Recipe 9.9. Backing Up and Restoring the Registry

Problem

You want to back up or restore the Registry on a computer.

Solution

With the NT Backup utility (ntbackup.exe) you can back up the Registry by backing up the System State. The System State includes such things as the files necessary to boot the system, the Active Directory database, and the Registry. To restore the Registry, you have to restore the System State from a previous backup.

Using a graphical user interface

Do the following to back up the System State:

1. Open the NT Backup utility (ntbackup.exe) from the Start menu by selecting Programs Accessories System Tools Backup.

2. Make sure Back up files and settings is selected and click Next.

3. To only back up the System State, select Let me choose what to back up and click Next.

4. Expand My Computer, check the box beside System State and click Next.

5. Click the Browse button to browse to the location you want to save the backup file to and click Next.

6. Click Finish to start the backup.

Do the following to restore the System State:

1. Browse to the backup file containing the System State you want to restore and double-click the file. This launches the NT Backup utility (ntbackup.exe).

2. Click Next.

3. Select Restore files and settings and click Next.

4. Under Items to restore, check the box beside System State and click Next.

5. Click Finish to start the restore.

You may see on the final screen that it states that existing files will not be replaced. This doesn't apply to the System State. Any time the System State is restored, all System State components are overwritten with the backup version.

Using a command-line interface

The following command backs up the system state to a file:

> ntbackup backup systemstate /j "<Description>" /f "<FilePath>" > ntbackup backup systemstate /j "System State Backup 1" /f "c:\sysstate.bkf"

You can't use ntbackup from the command line to restore files.

Another option for backing up the Registry is to use the regedit command to back up specific Registry hives to a file. The following command backs up the HKLM hive to a file called hklm.hiv:

> regedit /e hklm.hiv hkey_local_machine

To restore the hive, use the following command:

regedit /s hklm.hiv

You can use the reg command to copy specific subkeys if you don't want to back up an entire hive. For example:

> reg save HKLM\Software\Microsoft c:\backup\hklm-sw-ms.hiv

To restore the backup back to the Registry, use the same syntax except replace "save" with "restore":

> reg restore <Key> <Filename>

Discussion

If you ever run into the case where you have a corrupt Registry or you perhaps accidentally deleted a section of the Registry you shouldn't have, the best solution is to restore from your last good backup of the system. You have to be careful though; restoring the system state restores more than just the Registry and system boot files. It also restores the NTDS database for a domain controller.

See Also

MS KB 318149, "How to Maintain Current Registry Backups in Windows NT 4.0 and Windows 2000," MS KB 322755, "HOW TO: Backup, Edit, and Restore the Registry in Windows 2000," and MS KB 322756, "HOW TO: Back Up, Edit, and Restore the Registry in Windows XP and Windows Server 2003"