{"id":27783,"date":"2007-03-02T10:00:00","date_gmt":"2007-03-02T10:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2007\/03\/02\/the-default-user-is-not-the-default-user\/"},"modified":"2007-03-02T10:00:00","modified_gmt":"2007-03-02T10:00:00","slug":"the-default-user-is-not-the-default-user","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20070302-00\/?p=27783","title":{"rendered":"The .Default user is not the default user"},"content":{"rendered":"

If you ever gone spelunking in the HKEY_USERS<\/code> registry key, you’ve no doubt found the user named HKEY_USERS\\.Default<\/code>. Who is this guy?\n Despite its name, the profile for the .Default user is not the default user profile. It’s actually the profile for the Local System account and is an alias for HKEY_USERS\\S-1-5-18<\/code>. (S-1-5-18<\/code> is the security identifier for the Local System account<\/a>.) Consequently, settings in HKEY_USERS\\.Default<\/code> are used by programs and services that run as Local System. The most visible examples of programs that run as Local System are winlogon<\/code> and logonui<\/code>, the programs that display the interface for logging onto the system. Whatever color scheme and screen saver you choose for the Local System profile get used at the logon screen.\n Unfortunately, the name .Default<\/code> has led people to believe that this user’s settings are the basis for new user profiles. In retrospect, calling it .Default<\/code> was probably a bad decision. It just gave people the wrong idea. Here’s one customer that was faked out:<\/p>\n

I’m setting the values in HKEY_USERS\\.Default\\International<\/code> but when I create a new user, that user doesn’t pick up those settings. I’m stumped. <\/p><\/blockquote>\n

The registry settings for new users do not come from the .Default<\/code> user. Rather, they come from what I’ve started calling the “template user”, which is kept† in the file C:\\Documents and Settings\\Default User\\ntuser.dat<\/code>. This hive is not loaded most of the time (since there’s no reason to waste memory on something that is needed only rarely), so if you want to make a change to the template user, you’ll have to load the hive manually.\n Mind you, messing with the template user hive directly is most likely not supported. The supported way of modifying the template user hive on Windows XP is to use the system preparation tool “SysPrep”. Boot into factory mode, make your customizations to the current user, then reseal. The resealing process propagates the current user’s settings to the template user (or, more specifically, the ones that can safely be propagated to the template user—you don’t want to propagate things like encryption keys) before “resealing” the system for deployment.\n (No, I don’t know what the mechanism is for Windows Vista.)\n Nitpicker’s corner<\/b><\/p>\n

†s\/which is kept\/which is typically kept on US-English systems\/ <\/p>\n","protected":false},"excerpt":{"rendered":"

If you ever gone spelunking in the HKEY_USERS registry key, you’ve no doubt found the user named HKEY_USERS\\.Default. Who is this guy? Despite its name, the profile for the .Default user is not the default user profile. It’s actually the profile for the Local System account and is an alias for HKEY_USERS\\S-1-5-18. (S-1-5-18 is the […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-27783","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"

If you ever gone spelunking in the HKEY_USERS registry key, you’ve no doubt found the user named HKEY_USERS\\.Default. Who is this guy? Despite its name, the profile for the .Default user is not the default user profile. It’s actually the profile for the Local System account and is an alias for HKEY_USERS\\S-1-5-18. (S-1-5-18 is the […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/27783","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=27783"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/27783\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=27783"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=27783"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=27783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}