3 ms·
Wow thanks for this. I never knew the current user registry hive was stored at NTUSER.dat. I've always figured out the user id and navigated through hkey_users.
by joombaga 8y ago
Wow thanks for this. I never knew the current user registry hive was stored at NTUSER.dat. I've always figured out the user id and navigated through hkey_users.
- Someone1234 8y agoYou can actually offline mount NTUSER via "Load Hive" in RegEdit. Very useful if you're working with a backup or older system image and need something out of the user's registry (rather than the system registry stored in C:\Windows\System32\config).