Configuring Windows 7 (Training Kit) - Part 79 docx

The Last Known Good Configuration AdvancedThe Last Known Good Configuration Advanced feature in Advanced Boot Options is a recovery option that you use to start your computer with the mo

The Last Known Good Configuration (Advanced)

The Last Known Good Configuration (Advanced) feature in Advanced Boot Options is

a recovery option that you use to start your computer with the most recent settings that

worked Last Known Good Configuration (Advanced) restores registry information and driver

settings that were in effect the last time the computer started successfully

You should use the Last Known Good Configuration (Advanced) feature when you cannot

start Windows 7 after you make a change to your computer, or when you suspect that

a change that you just made is causing a problem—for example, if you cannot start Windows

after you install a new video driver When you start your computer by using the Last Known

Good Configuration (Advanced) feature, Windows 7 uses the configuration stored in the

following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet

Figure 14-13 shows the Control key within the CurrentControlSet registry key When

your computer restarts and you log on, your current configuration in ControlSet001 is

copied to CurrentControlSet and becomes the Last Known Good Configuration Take care,

therefore, if you see messages about error events being written to Event Viewer while your

logon screen is active If you log on at this point, you cannot return to the previous Last

Known Good Configuration, although you can perform a system restore to previous restore

points

FIgUre 14-13 The CurrentControlSet registry key

Windows 7 Boot Options

Windows 7 implements a boot loader, a boot configuration and storage system called Boot Configuration Data (BCD), and a boot option editing tool called Bcdedit In Chapter 2, you saw how you can use the Bcdedit tool to make VHDs bootable on computers running Windows 7 Enterprise and Ultimate editions

Windows 7 includes the following boot loader features:

n Windows boot manager (Bootmgr exe)

n Windows operating system loader (Winload exe)

n Windows resume loader (Winresume exe)

When a computer with multiple boot entries includes at least one entry for Windows 7, Windows Boot Manager starts the system and interacts with the user It displays the boot menu, loads the selected system-specific boot loader, and passes the boot parameters to the boot loader

Boot Configuration Data

On Windows 7, boot options and BCD are stored in the BCD store BCD provides a common interface for all computers running Windows 7 and enables administrators to assign rights for managing boot options BCD is available at run time and during all phases of setup, including resuming after hibernation

You can use the Bcdedit utility to manage BCD remotely and manage BCD when the system boots from media other than the media on which the BCD store resides This feature is important for debugging and troubleshooting, especially when a BCD store must be restored while running Startup Repair from DVD-ROM, from USB-based storage media, or remotely For example the following command forces the use of the Video Graphics Array (VGA; low resolution) display driver on reboot:

bcdedit /set vga on

The following command enables kernel debugging for the current operating system boot entry:

bcdedit /debug on

The following command disables kernel debugging for an operating system boot entry specified by its global unique identifier (GUID):

bcdedit /debug <GUID> off

You can use the Bcdedit utility to do the following:

n Create a BCD store

n Rebuild BCD

n Add entries to a existing BCD store

n Modify existing entries in a BCD store

n Delete entries from a BCD store

n Export entries to a BCD store

n Import entries from a BCD store

n List currently active settings

n Query entries of a particular type

n Apply a global change to all entries

n Change the default time-out value

More Info BCD BOOt OptIONS

For more information about BCD boot options, see http://msdn.microsoft.com/en-us/

library/aa906217.aspx.

You can use the Bcdedit utility to edit boot options in Windows 7 You must be a member

of the local Administrators group to use Bcdedit You can also use the Windows Management

Instrumentation (WMI) interface to programmatically change the boot options Chapter 13,

“Monitoring and Performance,” discussed WMI in detail

More Info the BCD WMI INterFaCe

For more information about the BCD WMI interface and the Windows Software

Development Kit (SDK), see http://msdn.microsoft.com/en-us/library/aa362692.aspx.

