Solved

SAM and SYSTEM hive

Posted on 2011-09-08
7
774 Views
Last Modified: 2012-05-12
With local  ladmin rights - can the admin copy the SAM and SYSTEM registry hives from a windows server? If not how can copies be obtained?
0
Comment
Question by:pma111
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 35

Accepted Solution

by:
Joseph Daly earned 200 total points
ID: 36504894
I believe these files are not able to be copied while windows is running. I think you can access these files with a bootable linux CD or you may also be able to copy them using a tool like NT Offline.

http://www.pogostick.net/~pnh/ntpasswd/
0
 
LVL 3

Author Comment

by:pma111
ID: 36504907
I wondered if ntbackup would work
0
 
LVL 9

Assisted Solution

by:Ashok Dewan
Ashok Dewan earned 150 total points
ID: 36504938
you can copy only registry hives but not sam file. Download any mini windows live cd or any linux live cd.
1. Ubuntu
2. knoppix
these are bootable live cd's
http://www.ubuntu.com/download/ubuntu/download
0
Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

 
LVL 9

Expert Comment

by:Ashok Dewan
ID: 36504947
sorry you also cannot copy registry hives.
0
 
LVL 35

Expert Comment

by:Joseph Daly
ID: 36504960
Another option you can try is this.

1. Create a restore point.
2. Open C:\System Volume Information\_restore{0145FC50-D40A-42A0-A56A-275EF2B2493B} folder and locate the latest restore folder starting with RP**.
3. In RP** folder, open snapshot folder. Where u can find all 5 OS hives restored.

Original posting here.
http://www.firewall.cx/ftopicp-21828.html
0
 
LVL 92

Assisted Solution

by:nobus
nobus earned 150 total points
ID: 36508670
or hook the drive to a working pc to copy the files
0
 
LVL 3

Author Comment

by:pma111
ID: 36508732
Its a live (v important server) so powering it down is out the equation or taking drives out.

I am suprised you cant just ntbackup the config folder :( then access them from a restored backup
0

Featured Post

Salesforce Has Never Been Easier

Improve and reinforce salesforce training & adoption using WalkMe's digital adoption platform. Start saving on costly employee training by creating fast intuitive Walk-Thrus for Salesforce. Claim your Free Account Now

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

An article on effective troubleshooting
The Windows functions GetTickCount and timeGetTime retrieve the number of milliseconds since the system was started. However, the value is stored in a DWORD, which means that it wraps around to zero every 49.7 days. This article shows how to solve t…
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question