I need to make changes on my registry without using the OS software, and need to do it with WINPE. However when WINPE is ready to work and I am trying to open regedit.exe it shows me only current OS information, actually the WINPE information.

So how to use WinPE as an offline registry editor?

Load the necessary registry hives:

  • in Registry Editor (regedit), select either HKEY_LOCAL_MACHINE or HKEY_USERS, then click File → Load Hive, open the hive file, and input a temporary name for it;

  • in command line, use reg load HKLM\temp-name path-to-hive
    or reg load HKU\temp‑name path-to-hive.

The hive files are located in:

  • most of HKEY_LOCAL_MACHINE corresponds to files in %SystemRoot%\system32\config:
    • HKLM\SAM – file SAM
    • HKLM\SECURITY – file SECURITY
    • HKLM\Software – file software
    • HKLM\SYSTEM – file system
    • the special "system" user's registry (e.g. login screen, etc.) – file default
  • each user's personal registry (i.e. their HKEY_CURRENT_USER) is located in file NTUSER.DAT in their profile directory (e.g. C:\Users\grawity\NTUSER.DAT);
    • however, HKCU\Software\Classes is stored in the file AppData\Local\Microsoft\Windows\UsrClass.dat.

A list of currently loaded hives is at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist.

  • what about HKEY_CLASSES_ROOT ? Can't we load it ? – Haplo Nov 3 '14 at 15:55
  • I found that HKCR is actually classes key under software hive. – Haplo Nov 3 '14 at 17:00
  • @Haplo: On Windows XP and later, it's a merged view of HKCU\Software\Classes and HKLM\Software\Classes. The former is a separate hive, the latter isn't. – grawity Nov 4 '14 at 5:32
  • 1
    You don't mention HKEY_USERS that contains default values for all users. I read it corresponds to NTUSER.dat, but not the one in the user directory. Is it correct? – FarO Nov 5 '15 at 9:26
  • 1
    @OlafM: Not quite. HKEY_USERS doesn't have any information by itself, all it has is sub-hives for each user. For example, HKU\S-1-5-21-…-1103 corresponds to C:\Users\grawity\ntuser.dat, and HKU\.default corresponds to C:\Windows\System32\config\DEFAULT. (Note that .default is not the default user and does not contain "default values for all users". It's actually the "system" user.) – grawity Nov 5 '15 at 9:40

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.