Last Known Good

[R. Hinse]

Awhile ago I had trouble booting into WIN2K after
uninstalling one version and installing a
different version of some software.
After rebooting, the keyboard and mouse wouldn't
work when I got to the logon screen. I finally had
to resort to Last Known Good Configuration to
restore functionality.

Afterwards my registry contained the following keys:

HKLM/System/Select

ControlSet001(failed) 3,130 KB
ControlSet002(default) 3,543 KB
ControlSet003(last known good) 3,137 KB
CurrentControlSet(current) 3,581 KB

Having copied the various ControlSet keys to a
text file and doing some comparisons, I noticed
that the ENUM keys for Kbdlass and Mouclass were
missing in the failed configuration.

While the problem was fixed, the LKG
(ControlSet003) now present is an almost identical
copy of the Failed ControlSet001, i.e missing the
ENUM parameters.

Is it possible somehow to remove the failed set and the LKG w/o problems?

 

[Dave Patrick]

Why would you want to? 'Failed' will never be used again and 'LastKnownGood'
will always equal 'CurrentControlSet'


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Awhile ago I had trouble booting into WIN2K after
| uninstalling one version and installing a
| different version of some software.
| After rebooting, the keyboard and mouse wouldn't
| work when I got to the logon screen. I finally had
| to resort to Last Known Good Configuration to
| restore functionality.
|
| Afterwards my registry contained the following keys:
|
| HKLM/System/Select
|
| ControlSet001(failed) 3,130 KB
| ControlSet002(default) 3,543 KB
| ControlSet003(last known good) 3,137 KB
| CurrentControlSet(current) 3,581 KB
|
| Having copied the various ControlSet keys to a
| text file and doing some comparisons, I noticed
| that the ENUM keys for Kbdlass and Mouclass were
| missing in the failed configuration.
|
| While the problem was fixed, the LKG
| (ControlSet003) now present is an almost identical
| copy of the Failed ControlSet001, i.e missing the
| ENUM parameters.
|
| Is it possible somehow to remove the failed set and the LKG w/o problems?
|
|

 

[R. Hinse]

Well, maybe I'm missing the point, but LKG is actually no good;
it is virtually identical to 'Failed'. I suppose if something were to
go wrong again, LKG would be replaced with 'CurrentControlSet'

However, I simply can't resist the temptation to return
HKLM/System/Select to its pristine state.

 

[Dave Patrick]

Really shouldn't happen that way.

CurrentControlSet, a pointer to a ControlSetxxx subkey (where xxx represents
a control set number, such as 001) designated in the Select\Current entry.

Clone, a copy of CurrentControlSet, created each time you start your
computer.

Select, which contains the following entries:

1. Default, which points to the control set number (for example,
001=ControlSet001) that the system has specified for use at the next
startup. If no error or manual invocation of the LastKnownGood startup
option occurs, this control set number is designated as the value of the
Default, Current, and LastKnownGood entries (assuming that a user is able to
log on successfully).

2. Current, which points to the last control set that was used to start the
system.

3. Failed, which points to a control set that did not start Windows
successfully. This value is updated when the LastKnownGood option is used to
start the system.

4. LastKnownGood, which points to the control set that was used during the
last user session. When a user logs on, the LastKnownGood control set is
updated with configuration information from the previous user session.



Ntldr uses the control set identified by the Default value unless you choose
the Last Known Good Configuration from the Windows Advanced Options menu.

After the user logs on, the following events occur:

Control sets are updated.

The control set referenced by the LastKnownGood registry entry is updated
with the contents in the Clone entry. Clone, which is a copy of the
CurrentControlSet entry, is created each time you start your computer. When
a user logs on, the LastKnownGood control set is updated with configuration
information from the previous user session.

http://support.microsoft.com/kb/q142033/


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Well, maybe I'm missing the point, but LKG is actually no good;
| it is virtually identical to 'Failed'. I suppose if something were to
| go wrong again, LKG would be replaced with 'CurrentControlSet'
|
| However, I simply can't resist the temptation to return
| HKLM/System/Select to its pristine state.

 

[R. Hinse]

Really shouldn't happen that way.

CurrentControlSet, a pointer to a ControlSetxxx subkey (where xxx represents
a control set number, such as 001) designated in the Select\Current entry.

Yes, and now CurrentControlSet points to ControlSet002 (default)

Clone, a copy of CurrentControlSet, created each time you start your
computer.

