Chapter 21 - Troubleshooting Startup and Disk Problems
| Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist. |
This chapter discusses what you can do to find the cause of problems when your computer fails to complete startup. Failure to complete startup means that the computer stops or displays an error message before you can log on to Windows NT. This chapter also discusses causes of and recovery from disk problems.
There are several utilities that you can use to troubleshoot these kinds of problems. The Windows NT Workstation Resource Kit CD contains a Windows NT-based utility, DiskProbe, that you can use to examine and change information on individual disk sectors. Chapter 22, "Disk, File System, and Backup Utilities," contains more information about DiskProbe and the MS-DOS-based utilities that you can use to read, write, and change information on disk sectors.
Other Sources of Information
.gif "Cc751278.spacer(en-us,TechNet.10).gif")
There are several other sources of information for troubleshooting startup and disk problems:
Chapter 23, "Overview of the Windows NT Registry," describes how to use information in the Registry for troubleshooting and configuration maintenance.
Chapter 25, "Configuration Management and the Registry," provides problem solving techniques using the Registry.
Chapter 36, "General Troubleshooting," contains details about Microsoft's sources for troubleshooting information and contains more details about troubleshooting hardware, software, and startup problems.
Chapter 39, "Windows NT Debugger," describes the different kinds of Kernel STOP errors that you might see during startup. It also contains information about using the Windows NT Debugger.
Windows NT online help contains a troubleshooting topic.
The Microsoft Knowledge Base contains support information developed by Microsoft Product Support Specialists. The Windows NT Knowledge Base is included on the Windows NT Workstation Resource Kit CD. It is also included on the:
Microsoft Developer Network (MSDN) CD
TechNet CD
Microsoft Internet FTP host, ftp.microsoft.com
Technical Support and Services category on the Web page at https://www.microsoft.com/ntworkstation
Troubleshooting Startup Problems on x86-based Computers
There are several things that can prevent a computer from successfully completing startup. The first step in figuring out what may be causing a problem is to determine whether the problem is occurring before the operating system takes control. If you do not see the boot loader screen on an x86-based computer, the problem may be due to a hardware failure, the Master Boot Record, Partition Tables, or the Partition Boot Sector, which might be damaged.
There are several ways such damage can happen, including viruses. On x86-based computers, viruses use BIOS interrupt (INT) 13 calls to install themselves, so they are operating-system independent. Windows NT traps BIOS INT 13 calls while it is running, but cannot protect itself when the computer is started from an MS-DOS bootable floppy disk or is dual-booted by using MS-DOS. The Knowledge Base contains several articles about protecting your computer from viruses and recovering from problems with viruses.
If the problem occurs after selecting Windows NT from the boot loader screen, files that are needed by the operating system might be missing or corrupt.
If you have installed new hardware or new drivers, they could be causing the problem.
Problem Occurs Before the Boot Loader Starts
This section describes the problems that might occur between the time you turn the computer on until you see the boot loader screen.
Symptoms of problems in this group are:
The computer hangs immediately after the Power On Self Test (POST).
You do not see the boot loader screen.
You receive messages such as:
Missing operating system.
A disk read error occurred.
Insert a system diskette and restart the system.
Invalid Partition Table.
Hard Disk Error.
Hard Disk Absent/Failed.
It is possible that you will not be able to start your computer to troubleshoot the problem. If all of your volumes are NTFS, using MS-DOS-based utilities will not do much good. If you have created a Windows NT startup floppy disk, as described in Chapter 20, "Preparing for and Performing Recovery," you can trying using that disk. If you cannot start the computer by using your Windows NT startup floppy disk, and repairing your system by using the Emergency Repair Disk does not fix the problem, you can try removing it from the computer and installing it as a second disk on another Windows NT computer. You can then use Windows NT-based utilities for troubleshooting.
Caution Moving disks between computers is not supported because of problems that can arise when the disk controllers on the two systems are incompatible or are configured differently. However, if your two computers are configured the same, you might be able to identify and correct the problem.
The problem could be one of the following:
There is no system partition on the first hard disk.
The Master Boot Record is corrupt.
The Partition Boot Sector is corrupt.
The Boot.ini file is missing.
The Windows NT boot loader, NTLDR, is missing or corrupt.
The Complementary Metal Oxide Semiconductor (CMOS) is corrupt, or the CMOS battery is run down.
Hardware has malfunctioned.
