How to edit reg. in Windows that won't boot.

Simple question: How do I edit the registry of a copy of windows that no longer boots? The answer I suspect is to use a Windows LiveCD of some sort. Years ago, I did this by installing another copy of windows in a C:\windows123 directry, the doing the "load remote hive" trick.

I tried generating a Windows PE disk using pebuilder3110a, but it generated crypic errors & wouldn't write an ISO file. Isn't there a Windows LiveCD somewhere out there that will boot on most anything, pre-configured? (basic stuff; VGA support, no NIC.. etc etc...)

Reason: I re-sized some partitions on this disk, and didn't realize the impact of deleting one of the partitions (not the one windows was on, but none the less, it caused the drives to re-order them selves or re-letter themselves). I put the partition back, so the order is correct now, just as it was before I messed with things.

Now, I've inherited that "login-then-logout" issue (Enter username & known-good PW, then "Saving your settings..." is displayed, then you're back to a ctrl-alt-del login screen. Microsoft article 555648 looks good to fix this, but I need to see the registry of my non-booting windows. How to?

 

To be honest with you the operating system can be (permanently) damaged; but its always worth the try.

I looked into the article and i thought its pretty good one; just a matter of connecting the defect computer with another compatible computer to edit the corrupt registry files (shell and userinit) which sit in Winlogon. But then i knew where you coming from: you cann't start your computer so how on earth can you connect to the other computer let alone log in your own registry or write your computer name.

So i thought the only way to get into your own registry is if you are able to boot from SAFE MODE; unless there is a registry command that you can run from Command Prompt Screen which is also in the Advanced Windows Boot Options where safe mode is. I would say keep this as a last resort, if it works, and try first Last Good Configuration which you also can access by Advanced Windows Boot Options. Below are Microsoft links for how to access safe mode and last good configuration:

http://support.microsoft.com/kb/307852/
http://support.microsoft.com/kb/315222/

 

Darn - I should have been more clear.. the machine boots up to a Ctrl-alt-del login, but it suffers from the login-logout loop. The machine boots up just fine, but I can't log into a shell.

 

also, booting safe mode, and 'last-known-good' result in the same login-logoff loop.

 

In my earlier post I suspected, because of the altering of the partitions, that "…the operating system can be (permanently) damaged; but its always worth the try."

As you might have read in that Microsoft article 555648 the culprit is that the following Registry key is corrupt:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

You write also, "the machine boots up to a Ctrl-alt-del login…but I can't log into a shell.â€

No wonder because Shell as well as Userinit are located in Winlogon which is "responsible for handling the secure attention sequence, loading the user profile on logon…â€:

http://en.wikipedia.org/wiki/Winlogon

“A shell is a piece of software that provides an interface for users to an operating system which provides access to the services of a kernel.â€

http://en.wikipedia.org/wiki/Shell_(computing)

“The userinit.sh file is a user-generated shell script that is executed during system start-up…â€

http://wiki.cyanogenmod.com/index.php/Userinit.sh

Okey, now having said all of this, the next logical step is to edit Shell and Userinit in Winlogon:

Shell=explorer.exe
Userinit = x:\windows\system32\userinit.exe

(replace x with the letter designated to the operating system, which is probably a C)

I think your one and only best tool is http://www.pcregedit.com/ from TonyT. This might be your salvation as of now. I would suggest to use a working computer and burn the PCRegedit 2.0 on a CD and run it on your pc. You do not need Windows to boot up this CD on your computer.

Notice:

1. If the CD does not boot, check boot sequence in the BIOS and make sure that the CD-DVD Drive on top of the list.
2. If every thing went well and you were able to boot the Operating System, which I hope it for you, you might want to scan your system against virussen because Winlogon is unfortunately a hit spot of Trojans and what have you, which can prevent a system from booting or even starting from Safe Mode.

 

PCRegEdt worked great; I was able to look into the registry on XP (which is not booting on its own). Unfortunatly, the path for userinit was correct. It was on the D:\ drive just like it was supposed to be. Here's another idea.. I read a post somewhere, where someone said they had to make their CD drive invisible to XP, in order for it to boot. -Maybe since I fooled with my partitions, the CD drive is being detected as the D:\ or something...

Question: Remember this system dual boots XP and Vista. Vista works fine. When I boot Vista, the XP partition comes up at d:\ just fine. However, how can I tell what drive-letters are being detected when XP boots? The driver letters assigned to each device are only significant inside the OS - meaning that Vista might see a certain partition as D:\, but another OS on the same disk might see it as another letter somehow.. I bet that's the issue here...

 

I will make a stab in the dark, only if the start sector # of the XP partition was moved.

Did you move the start of the XP partition ? Do you have more then 1 hdd ? How many partitions and what is on each ? list of primary and logical volumes ? Does XP boot via Vista's boot manager ? if not how ? What OS did you install first ? (if the below does not work)

If so that can result in problems if there is a Windows installed OS in a lower order partition. It can cause XP to try booting into both OS's and causing weird results. Note: This can happen if 2 XP installs not sure about with Vista but likely.

Depending on just how you have the hdd /OS's set up will determine the correct way to fix problem. Can try:
1) would boot into Vista and make a back up copy of the XP's registry folder (X:\Windows\System32\Config)
2)use PCRegEdt (I have never used the program) and delete HKLM\System\MountedDevices
3) try rebooting and hope.

HKLM\System\MountedDevices\DosDevices\X: (X:=drive letter) , the OS uses the value in that key to tell it just where to load the OS from and what drive letters to assign the other partitions. If the start sector of partition is moved , then the OS load routine must guess and not always correct.

in above the "00,75,00,75" = the hdd ID found in the MBR at offset 01b8.
"00,a0,db,6b,18" represents the starting sector # for the partition found in the MPT after some math.

Could tell you the correct value for DosDevice\X: but would have to have the physical start sector # for the XP partition.

 

Thanks for the out-of-the-box thinking.. We've stumbled on something important here...

The position of the XP partition *was* indeed moved. I needed to make the XP partition bigger, and the only free space I could get, was in FRONT of the partition, so I moved the start of the partition *forward*, I couldn't move the rear of the partition backwards...

A's to Q's:

The HDD in question is a single 250G drive. 1st partition was for diag utilities, and is ~30MB. This was orignally deleted, but replaced when I thought it fouled up the partition order. 2nd Partition is XP, and is 30GB. 3rd partition is Vista.

All partitions are primary.

XP was installed first, then Vista was installed, because someone told me that the Vista installation will detect XP, better than the other way around. XP boots via the Vista boot-loader.

Vista boots just fine. XP boots OK, but suffers the login-logout loop.

I can get XP to boot only by using a bootable flash-drive with NTLDR on it. I was unsuccessful in 'teaching' the Vista boot-loader to boot XP. When I try to boot XP from the Vista boot-loader, I get "/NTLDR is missing or corrupt.." XP only boots using the bootable flash-drive.

++++++++++++++++++++++++++++++

IN order to figure out what value to plug in for the DosDevices key, I bet GpartD will tell me the 1st block # of my XP partition....

 

"/NTLDR is missing or corrupt.." that error would lead me to suspect a wrong entire in XP's boot.ini.
multi(0)disk(0)rdisk(0)partition(XX)\WINDOWS= ect.. XX=partition #

if it boot ok from flash-drive.

 

You must have the sector # not block #. On my comp 1 block=2 sectors but do not know if that is always the case. (using linux fdisk -l but best to use fdisk -l-u).

If you get the sector # , multiply it by 2, convert to hex, then convert to little endian format.

For my XP partition:
start sector # 204860880 * 2=409721760=186BDBA0hex=00A0DB6B18 little endian format (add first 2 zeros to put 18 at the 9th place) check post # 12

 

I looked at fdisk while booted off of CloneZilla LiveCD.

1st partition: FAT32 1-588

2nd partition: NTFS 589-4744

3rd partition: NTFS 4745-30394

NOTE: The 3rd partition was marked with the "* ", meaning it was marked as the boot partition. --Remember that [when it used to work], XP would boot via the Vista bootloader.

I think these are sectors, because the report from fdisk said the disk had 30394 sectors, and I see that number above...

The wording said:

255 heads, 63 sectors/track, 30394 cyliniders
Units = cylinders of 16065 * 512 = 8225280 bytes

I'd post the screenshot, but this site doesn't allow direct upload; I can only link to another repository...

 

Those values are not the true sector # for the partitions.
The first partition can not start at sector #1 , it normaly starts at sector #63 . Will try to give the MountPoint (MP)data but could be off by 1 sector, due to my math. I will also assume the first partition start at sector 63. Will add 62 to the start of each partition.

Fat32- sector 63*2=126--7E hex-- MP==xx xx xx xx 00 00 00 00 7E
XP - sector 651*2=1302--516 hex--MP==xx xx xx xx 00 00 00 16 05
Vista 4807*2=9614--258Ehex -MP==xx xx xx xx 00 00 00 8E 25

I do not know what drive letter XP should be. The one MP value should be correct for Vistas value above, and the one for the FAT32 should be seen. The only one left would be XP's.
You could post current MP's if you can not decide or the one for Vista is not the same as I have posted. (It would be due to me, not wrong value in registry)

 

I'm always a fan of supplying too much info, rather than not enough. I can post current mountpoint data from XP's registry, and I can post MountPoint data from Vista (NOTE: Vista does see & mount the D:\ drive just fine). D:\ is where XP is.

It'd be interesting to see to what degree they're similar. Since the start of the D:\ drive changed, and Vista successfully detected it, does this mean Vista wrote the actual, proper mountpoint info into *its* registry? Maybe we can use that one. --I'll post the info a little later. Thanks for helping me get my XP back!!

Sure, I could have re-installed XP by now, but its great learning this stuff, and it's pretty much why we're all on windowsBBS...

 

I do not have Vista, but very possible.

I did make a mistake in my post #18 above . Should read:

Fat32- sector 63*2=126--7E hex-- MP==xx xx xx xx 00 7E 00 00 00 00 00 00
XP - sector 651*2=1302--516 hex--MP==xx xx xx xx 00 16 05 00 00 00 00 00
Vista 4807*2=9614--258E hex - MP==xx xx xx xx 00 8E 25 00 00 00 00 00

xx xx xx xx = the HDD ID found in the MBR
00 = is a space placement only
next 7 double digits is the sector # *2 hex in little endian format (lest significant bytes are first)