You can use the Recovery Console (RC) to solve some problems and make some repairs that you can't resolve with an Emergency Repair Disk (ERD) or Safe Mode. Three of the more common tasks the RC can help with are deleting a pagefile, disabling a driver or service, and recovering the SYSTEM hive.
How to Delete a Pagefile
A failure during Windows 2000 or Windows NT 4.0 Setup (or service pack installation) sometimes produces a very small temporary pagefile that prevents the OS from creating a larger, permanent file. When this happens, the OS boots and uses only the temporary file, which slows performance to a snail's pace. You can't delete the temporary pagefile while the OS is running because the file is open and in use. Worse, when a temporary file exists, the OS won't create a permanent pagefile even after you configure a permanent, correctly sized pagefile. You can use the RC to delete either a temporary or permanent pagefile, but the procedure isn't exactly straightforward:
- Before you boot to the RC, verify the exact location of the temporary or permanent pagefile. Both Win2K and NT 4.0 place a permanent pagefile at the top of a partition and a temporary pagefile in the system root. In Windows Explorer, search for a file named pagefile to identify the partition and directory of a permanent or temporary file.
- Set the default location to the location of the pagefile. If the pagefile is in the root of the C partition and C is your default partition, go to the command prompt (C:\). If the pagefile is in the system root and your system root is \winnt32, enter
- To make the pagefile visible to the RC, you need to overwrite it with the contents of another file. To do so, copy any file to the same location as the pagefile and rename the copied file to pagefile.sys. For example, to copy and rename a file called help.txt, you'd type
- Type
- Use the Exit command at the RC prompt to restart the system. When you reboot, Win2K notices the absence of the pagefile and uses Virtual Memory settings from System Properties, Advanced, Performance Options to recreate it. On my Win2K notebook, this procedure also created a new hiberfile.sys file that Win2K uses to save the OS state during hibernation.
cd C:\winnt32
copy help.txt pagefile.sys
delete pagefile.sys
to delete the pagefile that you just created.
How to Disable a Driver or Service
Suppose a driver or service is freezing your OS before you can get to the correct applet to disable the misbehaving component. You need only three RC commands to disable the related Win2K file and restart the system. After you restart the system, you can permanently remove or replace the malfunctioning driver or service.
To display the status of all drivers and services, go to a command prompt and type
listsvc
This command enumerates drivers and services in three columns that identify the name of the internal driver or service, the status of the component, and—in some cases—descriptive text. The Listsvc command displays the low-level name rather than the descriptive text that typically appears in the Services or Devices applet that you see while Win2K is running. (For example, Listsvc lists Lanmanworkstation as the Workstation service, Rasman as the Remote Access Connection Manager service, and Seclogon as the RunAs service.) The command output is lengthy, so you'll need to scroll through multiple screens to examine the entire list. When you identify the name of the problematic component, type
disable <servicename or drivername>
to disable it. To restart the system, use the Exit command. As long as you've disabled the correct driver or service, the OS will be fully operational when it starts up again.
How to Recover the SYSTEM Hive
If the registry's SYSTEM hive files are missing, fragmented, corrupted, or too large, Win2K can't load the hive and can't start. At startup, hardware restrictions limit to 16MB the amount of memory that the OS can access. To start the OS, Win2K must fit the boot loader, kernel files, hardware abstraction layer (HAL) code, boot drivers, and SYSTEM hive into 16MB. If this limitation is a problem on your system, Win2K informs you at startup that a file is missing or corrupted. This message has two common meanings: The SYSTEM hive is either fragmented or corrupted.
A fragmented SYSTEM hive prevents Win2K from starting on an NTFS partition. To eliminate some—if not all—of the fragments, you can boot the RC and copy the SYSTEM hive. (Because the RC runs a minimal version of the OS, the utility doesn't need the SYSTEM hive to start Win2K.) To ensure this procedure's success, you need contiguous free disk space so that you can create a copy that will load. Boot to the RC, and set your location to \%systemroot%\system32\config (i.e., the location of the active registry files), as follows:
cd \winnt\system32\config
Rename the SYSTEM hive to a temporary filename:
rename system system.org
Copy the renamed file back to the original filename:
copy system.org system
Finally, use the Exit command to restart the system.
Under unusual circumstances, Win2K or a file-system problem can corrupt (rather than fragment) the SYSTEM hive, thereby preventing the OS from starting. If you have a current \repair\regback directory, you can replace the corrupted SYSTEM hive with a clean copy in just a couple of steps. First, rename the corrupted file and the native backup copy (system.alt) in the \config directory:
cd system32\config ren system system.old ren system.alt systemalt.old
Next, copy a good version of the file from \%systemroot%\repair\regback into \%systemroot%\system32\config:
cd \%systemroot%\repair\regback copy system \%systemroot%\system32\config\*.*
Finish with the Exit command at the RC command prompt to restart the system.
