Replacing a SAM file

Posted on 2006-07-21
Last Modified: 2008-02-01
Hey guys, first off sorry I don't have many points to give, but I guess when you think about this question you either know it or you don't, so its pretty simple.

Anyway, a family computer of mine (not mine, my family's [thank god]) crashed.  It happened randomly overnight, we have no idea how it happened since no one was even home, the comptuer was on though, but it has tons of firewalls and stuff like that.

Now all I am getting when I turn it on is an error code, a "Windows Stop error code" I guess you could call it.

The thing says:

STOP: c000021a {Fatal System Error}

Then a little irrelevant information.  I have looked up the code and basically it means that I'm fucked (sorry for profanity).  My dad insisted I call Dell since we have a dell, I said it was useless, he didn't listen, so I called.  They said exactly what I suspected and had already read on the internet and that the harddrive and installation of windows was basically shot.  They advised reinstalling Windows, or getting a new harddrive.

I do not want to have to reinstall windows if there is a way around it because I lose everything, and thats what my dad and I exactly don't want to happen, thats why I called dell, maybe they had a way around it, they don't without like mailing them my harddrive.

Now, through my research I have also narrowed down that the file that is corrupt, since its a logon error, is the SAM file.  I got onto the harddrive and accessed it using Knoppix (which I have used a lot in the past in similar situations, and if you don't know what it is, take a minute and look it up, very useful) and go figure the last moment the SAM file was editted was July 15th, 2006 at 3:07am.  Interesting how thats the exact moment I would bet that the computer crashed >_<.

So, instead of reinstalling windows, I first want to try to take my extra SAM file which is in:


and paste it on top of the


SAM file and see if that will work, and then do everything else if it doesn't.

The question is, if I replace a SAM file, how much information will I lose, what will happen to the system.  See I know with an reinstallation of windows its possible to keep your Program Files and a few other things, but since you are making all new users, everything in your Documents and Settings folder is basically deleted, which in this case, sucks.  So I am trying to save that as best I can.

Do any of you know what would happen or have a better plan?

Thanks for the help in advance.

Question by:simpsons17371
LVL 32

Expert Comment

ID: 17158865
Easiest way, let windows recreate the sam file. Tell you the history;

When windows boots and it doesn't find a sam file, it recreates one with one user 'Administrator' and a blank password.

In your case what I would do is;

1. Use Knoppix and boot, go there and delete the sam from the location (which you know). Then reboot. Then you'll be able to login as administrator with no password. Once you are on the PC, you can then copy stuff from other's profile under document and setting then recreate the users. You can copy down the stuff you want and you're done.


Expert Comment

ID: 17159406
The SAM file contains all the user accounts on your machine. As rsivanandan noticed, if it is removed, Windows will create a new one with only an Administrator account.
You can try to copy the one in C:\WINDOWS\repair but it is not updated very often. This means that any user account you've created after the repair file will be lost and you will have to re-create it. If you do re-create it, it will actually be a considered a new account, so any special privileges the old account had will not be kept.
So my first recommendation is that you backup your current SAM before you do anything so just in case it is not the cause of the problem, you can undo what you've done.
If the SAM is indeed the problem, there is a way to make the new account use the old account's profile:
1) Re-Create the user account (don't log-in yet)
2) Go to "C:\Documents and Settings". You'll notice that a new folder has been created by the user (suppost the old one was "C:\Documents and Settings\username", the new one will probably be "C:\Documents and Settings\username.computername"). The old folder still exists though.
3) Delete the new folder.
4) Give the new user full control permissions for the old folder.
5) Open the registry editor.
6) Go to: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
7) Inside that there is a subkey for any user on your machine. Search for the one whose ProfileImagePath value is the name of the folder you've just deleted.
8) Modify that value to the old folder.
9) Close the registry editor.

Author Comment

ID: 17161486
Hey, thanks for the tip you guys but I seem to have a problem.

I went into the system with Knoppix but I can't delete the SAM file, it just won't let me.  I don't know the command console command either so I can't try it there, but I guess the SAM file is a read only file.

Do you guys have any idea how I can delete it?


Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

LVL 14

Accepted Solution

FriarTuk earned 75 total points
ID: 17206965
have you tried getting the files from the most current system restore backup

windows cannot start the file c:\windows\system32\config\system is missing or is damaged.

*** Below is revised by me (not using old files from the Repair folder) ***
*** if you can't see the "sys vol info" folder then under folder options, select "show hidden/system files" & unchk "hide protected o/s files" *** if you can't access that folder see this>  ***

boot from an XP cd, & press R to enter the Recovery Console
from c:\windows
md tmp

copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak

delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

cd c:\"system volume information"\_restore*\
dir /od  (find a folder "RPxxx" with a date prior to when this occurred)
cd rpXXX\snapshot

From the Snapshot folder, do the below command to copy the files:
 (space after copy & before c:\windows)

copy _registry_user_.default c:\Windows\System32\Config\default
copy _registry_machine_sam c:\Windows\System32\Config\sam
copy _registry_machine_security c:\Windows\System32\Config\security
copy _registry_machine_software c:\Windows\System32\Config\software
copy _registry_machine_system c:\Windows\System32\Config\system

reboot & run system restore to create new restore point

Assisted Solution

Chatable earned 75 total points
ID: 17207005
You can't delete the SAM file from Knoppix because the Linux NTFS driver is read only.
To do that you need to use either the Windows Recovery Console (to start it, insert your Windows CD and when setup starts press R for repair then C for console) or (recommended) the 3rd party utility ERD commander.
LVL 14

Expert Comment

ID: 17254872
LVL 14

Expert Comment

ID: 17340484
hey simpsons, plz provide feedback for further assistance.

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup" or a blinking cursor with black screen. A loop for Auto repair will start but fix nothing.  You will be panic as there are no back…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question