Umutiba w'Iyandikisha rya Windows Wononekaye (BAD_SYSTEM_CONFIG_INFO BSOD): Kubera iki RegBack Ni ubusa muri Windows 10/11 n'ingene wogarura imizinga kuva ku makopi y'igitutu ya VSS¶

Kubona imashini ya Windows 10, Windows 11, canke Windows Server igwa mu gihe co gutangura ikaja mu gicapo c’ubururu kitagira iherezo c’urupfu (BSOD) uruzitiro rwerekana Stop code: BAD_SYSTEM_CONFIG_INFO (0x00000074),CRITICAL_PROCESS_DIED, canke igicapo c'umwirabura c'Umucungerezi w'Ifunguro rya Windows kivuga \Windows\System32\config\SYSTEM is missing or contains errors (Status: 0xc000014c / 0xc0000225) bisobanura kimwe canke vyinshi mu bihimba vy'ivyandikano vya Windows (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) canke Amakuru y'Itunganywa ry'Igikoresho (BCD) iduka ryacitse mu gihe umuyagankuba wazimye, guhagarara ku nguvu, canke gusubiramwo ivy’ubuhinga bwa none. Ikibi kuruta, iyo abarongozi bakurikije inyigisho za kera zo kuri Internet zibabwira ngo bafungure Ibidukikije vyo Gusubizaho Windows (WinRE) Itegeko ry'ugusaba no gukopa amadosiye y'iyandikwa ry'ububiko kuva muri C:\Windows\System32\config\RegBack\, bavumbura ko ivyo RegBack dosiye iri ubusa (canke irimwo 0-byte amadosiye). Guhera muri Windows 10 verisiyo 1803 no mu nyubakwa zose za Windows 11, Microsoft yarazimye ubudasiba RegIdleBackup igikorwa co kubika umwanya kuri disiki. Ntuhanagure ngo wongere ushiremwo Windows: PC yawe hafi ata gukeka ko ifise kopi zitagira agasembwa, ziherutse gukorwa z’umutiba wose w’iyandikwa imbere mu Volume Shadow Copy Service (VSS) amafoto (HarddiskVolumeShadowCopyN) n'ugucuruza .LOG1 / .LOG2 ibinyamakuru ushobora gukura mu minota 3 uhereye kuri WinRE. Ku bijanye n'umushoferi rusangi canke gutorera umuti ingorane za BSOD, raba Idirisha ry'ubururu (BSOD) n'ugusanura; iyo BitLocker asaba urufunguzo rwo gusubizaho rw'imibare 48 imbere yo gufungura Command Prompt, reba BitLocker, FileVault, na LUKS gusubiza urufunguzo rwo gufunga no gusubiramwo TPM na SSD na NVMe bitunguranye gusoma gusa uburyo na TRIM guhagarika gutabara. Iyo iyo sisitemu idakora neza igatuma ibitaro vy’ubuvuzi bidakora, ubutumwa bwihutirwa (CAD), canke abajejwe gucungera ubuzima, hamagara inomero y’ivyihutirwa yo mu karere kawe (911 muri Leta Zunze Ubumwe za Amerika no muri Kanada, 112 mu bihugu vyose vy’Ubumwe bw’Uburaya, 999 mu Bwongereza) canke urabe ububiko bwacu bwa . inomero z'ivyihutirwa.

Ivyo ubikore ubu¶

1. NTUKANDE "Subiramwo iyi PC -> Kuraho vyose" canke ngo ukore kopi y'impumyi 0-byte dosiye zivuye muri C:\Windows\System32\config\RegBack\: Niwaba wiruka copy C:\Windows\System32\config\RegBack\* C:\Windows\System32\config\ ku madirisha 10 (1803+) canke amadirisha 11 utasuzumye dir RegBack mbere, uzokwandika hejuru y'imizinga yawe y'ivyandikano yononekaye bimwe bimwe n' 0-byte dosiye zitagira ikintu, zigasambura imizinga isigaye kandi zigatuma gukira bigorana cane.
2. Ifungure mu bidukikije vyo gusubizaho Windows (WinRE) hanyuma ufungure Troubleshoot -> Advanced options -> Command Prompt:
3. Iyo Windows inaniwe gufungura incuro zitatu zikurikiranye, ica ifungura Gusanura -> Amahitamwo ateye imbere.
4. Canke, gufungura kuri Windows 10 / 11 USB yo gushiramwo amakuru, ukande Shift + F10 (canke Shift + Fn + F10 ku bikoresho vy’amaboko) ku rubuga rwo guhitamwo ururimi rwa mbere, n’ururimi rwo hejuru X:\Sources> Command Prompt irafunguka ubwo nyene ata gukanda mu bimenyetso.
5. Rondera urudome rw'ukuri rw'umuduga w'umugabane wawe wa Windows (diskpart -> list vol), nk’uko bigenda kenshi . D: canke E: imbere muri WinRE, NTI C:: Imbere mu bidukikije vyo gukira, C: ni kenshi ishirwa ku megabyte 100 . System Reserved canke Recovery igice mu gihe Windows yawe nyayo iri kuri D: canke E:. Kwiruka dir C:\Windows, dir D:\Windows, dir E:\Windows kugira ngo wemeze urudome rw'umuduga rurimwo \Windows\System32\config\.
6. Igihe cose ushireho backup y'ivyo ufise (n'aho vyavunitse) config\ dosiye kuri C:\Config_Backup\ IMBERE yo gukora kuri dosiye imwe: Run mkdir D:\Config_Backup na xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Backup. Utegerezwa kuzigama izo dosiye zitanu z'intango zompi z'umutiba (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) na amadosiye yabo y'inyandiko y'ibikorwa vy'ubudandaji (SYSTEM.LOG1, SYSTEM.LOG2, SOFTWARE.LOG1, SOFTWARE.LOG2).
7. Imbere yo gusubirira umutiba uwo ari wo wose, gerageza nimba BCD (Boot Configuration Data) guca canke igitabo c'ibikorwa vy'umutiba w'umwanda (.LOG1 / .LOG2) ni yo mpamvu nyayo y’ BAD_SYSTEM_CONFIG_INFO:
8. Mu 30% ya BAD_SYSTEM_CONFIG_INFO BSODs, imizinga y’iyandikwa ni 100 kw’ijana n’i BCD ububiko bufise gusa bwononekaye truncatememory / numproc ibendera (msconfig umutego) canke ivya nkenerwa reg load gusubira gukina .LOG1/.LOG2 igitabo c'ibikorwa vy'ubudandaji ubwaco.
9. Nimba SYSTEM canke SOFTWARE ni vy’ukuri yononekaye, ukureho kopi ifise amagara meza ataco ihinduye muri VSS Shadow Copy (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\) ukoresheje vssadmin list shadows: N’igihe System Restore (rstrui.exe) n'ikosa muri GUI, umubare wo gukopa igitutu ca VSS uri kuri disiki kandi ushobora kugufasha gukopa neza SYSTEM na SOFTWARE imitiba igororotse muri \Windows\System32\config\ gukoresha copy canke robocopy.

Igiti c'ingingo: BAD_SYSTEM_CONFIG_INFO (0x00000074) na 0xc000014c gutoranya ivyanditswe¶

Koresha iki kigereranyo c'urugendo kuva ku WinRE Itegeko ry'Itegeko (Shift + F10) kugira ngo umenye neza dosiye yononekaye maze uyigarure ata gutakaza porogarama zashizwemwo canke konti z'abakoresha:

flowchart TD
    Start["Windows iragwa iyo itanguye: AMAKURU_YA_SISTEM_BIBI_YA_GUTUNGANIRA (0x74) canke 0xc000014c"] --> OpenCmd["Gufungura muri WinRE canke Windows USB -> Gufungura Itegeko (Shift + F10)"]

    OpenCmd --> FindDrive["Rondera urudome rw'ukuri rwa Windows (nk'akarorero D:) biciye kuri: igice c'umuduga -> urutonde -> gusohoka"]
    FindDrive --> BackupFirst["Gusubiza inyuma Dosiye y'Imiterere y'Ubu (Harimwo n'Ihishijwe .LOG1/.LOG2): xcopy /h D:\\Idirisha\\Sisitemu32\\imiterere D:\\Imiterere_Intango\\"]

    BackupFirst --> CheckBcd["Suzuma 1: Gukoresha bcdedit -> Hari umuntu yashizeho ububiko bw'ubwenge canke numproc muri msconfig?"]
    CheckBcd -->|"Ego: guca ububiko canke agaciro kabi Ubu"| FixBcd["Run: bcdedit /deletevalue {default} truncatememory AND bcdedit /deletevalue {default} numproc -> Reboot"]

    CheckBcd -->|"Oya: BCD Isukuye"| TestReplay["Suzuma 2: Igerageza & Subiramwo Inyandiko z'Ibikorwa (.LOG1/.LOG2) ku Mutiba wose biciye ku nzira y'umuzigo HKLM\\TempHive"]

    TestReplay --> WhichBroken{"Mbega reg load iraroranirwa kandi igasubira gukina .LOG1/.LOG2 neza?"}
    WhichBroken -->|"Ego: reg load Yasubiwemwo Igitabo c'Ibikorwa vy'Umwanda -> Gukuraho biciye kuri reg gukuraho"| BootFixed["Reboot PC: Umutwe w'umuzinga w'umwanda ushizweho mu kibanza ataco uhinduye"]

    WhichBroken -->|"Oya: SYSTEM canke SOFTWARE Igarura 'Ububiko bw'amakuru bw'inyandiko y'imiterere bwarononekaye' canke Ni 0 Bytes"| CheckVss["Kwiruka: urutonde rw'ibitutu rwa vssadmin"]

    CheckVss --> HasVss{"Mbega Kopi z'Igitutu c'Igitabo Ziri ku rutonde (IgitutuC'Igitabo1..N)?"}

