How to View Old Registry?

[Don Cohen]

I am having problems running Remote Assistance on my XP Home computer, which
used to do this just fine. I have tracked down the likely cause to an SID
change, which presumably arose when I replaced my primary hard drive with a
larger one, and used an Image created with DriveImage 2002 to restore the OS
partition to the new drive.

I still have the original image, and it would contain the original Registry
files, which in turn would show the original SID for this system.

What I need to know is how can I look at the registry contained in that
image? DriveImage has a way of viewing the folder and file contents of the
original OS, so I can access them, or copy/paste them if needed. Is there a
program that can "open" the registry contained in those files, or is there
some way I can view/display the registry, analogous to using REGEDIT?

Any suggestions appreciated.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Nepatsfan]

In

I am having problems running Remote Assistance on my XP Home
computer, which used to do this just fine. I have tracked
down the
likely cause to an SID change, which presumably arose when I
replaced
my primary hard drive with a larger one, and used an Image
created
with DriveImage 2002 to restore the OS partition to the new
drive.

I still have the original image, and it would contain the
original
Registry files, which in turn would show the original SID for
this
system.
What I need to know is how can I look at the registry
contained in
that image? DriveImage has a way of viewing the folder and
file
contents of the original OS, so I can access them, or
copy/paste them
if needed. Is there a program that can "open" the registry
contained
in those files, or is there some way I can view/display the
registry,
analogous to using REGEDIT?
Any suggestions appreciated.

How about trying a different approach to finding a solution to
this problem. First off, you might want to post your question
in this newsgroup.

microsoft.public.windowsxp.work_remotely

Instead of telling them what you think the solution is, try
providing information about what happens when you try to use
Remote Assistance. Include any error messages you receive.
There are usually two areas that cause RA to fail, a
misconfigured firewall or a NAT router.

Also, in one of your earlier posts on this topic, you cited
this article as the reason why you felt your computer's SID was
the source of your problem.

You Cannot Offer Remote Assistance To A Computer Running
Windows XP
http://support.microsoft.com/kb/555385

The information provided in that article wouldn't apply to your
computer. It discusses problems surrounding a system "offering"
Remote Assistance. To be able to offer unsolicited Remote
Assistance to another computer you would have to be running XP
Professional and be a member of an Active Directory Domain.
You're Windows XP Home computer is only capable of providing
Remote Assistance when asked and could never be a member of an
AD domain.

Bottom line, instead of focusing on the SID, you might want to
start looking at what may have changed on your system or the
remote computers in terms of networking. If you're unwilling to
use Windows Messenger to facilitate a Remote Assistance session
then you might want to remove any routers from the equation.
Any of these computers have Norton AntiVirus installed? NAV has
a worm stopper which I believe can interfere with RA. Try
shutting down any firewall programs other than the one built
into XP.

Good luck

Nepatsfan

 

[Claymore]

Hello Don,

Go to Start => Run and type in regedt32
Select the hive HKEY_LOCAL_MACHINE
Go to File and click on Load Hive
Navigate to the Registry Hive you want to edit (e.g. D:\Windows
\System32\Config\Software).
You will be asked for a key name to load the Registry Hive into. Give
it a name such as "Import".
The imported Hive will show up in the Registry tree and you can edit
it like any normal hive.
When you're finished editing, go to File and click on Unload Hive to
save the edited hive.

 

[Don Cohen]

First, thanks for the reply.

How about trying a different approach to finding a solution to this
problem. First off, you might want to post your question in this
newsgroup.

microsoft.public.windowsxp.work_remotely

I have already done that, and received essentially no useful replies,
unfortunately. The various other posts are the result of my own searching
and attempts to pinpoint the problem.

Instead of telling them what you think the solution is, try providing
information about what happens when you try to use Remote Assistance.
Include any error messages you receive. There are usually two areas that
cause RA to fail, a misconfigured firewall or a NAT router.

Again, I have done that in previous posts, in great detail - see the end of
this post. Unfortunately, neither of the areas that you suggest is the
problem here.

Also, in one of your earlier posts on this topic, you cited this article
as the reason why you felt your computer's SID was the source of your
problem.

You Cannot Offer Remote Assistance To A Computer Running Windows XP
http://support.microsoft.com/kb/555385

The information provided in that article wouldn't apply to your computer.
It discusses problems surrounding a system "offering" Remote Assistance.
To be able to offer unsolicited Remote Assistance to another computer you
would have to be running XP Professional and be a member of an Active
Directory Domain. You're Windows XP Home computer is only capable of
providing Remote Assistance when asked and could never be a member of an
AD domain.

I see what you're saying here. In my situation, I am definitely responding
to a RA request initiated from my kids computers. I hadn't considered that
this might be different from "offering" RA, but if they are in fact
different events, then you're right about my barking up the wrong tree here.

Bottom line, instead of focusing on the SID, you might want to start
looking at what may have changed on your system or the remote computers in
terms of networking. If you're unwilling to use Windows Messenger to
facilitate a Remote Assistance session then you might want to remove any
routers from the equation. Any of these computers have Norton AntiVirus
installed? NAV has a worm stopper which I believe can interfere with RA.
Try shutting down any firewall programs other than the one built into XP.

I've tried disabling both NAV and shutting down Zone Alarm, individually,
and both together. Neither helped. I also had the same thing done on the
kids' side, with no joy. The error message comes up so quickly when I open
the RA email attachment, that I'm pretty sure it's coming from my system,
and not theirs.

For completeness, here is the text of the first post I made on this subject,
to both help_and_support as well as work_remotely, which provides all the
pertinent information:


My system is a Gateway 700XL, Win XP Home, SP2, all updates installed. Well
maintained, running smoothly.

I used to be able to provide assistance to my kids and their computers using
Remote Assistance initiated on their end. When I recently tried again, I
received the following error message after launching the file received via
email from them in Outlook Express:

"There is a problem with the invitation and it cannot be opened.
To use Remote Assistance, the sender of this invitation will have
to send you a new invitation."

I tried temporarily disabling ZoneAlarm (Free) on both computers, disabling
NAV, etc., but no-go.

I researched this and found the suggestion to boot into Safe Mode and run:

sessmgr.exe -service

which I've done, but the problem hasn't changed.

When I check Event Manager, each time I try I find this:

RA: A XML parsing error for (local user) xxx occurred when attempting to
process a remote assistance ticket.
Event ID: 5102

In researching this, I discovered reference to SID as a possible source of
the problem.

I then recalled that about 6 months ago, I upgraded my system with a new
Hard Drive. I have used DriveImage 2002 since buying this computer, to
periodically create images of my OS partition, as back-up, and so I used a
fresh created image of the old OS partition, to recreate the prior C: drive
onto a partition of my brand new and larger hard drive. Everything else has
worked fine. I think XP has to re-verify the authenticity of my copy of
Windows, which it did without problem.

So I'm guessing that this created the SID issue, which is preventing me from
using Remote Assistance. I'm fairly knowledgeable about computer hardware
and software in general, but must confess I know virtually nothing about
SID. And I don't have on-hand any tools that could change SID. I looked at
Drive Image, and saw no reference whatsoever to it.

First - am I on the right track in suspecting an SID issue is responsible
for the Remote Assistance problem?

Second - if I am, what is the safest way to change this, what do I change it
to, and what possible unintended consequences might I incur?

Many thanks.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Don Cohen]

Hello Don,

Go to Start => Run and type in regedt32
Select the hive HKEY_LOCAL_MACHINE
Go to File and click on Load Hive
Navigate to the Registry Hive you want to edit (e.g. D:\Windows
\System32\Config\Software).
You will be asked for a key name to load the Registry Hive into. Give
it a name such as "Import".
The imported Hive will show up in the Registry tree and you can edit
it like any normal hive.
When you're finished editing, go to File and click on Unload Hive to
save the edited hive.

Many thanks for this, Claymore.

My main concern here would be 'contaminating' the actual current registry of
my system. Would doing what you suggest result in permanent changes to the
'real' registry?

I'm just wanting to examine the previous registry that is stored in the
Drive Image, to see whether or not the SID reference is different from what
is in my current registry, and at this point, not to make any changes. If
it is, then this might help me to resolve my original problem.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Claymore]

Hello Don,

Of course, you will back up your Registry before doing anything - just
in case - but think of it as opening a document in a word processor,
editing it and saving the changes. If you don't make any changes, then
the imported registry hive is unloaded with no changes to its original
location, and your registry is unchanged. Since you're giving the
imported registry hive a name not normal in the registry, e.g.
"Import", even if you left it unloaded, it wouldn't figure since no
program or setting is going to point to a key called "Import". When
the loaded ("imported" hive is loaded, you can examine it, edit it, or
export keys out of it to be copied to the currently active registry.

But ... export your current registry, just in case.

 

[Don Cohen]

Hello Don,

Of course, you will back up your Registry before doing anything - just
in case - but think of it as opening a document in a word processor,
editing it and saving the changes. If you don't make any changes, then
the imported registry hive is unloaded with no changes to its original
location, and your registry is unchanged. Since you're giving the
imported registry hive a name not normal in the registry, e.g.
"Import", even if you left it unloaded, it wouldn't figure since no
program or setting is going to point to a key called "Import". When
the loaded ("imported" hive is loaded, you can examine it, edit it, or
export keys out of it to be copied to the currently active registry.

But ... export your current registry, just in case.

Understood, Claymore.

Thanks.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Don Cohen]

Hi Claymore,

I need a couple of specifics before attempting this:

Hello Don,

Go to Start => Run and type in regedt32
Select the hive HKEY_LOCAL_MACHINE
Go to File and click on Load Hive
Navigate to the Registry Hive you want to edit (e.g. D:\Windows
\System32\Config\Software).
You will be asked for a key name to load the Registry Hive into. Give
it a name such as "Import".
The imported Hive will show up in the Registry tree and you can edit
it like any normal hive.
When you're finished editing, go to File and click on Unload Hive to
save the edited hive.

I have restored the files from the original OS partition Drive Image, in the
folder (c:\winnt\system32\config), to a non-OS location on my current hard
drive. It is my understand that XP Home's registry is contained in files in
this folder (along with user-specific settings in the 'Documents and
Settings' folder, which I haven't yet restored).

When I run REGEDT32, and click "Load Hive", it basically shows all the
files. Which specific file do I select there, that will contain the
registry? There are no conventional *.reg files. The 2 main ones seem to
be SOFTWARE and SYSTEM, with no file extensions, along with SAM and
SECURITY.

Thanks!

 

[Claymore]

Hi Claymore,

I need a couple of specifics before attempting this:





I have restored the files from the original OS partition Drive Image, in the
folder (c:\winnt\system32\config), to a non-OS location on my current hard
drive. It is my understand that XP Home's registry is contained in files in
this folder (along with user-specific settings in the 'Documents and
Settings' folder, which I haven't yet restored).

When I run REGEDT32, and click "Load Hive", it basically shows all the
files. Which specific file do I select there, that will contain the
registry? There are no conventional *.reg files. The 2 main ones seem to
be SOFTWARE and SYSTEM, with no file extensions, along with SAM and
SECURITY.

Thanks!

Hello Don,

In File => Import you would select in 'Files of Type' 'Registry Hive
Files'. I think you're getting this already.

As to which hive to import:

-----------------------------------------------------------------------------------

The Registry in XP is contained in these files on your computer:

The following 6 Registry files are stored in %SystemRoot%
\System32\Config\:

Sam
Security
Software
System
Default
Userdiff

NTUSER.dat

The 7th (NTUSER.dat) file is stored in \Documents and Settings
\<username>\

--------------------------------------------

I also gather that you just want to look at them, so you can import to
HKLM and view the hive there, and Export a specific key if you want.

I gather you want to look at a user profile (SID e.g. S-1-5-20 etc.)
The logged on user (at the time the image was made) is in NTUSER.DAT
Userdiff would be the SID_Classes key underneath the above in the
registry hive HKEY_USERS

Anyway, if you don't find in there what you're looking for, you can
try importing Software or possible System. If you load more than one
hive, give each a different name e.g. Import1, Import2.

Just be careful, Don.

 

[Don Cohen]

Hi Claymore,

As to which hive to import:

The Registry in XP is contained in these files on your computer:

The following 6 Registry files are stored in %SystemRoot%
\System32\Config\:

Sam
Security
Software
System
Default
Userdiff

NTUSER.dat

The 7th (NTUSER.dat) file is stored in \Documents and Settings
\<username>\

--------------------------------------------

I also gather that you just want to look at them, so you can import to
HKLM and view the hive there, and Export a specific key if you want.

I gather you want to look at a user profile (SID e.g. S-1-5-20 etc.)
The logged on user (at the time the image was made) is in NTUSER.DAT
Userdiff would be the SID_Classes key underneath the above in the
registry hive HKEY_USERS

Anyway, if you don't find in there what you're looking for, you can
try importing Software or possible System. If you load more than one
hive, give each a different name e.g. Import1, Import2.

Exactly the information I needed - much appreciated.

Just be careful, Don.

Don't I know it!! That's why I'm trying to define each step as precisely as
I can, with these follow-up questions. As you recall, I'm wanting to see
the SID in the original registry, to determine if it has been changed after
restoring the image to the new HD. If it's the same, then I can't blame it
for the original problem I'm trying to resolve, with Remote Assistance; if
it's different, then that might hold the 'key.'

And I'll definitely backup the registry before doing anything.

Measure twice, cut once!!

Best,

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Claymore]

Hi Claymore,

As to which hive to import:

The Registry in XP is contained in these files on your computer:

The following 6 Registry files are stored in %SystemRoot%
\System32\Config\:


The 7th (NTUSER.dat) file is stored in \Documents and Settings
\<username>\

I also gather that you just want to look at them, so you can import to
HKLM and view the hive there, and Export a specific key if you want.

I gather you want to look at a user profile (SID e.g. S-1-5-20 etc.)
The logged on user (at the time the image was made) is in NTUSER.DAT
Userdiff would be the SID_Classes key underneath the above in the
registry hive HKEY_USERS

Anyway, if you don't find in there what you're looking for, you can
try importing Software or possible System. If you load more than one
hive, give each a different name e.g. Import1, Import2.

Exactly the information I needed - much appreciated.

Just be careful, Don.

Don't I know it!! That's why I'm trying to define each step as precisely as
I can, with these follow-up questions. As you recall, I'm wanting to see
the SID in the original registry, to determine if it has been changed after
restoring the image to the new HD. If it's the same, then I can't blame it
for the original problem I'm trying to resolve, with Remote Assistance; if
it's different, then that might hold the 'key.'

And I'll definitely backup the registry before doing anything.

Measure twice, cut once!!

Best,

--
Don
Photo Website at:http://www.dlcphotography.net

[Remove the "lens cap" for email]- Hide quoted text -

- Show quoted text -

And, Don, create a Restore Point also. If everything went very bad
(unlikely) and you can't start Windows because of a corrupted
Registry, there's a way, using the Recovery Console, to replace the
Registry with one extracted from a Restore Point.

Good Luck!

 

[Don Cohen]

And, Don, create a Restore Point also. If everything went very bad

(unlikely) and you can't start Windows because of a corrupted
Registry, there's a way, using the Recovery Console, to replace the
Registry with one extracted from a Restore Point.

Not a bad suggestion, although I generally have System Restore turned off on
my computers. It chews up a lot of hard drive space, which is sometimes at
a premium. My fail-safe backup strategy is having reasonably recent Images
of my OS Partition to restore if it goes south, with all my data on a
separate partition, so it's not at risk (as well as having both backed up on
external hard drives).

OTOH, it wouldn't hurt to briefly turn it on before doing this, and turning
off after completing it.

Thanks for the thought.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Ken Blake, MVP]

Not a bad suggestion, although I generally have System Restore turned
off on my computers.

A poor idea, in my view. See below.

It chews up a lot of hard drive space,

Only if you let it take the default 12% of the drive, which is far too much
for most people. System restore is an excellent tool for reverting the
system to a state it was in a few days, or at most a week or two, ago. If
you go
back further than that, you are very likely to get things out of synch with
each other and exacerbate problems, rather than solve them. I recommend
keeping System Restore on, but greatly reducing the amount of disk space it
uses.

which is
sometimes at a premium. My fail-safe backup strategy is having
reasonably recent Images of my OS Partition to restore if it goes
south, with all my data on a separate partition, so it's not at risk
(as well as having both backed up on external hard drives).

Glad to hear you have what sounds like an excellent backup strategy in
place. But System restore isn't a substitute for a backup strategy and can
coexist with even a good one such as yours. It's an excellent tool that very
often can be used to quickly and easily revert the system back to the state
it was in, a day or two ago, before whatever caused a program occurred.
Using it is much easier than using your image backups.

 

[Don Cohen]

Hi Ken,

Glad to hear you have what sounds like an excellent backup strategy in
place. But System restore isn't a substitute for a backup strategy and can
coexist with even a good one such as yours. It's an excellent tool that
very often can be used to quickly and easily revert the system back to the
state it was in, a day or two ago, before whatever caused a program
occurred. Using it is much easier than using your image backups.

Good points; hard to find fault with your recommendations. I may need to
reconsider and give System Restore a little hd space!

Thanks for the post.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Don Cohen]

Also, Ken, now that I've got your attention:

Any thoughts on the cause for the intial problem that is behind all this
other stuff? Here is my original post on this subject:

My system is a Gateway 700XL, Win XP Home, SP2, all updates installed. Well
maintained, running smoothly.

I used to be able to provide assistance to my kids and their computers using
Remote Assistance initiated on their end. When I recently tried again, I
received the following error message after launching the file received via
email from them in Outlook Express:

"There is a problem with the invitation and it cannot be opened.
To use Remote Assistance, the sender of this invitation will have
to send you a new invitation."

I tried temporarily disabling ZoneAlarm (Free) on both computers, disabling
NAV, etc., but no-go.

I researched this and found the suggestion to boot into Safe Mode and run:

sessmgr.exe -service

which I've done, but the problem hasn't changed.

When I check Event Manager, each time I try I find this:

"RA: A XML parsing error for (local user) xxx occurred when attempting to
process a remote assistance ticket.
Event ID: 5102"

In researching this, I discovered reference to SID as a possible source of
the problem.

I then recalled that about 6 months ago, I upgraded my system with a new
Hard Drive. I have used DriveImage 2002 since buying this computer, to
periodically create images of my OS partition, as back-up, and so I used a
fresh created image of the old OS partition, to recreate the prior C: drive
onto a partition of my brand new and larger hard drive. Everything else has
worked fine. I think XP had to re-verify the authenticity of my copy of
Windows, which it did without problem.

So I'm guessing that this created the SID issue, which is preventing me from
using Remote Assistance. I'm fairly knowledgeable about computer hardware
and software in general, but must confess I know virtually nothing about
SID. And I don't have on-hand any tools that could change SID. I looked at
Drive Image, and saw no reference whatsoever to it.

First - am I on the right track in suspecting an SID issue is responsible
for the Remote Assistance problem?

Second - if I am, what is the safest way to change this, what do I change it
to, and what possible unintended consequences might I incur?

Many thanks.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Ken Blake, MVP]

Hi Ken,


Good points; hard to find fault with your recommendations. I may
need to reconsider and give System Restore a little hd space!

Thanks for the post.

Glad to hear that, and you're welcome.

 

[Ken Blake, MVP]

Also, Ken, now that I've got your attention:

Any thoughts on the cause for the intial problem that is behind all
this other stuff? Here is my original post on this subject:

I wish I could help, but unfortunately I have very little experience with
Remote Assistance. I've tried it once or twice, it worked without a problem,
and that's about all I know about it.

 

[Don Cohen]

I wish I could help, but unfortunately I have very little experience with

Remote Assistance. I've tried it once or twice, it worked without a
problem, and that's about all I know about it.

Thanks anyway, Ken.

Best,

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Nepatsfan]

Just out of curiosity, have you tried creating another user
account on your PC and seeing if Remote Assistance works under
that account. If your ISP allows you to create more than one
email account, you could create a new email account and assign
that account in OE for the new user. Then see if you can
establish a Remote assistance session between your laptop and
PC.

Since you don't seem interested in using Windows Messenger with
RA, the only other suggestions I can offer is to try System
File Checker or a repair installation. You're right that
something has changed between now and when you were last able
to use RA. I just think there's a point in time where you have
to try a different path to solving the problem.

Good luck

Nepatsfan

In

 

[Don Cohen]

Thanks for the reply.

Just out of curiosity, have you tried creating another user account on
your PC and seeing if Remote Assistance works under that account. If your
ISP allows you to create more than one email account, you could create a
new email account and assign that account in OE for the new user. Then see
if you can establish a Remote assistance session between your laptop and
PC.

That's an interesting suggestion, and one that also has crossed my mind. I
may have to give that a try and see what happens.

Since you don't seem interested in using Windows Messenger with RA, the
only other suggestions I can offer is to try System File Checker or a
repair installation. You're right that something has changed between now
and when you were last able to use RA. I just think there's a point in
time where you have to try a different path to solving the problem.

If there were some objective reason that using it with Windows Messenger
would yield a different outcome, I'd consider it, but if its just a
different means of transmitting the same basic file, then there'd be no
reason to expect a differnet outcome, I'd rather not re-enable this somewhat
obnoxious utility on my system.

Good luck

Thanks!

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]