Windows Registry Hive yonakele (BAD_SYSTEM_CONFIG_INFO BSOD): Kutheni RegBack Ayinanto Windows 10/11 kwaye Uzibuyisela njani iiHives kwiVSS Shadow Copies¶

Ukubona iWindows 10, Windows 11, okanye umatshini weWindows Server uphahlazeka ngexesha lokuqalisa kwiscreen esingenasiphelo sokufa (BSOD) iluphu ebonisa Stop code: BAD_SYSTEM_CONFIG_INFO (0x00000074), CRITICAL_PROCESS_DIED, okanye isikrini esimnyama seWindows Boot Manager esichaza \Windows\System32\config\SYSTEM is missing or contains errors (Status: 0xc000014c / 0xc0000225) ithetha enye okanye ngaphezulu kwi-Windows' core yobhaliso lwehives (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) okanye iData yoLungiselelo lweSiqalo (BCD) ivenkile yakrazulwa ngexesha lokucima kombane, ukuvalwa ngenkani, okanye uhlaziyo olongezelekayo aluphumelelanga. Okubi nangakumbi, xa abalawuli belandela izifundo ezidala ze-intanethi zibaxelela ukuba bavule iNdawo yoBuyiselo yeWindows (WinRE) Umyalelo okhawulezileyo kwaye ukhuphele iifayile zobhaliso ezigcinwe ngaphandle kwe C:\Windows\System32\config\RegBack\, bafumanisa ukuba i RegBack incwadi eneenkcukacha ayinanto kwaphela (okanye iqulathe 0-byte iifayile). Ukuqala ngaphakathi Windows 10 inguqulo 1803 nakuzo zonke izakhiwo ze Windows 11, uMicrosoft uye wayenza ingasebenzi ngokusisigxina RegIdleBackup umsebenzi wokugcina indawo kwidisk. Sukusula kwaye uphinde ufake iiWindows: iPC yakho iphantse yagcina injalo, iikopi ezisanda kuzibophelela kuyo yonke indawo yokubhalisa ngaphakathi efihliweyo Inkonzo yeKopi yesithunzi soMqulu (VSS) imifanekiso (HarddiskVolumeShadowCopyN) kunye nentengiselwano .LOG1 / .LOG2 iijenali onokuthi uzikhuphe ngemizuzu emi-3 kuzo WinRE. Kumqhubi jikelele okanye i-BSOD yokulungisa ingxaki, bona Isikrini esiluhlaza seWindows (BSOD) kunye nokulungiswa kwe-boot; ukuba BitLocker icela iqhosha le-48-digit yokubuyisela phambi kokuvula i-Command Prompt, qhagamshelana I-BitLocker, iFayileVault, kunye ne-LUKS yokuvala isitshixo sokubuyisela kunye nokusetha kwakhona kwe-TPM kwaye I-SSD kunye ne-NVMe imowudi yokufunda kuphela ngokukhawuleza kunye ne-TRIM yokukhubaza ukuhlangula. Ukuba le nkqubo isilela ivala izitishi zokusebenza zesibhedlele, ukuthunyelwa ngokukhawuleza (CAD), okanye ulawulo lokhuseleko lobomi, fowunela inombolo yakho kaxakeka yasekuhlaleni (911 eUnited States naseKhanada, 112 kwiManyano yaseYurophu, 999 eUnited Kingdom) okanye jonga uluhlu lwethu lwe amanani kaxakeka.

