Backing Up and Restoring Registry Hives

You might at some time find it necessary to restore backed up versions of Registry hives. This might occur, for example, when a new computer is to replace an old one, when a disk controller or hard disk has gone bad, or when an electrical failure erased large parts of a disk. This section describes how to back up and restore Registry hives.

How this restoration is done depends on what hardware is available and what file system is in use. You can, of course, only restore what you have backed up.

Important

Make frequent and consistent backup sets of all important files, including system files.

Your regular backup routine should include using the Configuration Save command in Disk Administrator to maintain an up-to-date Emergency Repair disk for restoring the Windows NT system. For details, see Chapter 18, "Disk Administrator" in the Windows NT System Guide.

Backing Up Registry Hives

You might make a Registry hive backup in one of four ways:

• Using a tape drive and the Windows NT Backup program, and select the Backup Local Registry option in the Backup Information dialog box to automatically include a copy of the local Registry files in the backup set. This is the preferred method for creating backups if you have a tape drive. For details, see Chapter 16, "Backup", in the Windows NT System Guide.
• If you don't have a tape drive, run the REGBACK.EXE or REPAIR.EXE program from the Resource Guide disk, or use another tool that uses the same techniques to back up Registry files.
• Start the computer using a different operating system. Then copy all files in the SystemRoot\SYSTEM32\CONFIG directory to a safe backup location. For example, use another instance of Windows NT if the Registry is stored on an NTFS partition, or use MS-DOS if the Registry is stored on a FAT partition.
• Use the Save Key command in Registry Editor, which essentially performs t he RegBack procedure manually.

  To do this, for each direct subkey of HKEY_LOCAL_MACHINE and HKEY_USERS, you must choose the Save Key command from the Registry menu, specifying filenames that match the key names. For example, save the SYSTEM key to \BACKDIR\SYSTEM. On the FAT file system, the filename should not have an extension.

  Don't use Save Key with the Hardware hive, which is volatile. You won't get any data, because Save Key cannot save volatile keys to disk.

Restoring Hives from Backup Files

If you have a good set of backup files, which you update regularly, you can restore Registry hives that are damaged or missing.

But you cannot use Registry Editor to fully restore hives, because active parts of the Registry require use of the ReplaceKey operation for restoration, which Registry Editor cannot perform.

To restore a damaged system, you must first restore the basic operating system installation. You might do this by using the Emergency Repair disk to restore your system to what it looked like just after installation, or simply run Windows NT Setup again. Such a restoration results in a system that starts the computer (which is good) but that lacks changes made since you first set it up (which isn't good). Most of those changes are recovered by copying files from backups by using the Windows NT Backup program for tape backups or by copying from disk backups.

However, you cannot merely copy the backups of Registry hive files, because those files are protected while Windows NT is running. So, after the system and all of the additional files such as device drivers are restored, you must restore the Registry. You might do this in one of the following ways, depending on which backup mechanism you used:

• For tape backups, you can use the Windows NT Restore program to restore the Registry. Then restart the computer. For details, see Chapter 14, "Backup," in the Windows NT System Guide.
• Start the computer using an alternate instance of the operating system (or using MS-DOS if the system files are on a FAT partition). Copy back the files to the SystemRoot\SYSTEM32\CONFIG directory. Then restart the computer using the regular operating system.
• Use the REPAIR.EXE program from the Resource Guide disk.
• Use the REGREST.EXE program from the Resource Guide disk. The RegRest program performs a ReplaceKey operation, which swaps backup files for the default files that the Emergency Repair or Windows NT Setup programs installed, and saves the default files under other filenames. Restart the computer after running the RegRest program to see the restored Registry.