Solved

Tool for Compacting offline registry

Posted on 2012-04-10
12
2,222 Views
Last Modified: 2013-03-15
Are there any tools that will allow me to compact an offline registry?  i.e. the NTUSER.DAT file located in the user's roaming profile directory.  I remember there being useful tools to do that but Google searching only gives me results for commercial products which only work for local installations.

I've already deleted a huge section of his hive (faulty software making unnecessary additions to its own key), but the file size hasn't reduced automatically, so I need to compact this, and do it for quite a lot of users, so something that works from the command line would be great.

I'd also be happy if it was vbscript.

Needs to work for Windows 2008 R2 SP1 (64 bit), and Windows 7 SP1 (64 bit)
0
Comment
Question by:LesterClayton
  • 5
  • 3
  • 2
  • +2
12 Comments
 
LVL 17

Expert Comment

by:Anuroopsundd
ID: 37827367
Please have a look at below link to view different tools for this and their poll results.. hope this should help

http://www.wilderssecurity.com/showthread.php?t=303009
0
 
LVL 28

Expert Comment

by:Run5k
ID: 37827368
Frankly, are you certain this procedure is really necessary?  In my experience, it's very rare to find a compelling need to clean or compact the registry in any way.  The benefits are minimal, while the potential side effects are problematic.

This Experts Exchange article written by one of the EE community's very best contributors provides some excellent perspective:

Registry Cleaners - Good or harmful to your PC?
0
 
LVL 17

Author Comment

by:LesterClayton
ID: 37827395
To Anuroopsundd: Thanks, but no thanks.  I want recommendations from people who have first hand-experience, not a link to some fail website which lists products which may or may not fill my needs:

To Run5k: Yes, it is necessary.  The NTUSER.DAT file has grown to over 50 MB, which makes it larger than the Roaming Profile is allowed, meaning that the user is getting errors about his roaming profile usage.  Since NTUSER.DAT is generally around 2 MB, I'd rather compact the existing files, than increase the profile size.
0
 
LVL 28

Expert Comment

by:Run5k
ID: 37827409
I understand your logic, but it's simply a path that I wouldn't choose to take.

Hopefully someone else within the EE community can chime in who has utilized these tools personally and point you in the right direction.
0
 
LVL 17

Accepted Solution

by:
LesterClayton earned 0 total points
ID: 37827855
I ended up writing my own application to do what I need.  It's written in Delphi, but posting it here so you can use it to create your own.

program CompactRegistryFile;

{$APPTYPE CONSOLE}

{$R *.res}

uses
  Winapi.Windows, System.SysUtils, System.Win.Registry;

Var
  Registry : TRegistry;

function EnableNTPrivilege ( Const Privilege : String; State : Integer) : Integer;
var
  cbPrevTP : DWord;
  hToken : THandle;
  aLuId : TLargeInteger;
  TP, fPrevTP : PTokenPrivileges;
begin
  Result:= 0;
  if OpenProcessToken( GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken) then
    try
      LookupPrivilegeValue( Nil, PChar( Privilege), aLuId);
      cbPrevTP:= SizeOf( TTokenPrivileges) + SizeOf( TLuIdAndAttributes);
      GetMem( TP, cbPrevTP);
      GetMem(fPrevTP, cbPrevTP);
        try
          TP^.PrivilegeCount:= 1;
          TP^.Privileges[ 0].LuId:= aLuid;
          TP^.Privileges[ 0].Attributes:= State;
          if not AdjustTokenPrivileges( hToken, False, tp^, cbPrevTP, fPrevTP^, cbPrevTP) then RaiseLastWin32Error;
          Result:= fPrevTP^.Privileges[ 0].Attributes;
        finally
          FreeMem( fPrevTP);
          FreeMem( tp);
        end
    finally
      CloseHandle( hToken);
    end
end;

procedure DoStuff;
Var
  Attrs : Integer;
begin
  Try
    EnableNTPrivilege( 'SeRestorePrivilege', SE_PRIVILEGE_ENABLED);
    Registry := TRegistry.Create;
    Registry.RootKey := HKEY_USERS;
    If Registry.LoadKey('NTUSER',ParamStr(1)) Then
       Begin
        EnableNTPrivilege( 'SeBackUpPrivilege', SE_PRIVILEGE_ENABLED);
        if Registry.SaveKey('NTUSER',ParamStr(1)+'~tmp') then
          Begin
            Registry.UnLoadKey('NTUSER');
            if FileExists(ParamStr(1)+'~tmp') then
              Begin
                Attrs := FileGetAttr(ParamStr(1),False);
                FileSetAttr(ParamStr(1), 0);  //Remove the current attributes from the file
                If DeleteFile(ParamStr(1)) // Delete the file
                  Then RenameFile(ParamStr(1)+'~tmp',ParamStr(1)); // Rename temp to be new file
                FileSetAttr(ParamStr(1), Attrs);  //Add the attributes back
              End;
          End;
      End;
  Finally
    Registry.Free;
  End;
end;

begin
  try
    if ParamCount = 1 then
      DoStuff;
  except
    on E: Exception do
      Writeln(E.ClassName, ': ', E.Message);
  end;
end.

Open in new window


If anybody is interested in obtaining the executable, post here and I'll make it available.

Incidentally, I've compacted my NTUSER.DAT file of 59,648 KB  down to 3,416 KB
0
 
LVL 28

Expert Comment

by:Run5k
ID: 37830329
I'm certainly glad that you found a solution on your own, but it may be prudent for you to spend a bit more time determining the root cause of that NTUSER.DAT growth.  Unless there have been some significant problems, it should definitely be under 10 MB.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 17

Author Comment

by:LesterClayton
ID: 37831304
To Run5k : I have already determined the cause of the NTUSER.DAT growth - I mentioned it in my original post - (faulty software making unnecessary additions to its own key)

The software which was causing the problem was a SHARP Printer Driver, creating a new registry hive under HKCU/Software/SHARP/

I've not resolved that problem yet, but I had to get rid of the symptom of the profile size being too large.  I'll get one of my juniors to look into the Sharp Printer Driver issue.

Thanks for your added input :)
0
 
LVL 17

Author Closing Comment

by:LesterClayton
ID: 37847965
I wrote an application to achieve what I wanted, and it works.  Executable provided on request.
0
 

Expert Comment

by:DavidLake
ID: 38357941
Will this file work on a Windows 2000 system hive file? I have one I need to compact as its grown to large and the server will no longer boot. The hive file is "system" . If possible could you send me the executable or link to it? Thank you
0
 

Expert Comment

by:donohoe1
ID: 38982628
LesterClayton, I would love to get an executable of your utility. It would come in extremely handy in dealing with a problem we're addressing.
0
 
LVL 17

Author Comment

by:LesterClayton
ID: 38984174
The tool is available to download from here:

http://www.nsasp.net/CompactRegistryFile.zip

I've included a 32 bit version and 64 bit version of the app, plus source code.  This is a console application and is intended to be run from the command line, a batch file or other scripting technology (Powershell, Windows Script Host)

Usage:
CompactRegistryFile.exe <[Path]NTUSER.DAT> [[KeyToDelete1]..[KeyToDeletex]]

Open in new window


Example 1 : CompactRegistryFile.exe \\server\c$\users\Administrator\NTUSER.DAT
This will load the NTUSER.DAT file, and overwrite it with a new copy, reducing its size if possible

Example 2 : CompactRegistryFile.exe \\server\c$\users\Administrator\NTUSER.DAT Printers\Connections
This will load the NTUSER.DAT file, delete the registry key HKCU\Printers\Connections of the loaded key, then re-save.

You don't have to specify a registry key to delete, and you can specify more than 1 to delete just by adding them at the end like so: CompactRegistryFile.exe Software\Key1 Software\Key2 "Control Panel\Desktop\Wallpaper" etc etc

Administrative rights (Full) will be required for both the file you are loading, as well as the machine you are running it from.

If the file is in locked (i.e. in use) then it won't be successful in saving the new file - this tool is intended to work user registry files which are not in use.  

This tool is not intended for machine hives (since they're always in use), but may work if for example you were able to boot into a Windows PE environment and ran it on the local disk of a server or workstation (Might be useful for DavidLake above).  Be sure to make a copy of the SYSTEM.DAT file just in case!

No warranties are provided with these file or its use, and I, the company I work for - nor Experts Exchange can or will be held responsible for any data loss which may occur.  Saying this though, I've never encountered a problem with this tool and I've used it on well over 100 users bloated hives.
1
 

Expert Comment

by:donohoe1
ID: 38989428
Thank you so much, that worked great.

Our issue is we use roaming profiles with Citrix, and our Outlook PRF file wasn't set to disable backups, so every time a user logged on the Outlook profile was backed up in the registry and new one was created. Over time we ended up with NTUSER.dat files in the 50-150mb range. We could manually remove the backups, but we had no way to compact the NTUSER.dat file afterward. For most of our users we'll just delete the file and let it recreate, but we wanted something slightly less dramatic for our executives. Thank you again!
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Join & Write a Comment

Deploying a Microsoft Access application in a Citrix environment is not difficult but takes a few steps. However, Citrix system people are often of little help, as they typically know next to nothing about Access. The script provided here will take …
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This Micro Tutorial will give you basic overview of the control panel section on Windows 7. It will depth in Network and Internet, Hardware and Sound, etc. This will be demonstrated using Windows 7 operating system.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now