Field note: an antivirus update broke a server, and its copy too
A bad antivirus update left a server unable to boot, and the physical-to-virtual copy made for safety had the same problem. A lesson about what copies do and don't protect.
We were migrating an old physical server to a virtual machine, a standard physical-to-virtual (P2V) move using a disk-imaging tool. Partway through the project, an antivirus update on the server went bad and left it unable to boot.
No problem, we thought. We had the P2V copy.
The P2V copy wouldn’t boot either.
Why the copy didn’t help
The virtual copy was an exact image of the physical server, taken after the bad update had already landed. It faithfully copied the problem along with everything else. A copy made after something goes wrong isn’t a way back from it.
The fix
Since the corrupted antivirus services were stopping Windows from starting, the approach was to disable those services offline: load the broken system’s registry from another environment and set the antivirus services not to start, so Windows could boot and the antivirus could be repaired or reinstalled properly.
What I took away from it
- A copy is only as good as the moment it was taken. P2V images, clones, and snapshots all capture problems too.
- Keep a real backup with history, so you can go back to before the problem, not just to right now.
- Security software can break things like any other software. Watch servers closely after major updates.
- Know how to edit a registry offline. It’s the way into a Windows system that won’t boot because of a bad service or driver.
Get new guides by email
Plain-English tech tips, scam and security alerts, and fixes for small offices, whether you're the office manager or the IT pro. No spam, and you can unsubscribe anytime.