When Windows 10 have some problems with registry files/settings (in case of corruption, accidental deletion, etc.), the system offers a simple way to restore the registry settings from the automatically created backup. In this guide, we will show how to restore Windows 10 registry from a backup or system restore point (VSS snapshots) that were created earlier.
Regback. How to Restore Registry from Backup in Windows 10?
The system automatically saves a Windows 10 backup copy of some registry hives to the folder %windir%\System32\config\RegBack.
Each registry hive is stored in a separate file. There are 5 files total in this location (in parentheses indicate the registry hive that is stored in a file):
- DEFAULT (HKEY_USERS.DEFAULT)
- SAM (HKEY_LOCAL_MACHINE\SAM)
- SOFTWARE (HKEY_LOCAL_MACHINE\Software)
- SECURITY (KEY_LOCAL_MACHINE\Security)
- SYSTEM (HKEY_LOCAL_MACHINE\SYSTEM)
Note. Please note that the user’s registry hives are not backed up automatically. These hives are stored in each directory with a user profile in the NTUSER.DAT and USRCLASS.DAT files and you need to make copies by yourself.
Accordingly, to restore the registry in Windows 10, you need to copy the files from the RegBack folder (where they are usually updated after updates that affect the registry) to the folder %windir%\System32\Config.
Registry hives backup copies are created by a separate task RegIdleBack from the Automatic Maintenance subsystem. By default, a registry backup is created every 10 days or when installing system updates, drivers, or programs. To find a task that is responsible for backing up the registry, open the Windows Scheduler (Taskschd.msc). In the Task Scheduler console, go to the section Task Scheduler Library > Microsoft > Windows > Registry.
As you can see, the RegIdleBack task is active (Ready) and the last time completed successfully (Last Run Result: The operation completed successfully – 0x0).
You can run this task manually by right-clicking on the task name and select Run.
If your Windows 10 is turned on (online), you can’t replace the original registry files in the %windir%\System32\Config since they are locked by the operating system. However, you can use the registry recovery procedure when your Windows is not booting properly in normal mode. In this case, you can replace the damaged registry files from the WinPE command prompt by booting your computer in the Windows 10 recovery environment or from Windows 10 installation media.
Restoring Registry Backup Task in Windows 10 1803 and Higher
Starting from Windows 10 1803 (and in all newer Windows 10 builds: 1809 and 1903), the task of automatically creating registry backups by default doesn’t work like before. The C:\Windows\System32\Config\RegBack directory is empty, or contains hive files with the size of 0 bytes. What is interesting is that the task RegIdleBackup is active and successfully performed according to the schedule.
According to the comments of Microsoft employees, the automatic backup task was disabled to save space. It also allows you to extract old versions of registry hives from system recovery points (if they are enabled).
You can enable automatic registry backups to the RegBack folder using the registry. To do this:
- Open the Registry editor regedit.exe;
- Go to the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager;
- Create a new DWORD parameter named EnablePeriodicBackup with the value 1;
- Close the registry editor and restart the computer. The next time you start automatic system maintenance (if you did not disable it), the copies of registry hives will also be created. To start a task manually, run the command:
schtasks /run /i /tn "Microsoft\Windows\Registry\RegIdleBackup"
Tip. You can also make changes to the registry with the command:reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager" /v EnablePeriodicBackup /t REG_DWORD /d 1
schtasks /create /ru system /sc weekly /st 12:00:00 /tn "MyRegIdleBackup" /tr "cmd /c del /f /q C:\PS\RegBack & cd /d C:\PS\RegBack & reg save HKLM\SAM SAM & reg save HKLM\SECURITY SECURITY & reg save HKLM\SOFTWARE SOFTWARE & reg save HKLM\SYSTEM SYSTEM & reg save HKU.DEFAULT DEFAULT"
You can manually back up important registry hives or make a full registry backup. Select the required registry hive (or select the registry root), and select Export from the context menu. Specify the name of the reg file in which you want to save your registry.
Restore Windows 10 Registry from Command Prompt
To open the command prompt, boot your PC in recovery mode. To do this you need to interrupt a normal boot of your computer 3 times in a row using the Power button. Then select Troubleshoot > Advanced Options > Command prompt.
Also to open the command prompt, you can boot your PC from Windows 10 distribution DVD disk or flash drive. On the first installation screen press Shift + F10 (for some laptops Shift + Fn + F10).
Your system drive assigned a letter in the WinPE recovery environment may be different from C:\. To find out what drive letter is assigned to your system partition, enter one by one the following commands:
You can easily detect your system partition by the large disk size. In our case, it’s the drive with the letter D:\ (volume 2).
Now use Command prompt to restore the registry from backup:
Xcopy d:\Windows\System32\config\regback d:\Windows\System32\config
Confirm the replacement of files using key A.
After the command execution finishes, all the registry files will be replaced with their backup copies. You can close the Command prompt, and reboot the computer to see whether the operability of Windows 10 has been restored.
If the registry files in the backup are corrupted, you can try to manually restore the older version of the registry files from a System Restore point.
Boot into WinPE environment as described earlier and go to the windows\system32 directory:
Display a list of all available restore points using the command:
vssadmin.exe list shadows
In this example, the last shadow copy has taken 10/20/2016 4:02:40 AM, and has a Shadow Copy Volume path ?GLOBALROOT\Device\HarddiskVolumeShadowCopy6.
Mount the restore point (snapshot) in the Read-only mode to the folder d:\ShadowCopy using the mklink tool:
mklink /D d:\ShadowCopy ?GLOBALROOT\Device\HarddiskVolumeShadowCopy6
Now you can access files stored in the shadow volume. Simply copy and replace registry files using the following commands:
xcopy d:\shadowCopy Windows\System32\config\DEFAULT d:\Windows\System32\config xcopy d:\shadowCopy Windows\System32\config\SAM d:\Windows\System32\config xcopy d:\shadowCopy Windows\System32\config\SOFTWARE d:\Windows\System32\config xcopy d:\shadowCopy Windows\System32\config\SECURITY d:\Windows\System32\config xcopy d:\shadowCopy Windows\System32\config\SYSTEM d:\Windows\System32\config
Reboot your computer, and you’ve successfully Restore Windows 10 Registry. Hope this was useful!
- Using Out-File Cmdlet to Redirect Output to File in PowerShell - December 4, 2020
- Fixing This Could be Due to CredSSP Encryption Oracle Remediation Error on Windows - December 4, 2020
- Installing Active Directory Users and Computers MMC Snap-in on Windows 10 - November 26, 2020