- Note One of the drawbacks of Windows NT 4.0 and earlier versions of the Windows NT
operating system was shared system files, which could be overwritten during
installation of incompatible third-party software. Starting with Windows 2000, this
drawback was eliminated by the addition of appropriate protection for critical
system files. This functionality was discussed in Chapter 6. If you wish to avoid
startup problems, I recommend that you regularly use these tools.
Parallel Installation of the Operating System
What else can be done to provide universal troubleshooting tools for startup problems? A
traditional method of increasing the probability of quick and easy recovery became
popular among users of Windows NT 4.0 and earlier. This method is known as "parallel
installation of the operating system". The parallel installation is another copy of the
Windows NT-based operating system installed on the same computer in a different
installation folder, preferably on a hard disk different from the primary installation. If the
main operating system (the one you use most frequently) fails to boot, an additional copy
of the operating system will allow quick access to NTFS volumes, system files, and
registry hives. Another method of providing access to NTFS volumes after system
failures is to use the NTFSDOS utility, which will be discussed in Chapter 14.
Note Parallel OS installations weaken the system security; like NTFSDOS, parallel
installations provide a backdoor to your main operating system. Thus, from a
reliability and recoverability point of view, both parallel OS installations and
NTFSDOS are beneficial. From a security point of view, they're not ideal methods.
Although the introduction of Recovery Console has significantly reduced the need for
parallel OS installation during a system recovery operation, this additional safeguard
should not be dismissed altogether. Despite the power of Recovery Console, you may
wish to continue using parallel OS installation on the most critical servers running
Windows 2000 or Windows Server 2003. For example, it gives you the ability to quickly
reset permissions on the primary installation's %Systemroot% folder if the permissions
are configured incorrectly. This is desirable because Recovery Console does not provide
an easy way of resetting such permissions. Furthermore, despite all of its impressive new
capabilities and power, Recovery Console remains a limited command-line environment.
For example, it doesn't allow you to run a GUI-based registry editor or backup utility, or
any other application that requires full GUI-based functionality. If the primary
installation becomes inaccessible and you need to access this type of application to
restore it, then parallel OS installation will be an enormous relief.
Note If you need a more advanced, GUI-based version of Recovery Console with built-in
Registry Editor, I'd like to draw your attention to ERD Commander 2002 from
Aelita Software. This utility will be covered in more detail in Chapter 14.
- You should install the parallel OS in advance; the procedure is time-consuming, and you
may be short of time when problems occur. Note that you can only install the minimum
set of options in the parallel OS. To make a parallel installation more useful and the
system effective, consider placing the installation on a disk partition other than that where
the primary OS is installed. This improves the chances that the parallel OS installation
will be accessible if the primary installation's boot partition is damaged severely.
Additional Hardware Profiles
In addition to a parallel installation of the operating system, there's another method of
performing quick recovery. If you experiment with various hardware devices and aren't
sure if the device you're going to install is listed in Hardware Compatibility List (HCL),
you may want to use additional hardware profiles for the system recovery. Proceed as
1. Before installing a new device that may cause a problem, create a new ERD
(Windows 2000) or prepare for Automated System Recovery (ASR) (Windows
XP and Windows Server 2003). Then back up the system registry using one of the
methods described in Chapter 2. The ERD (or ASR backup) and registry backup
copies will be useful.
2. Create a new hardware profile. Launch the System applet in Control Panel, go to
the Hardware tab, and click the Hardware Profiles button. The Hardware
Profiles window will open (Fig. 12.1). Click the Copy button and create a new
hardware profile by copying one of the existing profiles. It's best to name
hardware profiles using "speaking names" that explain their purpose (for example,
Working-the current hardware profile, free of errors; and Experimental-the new
hardware profile, where you'll try solutions to the problem). In the Hardware
profiles selection group, set the Wait until I select a hardware profile radio
- Figure 12.1: Before installing a new device that isn't listed in the HCL, create an
additional hardware profile.
3. Check if the hardware profiles are working. Try to start the operating system using
each of them.
4. Start the computer using the Working profile and try to install the new device and
its drivers using the Hardware Wizard. If the system prompts you to reboot the
computer, don't reboot the system immediately. Start Device Manager, find the
newly installed device in the list, and select the Properties command from the
context menu. You'll see the General tab of the properties window for this device.
