Restoring registry

[Guest]

In an nutshell, I need to restore the registry from about a week ago when I
had a system crash (possibly due to bad memory, which I've now replaced).
However, System Restore is failing to succeed. Software Distribution Service
3.0 appears after the checkpoint dates I need to use that are not working,
and some web posts suggest that could be what's preventing it from restoring.
I have yet to find a way to remove it. Is there a way to remove it, or is
there a "creative" way to get System Restore to work if it isn't working? Is
it possible that I can restore the registry file(s) from my external backup
to achieve the same result?

 

[Guest]

Have you tried the restore in safe mode?

 

[Pegasus \(MVP\)]

In an nutshell, I need to restore the registry from about a week ago when
I
had a system crash (possibly due to bad memory, which I've now replaced).
However, System Restore is failing to succeed. Software Distribution
Service
3.0 appears after the checkpoint dates I need to use that are not working,
and some web posts suggest that could be what's preventing it from
restoring.
I have yet to find a way to remove it. Is there a way to remove it, or is
there a "creative" way to get System Restore to work if it isn't working?
Is
it possible that I can restore the registry file(s) from my external
backup
to achieve the same result?

There are two ways to restore the registry from your external backup:
a) Restore the System State
b) Restore all registry files to a different location, then copy them back
manually.

There are several ways copy the registry files manually:
- By connecting your disk as a slave disk to some other machine.
- By booting your machine with a Bart PE boot CD (www.bootdisk.com).
- By booting the machine into Recovery Console mode.

If you intend to use the Recovery Console mode then you must first
enable full disk access in that mode. Here is how it's done:
- Run gpedit.msc via the Start / Run box.
- Local Computer Policy / Computer Configuration / Windows Settings /
Security Settings /
Security Options / Recovery Console: Allow floppy disk access . . .
- Set this policy to "Enabled".

 

[Guest]

Please allow me to ask (looking before I leap since I have so much at stake)...

Is there ANY downside to attempting System Restore in Safe Mode?

Thanks!

 

[Guest]

Thank you for this.

Please bear with me as I ask more questions so I'm surefooted in how I
proceed.

I assume a bootable CD is the most straightforward method of all, with least
room for user error (I’m experienced in most of the choices you provided but
I don’t do this every day). It also bypasses the question of whether the
registry files are in use or not. Agreed?

So, to do that:

The URL you gave me indirectly links to BartPE (Bart has pretty lengthy
discussions on the site which I have yet to read) but also gives the
following for a direct road to a downloaded bootable CD image:

http://www.eddiemaintenance.com/

Is this as good (and perhaps easier), do you think? Or should I read the
Bart stuff?

Also, where do I find a reliable list of what files to include as "registry"
or "system state" files that should be replaced from the System Restore
"saved" files?

And where do I find the System Restore saved files based on the date I'm
after?

(Oh, and by the way, is there any downside to trying System Restore in Safe
Mode first?)

Thanks again!

 

[Pegasus \(MVP\)]

*** See below.

Thank you for this.

Please bear with me as I ask more questions so I'm surefooted in how I
proceed.

I assume a bootable CD is the most straightforward method of all, with
least
room for user error (I'm experienced in most of the choices you provided
but
I don't do this every day). It also bypasses the question of whether the
registry files are in use or not. Agreed?

*** No, it does not bypass this question. I gave you several
*** methods to restore the registry manually. None of them
*** are subject to locked registry files.

So, to do that:

The URL you gave me indirectly links to BartPE (Bart has pretty lengthy
discussions on the site which I have yet to read) but also gives the
following for a direct road to a downloaded bootable CD image:

http://www.eddiemaintenance.com/

Is this as good (and perhaps easier), do you think? Or should I read the
Bart stuff?

*** A Bart PE boot CD is a very powerful tool but it can
*** take a few hours to make one. I am not familiar with
*** the Eddie Maintenance CD. I suggest you give it a try.

Also, where do I find a reliable list of what files to include as
"registry"
or "system state" files that should be replaced from the System Restore
"saved" files?

*** Your system registry files are kept in the folder
*** %SystemRoot%\System32\config. The two user registry
*** files are kept in the subfolders of c:\Documents and Settings.
*** They start with the letters "NT" and they are hidden. Make
*** sure to back up all registry files before replacing them.

And where do I find the System Restore saved files based on the date I'm
after?

*** My methods do not involve System Restore. Furthermore,
*** AFAIK, you cannot use these files directly.

(Oh, and by the way, is there any downside to trying System Restore in
Safe
Mode first?)

*** No, there isn't.

Thanks again!

*** You're welcome.

 

[Guest]

Thank you again.

I need to still clarify, please…

When I say “it bypasses the question†I meant that it makes the question no
longer an issue. I assume that using a bootable CD is one of the manual
methods you proposed and therefore I need not be concerned with whether
registry files are in use. Correct?

Some web searching I’ve done indicated more than two files comprising the
“registryâ€. For instance, from Wikipedia:

Windows NT, 2000, XP, Server 2003, and Vista
The following Registry files are stored in %SystemRoot%\System32\Config\:

Sam – HKEY_LOCAL_MACHINE\SAM
Security – HKEY_LOCAL_MACHINE\SECURITY
Software – HKEY_LOCAL_MACHINE\SOFTWARE
System – HKEY_LOCAL_MACHINE\SYSTEM
Default – HKEY_USERS\.DEFAULT

So, forgive me but I’m confused about the files I want.

