Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. config
FolderRisk: Do not touch

config C:\Windows\System32\config

Registry hives (SAM, SECURITY, SOFTWARE, SYSTEM, DEFAULT) and their .LOG and .sav files: the system's configuration database.

Updated on By AltF4 Formation

What it’s for

C:\Windows\System32\config holds the on-disk files of the Registry hives, that is the system’s configuration database. Microsoft states that most hive supporting files are here and that they are updated at each user logon. This page carries the rules common to all hives. Each hive then has its own page for what sets it apart.

What it contains

  • SAM: local accounts and password hashes (HKLM\SAM).
  • SECURITY: local security policy (HKLM\Security).
  • SOFTWARE: software and Windows configuration (HKLM\Software).
  • SYSTEM: hardware, drivers and services (HKLM\System), with an .alt backup copy on versions that support it.
  • DEFAULT: the HKEY_USERS\.DEFAULT hive.
  • COMPONENTS and DRIVERS, two more hives in the folder.
  • Associated files: .LOG (transaction log) and .sav (backup copy of a hive).
  • The RegBack subfolder, which has no longer been populated by default since Windows 10 version 1803 (see its page).

User hives are elsewhere: NTUSER.DAT at the root of the profile, UsrClass.dat in AppData\Local\Microsoft\Windows.

Risks and best practices

  • These files are locked while Windows runs. Move, rename or delete them offline and the system may no longer boot. To get a copy, use reg save or a system backup.
  • To change a value, work on the key with regedit, reg or PowerShell, never on the file.
  • An offline copy of the SAM and SYSTEM hives is enough to extract local password hashes. Protect physical access, encrypt the disk and watch your backups.

Useful commands

Fenêtre de terminal
# Hives and companion files (read access limited to administrators)
Get-ChildItem -Force "$env:windir\System32\config" -File | Select-Object Name, Length, LastWriteTime


# Offline copy of a hive (as administrator)
reg save HKLM\SYSTEM C:\Temp\system.hiv


# Read the Registry without touching the files
reg query HKLM\SYSTEM\CurrentControlSet\Services /s /v ImagePath

Folder contents

Folders 2

Files 5

Report a mistake