Registry Search-Replace tools – correcting the havoc after a data migration

A while ago, I found myself in the situation where at a corporate client the user profiles had moved on the LAN. Very understandable: it was one of the migrations towards DFS. They notified this in advance, so I made backups of everything (home drive and user profile) just to make sure.

The move indeed caused all sorts of havoc, because the data was moved, but the registry was only slightly modified.

Some of the errors I got were like these:

[Internet Explorer - Search Provider Default]
A program on your computer has corrupted your default search provider setting for Internet Explorer.

Internet Explorer has reset this setting to your original search provider, Live Search (search.live.com).

Internet Explorer will now open Search Settings, where you can change this setting or install more search providers.
[OK]

and

[Desktop]
\\old-server\old-share\user-id\Desktop refers to a location that is unavailable. It could be on a hard drive on this computer, or on a network. Check to make sure that the disk is properly inserted, or that you are connected to the Internet or your network, and then try again. If it still cannot be located, the information might have been moved to a different location.
[OK]

Below some of the ramblings on what I did to get everything working again, including registry searches when you are not allowed to run RegEdit, searching through text, and the places in the registry that had to change.

Apart from changing network shares, I needed to do a global search replace in the HKLU part of the registry of this form:

• From: \\old-server\userdata-share\user-id\Application Data
• To: \\new-server\dfs-share\userdata-path\user-id\Application Data

• From: \\old-server\userdata-share\user-id\Desktop
• To: \\new-server\dfs-share\userdata-path\user-id\Desktop

• From: \\old-server\userdata-share\user-id\Home
• To: \\new-server\dfs-share\userdata-path\user-id\Home

The above paths were easy to find as they were also used outside the registry.

• From: \\old-server\profile-share\user-id
• To: \\new-server\dfs-share\profile-path\user-id

This path was hard to find, as the path to the roaming user profile storage was only available in the registry under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\SidXXX in the key CentralProfile. where SidXXX is the SID of the user.

You can get that SID by performing this PSGETSID command (from SysInternals) on the console:

psgetsid %USERNAME%

It took a while to find that out, as RegEdit.exe and RegEdt32.exe are not allowed here in UI mode, nor is installing new software.
Luckily, the command-line mode of RegEdit.exe and the REG.EXE commandline registry tool are allowed, so I could export the registry and perform some search operations.

Editing the Registry that way is tough, so I looked for a downloadable, standalone running Registry search-replace tool and found some in the SuperUser.com question on Registry Search & Replace Tool.

The NirSoft RegScanner tool helped me find the registry keys, but it didn’t find all of them.
For instance, it didn’t find the new user-data share in the HKEY_CURRENT_USER\Volatile Environment , nor the Profilelist.

I started using this tiny batch-file using the REG EXPORT command to export all the registry roots, then did a search using notepad through them for the old profile and userdata shares.

@echo off
  if "%1"=="" goto :help
:list
  for %%r in (HKLM, HKCU, HKCR, HKU, HKCC) do REG EXPORT %%r %%r.%1
  goto :end
:help
  echo Syntax: %0 basefilename
  echo This will export the registry to HKLM.basefilename, HKCU.basefilename, HKCR.basefilename, HKU.basefilename and HKCC.basefilename
:end

Note that the output of REG is using UTF-16 as text format (the Registry can store data as Unicode), which many text tools don’t support. Since the utf162utf8 win32 search didn’t get many results, I used the UTF82ASCII tool I wrote long ago to a UTF162UTF8 tool and published the backlog of  C# text encoding sample sources (requires .NET 2.0 and higher) and Delphi text encoding sample sources (requires Delphi 2009 or higher).

In the end, none of the search tools, nor the exports would by default find the ProfileList, except for Nirsoft’s RegScanner (search only) and the Registrar Registry Manager by Daniel Terell (search and edit). Registrar Registry Manager – after installing on Windows 7 – can be just copied over on a new machine by copying the C:\Program Files\Registrar Registry Manager directory.

I could persuade REG EXPORT to do it by manually adding the full path ” HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList” on the command-line.

It means that most of the search tools barf one way or the other without warning and are therefore unreliable.

Learning all this, I modified a lot of registry keys to get the system working again; these were the more common ones:

• Key: HKEY_CURRENT_USER\Software\Microsoft\Office\Common
• Name: FontBmpCache
• Old Value: \\old-server\userdata-share\user-id\Application Data\Microsoft\Office\fbc1FB.tmp
• New Value: \\new-server\dfs-share\userdata-path\user-id\Application Data\Microsoft\Office\fbc1FB.tmp

• Key: HKEY_CURRENT_USER\Software\Microsoft\VisualStudio\6.0
• Name: ProfilePath
• Old Value: \\old-server\userdata-share\user-id\Application Data\Microsoft\Visual Studio\
• New Value: \\new-server\dfs-share\userdata-path\user-id\Application Data\Microsoft\Visual Studio\

• Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
• Name: AppData
• Old Value: \\old-server\userdata-share\user-id\Application Data
• New Value: \\new-server\dfs-share\userdata-path\user-id\Application Data

• Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
• Name: Desktop
• Old Value: \\old-server\userdata-share\user-id\Desktop
• New Value: \\new-server\dfs-share\userdata-path\user-id\Desktop

• Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
• Name: Personal
• Old Value: \\old-server\userdata-share\user-id\Home\My Documents\My Pictures
• New Value: \\new-server\dfs-share\userdata-path\user-id\Home\My Documents\My Pictures

• Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
• Name: My Pictures
• Old Value: \\old-server\userdata-share\user-id\Home\My Documents
• New Value: \\new-server\dfs-share\userdata-path\user-id\Home\My Documents

• Key: HKEY_CURRENT_USER\Volatile Environment
• Name: APPDATA
• Old Value: \\old-server\userdata-share\user-id\Application Data
• New Value: \\new-server\dfs-share\userdata-path\user-id\Application Data

Postface:

Still some of the software doesn’t work, all of them storing their configuration in binary data, not in the registry.

The above exercise shows you that a transition can be painful, but still doable because of the power that the registry has.

I wish more applications would use it…

–jeroen