Recover from a Corrupted Registry in Windows XP

When Will This Recovery Work?
You'll want to use the steps on this page to recover from a corrupted registry when you have already tried other options such as System Restore and you receive a message similar to one of the following when you try to boot your computer with Windows XP

.

• Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM
  
  
• Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SOFTWARE
  
  
• Stop: c0000218 {Registry File Failure} The registry cannot load the hive (file): \SystemRoot\System32\Config\SOFTWARE or its log or alternate
  
  
• System error: Lsass.exe
  
When trying to update a password the return status indicates that the value provided as the current password is not correct.

Be careful using this procedure in other circumstances or with an OEM version of Windows XP since OEM installations create passwords and user accounts that did not exist previously and may cause you not to be able to log into the Recovery Console to restore files.

Booting into the Recovery Console

You'll need to use the Windows XP Recovery Console to fix a corrupted registry, this will either require you to boot from a Windows XP Installation CD or boot directly to the Recovery Console if its installed. Follow these steps to boot into the Recovery Console from a Windows XP Installation CD.

1) Place your Windows XP in the CD-ROM Drive
2) Restart your computer and make sure your BIOS is set to boot from CD
3) When you see the following command press the space bar.

"press any key to boot from cd..."

4) Wait until you see the "Welcome to Setup" screen, and press R to start the Recovery Console
5) Choose which Windows installation you wish to load (this is usually #1 unless you have a multi-boot system)
6) Type the administrator password and Press Enter
7) You should now be at the C:\Windows> prompt

Copy Repair Files Using the Recovery Console

This procedure assumes Windows is installed on Drive C, if you have installed Windows on another drive, please substitute the appropriate drive letter in the procedure below.

At the Recovery Console command prompt, type the following lines, pressing ENTER after you type each line:

md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak

delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

copy c:\windows\repair\system c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default

Type exit to quit Recovery Console. Your computer will restart, press F8 as it starts and choose Safe Mode.


Restart in Safe Mode and Find a Recent Snapshot Backup

Restart your computer in Safe Mode by pressing F8 during the initial bootup and choosing Safe Mode. Once in Safe Mode, you need to make sure the files and folders are visible so you can access them. Follow these instructions to accomplish this.

1. Open My Computer
2. Click on the Tools menu, then click Folder Options.
3. Click the View tab.
4. Under Hidden files and folders, click to select Show hidden files and folders, and then click to clear the Hide protected operating system files (Recommended) check box.
5. Click Yes when the dialog box that confirms that you want to display these files appears.

In My Computer, Double-click the drive where you installed Windows XP (usually Drive C) to display a list of the folders. then double-click on the "System Volume Information" folder. This folder contains the system restore points stored on your computer. The folders will look similar to

_restore{EE42BEB8-700A-495F-8004-53D26C2E12C5}

You might receive an access denied error message similar to the following when trying to access the System Volume Information folder.

C:\System Volume Information is not accessible. Access is denied.

This is generally caused because the user you are logged in under does not have permissions set on the folder. To fix this, follow the instructions in the Microsoft Knowledge Base article 309531 to gain access and continue. Each version of Windows XP is different on how to change these permissions.

Once you have access to the snapshots, use the instructions below to copy one of the latest snapshots to the Windows\TMP directory so you have access to it.

1) In the System Volume Information Folder, click on View, and then click Details to display the date of each snapshot folder.
2) Double-click on a folder that was not created at the current time but rather before the problem started.
3) Double-click on the Snapshot subfolder
4) Using your normal windows copy and paste techniques, highlight the following files and copy them into the C:\Windows\TMP folder

• _REGISTRY_USER_.DEFAULT
• _REGISTRY_MACHINE_SECURITY
• _REGISTRY_MACHINE_SOFTWARE
• _REGISTRY_MACHINE_SYSTEM
• _REGISTRY_MACHINE_SAM
  

5) Rename the files that you just copied into the C:\Windows\TMP folder by right-clicking on each filename and choosing Rename, then typing the new name. Repeat this for each file in the list below.

