Troubleshooting Tools and Strategies

The Recovery Console is a startable text-mode command interpreter environment separate from the Windows 2000 command prompt that allows the system administrator access to the hard disk of computer running Windows 2000 Professional, regardless of the file format used, for basic troubleshooting and system maintenance tasks. Since Windows 2000 does not need to be running to use Recovery Console, it is most useful when a Windows 2000 – based computer does not start properly or cannot start at all.

The Recovery Console allows you to obtain limited access to NTFS file system, file allocation table (FAT) 16, and FAT32 volumes without starting the graphical interface. The Recovery Console allows administrators to manage files and folders, start and stop services, and repair the system. It can also be used to repair the master boot record (MBR) and boot sectors and to format volumes. The Recovery Console also prevents unauthorized access to volumes by requiring the user to enter the system administrator password before using the console.

Starting the Recovery Console

To start the Recovery Console, start the computer from the Windows 2000 operating system CD or the Windows 2000 Setup floppy disks. If you do not have Windows 2000 Setup floppy disks and your computer cannot start from the CD, use another Windows 2000 – based computer to create the setup disks. For information about creating the Windows 2000 Setup floppy disks, see Windows 2000 Professional Help.

Note

The Recovery Console can also be installed to the local hard disk and accessed from the Windows 2000 startup menu. However, if the MBR or system volume boot sector have been damaged, you need to start the computer from either the Setup floppy disks or the Windows 2000 Professional operating system CD to access the Recovery Console.

To add the Recovery Console to existing installations of Windows 2000, carry out the following command from the Windows 2000 operating system CD in the Run dialog box:

d
:\I386\Winnt32.exe /cmdcons

where d: represents the CD-ROM drive. This installation requires approximately 7 megabytes (MB) of disk space on your system volume.

This only works correctly if your computer does not contain a mirrored volume. To install the Recovery Console on a computer that contains a mirrored volume, first break the mirror. After the Recovery Console is installed, you can re-establish the mirrored volume. For more information, see the Microsoft Knowledge Base link on the Web Resources page at https://windows.microsoft.com/windows2000/reskit/webresources .

Start the computer from either the Windows 2000 Setup disks or the operating system CD, and then enter Windows 2000 Setup. Press ENTER at the Setup Notification screen to go to the Welcome to Setup screen. Press R to repair a Windows 2000 installation, and then press C to use the Recovery Console.

The Recovery Console displays valid Windows 2000 installations and prompts you select the installation to repair. To access the disk with the Recovery Console, press the number key for the Windows 2000 installation that you want to repair, and then press ENTER. If you press ENTER without typing a number, the Recovery Console quits and restarts the computer.

Note

The Recovery Console might show installations of Microsoft Windows NT. However, the results of attempting to access a Windows NT installation from the Recovery Console can be unpredictable. Only use the Recovery Console to fix Windows 2000 installations.

Mirrored volumes appear twice in the Recovery Console startup menu, but each entry uses the same drive letter, indicating a reference to the same disk.

The Recovery Console then prompts you for the local administrator account password. If you do not enter the correct password after three attempts, Recovery Console refuses access to the local disks and restarts the computer.

Note

If the registry is corrupted or missing or no valid installations are found, the Recovery Console starts in the root of the startup volume without requiring a password. You cannot access any folders, but you can carry out commands such as chkdsk , fixboot , and fixmbr for limited disk repairs.

After the password is validated, you can access the following folders on your computer:

• The root folder of any volume.

• %systemroot% and subfolders of the Windows 2000 installation on which you are currently logged on.

• \Cmdcons and subfolders (if they exist).

• Folders on removable media disks, such as CD-ROM and floppy disks.

By default, the Recovery Console prevents access to other folders such as Program Files or Documents and Settings, and folders containing other installations of Windows 2000. This can be changed by using local Group Policy settings. For more information about using Group Policy to change the default behavior of the Recovery Console, see the procedure on setting the policy later in this section. For access to other Windows 2000 installation folders, restart the Recovery Console, and select that installation.

Using the Recovery Console

You cannot copy a file from the local hard disk to a floppy disk. However, you can copy a file from a floppy disk or a CD-ROM to any hard disk, and from one hard disk to another. The Recovery Console displays an Access is denied error message when it detects invalid commands.

You cannot run any programs or commands other than the supported commands listed later in this section. The Recovery Console contains no editing capabilities.

Important

The set command makes use of Recovery Console environment variables to enable, among other options, disk write access to floppy disks. To enable the user to modify the restricted default Recovery Console environment variables, a Group Policy setting must be made. For more information about enabling the set command in Recovery Console, see the procedure at the end of this section.

