Windows 2000 server startup

Процесс запуска Windows NT — это процесс, с помощью которого Windows NT 4.0, Windows 2000, Windows XP и Windows Server 2003 операционные системы инициализируются. В Windows Vista и более поздних версиях этот процесс значительно изменился; см. Процесс запуска Windows Vista для получения информации о том, что изменилось.

Содержание

• 1 Программа установки
  • 1.1 Фаза загрузочного образа CD-ROM
  • 1.2 Фаза загрузчика
  • 1.3 Фаза ядра
  • 1.4 Ремастеринг
• 2 Фаза загрузчика
  • 2.1 Операционная система выбор
  • 2.2 Загрузка ядра Windows NT
• 3 Фаза ядра
• 4 Менеджер сеансов
• 5 Аутентификация
• 6 Оболочка
• 7 Удаленная загрузка и установка
• 8 См. также
• 9 Ссылки
• 10 Дополнительная литература
• 11 Внешние ссылки

Установщик

Установщик Windows NT работает очень похоже на обычную установку Windows NT, за исключением того, что он запускается с CD-ROM. Чтобы этот метод загрузки работал, BIOS должен быть совместим со спецификацией El Torito. Файловая система ISO 9660 на установочном компакт-диске не полностью совместима со стандартом. Хотя это «Уровень 1», к именам файлов не добавлена ​​версия файла. Загрузочный образ относится к типу «без эмуляции», имеет длину 1 сектор (2048 байт) и загружается в сегменте 0x7c0. Его можно извлечь из ISO-образа с помощью программы для извлечения файлов, такой как 7-Zip или WinZip. Образ ISO также не гибридизируется, как образы ISO из большинства дистрибутивов Linux, и поэтому он не содержит никакой основной загрузочной записи (MBR), что делает его невозможным для загрузки путем простого копирования образа. через блочное устройство, такое как флэш-накопитель.

Установщик также можно запустить из командной строки MS-DOS, чтобы можно было обновить уже установленные предыдущие версии Microsoft Windows. Чтобы запустить программу установки из операционной системы на базе MS-DOS, такой как Windows 98 или Windows ME, пользователь должен запустить систему «в режиме DOS», а затем выполнить I386 / WINNT.EXE на компакт-диске.

Дискету, содержащую MS-DOS, можно использовать для запуска установщика. Также были доступны версии установщика на дискетах. Начиная с Windows Vista, установщик запускается из BOOT.WIM, который содержит загрузочную версию Windows PE. Windows PE 2.0 основана на ядре Windows Vista, более поздние версии Windows PE основаны на более поздних версиях Windows.

Фаза загрузочного образа CD-ROM

При обычной установке с CD-ROM BIOS выполняет POST, а затем ищет дескриптор загрузки на компакт-диске. Дескриптор загрузки указывает на файл каталога загрузки в файловой системе ISO 9660. BIOS ищет загрузочный образ, совместимый с текущей архитектурой, загружает его в память и затем запускает. Загрузочный образ аналогичен загрузочному сектору жесткого диска. Загрузочный образ загружает SETUPLDR.BIN, который аналогичен NTLDR. Если это не удается по какой-либо причине, отображается сообщение о том, что NTLDR не был найден, что само по себе может вводить в заблуждение; более того, NTLDR на компакт-диске никогда не используется на этапе загрузки программы установки. Этот процесс также предполагает, что версии файлов недоступны.

Перед запуском загрузчика загрузочный образ проверяет, существует ли уже установленная Windows (система), и, если да, запускает BOOTFIX.BIN. Если установка не найдена или диск не имеет MBR, он запускает загрузчик напрямую, что устраняет необходимость в BOOTFIX.BIN. Если BOOTFIX.BINзапущен, отображается строка «Нажмите любую клавишу для загрузки с компакт-диска». и ждет ввода пользователя. Если ничего не обнаруживается в течение нескольких секунд, загружается следующее устройство и так далее. Такое поведение необходимо для загрузки второго этапа установщика, который запускается с жесткого диска.

Фаза загрузчика

И SETUPLDR.BIN, и NTLDRсостоят из двух объединенных двоичных файлов. Их также можно найти на установочном компакт-диске в виде сжатых файлов CAB. Первый файл — это STPBOOT.BIN, это плоский двоичный файл, который просто загружает второй файл. Второй файл — это обычный файл EXE в формате Portable Executable. В SETUPLDR.BINвторой файл — SETUPLDR.EXE, а в NTLDRвторой файл — OSLOADER.EXE. Как SETUPLDR.EXE, так и OSLOADER.EXEимеют встроенные драйверы файловой системы для базового доступа к FAT, NTFS и ISO 9660. В отличие от обычных драйверов *.SYS, загрузчик использует прерывания BIOS для доступа к загрузочному диску. Он также содержит встроенный анализатор INI и декомпрессор CAB.

После запуска программы установки она печатает строку «Программа установки проверяет конфигурацию оборудования вашего компьютера…». Вызывается NTDETECT.COM, и системная информация сохраняется в памяти. Затем он отображает синий экран в текстовом режиме VGA с заголовком «Установка Windows» и белой линией внизу, которая ведет себя как строка состояния, затем ищет TXTSETUP.SIFи анализирует Это. Этот файл работает как база данных значений ключей, как *.INI, *.INF или реестр. Ключи могут содержать либо список файлов, связанных с местом их установки, либо строку сценария. Следовательно, в базе данных хранятся данные и код. Во время синтаксического анализа пустые строки игнорируются, а разделы с одинаковыми именами объединяются.

Файл BIOSINFO.INFтакже загружается для устранения неполадок оборудования.

Синтаксис «ключ-значение» в разделе SourceDisksFilesвыглядит следующим образом:

filename_on_source = disk_id, subdir, upgrade_code, new_install_code, запасной, запасной, новое_имя_файла

Программа установки спрашивает, если любые дополнительные драйверы должны быть загружены и загружаются драйверы текстового режима.

• «Нажмите F6, если вам нужно установить сторонний драйвер SCSI или RAID…»
• «Нажмите F2, чтобы запустить Автоматическое восстановление системы (ASR)… «

Если да, то они могут быть загружены только с дискеты. Существует скрытая функция, которая показывает экран, предлагающий пользователю выбрать тип компьютера, если во время первого сообщения была нажата клавиша F5.

Драйверы текстового режима отличаются от драйверов PnP, поскольку они есть загружается независимо от того, присутствует оборудование или нет. На этапе загрузки установщик отображает на экране несколько сообщений о текущем загружаемом файле. Сообщение: «Программа установки загружает файлы ([описание файла])…». На этом этапе загружаются файлы, расположенные в разделах, оканчивающихся на .Load. В этих разделах ключ дает имя драйвера, а значение дает файл. Имя драйвера ищется в том же разделе без суффикса .Load, чтобы найти удобное для пользователя имя драйвера. Ядру также требуется смонтированный куст реестра для загрузки реестра, поэтому также загружается SETUPREG.HIV. Все имена файлов, загружаемых загрузчиком, жестко запрограммированы, за исключением драйверов.

Что касается устройств PnP, после их идентификации драйвером шины, адрес проверяется в разделе HardwareIdsDatabaseи дается соответствующее имя драйвера. Но они не используются на этом этапе.

Фаза ядра

После того, как все загрузочные файлы загружены загрузчиком, отображается сообщение «Программа установки запускает Windows» и ядро ​​запускается. Как и при обычной установке, она запускает драйверы и загружает единственную службу — setupdd.sys. Он работает в режиме ядра и запускает графический интерфейс по-прежнему в текстовом режиме. Отныне все драйверы основаны на NT, и прерывания BIOS больше не используются.

Пользователя просят выбрать макет файловой системы. Выбранный раздел при необходимости форматируется, и файлы из TXTSETUP.SIF копируются в систему. Затем он создает кусты реестра и автоматически перезагружает систему, чтобы система NT могла запуститься и выполнить загрузку. Раздел HiveInfs указывает на файлы, используемые для заполнения ульев значениями по умолчанию. При новой установке этот раздел называется HiveInfs.Fresh. Эти файлы не являются reg-файлами, но также являются ini-файлами, которые могут быть поняты интерпретатором ini, входящим в комплект установщика. Программа форматирования диска статически связана с setupdd.sys.

Remastering

В Интернете доступно множество бесплатных инструментов для настройки TXTSETUP.SIF. для создания автоматических установок или для интеграции драйверов и исправлений. Этот процесс иногда называют подстановкой.

. Следующая команда показывает, как можно создать обновленный компакт-диск с минимальным набором параметров в Linux. Предполагается, что текущий каталог является точкой монтирования компакт-диска. Образ будет создан в домашнем каталоге.

mkisofs -b Bootable_NoEmulation.img -no-emul-boot -N.>~ / ntsetup.iso

Файл winnt.sifможно использовать для автоматической установки, но его присутствие необязательно. На компакт-диске есть файл модели с именем UNATTEND.TXT. Программа установки пытается обнаружить файл winnt.sif в каталоге I386или в корневом каталоге дискеты.

Фаза загрузчика

Процесс запуска Windows NT запускается при запуске компьютера находит загрузчик Windows, часть операционной системы Windows, отвечающую за поиск Microsoft Windows и ее запуск. Однако до Windows Vista загрузчик был NTLDR. Microsoft также выпустила операционные системы для процессоров Intel Itanium, которые используют архитектуру IA-64. Загрузчиком этих выпусков Windows является (далее просто IA64ldr). Это программа Extensible Firmware Interface (EFI).

Выбор операционной системы

Меню дополнительных параметров загрузчика NTLDR

После запуска загрузчик выполняет поиск операционной системы Windows. Диспетчер загрузки Windows делает это, считывая данные конфигурации загрузки (BCD), сложную независимую от прошивки базу данных для данных конфигурации во время загрузки. Его предшественник, NTLDR, делает это путем чтения более простого boot.ini . Если файл boot.ini отсутствует, загрузчик попытается найти информацию из стандартного каталога установки. Для компьютеров Windows NT и 2000 он попытается загрузиться с C: \ WINNT. Для компьютеров Windows XP и 2003 она будет загружаться из C: \ WINDOWS.

Обе базы данных могут содержать список установленных операционных систем Microsoft, которые могут быть загружены с локального жесткого диска или удаленного компьютера на локальная сеть. NTLDR поддерживает операционные системы, установленные на дисках с файловой системой NTFS или FAT, CDFS (ISO 9660) или UDFS. Диспетчер загрузки Windows также поддерживает операционные системы, установленные в файле VHD, хранящемся на диске NTFS.

В Windows 2000 или более поздних версиях Windows, в которых спящий режим поддерживается, загрузчик Windows запускает поиск операционных систем с поиска hiberfil.sys. NTLDR просматривает корневую папку тома по умолчанию, указанного в boot.ini. Диспетчер загрузки Windows ищет расположение hiberfil.sys в BCD. Если этот файл найден и в нем найден активный набор памяти, загрузчик загружает содержимое файла (который представляет собой сжатую версию дампа физической памяти машины) в память и восстанавливает компьютер до состояния, в котором он был до гибернации.

Затем загрузчик ищет список установленных записей операционной системы. Если установлено более одной операционной системы, загрузчик показывает меню загрузки и позволяет пользователю выбрать операционную систему. Если выбрана операционная система, не основанная на NT, такая как Windows 98 (указанная стилем пути MS-DOS, например C: \), то загрузчик загружает связанный Файл «загрузочного сектора», указанный в boot.ini или BCD (по умолчанию, это bootsect.dos, если имя файла не указано) и передает ему управление выполнением. В противном случае процесс загрузки продолжается.

Загрузка ядра Windows NT

Операционная система запускается, когда в память загружаются определенные базовые драйверы, помеченные как «Boot». Среди них есть соответствующий драйвер файловой системы для типа раздела (NTFS, FAT или FAT32), на котором находится установка Windows. На этом этапе процесса загрузки загрузчик очищает экран и отображает текстовый индикатор выполнения (который часто не отображается из-за скорости инициализации); Windows 2000 также отображает текст «Запуск Windows…» внизу. Если пользователь нажимает F8 на этом этапе, отображается расширенное меню загрузки, содержащее различные специальные режимы загрузки, включая Безопасный режим, с последней удачной конфигурацией, с включенной отладкой и (в случае серверных выпусков) Режим восстановления служб каталогов. После выбора режима загрузки (или если F8 никогда не нажималась) загрузка продолжается.

Следующие файлы загружаются последовательно.

1. ntoskrnl.exe (ядро)
2. hal.dll (тип уровня абстракции оборудования)
3. kdcom.dll (ядро Отладчик HW Extension DLL)
4. bootvid.dll (для логотипа Windows и полосы боковой прокрутки)
5. config \ system (один из кустов реестра)

Затем NTDETECT.COM и ядро Windows NT (Ntoskrnl.exe ) и уровень аппаратной абстракции (hal.dll ) загружаются в память. Если в реестре Windows задано несколько конфигураций оборудования, пользователю предлагается выбрать одну из них.

Когда ядро ​​находится в памяти, драйверы устройств загрузки загружаются (но еще не инициализированы). Необходимая информация (вместе с информацией обо всем обнаруженном оборудовании и службах Windows) хранится в части реестра HKEY_LOCAL_MACHINE \ Systemв наборе ключей реестра, которые вместе называются Control Set. Сохраняется несколько наборов элементов управления (обычно два) на тот случай, если настройки, содержащиеся в текущем используемом, запрещают загрузку системы. HKEY_LOCAL_MACHINE \ Systemсодержит наборы элементов управления с метками ControlSet001, ControlSet002и т. Д., А также CurrentControlSet. Во время обычной работы Windows использует CurrentControlSetдля чтения и записи информации. CurrentControlSet— это ссылка на один из наборов элементов управления, хранящихся в реестре. Windows выбирает используемый «настоящий» набор элементов управления на основе значений, установленных в разделе реестра HKLM \ SYSTEM \ Select:

• По умолчаниюбудет выбором загрузчика, если ничто другое не отменяет это
• Если значение ключа Failedсовпадает с Default, то загрузчик отображает сообщение об ошибке, указывающее, что последняя загрузка не удалась, и дает пользователю возможность все равно попробуйте загрузиться или используйте «Последнюю удачную конфигурацию».
• Если пользователь выбрал (или выбрал) последнюю удачную конфигурацию, набор элементов управления, указанный клавишей LastKnownGood, будет используется вместо По умолчанию.

Когда выбирается контрольный набор, соответственно устанавливается клавиша Текущий. Клавиша Failedтакже устанавливается на то же самое, что и Current, до конца процесса загрузки. LastKnownGoodтакже устанавливается на Current, если процесс загрузки завершается успешно.

Какие службы запускаются и порядок запуска каждой группы задается следующими ключами:

• HKLM \ SYSTEM \ CurrentControlSet \ Services
• HKLM \ SYSTEM \ CurrentControlSet \ Control \ ServiceGroupOrder

Для В целях загрузки драйвер может быть одним из следующих:

1. «Загрузочный» драйвер, который загружается загрузчиком до запуска ядра. «Загрузочные» драйверы — это почти исключительно драйверы для контроллеров жестких дисков и файловых систем (ATA, SCSI, диспетчер фильтров файловой системы и т. Д.); другими словами, это абсолютный минимум, который потребуется ядру для начала загрузки других драйверов и остальной части операционной системы.
2. «Системный» драйвер, который загружается и запускается ядром после загрузочные драйверы. «Системные» драйверы охватывают более широкий диапазон основных функций, включая драйвер дисплея, поддержку CD-ROM и стек TCP / IP.
3. «Автоматический» драйвер, который загружается намного позже, когда в графическом интерфейсе пользователя уже есть

После этого управление передается от загрузчика к ядру.

Фаза ядра

Инициализация подсистемы ядра и подсистем Windows Executive выполняется в два этапа.

На первом этапе создаются базовые структуры внутренней памяти и инициализируется каждый контроллер прерываний ЦП. Инициализируется диспетчер памяти, создавая области для кэша файловой системы, выгружаемого и невыгружаемого пулов памяти. Диспетчер объектов, начальный маркер безопасности для назначения первому процессу в системе и сам диспетчер процессов. На этом этапе создаются процесс бездействия системы, а также процесс системы.

Второй этап включает инициализацию драйверов устройств, которые были определены NTLDR как системные драйверы.

В процессе загрузки драйверов устройств «индикатор выполнения» отображается в нижней части дисплея в системах Windows 2000; в Windows XP и Windows Server 2003 это было заменено анимированной полосой, которая не отображает фактический прогресс. До Windows XP эта часть процесса загрузки занимала значительно больше времени; это потому, что драйверы будут инициализироваться по одному. В Windows XP и Server 2003 все драйверы инициализируются асинхронно.

Диспетчер сеансов

После загрузки всех драйверов загрузки и системы ядро ​​(системный поток) запускает подсистему диспетчера сеансов (smss.exe).

Перед открытием любых файлов Autochk запускается с помощью smss.exe. Autochk монтирует все диски и проверяет их по одному, чтобы убедиться, были ли они аккуратно размонтированы. Если autochk определяет, что один или несколько томов загрязнены, он автоматически запускает chkdsk и предоставляет пользователю короткое окно для прерывания процесса восстановления путем нажатия клавиши в течение 10 секунд (введено в Windows NT 4.0 с пакетом обновления 4; более ранние версии не позволяют пользователь прервет chkdsk). Поскольку Windows 2000, XP и 2003 не отображают текстовый экран в этот момент (в отличие от NT 3.1–4.0, который отображал синий текстовый экран), пользователь увидит другое фоновое изображение с мини-текстовым экраном в центре экрана. и покажите там прогресс chkdsk.

Во время загрузки подсистема диспетчера сеансов:

• Создает переменные среды (HKLM \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Environment)
• Запускает сторону режима ядра подсистемы Win32 (win32k.sys). Это позволяет Windows переключаться в графический режим, поскольку теперь имеется достаточная инфраструктура.
• Запускает сторону пользовательского режима подсистемы Win32, подсистему сервера времени выполнения клиент / сервер (csrss.exe). Это делает Win32 доступным для приложений пользовательского режима.
• Создает виртуальную память файлы подкачки (HKLM \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management)
• Выполняет любые операции переименования (HKLM \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ PendingFileRenameOperations), которые помещены в очередь. Это позволяет использовать ранее используемые файлы (например, драйверы) для замены в рамках перезагрузки.
• Выполняет все программы, перечисленные в HKLM \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ BootExecute, например автоматическая проверка и преобразование.
• Запускает диспетчер входа в Windows (winlogon.exe). Winlogon отвечает за обработку интерактивного входа в систему Windows (локального или удаленного). Библиотека графической идентификации и аутентификации (GINA) загружается внутри процесса Winlogon и обеспечивает поддержку входа в систему в качестве локального пользователя или пользователя домена Windows.

Диспетчер сеанса сохраняет свои конфигурация в HKLM \ SYSTEM \ CurrentControlSet \ Control \ Session Manager. Точная работа большинства из этих элементов зависит от конфигурации, установленной в реестре.

Аутентификация

диалоговое окно GINA в Windows XP.

Winlogon запускает Службу подсистемы Local Security Authority (LSASS) и Диспетчер управления службами (SCM), что, в свою очередь, запустит все службы Windows, для которых установлен автоматический запуск. Он также отвечает за реакцию на безопасную последовательность внимания (SAS), загрузку профиля пользователя при входе в систему и, при необходимости, блокировку компьютера, когда запущена экранная заставка .

Процесс входа в систему выглядит следующим образом:

• Подсистема диспетчера сеансов запускает Winlogon.
• Winlogon запускает диспетчер управления службами (services.exe).
  • Запускает службы автозапуска.
  • Обновляет контрольные наборы; набор элементов управления LastKnownGood обновляется, чтобы отразить текущий набор элементов управления.
• (Windows XP) Winlogon запускает UIHost (logonui.exe), полноэкранный графический интерфейс.
• Winlogon загружается GinaDll (msgina.dll)
  • (необязательно) GINA отображает запрос на вход в систему, и пользователь нажимает Secure Attention Sequence (SAS) (Control-Alt-Delete Winlogon проверяет, настроена ли система для автоматического входа в определенную учетную запись (AutoAdminLogon).
  • Диалоговое окно входа отображается GINA
  • Пользователь вводит учетные данные (имя пользователя, пароль и домен)
  • GINA передает учетные данные обратно в Winlogon
• Winlogon передает учетные данные в LSASS
• LSASS пытается использовать кэшированные данные в базе данных LSA (куст SYSTEM)
• Если их нет, LSASS определяет, какой протокол учетной записи должен использоваться, используя пакеты безопасности, перечисленные в ключе HKLM / SYSTEM / CurrentControlSet / Control / Lsa:
  • msv1_0.dll, реализующий NT LAN Manager протоколы. Этот пакет i s используются в автономных системах и системах-членах домена для обратной совместимости.
  • Kerberos.dllобеспечивает удаленный вход с использованием Active Directory.
• LSASS применяет локальную политику безопасности (проверка разрешений пользователей, создание журналы аудита, выдача токенов безопасности и т. д.).
• Управление передается обратно в Winlogon для подготовки к передаче управления пользователю.
  • Создание станций Windows (WinSta0)
  • Создание рабочих столов (Winlogon, По умолчаниюи ScreenSaver)
  • Затем запускается указанная программа в значении Userinit, которое по умолчанию равно userinit.exe. Это значение поддерживает несколько исполняемых файлов.

Если пользователь пытается войти на локальный хост, то клавиша HKLM / SAMбудет использоваться в качестве базы данных. Если пользователь пытается войти на другой хост, то для передачи данных используется служба NetLogon .

msv1_0.dll <->netlogon <->удаленный сетевой вход <->удаленный msv1_0.dll <->удаленный SAM

В Windows XP GINA отображается только в том случае, если пользователь нажимает безопасную последовательность внимания.

Winlogon поддерживает подключаемые модули, которые загружаются и уведомляются о конкретных событиях и LSASS также поддерживает плагины (пакеты безопасности). Некоторые руткиты объединяют плагины Winlogon, потому что они загружаются до того, как любой пользователь войдет в систему. Некоторые ключи позволяют указывать несколько значений, разделенных запятыми, что позволяет вредоносной программе быть уязвимой. выполняется одновременно с легальным системным файлом. Алгоритмы хеширования, используемые для хранения учетных данных в базе данных SAM, являются слабыми и могут быть быстро подобраны на потребительском оборудовании.

Обязанности Winlogon и процесс входа в систему существенно изменились по сравнению с описанными выше в Windows Vista.

Shell

Userinit — первая программа, которая запускается с учетными данными пользователя. Он отвечает за запуск всех других программ, составляющих среду пользовательской оболочки.

Программа оболочки (обычно Explorer.exe) запускается из записи реестра Shell =, на которую указывает та же запись реестра в ключе HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ IniFileMapping \ system.ini \ Boot; его значение по умолчанию — SYS: Microsoft \ Windows NT \ CurrentVersion \ Winlogon, что соответствует HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon.

• Userinit загружает профиль пользователя. Существует несколько типов профилей пользователей, и они могут быть локальными или удаленными. Этот процесс может быть очень медленным, если профиль пользователя относится к «перемещаемому» типу. Применяются параметры
• Пользователь и Компьютер Групповая политика.
  • Запускать пользовательские сценарии
  • Запускать машинные сценарии
  • Запускать proquota.exe
• Запускать программы запуска перед запуском оболочки.
• Запускает оболочку, настроенную в реестре, по умолчанию explorer.exe.
• Userinit завершает работу, и программа оболочки продолжает работать без родительского процесса.

Userinit запускает программы запуска из следующих мест:

• HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ RunOnce
• HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ Run
• HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run
• HKCU \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Windows \ Load
• HKCU \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Windows \ Run
• HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run
• HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ RunOnce
• % ALLUSERSPROFILE% \ Start Menu \ Programs \ Startup \(этот путь локализован в неанглийских версиях Windows до Vista)
• % USERPROFILE% \ Start Menu \ Programs \ Startup \(это p ath локализован в неанглийских версиях Windows до Vista)

Удаленная загрузка и установка

Для успешной загрузки клиент должен поддерживать PXE загрузку и службы развертывания Windows (WDS) компонент должен быть установлен на сервере. По умолчанию он не установлен. WDS является преемником Службы удаленной установки (RIS).

Программа PXE находится в BIOS или на микросхеме ПЗУ на сетевой карте.

Загрузка PXE не является технологией, специфичной для Windows, и ее также можно использовать для запуска системы Linux. Фактически, система Linux может действовать как сервер для обслуживания DHCP или TFTP.

PXE можно использовать для запуска программы установки Windows для установки системы на клиентском компьютере или для запуска операционной системы из ОЗУ. Последний, называемый удаленной загрузкой, был представлен в Windows XP Embedded SP1 и доступен только для этой версии Windows.

Общий процесс для обоих методов выглядит следующим образом:

• PXE boot
  • DHCP запрос широковещательной передачи
  • (необязательно) DHCP-маршрутизатор перенаправляет на сервер
  • Сервер отправляет программу сетевой загрузки (NBP) (PXEboot. com) через TFTP
• Программа NBP загружает необходимые файлы по протоколу BINL

Уровень согласования информации о загрузке (BINL) — это служба Windows 2000 работает на сервере, который взаимодействует с клиентом после того, как NBP уже был загружен PXE.

См. Также

• Архитектура Windows NT
• Процесс запуска Windows
• Процесс запуска Linux
• Загрузка
• Основная загрузочная запись
• Самотестирование при включении
• BootVis

Ссылки

Дополнительная литература

Внешние ссылки

• Список запускаемых приложений
• Как редактировать SETUPAPI.DLL

Windows 2000 ProfessionalUnderstanding the various phases of
Setup and Startup

The Phases of Setup

The following will provide you with a brief description of how boot drivers and Plug and Play devices are loaded during the text-mode and graphical user interface (GUI) mode phases of Setup, along with a description of the Setup log files. Understanding of the Setup process can help you troubleshoot any problems you may encounter during Setup. Go to Setup Phases.

Understand the steps in starting Windows 2000 Professional.

Understanding the system startup procedure allows you to troubleshoot problems with installing and starting Windows 2000 Professional. Go to the Windows 2000 Professional Startup Process.

Understand how Windows 2000 Professional detects Plug and Play devices.

An understanding of how Windows 2000 Professional detects and loads Plug and Play devices can give you a better understanding of how these devices are detected and configured during Setup and help you troubleshoot any problems that might occur. Go to Plug and Play Device Detection.

Configure your computer to create a multiple-boot system by using Windows 2000 Professional with other operating systems.

Review the procedures and considerations for setting up a multiple-boot configuration. Review the detailed description about how to set up a multiple-boot system by using Windows 2000 Professional with Microsoft^® Windows NT^® 4.0, Microsoft^® Windows^® 95, Microsoft^® Windows^® 98, and Microsoft^® MS-DOS^®. Go to Installing a Multiple-Boot Operating System.

Install service packs with Windows 2000 Professional.

Learn how service packs are added to Windows 2000 Professional and how Service Pack installation has changed since Windows NT 4.0.Go to Installing Service Packs.

Remove Windows 2000 Professional from your computer

If you have problems during Setup or if Windows 2000 Professional does not run, you might need to remove the operating system from the computer. Review details about how to remove the operating system and the associated files. Go to Removing Windows 2000 from Your Computer.

Troubleshoot Windows 2000 Professional Setup

Review some of the problems that can occur during Windows 2000 Professional Setup and the steps you can take to troubleshoot them. Go to Troubleshooting Windows 2000 Professional Setup.

Top

Phases of Setup

When you are installing or upgrading Windows 2000 Professional, follow the three general Setup phases, including: the Setup Loader phase, which is used to begin the installation process; text-mode Setup, which is the text-based portion of Setup and is characterized by a blue background; and GUI-mode Setup, which is the final phase of Setup and is distinguished by a Windows graphical interface and wizard page.

Setup Loader

The Setup Loader phase of Setup is usually initiated by running Winnt.exe or Winnt32.exe from the command line. You can also initiate Setup Loader by starting the computer from the Windows 2000 operating system CD. Setup copies the installation files and Setupldr from the CD to the hard drive and creates or modifies Boot.ini (in multiple-boot configurations in which either Windows NT 4.0 or Windows 2000 is previously installed). Setupldr is a variant of Ntldr, which initiates the installation process when it is called by the bootstrap loader and loads Ntbootdd.sys and Ntdetect.com. These files perform initial hardware detection and then pass control to the kernel, which is loaded along with the boot drivers and the drivers for the hard drive controller(s). Setupldr also changes the boot sector to point to Setupldr.

This phase of Setup also gathers information to create a small unattended file. This file answers some of the questions that are asked later in the Setup process so that it can be run with minimal involvement.

For more information about using Winnt.exe and Winnt32.exe, refer to: Installing Windows 2000 Professional elsewhere on this site.

Text-Mode Setup

The text-mode phase of Setup is a mini-kernel mode phase that is started by a special session manager called Usetup.exe, which is located in the folder i386. The text-mode phase is also identified by its character-based screen with a blue background. During this phase, Setup completes the following tasks:

• Determines the basic hardware installed (such as the CPU, motherboard type, and hard disk controllers).

• Examines the hard disks.
• Creates the registry and file systems.
• Performs limited Plug and Play detection.
• Partitions and formats the drive for the file system or converts to an NTFS file system when you upgrade from Windows NT 4.0 Workstation.
• Checks that there is adequate disk space for the installation and checks for minimum system requirements, such as memory and hard disk drive space.
• Copies most installation files to the Windows 2000 installation folder to begin the GUI-mode phase of Setup.

After the text-mode phase of Setup is complete, the computer restarts, and the GUI-mode phase of Setup begins. GUI-mode is identified by a graphical user interface (GUI) and the Setup wizard, which begins with the End-User License Agreement ( EULA) and Product ID dialog box.

Note:

When you use Winnt32.exe or Autorun.exe, the EULA and Product ID dialog box appear during the Setup loader phase.

Setup performs the following tasks during the GUI-mode phase:

• Detects and installs devices found on the computer.
• Configures each device, and installs and configures networking components. Installs any optional components.
• Copies the remaining installation files that were not copied during the text-mode phase of Setup.
• Writes the Setup log files to the installation directory.
• The Setup log files are as follows:
  • Setupact.log, which contains information about all the files copied during setup.
  • Setuperr.log, which contains information about any errors that were encountered during Setup.
  • Setupapi.log, which contains information about the device driver files that were copied during Setup.
  • Setuplog.txt, which contains additional information about the device driver files that were copied during Setup.

Note: The log files that are created during Setup can be used to help troubleshoot any installation problems that you might encounter. Double-click a log file to read it, or open it by using Notepad or a word processing application.

When GUI-mode has completed these tasks, it starts the operating system and presents the Winlogon screen. This stage of Setup is recoverable; if Setup halts, it can restart and continue where it left off.

During a clean installation of Windows 2000 Professional, Setup now prompts you to provide a user account and logon information. If you are upgrading from Windows 95 or Windows 98, Setup prompts you to supply password information.

Note: On a new installation, you are prompted for an Administrator password; you can also personalize the installation, for example, by customizing Regional Options, Accessibility Options, and Network and Dial-up Connections settings.

Top

Windows 2000 Professional Startup Process

The Windows 2000 startup process is similar to the startup process for Windows NT 4.0 but is significantly different from other operating systems. In MS-DOS, Windows 95, and Windows 98, the computer loads the IO.sys file followed by Msdos.sys and Command.com. However, in Windows 2000, these files only exist on computers that have multiple-boot configurations with Windows 95, Windows 98, or MS-DOS.

The following list describes the startup sequence on a computer running Windows 2000 Professional:

• Power-on self test (POST)
• Initial startup process
• Bootstrap loader process
• Operating system selection (if the computer has a multiple-boot configuration)
• Hardware detection
• Hardware configuration selection (if you are using more than one hardware profile)
• Kernel loading
• Operating system logon process

Note: The system startup sequence only applies to a system that is started from a reboot or a power off state. This sequence does not apply to a system that is turned on from a hibernated state.

This startup sequence applies to all versions of Windows 2000.

Power-on Self Test

When a computer is started or reset, it runs the power-on self test (POST), which determines the amount of memory in the computer and checks that required hardware devices, such as the keyboard, are present and functioning. After the POST sequence, adapters that have their own basic input/output system (BIOS) run individual POST routines.

Note: Some adapters (for example, some video adapters) run their POST sequence before the memory and device check, which runs during the initial POST.

Starting the Computer

After the computer finishes the POST, the system BIOS attempts to start an operating system. The sequence that the BIOS follows depends on the BIOS configuration. For example, if the BIOS search order is set to A and then C (A, C), the BIOS searches the floppy disk drive for a bootable disk. If drive A contains a bootable floppy disk, the BIOS loads its first sector (the partition boot sector) into memory. If the floppy disk is not bootable, the following error message appears.

Non-system disk or disk error

Replace and press any key when ready

If the BIOS does not find a floppy disk in the drive, it then searches for the active partition on the hard disk drive. If there is no system partition on the first hard disk, the master boot record (MBR) displays one of the following errors:

• Invalid partition table
• Error loading operating system
• Missing operating system

When the active partition of the hard drive is found, the system BIOS reads the MBR and loads it into memory. The MBR then scans the partition table for the system partition information. When the system partition information has been read, it loads sector 0 of the system partition into memory and starts it.

Note: Sector 0 of the system partition can be a utility, a diagnostic program, or a partition boot sector that contains the startup code for the operating system.

The system partition must be on the first physical disk and contain the system startup files listed in Table 6.1.

Table 6.1 Windows 2000 Startup Files

Note: If the name of the path in Boot.ini uses small computer system interface (SCSI) syntax, the Ntbootdd.sys must be in the root folder of the system partition.

The boot partition can be on the same partition as the system partition, on a different partition, or on a different hard disk.

For the most part, the MBR is independent of the operating system. For example, the MBR can start Windows NT, Windows 95, Windows 98, MS-DOS, Microsoft^® Windows^® 3.x, and Windows 2000 Professional. However, after boot sector 0 has been loaded into memory, the partition boot sector is dependent on both the operating system and the file system. The Windows 2000 partition boot sector performs the following functions:

• Reads the file system to find the bootstrap loader.
• Loads the bootstrap loader into memory.
• Starts the bootstrap loader.

Bootstrap Loader Process

Ntldr loads the operating system files from the boot partition. If you have a multiple-boot configuration, you are prompted to choose an operating system.

Ntldr controls the operating system selection and the hardware detection process before passing control to the Windows 2000 kernel. Ntldr must be in the root folder of the startup disk.

Ntldr performs the following steps:

• Sets the processor to run in 32-bit flat memory mode. When you first start a computer, it runs in real mode, which is similar to an 8088 or 8086 CPU. Because Ntldr is a 32-bit program, it must switch the processor to 32-bit mode so that it can continue to load the operating system.
• Starts the NTFS file system or the file allocation table (FAT) 16 or 32 file system. The code to access the appropriate file system is built into Ntldr.
• Reads Boot.ini, which displays the operating selections on the boot loader screen. If you select an operating system other than Windows 2000 Professional, Ntldr loads and passes control to the Bootsect.dos file, and the selected operating system starts. If you select Windows 2000 Professional, Ntldr starts Ntdetect.com, which gathers information about the computer hardware.
• Asks you to choose a hardware profile if you have one or more hardware profiles on your computer.
• Loads and passes the information from Ntdetect.com to Ntoskrnl.exe, starting the startup screen.

Operating System Selection

Boot.ini contains the list of available operating systems. Each entry includes the path to the boot partition for the operating system, the string to display in the boot loader screen, and optional parameters. Boot.ini supports starting multiple versions of Windows 2000, as well as starting other operating systems, such as Windows 95, Windows 98, Windows NT 4.0, MS-DOS, and OS/2.

When you install Windows 2000, Setup places Boot.ini at the root of the system partition.

The following is a sample Boot.ini file:

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINNT

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\winnt= “Microsoft Windows 2000

Professional” /fastdetect

C:\=”Windows 98″

The information displayed on the boot loader screen is based on the contents of Boot.ini, such as in the following example:

Please select the operating system to start:

Microsoft Windows 2000 Professional

Microsoft Windows 98

Use your arrow keys to move the highlight to your choice.

Please touch Enter to choose.

Seconds until highlighted choice will be started automatically: 29

For troubleshooting and advanced startup options for Windows 2000, press F8.

The first operating system listed is the default. In this configuration, if you do not select an operating system before the timer reaches 0, Windows 2000 Professional is started.

Hardware Detection

After you select the operating system, Ntdetect.com detects the hardware, gathers a list of the currently installed hardware components, and passes the information to Ntldr.

Ntdetect.com detects the following components:

• Computer ID
• Bus/adapter type
• Video adapter
• Keyboard
• Communications ports
• Floppy disks
• Mouse or other pointing devices
• Parallel ports

Selecting a Hardware Configuration

During the Ntdetect phase, if you have multiple hardware configurations, the following information appears:

Hardware Profile/Configuration Recovery Menu

This menu allows you to select a hardware profile to be used when Windows 2000 is started.

Note: Profiles are only necessary under non–Plug and Play conditions. Plug and Play negates the need for profiles.

The bootstrap loader pauses for a few seconds or until you press Enter. If you have only one hardware profile, Windows 2000 Professional uses the default settings.

Windows 2000 Professional automatically uses the default settings if you do not select a hardware profile. When the default configuration is used, the bootstrap loader uses the registry information that Windows 2000 Professional saved at the completion of the last shutdown. After you select a hardware profile, Ntdetect.com passes control back to Ntldr.

Loading and Initializing the Kernel

During the next phase, Ntldr loads the kernel and the hardware abstraction layer (HAL) into memory. Next the bootstrap loader loads the registry key HKEY_LOCAL_MACHINE\SYSTEM from the folder %SystemRoot%\system32\Config\System. Ntldr creates the control set that it uses to initialize the computer. The loader uses the control set identified by the default value unless you choose the Last Known Good Configuration from the Hardware Profiles screen.

The kernel initiates the Windows 2000 Professional screen, and the Starting Up progress bar is displayed. When the status bar completes, Ntoskrnl prepares the network information.

The kernel uses the information that was passed from the boot loader to create the HKEY_LOCAL_MACHINE\HARDWARE key, which contains the hardware data that is collected at system startup. The data includes information about various hardware components on the motherboard and the system interrupts allocated by each device.

The kernel then creates the Clone control set, which is a copy that points to the Current control set. The Clone control set represents the state of the computer during configuration and is not changed or modified.

Logging On to the Operating System

The Windows subsystem automatically starts Winlogon.exe, which starts the Local Security Administration. The Begin Logon dialog box appears. Windows 2000 might still be initializing network device drivers, but you can log on.

The Service Controller searches the registry for services that are configured to load automatically. Autoload services have a Start value of 0x2 in the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DriverName.The services that are loaded during this phase are loaded in parallel and so are loaded based on their dependencies. The dependencies are described in the DependOnGroup and DependOnService entries in the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DriverName.

Note: Windows 2000 startup is not considered complete until a user successfully logs on to the system. After a user logs on, the Clone control set is copied to the LastKnownGood control set.

Understanding the Boot.ini Naming Convention

Windows 2000 uses the Advanced Reduced Instruction Set Computing (RISC) naming convention to define the path to a Windows 2000 installation.

Using ARC Pathnames

The Advanced RISC Computing (ARC) pathnames in Boot.ini point to the location of the boot partition for all Windows 2000 installations. A single line in Boot.ini represents each installation. During the startup process, the boot loader screen prompts you to choose an installation.

The ARC names in the file Boot.ini are similar to the following:

• Multi(W)disk(X)rdisk(Y)partition(Z)\%systemroot%
• Scsi(W)disk(X)rdisk(Y)partition(Z)\%systemroot%
• Signature(8b467c12)disk(1)rdisk(0)partition(2)%systemroot%=”description”

Windows 2000 Professional can use any of these formats in Boot.ini to locate the SystemRoot directory.

