Do you find the Support WebCast transcripts helpful?
Let us know!

Note This document is based on the original spoken WebCast transcript. It has been edited for clarity.

George Vordenbaum: My name is George Vordenbaum. I'm a Systems Content Developer in the GSA Group. What we're going to look at today is the Microsoft^® Windows^® XP Boot Options and Recovery Console. With that in mind, let's get started.

In this presentation we will discuss the Advanced Options (slide 2) menu that is available to you during Windows XP startup, as well as the Recovery Console Utility and its associated commands.

We're going to focus mainly on the consumer-level product. We won't go into a great detail on some of the other advanced tools, such as the debugger or the redirect. We'll briefly talk about them, but we'll spend more time on the more common utilities you'd use to support troubleshooting the client.

Windows XP does provide an options menu to help you troubleshoot those issues that prevent Windows XP from booting into normal mode. The Recovery Console utility does allow you to repair those situations where you cannot boot into Windows XP normally or when you can't get into safe mode. It gives you various commands that allow you to perform such maintenance tasks as formatting your drive, creating and deleting partitions, and other things such as rerouting the master boot record. It also gives you access to the secure NTFS file system.

Let's go on to the next slide (slide 3). What we'll look at first are the boot options that are available, and you select the mode. There's safe mode, safe mode with networking, safe mode with command prompt, Enable Boot Logging, Enable VGA Mode, and Last Known Good Configuration. If you're accustomed to Windows 98 or Windows Millennium, there is no option for Step-by-Step, if you've seen that before. Actually, the boot process is different in Windows NT^®.

In troubleshooting Windows XP it does help to understand the boot process. We're going to assume you have a good idea of that in this discussion today. There are articles available to you if you need to learn a little bit more about how Windows XP boots.

When looking at the different options for safe mode, these options allow you to boot into a basic state of Windows XP when you're having problems booting normally. We'll look in more detail at Enable Boot Logging and Enable VGA Mode. As a general rule though, you want to always troubleshoot these problems booting into normal mode by using the safe mode interface.

If you are unable to boot into safe mode, then that's when you want to consider using Recovery Console. That's going to be a theme throughout this WebCast. Any time you are troubleshooting problems with start up, safe mode is the first place you want to go, as opposed to Recovery Console.

Let's now look at the additional options that are available to you (slide 4). As I talked about briefly, there is the Directory Services Restore Mode, which is for domain controllers only. It is displayed on all machines because the Windows NT loader hasn't really been loaded at this point in the boot process, so the note portion of the registry is where we're going to look to determine the status of this machine. That option will appear on all Windows XP clients, as well as members of the server family. Again, it's only used for domain controllers and only when you're in a repair/recovery mode. It's a little beyond the scope of our presentation today.

Another option you see there is the Debugging Mode, which sends debug information through a serial cable to another computer. This is the same as adding a debug switch and a debug port COM2 switch to the Boot.ini. That entry outputs the debug information for the kernel debugger. Again, that's really a more complicated process and it's outside of our scope here. I just wanted to let you know what those are when we see these in the options menu.

Some other options you'll see are Start Windows Normally and Reboot. If you have multiple operating systems installed, you'll also see the Return to the OS Choices Menu selection. Again, there's a screen shot here that shows you what you would see when you access the Windows Advanced Options Menu.

Now what we'll do is discuss these in a little more detail. Move on to the next slide (slide 5). There are several different ways you can start the boot options. If you are in Windows XP, you can use the Microsoft Configuration Utility, which is launched with Msconfig, and in there you set some parameters to boot. Pressing F8 during the boot process gives you the options for those situations you saw earlier. At other times, during certain system crashes it will automatically pop up, and you will have the option to try to boot to safe mode.

When we talk about the Configuration Utility, you are editing the Boot.ini to add those options, but you can do it manually as well: options such as safe boot, no GUI boot, boot log, and base video. We'll talk about some of those and the ways you use the advanced options, but they're available there as well.

As we move on to the next slide (slide 6), although we're really talking about the advanced boot menu options and Recovery Console today, it does help to know a little bit about safe mode, because that is where you'll do most of your troubleshooting, if you're having a problem booting into normal mode. That's what the advanced menu option is designed to give you.

Safe mode was never really an option in the Windows NT code base before Windows 2000 and Windows XP. There were some limited options similar to safe mode, such as the Last Known Good Configuration and Enable VGA Mode, which you saw on your boot options menu. Before Windows 2000, you didn't have a way to limit the drivers and the services in a fairly easy way.

Safe mode is a minimal startup mode, and it removes a lot of those pieces. If you can boot into safe mode, then you can start the process of elimination to determine what's going on. When you do boot though, if again you have multiple operating systems installed, then after choosing safe mode you'll be given the option to select what operating system you'd want to boot into. If you do have Windows NT 4.0 on your computer, you do not want to choose that as an option, because more than likely you'll get a blue screen error.

As I mentioned before, until Windows 2000, safe mode wasn't really implemented, and so the Windows NT code base or Windows NT 4.0 didn't really understand that. As for Windows 98, Windows Millennium, Windows 2000, and Windows XP, you can use safe mode. You won't encounter that error unless you are multibooting your system.

When we look at safe mode, what it provides us is a method to boot, a kind of stripped-down version of your normal startup. We load just a minimal list of drivers (slide 7). We use a standard VGA driver installed for your video card; that basic driver is 800 × 600 16-bit color, and it's always used. A lot of times when you're booting to normal mode and you have problems with your video, you may have problems with a third-party application that's loading, and so on. Safe mode is a good way to eliminate those problems.

We only load the core operating system services when it starts. So any kind of third-party services loading in the background that start when you boot normally generally won't start here. We're also going to bypass the startup group, which is where you can automatically load applications, and the run keys in the registry. Those are all places where other third-party programs that you install set themselves up to load automatically, and we try to eliminate those possibilities by booting into safe mode.

We do load some of the drivers for your hardware, such as your floppy disk, hard disk, and CD-ROM drive; again those are CLSID drivers, so USB, parallel port, and keyboard, and not the ones that are necessarily installed and running when you're in normal mode. We do not, however, load drivers for the serial ports or for IEEE 1394. So if you have an IEEE 1394 device or a serial mouse, you will lose functionality with your mouse when booting in safe mode. If you have USB or PS/2, you'll be fine, but just be aware of that; we do not load drivers for those others.

Now let's look at safe mode with networking (slide 8). Again, this is for network issues. It provides a stable environment with which you can test the networking environment. If you're having a problem connecting related to the Internet or a network, it will isolate that and allow you to test it without the third-party applications or services loading, as we talked about before. All your standard internal utilities for troubleshooting networking should function when you boot safe mode with networking. In other words, I'm talking about IPConfig, Ping, and things of that nature.

Basically, safe mode with networking is the same as a normal safe mode boot. We're adding the networking adapter drivers and some of the services you need for networking. It will load the Computer Browser, DHCP client, DNS client, Event log, messenger, network connections, server TCP/IP, Windows Management Instrumentation, and so on.

Another method you might use to boot the system, and boot into safe mode, would be the safe mode with command prompt (slide 9). That's what we're going to look at now. This provides an alternate shell from Explorer. When I say shell, that's when you boot into normal mode and you have your Start menu, your background, and all these types of things, and it's Explorer.exe that is loading.

With safe mode with command prompt we still load the 32-bit safe mode; it's a normal safe-mode boot. At the end of that we load Cmd.exe, which is a command prompt-type window, instead of Explorer. This is good to use if you're having issues right at the end of booting that could be related to the shell.

Again, it is a 32-bit environment, so all your tools and utilities are available to you from that command prompt. It's not a command prompt in the true sense of MS-DOS^®, if you're used to that. Think of it as though you booted into normal mode and you clicked Start, selected Run, and typed in the command to bring up the window. You have access to Regedit for troubleshooting. Again, it's basically the same. The only time you would use this is if you are narrowing it down to an issue, maybe with the Explorer.exe, the shell itself.

Let's look at some of the other options you have on that advanced options menu. The main ones you're probably going to use will be the safe mode options when you can't boot normally, but there are some others that we can use. The Enable Boot Logging feature logs all the drivers and services that are loaded or possibly not loaded by the system into a file. The file is the Ntbtlog.txt, and it is located in the system root of the folder, generally Windows. The file is appended rather than overwritten, so it can get kind of big over time. It's best to open it with Notepad; it's in Unicode format.

Any time you use safe mode, be it safe mode with networking or safe mode with command prompt, the boot logging feature generally loads and then loads those drivers and services. This would be more for when you're trying to boot to normal mode and maybe you're getting an idea of what service or driver may be stopping that boot. You enable boot into normal mode, and then you can look at that file to see.

However, there are few limitations with it. When the logon is done after the driver is called, and after Chkdsk would run, if you had a problem like a failure in a driver and it shut you down and rebooted, and Chkdsk ran, it means that the last driver listed is not necessarily always the one that has stopped responding or is causing your problem. A lot of times you can look there to get an idea. Another issue with that is because it is loaded much later in the boot process, it does not always show you all the drivers that may be causing your problem. If the session manager hangs or is not initialized properly as part of your boot, it is responsible for creating this file, so there are times when it won't be created.

The session manager is initialized a little bit later in the process. When you see the "Please wait for the screen being displayed," or right before the appearance of the "Welcome to Windows" screen, at that point it's initializing, and it will start writing to the file. The only point I'm trying to make there is that if your system stops responding (hangs) much sooner or much earlier in the boot process, you may not be able to get any valuable information from this file.

Still, if you're booting almost all the way, say getting to "preparing network connections" in Windows and then it's hanging or not quite getting all the way in, then you might want to, from the advanced menu, choose Enable Boot Logging, boot toward normal mode, and then take a look at the file and see what some of the last entries are, and it may give you a clue.

Another option that we have under there is the Enable VGA Mode (slide 11). As I mentioned, we load the Microsoft default driver when we're booting into safe mode. If you choose Enable VGA Mode here - this mode exists to really take care of situations where the video resolution and your color depth, your monitor refresh rate, things like that are set too high, or corrupted, or incorrect. As I mentioned before, we install our driver during safe mode. You can't really make changes to it that will affect the driver that's loaded as you boot into normal mode.

If you're having a problem with the driver that loads for your card as you boot into normal mode, then that's when you want to try to use Enable VGA Mode. The system, as it boots, tries to use a low resolution, as low as your particular card and its driver can handle; 640 × 480 x 8 bit is where it starts, and it's always at 60 Hertz refresh rate. If you do successfully boot into normal mode at that point, you can change your driver, reset your settings - a lot of times maybe you set your settings too high, rebooted, and now you can't see your screen. This is a good option to use to enable you to get back into normal mode and then make those changes back.

Again, like I said, this is also useful if your monitor refresh rate was set too high, or if you attached a different monitor and then all of a sudden you can't see your desktop. The best way to change that is to just reboot the system, press F8 as we talked about earlier, and load Enable VGA Mode. It will load using your driver, and then you can go into Display Properties and make those changes.

That's basically what this is used for and how it's different than safe mode. Safe mode uses the Microsoft default CLSID driver, and when enabling VGA mode, you're still using the driver you install; the system just drops it to its lowest resolution possible.

Another feature that we have on the next slide (slide 12) is Last Known Good Configuration. Last known good is a recovery option that allows you to start your computer using the most recent settings that worked. The Last Known Good Configuration feature restores registry information and driver settings that were in effect the last time your computer started successfully.

You would use this feature when you are unable to start Windows XP after you made a change to your computer, or when you expect that the change you just made may have caused a problem. For example, if you are unable to start Windows XP after you install the new driver for your video adapter, or if you installed an incorrect driver by accident and you have not been able to restart your computer.

This entry has been saved at each successful logon, and it starts using that registry information and the drivers that Windows saved at the last shut down. As you're shutting down from that last successful logon, that's what it captures. Because of this, you can use that feature only if you were able to start your computer successfully prior to restoring your system.

Any changes you made since that last successful startup, by using last known good, these would be lost. In other words, if you booted successfully, and you went weeks before rebooting and made a lot of changes, and one of those changes caused a corruption, then the next time you reboot your computer you only would get in if you used last known good. It's going to put it back to the last successful time that you booted, so that's where that comes into play.

For those who are interested, that information is kept in HKEY_LOCAL_MACHINE\System\Select. There are values there that show you which one it's using for last known good.

Let's take a look here at the Recovery Console (slide 13). We didn't want to go into great detail with what you would do after you were able to get to safe mode, and then began to troubleshoot, determine, and narrow down what the problem is. Just know that if you can't boot into normal mode, you'll want to start with trying to boot to safe mode. Then if you are able to get into safe mode, you can use a utility there, such as MSConfig, looking in Device Manager at your drivers and things to eliminate, whether it's a service or a driver or some other type of corruption.

As long as you can boot into safe mode, that's generally going to be your preferred method. It's much easier to narrow down your problems, troubleshoot your issues, and get back into normal mode than it would be using Recovery Console. We'll look a little at that and discuss that.

Now as we move on to Recovery Console, what we're going to discuss is why you would need Recovery Console (slide 14); how it is different than safe mode, which we talked about a little bit already; how to start it; some of the various commands that are available; and the policy and registry changes that are available for Recovery Console. Remember, this is a command-line type utility; it's not very user friendly.

The best way to understand it is to start it, run the Help command, look at the different commands, and give them a shot. There are a few you want to be careful with, such as formatting, and Diskpart, which we will talk about, and which can delete and move partitions. But getting in there and giving it a shot is the best way to determine what it can do for you and how it can help you.

As I mentioned, we'll talk a little bit about why we would use Recovery Console. You would use it to repair installations for which you cannot boot normally into Windows XP or safe mode. Remember that. Just about everything you can do in Recovery Console you can do from safe mode - not everything, but most of the common things that would prevent you from booting up and starting.

Do remember that Recovery Console was not designed as a data recovery mechanism. It provides some limited security access and is restricted to some non-data locations. In some scenarios where you cannot access Windows XP through safe mode, at that point you would want to try the Recovery Console. One of its limitations is NTFS.

Getting back to why Recovery Console was created in the first place: NTFS was a secured file system, and there was an inability to access it in Windows NT. If you had a problem booting, and it could have been a simple problem, sometimes the only option left was to run a parallel installation and then fix those issues in the other installation of Windows NT, and then boot back up.

Recovery Console gives you the ability to access an NTFS drive. If you have Windows XP installed on NTFS, you can boot from the CD, access the drive in Recovery Console, and perform some basic repairs and functions to get you booted up normally. You don't have to reinstall your whole operating system.

The Recovery Console does also allow you access to FAT and FAT32 drives. However, if for example you upgraded from Windows Me to Windows XP and you're running FAT32, you still are going to have all the functionality and capabilities of your Windows 98 boot disk and running common commands from it, and you will probably find it easier. Things do run a little differently in Recovery Console, and we'll talk about that a little bit. Let's move on and take a more detailed look at it.

When you start Recovery Console, you can start it in three different ways (slide 15): you can boot from the Windows XP CD, you can grab the Windows XP boot floppies and boot into Recovery Console, or you can load it onto your hard drive and make it available as a boot menu option. Now what we'll do is just talk in a little bit more detail about those three methods and how you would go about using them.

The first method we'll look at is starting from boot floppies (slide 16). I would say that the CD-ROM boot is still the preferred method. Booting from the floppies and booting from the CD-ROM are basically the same; it's just that using it from the CD-ROM is quite a bit easier. For those instances when you can't boot from the CD - for example, you can't change the boot sequence in your BIOS, or maybe your BIOS doesn't support booting from a CD - that's when it may require you to get the floppy disk.

There are six disks required. Again, if you've ever booted off the CD, we're loading all the class drivers, basically the kernel, the mini-Windows to talk to those drivers, and it requires quite a bit, about 7 MB. That's why you need so many floppy disks. Again, that why I would recommend you just use the CD-ROM when it's available.

Then again, if you boot from the floppies your computer also has to be set to boot from floppies, so you may have to change your BIOS settings. When I talk about that, look at your motherboard manufacturer's documentation that describes how you can go into your BIOS and make those changes, if needed.

To start the Recovery Console from the boot floppies, it's basically the same as from the CD-ROM, so that's what we'll talk about in a minute; they are the same. One caveat here is if you do get the boot disk, they are version specific. What I mean is that if you're running Windows XP Professional, you'll need the Windows XP Professional boot floppies. If you're running Windows XP Home Edition, you'll need the boot floppies for Windows XP Home Edition. These are only available on our Web site. KB article Q310994 describes how to go about obtaining those from the Web site. They don't come with Windows XP. Again, most systems today can boot from the CD-ROM, so it's not really that much of an issue.

Let's look at another method here, which would be booting from the CD-ROM (slide 17). Again, you do have to enable it in your BIOS, and then set the option to boot from CD-ROM first. Usually in most BIOSs booting from the floppy is first, and then maybe from a CD-ROM, and then from a hard drive, or some sequence to that effect.

After you enable that and you know that it can boot from the CD-ROM, you will see the option to press any key to boot from the CD; that's how you'll start. It will go through the Windows XP setup process, loading the required drivers and all, and then you'll be presented with this screen shot, which is Welcome to Setup.

At this point, the second bullet point there is for repairing the installation, and you press R for Recovery Console. You can also press F10, and that will also launch Recovery Console. It is a little different than Windows 2000. Usually the R was to run a repair on the system, and here that's actually on the next screen. If I were to press ENTER and go on starting setup, then I get the option to run a repair of Windows XP. Pressing the R or F10 key is how you would start Recovery Console.

The one limitation here is that the CD drive is locked, so if you're going into Recovery Console because you need to copy some files and they're going to be from another CD, you're not going to be able to open the drive and put that other CD in and copy those files from it. You just need to be aware of that, that your drive will be locked while you're in Recovery Console. It goes back to security issues with NTFS and why the Recovery Console was created.

Let's look at the last option, which is to add it in the boot menu selection (slide 18). You're actually adding this to your hard drive. When you do this, you will have to install it to the drive before you have any potential failures that may prevent you from getting into the operating system; that's pretty obvious. If you haven't installed it to the drive yet, and then you run into an issue, you're probably not going to be able to boot from that.

After you're in Windows, to install this you run Winnt32.exe /cmdcons, and you'll want to do that from your i36 directory on your Windows XP CD. Or if you go to the flat-tier drive, you can run it from there. As I mentioned earlier, this is going to put about a 7-MB directory on your drive, and it's named Cmdcons. This will also add an entry into your Boot.ini, and it appears just as you see here, C:\cmdcons\bootsect.dat = "Microsoft Windows Recovery Console"/cmdcons.

This can also create some changes in your boot process if you do this. For those of you who multiboot your system, you know that as you boot up you are presented with the Boot.ini menu, and you can select what operating system you want to boot into. To speed up the startup time for Windows XP, we remove the five-second or eight-second lag where you had the option to hit F8 if you wanted to boot into safe mode, and things like that, to try and boot you directly in. After that there are additional entries added into the Boot.ini, then you're automatically presented with those, and you'll have a 30-second delay before it boots into whatever the default operating system selection is.

I just want to note that if you do install this to your local drive, and you've only been running Windows XP Home Edition all this time, and it just boots right up into it, you'll then notice an additional point - during your boot process it will pop up and ask if you want to load Windows XP or if you want to boot into Recovery Console, and it will sit there for 30 seconds before you boot in. You can change that default time, of course, but I did want you to be aware of that if you do opt for this option.

Another note here is that if you cannot boot the drive, then you may not be able to access Recovery Console if you've loaded it locally for the drive. So you may still have to rely on your CD to boot. I don't know if I mentioned that before, in the previous screen, because it's different than Windows 2000. If you do use the boot floppies to load Recovery Console, you'll still need the Windows XP CD to accomplish that, so just be aware of that as well.

Now let's talk in a little bit more detail about the Recovery Console itself. We'll start with after you've loaded it or after you've entered into it, where you have that initial screen, you press R or F10. Now we'll look at the logon process (slide 19), because you are required to log on. Again, this was designed to give you access to an NTFS partition, and that's a secure file system, and we do require that you logon to it.

Generally, you're first presented with the option to change the keyboard layout. Just let that go and it will default to U.S., but you can change that if you're used to using some other type of layout. After you've done that, it will present you with the Windows installations that it sees and it asks you to select the one you want to log into. Again, if you're multibooting, it does not show any Windows 98 or Windows Millennium operating systems. It will only show you Windows NT-based operating systems: Windows NT, Windows 2000, and Windows XP, and give you those choices.

You'll want to choose a number for the one you want to log into. So let's say, for example, you just have Windows on your system, so you'll be given the option C:\Windows, to the left will be a number 1, and if you more operating systems you will see 2, 3, or 4. You select the number of the OS you want to enter. If you just press the ENTER key without selecting the number, it will reboot you and take you right back out. So just be aware of that; that can happen.

After you choose the one that you want to boot into, then it will ask you for the administrative password. This is the local administrator account. So if you're working on Windows XP Professional, you need to know the password for the administrative account. If it is Windows XP Home Edition, and you've never made any changes, then by default the administrative password is blank, to let you in and give you access.

Let's move on. Again, as I already mentioned, it is secure and limited access (slide 20). You can access the file system, and you have access to the root directories of the local drive in the %SystemRoot% folder that you're currently logged into, and that you selected when you start up Recovery Console, and all the subfolders, so Windows and the folders under it. You also have access to the Cmdcons folder where Recovery Console is installed, if you have that set up locally on your drive. You can access your floppy and your CD-ROM drives.

However, you're not going to have access to other installations on the drive. In addition, you cannot copy files from the hard drive to removable media - that's a policy change. But you can copy from removable media to your drive. Again, like I said, with Windows XP Professional, you can modify that with a Global Policy setting that will allow you to have access to those, and we'll discuss that a little bit later.

After you log on, it will check the software hive for those policy settings. You also may need to check your system hive if you're using the Listsvc Enable or Disable commands. We'll talk about that a little bit a little later. What's important to note there is that if you have some registry corruption that's preventing you from booting into Windows, it may create some odd scenarios for you in Recovery Console too. You may just drop right to a prompt, not ask for any administrative passwords, and you may or may not have access to files and the systems on the drive. If you have those types of things, that generally leads to some corruption within your registry, so that's where you would need to look at troubleshooting. That's just kind of an FYI; you can see some problems there when you do that.

With that in mind, after we've picked the installation in Recovery Console, typed in the administrative password, and then it gives us access to that drive, this is where we can begin to use the commands that are available to us. Let's take a look at those (slide 21).

What we've done here is, for the purpose of the presentation, we have grouped these into service commands, drive commands, the MAP command, file controls, directory usage, and then there's a list of some other commands that really don't fit into any of those. We'll also discuss a new option in Recovery Console, which is BootCFG. That's great for those of you who are used to the Boot.ini, in the old days having to do everything manually. You'll really enjoy that command.

When we look at this command set available, again, it is limited. The syntax is a little different in Recovery Console than say a typical command prompt. If you just typed in help after you're into Recovery Console, it will give you a list of those types of commands and then for the specific one you want to look at, type that command \?, and it will give you the details.

Let's talk about some of those syntax restrictions too, where's it's different than say an MS-DOS command prompt. For example, change directory, cd\, and then change your directory. In Recovery Console you get an invalid command error if you did that. For it to recognize it in Recovery Console, you'd have to type cd, a space, and then the backslash (\). Or if you're used to using the period, you'd have to have a space between them.

Like I said, you need to be aware of that. There are some differences when you try to use them, and we'll talk about those in a little bit, as we go through these commands now. Let's look at the service commands (slide 22), or what we're grouping as service commands.

For startup-related issues, maybe with device drivers or services, Recovery Console will provide you a way to list those services and drivers that are installed, and whether you want to enable or disable them. Again, this is good if a service is preventing you from booting, or a driver you recently loaded is preventing you from booting.

Once again, as I mentioned before, if you go into Recovery Console and try these commands out, you'll quickly realize that doing this from safe mode is much, much easier; it will save you from the MSConfig utility. I wouldn't recommend going in here and doing this if you can access safe mode. It's much easier there. But if you can't, it's nice to have these tools; they're pretty powerful.

When we look at the Listsvc, it lists all the commands that are installed, the devices, and the services on your computer. In addition to that, the command will include the start value and the friendly name for that service, which is what you need when you're using the enabler or disabler that we'll talk about here in a second.

For example, you can see up there that if I wanted to enable the spooler, then I'm going to type Enable (space) Spooler, and then the command I want to use for Enable. When we look at that, Enable changes the value of the service after a reboot. So it enables the driver or the set of services to start automatically if it wasn't started before. And then it ensures that if you have a service or driver that's necessary to boot the computer, and say for example, it was set to manual or disabled, you can repair that from Recovery Console so that you can again boot normally.

The changes will have no effect in Recovery Console. It's applied the next time you restart the computer. The values you can choose are SERVICE_BOOT_START, which is set for boot, SERVICE_SYSTEM_START, which is for systems, the SERVICE_AUTO_START sets it to automatic, so that whatever that service is automatically starts. If you use SERVICE_DEMAND_START, as you see in the example here, that sets it to manual. And then there's a SERVICE_DISABLED.

When we look at these, more than likely most of the time what you'll use is disable, because the service was enabled for some reason, and you can't boot, or if you look in the log files and see there's a driver or something to that effect that's preventing you from getting in, then by using Listsvc, you can see its common name, and then you would use Disable (space) Spooler, the example here. Then the next time I reboot the spooler service will be disabled, and if that was causing my problem, I can now boot normally. That's where you would use these three commands and where they come in handy.

Again, when you go to disable or enable a service, right before you do that it will note what the current status of that service is, which is a good thing for you to write down in the event you disable or enable the wrong one or you do something incorrect there; you can go back and fix it. It will present it to you before it moves forward, "This is what this current service is set at, and this is your request to change it," and then it makes that change. And that way you have a record that you can write down.

Let's keep going and look at a couple more here. We'll look at some of the drive commands (slide 23). Format is pretty basic. This one allows you to format your hard drive while in Recovery Console. It doesn't let you really format removable media, such as a floppy disk or something like that. Again, here you see an example of what the command is, and the drive represents the drive that you want to format. The /Q just is a quick format, the /FS is for the file system. In other words, you want it to be FAT32 or NTFS. If you don't specify anything here, NTFS is the default file system that it will format the drive in.

If we were to go through an example of this, it would be Format [C:] [/Q][/FS:NTFS], and then it will do a quick format of that drive. You need to be careful with that, because you can just simply format your drive with all your data and lose all that data and everything will be gone. That's one you want to be a little careful with. But it is there if you need to use it.

Another command is Diskpart (slide 24). Diskpart allows you to create and delete partitions. It can be used without any arguments, and that's talking about these switches in this example. It's much better, I think, to use the interface that is supplied for it. If you simply type in Diskpart without any of those arguments, it will display a screen, kind of a GUI-mode interface where you can select the existing partitions or the free space where you want to create or delete a partition.

It's the same if you're booting from the Windows XP CD and starting a new Windows installation; it's the same look as that one, if you're familiar with that at all. I think that's much easier than, where you could run this command line Diskpart (space) and a switch to either add or delete, then the <device name> or <drive name>, and that's talking about if you've given it a volume name or if you just use C: or just name and size. So it's much, much easier. The best way to use this is to type in diskpart, press ENTER, and you'll get the screen that will show you a kind of GUI-mode interface of all the options that you have.

One option to be aware of is if you do boot with Recovery Console loaded from your hard drive which we mentioned earlier, there's a boot menu option, then that drive, that partition is a partition that you won't be able to delete, and it will present you with an error. If you want to wipe the whole system out and start over, for example, if that's what you're trying to do, then you would want to at that point boot from the CD and then run Diskpart in Recovery Console. If you boot from the drive, there is that limitation.

Another drive command that we'll take a look at is Chkdsk (slide 25). This a lot of times will run automatically for you on certain crashes, but you can also go into Recovery Console and run Chkdsk to look at bad sectors on your drive.

The command does require the Autocheck file, so it will attempt to locate that in the directory you're currently logged into. If that fails, it will then look to the CD-ROM. If for some reason it cannot find the auto check file, then it will prompt you for it. I don't really see that ever happening too much, not in my experience, but it does need access for that to run from within Recovery Console.

Again here, there are a couple of switches that you can use with it. If you just run Chkdsk without any switches, it will run through, pull up the sectors, and present to you a status report of the drive. If you use the /P, it performs a more exhaustive search of all the volumes and anything marked dirty. /R locates the bad sectors and tries to recover or relocate them to a readable information area. That one is a little more powerful, in that it does try to fix the system.

Now we'll look at the Map command (slide 26). This one is simple and basic, if you understand Windows NT and the boot process. If you're used to Windows 98 and Windows Millennium, it can a little bit confusing. It displays the existing drive letters and the location of the hard drive volumes. You'll see the removable media, floppy drives, and so on, all from with Recovery Console.

The Map ARC command will display the ARC path rather than the device path. If you look at these examples here, it shows C as partition(1) and hard disk(0), and down below it shows its ARC path, which is the multi zero rdisk partition. That one is the one you would use if you were trying to compare a problem in your Boot.ini. Maybe it's not booting correctly; you're getting errors and it can't find the directory to boot. That's where you would use the Map ARC command to compare to that, and then determine where your Windows directory is, so you can point it correctly to boot.

The nice thing about Windows XP is now you have to use the BootCFG command to do some of that for you, which we'll talk about. For me, it's my favorite command that's been added to Recovery Console for Windows XP, and we'll talk a little bit about it. It is useful to know this Map command in case you do have some problems booting, and you have some corruption in your Boot.ini and need to make those changes. This will allow you to do that.

One other thing you need to note though, is because of the way we initially boot and load the CLSID drivers and all, you may have a different look to the drive letters than when you're in Windows, because you can change the drive letters with the utilities in Windows XP. They can look a little bit different. If you want to get down to the details of that, the Migrate.inf file in the Cdmcons directory, has a copy of the HKEY_LOCAL_MACHINE\System\MountedDevices for the system.

For the most part you don't really need to worry about that, but if you make a lot of changes within the GUI to how all your drive letters are assigned, they may look a little different here, and then you definitely should use a Map ARC command in that case.

Let's go on and look at some of the file controls (slide 27). You're probably familiar with these if you've ever done anything with MS-DOS before Windows, or the boot command. We're going to look at the Copy and Delete.

The Copy command is basically that. You use it to copy a file over from the source to your destination. If you need to copy from a CD or floppy to your hard drive, you can do that from Recovery Console. Say you have a corrupt file or something of that nature and you need to put a different file in its place. You cannot copy from your drive to removable media by default in Recovery Console; you are limited there.

The Delete command is just that. You can also use Del, and it will delete a file on the drive if you want to get rid of something in there. Generally, I like to rename those files. We'll talk about that command later. It's best to do that in case you made a mistake and it's not what you wanted to do, so you haven't gotten rid of that file altogether.

One thing you should be aware of though is the wildcards are not going to work here. If you do a copy*.sys, or something to that effect, those types of commands aren't going to work, not without changing policies in the registry or in the Group Policy. Just be aware of that. That's where, again, I say if you can't boot to safe mode, it would be much easier to Copy, Move, Delete, Rename - perform all of those types of options from there. If you're running FAT32 on your system, you might consider booting from a Windows 98 floppy or Windows Me boot floppy to perform these types of commands, because you won't have those restrictions, like you do in Recovery Console.

We'll keep moving forward. The directory commands (slide 28): The DIR command gives you a list of all files, and it includes hidden system files in the drive and directory. It's interesting to note that the Directory command will support wildcards like asterisks and questions marks, but most of the other commands do not. It will show you all the attributes or it will list those for the directory, read-only hidden files, system, compressed, and encrypted. The MD or MKDIR, that is to create the new directory, you can use either one, MD and then the drive you want to create and the path, or the drive where you want to put it and the path to make the new directory. RD will remove that directory. CD is change the directory. Again, you could also use CHDIR; both of those commands do the same thing in Recovery Console.

As I mentioned earlier in the presentation, these commands run a little bit differently in Recovery Console. If you were using, for example, CD and then using the periods or the backslash, and then the drive or the directory you want to change to, it will not work, unless you use spaces between there. I would have to have CD(space)\ and then where I want it to go; otherwise you'll get an error in the command. You just need to be aware of that. It catches me all the time. I know it and I'm so used to the old MS-DOS days, and I get caught by that all the time. Just be aware of that.

