# Windows Automatic Repair Loop Recovery

## Root cause

After `chntpw` blanks passwords in the SAM hive, Windows 10/11 detects the offline hive modification and triggers automatic repair on every boot. The system records "boot failure" in `bootstat.dat` and sets the registry flags `LastBootSucceeded=0`.

## Fix workflow (from SystemRescue)

### Prerequisites
```bash
# Mount Windows partition
mount /dev/sdX3 /mnt

# Mount EFI partition (for BCD store access)
mkdir -p /mnt2
mount /dev/sdX1 /mnt2
```

### 1. Remove boot failure markers
```bash
rm -f /mnt/Boot/bootstat.dat
rm -rf /mnt/Windows/System32/LogFiles/Srt/
```

### 2. Fix registry boot flags using reged

**IMPORTANT**: `reged -C` (auto-commit) is essential — without `-C`, it asks "Commit changes? (y/n)" and does NOT save without interactive input.

Create a `.reg` file with the corrected flags:

```bash
cat > /tmp/fixboot.reg << 'EOF'
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager]
"LastBootSucceeded"=dword:00000001
"LastBootShutdown"=dword:00000001
"DirtyShutdownCount"=dword:00000000
EOF
```

Import with auto-commit:
```bash
# Prefix MUST match the .reg key root — single backslash
reged -C -I /mnt/Windows/System32/config/SYSTEM \
  "HKEY_LOCAL_MACHINE\SYSTEM" /tmp/fixboot.reg
```
Exit code 2 means success (the 2 is the "hives changed" count, not a failure).

### 3. Add BootStatusPolicy to disable auto repair entirely

If step 2 alone doesn't fix the loop, also add `BootStatusPolicy = IgnoreAllFailures`:

```bash
cat > /tmp/disable_repair.reg << 'EOF'
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\BootStatusPolicy]
"Policy"=dword:00000003
EOF

reged -C -I /mnt/Windows/System32/config/SYSTEM \
  "HKEY_LOCAL_MACHINE\SYSTEM" /tmp/disable_repair.reg
```
- `Policy=3` = `IgnoreAllFailures` — tells Windows to skip automatic repair entirely
- `Policy=0` = `DisplayAllFailures` (default — shows recovery UI)

### 4. Edit BCD store to disable RecoveryEnabled

Windows checks the BCD store for recovery flags even after registry is fixed. Element `25000080` = `RecoveryEnabled` must be set to 0.

```bash
# Add RecoveryEnabled=0 to all Windows Boot Loader entries
cat > /tmp/fix_bcd.reg << 'EOF'
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\BCD\Objects\{84ffb535-4fbd-11ea-b00d-fc9872299877}\Elements\25000080]
"Element"=hex:00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\BCD\Objects\{84ffb536-4fbd-11ea-b00d-fc9872299877}\Elements\25000080]
"Element"=hex:00,00,00,00,00,00,00,00
EOF

reged -C -I /mnt2/EFI/Microsoft/Boot/BCD \
  "HKEY_LOCAL_MACHINE\BCD" /tmp/fix_bcd.reg

# Also clear the Recovery BCD
if [ -f /mnt2/EFI/Microsoft/Recovery/BCD ]; then
    reged -C -I /mnt2/EFI/Microsoft/Recovery/BCD \
      "HKEY_LOCAL_MACHINE\BCD" /tmp/fix_bcd.reg
fi
```

**Finding the right BCD GUIDs**: BCD object Types:
- `10100002` = Boot Manager (typically `{9dea862c-5cdd-4e70-acc1-f32b344d4795}`)
- `10200003` = Windows Boot Loader — the OS entry, add RecoveryEnabled to these
- `10200005` = Windows Resume (hibernation)
- `20100000` = Recovery Sequence

Export BCD objects to see them: `reged -x /mnt2/EFI/Microsoft/Boot/BCD "HKEY_LOCAL_MACHINE\BCD" "\Objects" /tmp/all.txt`

### 5. Verify
```bash
# Check registry values
reged -x /mnt/Windows/System32/config/SYSTEM \
  "HKEY_LOCAL_MACHINE\SYSTEM" \
  "ControlSet001\Control\Session Manager" /tmp/verify.reg
grep "LastBoot\|DirtyShutdown" /tmp/verify.reg
```

## Alternative: Safe Mode bypass

If the repair loop persists after registry fix:
1. At Automatic Repair screen → Advanced options
2. Troubleshoot → Advanced options → Startup Settings → Restart
3. Press F4 for Safe Mode
4. Log in with blank password
5. Reboot normally — loop should be broken

## SYSTEM registry hive reference

The SYSTEM hive at `/mnt/Windows/System32/config/SYSTEM` contains:
- `ControlSet001\Control\Session Manager` → boot flags (LastBootSucceeded, LastBootShutdown, DirtyShutdownCount)
- `ControlSet001\Control\Session Manager\BootExecute` → autochk / boot repair commands
- `Select\Current` → DWORD pointing to which ControlSet is active (usually 1 = ControlSet001)

## Tools available in SystemRescue for registry editing

| Tool | Path | Purpose |
|------|------|---------|
| `chntpw` | `/usr/bin/chntpw` | SAM user password editing + limited registry navigation |
| `reged` | `/usr/bin/reged` | Full registry hive import/export with .reg files |

`reged` flags:
- `-I <hive> <prefix> <regfile>` — Import .reg file
- `-x <hive> <prefix> <key> <outfile>` — Export key
- `-C` — Auto-commit without interactive prompt
- `-L` — Log changed filenames + auto-save