Bart's Weblog

Just a blog…

Windows 2000 could not start because the following file is missing or corrupt: \WINNT\SYSTEM32\CONFIG\SYSTEMced

Posted by bartvdw on 1818/0606/2008

This was a nice message when booting a server, but not so fun actually. First of all, the “ced” at the end of the error is not really part of the message, but a formatting error from MS. What the message really is: your SYSTEM registry is missing or corrupt. Below the things I went through…

I booted using Win PE 2.0 and checked the file presence, it was there. I checked if I had some good copy in the “Repair” directory, copied it over and booted the system. The I tried to restore system state from backup. At that moment I noticed that my SYSTEM registry wasn’t fully restored… I started looking further and saw that the file was +/- 23MB, but after a restore I had only 2.3MB. So why the difference?

I then restored the system state to a different file location, to see what the file size is. That was OK! So what was happening?

After looking around a bit, I found that the SYSTEM hive shouldn’t be that large. If it’s too large, Windows 2000 will fail to boot. So question was: why is it so big? I copied over the file and started investigation. I loaded the hive in my registry and started exporting first level. This indicated all big stuff was located in “ControlSet001”; second level indicated “Enum”. Then we looked around a bit and we opened the “Root” key. We found a very long list of “LEGACY_TRISVC*” entries.

We checked is and apparently this was coming from IBM Director, a know issue even! We cleaned out those entries, ran “RegCompact Pro” on the hive and the result was a SYSTEM hive of about 2.7MB!

Below some references that give you some background about possible causes for this error, which we all checked. I found out that when you run into this issue, it can be hard to detect the real cause. Once you know it, like we did with the long list of “LEGACY_TRISVC*” entries, you will be able to recover the system like it was before (if you have a decent backup).

Error Message: Windows Could Not Start Because the Following File Is Missing or Corrupt: \Winnt\System32\Config\Systemced
http://support.microsoft.com/kb/269075

The System hive memory limitation is improved in Windows Server 2003
http://support.microsoft.com/kb/302594

Missing or corrupt Systemced – part 2 (Blog Justin @ TechNet)
http://blogs.technet.com/justinturner/archive/2006/12/21/missing-or-corrupt-systemced-part-2.aspx

EDIT 21/08/2008: Link from IBM
New in version 5.20.2
http://publib.boulder.ibm.com/infocenter/eserver/v1r2/index.jsp?topic=/diricinfo_5.20/fqm0_r_summary_of_changes_in_release_5.20.2.html

IC53455

Many TRISVC* registry entries are created on a Level-0 managed system running Windows 2000.
Advertisements

2 Responses to “Windows 2000 could not start because the following file is missing or corrupt: \WINNT\SYSTEM32\CONFIG\SYSTEMced”

  1. Greg Grebin said

    This is the exact issue that I am experiencing. I have our IBM Director experts looking into it right now. If you have a URL showing the Director bug I would sure appreciate you sending it to me. Thanks a lot for posting this issue! Greg

  2. bartvdw said

    Hi Greg,

    I’ve updated the post with the link. Version impacted is 5.20
    Issue should be solved with 5.20.2 as you can see in the link of the updated post (IC53455).

    Happy to hear this post has helped you!

    -Bart

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: