Removing SPs and hotfixes that leave Win2k unbootable

Windows 2000, Windows XP and Windows 2003 Service Packs and hotfixes are usually designed to fix problems, not aggravate them. Unfortunately, some hotfix or Service Pack installations have been known to damage a system to the point where it will not boot correctly. There are a plethora of reasons for this -- for instance, a mismatch between patched and existing components or damage to the Registry for some reason other than the application of the Service Pack of hotfix.

If a system has been left unbootable due to a Service Pack or hotfix, the first course of action would be to boot to Safe Mode and remove the SP or hotfix. But sometimes even Safe Mode is not accessible, and even the "Boot from Last Known Good configuration" does not work. In cases like this, the best next step (short of a repair operation or a parallel install) is to use the Recovery Console to manually restore the files that were replaced by the Service Pack or hotfix.

Here is the procedure:

  1. Boot the Windows CD-ROM.
  2. At the welcome screen, select R to start the Recovery Console. (In Windows 2000, you can press F10 at the "Welcome" screen when booting from the CD to go to the Recovery Console.)
  3. Select the installation of Windows to access and type the administrator password.
  4. Enter the Windows directory (usually C:WINDOWS or C:WINNT).
  5. Enter

Requires Free Membership to View

  1. the $NtServicePackUninstall$ subdirectory if you are removing a Service Pack. If you are removing a hotfix, the directory name will be $NtUninstallKBXXXXXX$ or $NtUninstallQXXXXXX$, with XXXXXX being the number of the hotfix in question. Note that these are all hidden directories.
  2. Within the hotfix or Service Pack Uninstall directory is another subdirectory, spuninst (also hidden). This directory contains a batch file, spuninst.bat.
  3. Use the command batch spuninst.bat to run the batch file. This should manually replace the files changed by the service pack or hotfix with backups of the originals.
  4. Reboot the machine and select Safe Mode. (If Windows still does not boot at this point, the Registry itself may be damaged and must be manually recovered.)
  5. Remove the service pack from the Add/Remove Programs control panel. This makes the needed changes in the Registry to indicate to the machine that the patch in question is not installed.

Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter. Check out his Windows 2000 blog for his latest advice and musings on the world of Windows network administrators – please share your thoughts as well!

This was first published in January 2004

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.