Submitted by Igor Vinnykov

Windows registry is an important source of information for network administrators. Many of us have own stories telling how to extract some hidden information from the registry or apply registry tweaks to change the Windows or applications behavior. No doubt, accessing raw data stored in the registry requires some knowledge, but sometimes it is the only way to check the system or application settings. If you need a tool to help you with accessing registry information on remote PCs, a free EMCO Remote Registry Exporter is right for you.

EMCO Remote Registry Exporter

By using EMCO Remote Registry Exporter, you can get access to registry information on remote computers. The application allows you to export selected registry keys or the entire registry from remote PCs and store exported information as .REG files. Using this feature, you can organize a centralized backup of registry information from remote PCs. Alternatively, you may use this tool to get access to particular information on remote PCs, which is stored in the registry. For example, you can check if Adobe Flash is installed, detect the default browser or verify the installed version of a particular application on remote PCs by exporting the corresponding registry keys.

The application allows you to export registry information from remote PCs located in the local network (either in a workgroup or a domain) if you have an administrative access. To export the registry data, you have to specify the set of keys (or the entire registry) and the PCs to export information from. When the operation is completed, the exported data is stored on the local file system in form of .REG files created for every remote computer. Files are stored in a standard REGEDIT5 format, so you can parse them later for information or apply automatically through regedit. For example, you can back up the entire registry of remote PCs before the system is updated to be able to restore the registry if something goes not as expected.

Automation of export tasks is one of the important features of EMCO Remote Registry Exporter. If you need to perform export only once, you can execute this operation immediately. If you plan to repeat the same operation multiple times, you can create a task that would include export options and a list of target PCs, and then execute this task anytime with a single click. Also, if you need to perform export regularly, you can schedule this task for automatic execution. The application allows creating tasks for one-time and recurrent executions. All those tasks can be managed in the calendar view.

You can use the application to organize centralized registry export across the entire networks you manage. If you have doubts about managing the export results, you really have nothing to worry about with EMCO Remote Registry Exporter. The application is designed to be used in corporate networks and let administrators automate their registry export tasks. You can easily check the export execution status for every remote PC and for every task, and get detailed error reports and troubleshooting information in case of problems.

EMCO Remote Registry Exporter

• AutoAdministrator – Part 4: Remote editing: Passwords, Registry, files, ODBC (0)
• FREE: RegScanner – Search the Windows Registry (2)
• Regedit as offline Registry editor (15)
• Free Registry Defrag – Defragment the Windows registry (3)
• FREE: CCleaner – Improve Windows performance by removing unnecessary files and registry entries (5)

In the last part of this series, I covered AutoAdministrator’s remote execution features. Today’s post will describe the remote editing functions.

Note: 4sysops readers get a discount on AutoAdministrator of $20 USD until the end of 2010, which means that you pay only $49 USD instead of the regular price of $69 USD. indicating that you are a 4sysops reader.

Remotely manage passwords

This is one of my favorite AutoAdministrator features. It allows you to verify, change, and reset passwords remotely on multiple machines. This function is especially useful if you want to change the local administrator password on all your machines. Since managing local passwords on multiple machines is somewhat cumbersome, most admins don’t change local administrator passwords often enough.

With AutoAdministrator, you can perform this important security task with a few mouse clicks. The verify function enables you to check if all computers received the new password.

The difference between changing and resetting the password is that with the first option you need to specify the current password of the corresponding account, whereas with resetting a password, you don’t have to know the current password. I recommend the use of the change function always because, after a password reset, the user will no longer be able to access security-related data such EFS encrypted files or Internet Explorer credentials.

Remote Registry editing

Another useful feature of AutoAdministrator is its remote Registry editing function. You can add or change the value of the Registry key types REG_DWORD, REG_SZ, and REG_EXPAND_SZ on multiple machines, regardless of the Windows version they employ. You can also read, delete, or copy REG_DWORD keys or values. AutoAdministrator doesn’t, however, allow you to browse the Registry. That is, you have to know the exact key name you want to edit. I recommend using the copy key name function of the Windows Registry editor. That way, you can just copy and paste those long key paths. Make sure that you delete the main key in the copied key path (for example, HKEY_LOCAL_MACHINE), which AutoAdministrator provides.

Remote file copy

AutoAdministrator’s File Management feature doesn’t really allow you to remotely edit files; however, you can copy files and folders to multiple remote computers, which serves the same purpose. Similar tasks are usually accomplished by using login scripts. The advantage of using AutoAdministrator instead is that you can copy files with admin rights to any location without much hassle. Moreover, you can be sure that the files reach their destination without delay. AutoAdministrator can create a directory structure automatically if it is not yet available on the remote machines. You can also configure the tool to overwrite existing files or delete files on multiple machines.

Remote edit ODBC configuration

Open Database Connectivity (ODBC) is a standard for moving data from one type of database to another. You can use AutoAdministrator to query, copy, and delete a System DSN (Data Source Name). The System DSN, you want to manage, has to be installed on the PC where you are running AutoAdministrator. It is also possible to copy the corresponding drivers to remote computers, overwrite existing settings, and replace locked files during the next reboot. Be careful with this feature because AutoAdministrator has no "undo" function.

AutoAdministrator’s functions are fairly varied and help you solve many different Windows administration problems. It is like a spanner set. You might not know what you will need it for next, but you do know that it is an essential part of every toolbox. Considering AutoAdministrator’s low price, it is almost like a free tool. I think, it belongs in every Windows admin’s toolbox.

• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Raffle: ManageEngine Desktop Central – Part 1: Overview (0)
• FREE: Workspace Manager Express – A roaming user profiles alternative (0)
• Spiceworks installation guide (1)
• Raffle: JiJi Password and Account Expiration Notification Tool (2)

Search Windows Registry

Perhaps even more interesting is that RegScanner offers some very useful search options. For instance, you can limit your search to keys that were modified within a certain time range. This is helpful if you installed a program recently and you only want to find Registry keys that belong to this program.

Moreover, you can limit your search to specific base keys (HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, etc.) and to Registry types (REG_SZ, REG_DWORD, etc.). Also useful is that RegScanner can show the values that belong to keys that contain the search term. You can also restrict the search results to show only keys (no values).

Find Windows Registry entries

What I like about RegScanner is that you can launch another search within the found entries. This is helpful with complex search patterns—for example, if you have to narrow your search to entries of a specific vendor.

Edit Windows Registry

Once you found the Registry entry, you can edit it in regedit by pressing F8 or through RegScanner’s context menu. This distinguishes RegScanner from the Registry editor RegAlyzer, which I reviewed a while back. RegScanner is merely a Registry search tool and not a Registry editor.

Delete Registry entries

However, you can delete Registry entries (keys/values) conveniently with RegScanner. The Registry search tool allows you to mark entries in the result window by clicking them while pressing the CTRL key. You can then delete the entries in one go. This feature comes in handy if you want to quickly get rid of the Registry entries of a certain application.

Export Registry entries

You probably know that you can export Windows Registry entries with regedit to .reg files, which you can then import on another machine. You can also do this in RegScanner. However, this nifty Registry search tool also allows you to select multiple Registry entries in the results pane and then export them into one .reg file. You can also copy multiple entries to the Windows clipboard or to a text file.

I tested RegScanner v1.82.

RegScanner

• FREE: EMCO Remote Registry Exporter – Export registry from network PCs (0)
• AutoAdministrator – Part 4: Remote editing: Passwords, Registry, files, ODBC (0)
• Regedit as offline Registry editor (15)
• Free Registry Defrag – Defragment the Windows registry (3)
• FREE: CCleaner – Improve Windows performance by removing unnecessary files and registry entries (5)

If a computer no longer boots up, often a rogue Registry setting is the culprit. In these cases you need an offline Registry editor, that is you have to edit the Registry from a second installation.  Although there are third party offline Registry editors, you can use regedit as an offline Registry editor. The procedure described here also works with Windows PE (Windows Preinstallation Environment) or Windows RE (Windows Recovery Environment).

