Play in DOS Environment Windows Registry _ Registry

Registry Editor can be run not only under Windows but also in MS-DOS real mode. Sometimes when the registry is corrupted and cannot start Windows, we only repair or modify the registry in DOS mode. The actual physical files for the registry are System.dat and User.dat, which means that the data in the registry is stored in these two files.

Export Registry


This command enables you to back up your registry files.

Command format: regedit/l:system/r:user/e filename.reg Regpath

Parameter meaning:

/L:SYSTEM specifies the path where the System.dat file resides.

/R:USER specifies the path where the User.dat file resides.

/e: This parameter specifies Registry Editor to export registry operations, blank after this parameter, and enter the file name of the exported registry.

Regpath: is used to specify which branch of the registry to export, and if not specified, all registry branches will be exported.

If intended to be saved in C:\Windows\System.dat and saved in C:\Windows\Profiles\User.dat all Hkey_classer_ The branch under root root is exported to File.reg, and you can execute the following command: regedit/l:c:\windows\/r:c:\windows\profiles\/e file1.reg hkey_classer_root

Import Registry

Command format: Regedit/l:system/r:user File.reg

Parameter meaning:

/L:SYSTEM specifies the path where the System.dat file resides.

/R:USER specifies the path where the User.dat file resides.

Rebuild the Registry

Rebuild the registry, i.e. re-establish the System.dat and User.dat files.

Command format: regedit/l:system/r:user/c File.reg

Parameter meaning:

/L:SYSTEM specifies the path where the System.dat file resides.

/R:USER specifies the path where the User.dat file resides.

/C: This parameter tells Registry Editor to re-establish the registry with the contents of the. reg file specified.

If you want to re-establish the entire registry with the contents of the File.reg file and save it to C:\Windows\System.dat and C:\Windows\Profiles\User.dat, execute the command: regedit/l:c: \WINDOWS\/R:C:\WINDOWS\PROFILES\/C File1.reg

Delete Registry Branch

This command deletes a subkey branch in the registry.

The command format is: regedit/l:system/r:user/d Regpath

Parameter meaning:

/L:SYSTEM specifies the path where the System.dat file resides.

/R:USER specifies the path where the User.dat file resides.

/C: This parameter tells the Registry Editor to delete the registry subkey branch specified by Regpath.

Restore Registry

Scanreg.exe can check, back up, restore, and repair the registry, which is stored under the "Windows\Command" directory.

Command format: Scanreg [/< option]

Parameter meaning:

The/backup parameter is to back up the registry and related configuration files, which are compressed into RB by System.dat, User.dat, Win.ini, System.ini four files in the Windows directory, respectively ——?. Cab a file, stored in the \windows\sysbckup directory, multiple use of this command will produce multiple CAB files, generally starting from 000, the system default maximum number of backups is 5. The maximum number of backups can be modified in the \windows\scanreg.ini file by modifying the maxbackupcopies=? "Value can be.

The/restore parameter is to select a backup to restore the registry, which cannot be performed in Windows 98 environments and must be shut down and restarted to run in pure DOS mode.

The/fix parameter is to repair the corrupted registry, and this command can only be run in DOS mode.

The/comment= "< comment >" parameter adds some detailed annotation to the CAB file when backing up the registry.

Recovering a corrupted registry file can be repaired using the Scanreg command by first entering the DOS system operating environment and then executing the following command: Scanreg/restore

The system prompts the registry for backup, including the CAB file name and backup time, and so on, so that the user can select the CAB file to recover.

If you want to see all the backup files and the parts associated with the backup, you can execute the command: scanreg/restore/comment

If there is a problem with the registry, you can use Scanreg to fix the command: Scanreg/fix.

Add:
Help information, the use of the time to remove the previous "//" symbol on it, it is best to first Test through the machine.
REGEDIT.EXE-E Reg1.txt HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Regedit.exe-e Reg2.dll "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal server\winstations\rdp-tcp "
Export Registry Contents above
Regedit.exe-s Reg2.dll
The contents of the registry are imported, without prompting information. Reg1.dll must be a legal format.
//____________________________________________________________________________
Win98 Registry File Header format
REGEDIT4
//
Win2000/xp/nt registry File header format (blank line)
//_____________________________________________________________________________
Windows Registry Editor Version 5.00
//
[Hkey_local_machine\software\test4adam]
"Test1" = "Adam"
"Test2" =hex:61
"Test3" =dword:00000064
The type of Test1 is "String value"
The type of TEST2 is "Binary value"
The type of TEST3 is "DWORD value"

Delete a project name
[Hkey_local_machine\software\test4adam]
"Test1" =-

Delete a subkey
[-hkey_local_machine\software\test4adam]

reg.exe query "Hklm\system\currentcontrolset\control\terminal server\winstations\rdp-tcp\portnumber"
reg.exe query "Hklm\system\currentcontrolset\control\terminal server\wds\rdpwd\tds\tcp\portnumber"
Because there are spaces behind the arguments. So you have to use double quotes

Here's the Win2000kit tool.
E:\SCANREG. EXE 1.05 <[-s] String> < [K] [-v] [-d] > [[r] key] [-c] [-e] [-n]
Examples:scanreg-s windows-k-v-d
Scanreg-s WINDOWS-KVD
SCANREG/S windows/r \lm\software/kvde
SCANREG Windows \lm-kd-n
SCANREG Windows \\MOON\HKEY_LOCAL_MACHINE-d
SCANREG Windows HKEY_CURRENT_USER\SOFTWARE-KVD

——————————————————————————————————————
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AutoAdminLogon" =dword:00000001
"DefaultDomainName" = ""
"DefaultUserName" = "Administrator"
"DefaultPassword" = "Password"
Automatic landing on top
[Hkey_local_machine\software\microsoft\windows\currentversion\policies\ratings]
"Key" =-
Above, remove IE rating check password
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun" =dword:00000001
Start not running project
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" =dword:00000001
0x1 Disable Registry Editing

About Psu.exe Using Registry content
Pulist.exe |findstr.exe/i "WINLOGON Explorer"
Get the corresponding Winlogon pid if you are using the terminal login entry 212,788 for the effective PID.
Pulist.exe |findstr.exe/i "WINLOGON Explorer"
Winlogon.exe 212 NT Authority\System
Explorer.exe 824 Netbar-5g2jury8\administrator
Winlogon.exe 341 NT Authority\System
Winlogon.exe 788 NT Authority\System
Explorer.exe 1752 Netbar-5g2jury8\guest
Psu.exe-p "%windir%\regedit.exe-s Admg.reg"-I. PID
Psu.exe-p "%windir%\regedit.exe-e admin.reg hkey_local_machine\sam\sam\"-I. PID
Psu.exe-p "%windir%\regedit.exe-s admg.reg"-I 212 (used in Telnet state)
Psu.exe-p "%windir%\regedit.exe-s Admg.reg"-I 788 (used under terminal cmd.exe)