THE BOTTOM LINE
One of the most frustrating problems to troubleshoot is when Windows does not boot and you cannot log in to Windows. To overcome these problems, you need to understand how the computer boots and be familiar with the tools available during boot up.
Every time you turn on a computer, it goes through the Power-On Self Test (POST), which initializes hardware and finds an operating system to load. The POST includes the following steps:
1. The computer does a quick power check to make sure it has enough power to supply the system.
2. When the processor receives a power good signal, the processor initializes and tests essential PC components as specified in the System ROM BIOS.
3. If a problem is found, the computer identifies the problem with a series of beeps based on the system ROM BIOS.
4. The processor then initializes the video card and starts sending information to the monitor.
Next, the system initializes additional components. If a problem is discovered, it displays a message to indicate the problem.
5. The system will search for a boot device (such as a hard drive, optical disk, or USB flash drive) from which to boot.
6. The system will read the master boot record on a boot device to determine operating system boot files.
If the system is running Windows XP or Windows Server 2003, the system will go through the following steps:
1. NT loader (NTLDR) is loaded, which reads the boot.ini file to display the boot menu or to boot from a partition or volume.
2. NTDetect.com gathers information about the computer hardware as reported by the BIOS.
3. NTOSKRNL.EXE is the main part of Windows, which is responsible for various system services and process and memory management.
4. HAL.DLL implements a number of functions different ways by various hardware platforms based on processor and chipset.
CERTIFICATION READY If your server fails to start properly, do you know how to isolate the point at which it fails?
6.1
c04MonitoringAndTroubleshootingS95 Page 95 1/15/11 3:40:39 PM users-133
c04MonitoringAndTroubleshootingS95 Page 95 1/15/11 3:40:39 PM users-133 /Users/users-133/Desktop/Ramakant_04.05.09/WB00113_R1:JWCL170/New/Users/users-133/Desktop/Ramakant_04.05.09/WB00113_R1:JWCL170/New
96 | Lesson 4
If the system is running Windows Vista, Windows 7, or Windows Server 2008, the system will go through the following steps:
1. BOOTMGR is loaded, which accesses the Boot Configuration Data Store to display the boot menu or to boot from a partition or volume.
2. WINLoad is the operating system boot loader, which loads the rest of the operating system.
3. NTOSKRNL.EXE is the main part of Windows, which is responsible for various system services and process and memory management.
4. Boot-class device drivers implement a number of functions in different ways by various hardware platforms based on processor and chipset.
A master boot record (MBR) is the first 512-byte boot sector of a partitioned data storage device such as a hard disk. It is used to hold the disk’s primary partition table, contains the code to bootstrap an operating system, which usually passes control to the volume boot record and uniquely identifies the disk media. By default, the master boot record contains the primary partition entries in its partition table.
A volume boot record (VBR), also known as a volume boot sector or a partition boot sector, is a type of boot sector, stored in a disk volume on a hard disk, floppy disk, or similar data storage device that contains code for booting an operating system such as NTLDR and BOOTMGR.
The active partition is the partition or volume that is marked as the partition from which to boot. The active partition or volume that contains the boot file (NTLDR or BOOTMGR) is known as the system partition/volume. The partition or volume that contains the Windows operating system files (usually the Windows or WINNT folder) is called the boot partition.
It is common for the systems to have one drive and one partition/volume that makes up the partition, system partition, and boot partition.
The %SystemRoot% variable is a special system-wide environment variable found on Microsoft Windows systems. Its value is the location of the system folder, including the drive and path. By default, on a clean installation of Windows, the %SystemRoot% is C:\Windows.
The menu options are stored in boot.ini, which itself is located in the root of the same disk as NTLDR. It is a read-only, hidden, system file.
The boot.ini file is divided into two sections, [boot loader] and [operating system]. The [boot loader] section configures the number of seconds the Boot Loader Operating System Selection menu appears on the screen and the default operating system loaded. For example, the following section:
[boot loader]
Timeout = 30
Default = multi(0)disk(0)ridsk(0)partition(1)\Windows
will display the Boot Loader Operating System Selection menu for 30 seconds. If no operating system is selected Windows will load in the Windows folder.
Understanding Boot.ini
The Windows XP and Windows Server 2003 NTLDR will read the boot.ini file to determine which operating system to load even if your system only has one operating system. If your system has multiple operating systems, the boot.ini file can display a boot menu so that you can choose which operating system to load and automatically select a default operating system if one is not selected during boot up.
c04MonitoringAndTroubleshootingS96 Page 96 12/10/10 7:08:26 PM user-f391
c04MonitoringAndTroubleshootingS96 Page 96 12/10/10 7:08:26 PM user-f391 /Users/user-f391/Desktop/24_09_10/JWCL339/New File/Users/user-f391/Desktop/24_09_10/JWCL339/New File
Monitoring and Troubleshooting Servers | 97 The [operating system] section contains the list of available operating systems. The location of the operating system is written as an Advanced RISC Computing (ARC) path. An example of the [operating system] section is:
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT=“Microsoft Windows Server 2003”/
fastdetect
The ARC path is used to specify the location of the operating system. It follows the format:
multi(x)disk(y)rdisk(z)partition(a) or
scsi(x)disk(y)rdisk(x)partition(a)
SCSI is used for a SCSI disk with its BIOS disabled. Multi is used for disks other than SCSI or a SCSI with its BIOS enabled. The number after Multi is the ordinal number of the hardware adapter starting with 0. The number after Disk is the SCSI bus number and will always be 0 for a non-SSCI disk or for a SCSI disk with its BIOS enabled. The number after Rdisk is the ordinal number of the disk starting from 0. The number after partition is the ordinal number of the partition starting with 1. After the partition, you then specify the folder that contains the Windows folder. This will usually be \Windows or \Winnt.
There are several options that can be used in the [operating system] section. Some of the popular settings include:
/FASTDETECT[:comx[,comy]]: Turns off serial and bus mouse detection for the specified port(s), or for all ports if none are specified. Use this switch when there is a component other than a mouse attached to a serial port during the startup process. Ports may be separated with commas to turn off more than one port.
/BASEVIDEO: Forces the system into standard 640 ! 480 16-color VGA mode by using a video device driver that is compatible with any video adapter. If the operating system fails to load due to a faulty or incorrectly configured video driver, this switch allows the system to load, so that the user may then remove, update, or roll back the problem video driver.
/3GB: Forces !86-based systems to increase the virtual address space allocated for user programs to 3 GB, and to decrease to 1 GB allocated to the kernel and to executive components. Some configurations of Windows Server 2003 that run virtual memory intensive applications such as database servers or Microsoft Exchange Server 2003 may require this switch for better performance.
/PAE: Enables Physical Address Extension support, which allows the system to see more than 4 GB of memory. Note: In safe mode, the computer starts by using normal kernels, even if the /PAE switch is specified.
/NOEXECUTE: Data Execution Prevention (DEP) uses a processor feature to prevent malicious code from exploiting buffer overflow bugs with unexpected program input in order to execute arbitrary code. The /NOEXECUTE option is only available with 32-bit versions of Windows running on processors that support DEP. The NoExecute option is always enabled on 64-bit versions of Windows. To disable DEP, you would include /NOEXECUTE=ALWAYSOFF.
When using Windows XP or Windows Server 2003, you can modify the default operating system and the amount of time the list of operating systems appear by right-clicking My Computer, selecting Properties, selecting the Advanced tab, and right-clicking the Settings button in the Startup and Recovery section. You can also edit the boot.ini file by clicking the Edit button and specifying what type of dump occurs during a system failure. See Figure 4-3.
c04MonitoringAndTroubleshootingS97 Page 97 12/10/10 7:08:26 PM user-f391
c04MonitoringAndTroubleshootingS97 Page 97 12/10/10 7:08:26 PM user-f391 /Users/user-f391/Desktop/24_09_10/JWCL339/New File/Users/user-f391/Desktop/24_09_10/JWCL339/New File
98 | Lesson 4
Unlike previous versions of Windows that used the boot.ini file to designate the boot configuration, newer versions of Windows store the configuration in a \Boot\bcd on the system volume on machines that use IBM PC compatible firmware. To edit the Windows Boot Menu Options, the Boot Configuration Data Editor (Bcdedit) is used.
The Bcdedit.exe command-line tool can be used to add, delete, and edit entries in the BCD store, which contains objects. Each object is identified by a GUID (Globally Unique Identifier). Every drive or partition on the system will have its own GUID and could be:
• {legacy}: Describes a drive or partition on a pre-Windows Vista operating system,
• {default}: Describes the drive or partition containing the current default operating system, or
• {current}: Describes the current drive or partition to which you are booted.
For example {c34b751a-ff09-11d9-9e6e-0030482375e7} describes another drive or partition on which an operating system has been installed.
Some of the options available for the BCDEdit command are:
• /createstore: Creates a new empty BCD store.
• /export: Exports the contents of the system BCD store to a specified file.
• /import: Restores the state of the system BCD store from a specified file.
• /copy: Makes copies of boot entries.
• /create: Creates new boot entries.
• /delete: Deletes boot entries.
• /deletevalue: Deletes elements from a boot entry.
• /set: Creates or modifies a boot entry’s elements.
• /enum: Lists the boot entries in a store.
Figure 4-3
Windows startup and recovery options