1

I'm in a computer tech class where everyone is working towards CompTIA A+ certification. After discussing troubleshooting problems in Windows, we were turned loose and given the opportunity to break (and ideally fix) one of the designated computers just to see what happens and whether we could find a way to recover or if we have to eventually install a new copy of Windows 7 on top of the old one.

By the way, we are fully encouraged to seek help online and from any resource for everything other than exams, so I'm not cheating here. I'm learning! :)

So my team when into regedit (GUI) and exported the entire registry as a .reg file and saved it on a USB drive. I then deleted an entire hive: HKEY_LOCAL_MACHINE. Not surprisingly, the system froze, so we restarted it manually.

Again, it's Windows 7. We have a clean copy of Windows 7 on a bootable USB, so we are able to access WinRE.

No luck from: Last Known Good Configuration; Startup Repair; there was no Restore Point available; CCleaner portable (it said it repaired 73 things, but the next bootup sent us back to Startup Repair, to no avail).

We have the .reg file (we did not backup any registry files in the config folder), and we are able to use the command prompt in WinRE. Is there a way to use the recovery command prompt to import the .reg file back into regedit?

Or any other method or third-party utility that might recover/rebuild/import the registry?

I feel like we've spent a lot of time looking for solutions, but not much time actually attempting solutions because we don't know what to try next.

Any suggestions or insight (even just tips or explanations on why our approach so far is flawed) is greatly appreciated.

Full disclosure: I don't have access to the machine on the weekend, so I won't have a chance to try any suggestion until class resumes. I will report back in order to help (or amuse) others based on my experience.

If I were doing things to the registry in real life, I would create a full backup, create a restore point, backup the registry files in the config folder as well as export the .reg file. For this exercise, we were intentionally being the unwitting user, so we didn't concern ourselves with finding a safe way to go about it; we wanted to see what would happen if we only made a .reg file. Ta-da! The answer so far is: nothing good.

Thanks all!


UPDATE 1: I thought I deleted the full HKLM, but a teammate recalled we weren't able to do so and instead deleted just the System subkey within HKLM. This bears out, now that we are able to access the regedit on the hard drive. Still, the same issue remains.

Is there a way to extract just part of a .reg file? Maybe if we could get just the HKLM System subkey, we could import that since it wouldn't be trying to overwrite the rest of the registry.

Or is there a third-party tool that can merge a .reg file into the registry? I've been looking, but only find tools to create .reg files and then use the regedit to import, which we've tried but can't accomplish.


UPDATE 2: Today, we attempted the following, to no avail:

-Used a working Windows 7 computer to open the regedit and exported a hive file for the System subkey and saved it on a USB drive.

-Used the recovery command prompt on the broken PC to open a temporary regedit (not the real one for the hard drive), and used Import just to navigate in File Explorer. We copied the hive file (use the name SYSTEMhome just so it would be unique) from a USB drive to the hard drive's Windows/System32/config folder.

-Returned to the temporary regedit, selected HKLM, and loaded SYSTEMhome as a hive.

-Exported the temporary regedit's SYSTEM hive and saved it to the hard drive's Windows/System32/config folder.

-Returned to the temporary regedit, selected the SYSTEMhome hive inside the HKLM key, and Imported the SYSTEM hive from the config folder. This produced a warning that it would overwrite the SYSTEMhome subkey, and we said OK. This resulted in a kind of merger of the information within the temp regedit's SYSTEM subkey with the SYSTEMhome subkey we added, without affecting the SYSTEM subkey still listed in the regedit.

-Unloaded the SYSTEMhome subkey so that the merged hive file saved to the hard drive's config folder, and the temporary regedit was left as we found it.

-Used the Import function to access File Explorer in order to delete the original SYSTEM hive file we exported from the temporary regedit.

-Renamed the newly “merged” SYSTEMhome hive file to SYSTEM, so that Windows would recognize it as a registry file.

-Restarted the computer, hoping the system would see the SYSTEM hive file and be able to boot.

No luck. Any more ideas out there?

Can you load a .reg file into a hive (at the same level as SYSTEM, SOFTWARE, etc.) so that it stands on its own instead of merging into an existing hive (or is there some way to create an empty hive that doesn't involve scripting in Power Shell, so that we could import the .reg file into that)? The native partitioning on the broken PC is different than that of the good Windows 7 PC on which we created the SYSTEM hive file, so we’re wondering if that partition numbering is interfering in the boot efforts. We can edit it as .reg, but then don’t have a way to convert it back to .reg.

  • I believe that it is possible to do this sort of thing if you boot Windows from a secondary device (e.g., a USB drive), but I’m unsure of the details.  Can you run the regedit (GUI) program from your secondary boot?  There are a couple of “Hive” commands in the “File” menu; I suspect that they’ll be useful. – Scott Nov 5 '17 at 1:07
  • When booting with the USB, we can either do a fresh install or launch the Recovery Environment. I just assumed we couldn't access the GUI regedit in the RE, but we didn't actually try typing regedit.exe in the RE command prompt to see. I'll put that down as something to attempt; if that works, we'd be able to attempt several solutions we've researched. – jls Nov 5 '17 at 1:16
0

According to this Microsoft support forum thread:

  • You can run Regedit from the Windows Recovery Environment's command prompt
  • When you start Regedit, it loads a temporary Registry, not the one from the on-disk installation of Windows (meaning it won't puke due to the damaged HKLM branch)

If that's the case, you should be able to use Regedit to re-import the .REG file export you made of the HKLM branch. Because the "temporary" Registry is loaded by default, you'll probably need to "load" the correct HKLM registry file from the C:\Windows\System32\Config folder.

  • We succeeded in copying our .reg folder from the thumb drive to the hard drive, and for reasons that aren't clear to me, this has allowed us to access the recovery environment from the hard drive rather than needing the thumb drive. From there, Startup Repair still failed, and the only other tool available is the Command Prompt (5 tools are listed, but say the tool is unavailable). We opened regedit, which is for the actual hard drive this time. However, when we tried to import the .reg file, it says that it cannot access the registry. – jls Nov 6 '17 at 15:58
0

Have you looked into the C:\Windows\System32\config\regback directory? There should be a backup of registry files there.

You can find directions here.

  • The regback files are blank (0). I assume this is because System Restore was not on. – jls Nov 6 '17 at 15:52
  • They could be of zero length because they're open - often a Windows file that hasn't been flushed can reflect a zero-byte length. The RegBack files should be created regardless of the System Restore configuration. Boot to your external OS and see if they have a non-zero length. – David W Nov 7 '17 at 20:46
  • The external OS is the only way we can get into the recovery environment, so that's how we checked the Regback files and found zero length. – jls Nov 8 '17 at 2:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.