Vista - what is the purpose of the following dir

C:\Windows\System32\config\RegBack

i'm seeing a hell of a lot of activity there....
cu
marc

Sounds like something Defender uses.

steve

"Marc Antheunis" <ask_me@ask.me> wrote in message
news:Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl...
> C:\Windows\System32\config\RegBack
>
> i'm seeing a hell of a lot of activity there....
> cu
> marc

Marc Antheunis wrote:

> C:\Windows\System32\config\RegBack
>
> i'm seeing a hell of a lot of activity there....

Marc:

Clearly it is some kind of backup of the HKLM portion of the registry
(the current versions are in C:\Windows\System32\config). I don't know
what the backup strategy is though.

David Wilkinson

Hi Marc,

That folder is used for automated backups of the registry.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Windows help - www.rickrogers.org

"Marc Antheunis" <ask_me@ask.me> wrote in message
news:Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl...
> C:\Windows\System32\config\RegBack
>
> i'm seeing a hell of a lot of activity there....
> cu
> marc

See for historical context:

How to back up, edit, and restore the registry in Windows 2000
http://support.microsoft.com/kb/322755

How to Maintain Current Registry Backups in Windows NT 4.0 and Windows 2000
http://support.microsoft.com/kb/318149/en-us

Windows XP Registry Backup 101
http://www.windowsnetworking.com/art...ry-Backup.html



CH


"Marc Antheunis" <ask_me@ask.me> wrote in message
news:Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl...
> C:\Windows\System32\config\RegBack
>
> i'm seeing a hell of a lot of activity there....
> cu
> marc

thx to all

"Marc Antheunis" <ask_me@ask.me> wrote in message
news:Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl...
> C:\Windows\System32\config\RegBack
>
> i'm seeing a hell of a lot of activity there....
> cu
> marc

Hello Marc,
The system backs up the registry at least once a day when it detects idle
time.
Two copies of the registry are maintained. The existing copies get renamed
to *.old and the current registry from \windows\system32\config get copied
to \windows\system32\config\regback. ( the ntuser.dat files-user registry
settings do not get backed up)
These copies are used in the WinRE repair process when system restore is
not available or does not resolve the issue and the regisry files in the
\Windows\system32\config folder cannot be loaded.

Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
<From: "Marc Antheunis" <ask_me@ask.me>
<References: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
<In-Reply-To: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
<Subject: Re: what is the purpose of the following dir
<Date: Wed, 6 Dec 2006 08:42:08 +0100
<Lines: 10
<MIME-Version: 1.0
<Content-Type: text/plain;
< format=flowed;
< charset="iso-8859-1";
< reply-type=response
<Content-Transfer-Encoding: 7bit
<X-Priority: 3
<X-MSMail-Priority: Normal
<X-Newsreader: Microsoft Windows Mail 6.0.6000.16386
<X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16386
<Message-ID: <OpbsNoQGHHA.2464@TK2MSFTNGP06.phx.gbl>
<Newsgroups: microsoft.public.windows.vista.general
<NNTP-Posting-Host: 17.66-64-87.adsl-dyn.isp.belgacom.be 87.64.66.17
<Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
<Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.vista.general:4151
<X-Tomcat-NG: microsoft.public.windows.vista.general
<
<thx to all
<
<"Marc Antheunis" <ask_me@ask.me> wrote in message
<news:Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl...
<> C:\Windows\System32\config\RegBack
<>
<> i'm seeing a hell of a lot of activity there....
<> cu
<> marc
<
<

hi Darrell,

is it normal that this is happening right after system start?
i can't remember it doing this in the first days...
also it takes a lot of time to complete
i looked with resource monitor to find out what was going on and it boiles
down to that directory
thx
marc

""Darrell Gorter[MSFT]"" <Darrellg@online.microsoft.com> wrote in message
news:0gdPcoaGHHA.516@TK2MSFTNGHUB02.phx.gbl...
> Hello Marc,
> The system backs up the registry at least once a day when it detects idle
> time.
> Two copies of the registry are maintained. The existing copies get
> renamed
> to *.old and the current registry from \windows\system32\config get copied
> to \windows\system32\config\regback. ( the ntuser.dat files-user registry
> settings do not get backed up)
> These copies are used in the WinRE repair process when system restore is
> not available or does not resolve the issue and the regisry files in the
> \Windows\system32\config folder cannot be loaded.
>
> Thanks,
> Darrell Gorter[MSFT]
>
> This posting is provided "AS IS" with no warranties, and confers no rights
> --------------------
> <From: "Marc Antheunis" <ask_me@ask.me>
> <References: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
> <In-Reply-To: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
> <Subject: Re: what is the purpose of the following dir
> <Date: Wed, 6 Dec 2006 08:42:08 +0100
> <Lines: 10
> <MIME-Version: 1.0
> <Content-Type: text/plain;
> < format=flowed;
> < charset="iso-8859-1";
> < reply-type=response
> <Content-Transfer-Encoding: 7bit
> <X-Priority: 3
> <X-MSMail-Priority: Normal
> <X-Newsreader: Microsoft Windows Mail 6.0.6000.16386
> <X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16386
> <Message-ID: <OpbsNoQGHHA.2464@TK2MSFTNGP06.phx.gbl>
> <Newsgroups: microsoft.public.windows.vista.general
> <NNTP-Posting-Host: 17.66-64-87.adsl-dyn.isp.belgacom.be 87.64.66.17
> <Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
> <Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.vista.general:4151
> <X-Tomcat-NG: microsoft.public.windows.vista.general
> <
> <thx to all
> <
> <"Marc Antheunis" <ask_me@ask.me> wrote in message
> <news:Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl...
> <> C:\Windows\System32\config\RegBack
> <>
> <> i'm seeing a hell of a lot of activity there....
> <> cu
> <> marc
> <
> <
>

Hello Marc,
I think a system restart would trigger the need to backup the registry
again.
It should be waiting for idle time after the restart to do this so as not
to affect performance.
Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
<From: "Marc Antheunis" <ask_me@ask.me>
<References: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
<OpbsNoQGHHA.2464@TK2MSFTNGP06.phx.gbl>
<0gdPcoaGHHA.516@TK2MSFTNGHUB02.phx.gbl>
<In-Reply-To: <0gdPcoaGHHA.516@TK2MSFTNGHUB02.phx.gbl>
<Subject: Re: what is the purpose of the following dir
<Date: Thu, 7 Dec 2006 08:59:53 +0100
<Lines: 65
<MIME-Version: 1.0
<Content-Type: text/plain;
< format=flowed;
< charset="iso-8859-1";
< reply-type=original
<Content-Transfer-Encoding: 7bit
<X-Priority: 3
<X-MSMail-Priority: Normal
<X-Newsreader: Microsoft Windows Mail 6.0.6000.16386
<X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16386
<Message-ID: <euTjyWdGHHA.1080@TK2MSFTNGP05.phx.gbl>
<Newsgroups: microsoft.public.windows.vista.general
<NNTP-Posting-Host: 204.36-200-80.adsl-dyn.isp.belgacom.be 80.200.36.204
<Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP05.phx.gbl
<Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.vista.general:4501
<X-Tomcat-NG: microsoft.public.windows.vista.general
<
<hi Darrell,
<
<is it normal that this is happening right after system start?
<i can't remember it doing this in the first days...
<also it takes a lot of time to complete
<i looked with resource monitor to find out what was going on and it boiles
<down to that directory
<thx
<marc
<
<""Darrell Gorter[MSFT]"" <Darrellg@online.microsoft.com> wrote in message
<news:0gdPcoaGHHA.516@TK2MSFTNGHUB02.phx.gbl...
<> Hello Marc,
<> The system backs up the registry at least once a day when it detects idle
<> time.
<> Two copies of the registry are maintained. The existing copies get
<> renamed
<> to *.old and the current registry from \windows\system32\config get
copied
<> to \windows\system32\config\regback. ( the ntuser.dat files-user registry
<> settings do not get backed up)
<> These copies are used in the WinRE repair process when system restore is
<> not available or does not resolve the issue and the regisry files in the
<> \Windows\system32\config folder cannot be loaded.
<>
<> Thanks,
<> Darrell Gorter[MSFT]
<>
<> This posting is provided "AS IS" with no warranties, and confers no
rights
<> --------------------
<> <From: "Marc Antheunis" <ask_me@ask.me>
<> <References: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
<> <In-Reply-To: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
<> <Subject: Re: what is the purpose of the following dir
<> <Date: Wed, 6 Dec 2006 08:42:08 +0100
<> <Lines: 10
<> <MIME-Version: 1.0
<> <Content-Type: text/plain;
<> < format=flowed;
<> < charset="iso-8859-1";
<> < reply-type=response
<> <Content-Transfer-Encoding: 7bit
<> <X-Priority: 3
<> <X-MSMail-Priority: Normal
<> <X-Newsreader: Microsoft Windows Mail 6.0.6000.16386
<> <X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16386
<> <Message-ID: <OpbsNoQGHHA.2464@TK2MSFTNGP06.phx.gbl>
<> <Newsgroups: microsoft.public.windows.vista.general
<> <NNTP-Posting-Host: 17.66-64-87.adsl-dyn.isp.belgacom.be 87.64.66.17
<> <Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
<> <Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.vista.general:4151
<> <X-Tomcat-NG: microsoft.public.windows.vista.general
<> <
<> <thx to all
<> <
<> <"Marc Antheunis" <ask_me@ask.me> wrote in message
<> <news:Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl...
<> <> C:\Windows\System32\config\RegBack
<> <>
<> <> i'm seeing a hell of a lot of activity there....
<> <> cu
<> <> marc
<> <
<> <
<>
<
<

It seems that this regback is running after every boot. Is there a way how to
disable or schedule this?

""Darrell Gorter[MSFT]"" wrote:

> Hello Marc,
> I think a system restart would trigger the need to backup the registry
> again.
> It should be waiting for idle time after the restart to do this so as not
> to affect performance.
> Thanks,
> Darrell Gorter[MSFT]
>
> This posting is provided "AS IS" with no warranties, and confers no rights
> --------------------
> <From: "Marc Antheunis" <ask_me@ask.me>
> <References: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
> <OpbsNoQGHHA.2464@TK2MSFTNGP06.phx.gbl>
> <0gdPcoaGHHA.516@TK2MSFTNGHUB02.phx.gbl>
> <In-Reply-To: <0gdPcoaGHHA.516@TK2MSFTNGHUB02.phx.gbl>
> <Subject: Re: what is the purpose of the following dir
> <Date: Thu, 7 Dec 2006 08:59:53 +0100
> <Lines: 65
> <MIME-Version: 1.0
> <Content-Type: text/plain;
> < format=flowed;
> < charset="iso-8859-1";
> < reply-type=original
> <Content-Transfer-Encoding: 7bit
> <X-Priority: 3
> <X-MSMail-Priority: Normal
> <X-Newsreader: Microsoft Windows Mail 6.0.6000.16386
> <X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16386
> <Message-ID: <euTjyWdGHHA.1080@TK2MSFTNGP05.phx.gbl>
> <Newsgroups: microsoft.public.windows.vista.general
> <NNTP-Posting-Host: 204.36-200-80.adsl-dyn.isp.belgacom.be 80.200.36.204
> <Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP05.phx.gbl
> <Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.vista.general:4501
> <X-Tomcat-NG: microsoft.public.windows.vista.general
> <
> <hi Darrell,
> <
> <is it normal that this is happening right after system start?
> <i can't remember it doing this in the first days...
> <also it takes a lot of time to complete
> <i looked with resource monitor to find out what was going on and it boiles
> <down to that directory
> <thx
> <marc
> <
> <""Darrell Gorter[MSFT]"" <Darrellg@online.microsoft.com> wrote in message
> <news:0gdPcoaGHHA.516@TK2MSFTNGHUB02.phx.gbl...
> <> Hello Marc,
> <> The system backs up the registry at least once a day when it detects idle
> <> time.
> <> Two copies of the registry are maintained. The existing copies get
> <> renamed
> <> to *.old and the current registry from \windows\system32\config get
> copied
> <> to \windows\system32\config\regback. ( the ntuser.dat files-user registry
> <> settings do not get backed up)
> <> These copies are used in the WinRE repair process when system restore is
> <> not available or does not resolve the issue and the regisry files in the
> <> \Windows\system32\config folder cannot be loaded.
> <>
> <> Thanks,
> <> Darrell Gorter[MSFT]
> <>
> <> This posting is provided "AS IS" with no warranties, and confers no
> rights
> <> --------------------
> <> <From: "Marc Antheunis" <ask_me@ask.me>
> <> <References: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
> <> <In-Reply-To: <Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl>
> <> <Subject: Re: what is the purpose of the following dir
> <> <Date: Wed, 6 Dec 2006 08:42:08 +0100
> <> <Lines: 10
> <> <MIME-Version: 1.0
> <> <Content-Type: text/plain;
> <> < format=flowed;
> <> < charset="iso-8859-1";
> <> < reply-type=response
> <> <Content-Transfer-Encoding: 7bit
> <> <X-Priority: 3
> <> <X-MSMail-Priority: Normal
> <> <X-Newsreader: Microsoft Windows Mail 6.0.6000.16386
> <> <X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16386
> <> <Message-ID: <OpbsNoQGHHA.2464@TK2MSFTNGP06.phx.gbl>
> <> <Newsgroups: microsoft.public.windows.vista.general
> <> <NNTP-Posting-Host: 17.66-64-87.adsl-dyn.isp.belgacom.be 87.64.66.17
> <> <Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
> <> <Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.vista.general:4151
> <> <X-Tomcat-NG: microsoft.public.windows.vista.general
> <> <
> <> <thx to all
> <> <
> <> <"Marc Antheunis" <ask_me@ask.me> wrote in message
> <> <news:Orp5RxHGHHA.4760@TK2MSFTNGP03.phx.gbl...
> <> <> C:\Windows\System32\config\RegBack
> <> <>
> <> <> i'm seeing a hell of a lot of activity there....
> <> <> cu
> <> <> marc
> <> <
> <> <
> <>
> <
> <
>
>