A registry change is one typo away from a machine that will not sign in. Export the exact key, save the full hive when the stakes are high, and know the two different ways back.
Export with **reg export** or save the whole hive with **reg save**, quote the key path, and restore with **reg import** or by loading the hive. Export the smallest key that contains your change, never the whole tree by reflex.
**reg export** writes a .reg text file you can read and diff. Point it at the deepest key that holds the value, because a giant export is slow to review and slow to restore selectively.
New-Item -ItemType Directory C:\RegBackup -Force | Out-Null
reg export "HKLM\SOFTWARE\Vendor\App" C:\RegBackup\app.reg /yA .reg file is authoritative, but a plain listing is what you read while troubleshooting. Both files together cost nothing and answer different questions.
reg query "HKLM\SOFTWARE\Vendor\App" /s > C:\RegBackup\app-before.txt
Get-Content C:\RegBackup\app-before.txt | Select-Object -First 15**reg save** writes a binary hive, including subkeys a .reg export cannot carry completely. This is the format that also works outside a running Windows, via reg load in the recovery environment.
reg save HKLM\SOFTWARE C:\RegBackup\SOFTWARE.hiv /y
reg save HKLM\SYSTEM C:\RegBackup\SYSTEM.hiv /y
Get-ChildItem C:\RegBackup | Select-Object Name,LengthOne value per command, with the exact type. A wrong type is the classic silent failure: the value exists, the program reads something else, and nothing looks broken.
reg add "HKLM\SOFTWARE\Vendor\App" /v FeatureEnabled /t REG_DWORD /d 1 /f
reg query "HKLM\SOFTWARE\Vendor\App" /v FeatureEnabled**reg import** merges the file back and overwrites the values it contains. For a single value you can also delete it, which returns the program to its built-in default.
reg import C:\RegBackup\app.reg
reg delete "HKLM\SOFTWARE\Vendor\App" /v FeatureEnabled /fA live hive is locked, so restoring a .hiv means loading it under a temporary name in the recovery environment and copying the branch back, or replacing the hive file offline.
reg load HKLM\TempSoftware C:\RegBackup\SOFTWARE.hiv
reg query HKLM\TempSoftware\Vendor\App
reg unload HKLM\TempSoftwareHKLM needs an elevated prompt. Open the terminal as administrator and confirm with whoami /groups that the token is elevated.
The merge may be blocked by policy, or the values are under a path that requires elevation. Import it from an elevated prompt with reg import to see the error.
Wrong registry view or wrong type. Check with reg query /reg:64 and /reg:32; 32-bit apps read the redirected Wow6432Node branch.
The file is already mounted or Windows is using it. Use a different mount name, or do the restore from the recovery environment where the live hive is not loaded.
A .reg file for a key you can name, a hive for a branch you cannot (or when Windows will not boot). The .reg file is smaller and human-readable, the hive is complete.
Yes, but as a whole-machine rollback that also undoes installed programs. A key export is the surgical option.
Import the .reg file you exported, or delete the value you added with reg delete. For hive changes, load the .hiv and copy the branch back, then unload it.
Free · no account needed · tracks your progress