If the newly installed device is incompatible, you'll immediately see that
"something is wrong" (despite the phrase "This device is working properly"
displayed in the Device status field, as shown in Fig. 12.2). For example, this
device may be marked as an Unknown device that may cause problems. To avoid
possible problems, disable this device in the current hardware profile by selecting
the Do not use this device in the current hardware profile (disable) option
from the Device usage list. The device will be disabled in the current hardware
profile, but it will remain enabled in the experimental hardware profile.
- Figure 12.2: Although the Device Manager states This device is working
properly, a newly installed device will cause problems. Disable it in the current
5. Now reboot the system and select the experimental hardware profile (where the
problem device is enabled). Do you see the "Blue Screen of Death"? Probably not,
because the device is disabled in the working hardware profile. In most cases,
you'll be able to boot the system using the working hardware profile.
Note I recommend that you always have a working hardware profile that contains no
errors and enables no problem devices. This profile often provides an easier means
of recovering a system with configuration problems than the Advanced startup
How Can I See the "Blue Screen of Death"?
Have you ever seen the "Blue Screen of Death"? If you haven't, most people will consider
you a lucky person. What... you're curious to see what it is? Well, here you are!
Windows 2000, Windows XP, and Windows Server 2003 have one undocumented
function that allows you to generate an artificial STOP error (blue screen) and manually
create a crash dump (Memory.dmp). The STOP screen that appears after using this
feature will contain the following message:
- *** STOP: 0x000000E2 (0x00000000, 0x00000000, 0x00000000, 0x00000000)
The end-user manually generated the crashdump.
By default, this feature is disabled. To enable it, you'll need to edit the registry and reboot
the computer. Open the
registry key, add the REG_DWORD CrashOnCtrlScroll value, and set it to 1.
After rebooting the system, you'll be able to manually "crash" the system. To view the
"Blue Screen of Death," press and hold the right key, and press the
How to Recreate a Missing ASR Floppy Disk
If you tried all of these troubleshooting options and nothing happened, you may decide to
run the Automated System Recovery (ASR) process. What should you do if the ASR
diskette is missing? Does this mean everything is lost? No, it doesn't, not if your ASR
backup for storing media works. Using this, you can recreate the missing ASR floppy
The Asr.sif and Asrpnp.sif files contained on the ASR diskette are ASCII files that can be
viewed or edited with any text editor, such as Notepad.exe. These files also can be
extracted from the ASR backup set and copied to a floppy disk that can be used for an
ASR procedure. You can use Backup Utility supplied with Windows Server 2003,
Windows XP, or even the version supplied with Windows 2000.
To recreate a missing ASR diskette:
1. Format a 1.44 megabyte (MB) floppy disk and insert the disk into the floppy disk
drive of any computer running Windows 2000, Windows XP, or Windows Server
2. In System Tools, start the Backup program. If it starts in wizard mode, switch to
the advanced mode and go to the Restore and Manage Media tab (Windows XP
and Windows Server 2003) or to the Restore tab (Windows 2000). Insert your
backup media with the ASR backup set into the backup device and select the
Catalog a backup file command from the Tools menu. When the next window
appears, specify the path to the backup copy that you require. (Use the Browse
button if necessary.)
3. Select the backup media containing the required ASR backup set. Expand the
Automated System Recovery Backup Set option corresponding to the ASR disk
you need to recreate.
4. Expand the Windows folder/Repair folder and click the following files from this
repair folder: Asr.sif, Asrpnp.sif, and Setup.log (Fig. 12.3). In the Restore files to
- field, select Alternate location. In the Alternate location field, specify the path
to the root of your floppy drive (for example, "A:\").
Figure 12.3: Recreating the missing ASR floppy disk
5. Click Next. The other options in this wizard are not mandatory and do not affect
the transfer of files to the floppy disk. When the wizard is finished, the files are
copied to the specified location. The ASR floppy disk is ready if you need to
perform an ASR restore operation.
Note The Asr.sif and Asrpnp.sif files must reside on the root of the floppy disk drive to
be used during ASR restore operation.