JSI Tip 0182 - Off-line Registry editing.

If you have an alternate install of Windows NT, you can use Regedt32.exe to edit a non-active instance of Windows NT. Boot to any instance of Windows NT and use regedt32 to highlight HKEY_LOCAL_MACHINE. On the Registry menu, Load Hive to invoke a standard file open dialogue box. If you want to modify something in HKEY_LOCAL_MACHINE\SYSTEM, you would navigate to the OriginalNTInstall\System32\config directory and open the SYSTEM file. When prompted for a name, use anything such as oldsystem. The HKEY_LOCAL_MACHINE window will list the following hives:

HARDWARE
oldsystem
SAM
SECURITY
SOFTWARE
SYSTEM

Double-click on oldsystem, and go down to the Select key. Take note of the number associated with Default: REG_DWORD: This corresponds to the Control Set which will be used to start the system on the other install. This means that instead of modifying something under CurrentControlSet (which doesn't exist when you've loaded a hive from another install), you would use ControlSet00x where x is from the Select key Default:.

You may now edit anything you want in this ControlSet. Changes are instantly written to disk. When you have finished, highlight oldsystem and select Unload Hive from the Registry menu.


Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish