Can you run SFC from the Recovery Console on the XP Setup CD?

G

googlegroups

It's a long story, but I can't boot into XP Pro (sp2) in either normal
or safe mode. The system keeps flashing a blue screen for a split
second and then reboots. It happens too fast to see what file's causing
the problem and the option on the F8 screen to "disable the
auto-restart on error" feature disappeared all of a sudden. I've run
chkdsk /r from the Recovery Console several times, but to no avail. I'm
hoping there is a way to run SFC /scannow from the XP Setup CD. If this
is possible, can someone tell me how?
Thank you in advance.
 
J

John John

No, you cannot run SFC from the Recovery Console. Use the HELP
command for a list of available commands. For help on any command use
the /? switch, example, for help on chkdsk do: chkdsk /?

You can change the auto reboot on crash behaviour so that the computer
stops at the blue screen but to do so you will have to use a different
boot disk with a registry editor on board, like a Bart PE disk with a
registry plugin, or you will have to mount the disk in another Windows
NT/2000/XP machine. You have to change the AutoReboot registry entry
value at the proper ControlSetnnn. If you are so inclined to do that
post again.

John
 
G

googlegroups

John said:
You can change the auto reboot on crash behaviour so that the computer
stops at the blue screen but to do so you will have to use a different
boot disk with a registry editor on board, like a Bart PE disk with a
registry plugin, or you will have to mount the disk in another Windows
NT/2000/XP machine. You have to change the AutoReboot registry entry
value at the proper ControlSetnnn. If you are so inclined to do that
post again.


John,
Thank you for the reply.
I'm not familar with a "Bart PE disk"??? Is there any way to make
whatever modifications are required with the hard disk still in this
machine (is there a text editor available when booting the machine from
the XP Setup CD)?
If I were to mount the hard disk in another [XP] machine, won't that
modify the data in the disk? If not, how do I change the ControlSetnnn
so the machine stops at the blue screen and does NOT auto-reboot?
David
 
G

googlegroups

John,
Here's a bit of an update: I found and created a Bart's PE disk, but I
didn't see anything about a "Registry Plug-in" on his plug-in page. Is
this something that's included on the PE disk by default or how do I
add it so I can do whatever I need to do to disable the "auto-reboot on
error" command in the Registry?
David
 
J

John John

John,
Thank you for the reply.
I'm not familar with a "Bart PE disk"??? Is there any way to make
whatever modifications are required with the hard disk still in this
machine (is there a text editor available when booting the machine from
the XP Setup CD)?

The modifications can be made while the disk is still in the machine but
not with the XP cd, you would have to boot with a different cd as I
mentioned earlier. The Windows XP cd has no such capabilities.
If I were to mount the hard disk in another [XP] machine, won't that
modify the data in the disk? If not, how do I change the ControlSetnnn
so the machine stops at the blue screen and does NOT auto-reboot?

Mounting the disk in another machine will not modify the data on the
disk unless you slip up and make changes. Are you comfortable moving
drives around from one computer to another and confident that you can do
the proper connections correctly? An alternative would be to install
a second (temporary) Windows 2000/XP on your computer, on another hard
disc or on a different partition and make the changes using that
installation. Do you have more than one hard disc in your computer, or
is your hard disc divided into more than one partition?

John
 
G

googlegroups

Mounting the disk in another machine will not modify the data on the
disk unless you slip up and make changes. Are you comfortable moving
drives around from one computer to another and confident that you can do
the proper connections correctly? An alternative would be to install
a second (temporary) Windows 2000/XP on your computer, on another hard
disc or on a different partition and make the changes using that
installation. Do you have more than one hard disc in your computer, or
is your hard disc divided into more than one partition?
John

John,
As I said initially, it's kind of complicated, but (in a nutshell),
yes, there were 2 discs in the computer. The system was initially
configured as a (mirrored) 2-disc RAID. I had a problem with the RAID
hardware, which is where the problems began. I removed the RAID
controller, re-connected the two EIDE drives (as Primary Master and
Slave) and then booted the system. I can't remember what the original
error message was (I've been working on this for 2 days and I'm a bit
hazy on exactly what I've done to get here???), but I ended up removing
the slave disc and then running chkdsk /r on the master. Initially,
when I booted the system after that, the boot process blue screened on
sfcfiles.dll. So I re-started the system from the XP Setup CD and
expanded sfcfiles.dl_ on the CD to c:\windows\system32. When I rebooted
again, I got another blue screen because of lz32.dll. So I did the same
thing (expanded lz32.dll from the CD) and restarted.... I was moving
along slowly but nicely for the next few dlls, but then, all of a
sudden, the option to disable the auto-reboot vanished from the F8 Safe
Mode screen and I had no way of knowing what file was causing the next
problem. When I booted the system, the blue screen popped-up for a
split second (not long enough to read what it says) and then the system
would auto-reboot.

