dxgkrnl BSOD on boot after move command

Hello there,

I'm new to this forum so I hope I didn't break any rules or miss any forums post that already explain this in detail. Usually I'm the type to do just the reading of many forums and articles for their own tinkering but now after 2 weeks of tinkering on this machine I hope to get better results by asking myself.

I guess I did something stupid. After doing a reinstall of my Windows (The type that creates Windows.old) was working again, but I wanted to try out if there is no other way to do an inplace upgrade for a repair.
So I moved in a WinPE environment the "Windows", "Perflog", "Program Files", "Program Fies x86)" and "Users" folder to a new folder. After realising that I wanted to do something in that fresh environment before starting the new expedition I moved everything back up one directory layer. But now Windows tries to repair itself or starts with a BSOD pointing to dxgkrnl.exe.
My suspicion is that I destroyed the permissions those folders. Is that correct and how can I restore those?

Coming back here in a few hours. PnP is calling me over now.
TinkerOrc

Just need some clarifications -
- did you copy those folders (vs. move them) and then delete them from original location?
- did you change your view of the folders to expose hidden files and folders before copying?
- files have attributes, some of which do not allow a straight copy, after you copied the folders did some remain in the original [folders] and what did you do with those?

I'm afraid there are so many factors in play here that it may be difficult to determine if/how to restore to a working level. I know and realize this is an after the fact statement but it's always almost a mandatory practice to capture a bare-metal backup of your system partition before trying anything like this. Copying files is never a true backup when the OS drive is concerned.

I recommend any of the following, (I use them all) AOEMI Backupper, EaseUS ToDo Backup, R-Drive Image, Terabyte Image for Windows.

Hello ALiverance,

yes you're right. Copying is never a true Backup. I wish I had done a full Partition Backup before trying anything, however that's to late now and I can only revert back to my 17 months old EaseUS backup if needed. Until then I'll try those many ways that I can learn more about the windows system itself. I take this as a learning practice also.

Concerning your questions. I used the move command not the copy command. I did something like "move Users Windows.bak" for all those folders. A friend of mine already told me tonight that I should have used some parameters that retains the permissions, attributes and ownership. What I still didn't understand is if the whole folder tree lost it's original ACL or just the parent directory. If the first was the case, shouldn't the execution of that command take more than just a fraction of a second. If the latter was the case, it should be relatively easy to reset those by the icacls command.
Am I right?
How would those look like?

Thanks for your time and help. :)

I suspect you will not have any way of retrieving what you need. In Powershell (I'm assuming you used that move command) hidden files are not automatically moved when you are working at the folder level. Moving hidden files (I think) can only be done with a different command (Get-ChildItem) with some parameters. I've seen others pipe the results of that into a Move but I have probably done that once or twice in the last 10 years so I'd have to look up the parms (gci -? for the help) I'm pretty sure you have to -Force to get hidden files.

So since you didn't move the hidden files things don't look so good for a chance to recover...

I used the cmd command shell. I didn't even know that you can run powershell in WinPE.

I just recreated what I did before just to see if there are remains of those folders after the move in the original location. There are not.
So what that means is that Windows dropped those hidden Files into the void? I could find hidden folders like AppData however. In the still existing directory tree of course.

I didn't completely underst the GetChild-Item. That's just for collecting hidden files into the command?

- - - Updated - - -

So what I did now was turning to my other machine that had a known good system on it and used

Code:

icacls C:\Windows /save H:\Windows.acl

where H: was another flash drive. On the broken system I just restored those with

Code:

icacls F:\ /restore E:\Windows.acl

(The system reserved partition seemed to snatch the C: drive letter so I had to check those with

Code:

diskpart

and

Code:

list volume

)
I hope this can help other people in the future.
For my next expedition I may open another thread. :)

- - - Updated - - -

For those who can't turn to another machine here are the contents I had in those files. I had to change the file extension, but that should not matter for icacls. Just change the command accordingly.