this user.

TIP: If you save the keys from a logged-on user, you can add them to the default user's Registry using Registry | Save Key. To add the Network key so all new users have the same network connections at startup, perform the following steps.

1. Use Edit | Add Key to add a key to the default user called Network.

2. Highlight the Network key for the default user, and select Registry | Restore.

3. In the Network key, go to each connection and change UserName to %username%.

4. Save the Network key at the logged-on user with Registry | Save Key.

As shown in Figure G.3, the default user and all new users created from the default will have the same connections automatically. The same tip works with Printer | Connections, but not necessarily with the other portions of the key.

Figure G.3. The logged-on user's SID and settings in the Registry.

Software

HKEY_USERS\SID\Software

This key is expanded for the individual user, based on the additional software installed by or for that user.

Summary

HKEY_USERS holds all the settings for the currently logged-on user and the default user. The information for the logged-on user changes as different users use the system. The user information is represented by the SID. Using the procedure to retrieve any user's NTUSER.DAT file and bring it into the Registry for viewing and editing (as shown in Chapter 9, "Making Manual Changes to the Registry Using REGEDT32.EXE") simplifies the editing of a specific user's data.