Which registry file is responsible for default settings for all new users?

Z

ZorkLVM

Member
Messages
47
Reaction score
4
The AI's are split on this, so asking here:

Inside a Windows installation iso lives the install.wim file, which contains files holding the registry data for default user settings.

If I wanted to change a setting in the windows registry for all future users created inside the install.wim file, which is inside a Windows installation iso, which file would I edit in my registry editor?

AI's are split among:

1. /sources/install.wim/Users/Default/ntuser.dat
2. /sources/install.wim/Windows/System32/config/DEFAULT

I'm not saying I'm going to do this, or even if it's proper to do it, just want to know which file is correct for all future user's registry settings.
 
This is a trick question, so don't ask an AI for a few more years. The answer depends on what the setting does, and if there's a group policy.

1. Every interactive user's profile is cloned from the Default User during new user provisioning. Default User's reg hive is stored as \Users\Default\NTUSER.dat. When you import reg files containing HKCU references from the Registry screen, those keys are saved here.

2. Non-interactive service accounts, like SYSTEM and TrustedInstaller, use a profile loaded from \Windows\System32\config\DEFAULT. When you import reg files containing HKU\.Default references from the Registry screen, those keys are saved here.

3. Some settings are managed under a Group Policy. A Group Policy may exist at the Machine (system) or User level, or both. There is no hard rule for which scope a GPO exists in. You must find the MS docs for that GPO, a Group Policy Editor ADMX template, or a reputable source on it.

4. When a GPO has both a Machine and User scope, the policies are applied in order of Machine and then User. Whichever policy is the last applied wins out.

Machine Policy ExistsMachine Policy Missing
User Policy ExistsUser Policy WinsUser Policy Wins
User Policy MissingMachine Policy Wins

5. HKLM\SOFTWARE keys are saved to \Windows\System32\config\SOFTWARE.
6. HKLM\SYSTEM keys are saved to \Windows\System32\config\SYSTEM.

7. Contrary to popular belief, not every Default User setting appears to be cloned to a new user. User provisioning appears to override or ignore some reg values, and those HCKU's need to be applied after the user's first desktop logon, from Post-Setup (After logon).

Some trial & error may be required to determine which HKCU settings are affected this way, as it depends on your Windows release.
 
You must log in or register to reply here.
Back
Top