Sometimes it becomes necessary to make changes to the Windows registry in a machine that cannot be booted into. This can be especially important when troubleshooting things like a machine rebooting after doing an image deploy, because this can often be caused by bluescreens with the registry set to reboot rather than freeze.
This example will explain how to mount the offline Windows registry from WinPE, using disabling bluescreen reboots as an example.
1 - Boot the device into WinPE.
2 - Open a new command prompt and run regedit.exe to open the Windows registry.
3 - In the registry editor highlight the HKEY_LOCAL_MACHINE hive and go to File -> Load Hive
4 - Browse to the location of the registry files. These will be located on the OS volume (whatever the drive letter is). The path from the root of the volume to the files should be:
The registry hives that can be loaded are:
SOFTWARE - HKLM\Software
SECURITY - HKLM\Security
SYSTEM - HKLM\System
Note that the files do not have an extension
5 - Select the hive to load and assign it a name. For example, select SYSTEM and name it OfflineSystem
6 - Expand the OfflineSystem hive (that should now appear in the list). This hive represents the HKLM\System hive for the Windows install that is on the hard disk, instead of WinPE's registry.
7 - Browse to the desired key or value. For example, browse to OfflineSystem\controlset001\control\crashcontrol and change the data in autoreboot to 0, instead of 1.
Note: The above change will make the device not automatically reboot when a bluescreen occurs. This is very useful for debugging HII problems when it is suspected that an incorrect driver is being used, or if the driver is not being correctly installed.
8 - Collapse the registry to the point where you have the newly added hive highlighted (ie, OfflineSystem).
9 - Go to File -> Unload Hive. This will unload the hive, all changes made will be saved.
Modifying the offline registry of a computer can help recover from many problems, or at least change settings to allow for better information to be gathered.