Appendix D

Using the Windows 2000 Recovery Console

The Windows 2000 Recovery Console is a special command-line environment that you can use to boot a nonfunctioning system. The Recovery Console is discussed in Chapter 38; this appendix covers some aspects of the console and provides a command reference.

Starting the Recovery Console

To start the Recovery Console, use the following steps:

Boot from the Windows CD-ROM or setup disks (you might have to change the boot order in your BIOS to boot from the CD-ROM first).
After Windows Setup loads, type R to choose to repair an existing Windows 2000 installation. Then type C to access the Recovery Console.
Enter the number corresponding to the Windows 2000 installation to which you want to log on and press Enter.
Enter the local system administrator password. (This is the password you originally assigned when installing Windows 2000.)

You can also install the Recovery Console on your hard drive so that it's available as a boot option by using Winnt32.exe with the /cmdcons switch. Another option is to install the Recovery Console on a Remote Installation Service (RIS) server so that systems can perform a network boot into the Recovery Console. For information on this, see Microsoft Knowledge Base Article Q222478.

Using the Command Console

After you start the Recovery Console, you receive the following message:

 Windows 2000(TM) Recovery Console Command Interpreter.
WARNING:
The Recovery Console provides system repair and recovery functionality.
Type `exit' to quit the recovery console and restart the computer.
1: C:\WINNT
Which Windows 2000 installation would you like to log on to? (To cancel, press ENTER.)

After you enter the number for the appropriate Windows 2000 installation, enter the Administrator account password. Note that if you use an incorrect password three times, the Recovery Console quits. Also, if the SAM database is missing or damaged, you will not be able to use the Recovery Console because you cannot be properly authenticated. After you enter your password and the Recovery Console starts, typing exit restarts your computer.

Restrictions and Limitations of the Recovery Console

From the Recovery Console you can access only the following folders:

The root folder.
The %SystemRoot% folder and the subfolders of the Windows 2000 installation you are currently logged on to.
The Cmdcons folder.
Removable media drives such as CD-ROM drives.

If you try to obtain access to other folders, you receive an "Access Denied" error message. Also, while in the Recovery Console you cannot copy a file from the local hard disk to a floppy disk. You can copy a file from a floppy disk or CD-ROM to a hard disk, and from one hard disk to another hard disk.

You can enable full access to your hard drives from the Recovery Console by changing the Recovery Console setting in the relevant Group Policy object. Just keep in mind that this exposes potentially sensitive data to anyone who can boot the system using the Recovery Console (that is, anyone who gains access to the local system administrator password and can gain physical access to the server).

Available Commands

HELP

HELP lists all of the following supported commands:

 ATTRIB DEL EXPAND MAP RMDIR
BATCH DELETE FIXBOOT MD SET
CD DIR FIXMBR MKDIR SYSTEMROOT
CHDIR DISABLE FORMAT MORE TYPE
CHKDSK DISKPART HELP RD
CLS ENABLE LISTSVC REN
COPY EXIT LOGON RENAME

ATTRIB

The ATTRIB command with any of the following parameters can change attributes of a file or folder:


-R	Removes read-only attribute
+R	Makes file read-only
-S	Removes system file attribute
+S	Marks the file as a system file
-H	Removes hidden attribute
+H	Hides the file
-C	Uncompresses the file
+C	Compresses the file

At least one attribute must be set or cleared. To view attributes use the DIR command.

BATCH

BATCH inputfile [outputfile]

Executes commands specified in a text file.

inputfile Specifies the text file that contains the list of commands to be executed.

outputfile If specified, contains the output of the specified commands. If not specified, the output is displayed on the screen.

CD and CHDIR

CD and CHDIR [drive:] [...] [path]

The CD and CHDIR commands change the folder. CD .. specifies that you want to change to the parent folder. Type CD drive: to display the current folder in the specified drive. Type CD without parameters to display the current drive and folder. The CD and CHDIR commands treat spaces as delimiters (unlike their behavior under a normal Windows 2000 command prompt). Because of this, you must enclose a subfolder name that contains a space with quotation marks. For example: CD "driver cache"

The CHDIR command operates only within the system folders of the current installation of Windows 2000, removable media, the root folder of any hard disk partition, or the local installation sources.

CHKDSK

CHKDSK [drive:] [/P] [/R]

Checks, and if needed, repairs or recovers a drive. Also marks bad sectors and recovers readable information.

drive: Specifies the drive to check. The /P switch instructs CHKDSK to do an exhaustive check of the drive even if the drive is not marked with problems, and it corrects any errors found. The /R switch locates bad sectors and recovers readable information. Note that specifying the /R switch implies the /P switch. CHKDSK can be specified without arguments, in which case the current drive is implied with no switches. Optionally, the listed switches are accepted. The CHKDSK command requires the Autochk.exe file. CHKDSK automatically locates this file in the bootup folder. This would typically be the Cmdcons folder if the Recovery Console was preinstalled. If it cannot be found in the bootup folder, CHKDSK tries to locate the Windows 2000 CD-ROM installation media. If the installation media cannot be found, CHKDSK prompts you to provide the location of the Autochk.exe file.

CLS

Clears the screen.

COPY

COPY [source] [destination]

Copies a file.

source Specifies the file to be copied. Wildcards or folder copies are not permitted. A compressed file from the Windows 2000 CD-ROM is automatically decompressed as it is copied.

destination Specifies the folder or filename for the new file. If this is not specified, it defaults to the current folder. If the file already exists, you are prompted to overwrite it.

DEL and DELETE

DEL [drive:] [path] [filename]

DELETE [drive:] [path] [filename]

Deletes a file.

drive: path filename specifies the file to delete.

The DELETE command operates only within the system folders of the current Windows 2000 installation, removable media, the root folder of any hard disk partition, or the local installation sources. The DELETE command does not accept wildcard (*) characters.

DIR

DIR [drive:] [path] [filename]

Displays a list of files and subfolders in a folder.

drive: path filename Specifies drive, folder, and/or files to list. The DIR command lists all files including hidden and system files. Files can have the following attributes:

 D - Directory R - Read-only file
H - Hidden file A - Files ready for archiving
S - System file C - Compressed
E - Encrypted P - Reparse Point

The DIR command operates only within the system folders of the current Windows 2000 installation, removable media, the root folder of any hard disk partition, or the local installation sources.

DISABLE

DISABLE servicename

The DISABLE command disables a Windows 2000 system service or driver.

servicename The name of the service or device driver to be disabled. Use the LISTSVC command to display all eligible services or drivers to disable. DISABLE prints the old start_type of the service before resetting it to SERVICE_DISABLED. Because of this, you should record the old start_type, in case it is necessary to re-enable the service.

The start_type values that the DISABLE command displays are as follows:

SERVICE_DISABLED

SERVICE_BOOT_START

SERVICE_SYSTEM_START

SERVICE_AUTO_START

SERVICE_DEMAND_START

DISKPART

DISKPART [/add] | /delete] [device name | drive name | partition name] [size]

Use the DISKPART command to manage the partitions on your hard disk volumes.

/add Create a new partition.

/delete Delete an existing partition.

device name Device name for creating a new partition. The name can be obtained from the output of the MAP command (for example, \Device\HardDisk0)

drive name This is a drive-letter-based name for deleting an existing partition (for example, D).

partition name This is a partition-based name for deleting an existing partition and can be used in place of the drive name argument (for example, \Device\HardDisk0\Partition1).

size Size of the new partition in megabytes.

If no arguments are used, a user interface for managing your partitions appears.

ENABLE

ENABLE servicename [start_type]

You can use the ENABLE command to enable a Windows 2000 system service or driver.

servicename The name of the service or device driver to be enabled. Use the LISTSVC command to display all eligible services or drivers to enable. The ENABLE command prints the old start_type of the service before resetting it to the new value. You should note the old value, in case it is necessary to restore the start_type of the service.

start_type Valid start_type values are as follows:

SERVICE_BOOT_START

SERVICE_SYSTEM_START

SERVICE_AUTO_START

SERVICE_DEMAND_START

If you do not specify a new start_type, ENABLE prints the old start_type for you.

EXIT

You can use the EXIT command to quit the Recovery Console and restart your computer.

EXPAND

EXPAND source [/F:filespec] [destination] [Y]

EXPAND source [/F:filespec] /D

Expands a compressed file.

source Specifies the file to be expanded; cannot include wildcards.

destination Specifies the folder for the new file. The default is the current folder.

/F:filespec If the source contains more than one file, this parameter is required to identify the specific file(s) to be expanded; can include wildcards.

/Y Do not prompt before overwriting an existing file.

/D Do not expand; only display a folder of the files that are contained in the source.

The destination can be any folder within the system folders of the current Windows 2000 installation, the root of any drive, the local installation sources, or the Cmdcons folder, but not removable media. The destination file cannot be read-only.

FIXBOOT

FIXBOOT drive

Writes new Windows 2000 boot sector code on the boot partition. This fixes problems where the Windows 2000 boot sector is corrupted. The emergency repair process also fixes the boot sector.

drive Drive letter where the boot sector will be written. This overrides the default of writing to the system boot partition.

FIXMBR

FIXMBR device name

Repairs the master boot record (MBR) of the boot partition. This is used in scenarios where a virus has damaged the MBR and Windows 2000 cannot start.

This command has the potential to damage your partition tables if a virus is present or a hardware problem exists. This command might lead to inaccessible partitions. Microsoft suggests running antivirus software before using this command.

device name Optional device name that specifies the device that needs a new MBR. The name can be obtained from the output of the MAP command. If this is left blank, the boot device's MBR is fixed. For example:

FIXMBR \device\harddisk2

If FIXMBR detects an invalid or nonstandard partition table signature, it prompts you for permission before rewriting the MBR.

FORMAT

FORMAT [drive:] [IQ] [/FS:file-system]

Formats the specified drive to the specified file system.

drive: Drive letter of the partition to format.

/Q Performs a quick format of the drive.

/FS:file-system Specifies the type of file system to use: FAT, FAT32, or NTFS. If none is specified, then the existing file system format is used, when available.

LISTSVC

The LISTSVC command lists all available services, drivers, and their start types for the current Windows 2000 installation. This might be useful when using the DISABLE and ENABLE commands.

These are extracted from the %SystemRoot%\System32\Config\SYSTEM hive. Should the SYSTEM hive become damaged or missing, unpredictable results might occur.

LOGON

The LOGON command lists all detected installations of Windows 2000 and Windows NT, and then requests the local administrator password for the copy of Windows you chose to log on to. If more than three attempts to log on do not succeed, the console quits and your computer restarts.

MAP

MAP [arc]

The MAP command lists drive letters, file system types, partition sizes, and mappings to physical devices.

arc The arc parameter tells MAP to use ARC paths instead of Windows 2000 Device paths.

MD and MKDIR

The MD and MKDIR commands make folders. Wildcard characters are not supported. The MKDIR command operates only within the system folders of the current installation of Windows 2000, removable media, the root folder of any hard disk partition, or the local installation sources.

MORE filename

The MORE command displays a text file to the screen.

RD and RMDIR

The RD and RMDIR commands delete a folder. They operate only within the system folders of the current Windows 2000 installation, removable media, the root folder of any hard disk partition, or the local installation sources. The folder must be empty for the command to work properly.

REN and RENAME

The REN and RENAME commands can rename a file. Note that you cannot specify a new drive or path for your destination file. The REN and RENAME commands operate only within the system folders of the current Windows 2000 installation, removable media, the root folder of any hard disk partition, or the local installation sources.

SET

The SET command allows you to display or modify four environment options:

 AllowWildCards = FALSE
AllowAllPaths = FALSE
AllowRemovableMedia = FALSE
NoCopyPrompt = FALSE

The SET command is disabled by default. To enable it, use the Enables The Set Command For The Recovery Console attribute of a security template, located under the Local Computer Policy/Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options container.

SYSTEMROOT

The SYSTEMROOT command sets the current working folder to the %SystemRoot% folder of the Windows 2000 installation you are currently logged on to.

TYPE

TYPE filename

The TYPE command displays a text file.

Appendix D - Using the Windows 2000 Recovery Console