Question

I’d like to ask if anyone knows correct way how to load ntuser.dat file into registry on Windows7 or XP. I’ve been trying to accomplish that by using this code

_Reg := TRegistry.Create;
_Reg.RootKey := HKEY_USERS;
if (_Reg.Loadkey('Test2', 'C:\Users\Test2\NTUSER.DAT')) then
  ShowMessage('User hive loaded'); 
_Reg.Unloadkey('Test2');
_Reg.CloseKey;
_Reg.Free; 

Path to a file is correct and file exists. I’ve also tried to use function I found on the internet EnableNTPrivilege(‘SeRestorePrivilege’, SE_PRIVILEGE_ENABLED) for setting up privileges before trying to load a hive. And still I get false from _Reg.Loadkey.

I’ve also tried to use this function NTSetPrivilege(‘SeRestorePrivilege’, True) for setting up privileges. But this function returns error ‘Not all privileges or groups referenced are assigned to the caller’

Answer 1

The TRegistry.LoadKey function internally uses the RegLoadKey function which requieres that the calling process have the SE_RESTORE_NAME and SE_BACKUP_NAME privileges. If the call to the function returns a value <> to ERROR_SUCCESS (0) you must check the LastError and the LastErrorMsg properties to get more info.

Check this sample to see how the function must be called and how the result of the operation is handled.

var
 Reg : TRegistry;
begin
  Reg := TRegistry.Create;
  try
    NTSetPrivilege('SeRestorePrivilege', True); //this is a third-party function, you can implemnt your own to set the privileges.
    NTSetPrivilege('SeBackupPrivilege', True);
    Reg.RootKey := HKEY_USERS;
    if (Reg.Loadkey('Test2', 'C:\Users\Test2\NTUSER.DAT')) then
    begin
      try
        Reg.OpenKey('Test2', False);
        try
            //do your stuff here


        finally
          Reg.CloseKey;
        end;
      finally
       Reg.Unloadkey('Test2');
      end;
    end
    else
      Writeln(Reg.LastErrorMsg);
  finally
    Reg.Free;
  end;
end;