Windows Registry Hive e Senyehile (BAD_SYSTEM_CONFIG_INFO BSOD): Hobaneng RegBack Ha e na letho ho Windows 10/11 le Mokhoa oa ho Khutlisa Hives ho tsoa ho VSS Shadow Copies¶

Ho bona Windows 10, Windows 11, kapa mochini oa Windows Server o senyeha ha o qala ho kena ho Blue Screen of Death e sa feleng (BSOD) ho bonts'a loop Stop code: BAD_SYSTEM_CONFIG_INFO (0x00000074), CRITICAL_PROCESS_DIED, kapa skrine e ntšo ea Windows Boot Manager e bolelang \Windows\System32\config\SYSTEM is missing or contains errors (Status: 0xc000014c / 0xc0000225) e bolela e le 'ngoe kapa tse ngata tsa Windows' core binary registry hives (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) kapa Data Configuration Data (BCD) lebenkele le ile la taboha nakong ea ho tima motlakase, ho tima ka likhoka, kapa ho hloleha ho ntlafatsa ntlafatso. Ho hobe le ho feta, ha batsamaisi ba latela lithupelo tsa khale tsa marang-rang tse ba bolellang hore ba bule Windows Recovery Environment (WinRE) Laela Prompt le ho kopitsa lifaele tsa ngoliso ea backup ho tsoa C:\Windows\System32\config\RegBack\, ba fumana hore the RegBack foldareng ha e na letho (kapa e na le 0-byte lifaele). Ho qala ka Windows 10 mofuta oa 1803 le meahong eohle ea Windows 11, Microsoft e holofalitse RegIdleBackup mosebetsi oa ho boloka sebaka sa disk. Se ke oa hlakola le ho kenya Windows hape: komporo ea hau e batla e ts'oere likopi tse sa tsoa etsoa tsa sebaka se seng le se seng sa ngoliso se ka har'a se patiloeng ** Tšebeletso ea Kopi ea Moriti oa Volume (VSS) linepe (HarddiskVolumeShadowCopyN)** le transaction .LOG1 / .LOG2 Likoranta tseo u ka li ntšang ka metsotso e 3 ho tsona WinRE. Bakeng sa ho rarolla mathata ka kakaretso kapa lisebelisoa tsa BSOD, bona Windows blue screen (BSOD) le tokiso ea boot; haeba BitLocker e kopa senotlolo sa ho hlaphoheloa sa linomoro tse 48 pele u bula Command Prompt, buisana BitLocker, FileVault, le LUKS encryption recovery keylockout le TPM reset le SSD le NVMe mokhoa oa ho bala feela ka tšohanyetso le TRIM e thibelang pholoso. Haeba ho hloleha ha sistimi ena ho tima lits'ebetso tsa kliniki tsa sepetlele, thomello ea tšohanyetso (CAD), kapa litaolo tsa polokeho ea bophelo, letsetsa nomoro ea hau ea tšohanyetso ea lehae (911 United States le Canada, 112 ho pholletsa le European Union, 999 United Kingdom) kapa sheba bukana ea rona ea dinomoro tsa tshohanyetso.

