Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Is there any way to get a copy of %systemroot%\system32\config\system, once the system is up and running? I know the OS puts a lock on this file to keep it from getting trashed, but all I need is to be able to read it, long enough to grab a copy. Perhaps something in the 'native API' would do it?

share|improve this question

3 Answers

up vote 5 down vote

The reason you're unable to copy that file is not a permission issue, or Windows being "protective" about the file; the problem is, that file is always in use (and therefore locked) on a running system.

When loaded, the file is mapped to HKLM\System; you can use reg.exe to export its contents, both in text and binary format:

reg export HKLM\System system.reg
reg save HKML\System system.hiv

The first one can be opened using any text editor; the latter is a full binary dump, and can be opened by loading it in REGEDIT.

Also, be aware that certain subkeys of HKLM\System are not stored on disk, but are rather populated at runtime by the OS (the most notorious one is CurrentControlSet); so, dumping/saving them might make no sense at all.

share|improve this answer
Ok, so windows puts a lock on the file. I know there's a lock on the file. What purpose does this lock serve other than to protect the file from corruption by other processes? – JustJeff Apr 23 '12 at 22:47
@justjeff Re-read this answer, it explains why the actual file locked -- it's actively in use by the OS. – jscott Apr 23 '12 at 22:58
So is what you're trying to say here, and not saying explicitly, is that there is so much ongoing change in the file (as a result of windows using it), that there's no meaningful snapshot that can be taken of it? – JustJeff Apr 23 '12 at 23:21
@JustJeff If you need a place-in-time copy, PXE (or live CD/DVD) boot the computer, and grab the file. – jscott Apr 24 '12 at 0:22
1  
In regards to your other question: in Unix, opening a file does not lock it by default, and the programmer needs to take extra steps to lock it if they want to. In Windows, opening a file locks it by default, and the programmer needs to take extra steps if they want it to remain unlocked. Now, it's trivial to open a file and leave it unlocked, but few people bother unless there's a specific reason to do so. So the system hive may just be locked by default, there doesn't need to be a purpose for the lock per se. – Harry Johnston Apr 25 '12 at 0:46
show 1 more comment
up vote 2 down vote

I think you want the Volume Shadow Copy Services.

On a server platform, the Diskshadow command-line interface is available.

share|improve this answer
NB: Massimo's answer (using reg save) is better. – Harry Johnston Apr 23 '12 at 20:13
up vote 0 down vote

Unless you need a copy that's right up to date it can sometimes be simpler to just restore the file from backup to a different location.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.