HKLM\SYSTEM is where Windows 2000 and NT keeps their crown jewels: the configuration settings that boot the current incarnation of the machine, as well as a number of ancillary settings that govern pretty much everything the OS and kernel services do.

There are four subkeys of interest directly beneath HKLM\SYSTEM:


This subkey stores information about the physical and logical disk volumes on your machine. When you run the Disk Administrator utility for the first time, this key is created; subsequent runs of Disk Administrator update the key’s data, which is then keeps track of how your disks are configured.


This Windows 2000 subkey replaces the Disk subkey used in NT 4.0. It’s used by the NTFS filesystem to link volume names with the internal identifiers of the volumes, which are usually comprised of a volume’s disk signature.


Ever wonder how a Windows 2000/NT system keeps track of which control set is the “last known good” set? Here’s the answer! Each of the four values is a REG_DWORD that contains the ordinal index of a ControlSetXXX entry under HKLM\SYSTEM:


Contains the ID of the control set currently in use; this set is the one linked to HKLM\SYSTEM\CurrentControlSet.


Contains the ID of the control set that boots the machine next time, unless you manually intervene during the boot process.


Contains the ID of ...

Get Managing The Windows 2000 Registry now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.