8
1
If I open the registry with the SYSTEM account in Windows by using the PSExec tool from SysInternals:
psexec -i -s regedit
and I change an entry, for example, here:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
... I presume that a corresponding NTUSER.DAT file will be modified.
What is the path to this NTUSER.DAT file?
Sopalajo de Arrierez
Posted 2014-07-28T00:45:18.307
Reputation: 5 328
3
Contrary to common intuition, the ntuser.dat file in LocalSystem's user profile folder (\Windows\System32\config\systemprofile) is not the source of HKEY_CURRENT_USER for applications running as SYSTEM. As far as I can tell, it's not actually used for anything, and it contains very little information.
In reality, the HKCU for applications running as SYSTEM is .DEFAULT under HKEY_USERS. (I'll address another common misconception: .DEFAULT isn't the template for new user profiles, ntuser.dat in \Users\Default is.) .DEFAULT is stored on disk in a file called \Windows\System32\config\DEFAULT. See the MSDN article on Registry-backing files.
Also interesting: the list of the backing files for the various Registry hierarchies, including .DEFAULT, can be found in HKLM\SYSTEM\CurrentControlSet\Control\hivelist.
Ben N
Posted 2014-07-28T00:45:18.307
Reputation: 32 973
Is this expected to be valid for any version of Windows? – Sopalajo de Arrierez – 2015-09-17T20:35:21.443
@SopalajodeArrierez Essentially yes, from Windows NT and on, with appropriate substitution of \WinNT for \Windows and \Documents and Settings for \Users on Windows XP. Further reading at TechNet
I think it's c:\windows\system32\config\systemprofile. – LawrenceC – 2014-07-28T00:56:42.550
What version of Windows? – I say Reinstate Monica – 2014-07-28T01:56:50.537
Well, @ultrasawblade, in fact there is a
ntuser.datfile there. I am trying to browse it from linux's toolchntpwto check what it is, but the key\Software\Microsoft\only contains a tree namedCTF. There is nothing about the rest of theHKEY_CURRENT_USERtree. – Sopalajo de Arrierez – 2014-07-28T01:56:57.9101@Twisty, I am testing this matter with Windows XP SP3 and Windows 7. I think most Windows versions behave the same way. – Sopalajo de Arrierez – 2014-07-28T01:59:35.703
Not true. I believe Windows 7 stores the LocalSystem and NetworkService registry hives at 'C:\Windows\ServiceProfiles\LocalService\ntuser.dat' and C:\Windows\ServiceProfiles\NetworkService\ntuser.dat' respectively. These folders don't exist on XP. – I say Reinstate Monica – 2014-07-28T02:17:39.623
Well, @Twisty, I have just made the change above (the
CurrentVerion\Runkey), and according to its modification date, none of these last twontuser.datfiles seem to be what we seek. – Sopalajo de Arrierez – 2014-07-28T02:34:38.843@Twisty: as it happent with the @ultrasawblade above suggestion, I have edited those
ntuser.datfiles, and they have only theCTFtree inside. – Sopalajo de Arrierez – 2014-07-28T02:50:30.453@SopalajodeArrierez - The path would be
C:\Users\<username>, becauseRunkey inHKEY_CURRENT_USERimplies that must be associated in that specific user profile. – Ĭsααc tիε βöss – 2014-07-28T11:10:08.497@Ĭsααctիεβöss, the
HKEY_CURRENT_USERregistry tree, when opened viapsexec -sis a diferent one than if I open it via simpleregedit, so I must suppose<username>here should be something likeSYSTEM, and there is noc:\Users\SYSTEMfolder in Windows computers. – Sopalajo de Arrierez – 2014-07-28T14:16:51.597