Lesson 3:Using Startup and Recovery Tools | 70-270: MCSE Guide to Microsoft Windows XP Professional (MCSE/MCSA Guides)

In this lesson, you learn about the tools and options Windows XP Professional provides to help you troubleshoot problems with starting your computer and recovering from disasters. These tools include safe mode, LastKnownGood configuration, the Recovery Console, and the Automated System Restore Wizard.

The Automated System Restore Wizard is explained in Chapter 16, "Backing Up and Restoring Data."

After this lesson, you will be able to

Describe how to use safe mode
Describe how to use the LastKnownGood configuration
Describe the advanced boot options
Install and use the Windows XP Professional Recovery Console

Estimated lesson time: 60 minutes

Using Safe Mode

If your computer will not start, you might be able to start it by using the safe mode. Pressing F8 during the operating system selection phase displays a screen with advanced options for booting Windows XP Professional. If you select safe mode, Windows XP Professional starts with limited device drivers and system services. These basic device drivers and system services include the mouse, standard VGA monitor, keyboard, mass storage, default system services, and no network connections. Safe mode also ignores programs that automatically start up, user profiles, programs listed in the registry to automatically run, and all local group policies.

Safe mode provides access to Windows XP Professional configuration files, so you can make configuration changes. You can disable or delete a system service, a device driver, or an application that automatically starts that prevents the computer from starting normally.

If you choose to start your computer in safe mode, the background will be black and "Safe Mode" will appear in all four corners of the screen (see Figure 18.4). If your computer does not start using safe mode, you can try Windows XP Professional Automatic System Recovery.

Figure 18.4 Running Windows XP Professional in safe mode

Safe Mode with Networking

There are a couple of variations of safe mode. You can select safe mode with networking, which is identical to safe mode except that it adds the drivers and services necessary to enable networking to function when you restart your computer. Safe mode with networking allows Group Policy to be implemented, including those implemented by the server during the logon process and those configured on the local computer.

Safe Mode with Command Prompt

A second variation of safe mode is safe mode with command prompt, which is similar to safe mode, but it loads the command interpreter as the user shell, so when the computer restarts it displays a command prompt.

Using the LastKnownGood Configuration

Selecting the LastKnownGood configuration advanced boot option starts Windows XP Professional using the registry information that Windows XP Professional saved at the last shutdown.

If you change the Windows XP Professional configuration to load a driver and have problems rebooting, you can use the last known good process to recover your working configuration. The last known good process uses the LastKnownGood configuration, stored in the registry, to boot Windows XP Professional.

Windows XP Professional provides two configurations for starting a computer, Default and LastKnownGood. Figure 18.5 shows the events that occur when you make configuration changes to your system. Any configuration changes (for example, adding or removing drivers) are saved in the Current control set.

Figure 18.5 Using Default and LastKnownGood configurations

After you reboot the computer, the kernel copies the information in the Current control set to the Clone control set during the kernel initialization phase. When you successfully log on to Windows XP Professional, the information in the Clone control set is copied to the LastKnownGood control set, as shown in the lower part of Figure 18.5.

If you experience startup problems that you think might relate to Windows XP Professional configuration changes, shut down the computer without logging on, and then restart it. When you are prompted to select the operating system to start from a list of the operating systems specified in the BOOT.INI file, press F8 to open the Windows Advanced Options Menu screen. Then select the LastKnownGood Configuration option.

The next time you log on, the Current configuration is copied to the Default configuration. If your configuration changes work correctly, the next time you log on, the Current configuration is copied to the Default configuration. If your configuration changes do not work, you can restart and use the LastKnownGood Configuration option to log on.

Table 18.9 summarizes the purpose of the Default and LastKnownGood configurations.

Table 18.9 Default and LastKnownGood Configurations


Configuration	Description
Default	Contains information that the system saves when a computer shuts down. To start a computer using the default configuration, select Windows XP Professional on the Please Select The Operating System To Start menu.
LastKnownGood	Contains information that the system saves after a successful logon. The LastKnownGood configuration loads only if the system is recovering from a severe or critical device driver loading error or if it is selected during the boot process.

Table 18.10 lists situations in which you can use the LastKnownGood configuration and the related solutions.

Table 18.10 Situations in Which to Use the LastKnownGood Configuration


Situation	Solution
After a new device driver is installed, Windows XP Professional restarts, but the system stops responding.	Use the LastKnownGoodConfiguration option to start Windows XP Professional because the LastKnownGood configuration doesn't contain any reference to the new, and possibly faulty, driver.
You accidentally disable a critical device driver (such as the Scsiport driver).	Some critical drivers are written to keep users from making the mistake of disabling them. With these drivers, the system automatically reverts to the LastKnownGood control set if a user disables the driver. If the driver does not automatically cause the system to revert to the LastKnownGood control set, you must manually select the LastKnownGood Configuration option.

Using the LastKnownGood configuration does not help in the following situations:

When the problem is not related to Windows XP Professional configuration changes. Such a problem might arise from incorrectly configured user profiles or incorrect file permissions.
After you log on. The system updates the LastKnownGood control set with Windows XP Professional configuration changes after a successful logon.
When startup failures relate to hardware failures or missing or corrupted files.

Starting Windows XP Professional using the LastKnownGood configuration overwrites any changes made since the last successful boot of Windows XP Professional.

Using Other Advanced Boot Options

Pressing F8 during the operating system selection phase displays a screen with the Windows Advanced Options menu. This menu provides the following options:

Enable Boot Logging. Selecting the Enable Boot Logging advanced boot option logs the loading and initialization of drivers and services for troubleshooting boot problems. All drivers and services that are loaded and initialized or that are not loaded in a file are logged. The log file, NTBTLOG.TXT, is located in the %windir% folder. All three versions of safe mode automatically create this boot log file.
Enable VGA Mode. Selecting the Enable VGA Mode advanced boot option starts Windows XP Professional with a basic VGA driver.
Directory Services Restore Mode. Selecting the Directory Services Restore Mode advanced boot option is only applicable to domain controllers, so it does not apply to computers running Windows XP Professional.
Debugging Mode. Selecting the Debugging Mode advanced boot option starts Windows XP Professional in kernel debug mode, which allows a debugger to break into the kernel for troubleshooting and system analysis.

When using the advanced boot options in Windows XP, logging is enabled with every option except LastKnownGood Configuration. The system writes the log file (NTBTLOG.TXT) to the %systemroot% folder. In addition, each option except LastKnownGood Configuration loads the default VGA driver.

Using an advanced boot option to boot the system sets the environment variable %SAFEBOOT_OPTION% to indicate the mode used to boot the system.

Using the Recovery Console

The Windows XP Professional Recovery Console is a text-mode command interpreter that you can use to access NTFS, FAT, and FAT32 volumes without starting Windows XP Professional. The Recovery Console allows you to perform a variety of troubleshooting and recovery tasks, including the following:

Starting and stopping services
Reading and writing data on a local drive
Formatting hard disks
Repairing the MBR

Installing and Starting the Recovery Console

To install the Recovery Console, insert the Microsoft Windows XP Professional CD-ROM into your CD-ROM drive, and close the Microsoft Windows XP Professional CD dialog box, if it opens. Open a Run dialog box or a Command Prompt window in Windows XP Professional, change to the i386 folder on the Windows XP Professional CD, and then run the winnt32 command with the /cmdcoms switch. After you install the Recovery Console, you can use the Windows XP Professional CD-ROM to start your computer, and then to access the Recovery Console, select the Recovery Console option when you are prompted to choose repair options.

After you start the Recovery Console, you must specify which installation of Window XP Professional you want to log on to (if you have a dual-boot or multiple-boot configuration), and then you must log on as the Administrator.

Using the Windows XP Professional Recovery Console

You can also run the Recovery Console from the Windows XP Professional CD-ROM. The Recovery Console provides a limited set of administrative commands that you can use to repair your Windows XP Professional installation. You can use the following steps to start the Recovery Console from the Windows XP Professional CD-ROM:

Insert the Windows XP Professional CD-ROM into the CD-ROM drive and restart the computer. If your computer or the workstation you want to repair does not have a bootable CD-ROM drive, you will need to insert your Windows XP Professional Setup Boot disk into your floppy disk drive. Insert the additional Windows XP Professional Setup disks when you are prompted to do so.
When Setup displays the Setup Notification message, read it, and then press Enter to continue.
Setup displays the Welcome To Setup screen. In addition to the initial installation of Windows XP Professional, you can use Windows Setup to repair or recover a damaged Windows XP Professional installation.
Press R to repair a Windows XP Professional installation.
The Windows XP Recovery Console screen appears.
Press C to start the Recovery Console.
If you have more than one installation of Windows XP Professional on the computer, you are prompted to select which installation you want to repair.
Type 1 and then press Enter.
You are prompted to enter the Administrator's password.
Type the Administrator's password and then press Enter.
Setup displays a command prompt.
Type help and press Enter for a list of the commands available.
When you have completed the repair process, type exit and press Enter.
The computer will restart.

Understanding the Recovery Console Commands

There are a number of commands available in the Recovery Console, some of which are described in Table 18.11.

Table 18.11 Recovery Console Commands


Command	Description
Attrib	Changes the attributes of a file or folder. - Clears an attribute+ Sets an attribute c Compressed file attribute h Hidden file attribute r Read-only attribute s System file attribute
Chdir (cd)	Displays the name of the current folder or changes the current folder.
Chkdsk	Checks a disk and displays a status report.
Cls	Clears the screen.
Copy	Copies a single file to another location. You can't copy a file from a hard drive to a floppy disk, but you can copy a file from a floppy disk or a CD-ROM to a hard drive or from a hard drive to another hard drive.
Delete (Del)	Deletes one or more files.
Dir	Displays a list of files and subfolders in a folder. The wildcard characters * and ? are permitted.
Disable	Disables a system service or a device driver.
Diskpart	Creates, deletes, and manages partitions on your hard disk. /add Creates a new partition/delete Deletes an existing partition Do not modify the structure of dynamic disks with this command, because you might damage your partition table.
Enable	Starts or enables a system service or a device driver.
Exit	Exits the Recovery Console and restarts your computer.
Expand	Expands a compressed file stored on the Windows XP Professional CD-ROM or from within a .cab file and copies it to a specified destination.
Fdisk	Manages partitions on your hard disk.
Fixboot	Writes a new partition boot sector onto the system partition.
Fixmbr	Repairs the MBR of the partition boot sector. This command only overwrites the master boot code, leaving the existing partition table intact. If corruption in the MBR affects the partition table, running fixmbr might not resolve the problem.
Format	Formats a disk. If no file system is specified, NTFS is used bydefault.
Help	Lists the commands you can use in the Recovery Console.
Logon	Logs on to a Windows XP Professional installation.
Map	Displays the drive letter mappings.
Mkdir (md)	Creates a folder.
More	Displays a test file.
Rmdir (rd)	Deletes a folder.
Rename (ren)	Renames a single file.
Systemroot	Sets the current folder to the %systemroot% folder of the system you are currently logged on to.
Type	Displays a text file.

Practice: Using the Windows XP Professional Recovery Console

In this practice, you use the Windows XP Professional Recovery Console to troubleshoot a Windows XP Professional installation that will not boot. You also install and then start the Recovery Console, and you look at Help to determine what commands are available in the Recovery Console. You also use the Listsvc command to view the services and then use the Disable command to disable the Alerter service.

If your computer is not equipped with a CD-ROM drive that is capable of booting from a CD-ROM, do not do Exercise 1 or you might have to reinstall Windows XP Professional. Skip to Exercise 2.

Optional Exercise 1: Troubleshooting a Windows XP Professional Installation

In this exercise, you troubleshoot a Windows XP Professional installation and repair it using the Recovery Console.

To create a system boot failure

Click Start, right-click My Computer, and then click Explore.
In the left pane of the Explorer window, click Local Disk (C:).
In the right pane of the Explorer window, right-click NTLDR and then click Rename.
Type oldntldr and then press Enter.
Windows XP Professional displays a Confirm File Rename dialog box asking if you are sure you want to rename the system file NTLDR to OLDNTLDR.
Click Yes.
Restart the computer.
What error do you receive when attempting to restart the computer?

To use the Recovery Console to repair the installation

Insert the Windows XP Professional installation CD into the CD-ROM drive and press Ctrl+Alt+Delete to restart the computer.
If your computer requires you to press a key to boot from the CD-ROM, press Spacebar when prompted.
When Setup displays the Setup Notification message, read it, and then press Enter to continue.
Setup displays the Welcome To Setup screen.
Press R to repair a Windows XP Professional installation.
Setup starts the Recovery Console.
Type 1 and then press Enter.
You are prompted to enter the Administrator's password.
Type password and then press Enter.
Setup displays a C:\Windows command prompt.
Type d: and press Enter.
If your CD-ROM drive is not drive d, use the correct drive letter.
Type cd i386 and press Enter.
Type dir and press Enter.
Most of the files on the CD-ROM end with an _, for example, NTOSKRNL.EX_.
Press Spacebar to scroll through the files and locate NTLDR.
NTLDR is not compressed so you can copy it directly to your computer.
Type copy ntldr c:\ntldr and then press Enter.
When the copy is complete, Setup displays a 1 file(s) copied message.
If there is a disk in your floppy drive, remove it. If your computer is capable of booting from the CD-ROM drive, remove the Windows XP Professional CD from your CD-ROM drive.
Type exit and press Enter.
The computer reboots and should start normally.

Exercise 2: Installing the Windows XP Professional Recovery Console

In this exercise, you install the Recovery Console.

Log on as Administrator.
Insert the Windows XP Professional CD into the CD-ROM drive.
When the Microsoft Windows XP Professional CD window appears, close it.
Click Start, and then click Run.
In the Run dialog box, type <cd-drive>:\i386\winnt32 /cmdcons (where <cd-drive> represents the letter assigned to your CD-ROM drive), and then click OK.
A Windows Setup message box appears, indicating that you can install the Windows Recovery Console as a startup option.
Click Yes to install the Windows XP Professional Recovery Console.
Windows Setup attempts to contact Microsoft and confirm that you have the latest version of Setup and then it installs the Windows XP Recovery Console on your hard disk.

Windows XP Professional displays a Microsoft Windows XP Professional Setup message box indicating that the Windows Recovery Console has been successfully installed.
Click OK to close the Microsoft Windows XP Professional Setup dialog box.

Exercise 3: Using the Windows XP Professional Recovery Console

In this exercise you use the Help command to view the available commands. You then use the available Listsvc and Disable commands.

Restart your computer.
In the Please Select The Operating System To Start screen, select Microsoft Windows Recovery Console.
The Microsoft Windows XP Recovery Console starts and prompts you to select which Windows installation you would like to log on to. If you had more than one Windows XP Professional installation on this computer, all of them would be listed here.
Type 1 and then press Enter.
Type password when prompted for the Administrator password, and then press Enter.
Type help and then press Enter to see the list of available commands.
Scroll through the list of commands.
The Listsvc command allows you to view all the available services.
Type listsvc and press Enter, and then scroll through the list of available services.
Press Esc to stop.
Type disable and then press Enter.
The Disable command allows you to disable a Windows system service or driver.
Type disable alerter and then press Enter.
Recovery Console displays several lines of text describing how the registry entry for the Alerter service has been changed from Service_Demand_Start to Service_Disabled. The Alerter service is now disabled.
Type exit and then press Enter to restart your computer.

Exercise 4: Restarting the Alerter Service

In this exercise you confirm that the Alerter service is disabled and then restart it.

Log on as Administrator.
Click Start, click All Programs, click Administrative Tools, and then click Computer Management.
In the Computer Management window, expand Services And Applications.
Under Services And Applications, click Services.
Double-click Alerter.
In the Alerter Properties dialog box, change the Startup Type option to Automatic and then click OK.
Right-click Alerter, and then click Start.
Close the Computer Management window.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering these questions, review the material in this lesson before beginning the next chapter. The answers are in Appendix A, "Questions and Answers."

What is safe mode and why do you use it?
How do you start Windows XP Professional in safe mode?
When is the LastKnownGood configuration created?
When do you use the LastKnownGood configuration?
How can you install the Windows XP Professional Recovery Console on your computer?

Lesson Summary

If your computer will not start, you might be able to start it by using the safe mode because Windows XP Professional starts with limited device drivers and system services.
If you change the Windows XP Professional configuration to load a driver and have problems rebooting, you can use the LastKnownGood process to recover your working configuration.
Pressing F8 during the operating system selection phase displays a screen with the Windows Advanced Options menu that provides the following options: Safe Mode, Safe Mode With Networking, Safe Mode With Command Prompt, Enable Boot Logging, Enable VGA Mode, LastKnownGood Configuration, Directory Services Restore Mode, and Debugging Mode.
The Windows XP Professional Recovery Console is a command-line interface that you can use to perform a variety of troubleshooting and recovery tasks.