have a look here:
http://www.windowsitlibrary.com/Content/224/1.htmlThe True Subtrees and Their Aliases Of the five subtrees, only two — HKLM and HKU — are "real." What I mean by "real" is that they are the only two subtrees backed by files, the only two that exist regardless of whether someone is logged on to the machine. Two of the other subtrees — HKCC and HKCR — are "aliases" or links to individual subkeys within HKLM. When I say links, I mean that the keys and values shown in HKCC and HKCR are really keys and values in HKLM. If you make a change to one, that change is reflected in the other. If you’re familiar with Unix-based file systems, you recognize that HKCC and HKCR are really symbolic links to their true location within HKLM. Placing them within their own subtree makes it easier to navigate directly to the information you need in each area.
The fifth subtree, HKCU, is actually the "Settings" portion of a logged-on NT or Win2K user profile and an alias of a special subkey that is loaded into the HKEY_USERS subtree at user logon — based on the user’s Win2K Security Identifier (SID).
The following list describes the relationship of the five subtrees:
HKEY_LOCAL_MACHINE = HKEY_LOCAL_MACHINE
HKEY_USERS = HKEY_USERS
HKEY_CURRENT_CONFIG = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\Current
HKEY_CLASSES_ROOT = HKEY_LOCAL_MACHINE\Software\Classes (and HKCU\Software \Classes)
HKEY_CURRENT_USER = HKEY_USERS\<SID VALUE>
As you look at the subtrees, note that three of the five are subkeys of HKLM and HKU that have been "exploded" for easier viewing.
hope that helps
