Recovering from Disasters | Microsoft Windows XP Registry Guide (Bpg-Other)

Everything I've explained to this point assumes that you can start Windows XP. If you can't, your recovery options are a bit more limited and a lot more dramatic. If you have the money, I'd invest in Winternals Software Administrator's Pak. This is a set of advanced troubleshooting tools that I use to recover configurations that are on the teetering edge of the trash bin. Learn more about it at http://www.winternals.com. I'll tell you more about these tools in Chapter 8, "Finding Registry Settings," because I use them to track down programs' settings in the registry (a hint of things to come).

It's fortunate that these types of problems don't occur as often as they once did. The reliability improvements in Windows XP mean that I don't have to recover nearly as many configurations as I did with Microsoft Windows 98 or Microsoft Windows NT 4.0. The tools available in Windows XP are similar to the ones that came with Windows 2000. The Advanced Options menu (the boot menu) offers a variety of modes in which to start Windows XP, including Safe Mode. Recovery Console is a limited command prompt with which you can fix certain classes of problems. And Automated System Recovery, which is the last resort, minimally reinstalls Windows XP on the computer. I'll present these in the order in which you should use each option.

Note

After a failure isn't the right time to master the advanced troubleshooting tools. Practice with them in a lab environment. Make them your own by scoping out their advantages and disadvantages well in advance of any problems. Master these tools now, and you'll enjoy that smug feeling you get by fixing a user's computer and walking away saying, "no worries," after just a few minutes of work.

Advanced Options Menu

Windows XP gives you a number of options for starting the computer. Safe Mode is the most common example. In Safe Mode, Windows XP uses default settings for the minimum set of device drivers required to start the operating system. When you can't start Windows XP normally, you can usually start it in Safe Mode and then repair the problem or use System Restore to restore a checkpoint. You can also remove programs using Add Or Remove Programs and uninstall cranky devices.

To start Safe Mode or one of the other modes, you have to display the Advanced Options menu. First restart the computer. When you see the message, "Please select the operating system to start," press F8 (you might start tapping F8 prior to seeing this message), and then select one of the options in the menu:

Safe Mode. Starts Windows XP using basic files and drivers (mouse, monitor, keyboard, mass storage, basic video, and default system services without network connections). If Windows XP doesn't start using safe mode, you might need to use Recovery Console to repair Windows XP.
Safe Mode With Networking. Starts Windows XP using basic files and drivers, as described in the last item, but includes network connections.
Safe Mode With Command Prompt. Starts Windows XP using basic files and drivers. After logging on to the operating system, you see a command prompt instead of the graphical user interface.
Enable Boot Logging. Starts Windows XP and logs all the device drivers and services that the operating system attempts to load. The log file is Ntbtlog.txt and is in the %SYSTEMROOT% folder. Safe Mode, Safe Mode with Networking, and Safe Mode with Command Prompt add to the log a list of all the drivers and services that Windows XP loaded. The log is useful for determining which device driver or service is preventing Windows XP from starting properly.
Enable VGA Mode. Starts Windows XP using the basic VGA driver. This mode is useful after installing a new device driver for the video card when it's causing Windows XP not to start properly. Windows XP always uses the basic VGA driver when you start in Safe Mode, Safe Mode with Networking, or Safe Mode with Command Prompt.
Last Known Good Configuration. Starts Windows XP using the registry hive files and device drivers that Windows XP saved the last time it shut down. Any changes made since the last successful startup are lost. Use Last Known Good Configuration only when the problem is in the configuration because it doesn't solve problems that corrupt or missing files cause.
Directory Service Restore Mode. Restores the SYSVOL directory and the Active Directory directory service on a server. This option is irrelevant to Windows XP.

Debugging Mode. Starts Windows XP and sends debugging information to another computer through a serial cable.

Note

If you're unable to start Windows XP using the graphical user interface, you can usually start it using Safe Mode with Command Prompt. To run System Restore, which you're likely to do if you want to restore an earlier restore point, run the command %SYSTEMROOT% \System32\Restore\rstrui.exe.

Recovery Console

If Safe Mode doesn't do the trick, try Recovery Console. It offers commands that help fix varieties of system-related problems. You can enable or disable services; format disks; read and write files on a local NTFS volume; and perform a number of other administrative tasks. Notably, you can copy files from a floppy disk or CD to %SYSTEMROOT% in order to replace broken system files. Recovery Console is useful only if you're already familiar with the MS-DOS command prompt, and you must log on to the computer as an administrator to use it.

You start Recovery Console one of two ways:

From the Windows XP CD. Boot the computer using the Windows XP CD, and the setup program gives you the option of starting Recovery Console.
From the list of operating systems when the computer boots. First install Recovery Console on the computer by typing D:\i386\winnt32.exe /cmdcons in the Run dialog box, where D is the drive containing the Windows XP CD. Restart the computer, and choose Recovery Console in the list of operating systems.

Recovery Console has numerous commands, but it's missing a good chunk of the commands the MS-DOS command prompt provides. To see a list of commands and how to use them, type help at the Recovery Console command prompt. Here's a brief overview of each of them:

Attrib Changes the attributes of a file or directory
Batch Executes the commands specified in the text file
Bootcfg Boot file (boot.ini) configuration and recovery
ChDir(Cd) Displays the name of the current directory or changes the current directory
Chkdsk Checks a disk and displays a status report
Cls Clears the screen
Copy Copies a single file to another location
Delete (Del) Deletes one or more files
Dir Displays a list of files and subdirectories in a directory
Disable Disables a system service or a device driver
Diskpart Manages partitions on your hard disks
Enable Starts or enables a system service or a device driver
Exit Exits the Recovery Console and restarts your computer
Expand Extracts a file from a compressed file
Fixboot Writes a new partition boot sector onto the specified partition
Fixmbr Repairs the master boot record of the specified disk
Format Formats a disk
Help Displays a list of the commands you can use in Recovery Console
Listsvc Lists the services and drivers available on the computer
Logon Logs on to a Windows installation
Map Displays the drive letter mappings
Mkdir (Md) Creates a directory
More Displays a text file
Net Use Connects a network share to a drive letter
Rename (Ren) Renames a single file
Rmdir (Rd) Deletes a directory
Set Displays and sets environment variables
Systemroot Sets the current directory to the systemroot directory of the system you are currently logged on to
Type Displays a text file

Policies that you can enable to add more oomph to Recovery Console are new for Windows XP. The policies Recovery console: Allow automatic administrative logon and Recovery console: Allow floppy copy and access to all drives and folders are per-computer administrative policies in \Windows Settings\Security Settings\Local Policies\Security Options. Enable Recovery console: Allow automatic administrative logon to automatically log on to Recovery Console as Administrator. Set Recovery console: Allow floppy copy and access to all drives and folders to allow access to all of the computer's drives and folders (Recovery Console limits access to %SYSTEMROOT% by default). After you enable this policy, you configure Recovery Console by setting environment variables: Type set variable = true | false at the command prompt (you must include a space on each side of the equal sign). Table 3-3 shows the default environment settings. To see the current settings, type set.

Table 3-3: Recovery Console Environment Settings
Setting	Default	Description
AllowWildCards	False	Enable wildcards for some commands
AllowAllPaths	False	Allow access to all files and folders
AllowRemovableMedia	False	Allow file copying to removable media
NoCopyPrompt	False	Don't prompt to overwrite existing files

Note

You can't log on to Recovery Console if you installed Windows XP from a disk image prepared with Sysprep (see Chapter 13, "Cloning Disks with Sysprep"). This is due to changes that Sysprep makes in the way Windows XP stores password keys in the registry. These changes aren't compatible with Recovery Console. Microsoft publishes a fix for this problem in the Knowledge Base. Look for article Q308402, and download the files it lists. I expect that the first service pack for Windows XP will fix this problem.

Automated System Recovery

Create Automated System Recovery (ASR) backups frequently as part of your overall strategy. It's a last resort for system recovery, useful only if you've used up the other options that I've described in this chapter, including Safe Mode, Last Known Good Configuration, and Recovery Console.

Automated System Recovery is a two-part process. The first part is to back up the computer using Automated System Recovery Preparation Wizard, which is in Backup Utility. The wizard backs up system state data, services, and all operating system components. It also creates a file that contains information about the backup data, disk configurations, and how to restore the computer. Automated System Recovery does not back up or restore data files, programs, and so on. It only backs up the files necessary to start the computer in the event of failure. Here's how to prepare for Automated System Recovery:

Run Backup Utility.

Click Start, All Programs, Accessories, System Tools, and then Backup.
If you see Backup or Restore Wizard, click Advanced Mode; otherwise, move on to the next step.
Click Automated System Recovery Wizard to start the wizard, and then follow the instructions you see on the screen to back up the computer and create an Automated System Recovery disk.

The second part of the process is to restore the computer. You use Automated System Recovery by pressing F2 when the setup program prompts you. Automated System Recovery reads the disk configurations from the file it created earlier, and restores all disk signatures, volumes, and disks containing operating system files. (It tries to restore all of the computer's disks but might not be able to do so successfully.) Automated System Recovery then installs Windows XP minimally, and then restores the backup created by Automated System Recovery Preparation Wizard. The whole process is similar to reinstalling Windows XP manually and then restoring your own backup. It's automated, however.

Administrator's Pak

Winternals Software Administrator's Pak contains tools that go far beyond Recovery Console and Automated System Recovery. You can also buy these tools individually if the price of the entire toolkit is a bit steep.

The first tool is ERD Commander. Using this tool, you can start computers directly from a CD into an environment similar to Windows XP. The environment gives you full access to all the computer's volumes. It's kind of like a graphical version of Recovery Console. You can even reset a forgotten Administrator password, edit the registry, and copy files from the computer to the network. If this tool is your last resort for fixing a downed computer, you're going to be in good hands.

Disk Commander is another tool in the kit that enables you to recover files from dead volumes. After scanning a volume, it presents the files it found in a user interface similar to Windows Explorer so you can copy them to a safe place.

Remote Recover is the last tool that I'm featuring here, but there are more in the Administrator's Pak. Use this tool to repair failed computers across a network. That is, it gives you access to a remote computer's disks as if you installed those disks on your computer. You have to boot the remote computer, though, and Remote Recover gives you two options. The first is to start the remote computer using a bootable floppy disk. The second, and the one I like best, is a PXE-based disk image that you can start remotely or add to a RIS (Remote Installation Service) server.

You can learn more about these notable tools by visiting Winternals Software's Web site at www.winternals.com. The wunderkind duo of Mark Russinovich and Bryce Cogswell, Winternals Software's founders, have developed these and other tools to such a high level of reliability that I often bet my job on them.