I have removed EEPC from a machine and when i ran the sbsetup - uninstall i cannot boot into windows after the restart. I am trying to reset the MBR and have successfully managed to from the wintech but when i restart, I still recieve the same message.
Any ideas? I need this machine back up and running urgently.
Solved! Go to Solution.
Using BartPE and working with local disk Windows registry hive:
To restore the default Windows logon interface, remove the following string value from the registry:
After you do so, Windows uses the default Graphical Identification and Authentication file (Msgina.dll).
looks like you did not have permission to remove registry entries - maybe your AV blocked you, or you were not an administrator?
You need to copy another driver back into the directory to make Windows think it's safe - serial.sys is pretty benign, so I usually use that. Just use your rescue-CD of choice and make a copy of serial.sys called sbalg.sys in the directory as above.
Thanks for the quick reply. I have did what u said and now it is stuck on C:\windows\system32\safeboot.sys file.
Yes it is correct i did uninstall without administrator rights. I used the BartPE session to uninstall. What do i do now?
Appreciate your help.
yeah. You can't uninstall from within BartPE - that would just remove the registry keys from the in-memory registry of Bart, not the real disk at all.
same answer though - just make a copy of serial.sys and put it in place of safeboot.sys. You just have to convince Windows that all the drivers are there.
or, you could boot back into bartpe and remove the upperfilter entry for SafeBoot, and the services entry for the safeboot.sys driver.
what's the original problem you were trying to fix?
I had just been trying to unencrypt a workstation. As u mentioned i should have just logged in as administrator and then ran the sbsetup -uninstall. I will do as you mentioned and hit you right back up with what happens.
Thanks for your help so far....im getting somewhere with this lol!
I have tried this and now I get the ol BSOD.
WRT this :
"or, you could boot back into bartpe and remove the upperfilter entry for SafeBoot, and the services entry for the safeboot.sys driver."
How could i do this?
Yeah., i havent touched the registry at any point. I just placed the mentioned files into the directory where the boot process was looking for these. So if i remove these two files im stuck again atr the point i began.
I had successfully removed eepc via wintech, but understand now that i removed the sbsetup -uninstall via bartpe and this hasnt removed any registry settings.
So far i feel this can still be recovered. I need to apply this upperfilter strategy?
Filter might be here:
But look also:
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\...your path to disk instance...\4&3a739529&0&000\Control]
And service itself:
I found tghese entries and removed them. Then reboot. Once i reboot, I get the same error cannot find c:\windows\system32\drivers\safeboot.sys
when i log back in via bartpe...i find the entries have come back?