Registry files in Windows server 2003

Where are the registry files stored in Windows 2003? Can they be modified offline with a boot disk? Can we backup and restore them offline as well? If so is this a security issue? Can someone inject a registry entry with a username and password?