C:\windows\system32\config\system is corrupt

[VirtualLarry]

I have a friend with a laptop with the above error.

So, I figure, system registry hive corruption, let's just restore from the backup in \windows\repair, right? Not so simple.

First, I ran Memtest86+ 2.00 bootable to check for memory errors. There were none.

Then, I grabbed an XP Home SP2 Retail Upgrade disc, to boot into the recovery console. His system had XP Home SP2 Compaq OEM installed.

I rename \windows\system32\config\system to system.old. I navigate to \windows\repair. Here's where things get wierd. The files in that directory, were not like the ones in my own personal \windows\repair directory. Specifically, there was no file named "system". Only system.bak, and system.sav. I decided to use system.bak since it was the larger of the two, and copied it back over, as \windows\system32\config\system.

Then I rebooted.

I got some wierd error about windows being unable to change the password, and then windows automatically restarted. It was in a dialog window, not a bluescreen. I tried safe mode and the same thing.

So I decide that perhaps I need to try system.sav instead. Boot into recovery console again, BLAM, cannot accept password for the administrator account. The password should have just been blank.

I never touched the SAM files. I have no idea why copying SYSTEM would have caused a password change/error. I also have no idea why the files in \windows\repair were non-standard. Possibly the OEM mucked with them, possibly they were changed by some well-meaning program like NAV when it installed, who knows.

There was a strange power-down, suddenly after copying the system.bak file. I hit ENTER one more time at the command prompt, and the system shut down on me. I don't know, could that have corrupted the SAM file somehow? I thought that NTFS was robust against that sort of thing.

So now I'm kind of stuck, no access to recovery console, and the XP Home SP2 disc I have is a retail upgrade disc, and he needs an OEM disc, because his key sticker is for OEM. So we can't just do a repair install. I'm not even sure if a repair install will let us log in after installing, or whether it will keep the corrupted administrator password.

(Btw, does anyone have a link to that page where they show how to edit the PID value in the SETUP.INF file to change an OEM into a retail and vice-versa, and to change whether the disc is an upgrade or a full install? That could save the day if a repair install would work.)

As a last resort, I will pull the HD and put it in a USB case and copy the files off of it.

 

[Billb2]

Laptops don't work that way. They have a hidden partition that is accessed by some weird keypress at post to "restore" the laptop to the way it was after windows was first installed (I. e. none of the settings and programs the user installed will be there). I don't think you can use the files in Windows/Repair with Recovery Consul.

 

[thegorx]

can you use a more recent hive from the system restore folder System Volume Information snapshot. You might want to make sure the laptop is getting the proper power or not over-heating "vent aren't blocked, it might not make a difference if you restore the registry only to have the root cause still there. If you don't have a CD to access the System Volume Information folder then use the usb external to get the restore snapshot in the config folder.

 

[bsobel]

I rename \windows\system32\config\system to system.old. I navigate to \windows\repair. Here's where things get wierd. The files in that directory, were not like the ones in my own personal \windows\repair directory. Specifically, there was no file named "system". Only system.bak, and system.sav. I decided to use system.bak since it was the larger of the two, and copied it back over, as \windows\system32\config\system.

Those aren't usually viable restore files.

I never touched the SAM files. I have no idea why copying SYSTEM would have caused a password change/error. I also have no idea why the files in \windows\repair were non-standard. Possibly the OEM mucked with them, possibly they were changed by some well-meaning program like NAV when it installed, who knows.

NAV does not touch those files, in fact I dont know of any utilities that much with them (other than as part of a system fix operation).

As a last resort, I will pull the HD and put it in a USB case and copy the files off of it.

As another poster mentioned, your best bet is to grab the latest registry files from that last system snapshot. If you cant use the recovery partition use BartsPE to boot and grab/move the files.

Bill

 

[VirtualLarry]

Does the system volume information snapshot also contain a backup of the SAM? (I assume that's where the passwords are stored.)

 

[bsobel]

Originally posted by: VirtualLarry
Does the system volume information snapshot also contain a backup of the SAM? (I assume that's where the passwords are stored.)

I believe all the registry files are there. However your existing SAM may be fine, it might be more of an issue of your systemkey being different from the system hive you put back. Regardless, since they should be backed up together putting them both (or all even) back shouldnt be too much of a rollback (presuming system restore was on and there is something recent available)...