The Recovery Console buffers previously entered commands and makes them available to the user by means of the UP ARROW and DOWN ARROW keys. To edit a previously entered command, use BACKSPACE to move the cursor to the point where you want to make the edit and rekey the remainder of the command.

To quit and restart the computer, at the command prompt, type:

exit

Important

The Recovery Console might not map disk volumes with the same drive letters found in Windows 2000. If you are having trouble locating files to copy make sure that the drive mappings for both the source and the target locations are correct. If not, examine other drive letters for the file you are seeking. In addition, some volumes might not have drive letters assigned to them, such as volumes formatted with NTFS and grafted onto the folder structure of another volume by the use of volume mount points. Use the map command to confirm which drive letters and unnamed volumes correspond to which local volumes on the system. For more information about volume mount points, see File Systems in this book.

Several of the Recovery Console commands are not fully functional to users who have converted to dynamic disk. For more information about dynamic disks, see Disks Concepts and Troubleshooting in this book.

Supported Commands

Table 31.3 lists the commands that are supported by the Recovery Console.

Table 31.3 Available Recovery Console Commands

attrib -|+[c][h][r][s] filename

+   Sets an attribute.

-   Clears an attribute.

c   Compressed file attribute.

h   Hidden file attribute.

r   Read-only file attribute.

s   System file attribute.

batch inputfile [outputfile]

inputfile    Specifies the text file that contains the list of commands to

be executed.

outputfile   Contains the output of commands listed in inputfile.

cd [path]|[..]|[drive:]

chdir [path]|[..]|[drive:]

path     Changes to the specified folder on the same volume.

..       Changes to the parent folder.

drive:   Displays the active folder of the volume specified.

Using no switches displays the current volume and folder.

chkdsk [drive:] [/p]|[/r]

drive:   Specifies the volume to check.

/p       Forces check if volume is not identified as bad.

/r       Locates bad sectors and recovers readable information (/p is

automatic).

copy source [target]

source  Specifies the file to be copied.

target  Specifies the destination folder and/or filename for the new file.

del [drive:][path]filename

delete [drive:][path]filename

drive:     Specifies the volume on which the file to be deletes resides.

path       Specifies the location within the folder structure of the file 

to be deleted.

filename   Specific file to be deleted.

dir [drive:][path][filename]

drive:     Specifies the volume on which the files to be displayed 

reside.

path       Specifies the location within the folder structure of the 

files to be displayed.

filename   Specific file to be displayed.

a   Archive                        h   Hidden

c   Compressed                     p   Reparse point

d   Directory                      r   Read-only

e   Encrypted                      s   System file

disable servicename

servicename   Name of the service or driver to be disabled.

SERVICE_DISABLED

SERVICE_BOOT_START

SERVICE_SYSTEM_START

SERVICE_AUTO_START

SERVICE_DEMAND_START

diskpart[/add|/delete] [device-name|drive-name|partition-name] [size]

/add             Create a new partition.

/delete          Delete an existing partition.

device-name      Device name for creating a new partition (such as 

\Device\HardDisk0).

drive-name       Drive-letter based name for deleting an existing 

partition (such as D:).

partition-name   Partition-based name for deleting an existing partition 

and can be used in place of the drive-name argument (such 

as \Device\HardDisk0\Partition1).

size             Size of the new partition, in megabytes.

enable servicename [start_type]

servicename   Name of the service or driver to be enabled.

start_type    How the service or driver is scheduled to be started. Valid 

values include:

SERVICE_BOOT_START

SERVICE_SYSTEM_START

SERVICE_AUTO_START

SERVICE_DEMAND_START

expand source [/f:filespec] [target] [/y]

expand source [/f:filespec] /d

source        Specifies the file to be expanded. May not include wildcard 

(* and ?) characters.

target        Specifies the destination folder and/or file name for the 

new file.

/y            Do not prompt before overwriting existing file.

/f:filespec   If source contains more than one file, this parameter is 

required to identify the specific file(s) to be expanded.

May use wildcards.

/d            Do not expand—only display a folder of the files which are 

contained in the source.

fixboot [drive:]

drive:   Specifies the volume on which to rewrite a new boot sector.

fixmbr [device-name]

device-name   Specifies the name of device needing a new MBR (such as 

\Device\HardDisk1).

format [drive:] [/q] [/fs:file_system]

drive:            Specifies the volume to format.

/q                Performs a quick format.

/fs:file_system   Specifies the file system use. Valid values for 

file_system include FAT, FAT32, and NTFS.

help [command]

command   Any Recovery Console command.

map [arc]

arc   Forces the use of Advanced RISC Computing (ARC) specification name 

paths instead of Windows device paths. This can be used in 

recreating the Boot.ini file.

md [drive:]path

mkdir [drive:]path

drive:   Specifies the volume on which to create a folder.

path     Specifies the name of the folder to be created.

more filename

type filename

filename   Specifies text file to be displayed.

ENTER      Scroll down one line at a time.

SPACEBAR   Scroll down one page at a time.

ESC        Quit viewing text file.

rd [drive:]path

rmdir [drive:]path

drive:   Specifies the volume on which to delete a folder.

path     Specifies the name of the folder to be deleted.

ren [drive:][path]filename1 filename2

rename [drive:][path]filename1 filename2

drive:      Specifies the volume on which the file to be renamed resides.

path        Specifies the location within the folder structure of the file 

to be renamed.

filename1   Specific file to be renamed.

filename2   New filename.

set [variable = value]

The following environment variables are supported:

AllowWildCards        Enable wildcard support for some commands, such as 

DEL, that do not otherwise support them.

AllowAllPaths         Allow access to all files and folders on the 

computer.

AllowRemovableMedia   Allow files to be copied to removable media, such as 

floppy disks.

NoCopyPrompt          Do not prompt when overwriting file.

Note

The switch /? displays a help screen offering a description of each command, its syntax, arguments (if any exist), and other useful information.

Arguments and switches listed between brackets ([and ]) are optional. Arguments and switches listed between pipes (|) are either/or choices.

To enable full functionality of the set command using Group Policy

Note

If the Group Policy snap-in has already been added to your MMC, then skip to step 8.

1. From the Start menu, click Run , and then type: mmc

2. From the Console1 dialog box, click the Console menu, and then select Add/Remove Snap-in .

3. Click Add .

4. Select Group Policy , and then click Add .

5. In the Group Policy Object list box, select Local Computer , and then click Finish .

6. In the Add Standalone Snap-in dialog box, click Close .

7. In the Add/Remove Snap-in dialog box, click OK .

8. Expand Local Computer Policy .

9. Expand Computer Configuration , Windows Settings , Security Settings , and Local Policies .

10. Click Security Options .

11. Double-click the policy Recovery Console: Allow floppy copy and access to all volumes and folders .

12. In the Local Security Policy Setting dialog box, select Enabled , and then click OK . Important If you are using computers running Windows 2000 Professional on a Microsoft Windows 2000 Server – based network, use Group Policy from the server to control this functionality. It is more efficient to set this policy in one place and have the workstations automatically implement it when logging on to the network than to implement it on each workstation. Note You can also use the Group Policy snap-in to enable the policy Recovery Console: Allow automatic administrative logon , allowing you to bypass the logon process when the Recovery Console is started. Activating this policy eliminates a security barrier used to protect your computer against intruders. You should only enable this policy on systems that have controlled access to the console, such as those in rooms that can be locked. Both of the settings available in the Group Policy snap-in can also be made through the Security Configuration and Analysis snap-in.

For more information about setting up, starting, and using Group Policy, see Customizing the Desktop in this book.

Using the Recovery Console to Restore the Registry

If you know your registry is damaged, or some of your registry files are corrupted or have been deleted, you might be able to use the Recovery Console to restore your registry. However, this procedure can only work if you regularly create an Emergency Repair Disk (ERD) and you choose the option to back up your registry to the repair directory. For more information about backing up the registry when creating the ERD, see Emergency Repair Process later in this chapter.

When you create an ERD and you choose this option, the current version of your registry files are copied from the %systemroot%\System32\Config folder to the %systemroot%\Repair\RegBack folder. Since both of these folders are accessible through the Recovery Console, you can use the copy command to restore the files.

To restore the Registry by using the Recovery Console

Warning

Only use this procedure if you are certain which registry file needs to be restored, and you are certain that the restoration will not cause other damage to your computer. Restoring registry files improperly can prevent your system from starting and can cause you to lose data.

1. Start the Recovery Console and log on to the Windows 2000 installation containing the registry that you want to restore.

2. To copy the files you want from %systemroot%\Repair\RegBack to %systemroot%\System32\Config, type: cd repair\regback and: copy file_namedrive_letter** :\system_root \system32\config where file_name is the registry file you want to restore, drive_letter is the drive letter where your system is installed (for example, C), and system_root is the system installation folder (for example, Winnt). Note As a precaution, first rename the existing file in the Config folder that you intend to restore from backup. If a problem arises from the restoration attempt, you can restore the renamed file to return your system to its original condition. To restore your entire registry, you need to copy the files Default, Sam, Security, Software, and System.

3. To exit the Recovery Console, type: exit