Nothing saves in HKLM

[Craig Cameron]

System: Win2kPro,SP4, Pentium III 800Mhz, IDE 20GB drive

Hi all, I have an interesting and frustrating problem that I have run out of
things to try and fix.

It all started when I set a chkdsk to run at next startup. It didn't run.
I set it again, and verified the entry in the bootexecute sections of
HKLM\System\CurrentControlSet\SessionManager. Rebooted, but still didn't
run, and said registry info in bootexecute, was gone.

Thinking it may be a conflict with one of my third party drivers, I created
a new hardware profile, and disabled one driver in the second profile. I
rebooted, and it didn't prompt for selection of which profile to use. After
bootup, I checked in Control Panel, and there was no sign of my hardware
profile that I had just created.

I think I can now conclude that entry's in the HKLM section of the registry
are not saving on reboot(I have done a logoff, and the registry entry for
the chkdsk was still there).

I have re-installed SP4, searched MS Knowledgebase about a million times,
but found nothing.

I have found in one of my many books, that any changes to the registry are
saved in a cache, then written to the registry on system reboot. But how
could I check that. The system file of the registry is always showing a
very recent modification, after reboot, so something is being written.

Could this be a local security policy setting?

Any help would be appreciated.

 

[Jerold Schulman]

System: Win2kPro,SP4, Pentium III 800Mhz, IDE 20GB drive

Hi all, I have an interesting and frustrating problem that I have run out of
things to try and fix.

It all started when I set a chkdsk to run at next startup. It didn't run.
I set it again, and verified the entry in the bootexecute sections of
HKLM\System\CurrentControlSet\SessionManager. Rebooted, but still didn't
run, and said registry info in bootexecute, was gone.

Thinking it may be a conflict with one of my third party drivers, I created
a new hardware profile, and disabled one driver in the second profile. I
rebooted, and it didn't prompt for selection of which profile to use. After
bootup, I checked in Control Panel, and there was no sign of my hardware
profile that I had just created.

I think I can now conclude that entry's in the HKLM section of the registry
are not saving on reboot(I have done a logoff, and the registry entry for
the chkdsk was still there).

I have re-installed SP4, searched MS Knowledgebase about a million times,
but found nothing.

I have found in one of my many books, that any changes to the registry are
saved in a cache, then written to the registry on system reboot. But how
could I check that. The system file of the registry is always showing a
very recent modification, after reboot, so something is being written.

Could this be a local security policy setting?

Any help would be appreciated.

Is your account also a member of the Guest group?
Have you use Regedt32.exe to check the permissions on
the "Session Manager" key?


Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com

 

[Jerold Schulman]

System: Win2kPro,SP4, Pentium III 800Mhz, IDE 20GB drive

Hi all, I have an interesting and frustrating problem that I have run out of
things to try and fix.

It all started when I set a chkdsk to run at next startup. It didn't run.
I set it again, and verified the entry in the bootexecute sections of
HKLM\System\CurrentControlSet\SessionManager. Rebooted, but still didn't
run, and said registry info in bootexecute, was gone.

Thinking it may be a conflict with one of my third party drivers, I created
a new hardware profile, and disabled one driver in the second profile. I
rebooted, and it didn't prompt for selection of which profile to use. After
bootup, I checked in Control Panel, and there was no sign of my hardware
profile that I had just created.

I think I can now conclude that entry's in the HKLM section of the registry
are not saving on reboot(I have done a logoff, and the registry entry for
the chkdsk was still there).

I have re-installed SP4, searched MS Knowledgebase about a million times,
but found nothing.

I have found in one of my many books, that any changes to the registry are
saved in a cache, then written to the registry on system reboot. But how
could I check that. The system file of the registry is always showing a
very recent modification, after reboot, so something is being written.

Could this be a local security policy setting?

Any help would be appreciated.

Is your account also a member of the Guest group?
Have you use Regedt32.exe to check the permissions on
the "Session Manager" key?


Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com

 

[Mark V]

System: Win2kPro,SP4, Pentium III 800Mhz, IDE 20GB drive

Hi all, I have an interesting and frustrating problem that I have
run out of things to try and fix.

It all started when I set a chkdsk to run at next startup. It
didn't run. I set it again, and verified the entry in the
bootexecute sections of
HKLM\System\CurrentControlSet\SessionManager. Rebooted, but still
didn't run, and said registry info in bootexecute, was gone.

