WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Startup and Recovery Tools

Windows 2000 Professional offers tools to help you troubleshoot problems with starting your computer and recovering from disasters. Some of the most useful tools are detailed in this section, as shown in Table 31.1.

For more information about troubleshooting techniques for setting up your computer, see "Setup and Startup" in this book.

Table 31.1 Startup and Recovery Troubleshooting Tools

Safe Mode

Safe Mode is a diagnostic tool for troubleshooting problems with starting and running Windows 2000. Safe Mode allows the user to specifically control how the computer starts Windows 2000.

If the computer fails to properly start up, restart Windows 2000 in Safe Mode to troubleshoot the problem. To do this, press F8 while the message "For troubleshooting and advanced startup options for Windows 2000, press F8" is displayed. Once the Windows 2000 Advanced Options Menu is displayed, you can start the computer in Safe Mode or press ESC to return to the normal startup menu.

Table 31.2 describes the Windows 2000 Advanced Options Menu options.

Table 31.2 Windows 2000 Advanced Options Menu Options

NOTE

---

A boot log file, Ntbtlog.txt, is automatically created every time the computer is started in Safe Mode. If a boot log file using that name already exists, the new data is appended to the existing file.

Use Safe Mode in the following situations:

If Windows 2000 Professional stalls for an extended period of time.

If Windows 2000 Professional does not work correctly or has unexpected results.

If your video display does not work correctly.

If your computer suddenly slows down.

If you need to test an intermittent error condition.

If you have recently installed a new device driver or software and your system no longer starts.

Unlike Microsoft® Windows® 98, Windows 2000 does not automatically initiate Safe Mode after the system startup has failed. You need to manually access the Windows 2000 Advanced Options Menu to access Safe Mode.

When starting Windows 2000 in Safe Mode, only essential drivers and system services are loaded, including the mouse, keyboard, CD-ROM, standard VGA device drivers, the Event Log, Plug and Play, Remote Procedure Call (RPC), and Logical Disk Manager system services. Safe Mode also bypasses programs referenced in Startup Program group folders (including the user's profile, the All Users profile, and the Administrator profile), programs referenced in the registry to automatically run, and all local group policies (which might also enforce the automatic start of an application). This makes Safe Mode useful for isolating and resolving error conditions caused by faulty automatically started applications, system services, and device drivers.

Safe Mode provides access to the Windows 2000 configuration files so you can make configuration changes, and then restart Windows 2000 Professional normally.

NOTE

---

Safe Mode with Command Prompt loads the basic VGA video driver and a graphical user interface with a command prompt.

After you are in Safe Mode, you can disable or delete a system service, a device driver, or automatically started application that is preventing the computer from starting normally.

NOTE

---

Your computer can take substantially longer to start up and shut down when running in Safe Mode because all disk caching is disabled.

For more information about using Safe Mode, see "Troubleshooting Problems with System Startup and Shutdown" later in this chapter.

Recovery Console

The Recovery Console is a startable text-mode command interpreter environment separate from the Windows 2000 command prompt that allows the system administrator access to the hard disk of computer running Windows 2000 Professional, regardless of the file format used, for basic troubleshooting and system maintenance tasks. Since Windows 2000 does not need to be running to use Recovery Console, it is most useful when a Windows 2000-based computer does not start properly or cannot start at all.

The Recovery Console allows you to obtain limited access to NTFS file system, file allocation table (FAT) 16, and FAT32 volumes without starting the graphical interface. The Recovery Console allows administrators to manage files and folders, start and stop services, and repair the system. It can also be used to repair the master boot record (MBR) and boot sectors and to format volumes. The Recovery Console also prevents unauthorized access to volumes by requiring the user to enter the system administrator password before using the console.

Starting the Recovery Console

To start the Recovery Console, start the computer from the Windows 2000 operating system CD or the Windows 2000 Setup floppy disks. If you do not have Windows 2000 Setup floppy disks and your computer cannot start from the CD, use another Windows 2000-based computer to create the setup disks. For information about creating the Windows 2000 Setup floppy disks, see Windows 2000 Professional Help.

NOTE

---

The Recovery Console can also be installed to the local hard disk and accessed from the Windows 2000 startup menu. However, if the MBR or system volume boot sector have been damaged, you need to start the computer from either the Setup floppy disks or the Windows 2000 Professional operating system CD to access the Recovery Console.

To add the Recovery Console to existing installations of Windows 2000, carry out the following command from the Windows 2000 operating system CD in the Run dialog box:

d:I386Winnt32.exe /cmdcons

where d: represents the CD-ROM drive. This installation requires approximately 7 megabytes (MB) of disk space on your system volume.

This only works correctly if your computer does not contain a mirrored volume. To install the Recovery Console on a computer that contains a mirrored volume, first break the mirror. After the Recovery Console is installed, you can re-establish the mirrored volume. For more information, see the Microsoft Knowledge Base link on the Web Resources page at http://windows.microsoft.com/windows2000/reskit/webresources.

Start the computer from either the Windows 2000 Setup disks or the operating system CD, and then enter Windows 2000 Setup. Press ENTER at the "Setup Notification" screen to go to the "Welcome to Setup" screen. Press R to repair a Windows 2000 installation, and then press C to use the Recovery Console.

The Recovery Console displays valid Windows 2000 installations and prompts you select the installation to repair. To access the disk with the Recovery Console, press the number key for the Windows 2000 installation that you want to repair, and then press ENTER. If you press ENTER without typing a number, the Recovery Console quits and restarts the computer.

NOTE

---

The Recovery Console might show installations of Microsoft® Windows NT®. However, the results of attempting to access a Windows NT installation from the Recovery Console can be unpredictable. Only use the Recovery Console to fix Windows 2000 installations.

Mirrored volumes appear twice in the Recovery Console startup menu, but each entry uses the same drive letter, indicating a reference to the same disk.

The Recovery Console then prompts you for the local administrator account password. If you do not enter the correct password after three attempts, Recovery Console refuses access to the local disks and restarts the computer.

NOTE

---

If the registry is corrupted or missing or no valid installations are found, the Recovery Console starts in the root of the startup volume without requiring a password. You cannot access any folders, but you can carry out commands such as chkdsk, fixboot, and fixmbr for limited disk repairs.

After the password is validated, you can access the following folders on your computer:

The root folder of any volume.

%SystemRoot% and subfolders of the Windows 2000 installation on which you are currently logged on.

Cmdcons and subfolders (if they exist).

Folders on removable media disks, such as CD-ROM and floppy disks.

By default, the Recovery Console prevents access to other folders such as Program Files or Documents and Settings, and folders containing other installations of Windows 2000. This can be changed by using local Group Policy settings. For more information about using Group Policy to change the default behavior of the Recovery Console, see the procedure on setting the policy later in this section. For access to other Windows 2000 installation folders, restart the Recovery Console, and select that installation.

Using the Recovery Console

You cannot copy a file from the local hard disk to a floppy disk. However, you can copy a file from a floppy disk or a CD-ROM to any hard disk, and from one hard disk to another. The Recovery Console displays an "Access is denied" error message when it detects invalid commands.

You cannot run any programs or commands other than the supported commands listed later in this section. The Recovery Console contains no editing capabilities.

IMPORTANT

---

The set command makes use of Recovery Console environment variables to enable, among other options, disk write access to floppy disks. To enable the user to modify the restricted default Recovery Console environment variables, a Group Policy setting must be made. For more information about enabling the set command in Recovery Console, see the procedure at the end of this section.

The Recovery Console buffers previously entered commands and makes them available to the user by means of the UP ARROW and DOWN ARROW keys. To edit a previously entered command, use BACKSPACE to move the cursor to the point where you want to make the edit and rekey the remainder of the command.

To quit and restart the computer, at the command prompt, type:

exit

IMPORTANT

---

The Recovery Console might not map disk volumes with the same drive letters found in Windows 2000. If you are having trouble locating files to copy make sure that the drive mappings for both the source and the target locations are correct. If not, examine other drive letters for the file you are seeking. In addition, some volumes might not have drive letters assigned to them, such as volumes formatted with NTFS and grafted onto the folder structure of another volume by the use of volume mount points. Use the map command to confirm which drive letters and unnamed volumes correspond to which local volumes on the system. For more information about volume mount points, see "File Systems" in this book.

Several of the Recovery Console commands are not fully functional to users who have converted to dynamic disk. For more information about dynamic disks, see "Disk Concepts and Troubleshooting" in this book.

Supported Commands

Table 31.3 lists the commands that are supported by the Recovery Console.

Table 31.3 Available Recovery Console Commands

attrib -|+[c][h][r][s] filename
+   Sets an attribute.
-   Clears an attribute.
c   Compressed file attribute.
h   Hidden file attribute.
r   Read-only file attribute.
s   System file attribute.

batch inputfile [outputfile]
inputfile    Specifies the text file that contains the list of commands to
be executed.
outputfile   Contains the output of commands listed in inputfile.

cd [path]|[..]|[drive:]
chdir [path]|[..]|[drive:]
path      Changes to the specified folder on the same volume.
..       Changes to the parent folder.
drive:   Displays the active folder of the volume specified.
Using no switches displays the current volume and folder.

chkdsk [drive:] [/p]|[/r]
drive:   Specifies the volume to check.
/p       Forces check if volume is not identified as bad.
/r       Locates bad sectors and recovers readable information (/p is
automatic).

copy source [target]
source  Specifies the file to be copied.
target  Specifies the destination folder and/or filename for the new file.

del [drive:][path]filename
delete [drive:][path]filename
drive:     Specifies the volume on which the file to be deletes resides.
path       Specifies the location within the folder structure of the file 
to be deleted.
filename   Specific file to be deleted.

dir [drive:][path][filename]
drive:     Specifies the volume on which the files to be displayed 
reside.
path       Specifies the location within the folder structure of the 
files to be displayed.
filename   Specific file to be displayed.

a   Archive                        h   Hidden
c   Compressed                     p   Reparse point
d   Directory                      r   Read-only
e   Encrypted                      s   System file

disable servicename
servicename   Name of the service or driver to be disabled.

SERVICE_DISABLED
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START

diskpart [/add|/delete] [device-name|drive-name|partition-name] [size]
/add             Create a new partition.
/delete          Delete an existing partition.
device-name      Device name for creating a new partition (such as 
DeviceHardDisk0).
drive-name       Drive-letter based name for deleting an existing 
partition (such as D:).
partition-name   Partition-based name for deleting an existing partition 
and can be used in place of the drive-name argument (such 
as DeviceHardDisk0Partition1).
size             Size of the new partition, in megabytes.

enable servicename [start_type]
servicename   Name of the service or driver to be enabled.
start_type    How the service or driver is scheduled to be started. Valid 
values include:
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START

expand source [/f:filespec] [target] [/y]
expand source [/f:filespec] /d
source        Specifies the file to be expanded. May not include wildcard 
(* and ?) characters.
target        Specifies the destination folder and/or file name for the 
new file.
/y            Do not prompt before overwriting existing file.
/f:filespec   If source contains more than one file, this parameter is 
required to identify the specific file(s) to be expanded.
May use wildcards.
/d            Do not expand-only display a folder of the files which are 
contained in the source.

fixboot [drive:]
drive:   Specifies the volume on which to rewrite a new boot sector.

fixmbr [device-name]
device-name   Specifies the name of device needing a new MBR (such as 
DeviceHardDisk1).

format [drive:] [/q] [/fs:file_system]
drive:            Specifies the volume to format.
/q                Performs a quick format.
/fs:file_system   Specifies the file system use. Valid values for 
file_system include FAT, FAT32, and NTFS.

help [command]
command   Any Recovery Console command.

map [arc]
arc   Forces the use of Advanced RISC Computing (ARC) specification name 
paths instead of Windows device paths. This can be used in 
recreating the Boot.ini file.

md [drive:]path
mkdir [drive:]path
drive:   Specifies the volume on which to create a folder.
path     Specifies the name of the folder to be  created.

more filename
type filename
filename    Specifies text file to be displayed.

 ENTER      Scroll down one line at a time.
SPACEBAR   Scroll down one page at a time.
ESC        Quit viewing text file.

rd [drive:]path
rmdir [drive:]path
drive:   Specifies the volume on which to delete a folder.
path     Specifies the name of the folder to be deleted.

ren [drive:][path]filename1 filename2
rename [drive:][path]filename1 filename2
drive:      Specifies the volume on which the file to be renamed resides.
path        Specifies the location within the folder structure of the file 
to be renamed.
filename1   Specific file to be renamed.
filename2   New filename.

set [variable = value]
The following environment variables are supported:
AllowWildCards        Enable wildcard support for some commands, such as 
DEL, that do not otherwise support them.
AllowAllPaths         Allow access to all files and folders on the 
computer.
AllowRemovableMedia   Allow files to be copied to removable media, such as 
floppy disks.
NoCopyPrompt          Do not prompt when overwriting file.

NOTE

---

The switch /? displays a help screen offering a description of each command, its syntax, arguments (if any exist), and other useful information.

Arguments and switches listed between brackets ([and ]) are optional. Arguments and switches listed between pipes (|) are either/or choices.

To enable full functionality of the set command using Group Policy

NOTE

---

If the Group Policy snap-in has already been added to your MMC, then skip to step 8.

From the Start menu, click Run, and then type:

mmc

From the Console1 dialog box, click the Console menu, and then select Add/Remove Snap-in.

Click Add.

Select Group Policy, and then click Add.

In the Group Policy Object list box, select Local Computer, and then click Finish.

In the Add Standalone Snap-in dialog box, click Close.

In the Add/Remove Snap-in dialog box, click OK.

Expand Local Computer Policy.

Expand Computer Configuration, Windows Settings, Security Settings, and Local Policies.

Click Security Options.

Double-click the policy Recovery Console: Allow floppy copy and access to all volumes and folders.

In the Local Security Policy Setting dialog box, select Enabled, and then click OK.

IMPORTANT

---

If you are using computers running Windows 2000 Professional on a Microsoft® Windows® 2000 Server-based network, use Group Policy from the server to control this functionality. It is more efficient to set this policy in one place and have the workstations automatically implement it when logging on to the network than to implement it on each workstation.

NOTE

---

You can also use the Group Policy snap-in to enable the policy Recovery Console: Allow automatic administrative logon, allowing you to bypass the logon process when the Recovery Console is started. Activating this policy eliminates a security barrier used to protect your computer against intruders. You should only enable this policy on systems that have controlled access to the console, such as those in rooms that can be locked.

Both of the settings available in the Group Policy snap-in can also be made through the Security Configuration and Analysis snap-in.

For more information about setting up, starting, and using Group Policy, see "Customizing the Desktop" in this book.

Using the Recovery Console to Restore the Registry

If you know your registry is damaged, or some of your registry files are corrupted or have been deleted, you might be able to use the Recovery Console to restore your registry. However, this procedure can only work if you regularly create an Emergency Repair Disk (ERD) and you choose the option to back up your registry to the repair directory. For more information about backing up the registry when creating the ERD, see "Emergency Repair Process" later in this chapter.

When you create an ERD and you choose this option, the current version of your registry files are copied from the %SystemRoot%System32Config folder to the %SystemRoot%RepairRegBack folder. Since both of these folders are accessible through the Recovery Console, you can use the copy command to restore the files.

To restore the Registry by using the Recovery Console

WARNING

---

Only use this procedure if you are certain which registry file needs to be restored, and you are certain that the restoration will not cause other damage to your computer. Restoring registry files improperly can prevent your system from starting and can cause you to lose data.

Start the Recovery Console and log on to the Windows 2000 installation containing the registry that you want to restore.

To copy the files you want from %SystemRoot%RepairRegBack to %SystemRoot%System32Config, type:

cd repairregback

and:

copy file_name drive_letter:system_rootsystem32config

where file_name is the registry file you want to restore, drive_letter is the drive letter where your system is installed (for example, C), and system_root is the system installation folder (for example, Winnt).

NOTE

---

As a precaution, first rename the existing file in the Config folder that you intend to restore from backup. If a problem arises from the restoration attempt, you can restore the renamed file to return your system to its original condition.

To restore your entire registry, you need to copy the files Default, Sam, Security, Software, and System.

To exit the Recovery Console, type:

exit

The Emergency Repair Process is a text-mode tool that you can use to repair or recover a system that cannot properly start. It helps you repair problems caused by damaged or deleted operating system files or a corrupted system volume boot sector.

The Emergency Repair Process can repair system files and re-enable the system to start up—it does not back up any files or programs.

The Emergency Repair Process can perform the following tasks:

Inspect and repair the startup environment.

Verify and replace system files.

Replace the system volume boot sector.

Replace the registry if it is missing or badly corrupted.

IMPORTANT

---

Using the Emergency Repair Process to repair registry problems is not recommended. The copy of the registry that the Emergency Repair Process restores is the original registry created during Setup. To back up the current registry in Windows 2000, you have one of two options using Backup:

Perform a backup of the System State data. This backs up the registry, the Component Services class registration database, and all system startup files.

Create a new ERD, and then back up the registry at the same time.

As a result of either action, the registry files are copied to the %SystemRoot%RepairRegBack folder. The registry files backed up with these processes are not the ones restored by the Emergency Repair Process. The Emergency Repair Process refers to the registry files stored in the %SystemRoot%Repair folder. To use these backup registry files for system restoration, use the Recovery Console to copy the backed up registry files to the %SystemRoot%System32Config folder. For more information about restoring backed up registry files by using the Recovery Console, see "Recovery Console" earlier in this chapter.

To prepare for the Emergency Repair Process, create an Emergency Repair Disk (ERD).

To create an ERD

From the Start menu, click Programs, Accessories, System Tools, and Backup.

On the Welcome tab, click Emergency Repair Disk.

Insert an empty, high-density 3.5-inch floppy disk into the floppy disk drive.

When the process is complete, remove the disk, label it "Emergency Repair Disk," and then store it in a safe location.

NOTE

---

Windows 2000 does not include the Rdisk.exe program that was used in Microsoft® Windows NT® version 4.0 and earlier versions to create an ERD.

When the ERD is created, the files listed in Table 31.4 are copied from the %SystemRoot%Repair folder to a floppy disk.

Table 31.4 Contents of the ERD

NOTE

---

The Emergency Repair Process relies on data saved in the %SystemRoot%Repair folder. Do not change or delete this folder.

The registry in Windows 2000 is too large to fit on a floppy disk, and the registry entries are no longer included on the ERD.

To restore your system with the Emergency Repair Process, use the Windows 2000 operating system CD or the Windows 2000 Setup disks and the ERD. During the restore process, press F1 for more information about your options.

NOTE

---

You must use the correct CD-ROM for repairs. You cannot use setup CDs for different languages or incorrect versions.

To restore your system with the Emergency Repair Process

Use the Windows 2000 Professional operating system CD to start your computer. If you have a computer that cannot start up from a CD-ROM, use the Windows 2000 Setup disks instead.

At the Setup Notification screen, press ENTER to continue.

At the Welcome to Setup screen, press R to select the option to repair a Windows 2000 installation.

When prompted to choose the type of repair or recovery option required, press R to repair a Windows 2000 installation by using the Emergency Repair Process.

Choose the type of repair option you want to use:




Press M for Manual Repair.

Press F for Fast Repair.




Follow the instructions that appear and insert the ERD when prompted. If you have the original Windows 2000 operating system CD, you can have Setup check your disk for corruption.

IMPORTANT

---

Because missing or corrupted files are replaced with files from the Windows 2000 operating system CD, changes made after the original installation are lost. Any Service Pack or hotfix installations must be reapplied after using the Emergency Repair Process to restore system files.

If you choose Fast Repair, all repair options are automatically performed, including examination of the registry files. If the registry files are corrupted or missing, Fast Repair automatically replaces them with the copies stored in %SystemRoot%Repair.

Manual Repair allows you to select from the following three options:

Inspect Startup Environment. Inspect Startup Environment verifies that the Windows 2000 files in the system volume are the correct ones. If any of the files that are needed to start Windows 2000 are missing or corrupted, Repair replaces them from the Windows 2000 operating system CD. If Boot.ini is missing, it is recreated.

NOTE

---

The replacement Boot.ini only contains information for the current installation. If your system was configured as a multiple-boot system, the nondefault entries in Boot.ini are not recreated.

Verify Windows 2000 System Files. Verify Windows 2000 System Files uses a checksum to verify that each installed file is good and that it matches the file that was installed from the Windows 2000 operating system CD. If the recovery process determines that a file on the disk does not match what was installed, it displays a message that identifies the file and asks whether you want to replace it. The Emergency Repair Process also verifies that startup files, such as Ntldr, Ntdetect.com, and Ntoskrnl.exe, are present and valid.

Inspect Boot Sector. Inspect Boot Sector verifies that the boot sector on the system volume references Ntldr, and replaces it if it does not. The Emergency Repair Process can only replace the boot sector for the system volume on the first hard disk.

If the Emergency Repair Process was successful, your computer automatically restarts, and you likely have a working system.

TIP

---

Make a copy of the ERD and store it in a secure location, perhaps off-site.

There are a couple of points to consider about maintaining and using the ERD:

Be sure to maintain a copy of your current ERD.

The ERD is not a replacement for backups.

If any of the files that Windows 2000 installs on the system volume are missing or corrupted, you cannot start your computer. You can restore any of the files listed in Table 31.5 by using the ERD.

Table 31.5 Additional Files Restored by the ERD

For more information about creating and using the ERD, see Windows 2000 Professional Help.