Etsa sena hona joale¶

1. ** U SE KE UA tobetsa "Seta hape PC ena -> Tlosa ntho e 'ngoe le e' ngoe" kapa u kopitse ka bofofu 0-byte lifaele tse tsoang ho C:\Windows\System32\config\RegBack\**: Haeba u matha copy C:\Windows\System32\config\RegBack\* C:\Windows\System32\config\ ho Windows 10 (1803+) kapa Windows 11 ntle le ho hlahloba dir RegBack pele, u tla overwrite hao ngolisoang hanyenyane senyeha hives le 0-byte lifaele tse se nang letho, ho senya li-hives tse setseng le ho etsa hore ho hlaphoheloe ho be thata haholo.
2. ** Qala ka har'a Tikoloho ea Pholoso ea Windows (WinRE) le ho bula Troubleshoot -> Advanced options -> Command Prompt**:
3. Haeba Windows e hloleha ho qala ka makhetlo a mararo ka tatellano, e tla qala ka bo eona Ho lokisa ka boits'oaro -> Likhetho tse tsoetseng pele.
4. Ntle le moo, qala ho tsoa leha e le efe Windows 10 / 11 USB Installation Media, tobetsa Shift + F10 (kapa Shift + Fn + F10 ho lilaptop) hantle skrineng sa pele sa khetho ea puo, le sebaka se phahameng X:\Sources> Command Prompt e bula hang-hang ntle le ho tobetsa ka har'a menyetla.
5. ** Fumana lengolo la 'nete la drive ea karolo ea hau ea Windows (diskpart -> list vol), joalo ka ha ho etsahala hangata D: kapa E: ka hare ho WinRE, CHE C:**: Ka hare ho tikoloho ea ho hlaphoheloa, C: hangata e abeloa ho 100 megabyte System Reserved kapa Recovery karohano ha ts'ebetso ea hau ea Windows e ntse e tsoela pele D: kapa E:. Matha dir C:\Windows, dir D:\Windows, dir E:\Windows ho netefatsa hore na lengolo la drive le na le eng \Windows\System32\config\.
6. Kamehla etsa bekapo ea hau e teng (esita le e robehileng) config\ foldara ho C:\Config_Backup\ PELE o ama faele e le nngwe: Matha mkdir D:\Config_Backup le xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Backup. U tlameha ho boloka lifaele tse hlano tsa mantlha tsa hive (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) **le ** lifaele tsa bona tse patiloeng tsa transaction log (SYSTEM.LOG1, SYSTEM.LOG2, SOFTWARE.LOG1, SOFTWARE.LOG2).
7. Pele o kenya hive leha e le efe, hlahloba hore na BCD (Boot Configuration Data) ho fokotsa kapa letlapa le litšila la hive (.LOG1 / .LOG2) ke sesosa sa sebele sa BAD_SYSTEM_CONFIG_INFO:
8. Ho 30% ea BAD_SYSTEM_CONFIG_INFO Li-BSODs, li-hives tsa registry li ntle ka liperesente tse 100 mme li BCD lebenkele le mpa le senyehile truncatememory / numproc folakha (msconfig trap) kapa litlhoko reg load ho replay the .LOG1/.LOG2 konteraka ea khoebo ka ho iketsa.
9. Haeba SYSTEM kapa SOFTWARE e hlile e senyehile, ntša kopi e phetseng hantle ka kotloloho ho VSS Shadow Copy (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\) sebelisa vssadmin list shadows: Leha ho le joalo System Restore (rstrui.exe) e hloleha ka phoso ho GUI, molumo oa VSS Shadow Copy o ka tlase o teng ho disk mme o o lumella ho kopitsa o hloekile. SYSTEM le SOFTWARE hives ka kotloloho ho \Windows\System32\config\ tshebediso copy kapa robocopy.

Sefate sa qeto: BAD_SYSTEM_CONFIG_INFO (0x00000074) le 0xc000014c registry triage¶

Sebelisa setšoantšo sena ho tloha ho WinRE Command Prompt (Shift + F10) ho supa faele e senyehileng hantle le ho e khutlisa ntle le ho lahleheloa ke mananeo a kentsoeng kapa li-account tsa mosebelisi:

flowchart TD
    Start["Windows Crashes ho Boot: BAD_SYSTEM_CONFIG_INFO (0x74) kapa 0xc000014c"] --> OpenCmd["Qala ka WinRE kapa Windows USB -> Open Command Prompt (Shift + F10)"]

    OpenCmd --> FindDrive["Fumana Lengolo la 'Nete la Windows Drive (mohlala, D:) ka: diskpart -> list vol -> exit"]
    FindDrive --> BackupFirst["Boloka Sephutheli sa Hona Joale sa Config (Ho kenyeletsoa le Patiloeng .LOG1/.LOG2): xcopy /h D:\\Windows\\System32\\config D:\\Config_Orig\\"]

    BackupFirst --> CheckBcd["Sheba 1: Matha bcdedit -> Na ho na le Motho ea Behileng truncatememory kapa numproc ho msconfig?"]
    CheckBcd -->|"E: truncatememory kapa badvalue Present"| FixBcd["Run: bcdedit /deletevalue {default} truncatememory AND bcdedit /deletevalue {default} numproc -> Reboot"]

    CheckBcd -->|"Che: BCD Hloekileng"| TestReplay["Hlahloba 2: Lekola & Bapala hape Li-logs tsa Transaction (.LOG1/.LOG2) bakeng sa E 'ngoe le e 'ngoe Hive ka reg load HKLM\\TempHive"]

    TestReplay --> WhichBroken{"Na reg load ea Atleha le ho Bapala hape .LOG1/.LOG2 Ka Hloekileng?"}
    WhichBroken -->|"E: reg load Replayed Dirty Transaction Log -> Laolla ka reg unload"| BootFixed["Reboot PC: Hlooho e Dirty Hive e Tsitsitseng Sebakeng ka Zero Rollback"]

    WhichBroken -->|"Che: SYSTEM kapa SOFTWARE E khutlisa 'Lebenkele la ngoliso ea tlhophiso le senyehile' kapa Ke 0 Byte"| CheckVss["Matha: vssadmin lethathamo la meriti"]

    CheckVss --> HasVss{"Na Likopi tsa Moriti oa Bolumo li thathamisitsoe (HarddiskVolumeShadowCopy1..N)?"}

    HasVss -->|"E: Likopi tsa Shadow li teng"| CopyVss["Kopitsa FEELA Hive e Senyehileng (mohlala, SYSTEM / SOFTWARE) ho tloha Newest HarddiskVolumeShadowCopyN ho ea D: \\ Windows \\ System32 \\ config\\"]

