Windows 10: Edit registry on a mounted wim

Can anybody tell me how to modify the registry on a mounted wim? I keep getting Access denied. This is the command I am using: reg load hkey_local_machine\software c:\test\offline\windows\system32\config\software

We have Windows 10 64 bit Enterprise edition.

:)

 

Current DISM commands as The DISM /ScanHealth, /CheckHealth, and /RestoreHealth are no longer valid.

Not finding the current syntax of this above command to apply to Windows 10 version I am using.

Current version of Windows 10 -

Version 1703 - > os build 15063.608

Windows 10 Professional

Current DISM Commands help file.

Deployment Image Servicing and Management tool

Version: 10.0.15063.0

DISM.exe [dism_options] {Imaging_command} [<Imaging_arguments>]

DISM.exe {/Image:<path_to_offline_image> | /Online} [dism_options]

{servicing_command} [<servicing_arguments>]

DESCRIPTION:

DISM enumerates, installs, uninstalls, configures, and updates features

and packages in Windows images. The commands that are available depend

on the image being serviced and whether the image is offline or running.

GENERIC IMAGING COMMANDS:

/Split-Image - Splits an existing .wim or .ffu file into multiple

read-only split WIM/FFU files.

/Apply-Image - Applies an image.

/Get-MountedImageInfo - Displays information about mounted WIM and VHD

images.

/Get-ImageInfo - Displays information about images in a WIM or VHD

file.

/Commit-Image - Saves changes to a mounted WIM or VHD image.

/Unmount-Image - Unmounts a mounted WIM or VHD image.

/Mount-Image - Mounts an image from a WIM or VHD file.

/Remount-Image - Recovers an orphaned image mount directory.

/Cleanup-Mountpoints - Deletes resources associated with corrupted

mounted images.

WIM COMMANDS:

/Apply-CustomDataImage - Dehydrates files contained in the custom data image.

/Capture-CustomImage - Captures customizations into a delta WIM file on a

WIMBoot system. Captured directories include all

subfolders and data.

/Get-WIMBootEntry - Displays WIMBoot configuration entries for the

specified disk volume.

/Update-WIMBootEntry - Updates WIMBoot configuration entry for the

specified disk volume.

/List-Image - Displays a list of the files and folders in a

specified image.

/Delete-Image - Deletes the specified volume image from a WIM file

that has multiple volume images.

/Export-Image - Exports a copy of the specified image to another

file.

/Append-Image - Adds another image to a WIM file.

/Capture-Image - Captures an image of a drive into a new WIM file.

Captured directories include all subfolders and

data.

/Get-MountedWimInfo - Displays information about mounted WIM images.

/Get-WimInfo - Displays information about images in a WIM file.

/Commit-Wim - Saves changes to a mounted WIM image.

/Unmount-Wim - Unmounts a mounted WIM image.

/Mount-Wim - Mounts an image from a WIM file.

/Remount-Wim - Recovers an orphaned WIM mount directory.

/Cleanup-Wim - Deletes resources associated with mounted WIM

images that are corrupted.

IMAGE SPECIFICATIONS:

/Online - Targets the running operating system.

/Image - Specifies the path to the root directory of an

offline Windows image.

DISM OPTIONS:

/English - Displays command line output in English.

/Format - Specifies the report output format.

/WinDir - Specifies the path to the Windows directory.

/SysDriveDir - Specifies the path to the system-loader file named

BootMgr.

/LogPath - Specifies the logfile path.

/LogLevel - Specifies the output level shown in the log (1-4).

/NoRestart - Suppresses automatic reboots and reboot prompts.

/Quiet - Suppresses all output except for error messages.

/ScratchDir - Specifies the path to a scratch directory.

For more information about these DISM options and their arguments, specify an

option immediately before /?.

Examples:

DISM.exe /Mount-Wim /?

DISM.exe /ScratchDir /?

DISM.exe /Image:C:\test\offline /?

DISM.exe /Online /?

 

Settings in Windows 10 doesn't work.

