Download (direct link):
So what would you actually do in Safe Mode? Typically, you'd open up Control Panel and undo whatever setting you recently made which may be causing Windows to start abnormally or hang up at boot time. For example, you could remove a newly installed device driver, or start or stop a system service. Then you'd restart normally and see if everything looks fine. If not, you may have to move to the next recovery option, Recovery Console (coming up soon).
Remember Safe Mode in any of its three flavors automatically creates a boot log named NTBTLOG.TXT in the Windows folder (usually C:\WINDOWS). See the section, "Boot logging" earlier in this chapter.
Warning You may be curious about the boot menu options 'Directory Services Restore Mode' and 'Debugging Mode.' April Fools! These options don't apply to Windows XP Professional, only to the 2002/2000 Server products! (You'd think Windows would know which version of itself was installed on a given PC, but apparently it doesn't, at least not this early in the boot process.)
Borrowing a bit of technology from Windows Me, Windows XP offers the System Restore feature that lets you 'roll back' your system to a previous (and, presumably, functional) state. Windows creates 'restore points' automatically and you can create your own manually, too. Use this facility to recover from bad drivers, application installations, or system reconfigurations, but try Last Known Good and Safe Mode first because they're less destructive. The System Restore feature only pertains to operating system files and neither backs up, nor wipes out, your data files.
Instant Answer The System Restore tool lives in the System Tools submenu of the Accessories menu; you can run it directly, too (it's RSTRUI.EXE in C:\ WINDOWS\SYSTEM32\RESTORE). Here's the other stuff you need to know for the exam about System Restore:
* System Restore monitors certain operating system and application files and backs them up to hidden archives when those files are changed or updated. The list of files is C:\WINDOWS\SYSTEM32\RESTORE\ FILELIST.XML. Windows compresses the archives on NTFS disks when the system is idle.
* A 'restore point' consists of a Registry snapshot and any backups of monitored files.
* System Restore creates a restore point whenever you install an unsigned device driver, install a logo-compliant application, restore data from backup media, restore using System Restore, or manually create a restore point with the System Restore Wizard.
* In addition, System Restore creates a restore point once a day if the computer's left on, and if it has been at least one day since the last restore point if the computer is turned on after being off. (The interval is configurable in Group Policy.)
* When System Restore hits 90 percent of its allocated disk space, it starts dumping old data to make room for new.
* You have to log on as an Administrator to perform a restore with this utility.
* You must be able to boot Windows XP, in normal mode or in Safe Mode, to use this utility.
* Most of this program's options are only configurable via the Registry. The exam won't expect you to know individual settings.
* System Restore is a major resource hog, requiring at least 200MB of free disk space and putting a burden on your CPU as well, and is one of the reasons for XP's hefty hardware requirements. You could disable it on a slower PC to reduce system overhead, as long as you have a sound backup program in place. You could also reduce the amount of disk space available to System Restore. Both settings live on the System Restore tab of the System control panel.
Okay, Last Known Good didn't work, and neither did Safe Mode or System Restore. Time to bring out a bigger hammer. Recovery Console is new since Windows NT 4.0. It lets you start Windows XP Professional when Professional won't start otherwise, and it provides a limited number of command-line utilities for repairing a damaged system. (Note that these commands aren't identical to the commands you can type in a 'regular' command prompt running under Windows XP Professional in normal operation.) One of the nice aspects of Recovery Console is its capability of working with NTFS drives in a command-line environment.
Tip Recovery Console doesn't start the Registry, so you can copy backed-up Registry files from (for example) C:\WINDOWS\REPAIR to C:\WINDOWS\ SYSTEM32\CONFIG to do a brute-force Registry restore.
Running Recovery Console
Here's the weird part. You run the Recovery Console by starting Windows XP setup. You can do this with the installation CD-ROM, if your PC can boot from the CD (using the 'El Torito' specification).
When you get to the Welcome to Setup screen, type R to open the Repair Options screen. Then, type C to activate the Recovery Console. The computer asks you which Windows XP installation you want to work with (usually there's only one, but the program is too dumb to figure this out, and you must make a selection). Finally, you have to log on with the Administrator password, unless you previously set a security policy to allow Recovery Console to bypass this step automatically. (If the system is so fouled up that it doesn't recognize this password, you're looking at a restore from a previous backup because you can't use Recovery Console.)