Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. config
  5. SYSTEM
FileRisk: Do not touch

SYSTEM C:\Windows\System32\config\SYSTEM

Registry hive HKLM\SYSTEM: control sets, services, drivers and hardware configuration needed to boot.

Updated on By AltF4 Formation

What it’s for

SYSTEM is the registry hive Windows loads first at startup, under HKEY_LOCAL_MACHINE\SYSTEM. The loader (winload) reads the list of boot drivers from it before the kernel is even running. The rules common to every hive (locking, reg save, never touching the file) are on the config folder page; this one keeps only what sets SYSTEM apart.

What it contains

  • The control sets ControlSet001, ControlSet002 and so on. CurrentControlSet is only a link to the active one; the Select key tells you which (Current, Default, Failed, LastKnownGood).
  • Services: one key per service and driver, with ImagePath and Start (0 for a boot driver, 2 for automatic start, 3 manual, 4 disabled).
  • Detected hardware, load order and boot configuration.
  • Alongside, the transaction files SYSTEM.LOG1 and SYSTEM.LOG2.

Risks and best practices

  • A missing or corrupted SYSTEM blocks startup with “Windows failed to start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM”. Repair from WinRE or restore a system state backup.
  • From WinRE you can also mount the hive offline to fix a driver that prevents booting: reg load HKLM\OFFSYSTEM D:\Windows\System32\config\SYSTEM, change the Start value of the faulty service under ControlSet001\Services, then reg unload HKLM\OFFSYSTEM. Skip the reg unload and the hive stays locked.
  • Together with the SAM hive, an offline copy of SYSTEM provides the boot key that decrypts local password hashes: protect it like an account backup.

Useful commands

Fenêtre de terminal
# Control set active at startup (Current, Default, Failed, LastKnownGood)
Get-ItemProperty 'HKLM:\SYSTEM\Select'


# Boot drivers (Start = 0) and their file
Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services | Get-ItemProperty |
    Where-Object Start -eq 0 | Select-Object PSChildName, ImagePath


# Offline copy of the hive (as administrator)
reg save HKLM\SYSTEM "$env:TEMP\system.hiv"

Report a mistake