Fault tolerance

You implement fault tolerance to keep your computer running in the event of a component or system failure.

  • Before creating RAID disk sets or adding a UPS device, see Checklists.
  • To find features that have been moved in Windows 2000 Server, see New ways to do familiar tasks.
  • For tips about using fault tolerance, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklists

  • Checklist: Creating a mirrored volume
  • Checklist: Creating a RAID-5 volume
  • Checklist: Configuring a UPS


Checklist: Creating a mirrored volume

Step | Reference
Review key concepts. Using mirrored volumes;
Best practices;
To restore disk configuration information
Confirm that you are a member of the Administrators group. | Groups overview
Back up existing data. | To back up files with the backup wizard
Create the volume. | To create a mirrored volume


Checklist: Creating a RAID-5 volume

Step | Reference
Review key concepts. Using RAID-5 volumes;
Best practices;
Choosing a RAID method;
To restore disk configuration information
Confirm that you are a member of the Administrators group. | Groups overview
Back up existing data. | Backing up and restoring data
Create the volume. | To create a RAID-5 volume


Checklist: Configuring a UPS

Step | Reference
Review key concepts. | Uninterruptible Power Supplies (UPS); Best practices
Confirm that you are a member of the Administrators group. | Groups overview
Back up existing data. | To back up files with the backup wizard
Configure a program to run at low battery level. | Install a UPS
Test your UPS configuration. | To test your UPS configuration


New ways to do familiar tasks

The following table compares familiar Windows NT 4.0 fault tolerance tasks with the equivalent tasks in Windows 2000.
If you want to | In Windows NT 4.0 use | In Windows 2000 use
Create a mirror set | Disk Administrator in Administrative tools. | Computer Management (Local) in Administrative tools. For more information, see Manage mirrored volumes.
Create a RAID-5 set | Disk Administrator in Administrative tools. | Computer Management (Local) in Administrative tools. For more information, see To create a RAID-5 volume.
Configure a UPS device | UPS in Control Panel. | Power Options in Control Panel. For more information, see To configure a UPS.


Best practices

  • Mirroring the system and boot volumes
    Mirror the boot and system volumes onto another disk. If one of the disks containing the boot and system volumes fails, you can start the computer from the disk containing the mirrors of these volumes.
  • Upgrading basic RAID disks to dynamic disks
    Upgrade basic disks that belong to RAID arrays to dynamic disks. If a member disk of a RAID array fails, you can add a new disk to the computer and then rebuild the new member without rebooting the computer, thereby saving time.
  • Testing an uninterruptible power supply (UPS)
    Test the UPS device by simulating a power failure. You can do this by disconnecting the power to the device. This will enable you to determine whether the UPS is configured correctly, and how long the computer will run before the battery runs out of energy. For more information, see To test your UPS configuration.
  • Selecting a UPS
    Select a UPS device that not only includes a battery, but can also take advantage of the alerting features of the Windows UPS service in the event of a power failure. These features include main-power failure detection, low-battery detection, and UPS shutdown. Confirm that your UPS device works with Windows by checking the Microsoft Windows Hardware Compatibility List at the Microsoft Web site (http://www.microsoft.com/). It may be necessary to order the correct serial cable from the UPS manufacturer. This cable is designed to follow the UPS interfacing specification for Windows 2000. If you are upgrading your computer to Windows 2000 and you already have a UPS, check with the manufacturer to make sure the existing cable works with Windows 2000. Unexpected results can occur if you use the wrong cable.
  • Executing a command
    If you set Power Options to execute a command file following main power failure, make sure the command file finishes running in 30 seconds. A run time that is greater than 30 seconds threatens the capability of Windows to complete a graceful system shutdown. For more information, see To configure a UPS.


How to...

  • Use RAID disks
  • Use an uninterruptible power supply (UPS)


Use RAID disks

  • Create a mirrored volume
  • Add a mirror to an existing simple volume
  • Resynchronize a mirrored volume
  • Break a mirrored volume into two volumes
  • Remove a mirror from a mirrored volume
  • Create a RAID-5 volume


Use an uninterruptible power supply (UPS)

  • Install a UPS
  • Remove a UPS
  • Configure a UPS
  • Configure a simple-signalling UPS
  • Test your UPS configuration


Concepts

This section provides general background information about the fault-tolerance capabilities of Windows 2000.

  • Fault tolerance overview
  • Understanding fault tolerance
  • Using fault-tolerant devices
  • Resources


Fault tolerance overview

Fault tolerance is the ability of a system to continue functioning when part of the system fails. Normally, fault tolerance is used in describing disk subsystems, but it can also apply to other parts of the system or the entire system. Fully fault-tolerant systems use redundant disk controllers and power supplies as well as fault-tolerant disk subsystems. You can also use an uninterruptible power supply (UPS) to safeguard against local power failure.

Although the data is always available and current in a fault-tolerant system, you still need to make backups to protect the information on your disk subsystem against user errors and destructive events such as fire, earthquakes, tornadoes, and floods. Disk fault tolerance is not an alternative to a backup strategy with offsite storage.

You can use dynamic storage to create volume-oriented disk systems that are fault tolerant. The new Disk Management architecture allows online changes without the need to restart your computer. To learn more about dynamic storage, see Disk Management.


Understanding fault tolerance

This section covers:

  • RAID disk arrays
  • Choosing a RAID method
  • Uninterruptible power supplies (UPS)


RAID disk arrays

Strategies for implementing a Redundant Array of Independent Disks (RAID) can use hardware or software solutions. In a hardware solution, the controller interface handles the creation and regeneration of redundant information. In Windows, this activity can be performed by the software. In either case, data is stored across an array of disks.

Disk arrays consist of multiple disk drives coordinated by a controller. Individual data files are typically written to more than one disk in a manner that, depending on the RAID level used, can improve performance or reliability.

However, there is no fault tolerance until the fault is repaired. Few RAID implementations can withstand two simultaneous failures. When the failed disk is replaced, the data can be regenerated by using the redundant information. Data regeneration occurs without bringing in backup tapes or performing manual update operations to cover transactions that took place since the last backup. When data regeneration is complete, all data is current and again protected against disk failure. The ability to provide cost-effective high data availability is the key advantage of disk arrays.


Choosing a RAID method

The major differences between mirrored volumes and RAID-5 volumes are hardware requirements, performance, and cost. The following table illustrates the major features of the two methods of fault tolerance:

Mirrored volumes | RAID-5 volumes
Support FAT and NTFS. | Support FAT and NTFS.
Can mirror system or boot volumes. | Cannot stripe system or boot volumes.
Require 2 hard disks. | Require a minimum of 3 hard disks.
Have higher cost per megabyte (50 percent utilization). | Have lower cost per megabyte.
Have good read and write performance. | Have moderate write performance and excellent read performance.
Use less system memory. | Require more system memory.
Support only 2 hard disks. | Support up to 32 hard disks.

Choosing between mirrored and RAID-5 volumes depends on your computing environment. RAID-5 volumes are a good solution for data redundancy when most activity consists of reading data. For example, if your network has a server on which you maintain all copies of the programs used by the people at that site, this might be a good case for using a RAID-5 volume. It enables you to protect the programs against the loss of a single disk in the striped volume. In addition, the read performance improves because of the concurrency of the reads across the disks that make up the RAID-5 volume.

In an environment in which frequent updates to the information occur, using mirrored volumes is usually better. However, you can use a RAID-5 volume if you want redundancy and if the storage overhead cost of a mirror is prohibitive.

Notes

  • Fault-tolerant disk structures from Windows NT 4.0, such as mirror sets or striped sets with parity, are still supported. For information on maintaining them, see Using mirror sets and stripe sets with parity. If you want to convert them into mirrored or RAID-5 volumes, see To upgrade a basic disk to a dynamic disk.
  • Operating systems such as MS-DOS that do not have fault-tolerance functionality cannot recognize the volumes that Windows 2000 Server creates for fault tolerance. Therefore, if you mirror your MS-DOS system volume on a dual-boot computer, MS-DOS cannot use or start either volume. Also, as a precaution, create a boot disk so that you can start your computer from the mirrored volume if the system volume is lost.


Uninterruptible power supplies (UPS)

A UPS provides power when the local power fails. It is usually rated to provide a specific amount of power for a specific period of time. This power comes from batteries that are kept charged while main power is available. Usually, all that is needed from a UPS is time to shut down the system in an orderly fashion by quitting processes and closing sessions.

Many UPS devices can communicate with operating systems, enabling the operating system to notify users automatically of the pending shutdown process or provide notification that the power has been restored and a shutdown is no longer necessary.

During a power failure, the UPS service immediately pauses the Server service to prevent any new connections and sends a message to notify users of the power failure. The UPS service then waits a specified interval of time before notifying users to quit their sessions. If power is restored during the interval, another message is sent to inform users that power has been restored and normal operations have resumed.


Using fault-tolerant devices

This section covers:

  • Using RAID
  • Using UPS


Using RAID

This section covers:

  • Using mirrored volumes
  • Using RAID-5 volumes
  • Repairing RAID disks


Using mirrored volumes

Mirrored volumes, called mirror sets in Windows NT 4.0, provide an identical copy for a selected disk. Because all data written to the primary disk is also written to a secondary or mirror disk, it uses only 50 percent of disk space. If one disk fails, the system uses data from the other disk.

Mirrored volumes protect a volume on a disk from media and, possibly, controller failure by maintaining a fully redundant copy on another disk. When a mirrored volume fails, you must break the mirrored volume to expose the remaining volume as a separate volume with its own drive letter. You can then create a new mirrored volume with unused free space of the same size or greater on another disk.

To create a mirrored volume, you create a volume using free space on another disk. If the second volume is larger, the remaining space becomes free space. The same drive letter is used for both volumes. Any existing volume, even the system and boot volumes, can be mirrored onto another volume of the same size, or greater, on another disk using either the same or a different controller. When creating mirrored volumes, it is best to use disks that are the same size, model, and manufacturer.

Mirrored volumes have better overall read and write performance than RAID-5 volumes. Another advantage of mirrored volumes over RAID-5 volumes is that there is no loss in performance when a member of a mirrored volume fails. Mirrored volumes are more expensive in terms of dollars per megabyte because disk space utilization is less. However, the entry cost of a mirrored volume is lower because it requires only two disks, whereas RAID-5 volumes require three or more disks.

Mirrored volumes reduce the chance of an unrecoverable error by providing a duplicate set of data, which doubles the number of disks required and the input/output (I/O) operations when writing to the disk. However, some performance gains are achieved for reading data because of I/O load balancing of requests between the two volumes.

When you want to use the space in a mirrored volume for other purposes, you must first break the mirrored volume relationship and then delete one of the volumes. Breaking the mirrored volume does not delete the information, but it is still safer to do a backup first.

In the case of an unrecoverable error on a volume within a mirrored volume, you need to break the mirrored volume relationship to expose the remaining volume as an individual volume. You can then reassign some free space on another disk to create a new mirrored volume.

For information about how to create, break, or repair a mirrored volume, or to add a volume to or remove a volume from an existing mirrored volume, see Manage mirrored volumes.

Figure showing a mirrored volume


Using RAID-5 volumes

RAID-5 volumes, called striping with parity in Windows NT 4.0, share data across all the disks in an array. RAID level 5 is unique because it writes the parity information to all the disks. Data redundancy is achieved by arranging a data block and its parity information on different disks in the array.

RAID-5 volumes have better read performance than mirrored volumes. However, when a member is missing, such as when a disk has failed, the read performance is degraded by the need to recover the data with the parity information.

Nevertheless, this strategy is recommended over mirrored volumes for applications that require redundancy and are primarily read-oriented. Write performance is reduced by the parity calculation. Also, a write operation requires three times more memory than a read operation during normal operation. Moreover, when a volume fails, reading requires at least three times more memory. Both conditions are caused by the parity calculation.

Understanding parity usage in RAID-5 volumes

The data redundancy method used in Windows 2000 for RAID-5 volumes is a function of the Boolean operation called exclusive OR, also called XOR. The important concept to remember about parity is that regeneration uses the parity information with the data on the good disks to re-create the data on the failed disk. RAID-5 fault tolerance maintains an XOR value of the total data. This enables the reconstruction of missing data (on a failed disk or sector) from the remaining disks in the RAID-5 volume.

RAID-5 volumes include one parity block per stripe. Therefore, you must use at least three, rather than two, disks to allow for the parity information. Parity stripes, as shown in the following illustration, are distributed across all the volumes to balance the I/O load.

RAID-5 provides data redundancy at a cost of only one additional disk for the volume. However, recovery from the failure of a disk in a RAID-5 volume is more time consuming than for a mirrored volume.

When you want to recover the space in a RAID-5 volume for other purposes, be sure to back up the information in it first, if you want to reuse that information. Then delete the volume.

For information about how to create and repair RAID-5 volumes, see Use RAID disks.

Figure showing a RAID-5 volume


Repairing RAID disks

You use the Windows 2000 fault-tolerance utilities to recover quickly and easily from problem situations. Using mirrored volumes, you have instant access to another disk with a redundant copy of the information on a failed disk. With RAID-5 volumes you can regenerate data by using the parity stripe if a disk fails. Bad-sector mapping capabilities enable the system to fix sector failures without user intervention.

This section briefly discusses how to recover data from a failed disk in a mirrored or RAID-5 volume and from sector failures:

  • Fixing mirrored volumes and RAID-5 volumes
  • Fixing sector failures


Fixing mirrored volumes and RAID-5 volumes

When a member of a mirrored volume or a RAID-5 volume fails, it becomes an orphan. Windows then determines that it can no longer use it and directs the reading and writing of all new data to the remaining members of the fault-tolerance volume.

When a member of a mirrored volume is orphaned, you must first break the mirrored volume relationship to expose the remaining volume as a separate volume. The remaining working member of the mirrored volume receives the drive letter that was previously assigned to the complete mirrored volume. The orphaned volume receives the next available drive letter or whatever letter you want to assign to it.

You can then create a new mirrored volume relationship from unused free space on another disk. When you restart the computer, the data from the good volume is copied to the new member of the mirrored volume.

For information about repairing a mirrored volume, see Repairing a dynamic mirrored volume.

When a member of a RAID-5 volume is orphaned, you can regenerate the data for the orphaned member from the remaining members. In Disk Management, select a new area of free space that is the same size as or larger than the other members of the RAID-5 volume, and then regenerate the data. If you are required to restart the computer, the fault-tolerance driver reads the information from the stripes on the other member disks and then re-creates the data of the missing member and writes it to the new member.

To regenerate a RAID-5 volume, the volume must be locked by the operating system. All network connections to the volume are lost when a volume is regenerated.

For information about repairing a RAID-5 volume, see Repairing a dynamic RAID-5 volume.

Note

  • The comments in this section regarding RAID-5 volumes and mirrored volumes on dynamic disks also apply to stripe sets with parity and mirror sets on basic disks.


Fixing sector failures

The file system verifies all sectors when it formats a volume. All faulty sectors are spared from service. Windows 2000 fault-tolerance services add sector-recovery capabilities to the system.

When a sector I/O failure occurs in a fault-tolerant system with redundant copies of the data, the fault-tolerance driver attempts to spare the bad sector from use. Small Computer System Interface (SCSI) devices can do this, but AT devices, such as Integrated Device Electronics (IDE) and Enhanced Small Device Interface (ESDI), cannot.

When the sector cannot be spared, the correct information obtained from the redundant copy is returned to the file system with a status message disclosing a faulty sector in the I/O. The file system then attempts to locate the failure and spare the bad sectors by removing them from the sector map of the file system. An error message is logged in Event Viewer about the potential for data loss if the partition containing the redundant copy also fails.

You can also use Disk Management to check for errors on your disk. In Properties for the disk, on the Tools menu, click Error-checking.


Using UPS

This section covers:

  • Using a UPS device with Windows
  • Running a command file upon UPS shutdown


Using a UPS device with Windows

You should use the following Windows services in combination with the uninterruptible power supply (UPS) device that you select for your computer: UPS, Alerter, Messenger, and Event Log. For other recommendations, see Best practices.

To configure the UPS service, in Control Panel, click UPS. You should base the configuration on the features supported by the UPS device that you are using. The three features that Windows 2000 supports are:

  • Main-power failure detection.
  • Low-battery detection.
  • UPS shutdown capability.

To determine the correct settings, read the user's manual for your UPS device carefully, or contact the manufacturer. Based on the features supported by the UPS, you might have to enter additional settings under UPS Characteristics in the UPS dialog box.

The UPS service can be controlled in several ways. One way is to configure the settings in the UPS dialog box. A message appears and asks whether you want to start the UPS service. Another way to start the service is to click Services in Control Panel.

The Alerter and Messenger services are started automatically when Windows 2000 starts. The Alerter service sends alerts to selected users, and the Messenger service sends messages to your local Windows 2000–based computer and to other users on the network. All detected power fluctuations and power failures are recorded in the event log, along with UPS service start failures and server shutdown initiations.

To ensure that the computer is protected from power failures, test it by simulating a power failure; that is, by disconnecting the main power supply to the UPS device. Your computer and peripherals connected to the UPS device should remain operational, messages should be displayed, and events logged. Wait until the UPS battery reaches a low level to verify that a graceful shutdown occurs. Restore the main power to the UPS device, and check the event log to verify that all actions were logged and there were no errors.


Running a command file upon UPS shutdown

You can define command files for the Windows uninterruptible power supply (UPS) service. However, you should specify a command file only if your system requires special actions prior to a system shutdown. For example, if you have a custom program running that is connected to another computer, you can use the command file to end the session and log off the connected computer automatically prior to system shutdown.

You cannot specify a command file that causes a dialog box to appear because dialog boxes that require user input can impede a graceful system shutdown.

The command file must reside in your Systemroot\System32 directory and have one of the following extensions: .exe, .com, .bat, or .cmd. For help with running a command file, see To configure a UPS.

Note

  • The command file must finish running in 30 seconds. A run time that is greater than 30 seconds threatens the capability of Windows to complete a graceful system shutdown. You should test the operation of the command file under a worst-case scenario.


Resources

  • Windows 2000 Server family at Microsoft Windows (http://www.microsoft.com/)
  • Microsoft Windows Hardware Compatibility List at the Microsoft Web site (http://www.microsoft.com/)
  • Microsoft TechNet at Microsoft TechNet (http://www.microsoft.com/)
  • Microsoft TechNet compact disks
  • Microsoft support at the Microsoft Web site (http://www.microsoft.com/)
  • Getting Started for Windows 2000 Server
  • Windows 2000 Server Resource Kit
  • Windows 2000 Server Registry
  • Updated technical information


Troubleshooting

What problem are you having?

A mirrored volume's status is Failed Redundancy

Cause: One or both of the members of the mirrored volume has failed, and the volume is no longer fault tolerant.

Solution: If the disk's status is Offline, see To reconnect the disk and repair the mirrored volume. If the disk's status is Online (Errors), see To reactivate the disk. The disk's status might be Missing if it cannot be accessed at all.

The RAID-5 volume's status is Failed Redundancy

Cause: One or all of the members of the RAID-5 volume has failed and the volume is no longer fault tolerant.

Solution: If the disk's status is Offline, see To reconnect the disk and repair the RAID-5 volume.


Disaster recovery

Disaster recovery includes how to prepare for system problems, how to use options that can help start a system that otherwise would not start, and how to use the repair and recovery options available in Windows 2000.

  • To prepare for disaster recovery, see Checklists.
  • To find features that have been moved in Windows 2000 Server, see New ways to do familiar tasks.
  • For tips about using disaster recovery, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklists

  • Checklist: Safeguarding your system
  • Checklist: Recovering a system that will not start


Checklist: Safeguarding your system

You can take a number of steps as safeguards against the possibility of disk failure or other serious system problems.

Step | Reference
Specify what you want Windows 2000 to do if the system stops unexpectedly. For example, you can specify that you want your computer to restart automatically and that it can control logging options. | Specify what Windows 2000 does if the system stops unexpectedly
Keep a set of boot disks for Windows 2000 where they can be accessed. This can be either the compact disc (CD) for Windows 2000 (for computers that can start from the CD drive) or a set of floppy disks that you create from the CD. | To create boot disks
Use Backup to create an Emergency Repair Disk. | To create an Emergency Repair Disk


Checklist: Recovering a system that will not start

Step | Reference
Try safe mode and related startup options, which you can use to start the system with only the minimal necessary services. | Safe mode startup options
An option to consider if safe mode does not help is the Recovery Console. This option is recommended only for advanced users or administrators. | The Recovery Console To start the computer and use the Recovery Console
If safe mode and the Recovery Console are not workable in your situation, and if you made appropriate advance preparations, you can try the Emergency Repair Disk option. | To use an Emergency Repair Disk for system repairs


Best practices

  • Separating the boot and system volumes
    Put the Windows 2000 Server system and boot volumes and the data volumes on separate drives. This greatly simplifies recovery if a disk is damaged.
  • Saving the disk configuration
    Save the disk configuration data each time you change the configuration using Disk Management.
  • Keeping a written record
    Keep a written record of disk volumes and their sizes to have during disk recovery. Attach this information to the front of each disk drive.


How to...

  • Safeguard a system
  • Recover a system that will not start


Safeguard a system

  • Create boot disks
  • Create an Emergency Repair Disk


Create boot disks

To create boot disks

  1. Obtain four blank, formatted, 3.5-inch, 1.44-megabyte (MB) floppy disks.
  2. Insert one of the disks into the floppy disk drive on a computer running any version of Windows or MS-DOS.
  3. Insert the Windows 2000 compact disc (CD) into the CD-ROM drive.
  4. Click Start, and then click Run.
  5. In the Open box, type d:\bootdisk\makeboot a: (where d is the drive letter assigned to your CD-ROM drive), and then click OK.
  6. Follow the screen prompts.

Notes

  • Disks created from the Windows 2000 Professional CD cannot be used with Windows 2000 Server; the reverse combination also does not work.
  • Before deciding that a computer must be started from a CD or floppy disks, you should first try starting in safe mode on that computer.
  • After starting a disabled computer from floppy disks, you can then use the Recovery Console or the Emergency Repair Disk (if you have prepared one).

Related Topics


Create an Emergency Repair Disk

To create an Emergency Repair Disk

  1. Obtain a blank, formatted 1.44-megabyte (MB) floppy disk.
  3. On the Welcome tab, click Emergency Repair Disk.
  4. Follow the instructions that appear on your screen.

Important

  • When you complete Setup, information about your original system settings is saved in the systemroot\Repair folder on the system partition. If you use the Emergency Repair Disk to repair your system, the information in this folder can be accessed. You must not change or delete this folder.

Note

  • To open Backup, click Start, point to Programs, point to Accessories, point to System Tools, and then click Backup.

Related Topics


Recover a system that will not start

  • Start Windows 2000 in safe mode
  • Start Windows 2000 using the Last Known Good Configuration
  • Start your computer at a command prompt
  • Start the computer and use the Recovery Console
  • Use an Emergency Repair Disk for system repairs


Start the computer and use the Recovery Console

To start the computer and use the Recovery Console

  1. Insert the Windows 2000 Setup compact disc (CD), or the first floppy disk you created from the CD, in the appropriate drive:
    • For systems that cannot start (boot) from the CD drive, you must use a floppy disk.
    • For systems that can start (boot) from the CD drive, you can use either the CD or a floppy disk.
  2. Restart the computer, and if using floppy disks, respond to the prompts that request each floppy disk in turn.
  3. When the text-based part of Setup begins, follow the prompts; choose the repair or recover option by pressing R.
  4. When prompted, choose the Recovery Console by pressing C.
  5. Follow the instructions on the screen for reinserting one or more of the floppy disks you created for starting the system.
  6. If you have a dual-boot or multiple-boot system, choose the Windows 2000 installation that you need to access from the Recovery Console.
  7. When prompted, type the Administrator password.
  8. At the system prompt, type Recovery Console commands; type help for a list of commands, or help commandname for help on a specific command.
  9. To exit the Recovery Console and restart the computer, type exit.

Important

  • Because the Recovery Console is quite powerful, it is recommended for use only by advanced users or administrators.

Related Topics


Use an Emergency Repair Disk for system repairs

To use an Emergency Repair Disk for system repairs

  1. Insert the Windows 2000 Setup compact disc (CD), or the first floppy disk you created from the CD, in the appropriate drive:
    • For systems that cannot start (boot) from the CD drive, you must use a floppy disk.
    • For systems that can start (boot) from the CD drive, you can use either the CD or a floppy disk.
  2. Restart the computer, and if using floppy disks, respond to the prompts that request each floppy disk in turn.
  3. When the text-based part of Setup begins, follow the prompts; choose the repair or recover option by pressing R.
  4. When prompted, insert the Windows 2000 Setup CD in the appropriate drive.
  5. When prompted, choose the emergency repair process by pressing R.
  6. When prompted, choose between the following:
    • Manual Repair (press M): This should be used only by advanced users or administrators. Use this option to choose whether you want to repair system files, partition-boot sector problems, or startup environment problems.
    • Fast Repair (press F): This is the easiest option, and does not require input. This option will attempt to repair problems related to system files, the partition boot sector on your system disk, and your startup environment (if you have a dual-boot or multiple-boot system).
  7. Follow the instructions on the screen and, when prompted, insert the Emergency Repair Disk in the appropriate drive.

    During the repair process, missing or corrupted files are replaced with files from the Windows 2000 CD or from the systemroot\Repair folder on the system partition. Replacement files from either of these sources will not reflect any configuration changes made after setup.

  8. Follow the instructions on the screen; you might want to write down the names of files that are detected as faulty or incorrect, to help you diagnose how the system was damaged.
  9. If the repair was successful, allow the process to complete; it will restart the computer.

    The restarting of the computer indicates that replacement files were successfully copied to the hard disk.

Important

  • Because the emergency repair process is quite powerful, it is recommended for use only by advanced users or administrators.

Related Topics


Concepts

  • Disaster recovery overview
  • Understanding disaster recovery
  • Using disaster recovery options
  • Resources


Disaster recovery overview

A computer disaster is any event that makes a computer unable to start or continue running. The causes of computer disasters range from failure of a piece of hardware to a complete system loss, such as in the case of fire or other similar events. When Windows 2000 encounters such an event, it might report a STOP error, and display the information necessary for you and a Microsoft Product Support Services engineer to locate and identify problem areas.

Disaster recovery is the restoration of a computer so that you can log on and access system resources after a computer disaster has occurred. Windows 2000 provides the following options to help you identify and recover from computer disasters:

Safe mode
You use safe mode startup options to start the system with only the minimal necessary services. Safe mode options, including Last Known Good Configuration, are especially useful if a newly installed device driver is causing problems with starting the system. For more information, see Safe mode startup options.

Recovery Console
An option to consider if safe mode does not help is the Recovery Console. This option is recommended only for advanced users or administrators. The method for starting the system is to use the Setup compact disc (CD) or floppy disks you created from the CD. Then, you can access the Recovery Console, a command-line interface from which you can perform tasks such as starting and stopping services and accessing the local drive (including drives formatted with the NTFS file system). For more information, see The Recovery Console.

Emergency Repair Disk
If safe mode and the Recovery Console are not workable in your situation, and if you made appropriate advance preparations, you can try to repair your system with the Emergency Repair Disk. The Emergency Repair Disk can help you repair core system files.


Understanding disaster recovery

This section covers:
  • Safe mode startup options
  • The Recovery Console
  • Emergency Repair Disk


The Recovery Console

If safe mode and other startup options do not work, you can consider using the Recovery Console; however, this method is recommended only if you are an advanced user or administrator who can use basic commands to identify and locate problem drivers and files. The Recovery Console is a command-line console that you can use after starting the computer with the Setup compact disc (CD)—if the computer's CD drive allows this—or with floppy disks you created from the CD. For information about how to create floppy disks from the Setup CD, see To create boot disks.

To use the Recovery Console, you need to log on to the Administrator account. This console provides commands you can use to do simple operations such as changing to a different directory or viewing a directory, and more powerful operations such as fixing the boot sector. You can access Help for the commands in the Recovery Console by typing help at the Recovery Console command prompt.

Using the Recovery Console, you can start and stop services, read and write data on a local drive (including drives formatted with the NTFS file system), copy data from a floppy disk or CD, format drives, fix the boot sector or master boot record, and perform other administrative tasks. The Recovery Console is particularly useful if you need to repair your system by copying a file from a floppy disk or CD-ROM to your hard drive, or if you need to reconfigure a service that is preventing your computer from starting properly. For example, the Recovery Console could be used to replace an overwritten or corrupted driver file with a good copy from a floppy disk.

Important

  • Because the Recovery Console is quite powerful, it is recommended for use only by advanced users or administrators.


Emergency Repair Disk

You can use the Windows 2000 Emergency Repair Disk (ERD) to fix problems preventing you from starting your computer.

By preparing an ERD when your computer is functioning well, you can be prepared to use it if you need to repair system files. (In this situation, to start a computer that needs repair, you use the Windows 2000 Setup compact disc or floppy disks you created from the compact disc.) The repairs possible with this method are limited to basic system files, the partition boot sector, and the startup environment. The repair process does not recover the registry. To replace registry files, use the Recovery Console. The Emergency Repair Disk does not back up data or programs, and is not a replacement for regularly backing up your system.

For more information, see To create an Emergency Repair Disk and To use an Emergency Repair Disk for system repairs.


Using disaster recovery options

  • Fixing a boot failure
  • Tools and techniques


Fixing a boot failure

If the system or boot volume of a disk fails, the system will not start. The process used to recover from a startup failure depends on the disk configuration.

Before you can start Windows from the mirror of a failed system or boot volume, you need to add an ARC path entry to the Boot.ini file on your boot disks. When the mirror of the boot or system volume is created in Disk Management, the system automatically displays the correct ARC path for the mirrored volume. You can write this path down and use it to correctly modify the boot.ini file. For an explanation of the ARC path, see the Windows 2000 Server Resource Kit.

Boot disks

To make Windows boot disks, see To create boot disks. After you have created the boot disks, you should test them in advance of any failure, or you might not be able to start your computer from the mirrored volume if the primary disk is lost. Check your boot disks by using them to boot the system from the mirrored volume. Test the disk with the primary disk powered on and then with the primary disk powered off. In both cases, if you can log on, the boot disks work.

You should update the boot disk every time volumes are changed. For example, if you are using volume 2 to start and you delete volume 1, you must change the ARC name to start using volume 1. Likewise, if you are starting on volume 2 and you delete volume 1 and split it into volumes 1 and 2, you must change the ARC name to start using volume 3.

Maintaining the boot configuration

After Windows starts successfully, back up the configuration directory (\Systemroot\System32\Config), and maintain current backups as you change the configuration and accounts. The registry is made up of the files in the configuration directory.

If you have to use the Repair process in Windows Setup to restore the registry files, you can restore the configuration from your backup.

Never delete Boot.ini, Ntldr, Bootsect.dos, Ntdetect.com, or Ntbootdd.sys (if Windows is installed on a SCSI disk) in the root directory of the system volume.

If you made changes to a system that previously started Windows successfully and now it does not start, you can return to your previous configuration by selecting Last Known Good Configuration at system startup. If Windows still does not start, use the Repair process in Windows Setup to restart the system. After the system is restarted, you can restore data by using backup tapes.

Repairing Config.nt and Autoexec.nt

If Windows displays an error message concerning these files, or if you have problems running MS-DOS–based programs, check whether Config.nt or Autoexec.nt is incorrect or missing. The files are located in the \Systemroot\System32 directory.

If the files are incorrect or missing, you can copy new versions from the boot disks to the \System32 directory.


Tools and techniques

The following system diagnosis, recovery, and repair options are available with Windows 2000:

  • Using Windows 2000 System Information to diagnose configuration problems.
  • Specifying how Windows 2000 Server records and responds to severe errors, by using the settings under Recovery on the Startup/Shutdown tab of System in Control Panel.
  • Restoring the previous working configuration by using the Last Known Good Configuration.
  • Using safe mode boot to restore basic system operation.
  • Restoring corrupted or missing system files, as well as the boot sector and configuration information by using the Repair process in Windows 2000 Setup.
  • Creating and using a boot disk to start the computer after failure of the primary volume. For details, see Fixing a boot failure.

Windows 2000 System Information

You can use Windows 2000 System Information, the diagnostic tool for Windows 2000, to view and print configuration information for a local or network computer. Windows 2000 System Information is located under System Tools in the Computer Management snap-in available in Administrative Tools.

By using Windows 2000 System Information, you can view the following:

  • Resource conflicts and sharing
  • Operating system information, such as the version number and system boot options, plus process, system, and user environment variables
  • Hardware details such as BIOS information, video resolution, CPU type, and CPU steppings
  • Physical memory, paging file information, and direct memory access (DMA) usage
  • The current state of each driver and service on the computer
  • Drives and devices installed on the computer, plus related interrupt (IRQ) and port information
  • Network information, including transports, configuration settings, and statistics
  • Printer settings, font settings, and system processes that are running

System failure reporting

When a severe error (called a STOP error) occurs, by default the system does the following:

  • Writes an event to the system log
  • Alerts administrators
  • Dumps system memory to a file you can use for debugging
  • Automatically restarts the server

Fatal system errors cause less server downtime because Windows 2000 Server automatically restarts rather than waiting for administrator intervention.

