Registry HKEY_USERS

[nickola2003]

Hi...
I have question. According to Microsoft article(http://support.microsoft.com/kb/256986) about registry, HKEY_USERS should contain sub folders for every active user on that machine. Well I have 4 users on my machine and under my HKEY_USERS I see only one user (administrator). Those are the sub folder that I have under HKEY_USERS:
Default
S-1-5-18
S-1-5-19
S-1-5-19_Classes
S-1-5-20
S-1-5-20_Classes
S-1-5-21-1708537768-651377827-725345543-500
S-1-5-21-1708537768-651377827-725345543-500_Classes
What happed to the rest of my users I don’t know?
Does any one know what is going on with it?

[monkey_1]

You have four:
S-1-5-18
S-1-5-19
S-1-5-20
S-1-5-21
But you can only 'see' the active user (the user or users logged on)...


HKEY_USERS Contains all the actively loaded user profiles on the computer. HKEY_CURRENT_USER is a subkey of HKEY_USERS. HKEY_USERS is sometimes abbreviated as "HKU."

[wareup]

I second the motion.
I encounter registry when I was making our company user policy. I think you have to go to Computer area not in user.

-----------------
Freeware (http://www.freewareupdater.com) OpenSource (http://www.freewareupdater.com/blog/)

[GoneToPlaid]

My computer shows four users too, but my XP Pro is setup with just the Admin account, my account, and the disabled Guest account. I don't know why there is a fourth user account. Could it be from when I reordered my secondary IDE drive and CD-ROM drives around on my IDE cables after cloning my IDE C: drive to my new SATA drive and then configured BIOS to boot from the new SATA drive? I'm just curious.

[josefz]

Those S-1-5-18, S-1-5-19, S-1-5-20 are not security identifiers (SIDs) of real users; they are SIDs of service accounts. Refer to Well-known security identifiers in Windows operating systems (http://support.microsoft.com/kb/243330):

# SID: S-1-5-18
Name: Local System
Description: A service account that is used by the operating system.
# SID: S-1-5-19
Name: NT Authority
Description: Local Service
# SID: S-1-5-20
Name: NT Authority
Description: Network Service

A real user profile SID begins with S-1-5-21-...

The HKEY_USERS key contains no more (and no less) than the actively loaded user profiles on the computer.

[GoneToPlaid]

Hi josefz,

Thanks for the above info and the link! Now I understand what those SIDs are. :)

[reghakr]

This is typical.

The account ending in 500 is the actual Administartive account.

All others are profiles from other users.

all the short ones are for Microsoft's use only.

If you have two accounts Profiles) on your machine, you'll have an SID similar to these:
HKEY_USERS\S-1-5-21-2324179612-35356136-2698337578-1000
HKEY_USERS\S-1-5-21-2324179612-35356136-2698337578-1001