Open Windows registry offline
The Windows Registry is a central database of Windows settings. The registry consists of several files (=hives). With exception to the user-specific settings the Windows Registry files are under: %Systemroot%\System32\config (thus usually under: c:\windows\system32\config).
Open Windows Registry
The registry can be opened using the command "regedit" in the search box
Hives of the registry
The HKEY_LOCAL_MACHINE (HKLM) hive contains computer specific settings.
HKLM consists of the following files:
| File in the file system | Branch in the registry: |
| %Systemroot%\System32\config\SAM | HKEY_LOCAL_MACHINE\SAM |
| %Systemroot%\System32\config\SECURITY | HKEY_LOCAL_MACHINE\SECURITY |
| %Systemroot%\System32\config\SOFTWARE | HKEY_LOCAL_MACHINE\SOFTWARE |
| %Systemroot%\System32\config\SYSTEM | HKEY_LOCAL_MACHINE\SYSTEM |
| %Systemroot%\System32\config\DEFAULT | HKEY_USERS\DEFAULT |
HKEY_CURRENT_USER (HKCU)
HKCU contains settings for the currently logged on user and is located in the following file in the file system: %Userprofile%\ntuser.dat
Hive in the registry: HKEY_CURRENT_USER
HKEY_USERS (HKU)
HKU contains settings for all users who have logged on to the computer once.
Database files: the respective ntuser.dat of the user profiles, and for the branch HKEY_USERS\Default the corresponding file: %Systemroot%\System32\config\DEFAULT
HKEY_CLASSES_ROOT (HKCR)
contains, for example, the mapping of file extensions to programs, context menus, class identifiers, and Windows mappings
This key is stored in HKEY_LOCAL_MACHINE and in HKEY_CURRENT_USER and therefore does not have its own database file.
HKEY_LOCAL_MACHINE\Software\Classes contains settings for all users
HKEY_CURRENT_USER\Software\Classes contains settings that override the settings for all users and apply only to the interactive user.
HKEY_CLASSES_ROOT combines information from both sources.
HKEY_CURRENT_CONFIG
Information about the hardware profile that the computer uses at startup (=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current) also does not have its own database file.
Open Windows registry offline
to load the Windows registry from a non-booted operating system (for example a 2nd Windows installation on another drive letter, using BartPE, backup files of the registry, ...)reg load HKLM\myofflineReg PathtoRegistrationFile
then use regedit to edit the registry
(located using the example under: HKLM\myofflineReg )
to save:reg unload
({{pro_count}})
{{percentage}} % positive
({{con_count}})
THANK YOU for your review!
Top articles in this section
When cloning a large hard disk to a smaller one, I lost the recovery partition. So far not bad, Windows works without recovery partition, but in case of an error the partition helps to get the PC up and running again. To summarize, here's how it works with the recovery partition: As long as the partition is still there, it can be deactivated and written to a file. If the partition gets lost unexpectedly, it can be recovered from the Windows setup media. This post is also available as a video, se...
Build means the kernel version of Windows. How current the Windows 10 or Windows 11 installation is, can be seen by the build number used.
Anyone who frequently creates scripts or analyzes log files and handles different versions can compare them very quickly with the help of the right editor.
