Offline Registry Editing in Sergei Strelec WinPE

If the target disk is already mounted as C: in Sergei Strelec’s WinPE environment, you can edit the offline registry not only via regedit “Load Hive” but also directly from the command line.

Method 1: reg load / reg unload Command

Run the following in the WinPE command prompt:

:: Temporarily load SYSTEM hive into HKLM\TempSys
reg load HKLM\TempSys C:\Windows\System32\config\SYSTEM

:: Temporarily load SOFTWARE hive into HKLM\TempSoft
reg load HKLM\TempSoft C:\Windows\System32\config\SOFTWARE

:: Example: Modify Tcpip parameters under TempSys
reg add "HKLM\TempSys\ControlSet001\Services\Tcpip\Parameters" /v EnableDHCP /t REG_DWORD /d 1 /f

:: Always unload after editing
reg unload HKLM\TempSys
reg unload HKLM\TempSoft

• HKLM\TempSys and HKLM\TempSoft are temporary names; you can choose freely.
• Changes may not apply unless the hive is properly unloaded.

Method 2: Editing Offline Hive with PowerShell

Since Strelec’s WinPE includes PowerShell, you can use commands like:

# Load hive
reg load HKLM\OfflineSys C:\Windows\System32\config\SYSTEM

# Add or modify values
Set-ItemProperty -Path "HKLM:\OfflineSys\ControlSet001\Services\Tcpip\Parameters" -Name EnableDHCP -Value 1

# Unload hive
reg unload HKLM\OfflineSys

Method 3: Using Dedicated Tools

Strelec often bundles GUI tools such as “Registry Editor PE” or “Registry Workshop.” These allow you to open and edit offline hives directly.

In summary, if C: is visible in WinPE, using reg load is the simplest approach. For GUI users, the bundled registry editors are also convenient.

For the next step, you may choose between the efficient reg load/unload procedure or the GUI-based Registry Workshop.