FileRisk: Do not touch

SOFTWARE C:\Windows\System32\config\SOFTWARE

Registry hive HKLM\SOFTWARE: Windows and application settings that apply to all users of the machine.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

SOFTWARE is the Registry hive Windows loads at startup under HKEY_LOCAL_MACHINE\SOFTWARE. It holds the configuration of installed software and of Windows that applies to all users of the machine. The rules shared by all hives (locking, backup, editing) are in the page for the System32\config folder.

What it contains

Windows and software settings: Microsoft\Windows\CurrentVersion keys, uninstall entries (Uninstall), auto-start entries (Run, RunOnce).
The machine part of file associations (Classes) and, on 64-bit Windows, the WOW6432Node branch used by 32-bit applications.
Machine settings applied by Group Policy, under Policies.
The .LOG1 and .LOG2 transaction files may sit next to it.

Risks and best practices

It is the hive you will consult most often, so always go through the Registry key and never through the file.
A corrupted SOFTWARE hive stops Windows components and applications from working. Restore from a system backup rather than handling the file.
The Run and RunOnce keys are a classic persistence location for malware, so audit them.

Useful commands

# Hive file metadata (contents are locked while Windows is running)
Get-Item -Force "$env:windir\System32\config\SOFTWARE" | Select-Object Name, Length, LastWriteTime

# The hive and its companion files (.LOG1, .LOG2, .regtrans-ms)
Get-ChildItem -Force "$env:windir\System32\config" -Filter "SOFTWARE*" | Select-Object Name, Length, LastWriteTime

# Programs started at logon for all users
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

# Export an offline copy of the hive (run as administrator)
reg save HKLM\SOFTWARE "$env:TEMP\software.hiv"

Report a mistake