Troubleshooting Startup Problems | Microsoft Windows 2000 Server Administrators Companion

A server that won't boot defines "emergency" for most system administrators. Therefore, you'll want to haul out your disaster recovery plan (as described in Chapter 34) and follow the procedures step by step. If you're reading this section for the first time because you're in the middle of a disaster and you don't have a disaster recovery plan, don't panic. You can still survive.

The recovery steps outlined in this section proceed from least drastic to most drastic. In any recovery procedure, always adopt a minimalist approach. Start with the least invasive steps. If they succeed, you'll have minimized both the loss of information and the impact on the network and your users.

Recovering a domain controller is no different from recovering a normal server, except if you want to restore the Active Directory and SYSVOL volume from a backup. To do this, you need to boot the server using the directory services restore mode, as described in Chapter 34.

Figure Out What Happened

Computers rarely "just fail." Usually something happens to cause a system to fail. Therefore, the first thing to do is ask yourself what changed between the last time the system started and now. If you performed any of the following tasks since the last reboot, an imaginary red flag should be waving in front of your eyes:

Added or removed a device
Updated a device driver
Installed a hot fix, patch, or service pack
Installed or uninstalled a program, especially a utility program
Used a configuration tool, MMC snap-in, or utility program to alter system or disk settings
Edited the registry

If you recently installed a new device driver, it's a good bet that the new driver is to blame. Try booting into safe mode (discussed later) and switching back to an older driver, or use the Last Known Good startup option.

If you installed a program, hot fix, patch, or service pack, you can try booting into safe mode and uninstalling the suspect program or you can use the Last Known Good startup option. You can also use this approach to recover from a registry-related difficulty.

If your system started making bad mechanical sounds or producing smoke, you might have hardware trouble. After putting out any flames, check to see if all the fans in the system are functioning properly and listen to determine whether the hard drives are still working. If you can't get the system to boot to its initial startup screen (displayed by the BIOS before Windows has a chance to load), you definitely have hardware trouble, most likely with the CPU, power supply, or RAM.

Display malfunctions can often be fixed simply by booting using the Enable VGA Mode option, available from the Windows Advanced Options menu (discussed in the next section). Once you have booted into Windows, select a more conservative display setting (lower the resolution, refresh rate, or both) or choose a different display driver.

Using the Last Known Good Configuration

It's what every system administrator dreads: you reboot the system, and it hangs or crashes. Although this is indeed a dire situation, fear not (yet), for Windows comes with an arsenal of tools that you can use to get the system running again. The first tool to try is the Last Known Good Configuration (if your system boots but produces an error message, skip to the section of this chapter entitled Fixing the Underlying Problem).

The Last Known Good boot option can help start a Windows system that won't boot because of changes made to the registry (usually by a new device driver). As such, when you start a computer using the last known good configuration, Windows restores the HKEY_LOCAL_MACHINE\System\CurrentControlSet registry key to the state it was in immediately after the last successful boot (other registry keys are unaffected).

The Last Known Good Configuration option is probably the quickest way to get a system back up and running, if it works. To use this approach, follow these steps:

Restart or turn on the computer.
If the computer displays a choice of operating systems select the Windows installation into which you want to boot and then press F8. Otherwise press F8 when the computer displays the Starting Windows text (but before any color images are displayed).
Choose Last Known Good Configuration and then press Enter. Windows attempts to start using the registry settings from the last successful boot. If this fails, move on to starting using Safe Mode. If it succeeds, evaluate what caused the trouble in the first place (probably a new device driver) and then plan future maintenance of the system accordingly (that is, don't use the same driver again).

Using Safe Mode

Windows safe mode, introduced with Windows 95, and brought to the Windows NT codebase by Windows 2000, is a special diagnostic mode that disables all unnecessary services and drivers, maximizing the chances of booting successfully. As such, it's one of the most important troubleshooting tools for dealing with a Windows machine that won't boot.

Once the computer boots into safe mode, you have full access to the system, making it much easier to fix the underlying condition. To boot using the Safe Mode option, use the following procedure:

Restart or turn on the computer.
If the computer displays a choice of operating systems, select the Windows installation into which you want to boot and then press F8. Otherwise press F8 when the computer displays the Starting Windows text (but before any color images are displayed).
Choose Safe Mode and then press Enter. Windows attempts to boot into safe mode.
You can also choose Safe Mode With Networking if you require network access (and the fault doesn't lie in the networking subsystem) or Safe Mode With Command Prompt to bypass the Explorer shell and instead use simply a command prompt interface (further increasing the chances of a successful boot).
If Windows successfully boots into safe mode, you now have the full power of Windows at your troubleshooting disposal. See the section entitled Fixing the Underlying Problem later in this chapter for information about what to do at this point.
If Windows doesn't boot successfully, you need to move on to a more drastic approach, such as attempting to repair your current installation using the Recovery Console (as discussed in the sections that follow). You should also test your system for viruses, because some can prevent Windows from booting.

Using the Emergency Repair Process

If you can't boot using one of the boot options mentioned earlier in this chapter, try the emergency repair process. This method involves booting from either the Windows 2000 CD-ROM or the four setup disks, and then using the Windows 2000 repair process. To do so, follow these steps:

Boot from the Windows 2000 setup disks or the Windows 2000 CDROM.
Type R to choose to repair an existing Windows 2000 installation.
Type R again to use the emergency repair process to fix an existing installation of Windows 2000.
Type F to use the Fast Repair option to automatically repair registry faults, system files, the boot sector of the boot volume, and problems with the startup environment if you have a dual-boot system.
Fast Repair repairs registry errors by using a backup copy of the system registry that was created when Windows 2000 was installed. Using this option might result in the loss of settings and preferences created since that installation. If you want to keep these settings, restore from a recent backup after you get the system booting properly.

Type M to use the Manual Repair option to manually specify what you want to repair, although the registry cannot be repaired in this way. (You can use the Recovery Console to manually repair individual registry files or to replace the entire registry if you like.)
If you chose Manual Repair, select the repair options you want by using the arrow keys and pressing Enter to select or clear each check box. Table 38-1 provides a list of the repair options. When you're done, select the Continue option and press Enter.
After you've selected the repair options, insert the emergency repair disk (ERD) and press Enter. (Creating an ERD is discussed in Chapter 34.) If you don't have an ERD, type L. Windows 2000 searches for the installation and displays any that it finds. To repair the found installation, press Enter; otherwise press Esc.

Table 38-1. Manual Repair options

Option	Purpose
Inspect Startup Environment	Examines the files used to boot the computer (Boot.ini, Ntldr, and so on) and fixes any faults it finds.
Verify Windows 2000 System Files	Scans the Windows 2000 system files for changes or corruption and restores changed files from the Windows 2000 CD-ROM.
Inspect Boot Sector	Checks the master boot record (MBR) and fixes any problems that were preventing the Windows 2000 system from booting. Note that this doesn't eradicate MBR viruses.

Using a Boot Disk to Recover the System

You don't need us to tell you how to use a boot disk (insert disk, boot computer). However, it's useful to know a little more about what a boot disk does and doesn't do. (For information about creating a Windows 2000 boot disk, see Chapter 34.)

Because Windows 2000 Server is installed on an NTFS partition (avoid FAT and FAT32 partitions on servers for security reasons), you can't just pop in any old Windows 98 boot disk and access the computer's hard drive. Instead, either use a specially made Windows 2000 Server boot disk, or boot using the Recovery Console (covered later).

When you boot the system from a Windows 2000 Server boot disk, you are bypassing the hard disk's master boot record, boot sector, and startup environment, but do not end up at a command prompt. Instead, the system boots straight from the floppy drive into the operating system you choose from the floppy's Boot menu (Windows 2000 Server).

This provides access to Windows on a system with a corrupted MBR, boot sector, or startup environment. After the system boots properly, you've narrowed down the difficulty to the Boot.ini file, MBR, boot sector, or Windows startup environment. You can edit the Boot.ini file and replace missing or corrupted Windows files such as Ntldr or Ntdetect.com while in Windows (as discussed later in this chapter), but to fix the MBR or boot sector you'll have to reboot using the Recovery Console, which is discussed next.

Using the Recovery Console

The Recovery Console is an incredibly powerful tool that was introduced with Windows 2000. It quite definitively eliminates the need for FAT system partitions or parallel recovery installations of Windows.

The Recovery Console allows secure access to the root directory and system folder of a nonbooting Windows computer using a special command prompt. At the command prompt, you can perform numerous recovery tasks, such as the following:

Fixing disk errors
Fixing the MBR and boot sector
Starting and stopping services
Extracting and copying files

Before you use the Recovery Console, it's important to understand its limitations. Although you can use the Recovery Console to securely log on to a Windows 2000 Server installation and access any NTFS, FAT, or FAT32 drives, by default you can use only the root folder of each drive, the %SystemRoot% folder and subfolders, the Cmdcons folder (if present), and any removable media drives attached to the system. By default you cannot copy files from the hard disk to a floppy disk, although you can copy files from a floppy to the hard disk or from one hard disk to another.

You can enable full access to your hard drives from the Recovery Console by changing the Recovery Console setting in the relevant Group Policy object. Just keep in mind that this exposes potentially sensitive data to anyone who can boot the system using the Recovery Console (in other words, anyone who gains access to the local system administrator password and physical access to the server).

To use the Recovery Console, follow these steps:

Boot from the Windows CDROM or setup disks (you might have to change the boot order in your BIOS to boot from the CD-ROM first). You can also boot directly into the Recovery Console, if you've installed it (see Chapter 34).
After Windows Setup loads, type R to choose to repair an existing Windows 2000 installation. Then type C to access the Recovery Console.
Enter the number corresponding to the Windows 2000 installation to which you want to log on and press Enter.
Enter the local system administrator password. (This is the password you originally assigned when installing Windows 2000.)
Type help at the command prompt for a list of available commands, or enter the commands you want to execute. See Appendix D for a list of the commands available and a description of what they do.
Some commands you might want to use include the following:
- chkdsk /r to locate bad sectors and fix them
- disable to disable a service or driver you suspect might be causing trouble
- diskpart to view and modify disk partitions
- expand to extract compressed files
- fixboot to write a new boot sector onto the specified partition
- fixmbr to write a new master boot record (MBR) on the specified disk drive
- format to format a disk
- listsvc to list the services and drivers installed on the system
The password used to log on to a domain controller is the directory services restore mode password you set when you promoted the computer to a domain controller. To change the password, restart the domain controller in directory service restore mode and type net user administrator new_password at a command prompt, replacing new_password with the desired password (or use the Local User and Groups snap-in). See Microsoft Knowledge Base article Q239803 for more information.

Booting from Mirrored Boot Partitions

If the primary boot drive fails on a system with mirrored boot partitions, the system continues to operate normally until the next reboot, at which point the system fails unless the drives and controllers involved in the mirror set are exactly the same (down to the firmware revisions and partitioning schemes).

If you can't boot a system with a failed mirror set, you'll need to create a boot floppy disk using the procedure outlined in Chapter 34, with one additional step. Edit the Boot.ini file on the floppy to change the ARC name of the boot partition to point to the secondary mirror drive, rather than the primary one. So, for example, if you have a pair of Adaptec 38SCSI adapters and you have duplexed your boot drives using the SCSI BIOS to boot from the primary partition on the first hard disk, you might have a line like this in your Boot.ini file:

 multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000
Advanced Server" /fastdetect

However, if you need to boot from the secondary mirror pair, you would need to change that line to

 multi(1)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000
Advanced Server" /fastdetect

Once you've booted your system and replaced the failed drive, re-create the mirror (as described in Chapter 15).

More Info

See Microsoft Knowledge Base article Q167045 or the Microsoft Windows 2000 Server Resource Kit for more information about how Windows 2000 Server and Windows 2000 deal with failed mirror sets.

Restoring a Completely Failed Server

So the worst has happened. You've had a server totally crash. You've replaced the failed hard disk, and you've got a backup tape to restore with, but you have to be able to boot before you can restore the tape.

The first step is to reinstall Windows 2000 Server on the new disk. Use a temporary directory name so it doesn't interfere with the original installation. Once you have the minimal system installed, you can restore the registry and partition information using your emergency repair disk and the backup tape. Run the Windows 2000 Backup program and restore the operating system and System State. The tape drive should be locally attached, and you'll want to make sure you select the Restore Local Registry option to recover the rest of your registry information. Restart the server and you're ready to go.

This process can take a significant amount of time. In an environment such as manufacturing or another production operation, where the server must be available, you might find that you can't afford the time this process takes. The most efficient solution to this dilemma is to mirror or, better yet, duplex the system disk, preferably with a hardware RAID controller. However, even using Windows 2000 Disk Management to mirror the system disk will save you significant amounts of downtime.