Re: Restore or turn on a registry key on C drive from a differenthard drive
Re: Restore or turn on a registry key on C drive from a differenthard drive
chevyavalanche wrote:
> On Jan 30, 5:18 pm, John John <audetw...@nbnet.nb.ca> wrote:
>
>>chevyavalanche wrote:
>>
>>>On Jan 30, 4:23 pm, chevyavalanche <chevyavalanche2...@yahoo.com>
>>>wrote:
>>
>>>>On Jan 30, 3:43 pm, John John <audetw...@nbnet.nb.ca> wrote:
>>
>>>>>chevyavalanche wrote:
>>
>>>>>>On Jan 30, 2:49 pm, John John <audetw...@nbnet.nb.ca> wrote:
>>
>>>>>>>chevyavalanche wrote:
>>
>>>>>>>>On Jan 30, 12:32 pm, John John <audetw...@nbnet.nb.ca> wrote:
>>
>>>>>>>>>chevyavalanche wrote:
>>
>>>>>>>>>>On Jan 30, 11:11 am, John John <audetw...@nbnet.nb.ca> wrote:
>>
>>>>>>>>>>>John John wrote:
>>
>>>>>>>>>>>>>The backup for the registry entries disabled by msconfig are stored at:
>>
>>>>>>>>>>>>>HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg
>>
>>>>>>>>>>>>>From the information there you will have to rebuild the deleted entry.
>>
>>>>>>>>>>>>>John
>>
>>>>>>>>>>>chevyavalanche wrote:
>>
>>>>>>>>>>>>Thanks so much for the help. Have you ever had to do this? How do I
>>>>>>>>>>>>rebuild or turn on the key? This is the key that needs to be turned
>>>>>>>>>>>>back on:
>>>>>>>>>>>>HKLM\System\CurrentControlSet\Services\WControl\c:\xxxx.exe
>>
>>>>>>>>>>>That doesn't sound like a valid registry key, where did you obtain that
>>>>>>>>>>>information?
>>
>>>>>>>>>>>You say you disabled the item in msconfig, right? Can you export the
>>>>>>>>>>>HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg key and post
>>>>>>>>>>>the contents here?
>>
>>>>>>>>>>>There is no HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key on a dormant
>>>>>>>>>>>Windows installation, you won't see a CurrentControlSet key when you
>>>>>>>>>>>load the hive of the broken machine. The CurrentControlSet is created
>>
>>>>>>>>>>>from one of the numbered control set when the computer is booted, it is
>>
>>>>>>>>>>>a copy of the Control Set that was used to boot Windows. The registry
>>>>>>>>>>>contains numbered Control Sets such as:
>>
>>>>>>>>>>>HKEY_LOCAL_MACHINE
>>>>>>>>>>> \SYSTEM
>>>>>>>>>>> \ControlSet001
>>>>>>>>>>> \ControlSet002
>>>>>>>>>>> \ControlSet003
>>
>>>>>>>>>>>You may not have an 003 key it depends on if you have previously failed
>>>>>>>>>>>hives. When the Windows is booted Ntldr reads the contents of the
>>>>>>>>>>>HKEY_LOCAL_MACHINE\SYSTEM\Select key to decide which Control Set will be
>>>>>>>>>>>loaded depending on which startup option you selected, the startup
>>>>>>>>>>>options are:
>>
>>>>>>>>>>> -Current
>>>>>>>>>>> -Default
>>>>>>>>>>> -Failed
>>>>>>>>>>> -LastKnownGood
>>
>>>>>>>>>>>Default is the Control set that normally boots. By looking at the Data
>>>>>>>>>>>Value of the option in the Select key you will know which Control Set to
>>>>>>>>>>>edit, for example if Default has Data value 0x00000001 then
>>>>>>>>>>>ControlSet001 is the Control set that normally boots Windows, that is
>>>>>>>>>>>the Control Set that you must edit.
>>
>>>>>>>>>>>>Once I get this key back on, when you save and 'Unload Hive', does
>>>>>>>>>>>>this put it back into the C drive registry?
>>
>>>>>>>>>>>Yes, you *must* unload the hive, the changes are saved when the hive is
>>>>>>>>>>>unloaded.
>>
>>>>>>>>>>>>Also, when the entry is
>>>>>>>>>>>>created as a folder called "system offline", does this stay in my
>>>>>>>>>>>>other drive or is it removed when I 'Unload Hive'?
