When Windows 10 have some problems with registry files/settings (in case of corruption, accidental deletion, etc.), the system offers a simple way to restore the registry settings from the automatically created backup. In this guide we will show you how to restore Windows 10 registry from a backup or system restore point (VSS snapshots) that were created earlier.
Regback: How to Restore Registry from Backup in Windows 10?
The system automatically saves a Windows 10 backup copy of some registry hives to the folder %windir%\System32\config\RegBack.
Each registry hive is stored in a separate file. There are 5 files total in this location (in parentheses indicate the registry hive that is stored in a file):
- DEFAULT (HKEY_USERS.DEFAULT)
- SAM (HKEY_LOCAL_MACHINE\SAM)
- SOFTWARE (HKEY_LOCAL_MACHINE\Software)
- SECURITY (KEY_LOCAL_MACHINE\Security)
- SYSTEM (HKEY_LOCAL_MACHINE\SYSTEM)
Note. Please note that the user’s registry hives are not backed up automatically. These hives are stored in each directory with a user profile in the NTUSER.DAT and USRCLASS.DAT files and you need to take it copies yourself.
Accordingly, to restore registry in Windows 10 you need simply to copy the files from RegBack folder (where they are usually updated after updates that affect the registry) to the folder %windir%\System32\Config.
Registry hives backup copies are created by a separate task RegIdleBack from the Automatic Maintenance subsystem. By default, a registry backup is created every 10 days or when installing system updates, drivers, or programs. To find job that is responsible for backing up the registry, open the Windows Scheduler (Taskschd.msc). In the Task Scheduler console, go to the section Task Scheduler Library > Microsoft > Windows > Registry.
As you can see, the RegIdleBack task is active (Ready) and the last time completed successfully (Last Run Result: The operation completed successfully – 0x0).
You can run this task manually by right click on the task name and select Run.
If your Windows 10 is turned on (online), you can’t replace the original registry files in the %windir%\System32\Config since they are locked by the operating system. However, you can use the registry recovery procedure when your Windows is not booting properly in normal mode. In this case, you can replace the damaged registry files from the WinPE command prompt by booting your computer in the Windows 10 recovery environment or from Windows 10 installation media.
Restoring Registry Backup Task in Windows 10 1803 and higher
Starting from Windows 10 1803 (and in all newer Windows 10 builds: 1809 and 1903), the task of automatically creating registry backups by default doesn’t work like before. The C:\Windows\System32\Config\RegBack directory is empty, or contains hive files of size 0 bytes. What is interesting is that the task RegIdleBackup is actively and successfully performed according the schedule.
According to the comments of Microsoft employees, the automatic backup task was disabled to save space (!!) and because you can always extract old versions of registry hives from system recovery points (if they are enabled).
You can enable automatic registry backups to the RegBack folder using the registry. To do this:
- Open the Registry editor regedit.exe;
- Go to the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager
- Create a new DWORD parameter named EnablePeriodicBackup with the value 1
- Close the registry editor and restart the computer. The next time you start automatic system maintenance (if you did not disable it), the copies of registry hives will also be created. To start a task manually, run the command:
schtasks /run /i /tn "Microsoft\Windows\Registry\RegIdleBackup"
Tip. You can also make changes to the registry with the command:
reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager" /v EnablePeriodicBackup /t REG_DWORD /d 1
schtasks /create /ru system /sc weekly /st 12:00:00 /tn "MyRegIdleBackup" /tr "cmd /c del /f /q C:\PS\RegBack & cd /d C:\PS\RegBack & reg save HKLM\SAM SAM & reg save HKLM\SECURITY SECURITY & reg save HKLM\SOFTWARE SOFTWARE & reg save HKLM\SYSTEM SYSTEM & reg save HKU.DEFAULT DEFAULT"
You can manually back up important registry hives or make a full registry backup. Select the required registry hive (or select the registry root) and select Export from the context menu. Specify the name of the reg file in which you want to save your registry.
Restore Windows 10 Registry from Command Prompt
To open command prompt, boot your PC in the recovery mode (you need to interrupt normal boot of your computer 3 times in a row using Power button) and select Troubleshoot > Advanced Options > Command prompt.
Also to open Command prompt you can boot your PC from Windows 10 distribution DVD disk or flash drive and on the first installation screen press Shift + F10 (on some laptops Shift + Fn + F10).
Your system drive assigned letter in the WinPE recovery environment may be different from C:. To find out what drive letter is assigned to your system partition, enter one by one the following commands:
You can easily detect your system partition by the large disk size. In my case this is assigned the drive letter D: (volume 2).
Now use Command prompt to restore the registry from backup:
Xcopy d:\Windows\System32\config\regback d:\Windows\System32\config
Confirm the replacement of files using key A.
After the command execution is finished, all the registry files will be replaced with their backup copies. You can close the Command prompt and reboot computer to see whether the operability of Windows 10 has been restored.
If the registry files in backup are corrupted, you can try manually restore older version of the registry files from a System Restore point.
Boot into WinPE environment as described earlier and go to the windows\system32 directory:
Display a list of all available restore points using command:
vssadmin.exe list shadows
In this example, the last shadow copy taken 10/20/2016 4:02:40 AM and has Shadow Copy Volume path ?GLOBALROOT\Device\HarddiskVolumeShadowCopy6.
Mount the restore point (snapshot) in the Read-only mode to the folder d:ShadowCopy using the mklink tool:
mklink /D d:\ShadowCopy ?GLOBALROOT\Device\HarddiskVolumeShadowCopy6
Now you can access files stored in the shadow volume. Simply copy and replace registry files using the following commands:
xcopy d:\shadowCopy Windows\System32\config\DEFAULT d:\Windows\System32\config xcopy d:\shadowCopy Windows\System32\config\SAM d:\Windows\System32\config xcopy d:\shadowCopy Windows\System32\config\SOFTWARE d:\Windows\System32\config xcopy d:\shadowCopy Windows\System32\config\SECURITY d:\Windows\System32\config xcopy d:\shadowCopy Windows\System32\config\SYSTEM d:\Windows\System32\config
Reboot your computer and you’ve successfully Restore Windows 10 Registry. Hope this was useful!
- RDP Error: Remote Desktop Can’t Find the Computer - September 17, 2020
- How to Seize FSMO Roles From Dead Domain Controller? - September 16, 2020
- Active Directory Schema Update - September 11, 2020