Windows 2000 Diagnostic Boot Methods and BOOT.INI Switches

Materials:

Working complete PC

Blank Diskette

Student Diskette, "New Boot A Ver 2.0+"

Student CD-ROM, "Room 6359"
Objectives:

The student will become familiar with the Windows 2000 boot process,

The student will learn how to use the [F8] menu choices,

The student will become familiar with the features of each diagnostic boot menu choice,

The student will become familiar with how to use switches within the BOOT.INI to control the Windows 2000 Start Up.
Competency:
The student will learn how to activate and use the Windows 2000 Diagnostic Boot Menu in order to be able to launch the operating system when it is failing to launch normally. The student will learn how to modify the BOOT.INI file and apply switches to an entry in order to control the start up process.

Preparation

Install or use GHOST to set up the system with Windows 2000 Advanced Server. The instructor will provide the student with a bad driver to install upon reboot. Complete the installation of the driver and note that it does issue warnings that it is not to the operating system's liking. Upon completion of the installation reboot the the system. Upon startup Windows 2000 will blue screen with a "Stop 0x0" message indicating that the problem came from the driver file that was just installed. At this point the system is ready to begin the procedures.

Procedures - Diagnostic Boot Menu

Reboot the system and press the [F8] key when prompted at the bottom of the startup screen:

Starting Windows...

For troubleshooting and advanced startup options for Windows 2000,press F8

This will open the Windows 2000 Diagnostic Boot Menu (MS refers to this as the Windows 2000 Advanced Options Startup Menu):

Windows 2000 Advanced Options Menu
Please select an option:

    Safe Mode
    Safe Mode with Networking
    Safe Mode with Command Prompt

    Enable Boot Logging
    Enable VGA Mode
    Last Known Good Configuration
    Directory Services Restore Mode (Windows 2000 domain controllers only)
    Debugging Mode

    Boot Normally
    Return to OS choices menu

Use and to move the highlight to your choice.
Press Enter to choose.
Each of these possible choices will affect the way the operating system will proceed to boot up:
- Safe Mode - The system will avoid loading all but the bare minimum drivers necessary in order to function. Expect all drivers installed separately after the installation to be absent (and their devices and services to be unavailable for this session) Many devices that are detected during installation will also have their drivers skipped under this boot process as well. Similarly to the Windows 9x family safe mode, this is designed around the concept of skipping video card drivers and only load the standard VGA driver so that system can be accessed and driver issues can be corrected including faulty settings or drivers being reinstalled.
- Safe Mode with Networking - Safe Mode will always skip networking device drivers including remote connectivity (modems) This choice explicitly requests that all other major drivers be skipped but try to load network interface card and/or modem drivers and the network protocol stack and attempt to make the network and/or remote connectivity services available for this session.
- Safe Mode with Command Prompt - This is the same as Safe Mode except that it will not load Explorer.exe and will instead load CMD.EXE to serve as the user interface for this session. This system will display the standard desktop and open a single DOS box window where commands can be issued. This should be tried if the OS core is suspected to be corrupted affecting Explorer.exe's stability.
- Enable Boot Logging - This is similar to Boot Logged (BOOTLOG.TXT) of Windows 98 (See the Windows 98 Diagnostic Boot Menu) The system will attempt to boot normally (loading all drivers and services) and will keep a detailed log of all start up events in the file "ntbtlog.txt" in the %systemroot% folder. Even if the system crashes, this file can later be examined to determine the possible cause of the crash.
- Enable VGA Mode - This choice indicates that the OS should attempt to boot normally and attempt to load all drivers and services including the video card drivers. The only difference is that this setting will force a 640x480 in 16 color VGA resolution onto those drivers. This will not load the standard VGA driver instead of the video card drivers. This can be used if the video card drivers settings are known to be the problem that needs to be resolved.
- Last Known Good Configuration - This is a limited form of "hardware driver go back" that will be described in detail below.
- Directory Services Restore Mode - If a domain controller malfunctions to the point that it cannot startup, an extra boot up subsystem has been built in to the domain controller (only) to attempt to fix it. (This one will be dealt with in another module).
- Debugging Mode - This mode appears to be more for programming and software developers or for gathering specific error codes or information for Microsoft TechNet articles or Microsoft Technical support representatives and will not be discussed in this article.
- Boot Normally - Proceed with a normal full startup.
- Return to OS choices menu - This will only be displayed if the BOOT.INI has more than one choice that can be chosen. In this case this Diagnostic Boot Menu choice will be displayed below the Boot Normally choice and will return control to the BOOT.INI menu and allow booting to alternate OS installations.

The Safe Modes order of operational functions:

Mode	Explorer.exe	Video	Networking	All Others
Safe Mode	Yes	No	No	No
Safe Mode with Networking	Yes	No	Yes	No
Safe Mode with Command Prompt	No	No	No	No
Enable VGA Mode	Yes	Yes	Yes	Yes

In Enable Boot Logging the file named "ntbtlog.txt" will be created in the %systemroot% folder. This is an environmental variable that allows the OS to be installed into any partition on any drive. The default is "C:\WINNT" You can test your system to see what the environmental variable is on the system by opening a DOS box and then issuing the echo command to display the value:
```
C:\Documents and Settings\Administrator>echo %systemroot%
C:\WINNT
C:\Documents and Settings\Administrator>_
```
If the system will not boot, then the technician will have to gain access to the system in order to be able to read this file.
Enable VGA mode will load all drivers and attempt to set the resolution of the video drivers to 640x480 in 16 colors. But if the drivers are corrupt or have other settings issues this may not work. If the resolution is too high for the monitor this is the recommended method of starting up the OS to set the resolution back down to a level that the monitor can handle.
The Last Known Good Configuration. The LKGC is created when Windows (NT4/W2K/XP) determines that the control set used to boot from led to a successful startup. The Control Set is a Registry Key found in the HKEY_LOCAL_MACHINE hive. It contains entries for all drivers for all devices that will be used for the startup process. Windows 2000 determines that the control set is "good" if there were no system critical errors generated and the user was capable of logging on without any errors (reached the desktop errorfree). At that point the control set used (the key and all of its contents in the Registry) is backed up to the LKGC. This is what will be accessed if this choice is selected from the Diagnostic Boot Menu. So the LKGC is effective if: The last startup was successful and new device drivers were just installed that are now causing the system to crash. The LKGC will not work if: files other than those within the Control Set key are causing the problem (corrupt kernel windows components or services), the exact same device drivers became corrupt during the last session and are the ones mentioned in the LKGC key and it is trying to load them, LKGC is only one successful boot "deep" (changes made more than one successful boot ago cannot be avoided by using the LKGC), LKGC is not a substitute for alternate hardware configuration profiles (use hardware profiles for that), the LKGC will not avoid problems that occur after the successful startup (Windows starts up to the logon screen, the user logs on, reaches the desktop and then the system locks up...this has another cause, not the hardware driver control set in other words).

Remember that Windows automatically creates a new LKGC everytime the system successfully startup according to the criteria above and this overwrites the previous LKGC key in the Registry.
Directory Services Restore Mode is intended for use with Windows 2000 Servers that are functioning as Domain Controllers and offer an opportunity for these systems to perform a recovery process. This option only works on Windows 2000 servers that are currently configured and running as domain controllers. This will be covered in another module.
Debugging Mode is used mainly by programmers to actually debug the kernel and its interaction with the software and or device drivers (mainly) that they are in the process of developing. When the system boots up in debugging mode, the system sends debug codes out the COM2 serial port. These can be received by a system attached by a serial crossover cable that is running a debugger and can be analyzed to see where the problem is occuring.
The return the OS choices menu returns control from this menu of NTLDR (this is the component that is displaying this menu) back to the menu that it displays based on the information found in BOOT.INI. This is the menu that lets the user boot to another OS installation.

Procedures - BOOT.INI Switches

Boot the system normally. Open the root of the C: drive and open the file BOOT.INI in notepad. If you cannot see the file then open Tools > Folder Options > View > click the "Show hidden files..." radio button, uncheck "Hide file extensions...", uncheck "Hide protected...", uncheck "Remember each..." > Apply > OK. Be sure that it is not read-only. Right click BOOT.INI > Properties > uncheck "Read-only" > Apply > OK.
With BOOT.INI open, there is probably only one line in the [operating systems] section. Find the one in which the multi(x) syntax matches the one mentioned in the [default] section. Copy it under itself so that there are four identical lines. The BOOT.INI contents might now look like this:
[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINNT [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Advanced Server" /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Advanced Server" /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Advanced Server" /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Advanced Server" /fastdetect
Select text by dragging the mouse from the beginning of a line to the end in order to scroll left or right.
Save the file as BOOTINI.NEW in the root of the C: drive. See the tutorial on Creating a Windows 2000 Boot floppy and create one now. Copy this BOOTINI.NEW to the root of the floppy and rename it BOOT.INI.
These lines already illustrate one of the switches that can be used "/fastdetect" on a line of the BOOT.INI to launch the OS. Here is a complete list and what each one does:
- /basevideo - Forces a 640x480 in 16 colors resolution setting on the video drivers when they load. This is equivalent to launching the operating system from the diagnostic boot menu and choosing the Enable VGA Mode choice.
- /baudrate=n - Sets the COM port rate for kernel debugging. The default is 9600 if a modem is attached and 19200 if a cross-over cable is being used. Setting this switch automatically enables Debugging Mode.
- /crashdebug - Allows Windows to start up in normal mode. When the system crashes it enables remote debugging through the COM ports. The COM ports will function normally until the crash occurs.
- /debug - Starts up Windows 2000 in Debugging Mode.
- /debugport=comn - Where n is 1, 2, 3, or 4. Establishes which COM port will be assigned to transmit the debugging information. This also automatically starts Debugging Mode.
- /maxmem=n - Sets the amount of RAM in MB that Windows 2000 can use. For Windows 2000 Professional do not set this below 64(MB), for 2000 Server do not set this below 128(MB) This can be used to test if the system will run with less memory and if a particular SIMM or DIMM is faulty (causing crashes, blue screens, etc)
- /nodebug - Will not allow the debugging mode to occur.
- /numproc=n - This switch can force a multiprocessor system to only recognize the number of CPU's specified. This will not allow a single processor installation of Windows 2000 to use multiple CPU's (See changing the HAL) This switch will not allow the system to test for a bad CPU (the choice of which CPU's will be used is evidently difficult to predict)
- /fastdetect:comn - where n is 1, 2, 3, or 4. This switch disables COM port activity from NTDETECT.COM. This is done because some serial devices will malfunction if this COM port activity is allowed. The main type of device that can malfunction from the values transmitted by NTDETECT.COM through the serial ports is a UPS. If you omit the :COMn part of the switch then NTDETECT.COM will not attempt to detect any external devices attached to any COM port.
- /sos - DIsplays the name of each driver as it loads. This can be used to determine which driver is causing a lockup or a blue screen if it is not evident from the blue screen's message. MS recommends using this switch in conjunction with the /basevideo switch.
- /PAE - Must be used on computers that support Physical Address Extensions in order for it to boot normally.
- /HAL=filename - This allows a system to launch using a different HAL.DLL file. This can be used to specify a multiprocessor HAL versus a single processor HAL, but the /kernel switch will be needed as well in that case.
- /kernel=filename - This allows alternate kernel files to be launched. This can be used to specify either a single processor kernel or a multiprocessor kernel. In this case the /hal switch must also be specified.
- /bootlog - This will turn on boot logging and create the file ntbtlog.txt in the %systemroot% folder. This is the same as activating the diagnostic boot menu and choosing the Enable Boot Logging choice.
- /noguiboot - This will turn off the progress bar bitmap image that appears on screen prior to the actual logon box (winlogon.exe).
- /3GB - Allows applications to request 3GB of memory. The kernel normally only permits an application 2GB of memory. This switch may be needed if there is more than 1GB of physical RAM. MS Exchange server running on Windows 2000 Enterprise apparently may need this switch.
- /safeboot:method - This switch controls booting into safe mode and can be used in various combinations. The switch is usually used in combination with /sos, /bootlog, /noguiboot but these do not have to specified. The switches allow booting in safe mode and with logging enabled. For example:
  To launch in safe mode: /safeboot:minimal
  To launch in safe mode with networking: /safeboot:network
  To launch in safe mode with command prompt: /safeboot:minimal(alternateshell)
  To launch in Directory services restore mode: /safeboot:dsrepair
  To launch in safe mode and display drivers as they load: /safeboot:minimal/sos
Armed with this information change the switches on each line in the BOOT.INI on the boot floppy such that there is one entry that will launch the system without detecting external devices on any COM port, in safe mode without networking support, that will list drivers as they load. Create another entry that will do the same but instead of display drivers as they load it will enable boot logging. Create a last entry that will launch in normal mode but enable logging and display drivers as they load. Change each entry's name between the double quotes to reflect the switches. Here is a finished example:
[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINNT [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Advanced Server" /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINNT="With /fastdetect /safeboot:minimal /sos" /fastdetect/safeboot:minimal/sos multi(0)disk(0)rdisk(0)partition(1)\WINNT="With /fastdetect /safeboot:minimal /bootlog" /fastdetect/safeboot:minimal/bootlog multi(0)disk(0)rdisk(0)partition(1)\WINNT="With /fastdetect /bootlog /sos" /fastdetect/bootlog/sos
Select text by dragging the mouse from the beginning of a line to the end in order to scroll left or right.
Reboot to the floppy and test the new boot up entries of the BOOT.INI file.