Re: Disable EWF RAM-REG when sealed

I believe Brad has included a complete set of instructions how to load registry hives offline in his post.

Just launch regedit on a XP workstation, select root key such as HKLM and go to File menu, Load Hive item.

--
=========
Regards,
KM

Ok, thanks for your help. Just one little question: How do I load a registry
hive? I have never done this before.

"Brad Combs" wrote:

Hello,

You could load the registry hive offline and change the state of the service
to disabled. First attach the disk that has the runtime to you development
workstation. Then, to load the registry file open Regedit, click to
highlight HKLM. Click File -> Load Hive and browse to
\Windows\System32\Config\SYSTEM in the disk that contains the runtime. Type
a name for the temporary key and Regedit will load the contents of the hive
below that temp key. So for example if you named the key "Temp" it would
look like HKLM\Temp\ControlSet001, etc.... Next, expand
ControlSet001\Services\EWF and change any necessary values. Lastly, click to
highlight "Temp" and click File -> Unload Hive. This will unload the hive
and you can now copy this image to other disks.

HTH,
Brad

"R.Demandt" <RDemandt@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F5713253-7256-43E9-BF4B-1969F70CEBB3@xxxxxxxxxxxxxxxx
I have made a windows embedded image for a laptop, I have configured EWF
(RAM-REG). I have also sealed the image (fbreseal). But I have forgotten
to
disable EWF (I just used the -commit command). Now my question is: Can I
disable the EWF without having to boot the image and "losing the seal"?
May
be connect the HD to an other computer and changing a file?





.

Relevant Pages

  • Re: Assuming one boots partition x
    ... You boot Windows XP on Partition X and you start Regedit and select the Load Hive feature. ... Using Regedit you can only load hives as shown in the Config folder, other than the ntuser.dat and the volatile hives, the files in the Config folder contain the whole registry. ...
    (microsoft.public.windowsxp.general)
  • Re: Perflib bug!
    ... You can still delete the key offline, meaning from another OS load. ... - Create a really small XPe image that would be able to use reg.exe from CMD. ... predefined set of commands to update the big image's hives. ... You just have to add a self-deleting batch file call to the StartUp items of the big image. ...
    (microsoft.public.windowsxp.embedded)
  • Re: Perflib bug!
    ... You can still delete the key offline, meaning from another OS load. ... - Create a really small XPe image that would be able to use reg.exe from CMD. ... predefined set of commands to update the big image's hives. ... You just have to add a self-deleting batch file call to the StartUp items of the big image. ...
    (microsoft.public.windowsxp.embedded)
  • Re: Perflib bug!
    ... You can still delete the key offline, meaning from another OS load. ... - Create a really small XPe image that would be able to use reg.exe from CMD. ... predefined set of commands to update the big image's hives. ... You just have to add a self-deleting batch file call to the StartUp items of the big image. ...
    (microsoft.public.windowsxp.embedded)
  • Re: Loading Hive with Script
    ... you can use a program called reg.exe to load/unload hives ... > Is there a way to load a hive into the Regedit. ... > Jeff Giroux ...
    (microsoft.public.scripting.wsh)