Rolling Back Drivers

Sometimes you can encounter problems because a recently installed driver for a hardware

device is incompatible with other drivers or with the hardware in your computer The classic

situation is when you update a video driver and find that when you restart your computer,

you cannot see your screen

In this case, you need to return your computer to its state before you updated the driver

If you have not logged on since the driver was updated, you can boot using Last Known

Good Configuration (Advanced) in Advanced Boot Options If you cannot use Last Known Good

Configuration (Advanced) you would next consider performing a system restore

Typically, you would boot into Advanced Boot Options by using the F8 key and selecting

Debugging Mode or boot from DVD-ROM and select Repair Your Computer In either case,

you would access the System Restore option and restore your system settings to the system

restore point that was created before you installed the problem driver It is a good idea to

create a system repair point before you make any significant changes to a computer, such as

installing a new driver

However, it is not always convenient to use Last Known Good Configuration (Advanced)

or a system restore The driver could have been installed through Windows Update with

other important and recommended updates that you do not want to roll back In this case, you need to boot the computer either into Safe Mode or Enable Low Resolution Video (if your problem is a video driver) and roll back the driver Managing drivers and using Device Manager were discussed in detail in Chapter 4, “Managing Devices and Disks ”

On the Drivers tab of the device’s Properties dialog box, shown in Figure 14-14, you can choose to uninstall or disable the driver If the device was a monitor, this would result in the default low-resolution driver being used, but in other types of devices, it would probably result in the device not working at all

FIgUre 14-14 Drivers tab of a device Properties box

Your choice, therefore, should be to roll back the driver This rolls back to the previous driver that was used (and worked satisfactorily) before the new device driver was installed One of the main functions of Safe Mode and the Enable Low Resolution Video option is to allow you to make changes to device drivers when these are causing problems Note that the Roll Back option is enabled only if a driver for a device has been installed that overwrote a previous driver

and performing a System restore

In this practice, you configure system protection on a hard disk on which it is not configured

by default You then manually create a restore point You make a system change (uninstall

a driver) and then perform a system restore to the restore point you created Finally, you check that the system change has been reversed

exercise 1 Configure System Protection

In this exercise, you configure system protection on a hard disk that does not hold a system

partition and therefore does not have system protection on by default You can choose any

hard disk you want, but you will likely use the second internal hard disk if one exists on your

computer If you are saving your backups on an external hard disk, you can choose to do

this provided that this disk is formatted with the NTFS filing system, although in practice

you are unlikely to enable system protection on a device used only to store backups System

protection configuration is discussed in more detail in Lesson 3 Perform the following

procedure:

1 If necessary, log on to the Canberra computer with the Kim_Akers account

2 In Control Panel, click System And Security In the System And Security window, click

System

3 In the System window, click System Protection This accesses the System Protection tab

of the System Properties dialog box, as shown in Figure 14-15

FIgUre 14-15 The System Protection tab of the System Properties dialog box

4 Select the drive on which you want to configure system protection and then click

Configure

5 In the System Protection dialog box for the selected drive, select Restore System

Settings And Previous Versions Of Files Configure the Maximum Usage setting (the

maximum disk capacity that you want to use to store restore points) by using the slider

control, as shown in Figure 14-16

FIgUre 14-16 Configuring system protection for a selected disk drive

6 Click OK

7 On the System Protection tab of the System Properties dialog box, ensure that system protection for the disk drive you selected is set to On Click OK

exercise 2 Create a Restore Point Manually

In this exercise, you manually create a restore point named Trial Restore Point

1 If necessary, log on to the Canberra computer with the Kim_Akers account and access the System Protection tab of the System Properties dialog box, as described in Exercise 1

2 Click Create

3. In the Create A Restore Point dialog box, type trial restore point Click Create

Windows 7 creates a restore point This can take some time

4 Click Close

exercise 3 Perform a System Restore

In this exercise, you make a system change You then perform a system restore to the Trial Restore Point and check the system change is reversed

1 If necessary, log on to the Canberra computer with the Kim_Akers account

2 On the Start menu, right-click Computer and choose Manage

3 In the left pane of the Computer Management console, select Device Manager

4 Choose a device that you are not using right now Right-click the device and choose Properties

5 Click Driver to access the Driver tab, as shown in Figure 14-17

FIgUre 14-17 The Driver tab for the chosen device

6 Click Uninstall Click OK to confirm that you want to uninstall the driver

7 Access the System Protection tab of the System Properties dialog box, as described in

Exercise 1

8 Click System Restore

9 On the Restore System Files And Settings page of the System Restore Wizard, click Next

10 In the Restore Your Computer To The State It Was In Before The Selected Event dialog

box, ensure that Trial Restore Point is selected, as shown in Figure 14-18 Click Next

FIgUre 14-18 Selecting a restore point

WarnIng YOUr COMpUter WILL reStart

The next step in this exercise restarts your computer Ensure that all your work is saved and any applications you are not currently using are closed before continuing.

11 Click Finish Click Yes to confirm that you want to continue Windows 7 performs

a system restore and the Canberra computer reboots

12 Log on to the Canberra computer with the Kim_Akers account

13 Click Close to close the System Restore Completed Successfully box

14 Access the Driver tab of the device you chose earlier, as described in steps 2 through 5

in this exercise

15 Check that the device driver is no longer uninstalled (that is, the Uninstall button is enabled)

Lesson Summary

n If system protection is configured on a disk drive, restore points are created

automatically when you make significant system changes You can also manually create

a restore point

n You can restore your system settings to a selected restore point

n You can restore your entire computer from a System Image backup to how it was when the backup was taken

n You can boot from the Windows 7 installation DVD-ROM and run a System Repair, or you can access the Advanced Boot Options by pressing the F8 key during a reboot Both techniques access tools that let you investigate boot and system problems

Lesson Review

You can use the following questions to test your knowledge of the information in Lesson 2,

“System Recovery ” The questions are also available on the companion DVD if you prefer to review them in electronic form

note aNSWerS

Answers to these questions and explanations of why each answer choice is correct or incorrect are located in the “Answers” section at the end of the book

1 You are testing unsigned device drivers on a computer on an isolated test network You install a display driver and find that the computer boots to a blank screen You restart the computer and press F8 What Advanced Boot Options could you choose to help remedy the situation? (Choose all that apply )

a Safe Mode

B Enable Boot Logging

c Enable Low Resolution Video

D Last Known Good Configuration (Advanced)

e Disable Driver Signal Enforcement

2 You are deciding on which storage devices you want to configure system protection

System protection is enabled by default on your C: drive, which holds your system files

No other storage device on your computer has system protection enabled On which

of the following storage devices can you enable system protection? (Choose all that

apply )

a Your second internal hard disk, formatted with NTFS

B An external USB hard disk formatted with FAT

c A USB flash drive

D Your optical drive

e A mounted VHD created on your second internal hard disk

3 You are investigating instability and boot problems on a computer running Windows 7

Enterprise You boot using the Last Known Good Configuration (Advanced) option and

perform a system restore This does not solve your problems, and you want to undo

the system restore Can you do this, and what is the reason for your answer?

a No You can undo a system restore only if you initiate it from the System Recovery

tools

B No You can undo a system restore only if you carry it out after booting normally

c Yes You can always undo a system restore, no matter how you booted the

computer or how you initiated the restore

D Yes You can undo a system restore that you perform after either booting normally

or booting using Last Known Good Configuration (Advanced)

4 You are troubleshooting instability problems on a computer running Windows 7

Ultimate and suspect that they might be related to hardware faults in RAM You access

the System Recovery options Which option is most likely to help you diagnose the

problem?

a Windows Memory Diagnostic

B Startup Repair

c System Restore

D System Image Recovery

5 What command-line utility can you use in Windows 7 to edit boot options?

a Bootmgr exe

B Winload exe

c Bcdedit exe

D Winresume exe

Lesson 3: recovering Files and Folders

This lesson looks at previous versions of files and folders created as shadow copies by the Volume Shadow Copy Service (VSS) when a restore point is created or held in backup sets created by a file and folder backup It discusses how you can restore previous versions of files even when these files have been renamed or deleted

The lesson looks at file and folder recovery and the Recover Files Wizard and describes how you use this wizard to restore user profile information System Protection was introduced

in Lesson 2, and this lesson considers System Protection settings in more detail

After this lesson you will be able to:

n Recover a previous version of a file or folder

n Recover a file and folder from backup

n Restore a renamed or deleted file

n Restore a user profile

Estimated lesson time: 35 minutes

Restoring Damaged or Deleted Files by Using

Previous Versions

Previous versions are either backups of files and folders that you create by using the

Backup And Restore console and restore by accessing the same tool and using the Restore

Files Wizard, or they are shadow copies Shadow copies are copies of files and folders that

Windows 7 automatically saves when it creates a restore point You can decide whether to restore from backup or restore from a shadow copy The file you restore from backup will be the version of the file that was current when the backup was taken You may have a shadow copy that is more recent than the backed-up file, or you may want to restore an older version You can use previous versions of files to restore damaged files or files that you, or users you support, accidentally modify or delete You can access previous versions, save them to

a different location, or restore a previous version of a damaged file to its original location

Restoring Files and Folders

Windows 7 makes restoring files and folders from backup straightforward You can restore

a file or folder to its original location or to a different location Typically, you restore a file to its original location if it is corrupted or has been accidentally overwritten, but sometimes you want to restore to a different location to test that your backup and restore procedures are working correctly without the risk of overwriting your current files and folders This is known

as a dummy restore