HKEY_LOCAL_MACHINE : This key also contains the files COMPONENTS and BCD, which can be found in the%systemroot%\System 32\Config\ folder, and which contain information specific to the PC’s boot configuration data.
A few of the subkeys in the HKEY_LOCAL_MACHINE section are worthy of note, because this collection of Registry files is most commonly modified and edited by users.
* SAMThe Security Accounts Manager keys section will commonly appear empty unless the viewing user has all appropriate administrative permissions. It contains the security information for all the domains the PC connects to, including the local domain, which is also called SAM.
Each SAM database contains the username used to log in to the domain, along with a UID (Unique Identifier) for the domain, a cryptographic hash of the user’s password, the location of the user’s Registry Hive, on the server, and various other settings and flags that may be required by the connection.
* SECURITY
This subkey also appears empty for most users unless they have appropriate administrative permissions. Upon connection to a domain, it is linked to the security database in the Server Registry Hive, which will contain all security policies applicable to the current user and their installed apps.
* SYSTEM
This subkey contains information about Windows setup, settings, and details for currently mounted devices, and for drives that contain a file system.
* SOFTWARE
This subkey contains settings for the currently installed Windows installation and its installed software and apps. The keys are organized by software vendor and include subkeys for file extensions, MIME types, and Object Class and Interface IDs (such as ActiveX controls).