Chapter 20 - Preparing for and Performing Recovery
This chapter describes what you can do to:
There is no way to make a computer running Windows NT failure proof. You can only make the computer more failure resistant. A memory module, cabling, or controller failure can corrupt data on any disk. In this event, the only option is to restore from a tape or a backup server that contains a copy of the data.
These are some things that you can do to make it easier to recover from problems:
The topics covered in this chapter are:
This chapter also describes using utilities on the Windows NT Workstation Resource Kit CD and the Windows NT Workstation CD to back up and restore critical data. Planning what utilities to use is as important as knowing how to use them. There is more information about these utilities in Chapter 22, "Disk, File System, and Backup Utilities."
These are some points to consider:
Maintaining Configuration and Essential System Information
Hardware failures, power failures, and human errors can corrupt information that your computer needs to start Windows NT.
Recovery is easier if:
On computers running Windows NT Workstation, you can purchase disk subsystems that maintain redundant information on the disks. The redundant information is either parity information, or a complete, separate copy of the data. Having redundant information makes the disk subsystems fault tolerant, meaning that you can continue to access the data when one disk in a fault-tolerant configuration fails. This fault-tolerant technology is called RAID, for Redundant Array of Inexpensive Disks. A disk subsystem that implements fault tolerance using RAID technology is also called a RAID array.
For complete information about RAID, RAID terminology, and RAID arrays, see The RAIDbook, A Source Book for Disk Array Technology. The RAID Advisory Board in St. Peter, MN, publishes this book. The June 1995 edition is the basis for RAID information in this chapter.
Keeping a Log Book
You should have a log book for every computer, which contains information about the computer's configuration. Having current information makes it easier to rebuild your computer in the event of a serious system crash. This information also helps product support personnel to troubleshoot problems. The Registry contains information about your disk configuration in the subkeys HKEY_LOCAL_MACHINE \HARDWARE \DeviceMap \AtDisk and Scsi.
The type of information to keep includes:
Backing up the Registry
All of the Windows NT internal configuration information is stored in the Registry. It is critical to have up-to-date, reliable backups of this information. There are several ways to back up the all or part of the Registry, and you should have redundancy in this area.
If you have a backup device installed on your computer, you can include the Registry in normal backups. You have to specifically select this option in the Windows NT tape backup program Ntbackup.exe. Third-party Windows NT-compatible backup software might also require that you take specific action to back up the Registry. Be sure to test your Registry backup and restore procedures.
Note Windows NT Backup can only back up the Registry on the local system. You cannot use Windows NT Backup to back up a computer's Registry over the network.
After any change in the configuration of the operating system, including adding new software, you should use the Repair Disk program, Rdisk.exe, to update files in the %systemroot%\Repair folder, and create a new Emergency Repair Disk. For information about using the Repair Disk program, see "Creating an Emergency Repair Disk," presented later in this chapter. It is a good idea to make a copy of the Emergency Repair Disk and store it in a separate location, perhaps off site.
You can use the Windows NT Registry Editor, Regedt32.exe, to save and restore Registry keys.
The Windows NT Workstation Resource Kit CD contains utilities that enable you to back up and restore all or part of the Registry. For information about the Registry Backup (Regback.exe) and Registry Restore (Regrest.exe) utilities, see Rktools.hlp.
Saving the SYSTEM Key
The HKEY_LOCAL_MACHINE \SYSTEM key contains configuration information that Windows NT uses during startup. Even though this key is copied to the Emergency Repair Disk when you use the Repair Disk program, there are times that you might want to restore this key from another disk. For more information, see "Restoring the SYSTEM Key," presented later in this chapter.
You can save the SYSTEM key by using either Disk Administrator or the Windows NT Registry Editor (Regedt32.exe). The primary difference between these two methods is that the Disk Administrator always saves the key to a floppy disk, whereas you can specify any disk by using the Registry Editor.
Note The %systemroot%\System32\Config\System file is usually larger than the SYSTEM key saved by using Disk Administrator or Registry Editor. The smaller size results because the two programs compact the file before copying it to eliminate internal fragmentation and holes.
To use Disk Administrator to save the SYSTEM key
To use Registry Editor to save the SYSTEM key
Saving the DISK Subkey
The HKEY_LOCAL_MACHINE \SYSTEM \DISK subkey in the Registry contains configuration information about currently defined drive letters, volume sets, stripe sets, stripe sets with parity, and mirror sets, as well as CD-ROM mappings and drive mappings. Any time that you make changes to your disk configuration, Windows NT updates the DISK subkey. You should save this subkey whenever you make changes that affect it, such as:
Having a backup is useful in situations when you do not want to restore the entire Registry or the entire SYSTEM key, such as the following:
For example, if you have changed a SCSI controller, restoring the entire SYSTEM key might make it difficult to start the computer. Restoring the DISK subkey enables you to have current disk configuration information without changing anything else in the Registry.
Note The DISK subkey does not exist the first time that you start Windows NT Workstation. Disk Administrator creates the subkey the first time that you run it.
To use the Registry Editor to save the DISK subkey
Creating an Emergency Repair Disk
When you install Windows NT, Setup creates the Registry information in %systemroot%\System32\Config. For recovery purposes, Setup also creates a %systemroot%\Repair folder that contains the following files:
During installation, Windows NT Setup asks whether you want to create an Emergency Repair Disk. You should choose Yes. When you create an Emergency Repair Disk during installation, or later by using the Repair Disk program (Rdisk.exe), the files are copied from %systemroot%\Repair to the floppy disk. You can also use the Emergency Repair Disk to repair a corrupt Partition Boot Sector for the system partition.
When you run the Repair Disk program, you can update the %systemroot%\Repair\Software and %systemroot%\Repair\System files with the current information in %systemroot%\System32\Config by using the Update Repair Info button.
The Repair Disk program does not update the Default, Sam and Security files if you run the program from Windows NT Explorer or My Computer. To update all the files, you can run rdisk from the command prompt by entering:
You can also update all of the files by clicking the Start button, clicking Run, and entering:
Using the /s switch forces the Repair Disk program to update all of the Registry keys in the %systemroot%\Repair folder.
There are several points to consider about maintaining and using your Emergency Repair Disk:
For more information about creating an Emergency Repair Disk, see Help for the Repair Disk program. For more information about the %systemroot%\Repair and %systemroot%\System32\Config folders, and the Emergency Repair Disk, search the Knowledge Base. For information about the Knowledge Base, see Chapter 36, "General Troubleshooting."
Chapter 23, "Overview of the Windows NT Registry," contains more information about these keys and the %systemroot%\System32\Config folder.
Backing up the Master Boot Record and Partition Boot Sector
No operating system can protect itself from damage to these disk areas, which can be caused by viruses, faulty SCSI configurations, device driver problems, or power outages. You should back up the Master Boot Record on a disk every time you change partition information for primary partitions or an extended partition. You should back up a Partition Boot Sector when you format a volume, install Windows NT in the volume, or convert a volume from the FAT file system to the NTFS file system.
You can back up these disk sectors by using the Windows NT–based program, DiskProbe, or the MS-DOS-based program, DiskSave. Both of these utilities are on the Windows NT Workstation Resource Kit CD. The procedures for using DiskProbe and DiskSave are described in Chapter 22, "Disk, File System, and Backup Utilities."
If you have more than one hard disk, or more than one partition on a disk, you should back up every Master Boot Record and Partition Boot Sector. The Master Boot Record for the startup disk and the Partition Boot Sector for your system partition are the most critical. The ones for the other disks and volumes are not as critical to the startup process, but you might not be able to access files if the Master Boot Record for the disk or the Partition Boot Sector for the volume is not correct.
Chapter 21, "Troubleshooting Startup and Disk Problems," describes how to determine if you have a problem with one of these sectors.
Backing Up Data on Your Hard Disks
You should back up data on your hard disk(s) that are not available anywhere else. For example, you might not want to back up Windows-based application programs, because you can reinstall them. However, it might be faster to restore the application programs from a backup tape rather than reinstall them if you have to replace a disk.
You can use the Windows NT backup program, Ntbackup.exe, to back up the data to a cartridge tape. You can also back up to another computer, such as a file server or the disk on a computer that is shared by other users. If you back up to another computer, you should have your files included in the backup procedure for that computer.
Understanding ARC Pathnames
Advanced RISC Computing (ARC) naming conventions are a standard for identifying the location of a file or a program on a device such as a hard disk or a floppy disk. You must understand the ARC pathname conventions to be able to create paths to use to start the computer from the Windows NT startup floppy disk.
On x86-based computers, you use ARC pathnames to describe the location of the boot partition for each instance of Windows NT installed on the computer. On an x86-based computer, you can create alternate paths to the boot partition, as described in "Creating Alternate Boot Selections for an x86-based Computer," presented later in this chapter. The ARC path in the Boot.ini file appears in one of the following forms:
On RISC-based computers, you use ARC pathnames to describe the location of:
When you create a Windows NT startup floppy disk to use on a RISC-based computer, you need to modify the NVRAM to include the ARC path to the floppy disk. To create an entry for the Windows NT startup floppy disk, see the section titled "Creating Alternate Boot Selections for a RISC-based Computer," presented later in this chapter. On a RISC-based computer, only the scsi() syntax is used for hard disks. The boot selection has the following parts:
This is an example of a boot selection for a RISC-based computer:
This form of the ARC pathname, refered to as multi() in the rest of this chapter, is only used on x86-based computers. On Windows NT version 3.1, it was only valid for IDE, EIDE, and ESDI disks. In Windows NT version 3.5 and later it is valid for SCSI disks as well.
The multi() syntax indicates to Windows NT that it should rely on the system BIOS to load system files. This means that NTLDR, the boot loader for x86-based computers, will be using interrupt (INT) 13 BIOS calls to find and load Ntoskrnl.exe and any other files it needs to get the system running.
Note The term multi() syntax refers to the multi(W)disk(X)rdisk(Y)partition(Z) form of the ARC pathname.
The W, X, Y, and Z parameters have the following meaning:
W is the ordinal number of the controller, and should always be 0. X is not used for multi(), and is always 0. Y is the ordinal for the disk on the controller, and is always 0 or 1 for disks connected to the primary controller. The range is 0 through 3 for disks on a dual-channel EIDE controller. Z is the partition number. All partitions receive a number except for type 5 (Extended) and type 0 (unused) partitions. These numbers start at 1, as opposed to all other entries, which start with 0.
Theoretically, the multi() syntax could be used to start Windows NT from any disk on the computer. However, this would require that all disks be correctly identified through the standard INT 13 interface. But support for this varies from controller to controller, and most system BIOS only identify a single controller through INT 13.
For a configuration with IDE or EIDE disks, the multi() syntax works for up to four disks on the primary and secondary channels of a dual-channel controller. In a SCSI-only configuration, the multi() syntax works for the first two disks on the first SCSI controller (the controller whose BIOS loads first). When your computer has both SCSI and IDE disks, the multi() syntax works only for the IDE disks on the first controller.
The scsi() syntax is used for both RISC-based and x86-based computers, and is used in all versions of Windows NT. Using the scsi() syntax indicates that Windows NT needs to load a SCSI device driver and use that driver to access the boot partition.
