{"id":7,"date":"2010-10-27T20:46:45","date_gmt":"2010-10-27T20:46:45","guid":{"rendered":"http:\/\/triplescomputers.com\/?p=7"},"modified":"2011-08-13T18:13:24","modified_gmt":"2011-08-13T18:13:24","slug":"when-last-known-good-configuration-fails","status":"publish","type":"post","link":"https:\/\/www.triplescomputers.com\/blog\/casestudies\/when-last-known-good-configuration-fails\/","title":{"rendered":"When Last Known Good Configuration fails"},"content":{"rendered":"<p>Sometimes when things go wrong, booting into Windows becomes difficult. As a tech, I often run into situations where the aftermath of an infection or a severe system file corruption prevents me from reaching the Windows desktop on a troubled PC.<\/p>\n<p>My first step in such situations now is simple. I boot to a remote operating system of my creation, open up the\u00a0<strong>system32\\config<\/strong> directory, and copy the registry hive files to a backup folder inside of the config folder. The following files, of course, are the registry hives:<\/p>\n<ul>\n<li>SAM<\/li>\n<li>SECURITY<\/li>\n<li>SOFTWARE<\/li>\n<li>SYSTEM<\/li>\n<li>DEFAULT<\/li>\n<\/ul>\n<p>Once these files have been backed up, I navigate to any recent backup of the hives in the config folder (most often the one in the \u00a0<strong>RegBack <\/strong>subfolder will work) and simply copy those same files from that folder directly into the config folder. This essentially replaces the registry hives with older, working copies of those hives.<\/p>\n<p>On XP machines, it&#8217;s a bit more complicated. \u00a0You&#8217;ll have to actually manually navigate into a restore point folder and copy the backup hives from there. \u00a0These are pretty easy to get to, however. \u00a0Look for the <strong>%SYSTEMDRIVE%\\System Volume Information <\/strong>folder, and find a recently-dated\u00a0<strong>_restore{GUID}RP#\\snapshot\u00a0<\/strong>folder inside it (the &#8220;RP&#8221; indicates it&#8217;s a restore point). \u00a0In this folder, simply copy the five hive files to the <strong>system32\\config<\/strong> folder and rename them to match the hive files you removed above.<\/p>\n<p>Generally, once this is complete, the PC is once again bootable. I highly recommend starting in Safe Mode next, however, as some of the drivers (whether filesystem\u00a0<em>or <\/em>device) may not be accurately catalogued after this procedure. From there, repairs can be carried out to correct any remaining issues with startup applications or drivers.<\/p>\n<p>It isn&#8217;t technically necessary to replace\u00a0<em>all <\/em>of the hives to correct boot problems, but it&#8217;s good practice.<\/p>\n<p><em>If you&#8217;re looking for computer help in the Louisville area,\u00a0<a title=\"Triple-S Computers\" href=\"http:\/\/www.triplescomputers.com\/\">look no further<\/a>. \u00a0Call me today and get it done right!<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Sometimes when things go wrong, booting into Windows becomes difficult. As a tech, I often run into situations where the aftermath of an infection or a severe system file corruption prevents me from reaching the Windows desktop on a troubled &hellip; <a href=\"https:\/\/www.triplescomputers.com\/blog\/casestudies\/when-last-known-good-configuration-fails\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[7,9,8],"class_list":["post-7","post","type-post","status-publish","format-standard","hentry","category-casestudies","tag-advanced","tag-boot-problems","tag-registry"],"_links":{"self":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/posts\/7","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/comments?post=7"}],"version-history":[{"count":0,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/posts\/7\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/media?parent=7"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/categories?post=7"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/tags?post=7"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}