REVISED: How to fix the Vista KSOD (Black Screen Of Death)

Warning: This is a highly technical article.  If you are not an IT Expert, don’t try this at home :).

Thanks to Dennis J Krohn (DDK Communications) for working with Microsoft on this and emailling me and Susan Bradley who pointed me to and has been working with Microsoft to track this issue and find the culprit (application or service that makes this happen); we now have a quick fix for the KSOD we have been seeing in Windows Vista.

KSOD Defined: Where after a reboot the Windows Vista PC boots up to a black screen with a white mouse cursor and nothing else ever loads (no logon screen, etc).  Safe mode does the same thing.  Last Known Good configuration and System Restore do not fix it except in rare cases where performing a System Restore to 1 month ago or earlier does (thanks Mike Katz for figuring that out).

So about an hour after Dennis and Susan emailed me the resolution last night, my main workstation KSOD’d.  It has already done this once before and Microsoft did not have a resolution — so my resolution last time was to reinstall Windows to a new directory and manually reinstall and reconfigure all my applications and settings.  THIS time, very fortunately, I got to try these steps out and they worked like a charm.  My workstation was back up and running in less than 5 minutes.

Here is how to recover from the KSOD (blacK Screen Of Death):

There apparently this a problem related to the Remote Procedure Call service (RPC) running under LocalSystem account instead of NT Authority\NetworkService account.

1. On the affected machine, boot using the Vista Media and Select “Next” and then in the bottom left you will see “Repair your Computer”; select Next and then Select Command Prompt.

2. At the command prompt, launch regedit.exe and load the SYSTEM hive, follow the below steps.


b. On the File menu, select Load Hive.

c. Browse to %WINDIR%\System32\Config Folder and select “SYSTEM”

d. Select Open.

e. In the Load Hive dialog box, type in “MySYSTEM” box for the registry hive that you want to edit.

3. After the hive is loaded, modify the following key value per the instructions below: You will need to know what ControlSet the machine is currently running on, this can be determined by going to HKEY_LOCAL_MACHINE\MySYSTEM\Select and find the “Current” value in the Right hand side. (Example: Current value is 1 then the ControlSet will be ControlSet001)

Key: HKEY_LOCAL_MACHINE\MySYSTEM\ControlSet00X\Services\RpcSs (X is the Number from the Current Key from above)

Value Name: ObjectName

Old Value: LocalSystem

New Value: NT AUTHORITY\NetworkService

4. Unload the SYSTEM hive by selecting the key “MySYSTEM” and then select File -> Unload Hive… menu item.

5. Exit regedit.exe

6. Reboot the system normally


Related Posts


    1. Mark says:

      Dec 26, 2008


      Glad to see it worked for you. Please email me and let me know if you were either running LogMeIn or Zenith SaaZ agent on the pc.

    2. […] Black Screen of Death, aka KSOD December 30, 2008 — Julie Found this solution on the LogBlog after another failed Vista boot up. This issue is being referred to as the blacK Screen Of Death […]

    3. […] is still not known/understood at this time. How to fix the Vista KSOD (blacK Screen Of Death) SBSC – Windows Vista Black Screen with Mouse Cursor Only Issue: […]

    4. […] Re: Boot Problem (Blank Screen & Cursor Only) We have been running into lots of these KSOD’s (blacK Screen Of Death). It has to do with the RPCSS key in the registry. Last known good, safe mode, and system restore generally don’t fix it. Here is how to fix it: How to fix the Vista KSOD (blacK Screen Of Death) | LogBlog […]

    5. twg says:

      Dec 31, 2008


      Performed the above procedure. Found the key value to be set correctly “NT AUTHORITY\NetworkService”
      Reboot still hangs with black screen and mouse pointer. Will attempt a system restore from 10 days ago when a logitech manager was updated by System. System rebooted adn logged in successfully. Looks good so far.

    6. Daniel Breslauer says:

      Dec 31, 2008


      Thanks. I had this a few months ago and couldn’t get it fixed. I used the command prompt (via the advanced startup options) to copy all of my data to an external USB drive (previously installed, thank Him) using robocopy. Then I used my laptop’s system recovery disc to get it back to default and reconfigured my whole laptop. If it ever happens again, I’ll try this.

    7. […] IT Consulting lays out the step-by-step instructions here. If you get a distress call from someone describing the KSOD, grab your Vista install disc and […]

    8. Greg P says:

      Jan 3, 2009


      Unfortunately this is not the fix, the whole fix and nothing but the fix.

      My RPC service value was set correctly set to
      NT Authority\NetworkService so I was unable to apply this fix.


    9. Ed J says:

      Jan 3, 2009


      Same here.. the RPC value was already correct, so no success here either.

      Back to the drawing board.

    10. David Lyon says:

      Jan 6, 2009


      The title of this page is rather misleading: this does _not_ “fix the KSOD”, rather, it identifies one possible cause, and presents it as the definitive solution.

      As with those above, the value was already correct. Problem remains.

      Some additional info: The system that I’m working on at the moment, which is afflicted, exhibits behaviour that suggests Windows is working at some level, inspite of the lack of interaction available via the screen. Watching the disk activity light while the screen remains black, with white cursor, it flickers as it would normally while loading various wares; pressing the power button causes the system to cleanly hibernate, and correctly displays “Resuming Windows…” when restarted. Upon successfully resuming, we’re back to a white cursor on black screen.

      Typically, System Restore is useless, Safe Mode is useless, all the Repair avenues are ineffective.

    11. Jason says:

      Jan 9, 2009


      Many different issues can cause a KSOD, and many people get frustrated when one solution doesn’t work . As a support professional, we recently found that the KSOD can be cause by explorer not running on boot. On your black screen, try and press ctrl+shift+esc at the same time and it should launch the task manager. (If explorer.exe is running, end the process and then start it over by “File” and new process) Start explorer.exe by typing explorer.exe and hit ok. This fixes the KSOD in some cases. Or it will at least give you enough time to get in and uninstall/back up/investigate etc…..

    12. gollumullog says:

      Jan 11, 2009


      This fix does not work for me (the same as many others). Jason’s suggestion of running the task manager and manually starting explorer did work as an interim solution.

    13. Ira Herman says:

      Jan 11, 2009


      Thanks for all the comments. It sounds like there are multiple ways Vista can KSOD :(. Whenever we have experienced the KSOD it happens right after the “starting windows” progress bar screen. Vista never reaches the Windows Logo and Musical introduction. Also, no matter what we hit on the mouse and keyboard we cannot bring up task manager, sticky keys, or anything else. If explorer can be launched, it sounds like some of you are running into a similar issue after login.

      Keep the comments coming and tell us if this fixed your KSOD or not.

    14. Toby Percival says:

      Jan 13, 2009


      Went through the process of changing the registry, as detailed above. Unfortunately the settings was already there (NETWORKSERVICE). I will watch this webpage in the hope another fix comes up.
      Thanks for the help.

    15. Nick Lockett says:

      Jan 14, 2009


      Same issue here – KSOD and registry NETWORKSERVICE settings correct

    16. James Strelec says:

      Jan 15, 2009


      I got a case of the KSOD as well but ctl+alt+del and ctl+shift+esc do not do anything. Is there another solution to bring up task manager?

    17. Christoph says:

      Jan 18, 2009


      thanks for this article, but the fix didn’t work for me as the registry-setting was already there….still the KSOD 🙁
      I can’t start the taskmanager or explorer + all restore options didn’t work at all. All I can do is to bring up the “Shift lock” by pressing Shift 5 times…

      Any other ideas???
      Thanks a lot.

    18. […] don’t fix it. Here is how to fix it: ‘How to fix the Vista KSOD (blacK Screen Of Death) | LogBlog’ ( 😎 — Ira […]

    19. Ira Herman says:

      Jan 20, 2009


      I revised the article, so for those it didn’t work for — please try again using the revised step 3.

      Step 3 was incorrect because it said to go to:
      Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Services\RpcSs (X is the Number from the Current Key from above)

      And it SHOULD have said HKEY_LOCAL_MACHINE\MySYSTEM\ControlSet00X\Services\RpcSs (X is the Number from the Current Key from above).

      Otherwise you were just looking at the registry of the preboot environment (I think) and not your KSOD’d Vista.

    20. Rey says:

      Jan 20, 2009


      what goes on the “value name” slot and what goes in the “value data” slot?

    21. Ado says:

      Jan 22, 2009


      I have tried the updated step from Ira and still find the correct registy value (NT AUTHORITY\NetworkService

    22. Rimscar says:

      Jan 23, 2009


      Well this is what i did folks and it’s now working and this on a Dell Inspiron 1720…
      1) could not do any windows updates because of 80073712 error.
      2) did all google tricks, still would not update.
      3) could not do in place reinstall (greyed out)
      4) transfered all settings, tried clean install
      5) ran through as per usual on a vista home premium, not sp1 disk.
      6) hanged on KSOD
      7) googled all tricks shown on here etc etc etc, nothing worked.
      8) NOW for What I Did….! 🙂
      9) reinstall procedure upto the point where you can reload drivers, put in drivers disk for SATA drive, let it install, carry on with rest of installation procedure.
      10) it will go through, even the bit where it says “this takes a moment” !!!
      11) you will get to the ksod screen again, where in utter frustration and cursing micorsoft with every breath, you’ll hammer ctrl-alt-del 5 or 6 times until the computer resets and then does a chksk.
      12) this will find a host of errors, including $SII, and will reindex securit descriptors for about 20 mins.
      13) it will then say all fixed, and you know what, the damn thing then gets to the “input new name” bit…..
      14) delared myself a genius, made tea.

      Good luck

    23. Scott Noyes says:

      Jan 23, 2009


      Holding down the shift key for 8 seconds brings up the filter keys configuration. Somewhere in there is a link, which will launch the default browser. In the address bar, put C:\Windows\explorer.exe

      Don’t know how to solve it for good, but it got me to a desktop anyway.

    24. Scott Noyes says:

      Jan 23, 2009


      To clarify, here’s what I did when the registry already contained the correct value, Ctrl-Alt-Del and Ctrl-Shift-Esc did nothing:

      – After boot up, wait a few minutes at the KSOD until disk activity stops
      – Shift key five times, or hold shift for 8 seconds, until Sticky/Filter keys pops up
      – Say ‘Yes’
      – Configuration menu for sticky/filter keys comes up. Under the Help menu, choose “Is this version of Windows legal”
      – Internet Explorer is launched. In the address bar, enter C:\Windows\explorer.exe

    25. Christoph says:

      Jan 26, 2009


      Hi Scott, hi all,

      on my computer, the registry already contained the correct value also, Ctrl-Alt-Del and Ctrl-Shift-Esc did nothing…tried revised step 3 also.

      I’ve tried to follow your instructions, here’s what happened:

      – After boot up, wait a few minutes at the KSOD until disk activity stops
      -> OK
      – Shift key five times, or hold shift for 8 seconds, until Sticky/Filter keys pops up
      -> OK
      – Say ‘Yes’
      -> OK
      – Configuration menu for sticky/filter keys comes up. Under the Help menu, choose “Is this version of Windows legal”
      -> no configuration menu came up, the window just closed

      So no chance for me to start the explorer.

      Any other ideas? Thanks a lot…

    26. Hello everyone, for those who are still having problems…I have a cure.
      Your problem lies in a service called (Windows Event Log) Now this might not be the problem with everyone but it is with me and various others.

      How to fix
      1. reboot your pc with a manual shutdown and boot into Safemode with Command prompt (Your desktop will not be there but the command prompt will, You can go into the prompt via the sticky keys trick but it WILL NOT work correctly

      2. type msconfig to oepn the msconfig menu

      3. Under general click SELECTIVE STARTUP and disable the first two items there.

      4.Click apply and Ok, you’ll be asked to reboot which you do.

      5. If your pc turns on fine then it is fixed, however in my case I came back to my desktop where the theme was gone, using a 98 ish style, the internet didnt work and various programs would give me errors. Don’t panic if that happens.

      6. Go to administrative tools, then to SERVICES

      7. You will notice a long list of your services and yes this is a long step. You must go on every item in that list where the startup type is set to Disabled and set it to automatic, (Right click, properties)

      8. Set every item to automatic (But dont start any of them yet aside from the ones that were already running)


      I don’t know why it causes the problem but it does, once you set everything to automatic, restart your pc and it should work fine. If not then you either have the registry error shown above or something else. email for any questions, comments.

    27. HomburgPokes says:

      Jan 29, 2009


      I first tried CTRL + ALT + DEL and my computer restarted. Pressing CTRL + ALT + ESC rapidly (out of frustration) fixed my problem temporarily. Restarting the computer returned to KSOD. The second time through, CTRL + ALT + ESC didn’t work.

      This is a pretty fresh install of Vista x64 (about one week old), on MSI DKA Platinum, 2x Seagate drives in RAID 0, Phenom II 940, GSkill 4xGB of RAM. I have the latest bios and returned everything to the fail safe defaults (then enabled RAID again). This did not work.

      I unplugged all peripheral devices, such as my printer and external hard drive. I also unplugged to internal SATA hard drives leaving only the SATA CD-ROM and the two SATA drives in RAID-0 and the machine booted right up. Unfortunately this was temporary again. When I rebooted, it was back to KSOD, but CTRL + ALT + ESC showed me a flash of the Windows Boot Manager (typically present for dual OS booting machines) and the login screen appeared.

      In the session before the KSOD I ran some malware detection software (MalwareBytes) that I have never run before, but I don’t think this is the cause, nor did the scan find any harmful results.

      Strange behavior indeed, though I have been able to log in several times during this whole process. I’ll reluctantly try the “Repair” option on the Vista disk, though I have never been a fan of any ‘repair and recover’ options offered by Windows.

    28. Yes, I was able to get in a few times as well but still no luck on it.

      Read what I wrote above, you might have the same solution

    29. h says:

      Jan 29, 2009


      when you type in msconfig into cmd, an error message comes up saying windows cannot find ‘msconfig’

    30. h says:

      Jan 29, 2009


      i solved it a simple way maybe this will only work for some people, i just booted up vista cd and choose system restore (takes a while to start) and restore to an earlier point and it boots up fine i must of had a dirver problem

    31. Based on what I have read, studied and etc. It seems that the KSOD is caused and fixed by different means, I say we group together and compile the knowledge we have into a guide for everyone.

    32. Clinto says:

      Jan 31, 2009


      I am currently working on a notebook with the KSOD, any of the solutions above don’t work. Can’t boot safe mode, cant ctrl+alt+del in normal or safe mode. Have run chkdsk, have tried system restore. Have read the MS article here
      which states that this problem was fixed in SP1 but this notebook already has SP1 and it still happened. Have scoured the net for days…I think the only solution is as MS states…format and start from scratch 🙁

    33. Adam says:

      Feb 1, 2009


      I had the same problem today, after about a dozen restarts I tried something different, I did the F8 thing and started the comp in 640 x 480 mode, It started fine, changed the screen resolution to something I could work with and restarted. Black screen and white cursor again…….. Tried again 640x 480 and tried a restore point…… it worked everythin back to normal,
      before it crashed I was changing the settings for my dual moniter setup and the everything went black with the white cursor…..ctrl,alt,del, would show the normal menu with restart and task manager but clicking on the task manager would goback to black screen…..

      hope this helps somebody


    34. Mesh says:

      Feb 3, 2009



      My name is Mohannad Shaheen and i am a computer engineer.

      seems THIS IS A REAL FIX! READ HERE is right, all the problem is caused by the EVENT LOG..

      1. after the KSOD HD activity ended and i pressed shift for 5 or 8 times , the window came, i clicked yes.. but it hanged and freezed ..

      2. i tried next time i rebooted, after clicking the shift for 5 or 8 times, the window appear, and there is a link on that window says :

      Go to the Ease of Access Center to disable the keyboard shortcut

      3. i clicked on that , an explorer window opens, in that window clear the link and type msconfig and run it.

      4. in the selective startup i’ve unchecked the two options, apply restart.

      5. windows started with explorer.

      6. running msconfig again, enabling all under startup items and all under services, but I’VE UNCHECKED THE FOLLOWING :

      A. Windows Event Log.

      B. Windows Event Collector.

      you don’t have to go and enable all the services one by one like THIS IS A REAL FIX! READ HERE said.

      if some one tried from step 3 just to disable A & B items, if it worked please feed back.


    35. Mesh says:

      Feb 3, 2009


      End Users : Don’t Panic,you don’t need the Event Log anyway ..

    36. Mikeb says:

      Feb 3, 2009


      Quote from Mesh:

      My name is Mohannad Shaheen and i am a computer engineer.

      seems THIS IS A REAL FIX! READ HERE is right, all the problem is caused by the EVENT LOG..

      1. after the KSOD HD activity ended and i pressed shift for 5 or 8 times , the window came, i clicked yes.. but it hanged and freezed ..

      2. i tried next time i rebooted, after clicking the shift for 5 or 8 times, the window appear, and there is a link on that window says :

      Go to the Ease of Access Center to disable the keyboard shortcut

      3. i clicked on that , an explorer window opens, in that window clear the link and type msconfig and run it.

      4. in the selective startup i’ve unchecked the two options, apply restart.

      5. windows started with explorer.

      6. running msconfig again, enabling all under startup items and all under services, but I’VE UNCHECKED THE FOLLOWING :

      A. Windows Event Log.

      B. Windows Event Collector.

      you don’t have to go and enable all the services one by one like THIS IS A REAL FIX! READ HERE said.

      if some one tried from step 3 just to disable A & B items, if it worked please feed back.


      Wow, I didnt know sticky keys would ever be useful to me… lol

      This solution worked indeed, but doesn’t completely solve the issue. Windows Event Log is useful for computer techs on solving other issues. Here is what I did following these steps to make the windows event log service function again. Apparently if the log files are corrupted, it causes windows event log to hang the system.

      Go to C:\Windows\System32\Winevt\ and rename your Logs folder to Logs_Bad, and make a new Logs folder

      Run Services and change your Windows Event Log service to automatic, and set the Windows Event Collector service to Manual.

      Hopefully this works for you, and you are able to keep your log service running.

    37. Clinto says:

      Feb 4, 2009


      OMG, i finally fixed it 🙂 woohoo. As per my post above nothing seemed to fix this damn KSOD. Based on what Mesh & MikeB has said above I just renamed the event log folder and away it went. Thanks guys, you saved me a reinstall/rebuild.

    38. Colin-s says:

      Feb 7, 2009


      I know exactly what caused my KSOD. I was too slapdash in removing the AV2009 virus from a friends’ m/c and tried to remove a file from system32 using ‘takeown’ and ‘cacls’ from the command prompt. As the file was still in use it would not delete, I tried to enter Safe Mode and that’s when the KSOD showed itself.

      From then on the only command prompt availabe was from System Repair on the distribution disc.

      Fortunately, before carrying out the above, I had copied the file to the Documents folder. Using the Command line, I renamed the ‘ownership modified file’ in system32 and copied the original unaltered file back into system32.

      This resolved the KSOD. I can only assume that Vista checked the file in question during startup and disliked its new ownership, then KSODed.

      This shows at least one way that a KSOD can be caused. I did read in another forum somewhere that NTFS problems can be involved, hope this may be of some use to somebody


    39. Warren Williams says:

      Feb 7, 2009


      Thank you, this worked like a charm.

      As mentioned in other replies, we are also a Managed Service Proviser and took the hit in terms of time spent to resolve this issue on 12 sesktops to date. All systems are HP Business Desktops and Laptops with Vista 64 and 32 bit Businees installed. We alsouse Zenith SAAZ agent and LogmeIn.

      My previous serchaes to this issue had been unsuccesfull as had calls tgo HP and Microsoft.

      We have had some succees with Last Know Config and System Restore, however if the system had not been successfully restarted since the last good “boot” system restore was over written, the recourse was re-install

      Again Thank you.

      Warren Williams
      Bralin Technology Solutions

    40. Buzz says:

      Feb 8, 2009


      What “THIS IS A REAL FIX! READ HERE” and “Mesh” said fixed the problem for me! Thanks guys!

    41. […] Galleria … Guess I will go over there to get some install disks. Found a very sophisticated procedure to try ( confirmed by several sources) but I have to fire up the OS from a CD. We will […]

    42. […] one knows which triggers may be causing the issue. A couple are described here with their appropriate fixes. I have been looking for several days to try out the first issue but […]

    43. Jolynn says:

      Feb 11, 2009


      all I can sya is, arrgh. None of this stuff is working.

    44. Serg Savel says:

      Feb 12, 2009


      Hi everyone,

      I have tried everything what is described above.
      1) The ‘NT AUTHORITY\NetworkService’ part is correct.
      2) Ctrl-Shift-Esc – did not lunch the task manager.
      3) Holding down the shift key for 8 seconds at the KSOD did not bring anything.
      4) Boot into Safe mode with Command prompt – I didn’t get the command prompt, so there is no way to do the next steps.
      5) I was able to bring up the file open dialog from the ‘regedit’ (I opened the regedit from the F8 – Computer Repair – Command Prompt but it can access only X drive (32 MB)). From there I can copy files between folders
      and can access the system32 folder. I tried to do the trick with the Logs folder (‘Go to C:\Windows\System32\Winevt\ and rename your Logs folder to Logs_Bad, and make a new Logs folder’) and it did not help.

      I don’t understand how to get the Shift (5 times or 8 seconds) key to work. If somebody knows then Please let me know, then I can try to perform the steps above.

      P.S. I wait for 2 minute at the KSOD, until the indicator shows that no processes are running.

    45. Serg Savel says:

      Feb 12, 2009


      Maybe there is some recovery programm which I can run from the CD?

    46. sly2m says:

      Feb 12, 2009


      2Serg Savel:

      The same situation here. Just downloaded regular MS Important Update, Vista 64 asked me to reboot – after rebooting got KSOD.
      Ctrl+Alt+Del is not working, Shift 5 times is not working, Reboot with in Safe Mode with Command Prompt is not working.

      Nothing is working.

      All I can do is boot from Vista Recovery CD, run regedit (running chkdsk /r didn’t help), load hive from c:\windows\system32\config\system and play with services – turn everything that could cause a problem off.

      Any ideas what service should be turned off first?
      I cannot go on by one – it’s hundreds up there.

      If I got any results – will post the solution.

    47. Serg Savel says:

      Feb 13, 2009


      If I don’t find a solution until tomorrow then I’ll copy all my personal files to the external hard drive (using the Windows LiveCD) and then I’ll try to reset my lap top to the factories settings. Did anybody try to reset the system to the factories settings? Was it succsesfull?

      I can’t find the Windows LiveCD for Vista 64 or 86. So I can’t run ‘msconfig’ program from my x32 LiveCD. If somebody knows where to download it, please post a URL.

    48. Evan Everett says:

      Feb 13, 2009


      Windows Vista Ultimate Sp2 Beta, KSOD (Black Screen of Death)

      This fix worked for me, it all started by running a scan with Spyware Doctor; 3 Registry keys were flagged as being infected with ddccc.dll: I had already deleted the file from the Windows\System32 folder at an earlier date, the Registry key’s remained.

      Threat Name – Trojan.Virtumonde
      Type – Startup
      Risk Level – Elevated
      Infection – HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa, Authentication Packages = C:\Windows\System32\ddccc.dll

      Type – Startup
      Risk Level – Elevated
      Infection – HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Lsa, Authentication Packages = C:\Windows\System32\ddccc.dll

      Type – Startup
      Risk Level – Elevated
      Infection – HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Lsa, Authentication Packages = C:\Windows\System32\ddccc.dll

      I proceeded to delete these strings; on the next reboot I had the Vista KSOD.

      LSA is the “Local Security Authority Process”

      1. On the affected machine, boot using your Vista DVD Media, Select “Next” If you are running a Raid setup you will have to load the drivers, download the appropriate driver and copy it to a floppy, once the driver is loaded, click Next then in the bottom left you will see “Repair your Computer”; select Next then Select Command Prompt.
      NOTE: Watch the Boot up screen it should tell you what driver version you will need.

      2. Once at the command prompt, type in regedit.exe and load the SYSTEM hive, following the steps below.

      a. Select HKEY_LOCAL_MACHINE

      b. On the File menu, select Load Hive.

      c. Browse to %WINDIR%\System32\Config Folder and select “SYSTEM”, Select Open, if running a Raid setup or if you have multiple hard drives you may have to look and find your windows partition drive letter, look for your Windows folder.

      d. In the Load Hive dialog box, type in “MySYSTEM” box for the registry hive that you want to edit

      3. After the hive is loaded, modify the following key Values if need be per the instructions below:

      Browse to HKEY_LOCAL_MACHINE\MySYSTEM\ControlSet00X\Services\RpcSs

      Check the following values under all RpcSs strings in all ControlSet*** strings:

      Value Name: ObjectName

      Old Value: LocalSystem (did not exist)

      New Value: NT AUTHORITY\NetworkService (Values were already set to this)

      I did not have the Old Value: LocalSystem under RpcSs (All Values were New)

      4. This is where the problem was, Modify or re-create the following strings as below:

      To re-create keys if deleted, right click in right pain window of Lsa, select New, Multi-String-Value. Name it Authentication Packages; right click on Authentication Packages select Modify, type in msv1_0 for data. Do this for every string that was deleted.

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa, Authentication Packages = C:\Windows\System32\msv1_0

      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Lsa, Authentication Packages = C:\Windows\System32\msv1_0

      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Lsa, Authentication Packages = C:\Windows\System32\msv1_0

      Ensure all ControlSet*** strings have msv1_0 as their Data value

      Replace ddccc.dll entry with msv1_0, simple

      Once I put these values back to msv1_0, Windows boots normally.

      5. Unload the SYSTEM hive by selecting the key “MySYSTEM” and then select File -> Unload Hive… menu item.

      6. Now ensure all ContorlSet*** string’s under HKEY_LOCAL_MACHINE\SYSTEM
      Look like this:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa, Authentication Packages = C:\Windows\System32\msv1_0

      7. Exit regedit.exe

      8. Reboot the system normally

      Hope this helps, quick fix no need to reload Vista from scratch.


    49. Serg Savel says:

      Feb 13, 2009


      Looks like it’s not my case, as I did not delete any keys. In the Lsa I’ve already had the correct values. I did not find any ddccc.dll file in my System32 folder, the msv1_0.dll was already there.

    50. Troy says:

      Feb 13, 2009


      Mesh, you are AWESOME! This solved my problem exactly!!! after over 12 hours of troubleshooting. DUDE, thanks!!!

      1. after the KSOD HD activity ended and i pressed shift for 5 or 8 times , the window came, i clicked yes.. but it hanged and freezed ..

      2. i tried next time i rebooted, after clicking the shift for 5 or 8 times, the window appear, and there is a link on that window says :

      Go to the Ease of Access Center to disable the keyboard shortcut

      3. i clicked on that , an explorer window opens, in that window clear the link and type msconfig and run it.

      4. in the selective startup i’ve unchecked the two options, apply restart.

      5. windows started with explorer.

      6. running msconfig again, enabling all under startup items and all under services, but I’VE UNCHECKED THE FOLLOWING :

      A. Windows Event Log.

      B. Windows Event Collector.

    51. SalemCat says:

      Feb 14, 2009


      E6600, 4GB DDR2, (4) 160GB Intel RAID 5, Vista Home Basic.

      On the evening of Feb 11th, as I shut down for the night, I saw the Icon that is displayed when an Update has been automatically dowloaded. I shut down, letting the Update install. On the morning of Feb 12th, for the first time in the two years that I’ve been using this system, I saw the KSOD.

      Like many other users, I saw the Scrolling Blue Bar, then the Black Screen with the Mouse Pointer would be displayed. Ctrl-Alt-Del, etc, accomplished nothing. Stickey Keys would Beep, but no Window would open.

      Booting from the DVD got me to Repair, which didn’t. No System Restore Points remained – all had been deleted. Command Prompt was working, but Regedit was the only program I could get to work.

      I’m no newbie; been building, repairing, and maintaining computers for over 20 years (part-time for myself, my employers, and friends). This computer is clearly Virus and Malware-Free. And every test has found no Hardware problems of any kind.

      None-the-less I replaced the PSU, having seen many computers act funky due to failing PSU’s over the years, and tried a PCI Graphics Card in place of the On-Board Video I’ve been using. No improvement.

      I tried every tip in this Forum, and many from other Forums. No improvement.

      I’ve added a 1TB Seagate HD, and have just installed Vista Home on it, and am using the computer again right now. But I have many, many Files to transfer, and many Settings to repair, etc, etc, etc.

      I use Carbonite On-Line Backup, and the actual RAID 5 Array looks to be fine. I’m confident I’ll be able to recover all my Data from it without resorting to Carbonite, which takes DAYS to download any significant amount of Data.

      When I’m done I think I’ll dis-assemble the 4 HD Array and make it a 2 HD RAID 0 Array. I will also NEVER enable Automatic Installations of Upgrades again.

      This experience has shown me I am weak in restoring my computer at a local level. I need a BACKUP PROGRAM that will create a COMPLETE BOOTABLE COPY of my Boot Drive, that will do incremental Backups, that is fast. Suggestions ?

      In the future every time I see an Update, I will do a Backup to the COMPLETE BOOTABLE COPY, then install the update. Should the Update fail, and grant me a KSOD, I’ll enter the BIOS and Boot from the Cloned HD. Yeah, I know System Resotre is supposed to prevent all this effort being needed, but the Bogus Update of Feb 11th deleted them all.

      Any suggestions for a Backup Program that will do this for me ?

    52. Andy says:

      Feb 14, 2009


      just another suggestion,

      If you can actually get into your computer… through the varios ways, I found that the fix was to remove the latest NVidia video drivers… ver 181.22 from my system, and reinstall the October 178.24 drivers..

      No more KSOD… from what I’ve read all over the internet, when it is video driver related, (and it not always is), this problem is not only associated with Nvidia.. ATI also has the problem.

      Although I’m not sure, some suggest it has to do with vista partially timing out your video drivers, as some people have actually reported not even seeing the blinking mouse, but the OS is running, but unresponsive If you can get rid of your video drivers and let windows load the native windows VGA driver, you can usually boot to a 640×480 screen. Again, if your problem is video related. This is an easy check for anyone with both integrated video, and a video card. On boot, go into the Bios, enable the onboard video/ disable the PCI-E video, (or remove the card), and let windows load with native drivers. If you get a normal Windows start up, you’ll know it’s video driver related.

      Others have suggested that it is due to a windows update KB952287.

      There appears to be many other reasons/solutions for the KSOD, and no one “trick” works for all.


    53. SalemCat says:

      Feb 14, 2009


      My system has Intel Video on-board, and with it disabled I installed a PCI ATI Card. The results were identical – no improvement.

      Some folks may have Video Card Driver porblems, but not in my case.

      I wonder if MS will ever own up to this being an upgrade issue. If so, they’ll need to distribute Bootable CD’s to address it.

    54. SalemCat says:

      Feb 14, 2009


      By the way, if you do a new installation of Vista to a new HD, and when you try to move your Data from the old HD, “Access is denied”, just turn off UAC temporarily.

    55. Nick Gordon says:

      Feb 15, 2009


      Per the “Mesh” solution above and “MikeB’s” follow up… all that is required is to rename your event logs folder. if you can get to a command prompt in any way, shape, or form, the solution is simple. Some people can get to the prompt through safe mode, others cannot… my only way to get there was using F8 at boot and using “Repair my computer” and starting the prompt there.

