Making last known good configuration the default?

[alex.birchall]

Hi,

I have a server running Windows 2000 SP4. It is up to date with
patches. Recently, the server started crashing and rebooting itself
several times a week. I sent the dump file to Microsoft for analsys
and they told me that a driver file named hidfw.sys was causing the
crashes.

In order to try renaming the file, I tried rebooting into safe mode.
The problem then was that in both Safe Mode and Safe Mode with
Networking, all I was getting was a blank screen -- the login prompt
never appeared.

I contacted a colleague who was able to map a drive to the server
while it was supposedly in Safe Mode. He was then able to rename the
file hidfw.sys.

What happens now is that when I restart Windows, the server
eventually restarts and displays the following message:

"Service control Manager
Windows 2000 could not be started as configured. A previous working
configuration was used instead."

After I log on, I find this message in the System Event Log:

"The Microsoft HID Class Drive failed to start due to the following
error: The system cannot find the file specified.
The system reverted to its last known good configuration. The system
is restarting."

Where is the Microsoft HID Class Drive -- presumably it is hidfw.sys,
which has been renamed.

In Device Manager, the only device that appears to have a problem is
something called "WinVNC Video Hook Driver". Should I uninstall it?

Should I reinstall SP4?

I can find no reference to hidfw.sys in the registry.

The thing is, the Last Known Good Configuration is fine by me. It
enables the server to provide the services people expect. Can I make
it the default?

And another question is: What exactly is the dllcache directory in c:
\winnt\system32? It is not on my other Windows 2000 server.

Any advice most gratefully received.

Alex

 

[alex.birchall]

Hi,

I have a server running Windows 2000 SP4.  It is up to date with
patches.  Recently, the server started crashing and rebooting itself
several times a week.  I sent the dump file to Microsoft for analsys
and they told me that a driver file namedhidfw.syswas causing the
crashes.

In order to try renaming the file, I tried rebooting into safe mode.
The problem then was that in both Safe Mode and Safe Mode with
Networking, all I was getting was a blank screen -- the login prompt
never appeared.

I contacted a colleague who was able to map a drive to the server
while it was supposedly in Safe Mode.  He was then able to rename the
filehidfw.sys.

What happens now is that when I restart Windows, the server
eventually  restarts and displays the following message:

"Service control Manager
Windows 2000 could not be started as configured. A previous working
configuration was used instead."

After I log on, I find this message in the System Event Log:

"The Microsoft HID Class Drive failed to start due to the following
error:  The system cannot find the file specified.
The system reverted to its last known good configuration.  The system
is restarting."

Where is the Microsoft HID Class Drive -- presumably it ishidfw.sys,
which has been renamed.

In Device Manager, the only device that appears to have a problem is
something called "WinVNC Video Hook Driver".  Should I uninstall it?

Should I reinstall SP4?

I can find no reference tohidfw.sysin the registry.

The thing is, the Last Known Good Configuration is fine by me.  It
enables the server to provide the services people expect.  Can I make
it the default?

And another question is:  What exactly is the dllcache directory in c:
\winnt\system32?  It is not on my other Windows 2000 server.

Any advice most gratefully received.

Alex

The good news is that I have found "hidfw.sys" appears under "Non-Plug
and Play Devices" when I choose to show hidden devices (on the View
menu in Device Manager). I'll try uninstalling it.

 

[Dave Patrick]

Since the box has successfully booted (well sort of) the LKG key probably
has already been set as current / overwritten. Did you backup the registry
before hand? If so you may be able to restore the system hive.

You can try using the most recent backup found in;
%systemroot%\repair\regback

If that fails you haven't much choice but to copy/ use the
original-as-installed system hive from
%systemroot%\repair\system
to
%systemroot%\system32\config\system
You'll need to reinstall the device drivers for any hardware added since the
original OS install.

To start the Recovery Console, start the computer from the Windows 2000
Setup CD or the Windows 2000 Setup floppy disks. If you do not have Setup
floppy disks and your computer cannot start from the Windows 2000 Setup CD,
use another Windows 2000-based computer to create the Setup floppy disks. At
the "Welcome to Setup" screen. Press F10 or R to repair a Windows 2000
installation, and then press C to use the Recovery Console. The Recovery
Console then prompts you for the administrator password. If you do not have
the correct password, Recovery Console does not allow access to the
computer. If an incorrect password is entered three times, the Recovery
Console quits and restarts the computer. Note If the registry is corrupted
or missing or no valid installations are found, the Recovery Console starts
in the root of the startup volume without requiring a password. You cannot
access any folders, but you can carry out commands such as chkdsk, fixboot,
and fixmbr for limited disk repairs. Once the password has been validated,
you have full access to the Recovery Console, but limited access to the hard
disk. You can only access the following folders on your computer: drive
root, %systemroot% or %windir%

Be prepared to reinstall the OS though, before you start down this path.



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect