{"id":8943,"date":"2022-10-11T22:08:46","date_gmt":"2022-10-11T20:08:46","guid":{"rendered":"https:\/\/michlstechblog.info\/blog\/?p=8943"},"modified":"2022-10-13T10:46:00","modified_gmt":"2022-10-13T08:46:00","slug":"windows-bluescreen-0xc0000225-windowssystem32configsystem-could-not-loaded","status":"publish","type":"post","link":"https:\/\/michlstechblog.info\/blog\/windows-bluescreen-0xc0000225-windowssystem32configsystem-could-not-loaded\/","title":{"rendered":"Windows: Bluescreen 0xc0000225,  \\windows\\System32\\config\\system could not loaded"},"content":{"rendered":"<div class=\"twoclick_social_bookmarks_post_8943 social_share_privacy clearfix 1.6.4 locale-en_US sprite-en_US\"><\/div><div class=\"twoclick-js\"><script type=\"text\/javascript\">\/* <![CDATA[ *\/\njQuery(document).ready(function($){if($('.twoclick_social_bookmarks_post_8943')){$('.twoclick_social_bookmarks_post_8943').socialSharePrivacy({\"services\":{\"flattr\":{\"uid\":\"Michl\",\"status\":\"on\",\"the_title\":\"Windows%3A%20Bluescreen%200xc0000225%2C%20%20windowsSystem32configsystem%20could%20not%20loaded\",\"the_excerpt\":\"Hi%2C%0D%0A%0D%0Alast%20week%20a%20customer%20had%20the%20problem%20that%20its%20PC%20won%27t%20start%2C%20The%20computer%20performs%20a%20reboot%20loop%20into%20the%20recovery%20environment%0D%0A%0D%0AWithin%20the%20recovery%20environment%20I%20disabled%20the%20boot%20to%20WinRE%20to%20see%20what%27s%20the%20root%20cause.%0D%0A%20%28more%26hellip%3B%29\",\"txt_info\":\"2 clicks for more data protection:\\r\\n\\r\\nOnly when you click here, the button will be come active and you can send your recommendation to Flattr. When activating, data are transmitted to third parties. \",\"perma_option\":\"off\"}},\"txt_help\":\"When you activate these fields by clicking, information to Flattr may be transferred abroad, and probably may also stored there.\",\"settings_perma\":\"Enable permanently and accept data transmission. \",\"info_link\":\"http:\\\/\\\/www.heise.de\\\/ct\\\/artikel\\\/2-Klicks-fuer-mehr-Datenschutz-1333879.html\",\"uri\":\"https:\\\/\\\/michlstechblog.info\\\/blog\\\/windows-bluescreen-0xc0000225-windowssystem32configsystem-could-not-loaded\\\/\",\"post_id\":8943,\"post_title_referrer_track\":\"Windows%3A+Bluescreen+0xc0000225%2C++windowsSystem32configsystem+could+not+loaded\",\"display_infobox\":\"on\"});}});\n\/* ]]> *\/<\/script><\/div><p>Hi,<\/p>\n<p>last week a customer had the problem that its PC won&#8217;t start, The computer performs a reboot loop into the recovery environment<\/p>\n<p>Within the recovery environment I disabled the boot to WinRE to see what&#8217;s the root cause.<br \/>\n<!--more--><br \/>\nList all enties. Usually there Windows boot loader entry:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nX:\\&gt; bcdedit \/enum\r\n...\r\n\r\nWindows Boot Loader\r\n-------------------\r\nidentifier              {current}\r\ndevice                  partition=C:\r\npath                    \\Windows\\system32\\winload.exe\r\ndescription             Windows Server 2016\r\nlocale                  en-US\r\n...\r\n<\/pre>\n<p>and disable WinRE for this entry<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nX:\\&gt; bcdedit \/set {current} recoveryenabled No\r\n<\/pre>\n<p>During the next boot a Bluescreen occurs:<br \/>\n<strong>\\windows\\System32\\config\\system &#8220;The operating system couldn&#8217;t be loaded because the system registry file is missing or contains errors.&#8221;<\/strong><br \/>\n<!--more--><br \/>\nAfter booting with Windows PE I took a look in the &#8220;\\windows\\System32\\config&#8221; folder. The registry hives (files) DEFAULT, SAM, SECURITY, SOFTWARE and SYSTEM only have a size of 8192 Bytes and there were Files with a 1, 001 and 002 suffix.<br \/>\n<code><br \/>\nC:\\windows\\System32\\config > dir<br \/>\n...<br \/>\nDEFAULT001<br \/>\nDEFAULT002<br \/>\nDEFAULT1<br \/>\n...<br \/>\nSAM001<br \/>\nSAM002<br \/>\nSAM1<br \/>\n...<br \/>\n<\/code><\/p>\n<p>On a reference system these files does not exists and these files had a greater size. Seems there went something wrong:<\/p>\n<p>I used the <a href=\"https:\/\/www.nirsoft.net\/utils\/shadow_copy_view.html\" rel=\"noopener\" target=\"_blank\">ShadowCopyViewer<\/a> and <strong>copied from the latest restore point<\/strong> all files <\/p>\n<p><code><br \/>\nDEFAULT<br \/>\nDEFAULT.LOG1<br \/>\nDEFAULT.LOG2<br \/>\nDRIVERS.LOG1<br \/>\nSAM<br \/>\nSAM.LOG1<br \/>\nSAM.LOG2<br \/>\nSECURITY<br \/>\nSECURITY.LOG1<br \/>\nSECURITY.LOG2<br \/>\nSOFTWARE<br \/>\nSOFTWARE.LOG1<br \/>\nSOFTWARE.LOG2<br \/>\nSYSTEM<br \/>\nSYSTEM.LOG1<br \/>\nSYSTEM.LOG2<br \/>\n<\/code><\/p>\n<p>back and deleted the DEFAULT001, DEFAULT002, DEFAULT1 and so on.<\/p>\n<p>Michael<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi, last week a customer had the problem that its PC won&#8217;t start, The computer performs a reboot loop into the recovery environment Within the recovery environment I disabled the boot to WinRE to see what&#8217;s the root cause.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[1895,1894,1604,1896,20],"class_list":["post-8943","post","type-post","status-publish","format-standard","hentry","category-windowsknowhow","tag-windowssystem32configsystem","tag-0xc0000225","tag-bluescreen","tag-copy-files-from-restore-point","tag-windows-2"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/8943","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/comments?post=8943"}],"version-history":[{"count":6,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/8943\/revisions"}],"predecessor-version":[{"id":8949,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/8943\/revisions\/8949"}],"wp:attachment":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/media?parent=8943"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/categories?post=8943"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/tags?post=8943"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}