Windows NT 4.0 -- TECHNICAL SUPPORT
- Chapter 1: Overview of NT
- Chapter 2: Installing NT
- Chapter 17: NT Boot Process
- Chapter 3: Configuring NT Environment -- Registry
- Appendix: Configuring NT -- install /remove hardware
NT refers to two different products - NT Server and NT Workstation.
provided by NT Server (and DCs) only, allows for centralized administration of / universial access to the network. The Directory Services anables each user who has been assigned a unique user name and password to access resources throughout the network. It also provides administrators with the ability to view and manage users and network resources from ANY computer on the network. In short, three benifits of NT Directory Services:
A logical grouping of typically no more than 10 computers that can share resources. As part of a workgroup, each computer running NT has its own directory database; resources and user accounts are managed at each computer.
An administrative unit of NT Directory Services. A domain contains (at least) a NT Server computer configured as PDC. The PDC maintains a dirctory database that stores all of the account and security info for the domain.
In each domain, there must be one and only one PDC, zero or more BDC (at least one BDC is recommanded)
The logical link that combines domains into one administrative unit: a trust relationship, or trust.
Domain: all domain controllers maintain a common directory database, so user can log on from any computer that is in the domain.
Workgroup: each computer maintain its own directory database, so a separate user account for each user must exist in each computer's directory database.
Differences between NT Server and NT Workstation:
Area | NT Workstation | NT Server |
Simultaneous connections | 10 | Unlimited (limited only by Client Access License - CAL) |
Maxium RAS sessions | 1 | 256 |
Replication | Import only | Import and export |
Multiprocessor | 2 | 4 (32 with OEM) |
Internet services | Peer Web Services | Internet Information Server |
Network server | No (personal web server only) | Yes |
F&P Sharing for Macintosh | No | Yes |
Disk fault tolerance | No | Yes (RAID 1, 5) |
Domain logon
validation (Directory Service) |
No | Yes |
More Detail on Differences between NT Server and NT Workstation:
Area | NT Workstation | NT Server |
No | Administrative Wizards | |
No | License Manager | |
No | Migration Tool for NetWare | |
No | Network Client Administrator | |
No | Server Manager | |
No | System Policy Editor | |
User Rights Policy | 10 basic and 17 advanced | 11 basic and 16 advanced |
More on Disk Fault Tolerance | Does not have
native support for fault tolerant volume structures
-- such as disk mirroring, disk duplexing, or disk
striping with parity ; Can do disk striping without parity. |
Native support for fault tolerant volume structures -- such as disk mirroring, disk duplexing, or disk striping with parity |
User Manager
(User Manager for Domains in NT Server) |
Users, Local Groups | Users, Local
Groups, Global Groups ; "Select Domain" ;
"Trust Relationships" ; |
Networking | Client Service for NetWare | Gateway (and
Client) Services for NetWare |
File and Print Service for NetWare | Does not come with; must purchase extra | Does not come with; must purchase extra |
Supports SQL Server, SMS, SNA, Proxy, Exchange Server | No | Yes |
NT Network Services -- NT Server vs NT Workstation
Service | NT Workstation | NT Server |
Computer Browser | Yes |
|
NetBIOS Interface | ||
Remote Access Service | ||
RPC Configuration | ||
Server | ||
Workstation | ||
RPC support for Banyan | ||
SAP Agent | ||
SNMP Service | ||
Simple TCP/IP Services | ||
Microsoft TCP/IP Printing | ||
Network Monitor Agent | ||
DHCP Relay Agent | No |
Yes |
Gateway (and Client) Services for NetWare | ||
Microsoft DHCP Server | ||
Microsoft DNS Server | ||
Microsoft Internet Information Server | ||
Network Monitor Tools and Agent | ||
Remoteboot Service | ||
RIP for Internet Protocol | ||
RIP for NWLink IPX/SPX compatible transport | ||
Services for Mac | ||
Windows Internet Name Service | ||
Microsoft Peer Web Services | Yes |
No |
Differences between NT Workstation and Windows 95
Area | NT Workstation | Windows 95 |
Certified for C2 Security | Yes | No |
Requires secured logon | Yes | No |
Runs DOS Applications | Most; DOS applications CANNOT have direct access to the CPU | Yes |
Can run 16 bit apps in separate address space | Yes | No |
Uses DOS and Win16 device drivers | No | Yes |
Multiplatform | Yes | No |
Multiprocessors | Yes | No |
Win16 applications | Yes | Yes |
DOS applications | Yes | Yes |
POSIX and OS/2 applications | Yes | No |
File systems | NTFS, FAT16 | FAT16, FAT 32 |
Plug and play | No | Yes |
Application/memory protection | Yes | Yes |
Internet services | Peer Web Services | Personal Web Server |
RAS | Inbound and outbound | Inbound with Plus! and Outbound |
MS supports only the devices listed on the HCL (Hardware Compatibility List).
NT provides the NT Hardware Qualifer (NTHQ), i.e. Hardware Query Tool 4.0 for Windows to determine the hardware on an Intel x86-based computer. Make a NTHQ disk by running Makedisk command included in the installation CD's \Support\HQTool folder. The NTHQ disk is bootable and runs in DOS.
Minimum NT hardware requirement:
Intel x86-based (80486/33 or higher)
- 486 / 33 MHz (or faster) or Pentium-based system
- RAM: 16 MB for NT Server; 12 MB for NT Workstation
- Free hard disk space (typical installation): 125 MB for NT Server, 110 MB for NT Workstation
Note: Required disk space varies according to cluster/sector size.- VGA or higher-resolution display adapter
- Microsoft Mouse or compatible pointing device
- 3.5 disk drive
Note: El Torito does not require the computer to have floppy disk because you can start computer from a bootable compact disk.- CD-ROM drive or access to a CD-ROM over a computer network
RISC-based
- Alpha AXP, MIPS R4x00 or PowerPC processor
- RAM: 16 MB
- Free hard disk space: 160 MB for NT Server, 110 MB for NT Workstation
- VGA or higher-resolution display adapter
- CD-ROM drive (required)
- Microsoft Mouse or compatible pointing device.
Note: NT 4.0 does not yet support Plug and Play. NT can automatically detect many kinds of hardware devices, but does not change hardware settings, such as the IRQ and DMA channels and base memory addresses. You may need to (manually) make sure there is no hardware setting confilictions.
System partition -- hardware-specific boot files in the active partition, must be on a primary partition (ordinarily drive C:\).
Boot partition -- contains the operating system files and its supporting files (i.e. the \Winnt\System32\... folder heirarchy). Can be located on an extended partition.
If both the hardware-specific files and the operating system and its supporting files are installed on one partition, then that partition would be both the system and boot partition.
Setup find "Unknown Partition Types" -- if you are installing NT on a hard disk that already contains stripe sets, volume sets, or any areas allocated for fault tolerance (disk mirroring and disk srtiping with parity), they appear on the Setup screen as partions of an unknown type.
NTFS -- can only be accesed by NT. Choose when:
- NT is the only operating system in use
- Using Services for Macintosh for file sharing
- Permissions must be preserved while migrating directories and files from Novell NetWare servers
- NT file compression is required
- Local File-level security is required
FAT -- can be accessed by NT, Windows 95, MS-DOS, and OS/2. Choose when:
Require multiple-boot capablity between NT and other operating systems, such as Win95 or MS-DOS. For this configuration, drive C must be formatted with FAT
- The system partition on a RISC-based computer must be formatted with FAT (must be at least 2 MB in size) for the firmware to detect the partition as a bootable partition.
Windows NT File Systems -- NTFS vs FAT
NTFS Considerations FAT Considerations Security Supports complete NT security, so you can specify who is allowed various kinds of access to a file or directory. Files are not protected by the security features of NT. Activity log Keeps a log of activities to restore the disk in the event of power failure or other problems. FAT file systems do not keep a log. Support multiple file forks for Macintosh files
- Yes
- No
Hot fixing (bad sector remapping)
- Yes
- No
Maximum File/Partition size 4 GB to 64 GB, depending on the size of your clusters. 4 GB. File compression Supports flexible per-file compression. File compression is not supported. Operating system compatibility NT only
Note: Although DOS connot see NTFS, DOS applications running under NT can.Allows access to files when your computer is running another OS, such as MS-DOS or OS/2. Huge Partitions (>4GB) Yes No Hot fixing -- or bad cluster remapping, means to repairs HD failures on the fly without returning an error message to the calling application.
Note:
The NT system partition must be formatted with the FAT file system if you want to run both Windows NT and MS-DOS or if you are dual-booting with Windows 95.
Although DOS connot see NTFS, DOS applications running under NT can.
To run both MS-DOS/Win95 and NT on the same computer, you must first install MS-DOS/Win95. Installing it later might overwrite the boot sector on the hard disk, making it impossible to start NT without using the Emergency Repair Disk.
If you want to use NTFS on a RISC-based computer, you need to create at least one FAT system partition of at least 2 MB plus a second partition large enough to contain all the files you want to protect with NTFS.
If you are installing NT on a mirrored partition, you must disable mirroring before running Setup and then reestablish mirroring after installation is complete.
If your hard disk contains stripe sets, volume sets, or mirrors, these elements appear on the Setup screen as "Windows NT Fault Tolerance" (although stripe sets without parity and volume sets are NOT fault tolerance!) -- another source says they will appears as "unknown partition types" ???
You cannot install NT on a compressed drive created with any utility other than NTFS compression (NT can be installed in an NTFS compressed drive).
NT 3.51 and earlier versions support HPFS (used in OS/2). However, NT 4.0 does support HPFS in any manner. To transform HPFS into NTFS you must use NT 3.51's Convert.exe. NT 4.0's Convert.exe can only be used to transform FAT to NTFS. Thus, if there is HPFS partition and running NT 3.51, perform the conversion before upgrading to NT 4.0.
The initial portion of NT Setup runs under MS-DOS, which does not support partitions with more than 1024 cylinders. During the installation, you may get a warning that your disk has more than 1024 cylinders. If so, you should enable sector translation (SCSI disks), or large block allocation (IDE disks) in the BIOS of your disk controller to allow NT access to the entire disk without partitioning it. If the disk controller does not support sector translation, you will have to create multiple partitions with fewer than 1024 cylinders.
Macintosh computer can access a maximum partition size of 2GB. If the partition is larger than 2GB, the client will receive a message that 0 bytes are available.
Neither the NT system nor the boot partitions can be a part of a volume or stripe set.
A partition larger than 4GB cannot be created during NT installation! and how to make one?
Why -- when creating a partition during installation, the partition is always formatted as FAT. Even if you choose to farmat the partiotion as NTFS, the initial format is FAT. At the end of the installation, the system starts and convert the partition to NTFS. Because FAT has a maximum partition size of 4 GB, a problem occurs when you want to create an NTFS partition larger than 4 GB during installation.
Solutions:
- extend the NTFS partition using Disk Administrator after NT installation (log on as Administrator)
- prior to installation, format the HD with a partition greater than 4 GB on another NT computer
- if upgrading NT, use Disk Administrator to create the partition prior to the upgrading.
NT Server can be configured to be one of: PDC, BDC, or Stand-alone (Member Server)
PDC
Once the computer is configured as a PDC it must be online before any other computer can join the domain.
SID -- when a domain is created, a domain Security Identifier (SID) is created. It is a numeric value that identifies a domain and is included in all user, group, and computer accounts that are created on the domain. So ...
Domain name CAN be changed without reinstalling the NT Server. This is because the domain SID (rather than domain name) identifies the domain. If the domain name is changed, you also have to change the domain name for all workstations and servers in the domain, and re-establish the trust relationships with other domains.
To change Computer/Domain names: Control Panel >> Network >> Identification >>Change ...Each domain requires and can contain only one PDC. PDC contains the directory database for the domain.
The PDC also authenticates logon requirests, from the following clients: MS-DOS clients with enhanced redirector installed, NT, Windows 9x, WfW, and MS LAN manager.
Note: A domain can contain one and only one PDC. When you configure a computer as a PDC, you are creating a domain. And if the computer is to be configured as a PDC, you must also choose either the Per Server or Per Seat licensing mode.
BDC
during a BDC setup, must supply the name of the domain that the BDC is joining.
BDC cannot be moved to another domain unless reinstalling NT Server on the BDC. This is because the domain SID cannot be changed without reinstalling NT Server.
when installing NT server as a BDC, make sure the PDC is up and running, and the BDC is using the same protocol as the PDC.
BDCs also validate user accounts. Therefore, the copy of the domain's Directory Service database, which is stored on the BDC, must be current with the one on the PDC.
if the PDC fails, one of the BDCs can be promoted to a PDC.
Stand-Alone or Member Server
a stand-alone server may be a member of either a workgroup or a domain. A stand-alone server that is part of a domain is also known as member server.
Stand-alone servers and NT Workstation computers cannot be reconfigured as a BDC or a PDC without reinstalling NT Server.
A stand-alone server or an NT Workstation computer can be moved to another domain without reinstalling NT. This is because both stand-alone server and NT Workstation computer maintain their own directory services database.
Stand-alone servers do not validate domain user logon requests. So they can provide file, print, and application services more efficiently than DCs.
for a BDC, a member server, or a NT Workstation computer to join a domain, a computer account for that computer must be created.
for BDC -- a computer account on the PDC must be created prior to or during the installation of the BDC (NOT after).
Stand-alone and NT Workstation computer -- can join a domain at any time: prior to, during or after installation.
Join a workgroup does not require a computer account because there is no centralized administration of the computer and user accounts in a workgroup.
Per Server -- CALs are assigned to the server. The number of CALs determined the number of simultaneous connections that can be made to that server.
Per Seat -- A CAL is purchased for each client computer. With a Per Seat license, a client can access any resources on any computer running NT Servers across the entire network, and can log on to multiple servers simultaneously. This means unlimited number of computers can have access to a single server, provided each computer is licensed with the Per Seat Licensing Mode.
A user can legally connect to any server in the network from any client computer for which a CAL has been purchased. If thePer Seat licensing option is chosen, it will not prevent clients from connecting to a serve if the number of simultaneous client connections exceeds the number of Per Seat licenses that have been purchased.
The Per Seat Licensing mode is often the most economical one for networks in which clients ordinarily connect to more than one server.
- ONE SERVER = PER SERVER Licensing
- MULTIPLE SERVERS = PER SEAT Licensing
Per Server option:
- Number of simultaneous connections needed to Server1
- Number of simultaneous connections needed to Server2
- Number of simultaneous connections needed to ServerN
- Total simultaneous connections needed to all Servers: A = server1+server2+...+serverN
- (A is the number of Per Server CALs needed?)
- Per Seat option:
- Number of seats (computers) that access any server is the number of CALs needed -- B
Only users who have the user right add workstations to a domain can create a computer account. By default, members of the Administrators, Domain Admins, or Account Operators groups have this right.
Computer accounts are created/deleted through the Server Manager >>Computer >>Add to Domain /Remove from Domain
- during installation, or
- prior to installation, use Server Manager >> Computer >> Add to Domain -- you can add the computer account prior to installation and then delegate the task of actually installing NT by providing the computer account name to the person who completes the installation.
- If the computer account is added to the domain already --
the computer can join the domian during NT installation, or after installation (for member server and NT workstation computer only. BDCs must join a domain prior or during installation) by using Control Panel (local computer) >> Network >> Identification >> Change >> Member of ... type in the name of Workgroup or Domain
- If the computer account had not previously created --
>> Create Computer Account in the Domain, supply a user account that has been granted the Add Workstations to Domain user right (Administrator and Server Operator have this right by default) and appropriate password.
Note: If the computer has had NT installed on it, or for some other reason needs to rejoin the domain, then the computer account must be deleted and recreated at the domain controller (because of a new SID created in installing an NT). If this is not done, an error message refers the administrator to check the computer account on the domain.
you can choose to log on to the local computer or to the domain. If log on to the local computer, you can view the shared folders on another computer in the domain, but cannot access them unless connect to them and specify a valid domain user account and password.
To map a network drive: --> NT Explorer >> Tool >> Map Network Drive >> Path, type in a universial naming convention (UNC) path for the domain resource, e.g. \\Server1\SharedFolder2 >> enter password when prompted.
You cannot choose to log on to the local computer if it is a Domain Controller (no such choice for you to choose at all). You can only log on to the domain, or another domain if appropriate trust relationship exist with other domain. This is because the local directory services database on any DC is the same domain directory services database.
Unlike logging on to a computer that is a member of a domain, you cannot choose other workgroups to log on to. The use name and password you enter is validated agasinst the local directory services database on that computer.
If you want to join a different workgroup, use Control Panel >> Network >> Identification >> Change >> Member of ... type in the name of the Workgroup you want to join.
Create a distribution server -- copy required NT setup Files to a Network Server (this is the "distribution server")
Use "xcopy /h /s" to copy (/h copy hidden and system files also; /s makes sure sub-folders are copied). If use Explorer to copy, make sure "Show All Files" is enabled because if it is not, hidden files will not be copied.
If your computer requires any drivers located in the folder Drvlib (drivers), copy it to the shared folder on the distribution server too.
Logon to each of the computers and connect to network share that containing NT setup files.
Run Winnt.exe
or Winnt32.exe from the client computer.
(Probably a good idea to use the /b switch. )
PARAMETER | DESCRIPTION |
/b | install without the Boot floppies;
Requires additional 4~5MB HD space must use this switch if not to use the installation CD -- by copying the \I386 directory to the hard drive first. |
/f | Prevent
verfying files
as they are copied; Use this switch to accelerate
installation. This command cannot be used with Winnt32.exe |
/i:inf_file | Specifies the file name for the setup information file. Default is DOSNET.INF |
/o | Creates boot floppies and starts the installation?? |
/x | Prevents setup from making Setup boot disks. Use this when you have created Setup boot disks already. |
/ox | Creates Setup boot floppy disks only -- does not start install |
/s:sourcepath | Specifies the source of the NT setup files. This must be a fully qualified path in the form drive_letter:\path or \\server_name\share\path. The current directory is the default source for the installation files. |
/t:drive | Force setup to place the temporary files on the specified drive. |
/U:answer_file | Specifies an unattended installation and lists the optional script file. |
/UDF:id, [UDF_file] | Specifies the identifier that is to be used to apply sections of the UDF_file in place of the same section in the answer_file. If no UDF is specified, the Setup program will prompt the user to insert a disk that contains a file called $UNIQUE$.UDF. If a UDF is specified, Setup will look for the identifier in that file. |
/I | Creates
$Winnt.log - a log file that lists any errors during copy
to temporary folder. This command cannot be used with Winnt32.exe |
To Install NT when CD-ROM is not on HCL -- must use the /b switch
Note:
Winnt.exe is used to install NT on a client computer running Windows 3.x, Windows 95 or MS-DOS. Winnt.exe cannot be run in NT command prompt, because it is a 16-bit application.
Winnt32.exe is used to install or upgrade NT on a computer already running NT. It can copies files to hard disk while NT 3.51 server is still running. Remember winnt32.exe is a 32-bit application, it cannot be run in Win95?, or Win31, WfW, or DOS.
When performing a server-based installation, if there is not enough disk space on the distribution server to copy all installation files, you can share the appropriate folder on the CD. However, this method is much slower than installing from the server's hard disk.
Server-based installation CANNOT be done on a RISC computer; You can use this method only to upgrade or reinstall the operating system when NT is already installed.
In an unattended setup, the Setup program runs over a network, using the Winnt.exe /u or Winnt32.exe /u. The /u switch is used to specify an answer file (Unattend.txt) -- a script used to automate the installation.
However, when you are doing multiple machines: "Unattend.txt is the 'source code' and UDF is the (individual settings / user and machine specific) 'compiler'.
General
Networking
Advanced
|
UDF defines specific info about each individual computer and/or the domain or workgroup it will be a member of. By using an UDF, user do not need to input info, such as the user name, computer name, etc., during the NT installation.
The answer file contains the configurations info common to all of the computers. UDFs are used to provide replacements for sections of the answer file, such as for a computer that specifies the user name and computer name, or supply additional sections. An UDF is indexed by means of strings called [UniqueIDs]
A sample UDF:
|
Use a single answer file (Unattend.txt) for the info that applies to all users, and use one or more UDFs to supply info that is specific to a single computer or a small group of computers. Note a single UDF can contain specified settings for many computers, which are identified by the [UniqueIDs]. Therefore --
You usually use only one UDF and several unattended files for installing NT on many different hardware platforms and configurations
If use Sysdiff /inf command, remember to change the default value of OemPreinstall = no to OemPreinstall = Yes in the unattend.txt, which indicates NT Setup will install files located in the subdirectories on $OEM$.
-- create an unattended answer file for EACH computer type (i.e. three unattend.txt), and a single uniqueness database file (UDF). Use these files as parameters of the Winnt setup utility launched from a network share.
-- three answer files and one UDF file
You need to install both NT Workstation and serveral applications and software packages on to 125 identical desktop computers. How can you do to automate and simply the setting up?
NT 3.51 and Windows 3.x to NT 4.0- install NT 4 to upgrade to the same folder (e.g. \Winnt351). Use winnt32.exe. If you choose to upgrade rather than complete a new installation, the following settings are preservede:
SID
Windows 95 to - NT CANNOT upgrade from a Win95 installation, because they do not use the same registry settings or hardware device support. Besides, it is not possible to install NT in the same directory of Win95. You must specify a new directory (and the computer will dual-boot). You need to:
Dual-boot --
- must first install the other operating system (e.g. Win95, or MS-DOS) before installing NT
- install NT in a different directory
- NT's system partition must be located on a primary FAT partition
You will have to use dual-boot, when using some Plug-n-Play utilities--
Many Plug-n-Play configuration utilities for network adapters, modems, video adapters, and other hardware devices will not run under NT, which does not allow direct access to hardware resources. These programs will have to reside in a FAT partition in order to be access from MS-DOS.
Use the following chart to decide which directory option is best for your installation:
Previous OS and NT Installation Directory | Migrates settings? | Supports multiple-boot? |
Windows NT Same directory New directory |
Yes No |
No Yes |
Windows 95 Same directory New directory |
N/A No |
N/A Yes |
Windows 3.x/ WfW Same directory New directory |
Yes No |
Yes?? Yes |
You can use either of the following methods to remove NT:
- Remove the partition NT is installed on. This also remove any other info on this partition
You can use NT Setup disks to remove the partition (no matter it is FAT or NTFS). Alternative methods -- MS-DOS fdisk (cannot remove an NTFS logical drive in an extended partition), or use OS/2 1.x installation disk A.
- Remove only NT. This method can ONLY be used on a FAT partition!
Note: NO version of FDISK can remove an NTFS logical drive in an extended partition. Some MS-DOS FDISK cannot even delete an NTFS partition.
Note: In addition to using SYS C: you can also replace the boot sector by useing FDISK /MBR
platform filename what it does where Intel x86 Ntldr loads the NT OS System partition root all required for the NT Boot Disk
Boot.ini builds the Boot Loader Operating System Selection menu Bootsect.dos contains the boot sector that was on the HD before NT installing. Loaded by Ntldr if another OS, such as DOS, Win9x, OS/2 1.x instead of NT is selected Ntdetect.com examines the hardware and build a list of it. This info is passed back to Ntldr to be added to the registry later in the boot process Ntbootdd.sys this driver access devices attached to the SCSI adapter during boot sequence. exists only when system boots from a SCSI HD and the BIOS on the SCSI adapter is disabled. Intel x86 RISC
Ntoskrnl.exe kernel file, starts the NT load phrase systemroot\System32 Hal.dll Hardare Abstraction Layer, hides platform-specific hardware issues from NT. Is loaded after the Ntoskrnl.exe System a collection of system configuration settings. Controls which device drivers and services are loaded during initialization process systemroot\System32\config Device drivers such as Ftdisk (fault tolerance) and Scsidisk systemroot\System32\Drivers RISC Osloader.exe OS loader; equivent to Ntldr. os\nt40 *.pal (Alpha only) contain PAL code, software subroutines that provide an OS with direct control of the processor os\nt40
Note: Bootsect.dos exists ONLY on a dual-boot system; it contains info of the boot sector before NT installation.
NT is loaded and initialized in four phrases:
kernel load >>kernel initialization >>services load >>Win32 subsystem start
1. Before loading NT kernel --
- Ntldr switches the processor from real mode into 32-bit flat memory mode.
- Ntldr starts the appropriate mini-file system drivers.
- Ntldr read the Boot.ini file, displays the Boot Loader Operating System Selection menu for user to select the operating systems contained in it.
- Ntldr loads the operating system selected by the user, or the default OS if no selection made.
If an OS other than NT was selected (on a dual-boot computer), Ntldr loads and runs Bootsect.dos and passes control to that OS; the NT boot process ends at this point.
- Ntldr runs Ntdect.com. Ntdect.com scans the hardware and sends the list of it back to Ntldr for later inclusion in the registry under HKEY_LOCAL_MACHINE\HARDWARE
- Ntldr loads Ntoskrnl.exe -->
2. Load Phases
- Kernel load -- begins when Ntoskrnl.exe is loaded. Then hal.dll (hardware abstration layer) is loaded.
This portion of boot sequence occurs when the screen clears after Ntdetect.com has run, and progress dots (......) are displayed across the top of the screen. It is possible to display the names of the drivers being loaded on this screen by adding an /sos switch to the appropriate OS line in Boot.ini.
- Kernel initialization -- initializes the kernel and the drivers that were loaded during the kernel load phase. This stage occur when screen is painted blue.
- Service load -- starts the Session Manager (Smss.exe), which starts the higher-order subsystems and services for NT.
- Win32 subsystem start -- starts Winlogon.exe, which starts the Local Security Authority (Lsass.exe) and display the Ctrl+Alt+Del logon dialog box.
- User logs on.
Note:
- The boot is not considered good until a successfully log on to the system.
- After a successful logon, the Clone control set is copied to the LastKnownGood control set (this is why you should not try to log on when you want to use the Last Known Good ).
- the LastKnownGood is a key in the Registry
Most problems related to booting are caused by required files that are either missing or corrupted, or when incorrect system configuration changes are made.
Note: Emergency Repair process (needs both NT Setup floppy disks and ERD, and maybe the installation CD too), or NT Boot Disk, can be used to recover the system and boot files, as would happen in the following situations, and return the computer to a bootable state.
Symptom -- before the Boot Loader Operating System menu, the following message appears:
BOOT: Couldn't find NTLDR Please insert another disk.- Problem/Solution -- the NTLDR is missing. Use NT Boot Disk or ERD to replace the missing or corrupted file
Symptom -- after the Boot Loader Operating System menu, the following message appears:
NTDETECT V4.0 Checking Hardware... NTDETECT failed- Problem -- the Ntdetect.com is missing.
Symptom -- after the Last Known Good prompt, the following message appears:
NT could not start because the following file is missing or corrupt: \winnt root\system32\ntoskrnl.exe Please re-install a copy of the above file.- Problem -- the Ntoskrnl.exe or Boot.ini is missing, or the NT path name in the Boot.ini is incorrect.
Symptom -- after the Boot Loader Operating System menu, the following message appears:
I/O Error accessing boot sector file multi(0)disk(0)rdisk(0)partition(1):\bootss- Problem -- the Bootsect.dos is missing, and the system has multiple-boot configuration.
Note: Bootsect.dos stores partition info specific to the computer. This file cannot be borrowed from another computer. Bootsect.dos exists ONLY on a dual-boot system
/basevideo -- is an optional parameter to allow user to boot the NT with a standard VGA driver.
/sos -- to display device loaded during boot sequence
C:\="Microsoft Windows" -- for dual-boot between NT and WindowsOther configuration options for loading NT
The applet in Control Panel >>System >>Startup/Shutdown >>System Startup ... can only be used to change the options for the default OS and timeout value. To modify all other options, such as change the display of "NT Server Version 4.00" to "NT Server 4.0 for MCSE" you need to edit the Boot.ini manually.
To create a multiboot systems of DOS/Win95, NT Server and NT Workstation, install DOS/Wind95 first, then install the first NT OS, then the second NT OS (all in different directories). The multiboot options will automatically added to the Boot.ini.
However, when you remove an OS from the computer, you need to edit the Boot.ini to remove the corresponding entry.
Some other OS's also have boot managers, for instance, OS/2. Installing NT will diable the OS/2 boot manager (and many other boot managers). You can reenable the OS/2 boot manager form the NT Disk Manager by making the partition containing OS/2 boot manager the active partition.
Solution to Boot.ini problems -- manually edit the Boot.ini file, correct the incorrect path or file names.
Symptom -- after the Last Known Good prompt, the following message appears:
NT could not start because the following file is missing or corrupt: <winnt root>\system32\ntoskrnl.exe Please re-install a copy of the above file.- Problem -- the Ntoskrnl.exe or Boot.ini is missing, or the NT path name in the Boot.ini is incorrect.
- Note: NT can boot successfully even when the Boot.ini file is missing, only if NT is installed in the default folder of:
multi(0)disk(0)rdisk(0)partition(1)\Winnt, or
scsi (0)disk(0)rdisk(0)partition(1)\WinntTherefor, when the above message appears on a system where NT is installed in the default folder, you can deduce the problem is NOT due to missing the boot.ini file. More likely missing Ntoskrnl.exe or the path name is incorrect.
Symptom -- after the Last Known Good prompt, the following message appears:
OS Loader V4.0- NT could not start because of a computer disk hardware configuration problem.
Couldn't read from the selected boot disk. Check boot path and disk hardware.
Please check the NT (TM) documentation about hardware disk configuration and your hardware reference manuals for additional information.- Problem -- invalid device in the path to NT in the Boot.ini file, e.g. when mixed up multi with scsi
Symptom -- A "new" operating system: NT(default) appears on the Boot Loader Operating System Selection menu
Problem -- the path name for the default parameter in the [boot loader] section does not match any of the path names in the [operating systems] section.
for Intel x86 computers -- Ntldr, Ntdetect.com, Boot.ini. Depends on the situation, maybe also need:
Ntbootdd.sys -- only for computers
with a BIOS-disabled SCSI adapter
Bootsect.dos -- for a dual-boot system
Decide when to use NT Boot Disk, and when to use ERD (ER process)? only certain files (such as the afore-listed) can be loaded from a floppy disk, all other files are accessed from the hard disk. For example, if the NT kernel (Ntoskrnl.exe) or other files are corrupt or missing, the NT Boot Disk is of no use.
If this is the case, use the Emergency Repair process to restore the missing or corrupt files.
NT provides two configurations in which you can start your computer:
- Default -- the configuration that was saved when you last shut down the computer.
- Last Known Good -- the configuration that was saved when you last successfully logged on to the computer. The LastKnownGood configurations are stored as a control set in the Registry under the key HKEY_LOCAL_MACHINE
There are only two conditions that cause the system to load the Last Known Good configuration:
- When the system is recovering from a severe or critical device driver loading error
- When the Last Known Good configuration is selected during the boot process
The Last Known Good control set is used ONLY to recover from problems caused by incorrect device or hardware configurations, such as when you installed a new device driver, video driver, or accidentally disabled a critical device driver and causes the NT not able to start. It does not solve problems caused by corrupt or missing drivers or files (in this case, use ERD or Boot Disk instead).
Use the Last Known Good does not help in these situations:
- after you logged on after making changes. Remember: DO NOT try to log on, if you what to use the Last Known Good.
- any problem that is unrelated to changes in control set info, such as incorrectly user profiles or file permissions; and --
- switching between different hardware profiles, such as docked and undocked laptops. The Last Known Good is only a method to switch between configuration info in the registry.
- starup failure caused by hardware failures, or missing or corrupted files.
If you are having problems with startup, and think the problems might be related to the changes that you made to your configuration, do not log on. Instead, restart the computer; when you see the following message on the screen:
press the SPACEBAR to invoke the Hardware Profile/Configuration Recovery menu.
Note: If the Last Known Good is used, all configuration changes you made the last time you were logged on to the NT computer are lost.
You can use the Emergency Repair Disk utility (Rdisk.exe, in systemroot\System32 folder) to update the repair info for NT on your hard disk (stored in folder systemroot\Repair), or to create a new Emergency Repair Disk (ERD) using the repair info currently saved on your hard disk.
The repair info on your hard disk or your ERD can be used to reconstruct NT system files, system configuration, and startup environment variables (i.e. appears in the Boot Loader Operating System Selection menu) if they become damaged. ERD or the Emergency Repair folder can return the NT system to the state of the last Emergency Repair update. (the \Repair folder and the ERD contains the same things -- most are info in the registry entries)
It is strongly recommended that you create and update an ERD every time you make significant changes to your hardware or software setup. The Repair Disk utility should not be used as a backup tool.
Note:
- In order to run Rdisk.exe, a user must be a member of the Administrators or Power User (in NT Workstation) group, or have the appropriate priviliges. For a user not having required priviliges, rdisk.exe appears to work, but when saving files, an error message appears indicating that it could not save all configuration files.
- The Update Repair Info option deletes and creates files under systemroot\Repair, if NT is installed on an NTFS partition, the user must also have the appropriate permissions to that folder.
- Rdisk.exe does NOT back up the three files -- Default, SAM, and Security, which contain user accounts and file security, unless you specify the /s parameter with rdisk command.
Note -- to store the Default, SAM, and Security files in ERD and /Repair folder, you must use the rdisk.exe /s command. They are saved as compressed files to save space.
- Default._ a copy of the Default hive from the registry.
- Sam._ a copy of the Securiry Account Manager (SAM) from the registry.
- Security._ a copy of the Securiry hive from the registry.
- Setup.log -- another file included in the Emergency Repair foler and ERD, used to verify files on the system.
Need what -- to repair a NT installation, NT Setup needs either the configuration info that is saved in the systemroot\Repair folder, or on the ERD. To perform the emergency repair process, you also need the following:
- If the SAM database is replaced, the Administrator password stored on the ERD.
- The three NT Setup floppy disks.
- The original NT installation CD, in case any files are detected as missing or corrupt.
How to perform a repair process, start NT Setup with the original Setup disks or CD, or winnt.exe, just as you did originally >>in the text-based Setup sceen that asks whether to install or repair files, type r to repair >>use the ERD as prompted ... you choose which of the tasks to be performed:
- [X] Inspect registry files -- Setup replaces one or more registry files with the files that were created when NT was first installed, or when the Emergency Repair folder or ERD was last updated. All changes made to the system since installation or the last update to the repair files are lost.
- [X] Inspect startup environment -- if NT is installed but does NOT appear in the bootable systems, select this option. ERD is needed for this option.
- [X] Verify NT system files --
- [X] Inspect boot sector -- select this option if NO system that is installed on the computer boots. Setup copies a new boot sector to the hard disk.
Note: If the original Setup disks cannot be located, use winnt.exe /ox or winnt32.exe /ox to create a new set. The /ox switch creates Setup disks only, without performing the entire installation.
- NT registry
- Modifying Setting Using Control Panel
- Modifying System Settings Using Control Panel
- Modifying System Settings Using Registry Editor
The Registry is a unified database where NT stores all hardware and software configuration info for the LOCAL computer. It controls the NT operating system by providing the appropriate initialization info to start applications and load components such as device drivers and newwork protocols.
Registry Editor, Control Panel, User Manager, and System Policy Editor can be used to change the registry based on configuration info you supply.
The Registry Structure -- a set of five predefined subtrees that contain per-computer and per-user databases. The per-computer databases include info about hardware and software installed on the specific computer. The per-user databases include the info in user profile, such as desktop settings, individual preference for certain software, and personal printer and network settings.
