Performing a System Recovery | Microsoft Windows 2000 Server Administrators Companion (IT-Administrators Companion)

[Previous] [Next]

This is everyone's least favorite part of the book, because, of course, if you're reading it you're probably not in a good mood. With that in mind, we'll get right to the point and help you get your system functioning again. Here we focus mainly on getting the system to boot. Later sections also discuss fixing the underlying problem and other situations you might encounter.

A Microsoft Windows 2000 Server that won't boot defines "emergency" for most system administrators. Therefore, you'll want to haul out your disaster recovery plan (as described in Chapter 33) and follow the procedures step by step. If you're reading this section now, for the first time, because you're in the middle of a disaster, and you don't have a disaster recovery plan, there's no need to panic. You can still survive.

The recovery steps outlined in the rest of this chapter proceed from least drastic to most drastic. In any recovery procedure, always adopt a minimalist approach. Start with the least invasive steps. If they succeed, you'll have minimized both the loss of information and the impact on the network and your users.

Using Boot Options

It's what we all dread. You reboot the system, and it hangs or crashes. While this is indeed a dire situation, fear not (yet), for Windows 2000 comes with an arsenal of tools that you can use to get the system running again. The first set of tools are the boot options, available from the Boot menu at startup. These options allow you to start the system safely so that you can fix the problem that is causing the system to fail to boot properly (perhaps a faulty driver or service). To use the boot options to get the system running again, follow these steps:

Boot the system to the Boot menu, and select the Windows 2000 installation you want to boot into.

Press F8 to display the Windows 2000 Advanced Options menu.

Choose the option you want to use, and press Enter. Table 37-1 lists the boot options and their purposes.

From the Boot menu, select the operating system that is having the problem, and press Enter to boot the system.

If you frequently find yourself using boot options on the computer, you may want to set up the boot options you use frequently in the Boot menu for quick access. To do this, open the Boot.ini file, copy the line pointing to the Windows 2000 installation you want to modify, and add one of the switches listed in Table 372 to the end of the new line. A sample Boot.ini file that includes these settings can be found on the CD that accompanies this book.

Table 37-1. Boot options available in Windows 2000

Boot Option	Explanation
Safe Mode	Starts Windows 2000 with a minimal set of files and drivers (basic mouse support, monitor, keyboard, mass storage, default system services but no network connections, basic VGA driver). Useful for fixing driver problems.
Safe Mode With Networking	Adds networking support to safe mode.
Safe Mode With Command Prompt	Starts Windows 2000 in safe mode with Networking, but launches a command-prompt window instead of displaying the Windows desktop, Start menu, and taskbar (Windows Explorer).
Enable Boot Logging	Creates a log file with all of the drivers and services loaded or failed during the boot process. The file is called Ntbtlog.txt and is stored in the %WinDir% folder. This mode is useful for determining the cause of the system failure. Note that a log file is also automatically created in all safe modes.
Enable VGA Mode	Starts Windows 2000 using the standard VGA driver (640 by 480 with 16 colors). Otherwise, Windows 2000 is started normally. This mode is useful when you've installed a bad display driver or have set the screen resolution to one that is not supported and are having trouble changing it.
Last Known Good Configuration	Starts Windows 2000 using the registry information from the last time Windows was shut down. This mode doesn't solve problems related to missing or corrupted drivers or other system files, and all changes made since the last successful startup are lost.
Directory Service Restore Mode	Starts Windows 2000 in safe mode with networking, and restores the SYSVOL and Active Directory directory service on a domain controller.
Debugging Mode	Starts Windows 2000 while sending debug information to another computer via a serial cable connection.
Recovery Console	Boots to the Recovery Console command line (only if it is installed).

MORE INFO
The password used to log on in directory services restore mode is the directory services restore mode password you set when you promoted the computer to a domain controller. For information on changing the password, see the Microsoft Knowledge Base article Q239803.

Table 37-2. Boot.ini switches for the various Windows 2000 boot options

Boot Option	Switch to Use in Boot.ini
Safe Mode	/safeboot:minimal /sos /bootlog /noguiboot
Safe Mode With Networking	/safeboot:network /sos /bootlog /noguiboot
Safe Mode With Command Prompt	/safeboot:minimal(alternateshell) /sos /bootlog /noguiboot
Enable Boot Logging	/bootlog
Enable VGA Mode	/basevideo
Directory Service Restore Mode (domain controllers only)	/safeboot:dsrepair /sos
Debugging Mode	/debug

What to Do When You Really Can't Boot

The only thing dreaded more than not being able to boot the system is not being able to boot the system in a safe mode. Fortunately, Windows 2000 still has a few tricks to help you get the system working in this situation. The main tools at your disposal here are the emergency repair disk and the Recovery Console (covered separately later in this chapter), although boot disks also occasionally come in handy. And yes, if these techniques fail, you can always reinstall Windows (discussed later in this chapter). But try the suggestions in this section first.

Using the Emergency Repair Process

If you can't boot using one of the boot options mentioned earlier in this chapter, try the emergency repair process. This involves booting from either the Windows 2000 CD-ROM or the four setup disks, and then using the Windows 2000 repair process. To do so, follow these steps:

Boot from the Windows 2000 setup disks or the Windows 2000 CD-ROM.

Type R again to choose to repair an existing Windows 2000 installation.

Type R to use the emergency repair process to fix an existing installation of Windows 2000.

Type F to use the Fast Repair option to automatically repair registry problems, system files, the boot sector of the boot volume, and problems with the startup environment if you have a dual-boot system.

CAUTION
Fast Repair repairs registry problems by using a backup copy of the system registry that was created when Windows 2000 was installed. Using this option may result in the loss of settings and preferences created since that instalation.

Or type M to use the Manual Repair option to manually specify what you want to repair, although the registry cannot be repaired in this way. (You can use the Recovery Console to manually repair individual registry files or to replace the entire registry if you like.)

If you chose Manual Repair, select the repair options you want by using the arrow keys and pressing Enter to select or clear each check box. Table 37-3 provides a list of the repair options. When you're done, select the Continue option and press Enter.

After you've selected the repair options, insert the emergency repair disk (ERD) and press Enter. (Creating an ERD is discussed in Chapter 33.) If you don't have an ERD, type L. Windows 2000 searches for the installation and displays any that it finds. To repair the found installation, press Enter; otherwise press Esc.

Table 37-3. Manual Repair options

Option	Purpose
Inspect Startup Environment	Examines the files used to boot the computer (Boot.ini, Ntldr, etc.) and fixes any problems it finds.
Verify Windows 2000 System Files	Scans the Windows 2000 system files for changes or corruption and restores changed files from the Windows 2000 CD-ROM.
Inspect Boot Sector	Checks the master boot record (MBR) and fixes any problems that were preventing the Windows 2000 system from booting. Note that this doesn't eradicate MBR viruses.

Using a Boot Disk to Recover the System

You don't need us to tell you how to use a boot disk (insert disk, boot computer). However, you might find it useful to know a little more about what a boot disk does and doesn't do. (For information on creating a Windows 2000 boot disk, see Chapter 33.)

When you boot the system from a Windows 2000 boot disk, you are bypassing the hard disk's master boot record, boot sector, and startup environment and booting straight from the floppy drive into the operating system you choose from the floppy's Boot menu. This can be a great way of accessing Windows 2000 on a system with a corrupted MBR, boot sector, or startup environment, but booting in this way doesn't mean that the problem has been fixed—you will have the same problem the next time you try to boot normally. However, a boot disk allows you to gain access to the Windows 2000 system, which you can then use to re-create the Boot.ini file and to copy missing or corrupted files such as Ntldr or Ntdetect.com. To fix the MBR or boot sector, you may need to run the emergency repair process, but at least you will know what the problem is.

Using the Recovery Console

The Recovery Console is one of the most useful new recovery tools provided with Windows 2000. It allows you to securely access the hard drive of a nonbooting Windows 2000 computer via a special command prompt, which you can then use to copy files, start and stop services, and perform other recovery. For information on installing the Recovery Console, see Chapter 33.

Before you use the Recovery Console, you should know what you can and can't do with it. You can use the Recovery Console to securely log on to a Windows 2000 installation and access any NTFS, FAT, or FAT32 drives you have, although you can use only the root folder of each drive, the %SystemRoot% folder and subfolders, the Cmdcons folder (if present), and any removable media drives attached to the system. You cannot copy files from the hard disk to a floppy disk, although you can copy files from a floppy to the hard disk or from one hard disk to another. You can use the Recovery Console to disable services or devices from starting the next time you boot the system as well as to reenable them. You can also repair the boot sector and MBR, manage and format partitions, and use, copy, rename, replace, and extract new versions of operating system files. To use the Recovery Console, follow these steps:

Boot the system with the Windows 2000 CD-ROM or setup disks.

Type R to choose to repair an existing Windows 2000 installation. Then type C to use the Recovery Console.

Enter the number corresponding to the Windows 2000 installation you want to log on to and press Enter.

Enter the local system administrator password. (This is the password you originally assigned when installing Windows 2000.)

Type help at the command prompt for a list of available commands, or enter the commands you want to execute. See Appendix D for a list of the commands available and a description of what they do.

TIP
The password used to log on to a domain controller is the directory services restore mode password you set when you promoted the computer to a domain controller. For information on changing the password, see the Microsoft Knowledge Base article Q239803.

Booting from Mirrored Boot Partitions

If you're using mirrored boot partitions and your primary boot drive fails, you'll need the boot disk we discussed in Chapter 33 to get into the system. Fortunately, hard disks have gotten much more dependable in recent years. The general rule is that if they last the first couple of months, they should last at least as long as the computer. The problem with this, of course, is that just when you become totally dependent on a system, Murphy comes along and smiles on you. And the whole point of running a mirrored boot drive, of course, is that you really, really don't want to have trouble, and if you do have problems, you want to get back online quickly.

Therefore, if your boot disk crashes, you need to switch over quickly to running off its mirror while you get a replacement for that boot disk. To do this, you'll need to create a boot floppy disk using the procedure outlined in Chapter 33, with one additional step. For an Intel-based processor, you'll need to edit the Boot.ini file on the floppy to change the ARC name of the boot partition to point to the secondary mirror drive, rather than the primary one. So, for example, if you have a pair of Adaptec 2940 adapters and you have duplexed your boot drives, using the SCSI BIOS to boot from the primary partition on the first hard disk, you might have a line like this in your Boot.ini file:

 multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Advanced Server" /fastdetect

However, if you need to boot from the secondary mirror pair, you would need to change that line to

 multi(1)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Advanced Server" /fastdetect

Once you've booted your system and replaced the failed drive, re-create the mirror (as described in Chapter 14).

Restoring a Completely Failed Server

So the worst has happened. You've had a server totally crash. You've replaced the failed hard disk, and you've got a backup tape to restore with, but you have to be able to boot before you can restore the tape.

The first step is to reinstall Windows 2000 Server on the new disk. Use a temporary directory name so it doesn't interfere with the original installation. Once you have the minimal system installed, you can restore the registry and partition information using your emergency repair disk and the backup tape. Run Windows 2000's Backup program and restore the tape and the registry. The tape drive should be locally attached, and you'll want to make sure you select the Restore Local Registry option to recover the rest of your registry information. Restart the server and you're ready to go.

This process can take a significant amount of time. In an environment such as manufacturing or another production operation, where the server must be available, you may find that you can't afford the time this process takes. The most efficient solution to this problem is to mirror or, better yet, duplex the system disk, preferably with a hardware RAID controller. But even using Windows 2000 Disk Management to mirror the system disk will save you significant amounts of downtime.