Windows server 2016 registry keys were removed suddenly

Question

Hello,

I'm facing a problem with windows server 2016, many registry keys are being removed suddenly, this happens in more than one machine and i can't identify the problem of this deletion.

These registry are located in "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"

Can anyone help me please.

Answer 1

Hi.

Registry keys suddenly disappear, the reasons may be:

Virus infection: Some viruses will attack the registry, destroy the data in it or directly delete the registry, causing system problems.

System errors: Certain system errors can cause issues with the registry, such as Windows update failures, hardware damage, etc.

Have any of the above conditions happened to you recently?

Please try the following solutions:

1. Perform System Restore: If you have ever set a system restore point, you can try to use System Restore to restore the registry.
2. Use registry backup: If you have backed up the registry before, you can try to use the backup to restore the registry.

Note: Before doing the above, make sure to back up your important data.

Hope the information is helpful.

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hello there,

Was there any log in Event Viewer?

I would suggest you use Process Monitor to monitor when registry keys are modified.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file

system, Registry and process/thread activity. You can get the tool from here

https://docs.microsoft.com/enus/sysinternals/downloads/procmon

System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log

system activity to the Windows event log.You can get the tool from here

https://docs.microsoft.com/enus/sysinternals/downloads/sysmon

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--