HI,
You can try this step which will bring the old installation back
SYMPTOMS
==========
After installing a hotfix/service pack/windows update the server may:
1. crash
2. continuously reboot
3. or, blue Screen (with/without any errors)
CAUSE
======
1. hotfix not installed/completed successfully
2. customer did a windows update with Antivirus running in the background
3. 3rd party drivers/applications conflict
4. Windows Installation got corrupt and we dont have a recent backup
MORE INFORMATION
==================
This article needs to be followed only when you have already tried the
following
troubleshooting steps:
1. safe Mode
2. Safe Mode (with Networking)
3. Last Known Good Configeration
4. Booted to Recovery COnsole and tried to uninstall the hotfixes/updates
(that broke the system)
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
<>
*** Resolution *** Aug 26 2003 9:10AM v_2garj
==============================
GET THE EXACT ERROR MESSAGE
==============================
1. do a parallel installation
2. boot to parallel installation and load the original (corrupt) system
hive :
regedit->select HKLM->file->load hive->c:\winnt\system32\config\system->
name it as "Test Hive"
3. HKLM\system\controlset001\control\crashcontrol\autoreboot->change 0x1 to
0x0
4. unload the hive
5. reboot to original install...to get the exact error message
6. Boot back to the parallel install to perform big copy
========
BIG COPY
========
1. bring the parallel installation to the same SP level as the original
installation
<if the customer doesnt know on which service pack he is, we can check the
version
of the following files>
1. winsrv.dll
2. basesrv.dll
Else, we can check the Service Pack version from the following registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ->
CSDVersion
2. backup the directories: C:\winnt\system32
to a different location
3. do a big copy of all the files <not the sub-directories>
from the parallel to the original...and say "YES" to overwrite
D:\WINDOWS\SYSTEM32>copy . c:\winnt\system32 /a /y
D:\WINDOWS\SYSTEM32\drivers> copy . c:\winnt\system32\drivers /a /y
4. reboot to the original installation....and we should be able to boot
====================================
Points to consider after doing "Big Copy"
====================================
1) All hotfixes, updates, and service packs need to be installed that were
installed on the old system. The registry may think that these are already
installed but the files may have been replaced.
2) All Applications should be reinstalled. You do not know whether the
dlls in
system32 have been replaced or are even there any longer.
3) The two folders should have Windiff run against them to check for
differences.
Windiff is not mentioned in any cases and it ships on the CD. You can use
Windiff
to isolate which files are different between the two folders. This should
limit
the change to a few files.
4) The system should never remain with the new folder in-place. Rarely do
I see
the original folders renamed back, most of the time the new folder is left
in
place (or at least that is the indication from the case notes). The OS
boots but
does the every-thing work, I doubt it.
5) Root Cause for the issue is not found, the customer does not have a
fully
functional system.
6) Only the file that needs to be replaced should be replaced, we should
not be
replacing all the files. If you cannot isolate the issue down to a couple
of
files, the customer may very well be better off restoring\rebuilding the
entire
system. At least you know where you stand in the OS if you rebuild.
==================
Potential problems
==================
1) Not all files are updated even though the system may show that hotfixes
are
installed.
2) Application files may be missing causing any number of application
problems
3) Comparing the two folders should show the file differences and PSS
should be
smarter about which files to replace and track those files
4) Too often it appears the new folder stays in-place, where-as I suspect
that
there may be only a file or two that really needs to be replaced.
5) Application updates may appear to be installed while they are not
6) Registry settings for updated files may not be correct for older files.
7) Windows File Protection may be working from different sets of files, one
in the
system32 may not match what is in dllcache
8) File versions may be mismatched between updates that took place to
program files
and to the replaced file under Windows System32
9) Security updates may be rolled back, but to the registry they look to be
installed.
Abhijeet Nigam, MCSE,A+,CCNA
This posting is provided "AS IS" with no warranties, and confers no rights
