Bindu Windows dafa yàqu (BAD_SYSTEM_CONFIG_INFO BSOD): Lu tax RegBack Dafa amul dara ci Windows 10/11 ak ni ñuy defaraat Hives ci VSS Shadow Copies¶

Gis Windows 10, Windows 11, wala Windows Server masin biy tàmbali ci Ekraŋ bu baxa bu amul àpp bu dee (BSOD) loop biy wane Stop code: BAD_SYSTEM_CONFIG_INFO (0x00000074), CRITICAL_PROCESS_DIED, wala benn ekraŋ bu ñuul buy wax \Windows\System32\config\SYSTEM is missing or contains errors (Status: 0xc000014c / 0xc0000225) dafay tekki benn wala lu ëpp ci lëmu registre binaire bu Windows (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) wala Done yiñ tëral ngir tàmbali (BCD) magasin bi dafa xottiku ci jamonoy dakkal kuuraŋ, tëjug forse, wala yeesal cumulatif bu lajj. Li yées, sudee kilifa yi topp nañu njàngale yu yàgg yi ci net bi di leen wax ñu ubbi Environmaa Recovery Windows (WinRE) Komànd Prompt ak kopie fichier registry sauvegarde ci C:\Windows\System32\config\RegBack\, ñu gis ni ** RegBack dossier bi amul dara (wala amna 0-byte dosie yi)**. Tambalee ci Windows 10 bi 1803 ak ci bépp tabax bu Windows 11, Microsoft dafa dindi ba fàww RegIdleBackup liggéey ngir sakkanal bayaalu disk bi. Bul fomp ba noppi sampaat Windows: sa PC daanaka mën na tëye ay kopi yuñ defar bu yàggul ci bépp lëmu registry bu nëbbu Serwiisu kopi lëndëm bu volume (VSS) nataal (HarddiskVolumeShadowCopyN) ak jëflante .LOG1 / .LOG2 surnaal yi nga mëna génne ci 3 simili WinRE. Ngir xam jafe-jafe BSOD yi ci dawalkat bi wala ci aparey bi, xoolal Ekraŋ bu baxa bu Windows (BSOD) ak defar boot; sudee BitLocker laaj ab caabi defaraat bu am 48 araf balaa ngay ubbi Command Prompt, xoolal BitLocker, FileVault, ak LUKS enkripsioŋ defaraat caabi tëjug ak reset TPM ak SSD ak NVMe ci saasi mode lire rek ak TRIM deactivate rescue. Sudee sistem bi dafa yàqu, dafay dindi barabu liggéeyukaay yi ci hopitaal bi, dañuy yónnee paj mu jamp (CAD), wala saytu kaaraange dundu, woo sa nimero urgence bi la gëna jege (911 ci Etats Unis ak Canada, 112 ci biir Mbootaayu Orop, 999 ci Royaume-Uni) wala nga xool sunu limu nimero paj mu jamp.

Defal lii leegi¶

1. BULEEN bës "Reset PC bii -> Dindi lépp" wala nga kopie 0-byte fichier yi C:\Windows\System32\config\RegBack\: Soo daw copy C:\Windows\System32\config\RegBack\* C:\Windows\System32\config\ ci Windows 10 (1803+) wala Windows 11 te doo xool dir RegBack njëkk, nga bind sa registry hives bu yàqu tuuti ak 0-byte fichier yu amul dara, yàq ulceer yi des ba noppi gëna yombal defaraat bi.
2. Dellu ci environmaa biy defaraat Windows (WinRE) ak ubbi Troubleshoot -> Advanced options -> Command Prompt:
3. Sudee Windows mënatul tàmbali ñetti yoon yu toppalante, ci saasi dafay tàmbali Defar ci boppam -> Tànneef yu gëna xóot.
4. Wala nga tàmbali ci bépp Media instalaasioŋ USB bu Windows 10 / 11, nga bës Shift + F10 (wala Shift + Fn + F10 ci ordinatër portable) ci ndeyjoor ci ekraŋu tànneef làkk wi njëkk, ak benn X:\Sources> Command Prompt dafay ubbeeku ci saasi te doo klike ci menu yi.
5. Wut arafu dawal bi dëgg ci sa xaaj Windows (diskpart -> list vol), ni ñu koy faral di defee D: wala E: ci biir WinRE, DU C:: Ci biir environmaa biy indiwaat, C: di faral di jox 100 megabyte System Reserved wala Recovery xaaj bi sa instalaasioŋ Windows nekk ci D: wala E:. Daw dir C:\Windows, dir D:\Windows, dir E:\Windows ngir firndeel ban arafu dawal moo am \Windows\System32\config\.
6. Deel def ab backup saa yu nekk (ba ci bu yàqu) config\ dossier C:\Config_Backup\ LAATA ngay laal benn fichier: Dawal mkdir D:\Config_Backup ak xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Backup. Danga wara denc juróomi fichier hive yi (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) ak seeni fichier journal transaction yu nëbbu (SYSTEM.LOG1, SYSTEM.LOG2, SOFTWARE.LOG1, SOFTWARE.LOG2).
7. Laata ngay wecci benn ulce, xoolal bu baax ndax BCD (Boot Configuration Data) dagg wala ab jurnaalu jëflante bu tilim (.LOG1 / .LOG2) mooy sabab dëgg BAD_SYSTEM_CONFIG_INFO:
8. ci 30% de BAD_SYSTEM_CONFIG_INFO BSODs, ulches registry yi 100 pursaa baaxnañu te BCD magasin bi amna lu yàqu truncatememory / numproc bandera (msconfig fiir) wala soxla reg load ngir jouer .LOG1/.LOG2 log jëflante ci saasi.
9. Sudee SYSTEM wala SOFTWARE dafa yàqu dëgg, genneel ab kopi bu sell ci benn kopi lëndëm bu VSS (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\) jëfandikoo vssadmin list shadows: Ba ci System Restore (rstrui.exe) ak njuumte ci GUI bi, VSS Shadow Copy volume bi nekk ci disk bi te daf lay may nga kopie bu baax SYSTEM ak SOFTWARE ulches jubal ci \Windows\System32\config\ jëfandikoo copy wala robocopy.

Garab dogal: BAD_SYSTEM_CONFIG_INFO (0x00000074) ak 0xc000014c triage registre¶

Jëfandikool diagram bii ci WinRE Komando Prompt (Shift + F10) ngir xam fichier bi yàqu ba noppi defaraat ko te doo ñàkk prograam yiñ samp wala kontu jëfandikukat yi:

flowchart TD
    Start["Windows dafay daanu ci tàmbali: SISTEM_BU BAAXU_LEERAL (0x74) wala 0xc000014c"] --> OpenCmd["Dellu ci WinRE wala Windows USB -> Ubbi ndigal (Shift + F10)"]

    OpenCmd --> FindDrive["Wut arafu disk Windows dëgg (lu melni D:) jaaraleko ci: diskpart -> limu vol -> genn"]
    FindDrive --> BackupFirst["Xcopy /h D:\\Windows\\System32\\tabb D:\\Tab_Orig\\"]

    BackupFirst --> CheckBcd["Saytu 1: Doxal bcdedit -> Ndax amna ku defar memory buy dagg wala numproc ci msconfig?"]
    CheckBcd -->|"Waaw: dagg mémoire wala valeur bu baaxul Leegi"| FixBcd["Run: bcdedit /deletevalue {default} truncatememory AND bcdedit /deletevalue {default} numproc -> Reboot"]

    CheckBcd -->|"Deet: BCD Set"| TestReplay["Saytu 2: Saytu ak joxewaat journal jëflante yi (.LOG1/.LOG2) ngir bu nekk ci Hive jaaraleko ci sargal reg HKLM\\TempHive"]

    TestReplay --> WhichBroken{"Ndax reg load amna ndam ba noppi joxewaat .LOG1/.LOG2 ci anam wu sell?"}
    WhichBroken -->|"Waaw: reg sargal Journal transaction bu tilim buñu delloosi -> Yebbi jaaraleko ci reg yebbi"| BootFixed["Reboot PC: Boppu Hive bu tilim ñu defar ko ci barab bi te amul benn Rollback"]

    WhichBroken -->|"Deet: SISTEM wala LOSISEEL Delloosi 'Base de done registry tabb' wala 0 Bytes"| CheckVss["Dawal: vssadmin limu lëndëm"]

    CheckVss --> HasVss{"Ndax ay kopi lëndëm volume am nañu ci limu (kopi lëndëm volume1..N)?"}

    HasVss -->|"Waaw: Amna ay Kopi Shadow"| CopyVss["Kopiel DU REKK lu yàqu (lu melni SISTEM / LOSISEEL) ci D: \ \ Windows \ \ Sistem32 \ \ config \\"]

    HasVss -->|"No: 0 Kopi lëndëm yuñ lim"| CheckAlt["Saytu yeneen balluwaay yi: D:\\Windows\\System32\\config\\TxR\\ WALA Windows.old WALA WinSxS"]

Faas 1: Lu tax BAD_SYSTEM_CONFIG_INFO ak lu tax RegBack amul dara ci Windows 10/11¶

Laata ngay soppali benn fichier ci biir \Windows\System32\config\, xam li juróomi fichier registry hive yi di def ak lu tax RegBack anam wi dootul dox.

1. Anatomie de \Windows\System32\config\¶

Sudee kernel Windows (ntoskrnl.exe) ak Sargeeur de démarrage (winload.efi) bi ñuy tàmbali, dañuy yab juróomi fichier base de done (ñu tuddee ko Hives, tàmbalee ci anamu siife ASCII bu 4-byte regf ci byte 0) ci \Windows\System32\config\:

2. Lu tax C:\Windows\System32\config\RegBack amul dara ci Windows 10 (1803+) ak Windows 11¶

Liko dalee ci Windows XP ba ci Windows 10 1709, liggéey buñ waajal bu tuddu \Microsoft\Windows\Registry\RegIdleBackup kopie ci saasi SYSTEM, SOFTWARE, SAM, SECURITY, ak DEFAULT ci \Windows\System32\config\RegBack\ saa yu sistem bi nekkee inactif. - Li Microsoft soppi: Tàmbali ci Windows 10 1803 (mee 2018) ba noppi wéy ci bépp génne bu Windows 11, Microsoft dafa dindi otomatik RegBack nit ñi dañu ko jagleel ngir wàññi emprent disk bi (ñu bind ko ci Jàppale Microsoft KB4509719). - Resultaa bi: Xana mu fekk nga yokk EnablePeriodicBackup = 1 DWORD ngir HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager balaa sa PC di tas, di daw dir D:\Windows\System32\config\RegBack dina wane 0 File(s) (wala juróomi fichier yu tollu 0 byte). - Li tax nga am backup ba leegi: Doonte RegBack amul dara, Windows 10 ak Windows 11 dañuy sos ci saasi Kopie lëndëm bu bari (VSS) snapshots balaa yeesali Windows, samp gi aplikaasioŋu MSI, samp dawalkat yi, ak saytu defaraat ayu-bis bu nekk. Bépp nataalu VSS dafa am kopi buñ jëlee ci waxtu \Windows\System32\config\.

2ème étape: saafara yu gaaw yudul dellu ginaaw (msconfig BCD fiir & .LOG1/.LOG2 Replay jëflante)¶

Laata ngay wecci SYSTEM wala SOFTWARE ci benn kopi lëndëm, natt ñaari defar yii zero-rollback ci WinRE Komando Prompt (Shift + F10). Lu ëpp genn-wàll ci ñoom ñépp BAD_SYSTEM_CONFIG_INFO (0x00000074) crash yi deñuy saafara fii ci diir bu néew 60 seconde te doo dellu ginaaw benn paramet.

Jéego 1: Xam sa arafu dawal Windows dëgg (D: vs C:) ak backup config\¶

ci X:\Sources> Palanteer biy joxe komand, nga seet ban arafu dawal mooy tëye sa instalaasioŋ Windows:

diskpart
list volume
exit

Defal ci saasi ab backup bu mat D:\Windows\System32\config (jëfandikoo /h nëbbu lool .LOG1 ak .LOG2 Dosie jëflante yi bokk nañu ci):

mkdir D:\Config_Emergency_Backup
xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Emergency_Backup

Xool saafara A: Ndax amna ku soppi Number of processors wala Maximum memory ci msconfig?¶

Këyitu ofisel bu Microsoft ngir saytu ay njuumte 0x74 (BAD_SYSTEM_CONFIG_INFO) dafay wane fiir bu siiw: jëfandikukat yi ubbi nañu **msconfig -> Tambali -> Tànneef yu xóot yi ** topp wideo "optimisation jeu" bu baaxul, xool Number of processors wala Maximum memory (def ko ci 0 wala valeur bu baaxul), nga tàmbaliwaat. Biñu delloo ci saasi, Windows dafay dem ba fàww BAD_SYSTEM_CONFIG_INFO BSOD balaa sax laal registry uches.

Saytu sa done tabb Boot (BCD) magasin leegi:

bcdedit /enum {default}

bcdedit /deletevalue {default} truncatememory
bcdedit /deletevalue {default} numproc
bcdedit /deletevalue {default} removememory

Xool Fix B: Replay tilim .LOG1 / .LOG2 hive jëflante logs ci barab bi jëfandikoo reg load¶

Sudee kuuraŋ bi dafa dagg bi Windows di bind ci SYSTEM wala SOFTWARE?

+-------------------------------------------------------------------------+
| HOW WINDOWS REGISTRY HIVE HEADER SEQUENCE NUMBERS WORK                  |
|                                                                         |
| Base Block Header of SYSTEM Hive (First 4,096 bytes: "regf"):           |
|   Offset 0x04: Primary Sequence Number   = 0x0004810A                   |
|   Offset 0x08: Secondary Sequence Number = 0x00048109 (MISMATCH)        |
|                                                                         |
| Why it fails at boot:                                                   |
|   Power died mid-write before Primary == Secondary. The missing         |
|   dirty pages are sitting safely inside SYSTEM.LOG1 / SYSTEM.LOG2.      |
|   If winload.efi cannot reconcile the log at early boot, it throws      |
|   0xc000014c or BAD_SYSTEM_CONFIG_INFO (0x74).                          |
|                                                                         |
| How to force-replay the .LOG1/.LOG2 file in WinRE:                      |
|   Running `reg load HKLM\Temp D:\Windows\System32\config\SYSTEM`        |
|   invokes the full WinRE Configuration Manager, which reads             |
|   SYSTEM.LOG1 + SYSTEM.LOG2, replays the dirty vector pages into        |
|   SYSTEM, sets Primary == Secondary, and flushes a clean hive on unload |
+-------------------------------------------------------------------------+

Saytu bu nekk ci juróomi ulse yi (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) benn-benn ci WinRE Komànd Prompt jëfandikoo reg load:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM

reg unload HKLM\TestSys

reg load HKLM\TestSoft D:\Windows\System32\config\SOFTWARE
reg unload HKLM\TestSoft

reg load HKLM\TestSam D:\Windows\System32\config\SAM
reg unload HKLM\TestSam

reg load HKLM\TestSec D:\Windows\System32\config\SECURITY
reg unload HKLM\TestSec

reg load HKLM\TestDef D:\Windows\System32\config\DEFAULT
reg unload HKLM\TestDef

3ème étape: dindi ay Hives Registre yu wér ci VSS Kopi lëndëm (HarddiskVolumeShadowCopyN)¶

Lan moo tax ñuy dindi ulceer bu yàqu bi ak loxo ci Volume Shadow Copy ludul klike ci **Dindi jafe-jafe -> Tànneef yu gëna xóot -> Defaraat sistem ** ci GUI bi? 1. Bi njëkk, sudee SYSTEM wala SOFTWARE mënul lire, graphique bi System Restore (rstrui.exe) wizard dafay faral di tas ak System Restore failed to extract the original copy of the directory from the restore point (0x80070002 / 0x80070017). 2. Ñaareel ba mooy, graphic System Restore dafay wecci lépp hives ba noppi delloosi téemeeri dawalkat / fichier executable ci disk bi, fekk kopie benn bu yàqu SYSTEM wala SOFTWARE ulce de HarddiskVolumeShadowCopyN Dafay jël 10 seconde ba noppi bàyyi sa yeneen ultiseer (SAM, SECURITY) kenn laalu ko.

Jéego 1: Lim bépp Volume Shadow Copies bu am ci disk bi¶

ci WinRE Prompt komand, daw:

vssadmin list shadows

Contents of shadow copy set ID: {4b9128a1-8812-4091-a910-112938475610}
   Contained 1 shadow copies at creation time: 10/30/2026 11:14:02 PM
      Shadow Copy ID: {99182736-1122-3344-5566-77889900aabb}
         Original Volume: (D:)\\?\Volume{12345678-0000-0000-0000-100000000000}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

2ème étape: Saytu registry bi ci biir Volume Copy Shadow¶

Ndax standard cd wala dir komand yi yenn saa yi dañuy tëf ci \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 kernel namespace yoon, mën nga joxe yoon wi ci biir guillemets ngir dir, wala nga sos lëkkalekaay bu am màndarga (mklink /d) ci kaw D:\ di joxoñ ndànk ci Shadow Copy bi:

# Create a folder symlink on D:\ pointing into the newest Shadow Copy (e.g., ShadowCopy1):
mklink /d D:\ShadowMount \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

# Inspect the file sizes and dates of the registry hives inside that Shadow Copy:
dir D:\ShadowMount\Windows\System32\config

3ème étape: Kopiel DU (s) lu yàqu ci Shadow Copy ci D:\Windows\System32\config\¶

Xalaatal sa examen ci 2 eelu jéego bi dafa wane ni SYSTEM mënatul sarse (wala ñoom ñaar SYSTEM ak SOFTWARE lajj).

Doxal yii ndigal ngir wecci li yàqu SYSTEM (ak/wala SOFTWARE) ulse bu sell:

# 1. Remove the dirty .LOG1 / .LOG2 files for the hive being replaced (already backed up in D:\Config_Emergency_Backup)
attrib -h -s -r D:\Windows\System32\config\SYSTEM.LOG*
del D:\Windows\System32\config\SYSTEM.LOG1
del D:\Windows\System32\config\SYSTEM.LOG2

# 2. Copy the healthy SYSTEM hive from the Shadow Copy into D:\Windows\System32\config\
copy /y D:\ShadowMount\Windows\System32\config\SYSTEM D:\Windows\System32\config\SYSTEM

# (If SOFTWARE was ALSO broken in Phase 2 Step 3, run the same for SOFTWARE:)
attrib -h -s -r D:\Windows\System32\config\SOFTWARE.LOG*
del D:\Windows\System32\config\SOFTWARE.LOG1
del D:\Windows\System32\config\SOFTWARE.LOG2
copy /y D:\ShadowMount\Windows\System32\config\SOFTWARE D:\Windows\System32\config\SOFTWARE

# 3. Clean up the temporary symlink so you don't leave a dangling link on D:\
rmdir D:\ShadowMount

4ème étape: Saytu ndax lëmu lëmu defaraat bi set na (reg load) nga xool CurrentControlSet¶

Saytu nga xam ndax li ñuy sooga kopie SYSTEM hive dafay sargal amul benn njuumte:

reg load HKLM\TestRestored D:\Windows\System32\config\SYSTEM
reg query HKLM\TestRestored\Select
reg unload HKLM\TestRestored

HKEY_LOCAL_MACHINE\TestRestored\Select
    Current    REG_DWORD    0x1
    Default    REG_DWORD    0x1
    Failed     REG_DWORD    0x0
    LastKnownGood    REG_DWORD    0x2

Faas 4: Sudee vssadmin list shadows Dafay wane No items found (0 Kopi lëndëm)?¶

Ak sudee Aar Sistem (VSS) dafa mujjee fay ci dawalkat bi, RegBack amul dara, te reg load Fail ci SYSTEM wala SOFTWARE? Ba leegi am nga ñetti yooni defaraat fallback balaa ngay sampaat Windows:

Dellu ginaaw 1: Wecci Default ngir LastKnownGood (ControlSet002) ci biir SYSTEM¶

Sudee reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM amna ndam, ak BSOD (BAD_SYSTEM_CONFIG_INFO) mingi am ndax dawalkat bi wala caabi serwiis bi ci biir ControlSet001 (Current = 0x1) dafa yàqu ControlSet002 (LastKnownGood = 0x2) ci biir benn SYSTEM ulche bi amul benn sikk:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM
reg query HKLM\TestSys\Select
# If ControlSet002 exists (verify via: reg query HKLM\TestSys\ControlSet002), switch Default from 1 to 2:
reg add HKLM\TestSys\Select /v Default /t REG_DWORD /d 2 /f
reg unload HKLM\TestSys

Delloosi 2: Xool C:\Windows\System32\config\TxR\ ak C:\Windows.old\Windows\System32\config\¶

Saytu ndax PC biñ yeesal amna man-man yuñ defar (22H2 -> 23H2 -> 24H2) wala am Kernel njiitu jëflante (TxR) logs conteneur:

dir /a D:\Windows.old\Windows\System32\config
dir /a D:\Windows\System32\config\TxR

Fallback 3: Delloosi yeesal buñ samp ci genn-wàll (dism /RevertPendingActions)¶

lu bari, BAD_SYSTEM_CONFIG_INFO wala CRITICAL_PROCESS_DIED Dafa am ndax PC bi daa ñàkk kuuraŋ ci 30% ci diiru Working on updates... Don't turn off your computer, dem SOFTWARE ak \Windows\WinSxS\pending.xml sinkronisewul. ci WinRE Komànd Prompt, wax Serwiis ak Doxal Nataalu Jëfandikoo (DISM) motër ngir delloosi bépp jëflante yeesal buñu deful ci nataalu Windows bu nekkul ci lëkkaloo (D:\):

mkdir D:\Scratch
dism /Image:D:\ /Cleanup-Image /RevertPendingActions /ScratchDir:D:\Scratch

Fallback 4: Defar ay done yuñ mënatul jàng ngir tabb (BCD) magasin (bootrec /rebuildbcd ak bcdboot)¶

Ak sudee juróomi registry yi yépp ñu ngi ci biir D:\Windows\System32\config\ yab ak wàcce bu baax ak reg load, ba leegi PC bi dafay sànni 0xc000014c (The Boot Configuration Data for your PC is missing or contains errors) wala 0xc000000f? Ndax Windows BCD fichier ci sa hidden 100 MB FAT32 EFI Xaajale Sistem (\EFI\Microsoft\Boot\BCD) ci boppam denc nañu ko ci benn binar regf format hive registry SYSTEM ak SOFTWARE, ñàkkum kuuraŋ mën na yàq BCD ulche bi ngay dem D:\Windows\System32\config\ laalul. Tabaxaat ab kër bu bees BCD Hive ci sa xaaj sistem EFI ci 15 seconde:

diskpart
list volume
# Find the 100 MB to 300 MB FAT32 EFI System Partition (e.g. Volume 2)
select volume 2
assign letter=S
exit

# Back up the old broken BCD hive and generate a fresh one from D:\Windows:
ren S:\EFI\Microsoft\Boot\BCD BCD.bak
bcdboot D:\Windows /s S: /f UEFI

5ème étape: Delloosi otomatik RegBack saaga ci Windows 10 ak Windows 11¶

Soo delloo sa ordinatër Windows ci sa biro, nga tàmbaliwaat Microsoft RegIdleBackup liggéey C:\Windows\System32\config\RegBack\ dafay fees ci saasi ayu-bis bu nekk, ba noppi xool Defaraat Sistem (VSS) dafay dox:

• Aktiwisewaat otomatik RegBack (1803+) ak Windows 11: Ubbi ab bataaxal bu yéeg (Run as Administrator) nga def benn komand registry ofisel bii (KB4509719):

  reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager" /v EnablePeriodicBackup /t REG_DWORD /d 1 /f
  

  Ginaaw loolu nga def backup bi benn yoon ci saasi ngir xool C:\Windows\System32\config\RegBack fees ak ay kopi yu wér ci juróomi ulse yi:

  schtasks /run /tn "\Microsoft\Windows\Registry\RegIdleBackup"
  dir C:\Windows\System32\config\RegBack
  

• Xam aaru sistem bi (VSS Delloosi poñ yi) dafay wëlbatiku ON pour C:: Bësal Win + R, bind sysdm.cpl ,4, tannal sa C: dawal, bësal Tabbal, tannal Taalal aaru sistem, nga def Jëfandiku bu gëna mag ci 5% (10 GB ngir 25 GB), nga bës Sosal ngir defar kopi lëndëm bu sell leegi.
• Daw sfc /scannow ak DISM /Online /Cleanup-Image /RestoreHealth buñu demee ba ci Windows ngir xool ndax amul benn DLL ci sistem bi wala dencukaay bi (COMPONENTS hive) yàqu nañu ci accident bi.

Nimero paj mu jamp ak protokolu agence¶

Windows BAD_SYSTEM_CONFIG_INFO BSOD dafay faral di nekk jafe-jafe IT bi ci biir wala defar ordinatëru bopp, station liggéey wala serwër bu yàqu buy jàpp hopitaal yi, yónnee paj mu jamp, wala infrastructure publik yi dañu soxla escalation ci saasi:

• Etats Unis ak Canada: Bësal 911 sudee Windows daanu, te dafay dindi malaad bi ci klinik bi, yónnee paj mu jamp (CAD), wala seytu kaaraange dundu, nga soppi ci doxalinu installation time downtime. Raporte CISA (1-844-Say-CISA / cisa.gov/report) wala Santu Kaaraange Siber bu Canada (1-833-CYBER-88).
• Royaume-Uni: Dial 999 ngir fitnaal dundu wala jafe-jafe klinik yu NHS. Raporte NCSC (ncsc.gov.uk) wala NHS Angleterre Operasioŋ Siber.
• Mbootaayu Ëroop: Dial 112 ci réew yépp yi bokk ci EU. Entite yiñ muur ci wàllu NIS2 Directive dañu wara yëgal seen CSIRT nasonaal ci diiru 24 waxtu su amee ay dog-dog ci liggéey.
• Ostralie ak Nouvelle-Zélande: Dial 000 ci Australie wala 111 ci Nouvelle-Zélande; xamle jafe-jafe yi am ci infrastructure yi ACSC (1300 CYBER1).
• Inde ak Asie-Pacifique: Bësal 112 ci Inde ngir tontu ci jafe-jafe; CERT-In (incident@cert-in.org.in).

Laaj yi ñuy faral di laaj¶

Sudee sama profil jëfandikukat ci boppam mënatul dugg ginaaw bimu tàmbalee ("We can't sign in to your account" / Profil temporaire) ndax NTUSER.DAT dafa yàqu?¶

Lu weesu juróomi sistem yi ci biir `\Windows\System32\config\`, kontu jëfandikukat bu nekk amna registre boppam (`HKEY_CURRENT_USER`) denc ci **`C:\Users\\NTUSER.DAT`** (yokk `AppData\Local\Microsoft\Windows\UsrClass.dat`). Sudee sa PC dafay tàmbali ci ekraŋu dugg bi baaxna, waaye dugg gi dafay sarse ab biro bu amul dara ndax `NTUSER.DAT` dafa yàqu ci jamonoy dakkal kuuraŋ, ubbi ab command prompt bu yéeg, daw `vssadmin list shadows`, nga koppi li wér `NTUSER.DAT` ci `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Users\\NTUSER.DAT` (bi nga duggee ci ñaareelu kontu administratër wala WinRE suko defee fichier bi tëjuwul).

Lu tax WinRE laaj ab caabi defaraat BitLocker bu am 48 araf balaa nga may may ubbi Prompt komand, bi musu ma taal BitLocker ci sama bopp?¶

Daanaka ci ordinatër portable yi am Windows 11 (ak Windows 10) `TPM 2.0` ak Modern Standby, dugg ci kontu Microsoft ci tabb bu njëkk bi dafay may ci saasi **Nkripsioŋ aparey (`BitLocker`)** ci ginaaw ba noppi yebbi sa caabi defaraat bu am 48 araf ci sa kontu Microsoft. Ubbi **`https://aka.ms/myrecoverykey`** ci sa telefon bu xarañ, dugg ci kontu Microsoft (`@outlook.com`, `@hotmail.com`, `@gmail.com`) wala ID dugg ci liggéey/daara (`myaccount.microsoft.com`) bi nga jëfandikoo ci PC bi, nga dugal butoŋu 48 araf bi méngoo ak `Key ID` di wane ci ekraŋ bi. Buñu ko tijji, `D:\Windows\System32\config` mën nañu ko jëfandikoo ci WinRE Komand Prompt.

Ak sudee copy fail ak The process cannot access the file because it is being used by another process Sumay jéema soppi SYSTEM wala SOFTWARE ci winre?¶

Ñaari sabab yooyu ñoo waral njuumte boobu: (1) danga juum ci bind `C:\Windows\System32\config\SYSTEM` kañ `C:` wala `X:` mooy disk RAM WinRE biy dawal ci saasi (`X:\Windows\System32\config\SYSTEM` WinRE ci boppam moo ko tëj; xool saa yu nekk sa arafu dawal SSD dëgg `D:` wala `E:` ak `diskpart -> list vol`); wala (2) danga daw `reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM` bu njëkk ci sesioŋ bi te fàtte daw **`reg unload HKLM\TestSys`** balaa ngay daw `copy`.

