Loading an offline registry file

Sometimes it is necessary to access an offline registry file. This may be in the course of troubleshooting a system that is down from a parallel install or another Windows system, loading the HKEY_CURRENT_USER registry hive of another user, or reading data from registry files restored from backup.

On Windows XP and Windows 2000 systems you can use REGEDIT to load hives, however on Windows NT and Windows 2000 systems this is only possible using REGEDT32.

The HKEY_LOCAL_MACHINE registry hive files are saved in %SYSTEMROOT%\System32\Config. HKEY_LOCAL_MACHINE\SYSTEM is saved as SYSTEM. HKEY_LOCAL_MACHINE\SOFTWARE is saved as SOFTWARE (this also contains HKEY_CLASSES_ROOT). HKEY_CURRENT_USER is saved in %USERPROFILE%\NTUSER.DAT.

1. Login as a privileged account (probably and Administrator). Note: Remember that the registry has its own permission structure unrelated to NTFS. Just because you have file-system access to a registry file does not mean you necessarily have permission to edit the registry entries it contains.
2. Open the appropriate registry editor.
3. Select the root of HKEY_LOCAL_MACHINE. Note: The Load Hive option is not available when most of the other hives are selected.
4. In the menu click File -> Load Hive....
5. Browse to the registry file you wish to load and click OK.
6. When prompted for Key Name enter an easily identifiable name such as "temp". This is the name of the temporary key under which the hive will be loaded.
7. Expand HKEY_LOCAL_MACHINE and locate the Key Name specified above.
8. Browse through the loaded hive and make desired changes.
9. When finished, click on the Key Name and in the menu choose File -> Unload Hive.... Note: Failing to unload the hive may have consequences such as preventing other processes from opening the file!

Warning: By visiting this site and/or by using any information contained herein, you agree to the Techbytes.ca terms of use.

Add a comment about this TechByte

If you wish to add a comment regarding this TechByte, please use the form below. Please note that by submitting comments using this form you are allowing all of the information submitted to be visible on this website. Any comments submitted using this form will only be shown on the website if they are approved by the administrators of this site. IF APPROVED, COMMENTS MAY TAKE SEVERAL DAYS TO BE POSTED.

Other TechBytes:

• How to change service start type in the registry
• How to change service display name
• Display folder size in Windows Explorer