Now I want to talk about a command that is new to Recovery Console for Windows XP, and that's the Bootcfg (slide 29). The Bootcfg command is a command that manipulates the Boot.ini file. It has a function to scan your hard drive for your Windows NT, Windows 2000, and Windows XP installations and then add them to the system Boot.ini file. It can rebuild your Boot.ini file, if one doesn't exist or if it's corrupt, and you just want to rename it. It allows some additional parameters that you can add - all kind of new entries. Basically, this does a lot of what in the past you had to do manually to your Boot.ini. This will now do it for you. It's great.

/default sets the operating system to the boot menu. In other words, it will scan your system and automatically set the one entry it defines as your default boot. If it finds a couple, it will pop up and give you a choice of which one you want to make the default, if you have more than one operating system. It's just that simple. If you run the /add switch, again it will scan.

As I mentioned, you will not see Windows 98, or Windows Millennium, none of those Windows 9x-based operating systems, it will present just the NT kernel-based operating systems to you. After it scans your computer, it will show you the installation entries, again based on the ARC path, and ask which ones you want to add.

The /rebuild, as I already mentioned, will search your system again and then display the results, and you can have the detected Windows installation and rebuild the Boot.ini if you don't have one for that. /scan will just scan and display the results, a list just parses through the Boot.ini and shows you a list of the operating system identifiers, load options, or location. That's basically what you'll have.

I just want to let you know here that when you do this, one thing that might be a little confusing if you're new - say for example, you run the /add command, after you select the installation you press ENTER, your next option is load identifier. All that's telling you is to enter the name you want to display in the Boot.ini: Windows XP or <My favorite operating system>. That's what it will display when you have the options to choose which OS you want to boot into.

Then it will ask for the operating system options; that's the fast detect. You could use some of your other options like safe boot or no GUI boot. Those are just extensions that you add to it. It will take anything there, so if you don't know your operating system options, then don't enter anything there, just press ENTER and leave it blank, because you could enter a non-valid switch there, and it will put that in, so just be aware of that.

This is a really good tool, so get used to it. If you've been around Windows NT for a while and you know the things that can happen with the Boot.ini, this is a great tool to help you with that.

Another command that we have is the Batch command. This allows you to run the output of a text file. So if you have a long series - for example, I mentioned if you needed to copy or rename of a great number of files, and you can't use the wildcards, like I talked about, you have to do each one individually - you could get a text file, enter the command to rename each one in there, then run the batch command, and it will run that for you.

This is good for a comment command, things that you have to do often. You could create one that says Type Boot.ini, and then name that Task.bat. And then you could put that on a floppy disk, go into recovery console, and then type batch a:\Task.bat. It would run that command during that file, so that's basically what that is used for. The CLS is straightforward, it clears your screen and moves your cursor to the top.

One thing that's a little bit different here is the up and down arrows will parse through the things you've typed in previously. Again, if you're accustomed to a command prompt in MS-DOS, you press F3 and you could scroll through things you've already typed so you didn't have to retype them. The up and down arrow keys give you that same functionality when you're in Recovery Console.

Another difference here is, the Attrib command allows you to remove attributes from a file directory. Say it's hidden or read only and you want to remove that to expose it so you can look at it. In MS-DOS or in an MS-DOS command prompt type of environment, you would type attrib(space)-h(space)-r(space)-s, that would be one way to remove the system read in only attributes. In Recovery Console, you would type a minus (-) and then all three of those letters without any spaces. That's the proper way and the proper syntax if you're using the attrib command here. Just keep in mind that you do not want to use spaces there, you'll get some problems.

There are just a few other commands that we're going to look at (slide 31). SystemRoot - if you type systemroot, it takes you back to the %windir%, which is your Windows directory. For most of us that's just Windows; it could be WinNT, depending on your upgrade path.

More or Type both do the same thing; they display it as a text file. One of the things you cannot do in Recovery Console is edit files, so you cannot directly edit the Boot.ini. You can use the Bootcfg to make a bunch of changes, but you can't directly edit the file itself. Again, if you're in FAT32 that might be another reason why you would boot from a Windows 9x floppy and run that. These will display it. So for example, I typed in more .boot.ini, it will then display on the screen what is in my Boot.ini file. I can't make any changes to it or edit it, but that's the way to look at it and review information in the file; that's what you would use that for.

Ren allows you to rename an existing file. Exit is going to exit you from Recovery Console. Another one not mentioned on the slide is Logon. Again, if you have multiple operating systems you can type Logon, and it will take you back to essentially to that first screen where you choose which operating system you want to log into with Recovery Console, if you want the change it for some reason. Because again, you have some restrictions there. You can access subfolders and directories into the one that you're currently logged into, but not into others, so if you need to get something from another one, you'd have to log back into it.

Now look at some of the repair functionality that you have (slide 32). FixMBR is a command that will rewrite your boot record. You can also specify the device name if you're writing to a different location. This is good to use if your MBR is corrupted, if there's something that's a problem or invalid, it will just rewrite it. If I type fixboot and press ENTER, it will use the current directory I'm in. If I type fixboot e:, it will write the boot record to that other area.

The only thing you need to be careful of here is say you have boot sector virus or something where it renamed or reassociated your pointers and all, you could lose data by running FixMBR, so you want to be careful there. It's a good tool for when you have some boot issues. But if you're concerned with some virus or something that has infected your boot record, that's when you want to be a little bit careful about that.

Fixboot will write a new Windows XP boot sector onto the system partition. For example, you can specify the drive Fixboot C:. This will override the default selection of the system boot partition. Fixboot will prompt you before overwriting the boot sector. Note these do not copy over NTLDR and NTdetect.com, as some people seem to think it does.

The expand functionality, which is on the next slide here (slide 33), will extract files from a CAB. Sometimes you may need to do that. For the most part, as we talked about before, with the Copy command in Recovery Console, if you copy a file from the CD, it will automatically expand it or extract it and put it out on the system. So there's not as much use for the expand functionality when you're in Recovery Console, but it is there for certain instances when you need that. For some of those switches, the /Y is so that you're not prompted for overwriting a file. It's a good one to note, if you're using this for a batch file and you're running that in the text. The /F is if the source contains more than one file. This is required to identify a specific file or files you want expanded.

The /D command is to only display the directory of the file. It doesn't actually expand them where they're contained in the source. Like I mentioned before, Copy also does what Expand does. For the most part you can use it, and you don't really have to worry about it this much.

One of the things I mentioned earlier was some of the policy changes (slide 34) that can have an effect on Recovery Console. The administrative logon for Recovery Console can be modified and allow automatic logon without a password. If you're logged on to the system - for example, you can go in if you want to manually do this, in registry editor you can go into HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Setup\RecoveryConsole and switch the DWORD value there to allow administrative logon without prompting for a password; change that to 1.

