Restoring registry backups and Recovery Console password

[Parish]

XP Home SP2

Get an error when booting that WINDOWS\SYSTEM32\CONFIG\SYSTME is missing
or corrupt. This is the HKLM registry hive yes?

Booted from the CD to the Recovery Console and went to
\WINDOWS\SYSTEM32\CONFIG. SYSTEM is there and seems a reasonable size,
~3.5MB

Many years ago I screwed the registry on an NT4 machine which, luckily,
dual booted NT3.51 so I booted into 3.51 and manually copied the
registry backup into placed. AFAICR the .SAV files are the backups (as
used when booting Last Known Good) so although SYSTEM.SAV was only ~25%
the size of SYSTEM I copied SYSTEM to C:\ and copied SYSTEM.SAV to
SYSTEM on the XP machine.

When I rebooted (from the HDD) it said "Setup is restarting" and the XP
install screen appeared. I rebooted from the CD and went to the Recovery
Console but now it won't accept a blank password - it worked the first
time as Administrator didn't have a password.

I guess that SYSTEM.SAV is from the original install which is why it
started running setup.

How do I get into the Recovery Console to restore SYSTEM and where are
the registry backups kept in XP? I've searched the KB but the only
likely article is 308402 but that only applies if SysPrep was used,
which it wasn't.

Also, any idea why this file keeps getting corrupted? The guy whose
machine it is has seen this several times and has reinstalled XP each time.

TIA

Regards,

Parish

 

[Dave Patrick]

Setup has two stages: text mode and graphics mode. The hive is copied to a
..sav file after the text-mode stage of setup to protect it from errors that
might occur if the graphics-mode stage of setup fails. If setup fails during
the graphics-mode stage, only the graphics-mode stage is repeated when the
computer is restarted; the .sav file is used to restore the hive data. So
those *.sav files should have had a date stamp of when you installed the OS
and can't be used in this case.

This article may help.

http://support.microsoft.com/kb/307545

(you only need to copy the system hive)

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| XP Home SP2
|
| Get an error when booting that WINDOWS\SYSTEM32\CONFIG\SYSTME is missing
| or corrupt. This is the HKLM registry hive yes?
|
| Booted from the CD to the Recovery Console and went to
| \WINDOWS\SYSTEM32\CONFIG. SYSTEM is there and seems a reasonable size,
| ~3.5MB
|
| Many years ago I screwed the registry on an NT4 machine which, luckily,
| dual booted NT3.51 so I booted into 3.51 and manually copied the
| registry backup into placed. AFAICR the .SAV files are the backups (as
| used when booting Last Known Good) so although SYSTEM.SAV was only ~25%
| the size of SYSTEM I copied SYSTEM to C:\ and copied SYSTEM.SAV to
| SYSTEM on the XP machine.
|
| When I rebooted (from the HDD) it said "Setup is restarting" and the XP
| install screen appeared. I rebooted from the CD and went to the Recovery
| Console but now it won't accept a blank password - it worked the first
| time as Administrator didn't have a password.
|
| I guess that SYSTEM.SAV is from the original install which is why it
| started running setup.
|
| How do I get into the Recovery Console to restore SYSTEM and where are
| the registry backups kept in XP? I've searched the KB but the only
| likely article is 308402 but that only applies if SysPrep was used,
| which it wasn't.
|
| Also, any idea why this file keeps getting corrupted? The guy whose
| machine it is has seen this several times and has reinstalled XP each
time.
|
| TIA
|
| Regards,
|
| Parish

 

[Parish]

.sav file after the text-mode stage of setup to protect it from errors that
might occur if the graphics-mode stage of setup fails. If setup fails during
the graphics-mode stage, only the graphics-mode stage is repeated when the
computer is restarted; the .sav file is used to restore the hive data. So
those *.sav files should have had a date stamp of when you installed the OS
and can't be used in this case.

This article may help.

http://support.microsoft.com/kb/307545

(you only need to copy the system hive)

Thanks Dave. So the backups are in \Windows\Repair - different to NT4
then, or is my memory letting me down?

I still have the problem that I can't get into the Recovery Console to
copy the backups into place though.

BTW, the KB article you posted refers to
http://support.microsoft.com/kb/318159 which says that a feature was
added in SP1 that automatically repairs damaged/corrupted registry hives
on boot-up. Since this machine is SP2 it makes it all the more puzzling
that I had this problem in the first place.

Regards,

Parish

 

[Dave Patrick]

No, same place. The difference is Windows NT stored them in a compressed
state.

Hard to say what effect using the SAV files have at this point. You may now
have to replace the files from a parallel install.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Thanks Dave. So the backups are in \Windows\Repair - different to NT4
| then, or is my memory letting me down?
|
| I still have the problem that I can't get into the Recovery Console to
| copy the backups into place though.
|
| BTW, the KB article you posted refers to
| http://support.microsoft.com/kb/318159 which says that a feature was
| added in SP1 that automatically repairs damaged/corrupted registry hives
| on boot-up. Since this machine is SP2 it makes it all the more puzzling
| that I had this problem in the first place.
|
| Regards,
|
| Parish

 

[Parish]

No, same place. The difference is Windows NT stored them in a compressed
state.

Hard to say what effect using the SAV files have at this point. You may now
have to replace the files from a parallel install.

Hmmm, I've just taken a look on another XP machine and the files in
\Windows\Repair have the timestamp from when XP was installed (although
they are a different size - bigger - than the .SAV ones). I thought
Windows saves the registry hives everytime it _successfully_ boots and
that it uses these if the next boot fails and you use Last Known Good?
If this isn't the case, how does it boot using the last known good setup?

Parish

 

[Dave Patrick]

Looking in;
HKEY_LOCAL_MACHINE\SYSTEM\Select
you'll find the Reg_Dword values for
"Current"=dword:00000001
"Default"=dword:00000001
"Failed"=dword:00000000
"LastKnownGood"=dword:00000002

CurrentControlSet is volatile and will always be an image (at boot) of
what's defined in ControlSetx where x = the value of "Current"

Choosing last known good boots the system with the control set that last
successfully booted your system. Control sets contain system configuration
information such as device drivers and services but nothing from the
software hive.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Parish" wrote:
| Hmmm, I've just taken a look on another XP machine and the files in
| \Windows\Repair have the timestamp from when XP was installed (although
| they are a different size - bigger - than the .SAV ones). I thought
| Windows saves the registry hives everytime it _successfully_ boots and
| that it uses these if the next boot fails and you use Last Known Good?
| If this isn't the case, how does it boot using the last known good setup?
|
| Parish