Microsoft Windows Registry Guide, Second Edition

Repairing a Corrupt Registry

When you try to start or restart your Windows XP–based computer, you might receive one of the following error messages if your registry is corrupt:

• Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

• Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SOFTWARE

• Stop: c0000218 {Registry File Failure} The registry cannot load the hive (file): \SystemRoot\System32\Config\SOFTWARE or its log or alternate

The steps that this section describes use the Windows Recovery Console and System Restore. This section also lists all the required steps in specific order to ensure that the process is fully completed. When you finish this procedure, the system returns to a state very close to its original state before the problem occurred. If you have ever run NTBackup and completed a system state backup, you do not have to follow the procedures in steps 2 and 3; you can go directly to step 4.

WARNING

Do not use the procedure that is described in this section if your computer has an OEM-installed operating system. The system hive on OEM installations creates passwords and user accounts that did not exist previously. If you use the procedure that is described in this section, you might not be able to log back into the Windows Recovery Console to restore the original registry hives.

Step 1

In step 1, you start the Windows Recovery Console, create a temporary folder, back up the existing registry files to a new location, delete the registry files at their existing location, and then copy the registry files from the repair folder to the System32\ Config folder. When you have finished this procedure, a registry is created that you can use to start Windows XP. This registry was created and saved during the initial setup of Windows XP. Therefore any changes that occurred after the Setup program was finished are lost.

To complete step 1, follow these instructions:

1. Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer. If prompted to do so, press a key to boot the computer from the CD-ROM drive.

2. When the Welcome To Setup screen appears, press R to start the Recovery Console.

3. If you have a dual-boot or multiple-boot computer, select the installation that you want to access from the Windows Recovery Console.

4. When you are prompted to do so, type the administrator password. If the administrator password is blank, press ENTER.

5. At the Windows Recovery Console command prompt, run the following commands. (These commands assume that Windows XP is installed to the C:\Windows folder. Make sure to change C:\Windows to the appropriate folder if Windows XP is in a different location.)

   • md tmp

   • copy c:\windows\system32\config\system c:\windows\tmp\system.bak

   • copy c:\windows\system32\config\software c:\windows\tmp\software.bak

   • copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak

   • copy c:\windows\system32\config\security c:\windows\tmp\security.bak

   • copy c:\windows\system32\config\default c:\windows\tmp\default.bak

   • delete c:\windows\system32\config\system

   • delete c:\windows\system32\config\software

   • delete c:\windows\system32\config\sam

   • delete c:\windows\system32\config\security

   • delete c:\windows\system32\config\default

   • copy c:\windows\repair\system c:\windows\system32\config\system

   • copy c:\windows\repair\software c:\windows\system32\config\software

   • copy c:\windows\repair\sam c:\windows\system32\config\sam

   • copy c:\windows\repair\security c:\windows\system32\config\security

   • copy c:\windows\repair\default c:\windows\system32\config\default

6. Type exit to exit the Windows Recovery Console. Your computer will restart.

NOTE

Make sure to replace all five of the registry hives. It can cause potential issues if you only replace a single hive or two because software and hardware might have settings in multiple locations in the registry.

Step 2

To complete the instructions described in this section, you must be logged on as an administrator or as an administrative user (a user who has an account in the Administrators group). With Windows XP Home Edition, you must start the computer in safe mode, as described earlier in this chapter.

In step 2, you use System Restore to copy the registry files from their backed-up location. This folder is not available in the Windows Recovery Console and is generally not visible during typical usage. Before you start this procedure, you must change several settings to make the folder visible:

1. Start Windows Explorer.

2. On the Tools menu, click Folder Options.

3. Click the View tab.

4. Under Hidden Files And Folders, click to select Show Hidden Files And Folders, and then click to clear the Hide Protected Operating System Files (Recommended) check box.

5. When the dialog box that confirms that you want to display these files appears, click Yes.

6. If it is important to click the correct drive, double-click the drive where you installed Windows XP to display a list of the folders.

7. Open the System Volume Information folder. This folder is unavailable and appears dimmed because it is set as a super-hidden folder.

   NOTE

   For more information about the System Volume Information folder, see Chapter 3, “Backing Up the Registry.” You might receive the following error message: “C:\System Volume Information is not accessible. Access is denied.” If you receive this message, follow the instructions in article 309531, “How to Gain Access to the System Volume Information Folder,” at http://support.microsoft.com or Chapter 3, “Backing Up the Registry,” to access it.

8. Open a folder with a time stamp that does not match the current time. You might have to click Details on the View menu to see when these folders were created. Under this folder, there might be one or more folders starting with “RPx.” These are restore points.

9. Open one of these folders to locate a Snapshot subfolder. The following path is an example of a folder path to the Snapshot folder: C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot.

10. From the Snapshot folder, copy the following files to the C:\Windows\Tmp folder:

    • _REGISTRY_USER_.DEFAULT

    • _REGISTRY_MACHINE_SECURITY

    • _REGISTRY_MACHINE_SOFTWARE

    • _REGISTRY_MACHINE_SYSTEM

    • _REGISTRY_MACHINE_SAM

11. Rename the files in the C:\Windows\Tmp folder as follows:

    • Rename _REGISTRY_USER_.DEFAULT to DEFAULT.

    • Rename _REGISTRY_MACHINE_SECURITY to SECURITY.

    • Rename _REGISTRY_MACHINE_SOFTWARE to SOFTWARE.

    • Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM.

    • Rename _REGISTRY_MACHINE_SAM to SAM.

    These files are the backed-up registry files from System Restore. Because you used the registry file that the Setup program created, this registry does not know that these restore points are available. Under System Volume Information, a new folder is created with a new GUID, and a restore point is created that includes a copy of the registry files that were copied during part one. Therefore, it is important not to use the most current folder, especially if the time stamp on the folder is the same as the current time.

The current system configuration is not aware of the previous restore points. You must have a previous copy of the registry from a previous restore point to make the previous restore points available again.

The registry files that were copied to the Tmp folder in the C:\Windows folder are moved to ensure that the files are available within the Windows Recovery Console. You must use these files to replace the registry files currently in the C:\Windows\ System32\Config folder. By default, the Windows Recovery Console has limited folder access and cannot copy files from the System Volume folder.

Step 3

In step 3, you delete the existing registry files and then copy the System Restore registry files to the C:\Windows\System32\Config folder:

1. Start the Windows Recovery Console.

2. At the command prompt, type the following lines, pressing ENTER after you type each line. (These steps assume that Windows XP is installed to the C:\Windows folder. Make sure to change C:\Windows to the appropriate folder if Windows XP is in a different location.)

   • del c:\windows\system32\config\sam

   • delc:\windows\system32\config\security

   • delc:\windows\system32\config\software

   • delc:\windows\system32\config\default

   • delc:\windows\system32\config\system

   • copy c:\windows\tmp\software c:\windows\system32\config\software

   • copy c:\windows\tmp\system c:\windows\system32\config\system

   • copy c:\windows\tmp\sam c:\windows\system32\config\sam

   • copy c:\windows\tmp\security c:\windows\system32\config\security

   • copy c:\windows\tmp\default c:\windows\system32\config\default

3. Type exit to quit Windows Recovery Console. Your computer restarts.

Step 4

Use the following steps to restore your computer to a previous RestorePoint:

1. Click Start, and then click All Programs.

2. Click Accessories, and then click System Tools.

3. Click System Restore, and then click Restore To A Previous RestorePoint.