Search code examples
azurewindows-server-2016

Azure VM - registry change prevents booting machine

We applied some Azure security center recommendations to our registry. A incorrect change in HKLM\SOFTWARE caused two machines to no longer boot (CRITICAL_PROCESS_DIED).

We took a snapshot of the osdisk and attached that to a different VM and cleaned that up. Confirmed after restoring C:\windows\system32\config\regback\software to C:\windows\system32\config\software fixes the issue.

The disks are encrypted however so Azure won't allow us to perform an OSdisk swap between the current corrupted osdisk and the fixed one.

enter image description here

Since the VM isn't bootable, we can't disable the encryption either from Azure portal.

enter image description here

  • Is there a way we can boot an Azure VM from it last succesful state without having a Azure backup available? or
  • Is there a way to perform an OSdisk swap with keeping the osdisk encrypted? or
  • Is there a way we can force the Azure VM to use the regback file?
Solution

  • I'm not sure about your actual question, but one thing you can do for sure is just create a new vm from the working disk. You can create a VM from existing encrypted disk if you give it keys to decrypt it.