Backing Up and Restoring Registry Hives

You might need to restore backed-up versions of Registry hives. This can occur, for example, when a new computer replaces an old one, when a disk controller or hard disk becomes corrupted, or when an electrical failure erases large parts of a disk. This section describes how to back up and restore Registry hives.

How this restoration is done depends on what hardware is available and what file system is in use. You can, of course, restore only what you have backed up.

Important

Back up all important files, including system files, frequently and consistently.

Your regular backup routine should include using Disk Administrator to create an uncompressed backup of the System hive. (In Disk Administrator, from the Partition menu, click Configuration, then click Save.) Also, the Emergency Repair Disk includes a compressed version of the System hive. For details, see Disk Administrator Help, and Chapter 20 of this book, "Preparing for and Performing Recovery."

Backing Up Registry Hives

You can make a Registry hive backup in one of four ways:

• Use a tape drive and the Windows NT Backup program. To automatically include a copy of the local Registry files in the backup set, select the Backup Local Registry option in the Backup Information dialog box. This is the preferred method for creating backups if you have a tape drive.

• If you do not have a tape drive, use a utility that backs up the Registry, such as the Repair Disk Utility (Rdisk.exe), which is automatically installed when you install Windows NT. You can also use Regback.exe, a tool included on the Windows NT Workstation Resource Kit CD. For more information, see Repair Disk Utility Help or Rktools.hlp on the Windows NT Workstation Resource Kit CD.

• Use a different operating system to start the computer. Then copy all files in the Systemroot\System32\Config directory to a safe backup location. For example, use another instance of Windows NT if the Registry is stored on an NTFS partition, or use MS-DOS if the Registry is stored on a FAT partition.

• In Regedt32, use the Save Key command, which backs up Registry keys manually.

For each key immediately below HKEY_LOCAL_MACHINE and HKEY_USERS, click the key, and then, from the Registry menu, click Save Key. Choose filenames that match the key names. For example, save the System key to \Backdir\System.

Note

Volatile subkeys, that is, those created each time the system starts and deleted when it stops, cannot be saved. However, you can save the nonvolatile subkeys of volatile keys. For example, although the HKEY_LOCAL_MACHINE\Hardware key is volatile, you can save nonvolatile subkeys under that key.

Restoring Hives from Backup Files

If you have a good set of backup files, which you update regularly, you can restore Registry hives that are damaged or missing.

But you cannot use Registry Editor to fully restore hives, because you must use the ReplaceKey operation to restore active parts of the Registry. Registry Editor cannot perform this operation.

To restore a damaged system, you must first restore the basic operating system installation. To do this, you can use the Emergency Repair Disk to restore your system to its postinstallation status, or you can simply run Windows NT Setup again. If you rerun Setup, the system starts the computer but lacks changes made since you first set it up. You can recover most of those changes if you copy files from backups by using the Windows NT Backup program for tape backups or by copying from disk backups.

Tip

To update the Emergency Repair Disk after making changes that affect the Registry, use the Repair Disk Utility (Rdisk.exe), a tool included in Windows NT. If you use the rdisk command alone (no switches), it backs up the System and Software hives only. If you use rdisk /s, it backs up the SAM and Security hives as well. However, if the system includes many user accounts, the file might be too large to fit on the single floppy disk required for the Emergency Repair Disk update process.

However, you cannot merely copy the backups of Registry hive files, because those files are protected while Windows NT is running. So, after the system and all of the additional files such as device drivers are restored, you must restore the Registry. You can do this in one of the following ways, depending on which backup mechanism you used:

• For tape backups, you can use Windows NT Restore to restore the Registry.

• Start the computer by using an alternative instance of the operating system (or using MS-DOS if the system files are on a FAT partition). Copy the files to the Systemroot\System32\Config directory. Then restart the computer by using the regular operating system.

• Use Regrest.exe, a tool included on the Windows NT Workstation Resource Kit CD. Regrest replaces the default files installed by Windows NT Setup with data from backup files, and saves the default files under other filenames. To see the restored Registry, restart the computer after running Regrest.