I Deleted my own SID from the Registry

Question

Just I deleted my own SID from the registry (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList) in windows 2008 R2 server then I logged off. Now tried to log in but getting the below error:

The user profile service failed the logon. user profile cannot be loaded .

Please any one advice me, how can I get into the server.

Advance Thanks/

Retore from backup. You have a backup right? – Zapto Apr 17 '13 at 07:42 — Zapto, Apr 17 '13 at 07:42
Use another account/restore from backup? – Bart De Vos Apr 17 '13 at 08:13 — Bart De Vos, Apr 17 '13 at 08:13

score 1 · Accepted Answer · answered Apr 17 '13 at 08:16

Normally, removing the SID-named key from the ProfileList does not do all that much of harm - it just removes the association between the user and her on-disk profile copy. If the user has a roaming profile defined, it is simply re-loaded from the profile path upon next logon and stored in a different local directory in C:\Users. If the user has a local profile, it is created anew in a different directory. Windows detects the presence of a conflicting directory in C:\Users and generates new names (e.g. by appending .<DOMAINNAME> to the user name).

To troubleshoot why this process might be failing, try logging on with a different (maybe even a newly created) user interactively. Note that a Windows Server also has a whole bunch of remote administration features where the user's profile is not involved (and which would be unaffected by a possible profile corruption):

you can view event logs from any Windows host using the eventvwr.msc and the "connect to another computer" feature
you can do the same with the Computer Management snapin (compmgmt.msc)
you can connect to the remote computer's registry by using regedit
you can get through to the remote command line by using psexec
you can install the RSAT (Windows 7) or the appropriate management features (another Server 2008 R2 machine) to manage roles, features and Active Directory remotely
after enabling PS remoting you can run remote PowerShells
you can access the administrative shares using the \\servername\C$ notation. From there, you even can access shadow copies (aka "previous versions") of your files - especially %windir%\system32\config\SOFTWARE where the HKLM\Software subkey would be stored. You could load a copy of a previous version of this file into regedit using the "Load Hive" function and restore the ProfileList entry to its previous state, if necessary.

Note that not all of this functionality will be available if you do not have a domain (or are not using a domain member to connect), also Windows Firewall settings might prevent you from doing one thing or the other remotely.

I Deleted my own SID from the Registry

1 Answers1