The information in this article applies to:
Microsoft Windows XP Home EditionMicrosoft Windows XP ProfessionalSUMMARYThis article describes how to recover a Windows XP system that does not start because of corruption in the registry. This procedure does not guarantee full recovery of the system to a previous state; however, you should be able to recover data when you use this procedure.
You can repair a corrupted registry in Windows XP. Corrupted registry files can cause a variety of different error messages. Please refer to the Knowledge Base for articles regarding error messages related to registry issues.
This article assumes that normal recovery methods have failed and access to the system is not available except by using Recovery Console. If an Automatic System Recovery (ASR) backup exists, it is the preferred method for recovery; it is recommended that you use the ASR backup before you try the procedure described in this article.
NOTE: Make sure to replace all 5 of the registry hives. If you only replace a single hive or two, this can cause potential issues, since software and hardware may have settings in multiple locations in the registry.
MORE INFORMATIONWhen you try to start or restart your Windows XP-based computer, you may receive one of the following error messages:
Windows XP could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM Windows XP could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Stop: c0000218 {Registry File Failure} The registry cannot load the hive (file):
\SystemRoot\System32\Config\SOFTWARE or its log or alternate
The procedure described in this article uses Recovery Console, System Restore, and lists all the required steps in specific order to ensure that the process completes fully. After you complete this procedure, the system should return to a state very close to the system before the problem occurred. If you have ever run NTBackup and completed a system state backup, you do not have to follow the procedures in parts two and three; you can skip to part four.
Part OneIn part one, you boot to the Recovery Console, create a temporary folder, back up the existing registry files to a new location, delete the registry files at their existing location, and then copy the registry files from the repair folder to the System32\Config folder. When you are finished with this procedure, a registry is created that you can use to boot back into Windows XP. This registry was created and saved during the initial setup of Windows XP, so any changes and settings that took place after Setup completes are lost.
To complete
part one, follow these steps:
Boot to the Recovery Console.
At the
Recovery Console command prompt, type the following lines, pressing ENTER after you type each line:
md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak
delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default
copy c:\windows\repair\system c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default
Type exit to quit Recovery Console. Your computer will restart.
NOTE: This procedure assumes that Windows XP is installed to the C:\Windows folder. Make sure to change C:\Windows to the appropriate windows_folder if it is a different location.
If you have access to another computer, to save time, you can copy the text in step two, and then create a text file called "Regcopy1.txt" . To run this file, run the following command when you boot into Recovery Console:
batch regcopy1.txt
Part TwoTo complete the procedure described in this section, you must be logged on as an administrator, or an administrative user (a user who has an account in the Administrators group). If you are using Windows XP Home Edition, you can log on as an administrative user. If you log on as an administrator, you must first start Windows XP Home Edition in Safe mode. To start the Windows XP Home Edition computer in Safe mode, follow these steps.
NOTE: Print these instructions before you continue. You cannot view these instructions after you restart the computer in
Safe Mode. Click
Start, click
Shut Down (or click Turn Off Computer), click
Restart, and then click
OK (or click Restart).
Press the F8 key.
On a computer that is configured to start to multiple operating systems, you can press F8 when you see the Startup menu.
Use the arrow keys to select the appropriate Safe mode option, and then press ENTER.
If you have a
dual-boot or
multiple-boot system, use the arrow keys to select the installation that you want to access, and then press ENTER.
In
part two, you copy the registry files from their backed up location by using System Restore. This folder is not available in Recovery Console and is normally not visible during normal usage.
Before you start this procedure, you must change several settings to make the folder visible:
Start Windows Explorer.
On the Tools menu, click Folder options.
Click the View tab.
Under Hidden files and folders, click to select Show hidden files and folders, and then click to clear the Hide protected operating system files (Recommended) check box.Click Yes when the dialog box is displayed that confirms that you want to display these files.Double-click the drive where you installed Windows XP to get a list of the folders. If is important to click the correct drive.Open the System Volume Information folder. This folder appears dimmed folder because it is set as a super-hidden folder.
NOTE: This folder contains one or more _restore {GUID} folders such as "
_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}".
NOTE: You may receive the following error message:
C:\System Volume Information is not accessible. Access is denied. To gain access to the System Volume Information folder, use the steps in the appropriate section.
Windows XP Professional or Windows XP Home Edition Using the
FAT32 File System
Click
Start, and then click
My Computer.
On the
Tools menu, click
Folder Options.
On the
View tab, click
Show hidden files and folders.
Clear the
Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
Click
OK.
Double-click the System Volume Information folder in the root folder to open it.
Windows XP Professional Using the NTFS File System on a Domain
Click Start, and then click My Computer.
On the Tools menu, click Folder Options.
On the View tab, click Show hidden files and folders.
Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
Click OK.
Right-click the System Volume Information folder in the root folder, and then click Sharing and Security.
Click the Security tab.
Click Add, and then type the name of the user to whom you want to give access to the folder. Choose the account location if appropriate (either local or from the domain). Typically, this is the account with which you are logged on. Click OK, and then click OK.
Double-click the System Volume Information folder in the root folder to open it.
Windows XP Professional using the NTFS File System on a Workgroup or Standalone Computer
Click Start, and then click My Computer.
On the Tools menu, click Folder Options.
On the View tab, click Show hidden files and folders.
Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
Clear the Use simple file sharing (Recommended) check box.
Click OK.
Right-click the System Volume Information folder in the root folder, and then click Properties.
Click the Security tab.
Click Add, and then type the name of the user to whom you want to give access to the folder. Typically, this is the account with which you are logged on. Click OK, and then click OK.
Double-click the System Volume Information folder in the root folder to open it.
Open a folder that was not created at the current time. You may have to click Details on the View menu to see when these folders were created. There may be one or more folders starting with "RPx under this folder. These are restore points.
Open one of these folders to locate a Snapshot subfolder folder; the following path is an example of a folder path to the Snapshot folder:
C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot From the Snapshot folder, copy the following files to the
C:\Windows\Tmp folder:
_REGISTRY_USER_.DEFAULT
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_SAM
These files are the backed up registry files from System Restore. Because you used the registry file created by Setup, this registry does not know that these restore points exist and are available. A new folder is created with a new
GUID under System Volume Information and a restore point is created that includes a copy of the registry files that were copied during part one. This is why it is important not to use the most current folder, especially if the time stamp on the folder is the same as the current time.
The current system configuration is not aware of the previous restore points. You need a previous copy of the registry from a previous restore point to make the previous restore points available again.
The registry files that were copied to the
Tmp folder in the
C:\Windows folder are moved to ensure the files are available under Recovery Console. You need to use these files to replace the registry files currently in the
C:\Windows\System32\Config folder. Recovery Console has limited folder access and cannot copy files from the System Volume folder by default.
Part ThreeIn part three, you delete the existing registry files, and then copy the System Restore Registry files to the
C:\Windows\System32\Config folder:
Boot to Recovery Console.
At the
Recovery Console command prompt, type the following lines, pressing ENTER after you type each line:
del c:\windows\system32\config\sam
del c:\windows\system32\config\security
del c:\windows\system32\config\software
del c:\windows\system32\config\default
del c:\windows\system32\config\system
copy c:\windows\tmp\_registry_machine_software c:\windows\system32\config\software
copy c:\windows\tmp\_registry_machine_system c:\windows\system32\config\system
copy c:\windows\tmp\_registry_machine_sam c:\windows\system32\config\sam
copy c:\windows\tmp\_registry_machine_security c:\windows\system32\config\security
copy c:\windows\tmp\_registry_user_.default c:\windows\system32\config\default
NOTE: This procedure assumes that Windows XP is installed to the
C:\Windows folder. Make sure to change C:\Windows to the appropriate windows_folder if it is a different location.
If you have access to another computer, to save time, you can copy the text in step two, and then create a text file called "
Regcopy 2.txt".
To run this file, run the following command when you boot into Recovery Console:
batch regcopy2.txt Part FourClick Start, and then click All Programs.
Click Accessories, and then click System Tools.
Click System Restore, and then click Restore to a previous Restore Point.
