Link to home
Start Free TrialLog in
Avatar of Marcus N
Marcus NFlag for United Kingdom of Great Britain and Northern Ireland

asked on

\SYSROOT\System32\Config\ hive(file) blue screen repair advice

I had a major power outage and my APC UPS didn't prevent an unplanned SBS 2003 R2 shutdown. (An issue I'll be taking up in due course with APC.)

On reboot I get a blue screen with the following message.

STOP: c0000218 {Registry File Failure} The registry cannot load the hive (file):  \Sysroot\System32\Config\Software or it's log or alternative.  It is corrupt, absent or not writable.  Beginning dump of physical memory.

I (stupidly) don't have an Automated System Recovery disc. I was backing up the system state using the ntbackup utility from within the backup section of the Server Management Console. I have these backups on a separate hard drive to the OS and older backups on tape.

I have tried to boot (F8) using "last known good configuration" and get the same error.

I have tried to boot (F8) into "safe more with networking" and "safe mode without networking" and get the same error.

I have tried to boot from the OS CD-ROM and use the "recovery" option but I get to a command prompt and can't run ntbackup to restore the system configuration.

What should I try next? I really would like to avoid havig to reinstall the OS (and ISA and SQL and everything else, as you can imagine... :-( ).
SOLUTION
Avatar of torimar
torimar
Flag of Germany image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
The slower, but more convenient way to restore your system would be to build yourself a Windows boot CD using Bart PE Builder and/or UBCD4Win:

http://www.nu2.nu/pebuilder/             
http://www.ubcd4win.com/                 
Avatar of Marcus N

ASKER

Thank you Mr. torimar.

The support article deals with XP recovery on a FAT partition and I have a SBS2003 OS on NTFS. Do you think this article still applies?

With respect to the boot CDs you mentioned, do you have a preference for ease of use?
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Hello again Mr. torimar,

Thanks again for your help. If I use the manual method in the URL from your first post and then ensure that I regularly prepare Automated System Recovery discs do I need BartPE or UBCD?

Regards, Marcus
No, you will not.

The boot CDs were just meant as a second, more convenient way of going about this, since not everybody likes the Recovery Console, and on top of that, it is restricted in its usefulness.
Avatar of natrat22
natrat22

I just want to say to Torimar that you are a LEGEND.  I have exactly the same issue at a clients (Law firm) where their UPS didnt shutdown the server and the software hive was corrupt.  I used the recovery console to just replace the software hive then i could login to the server.  If I were giving the points you would get them all.

One thing though - you suggest to restore from the NT backup (which i have access to) after you can access the server.  However I can't find anything that isn't in the same state it was in before - all the user accounts are there, software, DHCP server, networking setup, shares etc.   What settings does restoring the software hive from th repair folder actually wipe in the registry?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ok thanks.  Is there a way to just restore the software hive from the NT backup?
Sorry for the silence for the last week - I have been trying to resolve this problem.

Firstly, when following the instructions in the URL of the first post ( http://support.microsoft.com/kb/307545/en-us ) you have to some things differetnly with the OS is SBS. In particular, after you copy the files from the repair folder and reboot, you HAVE TO reboot in "DOMAIN CONTROLLER SAFE MODE" not one of the other safe modes. Only when you do this can you reinstall the system state from the ntbackup.

If you try one of the other safe modes you then have to start from the top of the URL again.

Secondly, my problem was somewhat more challenging. When I restored the ntbackup of the system state I discovered that the unscheduled power failure had resulted in "one or more bad stripes" in my RAID5 array (upon which my system is resident).

So, I've had to reboot and Ctrl-A for the RAID controller and then "verify and fix" each disc which takes a lot of time. When the array is fixed I can then follow the information in the original post and restore from the repair folder and then boot in "DOMAIN CONTROLLER SAFE MODE" and restore from ntnackup.

Thirdly, the problem still isn't completely resolved as a number of .dll files which I expected to be fully backed up appear to have not been. This requires that I download replacements from the microsoft website. I'm gradually getting through this now, but the system still isn't fully repaired.

Finally, if you have a RAID5 array like I do but have the ability to change this to a RAID5EE array (you'll need another disc) then I would do so. In fact, I'm going to do this when the system is repaired. This will improve my system performance and should make a recovery from bad stripes easier.

I'll let youknow how it turns out.

Regards, Marcus
OK, all's not well.

I guess a combination of the RAID problem (bad strips) and the system restore has meant that the restored system is not repaired enough to boot properly.

If I do a standard boot I get the message "The active directory is rebuilding indices" and then, after a fixed amount of time, the server shuts down.

If I boot into "safe mode" then I get to log in as Administrator, but after the same elapsed time the server shuts down also.

If I boot into "domain controller safe mode" (or whatever it's called) then I don't get the "...rebuilding indices" message but the server shuts down after the same elspsed time again.

So, regardless of how I boot, the server ends up shutting down after a fixed amount of time without any warning.

I'll look into this now. I'll sort out points for the responses as soon as I can see how things end up.

Thanks for your patience.