Autoruns: Trying To Analyze Offline On Non-bootable Dive

Question

I mistakenly disabled several registry entries and now my drive is non-bootable (MY BAD). I can connect the non-bootable drive as E:.

Where does Autoruns store the disabled entries? I searched throughout E: and didn't find any folder or file with the name AutorunsDisabled. I searched for AutorunsDisabled through the hives in E:\Windows\system32\config\SOFTWARE & SYSTEM, and found some folders and keys with that name. Sometimes it's a folder, sometimes it's a key with value 2 or 3. Are they the ones to restore?

If I can find the entries I disabled, then presumably, I can put them back via RegEdit by loading the hives found in E:\Windows\system32\config\SOFTWARE and SYSTEM, and restoring the disabled entries. Does that sound right?

Also, I was thinking that Autoruns might be able to simplify that task.

When I try to run Analyze Offline System, I point Autoruns to E:\Windows and the User Profile to E:\Users\admin, but it responds with "Error scanning offline system". Is there someplace to look for more detailed info about this error, or am I using the wrong directories?Thanks in advance for any help you can provide!

Autoruns v14.11

Answer 1

Hello

Thank you for posting in Q&A forum.

Knowing registry path is simple way to fix your issue.

If you are using Autoruns to disable the registry, you can use the same way to enable it. if don't have, you can check if you ever manually save it, then you can see this file by click save button

If you delete this registry which relate with some software, you can try to reinstall this software to see if registry will be reset.

If this registry relates with some settings. normally you can search which registry control this setting to find this out.

USB Device Registry Entries - Windows drivers | Microsoft Learn

Best regards

Yanhong

=====================================

If the answer is helpful, please click "Accept answer" and upvote it