Yenza oku ngoku¶

1. ** MUSA ukucofa "Setha kwakhona le PC -> Susa yonke into" okanye ukopishe ngobumfama 0-byte iifayile ngaphandle C:\Windows\System32\config\RegBack\**: Ukuba uyabaleka copy C:\Windows\System32\config\RegBack\* C:\Windows\System32\config\ on Windows 10 (1803+) okanye Windows 11 ngaphandle kokujonga dir RegBack kuqala, uya kubhala ngaphezulu ezonakalisiweyo hives yakho yobhaliso nge 0-byte iifayile ezingenanto, ukutshabalalisa i-hives eseleyo kunye nokwenza ukubuyisela kunzima kakhulu.
2. Qalisa kwiNdawo yoBuyiselo yeWindows (WinRE) kwaye uvule Troubleshoot -> Advanced options -> Command Prompt:
3. Ukuba iWindows iyasilela ukuqalisa izihlandlo ezithathu ngokulandelelana, izindulula ngokuzenzekelayo Ulungiso oluzenzekelayo -> Iinketho eziphambili.
4. Kungenjalo, qala kuyo nayiphi na Windows 10 / 11 USB yokuFakelo Media, cofa Shift + F10 (okanye Shift + Fn + F10 kwiilaptops) ekunene kwiscreen sokukhetha ulwimi lokuqala, kunye nendawo ephakamileyo X:\Sources> I-Command Prompt ivula ngoko nangoko ngaphandle kokucofa kwiimenyu.
5. Fumana unobumba oyinyani wokuqhuba kwecandelo lakho leWindows (diskpart -> list vol), njengoko kuqhelekile D: okanye E: ngaphakathi WinRE, NOT C:: Ngaphakathi kwendawo yokubuyisela, C: ihlala inikezelwe kwi-100 megabyte System Reserved okanye Recovery isahlulelo ngelixa ufakelo lwakho lweWindows luhleli D: okanye E:. Baleka dir C:\Windows, dir D:\Windows, dir E:\Windows ukuqinisekisa ukuba ngowuphi unobumba wokuqhuba \Windows\System32\config\.
6. ** Soloko ugcina ekhoyo (nokwaphukile) config\ ifolda ukuya C:\Config_Backup\ NGAPHAMBI kokubamba ifayile enye**: Baleka mkdir D:\Config_Backup kwaye xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Backup. Kufuneka ugcine zombini iifayile ezingundoqo ezintlanu (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) kunye neefayile zabo zelog yentengiselwano efihliweyo (SYSTEM.LOG1, SYSTEM.LOG2, SOFTWARE.LOG1, SOFTWARE.LOG2).
7. Phambi kokuba utshintshe nawuphi na umqolomba, vavanya ukuba ngaba BCD (Boot Configuration Data) ukunqunyulwa okanye isithinteli setransekshini sendlu emdaka (.LOG1 / .LOG2) ngoyena nobangela BAD_SYSTEM_CONFIG_INFO:
8. Kwi 30% ye BAD_SYSTEM_CONFIG_INFO I-BSODs, i-hives yobhaliso ilungile nge-100 ekhulwini kwaye BCD ivenkile imane yonakele truncatememory / numproc iflegi (msconfig umgibe) okanye iimfuno reg load ukuyidlala kwakhona i .LOG1/.LOG2 ilog yentengiselwano ngokuzenzekelayo.
9. Ukuba SYSTEM okanye SOFTWARE yonakele ngokwenene, khupha ikopi esempilweni ngokuthe ngqo kwi-VSS Shadow Copy (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\) usebenzisa vssadmin list shadows:Nanini na System Restore (rstrui.exe) iyasilela ngemposiso kwi GUI, i VSS Shadow Khuphela umthamo wevolumu ikhona kwidiski kwaye ikuvumela ukuba ukhuphele ucoceko. SYSTEM kwaye SOFTWARE iingcingo ngqo kwi \Windows\System32\config\ usebenzisa copy okanye robocopy.

Umthi wesigqibo: BAD_SYSTEM_CONFIG_INFO (0x00000074) kunye 0xc000014c irejistri triage¶

Sebenzisa le flowu tshati kwi WinRE Umyalelo womyalelo (Shift + F10) ukukhomba eyona fayile eyonakeleyo kwaye uyibuyisele ngaphandle kokuphulukana neenkqubo ezifakiweyo okanye iiakhawunti zomsebenzisi:

flowchart TD
    Start["Ii-Windows Crashes kwi-Boot: BAD_SYSTEM_CONFIG_INFO (0x74) okanye 0xc000014c"] --> OpenCmd["Qalisa kwi-WinRE okanye kwiWindows USB -> Vula i-Command Prompt (Shift + F10)"]

    OpenCmd --> FindDrive["Fumana ILetter ye-Windows Drive eyiNyaniso (umzekelo. D:) nge: diskpart -> list vol -> exit"]
    FindDrive --> BackupFirst["NONE"]

    BackupFirst --> CheckBcd["Jonga i-1: Qhuba i-bcdedit -> Ngaba kukho umntu omisele i-truncatememory okanye i-numproc kwi-msconfig?"]
    CheckBcd -->|"Ewe: truncatememory okanye badvalue Present"| FixBcd["Run: bcdedit /deletevalue {default} truncatememory AND bcdedit /deletevalue {default} numproc -> Reboot"]

    CheckBcd -->|"Hayi: I-BCD iCoca"| TestReplay["Jonga isi-2: Uvavanyo kunye nokuPhinda udlale iiLogi zeNtengiselwano (.LOG1/.LOG2) kwiHive nganye ngomthwalo wereg HKLM\\TempHive"]

    TestReplay --> WhichBroken{"Ngaba ireg load Iphumelele kwaye Udlale kwakhona i.LOG1/.LOG2 Ngokucocekileyo?"}
    WhichBroken -->|"Ewe: Ukulayisha kwakhona kweReg Replayed Dirty Transaction Log -> Khupha ngokulayisha kwakhona"| BootFixed["Qalisa kabusha iPC: Intloko emdaka yeHive eFaxiwe kwiNdawo eneZero Rollback"]

    WhichBroken -->|"Hayi: SYSTEM okanye SOFTWARE Ibuyisela 'Uqwalaselo logcino lwedatha lonakele' okanye yi 0 Bytes"| CheckVss["Qhuba: vssadmin uluhlu izithunzi"]

    CheckVss --> HasVss{"Ngaba iikopi zesithunzi soMqulu zidweliswe (HarddiskVolumeShadowCopy1..N)?"}

    HasVss -->|"Ewe: Iikopi zesithunzi zikhona"| CopyVss["Khuphela KUPHELA iHive eyonakeleyo (umzekelo, i-SYSTEM / SOFTWARE) ukusuka kwi-Newest HarddiskVolumeShadowCopyN ukuya kwi-D:\\Windows\\ System32\\config\\"]

