The Emergency Repair Disk

Restore lost Registry files without reinstalling NT

When you install Windows NT on a server or workstation, you can create anEmergency Repair Disk. It contains a backup of Registry files so that you canrestore damaged NT system files and reboot a failed system. Knowing how tocreate an up-to-date Emergency Repair Disk and use it to recover from a systemfailure is an important part of NT disaster recovery.

An Emergency Repair Disk has several uses. It lets you recover from asystem crash caused by corrupted files or boot a system with an NT startupprogram problem, without having to reinstall NT. And you can access a systemwhen you don't know the password--for example, when the systems administratorforgets the password or leaves the company. The Emergency Repair Disk lets yourestore the original user accounts database (which contains the system'soriginal password).

What's on the Emergency Repair Disk?
The Emergency Repair Disk contains copies of the files in an NT 3.51 or 4.0system's winntrepair directory. Some of these files are compressed versions offiles in the winntsystem32config directory, where NT stores the Registryfiles. Table 1 shows a sample listing of the winntrepair files under versions3.51 and 4.0. Note that in NT 4.0, some of the information comes from theprofiles subdirectory. User Profiles include information about software the userinstalls, desktop settings, and personal preferences; NT stores these settingsin the ntuser.dat file.

When you install NT, the system builds the setup.log file, which containsinformation about the files installed on the system. When you use the EmergencyRepair Disk to restore corrupted files, NT Setup (which performs the repairprocess) uses the information in setup.log to compare the files on the system'shard disk with the files on the NT installation CD-ROM and replace damaged fileswith the corresponding files from the CD-ROM. NT automatically updates thesystem's setup.log file when you add drivers such as those for a SCSI adapter ora tape drive. The other files on the Emergency Repair Disk include the softwareconfiguration, the systems settings (primarily for the hardware), the SecurityAccounts Manager (SAM) and security files, and the default user profilesettings. NT uses the autoexec.nt and config.nt as default files to start avirtual DOS session.

Creating an Emergency Repair Disk
According to Microsoft's NT documentation, "for best results," youwant to use a repair disk for only the computer you created it on. However,creating one Emergency Repair Disk per system is not practical if you havethousands of workstations (and you can often reinstall a workstation as fast asyou can recover its files with the repair disk). Create and store one EmergencyRepair Disk for each server and Primary Domain Controller (PDC) in your network.

Even if you create and store Emergency Repair Disks in a safe place, theycan quickly become outdated as system information changes--for example, as youadd users, build volume and stripe sets, and add hardware to an NT system. Someprograms, such as Disk Administrator, prompt you to update your Emergency RepairDisk. To do so, you must use the rdisk.exe utility. Creating the disk takesfewer than five minutes.

You can run rdisk from the Run command in NT 3.51's Program Manager; fromthe Start, Run option in NT 4.0; or by clicking the executable file in FileManager or Explorer. Of course, if you like command lines, you can simply enterRDISK at the command prompt. By default, NT installation does not have a programicon to rebuild the Emergency Repair Disk, but you can create one. The commandline for the icon is rdisk.exe. You can include the full path to rdisk.exe whencreating the icon; however, rdisk.exe is in the default path because it's in thewinntsystem32 subdirectory.

When you start rdisk, the Repair Disk Utility window in Screen 1 displayswith four options. The first, Update Repair Info, updates the repairinformation--but on the hard disk in the winntrepair directory, not onthe Emergency Repair Disk (the backup disk to which you'll copy the updatedwinntrepair files). After rdisk finishes updating the hard disk, it askswhether you want to create a floppy with this new information, as Screen 2shows. If you answer yes, rdisk creates the disk.

The second option in Screen 1, Create Repair Disk, formats the backup diskthat will be your Emergency Repair Disk and copies the winntrepair files to it.Note that this option doesn't check whether the winntrepair information iscurrent--it simply copies the contents of the repair subdirectory to the backupdisk. So to ensure your Emergency Repair Disk is up-to-date, use Update RepairInfo, not Create Repair Disk. Before you create an Emergency Repair Disk witheither option, make sure you have a backup of the old repair disk that you canuse if something goes wrong when you create the new repair disk. The other twooptions in the Repair Disk Utility window are Exit and Help. (Help displays ashort description of the utility.)

rdisk automatically updates all winntrepair files except the useraccounts files, Security and SAM. The procedure doesn't update those files fortwo reasons. First, backing up a large domain's accounts database to floppies isan impractical and risky way to store critical system information: On a PDC orBackup Domain Controller (BDC) this database can include information onthousands of users and occupy several megabytes. An Emergency Repair Disk's mainpurpose is to use the original user account information (i.e., the original SAMand Security files) to let you boot an NT system. After you reboot the system,you can restore the current accounts database from a backup tape.

