Solved

key recovery from ntuser.dat

Posted on 2002-03-28
7
1,820 Views
Last Modified: 2011-10-03
I corrupted the user hive (ntuser.dat) of
a registry with regedt32 (I don't think I
unloaded it properly). I can no longer log
in as that user (the system creates a new
user when I try).

Does some way exist of repairing that hive
so I can log on as that user again (first
choice), and if not, how do I copy all of
the keys (or as many as possible) so I can
import them into a new user (second choice)?
Regedt32 will only save keys in a long text
format, not an reg file.

Thanks for your help.
0
Comment
Question by:ctbohan
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 44

Expert Comment

by:CrazyOne
ID: 6904906
Have you tried to just remove the C:\Documents and Settings\"TheUser"\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat from the profile. I had a similar problem in I couldn't logon as that user anymore unitl I remove the UsrClass.dat.

Also use regedit instead of Regedt32 to import and export keys.


The Crazy One
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 6904913
If that doesn't work try removing the ntuser.dat file and see what happens. By removing I don't mean deleting the files but moving them to some other directory for temporary save keeping.
0
 
LVL 2

Expert Comment

by:omk
ID: 6905171
open regedit, select the hive you prefer to save, under Registry ->Export Registry File.
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 14

Accepted Solution

by:
AvonWyss earned 300 total points
ID: 6906135
If a new profile is created, you probably just have "lost" the profile information (renaming the profile folder does this, for instance). To check and fix this, use REGEDIT and check the keys in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList - there is a list with SIDs and in each SID there is information about which path the profile of that user is in.
0
 

Author Comment

by:ctbohan
ID: 6906198
CrazyOne, I will try removing that file on Monday.

I know that regedit and not regedt32 exports hives
to .reg files, but I can't load that hive with
regedit, because I can't log in as that user (it
creates a new profile under "user.DOMAIN", instead
of using the "user" profile).

AvonWyss, I will also try resetting that key to
point to the old profile on Monday. The system
might have not unlocked that file before (thus
forcing the creation of a new profile), but now
(after rebooting) it has become available again.

Thank you for your help.
0
 

Author Comment

by:ctbohan
ID: 6911045
I have recovered the registry for that user, and I
consider resetting the registry key as you described
as THE vital part of that recovery. Without telling
the OS where to look for profile, it never would
have recognized it.

I wish we had a finer system of grading, as I would
have taken off a couple of points for not reminding
me to reboot often. :) I didn't think what you
suggested would work at first (since it still logged
the user in with the new profile), but when I could
not even rename the directory containing the new
profile, the light went on, and a simple reboot
solved that problem (for that matter, if I had
rebooted after forgetting to unload that hive, I
probably would have never encountered the problem
in the first place - I guess I have become too used
to Linux where I only reboot to upgrade the kernel,
or in case of hardware problems). Thanks again.
0
 
LVL 14

Expert Comment

by:AvonWyss
ID: 6911118
ctbohan, you're welcome! When something fails in Windows, rebooting is practically always suggested as first measure to be taken. This is so "normal" that I indeed forget to tell people to do it. Thanks for reminding me.
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Are you unable to connect or configure Hotmail email account in Microsoft Outlook 2010, 2007? Or Outlook.com emails are not downloading to Outlook? Lets’ see the problem and resolve Outlook Connector error syncing folder hierarchy (0x8004102A).
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now