Ebibiri ekpuchi ndekọ Windows (BAD_SYSTEM_CONFIG_INFO BSOD): Gịnị kpatara ya RegBack Ọ bụ ihe efu na Windows 10/11 na otu esi eweghachi Hives na VSS Shadow Copy¶

Ịhụ Windows 10, Windows 11, ma ọ bụ Windows Server igwe mkpọka n'oge mmalite n'ime ihuenyo Blue nke ọnwụ na-adịghị agwụ agwụ (BSOD) ngosipụta loop Stop code: BAD_SYSTEM_CONFIG_INFO (0x00000074, CRITICAL_PROCESS_DIED, ma ọ bụ ihuenyo oji Windows Boot Manager na-ekwu \Windows\System32\config\SYSTEM is missing or contains errors (Status: 0xc000014c / 0xc0000225) pụtara otu ma ọ bụ karịa Windows' isi ọnụọgụ abụọ ndekọ hives (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) ma ọ bụ Boot Configuration Data (BCD) Adọkasịịrị ụlọ ahịa n'oge okuku ọkụ, mmechi mmanye, ma ọ bụ ngụkọta dara ada. Nke ka njọ, mgbe ndị nchịkwa na-agbaso nkuzi ntanetị ochie na-agwa ha ka ha mepee Windows Recovery Environment (WinRE) Nye iwu ozugbo ma detuo faịlụ ndekọ ndabere na C:\Windows\System32\config\RegBack\, ha chọpụtara na ** RegBack folda efu kpamkpam (ma ọ bụ nwere 0-byte faịlụ). Malite na Windows 10 ụdị 1803 na n'ofe ụlọ niile nke Windows 11, Microsoft nwere nkwarụ kpamkpam. RegIdleBackup ọrụ iji chekwaa ohere diski. Ehichapụla ma wụnye Windows: PC gị fọrọ nke nta ka ọ bụrụ na ọ dịgidere, nke emere n'oge na-adịbeghị anya nke ndekọ ndekọ aha ọ bụla n'ime zoro ezo ** Ọrụ Copy Copy.VSS) snapshots (HarddiskVolumeShadowCopyN na azụmahịa .LOG1 / .LOG2 akwụkwọ akụkọ ị nwere ike wepụta n'ime nkeji 3 WinRE. Maka nchọpụta nsogbu BSOD ọkwọ ụgbọ ala ma ọ bụ ngwaike, hụ Ihuenyo acha anụnụ anụnụ Windows (BSOD) na nrụzi buut; ọ bụrụ BitLocker na-arịọ maka igodo mgbake ọnụọgụ 48 tupu imepee Command ozugbo, jụọ BitLocker, FileVault, na LUKS mkpọchi igodo mgbake nzuzo yana nrụpụta TPM na SSD na NVMe na ọnọdụ ọgụgụ naanị mberede yana nnapụta TRIM na-emebi. Ọ bụrụ na ọdịda sistemụ a kwụsịrị ọrụ ụlọ ọgwụ ụlọ ọgwụ, izipu ihe mberede (CAD), ma ọ bụ njikwa nchekwa ndụ, kpọọ nọmba mberede mpaghara gị (911 na United States na Canada, 112 gburugburu European Union, 999 na United Kingdom) ma ọ bụ lelee akwụkwọ ndekọ aha anyị nọmba mberede.

Mee nke a ugbu a¶

1. Apịala "Tọgharịa PC a -> Wepu ihe niile" ma ọ bụ detuo kpuru ìsì 0-byte pụọ faịlụ C:\Windows\System32\config\RegBack\: Ọ bụrụ na ị na-agba ọsọ copy C:\Windows\System32\config\RegBack\* C:\Windows\System32\config\ na Windows 10 (1803+) ma ọ bụ Windows 11 na-enweghị ịlele dir RegBack mbụ, ị ga overwrite gị partially mebiri emebi ndekọ hives na 0-byte faịlụ efu, na-ebibi hives fọdụrụnụ na-eme ka mgbake sie ike karị.
2. ** Bọba n'ime gburugburu mgbake Windows (WinRE) na meghere Troubleshoot -> Advanced options -> Command Prompt**:
3. Ọ bụrụ na Windows adaghị buut ugboro atọ n'usoro, ọ ga-amalite ozugbo ** Ndozi akpaaka -> Nhọrọ dị elu ***.
4. N'aka nke ọzọ, buut site na ihe ọ bụla **Windows 10/11 USB nwụnye Media **, pịa Shift + F10 (ma ọ bụ Shift + Fn + F10 na laptọọpụ) ozugbo na ihuenyo nhọrọ asụsụ mbụ, yana elu X:\Sources> Command Prompt ga-emepe ozugbo na-enweghị ịpị site na menus.
5. ** Chọta ezigbo leta nkebi Windows gị (diskpart -> list vol), dị ka ọ na-adịkarị D: ma ọ bụ E: n'ime WinRE, ọ bụghị C:**: N'ime gburugburu mgbake, C: a na-ekenyekarị na 100 megabyte System Reserved ma ọ bụ Recovery Nkebi mgbe nrụnye Windows gị na-anọdụ ala D: ma ọ bụ E:. Gbaa ọsọ dir C:\Windows, dir D:\Windows, dir E:\Windows iji kwado nke akwụkwọ ozi mbanye nwere \Windows\System32\config\.
6. ** Na-akwado mgbe niile (ọbụlagodi agbajiri) config\ nchekwa na C:\Config_Backup\ TUPU imetụ otu faịlụ ***: Gbaa ọsọ mkdir D:\Config_Backup na xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Backup. Ị ga-echekwaba faịlụ mbụ hive ise (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) ** na *** faịlụ ndekọ azụmahịa ha zoro ezo (SYSTEM.LOG1, SYSTEM.LOG2, SOFTWARE.LOG1, SOFTWARE.LOG2).
7. Tupu dochie ekwo Ekwo ọ bụla, nwalee ma BCD (Boot Configuration Data) mkpọpu ma ọ bụ ndekọ azụmahịa hive ruru unyi (.LOG1 / .LOG2) bụ ihe kpatara ya BAD_SYSTEM_CONFIG_INFO:
8. N'ime 30% nke BAD_SYSTEM_CONFIG_INFO BSODs, hives ndekọ dị mma 100% yana ndị BCD ụlọ ahịa nwere naanị mebiri emebi truncatememory / numproc ọkọlọtọ (msconfig ọnyà) ma ọ bụ mkpa reg load iji megharịa ya .LOG1/.LOG2 ndekọ azụmahịa na-akpaghị aka.
9. ** Ọ bụrụ SYSTEM ma ọ bụ SOFTWARE na-emebi emebi n'ezie, wepụta otu ahụike ozugbo na VSS Shadow Copy (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\) iji vssadmin list shadows**: Ọbụna mgbe System Restore (rstrui.exe) dara na njehie na GUI, olu VSS Shadow Copy dị n'okpuru dị na diski wee nye gị ohere idetuo dị ọcha. SYSTEM na SOFTWARE hives ozugbo banye \Windows\System32\config\ iji copy ma ọ bụ robocopy.

Osisi mkpebi: BAD_SYSTEM_CONFIG_INFO (0x00000074) na 0xc000014c nhazi ndekọ¶

Jiri eserese ngosi nke a WinRE Ngwa ngwa iwu (Shift + F10) ịkọwapụta faịlụ mebiri emebi ma weghachi ya na-enweghị ida mmemme arụnyere ma ọ bụ akaụntụ onye ọrụ:

flowchart TD
    Start["Windows mkpọka na buut: BAD_SYSTEM_CONFIG_INFO (0x74) ma ọ bụ 0xc000014c"] --> OpenCmd["Banye n'ime WinRE ma ọ bụ Windows USB -> Mepee Iwu ozugbo (Shift + F10)"]

    OpenCmd --> FindDrive["Chọta Ezi Windows Drive Letter (dịka D:) site na: diskpart -> ndepụta vol -> ọpụpụ"]
    FindDrive --> BackupFirst["Back Up Current Config Folder (gụnyere zoro ezo .LOG1/.LOG2): xcopy / h D: \ Windows \ System32 \ config D: \ Config_Orig \\"]

    BackupFirst --> CheckBcd["Lelee 1: Gbaa bcdedit -> Onwere onye debere truncatememory ma ọ bụ nuproc na msconfig?"]
    CheckBcd -->|"Ee: truncatememory ma ọ bụ badvalue dị ugbu a"| FixBcd["Run: bcdedit /deletevalue {default} truncatememory AND bcdedit /deletevalue {default} numproc -> Reboot"]

    CheckBcd -->|"Mba: BCD dị ọcha"| TestReplay["Lelee 2: Test & Replay Transaction Logs (.LOG1/.LOG2) maka Hive ọ bụla site na reg load HKLM \ TempHive"]

    TestReplay --> WhichBroken{"reg load a na-aga nke ọma ma megharịa .LOG1/.LOG2 nke ọma?"}
    WhichBroken -->|"Ee: reg load Replayed unyi Azụmahịa Log -> Bupu site reg mbupu"| BootFixed["Malitegharịa PC: nkụnye eji isi mee hive ruru unyi ka edobere n'ebe yana Zero Rollback"]

    WhichBroken -->|"Mba: SYSTEM ma ọ bụ SOFTWARE na-alaghachi 'Nhazi nchekwa data ndekọ emebiela' ma ọ bụ Bụ 0 Bytes"| CheckVss["Gbaa ọsọ: vssadmin ndepụta onyinyo"]

    CheckVss --> HasVss{"Edepụtara nnomi nke onyinyo olu (HardiskVolumeShadowCopy1..N)?"}

    HasVss -->|"Ee: Mpempe onyinyo dị"| CopyVss["Detuo naanị hive mebiri emebi (dịka SYSTEM/SOFTWARE) site na HarddiskVolumeShadowCopyN Kacha ọhụrụ gaa na D:\WindowsSystem32\config\\"]

    HasVss -->|"Mba: 0 Edepụtara mbipụta onyinyo"| CheckAlt["Lelee isi mmalite hive ọzọ: D: \ Windows \ System32 \ config \ TxR \ ma ọ bụ Windows.old OR WinSxS Component Hive Repair"]

Nkeji 1: Gịnị mere BAD_SYSTEM_CONFIG_INFO eme na ihe kpatara ya RegBack bụ ihe efu na Windows 10/11¶

Tupu ịmegharịa faịlụ ọ bụla n'ime \Windows\System32\config\, ghọta ihe ise ndekọ hive faịlụ n'ezie na-eme na ihe mere omenala RegBack usoro anaghịzi arụ ọrụ.

1. Anatomi nke \Windows\System32\config\¶

Mgbe Windows kernel (ntoskrnl.exe) na Boot Loader (winload.efi) na-amalite n'oge mmalite, ha na-ebu faịlụ nchekwa data ọnụọgụ abụọ (a na-akpọ ** Hives **, malite na mbinye aka ASCII 4-byte). regf na byte 0) si \Windows\System32\config\:

2. Ntak C:\Windows\System32\config\RegBack Ọ bụ ihe efu na Windows 10 (1803+) na Windows 11¶

Site na Windows XP ruo na Windows 10 ụdị 1709, ọrụ ahaziri aha ya \Microsoft\Windows\Registry\RegIdleBackup na-eṅomi na-akpaghị aka SYSTEM, SOFTWARE, SAM, SECURITY, na DEFAULT banye \Windows\System32\config\RegBack\ mgbe ọ bụla sistemụ na-arụ ọrụ. - **Ihe Microsoft gbanwere ***: Malite na *Windows 10 ụdị 1803 (Mee 2018) wee na-aga n'ihu na mwepụta ọ bụla nke Windows 11 , Microsoft nwere nkwarụ akpaka RegBack Onu ogugu na ndabara iji wedata akara ukwu diski (nke edeputara na Microsoft Nkwado KB4509719). - ** Nsonaazụ: Ọ gwụla ma i jiri aka tinye ya EnablePeriodicBackup = 1 DWORD ka HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager tupu * PC gị d, na-agba ọsọ dir D:\Windows\System32\config\RegBack ga-egosi 0 File(s)** (ma bụ faịlụ ise nke nha 0 bytes**). - ** Ihe kpatara ị ka nwere nkwado ndabere na mpaghara ***: n'agbanyeghị RegBack bụ ihe tọgbọrọ chakoo, Windows 10 na Window11 mepụta na-akpaghị aka ** Copy Copy Copy (Oyi Mpịakọta).VSS) onyonyo tupu mmelite Windows, nrụnye ngwa MSI, nrụnye ọkwọ ụgbọ ala, yana ebe nyochaghachi kwa izu. Onyonyo VSS ọ bụla nwere nnomi oyi kpọnwụrụ akpọnwụ n'ime oge \Windows\System32\config\.

Nkeji 2: Ndozi ngwa ngwa anaghị emegharịghachi (msconfig Ọnyà BCD & .LOG1/.LOG2 Mmegharị azụmahịa)¶

Tupu dochie SYSTEM ma ọ bụ SOFTWARE site na nnomi oyiri, nwalee ndozi efu abụọ a n'ime WinRE Ngwa ngwa iwu (Shift + F10). Ihe karịrị ọkara nke ihe niile BAD_SYSTEM_CONFIG_INFO (0x00000074) A na-edozi mkpọka ebe a n'okpuru 60 sekọnd na-enweghị ịtụgharị azụ otu ntọala.

Kwụpụ 1: Chọpụta leta draịva Windows gị nke ọma (D: vs C:) na ndabere config\¶

N'ime X:\Sources> Window Command Prompt, chọta mkpụrụedemede mbanye na-ejide nrụnye Windows gị:

diskpart
list volume
exit

Ozugbo mee nkwado ndabere zuru oke nke D:\Windows\System32\config (iji /h otú zoro ezo .LOG1 na .LOG2 faịlụ azụmahịa gụnyere:

mkdir D:\Config_Emergency_Backup
xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Emergency_Backup

Nzọụkwụ 2: Lelee Idozi A: Ọ nwere onye gbanwere Number of processors ma ọ bụ Maximum memory n'ime msconfig?¶

Akwụkwọ gọọmentị Microsoft maka nlele ahụhụ 0x74 (BAD_SYSTEM_CONFIG_INFO) na-akọwapụta ọnyà ọjọọ: ndị ọrụ meghere **msconfig -> Boot -> Nhọrọ dị elu ** na-eso vidiyo "njikarịcha egwuregwu", lelee Number of processors ma ọ bụ Maximum memory (na-edozi ya 0 ma ọ bụ uru ọjọọ), ma malitegharịa. Ozugbo ịmalitegharịrị, Windows na-adaba na-adịgide adịgide BAD_SYSTEM_CONFIG_INFO BSOD tupu ọbụna imetụ hives ndekọ aka.