I tried running the Repair option from the Setup CD, but it's not
recognizing the existing Windows installation and keeps wanting to
install a fresh copy. From the Recovery Console (when I boot from the
Setup CD), I can see the entire file system (all of my original folders
and data), but there must be something missing in Windows. I also tried
doing a fixboot and fixmbr, but neither helped. I also tried copying
new ntldr and ntdetect.com files to c:\ from the Setup CD, but no-go
there either.

So, unless you know of another option, I'd be "happy" if I could just
get back to having the system stop on the blue screen during boots so I
can see which dll's are causing the boot to halt.
I hope that makes more sense.
David
 
J

John John

John,
Here's a bit of an update: I found and created a Bart's PE disk, but I
didn't see anything about a "Registry Plug-in" on his plug-in page. Is
this something that's included on the PE disk by default or how do I
add it so I can do whatever I need to do to disable the "auto-reboot on
error" command in the Registry?

http://sourceforge.net/projects/regeditpe/to

After you get the PE disk up and running go to the broken registry's
Select key http://tinyurl.com/vsoc9 and look at the number recorded for
the "Default" value name. It's not necessarily, but almost always 1.
That value (number) determines which ControlSet00x will be loaded when
Windows boots in normal mode. If the number is 0x1 then edit the
ControlSet001 key, if the value is 2 then edit the ControlSet002 key.

So, assuming the Select key tells us that ControlSet001 will be loaded
then navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl

and change the AutoReboot Value data to 0 (zero).

John

Note: If the AutoReboot behaviour continues after you make the registry
changes you probably don't have enough free space on the drive for the
creation of a memory dump file or the size of the pagefile is smaller
than the amount of memory installed. Further registry edits can be made
to change these parameters.
 
G

googlegroups

John said:


John,
I ran the Bart's PE disc, but it froze on the Microsoft Windows XP
Professional screen--the screen with the Windows "flag" and animated
status bar...
FYI: Just after I started to burn the Bart's PE disc, I noticed a
warning about using an OEM [Dell] Windows Setup, which is the only XP
Setup CD I have that contains SP1 (the Bart's program wouldn't accept
the XP "Upgrade" Setup disc, which is what I originally used to install
XP Pro on the machine, since it does not contain SP1). However, the
problem machine is NOT a Dell and it's running XP Pro Service Pack 2
with all current updates. So I'm guessing that's why it froze...

If it's an option, I also have a non-OEM "Windows XP Upgrade" CD (which
is what I originally used to install a fresh XP Pro on the machine) and
I have both the Service Pack 1 and Service Pack 1a distribution files.
If the OEM XP Setup CD poses a problem for editing the Registry on a
non-Dell machine, is there a way to make a new Bart's PE disc with
these other discs???


After you get the PE disk up and running go to the broken registry's
Select key http://tinyurl.com/vsoc9 and look at the number recorded for
the "Default" value name. It's not necessarily, but almost always 1.
That value (number) determines which ControlSet00x will be loaded when
Windows boots in normal mode. If the number is 0x1 then edit the
ControlSet001 key, if the value is 2 then edit the ControlSet002 key.

So, assuming the Select key tells us that ControlSet001 will be loaded
then navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl

and change the AutoReboot Value data to 0 (zero).

John

Note: If the AutoReboot behaviour continues after you make the registry
changes you probably don't have enough free space on the drive for the
creation of a memory dump file or the size of the pagefile is smaller
than the amount of memory installed. Further registry edits can be made
to change these parameters.

There's about 25 gigs of free space on the drive, so that shouldn't be
an issue....
This may be self-explanatory once I actually run the Bart's PE disc,
but how do I get to the Registry Editor on the disc? Any gotchas I
should know about?
David
 
G

googlegroups

John,
I just re-ran the Bart's PE disc and it booted up this time.
Before I dabble with the Registry, is there a way to run (or add) the
Windows System File Checker (sfc) from the Bart's PE disc? I just tried
it from a command prompt, but it returned the "not a recognizable
command" (or something similar). I think that if I could run sfc, it
would probably take care of everything in one fell-swoop.
What do you think?
 
J

John John

John said:



John,
I ran the Bart's PE disc, but it froze on the Microsoft Windows XP
Professional screen--the screen with the Windows "flag" and animated
status bar...
FYI: Just after I started to burn the Bart's PE disc, I noticed a
warning about using an OEM [Dell] Windows Setup, which is the only XP
Setup CD I have that contains SP1 (the Bart's program wouldn't accept
the XP "Upgrade" Setup disc, which is what I originally used to install
XP Pro on the machine, since it does not contain SP1). However, the
problem machine is NOT a Dell and it's running XP Pro Service Pack 2
with all current updates. So I'm guessing that's why it froze...

If it's an option, I also have a non-OEM "Windows XP Upgrade" CD (which
is what I originally used to install a fresh XP Pro on the machine) and
I have both the Service Pack 1 and Service Pack 1a distribution files.
If the OEM XP Setup CD poses a problem for editing the Registry on a
non-Dell machine, is there a way to make a new Bart's PE disc with
these other discs???



After you get the PE disk up and running go to the broken registry's
Select key http://tinyurl.com/vsoc9 and look at the number recorded for
the "Default" value name. It's not necessarily, but almost always 1.
That value (number) determines which ControlSet00x will be loaded when
Windows boots in normal mode. If the number is 0x1 then edit the
ControlSet001 key, if the value is 2 then edit the ControlSet002 key.

So, assuming the Select key tells us that ControlSet001 will be loaded
then navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl

and change the AutoReboot Value data to 0 (zero).

John

Note: If the AutoReboot behaviour continues after you make the registry
changes you probably don't have enough free space on the drive for the
creation of a memory dump file or the size of the pagefile is smaller
than the amount of memory installed. Further registry edits can be made
to change these parameters.


There's about 25 gigs of free space on the drive, so that shouldn't be
an issue....
This may be self-explanatory once I actually run the Bart's PE disc,
but how do I get to the Registry Editor on the disc? Any gotchas I
should know about?

You will have to consult the BartPE site for help with the creation of
the PE disk. You may need to use a Windows CD slipstreamed SP2 to
create the disk. The plugins go in the PE plugin folder, you could or
should place (nest) it in its own folder inside the plugin folder.

John
 
J

John John

John,
I just re-ran the Bart's PE disc and it booted up this time.
Before I dabble with the Registry, is there a way to run (or add) the
Windows System File Checker (sfc) from the Bart's PE disc? I just tried
it from a command prompt, but it returned the "not a recognizable
command" (or something similar). I think that if I could run sfc, it
would probably take care of everything in one fell-swoop.
What do you think?

I really don't know about that but I kind of doubt it. It would have to
be in the form of a plugin, the one on the Windows installation won't
run when Windows is anesthetized.

John
 
G

googlegroups

John said:
I really don't know about that but I kind of doubt it. It would have to
be in the form of a plugin, the one on the Windows installation won't
run when Windows is anesthetized.

Here's what I did:
1) I "slipstreamed" the XP Service Pack 2 distributable as per the FAQ
(the newly burned Bart's PE disc completed (for the first time) without
alerts or errors).
2) I created a "sfc" sub-folder in the plug-ins directory and then
copied the relevant sfc*.* files from \windows\system32 to that folder.
I also copied the mouse plug-in inf and htm files to that folder and
modified them to include references to the sfc.exe and related files.

With the original Slave drive installed (I'm saving the master drive
just in case), I started the machine with the Bart's PE. After one
false start (the system froze on the Bart's PE screen), I got the
Bart's PE program running, but I wasn't able to locate the sfc plug-in
anywhere.
So I tried running it from c:\windows\system32\sfc.exe, but that
resulted in the error "Windows File Protection could not initiate a
scan of protected system files....the RPC server is unavailable".


The Registry Editor plug-in is listed under Go->Programs->Registry
Editor PE, but SFC's not listed there (or in any of the other menus).
After loading the Registry Editor's dlls, it prompted me to "Select the
remote Windows directory"--I selected c:\windows. Then a browse screen
opened and prompted me to "Select the remote SAM hive"??? It presented
me with a list of files in c:\windows\system32\config (e.g., default,
default.sav, sam, sam.sav, security, security.sav, software,
software.sav, system, system.sav, etc.). Not sure what to do here?
 
G

googlegroups

John said:
After you get the PE disk up and running go to the broken registry's
Select key http://tinyurl.com/vsoc9 and look at the number recorded for
the "Default" value name. It's not necessarily, but almost always 1.
That value (number) determines which ControlSet00x will be loaded when
Windows boots in normal mode. If the number is 0x1 then edit the
ControlSet001 key, if the value is 2 then edit the ControlSet002 key.

So, assuming the Select key tells us that ControlSet001 will be loaded
then navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl

John,
Ok, I figured out that the Registry Editor PE prompts me to select a
number of default files in the \system32\config directory (e.g., SAM,
SECURITY, SOFTWARE, SYSTEM)--I just clicked OK to accept the default
options. Then it asked if I wanted to "Select a remote user profile
HIVE (ntuser.dat) for editing?". I clicked YES and it prompted me to
select the ntuser.dat in c:\documents and settings\administrator, but I
wasn't sure I should modify anything on c: that I didn't have to, so I
cancelled out and restarted the Registry Editor PE. This time, I
clicked NO and the Registry Editor PE loaded. However, there is only a
ControSet001 (no 002, etc.) and there isn't a CrashControl key listed
under \ControlSet001\Control.
Is this because I didn't select the ntuser.dat in c:\documents and
settings\administrator? Should I run it again and use that?
 
J

John John

Here's what I did:
1) I "slipstreamed" the XP Service Pack 2 distributable as per the FAQ
(the newly burned Bart's PE disc completed (for the first time) without
alerts or errors).
2) I created a "sfc" sub-folder in the plug-ins directory and then
copied the relevant sfc*.* files from \windows\system32 to that folder.
I also copied the mouse plug-in inf and htm files to that folder and
modified them to include references to the sfc.exe and related files.

With the original Slave drive installed (I'm saving the master drive
just in case), I started the machine with the Bart's PE. After one
false start (the system froze on the Bart's PE screen), I got the
Bart's PE program running, but I wasn't able to locate the sfc plug-in
anywhere.
So I tried running it from c:\windows\system32\sfc.exe, but that
resulted in the error "Windows File Protection could not initiate a
scan of protected system files....the RPC server is unavailable".


The Registry Editor plug-in is listed under Go->Programs->Registry
Editor PE, but SFC's not listed there (or in any of the other menus).
After loading the Registry Editor's dlls, it prompted me to "Select the
remote Windows directory"--I selected c:\windows. Then a browse screen
opened and prompted me to "Select the remote SAM hive"??? It presented
me with a list of files in c:\windows\system32\config (e.g., default,
default.sav, sam, sam.sav, security, security.sav, software,
software.sav, system, system.sav, etc.). Not sure what to do here?

The default SAM is the one without an extention. The hive with the
CurrentControl set that you have to edit is System without an
extention. These are all in the c:\windows\system32\config directory.

John
 
J

John John

John,
Ok, I figured out that the Registry Editor PE prompts me to select a
number of default files in the \system32\config directory (e.g., SAM,
SECURITY, SOFTWARE, SYSTEM)--I just clicked OK to accept the default
options. Then it asked if I wanted to "Select a remote user profile
HIVE (ntuser.dat) for editing?". I clicked YES and it prompted me to
select the ntuser.dat in c:\documents and settings\administrator, but I
wasn't sure I should modify anything on c: that I didn't have to, so I
cancelled out and restarted the Registry Editor PE. This time, I
clicked NO and the Registry Editor PE loaded. However, there is only a
ControSet001 (no 002, etc.) and there isn't a CrashControl key listed
under \ControlSet001\Control.
Is this because I didn't select the ntuser.dat in c:\documents and
settings\administrator? Should I run it again and use that?

No, ntuser.dat has nothing to do with this, these are user profile
hives. Edit the SYSTEM hive (without an extention). What does the
Select key say for the 0x1 value? If there is only one ControlSet then
edit that one, I take it there is probably no LastKnownGood.

John
 
G

googlegroups

John said:
No, ntuser.dat has nothing to do with this, these are user profile
hives. Edit the SYSTEM hive (without an extention). What does the
Select key say for the 0x1 value? If there is only one ControlSet then
edit that one, I take it there is probably no LastKnownGood.

John,
Actually, in the SYSTEM hive, there IS a LastKnownGood key, but it's at
HKEY_LOCAL_MACHINE\SYSTEM\Select\LastKnownGood. There's no Select key
under the ControlSet001 key.

There are keys under the HKEY_LOCAL_MACHINE\SYSTEM\Select\ key:
Current 0x00000001 (1)
Default 0x00000001 (1)
Failed 0x00000000 (0)
LastKnownGood 0x00000001 (1)

Does that help?
David
 
G

googlegroups

There are keys under the HKEY_LOCAL_MACHINE\SYSTEM\Select\ key:
Current 0x00000001 (1)
Default 0x00000001 (1)
Failed 0x00000000 (0)
LastKnownGood 0x00000001 (1)

That's supposed to be "These are the keys...."
 
J

John John

John,
Actually, in the SYSTEM hive, there IS a LastKnownGood key, but it's at
HKEY_LOCAL_MACHINE\SYSTEM\Select\LastKnownGood. There's no Select key
under the ControlSet001 key.

There are keys under the HKEY_LOCAL_MACHINE\SYSTEM\Select\ key:
Current 0x00000001 (1)
Default 0x00000001 (1)
Failed 0x00000000 (0)
LastKnownGood 0x00000001 (1)

Does that help?

There isn't supposed to be a Select key at the ControlSetnnn, where you
found it is where it's supposed to be. The value (LastKnownGood) is
there as I expected but it doesn't have a different ControlSet
associated to it. As it is when you boot your computer it makes no
difference if you choose to boot normally or to use the Last Known Good
boot option, both point to the same ControlSet, the same set of
instructions from the registry. Edit the ControlSet001 key. Not that
you have much of any other choice anyway, like the Ford Model T you
could have any colour you wanted as long as you wanted black... ;-)

John
 
G

googlegroups

John said:
There isn't supposed to be a Select key at the ControlSetnnn, where you
found it is where it's supposed to be. The value (LastKnownGood) is
there as I expected but it doesn't have a different ControlSet
associated to it. As it is when you boot your computer it makes no
difference if you choose to boot normally or to use the Last Known Good
boot option, both point to the same ControlSet, the same set of
instructions from the registry. Edit the ControlSet001 key. Not that
you have much of any other choice anyway, like the Ford Model T you
could have any colour you wanted as long as you wanted black... ;-)

John,
Sorry, what do I edit on the ControlSet001 key? Am I adding a new key
(currently, there are no keys in ControlSet001). However, ControlSet001
has four sub "folders":
Control
Enum
Hardware Profiles
Services

Also, and I think this may be what you were looking for earlier (it's
listed as "_REMOTE_SYSTEM", instead of just "SYSTEM", which threw me
off):
There's a CrashControl key here:
HKLM\_REMOTE_SYSTEM\ControlSet003\Control\CrashControl (there are no
other ControlSetxxx under _REMOTE_SYSTEM)

There are 7 keys below CrashControl:
AutoReboot REG_DWORD 0x00000001 (1)
CrashDumpEnabled REG_DWORS 0x00000001 (1)
DumpFile REG_EXPAND_SZ %SystemRoot%\MEMORY.DMP
LogEvent REG_DWORD 0x00000001 (1)
MinidumpDir REG_EXPAND_SZ %SystemRoot%\Minidump
Overwrite REG_DWORD 0x00000001 (1)
SendAlert REG_DWORD 0x00000001 (1)


Is the AutoReboot the key I need to set to (0) to stop it from
"auto-rebooting on errors"?
 
J

John John

John,
Sorry, what do I edit on the ControlSet001 key? Am I adding a new key
(currently, there are no keys in ControlSet001). However, ControlSet001
has four sub "folders":
Control
Enum
Hardware Profiles
Services

Also, and I think this may be what you were looking for earlier (it's
listed as "_REMOTE_SYSTEM", instead of just "SYSTEM", which threw me
off):
There's a CrashControl key here:
HKLM\_REMOTE_SYSTEM\ControlSet003\Control\CrashControl (there are no
other ControlSetxxx under _REMOTE_SYSTEM)

There are 7 keys below CrashControl:
AutoReboot REG_DWORD 0x00000001 (1)
CrashDumpEnabled REG_DWORS 0x00000001 (1)
DumpFile REG_EXPAND_SZ %SystemRoot%\MEMORY.DMP
LogEvent REG_DWORD 0x00000001 (1)
MinidumpDir REG_EXPAND_SZ %SystemRoot%\Minidump
Overwrite REG_DWORD 0x00000001 (1)
SendAlert REG_DWORD 0x00000001 (1)


Is the AutoReboot the key I need to set to (0) to stop it from
"auto-rebooting on errors"?

You are not adding new keys or values, you are just changing the value
data at one value name, nothing else. In the HKLM\_REMOTE_SYSTEM\ look
at the Select Key and then determine which ControlSet is the Default
one, as explained earlier, then, in the same HKLM\_REMOTE_SYSTEM\ tree,
edit the proper ControlSet and edit the AutoReboot value

The key will be:

[HKLM\_REMOTE_SYSTEM\ControlSet00x\Control\CrashControl]

The value name is:

AutoReboot (type REG_DWORD)

Modify the value data, change it from 1 to 0

That is the only thing that you need to change or should change for the
time being. Unload the remote hive and reboot.

John
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top