First problem, affecting AMD-based computers with OEM images, primarily HP Desktops
NEW: Use this tool to mitigate the problem
If you have an AMD-based computer, and all you want to do is prevent the problem before installing Service Pack 3, then try the new tool I just wrote. It will first check whether you have an AMD-based computer. If you do it will check whether the IntelPPM driver is set to load. If it is it will offer you an option to disable it. The tool works by simply double-clicking it. If you need to check many computers on a network you can do that by running it from the command line, using this command:
removeIntelPPMonAMD.vbs <computer 1> <computer 2> <computer 3>…
It will take an arbitrary number of computers. The only caveat is that the tool will prompt you several times for each computer. If you really need a silent version, I can probably be persuaded to write one for you.
Note that if you are downloading the tool on Safari there is a bug in how Safari handles these types of downloads. If you just click on the link Safari will save the tool with a .txt extension instead and open it. You can remove that extension and then double-click the tool to run it. If you right-click the link and select “Download link as…” Safari will put the name on the containing page on the tool, not the name of the tool itself. You would need to rename it to something with a .vbs extension first to use it. Neither Firefox nor Internet Explorer makes it this difficult to download that tool, although Firefox does not properly handle right-clicking and selecting “Save link as…”
Disclaimer: the tool is provided “as is” with no warranty express or implied. It is designed to make changes to your system and those changes always carries a risk. Even though I have tested it as much as I can, I cannot guarantee that it will work for you. By running the tool you agree to hold me harmless for any damage it may cause to your computer.
Problem Details
In my case, the computer would boot into safe mode fine, so I did that. Not knowing what it was, I ran a disk check, which turned out to be a real mistake. Once I configured the computer to run a disk check at startup it would not even boot into safe mode.
Fortunately, I know Bill Castner, another Microsoft MVP, and he pointed me to a solution. It turns out that this computer is running an OEM OS image from HP. If you have an HP computer with a part number that ends with a ‘z’ you have an AMD-based computer. Other manufacturers have also shipped AMD-based computers, but it is unclear whether they have built their images the same way HP did.
The problem is that HP, and possibly other OEMs, deploy the same image to Intel-based desktops that they do to AMD-based desktops. It also appears that this is unique to their desktop image, and any HP AMD-based laptops are unaffected by the problem. Because the image for both Intel and AMD is the same all have the intelppm.sys driver installed and running. That driver provides power management on Intel-based computers. On an AMD-based computer, amdk8.sys provides the same functionality. Microsoft points out in a Knowledge Base article that installing both drivers on the same computer is an unsupported configuration, putting the blame on the OEM that deploys the image. The article in question was written when the same problem occurred after installing Service Pack 2 for Windows XP.
Ordinarily, having intelppm.sys listed in the registry on an AMD-based computer appears to cause no problems, so long as the binary does not actually run. On HPs images, the driver is not installed, even though the driver is listed in the registry and supposed to load. However, on the first reboot after a service pack installation, it causes a big problem. The computer either fails to boot, as in my case, or crashes with a STOP error code of 0x0000007e. If you see that error code you almost certainly have this problem. The computer will boot into safe mode because the drivers are disabled there. Please note here that simply having the intelppm.sys file on your computer is not the problem so searching for it in the Windows directory is not relevant. Nor is only having a directive in the registry to load it a problem. It must be running to cause a problem, which means the file has to both exist on the disk, and the registry has to be configured to load it. Therein lies the problem. HPs images have the registry key set but no driver on disk. When the service pack is installed the pre-existing directive in the registry is read, the installer lays down the driver on the disk, and on the next reboot it launches, causing the crash.
You may not see the error code because the computer reboots too fast. To force the computer to stop when it crashes, you need to set an option during startup. To do so, hit the F8 key during restart right when you see the black Windows XP screen come up. Then select the “Disable automatic restart on system failure” option, as shown below:
To fix the problem, boot into safe mode, or boot to a WinPE disk, or into the recovery console, and disable the intelppm.sys driver.
WARNING: Do NOT under any circumstance disable the intelppm driver on an Intel-based computer. It will make your computer not boot! If your computer will not boot because you disabled the intelppm driver on an Intel-based computer, follow the directions in the Recovery Console section below.
If you have an AMD-based computer, however, you do not need the intelppm driver and can disable it. Boot into Safe Mode by hitting the F8 key as above, but select Safe Mode instead. You will need your Administrator account to log on in safe mode. To disable the driver, take the following steps:
If you booted into the recovery console, from a command prompt, run “disable intelppm”
If you booted into safe mode you can run “sc config intelppm start= disabled”
If you booted into WinPE, you have to manually edit the registry. Do this:
-
Run regedit
-
Click on HKEY_LOCAL_MACHINE
-
From the File menu, select “Load hive”
-
Navigate to %systemdriver%\Windows\System32\Config on the dead system and select the file name System
-
Name it something you can remember, such as “horked”
-
Navigate to horked\<the current control set>\Services\IntelPPM. See below for how to determine which one is the current control set.
-
Double click the Start value and set it to 4
-
If you did what I did and completely destroyed things by running a disk check, navigate to <the current control set>\Control\SessionManager. Open the BootExecute value and clear out the autochk entries
-
Reboot
Step 6 asks you to navigate to <the current control set>. Under HKEY_LOCAL_MACHINE\SYSTEM there are typically at least two numbered control sets, and sometimes there are up to four. They are called ControlSet001, ControlSet002, and so on. Control sets hold all the configuration data for the computer, including all drivers that load. One of them is designated the current one, and the others are backups of previous configurations that worked. The control set that is currently used as the current one is the one listed in the “Current” value under HKEY_LOCAL_MACHINE\SYSTEM\Select. That is the control set that you need to modify in step 6. If you modify one of the other control sets it will not solve the problem. You need to modify the current one. If you manage to boot the computer, CurrentControlSet will be a pointer to the current one and you can modify that one. If you boot from the recovery disk you have to figure out which one is the current to modify the proper one. It will not always be ControlSet001.
If this was your problem, the computer should now reboot just fine.