Windows Registry Hive Eyonoonese (BAD_SYSTEM_CONFIG_INFO BSOD): Lwaki RegBack Is Empty mu Windows 10/11 n'Engeri y'okuzzaawo Hives okuva mu VSS Shadow Copies¶
Ennamba z’embeera ez’amangu zaawukana okusinziira ku nsi. Omuko guno gukozesa 911, ennamba ya Amerika ne Canada. Ensi endala nnyingi zikozesa 112, 999, oba ennamba endala. Funa ennamba y'ensi yo.
Okulaba ekyuma kya Windows 10, Windows 11, oba Windows Server nga kigwa nga kitandika ne kiyingira mu Blue Screen of Death etakoma (BSOD) loopu eraga ** .Stop code: BAD_SYSTEM_CONFIG_INFO (0x00000074), ** .CRITICAL_PROCESS_DIED, oba olutimbe lwa Windows Boot Manager oluddugavu olulaga ** .\Windows\System32\config\SYSTEM is missing or contains errors (Status: 0xc000014c / 0xc0000225)** kitegeeza emu oba eziwera ku Windows' core binary registry hives (SYSTEM, . SOFTWARE, . SAM, . SECURITY, . DEFAULT) oba Data y’okusengeka Boot (BCD) store yakutuka mu kiseera ky’amasannyalaze okuvaako, okukaka okuggalwa, oba okulemererwa okukuŋŋaanyizibwa okulongoosa. Ekisinga obubi, abaddukanya bwe bagoberera ebisomesebwa eby’edda ku yintaneeti nga babagamba okuggulawo Windows Recovery Environment (WinRE) Command Prompt era okoppa fayiro za registry za backup okuva mu ** .C:\Windows\System32\config\RegBack\**, bakizuula nti aba RegBack folda njereere ddala (oba erimu 0-byte fayiro). Okutandika mu Windows 10 version 1803 ne mu kuzimba kwonna okwa Windows 11, Microsoft yalemesa enkalakkalira... RegIdleBackup omulimu okukekkereza ekifo ku disiki. Tosangula n’okuddamu okuteeka Windows: PC yo kumpi ddala ekwata kkopi ezitaliiko kamogo, ezaakakolebwa eza buli registry hive munda mu Volume Shadow Copy Service (VSS) ebifaananyi ebikutte ( .HarddiskVolumeShadowCopyN) n’okutunda ebintu .LOG1 / .LOG2 journals z’osobola okuggyamu mu ddakiika 3 WinRE. Okusobola okugonjoola ebizibu bya ddereeva oba hardware BSOD mu bulambalamba, laba Windows blue screen (BSOD) n’okuddaabiriza boot; singa BitLocker asaba ekisumuluzo kya digito 48 eky'okuzzaawo nga tonnaggulawo Command Prompt, weebuuze BitLocker, FileVault, ne LUKS okuzzaawo ensirifu okuggalawo ekisumuluzo n'okuddamu okutereeza TPM era SSD ne NVMe mode okusoma kwokka okw'amangu ne TRIM okulemesa okununula. Singa enkola eno okulemererwa kulemesa ebifo eby’okukoleramu eby’obujjanjabi mu malwaliro, okusindika mu bwangu (CAD), oba ebyuma ebifuga obukuumi bw’obulamu, kuba ku nnamba y’amangu mu kitundu kyo (911 mu Amerika ne Canada, . 112 okwetoloola omukago gwa Bulaaya, . 999 mu Bungereza) oba kebera ku dayirekita yaffe eya ennamba z’amangu.
Kino kikole kati¶
- TONYIGA "Reset this PC -> Remove everything" oba okukoppa nga tozibye amaaso
0-bytefayiro okuva muC:\Windows\System32\config\RegBack\: Bw’oba oddukacopy C:\Windows\System32\config\RegBack\* C:\Windows\System32\config\ku Windows 10 (1803+) oba Windows 11 nga tokebeddedir RegBackokusooka, ojja kuwandiika ku hives zo eza registry eziyonooneddwa ekitundu na0-bytefayiro empty, okusaanyaawo ebiyumba ebisigaddewo n’okukaluubiriza ennyo okuddamu okukola. - Boot mu mbeera y'okuzzaawo Windows (
WinRE) n’okuggulawoTroubleshoot -> Advanced options -> Command Prompt: - Singa Windows eremererwa okutandika emirundi esatu egy’omuddiring’anwa, etongoza Automatic Repair -> Advanced options.
- Ekirala, tandika okuva ku Windows 10 / 11 USB Installation Media yonna, nyweza ** .
Shift + F10** (obaShift + Fn + F10ku laptops) ddala ku screen y’okulonda olulimi olusooka, n’okugulumizibwaX:\Sources>Command Prompt eggulawo mangu nga tonyiga mu menus. - Funa ennukuta ya drive entuufu ey'ekitundu kyo ekya Windows (
diskpart -> list vol), nga bwe kitera okubaD:obaE:munda mu WinRE, SSIC:: Munda mu mbeera y'okudda engulu, .C:etera okuweebwa ku megabyte 100System ReservedobaRecoverypartition nga okuteekebwako kwo okwa Windows kwennyini kutudde kuD:obaE:. Ddukadir C:\Windows, .dir D:\Windows, .dir E:\Windowsokukakasa ebbaluwa ya drive ki erimu\Windows\System32\config\. - Bulijjo back up by'obaddewo (ne bwe bimenyese)
config\folda okutuuka kuC:\Config_Backup\NGA TONNAkwata ku fayiro emu: Ddukamkdir D:\Config_Backuperaxcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Backup. Olina okukuuma fayiro zombi ettaano ezisookerwako ez’ekiyumba (SYSTEM, .SOFTWARE, .SAM, .SECURITY, .DEFAULT) ne fayiro zaabwe ez'ebiwandiiko by'okutunda ebikwekeddwa (SYSTEM.LOG1, .SYSTEM.LOG2, .SOFTWARE.LOG1, .SOFTWARE.LOG2). - Nga tonnaba kukyusa kiyumba kyonna, kebera oba
BCD(Boot Configuration Data) okusalako oba ekiwandiiko ky'okutunda mu kiyumba ekicaafu (.LOG1/ ..LOG2) kye kivaako ddalaBAD_SYSTEM_CONFIG_INFO: - Mu
30%waBAD_SYSTEM_CONFIG_INFOBSODs, registry hives ziri bulungi 100 ku 100 ate nga...BCDstore simply erina ayonoonesetruncatememory/ .numprocebendera (msconfigomutego) oba ebyetaagoreg loadokuddamu okuzannya.LOG1/ ..LOG2ekiwandiiko ky’okutunda mu ngeri ey’otoma. - Singa
SYSTEMobaSOFTWAREddala eyonoonese, ggyayo kkopi ennungi butereevu okuva mu VSS Shadow Copy (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\) nga bakozesavssadmin list shadows: Ne bwe kibaSystem Restore (rstrui.exe)eremererwa n'ensobi mu GUI, voliyumu ya VSS Shadow Copy eyali wansi eriwo ku disiki era ekusobozesa okukoppa nga nnyonjoSYSTEMeraSOFTWAREhives butereevu mu\Windows\System32\config\nga bakozesacopyobarobocopy.
Danger
Towandiikangako SAM oba SECURITY nga erina backup ya myezi okuggyako nga fayiro ezo entono bbiri entongole bwe ziri 0 bytes oba okwonooneka: Kumpi ebitundu 99 ku 100 eby’okugwa kwa registry bikosa ** zokka .SYSTEM** (15 MB okutuuka ku 30 MB) oba SOFTWARE (80 MB okutuuka ku 150 MB), kubanga hives ezo ebbiri ziwandiikibwa buli kiseera mu kiseera kya boot ne Windows Updates. Omu SAM (Security Accounts Manager, mu ngeri entuufu 64 KB okutuuka ku 256 KB) ne SECURITY hives kwata hashes z'ekigambo kyo eky'omukozesa w'omu kitundu n'ekigambo ky'okuyingira ekyesiga akawunti y'ekyuma kya domain ($machine.ACC). Singa owandiika ku bulamu obulungi SAM era SECURITY hive ne shadow copy ey’emyezi 2 ku Active Directory domain-joined PC oba oluvannyuma lw’okukyusa password, ojja kumenya enkolagana y’okwesiga domain (The trust relationship between this workstation and the primary domain failed) oba okuggala enkyukakyuka mu bigambo by’okuyingira mu kitundu gye buvuddeko. Kikyuseemu yokka ekiyumba ekigere (SYSTEM oba SOFTWARE) ekiremererwa eki reg load okugezesebwa mu Mutendera 2.
Omuti gw'okusalawo: BAD_SYSTEM_CONFIG_INFO (0x00000074) ne 0xc000014c okulonda mu registry¶
Kozesa flowchart eno okuva mu... WinRE Ekiragiro ekisaba (Shift + F10) okulaga fayiro yennyini eyonoonese n'okugizzaawo nga tofiiriddwa pulogulaamu eziteekeddwa oba akawunti z'abakozesa:
flowchart TD
Start["Windows Egwa ku Boot: BAD_SYSTEM_CONFIG_INFO (0x74) oba 0xc000014c"] --> OpenCmd["Boot mu WinRE oba Windows USB -> Ggulawo Ekiragiro (Shift + F10)"]
OpenCmd --> FindDrive["Funa Ennukuta Entuufu eya Windows Drive (e.g. D:) ng'oyita mu: diskpart -> list vol -> okufuluma"]
FindDrive --> BackupFirst["Back Up Folda ya Config eriwo kati (Omuli ne .LOG1/.LOG2 Ekwekeddwa): xcopy /h D:\\Windows\\System32\\config D:\\Config_Orig\\"]
BackupFirst --> CheckBcd["Kebera 1: Duka bcdedit -> Waliwo eyateekawo truncatememory oba numproc mu msconfig?"]