Clone no longer used

Select, which contains the following entries:

1. Default, which points to the control set number (for example,
001=ControlSet001) that the system has specified for use at the next
startup. If no error or manual invocation of the LastKnownGood startup
option occurs, this control set number is designated as the value of the
Default, Current, and LastKnownGood entries (assuming that a user is able to
log on successfully).

2. Current, which points to the last control set that was used to start the
system.

3. Failed, which points to a control set that did not start Windows
successfully. This value is updated when the LastKnownGood option is used to
start the system.

4. LastKnownGood, which points to the control set that was used during the
last user session. When a user logs on, the LastKnownGood control set is
updated with configuration information from the previous user session.



Ntldr uses the control set identified by the Default value unless you choose
the Last Known Good Configuration from the Windows Advanced Options menu.

After the user logs on, the following events occur:

Control sets are updated.

The control set referenced by the LastKnownGood registry entry is updated
with the contents in the Clone entry. Clone, which is a copy of the
CurrentControlSet entry, is created each time you start your computer. When
a user logs on, the LastKnownGood control set is updated with configuration
information from the previous user session.

I thought LKG only appeared when there was a problem with boot

http://support.microsoft.com/kb/q142033/

This kb was somewhat informative, but the question remains; Can I just
delete
ControlSet001 and ControlSet003 without any harsh consequences? Or is
my Select key somehow screwed up?

 

[Dave Patrick]

:
Can I just
| delete
| ControlSet001 and ControlSet003 without any harsh consequences?
* I wouldn't.

Or is
| my Select key somehow screwed up?
* At this point we don't know. All you've given us was some text file sizes
for various *.reg exports.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[R. Hinse]

:
Can I just
| delete
| ControlSet001 and ControlSet003 without any harsh consequences?

* I wouldn't.

Or is
| my Select key somehow screwed up?

* At this point we don't know. All you've given us was some text file sizes
for various *.reg exports.

Since you do not recommend deleting the control sets, what other information
could I supply that would help you better understand the problem or
recomend a course of action?

 

[Dave Patrick]

Post an export of the subkey;

HKEY_LOCAL_MACHINE\SYSTEM\Select

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Since you do not recommend deleting the control sets, what other
information
| could I supply that would help you better understand the problem or
| recomend a course of action?

 

[R. Hinse]

[HKEY_LOCAL_MACHINE\SYSTEM\Select]
"Current"=dword:00000002
"Default"=dword:00000002
"Failed"=dword:00000001
"LastKnownGood"=dword:00000003

 

[Dave Patrick]

Here's a method to use if you believe the LastKnownGood subkey is damaged.

http://support.microsoft.com/default.aspx?scid=kb;[LN];329850

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|
| [HKEY_LOCAL_MACHINE\SYSTEM\Select]
| "Current"=dword:00000002
| "Default"=dword:00000002
| "Failed"=dword:00000001
| "LastKnownGood"=dword:00000003

 

[Mark V]

[HKEY_LOCAL_MACHINE\SYSTEM\Select]
"Current"=dword:00000002
"Default"=dword:00000002
"Failed"=dword:00000001
"LastKnownGood"=dword:00000003

What do think is wrong with this?
Jumping in late so... If the system boots without error and you can
logon without error, and you can shutdown and repeat that sequence,
there is nothing wrong as far as I can tell at this point. If your
previously missing keys are now present in CCS then they should
also be present in the LKG after a system restart. Ignore
"failed" as it will not be used.

I strongly suggest you do no manual editing in this area without a
specific problem present and with full understanding (and defensive
Full Registry Backup on hand) of the problem and certain knowledge
of how to correct it.

 

[R. Hinse]

Don't have room to install a second copy of Win2K on another partition so
would like to
use remote registry method. However, a couple of problems:

1. Apparently can only use regedt32 to completely access Win2k registry
2. Only have a Win98 system on the network to use as remote registry connect
and
it doesn't come with regedt32 nor can I find a regedt32 distribution for
Win98

I also cannot simply copy regedt32 and its support files to Win98: it
doesn't work

Any suggestions?

 

[Dave Patrick]

Another option if you believe the system hive is corrupt, is to restore a
system hive backup. To do so rename the system hive found in
%systemroot%\system32\config\system
to system.old
then copy the most recent backup found in;
%systemroot%\repair\regback
to;
%systemroot%\system32\config
folder. If no backups in %systemroot%\repair\regback then copy/ use the
original-as-installed system hive from
%systemroot%\repair\system
to
%systemroot%\system32\config\system
You'll need to reinstall the device drivers for any hardware added since the
original OS install and reinstall any applications that run as a service.