      Simply go to your windows drive, under C:\Windows\System32\Winevt\ and do this:

      ren Logs logs_bad
      md Logs

      Worked for me.

    56. Evan Everett says:

      Feb 17, 2009


      I would suggest renaming the original “log” folder under C:\Windows\System32\Winevt, then create a new folder called “logs”. After you can access Windows again save a copy of the renamed original “logs” folder for backup purposes, store it on hard drive somewhere. Once you are able to log back into Windows delete all the files in the original “logs” folder, keep the folder though. After you have deleted the files rename the original “logs” folder back to the original name and then delete the new one “logs” folder, this way the proper permissions are intact and you will not receive Event Viewer errors. The event files within the “logs” folder have a 20MB limit, if they reach the maximum limit problems will start. I have seen event files that will actually start to write into your local profile.

      The original log file folder has certain permissions set to it, check its Properties\Security\Advanced settings. When you create a new folder you do not get the proper permissions and you will start to receive Event Viewer errors.

      Simply rename the old log folder then create a new one, once you can access Windows again, delete files under the original log folder, reboot with Vista DVD media run repair again, rename new file to logs_new then rename the original logs folder back to logs. Event Viewer will not receive any strange errors as the original folder will retain the proper permissions.

      Hope this helps, worked for me, no more weird event error’s.


    57. Markus says:

      Feb 17, 2009


      This problem is driving my crazy since two days now. Still I refuse to reinstall Windows (Vista 32Bit) and setup all programs again.

      It all started yesterday when I – how trivial – plugged in my new 22” monitors. I accidently hit a switch on my mainboard (located right under the PS/2 plugs) which resets the BIOS. No big deal I thought, I went quickly through all the settings and reset everything for my needs. A little bit too quick as I later figured out.

      Booting Windows I noticed that I had too many partitions. My RAID1 system was broken because I forgot to set the controller to RAID mode (I booted in IDE mode). Windows refused to boot when I later set to RAID mode.

      Switching from IDE mode to RAID mode is no big deal (ICH9 controller on a Abit board with IP35 chipset). I did it once and thought it will work again. It involves importing some regsitry keys, rebooting, installing the RAID driver and configuring the RAID. But something went wrong.

      At the first boot the explorer.exe crashed instantly. I could’t get it running. I rebooted and ended with the KSOD with no possibility of interaction with the Windows system.

      For the last hours I think I read and tried almost every solution that was posted on the internet. I also tried to identify the registry keys that were imported with the ICH9 registry trick. But this seems not the be the issue.

      What a frustration. I think I’m going to install a fresh system overnight if I don’t stumble upon something during the next few hours.

    58. SalemCat says:

      Feb 17, 2009


      Markus, I feel your pain.

      I thought the whole point of a RAID 1 Array was you could remove one of the Mirrored Drives and Boot from the remaining one. Does it work that way ?

      I’ve been using RAID 1, RAID 0+1, RAID 5, and honestly I think they make my system MORE unstable, not less.

      Right now I’m using a newly created RAID 1 Array. I thought I could remove a HD and boot from the remaining HD. I also thought I could take (1) HD and place it in another computer and boot from it. I guess I need to actually TRY doing these before I get too confident.

      I did have a (4) HD RAID Array (until last week), and it worked fairly well. I could remove any single HD and still boot. And re-install the missing HD and Rebuild.

      But it did not save me from the KSOD.

    59. SalemCat says:

      Feb 17, 2009


      Oh yeah, I forgot to mention my (4) HD RAID Array was a RAID 5 Array.

    60. Markus says:

      Feb 18, 2009


      I feel very comfortable with my RAID system because I don’t have to worry about HW errors. Of course, this won’t include SW errors or my own stupidity. It reminds me once again to be very careful with system changes and for know I will regularly set restore points.

    61. SalemCat says:

      Feb 18, 2009


      Markus, what RAID version are you using ?

      My concern with RAID is that if there were a MB failure, you’d have to find a MB with the same RAID Chipset on it, and transfer the drives onto it.

      Chipsets are changing all the time, and I don’t know if the manufacturers are making them backwards-compatible.

      With RAID 1, simple mirroring, you’re supposed to be able to take a drive and place it in a standard MB and boot. At least that’s how I understand it.

      That’s why I’m leaning away from what I’ve done in the past, RAID 5 and RAID 0+1, and leaning towards RAID 1 only.

      Of course Intel has Matrix Raid, but I’ll bet that has major incompatibility issues.

    62. Rowedahelicon says:

      Feb 18, 2009


      Hey, I’m Rowe, the guy who wrote THIS IS THE REAL FIX.
      I discovered the initial problem that causes the KSOD, it lies in when the system is writing idea/to itself. For instance, I received it when shutting down during an update. However I found that it can also be caused by a Hibernation issue. Anyway, I received the KSOD again after…a hibernation issue. However Thanks to the input above, I found that the fastest way to fix is to rename the log’s folder. Appparently the issue is formed when a unknown record get’s stored into the logging structure. This may also be because of an update. As your read from my first responce, I was able to fix it by shutting off the event logger. Where as Windows must of turned it back on. Luckily I was able to just rename the folder via Windows 7 or Ubuntu.

    63. Rowedahelicon says:

      Feb 18, 2009


      Me again, Just an FYI I fixed the Ksod with this, this seems to be the fastes + safest way to do it

      Boot in safemode with console, msconfig and do the selective startup.
      But this time when you go on your desktop, run msconfig again and use normal boot, then under services enable all (REAL TIME SAVER) But don’t restart yet, save it and click it off then go to administrative tools. Make sure the Windows Event logger is DISABLED. Then you can restart, this saves around 20 mins of right clicking…

    64. KRM says:

      Feb 18, 2009


      Stumbled on this site after my 8 year old turned off the computer manually only to have it reboot to the KSOD. I tried the two most recommended remedies and neither worked.

      At first, it would reboot to a black screen and cursor. Hitting the shift 5 times worked once. I hadn’t read enough to know to hit the link, so I dismissed it, I was just checking to see if the dialog appeared. I rebooted, but then it completely stopped booting – the LED on the monitor indicated that it wasn’t getting any signal.

      I then rebooted and it to go into the Safe Mode version of the KSOD. Booting to the last known didn’t work either.

      Next, booting from the Vista CD. It actually took several attempts as it would frequently boot to the BGSSoD (Blue Green Setup Screen of Death). Literally – the Vista blue background with a white cursor. After several attempts, got setup to actually launch. Then tried modifying that reg entry – it already had the correct value. I checked all similar keys and they all had the right value, so even if I was looking at the wrong one, the value was still right. Then I tried renaming the logs folder and rebooted. Still no dice. Then tried running msconfig to turn off the event logging. No dice.

      Anyone else have any other bright ideas?

    65. KRM says:

      Feb 18, 2009


      One clarification – msconfig didn’t fail because it didn’t work, but because I couldn’t run it from the Setup command prompt. I attempted to run with elevated privileges as admin, but then got this error:

      RUNAS ERROR: Unable to run – msconfig
      1060: The specified service does not exist as an installled service.

    66. KRM says:

      Feb 19, 2009


      Using regedit, I was able to set the Windows Event Log service to stopped but couldn’t find the Windows Event Collector in the registry. Still no dice.

      After booting from the Vista CD again, I decided to try the restore, despite everyone’s claims that it wouldn’t work. It churned and churned, so I finally went to bed. Went I went to the computer this morning, the monitor LED was orange, indicating no signal. I bumped the mouse and it came to life at the Vista log on screen. I logged on successfully. I launched msconfig and checked the services and the Event Log was stopped. Since it had actually started, I didn’t disable the Event Collector (ooops!). I poked around and everything was working, so for kicks and grins, I restarted. Back to black, with no cursos and no signal. I let it sit for 10 minutes but it never came up. So, I rebooted and tried safe mode – fortunately, that did work, so I went into msconfig again and disabled the Event Collector service, rebooted, still black.

      So, after trying all of these steps, I’m now at a place where it boots successfully into safe mode, but booting normally fails.

      Any ideas as to what is going on?

    67. Blista says:

      Feb 19, 2009


      I tried all that jazz above, couldnt use sticky keys or boot to cmdprompt or safe mode, only KSOD. Used a Linux based live cd that edits the registry, all keys were correct. But the fix for me was the logs.

      Step #1 – Boot to Ubuntu Live Cd or the distro of your choice…
      Step #2 – Navigate to and Mount your harddrive
      Step #3 – Navigate to windows/system32/winevt
      Step #4 – Rename Logs to Logs_old
      Step #5 – Create a new folder called Logs
      Step #6 – Reboot to a working vista

      WTF Corrupt logs? Really? LOGS? REALLY? a Multi-Billion dollar corporation’s flagship operating system wont boot because of LOGS? Really…

      Optional Step #7 – install a free operating system that works and remove the virus that is W32/Vista.

    68. SalemCat says:

      Feb 19, 2009


      I tried everything from several Troubleshooting Web sites, and the only thing that worked was a fresh install to a new HD. Which is actually MicroSoft’s “Solution”.

      My old C: Drive, a (4) 160GB RAID 5 Array, still held all my Data, so I lost nothing but time.

      After much transferring of Data, I disassembled my RAID 5 Array, and used (2) of the original (4) HD’s to create a RAID 1 Array. Then I cloned my new Vista installation onto it. Sweet.

      Finally I downloaded MaxBlast 5 (free from Maxtor), and Imaged my new C: Drive. Next time (?) I’ll just Restore my C: from the image.

      I DISABLED Automatic Updates. Before I install any more Updates to Vista I’m doing a fresh Image first.

      I think I’m in pretty good shape now. And my computer is working better than ever.

    69. Andrew Susanto says:

      Feb 21, 2009


      I still have no luck fixing this with any of the above resolution.
      To I still unable to use shift 5 – 8 times to bring up msconfig, neither I can type it out in command prompt

    70. AimS says:

      Feb 22, 2009


      Hi there, thanks for posting all the different solutions to this problem. However, I’ve attempted several of the suggested fixes above, but nothing seems to work. Here’s what I’ve tried.

      * Start in safe mode w/ and without command prompt. Still have KSOD and never get the command prompt.
      * Start from last known good configuration. Same results (KSOD).
      * Using the Vista DVD tried to recover from different dates. None worked.
      * Tried to repair, said nothing to repair.
      * Ran regedit and followed the instructions in the article above, but the settings were correct.
      * Renaming the logs folder and created a new Logs folder.
      * Hit Shift key 5 times, the dialog asking to go to sticky mode comes up. I say yes, but does not take me to configuration panel. So I cannot start msconfig.
      * The only way I can get a command prompt is by starting through DVD and I cannot start msconfig through there. It either says it cannot find it or if I go to the Windoes\System32 and try to start it there, it says I “do not have sufficient privileges to run System Configuration.” To run as Administrator. How can I do this?

      I’ve basically run out of options. I don’t want to have to reinstall Vista and everything else. Thanks.

    71. SalemCat says:

      Feb 23, 2009


      Hi AimS,

      Your situation mirrors mine.

      I recommend you install Vista to a new HD, then attach your old one as a Slave. All your Data is probably still there – mine was.

      Use your old HD as a place to IMAGE your new HD. Then if the KSOD happens again (so far it has not to me) you can quickly restore everything.

      I’ve been very diligent backing up my Data, but now I realize I need to Image the entire HD. I just can’t spend days without my system.

    72. H-7 says:

      Feb 24, 2009


      Hi, I have two laptops doing this kosd.

      The first is a gateway, I tried everything on it. I was working on it before i found this site. But booting into safemode did nothing. Booting to last known did nothing. I even went as far as backing up my data, formatting the drive and installing windows fresh. I still received the kosd. So I tried another hard drive and still had problems. Slightly different now, sometimes it wont boot past the loading screen sometimes it will and then its the kosd. I installed another version of vista. It originally had Home Premium so I tried Ultimate. Ultimate installed and worked fine. I know there should be no problem with my Home Premium disk because i used it on another laptop yesterday with no problems.

      Now I have a dell laptop doing the same thing. I have checked the registry settings and they are all correct. I cannot boot to safe mode command prompt. The only way to access the command prompt is through the vista dvd. I have renamed the logs folder to logsbad and created a new folder Logs folder. Still kosd. I cannot bring up the sticky keys window either. The laptop beeps to let you know the sticky keys function has been enabled but it never brings up the window.

    73. SalemCat says:

      Feb 24, 2009


      Hi H-7,

      Your situation is typical, except that your Home Premium DVD would not work.

      I’m guessing it may have a slight scratch on it, or that particular DVD Reader is not as effective as it might be. I used to have CD-ROM Drives fail all the time; DVD Drives seem to be much more reliable (although I’ve gone thru more DVD Players for my TV than I can count).

      Once you have created a new Partition and Formatted a HD, that pretty much rules out O/S Software errors. Did you delete the old Partition as well as Format ? And the BIOS could be funky – but I doubt it.

      With a newly Partitioned and Formatted HD, any errors are likely Hardware related. Though my KSOD machine never showed any signs of Hardware Problems at all, and is running just fine now.

    74. SalemCat says:

      Feb 24, 2009



      Have you checked the Cooling Fans on the Laptops ? The Fans are the first thing to fail.

    75. AimS says:

      Feb 24, 2009


      Thanks for the response SalemCat. I ended up reinstalling Vista and all the software. I have multiple hard drives on that system and keep all the data on the separate drives from where Vista was installed. So I didn’t have too much to back up from the OS drive. It seems to be working fine now. It’s just a shame that I had to basically waste two days on this problem (1 researching trying to find a fix, 2nd reinstalling everything). I’ll keep an eye on this blog to see if anyone finds another solution, in case this happens again. Unfortunately, this seems to be a pretty common, yet serious, problem from all the forums I’ve seen and there doesn’t seem to be any good solution.

    76. Cpuguru says:

      Feb 25, 2009


      The Event Log Fix did the Trick. I also, renamed the old Logs folder and this workrd GREAT!!


    77. zach says:

      Feb 25, 2009


      it wont even let me boot up the vista media cd

    78. H-7 says:

      Feb 27, 2009


      Yes, all cooling fans are working properly.

    79. George says:

      Feb 28, 2009


      After wrestling with it for a few weeks, I finally fixed KSOD on my computer running 64 bit Vista Business. After much research, I’m starting to think this is boils down to ACL problems that prevent certain key Windows services from starting. Sometimes they cannot start because of bad ACL settings on their associated files. My KSOD occurred after chkdsk went haywire and “replaced invalid security id with default security” on every file on the hard drive. (There are a lot of blogs on that topic.) Some KSODs may be caused by bad ACLs in the registry as described above, but the result is the same.

      My fix was to reinstall Vista which puts the previous system files in the Windows.old folder. Reinstalling Vista warn you that you cannot use the previous version of Vista. Fortunately that is not always true. Sometimes you can go home again.

      Under the new installation I was initially denied access to the other folders on the C: drive and had reset the ACL and ownership on each folder by opening it with administrator permission.

      Now here is the trick to get the old system back again. I booted the computer with a BartPE cd based on Windows XP that I had created in a previous life. I then used the file manager to access the hard drive where I created a folder. I proceeded to move (not copy) all of the new system folders into and moved all of the old system folders from windows.old to the root directory. I rebooted and had my old system back again without having to reinstall the application software.

      I think this worked because reinstalling Vista essentially fixed the ACL corruption introduced by Chkdsk. I think it reset the ACL on the system folders to the standard administrator group ACL and allowed me to reset the rest of the folders manually.

      Other items of note:

      You don’t have to reinstall with the same copy of Vista used in the original installation. You may not even have to use the same version of Vista. I was sweating a little bit because my original Vista cd is damaged. A borrowed copy worked just fine for me.

      After reinstalling Vista, simply hooking the hard drive to another Vista or Windows 7 machine in order to move the folders will not work. It appears they “respect” the ACLs on the hard drive and deny access.

      However using a BartPE cd to move folders works and connecting the drive to a Windows XP machine would probably work as well.

      Windows 7 can experience the same problem.

    80. dave says:

      Mar 1, 2009


      Just thought I’d mention that using the Sticky Keys caused the computer to hang. I used the recovery tool to launch the command prompt and renamed the Logs directory in c:\Windows\System32\Winevt to Logs_bad, and then created a new Logs directory. On restart the computer loaded fine.

      That’s probably the easiest and quickest method of fixing this and doesn’t require any Sticky Keys hacks.

    81. SalemCat says:

      Mar 2, 2009


      AimS Says: “Unfortunately, this seems to be a pretty common, yet serious, problem from all the forums I’ve seen and there doesn’t seem to be any good solution.”

      Agreed. Although some correct the issue by simple means (renaming Logs, etc.), for many reinstallation remains the only solution.

    82. SalemCat says:

      Mar 2, 2009


      George: I’ll keep your method in mind should it happen again.

      George says: “After reinstalling Vista, simply hooking the hard drive to another Vista or Windows 7 machine in order to move the folders will not work. It appears they “respect” the ACLs on the hard drive and deny access.”

      I was able to access the old HD just by disabling UAC.

    83. Deejay says:

      Mar 4, 2009


      I have a Dell 6400 Laptop with Vista Home Premium.
      I have tried all of these fixes! None work for me.
      I can get the “Sticky Keys” – but it only asks if I want to turn it on or off!
      The only way I have found is to F12 on boot and load the Vista DVD.
      I have tried from there all the links – Check Disk, System Recovery (which lets me do it – but still the same. I also went back a month – it did not like that and refused!!) and others – no luck.
      I can get to DOS prompt and do some things (trying to remember my DOS commands – memories!!). Though cannot run MSCONFIG due to not having priveleges!
      I remember years ago that you could over write the XP installation, so I went for an Install of Vista and it warned me it would format the whole disk! Whoaa! Backed off from that. Need my data intact! I cannot add another HD (its a laptop!).
      Can anyone help further please? Pretty please?

      Cheers all.

    84. Sudds says:

      Mar 5, 2009


      I have an ASUS G50 laptop with 2 x 320Gb HDDs. Both HDDs are partitioned.
      Each HDD forms two drives….HDD-1 is C & D & HDD-2 is E & F. The system files are on “C”.
      The system is running Window’s Vista Premium.

      I encountered the BSOD after altering some settings in NVIDIA.

      I went nuts trying all kinds of blogs and forums for a fix and none of them worked.

      Eventually here is what I did……

      I consulted the ASUS User’s Manual for system recovery options.

      In that section you are presented with two options….one involving the use of the Recovery DVD which results in total data erasure. The other one involvews using the recovery partition.

      This last option allows you to re-install Vista on;


      2) THE ENTIRE HDD-1….which would remove the partition and format the entire HDD-1 as “C” drive. This would erase all data on the “D” drive.

      3) THE ENTIRE HDD-1 which will create a partition on the drive with 60% being the “C” drive and 40% being the “D” drive (with data erasure on the original “D”.

      It is recommended that you remove the secondary HDD-2 which contains drives “E” & “F”.

      I used option #1. I never even backed-up my data.

      When you reboot just keep hitting “F9” until a screen comes up presenting “Windows Setup” as an option. Just hit enter, read the Preload Wizard screen and hit “Next” 9which will select option “1” above.
      It will take a while to start the installation and mine took about 15-20mins in total.

      The system was re-booted and BAM I was in business!! None of the data on my “D”, “E” or “F” drives was TOUCHED!!

      I hope this works for you.


    85. SalemCat says:

      Mar 6, 2009



      I’d buy an External Hard Drive USB Enclosure, mount your 2.5in HD into it, connect it to a Desktop PC, and Image or Copy everything onto a Partition or Folder on the Desktop’s HD (assuming that HD has room).

      Put your 2.5in HD back, and re-install Vista (hopefully you have the Disc).

      You can then transfer your Data back by using your Network, or a USB Transfer Cable.

      In the future Image your HD frequently, and restorations (if needed)should be very easy.

    86. SalemCat says:

      Mar 6, 2009


      External Hard Drive USB Enclosures for 2.5in HD’s are usually $20 or less in the USA.

    87. SalemCat says:

      Mar 6, 2009



      If you have not taken apart Laptops before, first do a search for repairing your make and model. There are often excellent tutorials on the web.

      Also, be gentle and very patient. As you remove screws, tape them down to a piece of paper, and write down where they came from, and where they belong. Sketches or photos are very helpful.

      Remember, if something requires force, you’re doing it wrong.

      Good Luck !

    88. Ramorius says:

      Mar 9, 2009


      Been there, done that….

      I’ve tried everything here. Still no dice. I can’t get to msconfig – the Shift key thing does nothing and the only command prompt I can get to is from the “Repair your PC”, which isn’t recognizing me as an Administrator.

      Renaming the Logs directory and creating new one didn’t work either.

      All the Restore Points are gone. (Don’t know how that happened; I didn’t do it, and there were there just days before.)

      First thing I did was remove the drive and scan for viruses/malware. It was clean.

      I also determined that the last activity was a Microsoft Update. Apparently it was trying to do something, but there was no one at the keyboard so it was recording an error… First thing I’m going to do is disable those…

      Somewhere, there is a solution… I really don’t want to spend the hours reloading software into a new OS on the same drive, especially since it is a SOFTWARE PROBLEM and can occur again.

      Any ideas?

    89. SalemCat says:

      Mar 9, 2009


      Ramorius – Same thing happened to me, except I was able to “Repair” my PC, which kept the HD LED flashing for 20 minutes, with no improvement whatever.

      The KSOD happened immediately following an Update.

      I had to re-install Vista.

    90. Alex says:

      Mar 11, 2009


      Damn you microsoft. Damn you all to hell!
      Got 2 laptops none of them working. 5/8 times shift brings nothing up. I want to hammer this computer to bits. Over 2k, that son only gets richer sellingbus this garbage and microsoft support pretends they don’t about this issue. I’m going apple or Linux! Microsoft you will never get my money again.

    91. SalemCat says:

      Mar 11, 2009



      Software is designed by Human Beings. Human Beings make errors.

      Linux and Apple Software is also designed by Human Beings. They are not perfect, or at their core that much different from MicroSoft, despite what the TV Commercials say.

      In fact, many have attributed their own KSOD to Drivers written by 3rd parties; which is not MicroSoft’s responsibility.

      That said, if you are determined to write off Windows, do try Linux. Many are very pleased with it. It is free, or close to it. It will take a higher level of Technical Effort, though.

      Since you are in this Forum, I doubt you’re Apple material. Apple owners don’t think they even own a PC (Personal Computer). To them computers are Appliances, like a TV Set. If you have no inclination to ever crack the case open, let alone install cards, they are perfect for you.

    92. Andre says:

      Mar 11, 2009


      You are awesome, it worked! 3 days dealing with this Vista!

    93. VentureRider says:

      Mar 13, 2009


      THE solution!

      Root Cause: Corrupt event logs

      Resolution: Boot to installation DVD to get to a command prompt. Change to the C: drive. Rename c:\windows\system32\evtlog\logs
      to c:\windows\system32\evtlog\logs.old. Create *new* “logs” folder. Reboot.

    94. Nabeel K says:

      Mar 14, 2009


      I tried maannny of these suggestions and none of them worked. I sitll haven’t fixed the problem BUT…

      …I found a way to extract old files from the affected laptop and put it onto an external hard drive that I had laying around. Which I then can access from any computer. This is what I did.
      ***WARNING***: Instructions are given in a way where my 5 year old nephew can follow them. I’m a noob when it comes to computers, so, sorry to all you IT Experts

      1) Connect my external hard drive (via USB) to the affected laptop

      2) Turn the laptop on, repeatedly tapping on F8 to take me to the ADVANCED BOOT OPTIONS.

      3) Select Repair Your Computer

      4) Under SYSTEM RECOVERY OPTIONS I selected Command Prompt

      5) Typed C: [Press ENTER]

      6) At C:> typed regedit [Press ENTER]
      – The registry editor will open.

      7) In the Registry select ‘HKEY_LOCAL_MACHINE’ and then go to File > Load Hive.

      8 ) On the left panel, select Computer
      – You should then be able to see your external hard drive, as well as your OS (C:)

      From here on out, I’m not completely sure if this is how it is going to look for everyone. But this is how it looks for me (I have multiple users on this computer so I just went to into the user’s files and selected which ever files I wanted to COPY onto the external hard drive. )

      9) I Double Clicked on C: drive > double clicked on users > double clicked on the user under which my files are located

      10) I then located which files I wanted to copy. I right clicked on the file, selected copy.

      11) I then clicked on Computer on the left panel and then double clicked on my hard drive ( Mines was listed as the E: drive ). This should be located under Hard disk drives.

      12) Upon entering the hard drive, right click anywhere on the white part of the main box. Then select paste. I would give it some time to make the copy since the Estimated Time box doesn’t appear, just to make sure the files is being copied properly.

      I did this for all the documents that I needed ASAP and also for some family pictures. I still can’t come across a solution to fixing the “KSOD”. I tried many many suggestions but none of them worked. I think I might just as well do a reinstallation of VISTA since I got everything that I needed from the laptop.

      Be patient, optimistic, and keep persevering. Hope this helps. GOOD LUCK!

      • Nick says:

        Aug 28, 2011


        This seems to have worked for me, after having used the Ubuntu start up to change the logs folder – didn’t work I was able to use the vista start up disk to get to the point where I could access the command prompt – msconfig didn’t work but regedit gave me access to the harddrive – I put in an external hardrive and backed up what I needed – now I’m ready to reinstall and start again from scratch (possibly with Ubuntu!)

    95. KOMLO says:

      Mar 22, 2009


      Hi Guys,


      I just recovered from this. Like many I already had “NT AUTHORITY\NetworkService” in my registry. I was reading a forum where some said that they got the “Sticky Keys” Window to pop up by pressing “Shift” 5 times but that was all he could get it to do. I tried the same thing and when it popped up I noticed that there was a link to the “Ease of Access Center”. I clicked on that and in the address box I typed C:, sure enough I could see my files and back them up. The only bad part was that for some reason I could only x-fer about 4GB at a time because it would go back to a blank screen every 3 min or so, just keep doing the “Shift” trick, also it would lock up after I did the trick 5 or 6 times, just reboot and do it again til your all backed up. Hope this helps

      So While this did not fix the problem I was able to back up and reformat.

    96. KOMLO says:

      Mar 22, 2009



      Obviously not a hardware problem!

    97. Nuclear Option says:

      Mar 24, 2009


      None of the above solutions has worked for me. Like a fool, I took the microsoft updates on March 13. Contrary to suggestions on other sites, I have Genuine licensed software.

      Only arrow on black in safe mode.
      No choice but yes/no in shift x 5 technique.
      All registry entries read correctly.

      Sony VAIO FGN-FZ180E.

      I DO have LogMeIn on the PC.

      Thanks Microsoft!

    98. David Eisner says:

      Mar 24, 2009


      Just another data point: Just fixed a KSOD on a Dell XPS M1330 (with Vista). This is not my laptop, by the way, and I had to return it immediately, so I haven’t had an opportunity to do a post mortem.

      Registry fix didn’t work because RpcSs key already had correct setting. Renaming the event log didn’t fix the problem, either. Couldn’t get into command prompt with safe mode (just got KSOD again), so didn’t try msconfig.

      Wound up doing a system restore. There were two recent restore points, one from 3/23 11 PM (EDT), and one from 3/22 5 AM. The 3/23 restore point still exhibited the problem, but the earlier one fixed it. Not sure yet what got installed in the past few days, perhaps a driver update, or maybe malware.

      In any case, I agree that there does not seem to be One True Cause or One True Fix for this. I wonder what it is about Vista’s architecture that makes this such a common symptom, where the same was not the case with XP.

      P.S. I’ve seen a very intermittent KSOD on another laptop (Dell Latitude E6400), but there a reboot always fixes it. When I go back into the event log, I see that LogonUI.exe is crashing in these cases. Haven’t been able to determine why.

    99. NewJohnny says:

      Mar 26, 2009


      I believe George is right, this seems to be permissions-based:
      – Renaming the Logs folder (probably bad permissions on it)
      – Changing the RpcSs registry from Local to Network (permissions)

      After trying all other fixes, I figured bad permissions must reside elsewhere too. The fix for me was removing the drive and plugging it into another Vista pc. I added ‘Everyone’ with full permissions to the root of the drive and copied to all subfolders. I’m sure it was only a few files, but bulk changing them did the trick.

      For those who attempt this, keep in mind this can be dangerous in regards to spyware and viruses. They would now have full run of the system that would otherwise be blocked by proper permissions. A reinstall is still your best bet.

    100. MeierJ says:

      Mar 26, 2009


      1 Clients computer just had the second go around on this. First time did full system restore using Acronis True Image to a previous backup.

      I then did all windows updates and restarted it several times to ensure functionality.

      Only a matter of weeks later it was at it again.

      This time I decided to do more troubleshooting.

      It 2 Seagate 250GB Drives on a RAID 1 Mirror using GSATA from a Gigabyte P35-DS3R

      I removed 1 drive and scanned on a separate system with Antivir and Malwarebytes… nothing found.

      I then deleted the log folder winevt and then unhooked the first drive and hooked this up, no change

      Could not get into safe mode

      Finally ran system restore and that worked.

      Some of the things that I am wondering about are:

      logmein. This system also had logmein on it. This is a recent change and I’m not sure if it was in there for the first go around. However, numerous others on here have mentioned having logmein on affected systems.

      Also, this was hooked up to a Back-UPS 1300 with monitoring enabled.
      ( Windows native, not powerchute), I have seen antive windows monitoring do weird things with XP and Backups where it would shut systems into hibernation on the slightest event.

      This system is Vista Business x32 with SP1. It has Office 2007. Intel Core-2 6550 CPU. 2GB 800 DDR-2 ATI Video.

      It is hooked up to 2 Ricoh Network Printers a local Canon Pixma IP5000 and a local Lexmark X5100 series. (Come to think of it, lexmark was also mentioned)

      It has SImply Accounting 2008 & 2009, limewire, Pinnacle Studio, Nero 8, Avery Design Label & opera 9.64

    101. Frank says:

      Mar 26, 2009


      Got it working!

      I had KSOD after login. The sticky keys idea brought up the dialog, but couldn’t move past it. I booted from Vista…repair computer…renamed log directory through command prompt and voila!

      It’s working again. Thanks tons!

      I believe the corrupt logs brings the whole OS down.

    102. Royce says:

      Mar 28, 2009


      To Mesh and Mikeb, you guys are absolute legends. You have no idea how much headache you saved me with the fix. I was just about to rebuild. My procedure was slightly modified and I hope this helps someone else. I couldn’t get Msconfig to shutdown cleanly so instead I use the command prompt available from the repair options on the vista installation cd and was able to rename the folder that way.

      Thankyou, thankyou, thankyou!!!!! 🙂

      Amazing how corrupt logs can kill the entire OS. You’d think Microsoft would have some internal fix in place for that.

    103. Mike A. says:

      Mar 29, 2009


      I have fallen victim to KSOD, I have tried every posible suggestion, the only thing i haven’t done is a clean reinstall of vista, and that is possibly soon. (as soon as i can back up my data) the thing is, my Ksod doesn’t have the mouse cursor and the key board locks up so i can’t use the sticky keys trick.

      I can boot from my windows vista disk, but that only goes so far…(system restore points, repairing, etc. doesn’t work…)

      I’m at a complete loss here and i really don’t want to do a complete wipe of my computer.

      on a side note, this is the 1st time this has happened and i had vista for 2 years now with out that much of a problem.

      Any suggestions would be helpful, maybe something i didn’t think of before.

    104. Royce says:

      Mar 29, 2009


      Mike A., try what I did. Boot from vista disk, go to command prompt. Rename the logs folder (c:\windows\system32\winevt\Logs) then reboot. If that doesn’t help then maybe you have another issue.

    105. Mike A. says:

      Mar 30, 2009



      i really appreciate the reply but still no luck, i renamed the logs as you suggested. but still no luck with it. something else must be wrong with my system then. well thanks anyways 🙂

    106. WL says:

      Mar 30, 2009


      I have the Black screen of Death now 3 days at startup.
      My “special” SYMPTOMS:
      – After boot loading progress bar I get a black screen with a mouse pointer
      – I can move my mouse pointer
      – Ctrl + Alt + Del does not work
      – pressing shift several times does not work

      – after seeing this black screen for 20-30 seconds the system reboots
      – after a random number of reboots I can see the login screen and work on the system like nothing happend before.

      It can be either:
      – a windows update that came out after 27.03.2009
      – AnyDVD HD
      – Deamon Tools Lite (I deinstalled but it did not help)
      – ATI Display Driver and/or Realtek Audio drivers (I deinstalled and cleaned up but it did not help)
      – a Haupauge tv card update that came via windows update

      What I did/checked:
      – Log folder rename trick done
      – checked the registry for this RpcSs thing
      – tried to boot with Eventlog collector and Event logging disabled via msconfig

      so nothing helped me.
      any ideas?

    107. Royce says:

      Mar 30, 2009


      Mike A., sorry to hear about your problem. Unfortunately I have no suggestions for you.

      WL, make sure you press shift at least 5 times in rapid succession. If that doesn’t work, did you by any chance disable sticky keys? The only thing I can suggest is when you finally make it in to vista, run sfc /scannow from a command prompt. That’s supposed to check and repair your system files.

    108. WL says:

      Apr 1, 2009


      as I mentioned — After a random number of reboots I jumped into windows in normal mode. I was able to do an “upgrade” with the Vista Ultimate DVD so I did not loose personal data. I just had to reinstall some software after the long upgrade.

      Too bad that I was unable to test the command you mentioned above Royce 🙁

    109. Eddie says:

      Apr 2, 2009


      guys & Nick Gordon….
      Had a similar KSOD issue on Lenovo T400 notebook. Tried almost all the suggested repair modes as above (incl. sticky keys; freezing; clicking link won’t open explorer nor msconfig…..) and then tried renaming Logs folder as suggested above by Nick…mate!!!…worked like a charm.
      Appreciate LogBlog effort…and as correctly pointed out…sometimes a single way might not work for all the KSOD errors.

    110. Matt says:

      Apr 2, 2009



      OK, I just want everyone to know what worked when all the original and complex solutions did not work.

      It should be noted that my KSOD issue was the one where my computer never made it to the login screen, so it has nothing to do with explorer.exe not running. The KSOD started after I rebooted and Windows came up and said it could not start properly and had to do a startup repair (took about 10 mins). After rebooting is when I got the KSOD.

      Note: The only way I could get into the registry editor or command prompt was to boot to the Vista DVD on startup and go into the Repair your computer option as noted above.

      Here is what did not work for me:
      -various Safe Modes, Last known good, etc.
      -System Restore
      -Startup repair
      -Ctrl-Alt-Esc, Ctrl-Alt-Del, or Shift x5 (sticky keys)
      -I tried the RpcSs method outlined in the original article
      -I tried renaming the Event Log folders via the Command Prompt from the Vista media
      -I tried setting the Event Log and Event Collector service startup types to disabled via regedit from the Vista media
      -I tried to run msconfig from the Command prompt via Vista media (cannot run as elevated privileges so don’t bother trying)

      I was just about to give up, but realized that I had not tried one of the suggestions about resetting the security on the hard drive. I had already copied the data off of the drive using an XP SP3 PC, so I had a full backup of my data. I decided to plug the drive into another Vista PC and see if I could access the drive. Lo and behold I got access denied with Vista (not sure why XP could access the drive OK).

      So, this is what worked for me:
      -installed KSOD hard drive from my laptop into external Sata enclosure and plugged it into another Vista PC
      -tried to access the OS partition on the drive, got access denied
      -went into advanced security for the OS partition and took ownership of everything (including subfolders) – about 10 or 15 minutes to run on a 90GB partition
      -close dialog box, re-open, and add the Everyone group with full permissions on the OS partition and subfolders – again, about 10 or 15 minutes to run
      -put the KSOD hard drive back in the laptop, and voila! It’s working!

      I’m so happy I tried this before re-installing as this would have taken about 2 days to re-install and re-configure everything on this laptop.

      I should mention I am a computer tech and had access to these extra resources. If you are a home user and don’t have access to an external enclosure or additional Vista PC, you will have to take this solution to a PC repair shop and they should be able to do it for you in about an hour (including the restting of the security on the drive, which is the longest part).

      If you hate these types of Windows problems, find some software that will image your drive and do it at least once a week, or whenever you are about to install something new (even Windows updates) or update drivers, etc.

      Hope this helps someone else and saves a lot of headache, and perhaps all these potential solutions can be amalgamated into one article, with clear definition of steps and the defining differences between “black screen with white mouse cursor”.

    111. Dave G says:

      Apr 4, 2009


      Not sure if this has been covered as I haven’t ready absolutely every word here (but I have read about 75%), but I have been fiddling with Windows 7 build 7068.

      I have run into KSOD three times so far. 1st I think was triggered when I installed Nokia Comm Suite, 2nd when I updated to build of Norton anti virus 2009, 3rd was when I tried a patch to remove the “Evaluation Copy” water mark. Originally I tried all the above solutions to absolutely no avail. I then tried the old F8>Last know good configuration and that worked!!

      Hope this helps someone out there!!

    112. SalemCat says:

      Apr 6, 2009


      Matt – A very interesting solution.

      My situation was identical to yours. I gave up and re-installed everything. When I attempted to copy my Data from my old RAID 5 Array, installed as a Slave, I received an “Access is denied” message. So I just turned off UAC temporarily.

      You suggest giving “Everyone group with full permissions on the OS partition and subfolders”, and then re-installing the Boot Drive. That’s the one thing I did not try. It might have worked.

    113. Pedroghing as says:

      Apr 7, 2009


      Hello Everyone
      I have The same thing nothing work but in my case i can’t change the winlog to explorer he rest always cmd /k…. any idea how to change this.

    114. reza says:

      Apr 8, 2009


      i already rename logs..(in xp partition).but it doesnt work..please….help
      i just have black screen and mouse…i try shift button..nothing happen

    115. Brett says:

      Apr 16, 2009


      Hi people.

      Ok, I have tried all of the fixes here and none work. I did see this at the link below (bottom):

      “i found this on a previous topic and solved my problem, so here it is:
      “I have your solution, it is registy problem, boot up your pc, when it stops at the black screen with ‘my documents’ open (or not) hit cntr+alt+delete and then task manager, run a new task called regedit, now in the left hand collum navigate to HKEY_local machine/software/microsoft/WindowsNT/Currentversion/winlogon. now in the right hand panel click on shell. The data value should only be explorer.exe so delete anything after that, restart and thats it”
      Hope that helps… ”

      Ok. So this person was able to access his system. I can’t, but based on some of the other fixes here, it might work if we could find the right hive to load and make the changes (since the regedit works on x:) we need to load the correct hive.

      The problem is, I can’t find the hive. This is my last chance. If any pro out there can point me in the right direction, I’ll post back asap if it works.

      Also, SFC, sticky keys and restore, etc. do not work.


    116. steve says:

      Apr 16, 2009



      I was having the Vista KSOD on every boot but luckily it would always reboot itself into windows if left alone for a minute or two. I too suspected the event viewer.

      As per Mesh & MikeB I was then able to delete the event viewer logs in C:\Windows\System32\Winevt\ leaving its folder intact with all permissions etc. This folder was filled with only 80MB of logs.

      Hey presto….no more KSOD.

      Can’t understand why Vista gets so stressed over something it creates itself !

      I’m considering disabling event viewer for good in the services.

      Hope it works for you.

    117. eyeofdatigr says:

      Apr 17, 2009


      Thanks to Blista and steve here at the end renaming/creating a new Logs folder seems to work.

    118. Brett says:

      Apr 17, 2009


      It doesn’t work for me, unfortunately. I’m about to pull it out as per another post here and make it a slave on another Vista machine to release the permissions.

      Hopefully that will work for the small percentage of us that are currently still down.

      M-soft really should step up on this.

    119. Joe says:

      Apr 17, 2009


      Trying to take ownership as per “Matt” suggestion but am finding it difficult.

      Can anyone assist with eay take ownership instructions? I am trying to take ownership of a my KSOD Vista Drive that was taken from the desktop, put into an external case and is now connected to a laptop?


    120. Mark Maxwell says:

      Apr 19, 2009


      Hi everyone,

      I started having this problem earlier today, quickly found this webpage via another computer, and the MESH solution worked for me. Thanks a lot. What a horrible problem. I hope someone at Microsoft takes notice of this page and put out some sort of permanent fix in the updates for the non computer programmers among us, so this doent ever happen again. I’m not even sure really how to do this , the Mike B addition –

      Go to C:\Windows\System32\Winevt\ and rename your Logs folder to Logs_Bad, and make a new Logs folder
      Run Services and change your Windows Event Log service to automatic, and set the Windows Event Collector service to Manual.

      How does one make a new logd folder, exactly? anyway, its not so important right? I guess Im just afraid that the thing will turn on again sometime in the services and this will happen again somehow.

      Anyway, a question for those who might know – why do you think suddenly this is a widespread problem? Is it a virus thats going around and corrupting the events viewer log, or ?? Why now, we all have the same problem?? Anyway, the MESH fix worked for me so quickly and well, so whatever caused that problem, I also had it. Really curious why/how it happened.

    121. Mark Maxwell says:

      Apr 19, 2009


      Hi again,

      OK, it seems that you cant use system restore and create restore points without having the event log service turned on, which is pretty bad, so i did figure out how to make a new logs folder. No problem.

      A couple of questions:

      Why not just delete the Logs_Bad folder? After all, it seems so…. dangerous.

      Is there any way to prevent the file from becoming corrupted again, or ensuring that if it does, it won’t shut down the whole freaking computer again? Any idea what caused it to go down in the first place?! Anyway, thanks again MESH and Mike B.

    122. G.T. says:

      Apr 20, 2009


      I too had this issue and nothing seemed to fix it. I tried all of the given solutions here. My final last ditch effort before doing a complete reinstall was to put the drive in an enclosure and give everyone full control of the drive. I then also made a backup of the data I needed to save just incase this did not work. I inserted the drive back in the notebook and it booted fine. I did get one message stating that “the recycle bin was corrupt on the c drive, do you want to empty it?” This makes me think something was up with the drive and/or NTFS. Maybe a chkdsk did not complete properly or actually broke something it should fix. Anyway just my 2 cents.

    123. xopher says:

      Apr 22, 2009


      Great thanks, mikeb and mesh and sticky keys guy!

      All I did was rename the logs folder and it worked a charm!

    124. Brad says:

      Apr 22, 2009


      Hello everyone,

      I have been going through many posts on this and this one has been the most informative. The only problem that I have had though is that I have not been able to get step 3 in Mesh’s solution to work. I could only get the “Ease of Access” up by pressing WIN+U…

      Alternative solution:

      1. Boot into the Vista DVD and go through the repair and into the command prompt option.

      2. change you working directory to c:\windows and then run the following command “dir osk.exe /s”

      3. osk.exe should appear in two locations, go to each of these locations and rename the file to something else. (example osk.bak)

      4. Make sure you are in the following directory “c:\windows\system32” and run the following command “copy cmd.exe osk.exe”

      5. Reboot you computer and wait for it to get to the KSOD.

      6. Press the windows key + The letter U key (WIN+U)

      7. Check the box for “Type without the keyboard (On-Screen Keyboard)” and press “Apply”

      You should now have a command prompt to continue the rest of Mesh’s steps.

      Hope it helps and thanks to all for your notes.


    125. Brad says:

      Apr 22, 2009


      This is what Mesh wrote so that you don’t have to search through all the posts:


      My name is Mohannad Shaheen and i am a computer engineer.

      seems THIS IS A REAL FIX! READ HERE is right, all the problem is caused by the EVENT LOG..

      1. after the KSOD HD activity ended and i pressed shift for 5 or 8 times , the window came, i clicked yes.. but it hanged and freezed ..

      2. i tried next time i rebooted, after clicking the shift for 5 or 8 times, the window appear, and there is a link on that window says :

      Go to the Ease of Access Center to disable the keyboard shortcut

      3. i clicked on that , an explorer window opens, in that window clear the link and type msconfig and run it.

      4. in the selective startup i’ve unchecked the two options, apply restart.

      5. windows started with explorer.

      6. running msconfig again, enabling all under startup items and all under services, but I’VE UNCHECKED THE FOLLOWING :

      A. Windows Event Log.

      B. Windows Event Collector.

      you don’t have to go and enable all the services one by one like THIS IS A REAL FIX! READ HERE said.

      if some one tried from step 3 just to disable A & B items, if it worked please feed back.


    126. chadspen says:

      Apr 22, 2009


      The “EVENT LOG” fix worked after every regedit fix did not…

      As stated by other users, I just:
      1) waited about 2 minutes at black screen of death
      2) pressed shift key 5 times
      3) clicked the “Go to Ease of…” link
      4) in the title bar, typed “c:\windows\system32\msconfig.exe”
      5) in the “services” tab, located “windows event log”
      6) disabled (unchecked), applied, and restarted (manually)
      7) hello windows!

    127. Chuck says:

      Apr 24, 2009


      I downloaded the VISTA RECOVERY DISC here:

      restored to an earlier version. no problems since.

    128. Pete says:

      Apr 26, 2009


      Only fix that works for the Black Screen of Death problem, if your Vista boot disk can’t recognize any issues with your Vista installation, is to boot your computer to other OS, you have to install or have to have and put your Vista hard drive totally shared for the network and for users.
      This helps you to get rid of the permission problem that is causing your Vista to lock up. (You can maybe unplug your cord from the network just to make sure nobody will hack into your system, while you are applying this fix).

      Next step is to Boot into your newly opened Vista installation and run Regedit. You can see there many HKEY_XXX_XXX folders that contain your registry information, choose CLASSES_ROOT folder and click Edit from the toolbar, from there choose Permissions. Give “Creator Owner”, “System”, “Administrators” and “Users” Full Control, If you can see your own account name there, delete it. Go trough rest of the 5 HKEY_ folders Editing permissions and giving Full Control to all accounts except “Everyone”. After giving permissions, exit and reboot your computer. Now you can put your Vista installation HD private again by right clicking the hard drive icon, properties and uncheking shared options.
      Now you should have everything back without having to install Vista and all programs all over again!

    129. Feelin much better says:

      Apr 28, 2009


      started computer with vista dvd, went to command prompt, started c:\windows\notepad.exe
      Then did File/open and, browsed to C:\Windows\System32\Winevt\ then renamed logs to logs_old and created new logs folder.
      Rebooted, and everything worked!

    130. snpperhd says:

      May 1, 2009


      Hi, I have a Dell XPS laptop and my KSOD began immediately following a reboot after a windows update which included IE8. I’ve tried all the aforementioned actions and all don’t work for me. The StickyKeys menu never pops up with 5 presses of ‘shift’ or when holding down 8 secs. I have no disk activity indicated at all. When I boot through my Vista recovery disk and attempt msconfig from the cmd line, I get insufficent rights even though the cmd window shows administrator. System restore runs but errors out stating it cannot find the specified file (code 0X80070002). Not much else to say. I hope someone else was affected by the April 30th windows update and can help me out of this mess. Thanks for the support blog though…it’s been promising if not successful.

    131. PeterZ says:

      May 2, 2009


      My KSOD happened after the login screen. I followed the same procedure as chadspen and fixed the problem (it looked like the easiest, I’m not very confident in my abilities with this stuff). My question is “What, if any, ramifications are there to leaving “windows event log” disabled? Should this be considered a temporary fix? If so, what is my next step? Actually, my next step is to backup my computer! But then what? Thanks everyone!

    132. zhao cong says:

      May 4, 2009


      my vista is preinstalled so i cant boot using the media pls help

    133. PeterZ says:

      May 6, 2009


      Okay the fix per chadspen wasn’t perfect. I couldn’t backup my machine because the Task Scheduler was not on (and who knows what else!), and I couldn’t turn it back on. So tonight I tried the fix per Evan Everett and now everything seems to be great. I renamed the “Logs” file “Logs_bad” created a new file called “Logs”, copied the contents of “Logs_bad” to another new file in My Documents then deleted the contents of “Logs_bad”. Then, I couldn’t rename “Logs_bad” to “Logs” before deleting the new “Logs”, I had to merge them. Now I’m able to perform my backup. My question now is, “Why can’t you simply delete all the files in “Logs” instead of doing all the renaming stuff?”

    134. MusicMan says:

      May 7, 2009


      Well, thanks for all the input guys. I’ve been working on this machine for over 2 weeks now. Here’s the golden nugget that allowed me to get it to load up to the desktop.

      I had to get to a command prompt but the system was so corrupted that I couldn’t even get the vista repair utility to come up any longer. I had to burn an ISO of the repair utility on another comp and then boot to it. At the command prompt I navigated to c:\windows\system32\winevt and renamed the logs file to logs_old. Then I created a new file by typing “copy con logs” which opens up a new log file to edit. Hit CTRL + Z and hit enter to close the file. Reboot compter and Voila, we’re back on track. Hopefully, this will help someone.

    135. Hristo says:

      May 7, 2009


      Is there any software arising blue screen. I want to check my system stability.

    136. Tree says:

      May 9, 2009


      Believe it or not, after trying everything listed I am still at a blue screen with the cursor. Doesn’t even attempt safe mode, just goes to “Windows is loading files” and then sits at the blue screen. Any new developments that could help?

    137. Pablo Peirone says:

      May 12, 2009


      After a few hours of trying I’ve come to a solution for my Toshiba Satellite KSOD.

      *Reboot and went to Safe Mode with Command Prompt
      *Run CHKDSK /F
      *Go to Safe Mode with Command Prompt again
      *Type EXIT and go back to Win enviroment
      *Start Task Manager (ctrl+alt+delete, task manager)
      *Run REGEDIT
      *Go to HKEY_local machine/software/microsoft/WindowsNT/Currentversion/winlogon
      *In the right pane search for Shell, there leave Explorer.exe as the one and only value.
      *Restart again in Safe Mode
      *Control Panel
      *Administrative Tools
      *System Restore
      *I restored to a week previous of the KSOD

      That worked for me.

    138. […] Add a white arrow to it and you have yourself the new and Vista-specific “KSOD” or Black Screen of Death. (BSOD was already taken. […]

    139. Andrew @ NY says:

      May 18, 2009


      Worked for me…
      All operating modes gave me the KSOD. I had to:

      1)Go to recovery mode(press f8 at startup)
      2)Choose comand prompt from the list
      3)Type in c:
      4)Then type in Regedit
      5)Clicked “File>Import”
      6)Clicked to show “all files” at the bottom
      7)Surfed to C:\Windows\System32\Winevt\logs
      8)Deleted all event logs one bye one.

      Closed all windows, clicked on restart and was done. I am operating on a Dell Studio with Windows Vista Premium.

      Thanks Guys!

    140. Ken says:

      May 18, 2009


      What I did to fix this issue was take the battery off of my laptop for a while and then put it back on and it booted up just fine.

    141. Gilbert Tyrrell says:

      May 18, 2009


      Folks, my vista machine only black screens on a restart. No other problems on startup. None of the solutions have fixed it. Been searching all over the web including MS site. The only thing I have heard is it seems to be associated with the first version of vista. I have two othe newer machines without these issues. Any thoughts?

    142. Ehren says:

      May 19, 2009


      quote= “Hi everyone,

      I started having this problem earlier today, quickly found this webpage via another computer, and the MESH solution worked for me. Thanks a lot. What a horrible problem. I hope someone at Microsoft takes notice of this page and put out some sort of permanent fix in the updates for the non computer programmers among us, so this doent ever happen again. I’m not even sure really how to do this , the Mike B addition –

      Go to C:\Windows\System32\Winevt\ and rename your Logs folder to Logs_Bad, and make a new Logs folder
      Run Services and change your Windows Event Log service to automatic, and set the Windows Event Collector service to Manual.”


      Oh man, this worked for me. Thanks so much whomever figured this out originally. What an awful problem. All I had to do was rename the Logs folder, and then create a new one. Restarted and ran services.msc and Windows Event Log was already automatic, and Windows Event Collecter was already manual.

      Just booted right up. Thank you. 🙂

    143. Kuang says:

      May 20, 2009


      I’m stumped too, I’ve tried all the tips and solutions that people here have posted but I still can’t get the task manager to show up.

      With the MESH solution, I’m stuck at trying to get pass the sticky key trick to bring up the window with the link “Go to the Ease of Access Center to disable the keyboard shortcut” because it keeps asking “Do you want to trun on sticky keys?” even I have done clicked “yes” so many times even after multiple reboots (normal/safe mode/last good config/etc).

      ctrl-alt-del and ctrl-shift-esc doesn’t work either (nothing comes up).

      the solution required to edit the registry doesn’t work either although i wasn’t sure what this part meant:

      Value Name: ObjectName

      Old Value: LocalSystem

      New Value: NT AUTHORITY\NetworkService

      but i had a look at it and one of the values is set to
      NT AUTHORITY\NetworkService
      which I don’t think is the problem.

      The solution with renaming/deleting c:\windows\system32\winevt\log folder doesn’t work either.

      I don’t have any external harddrives or usb flash drives connected to it while booting

      Just a note, I’m currently running Windows Vista SP2 rtm and it’s not a problem with SP2 as I have being using it for a while before the KSOD happened.

      Any help will be appreciated as I don’t have a lot of free time to google up for other possible solutions. Thanks.

    144. Kuang says:

      May 20, 2009


      another thing i should add is that i have also tried using the vista installation disc to repair for startup problems (which didn’t find anything) and trying to get access to msconfig.exe which requires admin mode.

      tried using the runas command to run msconfig but that didn’t work either.

    145. JonGS says:

      May 20, 2009


      First off registry RpcSs already had correct settings.
      Was easily able to rename winevt logs directly using command prompt from ‘repair computer panel’ . Having renamed the directory and create the new one I double checked to make sure changes had been correctly made and rebooted – no luck still KSOD
      Having searched unsuccessfuly for another solution I then got explorer working using sticky keys method (incidentally each start only gave me a few minutes before it died again).
      I then disabled windows event log from msconfig and SUCCESS.
      Don;t understand why simply renaming logs directory did not work, but having disabled windows event log I then again renamed lod directlory and now all is good rebooting normally with event log enabled.
      Hope this might helo someone.


    146. jonboy71 says:

      May 21, 2009


      I’ve tried every possible fix listed in this thread and can’t get out of the KSOD. I can’t get get an explorer window to pop up. I’ve tried the sticky keys thing which didn’t work. i then had to do the trick to get the command prompt to come up when hitting WIN + U at the KSOD which was successful. When I try to run msconfig, I get an error saying “program too big to fit in memory”. I’m using a Dell Dimension E520. Anyone else have any suggestions?

    147. […] auto introduction in the 50’s. After working on yet another Vista PC with the infamous KSOD (blacK Screen Of Death), I think that comparison may have been too […]

    148. AubreyG says:

      May 24, 2009


      Matt, thanks for the following:

      “So, this is what worked for me:
      -installed KSOD hard drive from my laptop into external Sata enclosure and plugged it into another Vista PC
      -tried to access the OS partition on the drive, got access denied
      -went into advanced security for the OS partition and took ownership of everything (including subfolders) – about 10 or 15 minutes to run on a 90GB partition
      -close dialog box, re-open, and add the Everyone group with full permissions on the OS partition and subfolders – again, about 10 or 15 minutes to run
      -put the KSOD hard drive back in the laptop, and voila! It’s working!” –

      I too had been through all the other options in the forums and was about to cut my losses and copy contents via caddy before wiping. I would have used XP with the caddy, so wouldn’t have seen the permissions problem!

      Big thanks!

    149. molgan says:

      May 26, 2009


      5) in the “services” tab, located “windows event log”
      6) disabled (unchecked), applied, and restarted (manually)

      This worked for me a couple of times, but now my computer has restored the settings, and won’t start up
      before it used to start after a couple of hours with black screen and mouse pointer

      How can i run msconfig from safe boot with command promtp
      I says that i don’t have administrator rights

    150. molgan says:

      May 26, 2009


      “How can i run msconfig from safe boot with command promtp
      I says that i don’t have administrator rights”

      My mistake, I ment to write
      How can I run msconfig from command prompt after booting from the windows CD

    151. Wayne says:

      May 27, 2009


      Mesh and MikeB thank you so much!!! I just booted from my Vista CD, picked repair, opened a command prompt and renamed the logs directory. It worked great! Thanks again!

    152. RitaM says:

      May 29, 2009



      I have similar problems (started 3 days ago) on a Dell desktop (purchased new in March with Vista Home Premium) with the following exceptions:
      – since this is a multi-user machine i get to the window to select which user to logon
      – all get the black window with an active cursor when I log into an account
      – I have disable the Dell dock for all users EXCEPT the guest account
      – If I log into the guest account and press the enter key, the screen changes to blue AND the Dell dock icons loads which give me access to my computer. There is no Windows task bar, however, and none of my normal desk top icons

      I was on the phone with Dell support and over 2 hours and they did rollback (via remote control on my machine)to the last patch Tuesday. This did not fix anything.

      I have access to and called Microsoft internal support. This particular machine is not on the supported list but he tried to help. He said video drivers do not load until you logon and it was probably the video driver.

      Still have not attempted the log rename solution above. What is actually causing the problem. I want to know before I start changing things. (I also have a Dell inspiron 1720 laptop a little over a year old and it does NOT have these problems. Dell dock is also disabled) Both machines are regularly updated.

      Does this info add any more information to the possible cause of the problem? It seems if I rename the logs, what is to prevent the problem from reoccuring.

    153. RifRaf says:

      May 29, 2009


      Thanks for the solutions regarding resetting security permissions Matt. “Matt Says: April 2nd, 2009 at 11:53 am LAST DITCH EFFORT”
      Had all the same symptoms and had tried every other fix to no avail. It did mean installing vista onto another hard drive but that was nothin after pulling out my hair for 6 hours.

    154. FrankL says:

      May 30, 2009


      I read 80 percent of the post. I tried all the suggested fixes without success on a HP SR5310F. Ended up re-installing Vista home premium 32-bit.

    155. Natti says:

      Jun 1, 2009


      I have tried everything listed above (i read 100%) Chkdsk /f or /r did not fix. Resetting permissions of the whole drive did not work. Renaming the log dir did not work. sticky keys will not launch ease of use. ctrl + shift + esc will not work. System restore failed twice (there are only 2 points) I can do restore manually if i knew where the restore registry files are located.

    156. KelceyJF says:

      Jun 2, 2009


      Thx MESH!

      I dual-boot linux, so I booted from linux, force mounted the Vista partition, performed NTFSFIX, and renamed Logs and created a new Log folder.

      I rebooted into Vista and a chkdsk ran (because of NTFSFIX) and found orphaned files, and Vista booted successfully.

      I’m sure this would work if you booted from a linux distro on CD as well.


    157. CHK DSK Problem says:

      Jun 3, 2009


      […] I tried following this guide: and it didn’t help. Any other ideas? __________________ Desktop/Laptop nForce 750i SLI FTW […]

    158. Alexander A says:

      Jun 5, 2009


      Here’s yet another solution to the KSOD problem, may not be universal but it solved it in my case where the registry settings\keys had the correct values.

    159. bcc says:

      Jun 6, 2009


      Thank You Mesh & Company:

      I will be first to admit, I’ve badmouthed geek types on occasion.

      Well mad props to all who live and breath this stuff. THANK YOU for bailing a regular guy out, and helping me avoid pulling the few remaining hairs on my head!

      I did the same thing as Wayne above May 27th, 2009 with Vista disk and log renaming; it fixed in 5 minutes what had been a week of maddening frustration!

      Anyway you are awesome!

    160. Tim says:

      Jun 7, 2009


      Instead of a black screen I had a flashing (blinking) screen (black vista logon sreen), and I was able to boot into Save Mode.
      – Save boot with network booted but network was not working.
      – I tried all kinds of msconfig settings without success.
      – I uses “autoruns” and disabled many, many different things and ultimately was able to do a normal boot. (was it the fingerprint driver on my thinkpad 400 – I dont know for sure). But still network was not working and many services didnt start.
      I recovered from this with a simple:
      “netsh winsock reset”


    161. Mario says:

      Jun 7, 2009


      Thanks everyone. This was quite an excercise. After trying nearly everything on this page, I used Chuck’s note about getting the Recovery CD from:

      I made a bootable CD. I tried the “Auto Recover” but that did not work, however, I was able to go to an earlier working backup. That did work.


    162. FFrancesco says:

      Jun 9, 2009


      Unbelievable.. I have renamed/replaced C:\windows\system32\winevt\logs with a SLAX Live CD on a Compaq Vista Home Premium, and it’s worked! I wish to thank all of you, guys, grazie mille!
      I had KSOD after an automatic update


    163. Yuri says:

      Jun 12, 2009


      I’m stuck too. It’s absurd that this problem has still not been officially solved/looked into by microsoft.

    164. tyler says:

      Jun 13, 2009


      i got mine to boot by disabling driver signurature. but it took a LONG time

    165. Randy says:

      Jun 18, 2009


      Renaming the Log Folder worked for me after I tried everything else.

      Thanks all!!!

    166. Someone says:

      Jun 24, 2009



      Here’s the thing, (and I’m only writing this because I don’t have to sign up for the website……….. and this is where I got most of the fixes I tried). It’s a PERMISSIONS issue. There were several things I tried, when I was thinking of setting permissions for Everyone to full, but then I thought to myself, it that works, then perhaps there’s just a few certain folders that have had their permissions messed with. Sure enough, one of the folders that I noticed that did not have proper permissions was the WINDOWS folder in the root directory. I changed the permissions on it, (and several other folders such as the Logs folders in various locations of the Windows folder) and after a reboot it WORKED!!!! I used my XP laptop and an IDE/SATA to USB adapter to be able to look at the files and such because it’s MUCH faster than waiting for the Vista boot disk to load up.

      When you’re changing the permissions, make sure that SYSTEM has FULL CONTROL, as well as Administrators. Users should only have Read & Execute, List Contents and Read privileges.

      😀 😀 😀 😀 😀 😀 😀 😀 😀 😀

      ……….. Ohhh bugger, I just realized that I disabled several key services (secondary logon and such) that are needed to access the computer……… Time for another reboot.

    167. ATechGuy says:

      Jun 24, 2009


      Turns out my client had the clock set to 2099. If anyone happens to have System Restore say that you are trying to restore to a date that is more than 60 days ago, when you are really just going back a few days, that should be a tip-off to your problem. Renaming the log folder is by far, the simplest method, if you can get to the file system…

    168. Matthijs says:

      Jun 28, 2009


      The register key was as it should be, ive renamed the Logs folder and created an empty one.. problem solved.

    169. ClearlyPro says:

      Jul 7, 2009


      When I tried to log on to my dekstop, a box saying “there are not sufficient resources to load” my account with the default something-or-other came up. The message had a timer that was going to close the box, and then when it closed it would not log me on. I could not turn it off normally so I cut the power. When I turned it back on I logged on fine?
      I read here Windows Error but couldnt make sense?


    170. PDH says:

      Jul 9, 2009


      Yet another tale of woe… Had 1 drive of a RAID 5 array fail. In degraded mode CHKDSK owuld hang and recovery woudl hang. Once I got a replacement drive in I had some 360+ errors on the file system from CHKDSK and recover ran to completion.

      Vista now hangs before the logon screen, with a cursor. etc. None of the suggestions given here to date help any. An F8 boot with logging shows a driver failing to load but no details as to which one.

      My guess is random file permissions have been screwed up, though I suppose I could be missing some critical file. The RAID support is on the MB so I can’t easily drop the array into another machine to globably reset perms. Instead I tried booting the install, went into recovery and brought up the command prompt. In the command prompt, I went to the Windows dir and ran:

      system32/icacls * /GRANT “NT AUTHORITY\SYSTEM:(RX)” /T

      which is a WAG as to what might be needed to let the system read and execute everything. Unfortunately I’m still not booting. Anyone an expert on ACLs and have any idea on what else to try?

    171. Jimmie says:

      Jul 10, 2009


      Ok, I have tried everything that i have read to fix my problem and nothing works.
      1. tried the Shift Method – Nothing
      2. tired the ctrl-shift-esc – Nothing
      3. tried ctrl-alt-del – Nothing
      4. Regedit User info was all correct
      5. performed chckdsk – Nothing
      6. Logs Folder was empty – renamed the folder and created new folder anyway – Nothing
      7. Logon Repair returns no errors
      8. Safe Mode with cmd prompt – Nope

      So i guess i should stop trying to fix this issue and start over but i cannot loose the files on this HDD. How do i copy/transfer files by using the vista media disc and opening the command prompt? If i copy the files from the User folder into the d:\ Recovery Folder will i be able to transfer them back to c:\ once i finish the reinstall?

    172. PDH says:

      Jul 10, 2009


      Jimmie, doing a fresh install should rename windows to windows.old and leave everything intact (assuming you have space). You shouldn’t even have to copy them yourself, though it’s not a bad idea for safety. However, you can’t simply copy them back and get your apps back. None of the registry entries will be there and the SIDs used to determine authorization will not match up. The latter you can fix by resetting auths, but you need to reinstall the apps to fix the first problem (unless you have weeks of free time to spend copying over registry entries).

    173. PJ says:

      Jul 24, 2009


      I came across the same problem and tried the various fixes (5 hours) – all with no effect.

      The only thing that worked for me was to load the UBD (Universal Boot Disk) and change the permissions that had been suggested in previous comments. All the permissions were way off and looks like they were the problem. My system is booting again.

      Excellent thread and obviously a pretty common problem with various causes.

    174. Judith says:

      Jul 25, 2009


      I have the same problem. It will show splash screen/loading bar, then logon screen… But after that, it’s a black screen with a cursor. Pressing ctrl+alt+dlt brings up a menu, then I select task manager. This is only a temporary fix.

      I’ve found that if I just sit and wait, the cursor will show that it’s loading… And then after a while the desktop will bring itself up. Could this have something to do with a memory problem? Or a windows update?

      And for your solution, I wonder how the permissions got changed in the first place? It’s very odd.

    175. hahofssf ss says:

      Jul 27, 2009


      I had very bad problem, I couldn’t get anything to display, computer wouldn’t even respond to a shutdown within the welcome screen. Only thing worked was going in to safe mode with command promote, prompting the msconfig. Disabling everything. Then finally I got my desktop back, had to really play around with services comparing with a similar pc. Thanks to who ever came up with that one?

    176. Dent says:

      Jul 30, 2009


      i’ve been fighting a KSOD for a couple of weeks. None of the fixes I’ve seen here have worked yet. Treid the rpcss registry fix – permissions were O.K. New event logs. Still KSOD. Safe Mode is KSOD. No System Restore points to revert to.

      The application event log from the KSOD’d install shows multiple errors relating to failed COM+ events – details indicates the culprit file located in a SP1 folder. Event suggests reinstalling COM+ system.

      Anybody have any ideas on reinstalling COM+ on a non-functioning system? I have access to the drive of the failed install via a new install on a separate partition.

    177. jake g says:

      Aug 1, 2009


      mine says that my system is already running but i already exited out of everything i dont get it

    178. Dave says:

      Aug 7, 2009


      I am seeing this on my daughter’s Dell Inspiron 1751. I think it has Vista SP1. An update came through last night. System booted fine afterwards. The system gets automatic updates so it should be on the latest.

      I think an antivirus package deleted some items as she mentioned something about files deleted. She isn’t computer savvy so she doesn’t recall much.

      I get the KSOD booting into safe mode. None of the tricks, such as shift, doing regedits, renaming the event logs, etc, seem to work. For some reason there are no restore points which is odd as I am certain I enabled those. But from what I read it sounds like that may not work.

      So I am looking at a fresh install. I see that windows is renamed to windows.old. How about the User directory? There is all kinds of data there, such as photos and music. Will I need to get a couple of USB keys and save this off?

      Thanks for any advice.

    179. Jessy Grondin says:

      Aug 10, 2009


      Nothing works here too..

      Read and tried 100% of the ticks here… without success…

    180. djdeito says:

      Aug 11, 2009


      this solution worked for me. thanks so much.

      # Mesh Says:
      February 3rd, 2009 at 12:09 am


      My name is Mohannad Shaheen and i am a computer engineer.

      seems THIS IS A REAL FIX! READ HERE is right, all the problem is caused by the EVENT LOG..

      1. after the KSOD HD activity ended and i pressed shift for 5 or 8 times , the window came, i clicked yes.. but it hanged and freezed ..

      2. i tried next time i rebooted, after clicking the shift for 5 or 8 times, the window appear, and there is a link on that window says :

      Go to the Ease of Access Center to disable the keyboard shortcut

      3. i clicked on that , an explorer window opens, in that window clear the link and type msconfig and run it.

      4. in the selective startup i’ve unchecked the two options, apply restart.

      5. windows started with explorer.

      6. running msconfig again, enabling all under startup items and all under services, but I’VE UNCHECKED THE FOLLOWING :

      A. Windows Event Log.

      B. Windows Event Collector.

      you don’t have to go and enable all the services one by one like THIS IS A REAL FIX! READ HERE said.

      if some one tried from step 3 just to disable A & B items, if it worked please feed back.

      # Mesh Says:

    181. Bob in DC says:

      Aug 16, 2009


      If you have CA (Computer Associates) antispam software, this may work –
      it has been working for me (now for 2 days):
      (I have the CA Antivirus suite.)
      In System Configuration, selective startup, SERVICES,
      I unchecked : caCCProvSP

      And after restarting, no more Black Screen.
      If I re-check it, black screen again.
      I “chatted” with CA tech support and they said caCCProvSP is the anti-spam component of the CA suite.

      They had me uninnstall the anti-spam, the reinstall a version they gave me a link to. That didn’t work — black screen again, unless I uncheck it in SERVICES.

      The anti-spam software “seems” to be active… but I’m trying to find out what exactly caCCProvSP does. (anyone know?)

      CA’s tech support is down at the moment.

      Hope this helps anyone with CA. Since this just started a few days ago, I imagine it’s related to an update from Microsoft or CA.

    182. ChaiC says:

      Aug 17, 2009


      I’ve tried everything that was mentioned in the threads. It didn’t work.
      Went out and got an SATA/IDE to USB 2.0 adapter. Took out the hard drive with the KSOD and connected it to my other computer. Saw it as an external hard drive. Went into the eventlog, created a folder and moved everything that was in the LOGS file. After it finished moving, put the hard drive back
      into the laptop and it started running. Hope this helps.

    183. Rob (Froglicka) says:

      Aug 19, 2009


      Hey guys,

      Firstly, isnt Vista poor :((( ??? and secondly, I’m not here to offer any more magical solutions I’m afraid! I just thought I had better add:

      When running the cmd based fixes type “c:” in cmd prompt first… my cmd.exe defaulted to a PQService “X:” drive?.. This therefore meant I was renaming the logs on the wrong drive by accident!

      Backup Idea:
      If you have two harddrives, by running notepad.exe from cmd (C: drive), and then going to file>open – you can copy and paste folders(one at a time) in this explorer or” choose file to open” window… (Select view all files and not just .txt ones from the dropdown list)….I just copied my user data folder from my C drive to D and I’m about to reformat C. Oh and Btw, when the files are moving you get no notification window, the screen just lags about – watch and wait for your hdd light to go out. To check theyve transfered accross i viewed the folder details and checked the sizes of the files.

      My problem appeared this morning when I turned my laptop on. I am using a legit copy of vista home premium. My Laptop is less than a month old. The last thing I did on it was listen to music and talk on MSN Messenger. None of the fixes helped my problem.

      Kindest Regards & Good Luck… I hope I never return to this thread again with this problem… I will confirm if the file transfer in notepads open file window worked and is safe to do…

    184. Nicanor says:

      Aug 20, 2009


      I´m getting a SKOD with Windows 7. Shift Key doesn´t work in Win 7. Does anyone knows how to get sticky keys in W7??? thanks. Very scared here.

    185. Lalonde says:

      Aug 24, 2009


      My computer just came down with a rather wretched case of the KSoD. Currently having no luck with anything. The solution suggested way up at the top of the page does not work for me; I am finding “NT AUTHORITY\NetworkService” IS the old value. I also have sticky keys disabled, so no luck on that front. Beyond that, my logs file appears to be… empty? So that, I’m assuming, is not the problem. So… I’m feeling a little boned right now.

    186. PJ says:

      Aug 25, 2009


      Hi All

      Thanks for all of your help…unfortunately all the options here did not work for me. I have eventually been able to use the neo disc to reset back to factory settings…it was the last resort and still took forever to load once I selected the option…it’s starting now…fingers crossed this works.

      Thanks again

    187. […] Try this: REVISED: How to fix the Vista KSOD (blacK Screen Of Death) | LogBlog __________________ We are all members helping other members. Please return here where you may be […]

    188. NejikFans says:

      Sep 5, 2009


      Я думаю, что Вы не правы. Я уверен. Давайте обсудим это. Пишите мне в PM, пообщаемся.

    189. Gil Lederman says:

      Sep 6, 2009


      Off topic – need help with email settings
      How do I change Gmails SMTP settings?
      Dr Gil Lederman
      Gil Lederman
      Gil Lederman MD

    190. M.Bakir says:

      Sep 16, 2009


      here is a new solution for the Black screen of Death.
      Using the ultimate boot disk tools, used explorer to access the registery directory at C:|windows\system32\config\ found two registery files “software” and “software_previous” I renamed the “software” file into “software_corrupt” and the “software_previous” to “software”.
      Guess what! it worked.

      if it worked for you join my network 🙂

    191. KevinB says:

      Sep 16, 2009


      There appears to be various degrees of the Black Screen of Frustration. For those with the symptoms of a black screen with white mouse cursor PRIOR to the login window, then here is what solved the problem for me. After spending two days trying every trick posted on the Internet, to no avail, I called the Microsoft help line ready to pony up the $260 for support. Their answer, a CHKDSK /F, then restore a copy of the backup registry hives; all of which had previously been tried per all the suggestions above, and elsewhere. The Microsoft solution was to reload the OS then reload all the software – not an acceptable solution for me.

      Pete’s posting on April 26th gave me the insight I needed to solve the puzzle; and for that I offer Pete all the credit and my deepest and most sincere appreciation! It is a permissions problem. As he suggests, and everyone that has reached this point is very familiar with, boot to the Vista CD/DVD disk; choose the command prompt; go to the C:\Windows\System32\Config folder; then run regedit.

      At this point I varied my approach from Pete’s because I booted from the Vista DVD so I then loaded each of my five hives (as I learned to do from this article,) then selected “Permissions” from the right button click on each hive, and edited the user permissions. Unlike Pete, I added all the users and gave them all “full control.” I even went into the advanced tab and added inheritable user rights, because by this time I was at the end of the line and didn’t care; that and I figured if it worked I could always go back and clean it up. And it did work! I also noticed my security hive did not have any users in it; I suspect that was the root cause of my trouble. So now life is good again! I haven’t gone into the details of how to get the hives loaded because all the instructions you need is provided above. However, I will monitor this site for a while and if someone needs additional help I will provide more details. Good luck to everyone, and don’t give up! This doesn’t warrant an OS reload.

      Thanks again Pete!

    192. mark says:

      Sep 23, 2009


      Wow long thread. I had the same problem, did the steps, used winvista cd, repair – Control prompt … Solution 1 from this -page —
      What thsi did was backuped the current user profile setting, and made vista create new setting.
      My vista did take this in, and the black screen was gone. Vista Loaded normally, BUT now it loads like its a brand new computer. (all my files are there in C:/Users) but it fails to use my username setting.
      I tried using the old setting folder again, renamed it to Logs, and black screen again.

      Now the event folder has abt 86MG, and about 25 files, what to do next? pls help .. thanks

    193. Hynes says:

      Oct 6, 2009


      Hi everybody, after trying so many options which i must say should have solved the ever so famous KSOD, i discovered hitting the enter key(softly) at a reasonably speed for a number of times cos the the windows(in my case windows 7) to load. wasn’t sure if it sorted the problem but after a restart it works fine!. you could try that! hope it helps!

    194. Xtrem says:

      Oct 10, 2009


      well i managed to get into windows by pressing alt+ctrl+delete and restarting the explorer process after that i ran the msconfig process and disabled the Windows Management Instrumentation. after that my vista loaded up just fine. hope this helps someone.

    195. gem says:

      Oct 12, 2009


      Hi all,

      After having tried every conceivable solutions on these post, nothing works for me. I tried to restore from my multiple hard disk full backups from Acronis and even tried it on different hard disks. Nothing works@#$%^ It doesn’t make any sense, ultimately restoring from my backups never ever failed me. Then it hit me, besides the software-side another player could be causing the dilemma. And I was right, the hardware-side known as the video card. I searched forums and only tried a few solutions related to my probable video-card(NVIDIA GT250)-causing KSOD and still nothing works. I just got too frustrated to try anymore solutions and eventually I just reverted back to my old video card(NVIDIA GT7600). Guess what, it works!!! My system’s back to normal and no more KSOD…:)

      Hope this experience helps…

    196. Em says:

      Oct 14, 2009


      My computer started KSOD’ing around two weeks ago, after doing a windows update. Today, after getting the desktop running by opening c:\ via task manager, I ran windows update again and, gee! One of the many updates must have been designed to somehow magically fix my KSOD!

      Thanks, Microsoft. -_-;;

    197. YannisE says:

      Oct 15, 2009


      I experienced the KSOD about a week ago, after performing a CHKDSK on vista system disk. I spent the whole week trying to recover my system following solutions posted here and elsewhere, but nothing worked for me!!!

      So if you experience KSOD after CHKDSK don’t waste your time trying the solutions proposed here… Nothing works!

      What I learned is that the MFT file is corrupted and prevents windows to start. This file (Master File Table) holds the attributes of each file in the system. If corrupted, the system hungs because it has to authority to boot! This is crazy… The system has no authority on its own system!

      I cheated the system installing vista on a fresh drive and saving all system file attributes to a file (via “icacls” command). I then installed these attributes to my corrupted system disk (after booting with the recovery disk with command prompt) and BINGO the system started! Of course all files created after the initial vista installation (like application files) did not behave correctly, so finally I had to format the disk and make a clear installation from scratch.

      My advice to those having KSOD after CHKDSK is only to try to recover the MFT file. This is the only solution which might work. There are plenty of such utilities…


    198. Tony says:

      Oct 16, 2009


      Hi all from GREECE.. KSOD son of a bitch here..WIndows 7 ultimate x64 version.. I restored to the earliest point i could find with windows 7 repair CD I thankfully had created and it got back to normal.. hope this helps

    199. Ron says:

      Oct 20, 2009


      tried every fix on every site ive found, nothing works……recovery CD and upgrade DvD does absolutely nothing…..