CheckBcd -->|"Yee: truncatememory oba badvalue Eriwo"| FixBcd["Run: bcdedit /deletevalue {default} truncatememory AND bcdedit /deletevalue {default} numproc -> Reboot"]
CheckBcd -->|"Nedda: BCD Clean"| TestReplay["Kebera 2: Gezesa & Okuddamu okuzannya ebiwandiiko by'okutunda (.LOG1/.LOG2) ku Buli Hive nga oyita mu reg load HKLM\\TempHive"]
TestReplay --> WhichBroken{"Reg load Ewangudde era Eddamu Okuzannya .LOG1/.LOG2 Mu Buyonjo?"}
WhichBroken -->|"Yee: reg load Ezzeemu okuzannya Dirty Transaction Log -> Unload nga oyita mu reg unload"| BootFixed["Reboot PC: Omutwe gwa Hive omucaafu gutereezeddwa mu kifo nga Zero Rollback"]
WhichBroken -->|"Nedda: SYSTEM oba SOFTWARE Ezzaayo 'Datase y'ebiwandiiko by'okusengeka eyonoonese' oba Is 0 Bytes"| CheckVss["Run: vssadmin olukalala lw'ebisiikirize"]
CheckVss --> HasVss{"Kopi z'ekisiikirize kya Volume Ziwandiikiddwa (HarddiskVolumeShadowCopy1..N)?"}
HasVss -->|"Yee: Kopi z’Ekisiikirize Ziriwo"| CopyVss["Koppa Hive YOKKA Eyonooneddwa (e.g. SYSTEM / SOFTWARE) okuva ku HarddiskVolumeShadowCopyN Empya okudda ku D:\\Windows\\System32\\config\\"]
HasVss -->|"Nedda: 0 Kopi z'Ekisiikirize Ziwandiikiddwa"| CheckAlt["Kebera Ensonda Endala Ennyonyi: D:\\Windows\\System32\\config\\TxR\\ OBA Windows.old OBA WinSxS Component Hive Repair"]
Omutendera 1: Lwaki BAD_SYSTEM_CONFIG_INFO kibaawo era lwaki RegBack bwereere mu Windows 10/11¶
Nga tonnakyusa fayiro zonna munda \Windows\System32\config\, tegeera fayiro ettaano eza registry hive kye zikola ddala era lwaki ez’ennono RegBack enkola tekyakola.
1. Ensengekera y’omubiri (Anatomy) ya \Windows\System32\config\¶
Nga Windows kernel (ntoskrnl.exe) ne Boot Loader (winload.efi) batandika nga batandika, batikka fayiro ttaano eza binary database (eziyitibwa Hives, nga zitandikira ku 4-byte ASCII signature regf ku byte 0) okuva ku \Windows\System32\config\:
| Registry Hive Erinnya lya Fayiro | Ekkubo ly'okuwandiisa Liteekeddwa mu regedit |
Size ya Fayiro Ennungi eya bulijjo | Kiki Ekibaawo Singa Fayiro Eno Entongole Eyonooneka |
|---|---|---|---|
** SYSTEM ** |
HKEY_LOCAL_MACHINE\SYSTEM |
** 15 MB okutuuka ku 40 MB (15.7 million okutuuka ku 41.9 million bytes) . |
Okulemererwa kwa boot mu bwangu (0xc000014c) oba BAD_SYSTEM_CONFIG_INFO (0x00000074): winload.efi asoma SYSTEM nga kernel tennatandika na kumanya bavuzi ki abatereka (storahci.sys, . stornvme.sys), obuweereza, ne ControlSet001 parameters za hardware okutikka. |
** SOFTWARE ** |
HKEY_LOCAL_MACHINE\SOFTWARE |
** 80 MB okutuuka ku 200 MB (83.8 million okutuuka ku 209.7 million bytes) . |
Agwa oluvannyuma katono mu boot (BAD_SYSTEM_CONFIG_INFO oba CRITICAL_PROCESS_DIED nga tonnatuuka ddala ku screen y’okuyingira) ddi smss.exe / . winlogon.exe etikka kiraasi za Windows, enkola, n'ebitundu ebiteekeddwamu manifests. |
** SAM ** |
HKEY_LOCAL_MACHINE\SAM |
** 64 KB okutuuka ku 256 KB ** |
Database ya akawunti y'abakozesa mu kitundu (RID 500 Administrator, abakozesa mu kitundu). Tekitera kwonooneka okuggyako nga disiki ejjudde. |
** SECURITY ** |
HKEY_LOCAL_MACHINE\SECURITY |
** 64 KB okutuuka ku 512 KB ** |
Ekitongole ky’ebyokwerinda mu kitundu (LSA) ebyama, ebisumuluzo by'ekyuma kya BitLocker/DPAPI, n'ekigambo ky'okuyingira eky'okwesiga kompyuta eky'omu kitundu kya Active Directory. Tekitera kwonooneka. |
** DEFAULT ** |
HKEY_USERS\.DEFAULT |
** 256 KB okutuuka ku 2 MB ** |
Ensengeka za profile ku... LOCAL SYSTEM (S-1-5-18) pre-login desktop (awali screen y'okuyingira yennyini). |
** *.LOG1 & *.LOG2 (Fayiro z'enkola ezikwese) |
Ebiwandiiko by’okutunda mu maaso ku buli kiyumba (SYSTEM.LOG1, . SYSTEM.LOG2) . |
** 256 KB okutuuka ku 8 MB ** |
Critical: Buli Windows lw'ekyusa hive, ewandiika enkyukakyuka ku .LOG1 / . .LOG2 okusooka nga tonnalongoosa base regf omutwe (Primary Sequence Number == Secondary Sequence Number). |
2. Lwaki C:\Windows\System32\config\RegBack bwereere mu Windows 10 (1803+) ne Windows 11¶
Okuva ku Windows XP okuyita mu Windows 10 version 1709, omulimu ogutegekeddwa ogwatuumibwa erinnya \Microsoft\Windows\Registry\RegIdleBackup ekoppebwa mu ngeri ey’otoma SYSTEM, . SOFTWARE, . SAM, . SECURITY, era DEFAULT munda \Windows\System32\config\RegBack\ buli lwe yabanga enkola eno tekola.
- Microsoft kye yakyusa: Okutandika mu Windows 10 version 1803 (May 2018) n’okugenda mu maaso okuyita mu buli kufulumizibwa kwa Windows 11, Microsoft yalemesa mu butongole automatic RegBack omuwendo gw'abantu nga bwe guli okukendeeza ku kigere kya disiki (ekiwandiikiddwa mu Microsoft Support KB4509719).
- Ekyavuddemu: Okujjako nga oyongeddeko mu ngalo EnablePeriodicBackup = 1 DWORD okutuuka ku HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager nga PC yo tennagwa, ng'ekola dir D:\Windows\System32\config\RegBack ajja kulaga ** .0 File(s)** (oba fayiro ttaano ez'obunene 0 bytes).
- Why you still have a backup: Even though RegBack is empty, Windows 10 and Windows 11 automatically create Volume Shadow Copy (VSS) snapshots before Windows Updates, MSI application installs, driver installations, and weekly restore checkpoints. Every VSS snapshot contains a complete, point-in-time frozen copy of \Windows\System32\config\.
Omutendera 2: Okutereeza okw’amangu okutali kwa kudda mabega (msconfig BCD Omutego & . .LOG1/.LOG2 Okuddamu Okuzannya Enkolagana)¶
Before replacing SYSTEM oba SOFTWARE okuva ku kkopi y'ekisiikirize, gezaako bino ebibiri ebitereeza zero-rollback mu WinRE Ekiragiro ekisaba (Shift + F10). Ebisukka mu kitundu ku byonna BAD_SYSTEM_CONFIG_INFO (0x00000074) crashes are resolved right here in under 60 seconds without rolling back a single setting.
Omutendera 1: Laba ennukuta yo entuufu eya Windows drive (D: vs C:) n’okudda emabega config\¶
Mu... X:\Sources> Eddirisa lya Command Prompt, funa ennukuta ya drive ki ekwata okuteekebwa kwo okwa Windows:
Size era Label empagi okulaba ennukuta ki drive (C:, . D:, oba E:) ye kitundu kyo ekikulu ekya Windows OS (ku ndagiriro eno yonna, tujja kukozesa D:; kyusa ebbaluwa yo entuufu ey’okuvuga).
Amangu ago kola backup enzijuvu eya D:\Windows\System32\config (nga okozesa /h bwe kityo kikwese .LOG1 era .LOG2 fayiro z’okutunda zirimu:
mkdir D:\Config_Emergency_Backup
xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Emergency_Backup
Omutendera 2: Kebera Fix A: Waliwo eyakyuka Number of processors oba Maximum memory mu msconfig?¶
Ebiwandiiko ebitongole ebya Microsoft ku Bug Check 0x74 (BAD_SYSTEM_CONFIG_INFO) eraga omutego ogumanyiddwa ennyo: abakozesa baggulawo msconfig -> Boot -> Advanced options oluvannyuma lw'akatambi akabi "gaming optimization", kebera Number of processors oba ** .Maximum memory** (okukiteeka ku 0 oba omuwendo omubi), n'oddamu okutandika. Amangu ddala nga ozzeemu okutandika, Windows ekubye eky’olubeerera BAD_SYSTEM_CONFIG_INFO BSOD nga tonnakwata wadde ku registry hives.
Kebera Data yo ey'okusengeka Boot (BCD) dduuka mu kiseera kino:
truncatememory, ** .numproc, oba ** .removememory**. Singa emu ku layini ezo erabika, zisazeewo mangu:
bcdedit /deletevalue {default} truncatememory
bcdedit /deletevalue {default} numproc
bcdedit /deletevalue {default} removememory
wpeutil reboot kati: PC yo ejja kutandika butereevu ku desktop.
Omutendera 3: Kebera Fix B: Ddamu okuzannya obucaafu .LOG1 / . .LOG2 hive transaction logs mu kifo nga okozesa reg load¶
Watya singa amasannyalaze gaasalwako nga Windows ewandiika SYSTEM oba SOFTWARE?
+-------------------------------------------------------------------------+
| HOW WINDOWS REGISTRY HIVE HEADER SEQUENCE NUMBERS WORK |
| |
| Base Block Header of SYSTEM Hive (First 4,096 bytes: "regf"): |
| Offset 0x04: Primary Sequence Number = 0x0004810A |
| Offset 0x08: Secondary Sequence Number = 0x00048109 (MISMATCH) |
| |
| Why it fails at boot: |
| Power died mid-write before Primary == Secondary. The missing |
| dirty pages are sitting safely inside SYSTEM.LOG1 / SYSTEM.LOG2. |
| If winload.efi cannot reconcile the log at early boot, it throws |
| 0xc000014c or BAD_SYSTEM_CONFIG_INFO (0x74). |
| |
| How to force-replay the .LOG1/.LOG2 file in WinRE: |
| Running `reg load HKLM\Temp D:\Windows\System32\config\SYSTEM` |
| invokes the full WinRE Configuration Manager, which reads |
| SYSTEM.LOG1 + SYSTEM.LOG2, replays the dirty vector pages into |
| SYSTEM, sets Primary == Secondary, and flushes a clean hive on unload |
+-------------------------------------------------------------------------+
Gezesa buli emu ku biyumba ebitaano (SYSTEM, . SOFTWARE, . SAM, . SECURITY, . DEFAULT) omu ku omu mu WinRE Command Prompt nga ekozesa reg load:
The operation completed successfully:
Ekyo tokoma ku kukikakasa SYSTEM kisobola okutaasibwa, singa SYSTEM yalina ekivundu .LOG1/ ..LOG2 obutakwatagana mu nsengeka, . reg load yamala kuddamu kuzannya log y'okutunda n'okuddaabiriza ekiyumba mu jjukira. Kati fuumuula omutwe oguddaabiriziddwa mu ngeri enyonjo okudda ku disiki ng’ogutikkula:
- Ddamu okugezesebwa kwe kumu ddala okutikka-n’okutikkula ku SOFTWARE, . SAM, . SECURITY, era DEFAULT:
reg load HKLM\TestSoft D:\Windows\System32\config\SOFTWARE
reg unload HKLM\TestSoft
reg load HKLM\TestSam D:\Windows\System32\config\SAM
reg unload HKLM\TestSam
reg load HKLM\TestSec D:\Windows\System32\config\SECURITY
reg unload HKLM\TestSec
reg load HKLM\TestDef D:\Windows\System32\config\DEFAULT
reg unload HKLM\TestDef
reg load / . reg unload commands succeeded? Singa ekimu ku byo kyatwala sekondi 2 ku 3 okutikka (okuddamu okuzannya its .LOG1/ ..LOG2 journal) n’oluvannyuma n’etikkula bulungi, gezaako okuddamu okutandika (wpeutil reboot) kati: okuddamu okuzannya journal encaafu okuyita reg load emirundi mingi kitereeza 0xc000014c era BAD_SYSTEM_CONFIG_INFO bulikimu.