Prepare Windows RE or Windows PE

• Windows RE: You only need a Windows 7 or Windows Vista installation DVD. After you boot from the DVD, click “Next,” then click “Repair your computer,” then click “Next” (Use recovery tools), and then “Command Prompt.”

• Windows PE: You can also use Windows PE to launch an offline Registry editor. Check out my article about creating a bootable WinPE USB flash drive for more information.

Use regedit as offline Registry editor

1. Launch regedit on the command prompt.
2. Click HKEY_LOCAL_MACHINE.
3. In the File menu, click “Load Hive.”
4. Open the database file that contains the Registry hive you need:
   • HKEY_LOCAL_MACHINE \SAM = %windir%\system32\config\SAM
   • HKEY_LOCAL_MACHINE \SYSTEM = %windir%\system32\config\SYSTEM
   • HKEY_LOCAL_MACHINE \SOFTWARE = %windir%\system32\config\SOFTWARE
   • HKEY_USERS \.Default = %windir%\system32\config\DEFAULT
   • HKEY_CURRENT_USER = %userprofile%\ntuser.dat
5. Enter an arbitrary key name when prompted. A new node with your key name appears under HKEY_LOCAL_MACHINE. 
6. Edit the Registry entries in the new node. 
7. Click the root folder of your node, and then click “Unload hive” in the File menu. Your changes will be written to the offline Registry.

Note that you can import and export .reg files to the offline Registry edtior. This allows you to use Registry settings from another machine for troubleshooting purposes.

Also note that this procedure can be used to edit the settings of a user profile without logging on with the corresponding user account. In one of my next posts, I will show you how you can—through offline Registry editor—access a computer where you have forgotten the administrator password, without requiring third-party software.

• FREE: EMCO Remote Registry Exporter – Export registry from network PCs (0)
• AutoAdministrator – Part 4: Remote editing: Passwords, Registry, files, ODBC (0)
• FREE: My_7PE – Build Windows 7 PE without WAIK (45)
• FREE: RegScanner – Search the Windows Registry (2)
• Free unzip software – 7-Zip portable (4)

Windows and third party applications constantly write to and remove data from the Registry database. This produces empty areas in the Registry and data become fragmented (scattered) within the Registry file. This process is comparable to disk fragmentation. However, running a disk defrag tool won’t help to reduce Registry defragmentation. Disk defrag tools don’t change the contents of files, while a Registry defrag tool alters the database. This is why Registry defragmentation usually compacts, i.e., reduces, the size of the Registry file.

However, Registry defragmentation is not as risky as Registry cleaning because a defrag tool doesn’t have to understand what the Registry entries mean. Of course, if the defrag tool has a bug, then your Registry might also become corrupted. Therefore, you should always back up the Registry before you mess with it. You can do this with the Windows regedit tool.

Free Registry Defrag will first analyze the Registry and then tell you how much space will be regained after the defragmentation. You can then decide if it is worth the effort. Notice that Free Registry Defrag will reboot the computer after defragmentation is completed. I tested Free Registry Defrag v2.40.

Free Registry Defrag

• FREE: EMCO Remote Registry Exporter – Export registry from network PCs (0)
• AutoAdministrator – Part 4: Remote editing: Passwords, Registry, files, ODBC (0)
• FREE: RegScanner – Search the Windows Registry (2)
• Regedit as offline Registry editor (15)
• FREE: CCleaner – Improve Windows performance by removing unnecessary files and registry entries (5)

CCleaner is a famous free optimization, privacy and cleaning tool. I should have added it long time ago to the list of free administration tools, because it is a valuable tool for admins who have to clean a user’s PC that has been cluttered with junk. This usually improves the performance of a Windows PC that has become slow because too many applications have been installed over time, often leaving traces even after they have been uninstalled. CCleaner can also help to free disk space. If you are planning to upgrade your PC to Windows 7, then it might make sense to get rid of all of the deadwood first—although I would always recommend that you perform a fresh install of a new Windows version.

