A+ Ch 19 Troubleshooting Windows

How can you replace the registry in Vista / 7?

1. Boot to the Windows RE 2. Run the reg command 3. Copy the Registry files from the \regback to the \config folder one level up.

What improved in Event Viewer from XP to Vista / 7?

They added a better interface but kept all of the XP info. It has views to help you narrow down on problems.

How can viruses disrupt the GUI?

They can make fake BSoD or remove/hide graphical elements like the Start button.

What is Safe Mode with Command Prompt?

This is handy if the desktop does not display at all it will load a Command Prompt when it loads. You can replace a bad copy of explorer.exe or load Event Viewer with eventvwr.msc.

According to Comptia, what is a recovery image?

This is when you use Backup and Restore to create a system image and a system repair disc. You can then use the system repair disc to get to the System Image Recovery that uses the system image on the second disc to write a "fixed" or previously working version of Windows 7 to the hard drive.

What is Safe Mode with Networking?

This mode enables network drivers in Safe Mode in case you need to diagnose network driver issues. (Or download anti-virus updates)

What is Directory Services Restore Mode?

This only affects domain controllers, so selecting this will just boot into Safe Mode.

What are 3 ways to stop a program from loading on startup?

1. Check for options in the program. 2. Use the System Configuration Utility 3. Check the registry at: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

What do you need to do in the XP Recovery Console?

1. Select the Windows install you want to repair 2. Enter the Administrator password 3. Use the console to repair issues.

What 5 options do you have in Windows RE?

1. Startup Repair 2. System Restore 3a. Vista: Windows Complete PC Restore 3b. 7: System Image Recovery 4. Windows Memory Diagnostics (Vista adds Tool to name) 5. Command Prompt

What does Action Center provide direct links to?

1. UAC Settings 2. Performance Information and Tools 3. Backup and Restore 4. Windows Update 5. Troubleshooting Wizard 6. System Restore

How do you launch the XP repair console from the install disc?

1. You may need to setup CMOS to boot to CD 2. Boot from the CD 3. Hit R to enter Recovery Console

What is diskpart?

A disk partition tool in the command prompt. It doesn't have the safeguards or is as easy as computer management equivalent. One useful command in it is the clean command to wipe a partition.

How can the CMOS battery affect Windows?

A failing battery can reset the system time which can also change the time in Windows and cause errors in applications or network connections. These can be fixed by updating the time and changing the battery.

What is Start Windows Normally? Reboot?

This option starts windows normally. Reboot simply reboots the machine.

What command is added to Command Prompt in Windows RE and how is it used?

Bootrec replaces fixboot and fixmbr with one command that can do 4 things: 1. bootrec /fixboot - Rebuilds the boot sector for the active partition. 2. bootrec /fixmbr - Rebuilds the boot sector for the system partition. 3. bootrec /scanos - Looks for Windows installations not currently in the BCD store and only shows the results. 4. bootrec /rebuildmbr - Looks for Windows installations not currently in the BCD store and gives you the choice to add them.

How can you find out more about an error in XP Event Viewer?

Click on the application and then follow the link to the Microsoft knowledge base.

What is fsutil and its commands?

FSutil is a file system utility - fsinfo - provides details about drives and volumes - fsutil dirty [drivename] tell you if Windows considers the drive to be dirty, meaning it will run autochk on next reboot. fsutil repair initiate [drive letter] runs a basic version of chkdsk without rebooting.

How do you view results of the Windows Memory Diagnostic?

The PC will reboot when the test is finished, but you can view results in Event Viewer.

What is Windows Error Reporting?

The ability to send info about a program crashing to Microsoft to analyze.

What is Enable Boot Logging?

This starts Windows normally and creates a log file of the drivers as they load into memory. The log is Ntbtlog.txt and it is saved in %SystemRoot% The last entry in the log is most likely the bad driver.

How can you enter Windows Vista

- Boot to the Install DVD - If you have Vista SP1, you can create a System Repair Disc from Control Panel \ System and Security \ Backup and Restore \ and select "Create a Repair Disc"

How can you enter Windows RE in Windows 7?

- Boot to the Install DVD - Select Repair you Computer in the Advanced Boot Menu - You can create a System Repair Disc from Control Panel \ System and Security \ Backup and Restore \ and select "Create a Repair Disc"

Why does the Author prefer using the Install Disc for Windows RE over other methods?

- Hard drive could be messed up - Booting to Windows RE on the hard drive requires a local administrator password. - Using a bootable disc enables you to avoid any possible malware on the hard drive.

What is Enable VGA Mode (XP) or Enable Low-Resolution Mode (Vista / 7)?

This starts Windows normally but only loads a default VGA driver. It can be used to diagnose display driver issues or incorrect display settings. If the problem is fixed the full resolution can be enabled in display settings.

What is Disable Automatic Restart on System Failure?

This will stop the PC from quickly rebooting after a BSoD so you have time to copy down the details of the stop error.

How do you fix an MBR problem in the XP Recovery Console?

Type fixmbr

What will happen if device drivers problems stop the Windows GUI from loading?

You will get the Stop Error aka The Blue Screen of Death. This means Windows had errors it could not recover from.

What do you need to do to turn off Windows checking for Autorun.inf on a disc insertion?

You will need to change up to six different settings in the registry.

How can you change a subscore in the Windows Experience Index?

You will need to make a hardware change.

How do you backup/restore the BCD store?

You can export and import it as a file: bcdedit /export filename bcdedit /import filename

What should you use if you have problems installing or uninstalling programs?

You can right-click and select run as Administrator.

What can you do in safe mode?

You can use Device Manager to fix driver issues or disable devices.

What should you do if you get a .dll load failure error?

You can use the System File Checker, or you may have to find the .dll file and manually register it with the regsvr32 command.

What 3 commands can you use in BCDedit to change the boot menu?

bcdedit /displayorder {WindowsXP} /addfirst bcdedit /default {current} bcdedit /delete {WindowsXP}

How do you adjust compatibility settings in XP?

You can view the programs properties and switch to the Compatibility tab. There you can select the Windows version you want to emulate. You can also set it to run in 256 colors, in 640x480, or disable visual themes.

What syntax is used to change a BCD store field?

bcdedit /set {[identifier name]} [field name] [value] for example: bcdedit /set {current} path \BackupWindows\system32\winload.exe

How you fix missing boot files in the XP Recovery Console?

copy D:\i386\ntldr copy d:\i386\ntdetect.com where d: is your DVD drive.

What can you find in XP Event Viewer?

- Application - Errors, Warnings and Information about applications. Errors indicate the program failed to open. - Security - It records events or audits like logon events. Audits that are turned off can be turned on in Administrative Tools \ Local Security Policy. - System - This has errors, warnings and information about the OS.

What new options are in the Compatibility tab for Vista / 7?

- Disable desktop composition - Disable advanced display features like Aero. - Disable display scaling on high DPI settings - This turns off automatic resizing of program Windows, as some older programs may not display fonts correctly. - Run this program as an administrator - You need to be logged into an admin account to use this. - Change settings for all users - Any compatibility changes affect all users.

What 3 options do you have to repair to get back up and running if Windows will not boot?

1. Attempt to repair 2. Attempt to restore from a backup copy of Windows 3. Your last course is reinstall Windows, which means you can lose your data (unless you install to a diff hard drive or backup your data from the drive).

What is a recovery partition?

A hidden partition that you can boot to in order to restore / reinstall Windows.

What is BCDedit?

A tool in Vista / 7 to change how Windows boots from the BCD store.

What is required to make changes to log files in Event Viewer?

Administrative Privileges (Scott: this is to prevent someone from covering their tracks)

What is the Problem Reports and Solutions applet?

An applet in the Vista Control Panel improves on Windows Error Reporting by listing possible solutions to errors that you can click on to attempt to fix the error.

What is a General Protection Fault?

An error when a program tries to do something that is not permitted. It is rare to encounter.

When does startup repair run in Windows 7?

Anytime it detects your computer has failed to boot properly, even if you shut it down improperly.

What can you use to fix corruption in bootmgr and bcd?

BCDedit in the Windows Recovery Environment.

What should you do when faced with a "Missing Graphical Interface" (according to Comptia)?

If GUI files have been corrupted your only choices are to restore from a backup or rebuild from the installation media.

What is another indicator of a device problem other than a BSoD?

If you get a freeze-up, where the Windows Startup screen never switches over to the login screen. If this happens try one of the Advanced startup options.

What is Last Known Good Configuration?

If you installed a new device driver and the PC now fails on reboot you can use this to roll back the new driver.

What is Debugging Mode?

If you select this you can connect this PC to another running a debugger to get kernal debugging information. It is rarely used.

What is Action Center?

In Windows 7, Action Center aggregates data into a 1 page report with events, warnings and maintenance message.

When do Windows boot errors occur?

In between the end of POST and the start of the Loading Windows screen.

What does Startup Repair do in Windows RE?

It automatically performs a number of repairs: - Repairs registry using backup copy on HDD - Restores critical system and driver files - Runs equivalent of fixboot and fixmbr - Rolls back any non-working drivers - Uninstalls any incompatible service packs and patches - Runs chkdsk - Runs a memory test. It will produce a log file, which you can check to see what it found and fixed.

How do you force a PC to boot into Safe Mode on the next reboot?

It can only be enabled in msconfig.

What is Volume Shadow Copy Service?

It makes backup copies of files so you can restore to a previous version of a file. You must make sure this is enabled in System Protection.

What is XP Mode?

On Ultimate versions of Vista and 7 there is XP SP3 virtual machine that runs under Windows Virtual PC.

How can you run the Windows Memory Diagnostic?

On Vista / 7 it is added as an option on the Windows RE screen. When you select it, you can choose to reboot and run the test at startup.

What is Return to OS Choices Menu?

On computers with multiple OS installs you can select this to switch to a different OS in the OS Choices menu.

What Service load failures will Windows report with an Error Box?

Only critical Services.

What is the difference between the errors "Operating System not found" and "BOOTMGR is missing"?

Operating System not found indicates a hardware problem. BOOTMGR means it sees the drive but can't start Windows.

What is Windows PE / RE

Preinstallation Environment - a graphical installation process. That is made from a LiveDVD, where the OS is loaded from the install DVD into memory. Recovery Environment - Replaces the Recovery Console and built into Windows PE

How do you look at options during the Windows Memory Diagnostic?

Press F1 You can choose Test Mix (type), set whether they use the CPU cache, and set a number of passes to make.

What should you do when you get a BSoD?

Read what it says to try to find the file that caused it and what steps it recommends. You can take out any recently installed devices and reboot.

How do you get to the Windows Advanced Startup Options?

Restart and press F8 right after the POST messages but before the Windows loading screen.

What options do you have in Vista / 7 System Restore?

Restore to a specific Restore Point or you can select a system image.

What is the drawback to using an ASR backup?

Restoring from an Automated System Recovery backup means you will lose any changes made after the backup was created.

What is Safe Mode?

Safe mode loads very basic non-vendor specific drivers and has 640x480 in XP or 800 x 600 resolution.

What is a Registry load failure?

When the Windows loads a bad registry and fails to boot. The BSoD may indicate "Registry File Failure" or "Windows could not start". You can recover from this by loading the last known good configuration.

What is a repair installation?

When you reinstall Windows onto the same drive, on top of the existing system. It is better to install on a clean drive.

What is Disable Driver Signature Enforcement? (Vista / 7)

Windows Vista and 7 require low level drivers to be signed. You can disable this if you need to use unsigned drivers to startup the PC.

Where are backup registry files located in Vista / 7?

Windows\System32\config\regback

What should you enter in the XP recovery console to rebuild the registry?

delete C:\windows\system32\config\system delete C:\windows\system32\config\software delete C:\windows\system32\config\sam delete C:\windows\system32\config\security delete C:\windows\system32\config\default copy C:\windows\repair\system C:\windows\system32\config\system copy C:\windows\repair\software C:\windows\system32\config\software copy C:\windows\repair\sam C:\windows\system32\config\sam copy C:\windows\repair\security C:\windows\system32\config\security copy C:\windows\repair\defualt C:\windows\system32\config\default

What is required for Windows XP to boot and what errors will you see if it fails?

ntldr, ntdetect.com and boot.ini must be in C:\ and boot.ini must point to the Windows boot files. If not you will get these errors: - No Boot Device Present - NTLDR Bad or Missing - Invalid Boot.ini (The test may describe these as Missing NTLDR and Missing boot.ini)

How do you fix a broken boot.ini in the XP Recovery Console?

type bootcfg /rebuild The console will scan for installed copies of Windows and ask if you want to add them to boot.ini.