- Ate singa... reg load alemererwa ku SYSTEM oba SOFTWARE nga balina ERROR: The configuration registry database is corrupt oba The file or directory is corrupted and unreadable? Kati omanyi ekiyumba ekituufu ekimenyese (e.g., SYSTEM), era okimanyi nti ebiyumba ebirala bina biramu bulamu. Genda mu maaso amangu ddala ku Phase 3 okukyusa yokka ekiyumba ekimenyese okuva mu VSS Shadow Copy.
Omutendera 3: Okuggya Healthy Registry Hives okuva mu VSS Kopi z'Ekisiikirize (HarddiskVolumeShadowCopyN) .¶
Lwaki tuggya ekiyumba ekimenyese mu ngalo okuva mu Volume Shadow Copy mu kifo ky'okunyiga Troubleshoot -> Advanced options -> System Restore mu GUI?
1. Ekisooka, singa SYSTEM oba SOFTWARE tesobola kusomebwa, eky’ebifaananyi System Restore (rstrui.exe) omulogo atera okugwa ne System Restore failed to extract the original copy of the directory from the restore point (0x80070002 / 0x80070017).
2. Ekyokubiri, graphical System Restore ekyusa all hives era n'ezza emabega ebikumi n'ebikumi bya fayiro za driver/executable okubuna disiki, so nga okukoppa emu yokka eyonoonese SYSTEM oba SOFTWARE ekiyumba okuva HarddiskVolumeShadowCopyN kitwala sekondi 10 n’aleka ebiyumba byo ebirala (SAM, . SECURITY) obutakwatibwako.
Omutendera 1: Wandiika Volume Shadow Copies zonna eziriwo ku disiki¶
Mu... WinRE Ekiragiro, dduka:
Contained 1 shadow copies at creation time: 10/30/2026 11:14:02 PM):
Contents of shadow copy set ID: {4b9128a1-8812-4091-a910-112938475610}
Contained 1 shadow copies at creation time: 10/30/2026 11:14:02 PM
Shadow Copy ID: {99182736-1122-3344-5566-77889900aabb}
Original Volume: (D:)\\?\Volume{12345678-0000-0000-0000-100000000000}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
Shadow Copy Volume yatondebwa nga okugwa tekunnatandika (okugeza, \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2 oba HarddiskVolumeShadowCopy1).
Omutendera 2: Kakasa registry hives munda mu Shadow Copy Volume¶
Kubanga omutindo cd oba dir ebiragiro oluusi biziyira ku \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 kernel namespace path, osobola okuyisa ekkubo mu quotes eri dir, oba tonda akakwate ak’akabonero akalungi (mklink /d) ku D:\ nga osonga butereevu mu Shadow Copy:
# Create a folder symlink on D:\ pointing into the newest Shadow Copy (e.g., ShadowCopy1):
mklink /d D:\ShadowMount \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
# Inspect the file sizes and dates of the registry hives inside that Shadow Copy:
dir D:\ShadowMount\Windows\System32\config
SYSTEM (-15-35 MB) ne SOFTWARE (-80-180 MB) munda D:\ShadowMount\Windows\System32\config balina sayizi za fayiro ennungi ezitali za ziro n'ennaku ezisembyeyo.
Omutendera 3: Koppa hive(s) YOKKA eyonoonese okuva mu Shadow Copy mu D:\Windows\System32\config\¶
Ka tugambe nti okugezesebwa kwo mu Phase 2 Step 3 kwalaga nti SYSTEM eremereddwa okutikka (oba byombi SYSTEM ne ** .SOFTWARE** okugwa).
Warning
Sazaamu oba okutambuza eby'edda .LOG1 era .LOG2 fayiro z'ekiyumba ekigere ky'okyusa: Singa okyusa ekyonoonese SYSTEM fayiro n'omulamu obulungi SYSTEM file okuva mu Shadow Copy ya jjo, olina n'okutambuza oba okusazaamu eya leero SYSTEM.LOG1 era SYSTEM.LOG2 files (ze wakola edda backup D:\Config_Emergency_Backup mu Mutendera 2 Omutendera 1). Bwova ku bya leero .LOG1 era .LOG2 ng’atudde okumpi n’eya jjo SYSTEM hive, Windows eyinza okugezaako okukozesa ekiwandiiko ky'okutunda eky'ennaku zino ekitakwatagana ku hive y'eggulo.
