3

I'm having troubles with a virtual machine on a ESXi running windows server 2003 r2. The problem is that every time it initiates and displays the login window, the machine reboots with no warnings, no alerts, no bsod either. It doesn't matter what I do, I can just wait a few seconds or I can actually login and try to do something, the result is the same.

On the other hand, if I load last known good configuration, the system works normally. The thing here is that I can't manage to set that configuration as the default one, becouse at the next reboot if I select normal boot the issue arise again.

All these facts seems to point to a registry corruption of some kind.

It's worth to know this server runs several critical application so I must get through this problem. The critical application which the server runs is SIOPEL(http://www.siopel.com.ar/)

I also tried reinstalling windows in order to patch the registry. This fixed the issue it for a while but when the server was put back into production the problem came back. So at this point I can just think in a really nasty thing the application does over the registry that corrupts the entire system, or maybe all these is caused by a windows update; I think the former is more likely.

The next thing that I tried was kernel debugging. I'm new in the kernel debugging field but I find very strange that even with the kernel debugger attached, the system reboots leaving no other logs but the loaded modules and some other lines which gives no clue to what is causing that behavior. I must ask, if it's a driver or a malfunction service, shouldn't windbg log that and break after the kernel exception? If it's a registry corruption,

Ok, that's the scenario, I think what I must do now is reinstall the windows again and start tracing and logging all kind of writes to registry hoping to find a clue. I also think it's one of the server's applications but I don't know which and I can't probe it either.

Does anyone know how can I log all the activity that applications performs over the registry?

Any kind of recommendation or guideline will be very grateful.

Thanks in advance!

kique
  • 31
  • 1

1 Answers1

0

Unfortunately this question is a bit old, however one way to log application activity in the registry is with SysInternals' Process Monitor. It isn't only a registry monitor but it does perform some sophisticated filtering of the capture. You can filter by process name, e.g. firefox.exe or whatever the executable, the name of the operation, as well as what path(s) in the registry to include or exclude. The program requires 2003 Server SP1 or greater, so you are okay there. If you have the time to do what you planned and haven't already solved the problem, give it a try:

Process Monitor v3.05 By Mark Russinovich and Bryce Cogswell Published: June 4, 2013 http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Justin Brown
  • 1