Tried method 1 and did not work.

Method 2 so far is as follows:

Microsoft Windows [Version 10.0.10240]

(c) 2015 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>DISM.exe/Online/Cleanup-image/Scanhealth
Deployment Image Servicing and Management tool

Version: 10.0.10240.16384

Error: 87
The online/cleanup-image/scanhealth option is unknown.

For more information, refer to the help by running DISM.exe /?.
The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log
C:\WINDOWS\system32>DISM.exe/?
Deployment Image Servicing and Management tool

Version: 10.0.10240.16384

DISM.exe [dism_options] {Imaging_command} [<Imaging_arguments>]

DISM.exe {/Image:<path_to_offline_image> | /Online} [dism_options]

{servicing_command} [<servicing_arguments>]
DESCRIPTION:
DISM enumerates, installs, uninstalls, configures, and updates features

and packages in Windows images. The commands that are available depend

on the image being serviced and whether the image is offline or running.
GENERIC IMAGING COMMANDS:
/Split-Image - Splits an existing .wim or .ffu file into multiple

read-only split WIM/FFU files.

/Apply-Image - Applies an image.

/Get-MountedImageInfo - Displays information about mounted WIM and VHD

images.

/Get-ImageInfo - Displays information about images in a WIM or VHD

file.

/Commit-Image - Saves changes to a mounted WIM or VHD image.

/Unmount-Image - Unmounts a mounted WIM or VHD image.

/Mount-Image - Mounts an image from a WIM or VHD file.

/Remount-Image - Recovers an orphaned image mount directory.

/Cleanup-Mountpoints - Deletes resources associated with corrupted

mounted images.

WIM COMMANDS:
/Apply-CustomDataImage - Dehydrates files contained in the custom data image.
/Capture-CustomImage - Captures customizations into a delta WIM file on a

WIMBoot system. Captured directories include all

subfolders and data.

/Get-WIMBootEntry - Displays WIMBoot configuration entries for the

specified disk volume.

/Update-WIMBootEntry - Updates WIMBoot configuration entry for the

specified disk volume.

/List-Image - Displays a list of the files and folders in a

specified image.

/Delete-Image - Deletes the specified volume image from a WIM file

that has multiple volume images.

/Export-Image - Exports a copy of the specified image to another

file.

/Append-Image - Adds another image to a WIM file.

/Capture-Image - Captures an image of a drive into a new WIM file.

Captured directories include all subfolders and

data.

/Get-MountedWimInfo - Displays information about mounted WIM images.

/Get-WimInfo - Displays information about images in a WIM file.

/Commit-Wim - Saves changes to a mounted WIM image.

/Unmount-Wim - Unmounts a mounted WIM image.

/Mount-Wim - Mounts an image from a WIM file.

/Remount-Wim - Recovers an orphaned WIM mount directory.

/Cleanup-Wim - Deletes resources associated with mounted WIM

images that are corrupted.
IMAGE SPECIFICATIONS:
/Online - Targets the running operating system.

/Image - Specifies the path to the root directory of an

offline Windows image.
DISM OPTIONS:
/English - Displays command line output in English.

/Format - Specifies the report output format.

/WinDir - Specifies the path to the Windows directory.

/SysDriveDir - Specifies the path to the system-loader file named

BootMgr.

/LogPath - Specifies the logfile path.

/LogLevel - Specifies the output level shown in the log (1-4).

/NoRestart - Suppresses automatic reboots and reboot prompts.

/Quiet - Suppresses all output except for error messages.

/ScratchDir - Specifies the path to a scratch directory.
For more information about these DISM options and their arguments, specify an

option immediately before /?.
Examples:

DISM.exe /Mount-Wim /?

DISM.exe /ScratchDir /?

DISM.exe /Image:C:\test\offline /?

DISM.exe /Online /?

C:\WINDOWS\system32>

Where do I go from here?

 

A useful feature of the Enterprise Edition [what companies usually get] is the ability to lock out Users from various aspects which begs the question, could that be getting in your way? Other than that possibility I have no answer.