Subtrees:
HKEY_LOCAL_MACHINE contains configuration information particular to the computer (for any user).
HKEY_USERS is the root of ALL user profiles on the computer.
HKEY_CURRENT_USER is the root of the configuration information for the user who is currently logged on. Info such as the user's folders, screen colors, and Control Panel settings are stored here. This info is referred to as a user's profile.
HKEY_CLASSES_ROOT stores info about file associations and data associated with COM object, and points to the CLASSES subkey under HKEY_LOCAL_MACHINE\SOFTWARE.
HKEY_CURRENT_CONFIG contains data about the active hardware profile used by the local computer at system startup.
Hive is a discrete body of keys, subkeys, and values. Each hive has a corresponding registry file and .log file (?only exception is the subkey HKEY_LOACAL_MACHINE \HARDWARE ). The .log file is used to record changes to the registry and to ensure the integrity of the registry. By default, most hives, such as Default, SAM, Security, and System, and the corresponding hive files are located in folder:
system_root\System32\Config
Note: the subkey HARDWARE (in HEY_LOCAL_MACHINE subtree) does not map to a file on the hard disk because the parameter values are volatil, meaning that they are not saved, but built each time the computer is started.
The info under HKEY_LOACAL_MACHINE \HARDWARE can be used to determine:
- The appropriate driver to install for a piece of hardware, by seeing what hardware device was detected by NT
- Whether a device driver is failing to load because the hardware is no longer being detected (due to hardware failure or conflict with new installedc hardware).
Abstract From <<all road to NT >>
The Registry is not a record of an NT system configuration. It contains values that are not the the system defaults, AKA, data in the Registry -- is the exception. NT supports a maximum registry size of 108 MB.
Hive | Description |
HKEY_CLASSES_ROOT | Establishes OLE file associations (retained for backward compatibility) |
HKEY_CURRENT_USER | Displays user profile information for the user currently logged in |
HKEY_LOCAL_MACHINE | Manages hardware and software configuration, installed drivers, and security |
HKEY_USERS | Provides user profile information for all users |
HKEY_CURRENT_CONFIG | Displays the currently used hardware profile (a subset of HKEY_LOCAL_MACHINE) |
HKEY_DYN_DATA ?? | Provides temporary storage for the state of dynamic events and performance information |
NT Registry Backup Tools
Utilities that can be used for partially backup/save and restore Registry info:
Control Panel >> System
Notes and Tips
A hardware profile stores the configuration for a set of devices and services. NT can store different hardware profiles to meet a uesr's needs. For example, a portable computer user could create hardware profiles for docked and undocked state, and choose appropriate profile when starting the OS.
- To create and modify Hardware Profiles -- copy and then modify the default hardware profile, i.e. Original Configuration (Current).
- To configure a specific device or service for hardware profile -- use the Devices and Services programs in Control Panel. Each of these programs contains a Hardware Profiles button
(HW Profiles...) that allows to assign the configuration to a specific hardware profile.
- To configure a Network-Disabled Profile -- Control Panel >> System >> Hardware Profiles >> select an existing profile (or make a new copy an existing profile) >> Properties >> Network >> check Network-disabled hardware profile
When to use the Network-Disabled Profile? -- When not connected to the network, use a Network-disabled hardware profile can decrease the startup time and prevent startup error messages such as "One or more services failed to start" -- this occurs when starting a NT computer that is configured to start netoworking devices and services, but is not attached to a network.
NT uses a process called demand paging to swap data between RAM and one or more paging files (Pagefile.sys) located on one or more hard drives.
Default Size of Paging File:
- NT Server -- the amount of physical RAM, or if RAM less than 22MB, the 22MB or the amount of available disk space, whichever is smaller.
- NT Worksation -- the amount of physical RAM + 12MB, or the amount of available disk space, whichever is smaller. Minimum 2MB, typical 24MB or larger.
Configuring the Paging File:
Control Panel >> System >> Performance >> Virtual Memory >> ChangeOptions to improve system performance:
- if a system has multiple hard disks, consider creating a paging file for each disk
- moving the paging file off the drive that contains the NT systemroot folder -- avoids competition between various reading and writing requests.
- if the paging file is placed on the boot partition to facilitate the recovery feature (Remember: Write debugging information to requires the paging file be on the boot partition!), you can increase performance by creating myltiple paging files that reside on other drives.
- set the initial size of the paging file to the optimal size required by the system -- this eliminates the time required to enlarge the file.
Control Panel >> System >> Environment
Environment Variables are info about drive, path, or file name for NT to control the behavior of various applications. For example, the TEMP specifies the location where applications place temporary files.
The Environment tab displays two types of enviroment variables currently in effect:
- System environment variables
- User environment variables for ... (the logged_on_user_name)
Any user can add, modify, or remove a user environment variable, but only an administrator can add, modify, or remove a system environment variable.
By default, NT searches the C:\Autoexec.bat (NOT Autoexec.nt !), if one exists, and sets any environment statements. For example, the PATH statement in the C:\Autoexec.bat is automatically appended to the default system path every time any user logs on.
NT sets environment variables in this order:
- Autoexec.bat variables
- System environment variables
- User environment variables
The priority order is User environment variables > System environment variables > Autoexec.bat. For example, if the line "SET TMP=C:\" is placed in Autoexec.bat and a user variable "TMP=X:\TEMP" is set, the User variable overrides the prior setting. Therefore, the TMP environment variable is equal to X:\TEMP.
To prevent NT from searching the C:\Autoexec.bat (ONLY administrators can do it)
- Use Registry Editor >>set ParseAutoexec:REG_SZ=0
\HKEY_CURRENT_USER\Software\Microsoft\NT\CurrentVersion\Winlogon\ParseAutoexec:REG_SZ=0
- Or. use System Policy Editor to edit this registry paramenter -- Local User >> NT System >> clear Parse Autoexec.bat check box
Adding and Removing NT Components
- to add or remove NT component
Contral Panel >> Add/Remove Programs >> NT Setup
- to install or uninstall applications
Contral Panel >> Add/Remove Programs >> Install/UninstallAny application that uses Setup.exe or Install.exe to install itself can be both installed and uninstalled.
Important Points:
- both regedt32.exe and regedit.exe can be used to view and modify a remote/local NT computer's registry. To open a remote registry --
- in regedt.exe -- >>Registry >>Select Computer
- in regedit.exe, use "Registry >>Connect Remote Registry".
You must have appropriate permission to open the registry. You cannot use Auto Refresh while displaying a remote registry.
- regedt32.exe -- NT registry editor, allows an administrator to edit ALL keys of the registry on a local computer; but it can only display/edit two keys of a remote computer's registry: HKEY_LOCAL_MACHINE, and HKEY_USERS
- regedit.exe -- Windows 95 registry editor, also included in NT. It has, the only advantage over Regedt32.exe, a more powerful search engine to find keys, values, and data in a registry (Regedt32.exe can search for only keys). Regedit.exe is not the recommanded registry editor for NT, because it does not have a security menu, or a read-only mode, and does not support all of the data types that Regedt32.exe supports.
- Registry permissions -- by default, a user has Full control over his HKEY_CURRENT_USER subtree, and Read access to other parts of the registry. Administrators have Full control over the registry (all keys), and can change the registry permission through the Security menu in Registry Editor.
- How to backup/restore registry
- regedt32.exe -- Registry >>Save Key /Restore, either to/from a floppy disk or to a hard disk. (a restored hive overwrites an existing registry key and becomes permanent part of your configuration. )
- regedit.exe -- Registry >>Export Registry File / Import Registry File
- NT Backup -- can only backup/restore the registry or event logs on the computer where the tape drive is installed; cannot backup/restore registry or event log on remote computers. Besides, NT Backup can only backup the Registry if you have selected at least one other file. You cannot back up ONLY the Registry.
- REGBACK - utility from the NTRK.
- Where can find the info about registry size? >>Control Panel >>System >> Performance -> Virtual Memory >> Change >>Registry Size (NT supports a maximum registry size of 108 MB. )
System settings affect every user of the system, only member of the Administartors group can modify them.
Control Panel >>System >>Performance >>Change, then specify the initial /maximum size, and new locations of page files.
The paging file -- pagefile.sys is a protected system file that NT will not allow you to delete while it is running.
-- in the same location where you set the page file:
Control Panel >>System >>Performance >>Change, then specify the Maximum Registry Size.
To create additional Hardware Profiles: >>Control Panel >>System >>Hardware Profiles >>choose an existing one >>Copy...
You modify which device and services to use with that profile from the Device and Services icons in the Control Panel. Both have a HW Profiles... button for this task.
To create HW Profiles for a portable computer -- docked, or not docked
>System >>Harware Profiles >>Properties >>General >>This is a portable computerTo create a network-disabled hardware profile, ie. all network device is disabled for this HW Profiles
>System >>Harware Profiles >>Properties >>Network >>Network-disabled hardware profile- to disable /enable a particular device/service for a HW Profile -- you further modify a HW Profile In this way:
>>Control Panel >>Device >>select a device >>HW Profiles ... >>Enable or Disable the device in a HW Profile.
To disable/enable a particular service for HW Profiles in the same manner.
removing any software and drivers that rely on the hardware before removing the device.
Network Adapter -- install/ remove the driver for it a through Control Panel >>Network >>Adapters
SCSI Adapter -- install /remove the driver for it a through the SCSI Adapters applet in Control Panel.
NT installation program cannot identify the SCIS ID number of the booting SCIS disk. If the SCSI adapter BIOS has been set to boot a disk other than SCSI ID 0, the computer will not boot properly (because the ARC path in the BOOT.INI is set to SCSI ID 0.) To fix this problem, boot another operating system, such as DOS, to edit the ARC path.
Use the SCSI Tool to diagnose SCSI Problems -- NT installation CD includes a SCSI Tool in the \support\SCSITool folder. Use the Makedisk command to create a SCSI Tool Disk, and then use it to view the settings of all the SCSI adapter setting in your computer.
Tape device -- use the Tape Devices applet in the Control Panel
UPS
you do not have to install a UPS driver to use this device. The driver is necessary only if you want the computer to shut itself down in the event of a power failure.
to remove UPS support, simple uncheck the Uninterruptible Power Supply is installed on
an UPS problem: computer to shut down suddently during the boot process.
Why? -- at system startup, the Ntdetect procedure probes serial ports for the presence of a mouse. Some stupid UPS devices interpret the signal sent by Ntdetect as the signal to shut down, and it shut the system down!
How to fix? -- modify the BOOT.INI, append /NOSERIALMICE=COMx to the end of each line containing the word multi(0) or scsi(0). x is the COM port number to which that offending UPS is attached.
CD-ROM
NT automatically supports many CD-ROMs, usually there is not need to install driver for a CD-ROM.
However, some CD-ROMs require special drivers that NT do not have. Use the SCSI Adapters applet to install/remove its driver, e.g. some proprietary bus CD-ROM with special interface cards. Then you will need to manually install /remove its driver through the SCSI Adapters applet.
Display
If the system fails to boot with a readable display after installing a new video card ->>boot using the VGA Mode selection from the boot menu. Then install the correct display driver via the Display applet.
Alternate language -- if you're not native English speaker
Control Panel >>Region Settings >>Input Locales
User Profiles
where are they?
by default, the user YDY's profile is located in the C:\winnt\Profiles\ydy sub-folder. But you can set the profile directory to another location through User Manager /for Domains >>Profiles ...
Why other users could see the newly installed software?
Most changes made to the system, even by an administrator, may be saved only in their own personal profile. For instance, you installed a new software for everyone to use it, but when other users log on, they could not see it at all.
If you want any item, such as a shortcut to a new software, to appear in every user's Start menu, you must place it in the All Users sub-folder -- this is a partial profile that everyone logging into the computer will use. But only administrators can access/change it.
Mandatory profile -- rename NTuser.DAT to NTuser.MAN