Lelee data nhazi Boot gị (BCD) na-echekwa ugbu a:

bcdedit /enum {default}

bcdedit /deletevalue {default} truncatememory
bcdedit /deletevalue {default} numproc
bcdedit /deletevalue {default} removememory

Kwụpụ 3: Lelee Idozi B: Tinyegharịa unyi .LOG1 / .LOG2 ekwo Ekwo azụmahịa ndekọ na-ebe iji reg load¶

Kedu ihe ma ọ bụrụ na ebibiri ike mgbe Windows na-edegara ya akwụkwọ SYSTEM ma ọ bụ SOFTWARE?

+-------------------------------------------------------------------------+
| HOW WINDOWS REGISTRY HIVE HEADER SEQUENCE NUMBERS WORK                  |
|                                                                         |
| Base Block Header of SYSTEM Hive (First 4,096 bytes: "regf"):           |
|   Offset 0x04: Primary Sequence Number   = 0x0004810A                   |
|   Offset 0x08: Secondary Sequence Number = 0x00048109 (MISMATCH)        |
|                                                                         |
| Why it fails at boot:                                                   |
|   Power died mid-write before Primary == Secondary. The missing         |
|   dirty pages are sitting safely inside SYSTEM.LOG1 / SYSTEM.LOG2.      |
|   If winload.efi cannot reconcile the log at early boot, it throws      |
|   0xc000014c or BAD_SYSTEM_CONFIG_INFO (0x74).                          |
|                                                                         |
| How to force-replay the .LOG1/.LOG2 file in WinRE:                      |
|   Running `reg load HKLM\Temp D:\Windows\System32\config\SYSTEM`        |
|   invokes the full WinRE Configuration Manager, which reads             |
|   SYSTEM.LOG1 + SYSTEM.LOG2, replays the dirty vector pages into        |
|   SYSTEM, sets Primary == Secondary, and flushes a clean hive on unload |
+-------------------------------------------------------------------------+

Nwalee nke ọ bụla n'ime hives ise (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) otu otu n'ime WinRE Jiri iwu ozugbo reg load:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM

reg unload HKLM\TestSys

reg load HKLM\TestSoft D:\Windows\System32\config\SOFTWARE
reg unload HKLM\TestSoft

reg load HKLM\TestSam D:\Windows\System32\config\SAM
reg unload HKLM\TestSam

reg load HKLM\TestSec D:\Windows\System32\config\SECURITY
reg unload HKLM\TestSec

reg load HKLM\TestDef D:\Windows\System32\config\DEFAULT
reg unload HKLM\TestDef

Nkeji 3: Na-ewepụ Hives ndekọ ahụike dị mma na VSS Ụdị onyinyo (HarddiskVolumeShadowCopyN)¶

Kedu ihe kpatara anyị ji eji aka wepụ ekwo Ekwo gbajiri agbaji na Detuo Onyinyo olu kama ịpị ** Nchọpụta nsogbu -> Nhọrọ dị elu -> Weghachite sistemu ** na GUI? 1. Nke mbụ, ọ bụrụ SYSTEM ma ọ bụ SOFTWARE enweghị ike ịgụ, eserese System Restore (rstrui.exe) ọkachamara na-adakarị System Restore failed to extract the original copy of the directory from the restore point (0x80070002 / 0x80070017). 2. Nke abụọ, graphical System Restore na-edochi * niile * hives wee tụgharịa ọtụtụ narị faịlụ ọkwọ ụgbọ ala/executable n'ofe diski ahụ, ebe na-edegharị naanị otu mebiri emebi. SYSTEM ma ọ bụ SOFTWARE ekwo Ekwo si HarddiskVolumeShadowCopyN were 10 sekọnd wee hapụ hives gị ndị ọzọ (SAM, SECURITY) emetụghị aka.

Kwụpụ 1: Depụta akwụkwọ mpịakọta niile dị na diski ahụ¶

N'ime WinRE Ngwa ngwa ngwa, gbaa ọsọ:

vssadmin list shadows

Contents of shadow copy set ID: {4b9128a1-8812-4091-a910-112938475610}
   Contained 1 shadow copies at creation time: 10/30/2026 11:14:02 PM
      Shadow Copy ID: {99182736-1122-3344-5566-77889900aabb}
         Original Volume: (D:)\\?\Volume{12345678-0000-0000-0000-100000000000}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

Kwụpụ 2: Nyochaa hives ndekọ n'ime mpịakọta Shadow Copy¶

N'ihi ọkọlọtọ cd ma ọ bụ dir iwu mgbe ụfọdụ kpagbuo na \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 kernel namespace ụzọ, ị nwere ike gafere ụzọ na ruturu ka dir, ma ọ bụ mepụta njikọ ihe atụ dabara adaba (mklink /d) na D:\ na-atụ aka ozugbo na Copy Shadow:

# Create a folder symlink on D:\ pointing into the newest Shadow Copy (e.g., ShadowCopy1):
mklink /d D:\ShadowMount \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

# Inspect the file sizes and dates of the registry hives inside that Shadow Copy:
dir D:\ShadowMount\Windows\System32\config

Kwụpụ 3: Detuo naanị hive (s) mebiri emebi site na Detuo n'ime D:\Windows\System32\config\¶

Ka e were ya na ule gị na agba nke abụọ nzọụkwụ 3 gosiri na SYSTEM erubeghị (ma ọ bụ ha abụọ SYSTEM na SOFTWARE dara).

