The Process of Troubleshooting Startup CHAPTER 29 1453 process; symptoms include warning messages, startup failures, and Stop messages. The causes are typically improper device configuration, incorrect driver settings, or hardware malfunction and failure. For detailed information about troubleshooting hardware problems, read Chapter 30. How to Use System Restore Windows automatically captures system state before installing new applications or drivers. You can later use the System Restore tool to return to this system if you experience problems. To start System Restore from within Windows (including safe mode), click Start, click All Programs, click Accessories, click System Tools, and then click System Restore. To start System Restore when you cannot open Windows, follow these steps: 1. Start System Recovery tools, as described in the section titled “How to Start the System Recovery Tools” earlier in this chapter. 2. Click System Restore. The System Restore Wizard appears. Follow these steps to restore Windows to an earlier state: 1. On the Restore System Files And Settings page of the System Restore Wizard, click Next. 2. On the Choose A Restore Point page, click a restore point. Typically, you should choose the most recent restore point when the computer functioned correctly. If the computer has not functioned correctly for more than five days, select the Show More Restore Points check box (as shown in Figure 29-7) and then select a restore point. Click Next. FIGURE 29-7 You can solve some startup problems by using System Restore. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues 1454 3. On the Confirm Disks To Restore page, click Next. 4. On the Confirm Your Restore Point page, click Finish. 5. Click Yes to confirm the system restore. System Restore modifies system files and settings to return Windows to the state it was in at the time the restore point was captured. 6. When System Restore is done, click Restart. You should now attempt to start the computer and identify whether the problem was resolved. 7. When the computer restarts, Windows will display a System Restore notification. Click Close. How to Manually Repair the Boot Sector Startup Repair is by far the quickest and easiest way to solve most startup problems. However, if you are familiar with troubleshooting startup problems and simply need to fix a boot sector problem after installing another operating system, you can run the following command from a command prompt (including the Command Prompt tool in the System Recovery tools). bootsect /NT60 ALL Bootsect.exe is available from the \Boot\ folder of the Windows DVD and can be run from within WinRE or Windows 7. After running Bootsect, you should be able to load Windows, but you may not be able to load earlier versions of Windows that are installed on the same computer. To load other operating systems, add entries to the BCD registry file, as described in the section titled “How to Create an Entry for Another Operating System” earlier in this chapter. How to Manually Update the BCD Registry File The simplest way to solve problems related to the BCD registry file is to run Startup Repair, as described earlier in this chapter. However, you can also use the System Recovery tools to update the BCD registry file manually by following these steps: 1. Load the System Recovery tools, as described in the previous section. 2. Click Command Prompt. 3. Use BCDEdit to update the BCD registry file. For detailed information, read the section titled “How to Use BCDEdit” earlier in this chapter. How to Manually Replace Files If startup files are missing or become corrupted, Windows may not be able to boot success- fully. Often, Windows will display an error message that shows the name of the missing file, as shown in Figure 29-8. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. The Process of Troubleshooting Startup CHAPTER 29 1455 FIGURE 29-8 Windows can display the names of missing startup files, which you can then manually replace. Startup Repair can automatically replace missing system files, but it may not detect corrupted files. However, you can manually replace files using the System Recovery command-line tool. To replace files, follow these steps: 1. From another computer, copy the new files to removable media such as a CD-ROM or a USB flash drive. You cannot access Windows system files from the Windows DVD because they are stored within a Windows Imaging (WIM) file that is not accessible from within System Recovery. 2. Start System Recovery tools, as described in the section titled “How to Start the System Recovery Tools” earlier in this chapter. 3. After the System Recovery tools start, click Command Prompt. 4. Your removable media will have a drive letter, just like a hard disk. System Recovery tools assign hard disk letters starting with C and then assign letters to removable media. To identify the drive letter of your removable media, run the following commands. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues 1456 C:\>diskpart DISKPART> list volume Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- Volume 0 C Win7 NTFS Partition 63 GB Healthy Volume 1 E Windows XP NTFS Partition 91 GB Healthy Volume 2 D NTFS Partition 69 GB Healthy Volume 3 I Removable 0 B No Media Volume 4 H Removable 0 B No Media Volume 5 F LR1CFRE_EN_ UDF Partition 2584 MB Healthy Volume 6 G USBDRIVE FAT32 Partition 991 MB Healthy 5. Use the Copy command to transfer files from your removable media to the computer’s hard disk. How to Reinstall Windows Infrequently, startup files and critical areas on the hard disk can become corrupted. If you are mainly concerned with salvaging readable data files and using the Backup And Restore Center to copy them to backup media or a network location, you can perform a parallel installation of Windows. Although this may provide access to the file system, it will permanently damage your existing operating system and applications. If you cannot start Windows after following the troubleshooting steps in this guide, you can reinstall Windows for the purpose of data recovery by following these steps: 1. Insert the Windows DVD in your computer. 2. Restart your computer. When prompted to boot from the CD/DVD, press any key. 3. Windows Setup loads. When prompted, select your regional preferences and then click Next. 4. Click Install Now. 5. When prompted, enter your product key. 6. Select the I Accept The License Terms check box and then click Next. 7. Click Custom. 8. On the Where Do You Want to Install Windows? page, select the partition containing your Windows installation and then click Next. 9. When prompted, click OK. Setup will install a new instance of Windows and will move all files from your previous installation into the \Windows.Old folder (including the \Program Files, \Windows, and \Users folders). You now have two choices for returning the computer to its original state: n Reformat the system partition If you have an automated deployment solution in place (as described in Part II of this book, “Deployment”), the quickest solution is to Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. The Process of Troubleshooting Startup CHAPTER 29 1457 back up important files and redeploy Windows. If you need to manually reinstall Windows, you can follow this process: 1. Back up all important files by writing them to removable media, copying them to an external hard disk, or copying them to a shared folder on the network. 2. Reinstall Windows. This time, choose to reformat the system partition. 3. Reinstall all applications and reconfigure all custom settings. 4. Restore important files. n Continue working with the current system partition You can move important files to the proper locations within the new instance of Windows. Then, reinstall all applications and reconfigure any custom settings. Finally, you can delete the original Windows instance by removing the \Windows.Old folder using Disk Cleanup. Startup Troubleshooting After the Starting Windows Logo Appears If your computer displays the graphical Starting Windows logo before failing, as shown in Figure 29-9, the Windows kernel was successfully loaded. Most likely, the startup failure is caused by a faulty driver or service. FIGURE 29-9 Displaying the Starting Windows logo indicates that Windows 7 has successfully loaded the kernel. Use the process illustrated in Figure 29-10 to identify and disable the failing software feature to allow Windows to start successfully. After Windows starts, you can perform further troubleshooting to resolve the problem with the feature if necessary. If the startup problem occurs immediately after updating or installing a startup application, try troubleshooting the startup application. For information about troubleshooting startup applications, see the section titled “How to Temporarily Disable Startup Applications and Processes” later in this chapter. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues 1458 Run Startup Repair Use the last known good configuration Use System Restore Enable boot logging and attempt to start Windows 7 Analyze event viewer and boot log to isolate problem Does computer start in Safe Mode? Use Device Manager to upgrade, roll back, or remove failing driver Use System Configuration Utility to disable failing services or applications Did you identify a failing driver? No No Ye s Startup fails after the progress appears Use System Recovery Tools to analyze the boot log. Manually replace drivers or remove problematic hardware Ye s FIGURE 29-10 Follow this process to troubleshoot startup problems after the Starting Windows logo appears but before logon. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. The Process of Troubleshooting Startup CHAPTER 29 1459 The sections that follow describe each of these steps in more detail. How to Run Startup Repair Startup Repair can automatically fix many common startup problems, even if the problem occurs after the Starting Windows logo is displayed. Because Startup Repair is easy to use and has a very low likelihood of causing additional problems, it should be your first troubleshoot- ing step. For detailed instructions, refer to the section titled “How to Run Startup Repair” earlier in this chapter. After running Startup Repair, attempt to start your computer normally and continue with the troubleshooting process only if Windows fails to start. How to Restore the Last Known Good Configuration Last Known Good Configuration is usually used to enable the operating system to start if it fails after the Starting Windows logo is displayed. Using Last Known Good Configuration helps to correct instability or startup problems by reversing the most recent system, driver, and registry changes within a hardware profile. When you use this feature, you lose all configuration changes that were made since you last successfully started your computer. Using the Last Known Good Configuration restores previous drivers and also restores registry settings for the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet. Windows Vista does not update the LastKnownGood control set until you successfully start the operat- ing system in normal mode and log on. When you are troubleshooting, it is recommended that you use Last Known Good Configuration before you try other startup options, such as safe mode. However, if you decide to use safe mode first, logging on to the computer in safe mode does not update the LastKnownGood control set. Therefore, Last Known Good Configuration remains an option if you cannot resolve your problem by using safe mode. To access the Last Known Good Configuration startup option, follow these steps: 1. Remove all floppy disks, CDs, DVDs, and other bootable media from your computer and then restart your computer. 