Deploy Custom Registry Hives in Windows Imaging

Enterprise deployment tools push custom registry hives during the imaging process to preconfigure system policies, drivers, and user environments before a machine reaches an end user. By utilizing offline servicing techniques, deployment task sequences, and default profile modifications, tools like Microsoft Endpoint Configuration Manager (MECM), Microsoft Deployment Toolkit (MDT), and DISM inject registry configurations directly into target Windows images. This article explains the technical workflows enterprise tools use to load, modify, and commit custom registry hives during offline and online imaging phases.

Offline Registry Servicing with DISM and Reg.exe

The most common method for pushing custom registry entries during image creation is offline servicing. This approach modifies the Windows image file (WIM or VHD) directly without booting into the operating system.

Mounting the Image: The deployment tool mounts the offline install image using the Deployment Image Servicing and Management (DISM) engine:
```
dism /Mount-Image /ImageFile:C:\Images\install.wim /Index:1 /MountDir:C:\Mount
```
Loading the Target Hive: System-level registry hives reside as raw binary files in C:\Mount\Windows\System32\config\ (such as SOFTWARE, SYSTEM, or SAM). The deployment script uses reg.exe to load the target hive under a temporary key in the host machine’s registry:
```
reg load HKLM\OfflineSoftware C:\Mount\Windows\System32\config\SOFTWARE
```
Injecting Registry Entries: Once loaded, standard .reg files or reg add commands apply custom configurations directly into the mounted hive:
```
reg import custom_settings.reg
```
Unloading and Committing: The temporary hive is unloaded to release file locks, and DISM commits the changes back to the image file:
```
reg unload HKLM\OfflineSoftware
dism /Unmount-Image /MountDir:C:\Mount /Commit
```

Task Sequence Execution During Preinstallation (WinPE)

In dynamic enterprise environments like MECM or MDT, configurations are applied dynamically during deployment via task sequences rather than pre-baked into static WIM files.

Drive Identification: While booted in Windows Preinstallation Environment (WinPE), the target disk is partitioned and the base OS image is laid down on the disk (typically assigned a temporary drive letter like C: or D:).
Command Line Steps: The task sequence runs a batch or PowerShell script that executes reg load against the newly applied operating system disk before the system reboots into the full OS.
Hardware-Specific Injection: This allows deployment engines to evaluate hardware queries (WMI) and inject registry settings tailored specifically to the target hardware model.

Customizing the Default User Profile (NTUSER.DAT)

To ensure every new user who logs into the deployed machine receives specific application and interface configurations, enterprise tools modify the default user hive.

Targeting NTUSER.DAT: The template hive is located at \Users\Default\NTUSER.DAT.

Injection Process: The deployment script mounts this file to a temporary node such as HKLM\DefaultUser:

reg load HKLM\DefaultUser C:\Users\Default\NTUSER.DAT
reg add "HKLM\DefaultUser\Software\CustomApp" /v "Enabled" /t REG_DWORD /d 1 /f
reg unload HKLM\DefaultUser

Inheritance: When a new user logs on for the first time, Windows copies this modified Default folder to generate the user’s HKEY_CURRENT_USER hive, ensuring all preconfigured preferences are automatically inherited.

Post-Installation Scripting via SetupComplete.cmd

When deployment tools require registry changes after the Windows Out-of-Box Experience (OOBE) or specialize configuration passes, they utilize native post-setup hooks.

Deployment tools stage a SetupComplete.cmd file in C:\Windows\Setup\Scripts\.
When the deployment finishes and before the logon screen appears, Windows executes this script with local SYSTEM privileges.
The script imports native .reg files directly into HKEY_LOCAL_MACHINE using standard execution without requiring temporary hive mounting:
```
regedit.exe /s C:\Windows\Setup\Scripts\EnterpriseSettings.reg
```