Gbaa iwu ndị a kpọmkwem iji dochie ndị gbajiri agbaji SYSTEM (na/ma ọ bụ SOFTWARE) ekwo Ekwo nke ọma:

# 1. Remove the dirty .LOG1 / .LOG2 files for the hive being replaced (already backed up in D:\Config_Emergency_Backup)
attrib -h -s -r D:\Windows\System32\config\SYSTEM.LOG*
del D:\Windows\System32\config\SYSTEM.LOG1
del D:\Windows\System32\config\SYSTEM.LOG2

# 2. Copy the healthy SYSTEM hive from the Shadow Copy into D:\Windows\System32\config\
copy /y D:\ShadowMount\Windows\System32\config\SYSTEM D:\Windows\System32\config\SYSTEM

# (If SOFTWARE was ALSO broken in Phase 2 Step 3, run the same for SOFTWARE:)
attrib -h -s -r D:\Windows\System32\config\SOFTWARE.LOG*
del D:\Windows\System32\config\SOFTWARE.LOG1
del D:\Windows\System32\config\SOFTWARE.LOG2
copy /y D:\ShadowMount\Windows\System32\config\SOFTWARE D:\Windows\System32\config\SOFTWARE

# 3. Clean up the temporary symlink so you don't leave a dangling link on D:\
rmdir D:\ShadowMount

Kwụpụ 4: Chọpụta ibu ekwo ekwo eweghachiri nke ọma (reg load) ma lelee CurrentControlSet¶

Nwalee nke ahụ e depụtaghachiri ọhụrụ SYSTEM ibu ekwo Ekwo nwere mperi efu:

reg load HKLM\TestRestored D:\Windows\System32\config\SYSTEM
reg query HKLM\TestRestored\Select
reg unload HKLM\TestRestored

HKEY_LOCAL_MACHINE\TestRestored\Select
    Current    REG_DWORD    0x1
    Default    REG_DWORD    0x1
    Failed     REG_DWORD    0x0
    LastKnownGood    REG_DWORD    0x2

Nkeji 4: Gịnị ma ọ bụrụ vssadmin list shadows Ihe ngosi No items found (0 Oyiyi oyiri)?¶

Gịnị ma ọ bụrụ na Nchekwa System (VSS) agbanyụrụ kpamkpam na draịva, RegBack bụ ihe efu, na reg load ada na SYSTEM ma ọ bụ SOFTWARE? Ị ka nwere ụzọ mgbake ọdịda atọ tupu ịwụnye Windows:

Ndaghachi 1: Gbanwee Default ka LastKnownGood (ControlSet002) n'ime SYSTEM¶

Ọ bụrụ reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM ** na-aga nke ọma *** na BSOD (BAD_SYSTEM_CONFIG_INFO) na-eme n'ihi na onye ọkwọ ụgbọ ala ma ọ bụ igodo ọrụ n'ime ControlSet001 (Current = 0x1) mebiri emebi mgbe ControlSet002 (LastKnownGood = 0x2) n'ime otu SYSTEM ekwo Ekwo adịghị emebi emebi:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM
reg query HKLM\TestSys\Select
# If ControlSet002 exists (verify via: reg query HKLM\TestSys\ControlSet002), switch Default from 1 to 2:
reg add HKLM\TestSys\Select /v Default /t REG_DWORD /d 2 /f
reg unload HKLM\TestSys

Ndaghachi azụ 2: Lelee C:\Windows\System32\config\TxR\ na C:\Windows.old\Windows\System32\config\¶

Lelee ma PC emelitere n'oge na-adịbeghị anya na-ewuli elu (22H2 -> 23H2 -> 24H2) ma ọ bụ nwere kernel Transaction Manager (TxR) akwụkwọ ndekọ akpa:

dir /a D:\Windows.old\Windows\System32\config
dir /a D:\Windows\System32\config\TxR

Ndaghachi azụ 3: Weghachite nwelite mkpokọta arụnyere ọkara arụnyere (dism /RevertPendingActions)¶

Ọtụtụ mgbe, BAD_SYSTEM_CONFIG_INFO ma ọ bụ CRITICAL_PROCESS_DIED emee n'ihi na PC efunahụ ike na 30% n'oge Working on updates... Don't turn off your computer, pụọ SOFTWARE na \Windows\WinSxS\pending.xml enweghị mmekọrịta. Site na WinRE Ngwa ngwa ngwa, gwa ọrụ ọrụ na njikwa onyonyo nke ntinye (DISM) injin iji weghachite azụmahịa niile na-akwadoghị megide onyonyo Windows na-anọghị n'ịntanetị (D:\):

mkdir D:\Scratch
dism /Image:D:\ /Cleanup-Image /RevertPendingActions /ScratchDir:D:\Scratch

