How Windows RE Works
This topic describes how Windows RE works, specifically the automatic failover behavior, manual diagnosis and repair process and how Startup Repair tool works.
A computer running Windows Vista can automatically fail over into the on-disk Windows RE only if a boot failure is detected. At startup, the Windows loader sets a status flag to indicate that the boot process has started, and this flag is typically cleared before the Windows logon screen is displayed. If the boot attempt fails, the flag is not cleared. The next time the computer starts, the loader detects the flag and assumes that a boot failure occurred. When this happens, the loader launches Windows RE instead of Windows Vista.
|The detection of boot failure relies on boot completion and not on whether an error occurred in Windows Vista. One example of a false-positive is when power is lost during the boot process, and Windows RE is launched even though the Windows installation is bootable.|
Because the failover mechanism relies on the Windows boot manager and Windows boot loader, some failures will render Windows RE inaccessible. In the following scenarios, the user must use bootable Windows RE media to recover the computer:
Disk metadata corruption in the master boot record (MBR), partition table, or boot sector of Windows RE partition.
Missing or corrupt boot manager.
Missing or corrupt boot configuration data.
Sometimes the boot status flag cannot be read or written to by the boot loader, in which case Windows will not automatically fail over into Windows RE. However, the user can still manually launch into the on-disk Windows RE through the F8 menu.
Manual Diagnosis and Repair
When starting from a Windows RE CD/DVD or using the F8 advanced boot option menu to launch the on-disk Windows RE, the user can manually launch various system recovery tools:
Startup Repair (when not launched automatically)
System Restore (on rollback, by using existing restore points)
Windows Backup Disaster Recovery (to restore from a volume backup image)
Command prompt, from which all standard Windows PE console tools, such as Regedit and ChkDsk, are available
Custom OEM support/recovery tool
Startup Repair is a tool that automates common diagnostic and repair tasks of unbootable Windows Vista installations. If the computer fails over into Windows RE because of a detected boot failure, Startup Repair launches automatically. If automatic failover to an on-disk Windows RE is not available, Startup Repair can also be launched as a manual recovery tool from a Windows RE CD/DVD.
Startup Repair Process
Startup Repair will try to repair computers that are unbootable because of the following reasons:
Missing or damaged system and driver files
Disk metadata corruption (MBR, partition table, and boot sector)
File system metadata corruption
Installation of problematic or incompatible drivers
Installation of incompatible Windows service packs and patches
Corrupt boot configuration data
Bad memory and hard disk hardware (detection only)
Startup Repair will not repair unbootable systems caused by the following issues:
Malfunctioning firmware and other hardware components
Problems with clean Windows installations or Windows upgrades (for example, from Windows XP to Windows Vista)
Windows logon errors
Viruses and malicious software
Startup Repair Log
After Startup Repair has run, a text log with diagnostic information and repair results is generated. This log file is located at %WINDIR%\System32\LogFiles\Srt\SrtTrail.txt.
The log file begins with information about the diagnostic and repair session, such as in the following example.
Session Summary: System Disk = \Device\Harddisk0 WinDir = C:\windows AutoChk Run = 0 Root causes = 1
The following table describes these fields.
Device path of the disk on which the Windows installation is located.
Full path of the Windows installation to be repaired.
A non-zero value indicates that AutoChk was run during Windows PE boot.
Number of root causes found during diagnostics.
The next section of the log file contains diagnostic tasks performed. For example,
Test Performed: --------------------------- Name: Software installation log diagnosis Result: Completed successfully. Error code = 0x0 Time taken = 125 ms Test Performed: --------------------------- Name: ACL test Result: Completed successfully. Error code = 0x0 Time taken = 18200 ms
The following table describes these fields.
Name of the diagnostic task performed.
Textual description of whether the test completed successfully.
Win32 return code of the diagnostic procedure. A value of 0x0 indicates that the specified test ran successfully.
The amount of time, in milliseconds, spent on the diagnostic step.
The following table describes the diagnostic tasks performed by Startup Repair.
Disk metadata test
Verifies the integrity of the MBR, partition table, and boot sector.
Determine target OS
Extracts the location of the Windows installation from the Boot Configuration Data (BCD).
Registry hives test
Verifies the integrity of the registry hives.
Quick volume metadata test
Verifies that the Windows directory exists.
Event log diagnosis
Checks the Event Log for recent changes to Windows.
Boot status test
Verifies that Windows did not start successfully
Setup state check
Checks whether the failure occurred during Windows installation.
Analyzes available crash dumps created during the failed startup attempt.
Software installation log diagnosis
Checks whether Windows updates have recently been installed.
Disk failure diagnosis
Checks the Self-Monitoring, Analysis, and Reporting Technology (SMART) status on the hard disk hardware.
Runs Chkdsk to identify file system metadata problems.
Binary file integrity test
Verifies the integrity of system files required for startup.
Verifies that system files required for boot have the correct access control list (ACL).
When the root cause of the startup failure is found, the details and resulting actions are included in the log file. For example,
Root cause found: --------------------------- ACLs on file C:\windows\system32\user32.dll are not proper. Old value = 0xd015f Repair action: ACLs fix Result: Completed successfully. Error code = 0x0
The following table describes these fields.
Root cause found
Textual description of the problem.
Name of the repair action taken.
Textual description of the repair action's success or failure.
Win32 return code of the repair procedure. A value of 0x0 indicates that the specified repair completed successfully.
The following table lists the possible root causes for startup failures.
Boot manager failed to find OS loader.
Winload.exe is missing or cannot be accessed.
Boot configuration is corrupt.
The boot configuration file is missing or it contains no valid operating system entry.
Boot critical file <filename> is missing.
The specified file required for startup is missing.
Boot critical file <filename> is corrupt.
The specified file required for startup is corrupt.
Several boot critical files are corrupt.
Multiple files required for startup are corrupt.
Registry is corrupt.
A registry hive fails to load.
Unknown bugcheck <code>. Parameters = <param1>, <param2>, <param3>, <param4>.
The system crashed during startup with the specified bugcheck error.
Driver <drivername> is preventing the system from starting.
The specified driver is missing or corrupt.
A recent driver installation or upgrade may be preventing the system from starting.
An incompatible driver was installed prior to the startup failure.
A patch is preventing the system from starting.
An update to the operating system was installed prior to the startup failure.
ACLs on file <filename> are not proper. Old value = <value>
The specified file cannot be accessed due to an incorrect ACL.
The partition table does not have a valid System Partition.
The system partition listed in the partition table does not contain the required system files.
MBR is corrupt.
The MBR on the system disk is corrupt.
Partition table is corrupt on disk <drivenumber>.
The partition table on the specified disk does not contain any valid entries.
Boot sector for system disk partition is corrupt.
The boot sector information is not valid.
Boot sector code for system disk partition is corrupt.
The boot sector code does not match the default boot sector.
System volume on disk is corrupt.
The system volume cannot be accessed.
No OS files found on disk.
The Windows directory does not contain a valid Windows installation.
Boot manager is missing.
The boot manager can not be found on the system partition.
A hard disk could not be found. If a hard disk is installed, it is not responding.
Cannot detect any installed hard disk. This is only available when running Windows RE from CD/DVD.
Security settings on this computer are preventing Windows from starting.
Windows is unable to audit the system.
System partition has an unknown file system type.
The system partition is formatted using a file system type that Windows does not recognize.
Boot status indicates that the OS booted successfully.
Windows started successfully. This is a common scenario if a user manually launches Windows RE and runs Startup Repair.
Failure while setup is in progress.
The computer does not start due to a failed Windows installation process.
The operating system version is incompatible with Startup Repair.
The version of Windows does not match that of Startup Repair. For example, trying to repair Windows XP using Startup Repair will trigger this root cause.
The following table describes possible repair actions.
Repairs the MBR, partition table, or boot sector.
Runs ChkDsk in repair mode.
Replaces the corrupt system file with a backup copy.
Reconstructs the BCD.
Rolls back the system state by using System Restore.
Sets the ACLs of the specified file to a default value.
Replaces the corrupt registry hives with a backup copy.
Change Crash on Audit Failure setting
Disables Windows auditing. Only an administrator can log on to Windows.
Runs the Windows Memory Diagnostics tool.
The following table describes the descriptions of the possible diagnostic or repair results.
Completed successfully. Error code = 0x0
Diagnostic and repair processes finished without error.
Failed. Error code = <errorcode>
Diagnostic and repair processes failed with the specified error.
Started but not completed
Either the diagnostic process or the repair process was cancelled by the user.