DISM - Edit Registry on an Offline Image  

Page 1 of 3 123 LastLast
    DISM - Edit Registry on an Offline Image

    DISM - Edit Registry on an Offline Image

    How to use DISM to Edit Registry in Offline Windows 10 WIM (Image) File
    Published by Category: General Tips
    12 Oct 2017
    Designer Media Ltd

    information   Information
    Servicing an offline image, mounting an image, committing changes, it all sounds a bit complicated to an average Windows user. However, it's just geek speak meaning modifying default Windows install image, the install.wim file. It is a straight forward procedure. When changes have been committed (written, saved) to image, the modified install.wim can be used to deploy Windows or to replace original install.wim on existing install media.

    Servicing an offline image is done with DISM (Deployment Image Servicing and Management), a native Windows tool. DISM command options allow all kind of changes, changing the way Windows will be installed. Drivers can be added or removed, language packs applied to create a multilingual Windows install media, Windows Updates applied to get a new Windows installation to be up to date straight after installation, and so on.

    This tutorial will show how to modify Windows registry on an offline image.





    Contents

     Use links below to go to any step, back button of your browser to return to this list.



    Step One: Mount Offline Image
    Step Two: Edit Offline Registry
    Step Three: Commit (save) changes




    Step One

     Mount Offline Image

    1.1) Create a new folder, name it as you want to. In this example I create the folder on drive D: naming it ISO_Files.

    1.2) Mount a Windows 10 ISO image as virtual DVD by double clicking it. Open mounted ISO in Explorer, select all files and folders with CTRL + A and copy them with CTRL + C, paste the ISO content to ISO_Files folder with CTRL + V:
    DISM - Edit Registry on an Offline Image-image.png

    DISM - Edit Registry on an Offline Image-image.png
    Note   Note
    If you have Windows 10 install media on a USB flash drive, you can skip steps 1.1 & 1.2 and use it instead.

    1.3) Create a folder to mount offline image. In this example I use folder C:\Mount.

    1.4) Open elevated PowerShell (tutorial). Enter following command to check what editions are included in image:

    Dism /Get-WimInfo /WimFile:D:\ISO_Files\Sources\install.wim

    Note the index number of your selected edition. In this example I have copied all content of Windows Insider build 16299 to ISO_Files folder. I want to use PRO edition to edit its registry, noting its index number 8:
    DISM - Edit Registry on an Offline Image-image.png

    1.5) Mount the image of your preferred Windows 10 edition using it's index number, index 8 in this example:

    Dism /Mount-Wim /WimFile:D:\ISO_Files\Sources\install.wim /index:8 /MountDir:C:\Mount

    This will take some time. Please notice, the drive where the Mount folder is located needs some free space. I do not recommend mounting an image to a folder on a drive with less than 15 GB free space. For instance, mounting the multi edition build 16299.15 image requires almost 12 GB, in addition to space required to work with the image:
    DISM - Edit Registry on an Offline Image-image.png



    Step Two

     Edit Offline Registry

    2.1) To be able to edit offline registry, offline registry hive you want to modify needs to be imported to a temporary hive in your host registry. In this example I will import HKLM\Software hive from offline registry to a temporary hive named OFFLINE in host registry:

    reg load HKLM\OFFLINE C:\Mount\Windows\System32\Config\Software

    Above command creates a new hive HKLM\OFFLINE in host registry importing HKLM\SOFTWARE hive from offline image to it. Replace the imported hive name with one you want to import, for instance the following command would import hive SECURITY from offline image:

    reg load HKLM\OFFLINE C:\Mount\Windows\System32\Config\Security

    You can import SOFTWARE, DEFAULT, DRIVERS, SAM or SYSTEM hives.

    2.2) Open Registry Editor (regedit) on host, you will notice it now contains temporary hive HKLM\OFFLINE:
    DISM - Edit Registry on an Offline Image-image.png

    2.3) Edit registry settings in temporary hive as you wish. See a practical example in this post: Add or Remove Internet Explorer Desktop Icon in Windows 10 Browsers Email Tutorials



    Step Three

     Commit (save) changes

    3.1) When done with registry edits, unload temporary hive with following command:

    reg unload HKLM\OFFLINE

    This removes temporary hive from host registry

    3.2) Unmount offline image committing (saving) changes with following command:

    Dism /Unmount-Image /MountDir:C:\mount /Commit

    The /Commit switch takes care of saving all changes to install.wim file.

    3.3) If you were using Windows image on a USB drive, you are done. You can now install Windows 10 which by default contains changes you've made.

