67323: Acronis Cyber Protect Home Office, Acronis Cyber Protect Cloud: Machine fails to boot because of missing ngelam.sys

use Google Translate

Applies to: 

Last update: 02-03-2023

Symptoms

  • You initiated an installation or update of Acronis product, e.g. Acronis Cyber Protect Home Office to build 40252
  • Installation failed or got stuck, thus you canceled it
  • Machine fails to boot after aborted Acronis installation. You see an error related to the missing ngelam.sys:

File: \Windows\system32\drivers\ngelam.sys

Status: 0xc000000f
Info: The operating system couldn't be loaded because a critical system driver is missing or contains errors.

Cause

Machine cannot boot due to a missing ngelam.sys driver.

The issue occurs if update or installation fails after installation of services.

The issue is fixed. Please update to the latest build.

Workaround

For earlier build there are two workarounds to make the machine bootable. Do one of the following:

Copy the driver from the backup folder:

  1. In the recovery environment, open Command Prompt: boot your machine with Windows installation media and click Repair your computer. Click Troubleshoot -> Command Prompt.
  2. Run this command:
    copy C:\Windows\ELAMBKUP\ngelam.sys C:\Windows\system32\drivers

Path to Ngelam.sys backup location is defined in registry location HKLM\SYSTEM\CurrentControlSet\Control\EarlyLaunch via reg_key BackupPath. By default the path is C:\Windows\ELAMBKUP. If ngelam.sys cannot be found in that folder, check the registry key for the path to correct location, and adjust the command from Step 2 accordingly. You can access the registry of an unbootable system by booting it with Acronis Bootable media and creating a file/folder backup of \Windows\System32\Config\SYSTEM.

Boot into Windows by temporarily disabling ELAM (Early launch anti-malware protection):

  1. Boot your machine with Windows installation media and click Repair your computer. Click Troubleshoot -> Advanced options -> Startup Settings (you might need to click See more recovery options first) -> Restart. After your machine reboots, press 8 for 'Disable early launch anti-malware protection'. Your machine will boot with ELAM disabled.
  2. Once your system boots, open Command Prompt (Start -> in Search, type cmd.exe and press Enter) and run this command:
    copy C:\Windows\ELAMBKUP\ngelam.sys to C:\Windows\system32\drivers
  3. Reboot the machine.