CCleaner also allows you to remove unwanted traces that web browsers have left on the hard disk. The tool removes information such as the temporary file cache, the URL history, cookies etc. CCleaner supports Internet Explorer, Firefox, Chrome, Opera, and Safari, although the website doesn’t say what kind of traces can be removed for the latter three browsers.

It is also possible to remove Windows Explorer traces, such as recently opened documents or the thumbnail cache. Furthermore, it empties the Recycle Bin, Chkdsk file fragments, memory dumps and more places where the operating stores temporary information (see screenshot above for complete list). Most important thing is that CCleaner can also remove remnants of third party applications. Unfortunately, CCleaner’s homepage doesn’t list all of the supported applications. You can also use CCleaner to uninstall applications and to manage auto starting applications, although both features have only limited functionality.

It also comes with a Registry cleaner. A bloated registry is sometimes the reason for a sluggish PC. The problem with automatic Registry cleaning is that you might end up with a PC having zero speed; that is, with a non bootable system or perhaps with some apps that no longer work properly. This applies to all kinds of automatic PC cleaning tools; however, messing with the Registry is certainly the most dangerous.

Thus, I am missing an undo function in CCleaner. Of course, you can always use Windows System Restore to revert all changes CCleaner has made. However, you should always back up the entire system before running the tool. CCleaner allows you to analyze your disk first and lists all of the changes it intends to do. It certainly makes sense to have a closer look at these and to deselect those that could harm your installation.

I have tried CCleaner v2.25 and I had no problem with it. I also skimmed over some forum discussions before I wrote this post. All in all, it appears that CCleaner is reliable. Just in case you are using the tool, it would be great if you could share your experiences. I would also be interested in other PC cleaning tools.

Cleaning your system is only one way to speed up your PC. Two years ago I wrote a post that gives some additional tips on how to improve the performance of a Windows PC. IT pros probably won’t find anything new there, perhaps, except for the last method, which is still the one that has always worked best for me.

CCleaner

• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Raffle: ManageEngine Desktop Central – Part 1: Overview (0)
• FREE: Workspace Manager Express – A roaming user profiles alternative (0)
• Spiceworks installation guide (1)
• FREE: nspaces – Virtual Desktop Manager (3)

If an application doesn’t work, the first thing to do is to uninstall it and install it again. This often helps simply because corrupted registry entries have been added again to the registry. If it is a simple program with a couple of DLLs you can just register them manually using the regsvr32 command.

You can do it more conveniently with the EMSA Register DLL Tool by using its GUI or the Windows Explorer by right clicking on the program you want to register. You have to enable the shell extensions first via the Options menu if you want to use Explorer. It is also possible to register multiple files with the tool. However, you have to confirm the registration process for each file individually.

The EMSA Register DLL tool can display valuable information such as the description or the version number of a file. It is also possible to create a report of all files in a certain folder. Just right click on the folder and navigate to ActiveX report. Another feature enables you to compare two ActiveX files. I tried the tool under Windows XP and Windows Vista.

EMSA Register DLL Tool

• Dedicated Administrator Connection (DAC) in SQL Server 2008 R2 (3)
• Microsoft System Center Advisor – Part 2: Usage and privacy (0)
• Microsoft System Center Advisor – Part 1: Overview and installation (0)
• FREE: SimpleSysInfo – A customizable system information tool for Windows (0)
• FREE: SysInternalsUpdater – Update Sysinternals Suite (0)

AccessEnum only lists the users and groups who have read or write access and where the deny attribute has been set. In most cases that should be enough though. What I like most about the tool is that it allows you to compare the current configuration with saved settings. This way you can easily find out if someone manipulated access permissions on a certain directory structure. If you right click on a column you can access the folder’s properties and you can also exclude a folder with its subfolders from the list.

The tool hasn’t been updated since November 2006, but it also works on Windows Vista and Windows Server 2008. AccessEnum is a stand-alone app which makes it a good candidate for the tool box on your memory stick.

AcessEnum

• FREE: Smart Defrag – A defragmentation tool (9)
• FREE: Disk Defrag – A disk defragmenter (3)
• FREE: MyDefrag – Script defragmentation (4)
• FREE: Fast Duplicate File Finder – Find and delete duplicate files (2)
• Raffle: StarWind Enterprise CDP Edition – iSCSI SAN Storage Software for Windows (0)

My favorite feature is its search functionality. RegAlyzer supports different search criteria such as wildcards, Boolean operators (AND, OR, NOT) and even regular expressions. You can also limit your search by date (newer than, older than, between and outside of). However, the latter didn’t work properly when I tested it.

More important is RegAlyzer’s search result window. With regedit’s find function you can only jump from hit to hit. This is quite cumbersome. Usually, you have to hit F3 numerous times until you found the right Registry key. By contrast, RegAlyzer displays all matches in a result tab. This allows you to skim over all search results easily. A double click opens the corresponding key in RegAlyzer’s Registry editor. Selected search results can be exported as reg file. RegAlyzer also allows you to replace strings in the Registry database. This is certainly a dangerous function and one should be very careful with it.

What I also like about RegAlyzer is its undo and redo log. Both logs are in reg format which enables you to correct mistakes whenever you messed up your system. Editing the Registry is always risky even if you are a Windows geek. So don’t rely only on the logs and always backup the Registry database before you make changes to it.

Other RegAlyzer features (from the publisher’s site)

• Hierarchical bookmark support
• Jump to key by command line parameter
• Jump to key by typing/copying it into dialog (instead of browsing)
• DWord editing with parallel hex/decimal/binary display
• Support of QWord (64 bit integer)
• Display of .reg file contents without importing it
• Support of version 5 files (Unicode) even with Windows 95/NT
• Low-level display of security settings with option to export it

The only feature I am missing is a global delete function that allows me to remove all Registry entries that match a certain search pattern. This is even more dangerous, but it would save me a lot of time whenever I want to get rid of all entries created by a certain application. What is your favorite Registry editor?

RegAlyzer

• FREE: EMCO Remote Registry Exporter – Export registry from network PCs (0)
• AutoAdministrator – Part 4: Remote editing: Passwords, Registry, files, ODBC (0)
• FREE: RegScanner – Search the Windows Registry (2)
• Regedit as offline Registry editor (15)
• Free Registry Defrag – Defragment the Windows registry (3)

TrackWinstall uses the differential method, i.e. it compares the system states before and after the installation. However, it doesn’t create an MSI installation package. You’ll get an activity protocol instead. This is can be useful if there are conflicts between applications or if you want your packager to create a usable setup file.

The programmer’s description on the homepage is in German. Google’s translation is a bit strange, but understandable. If you start TrackWinstall on an English Windows, it opens with an English-user interface. The help file is in English, too. The tool doesn’t have to be installed; it is a stand-alone-program.

TrackWinstall supports Windows 2000 and XP. I tried it on Vista and it seems to work there, too. There is a version with a graphical user interface and a command line tool.

• MDT Workbench and Windows deployment (0)
• MDT (Microsoft Deployment Toolkit) prerequisites and add-ons (0)
• Introduction to the Microsoft Deployment Toolkit (MDT) (0)
• Raffle: ManageEngine Desktop Central – Part 2: Features (2)
• Deployment toolkit Part 2: Driver deployment tools (0)

SpyProtector prevents keyboard and mouse monitoring, warns you when the registry is changed, and eliminates traces of your internet activities and work on the computer.

• Poll: Are you currently using a monitoring solution? (11)
• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• SCOM 2012 review – Part 8: Dashboards (0)
• SCOM 2012 review – Part 7: Linux and JEE monitoring (4)

The feature I like most is its search function. The Windows registry editor only allows you to jump from one search result to another. RegCOPA presents all results in a list. This way you get a good overview of all search results and makes finding the relevant keys much faster.

Heavy registry users will especially like the possibility to add comments to registry keys. RegCOPA stores these comments within the registry. So, you can search for them too. I didn’t find this feature immediately as I expected since it’s not in the context menu. You have to modify a registry key first in order to see the comment field.

RegCOPA also allows you to take snapshots of the registry, i.e. a complete copy of the registry. Later, you can compare this snapshot with the current state of the registry. This is useful if you want to know what changes an application effected to the registry. If you install programs in your network using a software deployment solution this feature might be quite helpful. Unfortunately, one can’t revert changes to the snapshot using RegCOPA.

You will like the desktop shortcut feature if you edit some keys repeatedly. Just drag and drop a key to the desktop to create a short cut. With a double click, you can access and edit the key.

RegCOPA supports bookmarks and has a simple startup manager. The tool costs $24,95, a 30-day trial version can be downloaded here.

• FREE: EMCO Remote Registry Exporter – Export registry from network PCs (0)
• AutoAdministrator – Part 4: Remote editing: Passwords, Registry, files, ODBC (0)
• FREE: RegScanner – Search the Windows Registry (2)
• Regedit as offline Registry editor (15)
• Free Registry Defrag – Defragment the Windows registry (3)

Microsoft says that the purpose of this “new feature” is to turn off WGA when problems occur. I find this explanation a bit strange. Since the communication is encrypted, nobody really knows what kind of data is being sent to Redmond.

You can disable WGA by deleting the WgaLogon folder under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\ CurrentVersion\Notify in the Registry. However, you won’t be able to update your Windows anymore, although security updates are still possible. Backup the registry before you make any changes.

It seems that this registry key doesn’t appear in those Windows XP versions which are part of the Microsoft Select Program. More information about disabling WGA can be found here.

• FREE: EMCO Remote Registry Exporter – Export registry from network PCs (0)
• How to activate Office 2010? KMS vs. MAK (3)
• Office 2010 MAK activation essentials (0)
• Office 2010 KMS activation essentials (3)
• AutoAdministrator – Part 4: Remote editing: Passwords, Registry, files, ODBC (0)

Windows offers several options to start a program when the operating system comes up. There are several Registry Keys, the startup folder of the current user and the startup folder of all users. Startup Control Panel shows them all in an easy to use GUI. You can disable programs, and see what happens after a reboot if you’re not sure of the program’s function. If you realize that you disabled an essential function, you can enable it again. Other choices are: Moving the entry to another place; starting the program or deleting an entry. You can recover deleted entries later.

The setup of Startup Control Panel will copy the tool to the Windows Control Panel. However, the tool doesn’t have to be installed. You can copy the program to a USB stick. Usually when a user or friend tells me that her/his computer has slowed down recently, I come with my USB stick, start Startup Control Panel and remove tons of self-starting apps. There is a stand-alone version of Startup Control Panel which seems to have the same functionality.

Of course, it’s better not to allow all setup programs to register self-starting components in the first the place. That’s where StartupMonitor comes in. This tool also starts when Windows boots, but this is the case where it really makes sense since it prevents other programs from doing the same. Whenever a setup routine wants to register for one of the automatic start options, StartupMonitor warns you. You can then decide whether to allow it or not. If you don’t allow it, the entry will be disabled in the Startup Control Panel. Thus, if you change your mind, you can enable it again later.

I should mention that Startup Control Panel doesn’t allow managing services on Windows XP computers. There seems to be one tab for it, if you run the tool under Windows 98. I didn’t try this though. Windows XP has its own tool for configuring services. However, I think that it would be nicer, if Startup Control Panel at least showed the services which don’t come with Windows, i.e. services installed by applications.

Mike Lin’s Homepage: Startup Control Panel and StartupMonitor

• Service Account best practices – Part 2: Least Privilege implementation (0)
• Service Account best practices Part 1: Choosing a Service Account (0)
• FREE: Microsoft Standalone System Sweeper – Standalone antivirus software (0)
• FREE: Kaspersky Rescue Disk – Offline antivirus tool (2)
• Forefront Endpoint Protection (FEP) 2012 – Part 2: Deployment and configuration (3)