Export with Regedit - Fails for hkey_local_machine

Why does exporting hkey_local_machine from the Windows 10 registry into "registry hive files" fail?

Ghot said:

@Carla Rogers

It is doable.

You might want to open an elevated command prompt and run... sfc /scannow

If you still have problems... try running... chkdsk c: /r <---- can take a while depending on the size of the C: partition.

The c: partition is a 512G SSD, 97G used. This laptop is new, not much on it yet. I just fired sfc /verifyonly to see what comes back before applying any changes.

I should clarify, the following exports of the registry ran without a hitch, all by right clicking on a branch in the left pane in regedit:

• All the exports work when the "save as type" = Registration Files (*.reg)
• Exports of the following work with "save as type" = Registry Hive Files (*.*)
  
  • kjey_classes_root
  • hkey_current_user
  • hkey_current_configuration
  
  The following FAIL with "save as type" = Registry Hive Files (*.*)
  
  • hkey_local_machine
  • hkey_users

The answer is more obvious when you run 'reg save'.

C:\Users\GARLIN\Downloads>reg save HKLM HKLM.hiv
ERROR: Access is denied.

This is true, whether you're Administrator or running as SYSTEM. There are known registry keys which are protected by different permissions (ie. TrustedInstaller). While you could force ownership/permission changes to view them, it's not practical.

My random guess:
- when you export to REG file, it silently skips over inaccessible keys
- when you export to hive file, it can't recover from permission denied.

There is nice little free program RegBak from acelogix which does the job

https://www.acelogix.com/downloads/regbak.zip