cannot merge reg keys, "some are open by the system or other processes&


Recommended Posts

Hello!

I am having trouble merging some keys into my registry in Windows 7 Professional, 64bit. I am given the error,

  Quote
"Cannot import [my registry key]: Not all data was successfully written to the registry. Some keys are open by the system or other processes."

Background: The reason I need these keys is long and complicated, but it basically boils down to my Base Filtering Engine service (BFE) is corrupt. It won't start, and when I try and get it to start I am given an error of "An object with this GUID or LUID already exists". Because BFE wont start, many other important services (such as windows firewall and VPN/IP related ones) can't start either as they are dependant on BFE.

I am in the process of trying multiple avenues to fix this problem, as reformatting is NOT an option.

I found this post via google, in which the poster was kind enough to provide some valid registry keys for BFE and other core security processes. HOWEVER, when I try and merge any of them into my registry, I get the aforementioned error. I am the only user on the PC and the profile is an administrator profile.

I did attempt to do it in safe mode, as well, to no avail. Exact same error is given in safemode.

If ANYONE can help me out on either of these issues (the registry issue, or fixing BFE in general), I would be so, so so so so appreciative. I have been fighting with this issue for weeks, scoured many forum threads, and still can't seem to get it all working.

Thank you :)

I don't normally do this as I know it's against forum etiquette, but I've perused through these boards and I know they're full of extremely knowledgeable people -- probably more knowledgeable than any other online community. Don't leave me hanging, guys!

My first quick and dirty suggestion would be to start killing off programs and services until the reg key is editable.

Another idea would be to get Process Monitor by SysInternals and attempt to see what process exactly has that registry key locked.

Those are just my quick recommendations.

Another suggestion would be to open the reg files and attempt to do everything manually using regedit.

Do you know which reg entry specifically is locked?

  On 16/02/2012 at 17:27, DigitalSnow said:

My first quick and dirty suggestion would be to start killing off programs and services until the reg key is editable.

Another idea would be to get Process Monitor by SysInternals and attempt to see what process exactly has that registry key locked.

Those are just my quick recommendations.

Another suggestion would be to open the reg files and attempt to do everything manually using regedit.

Do you know which reg entry specifically is locked?

Hi DigitalSnow, thanks so much for the reply!

I have not tried killing off the processes, however I did try adding the reg keys while booted in safe mode (and came across the same issues as in normal mode). wouldn't this essentially be the same thing, as safe mode runs only the essential processes, or would killing them off manually in normal mode work better?

I will check out Process Monitor, thanks for the link!! :)

Yes, there are several which are locked. Surprisingly, the registry file for BFE merges perfectly fine, however the reg files for mpssvc and sdrsvc give me the "key open by system or other processes" error.

Thanks again for the response. Greatly appreciated.

EDIT: Just to make it a tad clearer, here are the contents of the registry files that I am trying to merge into my registry.

BFE.reg (merges properly):


Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE]
"DisplayName"="@%SystemRoot%\\system32\\bfe.dll,-1001"
"Group"="NetworkProvider"
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
00,65,00,4e,00,6f,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,00,00
"Description"="@%SystemRoot%\\system32\\bfe.dll,-1002"
"ObjectName"="NT AUTHORITY\\LocalService"
"ErrorControl"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020
"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"ServiceSidType"=dword:00000003
"RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
62,00,66,00,65,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="BfeServiceMain"
[/CODE]

[b]MPSSVC.reg (does NOT merge):[/b]