Thinking it may be a conflict with one of my third party drivers,
I created a new hardware profile, and disabled one driver in the
second profile. I rebooted, and it didn't prompt for selection of
which profile to use. After bootup, I checked in Control Panel,
and there was no sign of my hardware profile that I had just
created.

I think I can now conclude that entry's in the HKLM section of the
registry are not saving on reboot(I have done a logoff, and the
registry entry for the chkdsk was still there).

I have re-installed SP4, searched MS Knowledgebase about a million
times, but found nothing.

I have found in one of my many books, that any changes to the
registry are saved in a cache, then written to the registry on
system reboot. But how could I check that. The system file of
the registry is always showing a very recent modification, after
reboot, so something is being written.

Could this be a local security policy setting?

Limiting to just CHKDSK/AUTOCHK not-running problems, I suggest that
that possibly the data in "BootExecute" may be faulty. If not
formatted and ordered correctly in this REG_MULTI_SZ various failures
may occur.

Try reseting it via CHKNTFS.EXE first (chkntfs /D).

 

[Mark V]

System: Win2kPro,SP4, Pentium III 800Mhz, IDE 20GB drive

Hi all, I have an interesting and frustrating problem that I have
run out of things to try and fix.

It all started when I set a chkdsk to run at next startup. It
didn't run. I set it again, and verified the entry in the
bootexecute sections of
HKLM\System\CurrentControlSet\SessionManager. Rebooted, but still
didn't run, and said registry info in bootexecute, was gone.

Thinking it may be a conflict with one of my third party drivers,
I created a new hardware profile, and disabled one driver in the
second profile. I rebooted, and it didn't prompt for selection of
which profile to use. After bootup, I checked in Control Panel,
and there was no sign of my hardware profile that I had just
created.

I think I can now conclude that entry's in the HKLM section of the
registry are not saving on reboot(I have done a logoff, and the
registry entry for the chkdsk was still there).

I have re-installed SP4, searched MS Knowledgebase about a million
times, but found nothing.

I have found in one of my many books, that any changes to the
registry are saved in a cache, then written to the registry on
system reboot. But how could I check that. The system file of
the registry is always showing a very recent modification, after
reboot, so something is being written.

Could this be a local security policy setting?

Limiting to just CHKDSK/AUTOCHK not-running problems, I suggest that
that possibly the data in "BootExecute" may be faulty. If not
formatted and ordered correctly in this REG_MULTI_SZ various failures
may occur.

Try reseting it via CHKNTFS.EXE first (chkntfs /D).

 

[Craig Cameron]

Tried. Same result.

I have eliminated group policy, so the only thing I can think of is that
cached entries are being lost on shutdown(I tried a logoff, the logon, and
the registry entries were still there). I read somewhere that Windows will
keep changes in a cache, then when shutdown occurs, they are written to the
registry.

I tried auditing the key in the registry, but the auditing settings were
lost when I rebooted. So it is basically everything in HKLM.

Does anybody know of a registry repair tool? I guess I could boot the
Win2kPro cd and do a repair from there.

Everybody's input is appreciated.

Thanks.

 

[Craig Cameron]

Tried. Same result.

I have eliminated group policy, so the only thing I can think of is that
cached entries are being lost on shutdown(I tried a logoff, the logon, and
the registry entries were still there). I read somewhere that Windows will
keep changes in a cache, then when shutdown occurs, they are written to the
registry.

I tried auditing the key in the registry, but the auditing settings were
lost when I rebooted. So it is basically everything in HKLM.

Does anybody know of a registry repair tool? I guess I could boot the
Win2kPro cd and do a repair from there.

Everybody's input is appreciated.

Thanks.

 

[Dave Patrick]

AFAIK changes are written immediately or at least as fast as they can be
transferred from the log files.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| Tried. Same result.
|
| I have eliminated group policy, so the only thing I can think of is that
| cached entries are being lost on shutdown(I tried a logoff, the logon, and
| the registry entries were still there). I read somewhere that Windows
will
| keep changes in a cache, then when shutdown occurs, they are written to
the
| registry.
|
| I tried auditing the key in the registry, but the auditing settings were
| lost when I rebooted. So it is basically everything in HKLM.
|
| Does anybody know of a registry repair tool? I guess I could boot the
| Win2kPro cd and do a repair from there.
|
| Everybody's input is appreciated.
|
| Thanks.
| | > In microsoft.public.win2000.registry Craig Cameron wrote:
| >
| > > System: Win2kPro,SP4, Pentium III 800Mhz, IDE 20GB drive
| > >
| > > Hi all, I have an interesting and frustrating problem that I have
| > > run out of things to try and fix.
| > >
| > > It all started when I set a chkdsk to run at next startup. It
| > > didn't run. I set it again, and verified the entry in the
| > > bootexecute sections of
| > > HKLM\System\CurrentControlSet\SessionManager. Rebooted, but still
| > > didn't run, and said registry info in bootexecute, was gone.
| > >
| > > Thinking it may be a conflict with one of my third party drivers,
| > > I created a new hardware profile, and disabled one driver in the
| > > second profile. I rebooted, and it didn't prompt for selection of
| > > which profile to use. After bootup, I checked in Control Panel,
| > > and there was no sign of my hardware profile that I had just
| > > created.
| > >
| > > I think I can now conclude that entry's in the HKLM section of the
| > > registry are not saving on reboot(I have done a logoff, and the
| > > registry entry for the chkdsk was still there).
| > >
| > > I have re-installed SP4, searched MS Knowledgebase about a million
| > > times, but found nothing.
| > >
| > > I have found in one of my many books, that any changes to the
| > > registry are saved in a cache, then written to the registry on
| > > system reboot. But how could I check that. The system file of
| > > the registry is always showing a very recent modification, after
| > > reboot, so something is being written.
| > >
| > > Could this be a local security policy setting?
| >
| > Limiting to just CHKDSK/AUTOCHK not-running problems, I suggest that
| > that possibly the data in "BootExecute" may be faulty. If not
| > formatted and ordered correctly in this REG_MULTI_SZ various failures
| > may occur.
| >
| > Try reseting it via CHKNTFS.EXE first (chkntfs /D).
| >
|
|

 

[Dave Patrick]

AFAIK changes are written immediately or at least as fast as they can be
transferred from the log files.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| Tried. Same result.
|
| I have eliminated group policy, so the only thing I can think of is that
| cached entries are being lost on shutdown(I tried a logoff, the logon, and
| the registry entries were still there). I read somewhere that Windows
will
| keep changes in a cache, then when shutdown occurs, they are written to
the
| registry.
|
| I tried auditing the key in the registry, but the auditing settings were
| lost when I rebooted. So it is basically everything in HKLM.
|
| Does anybody know of a registry repair tool? I guess I could boot the
| Win2kPro cd and do a repair from there.
|
| Everybody's input is appreciated.
|
| Thanks.
| | > In microsoft.public.win2000.registry Craig Cameron wrote:
| >
| > > System: Win2kPro,SP4, Pentium III 800Mhz, IDE 20GB drive
| > >
| > > Hi all, I have an interesting and frustrating problem that I have
| > > run out of things to try and fix.
| > >
| > > It all started when I set a chkdsk to run at next startup. It
| > > didn't run. I set it again, and verified the entry in the
| > > bootexecute sections of
| > > HKLM\System\CurrentControlSet\SessionManager. Rebooted, but still
| > > didn't run, and said registry info in bootexecute, was gone.
| > >
| > > Thinking it may be a conflict with one of my third party drivers,
| > > I created a new hardware profile, and disabled one driver in the
| > > second profile. I rebooted, and it didn't prompt for selection of
| > > which profile to use. After bootup, I checked in Control Panel,
| > > and there was no sign of my hardware profile that I had just
| > > created.
| > >
| > > I think I can now conclude that entry's in the HKLM section of the
| > > registry are not saving on reboot(I have done a logoff, and the
| > > registry entry for the chkdsk was still there).
| > >
| > > I have re-installed SP4, searched MS Knowledgebase about a million
| > > times, but found nothing.
| > >
| > > I have found in one of my many books, that any changes to the
| > > registry are saved in a cache, then written to the registry on
| > > system reboot. But how could I check that. The system file of
| > > the registry is always showing a very recent modification, after
| > > reboot, so something is being written.
| > >
| > > Could this be a local security policy setting?
| >
| > Limiting to just CHKDSK/AUTOCHK not-running problems, I suggest that
| > that possibly the data in "BootExecute" may be faulty. If not
| > formatted and ordered correctly in this REG_MULTI_SZ various failures
| > may occur.
| >
| > Try reseting it via CHKNTFS.EXE first (chkntfs /D).
| >
|
|

 

[Mark V]

Tried. Same result.

