The HKEY_LOCAL_MACHINE Key
HKEY_LOCAL_MACHINE is one of the most important and most interesting root keys
of the registry. It contains configuration data for local computer. Information stored in
this registry key is used by applications and device drivers and by the operating system
itself for obtaining information on the local computer's configuration. Moreover, the
information doesn't depend on the user who's logged in to the system.
The HKEY_LOCAL_MACHINE root key contains five subkeys, briefly described in
Table 7.1
. The rest of this section describes the subkeys in greater detail.

Table 7.1: Subkeys Contained within the HKEY_LOCAL_MACHINE Root Key
Subkey Contents
HARDWARE This subkey contains a database describing all the hardware devices
installed on the computer, the method of interaction between device
drivers and hardware devices, and the data that connects kernel-mode
device drivers with user-mode code. All the data contained within this
subkey are volatile. The system re-creates these data each time it starts.
The Description subkey describes all the hardware physically present on
the computer. The hardware recognizer collects this information at system
startup and the kernel stores this information under the
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION registry key.
The DeviceMap subkey contains various data in formats defined by
certain device driver classes. As device drivers are loading, they pass their
information to the system so that it can associate specific hardware
devices and their drivers.
HARDWARE The ResourceMap subkey contains information on the system resources
allocated to each device (including ports, DMA addresses, IRQs). Notice
that all Windows NT-based operating systems, including Windows 2000,
Windows XP and Windows Server 2003 provide a much more convenient
way to view the contents of this subkey. To view (and possibly change)
this data, it is recommended that you use various administrative tools. For

loading order of device drivers and system services, and on operating
system behavior.

Note You can read the information contained in any of these subkeys, but it only makes
sense to edit the contents of the Software and System keys.
If the HKEY_CURRENT_USER registry key contains data similar to that contained
under HKEY_LOCAL_MACHINE, then by default the HKEY_CURRENT_USER data
takes priority.

Note If you read the previous chapter carefully, you'll recall that the Policy setting under
HKEY_LOCAL_MACHINE is given priority over the individual settings specified
for each user. This is only true if you logged in to the system as an Administrator
and specified the default value for the power policy, as described in Chapter 5
.
However, the settings under this key may also extend the data under
HKEY_LOCAL_MACHINE rather than replace them. Furthermore, there are certain
settings (for example, those that manage the device driver loading order) that have no
meaning outside the HKEY_LOCAL_MACHINE root key.
The HKEY_LOCAL_MACHINE\HARDWARE Key
The HKEY_LOCAL_MACHINE\HARDWARE registry key contains hardware data
recreated during each system startup. This data includes information about the devices on
the motherboard and the data on the IRQs used by individual device drivers.
The HARDWARE key contains important data sets subdivided between the following
three subkeys: DESCRIPTION, DEVICEMAP, and RESOURCEMAP.
All the information contained under HKEY_LOCAL_MACHINE\HARDWARE is
volatile. This means that the settings are computed and recreated each time the system
starts up, and are lost when you shut the system down. All drivers and applications use
this subtree for obtaining information on system components and for storing the data
directly under the DEVICEMAP subkey and indirectly under the RESOURCEMAP
subkey (Fig. 7.1

The DESCRIPTION Subkey
The DESCRIPTION subkey under HKEY_LOCAL_MACHINE\HARDWARE displays
information from the hardware database. For x86 computers, this information contains
data on the devices detected by Ntdetect.com and Ntoskrnl.exe.
Ntdetect.com is the standard DOS-style program that uses BIOS calls for selecting
hardware information and configuring hardware devices. This includes date and time
information stored in the CMOS chip; bus types (for example, ISA, PCI, EISA) and
identifiers of the devices on these buses; data on the number, type, and capacity of the
hard drives installed in the system; and the number and types of parallel ports. Based on
this information, the system creates internal data structures that Ntoskrnl.exe stores under
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION during system startup.
A specific feature of the Ntdetect.com version included with Windows 2000, Windows
XP, and Windows Server 2003 is that PnP detection functions are delegated to PnP
drivers. In contrast, the Windows NT 4.0 version of Ntdetect.com detects all installed
hardware (due to limited PnP support in Windows NT 4.0).
Ntdetect.com detects the following hardware:

Type of bus\adapter

Keyboard

SCSI adapters

COM-ports

Machine ID

Video adapter

Arithmetic coprocessor