Missing or corrupt Systemced - part 2

****EDIT Hey Guys, I goofed on this post: This post discusses a utility used during the course of a Microsoft support call. It is not available to send to customers, and is not available for download as I had originally thought.

The version posted on the download site does not contain the same functionality referenced here. If you email me through the blog I will do my best to help out. Due to my tremendous workload my response may be delayed. If this is an urgent matter then you may want to consider opening up a paid incident with Microsoft Support: https://support.microsoft.com/ ****

This is part 2 of my earlier post on the whole "missing or corrupt system hive" issue. Okay, so we have a copy of the bloated/corrupt registry hive. Now what do we do with it?  Chkreg.exe is your friend. Chkreg is a command line utility that you can use to repair a corrupt registry hive. You can also use it to just display registry key size. The majority of the issues that I see are not due to a corrupt system hive, so I use chkreg to help me identify what is taking up all of the hive size.

The ability to view registry key size wasn't added until a later version of chkreg than what is available at Microsoft.com.

The main version that you will find is actually used along with the XP Setup disks. In that version it is placed on disk 6, and after you boot to the recovery console it automatically attempts to repair the system hive. This version does not let you run it from the GUI. You will get this message if you try: "chkreg.exe application cannot be run in Win32 mode." 

I thought the newer version was available on our site, unfortunately it looks like you have to call us in order to get this special version of chkreg. With this version of chkreg you get the /S, /O, and /D options.

/S Displays space usage for the bin. When bin is not specified, displays usage for the entire hive.

/O Ordered by size

/D Dump subkeys

 I typically put the bloated hive in a folder such as c:\temp, and so my command would be:

chkreg.exe /F c:\temp\system /S /O /D >regbloat.txt

This will output the keys listed largest to smallest to a file called regbloat.txt  

Here is an example of two such bloated keys from the txt file:

Size Subkeys

552027 ControlSet002\Control\DeviceClasses\{28d78fad-5a12-11d1-ae5b-0000f803a8c2}\##?#Root#RDPDR#0000#{28d78fad-5a12-11d1-ae5b-0000f803a8c2}

547031 ControlSet001\Control\DeviceClasses\{28d78fad-5a12-11d1-ae5b-0000f803a8c2}\##?#Root#RDPDR#0000#{28d78fad-5a12-11d1-ae5b-0000f803a8c2}

In this example, the same key in both ControlSet keys are causing the registry size problem. This is a known issue that occurs when you have the Spooler service disabled on a Terminal Server.

I remove the bloated keys, and then run chkreg again, but this time with the /C switch to compress the hive. The last step is to swap the hive back out via recovery console in order to boot off of it.

There is a utility that you can use to correct the problem called scrubber.exe, but it only corrects the issue if it is due to the issue mentioned here: KB 277222

Tune in next time when I will discuss: Active Directory Forest recovery or something else equally exciting. :)

 

Thanks for viewing!

 

Justin

 

 

Technorati tags: Cluster, Setup, Windows 2000

Comments

• Anonymous
  January 01, 2003
  WHERE CAN I FIND the second, later version of CHKREG.EXE that you discuss?  I really need to use the command switches.

• Anonymous
  January 01, 2003
  The comment has been removed

• Anonymous
  January 01, 2003
  Unfortunately I found out after the fact that the chkreg on the download site doesn't have the same functionality as the one that I was using.  I have been trying to find another utility to use, but haven't had much luck.  As of right now they will not let us send this out.  (It has the potential to cause damage to a registry hive if used the wrong way) If you want to send me your system hive zipped up, I can see where the registry bloat is and clean it up for you. Thanks, Justin