NT Could Not Start Because File is Missing or Corrupt 1

[burritonator]

I have an NT 4.0 machine that gives the following error on bootup:

Windows NT could not start because the following file is missing or corrupt: \%winnt%\SYSTEM32\CONFIG\SYSTEMHardware Profile/Last Known Good menu

According to the MS Knnowledge Base Article that I found about the issue, the only workarounds are to use an Emergency Repair Disk (which I don't have for this system), or to reinstall Windows NT.

I wanted to check and see if anyone knows of any other way around this problem. If reinstalling NT is the only option, I also wanted to check and see if we will lose everything on the HD when we do this, or if data, installed programs, etc. will remain intact since we reinstalling NT on a system where it is already installed.

Thanks,
Burritonator

 

[wolluf]

If you have a 2k or XP install CD, you could try booting from it to start recovery console (it works with NT installations too) - you'll need Administrator password. Then run chkdsk /p or chkdsk /f. If this finds and fixes any problems, just try restarting NT - it may have been fixed.

(note - you could also mount the drive as slave in another NT/2k/XP machine and run chkdsk from there).

If you can try either of those - and it doesn't work, you could also try restoring the backup 'system' hive file. In \WINNT\system32\config, as well as system, there will be another file called system.alt. Rename system to say system.bak, then rename system.alt to system. Reboot & see if ok.

(Note - if its FAT filestore, you can do this booting from a win98 boot floppy).

If you can't get access to the filestore, then you could try the Emergency Repair Disk (ERD) approach (or you could try it first). Even though you don't have a repair disk, the repair option will try to find the NT installation and if it does (in my experience c. 50% of the time it will), it will use the backups on hard drive to try the repair. see

http://www.windowsreinstall.com/install/winnt/repairdisk/page1.htm

(you want just the inspect registry files entry checked).

If all no good, and you have to reinstall, you can install into the existing partition (ie, without formatting). You have 2 options here - either installing on top of existing installation (ie, choose the same folder for windows - usually \winnt for NT) or do a parallel install by specifying a new windows folder. The first will wipe the existing \winnt folder but leave the rest as is. As NT profiles folder is under \winnt, I'd suggest a parallel install (if there's room). Also, your apps will need reinstalling in the main (as new installation will not be aware of them - so there won't be any registry entries/system files/menu shortcuts for them. Standalone apps will run ok)

 

[burritonator]

I wound up going with the parallel install method, which allowed me to regain full access to the HD and copy the files that I needed from the PC to another PC on the network.

One problem that I've run into now is that when I boot into the original NT installation, all username/password combinations are rejected when I try to log in. I have no problem logging in to the new parallel NT installation, just the original one.

Do you have any idea why that would be, or how I could add a login to the original installation so I can regain access to it?

Thanks

 

[wolluf]

Bit confused - how can you boot into the original installation? (that was the problem - you were getting that error message)

 

[burritonator]

Sorry about that, I should have provided full details as to what else I did after doing the parallel install. I found the article #167233 in the MS Knowledge Base which described a solution to the problem that I described in my original post. It said to perform a parallel install of NT, run the command "Expand SYSTEM._ SYSTEM" on the SYSTEM._ file in the \winnt\repair directory, and then execute the command "Copy System C:\winnt\system32\config". The article indicated that I should then be able to boot into the original NT installation.

At bootup, I am given the option to boot into the original NT installation or the new parallel installation. If I boot into the new installation, I am able to log in with no problem. I was able to copy all of the files that I need from the PC to another PC on the network. However, it would be nice to be able to log back into the original NT installation so I could see if the user's software still functions properly so I won't have to reinstall and reconfigure all of it. When I boot to the original installation, however, I get login failure on all username/password combos. I've tried the accounts that existed before, including the administrator account. I've also tried a username of administrator with no password, and even a blank username and password, but I can't log in no matter what I try.

 

[wolluf]

One problem with \winnt\repair\system._ - unless you've run rdisk to create a new ERD since the original installation, its the system hive file from the original installation (before users set up, software installed - so it may not match your current installation at all). This may or may not be your problem (as you've still got the latest SAM hive file, where username/password information is held) - I just don't have enough detailed knowledge to be able to say.

Can you check the C:\winnt\system32\config folder and see if the original system.alt file is still there (it will be considerably larger and have a different last updated date to the system file if it is). If it is there, and you haven't run chkdsk, then going back to something like my original suggestion:-

From the parallel install, run chkdsk /f (letting it run on reboot). When its complete, log back into the parallel installation and rename the system file in C:\winnt\system32\config system.bak. Then rename system.alt as system, reboot and see if you can boot/login to old installation. The reason I suggested this is sometimes the corruption of the file is done at an ntfs/filestore level problem that chkdsk can fix - so can appear as miraculous recovery if it works! (but if the corruption is to the data in the registry hive, then obviously this solution won't work).

The only other approach I can think of is to try to load the original (corrupted) system hive file from regedt32 in the parallel installation - find the corruption (don't know how), remove it and unload the hive again (but would require additional research obviously). Or you could try posting the problem in 2k or XP forums (as both can have similar problems to this), as there are more people using those forums - bcastner particularly is very good.