    HasVss -->|"Hayi: 0 Iikopi zeShadow ezidwelisiweyo"| CheckAlt["Jonga enye Imithombo yeHive: D:\\Windows\\ System32\\config\\TxR\\ OKANYE Windows.old OKANYE WinSxS Component Component Hive Repair"]

Isigaba 1: Kutheni BAD_SYSTEM_CONFIG_INFO kwenzeka kwaye kutheni RegBack ayinanto Windows 10/11¶

Phambi kokuguqula naziphi na iifayile ngaphakathi \Windows\System32\config\, qonda ukuba zithini iifayile ze-hive zokubhalisa ezintlanu ngokwenene kwaye kutheni zendabuko RegBack indlela ayisasebenzi.

1. IAnatomy ye \Windows\System32\config\¶

Xa iWindows kernel (ntoskrnl.exe) kunye nesilayishi sebhuthi (winload.efi) qalisa ngexesha loqalo, balayisha iifayile ezihlanu zesiseko sedata yokubini (ebizwa ngokuba Hives, iqala nge-4-byte ASCII utyikityo regf nge-byte 0) ukusuka \Windows\System32\config\:

2. Kutheni C:\Windows\System32\config\RegBack ayinanto Windows 10 (1803+) kunye neWindows 11¶

Ukusuka kwi-Windows XP ukuya kwi-Windows 10 inguqulo ye-1709, umsebenzi ocwangcisiweyo obizwa ngegama \Microsoft\Windows\Registry\RegIdleBackup ikopishwe ngokuzenzekelayo SYSTEM, SOFTWARE, SAM, SECURITY, kwaye DEFAULT kwi \Windows\System32\config\RegBack\ ngalo lonke ixesha inkqubo yayingasebenzi. - Yintoni eyaguqulwa nguMicrosoft: Ukuqala nge Windows 10 inguqulelo 1803 (Meyi 2018) kwaye iqhubekeke ngokukhutshwa ngakunye kwe Windows 11, iMicrosoft ikhubazeke ngokusemthethweni ngokuzenzekelayo RegBack inani labantu ngokungagqibekanga ukunciphisa ushicilelo lwediski (ibhalwe kwiNkxaso kaMicrosoft KB4509719). - Isiphumo: Ngaphandle kokuba wongeze ngesandla i EnablePeriodicBackup = 1 DWORD ukuya HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager Phambi kokuba iPC yakho ingqubene, ibaleka dir D:\Windows\System32\config\RegBack izakubonisa 0 File(s) (okanye iifayile ezintlanu zobukhulu 0 iibhayithi). - Kutheni usene-backup: Nangona kunjalo RegBack ayinanto, Windows 10 kwaye Windows 11 yenza ngokuzenzekelayo ** Ikopi yesithunzi soMqulu (VSS) iisnapshots** phambi koHlaziyo lweWindows, ukufakwa kwesicelo seMSI, ufakelo lomqhubi, kunye neendawo zokujonga ukubuyisela rhoqo ngeveki. Yonke i-snapshot ye-VSS iqulethe ikopi epheleleyo, yenqaku-ngexesha efriziweyo \Windows\System32\config\.

Inqanaba lesi-2: ULungiso oluKhawulezayo olungaRhoyisi emva (msconfig I-BCD Trap & .LOG1/.LOG2 Ukudlala kwakhona kwentengiselwano)¶

Ngaphambi kokutshintsha SYSTEM okanye SOFTWARE ukusuka kwikopi yesithunzi, vavanya ezi zilungiso zimbini zero-rollback kwi WinRE Umyalelo womyalelo (Shift + F10). Ngaphezu kwesiqingatha sazo zonke BAD_SYSTEM_CONFIG_INFO (0x00000074) iingozi zisonjululwe kanye apha ngaphantsi kwe 60 imizuzwana ngaphandle kokubuyisela umva isicwangciso esinye.

Inyathelo 1: Chonga ileta yakho yeWindows drive (D: vs C:) kwaye uxhase config\¶

Kwi X:\Sources> Umyalelo wefestile ye-Command Prompt, fumana ukuba yeyiphi i-drive letter ebambe ufakelo lwakho lweWindows:

diskpart
list volume
exit

Ngoko nangoko yenza ugcino olupheleleyo lwe D:\Windows\System32\config (usebenzisa /h ifihlwe kakhulu .LOG1 kwaye .LOG2 Iifayile zentengiselwano zibandakanyiwe):

mkdir D:\Config_Emergency_Backup
xcopy /h /i /c /k /e /r /y D:\Windows\System32\config D:\Config_Emergency_Backup

Inyathelo 2: Jonga Lungisa A: Ngaba kukho umntu otshintshileyo Number of processors okanye Maximum memory kwi msconfig?¶

Uxwebhu olusemthethweni lukaMicrosoft lokuJonga iBug 0x74 (BAD_SYSTEM_CONFIG_INFO) iqaqambisa umgibe owaziwayo: abasebenzisi bavule **msconfig -> Boot -> Iinketho eziphambili ** kulandela ividiyo embi "yokudlala umdlalo", khangela Number of processors okanye Maximum memory (eyibeka ku 0 okanye ixabiso elibi), kwaye uqalise kwakhona. Ngokukhawuleza emva kokuqalisa kwakhona, iWindows ibetha ngokusisigxina BAD_SYSTEM_CONFIG_INFO BSOD ngaphambi kokuba uchukumise iihives zobhaliso.