Dduka ebiragiro bino ebituufu okukyusa ebimenyese SYSTEM (ne/oba SOFTWARE) ekiyumba ekiyonjo:
# 1. Remove the dirty .LOG1 / .LOG2 files for the hive being replaced (already backed up in D:\Config_Emergency_Backup)
attrib -h -s -r D:\Windows\System32\config\SYSTEM.LOG*
del D:\Windows\System32\config\SYSTEM.LOG1
del D:\Windows\System32\config\SYSTEM.LOG2
# 2. Copy the healthy SYSTEM hive from the Shadow Copy into D:\Windows\System32\config\
copy /y D:\ShadowMount\Windows\System32\config\SYSTEM D:\Windows\System32\config\SYSTEM
# (If SOFTWARE was ALSO broken in Phase 2 Step 3, run the same for SOFTWARE:)
attrib -h -s -r D:\Windows\System32\config\SOFTWARE.LOG*
del D:\Windows\System32\config\SOFTWARE.LOG1
del D:\Windows\System32\config\SOFTWARE.LOG2
copy /y D:\ShadowMount\Windows\System32\config\SOFTWARE D:\Windows\System32\config\SOFTWARE
# 3. Clean up the temporary symlink so you don't leave a dangling link on D:\
rmdir D:\ShadowMount
Omutendera 4: Kakasa emigugu gy’ekiyumba egyakomezeddwawo mu ngeri enyonjo (reg load) n’okukebera CurrentControlSet¶
Gezesa nti ebipya ebikoppoloddwa SYSTEM emigugu gy'ekiyumba nga girina ensobi za zero:
reg load HKLM\TestRestored D:\Windows\System32\config\SYSTEM
reg query HKLM\TestRestored\Select
reg unload HKLM\TestRestored
reg query HKLM\TestRestored\Select:
HKEY_LOCAL_MACHINE\TestRestored\Select
Current REG_DWORD 0x1
Default REG_DWORD 0x1
Failed REG_DWORD 0x0
LastKnownGood REG_DWORD 0x2
wpeutil reboot (oba ggalawo Command Prompt n'onyiga Weyongere ku Windows 10/11). PC yo ejja kutandika bulungi ku screen ya Windows login.
Omutendera 4: Watya singa vssadmin list shadows Ebiraga No items found (0 Kopi z'Ekisiikirize)?¶
Watya singa Okukuuma Enkola (VSS) yazikiddwa ddala ku drive, . RegBack bwereere, era reg load alemererwa ku SYSTEM oba SOFTWARE? Okyalina amakubo asatu ag’okuzzaawo fallback nga tonnaddamu kuteeka Windows:
Fallback 1: Okukyusa Default okutuuka ku LastKnownGood (ControlSet002) munda SYSTEM¶
Singa reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM atuuka ku buwanguzi, era BSOD (BAD_SYSTEM_CONFIG_INFO) kigenda mu maaso kubanga ekisumuluzo kya ddereeva oba service munda ControlSet001 (Current = 0x1) eyonoonese ate nga ControlSet002 (LastKnownGood = 0x2) munda mu kye kimu SYSTEM ekiyumba tekirina kamogo:
reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM
reg query HKLM\TestSys\Select
# If ControlSet002 exists (verify via: reg query HKLM\TestSys\ControlSet002), switch Default from 1 to 2:
reg add HKLM\TestSys\Select /v Default /t REG_DWORD /d 2 /f
reg unload HKLM\TestSys
F8 kubanga "Last Known Good Configuration" yaggyibwa mu menu ya boot, naye... Select\Default registry pointer munda SYSTEM n’okutuusa kati ebitiibwa ControlSet002 nga ekyusiddwa mu ngalo okuyita mu reg add.) .
Fallback 2: Kebera C:\Windows\System32\config\TxR\ era C:\Windows.old\Windows\System32\config\¶
Kebera oba ekintu kya PC ekyalongoosebwa gye buvuddeko kizimba (22H2 -> 23H2 -> 24H2) oba alina Omuddukanya Enkolagana ya Kernel (TxR) ebiwandiiko by’ebintu ebirimu:
D:\Windows.old\Windows\System32\config\SYSTEM eriwo okuva mu kulongoosa enkola ya Windows gye buvuddeko, osobola okwekenneenya n’okutaasa emiti gya hardware/service okuva mu yo, oba okuddamu okulongoosa mu bikozesebwa (Troubleshoot -> Advanced options -> Uninstall Updates -> Uninstall latest feature update).
Fallback 3: Okuzza emabega Cumulative Update essiddwako ekitundu (dism /RevertPendingActions) .¶
Buli kaseera, BAD_SYSTEM_CONFIG_INFO oba CRITICAL_PROCESS_DIED kibaawo kubanga PC yafiirwa amaanyi ku 30% mukasera Working on updates... Don't turn off your computer, okuvaawo SOFTWARE era \Windows\WinSxS\pending.xml okuva mu kukwatagana.
Okuva ku... WinRE Ekiragiro, gamba Okuweereza n'okuddukanya ebifaananyi by'okuteeka mu nkola (DISM) yingini okuzzaawo emirimu gyonna egy’okulongoosa egitaweereddwayo ku kifaananyi kya Windows ekitali ku mutimbagano (D:\):
dism /RevertPendingActions amaliriza bulungi, okusazaamu D:\Scratch n’okuddamu okutandika.
Fallback 4: Okuddaabiriza Data y'okusengeka Boot etasomebwa (BCD) sitoowa (bootrec /rebuildbcd era bcdboot) .¶
Watya singa ebiyumba byonna ebitaano ebya registry munda D:\Windows\System32\config\ okutikka n’okutikkula mu ngeri enyonjo ne reg load, naye ate PC ekyasuula 0xc000014c (The Boot Configuration Data for your PC is missing or contains errors) oba 0xc000000f? Kubanga Windows BCD fayiro ku kyo ekikwese 100 MB FAT32 EFI Enkola Ekitundu (\EFI\Microsoft\Boot\BCD) yennyini eterekeddwa mu binary y’emu ddala regf registry hive enkola nga SYSTEM era SOFTWARE, okufiirwa amaanyi kuyinza okwonoona... BCD ekiyumba ng’ogenda D:\Windows\System32\config\ nga tekukwatibwako.
