paperlined.org
apps > windows > internals
document updated 16 years ago, on Jun 10, 2008
An example HKEY_USERS\ subkey:
HKEY_USERS\S-1-5-21-3368764809-4108340485-4039417125-1008\
The long part is the local computer SID or domain SID (depending on whether it's a local or domain account).

The short part is the Relative ID (RID) — the user-specific part. It's as close to unix UIDs as you'll get (particularly true if you use Samba).

You can get the mapping information via LookupAccountName() and LookupAccountSid().



There are always several shorter entries like this:

HKEY_USERS\S-1-5-18\
HKEY_USERS\S-1-5-20\

These are well-known SIDs that stand for a larger class of users, rather than one specific user.



HKEY_CURRENT_USER\ is, of course, mapped to the subkey of HKEY_USERS\ that matches the username of the currently running process.



If the data for a desired user's subkey isn't currently available under HKEY_USERS\, you can use either reg.exe load or regedit > File > Load Hive to load %UserProfile%\NTUSER.DAT into the registry.