RegLoadKey is a Windows API that mounts a registry hive file under an existing registry root key, such as HKEY_USERS or a custom key. The hive becomes available to the caller as if it were part of the live registry. This operation requires elevated privileges, because it gives a process the ability to attach offline registry data to a running system.
In cyber security, RegLoadKey matters because registry hives store user settings, system configuration, and security-relevant state. Attackers may abuse it to inspect or modify another account’s registry data, stage persistence, or manipulate settings in a way that looks like normal administration. Defenders watch for unexpected hive-loading activity, especially from unusual processes or services, and limit who can use restore-style privileges. Legitimate uses include offline repair, forensic analysis, and controlled migration tasks.