    HasVss -->|"Che: Likopi tse 0 tsa Shadow tse thathamisitsoeng"| CheckAlt["Sheba Mehloli e meng ea Hive: D: \\ Windows \\ System32 \\ config \\ TxR \\ KAPA Windows.old OR WinSxS Component Hive Repair"]

Mokhahlelo oa 1: Hobaneng BAD_SYSTEM_CONFIG_INFO ho etsahala le hobaneng RegBack ha e na letho ho Windows 10/11¶

Pele o fetola lifaele tse ka hare \Windows\System32\config\, utloisisa hore na lifaele tse hlano tsa hive tsa registry ha e le hantle li etsa'ng le hore na ke hobane'ng ha e le tsa setso RegBack mokhoa ha o sa sebetsa.

1. Anatomy ea \Windows\System32\config\¶

Ha Windows kernel (ntoskrnl.exe) le Bootloader (winload.efi) qala nakong ea ho qala, ba kenya lifaele tse hlano tsa li-database tsa binary (tse bitsoang ** Hives **, ho qala ka saini ea 4-byte ASCII regf ka byte 0) ho tloha \Windows\System32\config\:

2. Hobaneng C:\Windows\System32\config\RegBack ha e na letho ho Windows 10 (1803+) le Windows 11¶

Ho tloha ho Windows XP ho ea ho Windows 10 mofuta oa 1709, mosebetsi o hlophisitsoeng o bitsoang \Microsoft\Windows\Registry\RegIdleBackup kopitsoa ka boiketsetso SYSTEM, SOFTWARE, SAM, SECURITY, le DEFAULT ho kena \Windows\System32\config\RegBack\ neng kapa neng ha sistimi e ne e sa sebetse. - Seo Microsoft e se fetotseng: Ho qala ka Windows 10 mofuta oa 1803 (May 2018) le ho tsoela pele ka tokollo e ngoe le e ngoe ea Windows 11, Microsoft e holofetse ka molao RegBack palo ea baahi ka mokhoa o ikhethileng ho fokotsa sebaka sa disk (e ngotsoe ho Microsoft Support KB4509719). - Sephetho: Ntle le haeba ka bowena o kentse faele EnablePeriodicBackup = 1 DWORD ho HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager *pele PC ea hau e soahlamana, e sebetsa dir D:\Windows\System32\config\RegBack e tla bontša 0 File(s) (kapa lifaele tse hlano tsa boholo 0 li-byte). - Hobaneng o ntse o na le bekapo: Leha ho le joalo RegBack ha e na letho, Windows 10 le Windows 11 iketsetse ** Volume Shadow Copy (VSS) linepe ** pele ho Lintlafatso tsa Windows, ho kengoa ts'ebeliso ea MSI, ho kenya mokhanni, le libaka tsa tlhahlobo tsa beke le beke tsa ho khutlisa. Sets'oants'o se seng le se seng sa VSS se na le kopi e felletseng, ea nako-nako e hatselitsoeng ea \Windows\System32\config\.

Mokhahlelo oa 2: Litokiso tse potlakileng tse sa Khutliseng (msconfig BCD Trap & .LOG1/.LOG2 Papali e phetoa ea transaction)¶

Pele o fetola SYSTEM kapa SOFTWARE ho tloha kopi ea moriti, leka litokiso tsena tse peli tsa zero-rollback ho WinRE Command Prompt (Shift + F10). Ho feta halofo ea tsohle BAD_SYSTEM_CONFIG_INFO (0x00000074) likotlo li rarolloa hona mona ka tlase ho metsotsoana e 60 ntle le ho khutlisa mokhoa o le mong.

Mohato oa 1: Tseba lengolo la hau la 'nete la Windows drive (D: khahlano le C:) le ho etsa bekapo config\¶

Ho X:\Sources> Fensetere ea Command Prompt, fumana hore na ke lengolo lefe la koloi le tšoereng Windows ea hau:

diskpart
list volume
exit

Hang-hang etsa bekapo e feletseng ea D:\Windows\System32\config (sebelisa /h patiloeng joalo .LOG1 le .LOG2 lifaele tsa transaction li kenyellelitsoe):

mkdir D:\Config_Emergency_Backup
xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Emergency_Backup

Mohato oa 2: Hlahloba Lokisa A: Na ho na le motho ea fetohileng Number of processors kapa Maximum memory ho msconfig?¶

Litokomane tsa molao tsa Microsoft bakeng sa Bug Check 0x74 (BAD_SYSTEM_CONFIG_INFO) e totobatsa leraba le tummeng hampe: basebelisi ba bula **msconfig -> Boot -> Likhetho tse tsoetseng pele ** ho latela video e mpe ea "papali ea papali", hlahloba Number of processors kapa Maximum memory (ho e beha ho 0 kapa boleng bo bobe), ebe o qala hape. Hang ha e qala bocha, Windows e tla otla ka ho sa feleng BAD_SYSTEM_CONFIG_INFO BSOD pele o ama li-hives tsa ngoliso.

