Every few years I need to make a Windows change I can’t undo from the UI, which means touching the registry — and that means making sure I can back out. This post collects the backup and restore habits that have kept me out of trouble since the Vista days, updated for how Windows actually works now.
Back up before you touch anything
You have two complementary options, and serious surgery deserves both:
1. Export the keys you’re about to change (targeted)
- Open
regedit(Win+R, typeregedit). - Select the key you’re about to modify, then File → Export.
- Save the
.regfile. To undo, import it — or manually re-enter the values, since importing merges rather than reverts deletions.
2. Create a System Restore point (safety net)
- Run
systempropertiesprotectionfrom the Start menu — this exe still exists in Windows 10/11. - On the System Protection tab, click Create, name the restore point, confirm.
- If System Restore is off, enable it for the system drive first; the Configure button lives on the same tab.
The .reg export undoes the specific change you made; the restore point saves you when you break something and can’t figure out what it was.
Restoring
- Undo a bad edit: import your
.regbackup, or re-enter the old values by hand. - Windows misbehaves broadly or won’t boot: run
rstrui.exe(System Restore), pick the point you created, and let Windows roll back the registry hives and reboot. The same wizard is reachable from the recovery environment when Windows won’t start.
Tracking what an installer actually changed
Back when I wrote the original version of this post, my tool of choice was RegShot (still mirrored on MajorGeeks, and still maintained over on SourceForge): snapshot the registry, run the installer, take a second snapshot, and diff. It’s a crude but effective way to see exactly which keys a program touched — I once used it to dissect an application’s licensing check, purely for educational reasons of course.
The sharper tool today is Process Monitor from Sysinternals: filter on Operation is RegWrite plus the process name, and you watch every registry write happen live — no before/after diff needed. Start the capture, run the installer, stop, filter.
The usual warnings
The registry editor has no undo button. A typo in regedit can take a machine down just as effectively as malware, so: export first, restore-point second, and don’t paste registry tweaks from random websites without reading what they actually change. For background on how the hives are organized, Microsoft’s registry reference is the map to keep open in a second window.