2. Press F8 at the operating system menu. If the operating system menu does not appear, press F8 repeatedly after the firmware POST process completes but before the Starting Windows logo appears. The Advanced Boot Options menu appears. 3. On the Advanced Boot Options menu, select Last Known Good Configuration (Advanced), as shown in Figure 29-11. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues 1460 FIGURE 29-11 Use Last Known Good Configuration to restore some settings to their state during the last time a user successfully logged on. When Windows starts, it reads status information from the file %WinDir%\Bootstat.dat. If Windows detects that the last startup attempt was unsuccessful, it automatically displays the startup recovery menu, which provides startup options similar to the Advanced Boot Options menu, without requiring you to press F8. note If you suspect that changes made since you last successfully restarted the computer are causing problems, do not start Windows and log on normally—logging on overwrites the LastKnownGood control set. Instead, restart the computer and use the Last Known Good Configuration. You can also log on in safe mode without overwriting the Last Known Good Configuration. For more information about control sets, see the section titled “Kernel Loading Phase” earlier in this chapter. How to Use System Restore If Last Known Good Configuration fails to resolve the problem, you can manually perform a system restore if Startup Repair did not initiate it. However, Startup Repair would typically have taken this step already if it might have solved the problem. For information on how to use System Restore, see the section titled “How to Use System Restore” earlier in this chapter. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. The Process of Troubleshooting Startup CHAPTER 29 1461 How to Enable Boot Logging Boot logging is useful for isolating the cause of a startup problem that occurs after the oper- ating system menu appears. You can enable boot logging by following these steps: 1. Remove all floppy disks, CDs, DVDs, and other bootable media from your computer and then restart your computer. 2. Press F8 at the operating system menu. If the operating system menu does not appear, press F8 repeatedly after the firmware POST process completes but before the Starting Windows logo appears. The Advanced Boot Options menu appears. 3. On the Advanced Boot Options menu, select Enable Boot Logging, as shown in Figure 29-12. FIGURE 29-12 Enabling boot logging can help you identify the cause of startup problems. Windows starts and creates a log file at %WinDir%\Ntbtlog.txt. The log file starts with the time and version information and then lists every file that is successfully loaded, as shown here. Microsoft (R) Windows (R) Version 6.1 (Build 7100) 5 27 2009 17:57:37.500 Loaded driver \SystemRoot\system32\ntoskrnl.exe Loaded driver \SystemRoot\system32\hal.dll Loaded driver \SystemRoot\system32\kdcom.dll Loaded driver \SystemRoot\system32\mcupdate_GenuineIntel.dll Loaded driver \SystemRoot\system32\PSHED.dll Loaded driver \SystemRoot\system32\BOOTVID.dll Loaded driver \SystemRoot\system32\CLFS.SYS Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 29 Configuring Startup and Troubleshooting Startup Issues 1462 Loaded driver \SystemRoot\system32\CI.dll Loaded driver \SystemRoot\system32\drivers\wdf0100.sys Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS Did not load driver \SystemRoot\system32\drivers\serial.sys Loaded driver \SystemRoot\system32\drivers\acpi.sys The following sections will provide additional information about viewing and analyzing the boot log file. How to Start in Safe Mode Safe mode is a diagnostic environment that runs only a subset of the drivers and services that are configured to start in normal mode. Safe mode is useful when you install software or a device driver that causes instability or problems with starting in normal mode. Often, Windows can start in safe mode even if hardware failure prevents it from starting in normal mode. In most cases, safe mode allows you to start Windows and then troubleshoot problems that prevent startup. Logging on to the computer in safe mode does not update the LastKnownGood control set. Therefore, if you log on to your computer in safe mode and then decide you want to try Last Known Good Configuration, this option is still available to you. In safe mode, Windows uses the minimum set required to start the GUI. The following registry subkeys list the drivers and services that start in safe mode: n Safe mode: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot \Minimal n Safe mode with networking: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Control\SafeBoot\Network To access safe mode, follow these steps: 1. Remove all floppy disks and CDs from your computer and then restart your computer. 