Jonga iData yakho yoLungiselelo lweNqaku (BCD) gcina ngoku:

bcdedit /enum {default}

bcdedit /deletevalue {default} truncatememory
bcdedit /deletevalue {default} numproc
bcdedit /deletevalue {default} removememory

Inyathelo 3: Jonga Lungisa B: Phinda udlale umdaka .LOG1 / .LOG2 Izigodo zentengiselwano zehive kwindawo usebenzisa reg load¶

Kuthekani ukuba amandla anqunyulwa ngelixa iWindows yayibhalela SYSTEM okanye SOFTWARE?

+-------------------------------------------------------------------------+
| HOW WINDOWS REGISTRY HIVE HEADER SEQUENCE NUMBERS WORK                  |
|                                                                         |
| Base Block Header of SYSTEM Hive (First 4,096 bytes: "regf"):           |
|   Offset 0x04: Primary Sequence Number   = 0x0004810A                   |
|   Offset 0x08: Secondary Sequence Number = 0x00048109 (MISMATCH)        |
|                                                                         |
| Why it fails at boot:                                                   |
|   Power died mid-write before Primary == Secondary. The missing         |
|   dirty pages are sitting safely inside SYSTEM.LOG1 / SYSTEM.LOG2.      |
|   If winload.efi cannot reconcile the log at early boot, it throws      |
|   0xc000014c or BAD_SYSTEM_CONFIG_INFO (0x74).                          |
|                                                                         |
| How to force-replay the .LOG1/.LOG2 file in WinRE:                      |
|   Running `reg load HKLM\Temp D:\Windows\System32\config\SYSTEM`        |
|   invokes the full WinRE Configuration Manager, which reads             |
|   SYSTEM.LOG1 + SYSTEM.LOG2, replays the dirty vector pages into        |
|   SYSTEM, sets Primary == Secondary, and flushes a clean hive on unload |
+-------------------------------------------------------------------------+

Vavanya isidleke ngasinye kwezihlanu (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) enye kwenye WinRE Umyalelo we-Command usebenzisa reg load:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM

reg unload HKLM\TestSys

reg load HKLM\TestSoft D:\Windows\System32\config\SOFTWARE
reg unload HKLM\TestSoft

reg load HKLM\TestSam D:\Windows\System32\config\SAM
reg unload HKLM\TestSam

reg load HKLM\TestSec D:\Windows\System32\config\SECURITY
reg unload HKLM\TestSec

reg load HKLM\TestDef D:\Windows\System32\config\DEFAULT
reg unload HKLM\TestDef

Inqanaba lesi-3: Ukutsalwa kweeHives zoBhaliso olusempilweni ukusuka VSS Iikopi zesithunzi (HarddiskVolumeShadowCopyN)¶

Kutheni sikhupha i-hive eyaphukileyo ngesandla kwi-Volume Shadow Copy endaweni yokucofa ** I-Troubleshoot -> Iinketho eziphezulu -> Ukubuyisela iNkqubo ** kwi-GUI? 1. Okokuqala, ukuba SYSTEM okanye SOFTWARE ayifundeki, umzobo System Restore (rstrui.exe) iwizard ihlala ingqubana nayo System Restore failed to extract the original copy of the directory from the restore point (0x80070002 / 0x80070017). 2. Okwesibini, uBuyiselo lweNkqubo yomzobo kutshintsha zonke izidleke kwaye ibuyisele umva amakhulukhulu omqhubi/iifayile eziphunyeziweyo kwidiski, ngelixa ukhuphela enye eyonakeleyo. SYSTEM okanye SOFTWARE hlala ukusuka HarddiskVolumeShadowCopyN ithatha imizuzwana eli-10 kwaye ishiya ezinye iihives zakho (SAM, SECURITY) engaphathwanga.

Inyathelo 1: Dwelisa zonke iikopi zesithunzi zeVolume kwidiski¶

Kwi WinRE Umyalelo we-Command, sebenzisa:

vssadmin list shadows

Contents of shadow copy set ID: {4b9128a1-8812-4091-a910-112938475610}
   Contained 1 shadow copies at creation time: 10/30/2026 11:14:02 PM
      Shadow Copy ID: {99182736-1122-3344-5566-77889900aabb}
         Original Volume: (D:)\\?\Volume{12345678-0000-0000-0000-100000000000}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

Inyathelo lesi-2: Qinisekisa iingcingo zobhaliso ngaphakathi kweShadow Copy Volume¶

Kuba umgangatho cd okanye dir imiyalelo ngamanye amaxesha iminxa kwi \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 indlela ye-kernel yesithuba segama, ungadlula umendo kwizicaphulo ukuya dir, okanye yenza ikhonkco lomfuziselo eliluncedo (mklink /d) kwi D:\ yalatha ngqo kwi-Shadow Copy:

# Create a folder symlink on D:\ pointing into the newest Shadow Copy (e.g., ShadowCopy1):
mklink /d D:\ShadowMount \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

# Inspect the file sizes and dates of the registry hives inside that Shadow Copy:
dir D:\ShadowMount\Windows\System32\config

INyathelo 3: Khuphela KUPHELA isidleke esonakeleyo ukusuka kwiSithunzi Khuphela ukuya D:\Windows\System32\config\¶

Masithi uvavanyo lwakho kwiSigaba sesi-2 iNyathelo 3 lubonise ukuba SYSTEM ayiphumelelanga ukulayisha (okanye zombini SYSTEM kwaye SOFTWARE ayiphumelelanga).

