Re: HKLM\Software key grayed out

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

In microsoft.public.win2000.registry Matt Nowell wrote:

> Good morning,
>
> The details:
>
> Windows 2000 SP4
> IIS 5
> .Net Framework 1.1
> SQL 2000 SP3
>
>
> The problem: HKLM\Software key becomes intermittently
> inaccessible. This occurs on both a development box and a
> production box (both similarly loaded to the specs above). I'd
> post some event log messages, but there aren't any that seem
> relevant to the problem. A reboot resolves the problem, but
> we've had it reoccur.
>
> Originally we'd thought that the symptoms were limited to the
> scheduled TSM backups failing (couldn't read the password from
> the registry). Unfortunately, we now have the problem that
> there's a process run that schedules a job using Task Scheduler.
> That fails, due to the registry problems.

I should try running REGMON (Sysinternals) to see if the relevant
registry writes (assumed) can be logged.

> I've attempted to take ownership of the key, but the dialog
> fails with "Unable to display security permissions." Searches

Yet this is gone on a reboot? Initially it sounds somewhat like
corrupt security data in the SOFTWARE hive (which usually means
replace from last available backup hive file). But clearing on
reboot makes it seem more like some active process is modifying or
locking the key. See if Regmon can show you what process is
(presumably) "messing" things up.

I assume that Anti-* tools have been run on the system and came up
clean. I assume the process list is "normal" and that none of the
event log entries are unexpected or unexplained. Have you thought
to run RootkitRevealer (Sysinternals) just to eliminate one set of
possibilities? (the system should be quiescent for this RKR run)

Just some initial ideas to look at. Anything more you can think of
there to post, may be useful to others here.
.

Relevant Pages

  • RE: FTPD and Telnet password lost when ethernet cable detached
    ... credentials also if they are saved into the hive registry. ... You might check, then, calling GetCurrentUserExin both cases, network ... and FTP works fine and I never lost password after reboot also with cable ... RemoteAdmin interface use different password to login than ftp and telnet? ...
    (microsoft.public.windowsce.platbuilder)
  • RE: FTPD and Telnet password lost when ethernet cable detached
    ... credentials also if they are saved into the hive registry. ... You might check, then, calling GetCurrentUserExin both cases, network ... and FTP works fine and I never lost password after reboot also with cable ... RemoteAdmin interface use different password to login than ftp and telnet? ...
    (microsoft.public.windowsce.platbuilder)
  • RE: FTPD and Telnet password lost when ethernet cable detached
    ... passwords are stored in the registry by user name. ... You might check, then, calling GetCurrentUserExin both cases, network ... and FTP works fine and I never lost password after reboot also with cable ... RemoteAdmin interface use different password to login than ftp and telnet? ...
    (microsoft.public.windowsce.platbuilder)
  • Re: WMP 11 installation troubles
    ... wrong or your registry is corrupt. ... See http://zachd.com/pss/pss.html for some helpful WMP info. ... "C:\WINDOWS\system32\iertutil.dll" on next reboot. ...
    (microsoft.public.windowsmedia.player)
  • Re: AV in rsaenh.dll
    ... would bsod then reboot itself over and over again. ... the boot list. ... If this is a registry setting, is there anyway to reset sections ... execution via regsvr32.exe. ...
    (microsoft.public.windowsupdate)