Get IT Done: Back up and restore the registry in Windows 2000

Learn how to use the Backup utility in Win2K to back up and restore the registry.

Recently, a TechProGuild member asked me to explain how to back up and restore the registry. He was confused by the various techniques. In this Daily Drill Down, I’ll give a brief overview of the Windows 2000 registry, as compared to Windows 98. Then, I’ll briefly explain how to back up and restore the registry in Windows 98. Finally, I’ll show you how to use the Windows 2000 Backup tool for System State backups, which include the registry.

What’s new in the Windows 2000 registry?
If you’re coming to Windows 2000 from Windows 98, you’ll find the registry structure to be very different. You can view the contents of the registry by using the program Regedit.exe. To open this program, choose Start | Run, type Regedit, and press [Enter].

When viewing or working with the registry, be extremely careful. Changing registry settings can be disastrous to your system. Never change the registry unless you’re sure of what you’re doing.

In the registry, all of your system’s settings, called keys, subkeys, and values, are contained within major divisions, called root keys (or subtrees in Windows 2000). In Windows 98, you’ll see six root keys:
  • HKEY_CLASSES_ROOT stores file associations used by Windows Explorer to open applications when a file is double-clicked, and for handling drag-and-drop.
  • HKEY_CURRENT_USER stores the user profile for the currently logged on user. Information here includes screen savers, desktop icons, colors, and other user-specific information.
  • HKEY_LOCAL_MACHINE stores global information pertaining to that particular computer.
  • HKEY_USERS stores all the user profiles on that computer.
  • HKEY_CURRENT_CONFIG records the current information about the loaded hardware profile.
  • HKEY_DYN_DATA contains data stored in RAM pertaining to devices. The Device Manager uses this information.

In Windows 2000, as well as in NT, the sixth root key, HKEY_DYN_DATA, doesn’t exist. Some of these root keys are actually parts of other root keys. HKEY_CURRENT_USER is actually drawn from the logged-in user’s information contained in HKEY_USERS. In other words, HKEY_CURRENT_USER is an alias of a specific subkey in HKEY_USERS. The same is true for HKEY_CLASSES_ROOT, which is actually a subkey of HKEY_LOCAL_MACHINE\Software. The Windows NT and Windows 2000 registries are very similar. If you’d like to learn more about the registry, read the resources I’ve included at the end of this Daily Drill Down.

Where are the registry files?
To appreciate the differences in backing up and restoring Windows 98 and Windows 2000 registries, you’ll need to know that these six root keys aren’t stored in six files. Rather, in Windows 98, all user registry information is stored in C:\Windows\User.dat, while all hardware, plug and play, and application registry settings are stored in C:\Windows\System.dat. In Windows 2000, these registry files don’t exist. However, if you look in your C:\Winnt\Repair folder, you’ll see a folder called RegBack. In this folder, you’ll find five files: default, SAM, SECURITY, software, and system. These files contain registry information. They’re whoppers. On my fairly recently installed Windows 2000 Pro system, they comprise over 8.5 MB worth of data. Also note that these files can’t be imported into the Registry Editor as they’re not in a format recognizable by that program.

Registry backup and restore in Windows 98
To back up the registry in Windows 98, you run the Registry Checker, scanregw.exe. When it’s finished, it places a CAB file in the hidden folder \Windows\Sysbckup. To restore the registry, you start Windows 98 in MS-DOS mode and run scanreg /restore at the MS-DOS prompt.

Registry backup in Windows 2000
In Windows 2000, you can’t back up and restore only the registry. Instead, you must use the built-in Backup tool to back up the System State data. What specifically gets backed up depends on whether you’re running Windows 2000 Professional or Windows 2000 Server. In Windows 2000 Professional, the System State data includes the registry, the COM+ Class Registration database, and boot files. Backing up the System State has several advantages. For example, if you’re about to install new drivers or devices and you’re unsure of the possible consequences to your system, you can create a backup first. If the driver fails, you can restore your system to a working state. This is better than using the Last Known Good (LKG) configuration because during installation, you may have had to reboot several times and inherited an LKG that wasn’t so good.

