Hack 99 Recovery Roadmap
| < Day Day Up > |
| When it comes to troubleshooting startup problems, finding the right tool for the job is the key . Would you try to crack a walnut with a bulldozer? Or pry open a door with a toothpick? Every tool has its purpose, and using the right tool for the job gets the job done quick and easy. The same is true concerning the maze of troubleshooting options available for restoring Windows 2000 and Windows Server 2003 systems that fail on startup. Safe Mode, Last Known Good Configuration, Emergency Repair Disk, Recovery Console, Automated System Recovery, Windows Startup Diskwhich should you use and in which situations? This hack helps you get your toolbox in order by answering that question. Windows 2000I'll start with Windows 2000 and then highlight differences in troubleshooting issues on the newer Windows Server 2003 platform. Obviously, we won't be able to cover every possible scenario or even the intricate details of specific situations, but if you follow the procedures outlined in this hack, you should be able to get started and figure the rest out yourself, with the help of various Knowledge Base articles on Microsoft Product Support Services (http://support.microsoft.com). To make things crystal clear, here's the big picture, right from the start:
There are exceptions to this procedure, based on possible knowledge you have of what might be wrong with your machine, and we'll talk about that later. But first, let's unpack these steps one at a time. Last Known Good ConfigurationWhen you press F8 during the startup process (or when you see the "Please select the operating system to start" message, if you have the Recovery Console installed), the Windows Advanced Options Menu is displayed. One of the options on this menu is Last Known Good Configuration, which uses the Registry settings that Windows used for its last successful logon. Every time you boot Windows and log on successfully, this information is updated in the Registry and becomes your next version of Last Known Good Configuration. This applies only to normal mode; logging on to Safe Mode successfully does not update your Last Known Good Configuration settings. Digging a little deeper, when you use Last Known Good Configuration, Windows restores the HKLM\SYSTEM\CurrentControlSet Registry settings from a previous set of settings, such as ControlSet001 or ControlSet002 . In addition, Last Known Good Configuration also rolls back the device drivers used by your system to those that loaded during your last successful logon. However, Last Know Good Configuration cannot be used to restore missing or corrupt operating-system files. When should you use Last Known Good Configuration to recover your system? Choosing this option overwrites any Registry changes or device-driver configuration changes you made during your last successful logon session and restores your system to the previous logon session's configuration. In other words, you lose any configuration changes made and any updated drivers installed since the last successful logon to your system. As a result, you should use this tool only if you think that some configuration change you recently made or a device driver you updated might be causing your system to fail upon startup. Typically, a problem like this will cause a STOP error (blue screen) of some sort , and the message on the screen might give you a clue about which driver or service might be causing the failure. So, the moral of the story is, if you change something, reboot, and your system won't start, try Last Known Good Configuration to restore your system. Safe ModeIf you think your problem isn't due to a recent misconfiguration error on your part and you haven't updated any device drivers lately, then try Safe Mode if your system won't start. Safe Mode lets you start your system using a minimal set of device drivers and services. This allows you to get to a logon screen and start using Windows to look for what might be wrong. Safe Mode can also be accessed by using the Advanced Options menu by pressing F8. There are three versions you can use: Safe Mode, Safe Mode with Networking, and Safe Mode with Command Prompt. I suggest you always try Safe Mode with Networking, because might may need to access your Windows installation files on a network distribution point to repair your serverfor example, by extracting driver files from a .cab file. If Safe Mode with Networking fails, try Safe Mode; if that works, then something might be wrong with your network card or networking subsystem settings. If that fails, try Safe Mode with Command Prompt so that you can at least get to the Windows command-line troubleshooting tools to look for what's wrong with your system. You can log on to Safe Mode by using either a domain administrator account or the local administrator account. On a domain controller, the local administrator account is the only local account present on the machine and is stored in a minimal version of the SAM database found on member servers and workstations. This is also the account used to run the Recovery Console, and it uses the password you specified when you first installed Windows (unless it's been changed). When should you use Safe Mode and its variants? Usually, you might try this if you recently installed new hardware or software on your machine, not necessarily during the most recent logon session. Once you're logged on in Safe Mode, you can start disabling hardware devices one at a time until you find exactly which device is causing the problem. Or, if the issue is software- related , you can try to reconfigure or even uninstall different applications to isolate the problem and then see if you can reboot in Normal Mode. Some of the Windows tools you might use in Safe Mode to try to determine the cause of startup failure include Event Viewer, System Information (Start Recovery ConsoleThe Recovery Console is a command-line interface that you can start either by selecting it from the Boot Loader menu (if you've previously installed the Recovery Console on your server) or directly from the product CD. You must log onto the Recovery Console using the local administrator account on your machine, even if it's a domain controller. Recovery Console provides you with a minimal version of Windows that lets you run various commands to perform tasks such as copying and replacing system files, enabling or disabling problem services, repairing a boot sector, or even reformatting your drive. Best practice is to install the Recovery Console on your machine before you need it. That way, you won't be running around looking for your product CD when a disaster occurs and you can't start your system. To install the Recovery Console on a machine, insert the product CD, open a command prompt, change to the I386 folder on the CD, and type winnt32 /cmdcons . If you haven't installed the Console and need to run it directly from the CD, insert the CD and select the Repair option. Windows Startup DiskSometimes, Windows won't boot because the boot sector is damaged on your system volume or a virus has infected your master boot record. A Windows Startup Disk can be extremely handy in such circumstances. The name of the disk is a bit of a misnomer, because you can't start Windows from the disk itself. Rather, the disk can be used in conjunction with the Recovery Console to repair certain kinds of problems that might arise. But first, here's how to create one of these disks so that you'll have it ready when you need it. Stick a blank floppy disk into your machine and double-click on My Computer. Right-click on your A : drive and select Format. Check the option for Quick Format and click Start to format your disk. Now, double-click on the C : drive to open it in My Computer, select Tools Now, if your system won't start because of a damaged master boot record, a corrupt boot sector, or missing or corrupt system files such as Ntldr or Ntdetect.com , you can start the system by using the Recovery Console (from the product CD if necessary), insert your Windows Startup Disk, and copy the files you need from the floppy to your C : drive. Then, you can run other Recovery Console commands to repair the boot sector (using the fixboot command), repair the master boot record (using the fixmbr command), and so on, until you have a working system that will start. Emergency Repair Process The only other thing you can usually try (short of reinstalling Windows from scratch) is the Emergency Repair Process. This feature of Windows 2000 is basically a holdover from Windows NT. The Emergency Repair Disk (ERD) itself isn't as useful (since a floppy can't contain the whole Windows 2000 Registry) as the other actions that are performed by Windows when you create this disk. In particular, when you create an ERD by starting the Backup utility and selecting Tools The repair process finds the boot.ini file, reads the ARC paths to the operating system, and then attempts to load the %systemroot%\System32\Config\Software Registry hive. If the boot.ini file is corrupt or missing or if the Software hive is corrupt, the repair fails (unless you actually do have an ERD handy, in which case the repair process can gain access to a working copy of the Setup.log file for your machine). Hopefully, you updated your EFD the last time you reconfigured your machine or installed new hardware on it to keep it current. Windows Server 2003Things are pretty much the same in Windows Server 2003, except for one major difference: the ERD of Windows 2000 has been replaced by the new Automated System Recovery (ASR) feature of Windows Server 2003 [Hack #98]. This new ASR feature is a powerful tool of last resort for restoring your system when everything else fails. ASR includes the functionality of ERD and much, much more and can really save your bacon in an emergency when your server won't start and everything else (Last Known Good Configuration, Safe Mode, Recovery Console) fails. Right Tool for the JobFinally, here's a list of the proper tools to use when any of these common issues prevent your system from starting:
|
Run | < Day Day Up > |
