Fix for large, possibly corrupt DEFAULT registry file?

[Henry Cumbie]

I have a Windows 2000 Server, Service Pack 4.

The DEFAULT file in C:\Winnt\System32\Config is shown as being 233,844 KB in
size. There is a DEFAULT.SAV file in the same folder that is 80 KB in size.

The DEFAULT file in C:\Winnt\Repair is 116 KB in size and is dated the date
of installation of Windows 2000 (over five years ago).

Running the Create ERD Wizard in NTBACKUP creates a DEFAULT file that is
shown as 0 KB in size in the C:\Winnt\Repair\RegBack folder.

Whenever I log on to the server console, using the administrator account
and/or any other account that has the right to logon locally, I get an error
message indicating the user profile cannot be loaded because the registry is
too large and that the default profile will be loaded.

I think it's pretty obvious that the DEFAULT registry file is corrupted. How
to I fix this problem???

Thanks in advance for any assistance and advice you can provide.

Henry Cumbie

 

[Dave Patrick]

What happens if you create a new user and logon with that account? Does this
server have an unusually large amount of services running under the system
account? HKEY_USERS\.Default is made up from Default, Default.log
(Default.sav is the file saved at end of text mode portion of Windows setup)
and is the profile for the Local System account.




--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[Henry Cumbie]

Dave,

Thanks for the response. Sorry I didn't reply earlier but I actually had the
weekend off for a change...

1. Created a new user account (local account, added to local Administrator
group). Log in with this account did NOT produce an error message related to
the size of the registry. The profile created for the new user is just over
130 MB in size total. Investigation shows that approximately 129 MB of the
profile is contained in C:\Documents and Settings\Username\Application
Data\Microsoft\CryptnetUrlCache folder. According to
http://support.microsoft.com/kb/887195/en-us this folder is used by the
CryptoAPI to cache certificate related information instead of using IE's
cache... The size of this folder structure and the fact that it is
independently created for each profile certainly presents a problem for
systems that have limited disk space on C: drive...

2. After the test with the test user account, I moved the profile for the
normal administrator account (the one that had been producing the error
message about the size of the registry and having to load the Default
profile) to a temporary location. Then I logged in using the normal
administrator account. It created a new profile and did not produce the error
message regarding size of the registry and using default profile... The new
profile for the administrator account is also greater than 130 MB in size and
has the large (129 MB) CryptnetUrlCache folder structure...

Note: Examining the old profile for the adminstrator account and other
profiles that log on locally, it appears that someone (another administrator)
must have tried removing the CryptnetUrlCache folder from the profiles. Two
don't have them and the one for the normal administrator account has the
folder but the contents is smaller, approximately 30 MB...

3. There are 61 services currently running under LocalSystem credentials.

Well, that's what I've been able to discover so far. I still think the large
DEFAULT file is a problem but I'm not sure it relates directly to the error
message I was getting at log in... And the size of the CryptnetUrlCache
folder structure in EACH new profile is definately a significant issue...

I appreciate any help you may be able to provide on this issue.

Henry Cumbie

What happens if you create a new user and logon with that account? Does this
server have an unusually large amount of services running under the system
account? HKEY_USERS\.Default is made up from Default, Default.log
(Default.sav is the file saved at end of text mode portion of Windows setup)
and is the profile for the Local System account.




--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

I have a Windows 2000 Server, Service Pack 4.

The DEFAULT file in C:\Winnt\System32\Config is shown as being 233,844 KB
in
size. There is a DEFAULT.SAV file in the same folder that is 80 KB in
size.

The DEFAULT file in C:\Winnt\Repair is 116 KB in size and is dated the
date
of installation of Windows 2000 (over five years ago).

Running the Create ERD Wizard in NTBACKUP creates a DEFAULT file that is
shown as 0 KB in size in the C:\Winnt\Repair\RegBack folder.

Whenever I log on to the server console, using the administrator account
and/or any other account that has the right to logon locally, I get an
error
message indicating the user profile cannot be loaded because the registry
is
too large and that the default profile will be loaded.

I think it's pretty obvious that the DEFAULT registry file is corrupted.
How
to I fix this problem???

Thanks in advance for any assistance and advice you can provide.

Henry Cumbie

 

[Dave Patrick]

I've never heard of the default hive bloating but if you
Programs|Accessories|System Tools|Backup, then choose ERD, then if you check
the box for "Also backup....", then the reg will also be backed up to
%systemroot%\repair\RegBack
leaving the
%systemroot%\repair\
directory files intact as original installation. This should compact the
hive during the backup.

