Managing the System Registry Hive on Windows Server 2003 and Windows Server 2008 Integrity Systems

Technical Review
Introduction
The Windows Server 2003 and Windows Server 2008 operating systems have a system registry
hive size limitation of 32 MB (for all Service Packs). For most customer configurations, it is
unlikely this limit will ever be reached. But in certain circumstances, particularly for customers
with large configurations or numbers of SAN disks using multipath MPIO technology, the 32
MB limit is reachable, and can cause the system to fail to boot when restarted.
HP and Microsoft have worked together to create methods of recovery, proactive notification,
and design avoidance should the System hive approach its 32 MB limit. By using proactive
notification and the other methods described in this white paper, reboot failures of this type can
be avoided.
Understanding System Hive Fundamentals and Limits
The System hive is a critical registry component. It is referenced by the Registry Editor application
(RegEdit.exe, or RegEdit) as “SYSTEM”. Below the System hive, structurally, are a number
of ControlSets. The origin of these ControlSets goes back to the Windows NT operating system.
A ControlSet encapsulates all of the system's hardware and software information, such as device
driver and SAN volume details, in a tree structure. Because this data is critical to system operation,
anytime the System hive is changed by adding a new hardware component or software package,
a new ControlSet is created.
Microsoft designed the system to maintain more than one ControlSet in order to achieve system
resilience. Typically there are two ControlSets, such as ControlSet001 and ControlSet002. The
system rotates between these two ControlSets every time a change is made. This functionality
allows an Administrator to revert back to the “Last Known Good Configuration”
(LastKnownGood, or LKG) by pressing the F8 key should the system fail to boot. Figure 1 shows
a typical System hive ControlSet, as displayed by RegEdit.
Figure 1 System Hive ControlSet structure
Note that Figure 1 shows ControlSet001 and ControlSet003. These numbers do not have to be
contiguous. There can even be more than two ControlSets in extreme circumstances, such as a
Technical Review 7