The dump of system memory to a log file can be valuable for debugging the cause of the STOP error. If you contact your technical support representatives about the error, they might ask for the log file. Notice that Windows 2000 writes the log file to the same file name (Memory.dmp, by default) each time a STOP error occurs. To preserve log files, you should copy them to a new file name after the computer restarts. For information about how to configure recovery options, see Choosing recovery actions to occur if Windows 2000 stops unexpectedly.

Last Known Good Configuration

If you encounter difficulty starting Windows after you install a new driver or change a driver configuration, you can start Windows using the Last Known Good Configuration. When you do this, the configuration is as it was before you made the changes that prevented it from starting. All configuration changes that were made since your system was last successfully started are lost. For information about starting Windows 2000 using the Last Known Good Configuration, see Start Windows 2000 using the Last Known Good Configuration.

Safe mode boot

If your computer will not start, you may be able to start it in safe mode. In safe mode, Windows 2000 uses default settings (VGA monitor, Microsoft mouse driver, no network connections, and the minimum device drivers required to start Windows). For information about starting Windows 2000 in safe mode, see To start Windows 2000 in safe mode.

Other error-detection tools

Some other ways in which Windows 2000 Server reports errors and preserves your system configuration and data include the following:

  • If your system uses the NTFS file system, Windows 2000 Server logs all file transactions, replaces bad clusters automatically, and stores copies of key information for all files on the NTFS volume.
  • Services and programs record events, including errors, in the event logs that you can view in Event Viewer. For information about Event Viewer, see Using Event Viewer.
  • The Alerter and Messenger services work together to provide warnings on printer, security, and user session problems. These services also provide server shutdown warnings if the system uses the UPS service. For information on uninterruptible power supplies, see Using UPS.
  • Performance Logs and Alerts can be configured to create an alert log for monitoring performance and generating network alerts. For information about Performance Logs and Alerts, see Performance Logs and Alerts overview.
  • The chkdsk command examines disk space and use for the NTFS and file allocation table (FAT) file systems. If there are errors on the disk, chkdsk alerts you and corrects the errors if the /f switch is used. If files are open when chkdsk is attempting to correct disk errors, you can have chkdsk automatically check the disk and correct errors the next time the computer restarts. For more information about running chkdsk, see Chkdsk.

Important

  • Using chkdsk to repair file system errors or bad sectors on very large volumes can render the volume inaccessible for several days.
  • You can use Dr. Watson for Windows to detect, diagnose, and log application errors for use by technical support personnel. To run Dr. Watson, type start drwtsn32 at the command prompt. Press F1 for Help on setting up and using Dr. Watson.


Resources

  • Windows 2000 Server family at Microsoft Windows (http://www.microsoft.com/)
  • Microsoft TechNet at Microsoft TechNet (http://www.microsoft.com/)
  • Microsoft TechNet compact disks
  • Microsoft support at Microsoft Web site (http://www.microsoft.com/)
  • Getting Started for Windows 2000 Server
  • Windows 2000 Server Resource Kit
  • Windows 2000 Server Registry
  • Updated technical information


Troubleshooting

What problem are you having?

My computer stops and displays a long message beginning with the word STOP.

Cause: Windows has encountered an error from which it cannot recover, and to prevent file damage, has stopped operating.

Solution: For general instructions on troubleshooting STOP messages, see Troubleshooting STOP messages: general strategies. For specific instructions on troubleshooting STOP messages, see Troubleshooting specific STOP messages.

See also How often to defragment a volume, and To defragment a volume.

My computer supports starting directly from the CD-ROM drive. However, when I try to start from the Windows 2000 compact disc, nothing happens.

Cause: To start your computer directly from the Windows 2000 compact disc, your computer's BIOS must support the El Torito Bootable CD-ROM (no emulation mode) format. Your BIOS may not support that format.

Solution: Check with your computer manufacturer if you are unsure whether your BIOS has this feature. The BIOS specifies the boot order. The CD-ROM should be listed as the first boot device.


New ways to do familiar tasks

The following table compares familiar Windows NT 4.0 disaster recovery tasks with the equivalent tasks in Windows 2000.
If you want to | In Windows NT 4.0 use | In Windows 2000 use
Create an Emergency Repair Disk | Rdisk command in Start menu. | Backup in System Tools. For more information, see To create an Emergency Repair Disk


Use the Recovery Console from a computer running Windows 2000

To use the Recovery Console from a computer running Windows 2000

  1. Insert the Windows 2000 compact disc (CD) into the CD drive.
  2. Click File, and then click Run.
  3. In the Open box, type the command:

    d:\i386\winnt32 /cmdcons (where d is the drive letter assigned to your CD-ROM drive)

  4. If you have a dual-boot or multiple-boot system, choose the Windows 2000 installation that you need to access from the Recovery Console.
  5. When prompted, type the Administrator password.
  6. At the system prompt, type Recovery Console commands; type help for a list of commands, or help commandname for help on a specific command.
  7. To exit the Recovery Console and restart the computer, type exit.

Important

  • Because the Recovery Console is quite powerful, it is recommended for use only by advanced users or administrators.

Related Topics