Microsoft IT Implements Microsoft Diagnostics and Recovery Toolset 7.0

Technical Case Study

Published: March 2012

The following content may no longer reflect Microsoft’s current position or infrastructure. This content should be viewed as reference documentation only, to inform IT business decisions within your own company or organization.

Learn how Microsoft Information Technology (Microsoft IT) deployed Microsoft® Diagnostics and Recovery Toolset 7.0 (DaRT) to help troubleshoot, repair, and recover Windows-based PCs. DaRT is part of the Microsoft Desktop Optimization Pack (MDOP) suite of technologies and provides administrators with the ability to recover unusable PCs, diagnose issues and causes, and repair unbootable or locked-out systems. By making DaRT available to Help Desk Technicians and corporate network connected users worldwide, Microsoft IT enabled Help Desk Technicians and users to work together through a remote connection to troubleshoot and repair system issues.


Download Technical Case Study, 228 KB, Microsoft Word file




Products & Technologies

In an effort to improve the recovery options available to users who experienced system failures on their Windows-based PCs, Microsoft IT deployed the Microsoft Diagnostics and Recovery Toolset 7.0 (DaRT).

DaRT allows administrators to easily recover unusable PCs, rapidly diagnose probable causes of issues, and quickly repair unbootable or locked-out systems, all without requiring users to leave their PCs.

  • Accelerated IT responsiveness and streamlined PC manageability
  • Boot DaRT remotely reducing time lost for users in remote locations
  • Multiple deployment options : local drive, network-based, and remote boot
  • Improved employee experience and positively impacted productivity
  • Microsoft Desktop Optimization Pack for Software Assurance
  • Microsoft Diagnostics and Recovery Toolset
  • Microsoft Windows 7

A common challenge among corporate IT departments is the continued effort to streamline and improve processes while improving the user experience and reducing costs. To do this, many IT departments take a proactive approach to ensuring network stability and to backing up network data. However, they tend to be reactive in planning for desktop system failures. When a system failure does occur and the desktop becomes unbootable, the most common solution is to reimage the machine. However, reimaging a machine can result in loss of user settings, personalization, and data; and machine reimaging is a costly and time-consuming process.

After reviewing the current issues and user experiences related to desktop system failures, Microsoft was compelled to find a proactive, efficient, and reliable way to resolve desktop system failures. As the company's first and best customer, Microsoft IT regularly adopts early releases of Microsoft technologies, tests them in a real-world environment, and provides critical feedback to improve products before they are generally available to the public. In this situation, the Microsoft Diagnostics and Recovery Toolset 7.0 was a viable solution for Microsoft IT to evaluate and to determine if it met their business needs and goals. Microsoft IT had three primary objectives. First, they wanted to provide users who had unbootable or locked-out systems with alternative solutions to machine reimaging. Second, they realized it was important to deploy a solution that could provide Help Desk Technicians with the ability to connect to user machines remotely. And third, they wanted to provide users with self-service capabilities that could reduce user down time.


With the Microsoft Diagnostics and Recovery Toolset 7.0 (DaRT), IT administrators can easily recover PCs that have become unusable, rapidly diagnose probable causes of issues, and quickly repair unbootable or locked-out systems. DaRT is a powerful toolset that extends the Windows Recovery Environment (Windows RE), enabling more effective troubleshooting and repair of Windows-based desktops.

Creating the DaRT Recovery Image

The first step in deploying DaRT is to create a DaRT Recovery Image. The DaRT Recovery Image is the central component of the DaRT platform and is a bootable system image file used to boot in parallel on an unstable desktop. The customizable DaRT Recovery Image can contain some or all of the 14 DaRT tools and can include additional tools, drivers, and files for specific organization hardware and troubleshooting requirements.

Note: DaRT is built on top of the Windows Recovery Environment and is deployed as a temporary, local installation of the recovery OS into the user machine's memory. DaRT does not remain on the machine after the repair is completed.

Deployment Options

DaRT includes flexible deployment options that meet a variety of organizational needs, including:

  • Removable media (USB or CD) enables IT administrators to boot from DaRT manually on a per-machine basis.

  • Local hard drive installation performed manually or using operating system imaging tools like Microsoft System Center Configuration Manager 2007 or the Microsoft Deployment Toolkit 2010 can deploy DaRT in a separate partition as part of installing the operating system.