Ndaghachi 4: Na-arụkwa data nhazi Boot enweghị ike ịgụ (BCDụlọ ahịa (bootrec /rebuildbcd na bcdboot)¶

Gịnị ma ọ bụrụ na ise ndekọ hives n'ime D:\Windows\System32\config\ jiri ma buo ya nke ọma reg load, ma PC ka na-atụba 0xc000014c (The Boot Configuration Data for your PC is missing or contains errors) ma ọ bụ 0xc000000f? N'ihi na Windows BCD faịlụ na gị zoro ezo 100 MB Nkebi sistemu FAT32 EFI\EFI\Microsoft\Boot\BCD) A na-echekwa ya n'onwe ya na ọnụọgụ abụọ regf ndekọ ekwo Ekwo format dị ka SYSTEM na SOFTWARE, a ike ọnwụ nwere ike imebi ihe BCD ekwo Ekwo mgbe ị na-apụ D:\Windows\System32\config\ emetụghị aka. wughachi ihe ọhụrụ BCD hive na nkebi Sistemu EFI gị na sekọnd 15:

diskpart
list volume
# Find the 100 MB to 300 MB FAT32 EFI System Partition (e.g. Volume 2)
select volume 2
assign letter=S
exit

# Back up the old broken BCD hive and generate a fresh one from D:\Windows:
ren S:\EFI\Microsoft\Boot\BCD BCD.bak
bcdboot D:\Windows /s S: /f UEFI

Nkeji 5: Na-eme ka akpaaka RegBack nkwado ndabere na mpaghara Windows 10 na Windows 11¶

Ozugbo Windows PC gị laghachitere na desktọpụ, mee ka arụnyere Microsoft ọzọ RegIdleBackup ọrụ ya C:\Windows\System32\config\RegBack\ A na-eju mmadụ na-akpaghị aka kwa izu, wee nyochaa Sistemu weghachi (VSS) na-arụsi ọrụ ike:

• ** Tinyegharịa akpaaka RegBack nkwado ndabere nke hive na Windows 10 (1803+) na Windows 11 **: Mepee ngwa ngwa iwu dị elu (Run as Administrator) ma mee otu iwu ndekọ ndekọ aha ọrụ a (KB4509719):

  reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager" /v EnablePeriodicBackup /t REG_DWORD /d 1 /f
  

  Mgbe ahụ ịkpalite ndabere ọrụ ozugbo ozugbo iji nyochaa C:\Windows\System32\config\RegBack jupụta n'ụdị dị mma nke hives ise niile:

  schtasks /run /tn "\Microsoft\Windows\Registry\RegIdleBackup"
  dir C:\Windows\System32\config\RegBack
  

• ** Nyochaa nchedo sistemu (VSS Isi ihe weghachi) tụgharịa ON maka C:**: Pịa Win + R, ụdị sysdm.cpl ,4, họrọ nke gị C: mbanye, pịa ** Hazie ***, họrọ ** Gbanwuo nchedo sistemu **, tọọ Max Usage ka ọ bụrụ. 5% (10 GB ka 25 GB), wee pịa ** Mepụta *** ka ịmee nnomi onyinyo ndabere dị ọcha ugbu a.
• ** Gbaa ọsọ sfc /scannow na DISM /Online /Cleanup-Image /RestoreHealth** otu ugboro butere n'ime Windows iji nyochaa enweghị sistemụ DLL ma ọ bụ ụlọ ahịa akụrụngwa pụtara (COMPONENTS hive) mebiri emebi n'oge okuku ahụ.

Nọmba mberede mpaghara na ụkpụrụ ụlọ ọrụ¶

Mgbe a Windows BAD_SYSTEM_CONFIG_INFO BSOD na-abụkarị okwu IT dị n'ime ma ọ bụ nrụzi kọmpụta nkeonwe, ebe ọrụ ma ọ bụ ọdịda nkesa na-emetụta ụlọ ọgwụ, izipu ihe mberede, ma ọ bụ akụrụngwa ọha chọrọ ịrị elu ozugbo:

