Stuck in Startup Repair

Don't know if install is Home or Pro (yet). It's 19041.630. I have an ISO I can use to do a Repair install from but since I can't get the system to boot that is not an option yet.
Found info in the registry, it's Home.

When I try to use Advanced Options, Command Prompt it does not give me any account to login as so I don't have any way to activate the Hidden Administrator account.
I used the direction of Option 5 here: Option Five: Enable or Disable Built-in Administrator in Command Prompt at Boot to supposedly enable the hidden Administrator account at offset 38 of the F key from 15 to 10 (directions say from 11 to 10 but it was originally set to 15). This had no effect as I still get no user account displayed to login as, and yes, I've rebooted many times.

Chkdsk fixed some problems the first time it was run but has been clean on subsequent runs. DISM and SFC using the offline parms have run clean.

Since the original user Maggie is still there and the registry entry that connects that user to it's data in \Users is there and valid, I'm not sure how to proceed.

I'd like to look at the Event Viewer but can't figure out how to do it. I've searched but everything i've found doesn't work or is too old. Supposedly the Event logs were .xml file but that doesn't appear to be true any more, so how to I get them off a non-booting system so I can load them into a working system to look at them?

Also, I've tried deleting \Windows\WinSXS\Cleanup.xml (not there) and Pending.xml (there, deleted) which allowed me to ruin SFC and DISM but got Automatic Repair on next boot anyway.

Any suggestions appreciated.

This is a friends computer so I don't want to reinstall unless there is no alternative. Key right now I think is to be able to read the Event logs.

Just a suggestion, boot Macrium's rescue medium to repair boot?

I don't think it's a boot problem but I'll try it anyway, thanks.

Fabler2 said:

Just a suggestion, boot Macrium's rescue medium to repair boot?

After doing this, I'm now totally dead in the water.



Can't even get back to Startup Repair.

If it booted to Macrium it should boot to from the installation media. Should get to this window,

Forgot about that, will try that as soon as Macrium Backup finishes. Thanks.

No help, it said unable to repair system. I sure wish regback was populated like it used to be, I think restoring a backup registry would fix this problem.

Looks like I'm going to have to do a Parallel install then restore Maggie's data and programs.
I may try a Clean Install first then restore just the CC: partition, see what that does but I don't really expect that to work.

Okay, trying to pull a copy of the registry out of Volume Shadow Copy backup.
I used vssadmin to list the backups of which there are two. The most recent is from 12/18/2020 which is fine as the system has not been used much recently.
Then I try to create a link to it using mklink: mklink /D d:\ShadowCopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6

but that fails saying The system cannot find the path specified. Not sure how to proceed. How do I access the Volume Shadow Copy if mklink doesn't work?

Remember, all I have is Command Prompt from a Windows 10 install flash drive or a WinPE flash drive.

Code:

MKLINK [[/D] | [/H] | [/J]] Link Target

        /D      Creates a directory symbolic link.  Default is a file
                symbolic link.
        /H      Creates a hard link instead of a symbolic link.
        /J      Creates a Directory Junction.
        Link    Specifies the new symbolic link name.
        Target  Specifies the path (relative or absolute) that the new link
                refers to.

Trying this on my own working system doesn't work either:

Code:

C:\Users\ztruk>vssadmin list shadows
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Contents of shadow copy set ID: {ee0e1dd5-0eba-4808-98af-cc389d64291e}
   Contained 1 shadow copies at creation time: 2/11/2021 8:51:25 PM
      Shadow Copy ID: {91b819f4-7b3f-4b53-8a14-e07cb99dee02}
         Original Volume: (C:)\\?\Volume{456741a0-6f8d-401a-95d7-17364d39ee2a}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
         Originating Machine: DESKTOP
         Service Machine: DESKTOP
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ClientAccessibleWriters
         Attributes: Persistent, Client-accessible, No auto release, Differential, Auto recovered

Code:

C:\Users\ztruk>mklink /d q:\Shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
The system cannot find the path specified.

Which path is it complaining about? q:\Shadowcopy doesn't exist yet, do I need to create that first, does it have to be on an existing volume?

Edit: Problem was the q:\Shadowcopy, had to be on an existing volume. Changed it to E:\Shadowcopy and it worked.

Now cd E:\Shadowcopy gets a The parameter is incorrect error message. Why?????

So close yet so far!!!!! If I can access the Shadowcopy mklink I can restore to an older registry and most likely fix this problem.