However, if you have a small domain with only a few user accounts, storingthat information on the Emergency Repair Disk makes sense. NT provides alittle-known way to update the user accounts information via rdisk. You enter

rdisk /s or rdisk -s

to copy the Security and SAM files to the winntrepair directory. After youenter rdisk/s, instead of the Repair Disk Utility window, you see a screen witha status bar showing the percentage of information updated, as in Screen 3.(This screen will look familiar: It's the same one you see at the end of the NTinstallation, when you save the configuration to disk the first time.) At theend of the process, the utility asks whether to create a new Emergency RepairDisk. Choose yes and create the Emergency Repair Disk as explained earlier. (Formore information about using rdisk to back up user accounts information, seeChrista Anderson, "Care and Feeding of the Registry," December 1996.)

Using the Emergency Repair Disk
The Emergency Repair Disk is not a bootable disk; you have to use it withthe three floppies included with NT 3.51 or 4.0 and the CD-ROM containing thesource code for NT. You start the repair process by booting the system from theNT boot disk, which is the first of the three floppy disks. After booting thesystem, insert the second NT disk as prompted, and the blue NT screen appears.At this point, the Setup process is running. The Setup program lets you specifywhether to use the Emergency Repair Disk or continue with a full installation.After you specify Emergency Repair Disk, you can choose any combination of thefollowing repair options.

Inspect Registry files. Choosing this option displays ascreen that lists the Registry hives, areas in the system32config subdirectorythat contain Registry files (for more information about hives, see "Careand Feeding of the Registry"). You choose the hives you want to load fromthe list shown in Figure 1. (Later in the repair process, the repair softwarewill try to load each selected hive.) Under Inspect Registry Files, you have theoption to restore user accounts.

Restore user accounts. The Setup program transfers thedefault Security and SAM files (or updated versions, if you used rdisk/s)from the Emergency Repair Disk to the Registry. At this point, the files becomeRegistry hives (you must confirm this step before it's performed).

Inspect startup environment. This option checks the NTsystem's boot files, such as ntldr and ntdetect.com. If it finds a problem witha boot file, it replaces the file with one from the NT Setup disk.

Verify Windows NT system files. This option uses a checksumalgorithm to verify each file in the installation. If a file is damaged ormissing, NT replaces it with a file from the installation disks or CD-ROM.

Inspect boot sector.This option reinstalls the Boot Loaderand other startup files, such as ntldr and boot.ini.

Once you choose the repair options you want NT to perform, the Setupprocess continues, loading drivers for the NT system's SCSI adapters, CD-ROMs,and other devices. Next, the Setup program asks whether you have the EmergencyRepair Disk. If so, remove the second NT install disk and insert the repairdisk. If you don't have a repair disk, Setup looks for the NT installation onthe hard disk and uses the repair files stored there. Once the necessary filesare available, Setup either loads the hives you specified earlier, or ifnecessary, replaces hives from the repair disk with your approval. Once Setuploads the hives, you can reboot the system and start NT.

If you replaced the user accounts database with an earlier version, you cannow restore the current version from tape. Just remember to reset theadministrator password before you log out.

Practice
Creating an Emergency Repair Disk and navigating the repair process aren'tdifficult tasks, but you must set aside time to do them. If you don't have anEmergency Repair Disk for each critical computer, put down this magazine andmake one! This relatively small time investment can pay off by letting yourestore critical systems quickly.

You'll be wise to practice using an Emergency Repair Disk on a noncriticalcomputer so you can perform a repair smoothly when a real disaster strikes. Anddon't forget that an Emergency Repair Disk is only part of a complete disasterrecovery plan. Back up all critical files on your NT systems regularly.