Chapter 1. NT System Availability

In this chapter we look at configuring Windows NT for availability and preparing for recovery with ADSM. We focus on the NT boot process, configuring an alternative, or repair, NT system partition, and installing a repair partition on removable media.

1.1 NT Boot Process

When considering how to recover an NT system, you must understand the NT boot process and its restrictions. An NT system is loaded in two stages: First the NT loader (NTLDR) is booted and then it loads an NT system ( Figure 1).

The boot and load process consists of four steps:

1. The hardware Basic Input/Output System (BIOS) reads the NT Master Boot Record (MBR) located in the first 512-byte sector of the primary disk partition. The MBR contains the bootstrap code that starts the NTLDR.
2. NTLDR invokes NTDETECT.COM, which compiles a list of the hardware configured on the PC. This information is used during the NT load process and stored in the registry when NT has loaded.
3. NTLDR reads the BOOT.INI file, which contains details of the loadable NT systems and their physical locations. NTLDR displays on the screen a list of the NT systems, enabling you to choose which system to load. This completes the boot stage of the process.
4. Having determined the hardware configuration, NTLDR attempts to load the system you selected in step 3. If the hardware configuration detected by NTDETECT matches the configuration being booted, NT continues to load.

The NT boot and load process uses two NT partitions: boot and system.

1.1.1 NT Boot Partition

The NT boot partition is usually the active primary partition on the first physical disk in a system. This is the partition from which the hardware BIOS will attempt to load. The boot partition must be formatted by NT as one of the supported NT file systems: File Allocation Table (FAT), High Performance File System (HPFS), or the NT File System (NTFS). This formatting creates the MBR, which, when activated, initializes the NTLDR.

The boot partition must contain the following files in its root directory:

• NTLDR
• NTDETECT.COM
• BOOT.INI
• NTBOOTDD.SYS

These files are "hidden" and "system" files and therefore are not usually visible either with File Manager or a dir command. You can use the attrib command to reset these attributes so that you can view the files. The functions of NTLDR and NTDETECT.COM are explained in the previous section. BOOT.INI and, optionally, NTBOOTDD.SYS, are used to configure and access the NT system partition.

+---Useful tip!--------------------------------------------------------------+

When NT is installed, it uses the first primary partition on the first physical disk as its boot partition (typically the C: drive). This is a sensible configuration for day-to-day use. For emergency use, you can create an alternative boot partition. NT can use any bootable media for a boot partition, including floppy disks.

+----------------------------------------------------------------------------+

1.1.2 NT System Partition

The NT system is located in and loaded from the NT system partition. It is typically the same partition as that used for the boot partition. When NT is installed, the operating system code is installed in a predefined directory structure known to NT as the SystemRoot directory ( Figure 2).

Figure 2. Windows NT System Partition

Figure 2 shows the directory structure of the C: drive. The SystemRoot directory in this example is \WINNT35. Having located this directory during the boot and load process, the system can continue to load. The operating system files are primarily located in the \system32 directory and its subdirectories. This directory structure must be on a direct-access, fixed disk. NT will not load from a floppy disk or sequential media such at tape. A typical NT installation places all of the NT boot and system files in the first primary partition on the first physical disk. In this case the boot and system partitions are the same.

The link between the NT boot and system partitions is the BOOT.INI file. This file provides the information that the NTLDR requires to locate the system partition and the SystemRoot directory structure. In 1.1.3 , "BOOT.INI" we look at the contents of the BOOT.INI file.

+---Useful tip!--------------------------------------------------------------+

The boot and system partitions are usually the same, but they do not have to be. They can be on separate disk partitions. This enables great flexibility. A boot partition can load NT from any number of system partitions.

+----------------------------------------------------------------------------+

1.1.3 BOOT.INI

BOOT.INI is a text file containing details of NT system partitions and the disk partitions where they are located. During the boot process, the NTLDR displays the information in this file on the screen. Thus you can choose which NT system to load (assuming that more than one is installed). If you do not select an alternative system, a predefined, default system is loaded.

The BOOT.INI file consists of two parts: boot loader and operating systems. The boot loader part defines the default system and a timeout value in seconds after which the default system is loaded. If you move the cursor to another system, the timer stops, and you can select an alternative system. The operating systems part defines the installed systems and the location of their system partitions ( Figure 3).

Figure 3. Sample BOOT.INI File

The structure of the BOOT.INI file is based on the Advanced RISC Computing (ARC) specifications, which define the adapters, disks, partitions, and paths to locate an operating system. Each line in the operating systems part defines an NT system partition and its physical location. Each system is defined with one of the following definitions:

• multi()disk()rdisk()partition()\path="Description"
•  or
• scsi()disk()rdisk()partition()\path="Description"

The definition used depends on the controller and device driver used to access the physical disk. The various parameters have different meanings in the two definitions.

1.1.3.1 multi() Definitions

The NT installation process by default uses multi() statements to define the location and path of the NT system. This specifies that the NTLDR should use the hardware BIOS to access the disk and load the NT system. This support is limited to the first disk controller in the system (either IDE or SCSI) and to the first two physical disks installed on that controller (four with a dual channel IDE controller):

multi()

This parameter tells the NTLDR to use the hardware BIOS. The value is always 0, to represent the first disk controller.

disk()

This parameter is not used with multi() definitions. It is always set to 0.

rdisk()

This parameter is used to define the physical disk number attached to the controller, and it is a number between 0 and 3.

partition()

This parameter is used to define the partition number on the physical disk defined with the rdisk() statement.

\path

Once the controller, disk, and partition have been defined, the \path parameter defines the SystemRoot directory from which the NT system is loaded. This directory is typically something like \WINNT35 (for an NT 3.51 system). It and its subdirectories contain all system files required to load an NT system. The SystemRoot directory is the NT system partition.

The final parameter, after the "=" sign is a description of the system to be loaded. This description is displayed by NTLDR when it prompts the user to choose a system to load. Here are two examples of multi() definitions taken from Figure 1:

multi(0)disk(0)rdisk(0)partition(1)\WINNT35="Windows NT Workstation 3.51"
multi(0)disk(0)rdisk(0)partition(2)\WINNT40="Windows NT Workstation 4.0"

The first example is for an NT workstation 3.51 system. It is located in the \WINNT35 directory in the first partition, in this case a primary partition. The partition is on the first disk, rdisk(0), attached to the first disk controller, multi(0). The second example is for an NT workstation 4.0 system. It is located in the \WINNT40 directory, this time in the second partition, a logical volume on the same physical disk as the previous definition.

Note: These examples are actually for a PS/2 Microchannel SCSI adapter. Because it is the first adapter in the system, supported by the BIOS, a multi() definition has been used. Alternatively, a scsi() definition could have been used (see below). The NT installation process uses multi() definitions for the first adapter, whether it is IDE or SCSI.

1.1.3.2 scsi() Definitions

A scsi() definition differs from a multi() definition in that, rather than relying on the hardware BIOS, it loads and uses a SCSI device driver, NTBOOTDD.SYS, to access the disks. The NTBOOTDD.SYS driver is created in the boot partition when NT is installed on a SCSI-attached disk. This support is not limited to the first two disks on the first controller as with the multi() definitions. A scsi() definition can be used with any SCSI adapter and disk supported by Windows NT. The parameters for scsi() definitions are:

scsi()

This parameter tells the NTLDR to use the NTBOOTDD.SYS device driver to access the disk. The value of scsi() is the SCSI adapter number; 0 to represent the first SCSI controller, 1 for the second, and so on. The actual numbering and ordering of the adapters depend on the individual adapter and the NTBOOTDD.SYS device driver.

disk()

This parameter defines the SCSI ID of the physical disk.

rdisk()

This parameter defines the SCSI logical unit number (LUN) of the disk. In most cases it is 0.

partition()

This parameter defines the partition number on the physical disk defined with the disk() statement.

\path

This parameter is the same as for multi() definitions. It defines the directory containing the NT system.

Here is an example of a scsi() definition taken from Figure 1:

scsi(1)disk(0)rdisk(0)partition(1)\WINNT35="Windows NT Repair Partition"

This example is for an NT workstation 3.51 system, described as a "Repair Partition". It is accessed by using the second SCSI adapter, a PS/2 Microchannel SCSI adapter, in the system (scsi(1)). The disk uses a SCSI ID of 0 and a LUN of 0 (disk(0) and rdisk(0)). The path to the NT system is the \WINNT35 directory located in the first partition (partition(0)) on the disk.

Note: The above SCSI ID is actually a logical ID used by the NT device driver for PS/2 Microchannel SCSI adapters. The real SCSI ID of the disk is 6, which NT interprets as a logical ID of 0. This mapping behavior is unique to Microchannel SCSI adapters.

In this example the NTBOOTDD.SYS device driver is used to access the adapter and disk. The NT install process creates the driver in the boot partition during the installation. The driver is not a generic SCSI device driver, it is a copy of the device driver for the adapter being used. NTBOOTDD.SYS is a copy of the Microchannel SCSI adapter driver, SPOCK.SYS. If an Adaptec 1540 SCSI controller were used, NTBOOTDD.SYS would be a copy of the AHA154X.SYS device driver.