    HasVss -->|"Ego: Amakopi y'igitutu arahari"| CopyVss["Kopa GUSA Umutiba Wononekaye (nk'akarorero UBURYO / PORORAMU) kuva kuri D:\\Windows\\Uburyo32\\config\\"]

    HasVss -->|"Oya: 0 Kopi z'igitutu ziri ku rutonde"| CheckAlt["Suzuma izindi nzira z'umutiba: D:\\Idirisha\\Sisitemu32\\imiterere\\TxR\\ CANKE Windows.ya kera CANKE WinSxS Igice c'umutiba"]

Icigwa ca 1: Kubera iki BAD_SYSTEM_CONFIG_INFO bishika kandi kubera iki RegBack ni ubusa muri Windows 10/11¶

Imbere yo guhindura amadosiye yose ari imbere \Windows\System32\config\, utahure ivyo amadosiye atanu y’umutiba w’iyandikwa akora mu vy’ukuri be n’igituma amadosiye y’agaciro . RegBack uburyo ntibugikora.

1. Ubuhinga bw'umubiri w' \Windows\System32\config\¶

Igihe umurongo wa Windows (ntoskrnl.exe) na Igikoresho co Gushiramwo (winload.efi) gutangura mu gihe co gutangura, bishiramwo amadosiye atanu y’urutonde rw’amakuru (yitwa Hives, atangura n’umukono wa ASCII w’amabayiti 4 regf kuri byte 0) kuva \Windows\System32\config\:

2. Kubera iki C:\Windows\System32\config\RegBack ni ubusa muri Windows 10 (1803+) na Windows 11¶

Kuva kuri Windows XP gushika kuri Windows 10 verisiyo 1709, igikorwa categekanijwe citwa . \Microsoft\Windows\Registry\RegIdleBackup bikopiwe ubwavyo SYSTEM, SOFTWARE, SAM, SECURITY, na DEFAULT muri \Windows\System32\config\RegBack\ igihe cose urutonde rwari rudakora. - Ivyo Microsoft yahinduye: Guhera mu Windows 10 verisiyo 1803 (Gitugutu 2018) no kubandanya gushika igihe cose Windows 11 isohotse, Microsoft yarazimye ku mugaragaro ubuhinga bwo kwikoresha RegBack igitigiri c'abantu ku buryo busanzwe kugira ngo ugabanye ikirenge ca disiki (vyanditswe mu Bufasha bwa Microsoft KB4509719). - Igisubizo: Keretse wongeyeko n'amaboko EnablePeriodicBackup = 1 DWORD ku HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager mbere y'uko PC yawe igwa, iriko irakora dir D:\Windows\System32\config\RegBack bizokwerekana 0 File(s) (canke amadosiye atanu y'ubunini 0 bytes). - Igituma ugifise backup: Naho RegBack ni ubusa, Windows 10 na Windows 11 zica zikora Igitutu c'Igitabo (VSS) amafoto imbere y’Ivugurura rya Windows, gushiramwo porogarama za MSI, gushiramwo umushoferi, n’ibibanza vyo gusubiramwo buri ndwi. Igishushanyo cose ca VSS kirimwo kopi yuzuye, y’igihe c’i \Windows\System32\config\.

Icigwa ca 2: Gukosora vyihuta bitasubirwamwo (msconfig BCD Umutego & .LOG1/.LOG2 Gusubiramwo ibikorwa)¶

Imbere yo gusubirira SYSTEM canke SOFTWARE kuva ku kopi y'igitutu, gerageza ibi bibiri vy'ugusubira inyuma mu WinRE Itegeko ry'Itegeko (Shift + F10). Ibirenga ica kabiri ca vyose BAD_SYSTEM_CONFIG_INFO (0x00000074) crashes zitorwa hano nyene mu masegonda atarenga 60 ata gusubira inyuma n’imwe.

Intambwe ya 1: Menya urudome rwawe rw’ukuri rwa Windows (D: vs C:) no gusubira inyuma config\¶

Mu X:\Sources> Idirisha ry'itegeko, rondera urudome rw'umuduga rufise Windows yawe:

diskpart
list volume
exit

Ubwo nyene ukore backup yuzuye ya . D:\Windows\System32\config (gukoresha /h vyihishije cane .LOG1 na .LOG2 dosiye z'ibikorwa zirimwo):

mkdir D:\Config_Emergency_Backup
xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Emergency_Backup

Intambwe ya 2: Suzuma Gukosora A: Hari uwahindutse Number of processors canke Maximum memory muri msconfig?¶

Inyandiko zemewe za Microsoft zo gusuzuma ibibazo 0x74 (BAD_SYSTEM_CONFIG_INFO) yerekana umutego uzwi cane: abakoresha barafungura msconfig -> Boot -> Amahitamwo ateye imbere akurikije videwo mbi "yo gukina neza", suzuma Number of processors canke Maximum memory (kuyishira kuri 0 canke agaciro kabi), hanyuma wongere utangure. Ubwo nyene iyo usubiye gufungura, Windows iratera ubudasiba BAD_SYSTEM_CONFIG_INFO BSOD imbere mbere yo gukora ku mizinga y’iyandikwa.