Qhuba le miyalelo kanye ukuze ubuyisele eyaphukileyo SYSTEM (kunye/okanye SOFTWARE) hlala ngokucocekileyo:

# 1. Remove the dirty .LOG1 / .LOG2 files for the hive being replaced (already backed up in D:\Config_Emergency_Backup)
attrib -h -s -r D:\Windows\System32\config\SYSTEM.LOG*
del D:\Windows\System32\config\SYSTEM.LOG1
del D:\Windows\System32\config\SYSTEM.LOG2

# 2. Copy the healthy SYSTEM hive from the Shadow Copy into D:\Windows\System32\config\
copy /y D:\ShadowMount\Windows\System32\config\SYSTEM D:\Windows\System32\config\SYSTEM

# (If SOFTWARE was ALSO broken in Phase 2 Step 3, run the same for SOFTWARE:)
attrib -h -s -r D:\Windows\System32\config\SOFTWARE.LOG*
del D:\Windows\System32\config\SOFTWARE.LOG1
del D:\Windows\System32\config\SOFTWARE.LOG2
copy /y D:\ShadowMount\Windows\System32\config\SOFTWARE D:\Windows\System32\config\SOFTWARE

# 3. Clean up the temporary symlink so you don't leave a dangling link on D:\
rmdir D:\ShadowMount

Inyathelo 4: Qinisekisa imithwalo yesidleke ebuyiselweyo ngokucocekileyo (reg load) kwaye khangela CurrentControlSet¶

Vavanya esanda kukotshwa SYSTEM imithwalo yehive eneziphoso eziqanda:

reg load HKLM\TestRestored D:\Windows\System32\config\SYSTEM
reg query HKLM\TestRestored\Select
reg unload HKLM\TestRestored

HKEY_LOCAL_MACHINE\TestRestored\Select
    Current    REG_DWORD    0x1
    Default    REG_DWORD    0x1
    Failed     REG_DWORD    0x0
    LastKnownGood    REG_DWORD    0x2

Inqanaba lesi-4: Ukuba vssadmin list shadows Imiboniso No items found (0 Iikopi zesithunzi)?¶

Kuthekani ukuba uKhuseleko lweNkqubo (VSS) yacinywa ngokupheleleyo kwi-drive, RegBack ayinanto, kwaye reg load iyasilela SYSTEM okanye SOFTWARE? Useneendlela ezintathu zokubuyisela umva ngaphambi kokufaka kwakhona iWindows:

Ukubuyela umva 1: Tshintsha Default ukuya LastKnownGood (ControlSet002) ngaphakathi SYSTEM¶

Ukuba reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM ** iphumelele **, kunye neBSOD (BAD_SYSTEM_CONFIG_INFO) kwenzeka ngenxa yokuba umqhubi okanye isitshixo senkonzo ngaphakathi ControlSet001 (Current = 0x1) yonakele ngelixa ControlSet002 (LastKnownGood = 0x2) ngaphakathi okufanayo SYSTEM i-hive ilungile:

reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM
reg query HKLM\TestSys\Select
# If ControlSet002 exists (verify via: reg query HKLM\TestSys\ControlSet002), switch Default from 1 to 2:
reg add HKLM\TestSys\Select /v Default /t REG_DWORD /d 2 /f
reg unload HKLM\TestSys

Ukubuyela umva 2: Jonga C:\Windows\System32\config\TxR\ kwaye C:\Windows.old\Windows\System32\config\¶

Jonga ukuba iPC isandula ukuphuculwa into eyakhayo (22H2 -> 23H2 -> 24H2) okanye unoMphathi weNtengiselwano yeKernel (TxR) iilog zesikhongozeli:

dir /a D:\Windows.old\Windows\System32\config
dir /a D:\Windows\System32\config\TxR

Ukubuyela umva 3: Buyisela umva uhlaziyo olufakelweyo olunesiqingatha (dism /RevertPendingActions)¶

Rhoqo, BAD_SYSTEM_CONFIG_INFO okanye CRITICAL_PROCESS_DIED kwenzeka ngenxa yokuba iPC iphelelwe ngamandla 30% ngexesha Working on updates... Don't turn off your computer, ehamba SOFTWARE kwaye \Windows\WinSxS\pending.xml ayihambisani Ukusuka kwi WinRE I-Command Prompt, xelela ukuhanjiswa koMfanekiso wokuSebenza kunye noLawulo (DISM) injini ukubuyisela zonke iitransekshini zohlaziyo ezinganyanzelekanga ngokuchasene nomfanekiso weWindows ongaphandle kweintanethi (D:\):

mkdir D:\Scratch
dism /Image:D:\ /Cleanup-Image /RevertPendingActions /ScratchDir:D:\Scratch

Ukubuyisela umva 4: Ukulungisa iData yoLungiselelo lweSiqalo engafundekiyo (BCD) ivenkile (bootrec /rebuildbcd kwaye bcdboot)¶

Kuthekani ukuba zontlanu registry izingxili ngaphakathi D:\Windows\System32\config\ layisha kwaye wothule ngokucocekileyo nge reg load, kodwa iPC isaphosa 0xc000014c (The Boot Configuration Data for your PC is missing or contains errors) okanye 0xc000000f? Ngenxa yokuba iWindows BCD ifayile kweyakho efihliweyo 100 MB ISahlulo seNkqubo yeFAT32 EFI (\EFI\Microsoft\Boot\BCD) yona ngokwayo igcinwe kubini oluchanekileyo regf registry hive format njengoko SYSTEM kwaye SOFTWARE, ukulahleka kwamandla kunokonakalisa i BCD hlala phantsi xa uhamba D:\Windows\System32\config\ engaphathwanga. Yakha ngokutsha kraca BCD Hive kwi-EFI System Partition yakho kwimizuzwana eyi-15:

diskpart
list volume
# Find the 100 MB to 300 MB FAT32 EFI System Partition (e.g. Volume 2)
select volume 2
assign letter=S
exit

# Back up the old broken BCD hive and generate a fresh one from D:\Windows:
ren S:\EFI\Microsoft\Boot\BCD BCD.bak
bcdboot D:\Windows /s S: /f UEFI

Inqanaba lesi-5: Ukuvula kwakhona okuzenzekelayo RegBack backups ngaphakathi Windows 10 kunye Windows 11¶

Nje ukuba iWindows PC yakho ibuyele kwi-desktop, yenza kwakhona iMicrosoft eyakhelwe-ngaphakathi RegIdleBackup umsebenzi ngoko C:\Windows\System32\config\RegBack\ ihlaliswa ngokuzenzekelayo veki nganye, kwaye uqinisekise uBuyiselo lweNkqubo (VSS) iyasebenza:

• Vumela kwakhona okuzenzekelayo RegBack hive backups ngaphakathi Windows 10 (1803+) kunye Windows 11: Vula i-Command Prompt ephakamileyo (Run as Administrator) kwaye uqhube lo myalelo omnye wobhaliso olusemthethweni (KB4509719):

  reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager" /v EnablePeriodicBackup /t REG_DWORD /d 1 /f
  

  Emva koko qalisa umsebenzi wogcino kube kanye ngokukhawuleza ukuze uqinisekise C:\Windows\System32\config\RegBack igcwalisa ngeekopi eziphilileyo zazo zontlanu izidleke:

  schtasks /run /tn "\Microsoft\Windows\Registry\RegIdleBackup"
  dir C:\Windows\System32\config\RegBack
  

• ** Qinisekisa uKhuseleko lweNkqubo (VSS Amanqaku okubuyisela) ajikiwe ON ngenxa C:**: Cinezela Win + R, uhlobo sysdm.cpl ,4, khetha eyakho C: qhuba, nqakraza Qinisekisa, khetha Vula ukhuseleko lwesixokelelwano, seta ukuSetyenziswa okukhulu 5% (10 GB ukuya 25 GB), kwaye ucofe Yenza ukwenza ikopi yesithunzi ecocekileyo esisiseko ngoku.
• Baleka sfc /scannow kwaye DISM /Online /Cleanup-Image /RestoreHealth once iqalwe kwi-Windows ukuqinisekisa ukuba akukho DLLs zenkqubo okanye ivenkile ebonakalisayo (COMPONENTS hive) zonakele ngexesha lengozi.

Iinombolo zengingqi zikaxakeka kunye neeprothokholi ze-arhente¶

Ngelixa iWindows BAD_SYSTEM_CONFIG_INFO I-BSOD iqhelekile ukuba yi-IT yangaphakathi okanye umba wokulungisa ikhompyuter yakho, indawo yokusebenza okanye ukusilela kweseva echaphazela izibhedlele, ukuthunyelwa kongxamiseko, okanye iziseko zoncedo zikawonke-wonke zifuna ukunyuka kwangoku:

• I-United States neKhanada: Cofa 911 ukuba ingozi yeWindows ikhubaza ukujongwa kwesigulana seklinikhi, ukuthunyelwa ngokukhawuleza (CAD), okanye ulawulo lokhuseleko lobomi, kunye nokutshintshela kwiinkqubo zokunciphisa ixesha loncedo. Xela ii-bootloops zeshishini ezixhaphakileyo ezibangelwa luhlaziyo lwearhente yokhuseleko okanye izehlo ze-cyber ku CISA (1-844-Say-CISA / cisa.gov/report) okanye iZiko laseKhanada loKhuseleko lweCyber (1-833-CYBER-88).
• United Kingdom: Cofa 999 kwizoyikiso zobomi okanye ukuphazamiseka kwekliniki ye-NHS. Xela i-cyber enkulu okanye iziganeko zokufumaneka kwi-NCSC (ncsc.gov.uk)* okanye NHS England Cyber Operations.
• I-European Union: Cofa 112 kuwo onke amazwe angamalungu e-EU. Amaqumrhu a-inshoriweyo phantsi koMyalelo we-NIS2** kufuneka anike ingxelo ngokungabikho kwemisebenzi ebalulekileyo kwi-CSIRT yawo kazwelonke zingadlulanga iiyure ezingama-24.
• Ostreliya neNew Zealand: Cofa 000 eOstreliya okanye 111 eNew Zealand; xela iziganeko ezibalulekileyo zeziseko ezingundoqo kwi-*ACSC (1300 CYBER1)**.
• I-Indiya kunye ne-Asia-Pacific: Cofa 112 eIndiya impendulo kaxakeka; xela iziseko zophuhliso okanye iziganeko ze-cyber ku CERT-In (incident@cert-in.org.in).

Imibuzo edla ngokubuzwa¶

Kuthekani ukuba iprofayile yam yomsebenzisi ngokwayo iyasilela ukungena emva kokuqalisa ("We can't sign in to your account" / Inkangeleko yeXeshana) kuba NTUSER.DAT yonakele?¶

Ukongeza kwii-hives ezintlanu zenkqubo ngaphakathi `\Windows\System32\config\`, iakhawunti nganye yomsebenzisi inendawo yayo yokubhalisa (`HKEY_CURRENT_USER`) igcinwe e **`C:\Users\\NTUSER.DAT`** (kunye `AppData\Local\Microsoft\Windows\UsrClass.dat`). Ukuba iibhutsi zePC yakho kwiscreen sokungena ilungile, kodwa ukungena kulayisha idesktop yethutyana engenanto kuba `NTUSER.DAT` yonakele ngexesha lokucima kombane, vula i-Command Prompt ephakamileyo, qhuba `vssadmin list shadows`, kwaye ukhuphele abaphilileyo `NTUSER.DAT` ngaphandle `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Users\\NTUSER.DAT` (ngelixa ungenile kwiakhawunti yesibini yomlawuli okanye WinRE ukuze ifayile ingatshixwa).

Kwakutheni ukuze WinRE ndicela iSitshixo soBuyiselo seBitLocker esineedijithi ezingama-48 ngaphambi kokuba undivumele ndivule i-Command Prompt, xa ndingazange ndijike iBitLocker kum?¶

Phantse kuzo zonke zangoku Windows 11 (kunye Windows 10) iilaptops ezine `TPM 2.0` kunye neSimo sangoku, ukungena ngeAkhawunti yeMicrosoft ngexesha lokuseta ngokuzenzekelayo kwenza **Ufihlo lweSixhobo (`BitLocker`)** ngasemva kwaye ikhuphela isitshixo sakho esineedijithi ezingama-48 kwiAkhawunti yakho yeMicrosoft. Vula **`https://aka.ms/myrecoverykey`** kwi-smartphone yakho, ngena ngeAkhawunti yeMicrosoft (`@outlook.com`, `@hotmail.com`, `@gmail.com`) okanye iSazisi sokuNgena emsebenzini/eSikolweni (`myaccount.microsoft.com`) isetyenziswe kuloo PC, kwaye ngenisa iqhosha elineedijithi ezingama-48 elihambelana ne `Key ID` iboniswe kwiscreen. Nje ukuba ivulwe, `D:\Windows\System32\config` ifikeleleka ngokupheleleyo kwi-WinRE Command Prompt.

Kuthekani ukuba copy iyasilela nge The process cannot access the file because it is being used by another process xa ndizama ukubhala ngaphezulu SYSTEM okanye SOFTWARE kwi WinRE?¶

Loo mpazamo yenzeka ngenxa yezizathu ezibini: (1) uchwetheze ngempazamo `C:\Windows\System32\config\SYSTEM` nini `C:` okanye `X:` ngenene iyasebenza WinRE RAM disk (`X:\Windows\System32\config\SYSTEM` itshixiwe yiWinRE ngokwayo; soloko uqinisekisa ileta yakho yokwenyani ye-SSD ngaphandle kweintanethi `D:` okanye `E:` kunye `diskpart -> list vol`); okanye (2) ubaleke `reg load HKLM\TestSys D:\Windows\System32\config\SYSTEM` ngaphambili kwiseshoni kwaye walibala ukuqhuba **`reg unload HKLM\TestSys`** phambi kokubaleka `copy`.