 

I do it like this (where $WorkDir is directory where the wim is mounted) PHP Code: # Registry Changes
reg load HKLM\WinPE_SYSTEM $WorkDir\mount\windows\system32\config\SYSTEM
reg load HKLM\WinPE_SOFTWARE $WorkDir\mount\windows\system32\config\SOFTWARE

$RegKey="HKLM\WinPE_SOFTWARE\Microsoft\NetSh"
reg add $RegKey /v wlancfg /t REG_SZ /d wlancfg.dll /f
Can you post the error - what are you not authorized to? Presumably you are running as administrator...

 

I am running as administrator:

C:\Program Files\Windows AIK\Tools\PETools>dism /mount-wim /wimfile:c:\test\images\64Win10Ent-1511-IHSlogo.wim /index:1 /mountdir:c:\test\offline

Deployment Image Servicing and Management toolVersion: 6.1.7600.16385

Mounting image
[==========================100.0%==========================]
The operation completed successfully.

C:\Program Files\Windows AIK\Tools\PETools>reg load hkey_local_machine\software
c:\test\offline\windows\system32\config\software
ERROR: Access is denied.

 

You are trying to load your offline image to the existing HKLM\SOFTWARE hive. You can't - you need a new unused name.

Make up another name like HKLM\WinPE_SOFTWARE and it works fine like this (the name doesn't matter - it just must not already exist): Code: PS C:\WINDOWS\system32> dism /mount-wim /wimfile:\Temp\install.wim /index:1 /mountdir:C:\test\offline Deployment Image Servicing and Management tool Version: 10.0.16281.1000 Mounting image [==========================100.0%==========================] The operation completed successfully. PS C:\WINDOWS\system32> reg load hkey_local_machine\SOFTWARE c:\test\offline\windows\system32\config\software ERROR: Access is denied. PS C:\WINDOWS\system32> reg load HKLM\SOFTWARE c:\test\offline\windows\system32\config\software ERROR: Access is denied. PS C:\WINDOWS\system32> reg load HKLM\WinPE_SOFTWARE c:\test\offline\windows\system32\config\software The operation completed successfully. PS C:\WINDOWS\system32>[/quote] Then update HKLM\WinPE_SOFTWARE or whatever name you chose like this (with whatever you want) Code: $RegKey="HKLM\WinPE_SOFTWARE\Microsoft\NetSh" reg add $RegKey /v wlancfg /t REG_SZ /d wlancfg.dll /f $RegKey="HKLM\WinPE_SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" reg add $RegKey /v LocalSystemNetworkRestricted /t REG_MULTI_SZ /d Netman\0hidserv\0svsvc\0dot3svc\0wlansvc /f[/quote] Unload the hive you mounted Code: reg unload HKLM\WinPE_SOFTWARE[/quote] and unmount the wim (I forget the dism syntax) Code: # Unmount the WinPE image Get-WindowsImage -Mounted -ErrorAction Stop | ForEach-Object { Dismount-WindowsImage -Path $_.Path -Save -ErrorAction Stop }[/quote]

 

Hello

Can I safely mount my 10 Pro install.wim and remove some apps and make HKCU and HKLM registry changes and use that to upgrade machines via SCCM? Or can this only be used in a clean full install? I have had sucess with an install.wim I removed some of the apps from but none that I have changed some of the registry keys to turn off privacy related setting I get a BSOD

Thanks

 

Saweet! It mounted successfully. Now I need to figure out the syntax for turning the numlock on at boot up. *Smile

Thank you LXO.

 

Is it possible the numlock Tutorial [in the Tutorials section of this Forum] would work for your purpose. I find that function works to Save State or if the numlock is On at shutdown it usually be be On at the next start.

 

I was able to make changes in HKLM such as UAC turned off. But I can't seem to be able to load HKEY_USERS\.DEFAULT so I can modify the keyboard and turn on numlock at start up. Any thoughts?