• United States na Canada : Kpọọ 911 Ọ bụrụ na ihe mberede Windows kwụsịrị nleba anya nke onye ọrịa, izipu ihe mberede (CAD), ma ọ bụ njikwa nchekwa ndụ, ma gbanwee gaa na usoro nkwụsịtụ ụlọ ọrụ. Kpesa bootloops ụlọ ọrụ zuru ebe niile sitere na mmelite ndị ọrụ nchekwa ma ọ bụ ihe omume cyber na ** CISA (1-844-Say-CISA / cisa.gov/report ma ọ bụ ** Canada Center for Cyber Security (1-833-CYBER-88).
• **United Kingdom **: Ịkpọ oku 999 maka iyi egwu ndụ ma ọ bụ nnukwu ọgbaghara ụlọ ọgwụ NHS. Kpesa nnukwu ihe gbasara cyber ma ọ bụ nnweta na NCSC (ncsc.gov.uk ma ọ bụ NHS England Cyber Operations.
• ** European Union ***: Ịkpọ oku 112 gafee mba ndị otu EU niile. Ụlọ ọrụ kpuchiri ekpuchi n'okpuru **NIS2 Directive ** ga-akọrịrị mpụ arụ ọrụ dị ukwuu na CSIRT obodo ha n'ime awa 24.
• **Australia na New Zealand ***: Ịkpọ oku 000 na Australia ma ọ bụ 111 na New Zealand; kọọ akụkọ ihe gbasara akụrụngwa dị egwu na ACSC (1300 CYBER1).
• **India na Asia-Pacific *: Ịkpọ oku 112 na India maka nzaghachi mberede; kọọ akụkọ akụrụngwa ma ọ bụ ihe omume cyber na ** CERT-In (incident@cert-in.org.in).

Ajụjụ a na-ajụkarị¶

Kedu ihe ma ọ bụrụ na profaịlụ onye ọrụ m abanyeghị mgbe ebuchara ("We can't sign in to your account" / Profaịlụ nwa oge) n'ihi na NTUSER.DAT emebiela?¶

Na mgbakwunye na ise usoro hives n'ime `\Windows\System32\config\`, akaụntụ onye ọrụ ọ bụla nwere ebe ndekọ nke ya (`HKEY_CURRENT_USER`) echekwara na **`C:\Users\\NTUSER.DAT`** (gbakwunyere `AppData\Local\Microsoft\Windows\UsrClass.dat`). Ọ bụrụ na akpụkpọ ụkwụ PC gị na ihuenyo nbanye dị mma, mana ịbanye na-ebu ibu desktọọpụ nwa oge efu n'ihi na `NTUSER.DAT` mebiri emebi n'oge okuku ọkụ, mepee Command Prompt dị elu, gbaa ọsọ `vssadmin list shadows`, ma detuo ahụ ike `NTUSER.DAT` pụọ `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Users\\NTUSER.DAT` (mgbe ị na-abanye na akaụntụ nchịkwa nke abụọ ma ọ bụ WinRE ka ekpochighị faịlụ ahụ).

Gịnị mere WinRE rịọ maka igodo mgbake BitLocker nwere ọnụọgụ 48 tupu ikwe ka m mepee Command Prompt, mgbe m tụgharịrị BitLocker n'onwe m?¶

N'ihe fọrọ nke nta ka ọ bụrụ Windows 11 (na Windows 10) ọgbara ọhụrụ nwere `TPM 2.0` na Njikere ọgbara ọhụrụ, iji Akaụntụ Microsoft wee banye n'oge nhazi mbụ na-enyere aka **Ezobere ngwaọrụ (`BitLocker`*** n'azụ wee bulite igodo mgbake nke ọnụọgụ 48 na Akaụntụ Microsoft gị. Mepee **`https://aka.ms/myrecoverykey`** na ekwentị gị, jiri Akaụntụ Microsoft banye (`@outlook.com`, `@hotmail.com`, `@gmail.com`) ma ọ bụ NJ ntinye ọrụ / ụlọ akwụkwọ (`myaccount.microsoft.com`) eji na PC ahụ, ma tinye igodo ọnụọgụ 48 dabara na ya `Key ID` egosiri na ihuenyo. Ozugbo emeghechara, `D:\Windows\System32\config` A na-enweta ya kpamkpam na WinRE Command Prompt.

Gịnị ma ọ bụrụ copy ada na The process cannot access the file because it is being used by another process mgbe m na-agbalị idegharị SYSTEM ma ọ bụ SOFTWARE na WinRE?¶

Njehie ahụ na-eme maka otu n'ime ihe abụọ: (1) ị pịnyere na mberede `C:\Windows\System32\config\SYSTEM` mgbe `C:` ma ọ bụ `X:` bụ n'ezie WinRE RAM diski dị ndụ (`X:\Windows\System32\config\SYSTEM` na-akpọchi WinRE n'onwe ya; chọpụta mgbe niile ezigbo akwụkwọ ozi SSD mbanye na-anọghị n'ịntanetị `D:` ma ọ bụ `E:` ya na `diskpart -> list vol`); ma ọ bụ (2) ị gbara ọsọ `reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM` Na mbụ na nnọkọ ma chefuo ịgba ọsọ **`reg unload HKLM\TestSys`** tupu ịgba ọsọ `copy`.