I have eliminated group policy, so the only thing I can think of
is that cached entries are being lost on shutdown(I tried a

Very unlikely. Changes are committed first to the LOG file then almost
immediately more permanently. That is not to say "impossible", but I
would think you would be seeing other signs like Event Log entries and
"registry corrupt" messages.

logoff, the logon, and the registry entries were still there). I
read somewhere that Windows will keep changes in a cache, then
when shutdown occurs, they are written to the registry.

I tried auditing the key in the registry, but the auditing
settings were lost when I rebooted. So it is basically everything
in HKLM.

Please clarify for me. Is this an issue with _a_ key/valuname/data
(and as regards AUTOCHK), or is there something that makes you say
"everything in HKLM" for a reason? Confused here over the scope of the
issues...

If this is _just_ issue with AUTOCHK and "BootExecute", then that
should be the areas of focus IMO and not anything spurious.

Does anybody know of a registry repair tool? I guess I could boot
the Win2kPro cd and do a repair from there.

Slow down. Before your frustration bites you in spite.
Diagnosis is a methodical process.

 

[Mark V]

Tried. Same result.

I have eliminated group policy, so the only thing I can think of
is that cached entries are being lost on shutdown(I tried a

Very unlikely. Changes are committed first to the LOG file then almost
immediately more permanently. That is not to say "impossible", but I
would think you would be seeing other signs like Event Log entries and
"registry corrupt" messages.

logoff, the logon, and the registry entries were still there). I
read somewhere that Windows will keep changes in a cache, then
when shutdown occurs, they are written to the registry.

I tried auditing the key in the registry, but the auditing
settings were lost when I rebooted. So it is basically everything
in HKLM.

Please clarify for me. Is this an issue with _a_ key/valuname/data
(and as regards AUTOCHK), or is there something that makes you say
"everything in HKLM" for a reason? Confused here over the scope of the
issues...

If this is _just_ issue with AUTOCHK and "BootExecute", then that
should be the areas of focus IMO and not anything spurious.

Does anybody know of a registry repair tool? I guess I could boot
the Win2kPro cd and do a repair from there.

Slow down. Before your frustration bites you in spite.
Diagnosis is a methodical process.

 

[Craig Cameron]

Everything I've tried: chkdsk, chkntfs, hardware profiles, auditing
settings( I tried to audit the key to hopefully see anything weird, but the
audit setting were lost on the reboot.

I'm really frustrated.

Thanks.

 

[Craig Cameron]

Everything I've tried: chkdsk, chkntfs, hardware profiles, auditing
settings( I tried to audit the key to hopefully see anything weird, but the
audit setting were lost on the reboot.

I'm really frustrated.

Thanks.

 

[Mark V]

Everything I've tried: chkdsk, chkntfs, hardware profiles,
auditing settings( I tried to audit the key to hopefully see
anything weird, but the audit setting were lost on the reboot.

I'm really frustrated.

[ ]

I can tell. Just help others help you a bit.

Is this only a failure to run chkdsk/autocheck?

Can you boot to the Recovery Console and run a manual CHKDSK? Do so
if you can.


If not, then have you checked both the file attributes and file
permissions on %systemroot%\system32\config\ ?

If you make a manual change in HKLM as an Administrator, the change
is lost on system restart?

Frankly, I still do not understand the problem fully. That may be
me, or it may be you not being patient/explicit/detailed. Or both.


Perhaps you'd rather backup up critical data, reformat and re-
install. That seems to be an acceptable solution to some.

 

[Mark V]

Everything I've tried: chkdsk, chkntfs, hardware profiles,
auditing settings( I tried to audit the key to hopefully see
anything weird, but the audit setting were lost on the reboot.

I'm really frustrated.

[ ]

I can tell. Just help others help you a bit.

Is this only a failure to run chkdsk/autocheck?

Can you boot to the Recovery Console and run a manual CHKDSK? Do so
if you can.


If not, then have you checked both the file attributes and file
permissions on %systemroot%\system32\config\ ?

If you make a manual change in HKLM as an Administrator, the change
is lost on system restart?

Frankly, I still do not understand the problem fully. That may be
me, or it may be you not being patient/explicit/detailed. Or both.


Perhaps you'd rather backup up critical data, reformat and re-
install. That seems to be an acceptable solution to some.

 

[Craig Cameron]

Everything is HKLM does not survive a reboot.

Auditing on the key is lost, I created a HW profile; it was lost.
Everything.