1.1.4 Summary

The Windows NT boot process is a relatively straightforward two-stage process. The NT loader sets up the environment for an NT system to be loaded. The NT loader is located in the boot partition and consists of four files. This boot partition is typically on a primary disk partition. However, it can also be on removable media such as floppy disks.

The NT system is loaded from the system partition. Typically this system partition is the same partition as the boot partition. However, it does not have to be. It can be located on any fixed disk partition. Multiple system partitions can be created for a single PC. The link between the boot and system partitions is the BOOT.INI file. This provides a high degree of flexibility, allowing multiple NT systems to be installed on a single PC.

1.2 Configuration Examples

Having established the "rules" governing the NT boot and load process, in this section we look at configuration examples for NT systems. For those systems that justify the effort, particularly NT servers, we recommend that you prepare for the time when the system will not load, such as when there is a hardware failure (processor, adapter, or disk drive) or a system failure, such as registry corruption or loss of a critical system file.

For these scenarios we recommend that you configure an alternative, or repair, NT system partition. When necessary, you can load the repair partition and use it to repair whatever has caused the problem. Having a repair partition is particularly important when using the NTFS. With a FAT file system, you can boot a DOS system from diskette and have access to the FAT drives on the system. With NTFS you do not have this option. The only system that can access an NTFS drive is another NT system.

In the remainder of this section we look at installing a disk repair partition, installing a repair partition on removable media, and using repair partitions.

The scenarios are based on using the NT install process to create and configure the repair partitions.

1.2.1 Installing a Disk Repair Partition

In 1.1 , "NT Boot Process" we indicate that the NT boot and system partitions can be in separate disk partitions. You can take advantage of this flexibility by creating an alternative system partition in another disk partition. Install another copy of NT in a different disk partition and update the boot partition to enable the repair system to be loaded. Having installed the system partition and updated the boot partition, you can copy the updated boot partition files to an NT formatted diskette to create an alternative bootable NTLDR

The three stages of installing a disk repair partition are:

1. Defining the disk repair partition to be used
2. Installing an NT system and update the boot partition
3. Creating a diskette boot partition

1.2.1.1 Defining the Disk Repair Partition to be Used

Before you install the NT system, you have to decide where to put it. Ideally, for maximum availability, you should put the system on another physical disk connected if possible to a different disk controller. The repair partition could be a dedicated partition, created with the NT Disk Administrator tool, or an existing partition with sufficient free space. With a dedicated partition, the system can be isolated from other applications and users. However, a dedicated partition uses another drive letter on the system. Using an existing partition saves the trouble of having to define another drive but exposes the repair system to possible damage by other applications or users.

Whether you choose a dedicated or existing partition, approximately 100 MB of space will be required. This amount of space is sufficient for a complete NT 3.51 or NT 4.0 system, either the server or workstation version.

1.2.1.2 Installing an NT System

Once you have decided where to install the repair partition, you will find the actual installation process straightforward. Two installation programs are available on the NT installation media. One, WINNT.EXE, is for installing NT on an existing DOS system, the other; WINNT32.EXE, is for installing NT on an existing NT system. The install program has a number of options. For the purpose of installing our repair system, we found the /B option very useful. It installs NT without creating installation recovery diskettes. The diskettes are created by default during the NT installation process and contain a subset of the NT system code. They can be used to assist in the recovery of a corrupted NT installation. However, for our purposes, installing an additional NT system, they are optional, and using the /B option bypasses their creation.

When WINNT32.EXE is executed, it determines whether an NT system is installed and asks if you want to upgrade that system or install another copy of NT. If you choose to install another copy of NT, you are prompted for a drive location. Once you specify the drive letter of the selected disk partition and a directory name, the installation process continues.

If you reinstall NT to create the repair partition, you have to do a complete install, answering all configuration questions about machine name, domain name, network protocols, and the like. We recommend that you configure the repair partition as an exact clone of the original NT system. If the system is an NT 3.51 domain controller, the repair partition should also be an NT 3.51 domain controller. We also recommend using the same server or workstation name. In this way, the repair partition can be used as if it were the original system, without having to add additional workstation or server names to the domain.

When the NT system is installation is complete, you will have:

1. Created an NT system partition in the specified disk partition. This will include a new SystemRoot directory structure ( 1.1.2 , "NT System Partition") containing all of the NT system files.
2. Updated the BOOT.INI file in the boot partition with the location and a basic description of the new system partition.

At this stage it is worth looking again at the BOOT.INI file. If an NT 3.51 workstation is installed, the installation will add two additional system partition entries to the BOOT.INI file:

scsi(1)disk(0)rdisk(0)partition(1)\WINNT35="Windows NT Workstation Version 3.51"
scsi(1)disk(0)rdisk(0)partition(1)\WINNT35=...
       ..."Windows NT Workstation Version 3.51 [VGA mode]" /basevideo /sos

These entries are the pointers to the newly created system partition. The NT installation program creates two entries for each system. The first entry is the original system entry that will load the system according to the configuration defined during its installation. The second entry is created for situations where the system will not load, because of either a bad device driver or missing system file. The /BASVIDEO option loads the system using a video graphics adapter (VGA) device driver. The /SOS option displays the individual NT system files on the screen as they are loaded and runs a checkdisk on the disk partitions. This option can be useful if a missing system file, file system problem, or bad device driver is preventing the system from loading.

The multi() or scsi() parameters for the two system partition entries are created by the installation program, which describes each system partition only by its level and type (workstation or server). With multiple systems installed, it is advisable to update this description so that it is clear to users which system they are loading.

We changed the description of our repair partition to "Repair Partition" by editing the BOOT.INI file, which is a "System" and "Read Only" file. Use the attrib command to reset these attributes both before and after editing the file. While editing BOOT.INI, ensure that the default system, loaded after the boot timer expires, is the correct production system. The default system is defined in the boot loader part of BOOT.INI (see Figure 3).

The repair partition is now ready to use. When the NT system is shut down and restarted, the new repair partition will be displayed on the NTLDR selection screen:

+----------------------------------------------------------------------+
|                                                                              |
| OS Loader V4.00                                                              |
|                                                                              |
| Please select the operating system to start:                                 |
|                                                                              |
|                                                                              |
| Windows NT Workstation 3.51                                                  |
| Windows NT Workstation 4.00                                                  |
| Windows NT Repair Partition                                                  |
|                                                                              |
| Use ^ and V to move the highlight of your choice                             |
| Press Enter to choose.                                                       |
|                                                                              |
+----------------------------------------------------------------------+

To load the newly created repair partition, select it and press Enter.

1.2.1.3 Creating a Diskette Boot Partition

Once you have created a repair partition, you can use it if for some reason the original partition will not load. However, you still have to start the NTLDR in the boot partition. This assumes that the hardware BIOS can still access the NT master boot record on the first physical disk to invoke the NTLDR. If that disk has failed, however, this process will not work. You have created a repair partition on another disk, but it cannot be loaded because the boot partition has been lost as well.

The simple solution is to create an emergency boot partition on a diskette. The boot and system partitions can be on different disks. The system partition must be on a fixed disk, but the boot partition can be on other media such as a diskette. Creating a diskette boot partition is a simple process:

1. Create an NT bootable diskette by formatting it with NT. You can do this from File Manager or from a command prompt with the format command. Both methods create the NT MBR on the diskette.
2. Using File Manager, copy the following files from the root of the boot partition (C: drive) to the diskette:
   • NTLDR
   • NTDETECT.COM
   • NTBOOTDD.SYS
   • BOOT.INI

Of these files, NTBOOTDD.SYS is optional; it is required only if a SCSI controller is being used. Once you have copied the files, the diskette can be booted when the system is started. The system will display the NTLDR selection screen and allow a system partition to be loaded from any fixed disk on the system.

1.2.2 Installing a Repair Partition on Removable Media

The process of using a diskette boot partition is fine as long as the repair system partition disk is accessible. To prepare for situations where the disk is not accessible or a permanent disk repair partition is not feasible, you can install a repair partition on removable media.

NT cannot be loaded from diskette. The boot partition files can be copied to diskette to create a diskette boot loader. However, the system partition must be on a fixed disk, or rather, a device that NT understands as being "fixed" and "direct access". This restriction excludes sequential media such as tape drives. However, NT views removable cartridge devices as disks. Popular examples of these devices are iomega Zip and Jaz drives and SyQuest EZ135 drives. They provide direct access and can be formatted as FAT or NTFS file systems. The NT installation program allows you to install an NT system on these devices. The combination of a diskette-based NTLDR and a removable system partition facilitates the installation and configuration of a truly removable NT system ( Figure 5).

Figure 5. Creating a Repair Partition on Removable Media

In this example an iomega Zip drive is used. This device has cartridges with a capacity of 100 MB which is adequate for installing an NT server or workstation system. First we look at the hardware configuration considerations for this type of drive and then at how an NT system can be installed.

1.2.2.1 Removable Drive Configuration

Windows NT supports various removable drive types. For details of the currently supported hardware, see the "Windows NT Hardware Compatibility List (HCL)," which you can find on the following Microsoft WWW and FTP servers:

• HTTP://WWW.MICROSOFT.COM/
• FTP.MICROSOFT.COM.

Basically, NT supports a variety of SCSI-attached devices including the Zip drive used in this example. In addition to a supported device, a SCSI adapter supported by NT is also required. This SCSI adapter must have on-board hardware BIOS and be capable of automatically identifying and configuring SCSI devices. It also must have an NT device driver and be capable of being used by NT for boot devices. An existing SCSI adapter could be used for other attached devices, or a separate adapter could be used specifically for this task. If you use an existing adapter, exercise care when defining the SCSI IDs. The Zip drive, for example, can be configured only with a SCSI ID of either 5 or 6, using a switch on the rear of the device. This restriction may conflict with other devices and dictate that a separate SCSI adapter be used.

In this example we used a PS/2 Microchannel SCSI adapter. After we connected the Zip drive and powered on the machine, the hardware automatically detected and configured the device. When NT is started, it detects that a new drive is available and runs a checkdisk operation on it during the load process. NT then assigns its next available drive letter to this drive.

+---New SCSI adapter?--------------------------------------------------------+

If a new SCSI adapter is also installed at the same time as the Zip drive, the required NT device driver may not be installed. In this case, before the drive can be used, you have to install the device driver by using the Windows NT Setup program and the Add/Remove SCSI Adapters option. This must be done before you install the new NT repair partition.

+----------------------------------------------------------------------------+

1.2.2.2 Repair System Configuration

The NT Disk Administrator tool views a Zip drive as a physical drive with a single formatted 96 MB primary partition ( Figure 6). Zip cartridges are preformatted as a FAT file system. They can be reformatted as NTFS; however, for the purpose of creating an emergency repair partition, FAT is probably the best choice.

Figure 6. NT Disk Administrator Showing Zip Partition

Once the drive is configured to NT, the installation process is the same as for a fixed disk. NT updates the BOOT.INI file with the location of the system partition on the Zip drive. Once you have completed the NT installation, you can load the newly created NT system in the same way as any other installed system. It is important to update the system description in the BOOT.INI file, particularly as the installed system is removable. As with the fixed disk example, you can create a diskette boot partition by copying the NTLDR files and the BOOT.INI file to an NT formatted diskette. The combination of this diskette and a removable cartridge system partition creates a truly portable NT system that can be removed and kept in a secure location for future use. If you move the system offsite, be sure to update the original BOOT.INI file on the primary disk partition to remove the pointers to the repair system partition that you have removed.

+---SCSI configurations------------------------------------------------------+

Take care when using SCSI adapters for booting NT images, particularly if more than one type of adapter is used. The installation process copies the appropriate SCSI device driver for the adapter card to the boot partition and renames it NTBOOTDD.SYS. Only one NTBOOTDD.SYS can be in the boot partition and it will be a copy of the driver for the adapter used during the most recent installation. If a previously installed NT system partition used a different driver, it will no longer load, as its "personalized" NTBOOTDD.SYS will have been replaced by the subsequent installation. A sensible precaution is to copy and rename NTBOOTDD.SYS before installing with a different adapter. In this way it is always possible to correct any problems after the installation.

+----------------------------------------------------------------------------+

1.2.3 Using Repair Partitions

The main use of a repair partition is system recovery when the normal NT system will not load. Having an alternative partition that can be loaded enables you to access the corrupted or damaged primary partition and resolve whatever the problem is.

In some cases the problem is a corrupted registry or lost system file. Loading a repair partition enables you to inspect such problems and potentially resolve them. One of the problems for administrators and users of NT is that a number of files, including the registry files, are opened during the NT loading process and locked. It is nearly impossible to perform any remedial action on a running NT system. Running from a repair partition changes this situation. Assuming that the repair partition is installed on the F: drive, NT will run from that drive, and all locked system files will be on that drive. If the primary partition is the C: drive, all system files, usually locked, are treated as ordinary files by the repair partition. If the problem is a corrupted registry or a missing device driver, these files can be copied, renamed, and generally treated like any other files. The system is exposed to potential damage, however, and extreme care should be taken when working with system these files.

In the more extreme case of a disk failure, a repair partition enables you to quickly get an NT system running again. Once you have replaced the failed disk, you can use the repair partition to configure the disk partitions and restore the data. In Chapter 2. "Using ADSM with Repair Partitions" we look at how ADSM can be used with repair partitions.