• Rename _REGISTRY_USER_.DEFAULT to DEFAULT
• Rename _REGISTRY_MACHINE_SECURITY to SECURITY
• Rename _REGISTRY_MACHINE_SOFTWARE to SOFTWARE
• Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM
• Rename _REGISTRY_MACHINE_SAM to SAM
  

6) Once you have renamed the files, restart your computer again with the Recovery Console (refer to the instructions above to do this)


Replace the Repair Files with a Current Backup of the Registry

After rebooting the computer and starting the Recovery Console again, type the following commands at the prompt to replace the files with a current backup. You'll need to press Enter after each command.

del c:\windows\system32\config\sam
del c:\windows\system32\config\security
del c:\windows\system32\config\software
del c:\windows\system32\config\default
del c:\windows\system32\config\system

copy c:\windows\tmp\software c:\windows\system32\config\software
copy c:\windows\tmp\system c:\windows\system32\config\system
copy c:\windows\tmp\sam c:\windows\system32\config\sam
copy c:\windows\tmp\security c:\windows\system32\config\security
copy c:\windows\tmp\default c:\windows\system32\config\default

After the files have been replaced, type EXIT at the command prompt to restart Windows in normal mode.

Use System Restore to Return to a Good Backup Point

Because there is more to a System Restore than just the registry files, follow these steps to restore your computer to a good backup point.

1. Click Start, and then click All Programs.
2. Click Accessories, and then click System Tools.
3. Click System Restore, and then click Restore to a previous Restore Point and finish the restore.

How to grant Send On Behalf Of permission

---

"Send on Behalf Of" allows one user to be able to send emails on behalf of another. The message will show the recipient who the message was sent on behalf of and who actually sent the message.

There are two ways of granting "Send on Behalf Of":

• via Outlook
  allowing a user to grant others to send on their behalf
• via Active Directory Users and Computers
  which can be performed by system managers only
  
  

Grant Send on Behalf of via Outlook

This procedure will allow you to grant other users the ability to send on your behalf:

1. Start Outlook
2. Tools → Options, select the "Delegates" tab
3. Click on [Add ...]
4. Add the user or users that you want to grant the send-on-behalf-of permission to, then click [OK]
5. The next window will allow you to specify which permissions you are granting. To allow send-on-behalf-of, you need to grant permissions on the "Inbox" to either "Author" or "Editor", then click [OK]
6. Click [OK] to close the "Options" dialog.

Note:

• The above has been demonstrated to work when using Outlook 2003, but not with Outlook 2000 connected to a Exchange 2003 server (I have not had time to identify why).
• See also "How to send a message on behalf of another"
  
  

Grant Send on Behalf of via Active Directory Users and Computers

This procedure will allow system managers to grant users the ability to send on the behalf of other users:

1. Log onto the server running Exchange.
2. Run Active Directory Users and Computers.
3. Find the user's account that you want to be able to send on behalf of, and open up the account properties.
4. Select the "Exchange General" tab.
5. Click [Delivery Options...]
6. Click [Add ...] and add the user (or users) that are to be granted permission to send on behalf of this account.
7. Click [OK] to close the "Delivery Options" dialog.
8. Click [OK] to close the account properties dialog..

See also "How to send a message on behalf of another".

How to Send a Message on Behalf of Another

To send an email on behalf of another (assuming you have been granted the necessary send-on-behalf-of privilege):

1. Start Outlook.
2. Go to your Inbox.
3. Click [New] to start a new mail message.
4. If the message does not show a "From" field then pull down the "View" menu and check "From Field".
5. Click [From...] and select the account that you wish to send an email on behalf of.
6. Compose the email as normal.

Note:

• When you try to send the email you will get an error if you have not been granted the necessary send-on-behalf-of permission.
• To the recipient the email will show both the true author and who it was sent on behalf of.

---

These notes have been tested with Exchange Server 2003, with Outlook 2000 and Outlook 2003. It is believed they also apply to Exchange Server 2000.

---

---