Suzuma amakuru yawe y'imiterere y'ifunguro (BCD) ububiko ubu nyene:

bcdedit /enum {default}

bcdedit /deletevalue {default} truncatememory
bcdedit /deletevalue {default} numproc
bcdedit /deletevalue {default} removememory

Intambwe ya 3: Suzuma Gukosora B: Gusubira gukina umwanda .LOG1 / .LOG2 umuzinga w'inyandiko z'ubucuruzi mu kibanza hakoreshejwe reg load¶

None iyo umuriro ucitse igihe Windows yariko irandika kuri . SYSTEM canke SOFTWARE?

+-------------------------------------------------------------------------+
| HOW WINDOWS REGISTRY HIVE HEADER SEQUENCE NUMBERS WORK                  |
|                                                                         |
| Base Block Header of SYSTEM Hive (First 4,096 bytes: "regf"):           |
|   Offset 0x04: Primary Sequence Number   = 0x0004810A                   |
|   Offset 0x08: Secondary Sequence Number = 0x00048109 (MISMATCH)        |
|                                                                         |
| Why it fails at boot:                                                   |
|   Power died mid-write before Primary == Secondary. The missing         |
|   dirty pages are sitting safely inside SYSTEM.LOG1 / SYSTEM.LOG2.      |
|   If winload.efi cannot reconcile the log at early boot, it throws      |
|   0xc000014c or BAD_SYSTEM_CONFIG_INFO (0x74).                          |
|                                                                         |
| How to force-replay the .LOG1/.LOG2 file in WinRE:                      |
|   Running `reg load HKLM\Temp D:\Windows\System32\config\SYSTEM`        |
|   invokes the full WinRE Configuration Manager, which reads             |
|   SYSTEM.LOG1 + SYSTEM.LOG2, replays the dirty vector pages into        |
|   SYSTEM, sets Primary == Secondary, and flushes a clean hive on unload |
+-------------------------------------------------------------------------+

Gerageza umwe wese muri iyo mizinga itanu (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) umwe umwe mu . WinRE Itegeko ry'ugukoresha reg load:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM

reg unload HKLM\TestSys

reg load HKLM\TestSoft D:\Windows\System32\config\SOFTWARE
reg unload HKLM\TestSoft

reg load HKLM\TestSam D:\Windows\System32\config\SAM
reg unload HKLM\TestSam

reg load HKLM\TestSec D:\Windows\System32\config\SECURITY
reg unload HKLM\TestSec

reg load HKLM\TestDef D:\Windows\System32\config\DEFAULT
reg unload HKLM\TestDef

Icigwa ca 3: Gukura imizinga y'amagara meza mu VSS Igitutu Kopi (HarddiskVolumeShadowCopyN)¶

Ni kuki dukura umutiba wavunitse n’amaboko mu Kopi y’Igitutu c’Igitabo aho gukanda Gutorera umuti ingorane -> Amahitamwo ateye imbere -> Gusubizaho Sisitemu muri GUI? 1. Ica mbere, nimba . SYSTEM canke SOFTWARE ntishobora gusomwa, igishushanyo System Restore (rstrui.exe) umupfumu kenshi aragwa na System Restore failed to extract the original copy of the directory from the restore point (0x80070002 / 0x80070017). 2. Ubwa kabiri, graphical System Restore isubirira yose imitiba kandi igasubiza inyuma amajana y'amadosiye y'umushoferi/ashobora gukorwa kuri disiki, mu gihe gukopa gusa imwe yononekaye SYSTEM canke SOFTWARE umutiba uva HarddiskVolumeShadowCopyN bifata amasegonda 10 bikava mu yindi mizinga yawe (SAM, SECURITY) ataco yakozweko.

Intambwe ya 1: Urutonde rw'Igitutu c'Igitabo cose kiri kuri disiki¶

Mu WinRE Itegeko, genda:

vssadmin list shadows

Contents of shadow copy set ID: {4b9128a1-8812-4091-a910-112938475610}
   Contained 1 shadow copies at creation time: 10/30/2026 11:14:02 PM
      Shadow Copy ID: {99182736-1122-3344-5566-77889900aabb}
         Original Volume: (D:)\\?\Volume{12345678-0000-0000-0000-100000000000}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

Intambwe ya 2: Suzuma imizinga y'iyandikwa imbere mu gitutu c'Ikopi y'Igitabo¶

Kubera ko urugero cd canke dir amabwirizwa rimwe na rimwe aranyiganyiga \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 kernel inzira y'umwanya w'amazina, ushobora guca inzira mu bivugwa kuri dir, canke ureme uruja n'uruza rw'ikigereranyo rwiza (mklink /d) kuri D:\ yerekana ugororotse muri Kopi y'Igitutu:

# Create a folder symlink on D:\ pointing into the newest Shadow Copy (e.g., ShadowCopy1):
mklink /d D:\ShadowMount \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

# Inspect the file sizes and dates of the registry hives inside that Shadow Copy:
dir D:\ShadowMount\Windows\System32\config

Intambwe ya 3: Kopa GUSA umutiba wononekaye kuva ku gitutu Kopi mu D:\Windows\System32\config\¶

Twibaze ko ikibazo cawe co mu Ciciro ca 2 Intambwe ya 3 cerekanye ko SYSTEM vyananiwe gushiramwo (canke vyose SYSTEM na SOFTWARE vyananiwe).