Then compare the size of the system hive found in;
%systemroot%\repair\RegBack
with that of the in use hive found in;
%systemroot%\system32\config




You might ask them here about the other issue.

http://www.microsoft.com/communitie...ee4-477c-4f8e-af64-5e30b5862742&lang=en&cr=US

http://www.microsoft.com/communitie...ef8-cf12-4752-bb42-274431b72e07&lang=en&cr=US


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[Henry Cumbie]

Dave,

Per my original message, I've already used the NTBackup program ERD option.
Doing that produces a DEFAULT file in the c:\winnt\repair\RegBack folder that
is listed as 0 KB in size. This indicates to me that the ERD process tried to
create a backup of DEFAULT and failed after opening the destination file,
thus the 0 KB size.

Well, hopefully it will not cause a real problem before we are ready to
migrate to the new server platform in a couple of months...

Thanks for your efforts.

Henry Cumbie

I've never heard of the default hive bloating but if you
Programs|Accessories|System Tools|Backup, then choose ERD, then if you check
the box for "Also backup....", then the reg will also be backed up to
%systemroot%\repair\RegBack
leaving the
%systemroot%\repair\
directory files intact as original installation. This should compact the
hive during the backup.

Then compare the size of the system hive found in;
%systemroot%\repair\RegBack
with that of the in use hive found in;
%systemroot%\system32\config




You might ask them here about the other issue.

http://www.microsoft.com/communitie...ee4-477c-4f8e-af64-5e30b5862742&lang=en&cr=US

http://www.microsoft.com/communitie...ef8-cf12-4752-bb42-274431b72e07&lang=en&cr=US


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

Dave,

Thanks for the response. Sorry I didn't reply earlier but I actually had
the
weekend off for a change...

1. Created a new user account (local account, added to local Administrator
group). Log in with this account did NOT produce an error message related
to
the size of the registry. The profile created for the new user is just
over
130 MB in size total. Investigation shows that approximately 129 MB of the
profile is contained in C:\Documents and Settings\Username\Application
Data\Microsoft\CryptnetUrlCache folder. According to
http://support.microsoft.com/kb/887195/en-us this folder is used by the
CryptoAPI to cache certificate related information instead of using IE's
cache... The size of this folder structure and the fact that it is
independently created for each profile certainly presents a problem for
systems that have limited disk space on C: drive...

2. After the test with the test user account, I moved the profile for the
normal administrator account (the one that had been producing the error
message about the size of the registry and having to load the Default
profile) to a temporary location. Then I logged in using the normal
administrator account. It created a new profile and did not produce the
error
message regarding size of the registry and using default profile... The
new
profile for the administrator account is also greater than 130 MB in size
and
has the large (129 MB) CryptnetUrlCache folder structure...

Note: Examining the old profile for the adminstrator account and other
profiles that log on locally, it appears that someone (another
administrator)
must have tried removing the CryptnetUrlCache folder from the profiles.
Two
don't have them and the one for the normal administrator account has the
folder but the contents is smaller, approximately 30 MB...

3. There are 61 services currently running under LocalSystem credentials.

Well, that's what I've been able to discover so far. I still think the
large
DEFAULT file is a problem but I'm not sure it relates directly to the
error
message I was getting at log in... And the size of the CryptnetUrlCache
folder structure in EACH new profile is definately a significant issue...

I appreciate any help you may be able to provide on this issue.

Henry Cumbie

 

[Dave Patrick]

Try moving the files from %systemroot%\repair\RegBack and try again.



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[Henry Cumbie]

Dave,

Just tried your suggestion. Again, the ERD process reports completion w/o
error but the "default" file created in C:\Winnt\Repair\RegBack is shown as 0
KB.

Henry Cumbie

Try moving the files from %systemroot%\repair\RegBack and try again.



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

Dave,

Per my original message, I've already used the NTBackup program ERD
option.
Doing that produces a DEFAULT file in the c:\winnt\repair\RegBack folder
that
is listed as 0 KB in size. This indicates to me that the ERD process tried
to
create a backup of DEFAULT and failed after opening the destination file,
thus the 0 KB size.

Well, hopefully it will not cause a real problem before we are ready to
migrate to the new server platform in a couple of months...

Thanks for your efforts.

Henry Cumbie

 

[Dave Patrick]

This machine now has more than a couple of unexplained issues. Personally
I'd rebuild it.



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[Henry Cumbie]

Dave,

I'm just hanging on until we migrate to a new server running Win 2003
Server...

Thanks again for your efforts.

Henry Cumbie

This machine now has more than a couple of unexplained issues. Personally
I'd rebuild it.



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

Dave,

Just tried your suggestion. Again, the ERD process reports completion w/o
error but the "default" file created in C:\Winnt\Repair\RegBack is shown
as 0
KB.

Henry Cumbie

 

[Dave Patrick]

You're welcome.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect