Windows Registry

[Cider]

Hi Guys,

Exported a full XP machines registry and would like to read it now in the native way (click, expand, etc) but I am stumped, how can I do this? I can open it up in notepad++ but it does "lag" somewhat trying to render all the text.

Any hits appreciated. This is on a windows environment.

Thanks

[ua549]

You should be able to import the file using regedit.

Another method is to simply click on a .reg file.
The file should be a text file and have a heading with a version.
For example here is a file that turns off the low disk warning.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer]
"NoLowDiskSpaceChecks"=dword:00000001

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search\\Gathering Manager]
"BackOffLowDiskThresholdMB"=dword:00000000

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search\\Gather]
"LowDiskMinimumMBytes"=dword:00000000

[HYBR|D]

BartPE should let you play with the offline registry. http://windowsxp.mvps.org/peboot.htm

or there's http://www.mitec.cz/wrr.html I have zero clue on if it works or is even safe to launch. Probably scan it and test run it in a Virtual Machine etc

Don't have access to an actual PC/Laptop atm. stuck using my galaxy10.1 tablet until the insurance company gets there ass into gear and cut me a check.

[Cider]

You should be able to import the file using regedit.

Another method is to simply click on a .reg file.
The file should be a text file and have a heading with a version.
For example here is a file that turns off the low disk warning.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer]
"NoLowDiskSpaceChecks"=dword:00000001

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search\\Gathering Manager]
"BackOffLowDiskThresholdMB"=dword:00000000

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Search\\Gather]
"LowDiskMinimumMBytes"=dword:00000000

ahah, thanks

What i was looking for was something that showed me the file in the normal regedit way, as trying to open the file with over 20k lines of code.

[Cider]

BartPE should let you play with the offline registry. http://windowsxp.mvps.org/peboot.htm

or there's http://www.mitec.cz/wrr.html I have zero clue on if it works or is even safe to launch. Probably scan it and test run it in a Virtual Machine etc

Don't have access to an actual PC/Laptop atm. stuck using my galaxy10.1 tablet until the insurance company gets there ass into gear and cut me a check.

Hi Hybrid,

Im not sure if you understood what i was looking for.

I asked a client to ZIP up their reg and send it to me so I can check it, was trying to find an easier way other than notepad to view the contents.

[ua549]

In regedit one can highlight a registry portion of interest and export just that portion.
Have you considered using a virtual PC where you can import/export portions of the client's registry for perusal?

[HYBR|D]

An option: From an account with Administrator level access

1) Click Start, Run and enter REGEDIT
2) In Regedit, highlight the HKEY_USERS key and go to File, Load Hive.
3) Use the File Open dialog to go to the Documents and Settings\<username>
folder, where <username> is the account you wish to modify.
4) Highlight the NTUSER.DAT file in this folder (usually a hidden file) and
select Open.
5) You'll be prompted to enter a "Key name". You can use whatever you wish,
but I use the User's logon name.
6) You can now expand the Hive you just loaded and make any needed changes.
7) When finished, highlight this Hive again and go to File, Unload Hive.

NOTE: You MUST unload the Hive prior to logging on to the users account.
Otherwise XP may have trouble loading the user's profile.

then once you log into the new user account you can then view those .reg entries via the regedit.

while it's in it's .reg format it's going to be difficult to view the actual file in a word editor etc, simply due to it's size and various character limits in most doc editors.

[Cider]

In regedit one can highlight a registry portion of interest and export just that portion.
Have you considered using a virtual PC where you can import/export portions of the client's registry for perusal?

Well in a VM I made as I did have this idea, I would file > import but it wouldnt import. Not sure what was wrong as it didnt give any error.

An option: From an account with Administrator level access

1) Click Start, Run and enter REGEDIT
2) In Regedit, highlight the HKEY_USERS key and go to File, Load Hive.
3) Use the File Open dialog to go to the Documents and Settings\<username>
folder, where <username> is the account you wish to modify.
4) Highlight the NTUSER.DAT file in this folder (usually a hidden file) and
select Open.
5) You'll be prompted to enter a "Key name". You can use whatever you wish,
but I use the User's logon name.
6) You can now expand the Hive you just loaded and make any needed changes.
7) When finished, highlight this Hive again and go to File, Unload Hive.

NOTE: You MUST unload the Hive prior to logging on to the users account.
Otherwise XP may have trouble loading the user's profile.

then once you log into the new user account you can then view those .reg entries via the regedit.

while it's in it's .reg format it's going to be difficult to view the actual file in a word editor etc, simply due to it's size and various character limits in most doc editors.

This is great , if someone sends teh full exported reg and I edit this as per user and send it back, will they be able to import the full reg with my changes?

[HYBR|D]

create .reg files that contain the changes, then have the user either manually launch each .reg file or create a batch script that will automagically import all the different .reg files into there registry.

then the person just needs to reboot the PC and job done.

here is a understanding .reg files page:> http://www.windowsnetworking.com/nt/...regfiles.shtml

side note* if possible why not just use a remote desktop control app, like vnc so you can remote connect and manually make your changes?

[Cider]

create .reg files that contain the changes, then have the user either manually launch each .reg file or create a batch script that will automagically import all the different .reg files into there registry.

then the person just needs to reboot the PC and job done.

here is a understanding .reg files page:> http://www.windowsnetworking.com/nt/...regfiles.shtml

side note* if possible why not just use a remote desktop control app, like vnc so you can remote connect and manually make your changes?

Thanks mate.

Ofc we use remote tools, logmein, teamviewer etc but some clients in South africa live in the bush XD ... so the speed is somewhat click and wait a few minutes. Basically unworkable.