Compress NTs Registry

Admin Tip # 193 : Technique to Compress NTs Registry

Hits: Failed to execute CGI : Win32 Error Code = 3

NT's registry is implemented as a database. It shares many of the characteristics including fragmentation as items are added, removed, or changed. In particular, when items are removed from the registry, there is no cleanup mechanism to recover the now unused space in the database. Microsoft released RegClean to clean up some of the debris. A alternative to Microsoft's RegClean is the freeware Regcleaner .Mark Russinovich has released PageDefrag which can defrag the page file and registry hive files.

Fragmentation can become significant over time on a busy system. Use either tool with caution. There is no tool to compress the registry, to recover lost space and reindex the fundamental database. But there is a method to achieve this result. Backup the registry and be prepared to get back to where you started if things go wrong.

Update the %systemroot\repair directory using the command
rdisk /s-

rdisk will update repair data including the default, software and system hives. The repair version of the hives is compressed and reorganized. It is not an image copy. Adding the /s parameter gets the sam and security hives. The dash, -, instructs rdisk to not make a floppy disk copy.
Expand the registry hives to a temporary location:
expand %systemroot%\repair\default._ C:\temp\reg\default
expand %systemroot%\repair\sam._ C:\temp\reg\sam
expand %systemroot%\repair\security._ C:\temp\reg\security
expand %systemroot%\repair\software._ C:\temp\reg\software
expand %systemroot%\repair\system._ C:\temp\reg\system

A comparison of the files sizes in %temp% and %systemroot%\system32\config can reveal significant differences in size. If the sizes are close, the hive in question did not have much lost space to recover. Usually the software hive has the greatest space recovery.

Replace the version in %systemroot%\system32\config with the newly reindexed version in %temp%. NT keeps the hives open and locked. You can not simply copy the new version over the old versions. To get around this problem, you need to make the copy when NT is not loaded. For a FAT-based installation, bootup using DOS and make the copy using the DOS COPY command. For NTFS-based installations, I recommend using a recovery or backdoor copy of NT. Install NT on the PC in a different directory. Boot under the secondary NT and copy the hives for the inactive primary NT installation.

There is some risk in this procedure. But as the hives get large with a high amount of dead space, performance suffers. If your server or workstations gets slower and slower for no apparent reason, you may get the performance back using this approach.

Do not attempt if you are not in a position to recover back to the starting point.

A safer and easier alternative is RegCompact .

Microsoft presents three methods to compress a bloated SAM on a PDC / BDC. Scary but then so are the use of non-supported 3rd party utilities on domain controllers.