How Windows RE Works

How Windows RE Works

Published: October 22, 2009

Updated: October 22, 2009

Applies To: Windows 7

Windows® Recovery Environment (Windows RE) is an extensible recovery platform based on Windows Preinstallation Environment (Windows PE). When a computer fails to start, Windows automatically fails over into this environment, and the Startup Repair tool in Windows RE automates the diagnosis and repair of an unbootable Windows® 7 installation. This topic describes Windows RE, specifically the automatic failover behavior, manual diagnosis, and repair process. It also describes how the Startup Repair tool works.

This topic includes:

Automatic Failover
Manual Diagnosis and Repair
Startup Repair

Automatic Failover

A computer running Windows 7 can automatically fail over into the on-disk Windows RE only if a boot failure is detected. At Startup, the Windows loader sets a status flag to indicate that the boot process has started, and this flag is typically cleared before the Windows logon screen is displayed. If the boot attempt fails, the flag is not cleared. The next time the computer starts, the loader detects the flag and assumes that a boot failure occurred. When this happens, the loader launches Windows RE instead of Windows 7.

Note
The detection of boot failure relies on boot completion and not on whether an error occurred in Windows 7. One example of a false positive is when power is lost during the boot process, and Windows RE is launched even though the Windows installation is bootable.

Because the failover mechanism relies on the Windows boot manager and Windows boot loader, some failures will render Windows RE inaccessible. In the following scenarios, the user must use bootable Windows RE media to recover the computer.

Corrupt disk metadata in the master boot record (MBR), partition table, or boot sector of a Windows RE partition.
Missing or corrupt boot manager.
Missing or corrupt boot configuration data.

Sometimes the boot loader cannot read or write to the boot status flag, in which case Windows will not automatically fail over into Windows RE. However, the user can still manually launch into the on-disk Windows RE through the F8 menu.

Manual Diagnosis and Repair

When starting from a Windows RE CD/DVD or using the F8 advanced boot option menu to launch the on-disk Windows RE, the user can manually launch these system-recovery tools:

Startup Repair (when not launched automatically)
System Restore (on rollback, by using existing restore points)
Complete PC Restore (to restore from a volume backup image)
Command prompt, from which all standard Windows PE console tools, such as Regedit and ChkDsk, are available
Custom support and recovery tool included by computer manufacturers

Startup Repair

Startup Repair is a tool that automates common diagnostic and repair tasks of unbootable Windows 7 installations. If the computer fails over into Windows RE because of a detected boot failure, Startup Repair launches automatically. If automatic failover to an on-disk Windows RE is not available, Startup Repair can also be launched as a manual recovery tool from a Windows RE CD/DVD.

Startup Repair Process

Startup Repair will try to repair computers that are unbootable because of the following reasons:

Registry corruption
Missing or damaged system and driver files
Disk metadata corruption (MBR, partition table, and boot sector)
File system metadata corruption
Installation of problematic or incompatible drivers
Installation of incompatible Windows service packs and patches
Corrupt boot configuration data
Bad memory and hard disk hardware (detection only)

Startup Repair will not repair unbootable systems caused by the following issues:

Malfunctioning firmware and other hardware components
Problems with clean Windows installations or Windows upgrades (for example, from Windows XP to Windows Vista)
Windows logon errors
Viruses and malicious software

Startup Repair Log

After Startup Repair has run, a text log with diagnostic information and repair results is generated. This log file is located at %WINDIR%\System32\LogFiles\Srt\SrtTrail.txt.

The log file begins with information about the diagnostic and repair session, such as in the following example.

Session Summary:
System Disk = \Device\Harddisk0
WinDir = C:\windows
AutoChk Run = 0
Root causes = 1

The following table describes these fields.

Field	Description
System Disk	Device path of the disk on which the Windows installation is located.
WinDir	Full path of the Windows installation to be repaired.
AutoChk Run	A non-zero value indicates that AutoChk was run during Windows PE boot.
Root causes	Number of root causes found during diagnostics.

The next section of the log file contains diagnostic tasks performed. For example,

Test Performed:
---------------------------
Name: Software installation log diagnosis
Result: Completed successfully. Error code =  0x0
Time taken = 125 ms

Test Performed: 
---------------------------
Name: ACL test
Result: Completed successfully. Error code =  0x0
Time taken = 18200 ms

The following table describes these fields.

Field	Description
Name	Name of the diagnostic task performed.
Result	Textual description of whether the test completed successfully.
Error code	Win32® return code of the diagnostic procedure. A value of 0x0 indicates that the specified test ran successfully.
Time taken	The amount of time, in milliseconds, spent on the diagnostic step.

The following table describes the diagnostic tasks performed by Startup Repair.

Diagnostic task	Description
Disk metadata test	Verifies the integrity of the MBR, partition table, and boot sector.
Determine target OS	Extracts the location of the Windows installation from the Boot Configuration Data (BCD).
Registry hives test	Verifies the integrity of the registry hives.
Quick volume metadata test	Verifies that the Windows directory exists.
Event log diagnosis	Checks the Event Log for recent changes to Windows.
Boot status test	Verifies that Windows did not start successfully.
Setup state check	Checks whether the failure occurred during Windows installation.
Bugcheck analysis	Analyzes available crash dumps created during the failed Startup attempt.
Software installation log diagnosis	Checks whether Windows updates have recently been installed.
Disk failure diagnosis	Checks the Self-Monitoring, Analysis, and Reporting Technology (SMART) status on the hard disk hardware.
Chkdsk	Runs Chkdsk to identify file system metadata problems.
Binary file integrity test	Verifies the integrity of system files required for Startup.
ACL test	Verifies that system files required for boot have the correct access control list (ACL).

Root Causes

When the root cause of the Startup failure is found, the details and resulting actions are included in the log file. For example,

Root cause found: 
---------------------------
ACLs on file C:\windows\system32\user32.dll are not proper. Old value = 0xd015f

Repair action: ACLs fix
Result: Completed successfully. Error code =  0x0

The following table describes these fields.

Field	Description
Root cause found	Textual description of the problem.
Repair action	Name of the repair action taken.
Result	Textual description of the repair action's success or failure.
Error code	Win32 return code of the repair procedure. A value of 0x0 indicates that the specified repair completed successfully.

The following table lists the possible root causes for Startup failures.

Root cause	Description
Boot manager failed to find OS loader.	Winload.exe is missing or cannot be accessed.
Boot configuration is corrupt.	The boot configuration file is missing or it contains no valid operating system entry.
The boot-critical file <filename> is missing.	The specified file required for Startup is missing.
The boot-critical file <filename> is corrupt.	The specified file required for Startup is corrupt.
Several boot-critical files are corrupt.	Multiple files required for Startup are corrupt.
The registry is corrupt.	A registry hive fails to load.
Unknown bugcheck <code>. Parameters = <param1>, <param2>, <param3>, <param4>.	The system failed during Startup with the specified bugcheck error.
Driver <drivername> is preventing the system from starting.	The specified driver is missing or corrupt.
A recent driver installation or upgrade may be preventing the system from starting.	An incompatible driver was installed prior to the Startup failure.
A patch is preventing the system from starting.	An update to the operating system was installed prior to the Startup failure.
ACLs on file <filename> are not proper. Old value = <value>.	The specified file cannot be accessed due to an incorrect ACL.
The partition table does not have a valid System Partition.	The system partition listed in the partition table does not contain the required system files.
MBR is corrupt.	The MBR on the system disk is corrupt.
Partition table is corrupt on disk <drivenumber>.	The partition table on the specified disk does not contain any valid entries.
The boot sector for system disk partition is corrupt.	The boot-sector information is not valid.
The boot-sector code for system disk partition is corrupt.	The boot-sector code does not match the default boot sector.
The system volume on disk is corrupt.	The system volume cannot be accessed.
No OS files found on disk.	The Windows directory does not contain a valid Windows installation.
Boot manager is missing.	The boot manager cannot be found on the system partition.
A hard disk could not be found. If a hard disk is installed, it is not responding.	Cannot detect any installed hard disk. This is available only when running Windows RE from CD/DVD.
Security settings on this computer are preventing Windows from starting.	Windows is unable to audit the system.
The system partition has an unknown file system type.	The system partition is formatted using a file-system type that Windows does not recognize.
Boot status indicates that the OS booted successfully.	Windows started successfully. This is a common scenario if a user manually launches Windows RE and runs Startup Repair.
Failure while setup is in progress.	The computer does not start due to a failed Windows installation process.
The operating system version is incompatible with Startup Repair.	The version of Windows does not match that of Startup Repair. For example, trying to repair Windows XP using Startup Repair will trigger this root cause.

Repair Actions

The following table describes possible repair actions.

Repair action	Description
Boot Critical Disk Meta-data Repair (BCDMD)	Repairs the MBR, partition table, or boot sector.
ChkDsk	Runs ChkDsk in repair mode.
File Repair	Replaces the corrupt system file with a backup copy.
BootCfg	Reconstructs the Boot Configuration Data (BCD).
System Restore	Rolls back the system state by using System Restore.
ACLs fix	Sets the ACLs of the specified file to a default value.
Registry rollback	Replaces the corrupt registry hives with a backup copy.
Change Crash on Audit Failure setting	Disables Windows auditing. Only an administrator can log on to Windows.
Memory Diagnostics	Runs the Windows Memory Diagnostics tool.

The following table describes the descriptions of the possible diagnostic or repair results.

Result text	Description
Completed successfully. Error code = 0x0	Diagnostic and repair processes finished without error.
Failed. Error code = <errorcode>	Diagnostic and repair processes failed with the specified error.
Started but not completed	Either the diagnostic process or the repair process was canceled by the user.

Automatic Failover

Manual Diagnosis and Repair

Startup Repair

Startup Repair Process

Startup Repair Log

Root Causes

Repair Actions

See Also

Concepts