Gukoresha aya mabwirizwa nyayo kugira ngo usubirize ivyavunitse SYSTEM (na/canke SOFTWARE) umutiba usukuye:

# 1. Remove the dirty .LOG1 / .LOG2 files for the hive being replaced (already backed up in D:\Config_Emergency_Backup)
attrib -h -s -r D:\Windows\System32\config\SYSTEM.LOG*
del D:\Windows\System32\config\SYSTEM.LOG1
del D:\Windows\System32\config\SYSTEM.LOG2

# 2. Copy the healthy SYSTEM hive from the Shadow Copy into D:\Windows\System32\config\
copy /y D:\ShadowMount\Windows\System32\config\SYSTEM D:\Windows\System32\config\SYSTEM

# (If SOFTWARE was ALSO broken in Phase 2 Step 3, run the same for SOFTWARE:)
attrib -h -s -r D:\Windows\System32\config\SOFTWARE.LOG*
del D:\Windows\System32\config\SOFTWARE.LOG1
del D:\Windows\System32\config\SOFTWARE.LOG2
copy /y D:\ShadowMount\Windows\System32\config\SOFTWARE D:\Windows\System32\config\SOFTWARE

# 3. Clean up the temporary symlink so you don't leave a dangling link on D:\
rmdir D:\ShadowMount

Intambwe ya 4: Suzuma neza imitwaro y’umutiba yagarutse (reg load) hanyuma usuzume CurrentControlSet¶

Gerageza ko iyo nshasha yakopiwe SYSTEM umutiba ushizwemwo n'amakosa ataco amaze:

reg load HKLM\TestRestored D:\Windows\System32\config\SYSTEM
reg query HKLM\TestRestored\Select
reg unload HKLM\TestRestored

HKEY_LOCAL_MACHINE\TestRestored\Select
    Current    REG_DWORD    0x1
    Default    REG_DWORD    0x1
    Failed     REG_DWORD    0x0
    LastKnownGood    REG_DWORD    0x2

Icigwa ca 4: Bimeze gute iyo vssadmin list shadows Ivyerekana No items found (0 Kopi z’Igitutu)?¶

Bimeze gute iyo Uburinzi bwa Sisitemu (VSS) yari yazimye burundu ku muduga, RegBack ni ubusa, kandi reg load birananirwa kuri SYSTEM canke SOFTWARE? Ugifise inzira zitatu zo gusubira inyuma imbere yo gusubira gushiramwo Windows:

Gusubira inyuma 1: Guhindura Default ku LastKnownGood (ControlSet002) imbere SYSTEM¶

Niba reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM biraroranirwa, na BSOD (BAD_SYSTEM_CONFIG_INFO) biriko biraba kubera ko umushoferi canke urufunguzo rwa serivisi ruri imbere . ControlSet001 (Current = 0x1) yononekaye mu gihe . ControlSet002 (LastKnownGood = 0x2) imbere muri ivyo nyene SYSTEM umutiba ntaco ukoze:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM
reg query HKLM\TestSys\Select
# If ControlSet002 exists (verify via: reg query HKLM\TestSys\ControlSet002), switch Default from 1 to 2:
reg add HKLM\TestSys\Select /v Default /t REG_DWORD /d 2 /f
reg unload HKLM\TestSys

Gusubira inyuma 2: Suzuma C:\Windows\System32\config\TxR\ na C:\Windows.old\Windows\System32\config\¶

Suzuma nimba PC iherutse kuvugururwa ikora (22H2 -> 23H2 -> 24H2) canke afise Umuyobozi w'Ibikorwa vya Kernel (TxR) ibitabo vy'ibikoresho:

dir /a D:\Windows.old\Windows\System32\config
dir /a D:\Windows\System32\config\TxR

Gusubira inyuma 3: Gusubiza inyuma igice c'Ivugurura ry'Ivyiyumviro (dism /RevertPendingActions)¶

Kenshi, BAD_SYSTEM_CONFIG_INFO canke CRITICAL_PROCESS_DIED bishika kubera ko PC yatakaje ubushobozi ku . 30% mu gihe Working on updates... Don't turn off your computer, gusohoka SOFTWARE na \Windows\WinSxS\pending.xml biva mu guhuza. Kuva ku WinRE Itegeko ry'Itegeko, bwira Ishusho y'Ikoreshwa n'Uburongozi (DISM) moteri kugira ngo usubiremwo amafaranga yose y'ivugurura ataco yashizeho ku ishusho ya Windows itari ku murongo (D:\):

mkdir D:\Scratch
dism /Image:D:\ /Cleanup-Image /RevertPendingActions /ScratchDir:D:\Scratch