    200. Brian says:

      Oct 30, 2009


      Done everything suggested, equipment runs fine with XP but after a clean install of Vista, random black screens, sometimes twice a day or can go 10 days without a hitch. I suppose Ubuntu may be the answer, unless some bod from MS comes up with an answer but I´m not holding my breath. I see that 7 has similar problems????

    201. Nita Holt says:

      Nov 7, 2009


      I experienced the KSOB about 2 months ago my Vista computer. I took my computer to a repair shop and one day later, KSOB again. I installed System Mechanics 9, ran everything, KSOB problem solved.

    202. cpm Dr. Les says:

      Nov 10, 2009


      the easiest way to fix this problem is to go to safe mode when you get to the sign in page restart and wala your problem is ova see ya.

    203. Bob says:

      Nov 22, 2009


      Will Reinstalling Vista fix this problem?

    204. Robbie says:

      Nov 29, 2009


      Ok im having a problem with this.I get to the point where i have to open SYSTEM but when i try this it tells me this file is in use and i cant get into it. Can someone help? Thanks.

    205. cbemerine says:

      Dec 2, 2009


      To all those wondering if reinstalling will make a difference…most likely not in the long term, only the short term.

      As soon as your system auto updates, the bloat will be back.

      Since mid way through Windows 2000, you could set Auto update off, however it would be ignored and the update would continue anyway.

      I switched to Linux when they refused to give me control over my desktop. Granted I still use Windows and occasionally OS X for work, however at home I am BSOD or rather KSOD free and happy for it.

      It was never a matter of IF, only a matter of WHEN? you know the answer now. Reset and the song remains the same.

      It is not a matter of IF, only a matter of WHEN, it (or something equally unproductive) happens to you again…

    206. ttwu says:

      Dec 2, 2009


      Andrew @ NY Says:

      May 18th, 2009 at 1:06 pm
      Worked for me…
      All operating modes gave me the KSOD. I had to:

      1)Go to recovery mode(press f8 at startup)
      2)Choose comand prompt from the list
      3)Type in c:
      4)Then type in Regedit
      5)Clicked “File>Import”
      6)Clicked to show “all files” at the bottom
      7)Surfed to C:\Windows\System32\Winevt\logs
      8)Deleted all event logs one bye one.

      Closed all windows, clicked on re start and was done. I am operating on a Dell Studio with Windows Vista Premium.

      Thanks Guys!

      *******Thank you! Thank you! Thank you! My system was suffering from KSOD and I tried several different things suggested on this site and nothing worked. Right as I was about to give up, I spotted your post and decided….why not? Well, thanks to you, my computer is working just fine now! Thank you again!


    207. […] for me. Option 3 This is very complex and should be done carefully. There is a suggested fix on this site which involves making registry changes. Be very careful in doing so. Option 4 You can try an […]

    208. Yan Herndon says:

      Dec 7, 2009


      here is a new solution for the Black screen of Death.
      Using the ultimate boot disk tools, used explorer to access the registery directory at C:|windows\system32\config\ found two registery files “software” and “software_previous” I renamed the “software” file into “software_corrupt” and the “software_previous” to “software”.
      Guess what! it worked.

      Worked for me. Nothing else did. PC seems to be in normal condition. software all seems to work. The _previous file was dated about 5 months ago…

    209. venom1stas says:

      Dec 15, 2009


      Ok guys I finally got mine fixed. Ive tried every solution on the net, nothing at all worked. After a bit of experimenting my pc suddenly logged on. Here is what I did.

      First id like to say my ksod was different because I have asus motherboard, so no way to boot in safe mode and no mouse pointer just flashing undercode at top left courner of black screen after boot.

      1. Put vista cd in cd drive. if you dont have one download it or get from friend, any vista cd will do doesnt have to be your own.

      2. When starts up tap f8 after boot screen. If you have asus mb like me youl end up with blue screen and select cd-rom

      3.Press any button when it asks and wait for cd to load. Can take 5 min on blue screen, another 5 min on OS screen.

      4. Chose language, repair

      5. Go to comman prompt, type
      ,then press enter
      then type
      bootrec /fixmbr
      wait few sec or min
      bootrec /fixboot
      wait a min

      type CHKDSK
      a list of command will display, use the top one (type chkdsk /*top command*)
      after the check type exit

      5. Back on the recovery menu chose Windows Memory Diagnostic Tool.
      Then go for the first option and wait for restart.

      Upon restart blue screen shouldappear and start fixing. It will take around 10-20min.

      Logon screen appears, your wallpaper is black because vista isnt activated, but you’l do that later.

      So this is what I did, and was happybefore I restarted PC and it went KSOD again…So then I just repeated steps… took me another half hour but I could log on again.

      Now I had to fix the root of the problem, and I could since I could log on now. So when you are logged on, to prevent further KSOD do this:

      1.Go to administrative tools (control panel,click classic view) , then to SERVICES

      2.You will see a huge list of all the services. Find WINDOWS EVENT LOG and set it to Disable.

      Reboot PC and rejoice!

      Hope this forks for yall.

    210. venom1stas says:

      Dec 17, 2009


      Just a quick follow up:
      I ksod again after writing the above. Had to repeat steps again.
      Then tried system restore from desktop, restored to just few days before ksod and now vista works properly

    211. jack says:

      Dec 23, 2009


      hey i fixed my computer by just switching the value in the current value to the control set i wasnt using and it seemed to work for me!:)

    212. Freaking Fabulous says:

      Dec 29, 2009


      OMG thank you soooo much. I knew it was the damned eventlog, just couldn’t figure out what to do about it!! the trick with opening notepad.exe worked for me to access and rename the log file and create a new one… Saved my arse!!

      Bless all of ya!!

    213. linksjuy says:

      Jan 15, 2010


      Your procedure is simply brilliant, thanks a lot kmwoely

    214. […] Possible KSOD (blacK Screen Of Death) Solution for Windows Vista Marc Gregoire’s Blog REVISED: How to fix the Vista KSOD (blacK Screen Of Death) | LogBlog. Voi ati patit asa ceva? stiti o alta solutie? acuma ma gandesc sa-l formatez, dar nu as vrea ca […]

    215. ANN says:

      Feb 6, 2010


      Didn’t read thru the entire blog.
      Had the KSOD.
      Found a BLOG that implicated three FILES.
      Copied the 3 files from a normally working system.
      Found a program on the web that allowed me to get into the VISTA RESTORATION.
      Went to a DOS PROMPT & copied the old files to a new name.
      Then copied the files from the working system into the broken system.
      Two of the three files had different file sizes.
      One of the three files was OK…performed a FC & was ok.
      Actually, I had tried the first file by itself… some things came back but was
      still NG.
      After copying the last two files…LOST KSOD.
      System started to behave.
      In my case, I thought file corruption was a good candidate for the problem because the computer (a laptop) had a dead battery & the
      power supply had a defective plug which kept failing.

    216. MBP says:

      Jun 4, 2011


      Well I tried the various fixes in this thread and none of them worked for me. However Brad’s solution to pull up the command prompt was brilliant because none of the other methods of getting a command prompt were working. From the command prompt I ran sfc /scannow and got it working.

    217. Micke says:

      Jul 8, 2011


      The solution which worked for me (i have tried all others) is to set the permission to Full Access for the User group Everyone. If you can not access the system hard driver (or partition), then you can download the Portable Windows 7 – USB edition and start your PC from it and then access your hard drive and change the permission settings.

    218. TTS says:

      Aug 3, 2011


      Hi all, indeed lots of different fixes, which in the case I was dealing with non worked. I found a very simple fix.

      Use Ultimate Boot CD, Windows Vista CD (Use the load hive option under regedit so you can browse files. GO to the System32 folder, Open Config, You will see each registry file here (Not the folders) You will also see a duplicate named with _Previous

      Here is the deal.. other than the files labeled as _Previous & the Sam, rename all files with the ending _
      Then copy each of the files named _Previous (except SAM) and paste. They will have the xxxxx file name and the word copy.. remove all from the _Previous…. so you will have the following

      Components, default, security, software, system

      Once done you have now reverted to the previous Registry sets. This worked like a champ.

      If you know the hard ware that was installed (If it was hardware related crash search for the drivers and software and remove)

    219. Ghc says:

      Sep 14, 2011


      My Ksod is different than described here. My screen went black while playing a game. I turned off the computer with the power button. When I try to turn it back on, I get no beeps, no text, no mouse pointer. It just sounds like the fan is running and that’s it. It doesn’t respond to anything on the keyboard. Is my motherboard fried or something like that?

    220. Ghc says:

      Sep 16, 2011


      Never mind, it was my graphics card that died.

    221. Consulter says:

      Oct 13, 2011


      Some of the solutions work some of the time but I believe that moving the drive to another computer as a slave, changing ownership to that computer’s login and then giving the user “Everyone” full access will fix this error in all cases where everything else has failed. I tried every other solution listed here with no success and in 15 minutes I was up and running with my Vista install intact by giving the user Everyone full permissions then moving the drive back to my laptop and booting up.

      As an aside, I did have a bunch of malware and viruses on the drive when I scanned it on the computer I had it slaved to. I would suspect something changed permissions and caused this to occur when a normal Vista update tried to install.

      Back in business!

    222. Billy says:

      Oct 13, 2011


      Mounting the system drive in another windows machine, I took ownership of and reset full control permissions on all files.

      Since I don’t have the SAM of the problematic machine, I used the “Everyone” object to assign ownership and set full control permissions.

      This isn’t an ideal situation since it breaks a few layers of security, but it got me back into the box.

    223. grumpy61 says:

      Nov 6, 2011


      CANNOT BOOT!!! Does anybody understand the words? My Toshiba laptop got the KSOD. I’ve been working on this and my Compaq Presario for about 3 weeks. The laptop is running Vista And the Desktop is running XP. I got the Desktop to boot from the Ultimate BOOT CD. It is now using Google Chromium. Chromium is unable to install any downloaded programs, is unable to burn any CD’s or DVD’s. Plus, i get a whole shitload of Certificate is revoked errors. I am now waiting for a new HDD. This will be it’s 3rd HDD in 5 years. The wife is not happy.
      The Laptop will not even boot the Ultimate Boot CD. It will not boot any CD including the Recovery Discs. During bootup all i see is a blip of Windows in the lower half of the screen. I replaced the HDD in the laptop with the one from my External HDD. It made no difference. There is no blinking cursor, just a BLACK screen. One forum suggested the memory had overheated and to clean the gold contacts, It didn’t work. I cannot afford to take it to a shop as i am on a fixed income. Hope this is in the right place and I hope sombody can help me fix this damn thing. In 3 wks i have tried every fix i can find, and they always start out with BOOT???

    224. Kiwi tech says:

      Dec 17, 2011


      Was sorting out an iTunes install for a friend when a reboot resulted in the KSOD. Read many forums but this was the most help. Laptop was running Vista Home on an older Acer machine. Tried most fixes here but the one that worked for me was the one above to change Software and Software_previous files around using Regedit via Command prompt. Thanks so much for posting that because this was driving me NUTS!

    225. VickiA says:

      Feb 23, 2012


      Just wanted to thank Mesh and the others who posted various methods for getting their VISTA program to boot properly! I’m right on the edge of knowing just enough to get myself out of trouble – and found the instructions easy to follow – and the better news is – IT WORKED! I couldn’t do many of the suggested tips – like ‘safe mode’ – or command prompt – and one early attempt when I was able to boot up – it didn’t last long and powered off before I could finish the first ‘tip’.

      It looks like ‘my’ pc issue was the event logs….I kept all my printouts and downloaded VISTA recovery disk that I gleened from this discussion – and will be ‘armed’ should this occur again.

      It also prompted me to get my brand new Seagate backupdrive out of the packaging and DO A PROPER backup on my ‘stuff’.

      Many many thanks to you all – I thought this pc was ‘toast’!!!

    226. Hondez says:

      Apr 13, 2012


      Hi Guys,

      My KSOD seems to be different from the ones above.
      Ive got Vista Home Premium on my Dell desktop but through my stupidity i turned off my pc after i thought that windows update had finished but it had not.

      When i rebooted all i see after the Dell screen is a black screen with a flashing _ at the top left hand corner of the screen.

      I can ctrl alt del to restart but it returns to the flashing _ screen again. I cannot press shift 5 times or get to the command prompt screen either. I can get to the bios screen and change the boot sequence to boot from the dvd rom first to try and install off the vista cd but it returns to the flashing _ screen after i exit or rebooting. I can get into the windows recovery screen where i am asked if i want to repair windows ( recommended ) or start windows normally, but after selecting either of those the system hangs with a totally blank black screen. I left it running over night on one occasion thinking that it may take a few hours to repair windows but it did nothing at all.

      I cannot get it to boot into safe mode by pressing F8 or get a response from pressing F9 as someone else has mentioned above. The only keys that i get a response from are F2, F12,CTRL=+ALT+DEL to restart.
      I cannot get a response from ctrl+shift+esc either.
      I cannot get into task manager to bring up the command prompt screen either.

      I cannot get the system to boot from a usb device either. I have removed the two hdd’s that are controlled by raid 0 but that did not work either. I tried to run the system using the basic graphics instead of my nvidia graphics card but that did nothing either.

      It seems that it will loop into trying to reboot but stops after the initial dell screen as if it cannot find the hdd’s to load windows. I would install vista again off the original vista disc if i could get the system to recognise the dvd rom drive or boot from it but i can’t.

      I have tried various configurations and processes to get this fixed but nothing is working.

      I cannot believe that all of this is because i turned off the pc before windows update had finished!!!

      If anyone has any ideas please add them below because i will be checking here regularly for anything new to try.



    227. Richard says:

      May 14, 2012


      I am a 20+ year PC support guy, and this was one of the most difficult and frustrating issues I’ve had in a while.

      My client had an Acer 4720z with Vista Home Premium that repeatedly crashed during boot due to a defective power jack and a dead battery. At some point, this crashing resulted in the KSOD (black screen with movable cursor, caps lock toggled status light normally, no response to or hitting the shift key to invoke the alternative input dialog). The machine was clearly Almost booting.

      I tried EVERYTHING I could find on the Web, including most of the tips above, and in my case the only thing that allowed the machine to boot was to take ownership of all the files on the disk, then assign Full Access permissions to Everyone. This is documented more completely in one or more of the posts above.

      This is of course not a real solution. because it leaves the machine in a vulnerable state, but it’s a great work-around for the original problem. I’m now in search of a method for restoring the default permissions for all the system folders so that they can’t be messed with more than was intended.

      There is a command-line method to do this for XP and earlier, but so far I haven’t found an approved solution for Vista. If anybody has a way to do this, ideally automatically, or even semi-manually, I’d certainly appreciate hearing about it.


      • Richard says:

        May 14, 2012


        Here’s the original statement from MS on the old command-line solution and why it doesn’t apply to Vista, but there’s a Fix-It that does! (see below):

        “Beginning with Windows Vista, the method to apply the security during operating system setup changed. Specifically, security settings consisted of settings defined in deftbase.inf augmented by settings applied by the operating installation process and server role installation. Because there is no supported process to replay the permissions made by the operating system setup, the use of the “secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose” command line is no longer capable of resetting all security defaults and may even result in the operating system becoming unstable.

        For Microsoft Windows 2000, Windows XP or Windows Server 2003 computers, the “secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose” command is still supported in the very few scenarios where security settings need to be restored using the secsetup.inf template.”

        But there is now a Fix-It!:

    228. Boon Tee says:

      Jul 29, 2012


      I just came across this problem on a SBS 2011 Std server. This was caused by the installation of the NTBACKUP Restore Utility, which was not uninstalled after it was used.

      The simple fix we did is documented on my blog –

    What do you think?

    Name required


    XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>