Dell 2450 can't boot - hive error

June 20, 2005 1:27 PM

I have a Dell server running Win2K Server. Registry damaged and won't boot now. Returning 'Hive Error'. No viable backup available. Help recover/repair?

I've got a Dell 2450 server (Service Tag: 9VHZ201). It's running Windows 2000 Server. The server froze up over the weekend and upon reboot, returned the following error:

--
-- STOP: c0000218 {Registry File Failure}
-- The registry cannot load the hive (file):
-- \SystemRoot\System32\Config\SOFTWARE
-- or its log or alternate.
-- It is corrupt, absent, or not writable.
--
-- Beginning dump of physical memory
-- Dumping physical memory to disk: ##
--

Of course I don't have a good backup of the registry or the data and there's critical data on the server which I desperately need. I completely deserve all the bad stuff that's happening to me, but this sinner wants a second chance!!

While restoring the server to its former glory would be great, I would be more than happy just to be able to download the databases and Excel files I need and then reinstall Win2KServer (along with a big old honking backup unit).

Any help would be great appreciated!

posted by Lactoso to computers & internet (8 comments total)

Take the hard drives out and slave them in a second Win 2K or XP box, or put the drives into external drive enclosures. They'll show up as different drive letters — copy and paste what you need.
posted by Rothko at 1:53 PM on June 20, 2005

How did you have your drives configured? The Dell PowerEdge 2450 comes with a hardware RAID card, so if they were set up as a RAID, you won't be able to mount your data in an external enclosure or slave them off another computer.

Regardless of how they're configured, you should be able to simply install another copy of Win2K over (or alongside) the existing one -- making sure NOT to erase the partition first -- and you'll then be able to access your data.
posted by pmbuko at 2:12 PM on June 20, 2005

if you have hardware raid, boot with a linux bootcd (I use a gentoo livecd, but knoppix should work well too) and backup to the network.

Be warned though, registry getting corrupted may well mean a HD is dying on you. I'd replace the disks if I had the money for it. You don't want to fuck around with bad disks (alternatively, RAID 1 could possibly save you from this).
posted by devilsbrigade at 2:37 PM on June 20, 2005

devilsbrigade writes "Be warned though, registry getting corrupted may well mean a HD is dying on you"

Boot knoppix and run smartctl (you'll have to "su root" to do this):

smartctl -a /dev/hda

This will tell you if your disk thinks it is failing.

Knoppix will also let you read NTFS and read and write FAT32, if you want to try manual repairs.

Otherwise, use the Windows install disk to repair.
posted by orthogonality at 2:42 PM on June 20, 2005

(A note on the above - keep in mind that it may not be /dev/hda depending on your IDE/SATA/SCSI setup - my primary drive is /dev/hde. Just make sure you watch on boot)
posted by devilsbrigade at 2:49 PM on June 20, 2005

The school solution is to run a repair of the registry using a current emergency repair disk (got one, right? ..yeah, me neither ).

If an ERD is not available, boot into the recovery console and replace the hives in %systemroot%\system32\config with the same hive from %systemroot%\repair

(I like orthogonality's idea too)
posted by stupidcomputernickname at 4:08 AM on June 21, 2005

The school solution is to run a repair of the registry using a current emergency repair disk (got one, right? ..yeah, me neither ).

In which case, the lesson is simple. Make the ERDs. You're running a Windows server in production without them? Bad call.

Recovery depends on how the drives are laid out. If the drives are just single drives on a controller, you can just move them to another machine and read off the data. (Single drives? In production? Bad call.)

If it's an array, though, things get harder.

What I would do, given the setup and tools I would have.

0) Restore from the ERD, if that failed, from Tape. You don't have those. I will make a short version of the lecture here:

ERDs and system backups aren't only data protection, they are job protection. If you can't recreate a server, given nothing but the tapes and the hardware, you aren't backing up, and you're not fit to be a production sysadmin. Another way of saying is this: You don't need backups. You need to be able to restore data. Backups are a big part of that, but so are other fiddly bits.

Once you've fixed this problem, I hope you'll budget a couple of weeks to making sure that the next time it happen, you can say "Eh, I'll restore it, no big deal."

I had a stupid bit in a script that erased, well, about three whole network shares. Why do I have a job? Becase I was able to restore them quickly. (Kids: Those who assume that variables are set will lose someday. In particular, "rm -rf $LTEMP/*" is a bomb waiting to go off.)

Lecture over.

1) Ghost the box off. You don't have Ghost? Get it, set up a dump server. If you screw up, you can go back to this step if you have a good image. Otherwise, everything you try may destroy the data forever.

2) Try stupidcomputernickname's idea. Note, it is safer to copy off the original hives, and the copy over the repair hives, than it is to simply copy the repair hives over the original hives. But, hey, it's quick, and with a ghost image, if you do hork things up, you restore the image, and then...

3) Do the "repair" reinstallation of Win2K. If you have a raid controller, you'll almost certainly need the right driver on floppy to do the install. This may get you back to normal, but you'll want to teardown and rebuild once you get the data off -- patching will really suck otherwise. You'll certainly need to rerun most of the updates, and they may get picky.

4) If that fails, ghost back, and do a normal install, WITHOUT FORMATTING THE DRIVES. This will leave you at Win2K SP0, but will let you read the drives. Read off the data, then rebuild the box.

Another option. Remove the disks, install another disk on a different controller, install Windows. Reinstall the original disks into the box (leaving the new drive), tell the controller to *not* boot the box. Boot up, use diskadmin to mount the array. Dump the data off to somewhere safe.

Once you have the data safe, you've changed the problem to "I need to install Windows 2000 on this box." -- a much simpler problem set.
posted by eriko at 5:17 AM on June 21, 2005

Thanks for all the answers everyone! I'm going to march down the list this weekend and will post my results as well as marking the best answer.

Thanks again!!
Ed T.
posted by Lactoso at 5:57 PM on June 24, 2005