Lu tax sama PC di crash ak BAD_SYSTEM_CONFIG_INFO (0x00000074) sax ci instalatëru Windows USB bu bees balaa ngay laal SSD bi?¶

Sudee `BAD_SYSTEM_CONFIG_INFO` (`0x00000074`) dafay am sooy tàmbali ab **Windows 10/11 USB bu bees** (fu instalatër bi di sarse boppam `boot.wim` RAM bi dugg ci mémoire sistem bi), sa registre SSD **nekkul** jafe-jafe bi: **sa RAM sistem (`DDR4 / DDR5`) mingi yàq registry hive bi ci mémoire bi muy tijji**. Dugalal sa plaque madre `BIOS / UEFI` tabb (`Del` wala `F2`), deactivate `XMP / EXPO` profil overclocking mémoire suko defee RAM di dox ci gaawaayu JEDEC buñ miin, wala nga jàngat ko ak benn stick RAM benn yoon jëfandikoo `MemTest86`.

Ndax ab antivirus bu nekk ci digante yenen wala gis poñ mujj (EDR) yeesal dawalkatu kernel bi waral ab bouclage BSOD bu niro ak yàqu-yàqu registry?¶

Waaw. Dawalkatu kaaraange ci anam kernel (`BOOT_START` dawalkat yi ak `Start = 0` ci biir `HKLM\SYSTEM\ControlSet001\Services\`) ñu ngi leen sarse ci `winload.efi` ci wetu `SYSTEM` hive balaa Windows di tàmbali wideo bi. Sudee amna sikk `.sys` fichier ci `D:\Windows\System32\drivers\` crash ci boot, jarul sax wecci registry hive: soppi tur wi am jafe-jafe `.sys` fichier ci `D:\Windows\System32\drivers\` (wala yab `D:\Windows\System32\config\SYSTEM` ak `reg load HKLM\TestSys` ak soppi serwiis bi yàqu `Start` valeur de `0` ngir `4` [Dafa ñàkk]).

Luy COMPONENTS ci biir C:\Windows\System32\config\, ak lu tax mu nekk 100 MB?¶

wuute ak `SYSTEM`, `SOFTWARE`, `SAM`, `SECURITY`, ak `DEFAULT` (ñuy sarse ci bépp boot), **`COMPONENTS`** ulse (`C:\Windows\System32\config\COMPONENTS`) duñu ko sarse ci anam wu dinaamik suñu ko laajee sudee **Windows Update (`TiWorker.exe` / Serwiis bu sukkandiko ci komponent)** wala `sfc /scannow` daw. ab yàqu `COMPONENTS` Hive du **musa** tere Windows tàmbali (`0x00000074`), waaye dina tax yeesali Windows baña mëna dem `0x80073712` bañu defar ak `DISM /Online /Cleanup-Image /RestoreHealth`.

Gid yu jëm ci loolu¶

• Ekraŋ bu baxa bu Windows (BSOD) ak defar boot
• BitLocker, FileVault, ak LUKS enkripsioŋ defaraat caabi tëjug ak reset TPM
• BIOS ak UEFI yeesal losisel bi, ñàkkum doole, ak ñaari-BIOS Flashback
• SSD ak NVMe mode lire rek ci lu gaaw, 0% bloku reserve, ak TRIM dindi rescue
• Disque dur bi dafa yàqu ak defaraat done yi
• Sauvegarde ordinatër, pexem 3-2-1, ak defaraat ci musiba
• Nimero paj mu jamp ci réew mi

Boroom yi ak tegtali ofisel¶

• Microsoft jàng (learn.microsoft.com): Saytu Bug 0x74: BAD_SYSTEM_CONFIG_INFO Royuwaay ofisel buy saafara jafe-jafe (BCD truncatememory / numproc Remediation ak saytu Hive Registre).
• Jàppale Microsoft (KB4509719): Registre sistem bi amatul backup ci RegBack dosiye bi tàmbali ci Windows 10 1803 (EnablePeriodicBackup Tabbu Bindu).
• Microsoft Windows Internals (7 eelu edisioŋ, Russinovich ak ñeneen): Arsitektu njiitu tabb, jumtukaayu binër bu registre (regf, hbin), ak Journal de Transaction Double (.LOG1 / .LOG2) Recuperation.
• Këyitu dencukaay serwëru Microsoft: Serwiisu kopie lëndëm volume (VSS) liggéey (vssadmin list shadows ak GLOBALROOT Accesu ci barabu tur aparey).
• Institut national de normes et de technologie (NIST) (Etats Unis): Publikaasioŋ buñ jagleel 800-86: Jàngat ak defaraat Registre Windows.