Windows 2000 Registry Hives on System Partition

This article provides an overview of how Microsoft Windows 2000 organizes, stores, and manages Registry hives on the system partition. It details the physical directory locations of core hive files, explains the relationship between logical Registry trees and their on-disk counterparts, highlights the role of transaction log files, and outlines how the operating system accesses these files during startup.

Core File Locations on the File System

In Windows 2000, the system partition houses Registry hives as discrete binary files rather than a single unified database. The majority of machine-wide configuration hives reside in the following directory:

%SystemRoot%\System32\Config\ (typically C:\WINNT\System32\Config\)

User-specific hives are isolated from the operating system files and stored within individual profile directories on the system drive:

%SystemDrive%\Documents and Settings\<Username>\NTUSER.DAT

Logical Keys to On-Disk Hive Files Mapping

The Registry presents data as a single hierarchical tree, but Windows 2000 divides this tree into separate hives on disk to optimize memory usage and access control:

  • HKEY_LOCAL_MACHINE\SAM: Mapped to the SAM file in Config\. It contains local account security descriptors, user accounts, and password hashes.
  • HKEY_LOCAL_MACHINE\SECURITY: Mapped to the SECURITY file in Config\. It contains local security policies, user rights, and audit configurations. Access is restricted exclusively to the SYSTEM account.
  • HKEY_LOCAL_MACHINE\SOFTWARE: Mapped to the SOFTWARE file in Config\. It contains vendor and application-specific settings, as well as non-boot Windows software configurations.
  • HKEY_LOCAL_MACHINE\SYSTEM: Mapped to the SYSTEM file in Config\. It holds driver initialization parameters, service definitions, and hardware configuration profiles organized into Control Sets.
  • HKEY_USERS.DEFAULT: Mapped to the DEFAULT file in Config\. This stores system-level user environment settings used prior to any interactive logon.
  • HKEY_CURRENT_USER: Dynamically loaded from the user's NTUSER.DAT file when logging in, then mapped under HKEY_USERS\<User-SID>.
  • HKEY_CLASSES_ROOT: In Windows 2000, this is a merged logical view constructed in memory, combining machine-wide settings from HKLM\SOFTWARE\Classes and user-specific customizations from HKCU\Software\Classes.
  • HKEY_CURRENT_CONFIG: An alias linking directly to HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current. It does not possess its own file on disk.

Supporting Files and Fault Tolerance

Windows 2000 uses specific companion files alongside each primary hive to maintain integrity against sudden power failures or system crashes:

  • .LOG Files: Each primary hive file in the Config\ directory has an associated transaction file (such as SYSTEM.LOG or SOFTWARE.LOG). Windows writes pending changes to the log before committing them to the main hive file. If the system crashes mid-write, the kernel's Configuration Manager reads the log during the next boot to roll forward valid changes or discard corrupted writes.
  • .SAV Files: Files such as SYSTEM.SAV represent backup snapshots generated during the text-mode phase of Windows 2000 Setup. They are retained as recovery baselines if initial installation components fail to configure.

Startup Access by NTLDR and the Kernel

Because file systems and storage drivers depend on settings stored in the Registry, the SYSTEM hive must be accessible before the operating system kernel is operational. During boot:

  1. The boot loader (NTLDR) uses basic disk access functions to read C:\WINNT\System32\Config\SYSTEM directly into memory.
  2. NTLDR scans the hive for the Select key to determine the active control set (e.g., ControlSet001).
  3. NTLDR identifies which storage and bus drivers have a Start value of 0 (Boot Start) and loads them into memory along with the Windows 2000 kernel (NTOSKRNL.EXE).
  4. Once the kernel initializes, the Configuration Manager takes ownership of the in-memory hive, mounts the remaining hives from the Config\ folder, and maps them to their corresponding root keys.