1．故障現象
SQL Server 服務管理器
通過啟動出錯提示如下:
服務管理器
通過啟動出錯提示如下:
2．原因分析
安照《五種常見Windows服務啟動問題的排錯方法》這篇文章的方案思路進行排除解決。
3．解決辦法
對于本次出現的錯誤，在查看正常系統服務注冊表文件時發現少幾個項值。并檢查一些數值數據是否被篡改如下：
BEGIN 下為非正常系統的注冊表項
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"DisplayName"="Microsoft Search"
"ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\
6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,\
00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,73,00,74,00,\
65,00,6d,00,5c,00,4d,00,53,00,53,00,65,00,61,00,72,00,63,00,68,00,5c,00,42,\
00,69,00,6e,00,5c,00,6d,00,73,00,73,00,65,00,61,00,72,00,63,00,68,00,2e,00,\
65,00,78,00,65,00,22,00,00,00
"Description"="基于結構化和半結構化數據的內容以及屬性生成全文索引，以便可以對數據進行快速的單詞搜索"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Performance]
"PerfIniFile"="DssCntrs.ini"
"Last Counter"=dword:00001290
"Last Help"=dword:00001291
"First Counter"=dword:00001260
"First Help"=dword:00001261
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Enum]
"0"="Root\\LEGACY_MSSEARCH\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
下為正常系統的注冊表項
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\
6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,\
00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,73,00,74,00,\
65,00,6d,00,5c,00,4d,00,53,00,53,00,65,00,61,00,72,00,63,00,68,00,5c,00,42,\
00,69,00,6e,00,5c,00,6d,00,73,00,73,00,65,00,61,00,72,00,63,00,68,00,2e,00,\
65,00,78,00,65,00,22,00,00,00
"DisplayName"="Microsoft Search"
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,4e,00,54,00,4c,00,\
4d,00,53,00,53,00,50,00,00,00,00,00
"DependOnGroup"=hex(7):00,00
"ObjectName"="LocalSystem"
"Description"="基于結構化和半結構化數據的內容以及屬性生成全文索引，以便可以對數據進行快速的單詞搜索"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Performance]
"PerfIniFile"="DssCntrs.ini"
"Last Counter"=dword:00000ffe
"Last Help"=dword:00000fff
"First Counter"=dword:00000fce
"First Help"=dword:00000fcf
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Security]
"Security"=hex:01,00,14,80,b8,00,00,00,c4,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,88,00,06,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,00,01,\
00,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,00,18,00,fd,01,02,00,01,02,00,\
00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,\
01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSEARCH\Enum]
"0"="Root\\LEGACY_MSSEARCH\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
END
嘗試用正常系統的注冊表項添加到非正常系統中去。(因為對比的兩個系統版本、結構相同，所此次就直接通過導入導出注冊表項進行批量修改)。