This form of the ARC pathname is referred to as Multi. On Microsoft^® Windows NT^® version 3.1, Multi syntax was only valid for Integrated Device Electronics (IDE), Enhanced Integrated Drive Electronics (EIDE), and Enhanced Small Device Interface (ESDI) disks. In Microsoft^® Windows NT^® version 3.5 and later (including Windows 2000), it is also valid for small computer system interface (SCSI) disks. It is not used with Windows 95 or Windows 98.

The Multi syntax instructs Windows 2000 Professional to rely on the system BIOS to load system files. This means that Ntldr is using interrupt (INT) 13 BIOS calls to find and load Ntoskrnl.exe and any other files it needs to start the system.

The following is an example of the Multi syntax :

multi(W)disk(X)rdisk(Y)partiton(Z)

Table 6.2 describes the parameters used in the Multi syntax:

Table 6.2 Multi Syntax Parameter Variables

In theory, the Multi syntax can start Windows 2000 from any disk. However, this requires that all connected disks use the INT 13, and the system BIOS usually identifies only one disk adapter with INT13. For this reason, you can only use the Multi syntax to start Windows 2000 Professional from either of the two disks on the primary IDE or SCSI device or on the secondary IDE or SCSI device.

The use of the Multi syntax depends on the type of adapter that your computer uses. For example:

• On IDE adapters, the Multi syntax works for up to four disks: two on primary and two on secondary IDE channels.
• On SCSI adapters, the Multi syntax works for the first two disks on the first SCSI adapter (the adapter whose BIOS loads first).
• With both SCSI and IDE adapters, the Multi syntax works for only the IDE disks on the first adapter.

SCSI Syntax

The SCSI syntax tells Windows 2000 Professional to load a SCSI device driver to access the boot partition.

The SCSI syntax is as follows:

scsi(W)disk(X)rdisk(Y)partition(Z)

Table 6.3 defines the parameters used in the SCSI syntax:

Table 6.3 SCSI Syntax Parameters

Signature Syntax

The Signature syntax is equivalent to the SCSI syntax but is used instead to support the Plug and Play architecture in Windows 2000. Because Windows 2000 is a Plug and Play operating system, the SCSI controller number instance might vary each time you start Windows 2000, especially if you add new SCSI controller hardware after Setup.

The Signature syntax instructs Ntldr to locate the drive with a disk signature that matches the value in the parentheses, regardless of which SCSI controller number that the drive is connected to.

The naming format in Boot.ini starts with Signature syntax. For example:

signature(8b467c12)disk(1)rdisk(0)partition(2)\winnt=”description”

The Signature syntax is used only if one of the following conditions exists:

• The partition on which you installed Windows 2000 is larger than 7.8 gigabytes (GB) in size, or the ending cylinder number is higher than 1024 for that partition, and the system BIOS or boot controller BIOS does not support Extended INT13.
• The drive on which you installed Windows 2000 is connected to a SCSI controller whose BIOS is disabled, so INT13 BIOS calls cannot be used during the startup process.

The Signature value is extracted from the MBR. This unique hexadecimal number is either written to the MBR during the text-mode portion of Setup or by a previous installation of Windows NT 4.0 or earlier.

Ntbootdd.sys

Ntbootdd.sys is a copy of the SCSI device driver and resides on the system partition. Ntbootdd.sys is used when using the SCSI or Signature syntax in the file Boot.ini.

Additionally, if you have multiple SCSI controllers that use different device drivers, include only the controllers that are controlled by Ntbootdd.sys when determining the value of the W parameter. For example, if you have an Adaptec 2940 controller (which uses Aic78xx.sys) and an Adaptec 1542 controller (which uses Aha154x.sys), the value of W is always 0. Ntbootdd.sys changes in the following situations:

• If you load Windows 2000 Professional from a disk on the Adaptec 2940 controller, Ntbootdd.sys is a copy of Aic78xx.sys.

• If you load Windows 2000 Professional from a disk on the Adaptec 1542 controller, Ntbootdd.sys is a copy of Aha154x.sys.

Editing Boot.ini

When you install Windows 2000 Professional, Boot.ini sets the system and hidden attributes for you. You can edit the time-out and default parameters in Boot.ini by using the System option in Control Panel.

Important: Back up the original Boot.ini file before making any changes.

To view Boot.ini, you must be able to view hidden files in My Computer.

To show hidden files in My Computer

1. On the Tools menu, click Folder Options, and then click the View tab.
2. Hide protected operating system files.
3. Click OK .

To edit the file Boot.ini, you can use Windows Explorer and double-click Boot.ini, or you can open any text editor to edit the file.

If you change the path to the Windows 2000 boot partition, edit the entries for both the default path and the operating system path. If you change only one, a new choice is added to the boot loader screen with the default designator next to it.

Driver Cabinet File

A cabinet (.cab) file is a compressed file that contains other distribution files, such as drivers and system files. Drivers are placed in a single .cab file on the Windows 2000 operating system CD. This driver .cab is used by both Setup and other system components that need to install drivers. The .cab file contains approximately 3000 files and is installed at:

%windir%\Driver Cache\\driver.cab

The list of files is in Drvindex.inf. To view the .cab file, use Windows Explorer.

The benefits of using a .cab file include the following:

• Does not require administrators to use a Setup CD to install new devices on the computer.

• Does not require you to log on with local admin rights to install new hardware as long as the device is present in the .cab file and digitally signed. You can override this by deleting the .cab file from the drive.

• Reduces the amount of bandwidth and installation time that is required for network installations. (Winnt32.exe and Winnt.exe copy a single file instead of many smaller files.)

• Provides a simple way to install printer drivers. Administrators do not need to have the Windows 2000 CD to install printer drivers because most printer manufactures use Microsoft core printer drivers. For mobile users, the printer drivers are always available for quick printing.

• Enables remote install services clients to install drivers for new devices locally. It also allows the Remote Installation feature to support different hardware between the source computer used to create the image and the destination computer installing that image.

When a driver file is needed, Setup checks the Drvindex.inf file to see if the file is listed. If the file is listed and the .cab file is on your computer, Setup tries to copy the file from the .cab file. If a signed driver file is found in the driver cache directory and has the same name as the needed file, Setup uses this file instead of the one contained in the .cab file. If the required file does not exist in the directory of the .cab, the installation path is searched. If that fails, Setup prompts you to supply the required file.

Top

Plug and Play Device Detection

Plug and Play is a combination of the system BIOS, hardware devices, system resources, device drivers, and operating system software. This combination provides dynamic installation and configuration of new system hardware components and Plug and Play devices that require little or no manual intervention.

System BIOS

The basic input/output system (BIOS) starts the computer by providing a basic set of instructions. It performs all necessary startup tasks, including POST and starting an operating system from a floppy disk or hard disk. The BIOS uses a library of interrupt handlers to provide the operating system with an interface to the underlying hardware. For instance, each time a key is pressed, the CPU performs an interrupt to read that key. This is similar for other input/output devices, such as serial and parallel ports, video cards, sound cards, hard disk controllers, and so on. Some older computers cannot cooperate with modern hardware because the operating system cannot call a BIOS routine to use it. You can solve this problem by replacing the BIOS with a newer one that supports your hardware or by installing a device driver for the hardware.

How the BIOS interacts with Plug and Play devices varies, depending on whether the system BIOS or the operating system is responsible for configuring the hardware device. Taking this into consideration, you have three possible scenarios:

Only the initial program load or boot devices are controlled by the BIOS

Initial program load (IPL) devices are required to start the system. They can be embedded on the system board or on added devices.

This scenario also supports dynamic configuration, where a non-boot device, such as a PCMCIA card, is installed while the power is on. Each time the system is started in a dynamic configuration, the devices are reexamined. In theory, the assigned resources can be rearranged at restart whether devices have been added or removed.

All devices are configured by the BIOS

If Enable Plug and Play operating system is disabled and the device has a static configuration, you can not remove the device without turning off the system. In addition, you must first turn off the system before you remove almost any device. The exceptions are external port devices and bus types that are Plug and Play by nature, such as universal serial bus (USB) and IEEE 1394.

No devices are configured by the BIOS

In the Advanced Configuration and Power Interface (ACPI) of Windows 98 and Windows 2000, the operating system configures almost all devices. The exceptions are those devices that are needed to start the operating system and bus types that handle it on their own, such as Peripheral Component Interconnect (PCI), USB, and IEEE 1394.

System Resources

System resources are made up of the BIOS, interrupt request lines (IRQs), direct memory access (DMA), input/output (I/O) port addresses, and reserved memory. They allow the individual hardware components to signal and gain access to the CPU without conflicting with other hardware devices. Before Plug and Play, each resource had to be configured manually, which could be difficult.

The Plug and Play Manager determines the hardware resources requested by each device (for example, I/O ports, IRQs, DMA channels, and memory locations) and assigns them appropriately. The Plug and Play Manager can reconfigure resource assignments when necessary, such as when a new device is added that requires resources that are already in use. It can also maintain ISA detection and configuration that is non–Plug and Play.

IRQs

IRQs are channels or switches that are used by hardware devices to signal the CPU. The traditional architecture has 16 IRQs, some of which are used for onboard devices such as the system clock, keyboard, and mouse. The remaining IRQs can be used by expansion cards that are added to the computer.

When you have used all your IRQs, you can share them. In addition, methods have been devised that do not require IRQs. Some new bus types, such as USB and IEEE 1394, require at least one IRQ for the bus controller itself because they reside over the PCI bus. It is possible to share available IRQs, On ACPI systems, all PCI devices can share IRQ 9 by default. Most of the problems created by sharing IRQs are related to bandwidth. To share IRQs, the system places these IRQs on a stack and manages them in first in, first out (FIFO) fashion. The more sharing, the longer it takes to traverse the stack and the more opportunity for time-outs and other problems.

I/O Port Address

After a device signals the CPU by using its assigned IRQ, the device needs to pass information between it and the CPU. This is done through memory. An I/O port address is an area of memory that is reserved by the device to pass required information to the device driver, which in turn passes the information to the CPU. These are not linear memory locations but numerical pointers or representations of physical memory locations. On each hardware device, a read-only memory (ROM) chip stores a collection of device descriptors as hardware registers or on the PCI bus, as the configuration memory space. I/O port addresses serve as a special “lens” that isolates one register from another. There are 65,535 of these ports available in current systems, but as with IRQs, the ports are already reserved for specific devices. In addition, I/O ports can be segregated according to bus type, with some I/O addresses reserved for PCI and others for ISA.

