HKEY_LOCAL_MACHINE (HKLM Registry Hive)

Details on the HKEY_LOCAL_MACHINE Registry Hive

Screenshot of the HKEY_LOCAL_MACHINE hive in the Windows Registry in Windows 10
HKEY_LOCAL_MACHINE Registry Hive (Windows 10).

HKEY_LOCAL_MACHINE, often abbreviated as HKLM, is one of several registry hives that make up the Windows Registry.

HKEY_LOCAL_MACHINE contains the majority of the configuration information for the software you have installed, as well as for the Windows operating system itself.

In addition to software configuration data, the HKEY_LOCAL_MACHINE hive also contains lots of valuable information about currently detected hardware and device drivers.

In Windows 10, Windows 8, Windows 7, and Windows Vista, information about your computer's boot configuration is also included in this hive.

How to Get to HKEY_LOCAL_MACHINE

Being a registry hive, HKEY_LOCAL_MACHINE is easy to find and open using the Registry Editor tool included in all versions of Windows:

  1. Open Registry Editor.
  2. Locate HKEY_LOCAL_MACHINE on the left-hand side of Registry Editor.
  3. Tap or click on the word HKEY_LOCAL_MACHINE or the small arrow to the left to expand it.

If you, or someone else, has used Registry Editor before on your computer, you may need to collapse any open registry keys until you find the HKEY_LOCAL_MACHINE hive.

Registry Subkeys in HKEY_LOCAL_MACHINE

The following registry keys are located under the HKEY_LOCAL_MACHINE hive:

  • HKEY_LOCAL_MACHINE\BCD00000000
  • HKEY_LOCAL_MACHINE\COMPONENTS
  • HKEY_LOCAL_MACHINE\DRIVERS
  • HKEY_LOCAL_MACHINE\HARDWARE
  • HKEY_LOCAL_MACHINE\SAM
  • HKEY_LOCAL_MACHINE\Schema
  • HKEY_LOCAL_MACHINE\SECURITY
  • HKEY_LOCAL_MACHINE\SOFTWARE
  • HKEY_LOCAL_MACHINE\SYSTEM

Note: The keys located under HKEY_LOCAL_MACHINE on your computer may differ somewhat depending on your version of Windows and your specific computer configuration. For example, newer versions of Windows do not include the HKEY_LOCAL_MACHINE\COMPONENTS key.

The SAM and SECURITY subkeys are hidden keys in most configurations and therefore can't be browsed like the other keys under HKEY_LOCAL_MACHINE. Most of the time they'll appear blank when you open them and/or contain subkeys that are blank.

To see the contents of either key, the Registry Editor must instead be opened using the System Account, which has greater permissions than any other user, even a user with administrator privileges.

Once Registry Editor has been opened using the appropriate permissions, the HKEY_LOCAL_MACHINE\SAM and HKEY_LOCAL_MACHINE\SECURITY keys can be explored like any other key in the hive.

Some free software utilities, like PsExec by Microsoft, are able to open Registry Editor with the proper permissions to view these hidden keys.

More on HKEY_LOCAL_MACHINE

It might be interesting to know that HKEY_LOCAL_MACHINE doesn't actually exist anywhere on the computer, but is instead just a container for displaying the actual registry data being loaded via the subkeys located within the hive, listed above.

In other words, HKEY_LOCAL_MACHINE acts like a shortcut to a number of other sources of data about your computer.

Because of this non-existant nature of HKEY_LOCAL_MACHINE, neither you, nor any program you install, can create additional keys under HKEY_LOCAL_MACHINE.

The HKEY_LOCAL_MACHINE hive is global, meaning that it's the same no matter which user on the computer views it, unlike a registry hive like HKEY_CURRENT_USER which is user specific.