Please see the attached document for the following instructions including screenshots.
NOTE: Because editing the registry cannot be done without some risk to the system, it is advisable to create a system restore point before proceeding.
The registry is backed up using a VSS writer. VSS writers will only be backed up if the fileset on the client has the following setting enabled: Use Service with All Non-Excluded Writers (Recommended).
The VSS Registry Writer backs up the hive files, which backs up the registry as a single unit. A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files containing backups of its data. Each time a new user logs on to a computer, a new hive is created for that user with a separate file for the user profile. This is called the user profile hive. A user's hive contains specific registry information pertaining to the user's application settings, desktop, environment, network connections, and printers. User profile hives are located under the HKEY_USERS key.
Traditionally, the writer would be restored in its entirety. However, if you wish to restore only select portions of the registry, you will need to pull the desired portions out of the registry hive files.
1. Obtaining the hive files from the VSS Registry Writer
- From the Jobs > History Tab, right-click the desired job and select Browse and Restore
- Browse to VSS:/System State/Registry Writer/Registry/C:/Windows/System32/config/
- Select the the name/link of the various files (these are called Subkeys) located within the config folder one-by-one.
- This will prompt you to download the files to the location your web browser uses for downloaded files.
2. Extract the desired portions of the registry.
- To extract the desired portions of the registry, open the hive files by temporarily loading them onto the registry.
- Open the registry editor, select HKEY_LOCAL_MACHINE in the left panel (HKLM must be the active selection, or the option to Load Hive will not be available).
- Select File > Load Hive.
- Point to one of the Subkeys restored from the CFA and select Open. Different parts of the registry are located in different areas/subkeys. The following link may help you determine where to find the registry key you wish to restore: http://en.wikipedia.org/wiki/Windows_Registry#Hives
- The Registry Editor will ask for a name for the key to load the hive into. You can name it any unique string. For example, backup.
- Browse into the key to find the portion of the registry you wish to restore.
- Due to the limitations of the registry editor, you will not be able to drag and drop the key to where you want it. You must first export the file, then re-import it.
- Right click the desired key and chose Export.
- Note: Save the file in a location you will be able to remember and with a name that you will recognize.
- IMPORTANT! After the desired keys are exported, you will need to close the hive file.
- Select the top key of the hive (In the example, this would be backup) > Select File > Select Unload Hive > Confirm Yes when it asks if you are sure.
- First right-click the .reg file created by the export above, and choose edit to open the file in notepad.
- From the edit menu, select find and replace. Here we will find the temporary location we had the hive file open at (in this example backup), and replace that with where the registry keys should be (in this example SOFTWARE).
- Save and Exit.
Double-Click the .reg file you just edited and confirm all prompts to continue to import the file into the registry.