HKEY_USERS\.DEFAULT v.s. Documents and Settings\Default User\NtUser.dat

[Brian Simmons]

What is the point of the HKEY_USERS\.DEFAULT hive? If I create a new
user all registry entries for it seem to come from "Documents and
Settings\Default User\NtUser.dat". If I make a change to the
HKEY_USERS\.DEFAULT key it does not seem to be reflected anywhere in
old or new users. What processes will use this data?

Brian Simmons

[Kent W. England [MVP]]

The default hive is used once, when the account profile is created at
first logon. If you make changes to the default hive, they will show up
only in accounts created and logged on after the changes are made.

The Welcome Screen uses the default hive. If you change, for example,
the cursor, then the welcome screen cursor will change, as will the
cursor in all accounts created thereafter.

--
Kent W. England, Microsoft MVP for Windows



"Brian Simmons" > wrote in message
om...
> What is the point of the HKEY_USERS\.DEFAULT hive? If I create a new
> user all registry entries for it seem to come from "Documents and
> Settings\Default User\NtUser.dat". If I make a change to the
> HKEY_USERS\.DEFAULT key it does not seem to be reflected anywhere in
> old or new users. What processes will use this data?
>
> Brian Simmons

[Roger Abell [MVP]]

As Kent implied, HKEY_USERS\.DEFAULT is used by=20
the system for the winstation that is visible when there=20
is no account logged in.

--=20
Roger Abell
MS MVP (Security, Windows), MCDBA, MCSE both
Associate Expert - Windows XP ExpertZone
http://www.microsoft.com/windowsxp/expertzone

"Brian Simmons" > wrote in message =
om...
> What is the point of the HKEY_USERS\.DEFAULT hive? If I create a new
> user all registry entries for it seem to come from "Documents and
> Settings\Default User\NtUser.dat". If I make a change to the
> HKEY_USERS\.DEFAULT key it does not seem to be reflected anywhere in
> old or new users. What processes will use this data?
>=20
> Brian Simmons

[Brian Simmons]

I actually just tried this. I place new values in
HKEY_USERS\.DEFAULT\Software and HKEY_USERS\.DEFAULT\Control
Panel\Cursors\Schemes, and then created a new user. I logged on to
that user and checked regedit and those values were not there. The
HKEY_CURRENT_USER matched what was in the Default User\NtUser.dat
file.

So, perhaps the HKEY_USERS\.Default is only used for sessions where
there is no user profile, like the logon screen?

"Kent W. England [MVP]" > wrote in message >...
> The default hive is used once, when the account profile is created at
> first logon. If you make changes to the default hive, they will show up
> only in accounts created and logged on after the changes are made.
>
> The Welcome Screen uses the default hive. If you change, for example,
> the cursor, then the welcome screen cursor will change, as will the
> cursor in all accounts created thereafter.
>
> --
> Kent W. England, Microsoft MVP for Windows
>
>
>
> "Brian Simmons" > wrote in message
> om...
> > What is the point of the HKEY_USERS\.DEFAULT hive? If I create a new
> > user all registry entries for it seem to come from "Documents and
> > Settings\Default User\NtUser.dat". If I make a change to the
> > HKEY_USERS\.DEFAULT key it does not seem to be reflected anywhere in
> > old or new users. What processes will use this data?
> >
> > Brian Simmons

[Kent W. England [MVP]]

You're right, I am confused by the different uses of "default". Default
is mine. :-)

C:\Documents and Settings\Default User\ntuser.dat is the registry hive
used to initialize accounts. Since that is not an account but only a
profile you have to use a trick to write to it. Either load that hive in
regedit and tweak it there, or tweak a profile and copy over the Default
User. Microsoft does not recommend copying over the Default User
profile, as the copying could disable some initializing entries in
there. Best to mount the Default User profile and edit it, or script
this using reg.exe.

..Default is the profile that is used when no one is logged on. This is
already available in regedit for direct editing.

Sorry for the confusion. Instructions on editing the Default User
profile follow:

Run regedit.exe. Go to HKEY_USERS and then File, Load Hive. Select the
Default User hive and name it "DefaultUser". Now this hive is visible in
regedit and can be edited directly. You can also load the hive using the
reg.exe command line and then use reg.exe to import a bunch of keys in a
..reg file for "HKEY_USERS\DefaultUser" if you want to script the
addition of keys to the Default User profile.

--
Kent W. England, Microsoft MVP for Windows



"Brian Simmons" > wrote in message
om...
> I actually just tried this. I place new values in
> HKEY_USERS\.DEFAULT\Software and HKEY_USERS\.DEFAULT\Control
> Panel\Cursors\Schemes, and then created a new user. I logged on to
> that user and checked regedit and those values were not there. The
> HKEY_CURRENT_USER matched what was in the Default User\NtUser.dat
> file.
>
> So, perhaps the HKEY_USERS\.Default is only used for sessions where
> there is no user profile, like the logon screen?
>
> "Kent W. England [MVP]" > wrote in message
> >...
> > The default hive is used once, when the account profile is created
> > at
> > first logon. If you make changes to the default hive, they will show
> > up
> > only in accounts created and logged on after the changes are made.
> >
> > The Welcome Screen uses the default hive. If you change, for
> > example,
> > the cursor, then the welcome screen cursor will change, as will the
> > cursor in all accounts created thereafter.
> >
> > --
> > Kent W. England, Microsoft MVP for Windows
> >
> >
> >
> > "Brian Simmons" > wrote in message
> > om...
> > > What is the point of the HKEY_USERS\.DEFAULT hive? If I create a
> > > new
> > > user all registry entries for it seem to come from "Documents and
> > > Settings\Default User\NtUser.dat". If I make a change to the
> > > HKEY_USERS\.DEFAULT key it does not seem to be reflected anywhere
> > > in
> > > old or new users. What processes will use this data?
> > >
> > > Brian Simmons