FileRisk: Do not touch

DEFAULT C:\Windows\System32\config\DEFAULT

The DEFAULT hive, exposed as HKEY_USERS\.DEFAULT: the SYSTEM account profile, used before anyone signs in (sign-in screen).

Updated on 12 November 2026 By AltF4 Formation

What it’s for

DEFAULT is the Registry hive Windows loads at startup and exposes under HKEY_USERS\.DEFAULT. It is the SYSTEM account’s profile, so it is what the sign-in screen and services use until a user signs in. The rules shared by all hives (locking, backup, editing) are in the page for the System32\config folder.

What it contains

Settings applied before sign-in and to processes running as SYSTEM: keyboard layout, regional format and sign-in screen preferences.
One well-known setting: Control Panel\Keyboard\InitialKeyboardIndicators decides the Num Lock state at the sign-in screen.
Do not confuse it with C:\Users\Default\NTUSER.DAT, the template profile copied when a new user is created. DEFAULT is not copied into new profiles.
The .LOG1 and .LOG2 transaction files may sit next to it.

Risks and best practices

Change values through HKU\.DEFAULT in the Registry, never in the file, and test on a lab machine first: a change here alters the sign-in screen and how services behave.
To customize future user profiles, edit the NTUSER.DAT hive of the Default profile, not this one.

Useful commands

# Hive file metadata (contents are locked while Windows is running)
Get-Item -Force "$env:windir\System32\config\DEFAULT" | Select-Object Name, Length, LastWriteTime

# The hive and its companion files (.LOG1, .LOG2, .regtrans-ms)
Get-ChildItem -Force "$env:windir\System32\config" -Filter "DEFAULT*" | Select-Object Name, Length, LastWriteTime

# Read a sign-in screen setting (Num Lock)
reg query "HKU\.DEFAULT\Control Panel\Keyboard" /v InitialKeyboardIndicators

# Export an offline copy of the hive (run as administrator)
reg save HKU\.DEFAULT "$env:TEMP\default.hiv"

Report a mistake