    3.4) If you were using image copied from an ISO image to ISO_Files folder, you can now create a new ISO using your preferred tool (Rufus for instance), or as told in Part Five in this tutorial: Create Windows 10 ISO image from Existing Installation Installation Upgrade Tutorials

    That's it geeks!

    Kari






  1. Posts : 52
    Windows 10 Pro 64-Bit
       #1

    Hello Kari. Do you need to commit changes after modifying each hive? Or can you unload one hive then import another before committing the changes?

    I started with the "Software" hive and want to modify "System"

    My guess is multiple hives can be loaded and unloaded one by one, then all the changes can be saved.

    Thanks for the work on this tutorial.
    Last edited by Barefoot; 30 Jul 2018 at 13:45.
      My Computer


  2. Posts : 17,661
    Windows 10 Pro
    Thread Starter
       #2

    You can import one hive at the time, then commit changes when you have edited all hives.

    Kari
      My Computer


  3. Posts : 52
    Windows 10 Pro 64-Bit
       #3

    I started with the HKLM\Software hive, and it loaded fine. When I attempted to load HKLM\System, access was denied. DISM - Edit Registry on an Offline Image-2018-08-01_20h07_37.png

    Second question. Can hives other than HKLM be modified?
    I'd like to remove the shortcut name extension by going to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer, and modifying the link BINARY to 00 00 00 00 = off, then HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NamingTemplates, and deleting the ShortcutNameTemplate string value.
      My Computer


  4. Posts : 4,511
    several
       #4

    You have given them both the same name.OFFLINE.

    I suggest in future you load software hive as the name SOFT
    REG LOAD HKLM\SOFT F:\MOUNTBOOT\WINDOWS\SYSTEM32\CONFIG\SOFTWARE

    then load system hive as the name SYS
    REG LOAD HKLM\SYS F:\MOUNTBOOT\WINDOWS\SYSTEM32\CONFIG\SYSTEM

    For now, as you have loaded software hive as the name OFFLINE

    You are ok to load system hive as the name SYS.
      My Computer


  5. Posts : 52
    Windows 10 Pro 64-Bit
       #5

    Thanks. Good suggestion. I wondered if the name should be changed. Your naming suggestion makes identifying where you are in the registry easier.

    I'm still curious if changes can be made to HKEY_CURRENT_USER. Powershell only allows loading HKLM and HKU.
      My Computer


  6. Posts : 317
    Microsoft Windows 10 x64
       #6

    thanks kari, you make everything easy
      My Computer


  7. Posts : 4,511
    several
       #7

    Not clear what you are trying to do. There is no HKCU hive. That is key on your currently running system. It is a combination of the user settings in %userprofile%\ntuser.dat and links to HKLM\Software.

    If you are trying to adjust user settings on the installation media - load users\administrator\ntuser.dat and users\default\ntuser.dat from the installation media. The ntuser.dat files are hives.

    Regedit allows you to load hives under the HKLM or HKU keys.

    Barefoot said:
    Thanks. Good suggestion. I wondered if the name should be changed. Your naming suggestion makes identifying where you are in the registry easier.

    I'm still curious if changes can be made to HKEY_CURRENT_USER. Powershell only allows loading HKLM and HKU.
    Last edited by SIW2; 02 Aug 2018 at 13:32.
      My Computer


  8. Posts : 4,511
    several
       #8

    Kari,
    I am not convinced powershell is the best way to do this. It is reliant on netframe, slow, and creates handles to the keys which can be difficult when unloading.

    I would suggest using regedit directly, or via cmd prompt. If you want to do it via script, .cmd using reg.exe is probably easier.
      My Computer


  9. Posts : 41,412
    windows 10 professional version 1607 build 14393.969 64 bit
       #9

    What options if any are there when using a windows 10 iso and winre?

    For example in winre running the command: sfc /scannow /offbootdir=d:\ /offwindir=d:\windows
    may display
    windows resource protection could not start the repair service
    or
    windows resource protection found corrupt files but was unable to fix some of them.

    If the log file displays problems in the registry what options are there to troubleshoot in winre?
      My Computer


 

Tutorial Categories

DISM - Edit Registry on an Offline Image Tutorial Index Network & Sharing Instalation and Upgrade Browsers and Email General Tips Gaming Customization Apps and Features Virtualization BSOD System Security User Accounts Hardware and Drivers Updates and Activation Backup and Restore Performance and Maintenance Mixed Reality Phone


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 03:12.
Find Us




Windows 10 Forums