Recovering From a SYSTEMced Error

Submitted by jroos on Wed, 10/16/2002 - 13:00

Note: This procedure has been superceeded by the availability of the Windows 2000 Registry Repair Utility. Please see my tip on how to make it into a bootable CD and try it before you try this tip.

The Windows 2000 SYSTEMced error occurs when the system can't load the SYSTEM hive of the registry. The reasons include the SYSTEM hive being damaged, missing or too large to load.

The cause I've experienced most often has been the hive being too large to load. The SYSTEM hive has to share 16 MB of memory with several other processes when it is first read so if the hive is 16 MB and the other processes take up 3 MB it just can't be read. Microsoft has instructions for recovering from a hive that gets too large in knowledge base article Q269075. However, I've never been able to recover a system using only the method they specify. Microsoft assumes that the SYSTEM hive is too large because there are a large number of shared resources and their fix is to eliminate the key of the hive with the shares in it.

If the SYSTEM hive isn't large due to shares then what makes it too big? As the system reads, writes and deletes data in the registry, it sometimes leaves gaps. While the size of the actual data may not increase by much, the system still has to read in the entire file. If there are 3 MB of data and the registry file has 13 MB of wasted space, there's going to be a problem. Normally the wasted space doesn't get very large, but occasionally a bad program or runaway process makes a mess of the registry.

I recently discovered a program called RegCompact that eliminates the empty wasted space from the registry. Unfortunately it only works on hives that are currently loaded so if you follow Microsoft's instructions and replace the oversized hive with the backup you won't be able to compact it.This procedure requires logging into the recovery console and changing registry hives. If you've come this far chances are your system is already not working right. You could still make things work so take care.

Follow my instructions to repair a SYSTEMced failure that is not due to a large number of shares. These steps are very similar to Microsoft's but we'll assume the problem is not with shares.

  • Use the Windows 2000 CD-ROM or Windows 2000 startup floppies to boot up.
  • Choose R to enter the repair menu.
  • Choose C on the repair menu to run the console.
  • Select the installation of Windows you wish to repair and enter the administrator password.
  • Type cd system32\config and press enter.
  • Rename the bad SYSTEM hive and its alternate by typing ren system system.bad then enter and ren system.alt systemalt.bad then enter.
  • If you have run the Emergency Disk Wizard in the Windows Backup program, type copy C:\WINNT\Repair\Regback\system and press enter. Most if not all of your drivers will already be installed.
  • If you have not run the Emergency Disk Wizard type copy C:\WINNT\Repair\system and press enter. This is the default system hive and you will likely have to install drivers when you reboot.
  • Remove any CDs or floppies and type exit and press enter to reboot.
  • Once Windows boots and you've installed any necessary drivers obtain and install a copy of RegCompact
  • Go to Start -> Run and type regedt32.exe and click OK
  • Locate the window titled HKEY_LOCAL_MACHINE on Local Machine and click on HKEY_LOCAL_MACHINE.
  • On the menu go to Registry -> Load Hive...
  • Navigate to C:\WINNT\system32\config and select system.bad then click Open.
  • For the key name enter System.bad and click OK
  • At this point the bad hive will either load or it won't.
    - If it doesn't load, it's simply corrupted. You can either use the backup hive you just loaded or start with a fresh install.
    - If it does load, continue on with the fix.
  • Exit the Registry Editor.
  • Open RegCompact. You should see system.bad in the list of hives. Click Compact. The computer will restart.
  • After
    the system has booted up into windows again, reboot and use the Windows
    2000 CD-ROM or Windows 2000 startup floppies to boot up.
  • Choose R to enter the repair menu.
  • Choose C on the repair menu to run the console.
  • Select the installation of Windows you wish to repair and enter the administrator password.
  • Type cd system32\config and press enter.
  • Rename the temporary SYSTEM hive and its alternate by typing ren system system.bak then enter and ren system.alt systemalt.bak then enter.
  • Copy the formerly bad system file to make it the actual system hive by typing copy system.bad system. There is no need to replace the alternate file because Windows will create a new one.
  • Remove any CDs or floppies and type exit and press enter to reboot.

Your computer should now be running as well as or better than it ran before the SYSTEMced error.

Modified 2003-09-04