Server platforms Toolkit

Recover the system hive of a Windows server

Tags:
Windows,
System,
Backup,
Servers

Peter Parsons Tech Republic

Published: 25 Feb 2003 08:55 GMT

The Windows server registry is the place where angels fear to tread. It's a mysterious spot with strange spellings, quirky capitalisation, and odd characters, but it's also the heart of your server's configuration. If there's a problem with a Windows server's registry, the entire network could suffer. I'm going to describe some problems with the system hive of the registry and explain how to recover from them.

A registry refresher
The registry is a database that records and updates all the settings and changes you make on the computer. If you change your wallpaper or your display settings or install software on your server, Windows 2000 records these changes in the registry. The registry consists of subtrees, keys, values, data types, and hives.

Subtrees represent the logical structure of the registry. Keys, values, and data types are the information contained in the registry subtrees. They are all part of the registry's logical structure. Data types represent the kinds of data the registry is expected to record (for instance, simple text strings or binary information). Hives, on the other hand, represent the registry's physical structure.

You can edit your server's registry using two utilities, Regedit (Regedit.exe) and Regedt32 (Regedt32.exe). Other than appearance, the difference between the two registry editors is fairly small. Principally, Regedt32 offers a security feature called Read Only Mode that, when selected from the Options menu, allows users to read the registry but not edit it. This minimises the risk of users making small mistakes with big consequences. Regedit doesn't have this feature, but it does offer a direct path to all of the subtrees instead of requiring you to jump from window to window. Even though both tools look different and have subtle internal differences, they're referred to by the same name, the Registry Editor.

The system hive holds your configuration settings
The system hive contains the system configuration information a machine needs to boot up correctly -- which drivers to load, information on hardware profiles, what services to start, and which software settings to implement. You'll find the system hive in the Registry Editor at Hkey_local_machine\system. The system hive stores configuration data in the CurrentControlSet subkey.

Just like any database file, the system hive exists as a physical file on your server's hard drive. You'll find it in the %systemroot%\system32\config directory. If you look in this directory, you'll see a bunch of files, including one called System and another called System.alt. System is the system hive, and System.alt is a complete copy of the system, for fault-tolerant purposes.

Problems with the system hive
Various limitations to the size of the system hive file can cause problems. To load and execute properly, the system hive file should be no larger than 13 MB. If it's larger, the Windows 2000 boot process will fail.

This limit exists because the system hive loads in a low-level environment in which only 16 MB of RAM is available to the boot process. The system hive loading process must share that 16 MB with the NT loader, the NT kernel, the HAL, and any required boot drivers. On a typical server, that doesn't leave much RAM to spare, so a big system hive can cause the boot process to fail.

The system hive file can be quite large even in an ordinary machine. For example, one of the machines I run is a laptop with various standard applications. It's not a heavy-duty machine by any means, but the system hive is 2.6 MB. Another machine I run as a testing server has a system hive of 5.5 MB, and it's not doing anything really fancy either.

Add to this the fact that as the system hive grows, it becomes fragmented. Fragmentation is bad in itself, but it also leads to file corruption. If all this happens to your system hive, you're going to have a dead server on your hands before too long.

You can limit the size of the system hive so that it doesn't grow beyond 13 MB, but that doesn't work with Windows 2000 domain controllers. It may work with servers that are running a significant number of shared resources and whose registries are too big. If your server falls into this category, you can check out the Microsoft Knowledge Base for the registry entries you need to make.

Go to section: