chapter 10 troubleshooting windows - crammaster …7… · 268 chapter 10: troubleshooting windows...

CHAPTER 10

TroubleshootingWindows

This chapter covers the following A+ exam topics:

. Repair Environments and Boot Errors

. Windows Tools and Errors

. Command-Line Tools

You can find a master list of A+ exam topics in the “Introduction.”

This chapter covers CompTIA A+ 220-701 objectives 2.1, 2.2, and 3.4and CompTIA A+ 220-702 objectives 2.1, 2.3, and 2.4.

Now for the toughest part of working with Windows: troubleshoot-ing. As I mentioned in Chapter 1, “Introduction to Troubleshooting,”troubleshooting is the most important skill for a computer technicianto possess. There are many different things that can go wrong in acomputer; the majority of them are software-related. This chapterendeavors to give you the tools, utilities, and skills necessary to trou-bleshoot the various boot errors, stop errors, and other Windowserrors that you might encounter.

Repair Environments andBoot ErrorsWindows startup errors prevent you from accessing the operatingsystem. Because of this, Windows Vista and XP have various startuptools, menus, and repair environments that you can use to trou-bleshoot these startup and boot errors.

Windows Repair ToolsThere are many tools included with Windows Vista and XP that aredesigned to help you troubleshoot and repair just about any issue that

might come up. Before we get into the exact issues you might face, let’s dis-cuss some of these repair tools, what they do, and where you can access them.Let’s start with the Advanced Boot Options menu.

Advanced Boot Options MenuIf Windows Vista/XP/2000 won’t start and you don’t see an error message, theculprit might be a video driver, new configuration, or other system issues.There are several startup options that can aid in fixing the problem. To accessthese startup options, press the F8 key immediately after the computer startsup; this brings up the Windows Advanced Boot Options menu, as shown inFigure 10.1.

266

CHAPTER 10: Troubleshooting Windows

FIGURE 10.1 Windows Vista Advanced Boot Options menu

The following options are included in the Advanced Boot Options menu:

. Safe Mode: Starts system with a minimal set of drivers; used in case oneof the drivers fails. Safe Mode is a good option when attempting to useSystem Restore.

. Safe Mode with Networking: Starts system with a minimal set of driv-ers and enables network support.

. Safe Mode with Command Prompt: Starts system with a minimal setof drivers but loads command prompt instead of Windows GUI.

ExamAlert

. Enable Boot Logging: Creates a ntbtlog.txt file.

. Enable low-resolution video (640x480): Uses a standard VGA driverin place of a GPU-specific display driver, but uses all other drivers asnormal. (This is called Enable VGA Mode in Windows XP/2000.)

. Last Known Good Configuration: Starts the system with the last con-figuration known to work; useful for solving problems caused by newlyinstalled hardware or software.

. Directory Services Restore Mode: This is used to restore a domaincontroller’s active directory (Windows Server). Even though it is listed,it is not used in Windows Vista/XP/2000.

. Debugging Mode: Enables the use of a debug program to examine thesystem kernel for troubleshooting.

. Disable automatic system on system failure (Vista only): PreventsWindows from automatically restarting, if an error causes Windows tofail. Choose this option only, if Windows is stuck in a loop in whichWindows fails, attempts to restart, and fails again repeatedly.

. Disable driver signature enforcement (Vista only): Enables driverscontaining improper signatures to be installed.

. Start Windows Normally: This can be used to boot to regularWindows. This option is listed in case a person inadvertently pressedF8, but did not want to use any of the Advanced Boot Options.

Know the Advanced Boot Options for the exam.

If Windows Vista fails to start properly, and then restarts automatically, it nor-mally displays the Windows Error Recovery screen and gives you the follow-ing options: Safe Mode, Safe Mode with Networking, Safe Mode withCommand Prompt, Last Known Good Configuration, and Start WindowsNormally. This means that Windows has acknowledged some sort of error orimproper shut down and offers a truncated version of the Advanced OptionsBoot menu.

Repair Environments and Boot Errors267

268


There is a small window of time available to press F8; it’s right between the BIOSand when the normal operating system boots. Press F8 repeatedly right after theBIOS POST begins.

It is recommended that you attempt to repair a computer with the Advanced BootOptions before using Windows Vista’s System Recovery Options or WindowsXP/2000’s Recovery Console.

Windows Recovery Environment (WinRE)WinRE is a set of tools included in Windows Vista, Windows Server 2008,and other upcoming Windows operating systems. It takes the place of theRecovery Console used in Windows XP/2000. Also known as SystemRecovery Options, WinRE’s purpose is to recover Windows from errors thatprevent it from booting; it can also be instrumental in fixing issues causing acomputer to “freeze” up. There are two possible ways to access WinRE:

. Booting to the Windows Vista DVD: This option is more commonwith an individual computer that had Windows Vista installed; for exam-ple, if you performed a clean installation with the standard WindowsVista DVD and made no modifications to it. To start WinRE, make surethat the DVD drive is first in the boot order of the BIOS, boot to theWindows Vista DVD (as if you were starting the installation), chooseyour language settings and click next, and then select Repair YourComputer, which you can find at the lower-left corner of the screen.

Important! Do not select Install Now because that would begin the process of rein-stalling Windows Vista on your hard drive.

. Booting to a special partition on the hard drive that has WinREinstalled: This option is used by OEMs (original equipment manufac-turers) so that users can access WinRE without having to search for andboot off of a Windows Vista DVD. These OEMs (computer buildersand system integrators) will preinstall WinRE into a special partition on

Note

Note

Note

the hard drive, separate from the operating system, so that the user canboot into it at any time. Compare this to the older Recovery Consolethat was installed into the same partition as the operating system. Toaccess WinRE that has been preinstalled, press F8 to bring up theAdvanced Boot Options menu, highlight Repair Your Computer, andpress Enter. If you don’t see Repair Your Computer in the AdvancedBoot Options menu, then it wasn’t installed to the hard drive, and youhave to use option 1, booting from the Vista DVD. Note that you canstill use option 1, even if WinRE was installed to the hard drive; forexample, in a scenario where the hard drive installation of WinRE hasfailed.

The process to install WinRE to the hard drive is a rather complicated one and isnot covered on the A+ exam. However, if you are interested, here is a link that givesthe basics of installing WinRE: http://blogs.msdn.com/winre/archive/2007/01/12/how-to-install-winre-on-the-hard-disk.aspx.

Regardless of which option you selected, at this point a window namedSystem Recovery Options should appear, prompting you to select an operat-ing system to repair. Most users will only have one listed. Highlight theappropriate operating system in need of repair and click Next. This displaysthe options at your disposal, as shown in Figure 10.2. Table 10.1 describesthese options in more depth.


Note

FIGURE 10.2 Windows Vista System Recovery Options window

http://blogs.msdn.com/winre/archive/2007/01/12/how-to-install-winre-on-the-hard-disk.aspx

http://blogs.msdn.com/winre/archive/2007/01/12/how-to-install-winre-on-the-hard-disk.aspx

TABLE 10.1 Description of the Windows Vista System Recovery Options

System Recovery Option Description

Startup Repair When clicked, this automatically fixes certainproblems, such as missing or damaged systemfiles that might prevent Windows from startingcorrectly. When you run Startup Repair, it scansyour computer for the problem and then tries tofix it so your computer can start correctly.

System Restore Restores the computer’s system files to an earli-er point in time. It’s a way to undo systemchanges to your computer without affecting yourpersonal files, such as email, documents, orphotos. Note: If you use System Restore whenthe computer is in safe mode, you cannot undothe restore operation. However, you can runSystem Restore again and choose a differentrestore point, if one exists.

Windows Complete PC Restore This restores the contents of a hard disk from abackup. Windows Complete PC Backup andRestore is only included with Vista Business andVista Ultimate.

Windows Memory Diagnostic Tool Scans the computer’s memory for errors.

Command Prompt Advanced users can use the Command Prompt (Replaces the Recovery to perform recovery-related operations and also Console in XP/2000) run other command-line tools for diagnosing and

troubleshooting problems. Puts the user into adirectory called X:\Sources. Works very muchlike the previous Recovery Console in WindowsXP/2000, with the addition of a few new com-mands.

Recovery ConsoleThe Windows XP/2000 Recovery Console is the command-line interface usedfor repairs. It is included on the Windows XP and 2000 CD-ROMs. TheRecovery Console can be invaluable when the system cannot start from thehard drive due to missing or corrupted files. These missing files could verywell block the Advanced Boot Options menu.

To start Windows XP’s Recovery Console, you have two options:

Option 1: Boot the computer to the Windows XP CD-ROM and run theRecovery Console.

Option 2: Boot from a previously installed Recovery Console. This appearsas part of the operating system boot menu but not if startup fileshave been affected.

270


ExamAlert

To run the Recovery Console from CD-ROM:

1. Boot the system from the Windows XP CD.

2. When prompted, press R to start the Recovery Console. (In Windows2000, you would press R for Repair and then C for the RecoveryConsole.)

3. Log into Recovery Console by selecting the installation to log into andproviding the Administrator password for the operating system.

To install the Recovery Console to hard disk:

1. While in Windows, insert the Windows CD-ROM into the drive.(Close any pop-up install windows.)

2. Open the Run prompt and type x:\i386\winnt32.exe /cmdcons.(For this scenario, x is the drive letter for the CD-ROM drive, this isusually D:, but will vary from system to system.)

3. Confirm the installation by clicking Yes and restart the computer. Now,Microsoft Windows Recovery Console should appear on the boot menu.Select it to start Recovery Console.

Memorize the different WinRE options in Vista, and know how to use the RecoveryConsole in XP.

Boot ErrorsThere are various reasons why a computer will fail to boot. If it is operatingsystem-related, you will usually get some type of message that can help you totroubleshoot the problem. Windows Vista and Windows XP have differentboot files, so it stands to reason that they have different boot error messages.

Windows Vista Boot ErrorsWindows Vista uses the bootmgr and BCD files during the startup process. Ifthese files are corrupted or missing, you see corresponding error messages:

. BOOTMGR is missing: This message is displayed if the bootmgr fileis missing or corrupt. This black screen will probably also say PressCtrl+Alt+Del to Restart; however doing so will probably have the sameresults.


There are two methods to repair this error. The first is to boot to theSystem Recovery Options and select the Startup Repair option. Thisshould automatically repair the system and require you to reboot. If thisdoesn’t work, try the second method, which is to boot to the SystemRecovery Options and select the Command Prompt option. Type thecommand bootrec /fixboot, as shown in Figure 10.3.

272


FIGURE 10.3 Repairing BOOTMGR.exe with Windows Vista’s WinRE Command Prompt

A hard drive’s lifespan is not infinite. In some cases, it is not possible to repair thisfile, and unfortunately the hard drive will need to be replaced.

. The Windows Boot Configuration Data file is missing requiredinformation: This message means that either the Windows BootManager (Bootmgr) entry is not present in the Boot Configuration Data(BCD) store; or the Boot\BCD file on the active partition is damaged ormissing. Additional information you might see on the screen includesFile: \Boot\BCD, and Status: 0xc0000034. Unfortunately, this meansthat the BCD store needs to be repaired or rebuilt. Hold on to yourhats; there are three methods of repair for this error:

The first method of repair is to boot to the System Recovery Optionsand select the Startup Repair option. This should automatically repairthe system and require you to reboot. If not, move on to method 2.

The second method of repair is to boot to the System Recovery Options and select the Command Prompt option. Type bootrec/rebuildbcd. At this point the bootrec.exe tool either succeeds orfails. If the Bootrec.exe tool runs successfully, it displays an installation

Note

path to a Windows directory. To add this entry to the BCD store, typeYes. A confirmation message appears that indicates the entry was addedsuccessfully.

If the Bootrec.exe tool can’t locate any missing Windows installations,you’ll have to remove the BCD store and then re-create it. To do this,type the following commands: Bcdedit /export C:\BCD_Backup

ren c:\boot\bcd bcd.old

Bootrec /rebuildbcd

Methods one and two will usually work, but if not, there is a thirdmethod which is more in depth and requires rebuilding the BCD storemanually. For more information this step-by-step process can be foundat the following link: http://support.microsoft.com/kb/927391.

Windows XP/2000 Boot ErrorsWindows XP and 2000 use the NTLDR (boot loader), Boot.ini, NTDETECT.COM, and Ntoskrnl.exe files during startup. If any of thesefiles are corrupted or missing, you see one of the following error messages:

. NTDETECT failed: This is displayed if the NTDETECT.COM fileis missing or corrupt.

. NTLDR is missing: This is displayed if the NTLDR file is missing orcorrupt.

. Invalid boot.ini: This is displayed if the boot.ini file is missing or cor-rupt. In some cases, the operating system will boot anyway because thereis usually only one disk partition on the hard disk. If not, the file willneed to be recopied to the hard disk.

To repair these issues, you can

. Reboot to the Windows CD and access the Recovery Console(XP/2000); then recopy the file from the Windows CD-ROM or frombackup media.

. Reboot to the Windows CD, select Repair, and run the EmergencyRepair option (Windows 2000).

. Repair the installation or restore of Windows. (More on restoringWindows later in this chapter).


http://support.microsoft.com/kb/927391

CramQuiz Repair Environments and Boot Errors

Know how to recover from Windows Vista and XP boot errors.

Cram QuizAnswer these questions. The answers follow the last question. If you cannot answerthese questions correctly, consider reading this section again until you can.

1. Which option starts the system with a minimal set of drivers?

❍ A. Last Known Good Configuration

❍ B. System Restore

❍ C. Safe Mode

❍ D. Debugging Mode

2. Which tool should be used if a person wanted to do Startup Repair in WindowsVista?

❍ A. Recovery Console

❍ B. WinRE

❍ C. System Restore

❍ D. Safe Mode

3. What switch should be used to install the Recovery Console to a hard drive?

❍ A. /recovery

❍ B. /winnt32

❍ C. /console

❍ D. /cmdcons

4. What command repairs the bootmgr.exe file in Windows Vista?

❍ A. bootrec /fixboot

❍ B. bootrec /fixmbr

❍ C. bootrec /rebuildbcd

❍ D. boot\bcd

5. Which tool should be used to fix the NTLDR if it is missing or corrupt?

❍ A. Safe Mode

❍ B. bootrec /fixmbr

❍ C. Recovery Console

❍ D. WinRE

ExamAlert

scanner

Rectangle

scanner

Rectangle

Windows Tools and ErrorsWindows could fail while you are working within the operating system. Quiteoften, error messages will accompany these failures. There are variousWindows repair tools you can use to troubleshoot these issues. The worstpossible scenario is when Windows fails and cannot be repaired. In thesecases, a restoration is necessary. There are several types of restoration tech-niques available to you in Windows as well. But before restoring the system,since it can be very time-consuming and possibly unnecessary, you shouldattempt to troubleshoot with Windows repair tools first.

Troubleshooting Within WindowsIf there are not any boot errors, then Windows should start and operate prop-erly. However, errors (recoverable ones) can occur while Windows is running.Devices can fail, applications can terminate for various reasons, and hardwarecould suffer performance issues.

Device ManagerThe Device Manager can detect if a device is malfunctioning, if it has thewrong driver installed, if it has a conflicting resource (like an IRQ or I/O set-ting), or if it has been disabled. Figure 10.4 shows a malfunctioning PCMCIAadapter. You know it’s malfunctioning because of the exclamation mark (!)within a yellow circle. The figure also shows a disabled IEEE 1394 adapter,the proof is indicated by the red X. These devices won’t work properly untilthey are fixed.

Of course, we can’t just leave these devices this way! A clean Device Manageris a good sign of a healthy computer. When a user opens this program, theyshould see nothing but collapsed categories; none of them should be open.Conflicting resources like IRQs and I/O settings are really a thing of the pastand are controlled automatically. But it is certainly possible for a device driverissue. Perhaps the driver failed, or the wrong one was installed initially, or adevice was updated with the wrong type of driver. Either way, we would needto repair it by opening the Device Manager, right-clicking on the device withthe exclamation point, and selecting Properties. Take a look at Figure 10.5.Notice the title at the top of the screen: It says Texas Instruments PCIxx12Cardbus Controller. Then underneath where it says Manufacturer, you see thename Vadem. Well, that’s a different manufacturer altogether, so somethingwent wrong along the way. (Really, I broke it for demonstration purposes!)

276


FIGURE 10.4 Device Manager window in Windows XP showing a disabled device anda malfunctioning device

Windows Tools and Errors277

FIGURE 10.5 PCMCIA Device Properties window

To repair this, install the correct Texas Instruments driver. This might be onthe hard drive already, or maybe the user has a disc that came with the com-puter containing this driver. Perhaps it needs to be downloaded from the

Internet. Internet installs are usually quite easy; download the .exe (or .zip)file and double-click it to install. But if the driver is already on the computer,it might be a bit more detailed. For example, you might need to find a specific.inf file, or you might need to search for the driver within Windows’ driverdatabase (a manual install), which is what we will do in the following steps:

1. In the Properties window of the device, click the Driver tab.

2. Click Update Driver. The wizard appears.

3. Click the Install from a List or Specific Location radio button and clicknext.

4. The next screen tries to find the driver automatically; you can try this,but chances are it will just reinstall the same driver that was alreadythere. Instead, click the Don’t Search. I Will Choose the Driver toInstall radio button and click Next.

5. On the next screen, you see compatible hardware. If the list of compati-ble hardware does not match with the name of your device, deselect theShow Compatible Hardware check box. Then, you get a list of manufac-turers and models. If the manufacturer/model that you want is not onthe list, you need to click Have Disk and search for the driver that couldbe elsewhere on the system, on removable media, or is something thatyou downloaded, or will download from the Internet. Figure 10.6 showsthe correct driver being selected. This driver is served up by Windows,so it is a Microsoft driver. However, for other devices, you might wantto use the manufacturer’s driver, which would have to be downloadedfrom their website. Click next and then finish to complete the installa-tion. Sometimes a restart of the computer is necessary.

As mentioned, a red X on a device means that it has been disabled. To enableit, simply right-click it and select Enable. You can also enable it on theGeneral tab of its Properties sheet. It is possible to create a hardware profilethat disables certain devices. To find out if a hardware profile is used, restartthe computer and watch for a hardware profile menu when the computer firstboots.

Codes can be helpful when troubleshooting issues with devices. If a device ismalfunctioning or is configured incorrectly, it should show a code numberwithin its Properties sheet on the General tab. Table 10.2 gives a few exam-ples of these codes.

278



FIGURE 10.6 Driver selection by manufacturer and model

TABLE 10.2 Description of Codes in the Device Manager

Device Manager RecommendedCode Number Problem Solutions

Code 1 This device is not configured correctly. Update the driver.

Code 3 The driver for this device might be Close some open corrupted, or your system might be applications.running low on memory or other Uninstall and reinstall resources. the driver.

Install additional RAM.

Code 10 Device cannot start. Update the driver.View MSKB article943104 for more informa-tion.

Code 12 This device cannot find enough free You can use the resources that it can use. If you want to Troubleshooting Wizard use this device, you need to disable one in Device Manager to of the other devices on this system. determine where the con-

flict is, and then disablethe conflicting device.Disable the device.

These are just a few examples of the codes you might see in the Device Manager.For a complete list, see the following link: http://support.microsoft.com/kb/310123.

Note


Event ViewerApplications are a boon and a bane to mankind. They serve a purpose, butsometimes they are prone to failure. The operating system itself can cause yougrief as well by underperforming, locking up, or causing other intermittentissues. One good tool for analyzing applications and the system is the EventViewer.

The Event Viewer tells a technician a lot about the status of the operating sys-tem and programs. It informs as to informational events, warns about possibleissues, and displays errors as they occur. It can be accessed from Start > AllPrograms > Administrative Tools, or through within the System Tools node inthe Computer Management console window. Information, warnings, anderrors are stored in log files. In Vista they are inside a folder called WindowsLogs; in XP they are directly within the Event Viewer. There are three logfiles located inside the Event Viewer that you should know for the exam:

. System: The System log contains information, warnings, and errorsabout hardware, device drivers, system files, and so on. This log dealsprimarily with the operating system.

. Application: The Application log contains events about programs thatare built into Windows, such as the Command Prompt or WindowsExplorer, and might contain information about applications that havebeen loaded after the operating system was installed.

. Security: The Security log holds information that was gathered forauditing and security purposes; for example, it might log who logged onto the computer, or who tried to gain access to a particular file.

An event can be viewed by double-clicking on it, as shown in Figure 10.7.

In Figure 10.7, you can see an Event with a simple description: The WindowsSecurity Center Service Has Started. It’s self-explanatory and is a typicalexample of an informational event. The fact that this service started is stan-dard procedure. However, if you are getting any warnings (indicated by anexclamation point), they should be investigated when time is available. And iferrors are received (indicated by an X), they should be investigated right away;an example of an error is shown in Figure 10.8.

280


FIGURE 10.7 Event Properties windows


FIGURE 10.8 Event Properties Windows showing an error

The error in Figure 10.8 is showing that the operating system was expecting atransaction from the stisvc service but never received it due to a timeout. Thisservice is installed by Windows to help interact with digital cameras and

ExamAlert

graphical input devices. If something like this happens only once, it isn’t usu-ally a big deal, but if you see it regularly, you would want to investigate fur-ther. Perhaps a device that uses the service is not working properly or needs anew driver, or maybe the service that the stisvc service is dependent on needsto be restarted. You can find more information by either typing in the codenumber for the event or the description into Microsoft Help and Support:http://support.microsoft.com. Sometimes you can find out information aboutthese types of services just by running a search, but it is best to go to thesource that is Microsoft. You never know when an error can occur, so theEvent Viewer logs should be reviewed regularly. Entire logs can be erased byright-clicking on the log file (for example System) and selecting Clear allevents. The system asks if you want to save the log for future viewing. Byright-clicking a log and selecting Properties, you can modify the size of thelog, and in Vista, can disable logging altogether.

