Fix STATUS_SYSTEM_HIVE_TOO_LARGE (0xC000036E) Boot Error

Quick answer: Boot from Windows Recovery Environment (WinRE), use regedit to load the SYSTEM hive, delete large keys under ControlSet001\Services and ControlSet001\Enum, then unload it. Reboot.

What's happening here?

Windows divides its registry into hives — files like SYSTEM, SOFTWARE, SAM, SECURITY, and DEFAULT. Each hive has a hard size cap of roughly 2 GB (exact limit varies by Windows version and page pool allocation). When the SYSTEM hive (stored at %SystemRoot%\System32\Config\SYSTEM) crosses that threshold, the OS refuses to boot and throws STATUS_SYSTEM_HIVE_TOO_LARGE (0xC000036E).

I've seen this most often on servers running antivirus drivers that dump logs into HKLM\SYSTEM\CurrentControlSet\Services, or on machines with buggy filter drivers that create thousands of subkeys under Enum. On Windows 10 and 11, third-party software that writes massive binary blobs — like virtual machine tools or backup agents — is the usual trigger.

The error appears as a black screen with white text before the logon screen ever shows. You might also see a message like "Your PC ran into a problem and needs to restart." Don't bother with Startup Repair — it won't fix this.

Fix: Shrink the SYSTEM hive via WinRE

You'll need access to the Windows Recovery Environment. If your PC boots to the recovery menu automatically, great. If not, force it by turning the machine off and on three times, letting it fail to boot each time.

Boot into WinRE — choose Troubleshoot > Advanced options > Command Prompt.
Identify the Windows drive — in the command prompt, type diskpart, then list volume. Your Windows partition is likely C: or D:. Note the drive letter. Exit DiskPart with exit.
Launch Regedit — type regedit and press Enter. Regedit will warn you it's running in a limited environment; ignore that.
Load the SYSTEM hive — highlight HKEY_LOCAL_MACHINE, then go to File > Load Hive. Navigate to X:\Windows\System32\Config\SYSTEM (replace X: with your Windows drive letter). Give the loaded hive a temporary name like OfflineSYSTEM.
Expand the loaded hive — browse to HKEY_LOCAL_MACHINE\OfflineSYSTEM. Underneath you'll see ControlSet001, ControlSet002, CurrentControlSet (which is a link), Select, and MountedDevices.
Find the big keys — the main space hogs are usually under ControlSet001\Services. Look for keys with many subkeys or large binary values (REG_BINARY). Right-click each candidate, choose Export first (backup), then Delete. I've seen antivirus drivers, filter drivers, and hypervisor-related services balloon to hundreds of MB.
Check the Enum key — ControlSet001\Enum can also grow large from device driver entries. Delete stale entries under STORAGE and ACPI that reference devices no longer present. Be cautious: don't delete everything — just the ones with subkeys that look like broken device instance IDs (often start with VEN_ or DEV_).
Unload the hive — highlight HKEY_LOCAL_MACHINE\OfflineSYSTEM, go to File > Unload Hive. Confirm.
Reboot — close Regedit and the command prompt, then choose Continue to restart Windows.

I won't lie — this process is fiddly. If you accidentally delete a critical service key, Windows might boot but lose functionality (network, storage, etc.). That's why I always tell people to export any key before deleting it. You can re-import from the WinRE command prompt later if needed.

Alternative fixes if Regedit isn't an option

If you can't load the hive in Regedit (maybe the hive file itself is corrupt), try these:

Use Registry Editor from a live Linux USB — boot into a Linux environment, mount the Windows partition, and run chntpw (a command-line registry tool). It's a bit geeky but works. I've used this on Windows Server 2016 boxes where the hive was over 2.5 GB.
System Restore from WinRE — if you have a restore point from before the hive got huge, run rstrui.exe from the command prompt. It restores the entire hive from that point, which can drop it below the limit. No guarantee, but it's fast.
Reinstall Windows — the nuclear option. If you can't shrink the hive and have no restore point, a repair install (keep files and apps) using a Windows 11 or 10 ISO may recreate the hive. I'd only do this as a last resort.

How to prevent this from happening again

Once you're back in Windows, check what's filling the hive:

Use the registry size checker — open regedit, go to HKEY_LOCAL_MACHINE\SYSTEM, right-click, choose Properties. Look at the Size — if it's above 1.5 GB, you're close to the limit again.
Identify the culprit — use reg.exe query HKLM\SYSTEM\CurrentControlSet\Services /s from an admin command prompt, but that can be slow. Faster: use a tool like RegSize or RegDllView (NirSoft) to find large keys.
Clean up regularly — uninstall software that writes massive registry keys. Look for drivers from old printers, scanners, or VPN clients. I've seen Check Point VPN and Symantec Endpoint Protection cause this repeatedly.
Increase the hive size limit — on some Windows 10/11 builds, you can tweak HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagedPoolSize to allow a larger hive, but I don't recommend it — it's a band-aid that can lead to memory pressure. Better to clean up the data.

I've watched sysadmins waste days on this error because they tried to chkdsk or sfc /scannow. Neither of those helps — the issue is purely registry size. Follow the steps above, and you'll be back in business within 30 minutes.