C
chevyavalanche
Re: Restore or turn on a registry key on C drive from a differenthard drive
On Jan 30, 6:00 pm, John John <audetw...@nbnet.nb.ca> wrote:
> chevyavalanche wrote:
> > On Jan 30, 5:18 pm, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>chevyavalanche wrote:
>
> >>>On Jan 30, 4:23 pm, chevyavalanche <chevyavalanche2...@yahoo.com>
> >>>wrote:
>
> >>>>On Jan 30, 3:43 pm, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>>>>chevyavalanche wrote:
>
> >>>>>>On Jan 30, 2:49 pm, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>>>>>>chevyavalanche wrote:
>
> >>>>>>>>On Jan 30, 12:32 pm, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>>>>>>>>chevyavalanche wrote:
>
> >>>>>>>>>>On Jan 30, 11:11 am, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>>>>>>>>>>John John wrote:
>
> >>>>>>>>>>>>>The backup for the registry entries disabled by msconfig are stored at:
>
> >>>>>>>>>>>>>HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg
>
> >>>>>>>>>>>>>From the information there you will have to rebuild the deleted entry.
>
> >>>>>>>>>>>>>John
>
> >>>>>>>>>>>chevyavalanche wrote:
>
> >>>>>>>>>>>>Thanks so much for the help. Have you ever had to do this? How do I
> >>>>>>>>>>>>rebuild or turn on the key? This is the key that needs to be turned
> >>>>>>>>>>>>back on:
> >>>>>>>>>>>>HKLM\System\CurrentControlSet\Services\WControl\c:\xxxx.exe
>
> >>>>>>>>>>>That doesn't sound like a valid registry key, where did you obtain that
> >>>>>>>>>>>information?
>
> >>>>>>>>>>>You say you disabled the item in msconfig, right? Can you export the
> >>>>>>>>>>>HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg key and post
> >>>>>>>>>>>the contents here?
>
> >>>>>>>>>>>There is no HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key on a dormant
> >>>>>>>>>>>Windows installation, you won't see a CurrentControlSet key when you
> >>>>>>>>>>>load the hive of the broken machine. The CurrentControlSet is created
>
> >>>>>>>>>>>from one of the numbered control set when the computer is booted, it is
>
> >>>>>>>>>>>a copy of the Control Set that was used to boot Windows. The registry
> >>>>>>>>>>>contains numbered Control Sets such as:
>
> >>>>>>>>>>>HKEY_LOCAL_MACHINE
> >>>>>>>>>>> \SYSTEM
> >>>>>>>>>>> \ControlSet001
> >>>>>>>>>>> \ControlSet002
> >>>>>>>>>>> \ControlSet003
>
> >>>>>>>>>>>You may not have an 003 key it depends on if you have previously failed
> >>>>>>>>>>>hives. When the Windows is booted Ntldr reads the contents of the
> >>>>>>>>>>>HKEY_LOCAL_MACHINE\SYSTEM\Select key to decide which Control Set will be
> >>>>>>>>>>>loaded depending on which startup option you selected, the startup
> >>>>>>>>>>>options are:
>
> >>>>>>>>>>> -Current
> >>>>>>>>>>> -Default
> >>>>>>>>>>> -Failed
> >>>>>>>>>>> -LastKnownGood
>
> >>>>>>>>>>>Default is the Control set that normally boots. By looking at the Data
> >>>>>>>>>>>Value of the option in the Select key you will know which Control Set to
> >>>>>>>>>>>edit, for example if Default has Data value 0x00000001 then
> >>>>>>>>>>>ControlSet001 is the Control set that normally boots Windows, that is
> >>>>>>>>>>>the Control Set that you must edit.
>
> >>>>>>>>>>>>Once I get this key back on, when you save and 'Unload Hive', does
> >>>>>>>>>>>>this put it back into the C drive registry?
>
> >>>>>>>>>>>Yes, you *must* unload the hive, the changes are saved when the hive is
> >>>>>>>>>>>unloaded.
>
> >>>>>>>>>>>>Also, when the entry is
> >>>>>>>>>>>>created as a folder called "system offline", does this stay in my
> >>>>>>>>>>>>other drive or is it removed when I 'Unload Hive'?
>
> >>>>>>>>>>>No, when you unload the hive it will delete the temporary hive.
>
> >>>>>>>>>>>Again, thanks for
>
> >>>>>>>>>>>>the help!
>
> >>>>>>>>>>>You're welcome. By the way, you are trying to repair a Windows 2000
> >>>>>>>>>>>installation, right?
>
> >>>>>>>>>>>John
>
> >>>>>>>>>>John,
>
> >>>>>>>>>>Yes it is a Windows 2000 installation.
>
> >>>>>>>>>>The key appears to be valid as I use a program to view all running
> >>>>>>>>>>services and it displays the registry key they belong to. If you
> >>>>>>>>>>thought the xxxx was bogus, it is because I didn't show the real
> >>>>>>>>>>program name. It really is ccmagent.exe. I believe what this shows
> >>>>>>>>>>as I have used it a couple of times before and it was correct. I
> >>>>>>>>>>won't know for sure until we get back into the registry of course. It
> >>>>>>>>>>will be the Default setting then. I am still baffled as to why the
> >>>>>>>>>>last known good config does not work.
>
> >>>>>>>>>>Can't post anything now as I'm at work. I'm going to a PC repair
> >>>>>>>>>>place shortly with your directions to see if we can get this
> >>>>>>>>>>resolved. I will keep you posted.
>
> >>>>>>>>>Ok, good luck with the repair. Do you have a recent Emergency Repair
> >>>>>>>>>Disk (ERD)? If yes, did you backup the registry when you made the ERD?
> >>>>>>>>>If yes you may be able to get out of the predicament with the ERD or
> >>>>>>>>>by copying the backup hives from the WINNT\repair\RegBack folder to the
> >>>>>>>>>WINNT\System32\config folder, this will work if the backup is fairly
> >>>>>>>>>recent, if the backups are old it may not work as well.
>
> >>>>>>>>>John
>
> >>>>>>>>Don't have an ERD. Backed up System State last Friday. Can I do the
> >>>>>>>>same with this back up as you suggest with ERD?
>
> >>>>>>>It depends on how you made the System State backup, you would have to be
> >>>>>>>able to extract the files from the backup.
>
> >>>>>>>John
>
> >>>>>>I used the W2K Backup wizard and backed up the Sys state.
>
> >>>>>Along with the .bkf backup file (that you placed in a location of your
> >>>>>choosing) NTBackup should have also created backup copies of the
> >>>>>registry hives and placed them in the WINNT\repair\RegBack folder. Take
> >>>>>a look in there and look at the timestamp on the hives. You can copy
> >>>>>them to the System32\config folder to replace the broken hives.
>
> >>>>>John
>
> >>>>Is this an automatic thing that NTbackup does? My PC is at repair
> >>>>shop now so I can't verify this.
>
> >>>Update: PC repair shop says that the 'load hive' command stays grayed
> >>>out and does not work. Is there a trick to it? He followed the
> >>>directions above that you provided the address to and I printed it out
> >>>for him.
>
> >>With Windows 2000 it cannot be done with Regedit, he *must* use
> >>Regedt32. He must also bring forth either the HKEY_LOCAL_MACHINE or the
> >>HKEY_USERS pane and he must click on and highlight the root key
> >>HKEY_LOCAL_MACHINE or HKEY_USERS, once the root key is highlighted he
> >>will be able to load the hive of the broken installation. If he is
> >>doing this with XP he can do it with Regedit but he must still highlight
> >>one of the root keys mentioned above, he will only be able to load the
> >>hive when he highlights one of the keys.
>
> >>Also, see my other post, when you did a backup of the System State data
> >>a copy of your registry hives was placed in the WINNT\repair\RegBack
> >>folder, he can use these copies to try to bring the machine back up.
>
> >>John
>
> > Can he just 'drag and drop' the regback into the C drive location? Is
> > it that simple or do you have to import or anything like that. Thanks
> > for being patient with me as I have never dealt with a situation like
> > this.
>
> He can just rename the files in question with a .old extension, or to
> reduce clutter in the config folder he can move them out to a temporary
> location for the time being, if the repair is succesful they can then be
> discarded.
>
> Move the following hives out of the \WINNT\System32\config folder:
>
> default
> SAM
> SECURITY
> software
> system
>
> Then copy the same respective backup hives from the
> \WINNT\repair\RegBack to the config folder and see if the machine can be
> booted.
>
> John
Will keep you posted John,
Sounds like this is the way to go. All I have to do then is reinstall
a couple of programs if it works.
On Jan 30, 6:00 pm, John John <audetw...@nbnet.nb.ca> wrote:
> chevyavalanche wrote:
> > On Jan 30, 5:18 pm, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>chevyavalanche wrote:
>
> >>>On Jan 30, 4:23 pm, chevyavalanche <chevyavalanche2...@yahoo.com>
> >>>wrote:
>
> >>>>On Jan 30, 3:43 pm, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>>>>chevyavalanche wrote:
>
> >>>>>>On Jan 30, 2:49 pm, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>>>>>>chevyavalanche wrote:
>
> >>>>>>>>On Jan 30, 12:32 pm, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>>>>>>>>chevyavalanche wrote:
>
> >>>>>>>>>>On Jan 30, 11:11 am, John John <audetw...@nbnet.nb.ca> wrote:
>
> >>>>>>>>>>>John John wrote:
>
> >>>>>>>>>>>>>The backup for the registry entries disabled by msconfig are stored at:
>
> >>>>>>>>>>>>>HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg
>
> >>>>>>>>>>>>>From the information there you will have to rebuild the deleted entry.
>
> >>>>>>>>>>>>>John
>
> >>>>>>>>>>>chevyavalanche wrote:
>
> >>>>>>>>>>>>Thanks so much for the help. Have you ever had to do this? How do I
> >>>>>>>>>>>>rebuild or turn on the key? This is the key that needs to be turned
> >>>>>>>>>>>>back on:
> >>>>>>>>>>>>HKLM\System\CurrentControlSet\Services\WControl\c:\xxxx.exe
>
> >>>>>>>>>>>That doesn't sound like a valid registry key, where did you obtain that
> >>>>>>>>>>>information?
>
> >>>>>>>>>>>You say you disabled the item in msconfig, right? Can you export the
> >>>>>>>>>>>HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg key and post
> >>>>>>>>>>>the contents here?
>
> >>>>>>>>>>>There is no HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key on a dormant
> >>>>>>>>>>>Windows installation, you won't see a CurrentControlSet key when you
> >>>>>>>>>>>load the hive of the broken machine. The CurrentControlSet is created
>
> >>>>>>>>>>>from one of the numbered control set when the computer is booted, it is
>
> >>>>>>>>>>>a copy of the Control Set that was used to boot Windows. The registry
> >>>>>>>>>>>contains numbered Control Sets such as:
>
> >>>>>>>>>>>HKEY_LOCAL_MACHINE
> >>>>>>>>>>> \SYSTEM
> >>>>>>>>>>> \ControlSet001
> >>>>>>>>>>> \ControlSet002
> >>>>>>>>>>> \ControlSet003
>
> >>>>>>>>>>>You may not have an 003 key it depends on if you have previously failed
> >>>>>>>>>>>hives. When the Windows is booted Ntldr reads the contents of the
> >>>>>>>>>>>HKEY_LOCAL_MACHINE\SYSTEM\Select key to decide which Control Set will be
> >>>>>>>>>>>loaded depending on which startup option you selected, the startup
> >>>>>>>>>>>options are:
>
> >>>>>>>>>>> -Current
> >>>>>>>>>>> -Default
> >>>>>>>>>>> -Failed
> >>>>>>>>>>> -LastKnownGood
>
> >>>>>>>>>>>Default is the Control set that normally boots. By looking at the Data
> >>>>>>>>>>>Value of the option in the Select key you will know which Control Set to
> >>>>>>>>>>>edit, for example if Default has Data value 0x00000001 then
> >>>>>>>>>>>ControlSet001 is the Control set that normally boots Windows, that is
> >>>>>>>>>>>the Control Set that you must edit.
>
> >>>>>>>>>>>>Once I get this key back on, when you save and 'Unload Hive', does
> >>>>>>>>>>>>this put it back into the C drive registry?
>
> >>>>>>>>>>>Yes, you *must* unload the hive, the changes are saved when the hive is
> >>>>>>>>>>>unloaded.
>
> >>>>>>>>>>>>Also, when the entry is
> >>>>>>>>>>>>created as a folder called "system offline", does this stay in my
> >>>>>>>>>>>>other drive or is it removed when I 'Unload Hive'?
>
> >>>>>>>>>>>No, when you unload the hive it will delete the temporary hive.
>
> >>>>>>>>>>>Again, thanks for
>
> >>>>>>>>>>>>the help!
>
> >>>>>>>>>>>You're welcome. By the way, you are trying to repair a Windows 2000
> >>>>>>>>>>>installation, right?
>
> >>>>>>>>>>>John
>
> >>>>>>>>>>John,
>
> >>>>>>>>>>Yes it is a Windows 2000 installation.
>
> >>>>>>>>>>The key appears to be valid as I use a program to view all running
> >>>>>>>>>>services and it displays the registry key they belong to. If you
> >>>>>>>>>>thought the xxxx was bogus, it is because I didn't show the real
> >>>>>>>>>>program name. It really is ccmagent.exe. I believe what this shows
> >>>>>>>>>>as I have used it a couple of times before and it was correct. I
> >>>>>>>>>>won't know for sure until we get back into the registry of course. It
> >>>>>>>>>>will be the Default setting then. I am still baffled as to why the
> >>>>>>>>>>last known good config does not work.
>
> >>>>>>>>>>Can't post anything now as I'm at work. I'm going to a PC repair
> >>>>>>>>>>place shortly with your directions to see if we can get this
> >>>>>>>>>>resolved. I will keep you posted.
>
> >>>>>>>>>Ok, good luck with the repair. Do you have a recent Emergency Repair
> >>>>>>>>>Disk (ERD)? If yes, did you backup the registry when you made the ERD?
> >>>>>>>>>If yes you may be able to get out of the predicament with the ERD or
> >>>>>>>>>by copying the backup hives from the WINNT\repair\RegBack folder to the
> >>>>>>>>>WINNT\System32\config folder, this will work if the backup is fairly
> >>>>>>>>>recent, if the backups are old it may not work as well.
>
> >>>>>>>>>John
>
> >>>>>>>>Don't have an ERD. Backed up System State last Friday. Can I do the
> >>>>>>>>same with this back up as you suggest with ERD?
>
> >>>>>>>It depends on how you made the System State backup, you would have to be
> >>>>>>>able to extract the files from the backup.
>
> >>>>>>>John
>
> >>>>>>I used the W2K Backup wizard and backed up the Sys state.
>
> >>>>>Along with the .bkf backup file (that you placed in a location of your
> >>>>>choosing) NTBackup should have also created backup copies of the
> >>>>>registry hives and placed them in the WINNT\repair\RegBack folder. Take
> >>>>>a look in there and look at the timestamp on the hives. You can copy
> >>>>>them to the System32\config folder to replace the broken hives.
>
> >>>>>John
>
> >>>>Is this an automatic thing that NTbackup does? My PC is at repair
> >>>>shop now so I can't verify this.
>
> >>>Update: PC repair shop says that the 'load hive' command stays grayed
> >>>out and does not work. Is there a trick to it? He followed the
> >>>directions above that you provided the address to and I printed it out
> >>>for him.
>
> >>With Windows 2000 it cannot be done with Regedit, he *must* use
> >>Regedt32. He must also bring forth either the HKEY_LOCAL_MACHINE or the
> >>HKEY_USERS pane and he must click on and highlight the root key
> >>HKEY_LOCAL_MACHINE or HKEY_USERS, once the root key is highlighted he
> >>will be able to load the hive of the broken installation. If he is
> >>doing this with XP he can do it with Regedit but he must still highlight
> >>one of the root keys mentioned above, he will only be able to load the
> >>hive when he highlights one of the keys.
>
> >>Also, see my other post, when you did a backup of the System State data
> >>a copy of your registry hives was placed in the WINNT\repair\RegBack
> >>folder, he can use these copies to try to bring the machine back up.
>
> >>John
>
> > Can he just 'drag and drop' the regback into the C drive location? Is
> > it that simple or do you have to import or anything like that. Thanks
> > for being patient with me as I have never dealt with a situation like
> > this.
>
> He can just rename the files in question with a .old extension, or to
> reduce clutter in the config folder he can move them out to a temporary
> location for the time being, if the repair is succesful they can then be
> discarded.
>
> Move the following hives out of the \WINNT\System32\config folder:
>
> default
> SAM
> SECURITY
> software
> system
>
> Then copy the same respective backup hives from the
> \WINNT\repair\RegBack to the config folder and see if the machine can be
> booted.
>
> John
Will keep you posted John,
Sounds like this is the way to go. All I have to do then is reinstall
a couple of programs if it works.