Troubleshooting System Partition Problems
When you startup from the hard disk on x86-based computers, the system BIOS code identifies the startup disk (usually disk 0), and reads the Master Boot Record. The code in the Master Boot Record searches for a system partition on the hard disk. If it cannot find such a system partition, or cannot start Windows NT from it, the startup process stops. If you get an error message such as "Error loading operating system," then the Master Boot Record code found a system partition, but could not start the operating system.
It is possible that there is no system partition on the hard disk from which you want to startup the computer. You might also have the wrong partition identified as the system partition. You can use the MS-DOS-based utility Fdisk to look at the partition information. For information about other utilities that have similar functionality, see Chapter 22, "Disk, File System, and Backup Utilities."
Note The system partition is the primary partition on the startup disk (usually disk 0) that has the Boot Indicator field set to 0x80. It contains the files that are needed to load Windows NT, such as Boot.ini and NTLDR.
Fdisk refers to the system partition as the active partition.
To use Fdisk to check for and set the system partition
Start MS-DOS, or start from an MS-DOS startup floppy disk that contains the Fdisk utility. Type fdisk.
Fdisk displays the following message if there is no system partition on your first hard disk:
WARNING! No partitions are set active - disk 1 is not startable unless a partition is set active.
The FDISK Options screen has several choices. The cursor will be on "Enter choice." Type 2 (Set Active partition). Fdisk displays information about the partitions on the hard disk. One partition should have an A in the Status column, which indicates it is the (active) system partition.
If there is no system partition, or the wrong partition is set as the system partition, enter the number of the partition that contains the files to use when loading the operating system. Fdisk displays the message "Partition X made active," where X is the partition number you entered.
Press ESC to return to the FDISK Options screen, and press ESC again to exit Fdisk. You can now restart the computer. Be sure to remove the floppy disk.
Not all computers should be set to start from the first partition. For instance, you can configure multiple partitions and install different operating systems on each partition. Some computers have EISA configuration partitions, and normally start from the second physical partition. For example, many Compaq computers are configured this way. However, the system partition should always be on your first physical hard disk.
Troubleshooting Master Boot Record Problems
This section describes troubleshooting Master Boot Record problems. The section titled "Master Boot Record," in Chapter 17, "Disk and File System Basics," contains details about the Master Boot Record.
The functions of the Master Boot Record code are to:
Read the Partition Table entries in the same sector.
Determine the location of the Partition Boot Sector.
Load and execute the code in the Partition Boot Sector.
If the executable code in the Master Boot Record does not do these functions, it displays one of these error messages:
Missing operating system.
Invalid Partition Table.
Note There is a Master Boot Record on each hard disk. However, only the Master Boot Record on the first hard disk is used in starting Windows NT.
Use DiskProbe or an MS-DOS-based utility to display the Master Boot Record. The example here shows what you should see at Cylinder 0, Side 0, Sector 1, which is the location for the Master Boot Record. This example shows the executable code in a Master Boot Record. This example might not match the code in the Master Boot Record on your computer, because some third-party boot and disk partitioning utilities modify the code in the Master Boot Record.
Physical Sector: Cyl 0, Side 0, Sector 1 00000000: 00 33 C0 8E D0 BC 00 7C - 8B F4 50 07 50 1F FB FC .3.....|..P.P.. 00000010: BF 00 06 B9 00 01 F2 A5 - EA 1D 06 00 00 BE BE 07 ................ 00000020: B3 04 80 3C 80 74 0E 80 - 3C 00 75 1C 83 C6 10 FE ...<.t..<.u..... 00000030: CB 75 EF CD 18 8B 14 8B - 4C 02 8B EE 83 C6 10 FE .u......L....... 00000040: CB 74 1A 80 3C 00 74 F4 - BE 8B 06 AC 3C 00 74 0B .t..<.t.....<.t. 00000050: 56 BB 07 00 B4 0E CD 10 - 5E EB F0 EB FE BF 05 00 V.......^....... 00000060: BB 00 7C B8 01 02 57 CD - 13 5F 73 0C 33 C0 CD 13 ..|...W.._s.3... 00000070: 4F 75 ED BE A3 06 EB D3 - BE C2 06 BF FE 7D 81 3D Ou...........}.= 00000080: 55 AA 75 C7 8B F5 EA 00 - 7C 00 00 49 6E 76 61 6C U.u.....|..Inval 00000090: 69 64 20 70 61 72 74 69 - 74 69 6F 6E 20 74 61 62 id partition tab 000000A0: 6C 65 00 45 72 72 6F 72 - 20 6C 6F 61 64 69 6E 67 le.Error loading 000000B0: 20 6F 70 65 72 61 74 69 - 6E 67 20 73 79 73 74 65 operating syste 000000C0: 6D 00 4D 69 73 73 69 6E - 67 20 6F 70 65 72 61 74 m.Missing operat 000000D0: 69 6E 67 20 73 79 73 74 - 65 6D 00 00 80 45 14 15 ing system...E.. 000000E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000100: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000110: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000120: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000130: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000140: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000150: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000160: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000170: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000180: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000190: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000001A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000001B0: 00 00 00 00 00 00 00 00 - FD 4E F2 14 00 00 80 01 .........N...... 000001C0: 01 00 06 0F 7F 96 3F 00 - 00 00 51 42 06 00 00 00 .....?...QB.... 000001D0: 41 97 07 0F FF 2C 90 42 - 06 00 A0 3E 06 00 00 00 A....,.B...>.... 000001E0: C1 2D 05 0F FF 92 30 81 - 0C 00 A0 91 01 00 00 00 .-....0......... 000001F0: C1 93 01 0F FF A6 D0 12 - 0E 00 C0 4E 00 00 55 AA ...........N..U.