  • Windows Deployment Services (WDS) server configured to work via PXE can be the quickest and simplest way to make the DaRT Recovery Image available to network connected users in production.


The Microsoft Diagnostics and Recovery Toolset is comprised of a robust set of tools that enables Help Desk Technicians to quickly repair unbootable systems without reinstalling or reimaging the operating system. DaRT users can also reset local passwords, detect and remove malware, restore lost files, and perform many other recovery and repair tasks. The toolset includes:

  • Registry Editor enables registry edits focused on helping repair systems that will not boot or edit values that the installed Windows operating system locks while it is running.

  • Locksmith permits password resets for any local account (not domain accounts) on the Windows operating system that is being repaired; in the event that a password is unknown or forgotten.

  • Crash Analyzer can quickly determine the cause of an issue by analyzing the memory dump file on the Windows operating system under repair.

  • File Restore attempts to restore permanently deleted files, including files within volumes that have been deleted.

  • Disk Commander allows recovery and repair of disk partitions and/or volumes.

  • Disk Wipe can erase all data from a disk or volumes by using a single-pass overwrite or four-pass overwrite, the latter of which meets U.S. Department of Defense standards.

  • Computer Management console diagnoses and repairs problems that can prevent the Windows operating system from booting.

  • Explorer browses the computer’s file system and network shares, allowing access to important data that the user stored on the local drive before you try to repair or reimage the computer.

  • Solution Wizard helps determine which tool to use when the user is not familiar with the tools in DaRT.

  • TCP/IP Config tool enables manual TCP/IP configuration.

  • Hotfix Uninstall can remove hotfixes or service packs from the Windows operating system on the computer that is being repaired.

  • SFC Scan starts the System File Repair Wizard, which can automatically repair system files that are corrupted or missing.

  • Search opens a File Search window that can be used to find documents when the file path is unknown or to search for general kinds of files across all local hard disks.

  • Standalone System Sweeper scans a computer for and removes malware while the installed Windows operating system is not running and, therefore, is able to identify and remove viruses like root kits.

  • Remote Connection remotely runs the DaRT tools on an end-user computer.

MSIT’s Solution

To take full advantage of the Microsoft Diagnostics and Recovery Toolset, Microsoft IT created their DaRT Recovery Image as a lightweight image generated alongside the Windows 7 OS image to ensure that it met all hardware and driver requirements and standards. Using Windows Deployment Services (WDS), Microsoft IT published DaRT as a selectable image enabling users to PXE boot and access the recovery tools. This deployment method provided users with the ability to load and use the toolset on demand.


Pilot Deployment

In April 2011, Microsoft IT designed a pilot program to test and validate DaRT before deploying it across all corporate domains. The pilot program's first task was to build the Recovery Image as a lightweight image that was generated with the Windows 7 OS image. After it was completed, the Recovery Image was published through the WDS environment, allowing users to load DaRT as part of a PXE boot.

The objectives of the Pilot program were to determine:

  • If the remote connectivity feature can be used worldwide

  • If DaRT was a viable self-service option

  • If DaRT was ready for production-scale deployment

To account for a variety of variables and test locations worldwide, Microsoft managed the beta pilot program using a two-pronged approach, conducting testing in both a contrived scenario setting and in the Microsoft IT Help Desk environment.

  • In the contrived scenario setting, global users were paired with a Help Desk Technician to test the Remote Connectivity tool functionality. Global users were tasked with testing the process to boot into DaRT from the WDS server and then to give control to the Help Desk Technician. After the Help Desk Technician confirmed the Remote Connectivity functionality was performing as expected, they took control of the system and tested one or more of the repair tools to confirm functionality.

  • In the Help Desk test environment, the Microsoft IT Help Desk Technician's assignment was to validate the PXE boot process and tool functionality on standard hardware. Their objective was to understand the functionality and to provide expert feedback on the experience.

Pilot Results

As a result of the DaRT pilot program, Microsoft IT successfully confirmed that the remote connectivity functionality performed as designed in both the contrived scenario setting and in the Microsoft IT Help Desk test environment.

  • Contrived scenario setting results. Help Desk Technicians confirmed they could easily use the Remote Connection tool to access the global user's machine across the WAN, and that they could run the DaRT toolset effectively.

  • Microsoft IT test environment results. Help Desk Technicians successfully validated that the PXE boot process and toolset functionality performed as expected on standard hardware.

Microsoft IT was able to provide valuable usability feedback to the DaRT product team that helped to clarify and define UI wording and terminology and to refine the menu text, reducing the potential for administrator error.

Note: An important consideration during any worldwide implementation is to plan appropriately for potential language barriers. During the pilot, the communication process between the Help Desk Technician and the user was briefly hindered by language differences when relaying instructions prior to establishing the remote connection.

Production Deployment

After the pilot program was completed and the DaRT 7.0 RTM version was released, Microsoft IT published the DaRT 7.0 RTM product as a self-service download on the Microsoft corporate network by deploying it through Windows Deployment Services (WDS) and by publishing an ISO image accessible from the software product servers. This publishing approach enables users to install DaRT via PXE boot or to burn a CD and run the tool locally.

Deployment Considerations

  • DaRT Recovery Image Maintenance. The DaRT Recovery Image is refreshed quarterly, when the Windows 7 image is refreshed within the corporate environment.

  • DaRT Recovery Image Toolset Options. One of the considerations when releasing DaRT 7.0 to the internal Microsoft population was to determine the appropriate toolset options to make readily available to users as part of the DaRT Recovery Image. The deciding factor hinged on counter-balancing the user's ability to damage their machine through misuse of the toolset with the technical nature of the workforce. Microsoft IT decided to provide most functionality found in the toolset. However, based on advisement from the Microsoft security team, the Locksmith tool is not available to the interactive user and is only available to the Help Desk Technician when they assist the user through the Remote Connection feature.

Production Results

Since the DaRT production rollout:

  • Self-service DaRT downloads average about 1,000 downloads per month.

  • Help Desk Technicians use DaRT approximately 30 times per month. Usage reports indicate that DaRT is primarily used for data recovery, for Master Boot Record recovery, and to wipe the hard drive prior to re-assigning or recycling the machine.

  • When used, DaRT resolves 80 to 100 percent of the issues, leading to a better user experience.

  • Machine reimage is no longer the first and only option available to users.


By implementing DaRT, Microsoft has realized a number of benefits:

  • Improved user experience and cost savings. Using DaRT, Microsoft IT has simplified Help Desk support and is able to deliver solutions quickly, reducing overall support costs, improving the user experience, as well as reducing lost productivity caused by down time.

  • Rapid recovery. The toolset provides many options for recovery, even when Windows Safe Mode or normal boot will not function. The offline boot environment helps IT teams quickly restart computers, recover deleted files, and remove malware from infected systems while the computer is offline. This helps protect other computers on the network and reduces the amount of time the computer is unavailable.

  • Improved IT responsiveness. DaRT helps IT professionals quickly respond to and resolve user issues. Key features include Remote Connectivity, Crash Analyzer, System Restore and Locksmith, enabling Help Desk Technicians to access and safely repair PCs.

  • Shift in service philosophy. An unexpected benefit of the DaRT 7.0 rollout was the shift in Microsoft IT service philosophy. Microsoft IT realized that they were not only resolving a poor user experience related to machine recovery but that they were also developing a dynamic support structure that better met the needs of all users worldwide across multiple service points, including phone support, onsite technicians, and self-service options.


Microsoft IT needed a proactive, efficient, and reliable way to resolve desktop system failures that could be deployed easily to users worldwide, provide remote connectivity access to Help Desk Technicians and a dynamic toolset that would benefit self-service users.

Microsoft IT began testing DaRT in a pilot program starting in April 2011. This program was designed to test DaRT's ease of deployment, remote connectivity and extensive toolset. At the end of the pilot program and with the RTM release, DaRT moved into production and was rolled out as a self-service download on the corporate network.

As a result of the pilot program, DaRT is now a sustained Microsoft IT service that includes approximately 1,000 self-service downloads per month, and the product is used about 30 times per month by Help Desk Technicians. In those situations, DaRT resolves 80 to 100 percent of the issues, leading to a better experience for users and reduced challenges for Microsoft IT. Overall, DaRT helps Microsoft IT make desktops safer to use and easier and less expensive to manage while also providing an alternative to dispatching an on-site technician.

For More Information

For more information about Microsoft products or services, call the Microsoft Sales Information Center at (800) 426-9400. In Canada, call the Microsoft Canada Order Centre at (800) 933-4750. Outside the 50 United States and Canada, please contact your local Microsoft subsidiary. To access information via the World Wide Web, go to:

© 2012 Microsoft Corporation. All rights reserved.

This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.