Problem In Registry (Self-inflicted)

[Greg Wallace]

I am running Windows XP Professional SP 2. I was recently cleaning out some
things in the registry, which I have done many times before, and somehow
fouled things up in the following way.

The space allocation for the MFT has mushroomed to cover several
gigabytes. This has caused all of the data on my hard drive, including the
system files, to be pushed way down onto the disk. The result of this is
that anything I access when I first boot up (Outlook, IE, the "System"
Control Panel, etc., etc.), takes about 20 minutes to come up the first time.
Once it's accessed for the first time it is, of course, cached in memory (I
have 2 Gig of memory), so if I close it and re-open it, it's instantaneous.
Additionally, Norton takes forever to start up when I first boot up. It was
always slow, but with the data being pushed down like it is, it's reallllly
slow.
I started an email case with Microsoft paid support on Sunday. Monday, I
got a reply that told me to go to
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Filesystem and add a key
called NtfsMftZoneReservation and set the value to 1. I did that and it
didn't solve the problem. He also asked me to send him the contents of
SvcHost under that same key. The problem is, there is no SvcHost folder
under that key on my machine, only 4 entries, NtfsDisable8dot3NameCreation,
Win31Filesystem, Win95TruncatedExtensions, and the one he had me add. I
informed him in my email yesterday that that's all that was there. I didn't
hear back from him today, so I feel like he's struggling to figure this out.
Since I didn't hear back from him, I called in and talked to a couple of
Microsoft tech reps on the phone today, but they seemed absolutely clueless
about what I might need to do. I'm holding out hope that I'll hear something
back tomorrow from the rep I initially contacted via email, but I'm beginning
to get a sick feeling that he won't have any answers.
So, I'm turning to this forum, holding out hope that someone knows what
registry entry controls this MFT allocation size and that I can correct it
(shrink it back down to a reasonable size). Any help greatly appreciated.

--
Yours truly,
Greg Wallace

[NewScience]

See if MS wanted the information from this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost

"Greg Wallace" > wrote in message
...
>I am running Windows XP Professional SP 2. I was recently cleaning out
>some
> things in the registry, which I have done many times before, and somehow
> fouled things up in the following way.
>
> The space allocation for the MFT has mushroomed to cover several
> gigabytes. This has caused all of the data on my hard drive, including
> the
> system files, to be pushed way down onto the disk. The result of this is
> that anything I access when I first boot up (Outlook, IE, the "System"
> Control Panel, etc., etc.), takes about 20 minutes to come up the first
> time.
> Once it's accessed for the first time it is, of course, cached in memory
> (I
> have 2 Gig of memory), so if I close it and re-open it, it's
> instantaneous.
> Additionally, Norton takes forever to start up when I first boot up. It
> was
> always slow, but with the data being pushed down like it is, it's
> reallllly
> slow.
> I started an email case with Microsoft paid support on Sunday. Monday, I
> got a reply that told me to go to
> HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Filesystem and add a
> key
> called NtfsMftZoneReservation and set the value to 1. I did that and it
> didn't solve the problem. He also asked me to send him the contents of
> SvcHost under that same key. The problem is, there is no SvcHost folder
> under that key on my machine, only 4 entries,
> NtfsDisable8dot3NameCreation,
> Win31Filesystem, Win95TruncatedExtensions, and the one he had me add. I
> informed him in my email yesterday that that's all that was there. I
> didn't
> hear back from him today, so I feel like he's struggling to figure this
> out.
> Since I didn't hear back from him, I called in and talked to a couple of
> Microsoft tech reps on the phone today, but they seemed absolutely
> clueless
> about what I might need to do. I'm holding out hope that I'll hear
> something
> back tomorrow from the rep I initially contacted via email, but I'm
> beginning
> to get a sick feeling that he won't have any answers.
> So, I'm turning to this forum, holding out hope that someone knows what
> registry entry controls this MFT allocation size and that I can correct it
> (shrink it back down to a reasonable size). Any help greatly appreciated.
>
> --
> Yours truly,
> Greg Wallace

[Greg Wallace]

Exactly.
--
Greg Wallace


"NewScience" wrote:

> See if MS wanted the information from this key:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
>
> "Greg Wallace" > wrote in message
> ...
> >I am running Windows XP Professional SP 2. I was recently cleaning out
> >some
> > things in the registry, which I have done many times before, and somehow
> > fouled things up in the following way.
> >
> > The space allocation for the MFT has mushroomed to cover several
> > gigabytes. This has caused all of the data on my hard drive, including
> > the
> > system files, to be pushed way down onto the disk. The result of this is
> > that anything I access when I first boot up (Outlook, IE, the "System"
> > Control Panel, etc., etc.), takes about 20 minutes to come up the first
> > time.
> > Once it's accessed for the first time it is, of course, cached in memory
> > (I
> > have 2 Gig of memory), so if I close it and re-open it, it's
> > instantaneous.
> > Additionally, Norton takes forever to start up when I first boot up. It
> > was
> > always slow, but with the data being pushed down like it is, it's
> > reallllly
> > slow.
> > I started an email case with Microsoft paid support on Sunday. Monday, I
> > got a reply that told me to go to
> > HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Filesystem and add a
> > key
> > called NtfsMftZoneReservation and set the value to 1. I did that and it
> > didn't solve the problem. He also asked me to send him the contents of
> > SvcHost under that same key. The problem is, there is no SvcHost folder
> > under that key on my machine, only 4 entries,
> > NtfsDisable8dot3NameCreation,
> > Win31Filesystem, Win95TruncatedExtensions, and the one he had me add. I
> > informed him in my email yesterday that that's all that was there. I
> > didn't
> > hear back from him today, so I feel like he's struggling to figure this
> > out.
> > Since I didn't hear back from him, I called in and talked to a couple of
> > Microsoft tech reps on the phone today, but they seemed absolutely
> > clueless
> > about what I might need to do. I'm holding out hope that I'll hear
> > something
> > back tomorrow from the rep I initially contacted via email, but I'm
> > beginning
> > to get a sick feeling that he won't have any answers.
> > So, I'm turning to this forum, holding out hope that someone knows what
> > registry entry controls this MFT allocation size and that I can correct it
> > (shrink it back down to a reasonable size). Any help greatly appreciated.
> >
> > --
> > Yours truly,
> > Greg Wallace
>
>
>

[Claymore]

Hi,

This from Microsoft themselves regarding the Registry key you were to
add. Note the part I've put between the asterisks at the end:

To add this value, perform the following steps:
1. Run Registry Editor (Regedt32.exe), and go to the following subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\FileSystem
2. From the Edit menu, click Add Value.
3. Type the following information in the dialog box:
Value Name: NtfsMftZoneReservation
Data Type : REG_DWORD
Data : (valid range is 1-4)
4. Quit Registry Editor and restart your computer.

NOTE: This is a run-time parameter and does not affect the actual
format of a volume. Rather, it affects the way NTFS allocates space on
all volumes on a given system. Therefore, to be completely effective,
the parameter must be in effect from the time that a volume is
formatted and throughout the life of the volume. *** If the registry
parameter is adjusted downward or removed, the MFT zone will be reduced
accordingly, but this will not have any affect on MFT space already
allocated and used.***

This edit will affect future formats, not the current one.

To check the size and status of the MFT start the Defragmenter and
click on Analyse. When it's finished, click on 'View Report' and check
the 'Volume Information'. What does it say about Size. Record Count, %
in use, Fragments? If it's badly defragmented, MS Defragmenter won't
defragment the MFT, you need a utility like Diskeeper or PerfectDisk.

Then for starters I suggest you run chkdsk /r from the Recovery Console.

[Greg Wallace]

I had already added NtfsMftZoneReservation as instructed by someone at
Microsoft. I ran defrag and it did not reduce the MFT allocation, as I think
you're saying. I also ran chkdisk /r and the disk is clean. I wonder if I
did an ASR backup and then a full recovery if that new NtfsMftZoneReservation
being in place would cause the MFT to be shrunk during the process? Also, I
am missing SvcHost under
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\FileSystem. Apparently
that's something that's supposed to be there. I'm wondering if that's
something that someone could export from the registry and I could import it,
or if there are too many things in it that are specific to a particular
machine. Maybe it would at least give me a starting point.
--
Greg Wallace


"Claymore" wrote:

>
> Hi,
>
> This from Microsoft themselves regarding the Registry key you were to
> add. Note the part I've put between the asterisks at the end:
>
> To add this value, perform the following steps:
> 1. Run Registry Editor (Regedt32.exe), and go to the following subkey:
> HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\FileSystem
> 2. From the Edit menu, click Add Value.
> 3. Type the following information in the dialog box:
> Value Name: NtfsMftZoneReservation
> Data Type : REG_DWORD
> Data : (valid range is 1-4)
> 4. Quit Registry Editor and restart your computer.
>
> NOTE: This is a run-time parameter and does not affect the actual
> format of a volume. Rather, it affects the way NTFS allocates space on
> all volumes on a given system. Therefore, to be completely effective,
> the parameter must be in effect from the time that a volume is
> formatted and throughout the life of the volume. *** If the registry
> parameter is adjusted downward or removed, the MFT zone will be reduced
> accordingly, but this will not have any affect on MFT space already
> allocated and used.***
>
> This edit will affect future formats, not the current one.
>
> To check the size and status of the MFT start the Defragmenter and
> click on Analyse. When it's finished, click on 'View Report' and check
> the 'Volume Information'. What does it say about Size. Record Count, %
> in use, Fragments? If it's badly defragmented, MS Defragmenter won't
> defragment the MFT, you need a utility like Diskeeper or PerfectDisk.
>
> Then for starters I suggest you run chkdsk /r from the Recovery Console.
>
>

[Claymore]

Hello again,

My earlier point was that what MS was suggesting with the Registry hack
won't work on your current installation. Also, as I said, running the
Defragmenter won't defragment the MFT. But I was curious as to what it
says about the condition of the MFT - size, files etc. (see earlier
post).

The Registry key you're asking about on this machine is the following:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\FileSystem]
"NtfsDisable8dot3NameCreation"=dword:00000001
"Win31FileSystem"=dword:00000000
"Win95TruncatedExtensions"=dword:00000001
"NtfsDisableLastAccessUpdate"=dword:00000000
"NtfsAllowExtendedCharacterIn8dot3Name"=dword:00000000

I'm pretty sure a complete re-install would fix the problem, and may be
the quickest way in the end, if no one has a better idea.

[Greg Wallace]

Looks like you have two registry keys in there that I don't have, namely the
last two. However, you also apparently don't have the key
HKEY_LOCAL_MACHINE\system\CurrentControlSet\Contro l\FIlesystem\SvcHost. The
Microsoft tech rep I've been working with via email asked for that. In an
earlier post to this thread, I thought NewScience was saying he had that
folder under that key. Now, in re-reading his note, he found it in another
part of the registry. I had done that myself, but thought it should also be
under the above key. At least that's what the Microsoft tech rep seemed to
be saying, but maybe he was pointing me to the wrong location to try to get
it (he wanted me to export it from the registry, zip it up, and send it to
him). If indeed it's not supposed to be under the above key, then maybe my
machine isn't quite as hosed as I thought, though I still don't understand
why all of a sudden it expanded the MFT allocation about a thousand (maybe
10,000 or 100,00) fold. I mean it's HUGE.
Anyway, I'm now cutting an ASR backup and am going to restore from that
overnight. I'm hoping that when the restore allocates the MFT it will see
that new entry I added to the registry and create a normal size MFT. I
believe that's what you're suggesting I try. Hopefully, that will do the
trick.

Thanks,
Greg Wallace
--
Greg Wallace


"Claymore" wrote:

>
> Hello again,
>
> My earlier point was that what MS was suggesting with the Registry hack
> won't work on your current installation. Also, as I said, running the
> Defragmenter won't defragment the MFT. But I was curious as to what it
> says about the condition of the MFT - size, files etc. (see earlier
> post).
>
> The Registry key you're asking about on this machine is the following:
>
> Windows Registry Editor Version 5.00
>
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\FileSystem]
> "NtfsDisable8dot3NameCreation"=dword:00000001
> "Win31FileSystem"=dword:00000000
> "Win95TruncatedExtensions"=dword:00000001
> "NtfsDisableLastAccessUpdate"=dword:00000000
> "NtfsAllowExtendedCharacterIn8dot3Name"=dword:00000000
>
> I'm pretty sure a complete re-install would fix the problem, and may be
> the quickest way in the end, if no one has a better idea.
>
>