Ddamu okuzimba ekipya ddala BCD hive ku EFI System Partition yo mu sikonda 15:
diskpart
list volume
# Find the 100 MB to 300 MB FAT32 EFI System Partition (e.g. Volume 2)
select volume 2
assign letter=S
exit
# Back up the old broken BCD hive and generate a fresh one from D:\Windows:
ren S:\EFI\Microsoft\Boot\BCD BCD.bak
bcdboot D:\Windows /s S: /f UEFI
Tip
Kebera obulamu bwa disiki mu SMART (wmic diskdrive get status) n'enkola ya fayiro ( .chkdsk D: /f) oluvannyuma lw'okutereka: Registry hives tezonoona out of nowhere okuggyako ng'amasannyalaze gasaliddwa mid-write, RAM erina unstable XMP/EXPO overclock, oba SSD/HDD yakola sectors embi right inside \Windows\System32\config\. Bw’omala okukola backup D:\Config_Emergency_Backup (era yakoppa ebiwandiiko byonna ebikulu eby'omukozesa off D:\Users\ ku USB drive), dduka chkdsk D: /f mu WinRE nga tonnaddamu kutandika mu Windows.
Omutendera 5: Okuddamu okusobozesa otomatiki RegBack backups mu Windows 10 ne Windows 11¶
Windows PC yo bw’emala okudda ku desktop, ddamu okusobozesa Microsoft ezimbiddwamu RegIdleBackup omulimu bwe kityo C:\Windows\System32\config\RegBack\ ejjula buli wiiki mu ngeri ey’otoma, era kakasa System Restore (VSS) akola:
- Ddamu okusobozesa otomatiki
RegBackhive backups mu Windows 10 (1803+) ne Windows 11: Ggulawo Ekiragiro ekigulumivu (Run as Administrator) era okole ekiragiro kino ekitongole ekimu eky'okuwandiisa (KB4509719):Oluvannyuma trigger omulimu gwa backup omulundi gumu amangu ddala okukakasareg add "HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager" /v EnablePeriodicBackup /t REG_DWORD /d 1 /fC:\Windows\System32\config\RegBackejjuza kkopi ennungi ez’ebiyumba byonna ebitaano: - Kakasa Obukuumi bw'Enkola (
VSSRestore Points) is turnedON-aC:: PressWin + R, typesysdm.cpl ,4, select yourC:drive, click Configure, select Turn on system protection, set Max Usage to5%(10 GBokutuuka ku25 GB), and click Create to make a clean baseline shadow copy right now. - Run
sfc /scannoweraDISM /Online /Cleanup-Image /RestoreHealthonce booted into Windows to verify no system DLLs or component store manifests (COMPONENTShive) were damaged during the crash.
Ennamba z’embeera ez’amangu mu bitundu n’ebiragiro by’ebitongole¶
While a Windows BAD_SYSTEM_CONFIG_INFO BSOD is normally an internal IT or personal computer repair issue, workstation or server failures affecting hospitals, emergency dispatch, or public infrastructure require immediate escalation:
- Amerika ne Canada: Kuba
911if a Windows crash disables clinical patient monitoring, emergency dispatch (CAD), or life-safety controls, and switch to facility downtime procedures. Report widespread enterprise bootloops caused by security agent updates or cyber incidents to CISA (1-844-Say-CISA/ .cisa.gov/report) oba Ekitongole kya Canada ekikola ku by'okwerinda ku mikutu gya yintaneeti (1-833-CYBER-88). - Bungereza: Kuba
999for threats to life or acute NHS clinical disruptions. Report major cyber or availability incidents to the NCSC (ncsc.gov.uk) or NHS England Cyber Operations. - Omukago gwa Bulaaya: Kuba
112across all EU member states. Covered entities under the NIS2 Directive must report significant operational outages to their national CSIRT within 24 hours. - Australia ne New Zealand: Kuba
000mu Australia oba111mu New Zealand; okuloopa ebizibu ebikulu ebibaddewo mu bikozesebwa eri ACSC (1300 CYBER1). - Buyindi ne Asia-Pacific: Kuba
112in India for emergency response; report infrastructure or cyber incidents to CERT-In (incident@cert-in.org.in).
Ebibuuzo ebitera okubuuzibwa¶
What if my user profile itself fails to log in after boot ("We can't sign in to your account" / Temporary Profile) because NTUSER.DAT is corrupted?¶
In addition to the five system hives inside `\Windows\System32\config\`, every individual user account has its own registry hive (`HKEY_CURRENT_USER`) stored at **`C:\Users\
Lwaki yakola WinRE ask for a 48-digit BitLocker Recovery Key before letting me open Command Prompt, when I never turned BitLocker on myself?¶
On almost all modern Windows 11 (and Windows 10) laptops with `TPM 2.0` and Modern Standby, signing in with a Microsoft Account during initial setup automatically enables **Device Encryption (`BitLocker`)** in the background and uploads your 48-digit recovery key to your Microsoft Account. Open **`https://aka.ms/myrecoverykey`** on your smartphone, sign in with the Microsoft Account (`@outlook.com`, . `@hotmail.com`, . `@gmail.com`) or Work/School Entra ID (`myaccount.microsoft.com`) used on that PC, and enter the 48-digit key matching the `Key ID` shown on screen. Once unlocked, `D:\Windows\System32\config` is completely accessible in WinRE Command Prompt.
What if copy alemererwa ne The process cannot access the file because it is being used by another process bwe ngezaako okuwandiika waggulu SYSTEM oba SOFTWARE mu WinRE?¶
Ensobi eyo ebaawo olw’emu ku nsonga bbiri: (1) wawandiika mu butanwa `C:\Windows\System32\config\SYSTEM` ddi `C:` oba `X:` mu butuufu ye disiki ya WinRE RAM ekola butereevu (`X:\Windows\System32\config\SYSTEM` esibiddwa WinRE yennyini; bulijjo kakasa ebbaluwa yo entuufu etali ku mukutu gwa SSD drive `D:` oba `E:` nga balina `diskpart -> list vol`); oba (2) wadduka `reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM` emabegako mu session ne yeerabira okudduka **`reg unload HKLM\TestSys`** nga tonnadduka `copy`.
Lwaki PC yange egwa ne BAD_SYSTEM_CONFIG_INFO (0x00000074) ne ku Windows USB installer empya ddala nga tonnakwata ku SSD?¶
Singa `BAD_SYSTEM_CONFIG_INFO` (`0x00000074`) kibaawo nga otandika **omuggo omupya ennyo ogwa Windows 10/11 USB installer** (omuteeka gy’atikka ogwayo `boot.wim` RAM registry hive mu system memory), SSD registry yo **si** ekizibu: **system RAM yo (`DDR4 / DDR5`) eyonoona ekiyumba kya registry mu memory nga bwe kisumulula**. Yingiza motherboard yo `BIOS / UEFI` okutandika (`Del` oba `F2`), okulemala `XMP / EXPO` memory overclocking profiles kale RAM etambulira ku sipiidi za JEDEC eza bulijjo, oba okugezesa n'omuggo gumu ogwa RAM omulundi gumu ng'okozesa `MemTest86`.
Asobola Antivirus oba Endpoint Detection ey’ekibiina eky’okusatu (EDR) kernel driver update ereeta BSOD loop eringa okwonooneka kwa registry?¶
Yee. Abavuzi b'obukuumi mu mbeera ya kernel (`BOOT_START` abavuzi b’ebidduka nga... `Start = 0` mu nda `HKLM\SYSTEM\ControlSet001\Services\
Kiki eki... COMPONENTS ekiyumba munda C:\Windows\System32\config\, era lwaki kiri 100 MB?¶
Okwawukanako ne `SYSTEM`, . `SOFTWARE`, . `SAM`, . `SECURITY`, era `DEFAULT` (ezitikkibwa ku buli bbuutu), **`COMPONENTS`** ekiyumba (`C:\Windows\System32\config\COMPONENTS`) etikkibwa mu ngeri ya dynamically yokka ku bwetaavu nga **Windows Update (`TiWorker.exe` / Okuweereza Okusinziira ku bitundutundu)** oba `sfc /scannow` adduka. A okwonooneka `COMPONENTS` hive **tejja** kuyimiriza Windows kutandika (`0x00000074`), wadde nga kijja kuleetera Windows Updates okulemererwa `0x80073712` okutuusa nga baddaabiriziddwa ne `DISM /Online /Cleanup-Image /RestoreHealth`.
Ebiragiro ebikwatagana nabyo¶
- Windows blue screen (BSOD) n’okuddaabiriza boot
- BitLocker, FileVault, ne LUKS okuzzaawo ensirifu okuggalawo ekisumuluzo n'okuddamu okutereeza TPM
- Firmware ya BIOS ne UEFI zitereeza ettoffaali, okufiirwa amaanyi, ne Dual-BIOS Flashback
- SSD ne NVMe mode okusoma kwokka okw'amangu, 0% spare blocks, ne TRIM okulemesa okununula
- Hard drive okulemererwa n'okuzzaawo data
- Okutereka kompyuta, enkola ya 3-2-1, n’okuddamu okukola mu mbeera y’akatyabaga
- Ennamba z’amangu okusinziira ku nsi
Ensonda n’obulagirizi obutongole¶
- Microsoft Yiga (
learn.microsoft.com): Okukebera Ebiwuka0x74:BAD_SYSTEM_CONFIG_INFOEkiwandiiko ekitongole ekikwata ku kugonjoola ebizibu (BCDtruncatememory/ .numprocOkutereeza n’okuwandiisa Hive Verification). - Obuwagizi bwa Microsoft (
KB4509719): Register y'enkola tekyali backup ku...RegBackfolda etandikira mu Windows 10 version 1803 (EnablePeriodicBackupEnsengeka y’Ekiwandiiko). - Microsoft Windows Internals (7th Edition, Russinovich et al.): Enzimba y’omuddukanya okusengeka, Enzimba y’ekiyumba ky’okuwandiisa (
regf, .hbin), ne Dual Transaction Log (.LOG1/ ..LOG2) Okuwona. - Ebiwandiiko by'okutereka Microsoft Server: Empeereza y'okukoppa ekisiikirize ky'obunene (
VSS) Enzirukanya y'emirimu (vssadmin list shadowseraGLOBALROOTOkuyingira mu kifo ky'erinnya ly'ekyuma). - Ekitongole ky’eggwanga ekikola ku mutindo ne tekinologiya (
NIST) (Amerika): Ekiwandiiko eky’enjawulo 800-86: Windows Registry Forensic Okwekenenya n’okuzzaawo.