Technical Reference to the Registry: Related Resources

Maintaining functional backups of your registry is highly recommended. You should regularly back up your current, working registry, and it is critical to back it up before you edit your registry. One incorrect or conflicting value can create many problems, including preventing Windows 2000 from starting. Saving a backup of the registry on removable media or secure network shares can make your life much easier if an error prevents you from accessing files on your hard disk. You can reload saved registry files later by using registry-restoration tools such as RegRest.exe (included on the Windows 2000 Resource Kit companion CD) or by copying them back onto the system, if the system has been configured for multiple-boot.

If you foster good backup habits, editing your registry using the information in this Help file can be no more dangerous than making routine hardware changes to your system. To test your backup and restore skills after reading this document and Windows 2000 Help, perform a practice backup and restore on a non-critical system. This will increase your skill and confidence before you need to make changes to your registry.

When to Back up Your Registry

Before you make any changes directly to your registry, back it up. The registry editors bypass standard safeguards, allowing settings that can degrade performance, damage your system, or even require you to reinstall Windows 2000. Some settings are not compatible with others, forcing you to reload your original settings in order to restore your system's performance. Unless you have backed up the correct settings, restoring them can prove very diffucult, especially if you made other changes to your registry or if some changes are preventing you from restarting Windows 2000.

Back up your registry before you install new hardware or software or remove old hardware or software. This way, you can restore the system to its previous configuration if the changes conflict or degrade performance. To make your changes effective after restoring or changing the registry, restart your system.

How to Back up Your Registry

The greatest challenge to restoring a severely damaged registry from a backup is that Windows 2000 requires the registry to operate. The system constantly reads and writes to the registry, so without a functional registry to run Windows 2000, you cannot easily start up your registry-restore tools. The following details several methods of backing up and restoring your registry.


In the case of a failed registry where your system will not start, you can restore your system by using the Windows 2000 installation program. This is also the simplest method of restoring your registry. Do not actually reinstall the operating system; instead, use the installation program to repair the errors. You will need to configure your system to boot from your CD-ROM drive, and the Windows 2000 disk must be in that drive. When Setup offers you choices for how to proceed, select R for Repair a damaged Windows 2000 installation . In a multiple-boot system, be certain before continuing that Setup is repairing the damaged registry and not another installation.

Last Known Good

Choosing Last Known Good Configuration at startup provides a way to recover from problems such as adding an incorrect driver. It does not solve problems resulting from damaged or missing drivers or files. When you choose Last Known Good Configuration , Windows 2000 restores your registry to its state when you last successfully logged on to your computer, but it only restores information in HKLM\SYSTEM\CurrentControlSet. Any changes made in other parts of the registry remain in effect.

RegBack.exe and Regback.exe

A safe way to perform registry backup and restore is to use the Windows 2000 Server Resource Kit tools designed specifically for this purpose. RegRest.exe restores registry hive files from backups created by RegBack.exe. See the Windows 2000 Resource Kit Tools reference (w2rktool.chm) for documentation about using these tools. Read the notes about Regback for details on the tool's requirements and limitations. To use these tools, you must be logged on as a member of the Administrators group with full file privileges. Also, make sure the media onto which you are saving the registry files is large enough to contain them, because the tools do not warn you if the media has reached its capacity.

Recovery Console

The Windows 2000 Recovery Console is another good tool for repairing a damaged registry. To use the Recovery Console, you must install it from the Windows 2000 CD-ROM after installing the operating system. For information about installing and using the Recovery Console, read Windows 2000 Help.

Regedit.exe and Regedt32.exe

The Windows 2000 registry editors, Regedit.exe and Regedt32.exe, also have built-in backup and restore functions. For detailed information about these functions, read Help for Regedit.exe and Regedt32.exe. As with the Resource Kit tools, you must be logged on as a member of the Administrators group with full file privileges in order to backup and restore using a registry editor.

By using the Export Registry File or Save Key functions of the registry-editing tools, you can back up individual entries, subkeys, keys, or whole subtrees by saving parts of your registry as files on your computer, removable media, or network shares. You can then use any basic text editor to work with the registry files you create, but be careful to always save as basic text. Registry files are saved with .reg extensions. These registry backups can later be loaded into the registry by using the Import Registry File or Restore functions of Regedit.exe and Regedt32.exe.

Manually Copying Files

You can also manually restore your registry if you have configured your computer as a multiple-boot system. If you have formatted your hard disk with the FAT file system, you can multiple-boot using either MS-DOS or Windows 98 or earlier. If you formatted your hard disk with the NTFS file system, you can perform this procedure only by starting a second copy of Windows 2000.

To Manually Back up and Restore Your Registry on a Multiple-Boot System:

  1. While your registry is properly configured, copy the entire contents of the %systemroot%\System32\config folder onto removable media or a network share. Perform this procedure regularly, especially before making any edits to your registry or hardware changes to your system. Write down the actual path to the folder where this information is saved, because %systemroot% will not resolve to a different operating system's root.

  2. If this operating system becomes unstable or damaged, start the second operating system.

  3. Make a backup copy of the registry you believe to be damaged, and save it in another location. This will help later if you discover that your restored registry is also damaged.

  4. Copy the entire contents of the saved \System32\config folder (using the path you wrote down earlier) from the external media or network share back to that same folder of the damaged operating system. This will overwrite all registry configuration information prior to performing the procedure described above.

You can now restart the previously damaged operating system. Assuming you have not made any hardware or software changes since backing up these files, the registry will perform as it had when you made the backup.

Cc939136.caution(en-us,TechNet.10).gif Cautions

  • Maintain the highest possible security for the backup copy of your registry, especially if you are backing up a server's registry. The registry contains sensitive security and user information that a hacker could use to circumvent your network security or to damage your system. Use the same physical security as you use on your servers to make sure no one can access this information. If you are backing up to a network share, make sure that share is completely secure. Make sure the backup cannot be infected by a virus, so you can restore your system if the entire network becomes infected.

  • Restoring your registry to a previous state overwrites changes made since you performed the backup. These new changes become a permanent part of your configuration. To avoid losing other configuration information, back up the registry immediately before you intend to make changes.

  • If the affected computer is connected to a network, network policy settings might prevent you from using registry backup and restore tools on that system.

  • Never restore only one registry file from a backup copy. Doing so could introduce incompatibility with other registry entries. Always restore the entire registry.

  • If you are planning on removing hardware or software, you must uninstall these components before backing up your registry. Otherwise you will introduce new errors when you restore those settings. This is especially important if your system contains problematic components.

  • If you perform a manual backup as described in the procedure above, you will encounter trouble if the backed-up registry does not contain information about any new hardware or software.

  • On computers running Windows NT 4.0 or Windows 2000, you should also update your Emergency Repair Disk (ERD) when performing a backup.

  • Note that you might see a Licensing Violation error while restoring a backup copy of your registry or afterward. This error will not stop the restored installation of Windows 2000 from operating.

Where to Find the Registry Hive Files

The permanent parts of the registry are stored as a set of files (called hives) that should never be directly edited. You can also find a list of locations for these hives in the hivelist entry in HKLM\SYSTEM\CurrentControlSet\Control. The following hives, which store four of the five registry keys in HKEY_LOCAL_MACHINE, are permanently saved (and updated with each logon) in %systemroot%\System32\config:

  • SAM: Contains information about the Security Accounts Manager service which is stored in the SAM key.

  • SECURITY: Contains the security information stored in the SECURITY key.

  • SOFTWARE: Contains information about your software configuration which is stored in the SOFTWARE key.

  • SYSTEM: Contains information about your system configuration which is stored in the SYSTEM key.

  • DEFAULT: Contains the default system information.

The HARDWARE key is not stored as a hive, because it is recreated each time the system starts.

Backups of these hives are kept in %systemroot%\repair, which the Windows 2000 installation program uses to repair a damaged registry by restoring an earlier backup.