Be able to describe the System, Application, and Security log files for the exam.

Problem Reports and Solutions, and Dr. WatsonProblem Reports and Solutions is a new program in Windows Vista that canbe accessed directly within the Classic view of the Control Panel. ProblemReports and Solutions enables you to check for solutions to hardware andsoftware problems. Windows can be set to report problems and check forsolutions automatically, or solutions can be checked for manually when aproblem occurs. To modify how problems will be reported, click the Changesettings link. Problem descriptions and solutions are saved, for later viewing.This program took the place of Dr. Watson in Windows XP/2000 that wasused as a system and application failure analysis tool. Dr. Watson can beaccessed in XP/2000 by opening the Run prompt and typing drwtsn32.Application failures that are listed in Dr. Watson are rare and are often listedin the Application log of the Event Viewer as well.

PerformanceAnother tool that you can use to analyze and troubleshoot applications iscalled Performance in Windows XP and is known specifically as theReliability and Performance Monitor in Windows Vista. This program trackshow much your devices are utilized; for example, what percentage of theprocessor is used, or how much RAM.

282


http://support.microsoft.com

This tool can be accessed within Administrative Tools. When you open theReliability and Performance Monitor in Windows Vista, it opens to a windowthat graphs the usage of the CPU, disks, network, and memory, as shown inFigure 10.9; these are ActiveX graphs like the ones used in the Performancetab of the Task Manager.


FIGURE 10.9 Resource overview within the Reliability and Performance Monitor ofWindows Vista

By clicking on Performance Monitor, you can track the usage of any device inthe computer (known as objects), in a variety of measurements (known ascounters). By default this screen tracks only the CPU. This screen is similar tothe default screen that comes up in Windows XP’s Performance window. InXP, this screen automatically tracks the Processor, RAM, and hard disk. Byclicking the + sign toward the top of the window, you can add devices to track,and in a myriad of ways. Information can be viewed in different formats likeline charts and histograms and can also be viewed in Report view. They can beexported as well. However, any objects that are added in this program are notsaved when you close the window. But it is possible to configure the programso that it saves your additions; enter the MMC. (You remember the MMCfrom Chapter 9, “Maintaining Windows.”) From an MMC a user can add theActiveX Control called System Monitor that is the Performance Monitor. Youcan also add Performance Logs and Alerts to log your findings and alert youto any changes or tripped thresholds. The MMC saves its contents and

remembers the last place you were working in, which works great if you aregoing to be analyzing the same things day in and day out.

MsconfigMsconfig can help troubleshoot various things, from operating system startupissues to application and service problems. From Msconfig (open the Runprompt and type msconfig), one can select different modes of startup, forexample loading only basic devices, or diagnostic startup. A user can also shutdown individual services and programs that would normally be loaded at start-up, an invaluable tool. Aside from that, some of the Advanced Boot Optionscan be accessed, which normally are accessed by pressing F8 when the systemstarts up.

Stop ErrorsA stop error (also known as a Blue Screen of Death or BSOD) is the worsttype of error that can happen while Windows is operating. It completely haltsthe operating system and displays a blue screen with various text and code.Anything you were working on is for the most part lost. In some cases, itreboots the computer after a memory dump has been initiated. (This is alsoknown as auto-restart.) If not, you need to physically turn the computer off atthe power button and turn it back on. Some BSODs happen only once, and ifthat is the case, then you need not worry too much. But if they happen two orthree times or more, you should investigate why. Quite often they are due to acorrupt driver file. If you see two columns of information with a list of driversand other files, that is probably the case. Look at the bottom of the second (orlast) column and identify the driver that has failed, for example cdrom.sys.These drivers can become corrupt for a variety of reasons and would need tobe replaced when you boot into Windows, or if you can’t boot into Windows,replaced from within WinRE’s Command Prompt (Vista) or the RecoveryConsole (XP/2000). Less commonly a BSOD might be caused by a memoryerror that will have additional code that you can research on Microsoft’s web-sites (MSKB and TechNet).

By default, two things happen when a Stop error occurs:

. An event will usually be written to the System Log within the EventViewer, if that option has been selected in the Startup and Recoverywindow, as shown in Figure 10.10. When a STOP error is written to theSystem Log, it is listed as an Information entry, not as an Error entry.The STOP error will be listed as “The System Has Rebooted from aBugcheck. The Bugcheck was (Error Number).” Use the error number

284


to look up the problem, and hopefully find a solution, on the MSKBand/or TechNet.


FIGURE 10.10 Startup and Recovery window

The settings shown in Figure 10.10 can be accessed in the followingways:

. In Windows Vista: Click Start, right-click Computer, selectProperties, click the link for Advanced system settings, select theAdvanced tab, and click the Settings button in the Startup andRecovery box.

. In Windows XP: Click Start, right-click My Computer, selectProperties, select the Advanced tab, and click the Settings buttonin the Startup and Recovery box.

. Windows will write debugging information to the hard drive for lateranalyses with programs such as Dumpchk.exe; this debugging informa-tion is essentially the contents of RAM. The default setting in WindowsXP is to only write a portion of the contents of RAM, known as a SmallMemory Dump; this is written to %systemroot%\Minidump, as shownin Figure 10.10. Or you could configure Windows to do a Kernel mem-ory dump, which is the default in Windows Vista. The Kernel memory

ExamAlert

dump is saved as the file %systemroot\MEMORY.DMP that is largerthan the minidump file. Both operating systems support the option for aComplete Memory Dump, which dumps the entire contents of RAM toa file once again named MEMORY.DMP. This must be where thephrase “My computer just took a dump…” comes from! For more infor-mation on how to analyze the debugging information resulting fromthese stop errors, see the following link:http://support.microsoft.com/kb/315263.

Know how to make configuration changes in the Startup and Recovery window.

Additional Windows Errors and ErrorReportingWindows errors less serious than STOP errors might display a pop-up win-dow like the one shown in Figure 10.11 after the application has closed.Figure 10.12 shows a critical error (runaway loop) that caused an applicationto close. However, the operating system and other applications still function.Figure 10.13 displays a critical application error known as a general protectionfault (GPF) that also caused the application to fail, but again, without crashingthe operating system.

286


FIGURE 10.11 An Internet Explorer error



FIGURE 10.12 A critical error

FIGURE 10.13 A General Protection Fault (GPF)

As you can see, Windows Vista/XP/2000 can recover from these types oferrors and continue to function. More information can be found about theerror in the Event Viewer, and in the case of Figure 10.11, the error reportinformation can be viewed just by clicking on the link Click Here within theerror window. You also have the option of sending an error report toMicrosoft, in the hopes of acquiring a solution or fix.

To enable/disable error reporting in Windows Vista, navigate to ControlPanel > System and Maintenance > Problem Reports and Solutions > Changesettings > Advanced settings. To find out if any new solutions are available,click the Check for New Solutions link within Problem Reports andSolutions.

To enable/disable error reporting in Windows XP, navigate to the SystemProperties window, Advanced tab, and click the Error Reporting button.

Restoring WindowsBeyond even stop errors, a complete system failure is when a system cannotbe repaired. When this happens, the only options are to reinstall or to restoreWindows. There are several methods for restoring Windows. Chapter 9showed how to back up the system and create System Restore points. Nowlet’s show how to restore entire system backups, restore data, and restore thecomputer to an earlier point in time.

Restoring from Windows Vista’s Complete PCBackupTo restore a system from the backup:

1. Insert the installation disc, and then restart the computer. (Make surethat the DVD drive is listed first in the BIOS boot order.)

2. Press any key when prompted to do so to boot off of the DVD.

3. Choose your language settings, and then click Next.

4. Click Repair your computer.

5. Select the operating system you want to repair (usually there will be onlyone), and then click Next.

If you are restoring a 64-bit system using a 32-bit Complete PC backup or a 32-bitsystem using a 64-bit Complete PC backup and have more than one operating sys-tem installed, do not select an operating system. If an operating system is selectedby default, clear the selection by clicking a blank area of the window, and then clickNext.

6. On the System Recovery Options menu, click Windows Complete PCRestore, and then follow the instructions. Insert the last DVD of thebackup set when prompted to do so.

Restoring from Windows XP’s ASR BackupTo restore a system with ASR, you need the Windows XP Professional CD,the ASR backup media, the ASR floppy disk, and the computer must have afloppy drive. Follow these steps to restore the system:

1. Boot to the Windows XP CD.

2. Press F2 to start Automated System Recovery.

3. Insert the ASR floppy disk.

4. Provide the backup media when asked for it.

When ASR is finished, applications need to be reinstalled and any data back-ups need to be restored.

288


Note

Restoring to an Earlier Condition in Windows Vistaand XPTo restore your system to an earlier condition in Windows Vista

1. Access the System Protection tab again, and this time click the SystemRestore button. This opens the System Restore window.

2. Select either Recommended restore, or Choose a different restore point.

3. The Recommended restore point asks you to confirm. If you choose adifferent restore point, you will need to select the appropriate one andconfirm.

4. The system initiates the restore and automatically restarts.

Windows Vista also enables you to undo a system restore, if it did not repairthe problem.

To restore your system to an earlier condition in Windows XP

1. Close any open programs and save your work before you start theprocess.

2. Navigate to Start > All Programs > Accessories > System Tools > SystemRestore. This opens the System Restore window.

3. Click Restore My Computer to an Earlier Time and click Next.

4. Select a date from the calendar. (Dates that have restore points are inbold text.)

5. Select a restore point and click Next. The system will shut down, restart,and start the restore.

Using System Restore with Advanced BootOptionsIf you cannot boot into Windows XP, try starting your computer using theSafe Mode option; then start System Restore . Click Restore My Computer toan earlier time, and click next. This returns your system to a previous state.

You can also start a System Restore with Safe Mode with Command Promptoption. If you are prompted to select an operating system, use the arrow keysto select the appropriate operating system for your computer, and then pressenter. Log on as an administrator or with an account that has administrator


ExamAlert

credentials. At the command prompt, type %systemroot%\system32\restore\rstrui.exe, and then press Enter. Follow the instructions thatappear on the screen to restore your computer to a functional state.

If System Restore is not available, it might be turned off. Within WindowsVista you can enable or disable System Restore on any volume from theSystem Properties window > System Protection tab. Simply check or uncheckany volume that you want to enable or disable. Within Windows XP, the stateof System Restore affects all drives; you can only turn the utility on and off.This is done from the System Properties window > System Restore tab. Youcan also change the amount of disk space it uses here.

Be aware that System Restore is not necessarily the first thing you should trywhen troubleshooting a computer. Simply restarting the computer has beenknown to “fix” all kinds of issues. It’s also a good idea to try the Last KnownGood Configuration. This can be accessed within the Windows AdvancedBoot Options menu by pressing F8 when the computer first boots.

Third-party programs such as Ghost and Acronis True Image can be used to restorea system from an image file, but the end result all depends on how long ago youimaged the machine in the first place. Factory recovery discs can also be used, butthese usually return the operating system back to its original state. Any data wouldhave to be restored afterward from some sort of backup.

Know the various ways a system can be restored.

