China DOS Union

Restoring the Correct Registry in Windows XP
http://cctips.nease.net/2kxp/xprepair/xprepair.htm

A friend bought a brand-name machine with Windows XP preinstalled last month. After using it for a while, he couldn't stop praising the stability of Windows XP. But the problem came right away. One day when starting the computer, he saw the following error message: "Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM". Windows could not start normally and could only enter Safe Mode. After checking, it seemed likely that registry corruption was preventing a proper boot, so he pressed F8 during startup and selected Last Known Good Configuration, but it didn't work. System Restore also didn't work. So he came to me for help.


After careful analysis and looking up some materials, I finally solved the problem successfully. I'm writing out the whole process here, hoping it can help you when you run into a similar error.


All of the following operations require that you have Administrators group privileges, that the system partition uses NTFS, and that you have not disabled System Restore on the system partition.


First you need to enter the Recovery Console. To be safe, I first created a temporary folder and backed up the registry files into that new folder. The method is to boot the computer with the Windows XP CD, then choose repair to enter the Recovery Console, and then directly type the following commands at the command line:


Md tmp
Copy c:\windows\system32\config\system c:\windows\tmp\system.bak
Copy c:\windows\system32\config\software c:\windows\tmp\software.bak
Copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
Copy c:\windows\system32\config\security c:\windows\tmp\security.bak
Copy c:\windows\system32\config\default c:\windows\tmp\default.bak

Delete c:\windows\system32\config\system
Delete c:\windows\system32\config\software
Delete c:\windows\system32\config\sam
Delete c:\windows\system32\config\security
Delete c:\windows\system32\config\default

Copy c:\windows\repair\system c:\windows\system32\config\system
Copy c:\windows\repair\software c:\windows\system32\config\software
Copy c:\windows\repair\sam c:\windows\system32\config\sam
Copy c:\windows\repair\security c:\windows\system32\config\security
Copy c:\windows\repair\default c:\windows\system32\config\default


All of the above assumes that Windows XP is installed in the C:\WINDOWS folder. If your system is installed in some other folder, just replace it with your own installation folder.


If you want, you can also install the console directly onto the computer, so that if you need to enter the Recovery Console you won't have to boot from the CD every time. You only need to press F8 at startup, and there will be an option to enter the Recovery Console. The installation method is to put the Windows XP CD into the CD-ROM drive. Assuming your CD-ROM drive letter is F, enter "
F:\i386\winnt32
/cmdcons" in Run, and after pressing Enter the Recovery Console will be installed automatically.


Next you need to restore the registry from the system files backed up by the system itself. I first pressed F8 at startup to enter Safe Mode, then opened My Computer. Under the "View" tab in "Tools - Folder Options", I cleared "Hide protected operating system files" and selected "Show hidden files and folders". Then I clicked OK.


Double-click to open the hard disk partition where Windows XP is installed (in my case, drive C), find the System
Volume Information folder, and open it. This folder is normally invisible. You should be able to see several folders similar to "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}".


According to the creation dates of those folders, choose one that was created when the system was completely normal. The files in that folder are backup files from System Restore. I chose the folder _restore{87BD3667-3246-476B-923F-F86E3
0B3E7F8}, and from _restore{87BD3667-3246-476B-923F-F86E30B3E7F8}\RP1\S
napshot
I copied some files to the temporary folder I created at the beginning (C:\WINDOWS\TMP). These files are:


_REGISTRY_USER_.DEFAULT
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_SAM


These files are the registry files backed up by the System Restore feature. Our goal is to use these files to replace the files of the same name in the C:\Windows\System32\Config folder. Since operations on files and folders are restricted in console mode, we have no choice but to use this method.
Next, restart the computer, continue into the Recovery Console, delete the current registry files, and restore them to the previous correct state.


In the console, enter the following commands in order:


Del c:\windows\system32\config\sam
Del c:\windows\system32\config\security
Del c:\windows\system32\config\software
Del c:\windows\system32\config\default
Del c:\windows\system32\config\system

Copy c:\windows\tmp\_registry_machine_software c:\windows\system32\config\so
ftware
Copy c:\windows\tmp\_registry_machine_system c:\windows\system32\config\syst
em
Copy c:\windows\tmp\_registry_machine_sam c:\windows\system32\config\sam
Copy c:\windows\tmp\_registry_machine_security c:\windows\system32\config\se
curity
Copy c:\windows\tmp\_registry_user_.default c:\windows\system32\config\defau
lt


At this point, most of the preparation work is done. After that, you only need to boot the computer in Safe Mode and run System Restore, choose a suitable restore point, and everything will be finished.


There is one more thing to note here: for the System Volume Information folder, you may not have sufficient permissions to open it. If so, you can try the following method:


For Windows XP Professional, first disable simple file sharing in "Folder Options - View", then right-click the System Volume Information folder and select "Properties". Under the "Security" tab, click "Add", then enter the username of the currently logged-in user and click OK. Then you will be able to open that folder.


For Windows XP Home, enter "CMD" in Run and press Enter to open a command prompt window. Go to the root directory of the system partition, for example C:\ , and then directly enter cacls " C:\System Volume
Information" /E /G .com.cn:F
, then press Enter. Here ".com.cn" is the username you are currently using. After that you will be able to access the folder that was previously denied. And if you want to restore it to the denied state, just enter cacls " C:\System Volume
Information" /E /R .com.cn.


Hope this article is helpful to you.