How to modify a computer's offline registry from WINPE?
I need to make changes on my registry without using the OS software, and need to do it with WINPE. However when WINPE is ready to work and I am trying to open regedit.exe it shows me only current OS information, actually the WINPE information.
So how to use WinPE as an offline registry editor?
Load the necessary registry hives:
in Registry Editor (
regedit
), select either HKEY_LOCAL_MACHINE or HKEY_USERS, then click File → Load Hive, open the hive file, and input a temporary name for it;in command line, use
reg load HKLM\temp-name path-to-hive
orreg load HKU\temp‑name path-to-hive
.
The hive files are located in:
- most of
HKEY_LOCAL_MACHINE
corresponds to files in%SystemRoot%\system32\config
:-
HKLM\SAM
– fileSAM
-
HKLM\SECURITY
– fileSECURITY
-
HKLM\Software
– filesoftware
-
HKLM\SYSTEM
– filesystem
- the special "system" user's registry (e.g. login screen, etc.) – file
default
-
- each user's personal registry (i.e. their
HKEY_CURRENT_USER
) is located in fileNTUSER.DAT
in their profile directory (e.g.C:\Users\grawity\NTUSER.DAT
);- however,
HKCU\Software\Classes
is stored in the fileAppData\Local\Microsoft\Windows\UsrClass.dat
.
- however,
A list of currently loaded hives is at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist
.