Link to home
Start Free TrialLog in
Avatar of ctbohan
ctbohan

asked on

key recovery from ntuser.dat

I corrupted the user hive (ntuser.dat) of
a registry with regedt32 (I don't think I
unloaded it properly). I can no longer log
in as that user (the system creates a new
user when I try).

Does some way exist of repairing that hive
so I can log on as that user again (first
choice), and if not, how do I copy all of
the keys (or as many as possible) so I can
import them into a new user (second choice)?
Regedt32 will only save keys in a long text
format, not an reg file.

Thanks for your help.
Avatar of CrazyOne
CrazyOne
Flag of United States of America image

Have you tried to just remove the C:\Documents and Settings\"TheUser"\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat from the profile. I had a similar problem in I couldn't logon as that user anymore unitl I remove the UsrClass.dat.

Also use regedit instead of Regedt32 to import and export keys.


The Crazy One
If that doesn't work try removing the ntuser.dat file and see what happens. By removing I don't mean deleting the files but moving them to some other directory for temporary save keeping.
Avatar of omk
omk

open regedit, select the hive you prefer to save, under Registry ->Export Registry File.
ASKER CERTIFIED SOLUTION
Avatar of AvonWyss
AvonWyss
Flag of Switzerland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of ctbohan

ASKER

CrazyOne, I will try removing that file on Monday.

I know that regedit and not regedt32 exports hives
to .reg files, but I can't load that hive with
regedit, because I can't log in as that user (it
creates a new profile under "user.DOMAIN", instead
of using the "user" profile).

AvonWyss, I will also try resetting that key to
point to the old profile on Monday. The system
might have not unlocked that file before (thus
forcing the creation of a new profile), but now
(after rebooting) it has become available again.

Thank you for your help.
Avatar of ctbohan

ASKER

I have recovered the registry for that user, and I
consider resetting the registry key as you described
as THE vital part of that recovery. Without telling
the OS where to look for profile, it never would
have recognized it.

I wish we had a finer system of grading, as I would
have taken off a couple of points for not reminding
me to reboot often. :) I didn't think what you
suggested would work at first (since it still logged
the user in with the new profile), but when I could
not even rename the directory containing the new
profile, the light went on, and a simple reboot
solved that problem (for that matter, if I had
rebooted after forgetting to unload that hive, I
probably would have never encountered the problem
in the first place - I guess I have become too used
to Linux where I only reboot to upgrade the kernel,
or in case of hardware problems). Thanks again.
ctbohan, you're welcome! When something fails in Windows, rebooting is practically always suggested as first measure to be taken. This is so "normal" that I indeed forget to tell people to do it. Thanks for reminding me.