There are two things that you can check in the Master Boot Record:
The error message text should be as shown in the example.
There should be only zeroes between the text "Missing operating system" and location hex 1B8.
A disk signature might or might not be present starting at location 1B8. Having no disk signature does not necessarily indicate a problem.
To use DiskProbe to display the Master Boot Record
Click the DiskProbe icon in the Resource Kit folder.
On the Drives menu, click Physical Drive. The Available Physical Drives are listed as PhysicalDrivex, where x=0 for the first hard disk. Double click the disk that contains the Master Boot Record used to start the computer. In the case of an x86-based computer, this disk is usually PhysicalDrive0.
In the Handle 0 group box, click Set Active. Click OK.
On the Sectors menu, click Read. Set Starting Sector to 0 and Number of Sectors to 1. Click Read.
Troubleshooting Partition Boot Sector Problems
Several known viruses can cause problems with the Partition Boot Sector, even if the volume is formatted with the NTFS file system. Infection can occur by running an MS-DOS-based program from either a floppy disk or by starting up MS-DOS on a dual-boot computer. Most viruses use BIOS INT 13 calls to transfer themselves to an absolute sector on the disk. Windows NT cannot protect itself from this type of infection when it is not running.
In some cases, the damage to the Partition Boot Sector can cause the computer to stop after displaying a blue screen with the message STOP 0x0000007B INACCESSIBLE_BOOT_DEVICE. Another symptom of a Partition Boot Sector problem is that the computer stops before displaying any messages, and the screen remains black.
To use DiskProbe to display the Partition Boot Sector
Use the DiskProbe procedure in "Troubleshooting Master Boot Record Problems," presented earlier in this chapter, to read the Master Boot Record, which contains the Partition Table.
On the View menu, click Partition table. In the Partition table index list box, double click the partition number whose Partition Boot Sector you want to read.
Click the Go button next to Relative Sector.
On the View menu, click Bytes to see a display of the Partition Boot Sector in hex. Otherwise, click NTFS BootSector or FAT BootSector to see a formatted display of the information.
Because the Partition Boot Sector contains several fields that are computer-specific, every byte in your Partition Boot Sector will not be identical to the information shown in the examples here. The following information should be the same:
The first three bytes should be the jump instruction.
The next 11 bytes should be the OEM header string.
There should be error message text toward the end of the sector.
These examples show portions of the Partition Boot Sector that should be the same or contain similar text on all computers. The first example is for a FAT volume, the second one is for an NTFS volume formatted when running Windows NT 3.5, and the third one is for an NTFS volume formatted when running Windows NT 4.0.
