3

In order to resolve a registry bloat issue caused by Samsung Print Drivers I'm needing to find a way to Export a user's Roaming Profile NTUSER.DAT Registry Hive while in PowerShell. Loading and Exporting a NTUSER.DAT Registry Hive works in REGEDIT, but so far I have not found a way to do this in PowerShell.

The PowerShell Script I am working on is able to Load the remote Registry Hive, remove keys, and unload. This does not provide a way for free/empty space to be removed from the Registry Hive file. When manually doing this in REGEDIT I've been able to take bloated NTUSER.DAT files that are over 150,000KB and then export them as a new NTUSER_Clean.DAT Registry Hive all the way down to 780KB (for a user with relatively few settings).

PowerShell Example code:

Write-Host "Attempting to load the User Roaming Profile Registry HIVE (NTUSER.DAT)."
#Write-Host $strRemoteLocation
reg load "HKU\$strKeyName" $strRemoteLocation
Write-Host $strLine

Write-Host "Attempting to clean the Registry HIVE of Samsung SSPrint Keys."
Clean_Key $strKeyName "spd__"
Clean_Key $strKeyName "spe__"
Clean_Key $strKeyName "ssp6m"
Write-Host $strLine

# Export Registry HIVE to NTUSER_Clean.DAT
Write-Host "This section would export the Registry HIVE to a new file."
Write-Host "At this point I'm not sure how to do this."
Write-Host $strLine

# Unload the Registry HIVE
Write-Host "Attempting to unload the Registry HIVE."
[gc]::collect()
start-sleep -s 3
reg unload "HKU\$strKeyName"

So far I have NOT found a way to use the reg (reg.exe) to Export as a Registry Hive file. The "reg EXPORT" argument only generates .reg files as far as I am aware.

1 Answer 1

2

Using "reg export" isn't what you want to use to Export a Registry Hive. I did not realize but the "reg save" option allows you to actually save a Registry Hive file such as your NTUSER.DAT.

Found a Microsoft article on reg.exe options and tested using "reg save": http://technet.microsoft.com/en-us/library/cc742108.aspx

PowerShell Code with reg save being used:

Write-Host "Attempting to load the User Roaming Profile Registry HIVE (NTUSER.DAT)."
#Write-Host $strRemoteLocation
reg load "HKU\$strKeyName" "$strRemoteHiveSourcePath\NTUSER.DAT"
Write-Host $strLine

Write-Host "Attempting to clean the Registry HIVE of Samsung SSPrint Keys."
Clean_Key $strKeyName "spd__"
Clean_Key $strKeyName "spe__"
Clean_Key $strKeyName "ssp6m"
Write-Host $strLine

# Export Registry HIVE to NTUSER_Clean.DAT
Write-Host "Attempt to save a new version of the Registry Hive."
reg save "HKU\$strKeyName" "$strRemoteHiveSourcePath\NTUSER_Clean.DAT"
Write-Host $strLine

# Unload the Registry HIVE
Write-Host "Attempting to unload the Registry HIVE."
[gc]::collect()
start-sleep -s 3
reg unload "HKU\$strKeyName"
Write-Host $strLine

# Verify that the NTUSER_Clean.DAT is found.
# If found rename NTUSER.DAT to NTUSER_OLD.DAT and then rename NTUSER_Clean.DAT to NTUSER.DAT
# Clean up NTUSER_OLD.DAT once verified that the new NTUSER.DAT is in place.
if (Test-Path "$strRemoteHiveSourcePath\NTUSER_Clean.DAT") {
    Write-Host "The Exported Registry Hive (NTUSER_Clean.DAT) was found."
    Write-Host $strLine

    Write-Host "Renaming the compacted NTUSER.DAT file to NTUSER_OLD.DAT."
    Rename-Item "$strRemoteHiveSourcePath\NTUSER.DAT" "NTUSER_OLD.DAT"

    Write-Host "Renaming the compacted NTUSER_Clean.DAT file to NTUSER.DAT."
    Rename-Item "$strRemoteHiveSourcePath\NTUSER_Clean.DAT" "NTUSER.DAT"

    # Verify we actually have a NTUSER.DAT file before removing the OLD version.
    if (Test-Path "$strRemoteHiveSourcePath\NTUSER.DAT") {
        Write-Host "Deleting the original NTUSER_OLD.DAT"
        Remove-Item "$strRemoteHiveSourcePath\NTUSER_OLD.DAT"
    }

}else {
   Write-Host "The Exported Registry Hive was NOT found."
   Write-Host "The NTUSER.DAT was NOT compacted."
} 
Write-Host $strLine
2
  • 1
    After all that I realized that the registry unload action is doing a Registry Free-Space Compaction. So all the code for the NTUSER_Clean.DAT was NOT even necessary. I was not expecting this as REGEDIT Unload Registry Hive does not do this so the free-space is never removed from the NTUSER.DAT file without Exporting as different Registry Hive file. Reg.exe apparently is smarter about removing free-space in a Registry Hive.
    – Arachnid
    Feb 11, 2014 at 21:39
  • Found a case where the compaction didn't work no matter if I created a temporary NTUSER_Clean.DAT or what. Ended up using REGEDIT and was able to reduce. I'm not sure why as a number of other NTUSER.DAT files were able to be reduced without issues.
    – Arachnid
    Feb 12, 2014 at 16:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .