Disable EWF RAM-REG when sealed

[Guest]

I have made a windows embedded image for a laptop, I have configured EWF
(RAM-REG). I have also sealed the image (fbreseal). But I have forgotten to
disable EWF (I just used the -commit command). Now my question is: Can I
disable the EWF without having to boot the image and "losing the seal"? May
be connect the HD to an other computer and changing a file?

 

[Brad Combs]

Hello,

You could load the registry hive offline and change the state of the service
to disabled. First attach the disk that has the runtime to you development
workstation. Then, to load the registry file open Regedit, click to
highlight HKLM. Click File -> Load Hive and browse to
\Windows\System32\Config\SYSTEM in the disk that contains the runtime. Type
a name for the temporary key and Regedit will load the contents of the hive
below that temp key. So for example if you named the key "Temp" it would
look like HKLM\Temp\ControlSet001, etc.... Next, expand
ControlSet001\Services\EWF and change any necessary values. Lastly, click to
highlight "Temp" and click File -> Unload Hive. This will unload the hive
and you can now copy this image to other disks.

HTH,
Brad

 

[Guest]

Ok, thanks for your help. Just one little question: How do I load a registry
hive? I have never done this before.

 

[KM]

I believe Brad has included a complete set of instructions how to load registry hives offline in his post.

Just launch regedit on a XP workstation, select root key such as HKLM and go to File menu, Load Hive item.

 

[Guest]

I'm sorry, you are ride, I really need a holiday!