Kutheni iPC yam iqhekeka BAD_SYSTEM_CONFIG_INFO (0x00000074) nakwi-Windows USB installer entsha kraca ngaphambi kokuba uchukumise i-SSD?¶

Ukuba `BAD_SYSTEM_CONFIG_INFO` (`0x00000074`) kwenzeka ngelixa kuqalwa i **brand-entsha Windows 10/11 intonga ye-USB yokufakela** (apho isifakeli silayisha esaso `boot.wim` Ukubhaliswa kwe-RAM kwimemori yenkqubo), ubhaliso lwakho lwe-SSD aluyiyo** ingxaki: **inkqubo yakho ye-RAM (`DDR4 / DDR5`) iyonakalisa i-hive yobhaliso kwinkumbulo njengoko ikhupha**. Ngenisa i-motherboard yakho `BIOS / UEFI` ukuseta (`Del` okanye `F2`), khubaza `XMP / EXPO` iiprofayili zememori ezigqithisiweyo ukuze i-RAM ibaleke ngezantya ezisemgangathweni zeJEDEC, okanye uvavanye ngentonga enye ye-RAM ngexesha usebenzisa. `MemTest86`.

Ngaba i-Antivirus yomntu wesithathu okanye i-Endpoint Detection (EDR) uhlaziyo lomqhubi wekernel lubangela i-BSOD loop ekhangeleka ngathi urhwaphilizo lobhaliso?¶

Ewe. Abaqhubi bokhuseleko bemowudi yeKernel (`BOOT_START` abaqhubi nge `Start = 0` ngaphakathi `HKLM\SYSTEM\ControlSet001\Services\`) zilayishwa ngu `winload.efi` ecaleni kwe `SYSTEM` yiva ngaphambi kokuba iWindows iqalise ividiyo. Ukuba inesiphene `.sys` ifayile kwi `D:\Windows\System32\drivers\` Ukungqubana kwesiqalo, awudingi kutshintsha indawo yobhaliso: yithiya kwakhona ingxaki `.sys` ifayile kwi `D:\Windows\System32\drivers\` (okanye layisha `D:\Windows\System32\config\SYSTEM` kunye `reg load HKLM\TestSys` kwaye utshintshe inkonzo eyaphukileyo `Start` ixabiso ukusuka `0` ukuya `4` [Kukhubazekile]).

Yintoni na COMPONENTS umqolomba ngaphakathi C:\Windows\System32\config\, kwaye kutheni i-100 MB?¶

Ngokungafaniyo `SYSTEM`, `SOFTWARE`, `SAM`, `SECURITY`, kwaye `DEFAULT` (elayishwa kuyo yonke ibhuthi), i **`COMPONENTS`** indlu (`C:\Windows\System32\config\COMPONENTS`) ilayishwe kuphela ngokutshintsha-kwimfuno xa **uHlaziyo lweWindows (`TiWorker.exe` / Inkonzo eSekwe kwiCandelo)** okanye `sfc /scannow` iyabaleka. A yonakele `COMPONENTS` umqolomba awusoze ** umise iWindows ekuqaliseni (`0x00000074`), nangona iya kubangela ukuba uHlaziyo lweWindows lungaphumeleli `0x80073712` de ilungiswe nge `DISM /Online /Cleanup-Image /RestoreHealth`.

Izikhokelo ezinxulumeneyo¶

• Isikrini esiluhlaza seWindows (BSOD) kunye nokulungiswa kwe-boot
• I-BitLocker, iFayileVault, kunye ne-LUKS yokuvala isitshixo sokubuyisela kunye nokusetha kwakhona kwe-TPM
• I-BIOS kunye ne-UEFI firmware yokuhlaziya isitena, ukulahlekelwa kwamandla, kunye ne-Dual-BIOS Flashback
• I-SSD kunye ne-NVMe imowudi yokufunda kuphela ngequbuliso, i-0% yeebhloko ezisecaleni, kunye ne-TRIM ekhubazayo yokuhlangula.
• Ukungaphumeleli kwe-hard drive kunye nokubuyisela idatha
• Ukugcinwa kwekhompyuter, isicwangciso se-3-2-1, kunye nokubuyisela intlekele
• Amanani kaxakeka ngokwelizwe

Imithombo kunye nezikhokelo ezisemthethweni¶

• Funda ngoMicrosoft (learn.microsoft.com): Khangela ibug 0x74: BAD_SYSTEM_CONFIG_INFO Isalathiso esisemthethweni sokulungisa ingxaki (BCD truncatememory / numproc Ulungiso kunye noQinisekiso lweRegistry Hive).
• Inkxaso kaMicrosoft (KB4509719): Ubhaliso lwesixokelelwano alusaxhaswanga kwi RegBack ifolda eqala kuyo Windows 10 inguqulelo 1803 (EnablePeriodicBackup Uqwalaselo loBhaliso).
• I-Microsoft Windows yangaphakathi (uHlelo lwesi-7, uRussinovich et al.): UManejala woqwalaselo loYilo, iRegistry Hive Binary Structure (regf, hbin), kunye nelog yeNtengiselwano eMabini (.LOG1 / .LOG2) UBuyiselo.
• Uxwebhu loGcino lweSeva yeMicrosoft: Inkonzo yokuKhuphela isithunzi seVolumu (VSS) Ulawulo (vssadmin list shadows kwaye GLOBALROOT Ufikelelo lweSixhobo seNdawo yegama).
• Iziko leSizwe leMigangatho kunye neTekhnoloji (NIST) (eUnited States): Ushicilelo oluKhethekileyo 800-86: Uhlalutyo lweForensic lwe-Windows Registry kunye noBuyiselo.