Kedu ihe kpatara PC m ji daa BAD_SYSTEM_CONFIG_INFO (0x00000074) ọbụlagodi na ihe nrụnye USB USB ọhụrụ tupu emetụ SSD aka?¶

Ọ bụrụ `BAD_SYSTEM_CONFIG_INFO` (`0x00000074`) na-eme mgbe ị na-ebupụ ihe ọhụrụ Windows 10/11 USB installer stick ** (ebe onye nrụnye na-ebu nke ya). `boot.wim` Ihe ndekọ RAM n'ime ebe nchekwa sistemụ), ndekọ SSD gị abụghị ** nsogbu ahụ: ** RAM sistemụ gị (RAM)`DDR4 / DDR5`) na-emebi ebe nchekwa ihe ndekọ ka ọ na-ebupụ ***. Tinye motherboard gị `BIOS / UEFI` nhazi (`Del` ma ọ bụ `F2`), gbanyụọ `XMP / EXPO` profaịlụ overclocking ebe nchekwa ka RAM na-agba ọsọ na ọsọ JEDEC ọkọlọtọ, ma ọ bụ jiri otu osisi RAM nwalee n'otu oge. `MemTest86`.

Nwere ike Antivirus nke atọ ma ọ bụ nchọpụta njedebe (EDR) Nwelite ọkwọ ụgbọ ala kernel na-akpata loop BSOD nke dị ka nrụrụ aka ndekọ?¶

Ee. Ndị ọkwọ ụgbọ ala nchekwa kernel (`BOOT_START` ndị ọkwọ ụgbọala na `Start = 0` n'ime `HKLM\SYSTEM\ControlSet001\Services\`) na-ebu ya `winload.efi` n'akụkụ `SYSTEM` ekwo Ekwo tupu Windows ọbụna initializes video. Ọ bụrụ na ọ nwere nkwarụ `.sys` faịlụ na `D:\Windows\System32\drivers\` mkpọka na buut, ị na-adịghị mkpa ka dochie ndekọ ekwo Ekwo: nanị nyegharịa nsogbu `.sys` faịlụ na `D:\Windows\System32\drivers\` (ma ọ bụ ibu `D:\Windows\System32\config\SYSTEM` ya na `reg load HKLM\TestSys` ma gbanwee ọrụ gbajiri agbaji `Start` uru si `0` ka `4` [Nkwarụ]).

Gịnị bụ COMPONENTS ekwo Ekwo n'ime C:\Windows\System32\config\, na gịnị kpatara ọ bụ 100 MB?¶

N'adịghị ka `SYSTEM`, `SOFTWARE`, `SAM`, `SECURITY`, na `DEFAULT` (nke a na-ebu na buut ọ bụla), **`COMPONENTS`** mmiri ozuzo (`C:\Windows\System32\config\COMPONENTS`A na-ebu ya ngwa ngwa na-achọ mgbe ** Mmelite Windows (`TiWorker.exe` / Ọrụ dabere na mpaghara)** ma ọ bụ `sfc /scannow` na-agba ọsọ. Nke mebiri emebi `COMPONENTS` ekwo Ekwo agaghị akwụsị ** akwụsị Windows na booting (`0x00000074`), n'agbanyeghị na ọ ga-eme ka mmelite Windows daa `0x80073712` ruo mgbe rụziri ya `DISM /Online /Cleanup-Image /RestoreHealth`.

Ntuziaka emetụtara¶

• Ihuenyo acha anụnụ anụnụ Windows (BSOD) na nrụzi buut
• BitLocker, FileVault, na LUKS mkpọchi igodo mgbake nzuzo yana nrụpụta TPM
• BIOS na UEFI firmware na-emelite brik, ọnwụ ike, na Dual-BIOS Flashback
• Ụdị naanị ịgụ naanị SSD na NVMe, ihe mgbochi 0% mapụtara, yana TRIM na-emebi nnapụta.
• Ike mbanye ọdịda na data mgbake
• Ndokwa kọmputa, atụmatụ 3-2-1, na mgbake ọdachi
• Nọmba mberede site na obodo

Isi mmalite na nduzi ọchịchị¶

• Microsoft Mụta (learn.microsoft.com): * Lelee ahụhụ 0x74: BAD_SYSTEM_CONFIG_INFO Ntuziaka Nchọpụta nsogbu gọọmentị (BCD truncatememory / numproc Ndozi na nkwenye hive ndekọ)*.
• Nkwado Microsoft (KB4509719): * Ndebanye aha sistemụ anaghịzi akwado ya RegBack nchekwa na-amalite na Windows 10 ụdị 1803 (EnablePeriodicBackup Nhazi ndekọ)*.
• Microsoft Windows Internals (Mbipụta nke asaa, Russinovich et al.): * Nhazi njikwa nhazi, nhazi ọnụọgụ abụọ nke Hive ndekọ (regf, hbin), na Ndekọ Azụmahịa Abụọ (.LOG1 / .LOG2) mgbake*.
• Akwụkwọ Nchekwa Sava Microsoft: Ọrụ Detuo Onyunyo olu (VSS) nchịkwa (vssadmin list shadows na GLOBALROOT Nweta ohere aha ngwaọrụ).
• National Institute of Standards and Technology (NIST) (United States): Mbipụta Pụrụ Iche 800-86: Windows Registry Forensic Analysis and Recovery.