How Windows XP Stored User Registry Settings

In Windows XP, the operating system managed user-specific configuration data by isolating individual user preferences from system-wide settings through dedicated registry hives. This article examines the internal mechanisms Windows XP used to store this information, focusing on the role of NTUSER.DAT, the mapping between HKEY_CURRENT_USER and HKEY_USERS, the logon mounting process, and the separation of user-specific class registrations.

The Role of HKEY_CURRENT_USER and HKEY_USERS

When applications interact with user-specific settings, they target the HKEY_CURRENT_USER (HKCU) registry subtree. In Windows XP, HKCU was not an independent physical database; it functioned as an active symbolic link pointing to a specific subkey within HKEY_USERS (HKU).

Each user account on the machine was assigned a unique Security Identifier (SID). When an account logged in, its full configuration was anchored under HKEY_USERS\<User-SID>. Windows XP then aliased this SID-specific path to HKCU, ensuring that applications could query a standardized root path regardless of which user was currently active.

Physical Storage in NTUSER.DAT

The underlying physical storage for a user's primary configuration was a file named NTUSER.DAT. This file represented an individual registry hive file formatted in a binary structure containing registry keys, subkeys, and values.

  • File Location: The file resided at the root of the user's profile directory: %SystemDrive%\Documents and Settings\<Username>\NTUSER.DAT.
  • Stored Data: It held personal application preferences, desktop configurations, mapped network drives, printer connections, and user-level environment variables.
  • Fault Tolerance: Alongside NTUSER.DAT, Windows XP maintained an NTUSER.DAT.LOG transaction log file. This write-ahead log prevented hive corruption in the event of an unexpected shutdown or power loss during a registry write operation.

The Dynamic Loading Process

Windows XP loaded and unloaded user hives dynamically to optimize system memory and security:

  1. Authentication: During login, the Winlogon process authenticated the user credentials with the Local Security Authority Subsystem Service (LSASS).
  2. Hive Mounting: Upon successful authentication, the User Profile Service mounted the user's NTUSER.DAT file into the active registry structure using the internal NtLoadKey system API.
  3. SID Mapping: The file was loaded into the registry tree at HKEY_USERS\<User-SID>, and the symbolic link for HKEY_CURRENT_USER was instantiated.
  4. Unloading: At logoff, all open handles to HKCU were closed, the changes were flushed to disk, the symbolic link was severed, and the hive was unmounted from memory to free system resources.

Class Registrations and UsrClass.dat

Windows XP introduced a refined method for managing user-specific file associations and COM registrations through a secondary hive file named UsrClass.dat.

  • Location: Located at %SystemDrive%\Documents and Settings\<Username>\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.
  • Purpose: This file stored non-roaming configuration data, primarily user-defined file type extensions and per-user COM components.
  • Registry Mapping: Windows XP mapped this hive to HKEY_USERS\<User-SID>_Classes, which was subsequently merged dynamically with the system-wide classes hive (HKEY_LOCAL_MACHINE\Software\Classes) to generate the unified HKEY_CLASSES_ROOT (HKCR) view.

This separation allowed standard users without administrative privileges to register software and file extensions locally without modifying global machine settings.