Sheba data ea hau ea Boot Configuration (BCD) boloka hona joale:

bcdedit /enum {default}

bcdedit /deletevalue {default} truncatememory
bcdedit /deletevalue {default} numproc
bcdedit /deletevalue {default} removememory

Mohato oa 3: Sheba Lokisa B: Bapala hape e litšila .LOG1 / .LOG2 hive transaction logs sebakeng se sebelisang reg load¶

Ho thoe'ng haeba motlakase o ne o khaotsoe ha Windows e ntse e ngolla SYSTEM kapa SOFTWARE?

+-------------------------------------------------------------------------+
| HOW WINDOWS REGISTRY HIVE HEADER SEQUENCE NUMBERS WORK                  |
|                                                                         |
| Base Block Header of SYSTEM Hive (First 4,096 bytes: "regf"):           |
|   Offset 0x04: Primary Sequence Number   = 0x0004810A                   |
|   Offset 0x08: Secondary Sequence Number = 0x00048109 (MISMATCH)        |
|                                                                         |
| Why it fails at boot:                                                   |
|   Power died mid-write before Primary == Secondary. The missing         |
|   dirty pages are sitting safely inside SYSTEM.LOG1 / SYSTEM.LOG2.      |
|   If winload.efi cannot reconcile the log at early boot, it throws      |
|   0xc000014c or BAD_SYSTEM_CONFIG_INFO (0x74).                          |
|                                                                         |
| How to force-replay the .LOG1/.LOG2 file in WinRE:                      |
|   Running `reg load HKLM\Temp D:\Windows\System32\config\SYSTEM`        |
|   invokes the full WinRE Configuration Manager, which reads             |
|   SYSTEM.LOG1 + SYSTEM.LOG2, replays the dirty vector pages into        |
|   SYSTEM, sets Primary == Secondary, and flushes a clean hive on unload |
+-------------------------------------------------------------------------+

Lekola e 'ngoe le e 'ngoe ho tse hlano (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) ka bonngoe ka bonngoe WinRE Command Prompt sebelisa reg load:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM

reg unload HKLM\TestSys

reg load HKLM\TestSoft D:\Windows\System32\config\SOFTWARE
reg unload HKLM\TestSoft

reg load HKLM\TestSam D:\Windows\System32\config\SAM
reg unload HKLM\TestSam

reg load HKLM\TestSec D:\Windows\System32\config\SECURITY
reg unload HKLM\TestSec

reg load HKLM\TestDef D:\Windows\System32\config\DEFAULT
reg unload HKLM\TestDef

Mokhahlelo oa 3: Ho hula Hives ea Registry e phetseng hantle ho tloha VSS Likopi tsa Shadow (HarddiskVolumeShadowCopyN)¶

Hobaneng re ntša hive e robehileng ka letsoho ho Volume Shadow Copy ho fapana le ho tobetsa **Troubleshoot -> Likhetho tse tsoetseng pele -> Tsosoloso ea Sistimi ** ho GUI? 1. Pele, haeba SYSTEM kapa SOFTWARE ha e balehe, ke kerafo System Restore (rstrui.exe) wizard hangata e thulana le System Restore failed to extract the original copy of the directory from the restore point (0x80070002 / 0x80070017). 2. Taba ea bobeli, graphical System Restore e nkela sebaka sa * mahibe ohle * 'me e khutlisa makholo a li-file tsa mokhanni / tse phethiloeng ka har'a disk, athe e kopitsa e le 'ngoe feela e senyehileng. SYSTEM kapa SOFTWARE hive from HarddiskVolumeShadowCopyN ho nka metsotsoana e 10 ebe o siea maqhoqho a hau a mang (SAM, SECURITY) e sa angoang.

Hata 1: Thathamisa likopi tsohle tse fumanehang tsa Moriti oa Moqolo ho disk¶

Ho WinRE Command Prompt, matha:

vssadmin list shadows

Contents of shadow copy set ID: {4b9128a1-8812-4091-a910-112938475610}
   Contained 1 shadow copies at creation time: 10/30/2026 11:14:02 PM
      Shadow Copy ID: {99182736-1122-3344-5566-77889900aabb}
         Original Volume: (D:)\\?\Volume{12345678-0000-0000-0000-100000000000}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

Mohato oa 2: Netefatsa li-hives tsa registry ka har'a Shadow Copy Volume¶

Hobane standard cd kapa dir litaelo ka linako tse ling li bipetsa \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 kernel namespace path, o ka fetisa tsela ka mantsoe a qotsitsoeng ho dir, kapa etsa sehokelo se loketseng sa tšoantšetso (mklink /d) ho D:\ ho supa ka kotloloho ho Shadow Copy:

# Create a folder symlink on D:\ pointing into the newest Shadow Copy (e.g., ShadowCopy1):
mklink /d D:\ShadowMount \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

# Inspect the file sizes and dates of the registry hives inside that Shadow Copy:
dir D:\ShadowMount\Windows\System32\config

Mohato oa 3: Kopitsa FEELA (ma)hiba (ma) a silafetseng ho tsoa ho Shadow Copy ho ea ho D:\Windows\System32\config\¶

Ha re re tlhahlobo ea hau ho Mohato oa 2 Mohato oa 3 o bonts'itse hore SYSTEM e hlotsoe ho kenya (kapa ka bobeli SYSTEM le SOFTWARE hlolehile).

Tsamaisa litaelo tsena hantle ho khutlisa tse robehileng SYSTEM (le/kapa SOFTWARE) hive ka mokhoa o hloekileng:

# 1. Remove the dirty .LOG1 / .LOG2 files for the hive being replaced (already backed up in D:\Config_Emergency_Backup)
attrib -h -s -r D:\Windows\System32\config\SYSTEM.LOG*
del D:\Windows\System32\config\SYSTEM.LOG1
del D:\Windows\System32\config\SYSTEM.LOG2

# 2. Copy the healthy SYSTEM hive from the Shadow Copy into D:\Windows\System32\config\
copy /y D:\ShadowMount\Windows\System32\config\SYSTEM D:\Windows\System32\config\SYSTEM

# (If SOFTWARE was ALSO broken in Phase 2 Step 3, run the same for SOFTWARE:)
attrib -h -s -r D:\Windows\System32\config\SOFTWARE.LOG*
del D:\Windows\System32\config\SOFTWARE.LOG1
del D:\Windows\System32\config\SOFTWARE.LOG2
copy /y D:\ShadowMount\Windows\System32\config\SOFTWARE D:\Windows\System32\config\SOFTWARE

# 3. Clean up the temporary symlink so you don't leave a dangling link on D:\
rmdir D:\ShadowMount

Mohato oa 4: Netefatsa meroalo ea hive e tsosolositsoeng ka mokhoa o hloekileng (reg load) le ho hlahloba CurrentControlSet¶

Lekola hore na e sa tsoa kopitsoa SYSTEM meroalo ea hive e nang le liphoso tse se nang letho:

reg load HKLM\TestRestored D:\Windows\System32\config\SYSTEM
reg query HKLM\TestRestored\Select
reg unload HKLM\TestRestored

HKEY_LOCAL_MACHINE\TestRestored\Select
    Current    REG_DWORD    0x1
    Default    REG_DWORD    0x1
    Failed     REG_DWORD    0x0
    LastKnownGood    REG_DWORD    0x2

Mokhahlelo oa 4: Ho thoe'ng haeba vssadmin list shadows Lipontšo No items found (0 Likopi tsa Shadow)?¶

Ho thoe'ng haeba Tšireletso ea Sisteme (VSS) e ile ea tingoa ka ho feletseng koloing, RegBack ha e na letho, le reg load hloleha ho SYSTEM kapa SOFTWARE? U ntse u na le litsela tse tharo tsa ho hlaphoheloa pele u kenya Windows hape:

Fallback 1: Fetola Default ho LastKnownGood (ControlSet002) ka hare SYSTEM¶

Haeba reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM ** e atleha **, le BSOD (BAD_SYSTEM_CONFIG_INFO) ho etsahala hobane moqhobi kapa senotlolo sa tshebeletso ka hare ControlSet001 (Current = 0x1) e senyehile ha nako e ntse e ea ControlSet002 (LastKnownGood = 0x2) ka hare ho tshoana SYSTEM hive e tiile:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM
reg query HKLM\TestSys\Select
# If ControlSet002 exists (verify via: reg query HKLM\TestSys\ControlSet002), switch Default from 1 to 2:
reg add HKLM\TestSys\Select /v Default /t REG_DWORD /d 2 /f
reg unload HKLM\TestSys

Fallback 2: Hlahloba C:\Windows\System32\config\TxR\ le C:\Windows.old\Windows\System32\config\¶

Sheba hore na PC e sa tsoa ntlafatsoa e ntse e haha ​​(22H2 -> 23H2 -> 24H2) kapa o na le Kernel Transaction Manager (TxR) likutu tsa setshelo:

dir /a D:\Windows.old\Windows\System32\config
dir /a D:\Windows\System32\config\TxR

Fallback 3: Khutlisetsa morao-rao e kentsoeng ka halofo ea Cumulative Update (dism /RevertPendingActions)¶

