nerdexam
GIAC

GCFA · Question #140

Which of the following registry hives stores configuration information specific to a particular user who is currently logged on to the computer?

The correct answer is B. HKEY_CURRENT_USER. HKEY_CURRENT_USER is the Windows registry hive that stores configuration and preference data exclusively for the user who is currently logged on.

File System & Registry Forensics

Question

Which of the following registry hives stores configuration information specific to a particular user who is currently logged on to the computer?

Options

  • AHKEY_USERS
  • BHKEY_CURRENT_USER
  • CHKEY_LOCAL_MACHINE
  • DHKEY_CLASSES_ROOT

How the community answered

(27 responses)
  • A
    15% (4)
  • B
    74% (20)
  • C
    4% (1)
  • D
    7% (2)

Why each option

HKEY_CURRENT_USER is the Windows registry hive that stores configuration and preference data exclusively for the user who is currently logged on.

AHKEY_USERS

HKEY_USERS contains the profiles for all user accounts that have been loaded on the computer, not just the currently active user.

BHKEY_CURRENT_USERCorrect

HKEY_CURRENT_USER contains profile data for the currently active user session, including desktop settings, environment variables, and application preferences. It is dynamically linked to the corresponding subkey within HKEY_USERS for the logged-on user's Security Identifier (SID). This design ensures each user's settings are isolated and only loaded during their active session.

CHKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE stores system-wide hardware and operating system configuration that applies to all users, not settings specific to a single logged-on user.

DHKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT stores file type associations and COM object registration data, not user-specific configuration or preference information.

Concept tested: Windows registry hive HKEY_CURRENT_USER purpose

Source: https://learn.microsoft.com/en-us/windows/win32/sysinfo/hkey-current-user

Topics

#Windows registry#HKEY_CURRENT_USER#registry hives#user configuration

Community Discussion

No community discussion yet for this question.

Full GCFA Practice