The size of the registry increases and your computer may not start after you join a Windows 2000-based computer to a domain (837330)


The information in this article applies to:

  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server

SYMPTOMS

When you join a computer to a domain or when you log on to a domain member computer, you may notice that the size of the registry increases substantially. If the registry becomes too large, Windows may no longer start. When this problem occurs, you may receive the following error message when you start your computer:
Windows 2000 could not start because the following file is missing or corrupt: \WINNT\SYSTEM32\CONFIG\SYSTEM

CAUSE

This problem may occur if Group Policy was used to apply large and complex discretionary access control list (DACL) entries to registry hives. When machine policy settings are applied, the size of the System hive may increase. In this scenario, when you have a complex DACL to apply to registry hives, and when these settings cause the DACLs to propagate to other registry objects, all the following behaviors may occur:
  • The Security Configuration Engine (SCE) receives the policy information.
  • The SCE calculates the DACL based on the hive DACL, on the policy DACL, and on the Access Control Entry (ACE) inheritance settings.
  • The SCE calls the appropriate APIs to apply the DACL to each registry key. In this scenario, inheritance causes some keys to receive DACLs more than one time because one or more permission entries are set on a particular key. Other more explicit permission entries are then applied.
Because of this multiple application and removal of large security descriptors, the registry hive may become fragmented or its size may increase.

RESOLUTION

To resolve this problem, reduce the complexity of the DACL settings that your Group Policy objects apply to the registry hives.

WORKAROUND

To work around this problem, manually copy the System registry hive to remove the "white space" or fragmentation that occurs when the large DACLs are overwritten by smaller and more explicit DACLs. To do this, follow these steps:
  1. Start the computer by using the Windows Setup floppy disks or the Windows 2000 CD. At the Welcome to Setup screen, press R to repair a Windows 2000 installation, and then press C to start the recovery console.
  2. Type the number for the appropriate Windows installation, and then type the Administrator account password.
  3. At the Recovery Console command prompt, type the following commands, pressing ENTER after you type each command:

    cd \winnt\system32\config
    copy system system.bak
    ren system system.old
    copy system.bak system

  4. Type exit, and then press ENTER to quit the recovery console and to restart the computer.

MORE INFORMATION

The size of the registry hive increases because many large DACLs are applied to many registry keys. However, when those DACLs are later overwritten by smaller DACLs, the size of the registry hive does not decrease. Instead, a "hole" or "white space" that is the size of the original DACL is left in the registry hive. This white space is removed when you copy the file, when you save the file, or when you run a registry scrubber on the file. The white space is removed because when the file is copied, saved, or scrubbed, only the data is saved. The white space is not saved. The size of the registry hive cannot decrease in other circumstances because it can only be reduced from the end of the file and not from inside the file.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

831260 "\WINNT\SYSTEM32\CONFIG\SYSTEM is corrupt" error message when you try to restart your Exchange 2000 server

Modification Type:MajorLast Reviewed:5/21/2004
Keywords:kbActiveDirectory kbDeployment kbenv kbinfo KB837330 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.