08455 271771
01202 232240

How to fix the Vista black screen of death (KSOD)

Method 1 change the RPC security value

Apparently there is a problem related to the Remote Procedure Call service (RPC) running under LocalSystem account instead of NT Authority\NetworkService account.
  1. On the affected machine, boot using the Vista Media and Select “Next” and then in the bottom left you will see “Repair your Computer”; select Next and then Select Command Prompt.
  2. At the command prompt type regedit.exe and press enter
    1. Select HKEY_LOCAL_MACHINE
    2. On the File menu, select Load Hive.
    3. Browse to %WINDIR%\System32\Config Folder and select "SYSTEM"
    4. It will prompt to name the hive you are about to edit.Put "MySYSTEM"
  3. Go to HKEY_LOCAL_MACHINE\MySYSTEM\Select and find the "Current" number in the Right hand side. Normally the "Current"is set to 1 so you need to open HKEY_LOCAL_MACHINE\MySYSTEM\ControlSet001\Services\RpcSs if the "Current" is set to any other number you need to go to the corresponding folder ContorlSet002 , ContorlSet002 ... etc. Change the "ObjectName" from "LocalSystem" to "NT AUTHORITY\NetworkService"
  4. Unload the SYSTEM hive by selecting the key "MySYSTEM" and then select File -> Unload Hive.
  5. Reboot the computer

Method 2 renaming corrupted Logs folder

Take the HDD out and connect it to another computer using an external enclosure or a spare cable connected to the motherboard and Rename C:\Windows\System32\Winevt\Logs to Logs_Bad

Method 3 disable the Events Service

Try to start in safe mode with command prompt and start msconfig to disable the event service.
Wait for the HDD light to go off and try starting task manager or pressing few times the shift key (enable sticky keys) and bring up the explorer and msconfig to disable the event service. Or connect the hdd to another computer using an external enclosure or a spare cable to the mothebroard. Disable Event Log service by loading in HKEY_LOCAL_MACHINE the %WINDIR%\System32\Config\SYSTEM file and find the event log service in ControlSet00X/services and change the start value "Start"=dword:00000004 Which is the current control set can be found in select\current

Method 4 change folders security settings


Using external HDD enclosure to change all folders permissions and ownership to everyone group. Setting the security settings this way isn't very good from security point of view, but in some cases the only way to make your vista system boot up again.
Posted: July 7, 2011