Chapter 20 - Preparing for and Performing Recovery

Article
02/20/2014

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

This chapter describes what you can do to:

Reduce the possibility of problems.
Recover from problems when they occur.

There is no way to make a computer running Windows NT failure proof. You can only make the computer more failure resistant. A memory module, cabling, or controller failure can corrupt data on any disk. In this event, the only option is to restore from a tape or a backup server that contains a copy of the data.

These are some things that you can do to make it easier to recover from problems:

Develop plans and procedures for recovering from failures before you have one.
Create and test floppy disks that enable you to restart the computer when you are having trouble starting from the system partition.
Maintain software configuration information for your computers running Windows NT. At a minimum, keep track of the version of the operating system installed on each computer, including service packs and hotfixes.
Record the hardware configuration of each computer running Windows NT, especially the disk configurations.

The topics covered in this chapter are:

Maintaining configuration and other forms of information.
Understanding ARC pathnames.
Creating floppy disks to use to start the computer.
Testing.
Restoring disk information.
Using an uninterruptable power supply

This chapter also describes using utilities on the Windows NT Workstation Resource Kit CD and the Windows NT Workstation CD to back up and restore critical data. Planning what utilities to use is as important as knowing how to use them. There is more information about these utilities in Chapter 22, "Disk, File System, and Backup Utilities."

These are some points to consider:

Investigate the various utilities for doing a task, and decide which one(s) to use for which situations.
When you have decided which utilities you want to use, prepare your floppy disks.
Know how to use the utilities that you decide to use.
Practice recovering from the common problems described in this chapter and in Chapter 21, "Troubleshooting Startup and Disk Problems."

Maintaining Configuration and Essential System Information

Hardware failures, power failures, and human errors can corrupt information that your computer needs to start Windows NT.

Recovery is easier if:

You know the configuration of each computer and its history.
You back up critical system files every time you make certain changes to your Windows NT configuration.

On computers running Windows NT Workstation, you can purchase disk subsystems that maintain redundant information on the disks. The redundant information is either parity information, or a complete, separate copy of the data. Having redundant information makes the disk subsystems fault tolerant, meaning that you can continue to access the data when one disk in a fault-tolerant configuration fails. This fault-tolerant technology is called RAID, for Redundant Array of Inexpensive Disks. A disk subsystem that implements fault tolerance using RAID technology is also called a RAID array.

For complete information about RAID, RAID terminology, and RAID arrays, see The RAIDbook, A Source Book for Disk Array Technology. The RAID Advisory Board in St. Peter, MN, publishes this book. The June 1995 edition is the basis for RAID information in this chapter.

Keeping a Log Book

You should have a log book for every computer, which contains information about the computer's configuration. Having current information makes it easier to rebuild your computer in the event of a serious system crash. This information also helps product support personnel to troubleshoot problems. The Registry contains information about your disk configuration in the subkeys HKEY_LOCAL_MACHINE \HARDWARE \DeviceMap \AtDisk and Scsi.

The type of information to keep includes:

Computer type, model number, and serial number.
Computer BIOS manufacturer and revision level (x86-based computers) or firmware revision level (RISC-based computers).
CMOS information for x86-based computers.
NVRAM information on RISC-based computers.
Hardware configuration information, including IRQs, DMA addresses, I/O ports, and similar information. If the computer has an EISA bus, the EISA configuration and its associated CFG files should be backed up.
SCSI controller model number, and the BIOS firmware revision level.
Jumper settings for all peripheral devices.

Complete map of the SCSI subsystem, including:
- SCSI configuration information from the SCSI setup program.
- Which devices are terminated and how they are terminated.
- The SCSI ID and physical location on the chain of every SCSI device.
Which versions of Windows NT are installed, and the partitions on which they are installed.
Details of any device drivers or other system level software that did not come in the Windows NT retail package. This software would include such things as a Network File System (NFS) provider, network protocol, or network management software.

Troubleshooting history for any system failures or Kernel STOP errors (blue screens). This information should include:
- The time and date the problem occurred.
- Any error messages, or events posted to the event log.
- Any troubleshooting done and the outcome.
Partition information, such as the size of the partitions and the file system used for each one. You can use the DiskMap program, described in Chapter 22, "Disk, File System, and Backup Utilities," to print a map of each of your disks by redirecting the output to a file or a printer.

Backing up the Registry

All of the Windows NT internal configuration information is stored in the Registry. It is critical to have up-to-date, reliable backups of this information. There are several ways to back up the all or part of the Registry, and you should have redundancy in this area.

If you have a backup device installed on your computer, you can include the Registry in normal backups. You have to specifically select this option in the Windows NT tape backup program Ntbackup.exe. Third-party Windows NT-compatible backup software might also require that you take specific action to back up the Registry. Be sure to test your Registry backup and restore procedures.

Note Windows NT Backup can only back up the Registry on the local system. You cannot use Windows NT Backup to back up a computer's Registry over the network.

After any change in the configuration of the operating system, including adding new software, you should use the Repair Disk program, Rdisk.exe, to update files in the %systemroot%\Repair folder, and create a new Emergency Repair Disk. For information about using the Repair Disk program, see "Creating an Emergency Repair Disk," presented later in this chapter. It is a good idea to make a copy of the Emergency Repair Disk and store it in a separate location, perhaps off site.

You can use the Windows NT Registry Editor, Regedt32.exe, to save and restore Registry keys.

The Windows NT Workstation Resource Kit CD contains utilities that enable you to back up and restore all or part of the Registry. For information about the Registry Backup (Regback.exe) and Registry Restore (Regrest.exe) utilities, see Rktools.hlp.

Saving the SYSTEM Key

The HKEY_LOCAL_MACHINE \SYSTEM key contains configuration information that Windows NT uses during startup. Even though this key is copied to the Emergency Repair Disk when you use the Repair Disk program, there are times that you might want to restore this key from another disk. For more information, see "Restoring the SYSTEM Key," presented later in this chapter.

You can save the SYSTEM key by using either Disk Administrator or the Windows NT Registry Editor (Regedt32.exe). The primary difference between these two methods is that the Disk Administrator always saves the key to a floppy disk, whereas you can specify any disk by using the Registry Editor.

Note The %systemroot%\System32\Config\System file is usually larger than the SYSTEM key saved by using Disk Administrator or Registry Editor. The smaller size results because the two programs compact the file before copying it to eliminate internal fragmentation and holes.

To use Disk Administrator to save the SYSTEM key

On the Partition menu, click Configuration.
On the Configuration menu, click Save. A message is displayed describing what will be saved and where you should save it.
Insert any floppy disk with enough unused space to hold the configuration information (about 512K). Using the Windows NT startup floppy disk is highly recommended.
Click OK to write the data to the floppy disk.

To use Registry Editor to save the SYSTEM key

Run Registry Editor (Regedt32.exe).
Click the HKEY_LOCAL_MACHINE \SYSTEM key. On the Registry menu, click Save key.
Enter the path to the file where you want to save the key.

Saving the DISK Subkey

The HKEY_LOCAL_MACHINE \SYSTEM \DISK subkey in the Registry contains configuration information about currently defined drive letters, volume sets, stripe sets, stripe sets with parity, and mirror sets, as well as CD-ROM mappings and drive mappings. Any time that you make changes to your disk configuration, Windows NT updates the DISK subkey. You should save this subkey whenever you make changes that affect it, such as:

Creating or deleting a disk partition.
Changing a drive letter.
Creating or deleting a volume set or stripe set.

Having a backup is useful in situations when you do not want to restore the entire Registry or the entire SYSTEM key, such as the following:

You want to move a volume set or stripe set to another computer because of a hardware failure.
Configuration information about a set has been corrupted.
You need to replace hardware.

For example, if you have changed a SCSI controller, restoring the entire SYSTEM key might make it difficult to start the computer. Restoring the DISK subkey enables you to have current disk configuration information without changing anything else in the Registry.

Note The DISK subkey does not exist the first time that you start Windows NT Workstation. Disk Administrator creates the subkey the first time that you run it.

To use the Registry Editor to save the DISK subkey

Run Registry Editor (Regedt32.exe).
Click the HKEY_LOCAL_MACHINE \SYSTEM \DISK subkey. On the Registry menu, click Save key.
Enter the path to the file where you want to save the subkey.

Creating an Emergency Repair Disk

When you install Windows NT, Setup creates the Registry information in %systemroot%\System32\Config. For recovery purposes, Setup also creates a %systemroot%\Repair folder that contains the following files:

File Name	Contents
Autoexec.nt	Copy of %systemroot%\System32\Autoexec.nt, which is used to initialize the MS-DOS environment.
Config.NT	Copy of %systemroot%\System32\Config.nt, which is used to initialize the MS-DOS environment.
Default._	Registry key HKEY_USERS \DEFAULT, compressed.
Ntuser.da_	Compressed version of %systemroot%\Profiles\Default user\Ntuser.dat. The repair process uses Ntuser.da_ if this one needs to be repaired.
Sam._	Registry key HKEY_LOCAL_MACHINE \SAM, compressed.
Security._	Registry key HKEY_LOCAL_MACHINE \SECURITY, compressed.
Setup.log	Log of which files were installed, and cyclic redundancy check (CRC) information for use during the repair process. This file is Read Only, System, and Hidden, so it will not be visible unless you have configured My Computer or Windows NT Explorer to show all files.
Software._	Registry key HKEY_LOCAL_MACHINE \SOFTWARE, compressed.
System._	Registry key HKEY_LOCAL_MACHINE \SYSTEM, compressed.

During installation, Windows NT Setup asks whether you want to create an Emergency Repair Disk. You should choose Yes. When you create an Emergency Repair Disk during installation, or later by using the Repair Disk program (Rdisk.exe), the files are copied from %systemroot%\Repair to the floppy disk. You can also use the Emergency Repair Disk to repair a corrupt Partition Boot Sector for the system partition.

When you run the Repair Disk program, you can update the %systemroot%\Repair\Software and %systemroot%\Repair\System files with the current information in %systemroot%\System32\Config by using the Update Repair Info button.

Cc751045.xwr_s01(en-us,TechNet.10).gif

The Repair Disk program does not update the Default, Sam and Security files if you run the program from Windows NT Explorer or My Computer. To update all the files, you can run rdisk from the command prompt by entering:

rdisk /s

You can also update all of the files by clicking the Start button, clicking Run, and entering:

rdisk /s

Using the /s switch forces the Repair Disk program to update all of the Registry keys in the %systemroot%\Repair folder.

There are several points to consider about maintaining and using your Emergency Repair Disk:

If you did not use the /s switch before you create the Emergency Repair Disk, and you use the Repair process to replace the SYSTEM Registry keys, all passwords in the system return to the passwords in effect at the time you last updated the Sam and Security files in %systemroot%\Repair. If you have more recently backed up these keys by using Windows NT Backup, Regback.exe, or Regedt32.exe, you can restore more current information.
If you did not update the Emergency Repair Disk after using Disk Administrator to configure volume sets or stripe sets, it might be difficult or impossible to recover data on these volumes. When you create a volume set or a stripe set, Disk Administrator updates the DISK subkey in the Registry and sets the fault-tolerant bit on the System ID field of the Partition Table for each partition or logical drive in the set.
You should make a copy of your current Emergency Repair Disk.
If you convert your boot partition from the FAT file system to the NTFS file system on an x86-based computer, be sure to update your Emergency Repair Disk. The NTFS Partition Boot Sector must be on the Emergency Repair Disk, not the FAT Partition Boot Sector.
The Emergency Repair Disk is not a replacement for backups.

For more information about creating an Emergency Repair Disk, see Help for the Repair Disk program. For more information about the %systemroot%\Repair and %systemroot%\System32\Config folders, and the Emergency Repair Disk, search the Knowledge Base. For information about the Knowledge Base, see Chapter 36, "General Troubleshooting."

Chapter 23, "Overview of the Windows NT Registry," contains more information about these keys and the %systemroot%\System32\Config folder.

Backing up the Master Boot Record and Partition Boot Sector

No operating system can protect itself from damage to these disk areas, which can be caused by viruses, faulty SCSI configurations, device driver problems, or power outages. You should back up the Master Boot Record on a disk every time you change partition information for primary partitions or an extended partition. You should back up a Partition Boot Sector when you format a volume, install Windows NT in the volume, or convert a volume from the FAT file system to the NTFS file system.

You can back up these disk sectors by using the Windows NT–based program, DiskProbe, or the MS-DOS-based program, DiskSave. Both of these utilities are on the Windows NT Workstation Resource Kit CD. The procedures for using DiskProbe and DiskSave are described in Chapter 22, "Disk, File System, and Backup Utilities."

If you have more than one hard disk, or more than one partition on a disk, you should back up every Master Boot Record and Partition Boot Sector. The Master Boot Record for the startup disk and the Partition Boot Sector for your system partition are the most critical. The ones for the other disks and volumes are not as critical to the startup process, but you might not be able to access files if the Master Boot Record for the disk or the Partition Boot Sector for the volume is not correct.

Chapter 21, "Troubleshooting Startup and Disk Problems," describes how to determine if you have a problem with one of these sectors.

Backing Up Data on Your Hard Disks

You should back up data on your hard disk(s) that are not available anywhere else. For example, you might not want to back up Windows-based application programs, because you can reinstall them. However, it might be faster to restore the application programs from a backup tape rather than reinstall them if you have to replace a disk.

You can use the Windows NT backup program, Ntbackup.exe, to back up the data to a cartridge tape. You can also back up to another computer, such as a file server or the disk on a computer that is shared by other users. If you back up to another computer, you should have your files included in the backup procedure for that computer.

Understanding ARC Pathnames

Advanced RISC Computing (ARC) naming conventions are a standard for identifying the location of a file or a program on a device such as a hard disk or a floppy disk. You must understand the ARC pathname conventions to be able to create paths to use to start the computer from the Windows NT startup floppy disk.

On x86-based computers, you use ARC pathnames to describe the location of the boot partition for each instance of Windows NT installed on the computer. On an x86-based computer, you can create alternate paths to the boot partition, as described in "Creating Alternate Boot Selections for an x86-based Computer," presented later in this chapter. The ARC path in the Boot.ini file appears in one of the following forms:

multi(W)disk(X)rdisk(Y)partition(Z)\%systemroot%
scsi(W)disk(X)rdisk(Y)partition(Z)\%systemroot%

On RISC-based computers, you use ARC pathnames to describe the location of:

The folder containing Osloader.exe and Hal.dll.
The full path to Osloader.exe.
The path to the boot partition.
Devices detected by the firmware, such as disks, keyboard, and video.

When you create a Windows NT startup floppy disk to use on a RISC-based computer, you need to modify the NVRAM to include the ARC path to the floppy disk. To create an entry for the Windows NT startup floppy disk, see the section titled "Creating Alternate Boot Selections for a RISC-based Computer," presented later in this chapter. On a RISC-based computer, only the scsi() syntax is used for hard disks. The boot selection has the following parts:

SYSTEMPARTITION is the FAT partition that contains Osloader.exe and Hal.dll.
OSLOADER is the path to the OSLOADER file itself.
OSLOADPARTITION is the boot partition, which contains the Windows NT system files.
OSLOADFILENAME is the name of the Windows NT folder in the boot partition, with no drive letter.
OSLOADOPTIONS indicates any debugging options that should be set up when loading Windows NT.

This is an example of a boot selection for a RISC-based computer:

LOADIDENTIFIER=Windows NT Workstation 4.0
SYSTEMPARTITION=scsi(0)disk(0)rdisk(0)partition(1)
OSLOADER=scsi(0)disk(0)rdisk(0)partition(1)\Os\Nt40\Osloader.exe
OSLOADPARTITION=scsi(0)disk(0)rdisk(0)partition(2)
OSLOADFILENAME=\Winnt
OSLOADOPTIONS=nodebug

multi(W)disk(X)rdisk(Y)partition(Z)

This form of the ARC pathname, refered to as multi() in the rest of this chapter, is only used on x86-based computers. On Windows NT version 3.1, it was only valid for IDE, EIDE, and ESDI disks. In Windows NT version 3.5 and later it is valid for SCSI disks as well.

The multi() syntax indicates to Windows NT that it should rely on the system BIOS to load system files. This means that NTLDR, the boot loader for x86-based computers, will be using interrupt (INT) 13 BIOS calls to find and load Ntoskrnl.exe and any other files it needs to get the system running.

Note The term multi() syntax refers to the multi(W)disk(X)rdisk(Y)partition(Z) form of the ARC pathname.

The W, X, Y, and Z parameters have the following meaning:

W is the ordinal number of the controller, and should always be 0. X is not used for multi(), and is always 0. Y is the ordinal for the disk on the controller, and is always 0 or 1 for disks connected to the primary controller. The range is 0 through 3 for disks on a dual-channel EIDE controller. Z is the partition number. All partitions receive a number except for type 5 (Extended) and type 0 (unused) partitions. These numbers start at 1, as opposed to all other entries, which start with 0.

Theoretically, the multi() syntax could be used to start Windows NT from any disk on the computer. However, this would require that all disks be correctly identified through the standard INT 13 interface. But support for this varies from controller to controller, and most system BIOS only identify a single controller through INT 13.

For a configuration with IDE or EIDE disks, the multi() syntax works for up to four disks on the primary and secondary channels of a dual-channel controller. In a SCSI-only configuration, the multi() syntax works for the first two disks on the first SCSI controller (the controller whose BIOS loads first). When your computer has both SCSI and IDE disks, the multi() syntax works only for the IDE disks on the first controller.

scsi(W)disk(X)rdisk(Y)partition(Z)

The scsi() syntax is used for both RISC-based and x86-based computers, and is used in all versions of Windows NT. Using the scsi() syntax indicates that Windows NT needs to load a SCSI device driver and use that driver to access the boot partition.

Note The term scsi() syntax refers to the scsi(W)disk(X)rdisk(Y)partition(Z) form of the ARC pathname.

On an x86-based computer, the device driver is Ntbootdd.sys, which can be found in the root of the system disk (usually C:). It is a copy of the device driver for the disk controller in use. On a RISC-based computer, the driver is built into the firmware, as required by the RISC standards, so no file is required.

The W, X, Y and Z parameters have the following meaning when using the scsi() syntax:

W is the ordinal number of the controller as identified by the Ntbootdd.sys driver. X is the SCSI ID of the target disk. Y is the SCSI logical unit number (LUN) of the disk that contains the boot partition. Y will almost always be 0. Z is the partition number. All partitions receive a number except for type 5 (Extended) and type 0 (unused) partitions. These numbers start at 1, as opposed to all other entries, which start with 0.

When using scsi() syntax, the value of W depends upon Ntbootdd.SYS. Each SCSI device driver used in Windows NT has its own method of ordering controllers, although the controller order corresponds to the order that the BIOS on the controllers loads (if they are being loaded).

Additionally, if you have more than one SCSI controller, and they use different device drivers, you should only count the controllers that are controlled by Ntbootdd.sys when determining the value of the W parameter. For instance, if you have an Adaptec 2940 (which uses Aic78xx.sys) and an Adaptec 1542 (which uses Aha154x.sys), W will always be 0. What changes is the Ntbootdd.sys file:

If you are loading Windows NT from a disk on the Adaptec 2940, Ntbootdd.sys will be a copy of Aic78xx.sys.
If you are loading Windows NT from a disk on the Adaptec 1542, Ntbootdd.sys will be a copy of Aha154x.sys.

Example ARC Pathnames

This section contains examples that you can use as a model. The first two examples are for ARC paths on x86-based computers. The last example is the boot entry on a DEC Alpha AXP 150 computer, and should be good for all RISC-based computers with similar disk configurations.

More Than One SCSI Controller on an x86-based Computer

This example for an x86-based computer has the following disks and controllers:

Two Adaptec 2940s, each with two 1 GB hard disks at ID 0 and ID 1.
One Adaptec 1542, with two 1 GB hard disks at ID 0 and ID 4.

Each hard disk has a single, 1 GB primary partition. Partitions 1 and 2 are on the first 2940, partitions 3 and 4 are on the second 2940, and partitions 5 and 6 are on the 1542. These are the ARC paths that you would have in the Boot.ini file if each partition had a copy of Windows NT installed in a folder named Winnt:

Partition 1: multi(0)disk(0)rdisk(0)partition(1)\Winnt
Partition 2: multi(0)disk(0)rdisk(1)partition(1)\Winnt
Partition 3: scsi(1)disk(0)rdisk(0)partition(1)\Winnt
Partition 4: scsi(1)disk(1)rdisk(0)partition(1)\Winnt
Partition 5: scsi(0)disk(0)rdisk(0)partition(1)\Winnt
Partition 6: scsi(0)disk(4)rdisk(0)partition(1)\Winnt

For partitions 3 and 4, Ntbootdd.sys is a copy of Aic78xx.sys. For partitions 5 and 6, Ntbootdd.sys is a copy of Aha154x.sys. For partitions 1 and 2, you could also use the following paths:

Partition 1: scsi(0)disk(0)rdisk(0)partition(1)\Winnt
Partition 1: scsi(0)disk(1)rdisk(0)partition(1)\Winnt

provided that you had an Ntbootdd.sys file that was a copy of Aic78xx.sys. However, Windows NT Setup always use the multi() syntax for the first two SCSI disks.

Both EIDE and SCSI Controllers on an x86-based Computer

This example is for an x86-based computer with the following disks and controllers:

A dual-channel EIDE controller with three 1 GB disks, two on the primary channel and one on the secondary channel.
An Adaptec 2940 controller with a single 4 GB hard disk at ID 3.

The three EIDE disks each have a single 1 GB partition. Partitions 1 and 2 are on the primary channel of the EIDE controller, and partition 3 is on the secondary channel.

The SCSI disk has four 1 GB partitions. Partitions 4, 5, 6 and 7 are on the SCSI disk. Each partition would have the following ARC paths in the Boot.ini file, assuming that each partition has Windows NT installed in the Winnt folder:

Partition 1: multi(0)disk(0)rdisk(0)partition(1)\Winnt
Partition 2: multi(0)disk(0)rdisk(1)partition(1)\Winnt
Partition 3: multi(0)disk(0)rdisk(2)partition(1)\Winnt
Partition 4: scsi(0)disk(3)rdisk(0)partition(1)\Winnt
Partition 5: scsi(0)disk(3)rdisk(0)partition(2)\Winnt
Partition 6: scsi(0)disk(3)rdisk(0)partition(3)\Winnt
Partition 7: scsi(0)disk(3)rdisk(0)partition(4)\Winnt

Loading Windows NT from partitions 4 through 7 requires that the Ntbootdd.sys file be a copy of Aic78xx.sys.

Boot Selection on a DEC Alpha AXP 150

On a RISC-based computer, all boot paths are defined in the NVRAM. When creating a new boot selection for a RISC-based computer, the firmware menus prompt you for the information to enter. There is an example for defining a boot selection in the section titled "Creating Alternate Boot Selections for a RISC-based Computer," presented later in this chapter.

The following example is a boot selection on a DEC Alpha AXP 150. The computer has a single hard disk at ID 0, which has a 4 MB system partition and a 396 MB boot partition. Windows NT is installed on the boot partition in a folder named Winnt and the OSLOADER folder is also named Winnt, although it is on the system partition. The boot selection has the following values:

LOADIDENTIFIER=Windows NT Workstation 4.0
SYSTEMPARTITION=scsi(0)disk(0)rdisk(1)partition(1)
OSLOADER=scsi(0)disk(0)rdisk(1)partition(1)\Os\Winnt\Osloader.exe
OSLOADPARTITION=scsi(0)disk(0)rdisk(1)partition(2)
OSLOADFILENAME=\Winnt
OSLOADOPTIONS=nodebug

Creating Floppy Disks for Starting Your Computer

For x86-based computers and RISC-based computers, you should create a floppy disk to use to start Windows NT if you cannot start up from the hard disk. For x86-based computers, you can also create a floppy disk that you can use to start MS-DOS if you cannot start Windows NT.

Creating each floppy disk requires two steps:

Format the disk.
Copy files to the disk.

After you create the Windows NT startup floppy disk or the MS-DOS bootable floppy disk, run a virus scan program to make sure the disk is not infected. Lock the floppy disk after you finish running the virus scan. (Most floppy disks have a tab on their back side that you slide down to lock the disk. You cannot write on a floppy disk when the tab is in the locked position.)

You should test each disk before you have to use it. You should also be familiar with using the programs that you copy to the floppy disks.

Depending on your disk configuration and whether you are using an x86-based computer or a RISC-based computer, you might also have to create alternate boot selections to your Windows NT startup floppy disk. For a description of the ARC pathname conventions that you need to use in boot selections, see "Understanding ARC Pathnames," presented earlier in this chapter.

Whenever possible, you should use an ARC path created by Windows NT Setup during an installation. When in doubt, install a copy of Windows NT onto the disk that you want to use for the boot partition, and then copy that ARC path, changing the partition number and folder name as necessary.

Windows NT Startup Floppy Disk

You must format your Windows NT startup floppy disk when you are running Windows NT. You can use My Computer to format the floppy disk, or enter format a: at the command prompt. Both of these utilities copy the Windows NT Partition Boot Sector, which is required to load the Windows NT boot loader, to the floppy disk. Windows NT Help describes the procedure for formatting a floppy disk by using My Computer.

You can use the Windows NT startup floppy disk to start Windows NT in the following circumstances:

The Master Boot Record or Partition Boot Sector on the system partition has a problem.
There are problems with the disk that contains the system partition and the boot partition is on another disk.
You are reconfiguring hard disks and you want to be able to start Windows NT from the Windows NT startup floppy disk if you are having problems.

Note On x86-based computers, if the Partition Table in the Master Boot Record has been corrupted, especially if the information for the system partition or boot partition is all zeroes, you might not be able to start up by using the Windows NT startup floppy disk. If you have a current backup of the Master Boot Record, try starting MS-DOS from the MS-DOS bootable floppy disk, and use the DiskSave program to replace the Master Boot Record.

The files that you need to copy to the floppy disk normally have the Read Only, System, and Hidden attributes set. If the files have either the System or Hidden attribute set, they are not visible. You need to make the files visible before you can copy them.

To copy files to the Windows NT startup floppy disk

Using My Computer or Windows NT Explorer, on the View menu, click Options.
On the View tab, select Show all files. Click OK.
Click the filename of the file to be copied.
On the File menu, click Properties.
In the Attributes box of the General tab, clear the Read Only, System, and Hidden check boxes, and click OK.

Do steps 3, 4, and 5 for each file that you want to copy.
Select the files, and then copy them to the floppy disk.

Files to Copy for an x86-based Computer

Copy the following files from the root folder of your system partition to the floppy disk you just formatted:

NTLDR — Windows NT boot loader program.
Boot.ini — describes the location of the boot partitions, specified by using Advanced RISC Computing (ARC) naming conventions.
Ntdetect.com — used for hardware detection.
Bootsect.dos — if you want to be able to dual-boot another operating system when using the Windows NT startup floppy disk.
Ntbootdd.sys — required only if you are using the scsi() syntax in the Boot.ini file. This file is not present in the root folder if you are using the multi() syntax.

The Ntbootdd.sys file is a renamed copy of the SCSI device driver used on your Windows NT computer. For example, if you are using the Adaptec 1542B SCSI controller, copy Aha154x.sys to the floppy disk, and then rename it to Ntbootdd.sys. If Windows NT Setup created an Ntbootdd.sys in your root folder, just copy that file.

You can find the device driver name by:

Looking in the HKEY_LOCAL_MACHINE \HARDWARE \DeviceMap \Scsi Registry subkey.
Double-clicking the SCSI Adapters option on Control Panel. In the Devices tab, click Properties. Click the Driver tab to see the driver filename.

Creating Alternate Boot Selections for an x86-based Computer

For Windows NT Workstation, you should not have to create alternate boot selections in your Boot.ini file. You might want to have other paths when you are reconfiguring disks. For instance, if you currently have a SCSI disk (with SCSI ID 0) and are adding an IDE disk to your configuration, the IDE disk must be the first one. If your SCSI disk has the BIOS enabled, and the boot partition is

multi(0)disk(0)rdisk(0)partition(1)\Winnt="Windows NT Workstation Version 4.0"

you should disable the BIOS on the SCSI controller and add a second entry of:

scsi(0)disk(0)rdisk(0)partition(1)\Winnt="Windows NT Workstation Version 4.0 SCSI disk"

Note If you had translation enabled when you low-level formatted the SCSI disk, you will not be able to access the disk after you disable the BIOS on the controller.

This second entry enables you to start Windows NT from the SCSI disk to use Disk Administrator to partition and format the IDE disk.

You might also want to create alternate boot selections for debugging purposes. In this case, you can add other entries to the Boot.ini file and append switches to the pathname, such as:

multi(0)disk(0)rdisk(0)partition(1)\Winnt="Windows NT Workstation Version 4.0" /sos /DEBUG

For more information about the switches, see:

Chapter 19, "What Happens When You Start Your Computer."
Chapter 21, "Troubleshooting Startup and Disk Problems."
Chapter 39, "Windows NT Debugger."

The section "Understanding ARC Pathnames," presented earlier in this chapter, contains more information about the pathnames on the Boot.ini file.

Note The Boot.ini file has the Read Only attribute set by default. Remove this attribute before editing the file. Restoring the attribute is optional. Windows NT Setup sets the attribute to prevent accidental deletion.

Files to Copy for a RISC-based Computer

When you install Windows NT on a RISC-based computer, it creates a folder, such as \Os\Winnt40, that contains the Osloader.exe and Hal.dll files. On Alpha AXP–based computers, this folder also contains several files with the .pal extension. Some or all of these files might have the system, hidden, or read-only attributes set.

A Windows NT startup floppy disk for a RISC-based computer should have a folder tree identical to the RISC-based system partition. Therefore, you should create the \Os\Winnt40 folder on the floppy disk.

Copy the following files from the \Os\Winnt40 folder on your hard disk to the same folder on the floppy disk:

Osloader.exe
Hal.dll
*.pal (AXP-based computers only)

Creating Alternate Boot Selections for a RISC-based Computer

RISC-based computers start from the system firmware. You should define a boot selection in the NVRAM that points to a Windows NT startup floppy disk. You only need to use the Windows NT startup floppy disk if there is a problem with the system partition (the partition with OSLOADER). If you do not create a path to the floppy disk ahead of time, and you cannot access the system partition, you will have to create a path to the Windows NT startup floppy disk to be able to start the computer.

For more information about firmware menus, see "Using a RISC-based Computer's Boot Menu" in Chapter 19, "What Happens When You Start Your Computer."

Note There are three types of RISC-based computers: Alpha, MIPS, and PowerPC. The examples in this section are for an Alpha AXP–based computer. The firmware menus that you use to get to the configuration options can be different for MIPS and PowerPC computers.

Creating a Path to the Windows NT Startup Floppy Disk

Once you have created the Windows NT startup floppy disk, you need to create the path to it by using the Add a boot selection menu. These are the steps to get to that menu:

Start the computer. You see the Boot menu.
On the Boot menu, click Supplementary menu.
On the Supplementary menu, click Setup the system.
On the Setup menu, click Manage boot selection menu.
On the Boot selections menu, click Add a boot selection.

The following example shows creating a path to the Windows NT startup floppy disk. Be sure that the path to the Osloader.exe on the Windows NT startup floppy disk matches the path to Osloader.exe on the hard disk.

Note The right justified arrows (<----) in these examples indicate which selection was made, or the information that was entered.

Thursday, 03-07-96 11:18:43 AM

Select a system partition for this boot selection:
SCSI Bus 0 Hard Disk 0 Partition 1
New system partition <-----------------------------------------

Enter location of system partition for this boot selection:
Select Media:
SCSI Hard Disk
Floppy Disk <------------------------------------------------------
CD-ROM

Enter floppy drive number: 0 <---------------------------------

Enter the osloader directory and name: \os\winnt40\osloader.exe <-------

Is the operating system in the same partition as the osloader:
Yes
No <------------------------------------------------------------

Enter the location of os partition:
Select Media:
SCSI Hard Disk <---------------------------------------------------
Floppy Disk
CD-ROM

Enter SCSI bus number: 0 <-------------------------------------
Enter SCSI ID: 2 <-------------------------------------
Enter Partition: 2 <-------------------------------------

Enter the operating system root directory: \winnt40 <----------
Enter a name for this boot selection: start from floppy disk <---------
Do you want to initialize the debugger at boot time:
Yes
No <-----------------------------------------------------------

Note The location of the operating system root folder and the values that you enter for the path to the partition on the SCSI disk depend on your system configuration. The SCSI bus number will usually be 0, but the SCSI ID can be anything from 0 to 6, although 2 is common.

After entering the data, you will be back at the Boot selections menu. Select Setup menu. On the Setup menu, select Supplementary menu, and save changes.

Using Alternate Boot Selections

When you have created alternate boot selections, you start an alternate one by selecting Boot an alternate operating system from the Boot menu. This example shows selecting the alternate operating system option.

ARC Multiboot Alpha AXP Version 3.5-11 
Copyright (c) 1993 Microsoft Corporation
Copyright (c) 1993 Digital Equipment Corporation

Boot Menu:

Boot Windows NT Server Version 4.0
Boot an alternate operating system <-------------------------------
Run a utility
Supplementary menu. . .

Use the arrow keys to select, then press Enter.
Seconds until auto-boot. Select another option to override: 9

If you have added a boot selections for the Windows NT startup floppy disk, as described earlier in this section, and select Boot an alternate operating system, you would see a screen like the following.

ARC Multiboot Alpha AXP Version 3.5-11 
Copyright (c) 1993 Microsoft Corporation
Copyright (c) 1993 Digital Equipment Corporation

Boot Menu:

start from floppy disk
Boot Windows NT Workstation 4.0 (Default)

Use the arrow keys to select, then press Enter.

Each time you create a new boot selection, it becomes the default selection. The preceding example shows the menu if you added a path to the Windows NT startup floppy disk after you had installed Windows NT Workstation 4.0. You should use the Rearrange boot selections menu to change the default boot selection back to the hard disk. See the section titled "Using a RISC-based Computer's Boot Menu ," in Chapter 19, "What Happens When You Start Your Computer," for information about managing boot selections.

MS-DOS Bootable Floppy Disk (x86-based Computers)

An MS-DOS bootable floppy disk is most useful if you have FAT partitions on your startup disk (the disk that contains the system partition that you use to start Windows NT).

Your MS-DOS bootable floppy disk contains the files that you need to start MS-DOS from the floppy disk. It also should contain utilities for examining the contents of disks, copying files, and creating and formatting partitions.

Note You must start the MS-DOS operating system to format the floppy disk that you will be using for your MS-DOS bootable floppy disk. Running format from the command prompt does not copy the correct Partition Boot Sector to the floppy disk.

To create an MS-DOS bootable floppy disk

Start MS-DOS. Put a blank floppy disk in drive A. Type format a: /s and press ENTER. You must specify the /s switch to make the floppy disk bootable. This switch causes the format program to copy the file Command.com to the floppy disk.
Copy other MS-DOS-based utilities that you might want to use to the floppy disk. At a minimum, you should copy these files:

• Attrib

• Copy

• Format

• Fdisk

• Mem

• Sys.com

• a text editor

• DiskSave

Testing

Now that you have created floppy disks to use to start the computer, created an Emergency Repair Disk, and backed up the Master Boot Record and Partition Boot Sector, you should use the utilities and floppy disks to practice recovering from problems. Going through the recovery process will force you to be diligent about making backups (Emergency Repair Disk, Master Boot Record, Partition Boot Sector, and data). You will also have an idea as to how long doing each procedure should take.

You should have a computer that you can use to do the following:

Look at Master Boot Records, Partition Tables, and Partition Boot Sectors.
Find the backup Partition Boot Sector on an NTFS partition.
Deliberately destroy and recover Master Boot Records and Partition Boot Sectors.
Delete Windows NT system files and restore them by using the Emergency Repair Disk.

If you have multiple disks in your configuration or have more than one installation of Windows NT, you should thoroughly test using your Windows NT startup floppy disk to start the computer from each boot partition. This is especially critical on x86-based computers when you have a configuration that has both SCSI and IDE or EIDI disks. Sometimes, when the multi() syntax works to start from a SCSI hard disk, you must modify the Boot.ini file on the Windows NT startup floppy disk to use the scsi() syntax.

Restoring Disk Information

If you have backed up the Registry, Master Boot Records, and Partition Boot Sectors, as recommended earlier in this chapter, you can recover from many disk and startup problems without having to reinstall Windows NT. This section describes using the floppy disks and tools to restart your computer and restore information.

One important thing that you can learn from testing is the best recovery procedure to use in a particular situation. For example, there are several methods that you can use to replace a Partition Boot Sector. You also want to learn when to use the Windows NT startup floppy disk to restart your computer, and when you have to use the repair process and the Emergency Repair Disk to replace files in order to start.

Starting Up by Using the Windows NT Startup Floppy Disk

Using the Windows NT startup floppy disk enables you to start up Windows NT so that you can troubleshoot the problem, recover from the problem, or just get the computer running again. Being able to restart the computer also enables you to finish the work that you need to get done now, and troubleshoot the problem later.

In a way, the Windows NT startup floppy disk is a troubleshooting tool. If you cannot start the computer by using the hard disk, and you can start by using the Windows NT startup floppy disk, the problem is probably one of the following:

There are problems with the disk that contains the system partition, and the boot partition is on another disk.
Something is wrong with the system partition itself, the Partition Boot Sector for the system partition, or the files on the system partition that are needed to start Windows NT.
On an x86-based computer, you are reconfiguring your disks, and your first hard disk does not have a system partition yet.

Using the Emergency Repair Disk

If your system files, Registry information, or Partition Boot Sector are corrupt, and you are unable to start Windows NT by using the Last Known Good control set, you can use the Repair process in Windows NT Setup to restore your system so you can start up.

To repair a Windows NT installation, Setup needs either the configuration information that is saved on the %systemroot%\Repair folder or the Emergency Repair Disk created when you installed the operating system (or you created later by using the Repair Disk program).

You cannot repair all disk problems by using the Emergency Repair Disk. Your Emergency Repair Disk needs to match the version of Windows NT that you have installed on your computer. It also needs to have current configuration information. If you have more than one installation of Windows NT on your computer, you should have an Emergency Repair Disk for each installation. You should never use an Emergency Repair Disk from another computer.

To use the Emergency Repair Disk

Start the computer from the Windows NT Setup disk 1. Insert disk 2 when it is requested. When prompted, select the option to Repair by pressing the R key. Setup displays the following options:
```
[X] Inspect Registry files 
```

[X] Inspect startup environment [X] Verify Windows NT system files [X] Inspect boot sector Continue (perform selected tasks)

A description of each of the options follows this procedure.

Clear all selections that you do not want to use. Click Continue (perform selected tasks).
After disk 3, you will be prompted for the Emergency Repair Disk. Follow the instructions.

Setup displays the following messages after it has finished the repair process:
```
Setup has completed repairs.
```

If there is a floppy disk inserted in drive A:, remove it. Press ENTER to restart your computer.

Inspect Registry Files

The Repair process in Windows NT Setup is one of several ways that you can repair Registry keys. When you select Inspect Registry files, Setup provides you with a list of the Registry files that it can restore. It also warns you that restoring a Registry file can result in information being lost. These are the options:

[ ] SYSTEM (System Configuration)
[ ] SOFTWARE (Software Information)
[ ] DEFAULT (Default User Profile)
[ ] NTUSER.DAT (New User Profile)
[ ] SECURITY (Security Policy) and 
SAM (User Accounts Database)
Continue (perform selected tasks)

Select the key(s) that you want to restore by entering an X between the brackets, such as:

[X] SYSTEM (System Information)

See "Creating an Emergency Repair Disk," presented earlier in this chapter, for information about how often to create the disk, and how to save the current keys.

Inspect Startup Environment

This option verifies that the Windows NT files in the system partition are the correct ones. If any of the files that are needed to start Windows NT are missing or corrupt, Repair replaces them from the Windows NT Workstation CD.

On x86-based computers, if Windows NT is not listed in the Boot.ini file, Repair adds a Windows NT option to the file. If there is no Boot.ini file, Repair creates one.

On a RISC-based computer, Repair inspects and repairs the startup information in the NVRAM.

Verify Windows NT System Files

This option uses a checksum to verify that each file in the installation is good and matches the file that was installed from the Windows NT Workstation CD. Repair uses the Setup.log file on the Emergency Repair Disk to determine what files were installed and their checksums. The repair process also verifies that files needed to start, such as NTLDR and Ntoskrnl.exe, are present and valid. To find out if one or more service packs need to be reinstalled, check Files.lst on each service pack. The Windows NT Workstation CD is required for this option.

When Repair determines that the file on the disk does not match what was installed, it displays a message that identifies the file and asks whether you want to replace it.

Inspect Boot Sector (x86-based Computers)

This option verifies that the Partition Boot Sector on the system partition still references NTLDR, and replaces it from the Emergency Repair Disk if it does not. The Repair process can only replace the Partition Boot Sector for the system partition on the first hard disk. The Repair process can also repair the Partition Boot Sector for the system partition on the startup disk.

If you have saved the Partition Boot Sector, you can also use the procedures described in "Replacing the Master Boot Record and the Partition Boot Sector," presented later in this chapter, to replace it.

Restoring Registry Information

There are several methods that you can use to restore Registry information.

You can use the Repair process in Windows NT Setup, which requires the Emergency Repair Disk.
If you have used Windows NT Backup or the Windows NT Workstation Resource Kit program Regback.exe to back up the Registry, you can restore the keys from the backup media.
You can restore just the SYSTEM key or the DISK subkey by using the procedures described in this section.

Note Windows NT Setup and the Repair Disk program store Registry information on the Emergency Repair Disk in compressed format. If you decide to restore the key from the Emergency Repair Disk by using either Disk Administrator or the Registry Editor, you can uncompress the System._ file by using one of the expand utilities. See Chapter 22, "Disk, File System, and Backup Utilities."

Restoring the SYSTEM Key

You can use the procedures in this section to restore the SYSTEM key. Because the Emergency Repair Disk also contains this key, you would generally use these procedures only if:

You do not have an Emergency Repair Disk.
You cannot read the Emergency Repair Disk, or the information isn't current.
You had to reinstall Windows NT Workstation and want to have the most recent configuration information.

To use this procedure, you need to have saved the information, following the procedures in the section titled "Saving the SYSTEM Key," presented earlier in this chapter.

To use Disk Administrator to restore the SYSTEM key

On the Partition menu, click Configuration.
On the Configuration menu, click Restore.

A message warns you that this operation will overwrite your current disk configuration information with what was previously saved on the floppy disk. Also, any changes made during this session will be lost.
Insert the floppy disk containing the saved configuration information.
Click OK.

Disk Administrator initiates a restart of your computer.

If you do not have a floppy disk that contains the current SYSTEM key, you can search for other Windows NT installations and restore the key from systemroot\System32\Config\System. In this case, the information might not match the configuration that you had been using.

To use Disk Administrator to search for and restore the SYSTEM key

On the Partition menu, click Configuration.
On the Configuration menu, click Search.

A message warns you that this operation will overwrite your current disk configuration information with the information from a different installation of Windows NT. Also, any changes made during this session will be lost.
Click OK.

Disk Administrator scans your disk for other Windows NT installations, and displays a list of the installations.
Select an installation.
Click OK.

Disk Administrator initiates a restart of your computer.

See Chapter 36, "General Troubleshooting," for details about troubleshooting problems by using the SYSTEM key.

Restoring the DISK Subkey

Both the Repair Disk program and Disk Administrator save the DISK subkey with the other information that they save. You would use this procedure only if you do not have current information on either of these media or you cannot read them. You might also want to use this procedure in special situations to restore just the DISK subkey, such as having to move a stripe set from one computer to another when the first computer has failed.

If you have previously saved the DISK subkey by using the Registry Editor (see the section titled "Saving Registry Information," earlier in this chapter), then you can restore it.

To restore the DISK subkey

Select the Registry key HKEY_LOCAL_MACHINE \SYSTEM \DISK.
On the Registry menu, click Restore.
Enter the filename or click the path to the file.

If you are restoring the key to a remote computer's Registry, the C drive designation that appears in the scroll list refers to the C drive on the remote computer.
Click OK.

Replacing the Master Boot Record and the Partition Boot Sector

For information about determining if you have a problem with either of these disk sectors, and procedures for displaying them, see Chapter 21, "Troubleshooting Startup and Disk Problems." For information about the utilities that you can use to save, replace, and edit these disk sectors, see Chapter 22, "Disk, File System, and Backup Utilities."

Caution Be careful when you use the low-level disk editors described in this section. If you replace the wrong sector, or change individual bytes to the wrong data, you can make your problems far worse. You could destroy information that is needed by Windows NT, and your only option would be to reformat the partition or the entire disk.

Replacing the Master Boot Record

There are two problems that can occur in the sector containing the Master Boot Record:

The Master Boot Record might be corrupt.
The Partition Tables can be damaged.

On many x86-based computers, the fastest and simplest way to replace the Master Boot Record is to use an MS-DOS bootable floppy disk with the MS-DOS-based program Fdisk on it.

Caution Do not use Fdisk to replace the Master Boot Record if you are using a:

Third-party translation program.
Dual-boot program that writes information in the area between the code and the Partition Table.
Third-party partitioning program that writes information in the area between the code and the Partition Table.

If you do not know whether you are using a program like this, you should not use this method.

To replace the Master Boot Record

Start the computer by using the MS-DOS bootable floppy disk. (You did run virus check and lock the floppy disk after you made it, didn't you?)
At the A:\ prompt, type fdisk /mbr.

This command replaces the Master Boot Record without altering the Partition Tables at the end of the sector. There is no message or response.

If there is a Windows NT disk signature in the Master Boot Record, it is overwritten by the new Master Boot Record. Overwriting the disk signature is a problem only if the disk contains partitions or logical drives that are members of volume sets or stripe sets. You can safely overwrite the disk signature when the disk has no volume sets or stripe sets, because Disk Administrator writes a new disk signature the next time you run it.

Note The fdisk /mbr command requires MS-DOS 5.0 or later, and only works on the first hard disk on the computer.

If you have saved the Master Boot Record by using either DiskSave (x86-based computers only) or DiskProbe, you can use one of these utilities to replace the Master Boot Record. These utilities rewrite the entire sector, including the Partition Table. If you cannot start Windows NT from the hard disk, you can usually start the computer by using the Windows NT startup floppy disk if you want to use DiskProbe to replace the Master Boot Record.

If none of these methods are available to you, you can use a low-level disk editor to copy a good Master Boot Record from another disk to the startup disk (usually disk 0 on x86-based computers). Since the smallest disk write is a sector, when you copy the Master Boot Record from another disk, you are also copying the other disk's Partition Table, which is not valid for the current disk. Therefore, you must first write down the partition information in the Master Boot Record that you are going to replace, starting from 0x1BE. You have to manually reenter the Partition Table information in hex format into the newly copied sector.

If you can start Windows NT by using the Windows NT startup floppy disk, you can use DiskMap to print a map of the disk. When you have copied a Master Boot Record from another computer of the same type (for example, another computer made by the same manufacturer with the same models of disk controllers), use DiskProbe to enter the information for the Partition Table. For information about DiskMap and DiskProbe, see Chapter 22, "Disk, File System, and Backup Utilities."

After you have replaced the Master Boot Record, you should check that it is now correct. If the Master Boot Record is not correct after replacing it, there is either a hardware problem, such as incorrect SCSI termination, or (on x86-based computers) there is a virus in memory that is trapping INT 13 calls. You have to isolate and correct the problem that is corrupting the Master Boot Record.

Repairing the Partition Table

If you have not changed the Partition Table since you saved the Master Boot Record, replacing the Master Boot Record also replaces the Partition Table.

If you have made only minor changes to the Partition Table since you saved the Master Boot Record, you might be able to use the information on the backup to help you repair the Partition Table. For instance, if the only change you have made is to convert a partition from FAT to NTFS, just change the System ID byte from 06 to 07.

If your disk has more than one partition, and you did not save the Master Boot Record or write down the information, you might be able to reconstruct it. You can use DiskProbe to edit the Partition Table.

Note If you will have to completely rebuild your Partition Table, either because of corruption or you had to copy the Master Boot Record from another computer, it might be safer to completely rebuild your disk. In this case, you should back up all of your files to tape (or another computer), recreate and reformat the partitions on the hard disk, and restore the data. If the disk with the invalid Partition Table contains your system or your boot partition, you will probably have to use the Windows NT startup floppy disk to start your computer.

Replacing the Partition Boot Sector

There are several methods that you can use to replace the Partition Boot Sector.

If you have saved the Partition Boot Sector by using either the DiskProbe or the DiskSave program, you can replace the sector from the backup. This is the fastest way to replace the Partition Boot Sector.

For NTFS volumes, there is one other alternative. When you create or reformat an existing volume as an NTFS volume, the NTFS file system writes a duplicate of the Partition Boot Sector at the end of the volume (Windows NT version 4.0) or at the logical center of the volume (Windows NT 3.51 and earlier). You can use the Windows NT–based program DiskProbe to locate and copy this sector to the beginning of the volume. There are also third-party MS-DOS-based disk utilities that you can use to locate and copy this sector.

You might want to display the Partition Boot Sector to make sure it is now correct. Once you have copied the Partition Boot Sector to the first sector of the partition, you should be able to start Windows NT.

Restoring Windows NT Files on the System Partition

If any of the files that Windows NT installs on the system partition are missing or corrupt, you cannot start your computer. These are the files:

x86-based file	Folder	RISC-based file	Folder
NTLDR	root	Osloader.exe	\Os\Winnt40
Boot.ini	root	no equivalent
Bootsect.dos	root	no equivalent
Ntdetect.com	root	no equivalent
Ntbootdd.sys (SCSI only)	root	no equivalent
Hal.dll is in the boot partition		Hal.dll	\Os\Winnt40
no equivalent		*.pal files (Alpha-based computers)	\Os\Winnt40

You can restore any of these files by using the Repair process and the Emergency Repair Disk. However, because you copied these files to your Windows NT startup floppy disk when you created it, you can use that disk to restore them.

To use the Windows NT startup floppy disk to restore system files

Start your computer by using the Windows NT startup floppy disk.
Replace individual files, or replace all of the files, by copying them from the Windows NT startup floppy disk to the corresponding location on your system partition.

Using an Uninterruptable Power Supply

An Uninterruptable Power Supply (UPS) supplies power to a computer system in the event of a power fluctuation or complete power loss. The UPS has electronics built in that constantly monitor line voltages. If the line voltage fluctuates above or below predefined limits, or fails entirely, the UPS supplies power to the computer system from built-in batteries. The UPS converts the relatively low Direct Current (DC) battery voltage into the Alternating Current (AC) voltage required by the computer system. The changeover to batteries must take place very rapidly or the computer can lose data.

Most UPS devices are one of the following types:

Online UPS. You connect an online UPS between the main power and the computer to constantly supply your computer system with power. Connecting it to the main power keeps its battery charged. This method provides power conditioning, which means that it removes spikes, surges, sags, and noise.
Standby UPS. This device is configured to provide either the main power or its own power source and to switch from one to the other as necessary. When the main power is available, the UPS device connects the main power directly to the computer and monitors the main power voltage level. When the main power fails or the voltage falls below an acceptable level, the UPS device switches the power fed to the computer from the main power to its own power.

UPS systems provide a hardware interface that can be connected to the computer. Using appropriate software, this interface enables an orderly handling of the power failure, including performing a system shutdown before the UPS batteries are depleted. Without such software, an orderly shutdown of the system is not possible without human intervention.

The most important consideration in selecting a UPS product is to use only hardware that is listed on the Windows NT 4.0 Hardware Compatibility List (HCL). Other items to consider are:

Whether to use a UPS per computer or have larger capacity, centralized UPSs that protect multiple computers.
What type of UPS you want (standby and online are the most common).
The sizing for the UPS (how big the UPS needs to be to protect the load).
How long it needs to keep running before automatic shutdown.

Which features you want to have in your UPS, such as:
- Continuous conditioning of the incoming power to provide clean, steady power.
- A Simple Network Management Protocol (SNMP) card that you can plug into the UPS and use network management software to remotely monitor the UPS.
- Software that logs UPS information to the event log, or produces statistics.
- Software for testing the integrity and reliability of the UPS battery.

Windows NT has built-in UPS functionality that takes advantage of the special features that many UPS systems provide. These features ensure the integrity of data on the system and provide for an orderly shutdown of both the computer system and the UPS should a power failure last long enough that the UPS batteries become depleted. In addition, users connected to a computer running Windows NT Workstation can be notified that a shutdown will occur and new users are prevented from connecting to the computer. Finally, damage to the hardware from a sudden, uncontrolled shutdown can be prevented.

Some vendors also provide a user interface for configuring the UPS, which you can use instead of the one provided in Windows NT.

This section contains a general overview of the Windows NT UPS service and discusses configuring and using the UPS on a computer running Windows NT. To fully protect your network, you should also install UPSs on network devices such as routers, hubs, and bridges. For the best protection, install UPSs on the cables that connect your computer and modem, telephone, printer, and network equipment.

Configuring the UPS Service

Use the UPS option on Control Panel to configure the Windows NT UPS service. The following dialog box is displayed:

Cc751045.xwr_s02(en-us,TechNet.10).gif

You need to specify the serial port that the UPS is installed on. The information that you enter in the other fields depends upon your specific UPS and how you want to use it.

When selecting the signals to use in the UPS Configuration group box, the interface voltages you specify are those that indicate an active state for the signal. In other words, if you select a negative interface voltage for the power failure signal, this means that the signal is normally positive and changes to negative when a power failure occurs.

If you want the UPS service to run a command file when a power failure occurs, select the Execute Command File check box and enter the name of the file. Windows NT terminates the command file if it does not complete its execution within 30 seconds. The command file should not contain a dialog box, since waiting for user input could exceed the 30 second requirement.

The command file must reside in your %systemroot%\system32 folder and have one of the following extensions:

.exe
.com
.bat
.cmd

If your UPS does not have a low battery signal, you need to set the fields in the UPS Characteristics group box. The documentation from your UPS vendor should specify the battery recharge rate.

At startup, the UPS service assumes that the battery has no charge. If the battery recharge rate is 100 minutes per minute of run time, the computer has to run for 100 minutes before Windows NT expects the battery to have one minute of life.

Signals Used by the UPS Service

Windows NT uses a serial (COM) port to connect to the UPS. Table 20.1 shows the signals that the Windows NT UPS service uses to communicate with the UPS, the associated pin numbers, and the function each signal provides to the UPS service. You need to know which of these signals your UPS supports so that you can configure the UPS service.

If you use a UPS service provided by your UPS vendor, the signals and their usage will probably be different than the signals that the Windows NT UPS service uses.

RS-232 Signal	9 Pin Connector Pin #	25 Pin Connector Pin #	UPS Usage
CTS	8	5	Power failure
DCD	1	8	Low battery
DTR	4	20	UPS shutdown

In the UPS Configuration group box, check the boxes that correspond to the signals that your UPS supports. For each of these signals, the UPS Interface Voltages (negative or positive) indicates the voltage present when that event occurs.

Low Battery Signal

When the UPS battery begins to run low, the UPS uses this signal to notify the UPS service.

When fully charged, UPSs typically deliver from five to 20 minutes of DC power after AC power has failed. If your UPS can detect when the battery is running down, you should check the low battery signal box in the UPS Configuration group box.

If you do not check the low battery signal box, the UPS service uses the information in the UPS Characteristics group box to estimate how much time remains on the battery after a power failure.

Remote UPS Shutdown

You want to conserve the life of the UPS battery for as long as possible. The UPS service uses the UPS Shutdown signal to notify the UPS that Windows NT has completed its orderly shutdown and that the UPS can shut off power to the computer.

Power Failure Signal

The power failure signal is generated by the UPS to signal the UPS service that a power failure has occurred. The Windows NT processing that occurs when it receives this signal depends upon whether the UPS can send a low battery signal.

If the UPS can send a low battery signal:

The Windows NT UPS service waits the amount of time specified in the Time between power failure and initial warning message field of the UPS Service group box. It then sends a message to all users connected to the computer running Windows NT telling them that a power failure has occurred. No more users can connect to the computer after the message is sent.
If a signal is received from the UPS indicating that power has been restored before the low battery signal occurs, normal operations are resumed. Users are again allowed to connect to the computer.
When the UPS signals a low battery condition, the file specified in the Execute Command File group box is executed. After execution of this file, Windows NT initiates shutdown.
Once the shutdown is complete, the UPS service signals the UPS that battery power can be turned off if you have checked Remote UPS Shutdown.

If the UPS cannot send a low battery signal:

The UPS service computes the expected battery life left by dividing the Battery recharge time per minute of run time (in the UPS Characteristics group box) into the amount of time that Windows NT has been running. If the result is less than two minutes, then the file specified in the Execute Command File group box is executed and allowed 30 seconds to complete. Windows NT then initiates a shutdown.
If the expected battery life is greater than two minutes, the UPS service waits the amount of time specified in the Time between power failure and initial warning message field of the UPS Service group box. It then sends a message to all users connected to the computer running Windows NT telling them that a power failure has occurred. No more users can connect to the computer after the message is sent.
If a signal is received from the UPS indicating that power has been restored while the expected battery life is still greater than two minutes, normal operation resumes. Users are again allowed to connect to the computer.
When the calculated battery life reaches two minutes, the file specified in the Execute Command File group box is executed. After execution of this file, Windows NT initiates shutdown. If the program takes longer than 30 seconds to complete, Windows NT terminates it, and final shutdown take places.
Once the shutdown is complete, the UPS service signals the UPS that battery power can be turned off if you have checked Remote UPS Shutdown.

Using the UPS Service

You should use the following Windows NT services in combination with the Windows NT UPS service:

Alerter
Messenger
EventLog

The Alerter service sends alerts to selected users. The Messenger service sends messages to your local computer and to other users on the network who are running Windows NT. All detected power fluctuations and power failures are recorded in the event log, along with UPS service start failures and shutdown initiations.

If you want the UPS service to start each time you start your computer, you need to modify the startup information.

To start the UPS service automatically

On Control Panel, double-click Services.
On the Services dialog box, click UPS, then click Startup.
On the UPS Service dialog box, select Automatic, and then click OK.

You might need to use the preceding procedure to set the other services to start automatically.

Testing the UPS

When the UPS service is started, it verifies the settings in the UPS dialog box by ensuring that the signal polarity on the CTS and DCD pins is opposite to that specified as the failure condition in the UPS dialog box. For example, if the UPS dialog box specifies that the UPS device supports a Power Failure Signal (CTS pin) with a positive signal, the UPS service checks to make sure that this pin is not already asserted positive (which would not happen unless you had started the system during a power failure).

This has some important implications. With an online UPS, the UPS device might shut itself off immediately if the configuration is incorrect. With a standby UPS, an incorrect configuration typically shuts the UPS device off as soon as a power failure is detected, effectively circumventing the purpose of the UPS. This is why it is important to configure and test your UPS device to ensure that it operates correctly.

On x86-based computers, there is one other reason that it is important to test your UPS. During startup, Windows NT sends a detection signal to each port in order to recognize hardware attached to that port. Some UPS units using serial monitoring implementations respond to the detection signal by turning off. If this happens, use the /NoSerialMice switch in the Boot.ini file to prevent the system from sending this signal to the COM port to which your UPS unit is connected.

You can use multiple /NoSerialMice switches. The format is:

/NoSerialMice=[COMx | COMx,COMy,COMz,...]

If /NoSerialMice is specified without parameters, serial mouse detection is disabled on all the serial ports.
If /NoSerialMice=COMx is specified, serial mouse detection is only disabled on COMx.
If /NoSerialMice=COMx,COMy,COMz ... is specified, serial mouse detection is disabled on each of the specified ports.

To ensure that the computer is protected from power failures, you can test it by simulating a power failure (that is, by disconnecting the main power supply to the UPS device). Your computer and peripherals connected to the UPS device should remain operational, and messages should be displayed and events logged. Wait until the UPS battery reaches a low level to verify that a graceful shutdown occurs. Restore the main power to the UPS device, and check the event log to ensure that all actions were logged and that there were no errors.

Note Before you begin any UPS tests, make sure that your UPS has sufficient charge built up to run all of the devices connected to it for at least the duration of the test.

Simulating UPS Operation

The next figure shows a simple simulator that you can build to emulate the power failure and low battery signals from a UPS.

Cc751045.xwr_s03(en-us,TechNet.10).gif

Figure 20.1 UPS Simulator

Note The pins numbers in the diagram are for a 9-pin serial port. For a 25-pin connector, use the pin numbers in parenthesis.

You can use two Single Pole Double Throw (SPDT) switches to construct the UPS simulator. To simulate normal operation, set both switches 1 and 2 to make contact with pin 7 (pin 4 on a 25-pin connector). Set both the Power failure signal and Low battery signal at least 2 minutes before shutdown to Negative in the UPS dialog box.

To simulate a power failure, move switch 1 to make contact with pin 3 (pin 2 on a 25-pin connector). Moving switch 2 to make contact with pin 3 simulates a low battery condition.

Simulating Power Failure and Low Battery Signals

To simulate the operation of a UPS with both a Power Failure and Low Battery signal, have both switches making contact with pin 7. Configure your UPS as shown in this dialog box:

Cc751045.xwr_s04(en-us,TechNet.10).gif

Flip switch 1 to simulate a Power Failure signal. After five seconds, the initial warning message should be displayed. Every 120 seconds, the warning message should be displayed again.

When you know that the Power Failure signal processing is working correctly, flip switch 2. If you have checked the Execute Command File check box and specified a filename, the file should begin execution immediately. If the file does not finish executing within 30 seconds, Windows NT should terminate it. Windows NT should perform an orderly shutdown after the file terminates or immediately after the Power Failure signal if no file is specified.

Simulating UPS With Power Failure Signal Only

To simulate the operation of a UPS with only a Power Failure signal, have both switches making contact with pin 7. For purposes of this test, you can set the values in the UPS Characteristics group box to make it seem that your computer does not have to run very long before the battery is fully charged. When you set the values this way, you have to make sure that your battery does have enough charge to be able to complete the tests. For instance, if you set the values as shown in this dialog box, and let your computer run for 20 minutes, the UPS service assumes that the battery is fully charged.

Cc751045.xwr_s05(en-us,TechNet.10).gif

You can test two scenarios with this configuration:

If you connect switch 1 to pin 3 within four minutes of starting the UPS service, the expected battery life is less than two minutes, and Windows NT should begin shutdown immediately.
If you allow the computer to run for 20 minutes before you flip switch 1, the battery is assumed to be fully charged. When you flip switch 1, the warning message should be displayed after five seconds. Every 120 seconds, another warning message should be displayed. Shutdown should not begin until the expected battery life decreases to two minutes.