2

Ok I want to edit an offline registry entry from WinPE, if I am booted into the OS (32bit) the reg key is:

hklm\system\currentcontrolset\services\mountmgr\noautomount

So I boot into WinPE and run my batch file to do these commands: (Tried on 32bit and 64bit)

Echo Loading Regestry Hive
reg Load HKLM\temphive H:\Windows\System32\config\SYSTEM
pause
Echo Import the reg
reg add "HKLM\temphive\system\CurrentControlSet\Services\MountMgr" /v "NoAutoMount" /t REG_SZ /d 0x1
Reg IMPORT z:\Restore\NoAutoMount.reg
regedt32 /s z:\Restore\NoAutoMount.reg /reg:64
Pause
Echo Query the key
reg query HKLM\System\CurrentControlSet\Services\MountMgr /s
pause
Echo Unload Registry Hive

reg unload HKLM\temphive

Registry file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mountmgr]
"DisplayName"="@%SystemRoot%\\system32\\drivers\\mountmgr.sys,-100"
"Group"="System Bus Extender"
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,6d,00,6f,00,75,00,6e,00,74,00,6d,\
00,67,00,72,00,2e,00,73,00,79,00,73,00,00,00
"Description"="@%SystemRoot%\\system32\\drivers\\mountmgr.sys,-101"
"ErrorControl"=dword:00000003
"Start"=dword:00000000
"Type"=dword:00000001
"NoAutoMount"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mountmgr\Enum]
"0"="Root\\LEGACY_MOUNTMGR\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Now if I boot to the OS and set this registry entry it works, but if I try to update it ofline it does not. I know if I load

HKLM\temphive

That's what I need to edit right? But if I do then boot into windows the registry key is not there. What am I doing wrong? and would it be different for 64bit over 32bit?

0

When you load a hive using reg load it loads that file into the key specified on the command line, in this case HKLM\temphive. So you should be adding the key to a descendant of HKLM\temphive, such as:

Reg ADD HKLM\temphive\system\CurrentControlSet\Services\MountMgr /v NoAutoMount /t REG_SZ /d 0x1

And the quote from the relevant help info (reg load /?):

REG LOAD HKLM\TempHive TempHive.hiv
  Loads the file TempHive.hiv to the Key HKLM\TempHive

  • I tried that, did not work. =/ – Claude Garlick Nov 2 '14 at 6:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.