I used a registry tool to get rid of spyware etc., I ran a virus scan, I
defragged the drive, I defragged the system file(renamed in recovery
console, then copied it back to original name) but still same problem.

Anything else come to mind?

Thanks.

Everything I've tried: chkdsk, chkntfs, hardware profiles,
auditing settings( I tried to audit the key to hopefully see
anything weird, but the audit setting were lost on the reboot.

I'm really frustrated.

[ ]

I can tell. Just help others help you a bit.

Is this only a failure to run chkdsk/autocheck?

Can you boot to the Recovery Console and run a manual CHKDSK? Do so
if you can.


If not, then have you checked both the file attributes and file
permissions on %systemroot%\system32\config\ ?

If you make a manual change in HKLM as an Administrator, the change
is lost on system restart?

Frankly, I still do not understand the problem fully. That may be
me, or it may be you not being patient/explicit/detailed. Or both.


Perhaps you'd rather backup up critical data, reformat and re-
install. That seems to be an acceptable solution to some.

 

[Craig Cameron]

Everything is HKLM does not survive a reboot.

Auditing on the key is lost, I created a HW profile; it was lost.
Everything.

I used a registry tool to get rid of spyware etc., I ran a virus scan, I
defragged the drive, I defragged the system file(renamed in recovery
console, then copied it back to original name) but still same problem.

Anything else come to mind?

Thanks.

Everything I've tried: chkdsk, chkntfs, hardware profiles,
auditing settings( I tried to audit the key to hopefully see
anything weird, but the audit setting were lost on the reboot.

I'm really frustrated.

[ ]

I can tell. Just help others help you a bit.

Is this only a failure to run chkdsk/autocheck?

Can you boot to the Recovery Console and run a manual CHKDSK? Do so
if you can.


If not, then have you checked both the file attributes and file
permissions on %systemroot%\system32\config\ ?

If you make a manual change in HKLM as an Administrator, the change
is lost on system restart?

Frankly, I still do not understand the problem fully. That may be
me, or it may be you not being patient/explicit/detailed. Or both.


Perhaps you'd rather backup up critical data, reformat and re-
install. That seems to be an acceptable solution to some.

 

[Mark V]

Everything is HKLM does not survive a reboot.

Auditing on the key is lost, I created a HW profile; it was lost.
Everything.

I used a registry tool to get rid of spyware etc., I ran a virus
scan, I defragged the drive, I defragged the system file(renamed
in recovery console, then copied it back to original name) but
still same problem.

Anything else come to mind?
No.

Everything I've tried: chkdsk, chkntfs, hardware profiles,
auditing settings( I tried to audit the key to hopefully see
anything weird, but the audit setting were lost on the reboot.

I'm really frustrated.

[ ]

I can tell. Just help others help you a bit.

Is this only a failure to run chkdsk/autocheck?

Can you boot to the Recovery Console and run a manual CHKDSK? Do
so if you can.


If not, then have you checked both the file attributes and file
permissions on %systemroot%\system32\config\ ?

If you make a manual change in HKLM as an Administrator, the
change is lost on system restart?

Frankly, I still do not understand the problem fully. That may
be me, or it may be you not being patient/explicit/detailed. Or
both.


Perhaps you'd rather backup up critical data, reformat and re-
install. That seems to be an acceptable solution to some.

 

[Mark V]

Everything is HKLM does not survive a reboot.

Auditing on the key is lost, I created a HW profile; it was lost.
Everything.

I used a registry tool to get rid of spyware etc., I ran a virus
scan, I defragged the drive, I defragged the system file(renamed
in recovery console, then copied it back to original name) but
still same problem.

Anything else come to mind?
No.

Everything I've tried: chkdsk, chkntfs, hardware profiles,
auditing settings( I tried to audit the key to hopefully see
anything weird, but the audit setting were lost on the reboot.

I'm really frustrated.

[ ]

I can tell. Just help others help you a bit.

Is this only a failure to run chkdsk/autocheck?

Can you boot to the Recovery Console and run a manual CHKDSK? Do
so if you can.


If not, then have you checked both the file attributes and file
permissions on %systemroot%\system32\config\ ?

If you make a manual change in HKLM as an Administrator, the
change is lost on system restart?

Frankly, I still do not understand the problem fully. That may
be me, or it may be you not being patient/explicit/detailed. Or
both.


Perhaps you'd rather backup up critical data, reformat and re-
install. That seems to be an acceptable solution to some.