So Windows takes a periodic backup of the HKLM Registry hives and stores them in the C:\Windows\System32\Config\RegBack folder and I'm in a position where I need to restore only a sub-key of the SOFTWARE hive (As the file has been restored from a file-system backup from a few weeks ago), however I'm unsure how to go about doing this rather than having to restore the entire SOFTWARE hive.

If I Load in the restored SOFTWARE file on another machine I can browse the entries, but they have to be in a uniquely named Key/Hive/Folder, and if I export the sub-key (And all of it's sub-keys) that I want then any attempt to re-import it will only import it to that temporary unique name from when I loaded the Hive.

Short of exporting this way and then manually changing the path of all the sub-keys in the exported .reg file I'm not sure how else I can possibly do this. Is there something I'm missing that anyone else might know?

CodePudding user response：

Create a program that calls RegLoadKey and then RegCopyTree. This should preserve the security descriptors unlike a .reg file.

With PowerShell you can do Copy-Item -Path 'HKLM:\mybackup' -Destination 'HKLM:\foo\bar' -Force -Recurse but I don't know if this copies all HKEY details or just the names and values.