6

So, as you probably know, the registry hive HKEY_LOCAL_MACHINE\BCD00000000 is actually the system BCD store; it's the same information you see when you run the BCDEDIT command (as an Administrator).

However, if I try running regedit as an Administrator and manually editing any of the values in there, you get the error Cannot edit <value_name>: Error writing the value's new contents. Similarly, if the Windows API function RegSetValueEx tries changing values in this subkey, even when in an application that is running as an Administrator, it will also fail.

Yet, the BCDEDIT command can insert, update and delete items from this store without issues and the changes will show up in the registry as well.

What's the difference between what BCDEDIT does and manually editing the registry?

4 Answers 4

6

In a word: permissions.

To elaborate…

Location

The BCD is stored on the boot drive (usually a ~100MB NTFS volume). It is hidden by default, but you can assign a drive-letter to it with the Disk Management MMC snap-in (diskmgmt.msc). Then you can look in the Boot directory and see the file BCD which is a regular registry-hive–format file that contains the boot configuration data.

Rationale

Obviously boot data is very sensitive and is the first line of failure. Messing up system files can be fixed with relative ease, but that requires something to run to do the repairs. If the boot files are messed up, then nothing will run, and it’s lights out. (Well it’s still fixable, but not automatically; it will require purposeful, manual intervention like using a boot- or install-disc.)

Since boot data is critical, Windows doesn’t make it easy to mess around in there. Using the registry editor to directly edit the boot data would make it possible to set invalid or conflicting values, add invalid or illegal entires, remove mandatory entries, etc. Limiting the modification of the BCD to bcdedit allows it restrict the changes to valid values which helps to limit the damage that can be done (it doesn’t completely eliminate problems; you can still kill a system, but at least it cuts out a big chunk of possible problems).

Method

If you examine the permissions of the BCD00000000 branch, you’ll see that it has Full Control set for the SYSTEM account, but the administrators group has Special permissions which is just Read-Only plus WriteDac which grants the ability to set permissions. (You may need to click the [Advanced] button because the basic dialog indicates that SYSTEM has Special access as well, but the Advanced Security Settings dialog shows it correctly set to Full Control.)

When you run Regedit (which requires elevated privileges), it runs under the context of your user-account and gets the administrator-group permissions, thus you cannot write to it. When you use the bcdedit command, it runs under the SYSTEM account context which has write permissions. If you enable the User Name column in the Task Manager, you can see that Regedit is run by your user account and bcdedit is run by SYSTEM.

Work-arounds

It is inadvisable to directly edit the BCD with Regedit and rarely necessary, but if you really must, then one way is to grant yourself write access to the BCD00000000 branch. Of course that is not recommended because you need to remember to revoke the permission later. An easier way is to simply run Regedit under the SYSTEM context.

1
  • 1
    Oh man, I typed this up last night, but just before I clicked [Post], SNL started and I got distracted. I almost shutdown for bed before clicking posting. ಠ_ಠ
    – Synetech
    Oct 6, 2013 at 6:00
3

@Synetech suggested work-around are good. Especially, one with runas system. But I want to suggest one simple way to edit.

  1. Unload BCD00000000 hive. You can do that, because it is only needed during boot. (Select it -> File -> Unload Hive...)
  2. Load BCD file from disk as a registry hive. (If you can't find that file, assign drive letter for volume.)
  3. Edit it simply.

You don't even need to load it again. However, it is recommended to make BCD file backup copy and reboot after edits.

2
  • Item 3 says "Edit it simply" - do you mean editing a device element is simple? Even changing c: to d: is far from simple(there is no c: stored in bcd registry but disk and partition signature)
    – snayob
    Apr 29, 2016 at 22:37
  • @snayob I don't say correctly edit is simple, I mean this way allows editing this key without any third party tools, if someone ever want this.
    – ST3
    May 2, 2016 at 6:13
1

Use Regedit to look at the permissions. Notice that by default Administrators do not have write access to that key or subkeys. It would seem that Administrators DO have permission to modify the DAC, i.e. permissions, so you might try that.

1
  • 1
    Fair enough, but my main question was, what does bcdedit.exe do that allows it to bypass the registry permissions and edit the BCD store anyway? Oct 6, 2013 at 5:18
1

Direct editing the BCD00000000 branch with a registry editor is not advisable.

Under this branch you have a copy of the "System BCD" which is a protected system file.

The system keeps the "System BCD" file and the registry branch BCD00000000 in sync.

The BCD has some structure - a collection of objects, where each object has again its structure (list of elements).

Most of the elements are simple strings or numbers(integers, hexadecimals). But some integers are enumerations and depend on context (!).

Some elements can be again objects with complex structure like device elements for a VHD device for example.

For editing every element or object of BCD you use either the command line tool "bcdedit" or you can use "Visual BCD Editor" - a complete GUI BCD editor.

Visual BCD Editor uses the BCD WMI Provider Interface for BCD access (an API for BCD access).

On UEFI systems the things are even more complex - the BCD mirrors part of NVRAM too - so we have a synchronization of three "places":

  1. NVRAM (part of it)

  2. BCD on EFI System Partition

  3. HKLM\BCD00000000 branch of registry

Microsoft documentation says that that are only two "legal" ways for editing the BCD:

  1. using bcdedit (through single commands or scripting it)

  2. using BCD WMI Provider interface (programmatic way of editing)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .