Module 7. The Windows XP Boot Process

Transcription

1 Module 7 The Windows XP Boot Process Copyright 2003 N+S training!

2 Objectives! The Boot Process! Registry Control Sets! Advanced Startup Options! The Boot.ini file! Use System Restore! Use Automated System Recovery Objectives By the end of this module, you should be able to: Describe the Windows XP boot process. Describe how Windows XP uses configuration information in the registry Control Sets to determine the devices and services to start during the boot process. Use the Windows XP Advanced Boot Options to troubleshoot the boot process. Explain the purpose and function of the Boot.ini file. Use System Restore. Use Automated System Recovery. Page SM D Copyright 2003 N+S training!

3 The Boot Process! Stages of the Boot Process! Preboot Sequence! Boot Sequence! Kernel Load! Kernel Initialisation! Logon! Required Files The Boot Process Stages of the Boot Process The Windows XP boot process on an Intel-based platform consists of five main stages: Preboot Sequence. Boot Sequence. Kernel Load. Kernel Initialisation. Logon. Copyright 2003 N+S training! SM D Page 7.3

4 Files Required The boot process requires a number of files, each with a specific purpose and each initialised at various stages as shown below. The table also lists the location of each file: File Name Location Stage of Boot Process Ntldr Root of system partition Preboot and boot Boot.ini Root of system partition Boot Bootsect.dos * Root of system partition Boot Ntdetect.com Root of system partition Boot Ntbootdd.sys * Root of system partition Boot Ntoskrnl.exe Winnt\System32 Kernel Load Hal.dll Winnt\System32 Kernel Load System Winnt\System32\Config Kernel Initialisation Device Drivers Winnt\System32\Drivers Kernel Initialisation Note Files marked * are optional files that are only needed for certain configurations. Bootsect.dos is required for dual-boot configurations with DOS and Windows 9x systems. Ntbootdd.sys is the renamed first SCSI driver file copied to the system partition. Page SM D Copyright 2003 N+S training!

5 The Preboot Sequence! POST Routine! Boot Device and MBR! Boot Sector! Ntldr Initialisation The Preboot Sequence The preboot sequence begins immediately once a computer is powered on and consists of the following four phases: The Power On Self Test (POST) Routine This phase involves a check for basic hardware components such as memory, keyboard, etc, and on computers with a Plug and Play BIOS, configuration and enumeration of hardware devices also takes place. Master Boot Record (MBR) initialised The computer s BIOS then attempts to locate the boot device usually the hard disk, but can be a floppy disk or a CD-ROM and when successful, locates and executes the MBR. Boot Sector The MBR is responsible for locating and then initialising the boot sector on the active (system) partition. Copyright 2003 N+S training! SM D Page 7.5

6 Ntldr This is the operating system loader located on the boot sector, and is responsible for controlling the next stage in the boot process. Note The Windows XP installation process modifies the boot sector to include the Ntldr, and to ensure that Ntldr is loaded during system startup. Page SM D Copyright 2003 N+S training!

7 The Boot Sequence! Initial Boot Loader! Operating System Selection! Hardware Detection! Hardware Profile/Configuration Selection The Boot Sequence Once the Ntldr has been initialised, the first phase of the boot sequence involves the collection of information on hardware and device drivers to prepare for later stages. The boot sequence consists of the following four phases: Initial Boot Loader During this phase, Ntldr switches the processor from real mode to a flat, 32-bit linear model. Ntldr then starts mini file system drivers so that Ntldr can later load Windows XP from FAT, FAT32 or NTFS partitions. Operating System Load Ntldr reads the contents of the Boot.ini file to determine whether the computer has a dual-boot configuration. If so, the contents of the Boot.ini are displayed on screen in order that the user can choose an operating system to load. This menu is displayed for 30 seconds by default. If the user does not make a choice before the 30-second expiry time, the default operating system will be loaded. The default operating system is the system located at the top of the menu, and is usually the latest Windows XP operating system to have Copyright 2003 N+S training! SM D Page 7.7

8 been installed. If the computer is not configured for dual-boot ie Windows XP is the only operating system installed the Boot.ini contents are not displayed and the Windows XP system is loaded automatically. Note The Boot.ini file, together with the implications of dualboot are discussed more fully later in this module. Hardware Detection If after the Operating System Selection phase, Windows XP was selected or loaded by default, Ntdetect.com executes. Ntdetect.com is responsible for detecting currently installed components including: Bus/adapter type. Communications and Parallel ports. Floating-point coprocessor. Floppy disks. Keyboard/pointing devices. SCSI adapters. Video adapters. Ntdetect.com then passes the information detected to Ntldr, which will update the registry location below at later stage in the boot process: HKEY_LOCAL_MACHINE\HARDWARE Hardware Profile/Configuration Selection Once hardware information has been collected, and if multiple hardware profiles are set up on the computer, the Ntldr presents the Hardware Profile/Configuration selection screen. The user can then choose a hardware profile to load. Alternatively, pressing L on the keyboard at this point will invoke an option to load the Last Known Good configuration discussed a little later in this module. If only one hardware profile is configured on the computer, the selection screen is not displayed and Windows XP loads using the default hardware profile. Page SM D Copyright 2003 N+S training!

9 Kernel Load! Ntoskrnl.exe loaded! Hal.dll loaded! HKEY_LOCAL_MACHINE\SYSTEM loaded! Control Set selection! Device Drivers loaded Kernel load Once the boot sequence stage is complete, Ntldr then assumes responsibility for loading a number of components including the Ntoskrnl.exe, and the hal.dll. Ntldr also scans the registry to determine which device drivers and services to start. Specifically, Ntldr: Loads, but does not initialise the Ntoskrnl.exe in preparation for the next stage. Loads the hal.dll. Loads the HKEY_LOCAL_MACHINE\SYSTEM registry key using information in the Winnt\System32\Config\System folder. Determines which set of configuration data to use to initialise the computer. This configuration information is stored in the registry in locations known as Control Sets, each of which contains a list of device drivers and services to load and execute Control Sets are discussed later in this module. Copyright 2003 N+S training! SM D Page 7.9

10 Loads all device drivers with a Start entry value of 0x0 typically low-level hardware device drivers which are loaded in an order specified in: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Control\ServiceGroupOrder These device drivers will be initialised in the next stage of the boot process. Page SM D Copyright 2003 N+S training!

11 Kernel Initialisation! Hardware Key Creation! Clone Control Set Creation! Device Driver Load! Services Start Kernel Initialisation After the Kernel Load stage, Ntldr initialises and then passes control to the Ntoskrnl.exe the operating system kernel. The Ntoskrnl.exe then performs the following tasks: Creates the registry Hardware key The Ntoskrnl.exe takes the information collected by Ntdetect.com during an earlier phase, and creates the HKEY_LOCAL_MACHINE\HARDWARE key in the registry. This key contains information on components attached to the system board, together with the interrupts used by hardware devices. Creates the Clone control set The value of the registry subkey HKEY_LOCAL_MACHINE\SYSTEM\Select\Current determines the control set currently being used during this boot. An identical copy of the control set referenced by this value is made and named the Clone control set. Note The purpose of the Clone control set is discussed later in this module. Copyright 2003 N+S training! SM D Page 7.11

12 Device drivers loaded and initialised The low level device drivers that were loaded during the kernel load phase are now initialised. Ntoskrnl.exe then scans the registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services Device drivers listed here with a Start entry of 0x1 are then loaded in order and immediately initialised. If there are no errors at this stage, the final phase of the kernel initialisation stage takes place next. If however an error is reported, the startup behaviour is determined by the value of the ErrorControl entry for the device held in: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\DriverOrServiceName\ErrorControl. The value of this entry reflects the severity of the error and therefore what should happen next: Value Severity Action 0x0 Ignore The error is not severe enough to delay the boot process. The boot process therefore continues and no message appears on-screen. 0x1 Normal The error is not severe enough to delay the boot process, but an error message is displayed for user information. 0x2 Severe The error is severe and the boot process fails, but restarts automatically using the LastKnownGood control set. If this boot sequence is already using the LastKnownGood control set (ie was selected by the user during the Boot Sequence), the error is ignored and the boot process continues. Page SM D Copyright 2003 N+S training!

13 Value Severity Action 0x3 Critical The boot sequence fails and restarts automatically using the LastKnownGood control set. If however, the LastKnownGood control set is already being used and is causing the error, the boot sequence fails completely, and an error message is displayed. Services start During this final phase of the kernel initialisation stage, control is passed to the Windows XP Session Manager (Smss.exe), which starts the high-order subsystems and services. Smss.exe executes instructions in the following registry location as shown below: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ SessionManager BootExecute Memory Management DOS Devices SubSystems Smss.exe executes any commands/programs specified here before loading services. Smss.exe creates the paging file information that is required by the Virtual Memory Manager. Smss.exe creates symbolic links to logical devices to support DOS-based applications. Smss.exe starts the Win32 subsystem, which controls I/O and access to the video display. The Win32 subsystem also starts the WinLogon process. Copyright 2003 N+S training! SM D Page 7.13

14 Logon! Local Security Authority! Service Controller and Services Load! Clone Control Set and LastKnownGood Logon The final stage of the boot process begins when Winlogon.exe executes the Local Security Authority (Lsass.exe), which displays the Logon dialogue box. The Service Controller then takes control, and scans the Services subkey of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet for services with a Start value of 0x2, and loads them in order. Default services include the Workstation service and the Server service. Note The order of loading depends on the value of DependOnGroup or DependOnService entries in the Services subkey. Once a user has successfully logged on, the whole boot process is considered successful. It is at this point that the Clone control set is copied to the LastKnownGoodRecovery configuration. Page SM D Copyright 2003 N+S training!

15 Registry Control Sets Registry Control Sets The registry control sets are groups of configuration information that are used to determine (control) the hardware configuration used to startup Windows XP. Under HKEY_LOCAL_MACHINE\SYSTEM are a number of control sets. The diagram above shows an example of the contents of the System key after a default installation of Windows XP. Typically, this key contains: ControlSet001. ControlSet002. CurrentControlSet This points to one of the above control sets and is the registry location that is changed when configuration information changes either through the Windows XP interface eg Control Panel or through direct editing of the registry. Note The Clone control set, although technically a subkey of the System key is not visible after logon. It is only created during the kernel Copyright 2003 N+S training! SM D Page 7.15

16 initialisation stage of the boot process and is a copy of the control set used to start the computer. The control set that will be used to start the system is determined by the values of data entries in the HKEY_LOCAL_MACHINE\SYSTEM\Select subkey. The data entries located here are: Current The value of this data entry determines which of the control sets (ControlSet001, ControlSet002 etc) is the CurrentControlSet. In the diagram on the previous page, the value of Current is binary (decimal equivalent 1.) This points to ControlSet001. Default This identifies the control set that will be used the next time Windows XP starts, unless the LastKnownGood configuration is selected. Typically the values of Default and Current are identical, confirmed in the diagram on the previous page. Failed If the computer is ever restarted using the LastKnownGood configuration, the control set that caused the problems that led to the LastKnownGood configuration selection is marked as failed. In the diagram on the previous page, the value of this data entry is 0, indicating that this computer has never been restarted using the LastKnownGood configuration. LastKnownGoodRecovery The value of this data entry points to the control set that was being used at the last successful logon. Recall that the Clone control set is copied to the LastKnownGoodRecovery control set after successful logon. In the example on the previous page, the value of this data entry is 2 indicating Controlset002. Page SM D Copyright 2003 N+S training!

17 The Last Known Good Process The Last Known Good Process If you make configuration changes to Windows XP that involve loading a new or updated driver, and then encounter problems, it is possible to recover using the LastKnownGood configuration. If, during the boot process, you experience problems that you think might relate to a driver configuration do not log on. Instead, restart the computer and then perform one of the following actions, depending on whether the computer is configured to dual boot or not: 1 If the computer is configured to dual-boot, an operating system choice list will be displayed during the boot process. When this is displayed, press the F8 key to invoke the Windows XP Advanced Startup menu. Select the Last Known Good option. Choose the operating system to boot to. Copyright 2003 N+S training! SM D Page 7.17

18 2 If the computer is not configured to dual-boot and therefore the operating system choice list is not displayed or if you miss the operating system choice list: Wait for the series of white rectangles to appear at the foot of the screen and then press the F8 key to invoke the Windows XP Advanced Boot Options. From here choose the Last Known Good configuration. The diagram on the previous page shows the result of invoking the last known good configuration, specifically: The value of Current under Select is set to 2 and points to ControlSet002 under SYSTEM. The value of Default the control set that will be used the next time Windows XP starts normally is set to 2, also pointing to ControlSet002. The value of Failed is set to 1, pointing to ControlSet001. This control set is the control set that was causing the problems and which the system has marked as failed. Recall that in this example this was the previous CurrentControlSet. This Control set will never be used to boot Windows XP. As this control set contains the changes that caused the problem, plus any other changes made during the same session, valid changes have effectively been overwritten. The value of Last Known Good is set to 3 and points to ControlSet003. Page SM D Copyright 2003 N+S training!

19 When and When Not to Use the LastKnownGood It is important to be aware that the LastKnownGood configuration cannot be used to solve every problem. The tables below summarises the situations in which this option is valid, and when it is not. Situation The system restarts but stops responding after the installation of a new device driver. Accidental disablement of a critical device driver. LastKnownGood does help Provided nobody logs on after the first problem restart. Some critical device drivers can recover from accidental disablement by causing the system to revert to the LastKnownGood at the next restart. Some critical device drivers are not protected in such a way, and user intervention is required to invoke the LastKnownGood configuration. Situation If the problem is not related to the Windows XP configuration such as problems with EFS, NTFS permissions, network access, user profiles etc. After a user has logged on. LastKnownGood does not help Attempting to reboot using the LastKnownGood in such situations will not only not solve the problems, but may result in loss of valid configuration changes. Once a user logs on after a restart, the boot process is considered successful. The Clone control set (a copy of the CurrentControlSet which is the one with the problem) then overwrites the LastKnownGood configuration. Copyright 2003 N+S training! SM D Page 7.19

20 Situation If the problem is due to hardware failures such as a failed hard disk, corrupt file, etc. LastKnownGood does not help Again, using the LastKnownGood in such cases may result in loss of valid configuration changes. Page SM D Copyright 2003 N+S training!

21 Advanced Startup Options! Safe Mode! Safe Mode with Networking! Safe Mode with Command Prompt! Enable Boot Logging! Enable VGA Mode! Last Know Good Configuration! Directory Services Restore Mode! Debugging Mode! Boot Normally Advanced Startup Options If a Windows XP Professional computer is experiencing problems booting, it may be possible to boot using the Windows XP Advanced Startup Options sometimes known as Advanced Boot Options. The options menu can be invoked by pressing F8 when: The operating systems selection menu appears (if the computer is configured for multi-boot). A series of white rectangles appears at the foot of the screen (if Windows XP is the only operating system installed or you miss the operating system selection menu). This presents a Windows XP Advanced Options Menu with the following options: Safe Mode Windows XP will load with basic files and drivers only, including a VGA monitor, mouse, keyboard, default system services and no network connections. Copyright 2003 N+S training! SM D Page 7.21

22 Safe Mode with Networking Windows XP loads with configuration that is identical to Safe Mode, but includes any drivers and services needed to establish network connections. Safe Mode with Command Prompt This mode loads the same drivers and services as Safe Mode, but presents the Command Prompt rather than the Windows XP GUI. Enable Boot Logging With this option Windows XP boots normally, and records the loading and initialising (or not) of drivers and services. The log file generated Ntbtlog.txt is located in the SystemRoot folder. Note The three version of Safe Mode also produce this log file. Enable VGA Mode Windows XP loads with a basic VGA driver. Last Known Good Configuration With this option, Windows XP boots using information from the registry saved at the last successful logon. Directory Services Restore Mode This option is only available on a Windows server running Active directory, and enables the Windows Active Directory directory services to be restored. Debugging Mode This option applies to Windows XP Servers only and allows administrators to trace problems with program code. Boot Normally If you have accessed the advanced options screen by mistake, or change your mind about choosing an advanced option, this option allows Windows XP to boot normally. Reboot Abandons the Advanced Boot Options menu and restarts the computer. Return to OS Choices Menu Returns to the operating systems choice list. Note Boot logging and VGA modes are available with all options except Last Known Good Configuration. Page SM D Copyright 2003 N+S training!

23 The Boot.ini File The Boot.ini File Main Purposes The Boot.ini file functions during the Boot Sequence phase of the Boot process and has three main purposes: To provide Ntldr with a menu of operating systems, which Ntldr then displays on-screen for user interaction. To point to the location of the Windows XP kernel (Ntoskrnl.exe). The Boot.ini uses an ARC path discussed later to achieve this. Using various switches, it can load Windows XP in different ways as an aid to troubleshooting. Copyright 2003 N+S training! SM D Page 7.23

24 Boot.ini Sections The Boot.ini file consists of two sections, [boot loader] and [operating systems] as shown in the previous diagram. These function as follows: [boot loader] This points to the location of the default operating system ie the operating system at the top of the list, that will be loaded if the user does not intervene. This section also contains the timeout parameter, indicating how long the operating system menu will be displayed for, before the default is loaded. [operating systems] This section lists all installed operating systems, including the default operating system indicated in the [boot loader] section. ARC paths are used to point to the location of the operating system loader or equivalent files. Switches can be added to the end of the ARC paths listed here, to determine the way operating systems load. Page SM D Copyright 2003 N+S training!

25 ARC Paths! Point to the System Files Location! Conventions! Multi! Scsi! Other Parameters! Disk! Rdisk! Partition ARC Paths ARC paths point to the location of the operating system files ie the boot partition, using identifiers for disk controllers, hard disks and partitions. ARC paths have two forms, Multi and SCSI. Examples of ARC paths are: multi(0)disk(0)rdisk(1)partition(3) scsi(0)disk(1)rdisk(0)partition(2) Copyright 2003 N+S training! SM D Page 7.25

26 Each component of an ARC path is described in the table below: Component multi(w) scsi(w) disk(x) rdisk(y) partition(z) Description This component indicates an identifier for the disk controller (that controls the disk upon which the boot partition resides). The scsi convention is used if the controller is a SCSI controller upon which the SCSI BIOS is not enabled. The multi convention is used in all other cases including SCSI controllers with the BIOS enabled. The value of w identifies the initialisation number of the controller ie the first controller to initialise is numbered first. Note Controller initialisation numbers are assigned from 0 upwards ie the first controller to initialise is numbered 0, the second 1 etc. This component identifies the SCSI ID of the disk (upon which the boot partition resides). This component is only relevant when the SCSI convention is used. The value of x is always set to 0 when the multi convention is used. Note SCSI IDs are assigned from 0 upwards. This identifies the number of the disk (upon which the boot partition resides), and is relevant only when using the multi convention. For the SCSI convention, the value of y is always 0. Note Disks are numbered from 0 upwards This identifies the number of the boot partition and is relevant when either convention is used. Note Partitions are numbered from 1 upwards. Primary (nonextended) partitions are numbered first, followed by logical drives within extended partitions. Page SM D Copyright 2003 N+S training!

27 ARC Path Examples IDE Controller or SCSI Controller (with SCSI BIOS) SCSI Controller (without SCSI BIOS) Multi (0) SCSI (0) Rdisk(0) Rdisk(1) Disk(0) Partition = 1 Partition = 2 Partition = 1 Boot Partition = 2 Partition = 3 Partition = 1 Partition = 2 Boot Partition = 3 ARC PATH = Multi(0)Disk(0)Rdisk(1)Partition(2) ARC PATH = SCSI(0)Disk(0)Rdisk(0)Partition(3) ARC Path Examples The above diagram shows two examples of ARC paths. The first shows a multi-disk system using an IDE controller and uses the Multi convention. The second shows a single disk system using a SCSI controller without the BIOS enabled and uses the SCSI convention. Note that: In the first example, the Rdisk parameter, rather than the Disk parameter is used. In the second example, the Disk rather than the Rdisk parameter is used. Copyright 2003 N+S training! SM D Page 7.27

28 Switches in the Boot.ini File! Basevideo! Fastdetect! Maxmem! Noguiboot! Sos Switches in the Boot.ini File The following switches can be added to the end of the ARC paths in the [operating systems] section of the Boot.ini file, to force Windows XP to boot with added functionality. /basevideo Windows XP will boot using the basic VGA video adapter. This is useful for troubleshooting problems with video drivers. /fastdetect This switch, with no further parameters, disables serial mouse detection on all COM ports, and is included on every ARC path by default. The addition on the parameter [comx,y,z] will disable serial mouse detection on all specified ports. /maxmem:n With this switch, Windows XP can be configured to use a specified amount of RAM. This is useful if a memory chip is suspected of being faulty. Page SM D Copyright 2003 N+S training!

29 /noguiboot The computer will boot without displaying the graphical boot status screen. /sos Forces the computer to display a list of device drivers as they load, and is useful when troubleshooting boot problems related to device drivers. /bootlog Enables the logging of all drivers and services loaded during the boot process and is a useful aid for troubleshooting startup problems. The resulting log file is called ntbtlog.txt, located in the operating system folder (Windows). Boot logging can also be enabled using the Startup Menu. /safeboot:startupoption This switch and parameter can force the computer to start in safe mode the equivalent of the Advanced Boot Options obtained by pressing F8 during the boot process. The parameter indicated by StartupOption determines which of the safe mode options are used to boot. Options include: Minimal Equivalent to Safe Mode. Network Equivalent to Safe Mode with Networking. Minimal (Alternate Shell) Equivalent to Safe Mode with Command Prompt. Copyright 2003 N+S training! SM D Page 7.29

30 Editing the Boot.ini File Editing the Boot.ini File If you need to change the default operating system or the timeout, it is best to use Control Panel Performance and Maintenance Tools System Advanced Startup and Recovery and then click Settings as shown above. To make other changes not available through the above method, the Boot.ini file can be edited directly, either by clicking the Edit button on the Settings screen, which will open the file directly, or by opening the file from the hard disk, using a simple text editor such as Notepad. The Boot.ini file is located directly under the root of the System partition usually drive C. Ensure that the Folder Options are set in such a way that system files are visible, locate the Boot.ini file, and double-click on it. It may be necessary to remove any system, hidden or read only attributes beforehand. Page SM D Copyright 2003 N+S training!

31 Circumstances Requiring Boot.ini Edits The boot.ini file may require editing under the following circumstances: New disks are added/removed, or new partitions created. These changes will affect the numbering in the ARC paths. The default location of the system files has changed. In other words, if the boot partition is no longer (or appears to be no longer) on the same partition indicated in the ARC path. This could occur if: The boot partition has been mirrored, the original disk has failed, and the mirror partition is now the boot partition. This will affect the numbers in the ARC paths. The system files have been physically moved to another partition or disk. For troubleshooting purposes, in order to add or change the switches. Note If the Boot.ini file is missing or corrupt, Ntldr will attempt to load Windows XP from the first partition on the first disk by default. Copyright 2003 N+S training! SM D Page 7.31

32 The Recovery Console! Recover from Boot Failures! Manipulate Services! Access files! Edit the Boot.ini! Copy from installation source! Format The Recovery Console The recovery console is a utility that allows an administrator to recover from boot failures, if none of the Advanced Boot Options solved the problem. The recovery console is essentially a command prompt-like interface, providing a set of command line utilities that can be used to troubleshoot a failure to boot. The Recovery Console enables the following: Enable/disable services. Reconfigure the start up behaviour of services. Access files and folders on partitions formatted with supported file systems. Display the Windows paths and arc paths to current Windows XP installations. Page SM D Copyright 2003 N+S training!

33 Run a series of commands from a text file, as if it were a batch file. Repair the boot sector and Master Boot Record. Add Windows XP installations to the Boot.ini file. Copy and/or extract system and other files from a floppy or CD. Format partitions. Manage files and folders create, copy delete etc. Change the simple attributes of files. The recovery console can be accessed from the bootable Windows XP Professional installation CD, or can be installed, which will result in it being added to the operating system choice list during startup. Copyright 2003 N+S training! SM D Page 7.33

34 Accessing and Using the Recovery Console Accessing and Using the Recovery Console Accessing the Recovery Console from the CD If the recovery console has not been installed, and the computer is experiencing problems with the boot process: 1 Insert the Windows XP Professional installation CD. 2 Restart the computer, and choose to boot from the CD ROM when prompted. 3 Allow the Setup program to copy files. 4 Hit the Enter key to continue with Setup. 5 Hit the R key to access the recovery console. 6 When prompted, choose an operating system installation. 7 When prompted, enter the password for the administrator account. Page SM D Copyright 2003 N+S training!

35 8 The result is a command prompt interface. 9 Type Help and then hit the Enter key to view a list of available commands. 10 After performing the necessary repairs, type Exit to exit the Recovery Console and restart the computer. Installing the Recovery Console To install the Recovery Console so that it is available as an option during the boot process: 1 Access the Windows XP installation source. This could be from a CD, hard disk location or a network share. 2 Type Winnt32.exe /cmdcons shown in the previous diagram. 3 When prompted, click the Yes button to confirm installation of the Recovery Console. 4 Allow Setup to copy the necessary files. 5 Click OK to the confirmation message. 6 The next time your computer is restarted, an additional option Microsoft Windows Recovery Console will be available on the operating system choice list. Using the Recovery Console It is important that only administrators or others with the appropriate skills use the Recovery Console. Changes made using the console could, if not performed correctly, permanently damage a system. The Recovery console can only be accessed using an account with administrative privileges. The following are situations when the Recovery Console can be used as a recovery tool. When a driver or service is starting, but prevents the startup process Use the disable Recovery Console command to prevent the service starting when the computer starts. Restart the computer and reconfigure the service to solve the problem. Copyright 2003 N+S training! SM D Page 7.35

36 Corrupt boot sector Use the fixboot Recovery Console command to overwrite the corrupt sector with a new one. Corrupt master boot record Use the fixmbr Recovery Console command to repair the MBR. Missing file The copy or extract Recovery Console commands can be used to extract or copy the missing file from another source such as a floppy disk or CD. Page SM D Copyright 2003 N+S training!

37 System Restore System Restore This utility is new to Windows XP Professional. It allows the system configuration to be rolled back to a previous point in time, known as a Restore Point. This rollback is extremely useful for troubleshooting problems that have occurred as a result of major configuration changes such as installation of a new driver. System Restore is achieved without affecting user data or user profiles, and is a reversible process. Restore Points A restore point is an earlier operable system configuration. Windows XP creates restore points automatically on a daily basis and when major changes occur, including configuration changes to some applications. It is also possible to create restore points manually, which is very useful when the system is about to be changed significantly. Copyright 2003 N+S training! SM D Page 7.37

38 Creating a Restore Point 1 Click Start All Programs Accessories System Tools System Restore. 2 Choose Create a restore point and then click Next. 3 Type a useful description for the restore point. Windows XP will automatically append the date and time to the description. 4 Click Create and then click Close. Restoring the System Using a Restore Point 1 Access the System Restore utility as in Step 1 above. 2 Choose to Restore my computer to an earlier time and then click Next. 3 Click on the required date on the displayed calendar. 4 Select the desired restore point and then click Next. 5 Review the summary window and then click Next to confirm and restart. 6 The system will then restart the computer, using the configuration indicated by the chosen restore point. Page SM D Copyright 2003 N+S training!

39 Automated System Recovery! Boot from installation CD! Press F2 when prompted! Insert ASR diskette when prompted! Disk will access System State backup Automated System Recovery The Automated System Recovery (ASR) process enables a computer system to revert to a previous state. This process requires the ASR floppy disk and the Windows XP installation CD, and should only be used as a final resort, if all other methods have failed. The system can only revert to the state it was in when the ASR disk and system backup were created. The process of creating an ASR disk and a backup of the system partition was covered in an earlier module. Copyright 2003 N+S training! SM D Page 7.39

40 Using ASR To use the ASR: 1 Boot the computer with the Windows XP Professional installation CD. 2 During the Text mode portion of Setup (when the screen is blue), press the F2 key when prompted to invoke the ASR process. Note This prompt occurs just after the prompt to press F6 to install SCSI devices, and does not appear for very long. If you miss it, restart from the CD and try again. 3 When prompted, insert the ASR floppy and hit any key to continue. Note The floppy contains some system state information and points to the location of the system backup that was created along with the ASR disk. 4 After some file copying, formatting and restarting, a message to continue with the ASR process will appear. Click Yes to confirm. 5 The system will then access the system backup and restore from it. It is highly recommended, particularly on critical systems, that ASR disks and system backups be created on a regular basis, and before making significant configuration changes. Page SM D Copyright 2003 N+S training!

41 Practical Mod. 7! Exercise 1 Observing Current Registry Values! Exercise 2 Invoking the LastKnownGood Configuration! Exercise 3 Observing Changed Registry Values Practical Mod. 7 The Boot Process In the following exercises, you will access the Windows XP Professional registry and observe the Control Set values. You will then make a minor configuration change to your display, and then re-boot your computer to invoke the Last Known Good configuration. Finally you will observe how this changes the Control Set values in the registry. Information Required You will need the following information in order to complete these exercises: The password assigned to the Administrator account. This was configured during the installation exercise and, unless indicated otherwise by your instructor is the word password. Copyright 2003 N+S training! SM D Page 7.41

42 Exercise 1 Observing Current Registry Values In this exercise, you will access the registry on your computer and observe the values of the Control Sets. You will then make a minor change to your desktop configuration. Action Access the Windows XP registry and note the values of the Select key under: HKEY_LOCAL_MACHINE\ SYSTEM Step-by-step Instructions 1 Click Start Run. 2 In the Open: box type regedt32 This opens the Windows XP Registry editor. 3 In the left-hand pane, expand HKEY_LOCAL_MACHINE 4 Expand SYSTEM. Note the list of Control Sets under the System key. 5 Click on Select. This displays the values of the Select subkey in the right-hand pane. 6 Make a note of the decimal equivalent values of: Current Default Failed LastKnownGood 7 Close the Registry editor. 8 Access the Properties of the Display and click the Settings tab. Page SM D Copyright 2003 N+S training!

43 9 Change the screen resolution to something noticeably different from your current resolution, and accept the change. Note If you are unable to change the resolution to one of your choice, do not accept the changes. Keep trying different resolutions until you find an acceptable one. Copyright 2003 N+S training! SM D Page 7.43

44 Exercise 2 Invoking the LastKnownGood Configuration In this exercise, you will restart your computer and invoke the LastKnownGood configuration. In doing so, your will observe how your computer s display settings revert to a previous configuration. Action Restart the computer and access the Advanced Options menu. Choose to invoke the Last Known Good configuration. When the computer restarts, log on and observe that the screen resolution has reverted back to the original setting. Step-by-step Instructions 1 Restart your computer. 2 During startup hit the F8 key to display the Advanced Options menu. If you miss any opportunity to invoke the Advanced Startup options do not log on to your computer. Instead, click Turn off computer at the logon screen and then choose restart. 3 When you have successfully invoked the Advanced Options menu, highlight Last Known Good Configuration (your most recent settings that worked) and then hit Enter. 4 Highlight your operating system from the menu (if applicable) and then hit Enter. 5 When the computer restarts, log on as administrator and observe that the screen resolution you changed in Step 9 has reverted back to the original settings. Page SM D Copyright 2003 N+S training!

45 Exercise 3 Observing Changed Registry Values In this exercise, you will access the registry and note how the values of entries under the Select key have changed as a result of invoking the LastKnownGood. Action Access the Windows XP registry and note the changed values of the keys under Select. Step-by-step Instructions 1 Open the Windows XP registry editor. 2 Locate and highlight the Select subkey you observed in Exercise 1. 3 In the right-hand pane, note the values of: Current Default Failed LastKnownGood 4 Compare these values to those noted in Exercise 1. Close the Registry Editor. Copyright 2003 N+S training! SM D Page 7.45

46 Review! The Boot Process! Registry Control Sets! Advanced Startup Options! The Boot.ini file! Use System Restore! Use Automated System Recovery Review 1 What files are required during the Windows XP boot phase? 2 What files are required during the Kernel Load phase of the boot process? 3 What files are required during the Kernel Initialisation phase of the boot process? Page SM D Copyright 2003 N+S training!

47 4 An error message indicating that the Ntldr file is missing appears when you switch on a computer onto which you recently installed the Recovery Console. How can you replace the missing file? 5 How is the recovery console installed after a Windows XP installation? 6 How is the Automated System Recovery process invoked? 7 The value of Current and Default in the Select subkey of the registry are each set to decimal value 2. The value of LastKnownGood is set to 3, and the value of failed is set to 1. What might this indicate about your computer? 8 A user has recently installed some new hardware and has reconfigured certain aspects of the display. The user is now experiencing problems, but does not know which of the changes caused the problems. How can you help this user? Copyright 2003 N+S training! SM D Page 7.47

48 Page left blank Page SM D Copyright 2003 N+S training!