724 Chapter 15 Performing System Recovery Functions Steps in the Boot Sequence 1. The boot sequence consists of the following steps: 2. For the initial boot loader phase, NTLDR switches the processor from real mode to 32-bit flat memory mode and starts the appropriate mini file system drivers. Mini file system drivers are used to support your computer’s file systems and include FAT16, FAT32, and NTFS. 3. For the operating system selection phase, the computer reads the BOOT.INI file. If you have configured your computer to dual-boot or multi-boot and Windows 2000 recognizes that you have choices, a menu of operating systems that can be loaded is built. If you choose an operating system other than Windows 2000, the BOOTSECT.DOS file is used to load the alternate operating system, and the Windows 2000 boot process terminates. If you choose a Windows 2000 operating sys- tem, the Windows 2000 boot process continues. 4. If you choose a Windows 2000 operating system, the NTDETECT.COM file is used to perform hardware detection. Any hardware that is detected is added to the Registry, in the HKEY_LOCAL_MACHINE key. Some of the hardware that NTDETECT.COM will recognize includes communication and parallel ports, the keyboard, the floppy disk drive, the mouse, the SCSI adapter, and the video adapter. 5. Control is passed to NTOSKRNL.EXE to start the kernel load process. Possible Errors during the Boot Sequence The following are some common causes for errors during the boot stage: Missing or corrupt boot files If NTLDR, BOOT.INI, BOOTSECT.DOS, NTDETECT.COM, or NTOSKRNL.EXE is corrupt or missing (by a virus or malicious intent), the boot sequence will fail. You will see an error message that indicates which file is missing or corrupt. You can restore these files through the ERD, which is covered later in this chapter. Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com Understanding the Windows 2000 Boot Process 725 The Kernel Load Sequence In the kernel load sequence, the Hardware Abstraction Layer (HAL), computer control set, and low-level device drivers are loaded. The NTOSKRNL.EXE file, which was described in the previous section, is used during this stage. 1. The kernel load sequence consists of the following steps: 2. The NTOSKRNL.EXE file is loaded and initialized. 3. The HAL is loaded. The HAL is what makes Windows 2000 portable to support platforms such as Intel and Alpha. 4. The control set that the operating system will use is loaded. The control set is used to control system configuration information, such as a list of device drivers that should be loaded. 5. Low-level device drivers, such as disk drivers, are loaded. If you have problems loading the Windows 2000 kernel, you will most likely need to reinstall the operating system. Improperly configured BOOT.INI file If you have made any changes to your disk configuration and your computer will not restart, chances are your BOOT.INI file is configured incorrectly. The BOOT.INI file is covered after the next sections about the boot process stages. Unrecognizable or improperly configured hardware If you have serious errors that cause NTDETECT.COM to fail, you should resolve the hardware problems. If your computer has a lot of hardware, remove all of the hardware that is not required to boot the computer. Add each piece of hardware one at a time and boot the computer. This will help you identify which piece of hardware is bad or is conflicting for a resource with another device. Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com 726 Chapter 15 Performing System Recovery Functions The Kernel Initialization Sequence In the kernel initialization sequence, the HKEY_LOCAL_MACHINE\HARDWARE Registry and Clone Control set are created, device drivers are initialized, and high-order subsystems and services are loaded. The kernel initialization sequence consists of the following steps: 1. Once the kernel has been successfully loaded, the Registry key HKEY_ LOCAL_MACHINE\HARDWARE is created. This Registry key is used to specify the hardware configuration of hardware components when the computer is started. 2. The Clone Control set is created. The Clone Control set is an exact copy of the data that is used to configure the computer and does not include changes made by the startup process. 3. The device drivers that were loaded during the kernel load phase are initialized. 4. Higher-order subsystems and services are loaded. If you have problems during the kernel initialization sequence, you might try to boot to the Last Known Good configuration, which is covered in the “Using Advanced Startup Options” section later in this chapter. The Logon Sequence In the logon sequence, the user logs on to Windows 2000 and any remaining services are loaded. 1. The logon sequence consists of the following steps: 2. After the kernel initialization is complete, the Log On to Windows dialog box appears. At this point, you type in a valid Windows 2000 username and password. 3. The service controller executes and performs a final scan of HKEY_LOCAL_ MACHINE\SYSTEM\CurrentControlSet\Services to see if there are any remaining services that need to be loaded. If logon errors occur, they are usually due to an incorrect username or password, or the unavailability of a domain controller to authenticate the request (if the computer is a part of a domain). See Chapter 4, “Managing Users and Groups,” for more information about troubleshooting user authentication problems. Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com Understanding the Windows 2000 Boot Process 727 Errors can also occur if a service cannot be loaded. If a service fails to load, you will see a message in Event Viewer. Using the Event Viewer utility is covered earlier in this chapter. Editing the BOOT.INI File The BOOT.INI file is located in the active partition and is used to build the boot loader menu and to specify the location of the Windows 2000 boot partition. It also specifies the default operating system that should be loaded if no selection is made within the default time allotment. You can open and edit this file to add switches or options that allow you to control how the operating system is loaded. Figure 15.5 shows a fairly common example of a BOOT.INI file, opened in Notepad. FIGURE 15.5 A sample BOOT.INI file The following sections describe the BOOT.INI ARC (Advanced RISC Computing; RISC stands for Reduced Instruction Set Computing) naming conventions and how to edit the BOOT.INI file. If you make changes to your disk configuration, you may see a message stating the number of the BOOT.INI file needs to be changed. This is the ARC number that points to the boot partition. If you try to restart your computer before you edit this file, you will find that the computer will not start. Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com 728 Chapter 15 Performing System Recovery Functions ARC Naming Conventions In the BOOT.INI file, the ARC path is used to specify the location of the boot partition within the disk channel. ARC names are made up of the information shown in Table 15.6. As an example, the BOOT.INI file shown in Figure 15.5 contains the following line: multi(0)disk(0)rdisk(0)partition(1)\WINNT= “Microsoft Windows 2000 Server” This indicates that the boot partition is in the following location: multi(0) is an IDE controller or a SCSI controller with the BIOS enabled. disk(0) is 0 since the multi option was used. rdisk(0) specifies that first disk on the controller is being used. TABLE 15.6 ARC Naming Conventions ARC Path Option Description multi (w) or scsi (w) Identifies the type of disk controller that is being used by the system. The multi option is used by IDE controllers and SCSI adapters that use the SCSI BIOS. The scsi option is used by SCSI adapters that do not use the SCSI BIOS. The number (w) represents the number of the hardware adapter you are booting from. disk (x) Indicates which SCSI adapter you are booting from if you use the scsi option. If you use multi, this setting is always 0. rdisk (y) Specifies the number of the physical disk to be used. In an IDE environment, it is the ordinal of the disk attached to the controller and will always be a 0 or a 1. On a SCSI system, this is the ordinal number of the SCSI drive. partition (z) Specifies the partition number that contains the operating system files. The first partition is always 1. Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com Understanding the Windows 2000 Boot Process 729 partition(1) specifies that the system partition is on the first partition. \WINNT indicates the folder that is used to store the system files. “Microsoft Windows 2000 Server” is what the user sees in the boot menu. BOOT.INI Switches When you edit your BOOT.INI file, you can add switches or options that allow you to control how the operating system is loaded. Table 15.7 defines the BOOT.INI switches. BOOT.INI File Access Because the BOOT.INI file is marked with the System and Hidden attributes, it is not normally seen through Windows Explorer or the DOS DIR command. The following sections explain how to modify the attributes of the BOOT.INI through Windows Explorer and the DOS ATTRIB command. Changing Attributes through Windows Explorer To access and change the BOOT.INI attributes through Windows Explorer, take the following steps: 1. Select Start Programs Accessories Windows Explorer. TABLE 15.7 BOOT.INI Switches Switch Description /basevideo Boots the computer using a standard VGA video driver. This option is used when you change your video driver and then cannot use the new driver. /fastdetect=comx Keeps the computer from auto-detecting a serial mouse attached to a serial port. /maxmem:n Specifies the maximum amount of RAM that is recog- nized. This option is sometimes used in test environ- ments where you want to analyze performance using different amounts of memory. /noguiboot Boots Windows 2000 without loading the GUI. With this option, a command prompt appears after the boot process ends. Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com 730 Chapter 15 Performing System Recovery Functions 2. In Windows Explorer, expand My Computer and right-click Local Disk (C:). 3. Select Tools Folder Options and click the View tab. 4. In the View dialog box, click the Show Hidden Files and Folders radio button, and uncheck the Hide File Extensions for Known File Types and Hide Protected Operating System Files (Recommended) check boxes, as shown in Figure 15.6. FIGURE 15.6 The View tab of the Folder Options dialog box 5. You see a dialog box with a warning about displaying protected operating system files. Click the Yes button to display these files. Then click the OK button. 6. You should now see the BOOT.INI file in the root of the C: drive. To change the file attributes, right-click the BOOT.INI file and select Properties. 7. The boot.ini Properties dialog box appears, as shown in Figure 15.7. Uncheck the Read-only attribute at the bottom of the dialog box and click the OK button. Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com Understanding the Windows 2000 Boot Process 731 FIGURE 15.7 The boot.ini Properties dialog box 8. Open the BOOT.INI file by double-clicking the file in Windows Explorer. 9. When you’re finished editing the BOOT.INI file, you should reset its file attributes by selecting Tools Folder Options View Restore Defaults. Changing Attributes through the ATTRIB Command The DOS ATTRIB command provides a quick way to access the BOOT.INI file. To use the ATTRIB command, take the following steps: 1. Select Start Programs Accessories Command Prompt. 2. In the Command Prompt dialog box, type ATTRIB and press Enter. You should see all of the files that reside at the root of C: and their current file attributes. 3. Type ATTRIB BOOT.INI –S –H and press Enter to remove the System and Hidden file attributes. 4. Type EDIT BOOT.INI and press Enter to execute the EDIT program and open the BOOT.INI file for editing. 5. When you’re finished editing the BOOT.INI file, choose File Save to save the file and File Exit to exit the EDIT program. 6. Reset the file attributes by typing ATTRIB BOOT.INI +S +H and pressing Enter. Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com 732 Chapter 15 Performing System Recovery Functions Creating the Windows 2000 Boot Disk After you create a Windows 2000 boot disk, you can use it to boot to the Windows 2000 Server operating system in the event of a Windows 2000 Server boot failure. You create a Windows 2000 boot disk through the following process: 1. Format a floppy disk through the Windows 2000 Server operating system. 2. Copy the following files from the Windows 2000 Server system partition: NTLDR NTDETECT.COM NTBOOTDD.SYS (if you use SCSI controllers with the BIOS dis- abled) BOOT.INI 3. Test the boot disk by using it to boot to Windows 2000 Server. If the BOOT.INI file for the computer has been edited, you will need to update the BOOT.INI file on your Windows 2000 boot disk. The BOOT.INI file on the Windows 2000 Server boot disk contains a specific configuration that points to the computer’s boot partition. This might keep a Windows 2000 boot disk that was made on one computer from working on another computer. In Exercise 15.2, you will create a Windows 2000 boot disk. EXERCISE 15.2 Creating a Windows 2000 Boot Disk 1. Put a blank floppy diskette in your floppy drive. 2. Select Start Programs Accessories Windows Explorer. 3. In Windows Explorer, expand My Computer, right-click 3 1 / 2 Floppy (A:), and select Format. Accept all of the default options and click the Start button. Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com Using Advanced Startup Options 733 Using Advanced Startup Options The Windows 2000 advanced startup options can be used to troubleshoot errors that keep Windows 2000 Server from successfully booting. 4. You see a dialog box warning you that all the data will be lost. Click the OK button. 5. When you see the Format Complete dialog box, click the OK button, then click the Close button to close the Format dialog box. 6. Select Start Programs Accessories Command Prompt. 7. In the Command Prompt dialog box, type ATTRIB and press Enter. You see all of the files at the root of the C: drive. Note the file attributes of the NTLDR, NTDETECT.COM, and BOOT.INI files. 8. Type ATTRIB NTLDR –S –H –R and press Enter. 9. Type COPY NTLDR A: and press Enter. 10. Type ATTRIB NTLDR +S +H +R and press Enter. 11. Repeat steps 8 through 10 for the NTDETECT.COM and BOOT.INI files, to remove the file attributes, copy the file, and replace the file attributes. If you have a SCSI adapter with the BIOS disabled, you will also need to copy the NTBOOTDD.SYS file. 12. Verify that all of the files are on the boot disk by typing DIR A:. 13. Type Exit to close the Command Prompt dialog box. 14. To test your Windows 2000 boot disk, select Start Shut Down Restart and click the OK button. 15. Label your Windows 2000 boot disk and put it in a safe place. Microsoft Exam Objective Recover System State and user data. Troubleshoot system restoration by starting in safe mode. EXERCISE 15.2 Copyright ©2000 SYBEX , Inc., Alameda, CA www.sybex.com [...]... Using the Windows 2000 Server Setup Boot Disks to install Windows 2000 is described in Chapter 1, “Getting Started with Windows 2000 Server. ” The Recovery Console and ERD are covered later in this chapter The Windows 2000 Server Setup Boot Disks are not specific to a computer They are general Windows 2000 Server disks, which can be used by any computer running Windows 2000 Server Copyright 2000 SYBEX... Chapter 15 Performing System Recovery Functions To create the Windows 2000 Server Startup disks, you need four high-density floppy disks Label them as follows: Windows 2000 Server Setup Boot Disk Windows 2000 Server Setup Disk #2 Windows 2000 Server Setup Disk #3 Windows 2000 Server Setup Disk #4 The command to create boot disks from Windows 2000 or Windows 9x is MAKEBT32.EXE The command to make boot disks... 15.6 Creating Windows 2000 Server Setup Boot Disks 1 Label each of your high-density floppy disks as follows Copyright 2000 SYBEX , Inc., Alameda, CA www.sybex.com Using the Backup Utility 743 EXERCISE 15.6 (continued) Windows 2000 Server Setup Boot Disk Windows 2000 Server Setup Disk #2 Windows 2000 Server Setup Disk #3 Windows 2000 Server Setup Disk #4 2 Insert the Windows 2000 Server CD into your... system is MAKEBOOT.EXE Setup disks created for Windows 2000 Server will not work with Windows 2000 Professional Setup disks created for Windows 2000 Professional will not work with Windows 2000 Server Once you have formatted and labeled your floppy disks, take the following steps to create the Windows 2000 Server Setup Boot Disks: 1 Insert the Windows 2000 Server CD into your CD-ROM drive 2 Select Start... Windows 2000 Server Setup Boot Disk The files will be copied 5 When prompted, insert Windows 2000 Server Setup Disks #2, #3, and #4 6 When you are finished creating the boot disks, place them in a safe location In Exercise 15.6, you will create Windows 2000 Server Setup Boot Disks This exercise requires four high-density floppy disks You also need the Windows 2000 Server CD EXERCISE 15.6 Creating Windows. .. can be accessed only by using the Windows 2000 Server Setup CD or the Windows 2000 Server Setup diskettes that are created from the CD Take the following steps to use an ERD: 1 Restart you computer using the Windows 2000 Server Setup Boot Disk 2 When prompted, insert the Windows 2000 Server Setup Disk #2, #3, and #4, pressing Enter after you insert each one Copyright 2000 SYBEX , Inc., Alameda, CA www.sybex.com... Recovery dialog box Creating Windows 2000 Server Setup Boot Disks Y ou can create floppy disks that can be used to boot to the Windows 2000 Server operating system in case your computer will not boot and will not read the CD-ROM drive These disks are called the Windows 2000 Server Setup Boot Disks From these diskettes, you can perform the following tasks: Reinstall the Windows 2000 Server operating system... four Windows Server Setup Boot Disks you created in Exercise 15.6 Copyright 2000 SYBEX , Inc., Alameda, CA www.sybex.com Using the Backup Utility 747 and the ERD you created in Exercise 15.7 You will also need the Windows 2000 Server CD EXERCISE 15.8 Restoring Your System with an Emergency Repair Disk 1 Restart your computer using the Windows 2000 Server Setup Boot Disk 2 When prompted, insert Windows. .. but really wanted to boot Windows 2000 normally Windows 2000 handles startup options in a slightly different way than Windows NT 4 does In Windows NT 4, the boot loader menu shows an option to load VGA mode, which appears each time you restart the computer In Windows 2000, this has been moved to the Advanced Options menu to present the user with a cleaner boot process Also, in Windows NT 4, you need to...734 Chapter 15 Performing System Recovery Functions To access the Windows 2000 advanced startup options, press the F8 key when prompted during the beginning of the Windows 2000 Server boot process This will bring up the Windows 2000 Advanced Options menu, which allows you to boot Windows 2000 with the following options: Safe Mode Safe Mode with Networking Safe Mode with Command . information quickly. Windows 2000 Server Setup Boot Disk Windows 2000 Server Setup Disk #2 Windows 2000 Server Setup Disk #3 Windows 2000 Server Setup Disk #4 2. Insert the Windows 2000 Server CD into. follows: Windows 2000 Server Setup Boot Disk Windows 2000 Server Setup Disk #2 Windows 2000 Server Setup Disk #3 Windows 2000 Server Setup Disk #4 The command to create boot disks from Windows 2000. chapter. The Windows 2000 Server Setup Boot Disks are not specific to a computer. They are general Windows 2000 Server disks, which can be used by any computer running Windows 2000 Server. EXERCISE