Hangata, BAD_SYSTEM_CONFIG_INFO kapa CRITICAL_PROCESS_DIED etsahala hobane PC e felloa ke matla ho 30% nakong Working on updates... Don't turn off your computer, ho tsamaea SOFTWARE le \Windows\WinSxS\pending.xml ha e tsamaellane. Ho tloha ho WinRE Command Prompt, bolella Ts'ebeletso le Tsamaiso ea Litšoantšo tsa Deployment (DISM) enjine ho khutlisa lits'ebetso tsohle tse sa ikemisetsoang khahlano le setšoantšo sa Windows se sa sebetseng (D:\):

mkdir D:\Scratch
dism /Image:D:\ /Cleanup-Image /RevertPendingActions /ScratchDir:D:\Scratch

Fallback 4: Ho lokisa data e sa baleheng ea Boot Configuration (BCD) lebenkele (bootrec /rebuildbcd le bcdboot)¶

Ho thoe'ng haeba tsohle tse hlano registry hives ka hare D:\Windows\System32\config\ jarisa le ho laolla ka bohloeki ka reg load, leha ho le joalo PC e ntse e lahlela 0xc000014c (The Boot Configuration Data for your PC is missing or contains errors) kapa 0xc000000f? Hobane Windows BCD faele e patiloeng 100 MB FAT32 EFI System Partition (\EFI\Microsoft\Boot\BCD) ka boeona e bolokiloe ka har'a binary e ts'oanang hantle regf registry hive sebopeho e le SYSTEM le SOFTWARE, tahlehelo ea matla e ka senya BCD hive ha o tloha D:\Windows\System32\config\ e sa angoang. Aha bocha bocha BCD Hive ho EFI System Partition ea hau ka metsotsoana e 15:

diskpart
list volume
# Find the 100 MB to 300 MB FAT32 EFI System Partition (e.g. Volume 2)
select volume 2
assign letter=S
exit

# Back up the old broken BCD hive and generate a fresh one from D:\Windows:
ren S:\EFI\Microsoft\Boot\BCD BCD.bak
bcdboot D:\Windows /s S: /f UEFI

Mokhahlelo oa 5: Ho bulela hape ka boiketsetso RegBack backups ho Windows 10 le Windows 11¶

Hang ha Windows PC ea hau e khutletse komporong ea hau, etsa hore Microsoft e kene kahare hape RegIdleBackup mosebetsi joalo C:\Windows\System32\config\RegBack\ e tlatsoa ka bo eona beke e 'ngoe le e 'ngoe, 'me u netefatse Restore ea Sistimi (VSS) e ea sebetsa:

• Bulela hape ka boiketsetso RegBack hive backups ho Windows 10 (1803+) le Windows 11: Bula Command Prompt e phahameng (Run as Administrator) ebe u tsamaisa taelo ena e le 'ngoe ea ngoliso ea semmuso (KB4509719):

  reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager" /v EnablePeriodicBackup /t REG_DWORD /d 1 /f
  

  Ebe o qala mosebetsi oa bekapo hang hang ho netefatsa C:\Windows\System32\config\RegBack e tlatsa ka likopi tse phetseng hantle tsa li-hives tse hlano:

  schtasks /run /tn "\Microsoft\Windows\Registry\RegIdleBackup"
  dir C:\Windows\System32\config\RegBack
  

• ** Netefatsa Tšireletso ea Sistimi (VSS Restore Points) e fetotsoe ON bakeng sa C:: Tobetsa Win + R, mofuta sysdm.cpl ,4, khetha ea hau C: khanna, tobetsa Lokis, khetha ** Bulela ts'ireletso ea sistimi **, beha Ts'ebeliso e Ntle ho 5% (10 GB ho 25 GB), ebe o tobetsa Create ho etsa kopi e hloekileng ea moriti hona joale.
• Matha sfc /scannow le DISM /Online /Cleanup-Image /RestoreHealth hang ha e kentsoe Windows ho netefatsa hore ha ho na li-DLL tsa sistimi kapa likarolo tsa polokelo ea likarolo (COMPONENTS hive) li senyehile nakong ea kotsi.

Linomoro tsa libaka tsa tšohanyetso le liprothokholo tsa mekhatlo¶

Ha e le Windows BAD_SYSTEM_CONFIG_INFO BSOD hangata ke taba ea ka hare ea IT kapa ea tokiso ea komporo ea motho ka mong, ho hloleha ha setsi sa mosebetsi kapa li-server tse amang lipetlele, thomello ea tšohanyetso kapa meaho ea sechaba e hloka ho eketseha hanghang:

• United States le Canada: Letsetsa 911 haeba koluoa ​​ea Windows e sitisa ho lekola bakuli ba kliniki, thomello ea tšohanyetso (CAD), kapa litaolo tsa ts'ireletso ea bophelo, le ho fetohela lits'ebetsong tsa ho fokotsa nako ea setsi. Tlaleha li-bootloops tsa likhoebo tse atileng tse bakoang ke liapdeite tsa moemeli oa ts'ireletso kapa liketsahalo tsa cyber ho CISA (1-844-Say-CISA / cisa.gov/report) kapa Setsi sa Canada sa Tšireletso ea Cyber ​​(1-833-CYBER-88).
• United Kingdom: Daela 999 bakeng sa litšokelo bophelong kapa litšitiso tse matla tsa bongaka tsa NHS. Tlaleha liketsahalo tse kholo tsa cyber kapa ho fumaneha ho NCSC (ncsc.gov.uk) kapa NHS England Cyber Operations.
• European Union: Letsetsa 112 ho phatlalla le linaha tsohle tseo e leng litho tsa EU. Mekhatlo e koahetsoeng tlas'a NIS2 Directive e tlameha ho tlaleha mathata a mangata a ts'ebetso ho CSIRT ea bona ea naha nakong ea lihora tse 24.
• Australia le New Zealand: Letsetsa 000 Australia kapa 111 New Zealand; tlaleha liketsahalo tsa bohlokoa tsa litšebeletso tsa motheo ho ACSC (1300 CYBER1).
• India le Asia-Pacific: Daela 112 India bakeng sa karabelo ea tšohanyetso; tlaleha liketsahalo tsa motheo kapa cyber ho CERT-In (incident@cert-in.org.in).

Lipotso tse botsoang khafetsa¶

Ho thoe'ng haeba profil ea ka ea mosebelisi ka boeona e hloleha ho kena kamora boot ("We can't sign in to your account" / Boemo ba Nakoana) hobane NTUSER.DAT e senyehile?¶

Ho phaella ho tse hlano tsamaiso hives ka hare `\Windows\System32\config\`, akhaonto e 'ngoe le e' ngoe ea mosebedisi e na le sebaka sa eona sa ho ngolisa (`HKEY_CURRENT_USER`) bolokoa ho **`C:\Users\\NTUSER.DAT`** (hammoho `AppData\Local\Microsoft\Windows\UsrClass.dat`). Haeba PC ea hau e kena skrineng sa ho kena hantle, empa ho kena ho jara komporo ea nakoana e se nang letho hobane `NTUSER.DAT` e ne e senyehile nakong ea ho tima ha motlakase, bula Command Prompt e phahameng, matha `vssadmin list shadows`, le ho etsisa ba phetseng hantle `NTUSER.DAT` tsoa ho `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Users\\NTUSER.DAT` (ha o ntse o kentsoe akhaonteng ea motsamaisi oa bobeli kapa WinRE kahoo faele ha e notletsoe).

Hobaneng o entse joalo WinRE kopa senotlolo sa ho khutlisa BitLocker sa linomoro tse 48 pele u ntumella ho bula Command Prompt, ha ke so ka ke itumella BitLocker?¶

Hoo e ka bang tsohle tsa sejoale-joale Windows 11 (le Windows 10) lilaptop tse nang le `TPM 2.0` le Boemo ba Sejoale-joale, ho saena ka Ak'haonte ea Microsoft nakong ea ho seta ha qalong ho etsa hore ** Encryption ea Sesebelisoa (`BitLocker`)** ka morao 'me e kenya linotlolo tsa hau tsa ho fumana lintlha tse 48 ho Akhaonto ea hau ea Microsoft. Bula **`https://aka.ms/myrecoverykey`** ho smartphone ea hau, kena ka Ak'haonte ea Microsoft (`@outlook.com`, `@hotmail.com`, `@gmail.com`) kapa ID ea Kena ea Mosebetsi/Sekolo (`myaccount.microsoft.com`) e sebelisitsoeng ho PC eo, ebe u kenya konopo ea linomoro tse 48 e tsamaellanang le `Key ID` e hlahang skrineng. Hang ha e notletsoe, `D:\Windows\System32\config` e fumaneha ka botlalo ho WinRE Command Prompt.

Ho thoe'ng haeba copy hloleha le The process cannot access the file because it is being used by another process ha ke leka ho ngola SYSTEM kapa SOFTWARE ho WinRE?¶

Phoso eo e etsahala ka lebaka le leng la mabaka a mabeli: (1) u thaepile ka phoso `C:\Windows\System32\config\SYSTEM` neng `C:` kapa `X:` ha e le hantle ke sesebelisoa sa WinRE RAM disk (`X:\Windows\System32\config\SYSTEM` e notletsoe ke WinRE ka boeona; kamehla netefatsa lengolo la hau la drive la SSD le sa sebetseng `D:` kapa `E:` ka `diskpart -> list vol`); kapa (2) u ile ua matha `reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM` pejana lenaneong mme o lebetse ho matha **`reg unload HKLM\TestSys`** pele o matha `copy`.

