TechDuke

The primary tool in Windows Vista for working directly with the registry is Registry Editor. You won’t find it anywhere on the Start Menu, however, and it doesn’t show up in the Start Menu Search box when you type its name; you must use the name of its executable file, Regedit.exe. To start Registry Editor, at a command prompt, type regedit.

The two most important things to know about Registry Editor are that it copies your changes immediately into the registry and that it has no Undo command. Registry Editor doesn’t wait for you to issue a File, Save command (it has no such command) before making changes in the registry files. And after you have altered some bit of registry data, the original data is gone forever—unless you remember it and restore it yourself or unless you have some form of backup that you can restore. Registry Editor is therefore a tool to be used sparingly and soberly; it should not be left open when not in use.

Note
A new technology underlying Windows Vista is Kernel Transaction Manager (KTM), which enables Transactional Registry (TxR) This feature does enable a form of registry rollback, but it’s not implemented in Registry Editor Rather, this feature is designed for use by developers who need to create robust applications using transactional processing For more information, visit http://www.vista-io.com/2601

So that you can recover from ill-advised edits to the registry, before you make any changes you should back up the registry using one or both of these methods:

+ Use the Export command in Registry Editor to back up the branch of the registry where you plan to work.

+ Use System Restore to set a restore point.

Note
In Windows XP and Windows 2000, the Backup program has an option to back up (and subsequently restore, if necessary) the “system state,” which includes the registry Backup And Restore Center in Windows Vista has no such option, so it’s not a viable method for backing up the registry Some third-party backup programs do have registry backup capabilities, which provide an alternative to the methods described in the following sections.

Backing Up Before You Edit

One relatively safe way to edit your registry is to back up the section you’re interested in before you make any changes to it. If something goes wrong, you can usually use your backup file to restore the registry to the state it was in when you backed up. Registry Editor can save all or portions of your registry in any of four different formats, described below.

Registration Files The Registration Files option creates a .reg file, a text file that can be read and edited in Notepad or another similar program. A .reg file can be merged into the registry of a system running Windows Vista, Windows XP, or Windows 2000. When you merge a .reg file, its keys and values replace the corresponding keys and values in the registry. Using .reg files allows you to edit your registry “off line” and add your changes to the registry without even opening Registry Editor. You can also use .reg files as an easy way to share and copy registry settings to other computers.

Registry Hive Files The registry hive format saves a binary image of a selected portion of the registry. You won’t be able to read the resulting file (choose one of the text-file options if that’s what you need to do), but if you need to restore the keys you’ve worked on, you can be confident that this format will do the job correctly. Registry hive file is the format of choice if you want to create a backup before working in Registry Editor. That’s because when you import a registry hive file, it restores the entire hive to exactly the way it was when you saved it. (The .reg file types, when merged, restore all the saved keys and values to their original locations, which repairs all deletions and edits. But the process does not remove any keys or values that you added.) Note, however, that a registry hive file has the potential to do the greatest damage if you import it to the wrong key; see the caution in the following section.

Win9x/NT4 Registration Files The Win9x/NT4 Registration Files option also generates a .reg file, but one in an older format used by earlier versions of Windows. The principal difference between the two formats is that the current format uses Unicode and the older format does not. Use the Win9x/NT4 Registration Files option only if you need to replicate a section of your registry in the registry of an older system.

Text Files The Text Files option, like the Registration Files option, creates a file that can be read in Notepad or another text editor. The principal advantage of this format is that it cannot accidentally (or intentionally) be merged into the registry. Thus it’s a good way to create a record of your registry’s state at a particular time. Its disadvantage, relative to the .reg fi le format, is its size. Text files are considerably larger than corresponding .reg fi les, and they take longer to create.

To export a registry hive, select a key in the left pane, and then on the File menu, click Export. (Easier yet: right-click a key and click Export.) In the Save As Type list in the Export Registry File dialog box, select one of the four file types. Under Export Range, select Selected Branch. The resulting file includes the selected key and all its subkeys and values.

Note
The All option under Export Range in the Export Registry File dialog box sounds useful, but it rarely is It’s an invalid selection for the binary registry hive files type For any of the three text file types, it generates a gigantic file (often hundreds of megabytes) that is usually not appropriate for registry recovery

Create hive files using Reg exe
As an alternative to exporting a hive with the Export command in Registry Editor, you can use the Save operation of Reg exe, a command-line tool for registry operations Because Reg exe is a command-line tool, you can use it in batch programs, which might be useful for backing up a certain hive repeatedly or on a scheduled basis For more information about Reg exe, see “Editing the Registry from the Command Line,” page 26xx.

Restoring the Registry from an Exported Hive

If you need to restore the exported hive from a registry hive file, select the same key in the left pane of the Registry Editor window, click Import on the File menu, and specify the file. You’ll see a confirmation prompt letting you know that your action will overwrite (replace) the current key and all its subkeys. This is your last chance to make sure you’re importing the hive into the right location, so take a moment to make sure you’ve selected the correct key before you click Yes.

Important
Importing a registry hive file replaces the entire content of the selected key with the contents of the file—regardless of its original source That is, it wipes out everything in the selected key and then adds the keys and values from the file When you import, be absolutely certain that you’ve selected the correct key

If you saved your backup as a .reg file, you use the same process to import it. (As an alternative, you can double-click the .reg file in Windows Explorer without opening Registry Editor.) Unlike the registry hive file, however, the complete path to each key and value is stored as part of the file and it always restores to the same location. This approach for recovering from registry editing mishaps is fine if you did not add new values or subkeys to the section of the registry you’re working with; it returns existing data to its former state but doesn’t alter the data you’ve added.

Using System Protection to Save the Registry’s State

The System Protection utility takes snapshots of your system’s state, at prescribed time intervals or on demand, and allows you to roll your system back to an earlier state (called a restore point) if you experience problems. Most of the registry is included in the restore point (the keys that are not included are listed at HKLM\System\ControlSet001\ BackupRestore\KeysNotToRestore). Creating a restore point before you begin working in the registry is an excellent way to protect yourself against mishap.