As to my referring to System Restore saved files, I realize I’m not “usingâ€
the System Restore utility to do the restore. I was referring to “it†having
created saved copies of my registry files every day or so for the past two
weeks, from which I expected I’d be choosing my registry files to copy over
the current registry files and thus “restoreâ€. Is this not a correct
assumption? What files am I overwriting over the current registry files?

On a separate note, if I may please ask, a moderator at a different forum
suggests multiple malware scans (I already ran Norton Internet Security 2008
and it came up clean), and running “sfc / scannowâ€. I run Error-Checking
(Properties – Tools) often on the C: drive. Should I also run SFC?

BTW, the problems I’ve been having are strictly that the following program
groups intermittently (often) fail to populate: Start, Programs, QuickLaunch,
and Add/Remove (I’m sure others will if I go into them when it’s
misbehaving), and the sequence of the programs in QuickLaunch keeps going out
of whack.

I’m guessing it’s probably a registry corruption, in light of the behavior
and in light of the fact that this began to occur right after a
crash-and-reboot that resulted in a message saying “Windows has recovered
from a serious system failure.†MS senior TS told me that message only
happens if it encounters a hardware failure “or a rare fluke.†(I’ve since
replaced my memory out of caution.) Any guesses as to if it’s likely registry
corruption?

Thanks again!

 

[Pegasus \(MVP\)]

Thank you again.

I need to still clarify, please.

When I say "it bypasses the question" I meant that it makes the question
no
longer an issue. I assume that using a bootable CD is one of the manual
methods you proposed and therefore I need not be concerned with whether
registry files are in use. Correct?

*** Correct.

Some web searching I've done indicated more than two files comprising the
"registry". For instance, from Wikipedia:

Windows NT, 2000, XP, Server 2003, and Vista
The following Registry files are stored in %SystemRoot%\System32\Config\:

Sam - HKEY_LOCAL_MACHINE\SAM
Security - HKEY_LOCAL_MACHINE\SECURITY
Software - HKEY_LOCAL_MACHINE\SOFTWARE
System - HKEY_LOCAL_MACHINE\SYSTEM
Default - HKEY_USERS\.DEFAULT

So, forgive me but I'm confused about the files I want.

*** I gave you a folder where the system registry files reside.
*** You can restore some or all of them.

As to my referring to System Restore saved files, I realize I'm not
"using"
the System Restore utility to do the restore. I was referring to "it"
having
created saved copies of my registry files every day or so for the past two
weeks, from which I expected I'd be choosing my registry files to copy
over
the current registry files and thus "restore". Is this not a correct
assumption? What files am I overwriting over the current registry files?

*** As I said, I do not think that you can use the System Restore
*** folder to restore registry files by yourself. You have to use the
*** System Restore program to do this.

On a separate note, if I may please ask, a moderator at a different forum
suggests multiple malware scans (I already ran Norton Internet Security
2008
and it came up clean), and running "sfc / scannow". I run Error-Checking
(Properties - Tools) often on the C: drive. Should I also run SFC?

*** It's probably a good idea but I have to admit that I have next
*** to no experience with the System File Checker.

BTW, the problems I've been having are strictly that the following program
groups intermittently (often) fail to populate: Start, Programs,
QuickLaunch,
and Add/Remove (I'm sure others will if I go into them when it's
misbehaving), and the sequence of the programs in QuickLaunch keeps going
out
of whack.

I'm guessing it's probably a registry corruption, in light of the behavior
and in light of the fact that this began to occur right after a
crash-and-reboot that resulted in a message saying "Windows has recovered
from a serious system failure." MS senior TS told me that message only
happens if it encounters a hardware failure "or a rare fluke." (I've since
replaced my memory out of caution.) Any guesses as to if it's likely
registry
corruption?

*** Yes, it is highly likely that your problems are caused by
*** inappropriate registry entries.

 

[Guest]

So are you saying the place to get my "backup" of the registry files from is
still limited to my external drive where I did an actual full-system backup a
month ago?

Am I missing something, or is that pretty much where you think I'm at?

And if that's the case, is it not perhaps worth it to ask Retrospect tech
support of their recommended procedure for restoring the system files from
that backup?

Thank you again!!!!

 

[Pegasus \(MVP\)]

So are you saying the place to get my "backup" of the registry files from
is
still limited to my external drive where I did an actual full-system
backup a
month ago?

*** Yes.

Am I missing something, or is that pretty much where you think I'm at?

*** That's what I think.

And if that's the case, is it not perhaps worth it to ask Retrospect tech
support of their recommended procedure for restoring the system files from
that backup?

*** I do not know who Retrospect is.

Thank you again!!!!

*** You're welcome.

 

[Guest]

FYI, see new thread I'm starting: "Explorer issues poplulating program groups
etc"

Thanks again!

 

[Guest]

See solution to getting System Restore to work in my new thread entitled
"IMPORTANT: Norton Internet Security BLOCKS System Restore!!!"