Missing or corrupt Systemced... What's that?

Technorati tags: Cluster, Setup, Boot, Windows 2000

Part 1 of 2

The on-call pager went off at two in the morning. John rushed in to discover that one of their main Windows 2000 file and print servers was sitting at a black screen with the following error displayed:

Windows 2000 could not start because the following file is missing or corrupt:

\WINNT\SYSTEM32\CONFIG\SYSTEMced

Well was it missing or was it corrupt!? He booted the server into Recovery Console, and went to the location mentioned in the error. It appeared to be missing---he couldn't find a file called "Systemced" anywhere...

There really isn't a file called SYSTEMced. The error message has just overwritten the message that normally appears there during system boot: "For troubleshooting and advanced startup options for Windows 2000, press F8."

Here is the message that is normally displayed at this point in the boot process: (notice that the ced from SYSTEMced is actually the last part of the word "advanced")

 The method of recovery for this issue is actually documented fairly well here: KB 269075 here: KB 323148  and here: KB 302829 There are several other articles that describe various methods of correcting the problem, but these cover the basic steps required.

Usually when I see the issue it is because the system hive is too large to load into memory. In Windows 2000 (and NT 4) we are limited to 16 MB of memory at boot time. You will likely first run into this problem when the system hive reaches just a little over 10 MB. Thankfully this memory limitation has been greatly increased in Server 2003.

Essentially what you do is boot using an alternate system hive, and then either restore the hive from backup, (in the case of a corrupted hive) or clean up space in the system hive if the boot failure is caused by the system hive being too large.

This is a very common problem. I've seen it three times in the past week. (and countless times in the last few years) Some customers have this problem so often that they have a process in place to check the size of the system hive before they reboot a server. (you know who you are ;-) ) Hopefully with this and the next post, I can convince some of you to correct the problem that causes the bloated hive in the first place so that you never have to see this error on reboot.

In the next post I will go over the chkreg.exe utility that I use to correct this problem, and ways to prevent it from happening in the future.

 

Stay tuned...

 

Justin

Comments

• Anonymous
  January 01, 2003
  This is part 2 of my earlier post on the whole " missing or corrupt system hive " issue. Okay, so we

• Anonymous
  January 01, 2003
  I sense that this hit a sore spot? :-)

• Anonymous
  December 16, 2006
  HAHAHAHAAHAH! DOH!