DMA

The device can access physical memory either through the CPU or by bypassing the CPU entirely. Direct memory access (DMA) channels allow devices to write to physical memory without placing a load on the CPU. There are usually eight DMA channels; existing devices reserve a number of channels, leaving approximately five channels free to be used with additional devices. The exception is the PCI bus, in which the DMA is replaced by bus mastering.

Detecting Plug and Play Devices

The Plug and Play detection process in Windows 2000 works similarly to Plug and Play in Windows 98. Each device that is attached to the computer is identified when Windows 2000 Professional starts. Devices that are not required to start the computer remain inactive until the operating system has started.

After identifying each device, Plug and Play determines the system resources that each device requires, stores the configuration in memory, and assigns those resources to the device. After the devices have been configured, Plug and Play identifies and loads the drivers that each device requires.

Plug and Play continues to provide an interface between the system and the device drivers, which consist of I/O routines, Interrupt Request Packets (IRPs), driver entry points, and the registry. In addition, Plug and Play handles power management events and hardware detection, such as removing a portable computer from a docking station or adding or removing a hardware device. Plug and Play also allows applications to control certain power management events.

Building the Device Tree

The device tree contains information about the devices attached to the system. The operating system uses information from drivers and other components to build this tree when the computer starts, and it updates the tree as devices are added or removed. The device tree is hierarchical, with devices on a bus represented as subcomponents of the bus adapter or controller.

To view the hierarchy of devices in the device tree

• In Device Manager, click the View menu, and then click Devices by connection.

Figure 6.1 shows the structure of the device tree.

Figure 6.1 Device Tree Structure

Each node of the device tree is a device node, which consists of the device objects for the drivers and internal information maintained by the operating system.

The hierarchy of the device tree reflects the structure in which the devices are attached to the computer. The operating system uses this hierarchy as it manages the devices. For example, if a user requests to unplug the USB controller from the computer represented in Figure 6.1, the Plug and Play Manager asks the drivers for the USB controller to remove the controller, and the Plug and Play Manager queries the drivers for any descendants of the controller. The Plug and Play Manager determines that this action would cause the USB hub, the joystick, and the camera to become unplugged.

Plug and Play Detection on Non-ACPI Systems

Before installing Windows 2000 on a non-ACPI system, disable Plug and Play Operating System support in the system BIOS.

When a non-ACPI computer is started, Plug and Play is configured by the system BIOS and not the operating system. The BIOS performs the following steps:

1. Isolates any Plug and Play ISA devices for configuration.
2. Builds a resource allocation map of the resources consumed by non-Plug and Play devices.
3. Optionally maintains a list of the previous resource configuration in non-volatile storage or memory.
4. Selects and enables the input and output devices that are required during the startup process.
5. Initializes the device ROM if the device encountered is a boot device.
6. Allocates conflict-free resources to devices that have not yet been configured.
7. Activates all devices.
8. Initializes any option ROMs that have been encountered.
9. Starts the bootstrap loader.

One requirement of Plug and Play is the ability to isolate individual cards for configuration. PCI cards are isolated by the PCI architecture itself. Because the original ISA specification provided no method for isolating one card from another, either the operating system or the system BIOS can perform these steps.

The detection process remains largely unchanged under the ACPI architecture, except that on an ACPI system, the operating system and not the BIOS is responsible for device detection and configuration.

Plug and Play Detection on ACPI Systems

ACPI combines and enhances both Plug and Play and power management. On an ACPI computer, Plug and Play is configured by the operating system and not the system BIOS.

In the following example, a user installs a Plug and Play USB joystick into a USB hub on a USB host controller. The USB hub is a Plug and Play bus device because it can have other devices attached to it. In this example, the USB supports hot-plug notification, and the function driver for the USB is notified that its subcomponents have changed. The operating system performs the following steps:

1. The function driver for the device determines that there is a new device on its bus.
2. The function driver for the bus device notifies the Plug and Play Manager that its set of devices has changed.
3. The Plug and Play Manager queries the drivers for the bus for the current device tree.
4. The Plug and Play Manager sends an Interrupt Request Packet (IRP) to the device stack for the bus asking for the current list of devices on the bus. When the main driver of the USB hub (the USB host controller class or miniclass driver pair) completes the IRP, the IRP travels back through the device stack by means of any completion routines registered by the hub drivers.

   When the Plug and Play Manager has the current list of devices on the bus, it determines if any devices have been added or removed. In this example, there is one new device, and the only driver that is configured for the joystick is the main USB hub driver. Any optional bus filter drivers are also present in the device stack.

5. The Plug and Play Manager gathers information about the new device and begins configuring the device.
6. The Plug and Play Manager checks the registry to determine if the device has been installed on this computer before.
7. The Plug and Play Manager stores information about the device in the registry.
8. The kernel-mode Plug and Play Manager attempts to find and load the function and filter drivers for the device, if any exist.
9. The Plug and Play Manager assigns resources to the device, if needed, and issues an IRP to start the device.

Top

Installing a Multiple-Boot Operating System

You can configure Windows 2000 Professional to start with other operating systems, such as Windows 2000 Server, Windows NT, Windows 95, Windows 98, Windows 3.x, MS-DOS, and OS/2. This section discusses how you can set up Windows 2000 Professional as a multiple-boot system with the following operating systems:

• Windows NT 4.0 and Windows NT 3.51

• Windows 95 or Windows 98

• MS-DOS or Windows 3.x

Important: Each operating system in a multiple-boot configuration must reside in its own partition. Windows 2000 Professional does not support a multiple-boot system that shares the same partition with another operating system.

Multiple-Boot Considerations

Before you set up a multiple-boot configuration between Windows 2000 and another operating system, you need to consider certain precautions, as described in Table 6.4.

Table 6.4 Multiple Boot Considerations

If you need a multiple-boot configuration between Windows 2000 and Windows NT, Windows 95, or Windows 98, install the applications while you are running each of the operating systems to ensure that the applications are included in the registry for all the operating systems.

File System Considerations

Each operating system in a multiple-boot configuration can use one or more file systems to organize data on partitions. Operating systems that use the same file systems can share volumes, so a user can see files in shared partitions from different operating systems.

Additional file system considerations include:

1. NTFS partitions are not available to users running Windows 95, Windows 98, Windows 3.x, or MS-DOS.
2. A computer that is configured with Windows 2000, Windows NT, Windows 95, and Windows 98 can see long file names on a FAT16 volume.

Windows 2000 Professional Multiple-Boot Configurations

Windows 2000 Professional can support multiple-boot configurations between one or more instances of Windows 2000 and additional operating systems in separate partitions on the same computer.

This section describes the configuration details involved when you start Windows 2000 Professional with MS-DOS.

Bootsect.dos

Bootsect.dos is a file with the hidden, system, and read-only attributes that Ntldr uses when the computer is configured to start MS-DOS, Windows 3.x, and Windows 95 or Windows 98.

If there is an existing MS-DOS-based operating system, Windows 2000 Setup copies the boot sector on the active partition of the computer to Bootsect.dos and replaces the original boot sector on the active partition with its own boot sector.

When the computer is started, the active partition that contains the boot sector code starts Ntldr, which loads and displays the boot loader screen from Boot.ini. From the boot loader screen you can choose to start Windows 2000 Professional or another operating system.

If you select an operating system other than Windows 2000 Professional, Windows NT 4.0, or Windows NT 3.51, Ntldr loads ands passes control to Bootsect.dos, which then loads the other operating system.

Configuring a Multiple-Boot System with MS-DOS

If you are going to set up Windows 2000 with a multiple-boot system that includes MS-DOS, it’s a good idea to install MS-DOS before installing Windows 2000 Professional. If MS-DOS is installed after Windows 2000, the boot sector is overwritten with the MS-DOS boot sector and you can no longer start Windows 2000 Professional.

If you have already installed Windows 2000 Professional and you want to install MS-DOS on another partition, you can install MS-DOS and then restore the Windows 2000 boot sector by using the Emergency Repair Disk (ERD).

Configuring a Multiple-Boot System with Windows 95, Windows 98, or Windows NT 4.0.

You can configure Windows 2000 Professional as a multiple-boot system with Windows 2000 Server, Windows NT 4.0, Windows 95, or Windows 98.

If you plan to set up a multiple-boot system with Windows 95, Windows 98, or Windows NT 4.0, install Windows 95 or Windows 98 before installing Windows NT or Windows 2000 because Windows 95 and Windows 98 sometimes replace the Windows 2000 Professional boot sector with their own boot sector.

Configuring a Multiple-Boot System with Windows 2000 Professional, Windows NT, Windows 95 or Windows 98, and MS-DOS

You can configure a computer with a multiple-boot system that includes MS-DOS, Windows 95 or Windows 98, Windows NT, and Windows 2000 Professional, if each operating system resides in its own partition. You need to install the systems in the following order:

• MS-DOS
• Windows 95 or Windows 98
• Windows NT
• Windows 2000 Professional

If you are already running a multiple-boot system with Windows 2000 Professional and MS-DOS, you can install Windows 95 or Windows 98.

To install Windows 95 or Windows 98 after installing MS-DOS

1. From the Start menu, click Shut Down.
2. In the Shut Down Windows box, click Restart and then click OK. The boot loader screen appears.
3. Under Please select the operating system to start, select MS-DOS.
4. Install Windows 95 or Windows 98 in a separate partition, following the standard installation procedures.

After the Windows 95 or Windows 98 installation has finished, restart the computer. With Windows 95, you need to run the Windows 2000 Professional repair process, and then replace the Windows 95 boot sector with the Windows 2000 boot sector. The Windows 2000 boot loader screen allows you to choose between Windows 2000 Professional and MS-DOS. If you choose MS-DOS, Windows 95 or Windows 98 starts.

Top

Installing Service Packs

Windows 2000 Professional makes it easier for administrators to add service packs through a process called slipstreaming, in which the service pack is added directly to the operating system’s distribution share during installation.

Windows 2000 Professional also eliminates the need to reinstall components that were applied before a service pack was installed. In the past, when service packs were applied, many previously installed components had to be reinstalled. Windows 2000 Professional provides the following solutions to service pack installation.

When Windows 2000 Professional is installed from a network share, the appropriate files from the service pack are installed without having to manually apply the service pack after the installation.

To apply a new service pack, use Update.exe with the /slip switch to copy over the existing Windows 2000 files with the updated service pack files. Some of the key files that update during this process include:

• New Layout.inf, Dosnet.inf, and Txtsetup.sif files, which have the updated checksums for all the service pack files. These files need additional entries if any additional files have been added.
• A new driver .cab if the drivers in the cabinet file have been changed.
• If you apply a service pack to a single computer running Windows 2000, you must reapply the service pack to add another service, unless you are updating from a network share that supports service pack slipstreaming.

Top

Removing Windows 2000 Professional from Your Computer

Important: Before removing Windows 2000 Professional from your computer, make sure to back up all important data.

Before removing Windows 2000 Professional, make sure you know where Windows 2000 Professional is installed, what you want to remove, and how your hard disk is partitioned and formatted. The following sections describe how to remove Windows 2000 from your computer:

• Removing Windows 2000 Professional from the Boot Sequence
• Removing a Primary NTFS Partition
• Removing Windows 2000 Professional Files

Note: If the hard disk contains a partition using the NTFS file system, remove this partition from within Windows 2000 before removing Windows 2000 from the boot sequence.

Removing Windows 2000 from the Boot Sequence

You can remove the Windows 2000 boot sector from your computer in two ways.

You can use an MS-DOS boot floppy to start MS-DOS, and then type:

sys c:

This command replaces the Windows 2000 boot sector with the MS-DOS boot sector and allows your computer to start MS-DOS. The following files remain in the root and %SystemRoot% folder and can be deleted after you perform this operation:

• Hyberfil.sys (located in %Systemdrive%)
• Pagefile.sys (located in %Systemdrive%)
• Boot.ini
• Ntldr
• Ntdetect.com
• Ntbootdd.sys

You can also start your computer with a Windows 95 or Windows 98 bootable floppy disk and use the sys c: command to return to your original configuration.

You can leave the Windows 2000 boot sector on the disk and start MS-DOS without being prompted by changing the startup operating system and time-out value.

To change the startup operating system and time-out value

1. Click the Start button, point to Settings, and then click Control Panel.
2. In Control Panel, double-click the System icon, click the Advanced tab, and then click Startup and Recovery.
3. Click the Default operating system list, and then select MS-DOS.
4. In the Display list of operating systems for Seconds box, type or select 0 (zero).

Note: If the primary partition was converted to NTFS, to return to starting MS-DOS automatically, reformat the drive and reinstall MS-DOS.

Removing a Primary NTFS Partition

Modifying the primary, bootable NTFS partition does not typically succeed for the following reasons:

• MS-DOS versions 5.0 and 6.0 do not recognize an NTFS partition. The MS-DOS program Fdisk reports an NTFS partition as an OS/2 high-performance file system (HPFS) partition.

• You cannot modify or delete an NTFS partition from within an existing partition. To delete or modify a primary NTFS partition, use any of the following methods:

• Start MS-DOS by using a Windows 95 or Windows 98 boot disk, then run Fdisk and delete the non-MS-DOS partition.
• Run the Windows 2000 installation from floppy disks or the Windows 2000 operating system CD. Choose D to remove the partition when you are prompted.

Removing Windows 2000 Professional Files

Caution: Make sure you back up all important data before removing the Windows 2000 files from the computer.

You can delete the following Windows 2000 Professional folders to free additional disk space:

• Program Files
• Documents and Settings
• Winnt
• Debug

Note: The folder name for Winnt might vary.

Top

Troubleshooting Windows 2000 Professional Setup

Windows 2000 provides valuable troubleshooting tools that can be used to resolve problems that might occur during Setup. This section discusses how to create Setup and startup disks as well as some frequently asked questions about common Setup problems.

Creating the Startup Disks

To prepare for a system failure on a computer that you cannot start from the operating system CD, you need to create floppy disks that can start the computer.

Note: Before starting a computer by using the Windows 2000 operating system CD or the floppy disks, try starting the computer in safe mode.

After you start the computer by using the floppy disks, you can then use the Recovery Console or an Emergency Repair Disk (if you have prepared one).

Note: You can create floppy disks for starting a disabled system by using the Windows 2000 operating system CD on any computer running a version of Windows or MS-DOS. You need four blank, formatted, 3.5-inch, 1.44-MB floppy disks. Label them Startup Disk One, Startup Disk Two, Startup Disk Three, and Startup Disk Four.

Disks created from the Windows 2000 Server operating system CD cannot be used with Windows 2000 Professional.

To create floppy disks for starting the system

1. Insert a blank, formatted, 1.44-MB disk into the floppy disk drive on a computer that is running any version of Windows or MS-DOS.
2. Insert the Windows 2000 Professional operating system CD into the CD-ROM drive.
3. Click Start, and then click Run.
4. In the Open box, type

   d:\bootdisk\makeboot.exe a:

5. where d: is the drive letter assigned to your CD-ROM drive.
6. Click OK.
7. Follow the screen prompts to finish the installation.

Media Errors

If the CD-ROM drive does not work, replace it.

For a list of drives that are supported for use with Windows 2000 Professional, see the Microsoft Hardware Compatibility List (HCL) link on the Web Resources page at The Microsoft Resource Kit – Web Resources.

Try another installation method, such as copying the source files from the CD-ROM to the hard drive or installing over the network.

If you are unable to copy from the CD-ROM, test the CD-ROM on another computer. If possible, use the CD-ROM on the other computer, use a different CD, or copy the installation folder i386 to the hard drive of the computer that works, and then copy the folder to the computer that had the media errors. To request a replacement CD, contact the vendor.

Disk Errors

If you receive the error Not enough disk space for installation, use the Setup program to create a partition by using the existing free space on the hard disk or, if you do not have enough space, you may have to delete files on the target partition to make room for the installation. You can delete and create partitions as needed to obtain a partition that has enough disk space to install Windows 2000 Professional.

Other Common Setup Problems

If Windows 2000 does not start, make sure that all the hardware that is installed on the computer is being detected. Check that all hardware is listed on the HCL. Only devices that are listed on the HCL have passed testing for compatibility with Windows 2000 Professional.

Stop messages

If you are installing Windows 2000 and you encounter a Stop message, check the HCL to determine if the computer and its components are supported with Windows 2000 Professional. Reduce the number of hardware components by removing nonessential devices.

Setup stops during text mode

Although text-mode Setup does not execute any code, it does rely on access to the devices on the system. It is important on both ACPI and non-ACPI systems to verify that any legacy device IRQ requirements have been set in the BIOS to Reserved for ISA. If possible, avoid legacy boot devices on ACPI systems because these settings cannot be reliably determined by the ACPI system. This can make the building of the device tree inaccurate, causing problems that are very hard to track.

For non-ACPI systems, verify that the Plug and Play operating system option has been disabled in the BIOS. If it has not been disabled, your operating system might read and write to the hardware registers.

Setup stops during GUI mode

During GUI-mode Setup, the computer might stop responding; if this happens, restart the computer and Setup attempts to resume from where it stopped responding. You can usually isolate these failures to one of the following locations:

• Device detection. At the beginning of the GUI-mode phase of Setup, Plug and Play runs to detect all the devices on the system. This involves external code called class installers. These class installers check the hardware settings on the computer to determine which devices are present. The system can sometimes stop responding during this phase.
• OC Manager. The OC Manager (OCM) is a Setup component that allows the integration of external components, such as server applications, into the Setup process. As with device detection, this phase can cause the system to stop responding.
• Computer configuration.
  This is one of the last phases of Setup and involves the registration of OLE control dynamic-link libraries (DLLs). It is possible for Setup to stop responding during this phase as well.

*The information above has been compiled from a number of sources that we would like to acknowledge. They include: Microsoft Technet, Microsoft Resource Kit, various news groups as well as our own technical staff.

Back to Windows 2000 Help?

A server that won’t boot defines «emergency» for most system administrators. Therefore, you’ll want to haul out your disaster recovery plan (as described in Chapter 34) and follow the procedures step by step. If you’re reading this section for the first time because you’re in the middle of a disaster and you don’t have a disaster recovery plan, don’t panic. You can still survive.

The recovery steps outlined in this section proceed from least drastic to most drastic. In any recovery procedure, always adopt a minimalist approach. Start with the least invasive steps. If they succeed, you’ll have minimized both the loss of information and the impact on the network and your users.

Recovering a domain controller is no different from recovering a normal server, except if you want to restore the Active Directory and SYSVOL volume from a backup. To do this, you need to boot the server using the directory services restore mode, as described in Chapter 34.

Figure Out What Happened

Computers rarely «just fail.» Usually something happens to cause a system to fail. Therefore, the first thing to do is ask yourself what changed between the last time the system started and now. If you performed any of the following tasks since the last reboot, an imaginary red flag should be waving in front of your eyes:

• Added or removed a device
• Updated a device driver
• Installed a hot fix, patch, or service pack
• Installed or uninstalled a program, especially a utility program
• Used a configuration tool, MMC snap-in, or utility program to alter system or disk settings
• Edited the registry

If you recently installed a new device driver, it’s a good bet that the new driver is to blame. Try booting into safe mode (discussed later) and switching back to an older driver, or use the Last Known Good startup option.

If you installed a program, hot fix, patch, or service pack, you can try booting into safe mode and uninstalling the suspect program or you can use the Last Known Good startup option. You can also use this approach to recover from a registry-related difficulty.

If your system started making bad mechanical sounds or producing smoke, you might have hardware trouble. After putting out any flames, check to see if all the fans in the system are functioning properly and listen to determine whether the hard drives are still working. If you can’t get the system to boot to its initial startup screen (displayed by the BIOS before Windows has a chance to load), you definitely have hardware trouble, most likely with the CPU, power supply, or RAM.

Display malfunctions can often be fixed simply by booting using the Enable VGA Mode option, available from the Windows Advanced Options menu (discussed in the next section). Once you have booted into Windows, select a more conservative display setting (lower the resolution, refresh rate, or both) or choose a different display driver.

Using the Last Known Good Configuration

It’s what every system administrator dreads: you reboot the system, and it hangs or crashes. Although this is indeed a dire situation, fear not (yet), for Windows comes with an arsenal of tools that you can use to get the system running again. The first tool to try is the Last Known Good Configuration (if your system boots but produces an error message, skip to the section of this chapter entitled Fixing the Underlying Problem).

The Last Known Good boot option can help start a Windows system that won’t boot because of changes made to the registry (usually by a new device driver). As such, when you start a computer using the last known good configuration, Windows restores the HKEY_LOCAL_MACHINE\System\CurrentControlSet registry key to the state it was in immediately after the last successful boot (other registry keys are unaffected).

The Last Known Good Configuration option is probably the quickest way to get a system back up and running, if it works. To use this approach, follow these steps:

1. Restart or turn on the computer.
2. If the computer displays a choice of operating systems select the Windows installation into which you want to boot and then press F8. Otherwise press F8 when the computer displays the Starting Windows text (but before any color images are displayed).
3. Choose Last Known Good Configuration and then press Enter. Windows attempts to start using the registry settings from the last successful boot. If this fails, move on to starting using Safe Mode. If it succeeds, evaluate what caused the trouble in the first place (probably a new device driver) and then plan future maintenance of the system accordingly (that is, don’t use the same driver again).

Using Safe Mode

Windows safe mode, introduced with Windows 95, and brought to the Windows NT codebase by Windows 2000, is a special diagnostic mode that disables all unnecessary services and drivers, maximizing the chances of booting successfully. As such, it’s one of the most important troubleshooting tools for dealing with a Windows machine that won’t boot.

Once the computer boots into safe mode, you have full access to the system, making it much easier to fix the underlying condition. To boot using the Safe Mode option, use the following procedure:

1. Restart or turn on the computer.
2. If the computer displays a choice of operating systems, select the Windows installation into which you want to boot and then press F8. Otherwise press F8 when the computer displays the Starting Windows text (but before any color images are displayed).
3. Choose Safe Mode and then press Enter. Windows attempts to boot into safe mode.

   You can also choose Safe Mode With Networking if you require network access (and the fault doesn’t lie in the networking subsystem) or Safe Mode With Command Prompt to bypass the Explorer shell and instead use simply a command prompt interface (further increasing the chances of a successful boot).

4. If Windows successfully boots into safe mode, you now have the full power of Windows at your troubleshooting disposal. See the section entitled Fixing the Underlying Problem later in this chapter for information about what to do at this point.
5. If Windows doesn’t boot successfully, you need to move on to a more drastic approach, such as attempting to repair your current installation using the Recovery Console (as discussed in the sections that follow). You should also test your system for viruses, because some can prevent Windows from booting.

Using the Emergency Repair Process

If you can’t boot using one of the boot options mentioned earlier in this chapter, try the emergency repair process. This method involves booting from either the Windows 2000 CD-ROM or the four setup disks, and then using the Windows 2000 repair process. To do so, follow these steps:

1. Boot from the Windows 2000 setup disks or the Windows 2000 CDROM.
2. Type R to choose to repair an existing Windows 2000 installation.
3. Type R again to use the emergency repair process to fix an existing installation of Windows 2000.
4. Type F to use the Fast Repair option to automatically repair registry faults, system files, the boot sector of the boot volume, and problems with the startup environment if you have a dual-boot system.

   Fast Repair repairs registry errors by using a backup copy of the system registry that was created when Windows 2000 was installed. Using this option might result in the loss of settings and preferences created since that installation. If you want to keep these settings, restore from a recent backup after you get the system booting properly.

   Type M to use the Manual Repair option to manually specify what you want to repair, although the registry cannot be repaired in this way. (You can use the Recovery Console to manually repair individual registry files or to replace the entire registry if you like.)

5. If you chose Manual Repair, select the repair options you want by using the arrow keys and pressing Enter to select or clear each check box. Table 38-1 provides a list of the repair options. When you’re done, select the Continue option and press Enter.
6. After you’ve selected the repair options, insert the emergency repair disk (ERD) and press Enter. (Creating an ERD is discussed in Chapter 34.) If you don’t have an ERD, type L. Windows 2000 searches for the installation and displays any that it finds. To repair the found installation, press Enter; otherwise press Esc.

Table 38-1. Manual Repair options

Using a Boot Disk to Recover the System

You don’t need us to tell you how to use a boot disk (insert disk, boot computer). However, it’s useful to know a little more about what a boot disk does and doesn’t do. (For information about creating a Windows 2000 boot disk, see Chapter 34.)

Because Windows 2000 Server is installed on an NTFS partition (avoid FAT and FAT32 partitions on servers for security reasons), you can’t just pop in any old Windows 98 boot disk and access the computer’s hard drive. Instead, either use a specially made Windows 2000 Server boot disk, or boot using the Recovery Console (covered later).

When you boot the system from a Windows 2000 Server boot disk, you are bypassing the hard disk’s master boot record, boot sector, and startup environment, but do not end up at a command prompt. Instead, the system boots straight from the floppy drive into the operating system you choose from the floppy’s Boot menu (Windows 2000 Server).

This provides access to Windows on a system with a corrupted MBR, boot sector, or startup environment. After the system boots properly, you’ve narrowed down the difficulty to the Boot.ini file, MBR, boot sector, or Windows startup environment. You can edit the Boot.ini file and replace missing or corrupted Windows files such as Ntldr or Ntdetect.com while in Windows (as discussed later in this chapter), but to fix the MBR or boot sector you’ll have to reboot using the Recovery Console, which is discussed next.

Using the Recovery Console

The Recovery Console is an incredibly powerful tool that was introduced with Windows 2000. It quite definitively eliminates the need for FAT system partitions or parallel recovery installations of Windows.

The Recovery Console allows secure access to the root directory and system folder of a nonbooting Windows computer using a special command prompt. At the command prompt, you can perform numerous recovery tasks, such as the following:

• Fixing disk errors
• Fixing the MBR and boot sector
• Starting and stopping services
• Extracting and copying files

Before you use the Recovery Console, it’s important to understand its limitations. Although you can use the Recovery Console to securely log on to a Windows 2000 Server installation and access any NTFS, FAT, or FAT32 drives, by default you can use only the root folder of each drive, the %SystemRoot% folder and subfolders, the Cmdcons folder (if present), and any removable media drives attached to the system. By default you cannot copy files from the hard disk to a floppy disk, although you can copy files from a floppy to the hard disk or from one hard disk to another.

You can enable full access to your hard drives from the Recovery Console by changing the Recovery Console setting in the relevant Group Policy object. Just keep in mind that this exposes potentially sensitive data to anyone who can boot the system using the Recovery Console (in other words, anyone who gains access to the local system administrator password and physical access to the server).

To use the Recovery Console, follow these steps:

1. Boot from the Windows CDROM or setup disks (you might have to change the boot order in your BIOS to boot from the CD-ROM first). You can also boot directly into the Recovery Console, if you’ve installed it (see Chapter 34).
2. After Windows Setup loads, type R to choose to repair an existing Windows 2000 installation. Then type C to access the Recovery Console.
3. Enter the number corresponding to the Windows 2000 installation to which you want to log on and press Enter.
4. Enter the local system administrator password. (This is the password you originally assigned when installing Windows 2000.)
5. Type help at the command prompt for a list of available commands, or enter the commands you want to execute. See Appendix D for a list of the commands available and a description of what they do.
6. Some commands you might want to use include the following:
   • chkdsk /r to locate bad sectors and fix them
   • disable to disable a service or driver you suspect might be causing trouble
   • diskpart to view and modify disk partitions
   • expand to extract compressed files
   • fixboot to write a new boot sector onto the specified partition
   • fixmbr to write a new master boot record (MBR) on the specified disk drive
   • format to format a disk
   • listsvc to list the services and drivers installed on the system

   The password used to log on to a domain controller is the directory services restore mode password you set when you promoted the computer to a domain controller. To change the password, restart the domain controller in directory service restore mode and type net user administrator new_password at a command prompt, replacing new_password with the desired password (or use the Local User and Groups snap-in). See Microsoft Knowledge Base article Q239803 for more information.

Booting from Mirrored Boot Partitions

If the primary boot drive fails on a system with mirrored boot partitions, the system continues to operate normally until the next reboot, at which point the system fails unless the drives and controllers involved in the mirror set are exactly the same (down to the firmware revisions and partitioning schemes).

If you can’t boot a system with a failed mirror set, you’ll need to create a boot floppy disk using the procedure outlined in Chapter 34, with one additional step. Edit the Boot.ini file on the floppy to change the ARC name of the boot partition to point to the secondary mirror drive, rather than the primary one. So, for example, if you have a pair of Adaptec 38SCSI adapters and you have duplexed your boot drives using the SCSI BIOS to boot from the primary partition on the first hard disk, you might have a line like this in your Boot.ini file:

 multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000
Advanced Server" /fastdetect 

However, if you need to boot from the secondary mirror pair, you would need to change that line to

 multi(1)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000
Advanced Server" /fastdetect 

Once you’ve booted your system and replaced the failed drive, re-create the mirror (as described in Chapter 15).

More Info

See Microsoft Knowledge Base article Q167045 or the Microsoft Windows 2000 Server Resource Kit for more information about how Windows 2000 Server and Windows 2000 deal with failed mirror sets.

Restoring a Completely Failed Server

So the worst has happened. You’ve had a server totally crash. You’ve replaced the failed hard disk, and you’ve got a backup tape to restore with, but you have to be able to boot before you can restore the tape.

The first step is to reinstall Windows 2000 Server on the new disk. Use a temporary directory name so it doesn’t interfere with the original installation. Once you have the minimal system installed, you can restore the registry and partition information using your emergency repair disk and the backup tape. Run the Windows 2000 Backup program and restore the operating system and System State. The tape drive should be locally attached, and you’ll want to make sure you select the Restore Local Registry option to recover the rest of your registry information. Restart the server and you’re ready to go.

This process can take a significant amount of time. In an environment such as manufacturing or another production operation, where the server must be available, you might find that you can’t afford the time this process takes. The most efficient solution to this dilemma is to mirror or, better yet, duplex the system disk, preferably with a hardware RAID controller. However, even using Windows 2000 Disk Management to mirror the system disk will save you significant amounts of downtime.