There are several utilities that you can use to troubleshoot these kinds of problems. The Windows NT Server Resource Kit CD contains a Windows NT-based utility, DiskProbe, that you can use to examine and change information on individual disk sectors. Chapter 7, "Disk, File System, and Backup Utilities," contains more information about DiskProbe and the MS-DOS-based utilities that you can use to read, write, and change information on disk sectors.

Other Sources of Information

There are several other sources of information for troubleshooting startup and disk problems:

Chapter  8, "General Troubleshooting," contains details about Microsoft's sources for troubleshooting information and contains more details about troubleshooting hardware, software, and startup problems.

The Windows NT Workstation Resource Guide contains several chapters that have troubleshooting information. These chapters are not included in the Windows NT Server Resource Guide:

	Chapter 23, "Overview of the Windows NT Registry," describes how to use information in the Registry for troubleshooting and configuration maintenance.
	Chapter 25, "Configuration Management and the Registry," provides problem solving techniques using the Registry.
	Chapter 39, "Windows NT Debugger," describes the different kinds of Kernel STOP errors that you might see during startup. It also contains information about using the Windows NT Debugger.

	Appendix A, "Windows NT Setup Troubleshooting" in the Windows NT Server Concepts and Planning book, contains troubleshooting information, including answers to commonly asked questions.
	Windows NT online help contains a troubleshooting topic.

The Microsoft Knowledge Base contains support information developed by Microsoft Product Support Specialists. The Windows NT Knowledge Base is included on the Windows NT Server Resource Kit CD. It is also included on the:

	Microsoft Developer Network (MSDN) CD
	TechNet CD
	Microsoft Internet FTP host, ftp.microsoft.com
	Technical Support and Services category on the Web page at http://www.microsoft.com/server

Troubleshooting Startup Problems on x86-based Computers

If you have installed new hardware or new drivers, they could be causing the problem.

Problem Occurs Before the Boot Loader Starts

Symptoms of problems in this group are:

	The computer hangs immediately after the Power On Self Test (POST).
	You do not see the boot loader screen.

You receive messages such as:

	Missing operating system.
	A disk read error occurred.
	Insert a system diskette and restart the system.
	Invalid partition table.
	Hard Disk Error.
	Hard Disk Absent/Failed.

It is possible that you will not be able to start your computer to troubleshoot the problem. If all of your primary partitions are NTFS, using MS-DOS-based utilities will not do much good. If you have created a Windows NT startup floppy disk, as described in Chapter 5, "Preparing for and Performing Recovery," you can try using that disk. If you cannot start the computer by using your Windows NT startup floppy disk, and repairing your system by using the Emergency Repair Disk does not fix the problem, you can try removing it from the computer and installing it as a second disk on another Windows NT computer. You can then use Windows NT-based utilities for troubleshooting.

Caution Moving disks between computers is not supported because of problems that can arise when the disk controllers on the two systems are incompatible or are configured differently. However, if your two computers are configured the same, you might be able to identify and correct the problem.

The problem could be one of the following:

	There is no system partition on the first hard disk.
	The Master Boot Record is corrupt.
	The Partition Boot Sector is corrupt.
	The Boot.ini file is missing.
	The Windows NT boot loader, NTLDR, is missing or corrupt.
	The Complementary Metal Oxide Semiconductor (CMOS) is corrupt, or the CMOS battery is run down.
	Hardware has malfunctioned.

Troubleshooting System Partition Problems

Using Fdisk to check for and set the system partition

Not all computers should be set to start from the first primary partition. For example, you can configure multiple partitions and install different operating systems on each partition. Some computers have EISA configuration partitions, and normally start from the second physical partition. For example, many Compaq computers are configured this way. However, the system partition should always be on your first physical hard disk.

Troubleshooting Master Boot Record Problems

The functions of the Master Boot Record code are to:

	Read the Partition Table entries in the same sector.
	Determine the location of the Partition Boot Sector.
	Load and execute the code in the Partition Boot Sector.

If the executable code in the Master Boot Record does not do these functions, it displays one of these error messages:

	Missing operating system.
	Invalid partition table.

Note There is a Master Boot Record on each hard disk. However, only the Master Boot Record on the first hard disk is used in starting Windows NT.

There are two things that you can check in the Master Boot Record:

	The error message text should be as shown in the example.
	There should be only zeroes between the text Missing operating system and location hex 1B8.

A disk signature might or might not be present starting at location 1B8. Having no disk signature does not necessarily indicate a problem.

Using DiskProbe to display the Master Boot Record

Troubleshooting Partition Boot Sector Problems

In some cases, the damage to the Partition Boot Sector can cause the computer to stop after displaying a blue screen with the message STOP 0x0000007B INACCESSIBLE_BOOT_DEVICE. Another symptom of a Partition Boot Sector problem is that the computer stops before displaying any messages, and the screen remains black.

Using DiskProbe to display the Partition Boot Sector

Because the Partition Boot Sector contains several fields that are computer-specific, every byte in your Partition Boot Sector will not be identical to the information shown in the examples here. The following information should be the same:

	The first three bytes should be the jump instruction.
	The next 11 bytes should be the OEM header string.
	There should be error message text toward the end of the sector.

These examples show portions of the Partition Boot Sector that should be the same or contain similar text on all computers. The first example is for a FAT volume, the second one is for an NTFS volume formatted when running Windows NT 3.51, and the third one is for an NTFS volume formatted when running Windows NT 4.0.

00000000: EB 3C 90 4D 53 44 4F 53 - 35 2E 30 00 02 08 01 00 .<.MSDOS5.0.....
00000180: 90 A2 07 02 F8 CB 42 4F - 4F 54 3A 20 43 6F 75 6C ......BOOT: Coul
00000190: 64 6E 27 74 20 66 69 6E - 64 20 4E 54 4C 44 52 0D dn't find NTLDR.
000001A0: 0A 00 42 4F 4F 54 3A 20 - 49 2F 4F 20 65 72 72 6F ..BOOT: I/O erro
000001B0: 72 20 72 65 61 64 69 6E - 67 20 64 69 73 6B 0D 0A r reading disk..
000001C0: 00 50 6C 65 61 73 65 20 - 69 6E 73 65 72 74 20 61 .Please insert a
000001D0: 6E 6F 74 68 65 72 20 64 - 69 73 6B 00 4E 54 4C 44 nother disk.NTLD
000001E0: 52 20 20 20 20 20 20 00 - 00 00 00 00 00 00 00 00 R .........
000001F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA ..............U.

00000000: EB 5B 00 4E 54 46 53 20 - 20 20 20 00 02 01 00 00 .[.NTFS .....
00000130: F2 C3 1D 00 41 20 64 69 - 73 6B 20 72 65 61 64 20 ....A disk read
00000140: 65 72 72 6F 72 20 6F 63 - 63 75 72 72 65 64 2E 0D error occurred..
00000150: 0A 00 29 00 41 20 6B 65 - 72 6E 65 6C 20 66 69 6C ..).A kernel fil
00000160: 65 20 69 73 20 6D 69 73 - 73 69 6E 67 20 66 72 6F e is missing fro
00000170: 6D 20 74 68 65 20 64 69 - 73 6B 2E 0D 0A 00 25 00 m the disk....%.
00000180: 41 20 6B 65 72 6E 65 6C - 20 66 69 6C 65 20 69 73 A kernel file is
00000190: 20 74 6F 6F 20 64 69 73 - 63 6F 6E 74 69 67 75 6F too discontiguo
000001A0: 75 73 2E 0D 0A 00 33 00 - 49 6E 73 65 72 74 20 61 us....3.Insert a
000001B0: 20 73 79 73 74 65 6D 20 - 64 69 73 6B 65 74 74 65 system diskette
000001C0: 20 61 6E 64 20 72 65 73 - 74 61 72 74 0D 0A 74 68 and restart..th
000001D0: 65 20 73 79 73 74 65 6D - 2E 0D 0A 00 00 00 00 00 e system........
000001E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000001F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA ..............U.

00000000: EB 5B 90 4E 54 46 53 20 - 20 20 20 00 02 01 00 00 .[.NTFS .....
00000130: 07 00 CD 10 EB F2 C3 1D - 00 41 20 64 69 73 6B 20 .........A disk
00000140: 72 65 61 64 20 65 72 72 - 6F 72 20 6F 63 63 75 72 read error occur
00000150: 72 65 64 2E 0D 0A 00 29 - 00 41 20 6B 65 72 6E 65 red....).A kerne
00000160: 6C 20 66 69 6C 65 20 69 - 73 20 6D 69 73 73 69 6E l file is missin
00000170: 67 20 66 72 6F 6D 20 74 - 68 65 20 64 69 73 6B 2E g from the disk.
00000180: 0D 0A 00 25 00 41 20 6B - 65 72 6E 65 6C 20 66 69 ...%.A kernel fi
00000190: 6C 65 20 69 73 20 74 6F - 6F 20 64 69 73 63 6F 6E le is too discon
000001A0: 74 69 67 75 6F 75 73 2E - 0D 0A 00 33 00 49 6E 73 tiguous....3.Ins
000001B0: 65 72 74 20 61 20 73 79 - 73 74 65 6D 20 64 69 73 ert a system dis
000001C0: 6B 65 74 74 65 20 61 6E - 64 20 72 65 73 74 61 72 kette and restar
000001D0: 74 0D 0A 74 68 65 20 73 - 79 73 74 65 6D 2E 0D 0A t..the system...
000001E0: 00 17 00 5C 4E 54 4C 44 - 52 20 69 73 20 63 6F 6D ...\NTLDR is com
000001F0: 70 72 65 73 73 65 64 2E - 0D 0A 00 00 00 00 55 AA pressed.......U.

Although other corruption problems are possible, if any of the strings are incorrect or missing, you should assume the sector is corrupt.

Even if there is no obvious damage, the Partition Boot Sector might not be working correctly. One way to check for this problem is to change the name of NTLDR to anything else and restart Windows NT from the hard disk.

You should see this error message on a FAT primary partition:

Couldn't find NTLDR.

You should see this error message on an NTFS primary partition:

A kernel file is missing from the disk.

These errors indicate that the Partition Boot Sector is okay and that the problem is with a corrupt NTLDR file. In this case, see "Replacing Windows NT Files on the System Partition" within Chapter 5, "Preparing For and Performing Recovery," for information about replacing NTLDR.

If you don't get this error message, then the problem is probably a corrupt Partition Boot Sector. To replace the sector, see "Replacing the Partition Boot Sector," within Chapter 5, "Preparing for and Performing Recovery." Be sure to change the name back to NTLDR so that the Partition Boot Sector can find it again.

NTLDR usually has the Hidden, System, and Read Only attributes set. Because you cannot start Windows NT when the Partition Boot Sector on the boot partition is corrupt, you can start the MS-DOS operating system from the MS-DOS startup floppy disk to change the attributes. To change the attributes by using the MS-DOS attribute command, enter:

attrib -s -h -r ntldr

CMOS Problems

The CMOS typically stores information about the following:

	Time and date
	Floppy disks
	Video type
	Hard disks
	Memory installed

Each manufacturer and BIOS vendor can decide what a user should be able to configure, and what the standard configuration is. You can access the CMOS through either a utility or a keyboard sequence, depending on the manufacturer. You should write down or use a utility to print all of the CMOS information.

The computer uses the CMOS checksum to determine if any CMOS values have been changed other than by using the CMOS Setup program. If the checksum is not correct, the computer will not start.

Once the CMOS is correctly configured, CMOS problems are usually caused by one of the following:

	A weak battery, which can happen if the computer has not been powered on for a long time.
	The connection between the CMOS and the battery is loose or faulty.
	The CMOS has been damaged from static electric discharge.

All of these problems can result in information in the CMOS being set to zero or otherwise corrupt, this halting the startup.

Hardware Problems

If you have changed your disk configuration, you should check that:

	SCSI devices are terminated properly.
	The BIOS is enabled on only the first SCSI controller (if at all). See "Understanding ARC Pathnames" within Chapter 5, "Preparing For and Performing Recovery," for information about whether the controller BIOS should be enabled.
	There are no IRQ conflicts.

If you have not made any changes, check that

	Controller cards are seated properly.
	Cables are properly connected.
	Disks are all powered up.

Chapter 8, "General Troubleshooting," discusses hardware problems. The Knowledge Base also contains information about troubleshooting these kinds of problems.

Problem Occurs After the Boot Loader Starts

NTDETECT V1.0 Checking Hardware . . .

Using Checked Version of NTDETECT

To use the checked version:

	Rename Ntdetect.com to Ntdetect.bak in the root folder of your system partition.
	Copy Ntdetect.chk from Support\Debug\I386 to the root folder.
	Rename Ntdetect.chk to Ntdetect.com.

The utility Installed on the Windows NT Server Resource Kit CD performs the same functions.

Note Ntdetect.com has attributes of Hidden, System, and Read Only set when you install Windows NT. You need to clear these attributes to make the file visible. You can change the attributes by using My Computer, Windows NT Explorer, or the command prompt.

To change file attributes by using My Computer or Windows NT Explorer

When you have finished using Ntdetect.chk, you should rename Ntdetect.com to Ntdetect.chk and rename Ntdetect.bak to Ntdetect.com.

Using the /maxmem Switch

Chapter 8, "General Troubleshooting," contains more information about troubleshooting memory problems.

Using the /sos Switch

multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\c_1252.nls
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\c_437.nls
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\n_intl.nls
multi(0)disk(0)rdisk(0)partition(2)\winnt40\FONTS\vgaoem.fon
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Drivers\Atdisk.sys
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Disk.sys
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\CLASS2.SYS
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Diskperf.sys
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Ntfs.sys

Fatal System Error: 0x0000006B

In some cases on ESDI disks with more than 1024 cylinders, Windows NT Server appears to have been successfully installed. However, the first time that you attempt to start from the hard disk, NTLDR loads various files and then produces a Fatal System Error: 0x0000006b with the message that Phase 1 Process Initialization failed. Following this message is a hexadecimal dump and system lockup. If you experience this problem, read the section "ESDI Hard Disk" within Chapter 3, "Disk Management Basics," for information about the ESDI controllers that Microsoft has tested.

Stop 0x0000007B — Inaccessible Boot Device

Another cause of the problem is incompatible Logical Block Addressing (LBA). The system BIOS is designed to allow access to fixed disks that use fewer than 1024 cylinders. Many modern disks, however, exceed 1024 cylinders. LBA is used to provide support for these disks. Such support is often built into the system BIOS. However, there are potential problems with LBA:

	If partitions were created and formatted with LBA disabled, and LBA is subsequently enabled, a STOP 0x0000007B can result. The partitions must be created and formatted while the LBA is enabled. In addition, changing LBA modes from one scheme to another can cause you to have to recreate the partitions and reformat the disk.
	Some LBA schemes are not compatible with Windows NT. When in doubt, it is best to check with your vendor.

A corrupt Partition Boot Sector can also cause this STOP message, depending upon what part is corrupt. This problem is similar to a virus, except that the corruption is caused by such things as a defective disk or controller, or a bug in a program that somehow has corrupted the Partition Boot Sector.

Troubleshooting Startup Problems on RISC-based Computers

The startup problems common to RISC-based computers are:

	Missing or incorrect file(s). This problem is usually the result of a user deleting, moving, or renaming a file that is needed for startup. It is also possible that a device driver is not the correct version for the device.
	Incorrect firmware. Upgrading to a new version of Windows NT typically requires upgrading the firmware. The firmware upgrades are available through your RISC-based computer vendor.

On RISC-based computers, you can use the /sos switch to display the Kernel and device driver names while they are being loaded. Include this switch on the OSLOADOPTIONS variable in the firmware. See the section "Using the /sos Switch," presented earlier in this chapter, for a description of the output you see when using this switch. There is information about editing the firmware variables in the section titled "Manage Boot Selection Menu," within Chapter 19, "What Happens When You Start Your Computer," in the Windows NT Workstation Resource Guide.

Troubleshooting problems with RISC-based computers can be more difficult than troubleshooting problems with x86-based computers because there are few disk or hardware troubleshooting tools available outside of Windows NT. If you can startup Windows NT, which you might be able to do by using your Windows NT startup floppy disk, try using these utilities:

	The Windows NT Diagnostics in the Administrative Tools program group, which enables you to look at hardware information.
	The DiskProbe utility on the Windows NT Server Resource Kit CD, which is a low-level disk editor that enables you to examine and change individual disk sectors.

On RISC-based computers, there are no recovery tools such as those available when you dual-boot MS-DOS on x86-based computers. If your startup problem is because of a problem with information on the hard disk, you might have to remove the disk from the RISC-based computer and install it as a second disk on an x86-based computer to troubleshoot the problem. When you use this approach, you can use a low-level disk editor to examine the information on the disk in the same way you would troubleshoot a problem with a disk on an x86-based computer. Although these kinds of problems do not occur very often, you might have to use this approach after a power failure or system crash.

Note On NTFS volumes, you need to use Windows NT-based utilities, such as DiskProbe, to examine information on the volume.

Troubleshooting Startup Problems Common to Both x86-based and RISC-based Computers

When starting your computer, Windows NT provides options for using alternative configurations. If you have changed hardware or device drivers since the last startup and Windows NT does not complete startup, try using one of the other options.

Troubleshooting by Using the Last Known Good Configuration

Windows NT provides two configurations in which you can start your computer:

	Default, the configuration that was saved when you shutdown the computer.
	Last Known Good, the configuration that was saved when you last logged on to your computer.

The configurations are stored as control sets in the Registry key HKEY_LOCAL_MACHINE\SYSTEM. If you made changes to your configuration when you were last logged on, such as adding drivers, changing services, or changing hardware, the two control sets will contain different information. As soon as you log on however, the information in these control sets will be the same. Therefore, if you are having problems with startup, and think the problems might be related to changes in your configuration, do not log on. Instead, shutdown the computer and restart it. Then, select Last Known Good from the Hardware Profile/Last Known Good menu to recover from the following types of problems:

	You install a new device driver, restart Windows NT, and the system stops responding. The Last Known Good control set enables you to startup because it does not contain any reference to the new, faulty driver.
	You install a new video driver and are able to start the system. However, you cannot see anything, because the new video resolution is incompatible with your video adapter. Do not try to log on. If you have the option to shutdown the computer without logging on, do so. If that option is not available, you need to restart your computer by turning it off or using the reset button. Wait for all disk activity to stop before you initiate the restart, especially if the computer has FAT volumes.
	You accidentally disable a critical device driver (such as the Scsiport driver). Windows NT is not be able to start and automatically reverts to the Last Known Good control set.

Using the Last Known Good control set does not help in the following situations:

	Any problem that is not related to changes in control set information, such as information like user profiles and file permissions.
	After you logged on after making changes. Here, the Last Known Good control set has already been updated to include the changes.
	Switching between different hardware profiles, such as docked and undocked laptops. The Last Known Good control set is only a method to switch between configuration information in the Registry. Use Hardware Profiles for this.
	Startup failures caused by hardware failures or corrupted files.
	Copying a new driver over the top of an old one, and the old one is already active.

Chapter 8, "General Troubleshooting," contains more details about troubleshooting by using the Registry key HKEY_LOCAL_MACHINE. For more information about hardware profiles and control sets, see Chapter 19, "What Happens When You Startup Your Computer," in the Windows NT Workstation Resource Guide.

Troubleshooting Video Problems

Troubleshooting Disk Problems That Occur After Logon

This section discusses problems that occur after you have successfully logged on.

Volume is Displayed as Unknown

If you have created and formatted a volume with NTFS or FAT, but you can no longer access files on it, and Disk Administrator displays the volume as Unknown, the Partition Boot Sector for the volume might be bad.

	For NTFS volumes, there are two other possible causes for this error:
	Permissions for the volume have been changed.
	The Master File Table (MFT) is corrupt.

The Partition Boot Sector can be corrupted by viruses. Corruption problems can also occur if you have a dual-boot configuration with Windows 95 and you use the Windows 95 version of Fdisk. To avoid problems with Fdisk, delete the Windows 95 version, make sure that you have the MS-DOS-based version, and run Fdisk only when you start MS-DOS.

The permission problem occurs when you have done all the following:

	Created a second volume.
	Removed the group Everyone from the Access Control List (ACL).
	Granted access to a specific user.

The single user has normal access, but when other users log on, or if Windows NT is reinstalled, Disk Administrator sees the drive as unknown.

To correct this problem, log on as an administrator and take ownership of all folders, or add the group Everyone back with full control (default).

If there is corruption in the MFT file, there is no general solution. If you suspect this kind of problem, you should contact your technical support personnel for assistance.

Extended Partition Problems