To start the Recovery Console, start the computer from the Windows 2000
Setup CD or the Windows 2000 Setup floppy disks. If you do not have Setup
floppy disks and your computer cannot start from the Windows 2000 Setup CD,
use another Windows 2000-based computer to create the Setup floppy disks. At
the "Welcome to Setup" screen. Press F10 or R to repair a Windows 2000
installation, and then press C to use the Recovery Console. The Recovery
Console then prompts you for the administrator password. If you do not have
the correct password, Recovery Console does not allow access to the
computer. If an incorrect password is entered three times, the Recovery
Console quits and restarts the computer. Note If the registry is corrupted
or missing or no valid installations are found, the Recovery Console starts
in the root of the startup volume without requiring a password. You cannot
access any folders, but you can carry out commands such as chkdsk, fixboot,
and fixmbr for limited disk repairs. Once the password has been validated,
you have full access to the Recovery Console, but limited access to the hard
disk. You can only access the following folders on your computer: drive
root, %windir% or %systemroot%


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Don't have room to install a second copy of Win2K on another partition so
| would like to
| use remote registry method. However, a couple of problems:
|
| 1. Apparently can only use regedt32 to completely access Win2k registry
| 2. Only have a Win98 system on the network to use as remote registry
connect
| and
| it doesn't come with regedt32 nor can I find a regedt32 distribution
for
| Win98
|
| I also cannot simply copy regedt32 and its support files to Win98: it
| doesn't work
|
| Any suggestions?

 

[R. Hinse]

I am now more reluctant than ever to change anything since I am now
unsure whether repair\regback contains an uncorrupted registry. I suppose
that if LKG now contains a corrupt control set, it will be replaced with
ControlSet0002, the current uncorrupted ControlSet, if anything should
go wrong in the future.

Thanks for all your help.

Another option if you believe the system hive is corrupt, is to restore a
system hive backup. To do so rename the system hive found in
%systemroot%\system32\config\system
to system.old
then copy the most recent backup found in;
%systemroot%\repair\regback
to;
%systemroot%\system32\config
folder. If no backups in %systemroot%\repair\regback then copy/ use the
original-as-installed system hive from
%systemroot%\repair\system
to
%systemroot%\system32\config\system
You'll need to reinstall the device drivers for any hardware added since the
original OS install and reinstall any applications that run as a service.

To start the Recovery Console, start the computer from the Windows 2000
Setup CD or the Windows 2000 Setup floppy disks. If you do not have Setup
floppy disks and your computer cannot start from the Windows 2000 Setup CD,
use another Windows 2000-based computer to create the Setup floppy disks. At
the "Welcome to Setup" screen. Press F10 or R to repair a Windows 2000
installation, and then press C to use the Recovery Console. The Recovery
Console then prompts you for the administrator password. If you do not have
the correct password, Recovery Console does not allow access to the
computer. If an incorrect password is entered three times, the Recovery
Console quits and restarts the computer. Note If the registry is corrupted
or missing or no valid installations are found, the Recovery Console starts
in the root of the startup volume without requiring a password. You cannot
access any folders, but you can carry out commands such as chkdsk, fixboot,
and fixmbr for limited disk repairs. Once the password has been validated,
you have full access to the Recovery Console, but limited access to the hard
disk. You can only access the following folders on your computer: drive
root, %windir% or %systemroot%


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Don't have room to install a second copy of Win2K on another partition so
| would like to
| use remote registry method. However, a couple of problems:
|
| 1. Apparently can only use regedt32 to completely access Win2k registry
| 2. Only have a Win98 system on the network to use as remote registry
connect
| and
| it doesn't come with regedt32 nor can I find a regedt32 distribution
for
| Win98
|
| I also cannot simply copy regedt32 and its support files to Win98: it
| doesn't work
|
| Any suggestions?

 

[Dave Patrick]

You're welcome.

repair\regback contains hive file copies of the last time you manually
backed up the reg. You can check the date/time stamps on those files.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I am now more reluctant than ever to change anything since I am now
| unsure whether repair\regback contains an uncorrupted registry. I suppose
| that if LKG now contains a corrupt control set, it will be replaced with
| ControlSet0002, the current uncorrupted ControlSet, if anything should
| go wrong in the future.
|
| Thanks for all your help.