Note The term scsi() syntax refers to the scsi(W)disk(X)rdisk(Y)partition(Z) form of the ARC pathname.
On an x86-based computer, the device driver is Ntbootdd.sys, which can be found in the root of the system disk (usually C:). It is a copy of the device driver for the disk controller in use. On a RISC-based computer, the driver is built into the firmware, as required by the RISC standards, so no file is required.
The W, X, Y and Z parameters have the following meaning when using the scsi() syntax:
W is the ordinal number of the controller as identified by the Ntbootdd.sys driver. X is the SCSI ID of the target disk. Y is the SCSI logical unit number (LUN) of the disk that contains the boot partition. Y will almost always be 0. Z is the partition number. All partitions receive a number except for type 5 (Extended) and type 0 (unused) partitions. These numbers start at 1, as opposed to all other entries, which start with 0.
When using scsi() syntax, the value of W depends upon Ntbootdd.SYS. Each SCSI device driver used in Windows NT has its own method of ordering controllers, although the controller order corresponds to the order that the BIOS on the controllers loads (if they are being loaded).
Additionally, if you have more than one SCSI controller, and they use different device drivers, you should only count the controllers that are controlled by Ntbootdd.sys when determining the value of the W parameter. For instance, if you have an Adaptec 2940 (which uses Aic78xx.sys) and an Adaptec 1542 (which uses Aha154x.sys), W will always be 0. What changes is the Ntbootdd.sys file:
Example ARC Pathnames
This section contains examples that you can use as a model. The first two examples are for ARC paths on x86-based computers. The last example is the boot entry on a DEC Alpha AXP 150 computer, and should be good for all RISC-based computers with similar disk configurations.
More Than One SCSI Controller on an x86-based Computer
This example for an x86-based computer has the following disks and controllers:
Each hard disk has a single, 1 GB primary partition. Partitions 1 and 2 are on the first 2940, partitions 3 and 4 are on the second 2940, and partitions 5 and 6 are on the 1542. These are the ARC paths that you would have in the Boot.ini file if each partition had a copy of Windows NT installed in a folder named Winnt:
For partitions 3 and 4, Ntbootdd.sys is a copy of Aic78xx.sys. For partitions 5 and 6, Ntbootdd.sys is a copy of Aha154x.sys. For partitions 1 and 2, you could also use the following paths:
provided that you had an Ntbootdd.sys file that was a copy of Aic78xx.sys. However, Windows NT Setup always use the multi() syntax for the first two SCSI disks.
Both EIDE and SCSI Controllers on an x86-based Computer
This example is for an x86-based computer with the following disks and controllers:
The three EIDE disks each have a single 1 GB partition. Partitions 1 and 2 are on the primary channel of the EIDE controller, and partition 3 is on the secondary channel.
The SCSI disk has four 1 GB partitions. Partitions 4, 5, 6 and 7 are on the SCSI disk. Each partition would have the following ARC paths in the Boot.ini file, assuming that each partition has Windows NT installed in the Winnt folder:
Loading Windows NT from partitions 4 through 7 requires that the Ntbootdd.sys file be a copy of Aic78xx.sys.
Boot Selection on a DEC Alpha AXP 150
On a RISC-based computer, all boot paths are defined in the NVRAM. When creating a new boot selection for a RISC-based computer, the firmware menus prompt you for the information to enter. There is an example for defining a boot selection in the section titled "Creating Alternate Boot Selections for a RISC-based Computer," presented later in this chapter.
The following example is a boot selection on a DEC Alpha AXP 150. The computer has a single hard disk at ID 0, which has a 4 MB system partition and a 396 MB boot partition. Windows NT is installed on the boot partition in a folder named Winnt and the OSLOADER folder is also named Winnt, although it is on the system partition. The boot selection has the following values:
Creating Floppy Disks for Starting Your Computer
For x86-based computers and RISC-based computers, you should create a floppy disk to use to start Windows NT if you cannot start up from the hard disk. For x86-based computers, you can also create a floppy disk that you can use to start MS-DOS if you cannot start Windows NT.
Creating each floppy disk requires two steps:
After you create the Windows NT startup floppy disk or the MS-DOS bootable floppy disk, run a virus scan program to make sure the disk is not infected. Lock the floppy disk after you finish running the virus scan. (Most floppy disks have a tab on their back side that you slide down to lock the disk. You cannot write on a floppy disk when the tab is in the locked position.)
You should test each disk before you have to use it. You should also be familiar with using the programs that you copy to the floppy disks.
Depending on your disk configuration and whether you are using an x86-based computer or a RISC-based computer, you might also have to create alternate boot selections to your Windows NT startup floppy disk. For a description of the ARC pathname conventions that you need to use in boot selections, see "Understanding ARC Pathnames," presented earlier in this chapter.
Whenever possible, you should use an ARC path created by Windows NT Setup during an installation. When in doubt, install a copy of Windows NT onto the disk that you want to use for the boot partition, and then copy that ARC path, changing the partition number and folder name as necessary.
Windows NT Startup Floppy Disk
You must format your Windows NT startup floppy disk when you are running Windows NT. You can use My Computer to format the floppy disk, or enter format a: at the command prompt. Both of these utilities copy the Windows NT Partition Boot Sector, which is required to load the Windows NT boot loader, to the floppy disk. Windows NT Help describes the procedure for formatting a floppy disk by using My Computer.
You can use the Windows NT startup floppy disk to start Windows NT in the following circumstances:
Note On x86-based computers, if the Partition Table in the Master Boot Record has been corrupted, especially if the information for the system partition or boot partition is all zeroes, you might not be able to start up by using the Windows NT startup floppy disk. If you have a current backup of the Master Boot Record, try starting MS-DOS from the MS-DOS bootable floppy disk, and use the DiskSave program to replace the Master Boot Record.
The files that you need to copy to the floppy disk normally have the Read Only, System, and Hidden attributes set. If the files have either the System or Hidden attribute set, they are not visible. You need to make the files visible before you can copy them.
To copy files to the Windows NT startup floppy disk
Files to Copy for an x86-based Computer
Copy the following files from the root folder of your system partition to the floppy disk you just formatted:
The Ntbootdd.sys file is a renamed copy of the SCSI device driver used on your Windows NT computer. For example, if you are using the Adaptec 1542B SCSI controller, copy Aha154x.sys to the floppy disk, and then rename it to Ntbootdd.sys. If Windows NT Setup created an Ntbootdd.sys in your root folder, just copy that file.
You can find the device driver name by:
Creating Alternate Boot Selections for an x86-based Computer
For Windows NT Workstation, you should not have to create alternate boot selections in your Boot.ini file. You might want to have other paths when you are reconfiguring disks. For instance, if you currently have a SCSI disk (with SCSI ID 0) and are adding an IDE disk to your configuration, the IDE disk must be the first one. If your SCSI disk has the BIOS enabled, and the boot partition is
multi(0)disk(0)rdisk(0)partition(1)\Winnt="Windows NT Workstation Version 4.0"
you should disable the BIOS on the SCSI controller and add a second entry of:
scsi(0)disk(0)rdisk(0)partition(1)\Winnt="Windows NT Workstation Version 4.0 SCSI disk"
Note If you had translation enabled when you low-level formatted the SCSI disk, you will not be able to access the disk after you disable the BIOS on the controller.
This second entry enables you to start Windows NT from the SCSI disk to use Disk Administrator to partition and format the IDE disk.
You might also want to create alternate boot selections for debugging purposes. In this case, you can add other entries to the Boot.ini file and append switches to the pathname, such as:
multi(0)disk(0)rdisk(0)partition(1)\Winnt="Windows NT Workstation Version 4.0" /sos /DEBUG
For more information about the switches, see:
The section "Understanding ARC Pathnames," presented earlier in this chapter, contains more information about the pathnames on the Boot.ini file.
Note The Boot.ini file has the Read Only attribute set by default. Remove this attribute before editing the file. Restoring the attribute is optional. Windows NT Setup sets the attribute to prevent accidental deletion.
Files to Copy for a RISC-based Computer
When you install Windows NT on a RISC-based computer, it creates a folder, such as \Os\Winnt40, that contains the Osloader.exe and Hal.dll files. On Alpha AXP–based computers, this folder also contains several files with the .pal extension. Some or all of these files might have the system, hidden, or read-only attributes set.
A Windows NT startup floppy disk for a RISC-based computer should have a folder tree identical to the RISC-based system partition. Therefore, you should create the \Os\Winnt40 folder on the floppy disk.
Copy the following files from the \Os\Winnt40 folder on your hard disk to the same folder on the floppy disk:
Creating Alternate Boot Selections for a RISC-based Computer
RISC-based computers start from the system firmware. You should define a boot selection in the NVRAM that points to a Windows NT startup floppy disk. You only need to use the Windows NT startup floppy disk if there is a problem with the system partition (the partition with OSLOADER). If you do not create a path to the floppy disk ahead of time, and you cannot access the system partition, you will have to create a path to the Windows NT startup floppy disk to be able to start the computer.
For more information about firmware menus, see "Using a RISC-based Computer's Boot Menu" in Chapter 19, "What Happens When You Start Your Computer."
Note There are three types of RISC-based computers: Alpha, MIPS, and PowerPC. The examples in this section are for an Alpha AXP–based computer. The firmware menus that you use to get to the configuration options can be different for MIPS and PowerPC computers.
Creating a Path to the Windows NT Startup Floppy Disk
Once you have created the Windows NT startup floppy disk, you need to create the path to it by using the Add a boot selection menu. These are the steps to get to that menu:
The following example shows creating a path to the Windows NT startup floppy disk. Be sure that the path to the Osloader.exe on the Windows NT startup floppy disk matches the path to Osloader.exe on the hard disk.
Note The right justified arrows (<----) in these examples indicate which selection was made, or the information that was entered.
Thursday, 03-07-96 11:18:43 AM Select a system partition for this boot selection: SCSI Bus 0 Hard Disk 0 Partition 1 New system partition <----------------------------------------- Enter location of system partition for this boot selection: Select Media: SCSI Hard Disk Floppy Disk <------------------------------------------------------ CD-ROM Enter floppy drive number: 0 <--------------------------------- Enter the osloader directory and name: \os\winnt40\osloader.exe <------- Is the operating system in the same partition as the osloader: Yes No <------------------------------------------------------------ Enter the location of os partition: Select Media: SCSI Hard Disk <--------------------------------------------------- Floppy Disk CD-ROM Enter SCSI bus number: 0 <------------------------------------- Enter SCSI ID: 2 <------------------------------------- Enter Partition: 2 <------------------------------------- Enter the operating system root directory: \winnt40 <---------- Enter a name for this boot selection: start from floppy disk <--------- Do you want to initialize the debugger at boot time: Yes No <-----------------------------------------------------------
Note The location of the operating system root folder and the values that you enter for the path to the partition on the SCSI disk depend on your system configuration. The SCSI bus number will usually be 0, but the SCSI ID can be anything from 0 to 6, although 2 is common.
After entering the data, you will be back at the Boot selections menu. Select Setup menu. On the Setup menu, select Supplementary menu, and save changes.
Using Alternate Boot Selections
When you have created alternate boot selections, you start an alternate one by selecting Boot an alternate operating system from the Boot menu. This example shows selecting the alternate operating system option.
ARC Multiboot Alpha AXP Version 3.5-11 Copyright (c) 1993 Microsoft Corporation Copyright (c) 1993 Digital Equipment Corporation Boot Menu: Boot Windows NT Server Version 4.0 Boot an alternate operating system <------------------------------- Run a utility Supplementary menu. . . Use the arrow keys to select, then press Enter. Seconds until auto-boot. Select another option to override: 9
If you have added a boot selections for the Windows NT startup floppy disk, as described earlier in this section, and select Boot an alternate operating system, you would see a screen like the following.
ARC Multiboot Alpha AXP Version 3.5-11 Copyright (c) 1993 Microsoft Corporation Copyright (c) 1993 Digital Equipment Corporation Boot Menu: start from floppy disk Boot Windows NT Workstation 4.0 (Default) Use the arrow keys to select, then press Enter.
Each time you create a new boot selection, it becomes the default selection. The preceding example shows the menu if you added a path to the Windows NT startup floppy disk after you had installed Windows NT Workstation 4.0. You should use the Rearrange boot selections menu to change the default boot selection back to the hard disk. See the section titled "Using a RISC-based Computer's Boot Menu ," in Chapter 19, "What Happens When You Start Your Computer," for information about managing boot selections.
MS-DOS Bootable Floppy Disk (x86-based Computers)
An MS-DOS bootable floppy disk is most useful if you have FAT partitions on your startup disk (the disk that contains the system partition that you use to start Windows NT).
Your MS-DOS bootable floppy disk contains the files that you need to start MS-DOS from the floppy disk. It also should contain utilities for examining the contents of disks, copying files, and creating and formatting partitions.
Note You must start the MS-DOS operating system to format the floppy disk that you will be using for your MS-DOS bootable floppy disk. Running format from the command prompt does not copy the correct Partition Boot Sector to the floppy disk.
To create an MS-DOS bootable floppy disk
Now that you have created floppy disks to use to start the computer, created an Emergency Repair Disk, and backed up the Master Boot Record and Partition Boot Sector, you should use the utilities and floppy disks to practice recovering from problems. Going through the recovery process will force you to be diligent about making backups (Emergency Repair Disk, Master Boot Record, Partition Boot Sector, and data). You will also have an idea as to how long doing each procedure should take.
You should have a computer that you can use to do the following:
If you have multiple disks in your configuration or have more than one installation of Windows NT, you should thoroughly test using your Windows NT startup floppy disk to start the computer from each boot partition. This is especially critical on x86-based computers when you have a configuration that has both SCSI and IDE or EIDI disks. Sometimes, when the multi() syntax works to start from a SCSI hard disk, you must modify the Boot.ini file on the Windows NT startup floppy disk to use the scsi() syntax.
Restoring Disk Information
If you have backed up the Registry, Master Boot Records, and Partition Boot Sectors, as recommended earlier in this chapter, you can recover from many disk and startup problems without having to reinstall Windows NT. This section describes using the floppy disks and tools to restart your computer and restore information.
One important thing that you can learn from testing is the best recovery procedure to use in a particular situation. For example, there are several methods that you can use to replace a Partition Boot Sector. You also want to learn when to use the Windows NT startup floppy disk to restart your computer, and when you have to use the repair process and the Emergency Repair Disk to replace files in order to start.
Starting Up by Using the Windows NT Startup Floppy Disk
Using the Windows NT startup floppy disk enables you to start up Windows NT so that you can troubleshoot the problem, recover from the problem, or just get the computer running again. Being able to restart the computer also enables you to finish the work that you need to get done now, and troubleshoot the problem later.
In a way, the Windows NT startup floppy disk is a troubleshooting tool. If you cannot start the computer by using the hard disk, and you can start by using the Windows NT startup floppy disk, the problem is probably one of the following:
Using the Emergency Repair Disk
If your system files, Registry information, or Partition Boot Sector are corrupt, and you are unable to start Windows NT by using the Last Known Good control set, you can use the Repair process in Windows NT Setup to restore your system so you can start up.
To repair a Windows NT installation, Setup needs either the configuration information that is saved on the %systemroot%\Repair folder or the Emergency Repair Disk created when you installed the operating system (or you created later by using the Repair Disk program).
You cannot repair all disk problems by using the Emergency Repair Disk. Your Emergency Repair Disk needs to match the version of Windows NT that you have installed on your computer. It also needs to have current configuration information. If you have more than one installation of Windows NT on your computer, you should have an Emergency Repair Disk for each installation. You should never use an Emergency Repair Disk from another computer.
To use the Emergency Repair Disk
Inspect Registry Files
The Repair process in Windows NT Setup is one of several ways that you can repair Registry keys. When you select Inspect Registry files, Setup provides you with a list of the Registry files that it can restore. It also warns you that restoring a Registry file can result in information being lost. These are the options:
[ ] SYSTEM (System Configuration) [ ] SOFTWARE (Software Information) [ ] DEFAULT (Default User Profile) [ ] NTUSER.DAT (New User Profile) [ ] SECURITY (Security Policy) and SAM (User Accounts Database) Continue (perform selected tasks)
Select the key(s) that you want to restore by entering an X between the brackets, such as:
[X] SYSTEM (System Information)
See "Creating an Emergency Repair Disk," presented earlier in this chapter, for information about how often to create the disk, and how to save the current keys.
Inspect Startup Environment
This option verifies that the Windows NT files in the system partition are the correct ones. If any of the files that are needed to start Windows NT are missing or corrupt, Repair replaces them from the Windows NT Workstation CD.
On x86-based computers, if Windows NT is not listed in the Boot.ini file, Repair adds a Windows NT option to the file. If there is no Boot.ini file, Repair creates one.
On a RISC-based computer, Repair inspects and repairs the startup information in the NVRAM.
Verify Windows NT System Files
This option uses a checksum to verify that each file in the installation is good and matches the file that was installed from the Windows NT Workstation CD. Repair uses the Setup.log file on the Emergency Repair Disk to determine what files were installed and their checksums. The repair process also verifies that files needed to start, such as NTLDR and Ntoskrnl.exe, are present and valid. To find out if one or more service packs need to be reinstalled, check Files.lst on each service pack. The Windows NT Workstation CD is required for this option.
When Repair determines that the file on the disk does not match what was installed, it displays a message that identifies the file and asks whether you want to replace it.
Inspect Boot Sector (x86-based Computers)
This option verifies that the Partition Boot Sector on the system partition still references NTLDR, and replaces it from the Emergency Repair Disk if it does not. The Repair process can only replace the Partition Boot Sector for the system partition on the first hard disk. The Repair process can also repair the Partition Boot Sector for the system partition on the startup disk.
If you have saved the Partition Boot Sector, you can also use the procedures described in "Replacing the Master Boot Record and the Partition Boot Sector," presented later in this chapter, to replace it.
Restoring Registry Information
There are several methods that you can use to restore Registry information.
Note Windows NT Setup and the Repair Disk program store Registry information on the Emergency Repair Disk in compressed format. If you decide to restore the key from the Emergency Repair Disk by using either Disk Administrator or the Registry Editor, you can uncompress the System._ file by using one of the expand utilities. See Chapter 22, "Disk, File System, and Backup Utilities."
Restoring the SYSTEM Key
You can use the procedures in this section to restore the SYSTEM key. Because the Emergency Repair Disk also contains this key, you would generally use these procedures only if:
To use this procedure, you need to have saved the information, following the procedures in the section titled "Saving the SYSTEM Key," presented earlier in this chapter.
To use Disk Administrator to restore the SYSTEM key
If you do not have a floppy disk that contains the current SYSTEM key, you can search for other Windows NT installations and restore the key from systemroot\System32\Config\System. In this case, the information might not match the configuration that you had been using.
To use Disk Administrator to search for and restore the SYSTEM key
See Chapter 36, "General Troubleshooting," for details about troubleshooting problems by using the SYSTEM key.
Restoring the DISK Subkey
Both the Repair Disk program and Disk Administrator save the DISK subkey with the other information that they save. You would use this procedure only if you do not have current information on either of these media or you cannot read them. You might also want to use this procedure in special situations to restore just the DISK subkey, such as having to move a stripe set from one computer to another when the first computer has failed.
If you have previously saved the DISK subkey by using the Registry Editor (see the section titled "Saving Registry Information," earlier in this chapter), then you can restore it.
To restore the DISK subkey
Replacing the Master Boot Record and the Partition Boot Sector
For information about determining if you have a problem with either of these disk sectors, and procedures for displaying them, see Chapter 21, "Troubleshooting Startup and Disk Problems." For information about the utilities that you can use to save, replace, and edit these disk sectors, see Chapter 22, "Disk, File System, and Backup Utilities."
Caution Be careful when you use the low-level disk editors described in this section. If you replace the wrong sector, or change individual bytes to the wrong data, you can make your problems far worse. You could destroy information that is needed by Windows NT, and your only option would be to reformat the partition or the entire disk.
Replacing the Master Boot Record
There are two problems that can occur in the sector containing the Master Boot Record:
On many x86-based computers, the fastest and simplest way to replace the Master Boot Record is to use an MS-DOS bootable floppy disk with the MS-DOS-based program Fdisk on it.
Caution Do not use Fdisk to replace the Master Boot Record if you are using a:
If you do not know whether you are using a program like this, you should not use this method.
To replace the Master Boot Record
If there is a Windows NT disk signature in the Master Boot Record, it is overwritten by the new Master Boot Record. Overwriting the disk signature is a problem only if the disk contains partitions or logical drives that are members of volume sets or stripe sets. You can safely overwrite the disk signature when the disk has no volume sets or stripe sets, because Disk Administrator writes a new disk signature the next time you run it.
Note The fdisk /mbr command requires MS-DOS 5.0 or later, and only works on the first hard disk on the computer.
If you have saved the Master Boot Record by using either DiskSave (x86-based computers only) or DiskProbe, you can use one of these utilities to replace the Master Boot Record. These utilities rewrite the entire sector, including the Partition Table. If you cannot start Windows NT from the hard disk, you can usually start the computer by using the Windows NT startup floppy disk if you want to use DiskProbe to replace the Master Boot Record.
If none of these methods are available to you, you can use a low-level disk editor to copy a good Master Boot Record from another disk to the startup disk (usually disk 0 on x86-based computers). Since the smallest disk write is a sector, when you copy the Master Boot Record from another disk, you are also copying the other disk's Partition Table, which is not valid for the current disk. Therefore, you must first write down the partition information in the Master Boot Record that you are going to replace, starting from 0x1BE. You have to manually reenter the Partition Table information in hex format into the newly copied sector.
If you can start Windows NT by using the Windows NT startup floppy disk, you can use DiskMap to print a map of the disk. When you have copied a Master Boot Record from another computer of the same type (for example, another computer made by the same manufacturer with the same models of disk controllers), use DiskProbe to enter the information for the Partition Table. For information about DiskMap and DiskProbe, see Chapter 22, "Disk, File System, and Backup Utilities."
