I knew this already but came across again from this script Q&A and thought its worth reminding myself: HKEY_USERS\.DEFAULT
is not the default user profile (i.e. the profile used as the default settings for a user who logs in and does not have an existing profile).
HKEY_USERS \.DEFAULT
is the profile for the LOCALSYSTEM account. It is an alias for HKEY_USERS\S-1-5-18
.
The registry settings used as the default settings for a user who logs in and does not have an existing profile are at C:\Users\Default\ntuser.dat
.
Also pointing to this blog post that explains this in more detail.