<Li> The "HKLM \ SAM" key usually appears as empty for most users (unless they are granted access by administrators of the local system or administrators of domains managing the local system). It is used to reference all "Security Accounts Manager" (SAM) databases for all domains into which the local system has been administratively authorized or configured (including the local domain of the running system, whose SAM database is stored a subkey also named "SAM": other subkeys will be created as needed, one for each supplementary domain). Each SAM database contains all builtin accounts (mostly group aliases) and configured accounts (users, groups and their aliases, including guest accounts and administrator accounts) created and configured on the respective domain, for each account in that domain, it notably contains the user name which can be used to log on that domain, the internal unique user identifier in the domain, a cryptographic hash of each user's password for each enabled authentication protocol, the location of storage of their user registry hive, various status flags (for example if the account can be enumerated and be visible in the logon prompt screen), and the list of domains (including the local domain) into which the account was configured . </Li> <Li> The "HKLM \ SECURITY" key usually appears empty for most users (unless they are granted access by users with administrative privileges) and is linked to the Security database of the domain into which the current user is logged on (if the user is logged on the local system domain, this key will be linked to the registry hive stored by the local machine and managed by local system administrators or by the builtin "System" account and Windows installers). The kernel will access it to read and enforce the security policy applicable to the current user and all applications or operations executed by this user . It also contains a "SAM" subkey which is dynamically linked to the SAM database of the domain onto which the current user is logged on . </Li> <Li> The "HKLM \ SYSTEM" key is normally only writable by users with administrative privileges on the local system . It contains information about the Windows system setup, data for the secure random number generator (RNG), the list of currently mounted devices containing a filesystem, several numbered "HKLM \ SYSTEM \ Control Sets" containing alternative configurations for system hardware drivers and services running on the local system (including the currently used one and a backup), a "HKLM \ SYSTEM \ Select" subkey containing the status of these Control Sets, and a "HKLM \ SYSTEM \ CurrentControlSet" which is dynamically linked at boot time to the Control Set which is currently used on the local system . Each configured Control Set contains: <Ul> <Li> an "Enum" subkey enumerating all known Plug - and - Play devices and associating them with installed system drivers (and storing the device - specific configurations of these drivers), </Li> <Li> a "Services" subkey listing all installed system drivers (with non device - specific configuration, and the enumeration of devices for which they are instantiated) and all programs running as services (how and when they can be automatically started), </Li> <Li> a "Control" subkey organizing the various hardware drivers and programs running as services and all other system - wide configuration, </Li> <Li> a "Hardware Profiles" subkey enumerating the various profiles that have been tuned (each one with "System" or "Software" settings used to modify the default profile, either in system drivers and services or in the applications) as well as the "Hardware Profiles \ Current" subkey which is dynamically linked to one of these profiles . </Li> </Ul> </Li> <Ul> <Li> an "Enum" subkey enumerating all known Plug - and - Play devices and associating them with installed system drivers (and storing the device - specific configurations of these drivers), </Li> <Li> a "Services" subkey listing all installed system drivers (with non device - specific configuration, and the enumeration of devices for which they are instantiated) and all programs running as services (how and when they can be automatically started), </Li> <Li> a "Control" subkey organizing the various hardware drivers and programs running as services and all other system - wide configuration, </Li> <Li> a "Hardware Profiles" subkey enumerating the various profiles that have been tuned (each one with "System" or "Software" settings used to modify the default profile, either in system drivers and services or in the applications) as well as the "Hardware Profiles \ Current" subkey which is dynamically linked to one of these profiles . </Li> </Ul>

Where is the registry file located in windows 7