After you have replaced the Master Boot Record, you should check that it is now correct. If the Master Boot Record is not correct after replacing it, there is either a hardware problem, such as incorrect SCSI termination, or (on x86-based computers) there is a virus in memory that is trapping INT 13 calls. You have to isolate and correct the problem that is corrupting the Master Boot Record.
Repairing the Partition Table
If you have not changed the Partition Table since you saved the Master Boot Record, replacing the Master Boot Record also replaces the Partition Table.
If you have made only minor changes to the Partition Table since you saved the Master Boot Record, you might be able to use the information on the backup to help you repair the Partition Table. For instance, if the only change you have made is to convert a partition from FAT to NTFS, just change the System ID byte from 06 to 07.
If your disk has more than one partition, and you did not save the Master Boot Record or write down the information, you might be able to reconstruct it. You can use DiskProbe to edit the Partition Table.
Note If you will have to completely rebuild your Partition Table, either because of corruption or you had to copy the Master Boot Record from another computer, it might be safer to completely rebuild your disk. In this case, you should back up all of your files to tape (or another computer), recreate and reformat the partitions on the hard disk, and restore the data. If the disk with the invalid Partition Table contains your system or your boot partition, you will probably have to use the Windows NT startup floppy disk to start your computer.
Replacing the Partition Boot Sector
There are several methods that you can use to replace the Partition Boot Sector.
If you have saved the Partition Boot Sector by using either the DiskProbe or the DiskSave program, you can replace the sector from the backup. This is the fastest way to replace the Partition Boot Sector.
For NTFS volumes, there is one other alternative. When you create or reformat an existing volume as an NTFS volume, the NTFS file system writes a duplicate of the Partition Boot Sector at the end of the volume (Windows NT version 4.0) or at the logical center of the volume (Windows NT 3.51 and earlier). You can use the Windows NT–based program DiskProbe to locate and copy this sector to the beginning of the volume. There are also third-party MS-DOS-based disk utilities that you can use to locate and copy this sector.
You might want to display the Partition Boot Sector to make sure it is now correct. Once you have copied the Partition Boot Sector to the first sector of the partition, you should be able to start Windows NT.
Restoring Windows NT Files on the System Partition
If any of the files that Windows NT installs on the system partition are missing or corrupt, you cannot start your computer. These are the files:
You can restore any of these files by using the Repair process and the Emergency Repair Disk. However, because you copied these files to your Windows NT startup floppy disk when you created it, you can use that disk to restore them.
To use the Windows NT startup floppy disk to restore system files
Using an Uninterruptable Power Supply
An Uninterruptable Power Supply (UPS) supplies power to a computer system in the event of a power fluctuation or complete power loss. The UPS has electronics built in that constantly monitor line voltages. If the line voltage fluctuates above or below predefined limits, or fails entirely, the UPS supplies power to the computer system from built-in batteries. The UPS converts the relatively low Direct Current (DC) battery voltage into the Alternating Current (AC) voltage required by the computer system. The changeover to batteries must take place very rapidly or the computer can lose data.
Most UPS devices are one of the following types:
UPS systems provide a hardware interface that can be connected to the computer. Using appropriate software, this interface enables an orderly handling of the power failure, including performing a system shutdown before the UPS batteries are depleted. Without such software, an orderly shutdown of the system is not possible without human intervention.
The most important consideration in selecting a UPS product is to use only hardware that is listed on the Windows NT 4.0 Hardware Compatibility List (HCL). Other items to consider are:
Windows NT has built-in UPS functionality that takes advantage of the special features that many UPS systems provide. These features ensure the integrity of data on the system and provide for an orderly shutdown of both the computer system and the UPS should a power failure last long enough that the UPS batteries become depleted. In addition, users connected to a computer running Windows NT Workstation can be notified that a shutdown will occur and new users are prevented from connecting to the computer. Finally, damage to the hardware from a sudden, uncontrolled shutdown can be prevented.
Some vendors also provide a user interface for configuring the UPS, which you can use instead of the one provided in Windows NT.
This section contains a general overview of the Windows NT UPS service and discusses configuring and using the UPS on a computer running Windows NT. To fully protect your network, you should also install UPSs on network devices such as routers, hubs, and bridges. For the best protection, install UPSs on the cables that connect your computer and modem, telephone, printer, and network equipment.
Configuring the UPS Service
Use the UPS option on Control Panel to configure the Windows NT UPS service. The following dialog box is displayed:
You need to specify the serial port that the UPS is installed on. The information that you enter in the other fields depends upon your specific UPS and how you want to use it.
When selecting the signals to use in the UPS Configuration group box, the interface voltages you specify are those that indicate an active state for the signal. In other words, if you select a negative interface voltage for the power failure signal, this means that the signal is normally positive and changes to negative when a power failure occurs.
If you want the UPS service to run a command file when a power failure occurs, select the Execute Command File check box and enter the name of the file. Windows NT terminates the command file if it does not complete its execution within 30 seconds. The command file should not contain a dialog box, since waiting for user input could exceed the 30 second requirement.
The command file must reside in your %systemroot%\system32 folder and have one of the following extensions:
If your UPS does not have a low battery signal, you need to set the fields in the UPS Characteristics group box. The documentation from your UPS vendor should specify the battery recharge rate.
At startup, the UPS service assumes that the battery has no charge. If the battery recharge rate is 100 minutes per minute of run time, the computer has to run for 100 minutes before Windows NT expects the battery to have one minute of life.
Signals Used by the UPS Service
Windows NT uses a serial (COM) port to connect to the UPS. Table 20.1 shows the signals that the Windows NT UPS service uses to communicate with the UPS, the associated pin numbers, and the function each signal provides to the UPS service. You need to know which of these signals your UPS supports so that you can configure the UPS service.
If you use a UPS service provided by your UPS vendor, the signals and their usage will probably be different than the signals that the Windows NT UPS service uses.
In the UPS Configuration group box, check the boxes that correspond to the signals that your UPS supports. For each of these signals, the UPS Interface Voltages (negative or positive) indicates the voltage present when that event occurs.
Low Battery Signal
When the UPS battery begins to run low, the UPS uses this signal to notify the UPS service.
When fully charged, UPSs typically deliver from five to 20 minutes of DC power after AC power has failed. If your UPS can detect when the battery is running down, you should check the low battery signal box in the UPS Configuration group box.
If you do not check the low battery signal box, the UPS service uses the information in the UPS Characteristics group box to estimate how much time remains on the battery after a power failure.
Remote UPS Shutdown
You want to conserve the life of the UPS battery for as long as possible. The UPS service uses the UPS Shutdown signal to notify the UPS that Windows NT has completed its orderly shutdown and that the UPS can shut off power to the computer.
Power Failure Signal
The power failure signal is generated by the UPS to signal the UPS service that a power failure has occurred. The Windows NT processing that occurs when it receives this signal depends upon whether the UPS can send a low battery signal.
If the UPS can send a low battery signal:
If the UPS cannot send a low battery signal:
Using the UPS Service
You should use the following Windows NT services in combination with the Windows NT UPS service:
The Alerter service sends alerts to selected users. The Messenger service sends messages to your local computer and to other users on the network who are running Windows NT. All detected power fluctuations and power failures are recorded in the event log, along with UPS service start failures and shutdown initiations.
If you want the UPS service to start each time you start your computer, you need to modify the startup information.
To start the UPS service automatically
You might need to use the preceding procedure to set the other services to start automatically.
Testing the UPS
When the UPS service is started, it verifies the settings in the UPS dialog box by ensuring that the signal polarity on the CTS and DCD pins is opposite to that specified as the failure condition in the UPS dialog box. For example, if the UPS dialog box specifies that the UPS device supports a Power Failure Signal (CTS pin) with a positive signal, the UPS service checks to make sure that this pin is not already asserted positive (which would not happen unless you had started the system during a power failure).
This has some important implications. With an online UPS, the UPS device might shut itself off immediately if the configuration is incorrect. With a standby UPS, an incorrect configuration typically shuts the UPS device off as soon as a power failure is detected, effectively circumventing the purpose of the UPS. This is why it is important to configure and test your UPS device to ensure that it operates correctly.
On x86-based computers, there is one other reason that it is important to test your UPS. During startup, Windows NT sends a detection signal to each port in order to recognize hardware attached to that port. Some UPS units using serial monitoring implementations respond to the detection signal by turning off. If this happens, use the /NoSerialMice switch in the Boot.ini file to prevent the system from sending this signal to the COM port to which your UPS unit is connected.
You can use multiple /NoSerialMice switches. The format is:
/NoSerialMice=[COMx | COMx,COMy,COMz,...]
To ensure that the computer is protected from power failures, you can test it by simulating a power failure (that is, by disconnecting the main power supply to the UPS device). Your computer and peripherals connected to the UPS device should remain operational, and messages should be displayed and events logged. Wait until the UPS battery reaches a low level to verify that a graceful shutdown occurs. Restore the main power to the UPS device, and check the event log to ensure that all actions were logged and that there were no errors.
Note Before you begin any UPS tests, make sure that your UPS has sufficient charge built up to run all of the devices connected to it for at least the duration of the test.
Simulating UPS Operation
The next figure shows a simple simulator that you can build to emulate the power failure and low battery signals from a UPS.
Figure 20.1 UPS Simulator
Note The pins numbers in the diagram are for a 9-pin serial port. For a 25-pin connector, use the pin numbers in parenthesis.
You can use two Single Pole Double Throw (SPDT) switches to construct the UPS simulator. To simulate normal operation, set both switches 1 and 2 to make contact with pin 7 (pin 4 on a 25-pin connector). Set both the Power failure signal and Low battery signal at least 2 minutes before shutdown to Negative in the UPS dialog box.
To simulate a power failure, move switch 1 to make contact with pin 3 (pin 2 on a 25-pin connector). Moving switch 2 to make contact with pin 3 simulates a low battery condition.
Simulating Power Failure and Low Battery Signals
To simulate the operation of a UPS with both a Power Failure and Low Battery signal, have both switches making contact with pin 7. Configure your UPS as shown in this dialog box:
Flip switch 1 to simulate a Power Failure signal. After five seconds, the initial warning message should be displayed. Every 120 seconds, the warning message should be displayed again.
When you know that the Power Failure signal processing is working correctly, flip switch 2. If you have checked the Execute Command File check box and specified a filename, the file should begin execution immediately. If the file does not finish executing within 30 seconds, Windows NT should terminate it. Windows NT should perform an orderly shutdown after the file terminates or immediately after the Power Failure signal if no file is specified.
Simulating UPS With Power Failure Signal Only
To simulate the operation of a UPS with only a Power Failure signal, have both switches making contact with pin 7. For purposes of this test, you can set the values in the UPS Characteristics group box to make it seem that your computer does not have to run very long before the battery is fully charged. When you set the values this way, you have to make sure that your battery does have enough charge to be able to complete the tests. For instance, if you set the values as shown in this dialog box, and let your computer run for 20 minutes, the UPS service assumes that the battery is fully charged.
You can test two scenarios with this configuration: