I used AutoRuns to “disable” Acronis True Image 2019, now Windows 10 won’t boot
I have Acronis 2019 installed on a new computer that I was in the process of setting up. In connection with this I was having software timeouts during import of images that looked like a virus checker problem so I was interested in disabling True Image completely - all services, everything. I used the instructions at https://kb.acronis.com/content/60222, using the autoruns program to disable all Acronis entries. Now Windows 10 won’t boot. I have put a lot of time into configuring the new computer but I had not done a system backup or a USB emergency boot disk (though I have one from my previous laptop). How can I repair this system? Thank you.
The fltsrv service is what's stopping Windows from booting. Autoruns didn't disable the service properly. The start value was changed from 0 to 4. The 4 means to disable the service. The problem is that there are two UpperFilter registry keys that have fltsrv in them. These UpperFilters were left in place. This is what stops Windows from booting.
You will need to edit the registry of the system to get it bootable again. The easiest change will be to change the fltsrv start type from 4 back to 0. To do this you need to boot the computer using a WinPE based recovery media. Once booted, you need to run regedit.exe from the command prompt. You will need to know the drive letter WinPE assigned to the Windows OS partition. Most of the time it will be C: drive. the easiest way to force it to be the C: drive is to have only that one disk installed in the computer.
When you get regedit.exe running, follow these steps to make the change:
1. Highlight HKLM on the left.
2. Select File/Load Hive
3. Navigate to C:\Windows\System32\config and select the SYSTEM hive.
4. Name the hive Remote_SYSTEM.
5. Expand HKLM and expand Remote_SYSTEM.
6. Navigate to ControlSet 001\Services\fltsrv.
7. Highlight Start on the right.
8. Select Edit/Modify.
9. Change the data value box from 4 to 0 and click OK.
10. Highlight HKLM\Remote_SYSTEM on the left.
11. Select File/Unload hive to save the change.
Your Windows system should now be bootable.
Mustang wrote:The fltsrv service is what's stopping Windows from booting. Autoruns didn't disable the service properly. The start value was changed from 0 to 4. The 4 means to disable the service. The problem is that there are two UpperFilter registry keys that have fltsrv in them. These UpperFilters were left in place. This is what stops Windows from booting.
Paul, how did you figure that out?!?
- Was there some offline communication between you and the OP?
- Are the instructions in the KB60222 article incorrect? (If so, Acronis should correct them.)
- Is there a bug in Autoruns? Or is it just not the right tool to use?
- Something else?
Patrick,
I experimented with Autoruns. I followed the article and started disabling a few items at a time. Each time I rebooted to see if Windows could still boot. Eventually, I got down to just the services. I disables all but fltsrv and snapman. Windows was still able to boot. I had suspected the issue was related to UpperFilters, so I disabled snapman next. Windows was still able to boot. Then I disabled fltsrv. Windows could no longer boot. Then I booted into WinPE and looked at the Windows registry. That's when I learned that Autoruns had set the Start value of fltsrv to 4. I then looked at the UpperFilters entries at HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} and HKLM\SYSTEM\ControlSet001\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} and found that fltsrv was still listed in both keys. I removed filtsrv from both keys. Leaving the fltsrv Start value set at 4 to keep it disabled. Windows was now able to boot again.
The KB instruction are correct, but there should be a warning not to disable snapman or fltsrv without checking the above registry keys for UpperFilters entries and removing them before attempting to reboot.
Autoruns should be checking for the existance of UpperFilters when disabling a kernel level driver. Kernel level drivers have a Start value of 0. This means they start during the boot process before Windows has finished booting. Not all kernel level drivers with UpperFilters left behind will stop the boot process. It would be very complicated to remove the UpperFilters and then put them back when the service is later reactivated.
Patrick, thanks for asking the questions here!
Paul, thanks for the detailed explanation.
I am a great fan of the KISS principle and it seems to me that KB 60222 is both complicated and dangerous for all but the most experienced users who know their way around the registry for kernel entries.
Following KISS, just disabling the obvious Acronis Services via the Services.msc will do the bulk of what's needed, then disabling the remaining Processes via either msconfig or the Win 10 Settings > Start options would do the rest, without any need to dabble in the registry!
KB 63256: Acronis True Image 2020: Windows services and processes - as the guide.
Paul, great analysis.
In Autoruns, there are services and drivers. The services can easily be turned off using MMC, but not the drivers. I wonder if there is a safe way to disable drivers. Apparently Autoruns isn't it.
Mustang Thank you for your detailed but straightforward solutions.
I did exactly the same as @Patrick today by disabling all Acronis services and entries with Autoruns. As a confident tech I didn't make a registry backup before I did so and then a few more changes later I had to restart and then Windows didn't boot with an "INACCESSIBLE BOOT DEVICE" BSOD error.
Tried to restore to a restore point but this failed since my "C" drive didn't have enough space. Then I started googling and came across this thread. If it wasn't for @Patrick who asked the question and Mustang to answer it, I wouldn't have been able to solve my problem. My only other option was to try and understand what Autoruns did and try to reverse it, but this was difficult since I didn't even know what version of Acronis I disabled, I have a few Acronis products installed over the years.
Mustang wrote:The fltsrv service is what's stopping Windows from booting. Autoruns didn't disable the service properly. The start value was changed from 0 to 4. The 4 means to disable the service. The problem is that there are two UpperFilter registry keys that have fltsrv in them. These UpperFilters were left in place. This is what stops Windows from booting.
You will need to edit the registry of the system to get it bootable again. The easiest change will be to change the fltsrv start type from 4 back to 0. To do this you need to boot the computer using a WinPE based recovery media. Once booted, you need to run regedit.exe from the command prompt. You will need to know the drive letter WinPE assigned to the Windows OS partition. Most of the time it will be C: drive. the easiest way to force it to be the C: drive is to have only that one disk installed in the computer.
When you get regedit.exe running, follow these steps to make the change:
1. Highlight HKLM on the left.
2. Select File/Load Hive
3. Navigate to C:\Windows\System32\config and select the SYSTEM hive.
4. Name the hive Remote_SYSTEM.
5. Expand HKLM and expand Remote_SYSTEM.
6. Navigate to ControlSet 001\Services\fltsrv.
7. Highlight Start on the right.
8. Select Edit/Modify.
9. Change the data value box from 4 to 0 and click OK.
10. Highlight HKLM\Remote_SYSTEM on the left.
11. Select File/Unload hive to save the change.
Your Windows system should now be bootable.
Created a forum account just to thank you and let others know this worked for me, as well. I went through disabling entries in autoruns organizer for a bunch of stuff that I dont actively use anymore. I had previously prevented a bunch of applications from starting and added delays to many others. I noticed a lot of random drivers and services that I didn't need to load at startup, either so I went through and disabled a bunch of them and didn't think they'd prevent a system boot since they weren't system services or drivers.
I tried to do a system restore when I couldn't find AutoRunsDisabled entries in the registry and couldn't think what specifically would cause an INACCESSIBLE BOOT DEVICE but they all failed to replace a random iCloud Drive file (super important, obviously should block a system restore) until I luckily came across this thread.
I can confirm that I too overzealously started cleaning things up with Autoruns, only to end up with a non-booting computer.
Thanks so much for providing the fix! Loading the registry hive, changing Start to 0, unmounting, and rebooting worked like a charm!