2. Press F8 at the operating system menu. If the operating system menu does not appear, press F8 repeatedly after the firmware POST process completes but before the Starting Windows logo appears. The Advanced Boot Options menu appears. 3. On the Advanced Boot Options menu, select Safe Mode, Safe Mode With Networking, or Safe Mode With Command Prompt. Select Safe Mode if you do not require net- working support. Select Safe Mode With Networking if you require access to the net- work for your troubleshooting—for example, if you must download an updated driver. Select Safe Mode With Command Prompt if you want to work at a command prompt. When Windows starts, it reads status information from the file %SystemRoot%\Bootstat.dat. If Windows detects that the last startup attempt was unsuccessful, it automatically displays the startup recovery menu, which provides startup options similar to the Advanced Boot Options menu, without requiring you to press F8. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. [...]... “dirty,” and Windows will run ChkDsk on the next startup Improved Driver Reliability Drivers should be more reliable in Windows Vista and Windows 7 than they are in previous versions of Windows Improved I/O cancellation support is built into Windows Vista and Windows 7 to enable drivers that might become blocked when attempting to perform I/O to gracefully recover Windows Vista and Windows 7 also have... watermark 1 473 Windows 7 Improvements for Hardware and Driver Troubleshooting Windows 7 includes Reliability Monitor and Resource Monitor to simplify how you isolate the source of hardware problems, allowing you to reduce client computer downtime Additionally, Windows 7 includes several troubleshooting features first introduced with Windows Vista The following sections describe these improvements Windows. .. titled “Logon Phase” earlier in this chapter Summary Windows 7 automatically installs WinRE and improves startup, shutdown, and sleep recovery times Although the startup improvements over Windows Vista are minimal, Windows Vista introduced many improvements over Windows XP that Windows 7 continues to support These features include: n Windows Boot Manager n Windows Boot Loader n The BCD registry file and... the improved user interface, Windows 7 extends Reliability Monitor by exposing reliability data via the Windows Management Instrumentation (WMI) Using WMI, you can Windows 7 Improvements for Hardware and Driver Troubleshooting  Chapter 30 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 1 477 gather reliability data remotely and process it using Windows PowerShell scripts and... that doesn't work in this version of Windows Search And Indexing Troubleshoot problems finding items with Windows Search Windows Update Troubleshoot problems preventing Windows Update from working correctly Windows Troubleshooting Platform Components The Windows Troubleshooting Platform consists of three main components: n Windows troubleshooting packs  A collection of Windows PowerShell 2.0 scripts that... compatibility, networking, and sound Table 30-1 describes the troubleshooting packs that are built into Windows 7 or are currently available using the Windows Online Troubleshooting Service (WOTS) WOTS is a free online service that Windows 7 can use to download new or updated troubleshooting packs Table 30-1  Windows 7 Troubleshooting Packs Troubleshooting Pack Aero Troubleshoot problems that prevent your computer... information about resource utilization on a process-byprocess basis, Windows 7 includes an improved version of Resource Monitor As shown in Figure 30-2, Resource Monitor displays this data in a format that provides rapid access to a great deal of information that you can use to easily explore process-specific details Figure 30-2  Resource Monitor shows detailed, real-time performance data 1 478 Chapter 30 ... improvements Windows Troubleshooting Platform The Windows Troubleshooting Platform, new to Windows 7, is an extensible infrastructure for automated diagnosis of software and hardware problems If you used Windows Network Diagnostics in Windows Vista, you’re familiar with how Windows Troubleshooting Platform works To the user performing the troubleshooting, the Windows Troubleshooting Platform is a wizard... shared and conflicting resources (which do not always indicate a critical problem), expand Hardware Resources and then click Conflicts/Sharing Examine the Resource and Device columns for devices that are incorrectly assigned overlapping resources Remove or disable one of the devices or use Device Manager to change the resources assigned to the devices Error Reporting Service The Windows error reporting... settings to improve browser safety in Internet Explorer Windows Media Player Library Troubleshoot problems that prevent music and movies from being shown in the Windows Media Player Library Windows Media Player Settings Reset Windows Media Player back to default settings Windows Media Player DVD Troubleshoot problems that prevent playing a DVD in Windows Media Player Connection to a Workplace Using DirectAccess . successfully loaded, as shown here. Microsoft (R) Windows (R) Version 6.1 (Build 71 00) 5 27 2009 17: 57: 37. 500 Loaded driver SystemRootsystem32 toskrnl.exe. minimal, Windows Vista introduced many improvements over Windows XP that Windows 7 continues to support. These features include: n Windows Boot Manager n Windows