Why is (Almost) Everybody Wrong About HKU\.Default?

Most technical folks have stumbled across the registry hive HKEY_USERS\.Default at some point. Many of them think they know what it is used for. Interestingly, most who do are wrong.

The misconception about what HKU\.Default is used for dates back to the good old days when Windows NT 4.0 was still considered “new technology”. This misconception has been, and still is, passed on to future generations by means of books, magazine articles, blog entries and geek talk. It is, in my humble opinion, so widespread, that I would bet that 50% of those who think they know the correct meaning are, in fact, wrong.

What Most Think

Supposedly, HKU\.Default is the registry hive of the default user profile. The default user profile (typically located in C:\Users\Default) sits in the user profile base folder and is used as a template for new user profiles. Whenever a user logs on who has an empty or non-existent profile the system basically copies the default user profile to a new folder and makes that the user’s new profile. Since every registry setting stored in the default user profile gets copied into every new user profile, many administrators think it is a good idea to modify the default user’s registry. I don’t. But that is a topic for another article.

Of the many admins that modify the default user profile’s registry, some are proud enough of this “feat” to publish what they do and how they do it. This is how the myth gets carried on. Type “HKU\.Default” in the search engine of your choice. Way too many of the results point to registry scripts that try to do exactly what I have described.

The Truth

The settings stored in the registry hive HKU\.Default are used by the logon desktop. That desktop is, of course, shown to give users the ability to log on to their system. Want to have the Num Lock key turned on when users enter their credentials? Go to HKEY_USERS\.DEFAULT\Control Panel\Keyboard and change the value InitialKeyboardIndicators from 0 to 1. Don’t believe me? Try it out!

The hive HKU\.Default is stored in %SystemRoot%\system32\config\default (no extension). This is a very different location from the default user profile’s registry file which is stored in the file NTUSER.DAT inside the profile directory (typically in C:\Users\Default).