Modifying the registry of a remote machine
You can modify the registry of remote computers without having to log on locally. To
do this, select Connect Network Registry on the File menu in
Registry Editor, and then use the Select Computer dialog box to
specify the computer with which you want to work. In most cases, all
you must do is type the name of the remote computer and then tap or
click OK. If prompted, you might need to enter the user name and
password of a user account that is authorized to access the remote
computer.
After you connect, you get a new icon for the remote computer
under your Computer icon in the left pane of Registry Editor.
Double-tap or double-click this icon to access the physical root
keys on the remote computer (HKEY_LOCAL_MACHINE and HKEY_USERS). The
logical root keys aren’t available because they are either
dynamically created or simply pointers to subsets of information
from within HKEY_LOCAL_MACHINE and HKEY_USERS. You can then edit the
computer’s registry as necessary. When you are done, you can select
Disconnect Network Registry on the File menu and then choose the
computer from which you want to disconnect. Registry Editor then closes the registry on the remote computer and breaks the connection.
If you’re wondering why you would do this,
the primary reason is to work with a specific hive, such as the hive
that points to Dianne Prescott’s user profile because she
inadvertently changed the display mode to an invalid setting and can
no longer access the computer locally. With her user-profile
data loaded, you could then edit the registry to correct the problem and then save the
changes so that she can once again log on to the system.
Importing and exporting registry data
Sometimes you might find that it is necessary or useful to
copy all or part of the registry to a file. For example, if you’ve
installed a service or component that requires extensive
configuration, you might want to use it on another computer without
having to go through the whole configuration process again. So,
instead, you could install the service or component baseline on the
new computer, export the application’s registry settings from the
previous computer, copy them over to the other computer, and then
import the registry settings so that the service or component is
properly configured. Of course, this technique works only if the
complete configuration of the service or component is stored in the
registry, but you can probably see how useful being able to import
and export registry data can be.
By using Registry Editor, it is easy to import and export
registry data. This includes the entire registry, branches of data
stemming from a particular root key, and individual subkeys and the
values they contain. When you export data, you create a .reg file that contains the designated registry data.
This registry file is a script that can then be loaded back into the
registry of this or any other computer by importing it.
Note
Because the registry script is written as standard text, you can
view it and, if necessary, modify it in any standard text editor
as well. Be aware, however, that double-tapping or double-clicking
the .reg file starts Registry Editor, which prompts you
as to whether you want to import the data into the registry. If you are concerned about
this, save the data to a file with the .hiv extension because double-tapping or
double-clicking files with this extension won’t start Registry
Editor. Files with the .hiv extension must be manually imported
(or you could simply change the file extension to .reg when it is
time to use the data).
To export registry data, press and hold or right-click the
branch or key you want to export and then select Export. You can
also press and hold or right-click the root node for the computer
you are working with, such as Computer for a local computer, to
export the entire registry. Either way, you’ll see the Export
Registry File dialog box as shown in Figure 9. Use the Save
In selection list to choose a save location for the .reg file, and
then type a file name. The Export Range panel shows you the selected
branch within the registry that will be exported. You can change
this as necessary or select All to export the entire registry. Then
tap or click Save to create the .reg file.
Importing registry data adds the contents of the registry script
file to the registry of the computer you are working with, either
creating new keys and values if they don’t already exist or
overwriting keys and values if they do exist. You can import
registry data in one of two ways. You can double-tap or double-click
the .reg file, which starts Registry Editor and prompts you as to
whether you want to import the data. Or you can select Import on the
File menu, and then use the Import Registry File dialog box to
select and open the registry data file you want to import.
Loading and unloading hive files
Just as you sometimes must import or export registry data, you’ll sometimes need to work with
individual hive files. The most common reason for doing this, as
discussed previously, is when you must modify a user’s profile to
correct an issue that prevents the user from accessing or using a
system. Here, you would load the user’s Ntuser.dat file into
Registry Editor and then make the necessary changes. Another reason
for doing this is to change a particular part of the registry on a
remote system. For example, if you need to repair an area of the
registry, you could load the related hive file into the registry of
another machine and then repair the problem on the remote
machine.
Loading and unloading hives affects only HKEY_LOCAL_MACHINE
and HKEY_USERS, and you can perform these actions only when you
select one of these root keys. Rather than replacing the selected
root key, the hive you are loading then becomes a subkey of that
root key. HKEY_LOCAL_MACHINE and HKEY_USERS are, of course, used to
build all the logical root keys used on a system, so you could work
with any area of the registry.
After you select either HKEY_LOCAL_MACHINE or HKEY_USERS in
Registry Editor, you can load a hive for the current machine or
another machine by selecting Load Hive on the File menu. Registry
Editor then prompts you for the location and name of the previously
saved hive file. Select the file, and then tap or click Open.
Afterward, enter a name for the key under which you want the hive to
reside while it is loaded into the current system’s registry, and
then tap or click OK.
Note
You can’t work with hive files that are already being used
by the operating system or another process. You could, however,
make a copy of the hive and then work with it. At the command
line, type reg save followed by the
abbreviated name of the root key to save and the file name to use
for the hive file. For example, you could type reg save hkcu c:\curr-hkcu.hiv to save
HKEY_LOCAL_MACHINE to a file called Curr-hkcu.hiv on drive C.
Although you can save the logical root keys (HKCC, HKCR, HKCU) in
this manner, you can save only subkeys of HKLM and HKU using this
technique.
When you are finished working with a hive, you should unload
it to clear it out of memory. Unloading the hive doesn’t save the
changes you’ve made—as with any modifications to the registry, your
changes are applied automatically without the need to save them. To
unload a hive, select it and choose Unload Hive on the File menu.
When prompted to confirm, tap or click Yes.
Working with the registry from the command line
If you want to work with the registry from the command line, you can do so using
the REG command. REG is run using the permissions of the
current user and can be used to access the registry on both local
and remote systems. As with Registry Editor, you can work only with
HKEY_LOCAL_MACHINE and HKEY_USERS on remote computers. These keys
are, of course, used to build all the logical root keys used on a
system, so you can work with any area of the registry on a remote
computer.
REG has different subcommands for performing various registry tasks.
These commands include the following:
-
REG ADD Adds a new subkey
or value entry to the registry.
-
REG COMPARE Compares
registry subkeys or value entries.
-
REG COPY Copies a registry
entry to a specified key path on a local or remote
system.
-
REG DELETE Deletes a subkey
or value entry from the registry.
-
REG EXPORT Exports registry
data and writes it to a file.
Note
These files have the same format as files you export
from Registry Editor. Typically, however, they are saved with
the .hiv extension, so double-tapping or
double-clicking files with this extension won’t start Registry
Editor.
-
REG FLAGS Sets or queries
the flags on a registry key. Flags that can be associated with
keys include DONT_VIRTUALIZE, DONT_SILENT_FAIL, and
RECURSE_FLAG.
-
REG IMPORT Imports registry
data, and either creates new keys and value entries or
overwrites existing keys and value entries.
-
REG LOAD Loads a registry
hive file.
-
REG QUERY Lists the value
entries under a key and the names of subkeys (if any).
-
REG RESTORE Writes saved
subkeys and entries back to the registry.
-
REG SAVE Saves a copy of
specified subkeys and value entries to a file.
-
REG UNLOAD Unloads a
registry hive file.
You can learn the syntax for using each of these commands by
typing reg
followed by the name of the subcommand you want to
learn about and then /?. For example,
if you want to learn more about REG ADD, you type reg add /? at the command line.
