Edit Offline Registry

Regedit: Shows the starting screen when you open regedit tool the first time

Sometimes, editing the registry while the computer is on, is not an option. There can be many reason for this, such as:

  • Computer wont boot
  • Registry tweak in an Image that you created
  • Changing the default profile registry

I have found myself using it very often for different reasons. Let’s jump in on how to do it:

  1. Open Regedit as you normally would on a working Windows machine
  2. If you are trying to edit a system reg, them click on the HKEY_LOCAL_MACHINE, or a user reg, click on HKEY_USERS. (You must perform this step or you will not get the correct option.

    Regedit: Shows the "HKEY_USERS" hive selected
    Regedit: Shows the “HKEY_USERS” hive selected
  3. Click File then Load Hive

    Regedit: Shows the "Load Hive" option selected
    Regedit: Shows the “Load Hive” option selected
  4. Locate the registry file you are trying to work with (Will make another blog post for common locations)
  5. A box stating Key Name will pull up. Put anything you want it there (this is a temp name). If you are wanting to run a reg script on the hive, then name it what you find in the file. For example, if its HKEY_USER\temp\Printers\Connections, then you want to use “temp” as the key name.

    Regedit: Shows entering the temporary Key Name
    Regedit: Shows entering the temporary Key Name
  6. You can now find the hive you just loaded under the respective folder you clicked on in step 2.

    Regedit: Shows hive loaded as "temp name"
    Regedit: Shows hive loaded as “temp name”
  7. When you are done making your changes, you MUST click File –> Unload Hive to save changes and dismount the hive properly.

You have now made your changes and saved your hive. Be sure to always test and create backups in case something gets corrupted!

 

Why did you need to edit the registry offline? Let me know in the comments!

Common Registry Hive Locations

Regedit: Shows the starting screen when you open regedit tool the first time

From time to time, I found myself needing to know weird things – such as where a certain registry hive is located so I can edit the hive offline. I decided to finally make a list of where to find these registry hives.

  • Default User: C:\Users\default\NTUSER.DAT
  • User: C:\Users\{username}\NTUSER.DAT
  • System: C:\Windows\System32\config\SYSTEM
  • Software: C:\Windows\System32\config\SOFTWARE
  • Security: C:\Windows\System32\config\SECURITY
  • Drivers: C:\Windows\System32\config\DRIVERS

Interesting fact that I found is that the registry actually has a list of all the hives on that machine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist

Please keep in mind that editing any of these files can permanently your Windows installation and to use caution!