Had a Windows Server 2008 R2 server that started giving a blank screen since the recent Windows update reboot. This was a VM and it was the same result via VMware console or RDP. Safe Mode didn’t help either. Bummer!<\/p>\n
Since this is a VM I mounted its disk on another 2008 R2 VM and tried to fix the problem offline. Most of my attempts didn’t help but I thought of posting them here for reference.\u00a0<\/p>\n
Note<\/strong>: In the following examples the broken VM’s disk is mounted to F: drive.\u00a0<\/p>\n I used To remove an update:<\/p>\n I did this for each of the updates I had. That didn’t help though. And oddly I found that one of the updates kept re-appearing with a slightly different name (a different number suffixed to it actually) each time I’d remove it. Not sure why that was the case but I saw that I used No luck with that either!<\/p>\n Maybe the Event Logs have something? These can be found at In my case the Event Logs had nothing! No record at all of the VM starting up or what was causing it to hang. Tough luck!<\/p>\n Bonus info:\u00a0 Could drivers cause any issue? Unlikely. You can’t use Whenever I’d boot up the VM I never got the Last Known Good (LKG) Configuration option. I tried pressing F8 a couple of times but it had no effect. So I wondered if I could tweak this via the registry. Turns out I can. And turns out I already knew this just that I had forgotten!<\/p>\n Your current configuration is\u00a0 This helped in my case! I was finally able to move past the blank screen and get a login prompt. Upon login I was also able to download and install all the patches and confirm that the VM is now working fine (took a snapshot of course, just in case!). I have no idea what went wrong, but at least I have the pleasure of being able to fix it. From the post I link to below, I’d say it looks like a registry hive corruption.\u00a0<\/p>\n Since I successfully logged in, my machine’s Last Known Good Configuration will be automatically updated by Windows with the current one. Here’s a blog post<\/a> that explains this in more detail.\u00a0<\/p>\n That’s all! Hope this helps someone.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":" Had a Windows Server 2008 R2 server that started giving a blank screen since the recent Windows update reboot. This was a VM and it was the same result via VMware console or RDP. Safe Mode didn’t help either. Bummer! Since this is a VM I mounted its disk on another 2008 R2 VM and … Continue reading Useful offline Windows troubleshooting\/ fixing tricks<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[85],"tags":[53,691,14,689,690,329,317],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3293"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=3293"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3293\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=3293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=3293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=3293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Recent updates<\/h2>\n
dism<\/code> to list recent updates and remove them. To list updates from this month (March 2017):<\/p>\ndism \/image:f:\\ \/get-packages \/format:table | findstr \"03\/2017\"<\/pre>\n
dism \/image:f:\\ \/remove-package \/packagename:Package_for_BlahBlahBlah<\/pre>\n
F:\\Windows\\SxS<\/code> had a file called pending.xml<\/code>\u00a0and figured this must be doing something to stop the update from being removed. I couldn’t delete the file in-spite of taking ownership and full control, so I opened it in Notepad and cleared all the contents. :o) After that the updates didn’t return but the machine was still broken.\u00a0<\/p>\nSFC<\/h2>\n
sfc<\/code> to check the integrity of all the system files:<\/p>\nsfc \/scannow \/offbootdir=f:\\ \/offwindir=f:\\Windows<\/pre>\n
Event Logs<\/h2>\n
F:\\Windows\\System32\\Winevt\\Logs<\/code>. Double click the ones of interest to view.\u00a0<\/p>\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Eventlog<\/code> contains locations of the files backing the Event Logs. Just mentioning it here as I came across this.<\/p>\nDrivers<\/h2>\n
dism<\/code> to query drivers as above but you can check via registry. See this post<\/a>. Honestly, I didn’t read it much. I didn’t suspect drivers and it seemed too much work fiddling through registry keys and folders.\u00a0<\/p>\nLast Known Good Configuration<\/h2>\n
HKLM\\System\\CurrentControlSet<\/code>. This is actually a link to\u00a0HKLM\\System\\CurrentControlSet01<\/code> or\u00a0HKLM\\System\\CurrentControlSet02<\/code> or\u00a0HKLM\\System\\CurrentControlSet03<\/code> or … (you get the point). Each of the CurrentControlSetXXX<\/strong><\/span><\/code> key is one of your previous configurations. The one that’s actually used can be found via\u00a0HKLM\\System\\Select<\/code>. The entry Current<\/code> points to the number of the\u00a0CurrentControlSetXXX<\/strong><\/span><\/code> key in use. The entry LastKnownGood<\/code> points to the Last Known Good Configuration. Now we know what to do.\u00a0<\/p>\n\n
HKLM\\SYSTEM<\/code> hive of the broken VM. All registry hives can be found under %windir%\\System32\\Config<\/code>. In my case that translates to the file F:\\Windows\\System32\\Config\\SYSTEM<\/code>.<\/li>\nHKLM<\/code> hive, and go to File > Load Hive. (This <\/a>is a good post with screenshots etc). \u00a0<\/li>\nSelect<\/code> key above. Change Current<\/code> to whatever LastKnownGood<\/code> was.\u00a0<\/li>\n