[CODE]
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc]
"DisplayName"="@%SystemRoot%\\system32\\FirewallAPI.dll,-23090"
"Group"="NetworkProvider"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
00,65,00,4e,00,6f,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,00,00
"Description"="@%SystemRoot%\\system32\\FirewallAPI.dll,-23091"
"ObjectName"="NT Authority\\LocalService"
"ErrorControl"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020
"DependOnService"=hex(7):6d,00,70,00,73,00,64,00,72,00,76,00,00,00,62,00,66,00,\
65,00,00,00,00,00
"ServiceSidType"=dword:00000003
"RequiredPrivileges"=hex(7):53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,50,\
00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,\
72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,75,\
00,64,00,69,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,\
00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\
53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,\
00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,\
65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,\
6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
6d,00,70,00,73,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap]
"Collection"=hex:87,00,01,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\Teredo]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Security]
"Security"=hex:01,00,14,80,b4,00,00,00,c0,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,84,00,05,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,28,00,15,00,\
00,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,\
0e,a7,8b,eb,ca,7b,42,13,56,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,\
00,00,00,05,12,00,00,00
[/CODE]

[b]SDRSVC.reg (does NOT merge):[/b]

[CODE]
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SDRSVC]
"DisplayName"="@%SystemRoot%\\system32\\sdrsvc.dll,-107"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,53,00,44,00,52,00,53,00,56,00,43,00,00,00
"Start"=dword:00000003
"Type"=dword:00000010
"Description"="@%SystemRoot%\\system32\\sdrsvc.dll,-102"
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"ObjectName"="localSystem"
"ServiceSidType"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SDRSVC\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
53,00,44,00,52,00,53,00,56,00,43,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SDRSVC\Enum]
"0"="Root\\LEGACY_SDRSVC\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
[/CODE]

  On 16/02/2012 at 17:44, Pr3fix said:

Hi DigitalSnow, thanks so much for the reply!

I have not tried killing off the processes, however I did try adding the reg keys while booted in safe mode (and came across the same issues as in normal mode). wouldn't this essentially be the same thing, as safe mode runs only the essential processes, or would killing them off manually in normal mode work better?

I will check out Process Monitor, thanks for the link!! :)

Yes, there are several which are locked. Surprisingly, the registry file for BFE merges perfectly fine, however the reg files for mpssvc and sdrsvc give me the "key open by system or other processes" error.

Thanks again for the response. Greatly appreciated.

Safe mode while is great, still runs many processes that are not necessary for your desired fix. For example only: it could be the explorer process that is using the registry key needed; explorer can be killed while you apply the fix.

I am not sure how comfortable you are just killing off processes, but it is sometimes necessary. To restart say explorer or a process once it has been killed, in Windows Task Manager, click File > New Task (Run) and type in the name of the process that you want started (explorer.exe).

Disclaimer: There is always a risk of data corruption when killing a running process.

I would really recommend trying to enter in the values manually. (Yes it is tedious)

1. Open/run the RegEdit application

2. Open the .reg files in a text editor

3. Navigate to the target key in RegEdit

4. Double click on the key to edit it

5. Enter the value listed in the .reg file.

6. Repeat for each key.

Also on a side note, have you tried the bat file (Repair.bat) that Farstrider suggested and the Farbar Service Scanner from the other thread?

Pr3fix,

I had the same problem, and I've just fixed it by changing the permissions of the registry key I wanted to change. I gave Administrators full control of the key, and I was then able to merge the keys from the registry file.

mMshj.png

I hope this will work for you. I also tried killing the relevant processes and services, and also trying to merge the key in safe mode, and they didn't work.

This topic is now closed to further replies.
  • Posts

    • Hahaha! I've been arguing with my dad for 10 years (he's pro-Tesla, I'm impartial as I don't trust a lot of the people and their tech in these robotaxis) about this whole charade. His continued argument is the cost factor (economies of scale principle) and the associated technology (different dependencies of which reduced production cost is a potential outcome thus feeding into the reduced cost argument). And my rebuttal is the broad-market trust factor -- it's often not the most innovative or first-mover that wins (Uber and Tesla have been arguing/investing in autonomous vehicles forever) but rather the option that builds the most trust amongst the commonwealth. VW and Toyota are not the first or best or cheapest cars on the road, but they've built a long of continued trust to the scales of being the largest automakers by volume worldwide. Supercar makers have the highest profit margins, Tesla has the highest stock price, but VW and Toyota have the sales volumes. As it stands, the writing is on the wall... No matter what advantages Tesla had in their ambitions, they have an even-longer road to repair public trust than any other robotaxi provider (foreign or domestic). If the trend continues, everyone will realise that their market valuation is based on their non-automotive efforts (including not robotaxis or consumer humanoids).
    • Or just use Linux and live free. For the anti-Linux brigadiers reading this, this is the part where you go: Nooo! I love being digitally abused by Microsoft 😡😡 /s
    • Windows 10 KB5061087 fixes incorrect version reporting, Start menu bugs, and more by Taras Buria Following the news about a free year of Windows 10 security updates (there are some strings attached), Microsoft is releasing a new non-security update for its decade-old operating system. Today, Microsoft shipped KB5061087 (build number 10945.6036) with a pretty long list of fixes. In today's update, Windows 10 users get fixes for the Settings app incorrectly reporting Windows version, issues with Multi-Function printers with dual protocol interface, disappearing jump list in the Start menu, and other bugs. Here is the changelog: [Mobile Operator Profiles] Updated: Country and Operator Settings Asset (COSA) profiles. [App Platforms and Frameworks] Fixed: An issue affecting Component Object Model (COM) functionality on Windows platforms. Remote COM activations were failing with error 0x8001011. Updated: The version of the curl tool included in Windows is updated to v8.13.0. [Authentication Platform] Fixed: An issue affecting the device registration in Entra ID Windows Account Manager (WAM) plugin. [Input and Composition] Fixed: An issue affecting the complete removal of unused language packs and Feature on Demand (FOD) packages. This issue led to unnecessary storage use and increased Windows update installation time. [Print and Peripherals] Fixed: An issue affecting USB-connected Multi-Function printers with dual protocol interfaces. Scanning failed and prevented using the built-in scanning functionality in the operating system. [Start Menu] Fixed: An issue causing jump lists to disappear from the Start Menu. Fixed: An issue where the Start Menu was not starting after installing an update. [WinSaS] Fixed: Settings > System > About incorrectly shows version 2009 instead of version 22H2. Change of behavior: To maintain DMA compliance in the European Economic Area (EEA), when a new default browser is set, it is automatically pinned to the Taskbar and Start menu. Change of behavior: Associates HTTP and .pdf file types when setting default browser. [Servicing] Fixed: An issue where Kiosk devices using the ForceAutoLogon configuration and Shift Override might stop responding with a blue screen after being locked and unlocked by support administrators. [File Server] Fixed: An issue where the system may stop responding when acknowledging an Oplock break request on resources located on SMB shares. Known issues include a single bug with Noto fonts appearing blurry in Chromium-based browsers such as Edge or Chrome. For now, the only fix is to set your screen scaling to 125% or higher. As usual, feel free to skip KB5061087 if you do not need any of those fixes. Non-security updates are optional, and they eventually arrive with monthly Patch Tuesday updates. You can get KB5061087 from Windows Update or the Microsoft Update Catalog using this link.
    • Governments should be encouraging users to move to Linux instead of creating unnecessary eWaste with great and still-capable machines. Of course, that's presuming they actually give a damn after all their talks of "global warming"/"climate change"/"carbon capture" and those weren't all just PR talks.
    • Except now you need to use a MSA account to do that... one step closer to Windows 11
  • Recent Achievements

    • Week One Done
      DrRonSr earned a badge
      Week One Done
    • Week One Done
      Sharon dixon earned a badge
      Week One Done
    • Dedicated
      Parallax Abstraction earned a badge
      Dedicated
    • First Post
      956400 earned a badge
      First Post
    • Week One Done
      davidfegan earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      605
    2. 2
      ATLien_0
      225
    3. 3
      Michael Scrip
      168
    4. 4
      +FloatingFatMan
      154
    5. 5
      Xenon
      137
  • Tell a friend

    Love Neowin? Tell a friend!