How Windows RE Works
This topic describes how Windows RE works, specifically the automatic failover behavior, manual diagnosis and repair process and how Startup Repair tool works.
Automatic Failover
A computer running Windows Vista can automatically fail over into the on-disk Windows RE only if a boot failure is detected. At startup, the Windows loader sets a status flag to indicate that the boot process has started, and this flag is typically cleared before the Windows logon screen is displayed. If the boot attempt fails, the flag is not cleared. The next time the computer starts, the loader detects the flag and assumes that a boot failure occurred. When this happens, the loader launches Windows RE instead of Windows Vista.
Note
The detection of boot failure relies on boot completion and not on whether an error occurred in Windows Vista. One example of a false-positive is when power is lost during the boot process, and Windows RE is launched even though the Windows installation is bootable.
Because the failover mechanism relies on the Windows boot manager and Windows boot loader, some failures will render Windows RE inaccessible. In the following scenarios, the user must use bootable Windows RE media to recover the computer:
- Disk metadata corruption in the master boot record (MBR), partition table, or boot sector of Windows RE partition.
- Missing or corrupt boot manager.
- Missing or corrupt boot configuration data.
Sometimes the boot status flag cannot be read or written to by the boot loader, in which case Windows will not automatically fail over into Windows RE. However, the user can still manually launch into the on-disk Windows RE through the F8 menu.
Manual Diagnosis and Repair
When starting from a Windows RE CD/DVD or using the F8 advanced boot option menu to launch the on-disk Windows RE, the user can manually launch various system recovery tools:
- Startup Repair (when not launched automatically)
- System Restore (on rollback, by using existing restore points)
- Windows Backup Disaster Recovery (to restore from a volume backup image)
- Command prompt, from which all standard Windows PE console tools, such as Regedit and ChkDsk, are available
- Custom OEM support/recovery tool
Startup Repair
Startup Repair is a tool that automates common diagnostic and repair tasks of unbootable Windows Vista installations. If the computer fails over into Windows RE because of a detected boot failure, Startup Repair launches automatically. If automatic failover to an on-disk Windows RE is not available, Startup Repair can also be launched as a manual recovery tool from a Windows RE CD/DVD.
Startup Repair Process
Startup Repair will try to repair computers that are unbootable because of the following reasons:
- Registry corruption
- Missing or damaged system and driver files
- Disk metadata corruption (MBR, partition table, and boot sector)
- File system metadata corruption
- Installation of problematic or incompatible drivers
- Installation of incompatible Windows service packs and patches
- Corrupt boot configuration data
- Bad memory and hard disk hardware (detection only)
Startup Repair will not repair unbootable systems caused by the following issues:
- Malfunctioning firmware and other hardware components
- Problems with clean Windows installations or Windows upgrades (for example, from Windows XP to Windows Vista)
- Windows logon errors
- Viruses and malicious software
Startup Repair Log
After Startup Repair has run, a text log with diagnostic information and repair results is generated. This log file is located at %WINDIR%\System32\LogFiles\Srt\SrtTrail.txt.
The log file begins with information about the diagnostic and repair session, such as in the following example.
Session Summary:
System Disk = \Device\Harddisk0
WinDir = C:\windows
AutoChk Run = 0
Root causes = 1
The following table describes these fields.
| Field | Description |
|---|---|
System Disk |
Device path of the disk on which the Windows installation is located. |
WinDir |
Full path of the Windows installation to be repaired. |
AutoChk Run |
A non-zero value indicates that AutoChk was run during Windows PE boot. |
Root causes |
Number of root causes found during diagnostics. |
The next section of the log file contains diagnostic tasks performed. For example,
Test Performed:
---------------------------
Name: Software installation log diagnosis
Result: Completed successfully. Error code = 0x0
Time taken = 125 ms
Test Performed:
---------------------------
Name: ACL test
Result: Completed successfully. Error code = 0x0
Time taken = 18200 ms
The following table describes these fields.
| Field | Description |
|---|---|
Name |
Name of the diagnostic task performed. |
Result |
Textual description of whether the test completed successfully. |
Error code |
Win32 return code of the diagnostic procedure. A value of 0x0 indicates that the specified test ran successfully. |
Time taken |
The amount of time, in milliseconds, spent on the diagnostic step. |
The following table describes the diagnostic tasks performed by Startup Repair.
| Diagnostic task | Description |
|---|---|
Disk metadata test |
Verifies the integrity of the MBR, partition table, and boot sector. |
Determine target OS |
Extracts the location of the Windows installation from the Boot Configuration Data (BCD). |
Registry hives test |
Verifies the integrity of the registry hives. |
Quick volume metadata test |
Verifies that the Windows directory exists. |
Event log diagnosis |
Checks the Event Log for recent changes to Windows. |
Boot status test |
Verifies that Windows did not start successfully |
Setup state check |
Checks whether the failure occurred during Windows installation. |
Bugcheck analysis |
Analyzes available crash dumps created during the failed startup attempt. |
Software installation log diagnosis |
Checks whether Windows updates have recently been installed. |
Disk failure diagnosis |
Checks the Self-Monitoring, Analysis, and Reporting Technology (SMART) status on the hard disk hardware. |
Chkdsk |
Runs Chkdsk to identify file system metadata problems. |
Binary file integrity test |
Verifies the integrity of system files required for startup. |
ACL test |
Verifies that system files required for boot have the correct access control list (ACL). |
Root Causes
When the root cause of the startup failure is found, the details and resulting actions are included in the log file. For example,
Root cause found:
---------------------------
ACLs on file C:\windows\system32\user32.dll are not proper. Old value = 0xd015f
Repair action: ACLs fix
Result: Completed successfully. Error code = 0x0
The following table describes these fields.
| Field | Description |
|---|---|
Root cause found |
Textual description of the problem. |
Repair action |
Name of the repair action taken. |
Result |
Textual description of the repair action's success or failure. |
Error code |
Win32 return code of the repair procedure. A value of 0x0 indicates that the specified repair completed successfully. |
The following table lists the possible root causes for startup failures.
| Root Cause | Description |
|---|---|
Boot manager failed to find OS loader. |
Winload.exe is missing or cannot be accessed. |
Boot configuration is corrupt. |
The boot configuration file is missing or it contains no valid operating system entry. |
Boot critical file <filename> is missing. |
The specified file required for startup is missing. |
Boot critical file <filename> is corrupt. |
The specified file required for startup is corrupt. |
Several boot critical files are corrupt. |
Multiple files required for startup are corrupt. |
Registry is corrupt. |
A registry hive fails to load. |
Unknown bugcheck <code>. Parameters = <param1>, <param2>, <param3>, <param4>. |
The system crashed during startup with the specified bugcheck error. |
Driver <drivername> is preventing the system from starting. |
The specified driver is missing or corrupt. |
A recent driver installation or upgrade may be preventing the system from starting. |
An incompatible driver was installed prior to the startup failure. |
A patch is preventing the system from starting. |
An update to the operating system was installed prior to the startup failure. |
ACLs on file <filename> are not proper. Old value = <value> |
The specified file cannot be accessed due to an incorrect ACL. |
The partition table does not have a valid System Partition. |
The system partition listed in the partition table does not contain the required system files. |
MBR is corrupt. |
The MBR on the system disk is corrupt. |
Partition table is corrupt on disk <drivenumber>. |
The partition table on the specified disk does not contain any valid entries. |
Boot sector for system disk partition is corrupt. |
The boot sector information is not valid. |
Boot sector code for system disk partition is corrupt. |
The boot sector code does not match the default boot sector. |
System volume on disk is corrupt. |
The system volume cannot be accessed. |
No OS files found on disk. |
The Windows directory does not contain a valid Windows installation. |
Boot manager is missing. |
The boot manager can not be found on the system partition. |
A hard disk could not be found. If a hard disk is installed, it is not responding. |
Cannot detect any installed hard disk. This is only available when running Windows RE from CD/DVD. |
Security settings on this computer are preventing Windows from starting. |
Windows is unable to audit the system. |
System partition has an unknown file system type. |
The system partition is formatted using a file system type that Windows does not recognize. |
Boot status indicates that the OS booted successfully. |
Windows started successfully. This is a common scenario if a user manually launches Windows RE and runs Startup Repair. |
Failure while setup is in progress. |
The computer does not start due to a failed Windows installation process. |
The operating system version is incompatible with Startup Repair. |
The version of Windows does not match that of Startup Repair. For example, trying to repair Windows XP using Startup Repair will trigger this root cause. |
Repair Actions
The following table describes possible repair actions.
| Repair action | Description |
|---|---|
BCDMD |
Repairs the MBR, partition table, or boot sector. |
ChkDsk |
Runs ChkDsk in repair mode. |
File Repair |
Replaces the corrupt system file with a backup copy. |
BootCfg |
Reconstructs the BCD. |
System Restore |
Rolls back the system state by using System Restore. |
ACLs fix |
Sets the ACLs of the specified file to a default value. |
Registry rollback |
Replaces the corrupt registry hives with a backup copy. |
Change Crash on Audit Failure setting |
Disables Windows auditing. Only an administrator can log on to Windows. |
Memory Diagnostics |
Runs the Windows Memory Diagnostics tool. |
The following table describes the descriptions of the possible diagnostic or repair results.
| Result text | Description |
|---|---|
Completed successfully. Error code = 0x0 |
Diagnostic and repair processes finished without error. |
Failed. Error code = <errorcode> |
Diagnostic and repair processes failed with the specified error. |
Started but not completed |
Either the diagnostic process or the repair process was cancelled by the user. |