To back up the System State, open the Backup tool by double-clicking My Computer, right-clicking on the drive you want to back up, and selecting Properties. Under the Tools tab, click Backup Now. Click the Backup tab and select the System State check box. As you can see in Figure A, the right pane of the Backup tab under System State contains three grayed-out check boxes. You cannot select or deselect these components: Boot Files, COM+ Class Registration Database, and Registry.

Figure A
Check the box next to System State to back up the registry.

Next, choose a Backup Destination from the drop-down list. The options will consist of File or Tape, if you have a tape backup installed. The ability to back up and restore to and from files, whether locally or on a network share, is a new feature in Windows 2000 Backup. Windows NT users, especially, will appreciate this. Next, give your backup a name and browse to the location to which you wish to back up. For a filename, I use a combination of date and description, as shown in Figure A. Finally, click Start Backup.

A Backup Job Information dialog box gives you the opportunity to change the default Backup Description, choose whether to append or replace the data with this backup, and modify the default label (Figure B). You can choose to schedule the backup for another time (another great feature of this tool) or choose advanced features, such as verifying data after backup, backing up system protected files, and the backup type: Normal, Copy, Incremental, Differential, or Daily (Figure C). Adding data verification to the backup ensures data integrity. When you’re finished setting options, click OK.

When backup begins, a Backup Progress dialog box appears (Figure D). I found that the estimated remaining time for the backup was too generous in my test network, where frequent collisions and bottlenecks increase backup time.

Figure B
Use the Backup Job Information dialog box to make changes to description and label.

Figure C
Advanced backup features include the option to verify your data. This ensures data integrity.

Figure D
The Backup Progress dialog box shows you an estimate of time remaining. The backup will probably take longer over a network.

You may be startled by the size of your System State backup. Make sure you have enough space available. Because this backup is designed to completely restore Windows 2000 to a previous condition, .system dlls, drivers, executables, and other necessary files are included. At 218 MB, you know the file contains more than the registry. If you’re not interested in backing up all these files, under Advanced options, uncheck Automatically Backup System Protected Files With The System State. Unchecking this option reduced my backup to 12 MB.

Registry restore in Windows 2000
To restore your registry, you’ll have to restore the entire System State. In the Backup utility, click the Restore tab. Choose the backup you wish to restore by double-clicking the File (or Tape) displayed in the left pane. It expands to show the media descriptions available. Expand the descriptions and choose what you want to restore by checking the box next to the file or folder. In this example, I’ve checked System State. The right pane shows the specific items to be restored (see Figure E).

Figure E
Get ready to restore the System State by checking its box within the backup media you created.

You can also specify whether you want to restore your backup to the original location, an alternate location, or to a single folder. To restore to an alternate location, as you might do when you want to store the files to work with them, first use Windows Explorer to create a folder to contain the files and then browse to that location so that Restore knows where to place them. Restoring to an alternate location will not include the COM+ Class Registration database, only the Boot files and Registry.

If you choose Original Location, remember that all your System State files will be overwritten. Click Start Restore. A warning reminds you that your current System State will be overwritten. Click OK to continue. A confirmation window allows you to click OK or Cancel, or select Advanced options. Click OK to continue. The next window asks for the name of the backup file from which to restore. Use the Browse button to fill in the text box and click OK. A Restore Progress dialog will display an up-to-the-moment status of your restore operation. Restoring takes much longer than backing up. While backing up my System State took about six minutes, a restoration tied up my system for about half an hour.

There’s no easy way to back up only the registry in Windows 2000. Windows 98 has the handiest tool, but then, Windows 98 doesn’t have the interrelationships between applications, security, and system that you find in Windows 2000. Using the much-improved Backup utility in Windows 2000 lets you save your System State to a tape or a file on your local machine or across a network share. Restoring the System State will also restore your registry.
For more information on the registry and on backups, read these TechProGuild Daily Drill Downs:The authors and editors have taken care in preparation of the content contained herein but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.

Editor's Picks