Registry Problems with Windows 2000 Terminal Server

jasonb

Hi there...

Sorry for the long post, I find it's better to include as much info as possible in these posts!

The Backup Exec backups of my Windows 2000 Terminal Server have recently ( last few weeks ) started reporting problems backing up the System State ( the registry ).

I've tried backing up the System State with Windows Backup on the server itself and it reports the same problem...

Error: You do not have permission to access portions of System State\Registry\software.
Please see the owner or administrator to get permission.
Warning: Unable to open the file \Registry\software - skipped.

This is not a permissions problem, apart from updating Microsoft Patches nothing has changed on the server for months and this only happened recently. The backups are being run as the Domain Admin which has full permissions on the server.

I tried to save the HKEY\Local Machine\Software key using regedt32 and it won't let me, it says it couldn't be completed. I managed to narrow it down to HKEY\Local Machine\Software\Classes, it's this key that has the problem. In fact, not only can I not save it with regedt32, but if I open it and scroll down through the numerous entries there, regedt32 hangs. I've been able to export the key using regedit, but it's a huge file and the corruption isn't obvious.

So, I reckon I've basically got a corrupt HKEY\Local Machine\Software\Classes key. I can't backup the key, so I'm feeling very dodgy about doing much to it. I know there's a host of 'registry cleaners' out there, but I'm also unsure of running them on a production Windows 2000 Server ( it's our Citrix server ).

I've done a fair bit of searching online, but haven't found any helpful answers ( it's either make sure the permission are ok, and they are ) or lots of 'sales' sites about registry cleaners. Hence me posting this here.

So, anyone out there got any suggestions? Would running a registry cleaner help at all, and is there any particular one you'd recommend? Or am I taking my life ( or at least my career! ) in my own hands by doing that on a production server? Is there any software that can scan a .reg file ( as I was able to export the key to classes.reg ) for problems. This way I could scan the exported key first, before dealing with the production one. Thanks in advance for any advice...

J.

ressem

I wouldn't think that the average registry cleaner will work, but could be wrong. Usually they remove obsolete keys, keys using NULLs to hide themselves or whatever.

It might be worth examining old versions of the SOFTWARE hive.

Can you make a copy of the SOFTWARE file stored under
C:\WINDOWS\system32\config and try opening it using an offline registry tool like
http://www.sysdevsoftware.com/soft/dreg.php

If this tool fails to display the key then compare it to older versions of SOFTWARE from backup files, to see whether you have an old copy of the registry which can be used to replace it.

jasonb

Hi there...

Thanks for your reply. I can't copy the file out ( it says it's in use ) and I'll have to check older backups to see if I have an older copy of the registry. I presume if I were to restore an older version then I'd be potentially messing up the server is something did change on the server ( that I didn't know about ) and then I went back to an earlier version, thus messing up that change?

J.

Jaoibh

Hi

I've seen this before while installing Service Pack 2.
cmd - regedit - browse to the folder where the registry setting its giving you the error and then right click on the folder and choose permissions. Add the appropriate permissions and restart the server.

It worked for me. let me know how you get on.

ressem

You can copy the file by doing a system state backup, then extracting to an alternate location.
Or by using the recovery console but that's probably not best.

If you don't have an up to date backup, less than a few days old, then yes you can't really restore it on a production machine.
If the old file loaded and the new one did not, then that would hint to you when the problem is not, if you need to alter the live registry.

jasonb

I'm pretty certain this isn't a permissions problem Jaoibh, but when I did try to change the permissions it wouldn't let me for the Classes key ( another reason why I think that key is corrupt ).

Ressem, the most recent good backup I have is 2 months ago ( due to some unrelated backup issues which always seem to happen a month before any problem pops up so that you're then fecked! ).

I can't copy the file by doing a System State backup as the problem I'm experiencing is an inability to do a System State backup! It's the System State Backup failing that alerted me to this problem in the first place...

J.

ressem

Sorry, didn't reread the original post today.

Can you try hobocopy which uses the volume shadow service to copy these open files?
http://www.pluralsight.com/wiki/default.aspx/Craig/HoboCopy.html

EDIT: of course not, VSS not in 2000 Server.

Looks like you need to restart the server in recovery mode then to copy the registry files.

jasonb

Hi ressem...

Yep, I think that's what I'll have to do. If I can get my hands on a copy of the software file from winnt\system32\config I can at least try some software on it to recover it and see what happens. I've read in a few places that if you do a 'load hive' in regedt32 on a W2k3 server it automatically runs a repair, so maybe loading the hive onto my Windows 2003 Server might help?

If not, there are also a couple of programs out there ( RegDatXP and Regrecover ) that might repair the hive. The trick is getting a copy of the hive first, and hopefully the recovery console will let me do that...

J.

jasonb

Another update...

I used the recovery console to get a copy of the software file.

Now, here's the weird thing. I'm able to load the hive ( from the copied file ) into Windows Server 2003 regedt32 no problem, I can browse the Classes key, and when the hive is loaded I'm able to backup the System State of that server with no problems ( therefore backing up the hive ). That suggests there's nothing wrong with the hive.

Next, I ran RegDatXP and Regrecover on the copied file and both of them report no problems with it. However, chkreg seems to hang when running against the file ( though maybe I just haven't left it running long enough ).

If I try to load the hive ( from the copied file ) into my PC's Registry ( Windows 2000 Professional ) it loads fine, but when I try to browse the Classes key regedit32 hangs. And if I try to load the hive ( from the copied file ) in the Registry of the server it actually came from ( in other words, the server that has the original Software file as part of its registry - Windows 2000 Terminal Server ) it says the operation cannot be completed.

So, what does all this mean? The hive itself seems to be ok, but I still can't backup it up on the server and there still seems to be issues even trying to load the hive on the server. Any ideas?

J.

barrywohl

This problem just popped up on my Windows 2000 Server SP4 Terminal Services Server. I get the same message and I cannot backup the system state with either Backup Exec 12.5 or with NTBackup.

I hope you found a solution you can share.

Capt'n Midnight

yes there are some registry keys you can't see
microsoft internal stuff

but no this should not stop you backing it up

Try this to get a backup of the reg files - at least it will confirm no bad sector in the file and you could manually restore the reg later as a Plan B while you sort out the system state


http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/AdminTips/TroubleShooting/Windows2000ERDandRecoveryConsole.html

o create a Windows 2000 ERD disk:

* Start
* Run
* Enter ntbackup and click OK
* Click on Emergency Repair Disk button on the Welcome to the Windows 2000 Backup and Recovery Tools window

Follow instructions on screen from this point.

Why does the Windows 2000 ERD not include registry hives? Microsoft's position is that there is simply not enough space on commonly available removable media. When you update the w2k ERD, the registry files are copied to %systemroot%\Repair\Regback. Potential gotcha! for NT gurus: unlike Windows NT, the w2k Repair directory only contains the original installation hives only. Updated hives go to Repair\Regback. The registry files are only updated when you run ntbackup with the backup system state data option.

You could also try this in safe mode in case some AV or malware package is interfering