Manual System restore of Software Registry

Posted on 2006-04-11
Last Modified: 2008-01-09
Strange question I just came up with.  I am working on a system that had a corruption in the SAM file for the registry.  The system would kick an error with lsass.exe stating that the passwords did not match.  I was able to use the backups stored in the windows/repair folder to get the system running again.  I then did a manual restore of the last restore point by copying the SAM, SYSTEM, SOFTWARE, SECURITY and DEFAULT files into the c:\windows\system32\config folder.  Then the system came back with missing files.  What I would like to know is, if I were to format and reinstall windows xp, then restore a backup of the program files folder, would I be able to restore the SOFTWARE file from the last system restore point to the c:\windows\system32\config folder and get all the old software running again without having to install them all?
Question by:ffemtdd
    LVL 3

    Expert Comment

    LVL 16

    Expert Comment

    "Then the system came back with missing files."
    Does this mean the system was unable to boot? If so, manually restore from an even older restore point.

    Backup the restored restore points and try it. You have a good knowledge of the process already. If it gorks out, just restore manually again.

    Author Comment

    @ M_Intuit ... I know how to restore the files from the restore points in system volume information.  What I want to know is if the files are independant of each other and if the Software file will add the registry entries needed to get all of the previously installed software operational?

    @ craylord ... No, the system booted just fine.  The error was related to a missing dll (wininet.dll)  When that file was restored another error appeared.  The next error was SHRegGetValueW.  Of course I read the instructions on this site to uninstall WinXPSP2 but when I attempted to do so I ran into an error getting into the administration account via safe mode.  I believe it was again due to a corrupted SAM file as the lsass.exe password error re-appeared.
    LVL 10

    Expert Comment

    It really just depends on the program.  Some will, some wont.  Some software adds reg entries to the current user (ntuser.dat), plus, file assosications will still be broken as they come from the System key.

    It's worth a shot, but I'm guessing won't work.
    LVL 10

    Accepted Solution

    What you could do is load the hives into your registry editor after your reload, and export what you think you need.  Try it, and if it doesn't work, then you know you're going to have to reload that one.

    Also, another problem is going to be the changing of SID's.

    Also, just to correct myself earlier, file associations do come from the SOFTWARE, not the SYSTEM.  Dunno what I was thinking.  I knew this.

    Anyway, if you need a refresher on the registry, here is some in depth info of what everything does and where it's all kept and how the registry is built.

    Featured Post

    Do You Know the 4 Main Threat Actor Types?

    Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

    Join & Write a Comment

    Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
    If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article ( first and run the tool TDSSKiller ( to get rid of the infection. Once done, and if the …
    This video is in connection to the article "The case of a missing mobile phone (". It will help one to understand clearly the steps to track a lost android phone.
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now