To restore the system hive with a recently created ERD, start an instance of the Recovery Console. At the command prompt, type the following commands, pressing [Enter] after you type each one: cd system32\config
ren system system.old
ren system.alt systemalt.old
cd \winnt\repair\regback
copy system c:\winnt\system32\config During the process, you'll rename the corrupted System and System.alt hive files and replace them with the most recent version of the system hive from your ERD. While you're doing all this, you'll need your copy of the ERD. The repair process looks to it for various files, the most important of which is Setup.log, a record of all installed files with their cyclical redundancy check (CRC) data. With this information, Regback can restore your old system hive. In a perfect world, you'll have created your ERD within the last 48 hours, but in the real world, you'll probably have to deal with a server running a registry configuration that was backed up sometime between the original Windows 2000 OS installation and the present. Reboot the server and with any luck, you won't have too much software to reinstall. Restoring the system hive without an ERD
If you don't have a recent copy of the system hive saved to an ERD, you have two options for fixing the damaged system hive on your server: Fast Repair and the Recovery Console. Using Fast Repair
You can run Fast Repair from the Emergency Repair Process screen described above, but before you do, make absolutely sure that you have no other choice. If you run Fast Repair on a Windows 2000 domain controller, Windows 2000 will activate the system hive as it was when you first installed the operating system. Fast Repair looks in %systemroot%\repair for the requisite files, but these files won't have been updated to include any additional programs you installed on your server. For a domain controller, this includes things such as Active Directory. When Fast Repair finishes, you must reboot and reinstall all necessary software and drivers. When you finally get the domain controller going again, be sure to back up the system state daily so you can restore the Active Directory from Directory Services Restore Mode. Using the Recovery Console
You may also be able to save the day using the Recovery Console. When the Recovery Console command prompt appears, type the following commands, pressing [Enter] after you type each one: cd system32\config
ren system system.old
ren system.alt system Remember that System.alt is a complete copy of CurrentControlSet and thus is the most up-to-date version of the system hive. By renaming it, you're activating it as the new master copy of the system hive. Try to reboot. If it works, you're finished. This procedure should work, but it may not if the corruption/fragmentation of the system hive file has also compromised System.alt. If your system fails to boot because the system hive is too big, this approach won't help at all, because System.alt is a direct copy of System; no amount of renaming will change its size. The best you can do now from the Recovery Console is type the following commands, pressing [Enter] after you type each one: cd system32\config
ren system system.old
ren system.alt systemalt.old
cd \winnt\repair
copy system c:\winnt\system32\config This will rename the old System and System.alt files and copy the original system hive file from %systemroot%\repair back into %systemroot%\system32\config. Then, you must reboot and reinstall all necessary software and drivers. Don't break out in hives
Just because you've encountered a problem with your server's system hive, there's no reason to panic. The system hive is critically important, but if you've taken time to create an Emergency Repair Disk, you can get things working in short order. Even if you don't have an ERD, you're not out of luck. With a little extra work, you can get your server up and running again and not have to worry about data loss. Editorial disclaimer: The authors and editors have taken care in preparation of the content contained herein but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.
For a weekly round-up of the enterprise IT news, sign up for the
Enterpise newsletter. Find out what's where in the new Tech Update with our
Guided Tour. Tell us what you think in the
Enterprise Mailroom.
Enterpise newsletter. Find out what's where in the new Tech Update with our
Guided Tour. Tell us what you think in the
Enterprise Mailroom.
