Loading Hives from Another Computer

You can use the Load Hive and Unload Hive commands in Registry Editor to display and maintain another computer's Registry without viewing it remotely. You might want to do this to view specific values or to repair certain entries for a computer that is not configured properly or cannot connect to the network.

The hives that make up your computer's Registry are loaded automatically when you start the computer, and you can view the content of these hives in Registry Editor. If you want to view or change the contents of other hive files, you must use the Load Hive command to display its contents in Registry Editor.

The following examples use the Load Hive command:

• Repairing a hive on a computer that temporarily cannot run Windows NT. For details, see "Backing Up and Restoring Registry Hives," later in this chapter.
• Looking at or repairing hives for profiles of people who aren't currently logged on, either on the same computer or a remote PC. For details and examples, see "Managing User Profiles Through the Registry" in Chapter 12, "Configuration Management and the Registry."
• Creating a custom LastKnownGood and other startup controls. For details and examples, see "Making Sure the System Always Starts" in Chapter 12, "Configuration Management and the Registry."

The Load Hive and Unload Hive commands affect only the Registry windows that display HKEY_USERS and HKEY_LOCAL_MACHINE. To use these commands, you must have Restore and Backup privileges, which you have if you are logged on as a member of the Administrators group. The Load Hive command is available only when HKEY_USERS or HKEY_LOCAL_MACHINE is selected. The Unload Hive command is available only when a subkey of one of these handles is selected.

To load a hive into the Registry Editor

1. Select the HKEY_LOCAL_MACHINE or HKEY_USERS root.
2. From the Registry menu, choose the Load Hive command.
3. Use the File Name, Drives, and Directories boxes and the Network button of the Load Hive dialog box to select the file that contains the hive you want to load, and then choose the OK button.

   If you are loading a hive on a remote computer, the drive and path in the filename is relative to the remote computer.

Tip You can find the directory location and names of hives on a computer in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Hivelist.

This file must have been created with the Save Key command (as described later in this chapter), or it must be one of the default hives. Under the FAT file system, the filename cannot have an extension.

If you are unable to connect to another computer over the network, you can load a hive file that you copied to a floppy disk.

4. In the second Load Hive dialog box, type the name you want to use for the key where the hive will be loaded, and then choose the OK button.

   This name creates a new subkey in the Registry. You can specify any name using any characters and including blank spaces. You cannot load to an existing key.

Data from the loaded hive appears as a new subkey under HKEY_USERS or HKEY_LOCAL_MACHINE (whichever handle you selected before loading the hive). A loaded hive remains in the system until it is unloaded.

The Load Hive command creates a new hive in the memory space of the Registry and uses the specified file as the backing hive file (filename.LOG) for it. The specified file is held open, but nothing is copied to the file unless the information in a key or value entry is changed. Likewise, the Unload Hive command does not copy or create anything; it merely unloads a loaded hive.

To unload a hive from the Registry Editor

• Select the key that represents a hive that you previously loaded, and then from the Registry menu, choose the Unload Hive command.

  The selected key is removed from the window and is no longer actively available to the system or for editing in Registry Editor.

You cannot unload a hive that was loaded by the system. Also, you won't be able to unload a hive that contains an open key.