Loading Hives from a Remote Computer

An alternative to viewing another computer's Registry remotely is to save copies of the other computer's Registry hives and then load them into Regedt32 on your computer. You can use this method to view and change the keys and subkeys of the HKEY_LOCAL_MACHINE and HKEY_USERS hives of another computer's Registry. This enables you to investigate and repair the Registry values and value entries of a computer that is not configured properly or cannot connect to the network.

The subtrees of your computer's Registry are loaded automatically when you start the computer, and you can view its contents in a Registry editor. To view or change the contents of another computer's Registry, you must load a saved copy of all or part of its hive.

You might load the hive of another computer's Registry for the following reasons:

• To view or repair a hive on a computer that temporarily cannot run Windows NT. For details, see "Backing Up and Restoring Registry Hives," later in this chapter.

• To view or repair the profiles of users who aren't currently logged on to a computer. For details and examples, see "Managing User Profiles Through the Registry" in Chapter 25, "Configuration Management and the Registry."
• To view or repair a hive of a computer that is not connected to the network. Save a copy of its hive on a floppy disk, then load it into Regedt32 on another computer.

• To create a custom version of the LastKnownGood control set and other startup controls. For details and examples, see "Making Sure the System Always Starts" in Chapter 25, "Configuration Management and the Registry."

Please note the following rules when loading a hive from another computer's Registry by using Regedt32:

• Before you can load a hive, you must save it as a file by using the Save Key command in Regedt32 (described later in this chapter). You can also load another computer's system hive files—those that Windows NT creates for its own use—but only while Windows NT is not running on that computer. By default, the system's hive files are stored in Systemroot\System32\Config and Systemroot\Profiles.
• You can load only the keys and subkeys of HKEY_LOCAL_MACHINE and HKEY_USERS. Also, you can neither save nor load keys and subkeys that are volatile, that is, those that are created each time the system starts and deleted when the system stops. (You can save nonvolatile keys in volatile hives. For example, although the HKEY_LOCAL_MACHINE\Hardware key is volatile, you can save nonvolatile subkeys under that key.)
• To load or unload a hive, you must log on to the computer as Administrator or as a member of the Administrator group, and you must have Restore and Backup permissions.
• The Load Hive command is enabled only when the HKEY_USERS or HKEY_LOCAL_MACHINE subtree is selected in Regedt32. The Unload Hive command is enabled only when the root (highest key) of a loaded hive is selected.

Note

Versions of Windows NT previous to version 4.0 did not allow you to load hive files that had filename extensions. This restriction does not apply to Windows NT 4.0.

If you are unable to connect to another computer over the network, you can load a hive file from a floppy disk.

To load a hive file into Regedt32

1. In Regedt32, click the HKEY_LOCAL_MACHINE or HKEY_USERS subtree window.

2. From the Registry menu, click Load Hive.
The Load Hive dialog box appears. This is a Windows NT Explorer dialog box that lists the drives of the local computer and represents all computers connected to the local computer.

3. Locate the saved hive file and double-click its entry.

Note

When locating a hive file on a remote computer, use a path relative to the remote computer, not to the local computer. For example, if you are using your G: drive to connect to \\Text01\Public to save Hive.tst, enter \\Text01\Public\Hive.tst, not G:\Hive.tst. The G:\Hive.tst entry directs Regedt32 to look for the file on the G: drive of the remote computer, not the G: drive of the local computer.

4. In the second Load Hive dialog box, type the name you want to use for the key where the hive will be loaded, then click OK.

This names a new subkey in the selected subtree. You can specify any name that is not being used for another file or another key in the Registry.

Data from the loaded hive appears as a new subkey in the subtree selected when you loaded the hive file. A loaded hive remains in the system until you unload it.

The Load Hive command creates a new hive in the memory space of the Registry and uses the specified file as the backing hive file (Filename.log) for it. The specified file is held open, but nothing is copied to the file unless the information in a key or value entry is changed. Likewise, the Unload Hive command does not copy or create anything; it merely unloads a loaded hive.

To unload a hive from Regedt32

· Select the root (top) key of the hive you want to unload. From the Registry menu, click Unload Hive.

The connection is ended and the selected key is removed from Regedt32.

Note You cannot unload a hive that was loaded by the system. Also, you cannot unload a hive if an application has an open handle to any subkey in the hive. (A handle is a means for controlling access to objects in the system.) However, there is no way to detect whether an application has an open handle to a key.

If an attempt to use the Unload Hive command fails, close all applications not in immediate use and try again.