Backing up and Restoring Windows NT/2000/XP/ Server 2003 Registries Manually

Backing up and Restoring Windows NT/2000/XP/ Server 2003 Registries Manually
If the boot partition of Windows NT/2000/XP/Server 2003 is formatted using the FAT
file system, you can easily back up the system registry manually by booting the computer
under an alternative operating system (for example, MS DOS or Windows 9x/ME) or
even using the boot diskette. When this is done, you will be able to copy registry-hive
files to the backup media using any method of copying (for example, you may use both
Windows Explorer and the command line).
If the Windows NT/2000/XP or Windows Server 2003 boot partition uses NTFS, you
may have some difficulties using this method of backing up the registry (however,
contrary to information provided in some sources, this isn't always the case). You may
sometimes need to format the Windows NT/2000/XP/Server 2003 boot partition using
NTFS (this may be required by the security rules adopted by your company or by certain
software products, which need to be installed on NTFS partitions). However, you may
wish to continue using a manual method of backing up the registry. The simplest method
of avoiding any possible problems is a parallel installation of the operating system.
Microsoft officially recommends this method of improving system reliability. This tip
can be found in both the Resource Kit documentation and in Microsoft Knowledge Base
articles. If you follow this recommendation, though, you'll need to consider the
compatibility aspects of NTFS 4 and NTFS 5. You can also use shareware or freeware
NTFS drivers, which can be downloaded from the Internet).
To back up Windows NT/2000/XP/Server 2003 registry manually, copy the files
contained in the %SystemRoot%\System32\Config folder to the backup media. Note that
you need to use backup media of sufficient capacity, since the contents of this folder
almost certainly won't fit on a 1.44 MB diskette.
Selection of removable storage media for transporting your files (for system
administrators and technical-support personnel these, most probably, will include
recovery tools, drivers, system updates, diagnostic utilities and, certainly, backup files,
such as registry backups) is very important. Till recently, ZIP disks and CD-Rs were used
for this purpose. Over the past few years, however, newer and better media have become
more and more popular. If you need a portable toolkit for emergency situations, such

things as external USB card readers, Flash Memory cards, and, above all, USB Flash
drives, will be invaluable. Such devices can hold up to 1 GB of data, are very portable,
extremely light weight, and compatible with any PC equipped with a USB port. Just stick
the flash drive into the USB port of your PC running Windows 2000/XP or Windows
Server 2003 and Windows Plug and Play will immediately see it as an additional drive
(more information on this topic will be provided in Chapter 5
). Then copy the files you
need to take with you, unplug the device from the PC, and you're ready to go. Flash
drives hold more data than a floppy disk, are more portable than ZIP drives and other
remote-storage devices, and are more convenient (and less fragile) than CD-RW disks. In
short, USB Flash Drives may just be the perfect removable storage medium.

Note Unfortunately, the small size and large storage capacity of such devices, apart from
the advantages that they bring, can also make them dangerous. In order to install
such a device in Windows 2000/XP or Windows Server 2003, it isn't necessary for
the user to belong to the Administrators group. For example, during the installation
of portable USB drives the user can bypass entirely administrative safeguards
against worms and viruses, unauthorized software such as shareware programs,
software pranks, MP3 files, video clips, spyware or keystroke loggers that can
enable users to capture passwords or other sensitive information. Another threat
created by such devices is that of theft or loss of software and confidential data.
Unless you disable all of the USB ports in your environment, they are impossible to
defend against. Protective measures that you can take to safeguard your corporate
network against these threats will be considered in Chapter 9
.
The files that need to be copied from the %SystemRoot%\System32\Config folder are
listed below:
Appevent.evt Secevent.evt Sysevent.evt
Default Security System
Default.log Security.log System.alt

[*]

Default.sav Software System.log
Sam Software.log System.sav
Sam.log Software.sav Userdiff
[*]
This file was eliminated in Windows XP and Windows Server 2003. It is only present
in earlier versions of Windows NT/2000.

Note When backing up the registry manually, don't forget to create
backup copies of user profiles, which are stored under
%Systemdrive%\Documents and Settings\<Usemame> folders.
To create backup copies of user profiles for each user quickly,
log in as the Administrator and copy the Ntuser.dat files for
each existing user profile (more detailed information on user
profiles will be provided in Chapter 10
.
Restoring the registry from a backup copy that was created using this method requires
booting the computer under an alternate operating system. After rebooting, you simply
need to copy the registry files from the backup media back to the
%SystemRoot%\System32\Config folder.