Ivyiyumviro vya 4: Gusanasana amakuru y'imiterere y'ifunguro adashobora gusomwa (BCD) ububiko (bootrec /rebuildbcd na bcdboot)¶

Bimeze gute iyo imizinga yose itanu y’iyandikwa iri imbere . D:\Windows\System32\config\ kwikorera no gukuraho neza na reg load, yamara PC iracariko iratera . 0xc000014c (The Boot Configuration Data for your PC is missing or contains errors) canke 0xc000000f? Kubera ko Windows . BCD dosiye kuri yawe yihishije 100 MB FAT32 EFI Uburyo bwo Gucapura (\EFI\Microsoft\Boot\BCD) ubwayo ibitswe muri iyo binaire nyene regf Uburyo bw'umuzinga w'iyandikisha nk' SYSTEM na SOFTWARE, gutakaza ububasha birashobora kwonona . BCD umutiba mu gihe uriko urasohoka D:\Windows\System32\config\ ataco akozweko. Gusubira kwubaka inyubakwa nshasha BCD hive ku gice cawe ca EFI mu masegonda 15:

diskpart
list volume
# Find the 100 MB to 300 MB FAT32 EFI System Partition (e.g. Volume 2)
select volume 2
assign letter=S
exit

# Back up the old broken BCD hive and generate a fresh one from D:\Windows:
ren S:\EFI\Microsoft\Boot\BCD BCD.bak
bcdboot D:\Windows /s S: /f UEFI

Icigwa ca 5: Gusubira gukoresha ubuhinga bwikora RegBack ububiko muri Windows 10 na Windows 11¶

Igihe PC yawe ya Windows isubiye ku biro, wongere ukoreshe Microsoft yubatswemwo RegIdleBackup igikorwa rero C:\Windows\System32\config\RegBack\ ni ubwo nyene buri ndwi, kandi ugenzure Gusubizaho Sisitemu (VSS) irakora:

• Subira gufungura ubwavyo RegBack (1803+) na Windows 11: Gufungura Itegeko ry'Itegeko (Run as Administrator) maze ukoreshe iri tegeko rimwe ry'iyandikwa ryemewe (KB4509719):

  reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager" /v EnablePeriodicBackup /t REG_DWORD /d 1 /f
  

  Hanyuma ushireho igikorwa co gusubiza inyuma rimwe ubwo nyene kugira ngo ugenzure C:\Windows\System32\config\RegBack yuzuye amakopi meza y’imizinga yose itanu:

  schtasks /run /tn "\Microsoft\Windows\Registry\RegIdleBackup"
  dir C:\Windows\System32\config\RegBack
  

• Suzuma Uburinzi bwa Sisitemu (VSS Gusubizaho Ingingo) irahindurwa ON kubera C:: Kanda Win + R, ubwoko sysdm.cpl ,4, hitamwo ivyawe C: umuduga, kanda Gutunganya, uhitemwo Gufungura uburinzi bwa sisitemu, ushireho Ikoreshwa ryinshi kuri 5% (10 GB ku 25 GB), hanyuma ukande Rema kugira ngo ukore kopi y'igitutu c'ishimikiro isukuye ubu nyene.
• Kwiruka sfc /scannow na DISM /Online /Cleanup-Image /RestoreHealth iyo ufunguye muri Windows kugira ngo ugenzure ko ata DLLs za sisitemu canke ububiko bw'ibice vyerekana (COMPONENTS hive) vyarononekaye mu gihe c’impanuka.

Inomero z'ivyihutirwa zo mu karere n'amategeko y'ibigo¶

Mu gihe Windows BAD_SYSTEM_CONFIG_INFO BSOD mu bisanzwe ni ikibazo co gusanura IT canke mudasobwa y’umuntu ku giti ciwe, ikibanza co gukoreramwo canke server ishobora gukora nabi mu bitaro, mu gutuma abantu bihutirwa, canke mu bikorwa remezo vya bose bisaba ko bihita bitera imbere:

• Leta Zunze Ubumwe za Amerika na Canada: Hamagara 911 iyo Windows ipfuye ibuza kugenzura abarwayi, gutumako vyihutirwa (CAD), canke uburyo bwo kugenzura ubuzima, hanyuma ugahindukira ukaja ku buryo bwo guhagarara kw’ibikorwa. Raporo y'ibibazo vy'ibigo vyakwiragiye bitewe n'ivugurura ry'abakozi b'umutekano canke ibibazo vyo kuri interineti kuri CISA (1-844-Say-CISA / cisa.gov/report) canke Ikigo ca Kanada kijejwe umutekano wo kuri Internet (1-833-CYBER-88).
• Ubwongereza: Hamagara 999 kubera ibitera ubwoba ubuzima canke ibihungabanya cane ubuvuzi bwa NHS. Raporo y'ibintu bikomeye bishika ku rubuga rwa interineti canke ku bijanye n'ukuboneka kuri NCSC (ncsc.gov.uk) canke NHS Ubwongereza Ibikorwa vy’Ikoranabuhanga.
• Ubumwe bw'Uburayi: Hamagara 112 mu bihugu vyose bigize Umuryango w’Ubumwe bw’Uburayi. Ibigo bicungiwe hakurikijwe Itegeko rya NIS2 bitegerezwa kumenyesha CSIRT y’igihugu cavyo ko ibikorwa vyabo bihagaze cane mu masaha 24.
• Ostraliya na Nouvelle-Zélande: Hamagara 000 muri Australiya canke 111 muri Nouvelle-Zélande; raporo y'ibintu bikomeye vy'ibikorwa remezo kuri ACSC (1300 CYBER1).
• Ubuhinde na Aziya-Pasifike: Hamagara 112 mu Buhindi kugira ngo haboneke inyishu zihutirwa; raporo y'ibikorwa remezo canke ibibazo vyo kuri interineti kuri CERT-In (incident@cert-in.org.in).

Ibibazo bikunda kubazwa¶

Bimeze gute iyo urutonde rwanje rw'ukoresha ubwarwo rudashobora kwinjira inyuma yo gufungura ("We can't sign in to your account" / Umwirondoro w'igihe gito) kubera ko NTUSER.DAT ni yononekaye?¶

Uretse imizinga itanu iri imbere . `\Windows\System32\config\`, konti y'ukoresha yose ifise umutiba wayo w'iyandikwa (`HKEY_CURRENT_USER`) ibitswe kuri **`C:\Users\\NTUSER.DAT`** (wongeyeko `AppData\Local\Microsoft\Windows\UsrClass.dat`). Niba PC yawe ifunguye ku rubuga rwo kwinjira ni vyiza, ariko kwinjira bishiramwo ubusa kuri desktop y’igihe gito kubera `NTUSER.DAT` yari yononekaye mu gihe umuyagankuba wazimye, gufungura Command Prompt iri hejuru, kwiruka `vssadmin list shadows`, maze ukope abafise amagara meza . `NTUSER.DAT` kuva muri `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Users\\NTUSER.DAT` (mu gihe winjiye muri konti y’umuyobozi wa kabiri canke WinRE kugira ngo dosiye ntikingiwe).

Kubera iki WinRE gusaba urufunguzo rwo gusubizaho BitLocker rw’imirongo 48 imbere y’uko unreka nfungure Command Prompt, igihe ntarigeze nfungura BitLocker jewe ubwanje?¶

Hafi ku bikoresho vyose vy’ubu bifise Windows 11 (na Windows 10) bifise `TPM 2.0` na Modern Standby, kwinjira ukoresheje Konti ya Microsoft mu gihe co gutegura ubwa mbere bica bishoboza **Ugushiramwo amakuru y'ibikoresho (`BitLocker`)** mu nyuma maze ugashira urufunguzo rwawe rwo gusubizaho rw’imirongo 48 kuri Konti yawe ya Microsoft. Gufungura **`https://aka.ms/myrecoverykey`** kuri telefone yawe, winjiremwo ukoresheje Konti ya Microsoft (`@outlook.com`, `@hotmail.com`, `@gmail.com`) canke Indangamuntu yo Kwinjira mu Kazi/Ishure (`myaccount.microsoft.com`) ikoreshwa kuri iyo PC, hanyuma winjize urufunguzo rw’imirongo 48 rujanye n’i `Key ID` yerekanwa ku rubuga. Igihe umaze gufungura, `D:\Windows\System32\config` ni ushobora gushikira vyose mu nzira y'itegeko rya WinRE.

Bimeze gute iyo copy inanirwa na The process cannot access the file because it is being used by another process iyo ngerageje kwandika SYSTEM canke SOFTWARE mu WinRE?¶

Iryo kosa riterwa n’imwe muri izo mpamvu zibiri: (1) wanditse mu mpanuka . `C:\Windows\System32\config\SYSTEM` igihe `C:` canke `X:` ni mu vy'ukuri disiki ya WinRE RAM iriko irakora (`X:\Windows\System32\config\SYSTEM` ni ugukingirwa na WinRE ubwayo; Igihe cose ugenzure ikete ryawe ry'ukuri ry'umuvuduko wa SSD `D:` canke `E:` na `diskpart -> list vol`); canke (2) warirutse `reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM` mbere y'ikiganiro maze nkibagirwa kwiruka **`reg unload HKLM\TestSys`** imbere yo kwiruka `copy`.

Ni kuki PC yanje igwa na BAD_SYSTEM_CONFIG_INFO (0x00000074) mbere no ku gikoresho gishasha ca Windows USB imbere y’uko ukora kuri SSD?¶

Niba `BAD_SYSTEM_CONFIG_INFO` (`0x00000074`) bishika igihe uriko urafungura **inkoni nshasha yo gushiramwo Windows 10/11** (aho uwushiramwo ariko arashiramwo ivyiwe `boot.wim` RAM registry hive mu bubiko bwa sisitemu), SSD yawe **si** ikibazo: **sisitemu yawe RAM (`DDR4 / DDR5`) iriko irasenyura umutiba w'iyandikwa mu bwibuke uko ufungura**. Injira mu rubaho rwawe `BIOS / UEFI` gutegura (`Del` canke `F2`), guhagarika `XMP / EXPO` ubwonko burengeye imirongo kugira ngo RAM ikore ku muvuduko usanzwe wa JEDEC, canke ugerageze n'inkoni imwe ya RAM ku gihe ukoresheje `MemTest86`.

Mbega Antivirus y'uwundi muntu canke Iherezo ry'Ibimenyetso (EDR) guhindura umushoferi wa kernel bitera uruzitiro rwa BSOD rusa n’uruswa rw’iyandikwa?¶

Egome. Umushoferi w'umutekano w'uburyo bwa Kernel (`BOOT_START` abashoferi bafise `Start = 0` imbere `HKLM\SYSTEM\ControlSet001\Services\`) zishirwako na `winload.efi` iruhande y' `SYSTEM` hive imbere y’uko Windows mbere itanguza videwo. Iyo hari akaga `.sys` dosiye muri `D:\Windows\System32\drivers\` n'aho woba utanguye, ntukeneye no gusubirira umutiba w'iyandikwa: gusa hindura izina ry'ingorane `.sys` dosiye muri `D:\Windows\System32\drivers\` (canke gutwara `D:\Windows\System32\config\SYSTEM` na `reg load HKLM\TestSys` kandi uhindure igikorwa cavunitse `Start` agaciro kuva `0` ku `4` [Umugaye]).

Ni igiki COMPONENTS umutiba imbere C:\Windows\System32\config\, kandi ni kuki ari 100 MB?¶

Bitandukanye n'ivyo `SYSTEM`, `SOFTWARE`, `SAM`, `SECURITY`, na `DEFAULT` (ivyo bishirwa ku nkweto yose), i **`COMPONENTS`** umutiba (`C:\Windows\System32\config\COMPONENTS`) ishirwako gusa mu buryo buhinduka iyo usavye igihe **Windows Update (`TiWorker.exe` / Ibikorwa bishingiye ku bice)** canke `sfc /scannow` yiruka. A yononekaye `COMPONENTS` hive **ntizokwigera** ihagarika Windows gufungura (`0x00000074`), naho nyene bizotuma Windows Updates inanirwa na . `0x80073712` gushika gusanuwe n’ `DISM /Online /Cleanup-Image /RestoreHealth`.

Inyobora zifitaniye isano¶

• Idirisha ry'ubururu (BSOD) n'ugusanura
• BitLocker, FileVault, na LUKS gusubiza urufunguzo rwo gufunga no gusubiramwo TPM
• BIOS na UEFI porogaramu nkuru y'itafari, ugutakaza ubushobozi, n'Isubira inyuma rya BIOS zibiri
• SSD na NVMe bitunguranye gusoma gusa uburyo, 0% amabuye y'inyuma, na TRIM guhagarika gukiza
• Hard drive irananirwa no gusubiza amakuru
• Ivy’ugusubiza inyuma amakuru kuri mudasobwa, ubuhinga bwa 3-2-1, n’ugusubiza ibintu mu buryo iyo habaye ibiza
• Inomero z'ivyihutirwa hakurikijwe igihugu

Amasoko n'ubuyobozi buzwi¶

• Mikorosofi Iga (learn.microsoft.com): Igenzura ry'ibikoko 0x74: BAD_SYSTEM_CONFIG_INFO Igitabo cemewe co gutorera umuti ingorane (BCD truncatememory / numproc Gusubizaho n’Igenzura ry’Umutiba w’Ivyanditswe).
• Infashanyo ya Microsoft (KB4509719): Igitabo c'ivyandikano ntikigishigikiwe ku RegBack ububiko butangura muri Windows 10 verisiyo 1803 (EnablePeriodicBackup Ivyerekeye Igitabu c'Ivyanditswe).
• Ivy'imbere muri Microsoft Windows (Igitabu ca 7, Russinovich n'abandi): Ubwubatsi bw'Umucungerezi w'Imiterere, Ubuhinga bw'Imiterere y'Ivyanditswe (regf, hbin), n’Igitabo c’Ibikorwa Bibiri (.LOG1 / .LOG2) Gukira.
• Inyandiko z'ububiko bwa Serveri ya Microsoft: Serivisi yo gukopa igitutu c'umubare (VSS) Ubuyobozi (vssadmin list shadows na GLOBALROOT Ugushikira Umwanya w'Izina ry'Igikoresho).
• Ikigo c’Igihugu c’Ivyagezwe n’Ikoranabuhanga (NIST) (Leta Zunze Ubumwe za Amerika): Igitabu kidasanzwe 800-86: Isesengura ry’Ivyanditswe vy’Ivyanditswe vya Windows n’Ivyanditswe.