00000000: EB 3C 90 4D 53 44 4F 53 - 35 2E 30 00 02 08 01 00 .<.MSDOS5.0..... 00000180: 90 A2 07 02 F8 CB 42 4F - 4F 54 3A 20 43 6F 75 6C ......BOOT: Coul 00000190: 64 6E 27 74 20 66 69 6E - 64 20 4E 54 4C 44 52 0D dn't find NTLDR. 000001A0: 0A 00 42 4F 4F 54 3A 20 - 49 2F 4F 20 65 72 72 6F ..BOOT: I/O erro 000001B0: 72 20 72 65 61 64 69 6E - 67 20 64 69 73 6B 0D 0A r reading disk.. 000001C0: 00 50 6C 65 61 73 65 20 - 69 6E 73 65 72 74 20 61 .Please insert a 000001D0: 6E 6F 74 68 65 72 20 64 - 69 73 6B 00 4E 54 4C 44 nother disk.NTLD 000001E0: 52 20 20 20 20 20 20 00 - 00 00 00 00 00 00 00 00 R ......... 000001F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA ..............U. 00000000: EB 5B 00 4E 54 46 53 20 - 20 20 20 00 02 01 00 00 .[.NTFS ..... 00000130: F2 C3 1D 00 41 20 64 69 - 73 6B 20 72 65 61 64 20 ....A disk read 00000140: 65 72 72 6F 72 20 6F 63 - 63 75 72 72 65 64 2E 0D error occurred.. 00000150: 0A 00 29 00 41 20 6B 65 - 72 6E 65 6C 20 66 69 6C ..).A kernel fil 00000160: 65 20 69 73 20 6D 69 73 - 73 69 6E 67 20 66 72 6F e is missing fro 00000170: 6D 20 74 68 65 20 64 69 - 73 6B 2E 0D 0A 00 25 00 m the disk....%. 00000180: 41 20 6B 65 72 6E 65 6C - 20 66 69 6C 65 20 69 73 A kernel file is 00000190: 20 74 6F 6F 20 64 69 73 - 63 6F 6E 74 69 67 75 6F too discontiguo 000001A0: 75 73 2E 0D 0A 00 33 00 - 49 6E 73 65 72 74 20 61 us....3.Insert a 000001B0: 20 73 79 73 74 65 6D 20 - 64 69 73 6B 65 74 74 65 system diskette 000001C0: 20 61 6E 64 20 72 65 73 - 74 61 72 74 0D 0A 74 68 and restart..th 000001D0: 65 20 73 79 73 74 65 6D - 2E 0D 0A 00 00 00 00 00 e system........ 000001E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000001F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA ..............U. 00000000: EB 5B 90 4E 54 46 53 20 - 20 20 20 00 02 01 00 00 .[.NTFS ..... 00000130: 07 00 CD 10 EB F2 C3 1D - 00 41 20 64 69 73 6B 20 .........A disk 00000140: 72 65 61 64 20 65 72 72 - 6F 72 20 6F 63 63 75 72 read error occur 00000150: 72 65 64 2E 0D 0A 00 29 - 00 41 20 6B 65 72 6E 65 red....).A kerne 00000160: 6C 20 66 69 6C 65 20 69 - 73 20 6D 69 73 73 69 6E l file is missin 00000170: 67 20 66 72 6F 6D 20 74 - 68 65 20 64 69 73 6B 2E g from the disk. 00000180: 0D 0A 00 25 00 41 20 6B - 65 72 6E 65 6C 20 66 69 ...%.A kernel fi 00000190: 6C 65 20 69 73 20 74 6F - 6F 20 64 69 73 63 6F 6E le is too discon 000001A0: 74 69 67 75 6F 75 73 2E - 0D 0A 00 33 00 49 6E 73 tiguous....3.Ins 000001B0: 65 72 74 20 61 20 73 79 - 73 74 65 6D 20 64 69 73 ert a system dis 000001C0: 6B 65 74 74 65 20 61 6E - 64 20 72 65 73 74 61 72 kette and restar 000001D0: 74 0D 0A 74 68 65 20 73 - 79 73 74 65 6D 2E 0D 0A t..the system... 000001E0: 00 17 00 5C 4E 54 4C 44 - 52 20 69 73 20 63 6F 6D ...\NTLDR is com 000001F0: 70 72 65 73 73 65 64 2E - 0D 0A 00 00 00 00 55 AA pressed.......U.
Although other corruption problems are possible, if any of the strings are incorrect or missing, you should assume the sector is corrupt.
Even if there is no obvious damage, the Partition Boot Sector might not be working correctly. One way to check for this problem is to change the name of NTLDR to anything else and restart Windows NT from the hard disk.
You should see this error message on a FAT primary partition:
Couldn't find NTLDR.
You should see this error message on an NTFS primary partition:
A kernel file is missing from the disk.
These errors indicate that the Partition Boot Sector is okay and that the problem is with a corrupt NTLDR file. In this case, see "Replacing Windows NT Files on the System Partition" in Chapter 20, "Preparing For and Performing Recovery," for information about replacing NTLDR.
If you don't get this error message, then the problem is probably a corrupt Partition Boot Sector. To replace the sector, see "Replacing the Partition Boot Sector," in Chapter 20, "Preparing for and Performing Recovery." Be sure to change the name back to NTLDR so that the Partition Boot Sector can find it again.
NTLDR usually has the Hidden, System, and Read Only attributes set. Because you cannot start Windows NT when the Partition Boot Sector on the boot partition is corrupt, you can start the MS-DOS operating system from the MS-DOS startup floppy disk to change the attributes. To change the attributes by using the MS-DOS attribute command, enter:
attrib -s -h -r ntldr
CMOS Problems
The CMOS typically stores information about the following:
Time and date
Floppy disks
Video type
Hard disks
Memory installed
Each manufacturer and BIOS vendor can decide what a user should be able to configure, and what the standard configuration is. You can access the CMOS through either a utility or a keyboard sequence, depending on the manufacturer. You should write down or use a utility to print all of the CMOS information.
The computer uses the CMOS checksum to determine if any CMOS values have been changed other than by using the CMOS Setup program. If the checksum is not correct, the computer will not start.
Once the CMOS is correctly configured, CMOS problems are usually caused by one of the following:
A weak battery, which can happen if the computer has not been powered on for a long time.
The connection between the CMOS and the battery is loose or faulty.
The CMOS has been damaged from static electric discharge.
All of these problems can result in information in the CMOS being set to zero or otherwise corrupt, thus halting the startup.
Hardware Problems
If a device fails to initialize during POST, there can be a problem with accessing it. If you have changed or added a device since the last startup, the problem might be with the new configuration.
If you have changed your disk configuration, you should check that:
SCSI devices are terminated properly.
The BIOS is enabled on only the first SCSI controller (if at all). See "Understanding ARC Pathnames" in Chapter 20, "Preparing For and Performing Recovery," for information about whether the controller BIOS should be enabled.
There are no IRQ conflicts.
If you have not made any changes, check that:
Controller cards are seated properly.
Cables are properly connected.
Disks are all powered up.
Chapter 36, "General Troubleshooting," discusses hardware problems. The Knowledge Base also contains information about troubleshooting these kinds of problems.
Problem Occurs After the Boot Loader Starts
This section describes troubleshooting problems that might occur from the time NTLDR starts executing through the time that you successfully log onto Windows NT. This phase of startup begins when you see the following message:
NTDETECT V1.0 Checking Hardware . . .
Using Checked Version of NTDETECT
On x86-based computers, NTDETECT detects installed hardware components.
There is a debug version of Ntdetect.com on the Windows NT Workstation product CD, called Ntdetect.chk. If Ntdetect.com fails to detect all of the hardware that you think it should find, you can use the debug version to help isolate the problem. A mouse or a disk controller are the components that typically cause problems.
To use the checked version:
Rename Ntdetect.com to Ntdetect.bak in the root folder of your system partition.
Copy Ntdetect.chk from Support\Debug\I386 to the root folder.
Rename Ntdetect.chk to Ntdetect.com.
The utility Installd on the Windows NT Workstation Resource Kit CD performs the same functions.
Ntdetect.com has attributes of Hidden, System, and Read Only set when you install Windows NT. You need to clear these attributes to make the file visible. You can change the attributes by using My Computer, Windows NT Explorer, or the command prompt.
To change file attributes by using My Computer or Windows NT Explorer
On the View menu, click Options.
On the View tab, select Show all files. Click OK.
Click the filename NTLDR at the root of the C drive.
On the File menu, click Properties.
In the Attributes box of the General tab, clear the Read Only and Hidden check boxes, and then click OK.
To change the attributes by using the command prompt, enter:
attrib -s -h -r ntldr
Shutdown Windows NT and restart the computer. When Ntdetect.chk executes, it displays information on the screen as it detects the hardware. This is a sample of the kind of information you might see:
Detecting System Component . . . Reading BIOS date . . . Done reading BIOS date (1/20/1994) Detecting Bus/Adapter Component . . . Collecting Disk Geometry . . . Detecting Keyboard Component . . .
After it finishes displaying information about the components, press ENTER so Ntdetect.chk will continue. Ntdetect.chk next displays information about the current nodes for the controllers and peripherals. You need to press ENTER at the end of each screen of information.
When you have finished using Ntdetect.chk, you should rename Ntdetect.com to Ntdetect.chk and rename Ntdetect.bak to Ntdetect.com.
Using the /maxmem Switch
For x86-based computers, the Boot.ini file has a /maxmem switch that enables you to specify the maximum amount of RAM memory that Windows NT can use. You can use this switch to troubleshoot memory parity errors, mismatched SIMM speeds, and other memory-related problems. To use this switch, the memory must be contiguous. You should never specify a value less than 8 for Windows NT Workstation.
Note Windows NT Workstation can run in 8 MB RAM, although it will probably run quite slowly.
You include this switch at the end of the ARC path specified in the [operating systems] section of the Boot.ini file. This example restricts Windows NT Workstation to using only the first 12 MB RAM.
multi(0)disk(0)rdisk(0)partition(1)\winnt=Windows NT Workstation 4.0 /MAXMEM=12
Chapter 36, "General Troubleshooting," contains more information about troubleshooting memory problems.
Using the /sos Switch
You can add the /sos switch to the Boot.ini file to have NTLDR display the Kernel and device driver names while they are being loaded. Use this switch if Windows NT does not startup and you think a driver is missing or corrupted. See the section "Boot.ini Switches" in Chapter 17, "Disk and File System Basics," for information about changing Boot.ini switches.
These examples assume that you have installed Windows NT Workstation in the folder winnt40 on partition 2.
First, you should see this message:
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\ntoskrnl.exe
And then this one:
Press spacebar now to invoke Hardware Profile/Last Known Good Menu
Regardless of whether you press the SPACEBAR, you should see these two messages:
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\hal.dll multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\config.sys
The Hardware Profile/Last Known Good menu displays at this time if you pressed the spacebar or you have more than one hardware profile. After NTLDR finishes processing the hardware profile information, it clears the screen and displays information such as:
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\c_1252.nls multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\c_437.nls multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\n_intl.nls multi(0)disk(0)rdisk(0)partition(2)\winnt40\FONTS\vgaoem.fon multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Drivers\Atdisk.sys multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Disk.sys multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\CLASS2.SYS multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Diskperf.sys multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Ntfs.sys
Fatal System Error: 0x0000006B
In some cases on ESDI disks with more than 1024 cylinders, Windows NT Workstation appears to have been successfully installed. However, the first time that you attempt to start from the hard disk, NTLDR loads various files and then produces a Fatal System Error: 0x0000006b with the message that Phase 1 Process Initialization failed. Following this message is a hexadecimal dump and system lockup. If you experience this problem, read the section "ESDI Hard Disk" in Chapter 17, "Disk and File System Basics," for information about the ESDI controllers that Microsoft has tested.
Stop 0x0000007B — Inaccessible Boot Device
This Kernel STOP error means that Windows NT is unable to access the Partition Boot Sector or the required information is not found. A common cause of this error is a virus.
Another cause of the problem is incompatible Logical Block Addressing (LBA). The system BIOS is designed to allow access to fixed disks that use fewer than 1024 cylinders. Many modern disks, however, exceed 1024 cylinders. LBA is used to provide support for these disks. Such support is often built into the system BIOS. However, there are potential problems with LBA:
If partitions were created and formatted with LBA disabled, and LBA is subsequently enabled, a STOP 0x0000007B can result. The partitions must be created and formatted while the LBA is enabled. In addition, changing LBA modes from one scheme to another can cause you to have to recreate and reformat the partitions.
Some LBA schemes are not compatible with Windows NT. When in doubt, it is best to check with your vendor.
A corrupt Partition Boot Sector can also cause this problem, depending upon what part is corrupt. This problem is like a virus, except that the corruption is caused by such things as a defective disk or controller, or a bug in a program that somehow has corrupted the Partition Boot Sector.
MS-DOS Will Not Start
You might see one of the following error messages when you have configured your x86-based computer to dual-boot Windows NT and MS-DOS:
Non-System disk or disk error
Replace and press any key when ready
– Or –
Couldn't open boot sector file
multi(0)disk(0)rdisk(0)partition(1):\Bootsect.dos
These error messages occur because the Bootsect.dos file is missing or corrupt. Bootsect.dos is a hidden, system, read-only file that NTLDR uses to start the MS-DOS operating system.
Because Windows NT is able to load correctly and the Partition Boot Sector is not damaged, the Emergency Repair Disk might not detect a problem. To force the Emergency Repair Disk to rewrite Bootsect.dos, you should use the following procedure.
To replace Bootsect.dos
Shut down and restart the system from an MS-DOS startup floppy disk that contains the MS-DOS program Sys.com. Type sys c: at the command prompt.
You should receive a System Transferred message. Sys.com replaces the Partition Boot Sector, which loads NTLDR, with an MS-DOS Partition Boot Sector that loads Msdos.sys and Io.sys.
Start the computer from the Windows NT Setup disk 1. Insert disk 2 when it is requested. When prompted, select the option to Repair by entering R. Setup displays the following options:
[X] Inspect registry files
[X] Inspect startup environment [X] Verify Windows NT system files [X] Inspect boot sector Continue (perform selected tasks)
Clear all selections except Inspect boot sector. Select Continue (perform selected tasks).
After disk 3, you will be prompted for the Emergency Repair Disk. Setup displays the following messages after it has finished processing the Emergency Repair Disk:
Setup has completed repairs.
If there is a floppy disk inserted in drive A:, remove it. Press ENTER to restart your computer.
The Repair process replaces the Partition Boot Sector and creates Bootsect.dos so that the dual-boot configuration is restored.
Troubleshooting Startup Problems on RISC-based Computers
RISC-based computers generally have fewer problems at startup than x86-based computers. This is because they do not have problems with viruses destroying the Master Boot Record or the Partition Boot Sector. They also do not have problems with the disk configuration information in the computer not matching what the controller is using.
The startup problems common to RISC-based computers are:
Missing or incorrect file(s). This problem is usually the result of a user deleting, moving, or renaming a file that is needed for startup. It is also possible that a device driver is not the correct version for the device.
Incorrect firmware. Upgrading to a new version of Windows NT typically requires upgrading the firmware. The firmware upgrades are available through your RISC-based computer vendor.
On RISC-based computers, you can use the /sos switch to display the Kernel and device driver names while they are being loaded. Include this switch on the OSLOADOPTIONS variable in the NVRAM. See the section "Using the /sos Switch," presented earlier in this chapter, for a description of the output you see when using this switch. There is information about editing the firmware variables in the section titled "Manage Boot Selection Menu," in Chapter 19, "What Happens When You Start Your Computer," in the Windows NT Workstation Resource Guide.
Troubleshooting problems with RISC-based computers can be more difficult than troubleshooting problems with x86-based computers because there are few disk or hardware troubleshooting tools available outside of Windows NT. If you can startup Windows NT, which you might be able to do by using your Windows NT startup floppy disk, try using these utilities:
The Windows NT Diagnostics in the Administrative Tools (common) program group, which enables you to look at hardware information.
The DiskProbe utility on the Windows NT Workstation Resource Kit CD, which is a low-level disk editor that enables you to examine and change individual disk sectors.
On RISC-based computers, there are no recovery tools such as those available when you dual-boot MS-DOS on x86-based computers. If your startup problem is because of a problem with information on the hard disk, you might have to remove the disk from the RISC-based computer and install it as a second disk on an x86-based computer to troubleshoot the problem. When you use this approach, you can use a low-level disk editor to examine the information on the disk in the same way you would troubleshoot a problem with a disk on an x86-based computer. Although these kinds of problems do not occur very often, you might have to use this approach after a power failure or system crash.
Note On NTFS volumes, you need to use Windows NT-based utilities, such as DiskProbe, to examine information on the volume.
Troubleshooting Startup Problems Common to Both x86-based and RISC-based Computers
When starting your computer, Windows NT provides options for using alternative configurations. If you have changed hardware or device drivers since the last startup and Windows NT does not complete startup, try using one of the other options.
Troubleshooting by Using the Last Known Good Configuration
Windows NT provides two configurations in which you can start your computer:
Default, the configuration that was saved when you shutdown the computer.
Last Known Good, the configuration that was saved when you last logged on to your computer.
The configurations are stored as control sets in the Registry key HKEY_LOCAL_MACHINE \SYSTEM. If you made changes to your configuration when you were last logged on, such as adding drivers, changing services, or changing hardware, the two control sets will contain different information. As soon as you log on however, the information in these control sets will be the same. Therefore, if you are having problems with startup, and think the problems might be related to changes in your configuration, do not log on. Instead, shutdown the computer and restart it. Then, select Last Known Good from the Hardware Profile/Last Known Good menu to recover from the following types of problems:
You install a new device driver, restart Windows NT, and the system stops responding. The Last Known Good control set enables you to startup because it does not contain any reference to the new, faulty driver.
You install a new video driver and are able to restart the system. However, you cannot see anything, because the new video resolution is incompatible with your video adapter. Do not try to log on. If you have the option to shutdown the computer without logging on, do so. If that option is not available, you need to restart your computer by turning it off or using the reset button. Wait for all disk activity to stop before you initiate the restart, especially if the computer has FAT volumes.
You accidentally disable a critical device driver (such as the Scsiport driver). Windows NT is not be able to start and automatically reverts to the Last Known Good control set.
Using the Last Known Good control set does not help in the following situations:
Any problem that is not related to changes in control set information, such as information like user profiles and file permissions.
After you logged on after making changes. Here, the Last Known Good control set has already been updated to include the changes.
Switching between different hardware profiles, such as docked and undocked laptops. The Last Known Good control set is only a method to switch between configuration information in the Registry. Use Hardware Profiles for this.
Startup failures caused by hardware failures or corrupted files.
Copying a new driver over the top of an old one, and the old one is already active.
For more information about hardware profiles and control sets, see Chapter 19, "What Happens When You Start Your Computer." Chapter 36, "General Troubleshooting," contains more details about troubleshooting by using the Registry key HKEY_LOCAL_MACHINE.
Troubleshooting Video Problems
If your screen stays black or is skewed after a restart, either the video device is not resetting correctly during the restart or the video is sharing an IRQ.
Turn the power off and restart it. If the video works, you will probably need to turn the power off each time you restart Windows NT. This problem is video- and system-BIOS related.
If the video is still wrong after shutting the power down and restarting, check for IRQ and memory conflicts with other cards on your system. If you are using a PCI-based computer, make certain that the video is not using IRQs 2, 9, or 12.
If you have installed a new video driver, or changed the display type by using the Display option in Control Panel, you might have created an incompatibility between the driver and the video device. One way that you can tell you have a problem is if you get a black screen instead of the logon message when you restart Windows NT.
You can turn off your computer or use the reset button to restart your computer. Then select the Last Known Good configuration. This recovery method is described in "Troubleshooting by Using the Last Known Good Configuration," presented earlier in this chapter.
On x86-based computers, you have another way to recover. When you install Windows NT, it creates two paths to the Windows NT folder, such as:
scsi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00" scsi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo
If you select the path with the VGA mode option, Windows NT starts up by using the standard VGA driver. You can then use the Display option to reconfigure your video device.
Note Windows NT version 4.0 requires new video and printer drivers. Windows NT version 3.51 drivers for these devices will not work correctly when you are running Windows NT version 4.0.
Troubleshooting Disk Problems That Occur After Logon
This section discusses problems that occur after you have successfully logged on.
Volume is Displayed as Unknown
If you have created and formatted a volume with NTFS or FAT, but you can no longer access files on it and Disk Administrator displays the volume as Unknown, the Partition Boot Sector for the volume might be bad.
For NTFS volumes, there are two other possible causes for this error:
Permissions for the volume have been changed.
The Master File Table (MFT) is corrupt.
The Partition Boot Sector can be corrupted by viruses. Corruption problems can also occur if you have a dual-boot configuration with Windows 95 and you use the Windows 95 version of the Fdisk utility. To avoid problems with Fdisk, delete the Windows 95 version, make sure that you have the MS-DOS-based version, and run Fdisk only when you start MS-DOS.
To determine if a corrupt Partition Boot Sector is causing the problem, and for the description of the procedures to restore it, see "Replacing the Partition Boot Sector" in Chapter 20, "Preparing for and Performing Recovery."
The permission problem occurs when you have done the following:
Created a second volume.
Removed the group Everyone from the Access Control List (ACL).
Granted access to a specific user.
The single user has normal access, but when other users log on, or if Windows NT is reinstalled, Disk Administrator sees the drive as unknown.
To correct this problem, log on as an administrator and take ownership of all folders, or add the group Everyone back with full control (default).
If there is corruption in the MFT file, there is no general solution. If you suspect this kind of problem, you should contact your technical support personnel for assistance.
Extended Partition Problems
If a Partition Table that defines a logical drive within an extended partition becomes corrupt, Windows NT can no longer access that volume, or the volumes that follow it on the disk. Once the pointer to the next volume has been lost, Windows NT can no longer find out where the volumes start.
When an extended partition becomes corrupt, it might be possible to rebuild the information by using a sector editor or Partition Table editor.
For information about the organization of extended partitions, see "Logical Drives and Extended Partitions" in Chapter 17, "Disk and File System Basics." For information about ways to attempt to repair the extended partition, see the description of the DiskProbe utility in Chapter 22, "Disk, File System, and Backup Utilities."