Deleting the DEFAULT registry file
The issue begins with the installation of Intel_Unified-AMT-7-Manageme_A00_R292087.exe or the newer version Intel_Unified-AMT-7-Manageme_A01_R298379.exe. These are standard driver installs from the Dell (and Intel) websites for
the Chipset that is in these Dell 790's.
This executable installs the proper drivers for the PCI Serial Device and the PCI Simple Communications Controller devices. The problem is that this executable also installs 2 applets that run as Services on the machines. These are the LMS (Local Manageability
Service) and UNS (User Notification Service) services. It is the UNS service that is accessing and writing to the Default registry hive file found C:\windows\System32\Config\DEFAULT file. This is causing it to grow in size over time in seeming a random manner.
By disabling these 2 services the file growth will stop.
We ran an SCCM query checking this file size on all of our PC's in house. We found that the file size in all of the new Dell PC's (and a couple other PC's) have grown to various sizes. During bootup the OS will parse through this file and load it into the registry.
The larger the file size is the longer it takes to parse it resulting in longer boot times.
The default file size for C:\windows\System32\Config\DEFAULT in a WinXPsp2 and above machine is 512 KB. This should not change. The file size in our problem PC's ranges from
20,xxx KB to 390,xxx KB. You probably would not notice the delay in boot times until this file reaches say 50,xxx KB. Typical numbers and boot times are:
80,xxx KB = about a 5 minute boot time
160,xxx KB = about a 10 minute boot time
250,xxx KB = about a 20 minute boot time
390,xxx KB = about a 45 minute boot time
Fixing the problem is a 2 step process.
Step 1: stop the bleeding
Step 2: replace the corrupt C:\windows\System32\Config\DEFAULT file with a good one.
Step 1: Stop and disable the LMS and UNS services:
We are pushing out a script via SCCM that stops these 2 services, and then disables them from starting again. If you uninstall the Intel Management System Components via control panel add/remove then you will remove the LMS/UNS services, however you will also
remove the drivers for 2 PCI devices. This is indicated by the bangs in Device Manager for the PCI Serial Device and the PCI Simple Communications Controller.
The proper drivers for these 2 devices can be installed with running the ....R292087.exe executables. Just explode the R292087 (or R298379) and there is a driver folder that contains the drivers. Then in Device Manager you simply select to update the drivers
for these to devices and browse to the driver folder to get the drivers.
Batch file we are scripting via SCCM to stop the services and then make the require registry changes to disable the LMS and UNS on all Dell PC's:
sc stop UNS
sc stop LMS
regedit -s c:\AMT.REG
AMT.REG contains the following 2 registry entry changes. Default value is 2 for automatic Startup of these services. Changing the value to 4 disables these services.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UNS]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LMS]
"Start"=dword:00000004
Step 2: Replace the damaged DEFAULT registry hive file with a good one that is 512 KB.
To do this you have to somehow boot-up outside of the PC's native OS as this file is loaded in the registry at bootup and cannot be moved/renamed or deleted in the native OS.
We are using a bootable flash drive to boot in Windows PE and then we run a batch file that will overwrite the bad file with a good file.
Plug the flash drive into the PC, restart it, use F12 to get to the Dell boot options menu, tell it to boot from the USB flash drive. When booted run your batch file to copy the good file to the location. Pull your flash drive and type EXIT. The system will
automatically reboot normally.
This process takes 1.5 minutes total per unit if you want to stick around and see it reboot normally.
When you get tire of doing that just type the exit command and move to the next PC. (30 seconds per PC)"
