registry

Restore Windows 10 Registry from Backup using Command Prompt


When Windows 10 have some problems with registry files/settings (in case of corruption, accidental deletion etc.), the system offers a simple way to restore the registry settings from the automatically created backup. In this guide we will show you how to restore Windows 10 registry from a backup or system restore point (VSS snapshots) that were created earlier.

Regback: How to Restore Registry from Backup in Windows 10?

The system automatically saves a Windows 10 backup copy of some registry hives to the folder %windir%\System32\config\RegBack\.

windows 10 registry backup location

Each registry hive is stored in a separate file. There are 5 files total in this location (in parentheses indicate the registry hive that is stored in a file):

  • DEFAULT (HKEY_USERS\.DEFAULT)
  • SAM (HKEY_LOCAL_MACHINE\SAM)
  • SOFTWARE (HKEY_LOCAL_MACHINE\Software)
  • SECURITY (KEY_LOCAL_MACHINE\Security)
  • SYSTEM (HKEY_LOCAL_MACHINE\SYSTEM)

Note. Please note that the user’s registry hives are not backed up automatically. These hives are stored in each directory with a user profile in the NTUSER.DAT and USRCLASS.DAT files and you need to take it copies yourself.

Accordingly, to restore registry in Windows 10 you need simply to copy the files from RegBack folder (where they are usually updated after updates that affect the registry) to the folder %windir%\System32\Config.

regback

Registry hives backup copies are created by a separate task RegIdleBack from the Automatic Maintenance subsystem. By default, a registry backup is created every 10 days or when installing system updates, drivers, or programs. To find job that is responsible for backing up the registry, open the Windows Scheduler (Taskschd.msc). In the Task Scheduler console, go to the section Task Scheduler Library > Microsoft > Windows > Registry.

As you can see, the RegIdleBack task is active (Ready) and the last time completed successfully (Last Run Result: The operation completed successfully – 0x0).

You can run this task manually by right click on the task name and select Run.

restore registry windows 10 command prompt

If your Windows 10 is turned on (online), you can’t replace the original registry files in the %windir%\System32\Config since they are locked by the operating system. However, you can use the registry recovery procedure when your Windows is not booting properly in normal mode. In this case, you can replace the damaged registry files from the WinPE command prompt by booting your computer in the Windows 10 recovery environment or from Windows 10 installation media.

Restoring Registry Backup Task in Windows 10 1803 and higher

Starting from Windows 10 1803 (and in all newer Windows 10 builds: 1809 and 1903), the task of automatically creating registry backups by default doesn’t work like before. The C:\Windows\System32\Config\RegBack directory is empty, or contains hive files of size 0 bytes. What is interesting is that the task RegIdleBackup is actively and successfully performed according the schedule.

According to the comments of Microsoft employees, the automatic backup task was disabled to save space (!!) and because you can always extract old versions of registry hives from system recovery points (if they are enabled).

You can enable automatic registry backups to the RegBack folder using the registry. To do this:

  • Open the Registry editor regedit.exe;
  • Go to the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager
  • Create a new DWORD parameter named EnablePeriodicBackup with the value 1
  • Close the registry editor and restart the computer. The next time you start automatic system maintenance (if you did not disable it), the copies of registry hives will also be created. To start a task manually, run the command : schtasks /run /i /tn “\Microsoft\Windows\Registry\RegIdleBackup”

Tip. You can also make changes to the registry with the command:

reg add “HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager” /v EnablePeriodicBackup /t REG_DWORD /d 1

You can also use your own scheduler task (with schtasks) to backup the Windows registry keys to a separate directory (you can also place backup on a separate disk) using the commands:

md C:\PS\RegBack
schtasks /create /ru system /sc weekly /st 12:00:00 /tn "MyRegIdleBackup" /tr "cmd /c del /f /q C:\PS\RegBack & cd /d C:\PS\RegBack & reg save HKLM\SAM SAM & reg save HKLM\SECURITY SECURITY & reg save HKLM\SOFTWARE SOFTWARE & reg save HKLM\SYSTEM SYSTEM & reg save HKU\.DEFAULT DEFAULT"

You can manually back up important registry hives or make a full registry backup. Select the required registry hive (or select the registry root) and select Export from the context menu. Specify the name of the reg file in which you want to save your registry.

windows 10 registry backup location

Restore Windows 10 Registry from Command Prompt

To open command prompt, boot your PC in the recovery mode (you need to interrupt normal boot of your computer 3 times in a row using Power button) and select Troubleshoot > Advanced Options > Command prompt.

Also to open Command prompt you can boot your PC from Windows 10 distribution DVD disk or flash drive and on the first installation screen press Shift + F10 (on some laptops Shift + Fn + F10).

Your system drive assigned letter in the WinPE recovery environment may be different from C:\. To find out what drive letter is assigned to your system partition, enter one by one the following commands:

diskpart
list volume
exit

cmd diskpart

You can easily detect your system partition by the large disk size. In my case this is assigned the drive letter D:\ (volume 2).

Now use Command prompt to restore the registry from backup:

Xcopy d:\Windows\System32\config\regback d:\Windows\System32\config

Confirm the replacement of files using key A.

restore windows 10 registry from command prompt

After the command execution is finished, all the registry files will be replaced with their backup copies. You can close the Command prompt and reboot computer to see whether the operability of Windows 10 has been restored.

If the registry files in backup are corrupted, you can try manually restore older version of the registry files from a System Restore point.

Boot into WinPE environment as described earlier and go to the windows\system32 directory:

d:
cd d:\windows\system32

Display a list of all available restore points using command:

vssadmin.exe list shadows

restore windows 10 registry command prompt

In this example, the last shadow copy taken 10/20/2016 4:02:40 AM and has Shadow Copy Volume path \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6\.

Mount the restore point (snapshot) in the Read-only mode to the folder d:\ShadowCopy using the mklink tool:

mklink /D d:\ShadowCopy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6\

restore registry windows 10 command prompt

Now you can access files stored in the shadow volume. Simply copy and replace registry files using the following commands:

xcopy d:\shadowCopy\ Windows\System32\config\DEFAULT d:\Windows\System32\config

xcopy d:\shadowCopy\ Windows\System32\config\SAM d:\Windows\System32\config

xcopy d:\shadowCopy\ Windows\System32\config\SOFTWARE d:\Windows\System32\config

xcopy d:\shadowCopy\ Windows\System32\config\SECURITY d:\Windows\System32\config

xcopy d:\shadowCopy\ Windows\System32\config\SYSTEM d:\Windows\System32\config

Reboot your computer and you’ve successfully Restore Windows 10 Registry. Hope this was useful!

You may also like:

Sysprep Windows 10 Machine: Step by Step Guide In this guide, we will show you how to use PowerShell and Windows System Preparation Tool (Sysprep) to prepare a highly customized, personal Windows 1...
How to Convert ESD to WIM File on Windows 10? In this tutorial, we will show you how to convert ESD to WIM file using Command Prompt. ESD file is a new thing within Windows 10 OS, that Microsoft i...
Integrate WSUS Offline Updater with MDT 2013 to De... In this article we will show you how to install updates offline gained using WSUS Offline Updater, inside MDT 2013 (Microsoft Deployment Toolkit) task...
Capture Windows 10 Image using MDT 2013 In this article we are going to show you how to capture Windows 10 image using Microsoft Deployment Toolkit 2013 (MDT 2013). Later you can use such im...
Deploy Windows 10 with MDT 2013 and WDS In this article we will show you how to install and configure WDS role, MDT 2013 and Windows ADK on Windows Server 2012 R2 and use it to network PXE (...
Comments
  1. Posted by Sergio Garcia
  2. Posted by neslihan
  3. Posted by Conrad
  4. Posted by alcapone
  5. Posted by Luke
  6. Posted by Thesty
  7. Posted by Scott Petrack
  8. Posted by MarkL
  9. Posted by LALO
  10. Posted by Dennis Faas

Add Your Comment