You can also add some greater functionality with the Set command, which you can see will allow some options that before I told you weren't possible. If you do this with the policy editor, you can then, for example, use Set to AllowAllPaths, so I can get to other directories that I was restricted from before; AllWildcards would let me use the copy* command, for example.

AllRemovableMedia would again let me copy to removable media, which I'm normally restricted from doing in Recovery Console. Before I can use a Set command to make these changes, I have to add that policy, and that's in Windows XP Professional. You don't have the policy editor in Windows XP Home Edition, so you have a limitation there.

If you are looking at the policy change, it's in the local security login, and it's under the security settings, so you would expand the local policies there. Go into Control Panel, then double-click Administrative Tools, then double-click Local Security Policy, and the security settings, double-click Local Policies, and then double-click Security Options. You'll have to scroll down to see the Recovery console, Allow automatic administrative logon, and the one for the Set command. Again, that's on Windows XP Professional. You don't have that option in Windows XP Home Edition, but it can give you these.

When you create that possibility and then you load and run the Set command, just be aware that's a one-time instance. So the first time I go into Recovery Console, I run set(space)allowallpaths=true. Now during that session of Recovery Console I can access all the different directories and the subdirectories. If you error that boot out or exit out of Recovery Console and boot back in, the Set command will reset that back to default, so you have to do that with each instance.

Then for that particular administrator to log on automatically, that KB article is Q312149. That really is going pretty quickly through all those commands, and it's just kind of touching on them. Go into Recovery Console and work with those yourself.

Here at the end, as we move on here to these last couple of slides, I've provided some good Knowledge Base articles (slide 35) that describe the safe mode (Q315222) that we talked about today and those boot options that are available to you. We have articles on how to create boot disks (Q305595), how to copy files from the Recovery Console (Q240831), and advanced clean boot troubleshooting (Q316434), which again goes into why and when you would use some of these commands that we went over today.

Then on this last slide (slide 36) we have just a few more articles. We talked about how to install Recovery Console. If you do install it to the drive and then realize, for example, you don't want that, you just want to run it from the CD, there is a Knowledge Base article that describes how you can uninstall it from your local hard drive. I didn't provide that article here, but that is available.

"A Discussion About the Bootcfg Command and its Uses" (Q291980) is really good. I would recommend going over that. "Description of the Windows XP Recovery Console" (Q314058) basically goes through all the commands we talked about today. Then there's a little more information about last known good (Q307852), I put that in as well.

That wraps up everything that I wanted to talk about today. Like I said, that was pretty fast. All I really did was touch on the advanced boot options and what they each represent. Now how you would use those in troubleshooting, we didn't go into too much detail on that today, but I included some articles about safe mode and troubleshooting, startup, and things of that nature. If you look at those they will answer, "Okay, if I can boot to safe mode but I can't boot to normal mode, what's my next step to determine what's going on?"

Remember, I strongly suggest you use safe mode to troubleshoot problems booting to normal mode, versus Recovery Console. Don't use Recovery Console until that is the only option that you have, because you can't get to normal mode or safe mode.

So that pretty much wraps it up. Now we'll move to questions, if there are any.

Otto Cate: Great. Thank you very much for the presentation. Before we move into the Q&A portion of the Support WebCast today, I have a couple of program notes we'd like to share with everyone. Just a reminder, the Q&A portion of the Support WebCast is intended to encourage further discussion of the Web Cast topic today. One-on-one product support issues are outside the scope of what we're able to address. So if you do need some technical assistance that requires one-on-one support, please contact a support professional either on the Web or by phone.

We have a few questions here. This is more of a clarification question, it looks like: Is there USB support within safe mode?

George: Yes. When you boot into safe mode, we do load the stack for USB, so you should have functionality with any USB device. It's only going to work with the CLSID driver. We don't load the stack for IEEE 1394, or FireWire as it's sometimes called, so you wouldn't have support for it or for serial ports. So if you have an old serial port mouse, you'll lose that functionality. But you would have support for USB.

Otto: Great. I believe we're referencing slide 10, where we were talking about boot logging: Is there a really good way to find out what the next driver in the list that should have loaded would have been? Say, for instance, if it hangs on one particular file, is there an easy way to find out what that next upcoming driver would have been?

George: Yes, that's kind of tough, because the last one listed is not always where you're hanging; it may be the one after that.

If it's happening to you booting into safe mode, you can look in the registry key and see the list of how everything is booting, and you might get some idea there. That's really kind of a stretch, but that's about the only way, outside of doing something a little more detailed like with the debugger, which we didn't really talk about today. That's really about all you can do there, as far as I know.

Otto: Right. When I'm accessing an NTFS partition through the Recovery Console (this is also a clarification), am I getting read/write access versus read-only access to that drive?

George: Do you mean in that can you edit and change files?

Otto: Yes. I'm assuming.

George: Yes, I think that's probably it. You can't edit the files from within Recovery Console. You can rename files and copy files. You can change the attributes with the Attribute command because you are logging in with the Local Administrator account, so you do have the ability to rename those files and things of that nature, if that's what we're getting to.

Otto: Concerning the logon process to the Recovery Console, does Windows XP Home Edition require that same logon process? Is it pretty much the same with Windows XP Home Edition and Windows XP Professional?

George: Yes, it does require the same logon process. Again, I don't know if I mentioned it, but with Windows XP Home Edition, you don't normally see the Administrative account unless you're booting into safe mode. When you boot into Recovery Console it is asking for that local account. Unless you've made a change to it within safe mode, for example, or changed that account, then by default with Windows XP Home Edition, your password is blank. That is set for the administrative account. Yes, the logon process is essentially the same.

Otto: The next question here: Is there a reason why many Recovery Console commands are not available in normal mode? I think some of them might be useful in normal mode.

George: As I mentioned before, most of the commands have a GUI interface-related counterpart so that if you're in safe mode or normal mode, you can accomplish most of the tasks, if not all of them, when you're in that mode. When you are in normal mode, some of the commands are different. For example, Bootcfg has a different set of commands and priorities, and I don't really want to go down that road, but if I'm in Windows XP, and I click Start and point to Run and bring up the Cmd.exe window and type bootcfg and then type help, I'm going to see a different series of commands and options than what is in Recovery Console. So some of them are different.

But to answer this question, you can do just about everything through a GUI-related interface, and that's why. I don't know which ones you might specifically be talking about, but you can do almost all of those from there.

Otto: Great. If a disk has been set to Dynamic, and it's the boot volume, is there a way to remove all the partitions from the disk and reset the volume to Basic, then re-create the partitions as basic NTFS partitions for an installation of a new system?

George: That's a really good question. Within Recovery Console, I don't know that we can really do that. That's one that I'd need to get a little more information on. You'd have to more than likely use some other tools that I'm thinking of. I cannot think of the word at the moment. That's one item I'd have to defer on and do a little more research and get back to them on that. Take that offline, and I'll e-mail him back.

{Follow-up answer: Review articles Q227364 and Q229077.}

Otto: Next question: Is Bootcfg only available within the Windows XP realm, or is there possibly a version available for Windows 2000?

George: Within Recovery Console, it's only in Windows XP. I would like to see it in Windows 2000; but no, not at this time.

Otto: Great. How does the rebuild switch of the Bootcfg detect other installations like Windows 2000, Windows 98, and Windows NT 4.0 that happen to be present on the hard disks?

George: All those come in right on the premise of the scan. It looks for the MAP ARC paths, and presents that information. Again, if you already have Boot.ini present in the path that you're booting, then it just pops up and shows you here are the commands, do you want to set these? It does basically the same thing as a MAP ARC - pulls those, and presents it.

Again, you would then have to put it in the OS load identifier, which would be the name for it as you boot into it. You have to kind of have a little bit of an idea, but it will see it, and if it knows that directory, whatever you listed that directory as, it should show that there as well. But it runs that same scan, and looks at the ARC path. That's why we don't pick up Windows 98, Window Millennium, and so on, if you're multibooting with those.

Otto: Great. Can you go into a little bit more detail about what that /redirect /disable redirect switch does in Bootcfg?

George: Yes, I didn't really go through that. Sometimes we're doing headless servers. That is for connecting to servers, and you need to access them remotely. Again, because we were focusing on the client, I didn't really go into those. You can get some more detail from those KB articles referenced earlier, but that's what we use those for. Unless you need to access headless servers, there's no real reason to use those switches.

Otto: Next question here: Can you use the Format command to format a disk that is NTFS, and basically format it and get it back to FAT32? I'm not sure if that's an available option.

George: Generally, you'd have to use Diskpart; remove and create the new partition, and then format into FAT32.

Otto: Great. This is an interesting question: How does System Restore work in safe mode?

George: Again, if you remember, you're still in a 32-bit environment, so you can launch and run System Restore from within safe mode. You can do it from the Msconfig utility. There's the option to launch System Restore there. As we talked about before, if Explorer.exe, your shell is your problem, then when you boot with safe mode with command prompt, you're still loading the 32-bit environment, which you have to have for System Restore. You can't run System Restore from a true command-type prompt; you have to be in that 32-bit mode environment.

You could launch it from safe mode with command prompt with the executable, as well as if you launched into safe mode and then ran it from the Microsoft software configuration utility. That's where you would have that option and it will run and boot and pop up, and then you can choose your options to boot to a previous point.

Otto: I have a few more questions. I just want to take some time to solicit some feedback from our audience. If you happen to have any suggestions for future topics, maybe general comments about today's session, sound quality, or the WebCast program as a whole, we'd love to hear from you. We definitely value your feedback. If you'd like to send us some feedback, send us e-mail at supweb@microsoft.com. Please include "feedback" in the subject line.

George: That might be one you'd want to refer to a support professional, who could help you in a little more detail. I would say you could look at booting into safe mode with networking, so you have a stripped down piece of the stack, and see if you have any better process there.

Again, I don't want to get outside of what we're talking about today, but there's another tool, BootVis.exe, that you can get from our Web site, which will monitor that boot process and look at it. I don't know that Enable Boot Logging is going to really show you anything; it just lists the drivers and services as they load. It's not really going to help you with a lag in performance time.

Did I understand that right? You're saying they're taking a long time to boot to access the network?

Otto: Yes, that's what it looks like.

George: Yes. I would use safe mode with networking. But like I said, you might want to submit an incident through our system, and a support professional can deal with that in a little more detail, maybe use some of those other tools. That's where I would start.

Otto: How do I access Ntbtlog.txt?

George: If we can boot to safe mode, then you simply search for the file, bring it up, and take a look at it. It's in Unicode, so Notepad is the easiest way to take a look at it and review it. If you're in Recovery Console, again, that file is appended over time, so it can get kind of big. You could, if it is on the system, in Recovery Console, use More or Type to take a look at it, but it may not show you what your current problem is, depending on how far you booted and what we logged the last time, if that's what he's talking about - from a Recovery Console.

If it's from safe mode or normal mode, you can just pull it up and take a look at it with Notepad, if that's what he's asking there.

Otto: Have you seen any issues using Recovery Console when mirrored boot drives are involved?

George: That's a good question. Any issues as to being able to access, depending on where some of the data is, that's a good question that we could get into a little more detail on. Maybe if you can forward that to me, I'll reply back to him with a little more information on that. As a general rule, not too much, but there are some caveats. I would want to look that up and get back to him, and give him exactly what they need to look out for on that.

{Follow-up answer: Review articles Q227364 and Q317587.}

Otto: Excellent. It appears that so far we've answered all the questions here that have been submitted today. I want to just let everybody know that this is the only time that George will be available to directly answer these questions, so if you have anything else, feel free to ask, and we'll be able to get to the question here; we definitely have plenty of time.

In the meantime, I'd like to also go back to the feedback. If you have any topic suggestions or any feedback about the quality of the show or the quality of the presentation, everything is pretty much fair game. So definitely send feedback to us via e-mail to supweb@microsoft.com. We certainly value your feedback to adapt this program to meet your needs.

We do have one last question: A little earlier on in the presentation you went through some of the policy changes that can be done. Would that be a good route to possibly resolve a lost administrator password situation? What kind of recommendations might you give in that type of situation?

George: No. If you don't know or have forgotten the administrative password, there's not really an easy way to get that back to give you access into Recovery Console, not in a supported way, I guess I should say, based on the security that's there and some of the things you can do.

Now there were some earlier issues with using Sysprep. Another thing you can try to do is if it happened during the initial installation of setup, you can at times look at some of the setup boot log files for the random password that's generated during the setup process. After you're already in and you've created the password and the account for administrative password for that local administrator, and you've forgotten that or something to that effect, then no, there's really no easy way.

Otto: That's great. Thank you very much for that clarification.

With that, it appears that we've answered all the questions that have been submitted today. I'm going to wrap up the session. I wanted to thank everyone again for joining us today, and I hope that this information was useful to you. I also wanted to thank George for coming out and giving us a great presentation, and giving us a lot of really good information.

Again, if you'd like to see any other topics or if you have any feedback, feel free to send those to us via e-mail at supweb@microsoft.com. We hope that you have the opportunity to tune in again in the near future. Thanks everyone, and have a great day.