>>
>>>>>>>>>>>No, when you unload the hive it will delete the temporary hive.
>>
>>>>>>>>>>>Again, thanks for
>>
>>>>>>>>>>>>the help!
>>
>>>>>>>>>>>You're welcome. By the way, you are trying to repair a Windows 2000
>>>>>>>>>>>installation, right?
>>
>>>>>>>>>>>John
>>
>>>>>>>>>>John,
>>
>>>>>>>>>>Yes it is a Windows 2000 installation.
>>
>>>>>>>>>>The key appears to be valid as I use a program to view all running
>>>>>>>>>>services and it displays the registry key they belong to. If you
>>>>>>>>>>thought the xxxx was bogus, it is because I didn't show the real
>>>>>>>>>>program name. It really is ccmagent.exe. I believe what this shows
>>>>>>>>>>as I have used it a couple of times before and it was correct. I
>>>>>>>>>>won't know for sure until we get back into the registry of course. It
>>>>>>>>>>will be the Default setting then. I am still baffled as to why the
>>>>>>>>>>last known good config does not work.
>>
>>>>>>>>>>Can't post anything now as I'm at work. I'm going to a PC repair
>>>>>>>>>>place shortly with your directions to see if we can get this
>>>>>>>>>>resolved. I will keep you posted.
>>
>>>>>>>>>Ok, good luck with the repair. Do you have a recent Emergency Repair
>>>>>>>>>Disk (ERD)? If yes, did you backup the registry when you made the ERD?
>>>>>>>>>If yes you may be able to get out of the predicament with the ERD or
>>>>>>>>>by copying the backup hives from the WINNT\repair\RegBack folder to the
>>>>>>>>>WINNT\System32\config folder, this will work if the backup is fairly
>>>>>>>>>recent, if the backups are old it may not work as well.
>>
>>>>>>>>>John
>>
>>>>>>>>Don't have an ERD. Backed up System State last Friday. Can I do the
>>>>>>>>same with this back up as you suggest with ERD?
>>
>>>>>>>It depends on how you made the System State backup, you would have to be
>>>>>>>able to extract the files from the backup.
>>
>>>>>>>John
>>
>>>>>>I used the W2K Backup wizard and backed up the Sys state.
>>
>>>>>Along with the .bkf backup file (that you placed in a location of your
>>>>>choosing) NTBackup should have also created backup copies of the
>>>>>registry hives and placed them in the WINNT\repair\RegBack folder. Take
>>>>>a look in there and look at the timestamp on the hives. You can copy
>>>>>them to the System32\config folder to replace the broken hives.
>>
>>>>>John
>>
>>>>Is this an automatic thing that NTbackup does? My PC is at repair
>>>>shop now so I can't verify this.
>>
>>>Update: PC repair shop says that the 'load hive' command stays grayed
>>>out and does not work. Is there a trick to it? He followed the
>>>directions above that you provided the address to and I printed it out
>>>for him.
>>
>>With Windows 2000 it cannot be done with Regedit, he *must* use
>>Regedt32. He must also bring forth either the HKEY_LOCAL_MACHINE or the
>>HKEY_USERS pane and he must click on and highlight the root key
>>HKEY_LOCAL_MACHINE or HKEY_USERS, once the root key is highlighted he
>>will be able to load the hive of the broken installation. If he is
>>doing this with XP he can do it with Regedit but he must still highlight
>>one of the root keys mentioned above, he will only be able to load the
>>hive when he highlights one of the keys.
>>
>>Also, see my other post, when you did a backup of the System State data
>>a copy of your registry hives was placed in the WINNT\repair\RegBack
>>folder, he can use these copies to try to bring the machine back up.
>>
>>John
>
>
> Can he just 'drag and drop' the regback into the C drive location? Is
> it that simple or do you have to import or anything like that. Thanks
> for being patient with me as I have never dealt with a situation like
> this.
He can just rename the files in question with a .old extension, or to
reduce clutter in the config folder he can move them out to a temporary
location for the time being, if the repair is succesful they can then be
discarded.
Move the following hives out of the \WINNT\System32\config folder:
default
SAM
SECURITY
software
system
Then copy the same respective backup hives from the
\WINNT\repair\RegBack to the config folder and see if the machine can be
booted.
John