Hobaneng ha PC ea ka e senyeha BAD_SYSTEM_CONFIG_INFO (0x00000074) esita le ho sesebelisoa se secha sa Windows USB pele o ama SSD?¶

Haeba `BAD_SYSTEM_CONFIG_INFO` (`0x00000074`) e etsahala ha o ntse o qalisa **brand-new Windows 10/11 USB installer stick** (moo sehlomathisi se itjarisang sona. `boot.wim` Registry ea RAM e kena mohopolong oa sistimi), ngoliso ea hau ea SSD ha se** bothata: ** sistimi ea hau ea RAM (`DDR4 / DDR5`) e senya registry hive mohopolong ha e ntse e bula**. Kenya boardboard ea hau `BIOS / UEFI` setup (`Del` kapa `F2`), tima `XMP / EXPO` Memory overclocking profiles kahoo RAM e matha ka lebelo le tloaelehileng la JEDEC, kapa leka ka thupa e le 'ngoe ea RAM ka nako u sebelisa `MemTest86`.

Na ho na le Antivirus ea motho oa boraro kapa ea ho lemoha Endpoint (EDR) ntlafatso ea mokhanni oa kernel e baka loop ea BSOD e shebahalang joalo ka bobolu ba ngoliso?¶

Ee. Bakhanni ba tšireletso ba mokhoa oa Kernel (`BOOT_START` bakhanni ba nang le `Start = 0` ka hare `HKLM\SYSTEM\ControlSet001\Services\`) li laeloa ke `winload.efi` haufi le `SYSTEM` hive pele Windows e qala video. Haeba e na le sekoli `.sys` faele ka `D:\Windows\System32\drivers\` ha u le boot, ha ho hlokahale hore u nke sebaka sa registry hive: feela reha bothata `.sys` faele ka `D:\Windows\System32\drivers\` (kapa kenya `D:\Windows\System32\config\SYSTEM` ka `reg load HKLM\TestSys` 'me u fetole litšebeletso tse robehileng `Start` boleng ho tloha `0` ho `4` [E holofetse]).

Ke eng e COMPONENTS hive ka hare C:\Windows\System32\config\, 'me ke hobane'ng ha e le 100 MB?¶

Ho fapana le `SYSTEM`, `SOFTWARE`, `SAM`, `SECURITY`, le `DEFAULT` (tse kentsoeng bootng bo bong le bo bong), **`COMPONENTS`** ntloana (`C:\Windows\System32\config\COMPONENTS`) e laeloa feela ka matla ha e batloa ha ** Windows Update (`TiWorker.exe` / Ts'ebeletso e Thehiloeng ka Karolo)** kapa `sfc /scannow` mathela. Se senyehileng `COMPONENTS` hive e ke ke ea hlola e thibela Windows ho qala (`0x00000074`), leha e tla etsa hore Lintlafatso tsa Windows li hlolehe `0x80073712` ho fihlela e lokisoa ka `DISM /Online /Cleanup-Image /RestoreHealth`.

Litataiso tse amanang¶

• Windows blue screen (BSOD) le tokiso ea boot
• BitLocker, FileVault, le LUKS encryption recovery keylockout le TPM reset
• BIOS le UEFI firmware apdeite setene, tahlehelo ea matla, le Dual-BIOS Flashback
• SSD le NVMe mokhoa oa ho bala feela ka tšohanyetso, li-block tsa 0%, le pholoso e sitisang TRIM.
• Ho hloleha ha hard drive le ho hlaphoheloa ha data
• Li-backups tsa khomphutha, leano la 3-2-1, le ho hlaphoheloa ha koluoa
• Linomoro tsa maemo a tshohanyetso ho ea ka linaha

Mehloli le tataiso ea semmuso¶

• Microsoft Ithute (learn.microsoft.com): Sheba Litšitšili 0x74: BAD_SYSTEM_CONFIG_INFO Referense ea Molao ea Tharollo ea Mathata (BCD truncatememory / numproc Tokiso le Registry Hive Verification).
• Tšehetso ea Microsoft (KB4509719): Registry ea sistimi ha e sa tšehetsoa ho ea ho RegBack foldara e qalang ka Windows 10 mofuta oa 1803 (EnablePeriodicBackup Tlhophiso ea Registry).
• Microsoft Windows Internals (Khatiso ea Bo7, Russinovich et al.): * Sebopeho sa Motsamaisi oa Litlhophiso, Registry Hive Binary Structure (regf, hbin), le Dual Transaction Log (.LOG1 / .LOG2) Ho hlaphoheloa*.
• Litokomane tsa Polokelo ea Seva ea Microsoft: * Tšebeletso ea Khopi ea Moriti oa Bolumo (VSS) Tsamaiso (vssadmin list shadows le GLOBALROOT Fumana Sebaka sa Lebitso la Sesebelisoa)*.
• Setsi sa Naha sa Maemo le Thekenoloji (NIST) (United States): Phatlalatso e Khethehileng 800-86: Windows Registry Forensic Analysis and Recovery.