The Six-Step Troubleshooting ProcessRevisitedRemember to try to use the CompTIA six-step troubleshooting process whentroubleshooting software issues. They are

290


Note

CramQuizWindows Tools and Errors

ExamAlert

By using a methodical troubleshooting process like this one, you are organiz-ing your thoughts and actions, and probably, saving time and effort in thelong run.

Memorize the six-step CompTIA troubleshooting process for the exam.


1. What could a yellow exclamation point in the Device Manager indicate?

❍ A. Disabled device

❍ B. Event Viewer error

❍ C. Incorrect driver

❍ D. Device is not installed

2. Which log file in the Event Viewer contains information concerning auditing?

❍ A. System

❍ B. Application

❍ C. Internet Explorer

❍ D. Security

Step 1: Identify the problem.

Step 2: Establish a theory of probable cause. (Question the obvious.)

Step 3: Test the theory to determine the cause.

Step 4: Establish a plan of action to resolve the problem and imple-ment the solution.

Step 5: Verify full system functionality and if applicable implement pre-ventative measures.

Step 6: Document findings, actions, and outcomes.

scanner

Rectangle

scanner

Rectangle

Command-Line ToolsLet’s face it; the command-line interface, or CLI, is where the extreme techslive. Some things are just easier to do in the command line, or the functionali-ty needed might be accessible only in the command line. In this section wecover two groups of commands: First, ones that run from within Windows,and second, ones that should be run within the Recovery Console (XP) or theCommand Prompt option in WinRE’s System Recovery Options (Vista).Commands use what are known as switches. For example, if you typed DIR/?, the switch would be /?. Switches are also referred to as parameters oroptions.

Windows Command PromptMicrosoft’s name for the command line is the Command Prompt. TheCommand Prompt can be found in Start > All Programs > Accessories.However, if you troubleshoot Windows Vista, you probably need to run theCommand Prompt in elevated mode (as an administrator), which can be donein one of two ways:

1. Click Start > All Programs > Accessories; then right-click CommandPrompt and select Run as Administrator.

2. Click Start and type cmd in the search field, and instead of pressingEnter, press Ctrl+Shift+Enter.

ChkdskBy running the command chkdsk, this tool checks a disk, fixes basic issueslike lost files, and displays a status report; it can also fix some errors on thedisk by using the /F switch. Here’s an example of the three stages of resultswhen running the chkdsk command:The type of the file system is NTFS.

Volume label is WinXPC.

WARNING! F parameter not specified.

Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...

File verification completed.

CHKDSK is verifying indexes (stage 2 of 3)...

Index verification completed.

CHKDSK is recovering lost files.

Recovering orphaned file ~WRL3090.tmp (59880) into directory file28570.

Command-Line Tools293

Recovering orphaned file ~DFA188.tmp (59881) into directory file28138.

CHKDSK is verifying security descriptors (stage 3 of 3)...

Security descriptor verification completed.

Correcting errors in the master file table’s (MFT) BITMAP attribute.

Correcting errors in the Volume Bitmap.

Windows found problems with the file system.

Run CHKDSK with the /F (fix) option to correct these.

31471300 KB total disk space.

13053492 KB in 56091 files.

16340 KB in 4576 indexes.

0 KB in bad sectors.

133116 KB in use by the system.

65536 KB occupied by the log file.

18268352 KB available on disk.

4096 bytes in each allocation unit.

7867825 total allocation units on disk.

4567088 allocation units available on disk.

Notice that the utility warned us that the /F switch was not specified, andbecause of this it ran in read-only mode. Also notice that the orphaned fileswere recovered, although they are just .tmp files, and most likely not neces-sary for the functionality of Windows. Finally, the program found issues withthe file system; if we wanted to repair these, we would have to use the /Foption. Be sure that you really need to run chkdsk with the /F parameterbefore doing so. For example, if the system seems to function properly, butthe standard chkdsk command gave an error, it might not be absolutely neces-sary to run chkdsk with the /F parameter.

SFCSystem File Checker (SFC) is a Windows Vista/XP/2000 utility that checksprotected system files. It replaces incorrect versions or missing files with thecorrect files. SFC can be used to fix problems with Internet Explorer or otherWindows applications. To run SFC, open the command prompt and type SFCwith the appropriate switch. A typical option is SFC /scannow, which scansall protected files immediately. Another is SFC /scanonce, which scans allprotected files at the next boot. If SFC finds that some files are missing, youare prompted to reinsert the original operating system disc, so the files can becopied to the DLL cache.

ConvertThe convert command enables you to convert a volume that was previouslyformatted as FAT32 over to NTFS, without losing any data. An example of

294


the convert command would be convert d: /FS:NTFS, which would con-vert the hard disk volume D: to NTFS. Sometimes you might encounter oldercomputers’ hard drives (or flash media) that require being formatted as NTFSfor compatibility with other devices and networked computers.

FormatFormat is a command used to format magnetic media such as hard drives andsolid-state media such as USB flash drives to the FAT, FAT32 or NTFS filesystems. An example of formatting a USB flash drive in the command linewould be format F:. The type of file system that the media will be format-ted to can be specified with the switch /FS:filesystem, where file systemwill equal either FAT, FAT32, or NTFS. For more information on the variousswitches available with format, type format /?.

DiskpartThe Diskpart utility is the command-line counterpart of Windows’ DiskManagement program. This program needs to be run by typing diskpartbefore any of the diskpart actions can be implemented. This brings the userinto the DISKPART> prompt. From here you can create, delete, and extendvolumes, assign drive letters, make a partition active, and so on. Essentially,everything that was covered in the Disk Management portion of Chapter 9 canbe done with Diskpart. When you finish using Diskpart, type exit to returnback to the standard command prompt.

DefragThis is the command-line version of the Disk Defragmenter. To analyze adisk, type the command defrag –a. If a volume needs to be defragmented,but has less than 15 percent free space, use the –f parameter.

XcopyThe Xcopy command is meant to copy large amounts of data from one locationto another; entire directory trees even. One example of it’s usage would be tocopy the contents of a Windows Vista DVD-ROM over to a USB flash drive sothat you can use the USB flash drive as installation media. The command forthis would be xcopy d:\*.* /E/F e:\. This is assuming that D: is theDVD-ROM drive, and E: is the USB flash drive. *.* means all files with allextensions within the D: drive. /E indicates that all folders and subfolders willbe copied including empty ones. /F displays full source and destination fileswhile copying. For more information about Xcopy type xcopy /?.


296


Memorize as many of the commands mentioned in this section as you can!

Recovery Command PromptWindows Vista’s System Recovery Options Command Prompt and WindowsXP’s Recovery Console are used to repair issues with the operating system.For example, a system file causing the system to fail at startup can be copiedfrom installation media. This environment can also be used to edit files andrun commands that can fix the boot sector and master boot record. In thissection I refer to both Windows Vista’s System Recovery Options CommandPrompt and Windows XP’s Recovery Console collectively as “recoveryCommand Prompts” for easier reading.

EditThe edit command can be used to create and modify text files withinWindows or within a recovery Command Prompt. For example, maybe theboot.ini file in Windows XP needs to be modified. Within the root of C: thecommand to modify this would be simply edit boot.ini. Here is an exam-ple of a default Windows XP boot.ini file that has some incorrect information:[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINNT

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Microsoft Windows XPProfessional” /fastdetect /NoExecute=OptIn

Did you notice the error? The default %systemroot% folder name inWindows XP is \Windows, not \Winnt, as is incorrectly shown in line 3.Line 3 contains what is called an Advanced RISC Computing (ARC) path. Ittells us the type of disk being used, which disk and partition the operating isinstalled to, and finally the installation folder. Errors within an ARC path canbe easily fixed with the edit command, or you could simply delete the file,and Windows XP would re-create a default boot.ini automatically uponrestart. However, the file that XP re-creates automatically would be a defaultfile, assuming one hard drive with the operating system installed to the C:drive. Any other configurations would require the boot.ini be modified. Forexample, if Windows was installed to D: instead of C:, the “partition” sectionof the ARC path would have to be modified to partition(2). If using SATA orIDE hard drives, the default setting for rdisk is 0, which means the first hard

ExamAlert

drive; the default setting for partition is 1, which means the first partition onthe drive. Note that the partition setting does not start with 0. For more infor-mation on ARC paths, an older but still valid article can be found at:http://support.microsoft.com/kb/102873.

CopyThe copy command obviously copies files from one location to another. Anexample of its usage in a recovery-based Command Prompt would be toreplace a missing NTLDR file in Windows XP. To do this, the file would haveto be copied from the CD-ROM to the hard disk. Assuming that all drive let-ters are standard (hard disk is C: and CD-ROM drive is D:), the syntax forthis would be copy d:\i386\ntldr c:\. This copies the NTLDR filefrom the I386 folder on the CD-ROM to the root of C: on the hard drive.

ExpandSometimes you can’t just copy files from a DVD/CD to the hard drive. Manyof these files are compressed. If a file ends with an underscore, for examplentoskrnl.ex_ then it is a compressed file and has to be expanded. Let’s just saythat it was a dark day and that ntoskrnl.exe had failed. You can’t do muchwithout that core operating system file. To fix the problem in the recoveryCommand Prompt, you would expand the file from DVD/CD to the harddrive. In a standard environment where the hard drive is C: and the DVD/CDdrive is D:, the syntax would be expand D:\i386\ntoskrnl.ex_C:\Windows\System32\ntoskrnl.exe. This decompresses the file andplaces a copy of the decompressed version on the hard drive. Be sure to typethe entire name of the file in the destination; otherwise, you will need torename the file.

The edit, copy, and expand commands can also be used within Windows in theCommand Prompt.

Other Recovery Environment CommandsIf Windows Vista has startup issues, you can use several commands:

. bootrec /fixboot—Replaces the bootmgr file and writes a newWindows Vista compatible boot sector to the system partition.


Note


CramQuiz Command-Line Tools

. bootrec /fixmbr—Rewrites the Windows Vista compatible masterboot record to the system partition.

. bootrec /rebuildbcd—Repairs the BCD store.

. bootrec /ScanOs—This scans all disks for installations compatiblewith Windows Vista. This option also displays the entries that are cur-rently not included in the BCD store. Use this command if there areWindows Vista installations that the Boot Manager menu does not list.

If Windows XP has startup issues, there are a couple of commands that youcan use:

. FIXMBR—Use this command to repair the MBR of the system partition.Use this command if a virus has damaged the MBR and Windows can-not start.

. FIXBOOT—Use this command to write new Windows boot sector codeto the system partition.

For an advanced description of the Recovery Console and all its commands, seethe following link: http://support.microsoft.com/kb/314058.


1. Which command can fix lost files?

❍ A. Defrag

❍ B. Diskpart

❍ C. Chkdsk

❍ D. FIXMBR

2. Which Recovery Console command will decompress a file as it copies it to thehard drive?

❍ A. Extract

❍ B. Expand

❍ C. Compress

❍ D. Encrypt

Note


scanner

Rectangle

scanner

Rectangle

chapter 10 troubleshooting windows - crammaster …7… · 268 chapter 10: troubleshooting windows...

Documents