Chapter 1: Managing Error Codes and Startup Messages
Exam Objectives
Recognizing and resolving common error codes and startup messages
Resolving issues with missing boot files or OS components
Identifying steps to correct operational problems
Using diagnostic utilities and tools to resolve operational problems
This chapter examines problems common to the Windows environment. Many of these problems occur during the boot process, but a few can occur at any time. I examine boot or startup errors first and then other errors that occur within the OS. The end of the chapter reviews some tools used to help diagnose the cause of the errors.
As an A+ Certified Professional, you will often need to diagnose problems based on error codes and messages from the OS. This chapter introduces you to many common boot or startup error messages that you might see when using Windows. You will also be introduced to the key files required to allow you to boot a computer running Windows.
Windows Boot Files and Failure-to-Boot Errors
All operating systems are vulnerable to issues that can keep them from booting, and the current crop of Windows OSes, from Windows XP on, are no different. The following sections look at some of these problems and possible resolutions.
To help you understand the key files that are used in the boot process, you may want to review Book V, Chapter 6.
The Windows boot process can suffer from boot sector corruption, boot loader problems, and drive identification problems within boot.ini or the BCD. For most problems, the Emergency Repair Process or Recovery Console are reasonable troubleshooting and repair steps. (I discuss the Emergency Repair Process and the Recovery Console in Chapter 3 of this minibook.)
SCSI issues
The boot.ini file on your hard drive identifies the controller bus that contains the hard drives in your computer. This controller bus is identified as either SCSI or multi. If your drives are connected to a SCSI controller with the BIOS disabled, the controller is identified as SCSI. In all other circumstances, the controller is identified as multi. If your system is unable to initiate the boot process, or if you receive an error regarding a missing ntoskrnl.exe, the problem could be a misidentified SCSI controller. www.dummies.com/go/aplusaio, has more information about the boot.ini file.
No operating system found or incorrect boot device
The No operating system found error in Windows, just like in MS-DOS, is tied to severe corruption of the boot sector on your hard drive. To restore your drive to working condition, perform the Emergency Repair Process to restore the boot sector on your hard drive. The Emergency Repair Process is covered in Book VII, Chapter 3. Minor corruption of the boot files would report missing files, such as bootmgr, winloader.exe, ntldr, or ntdetect.com, and the next section will tell you how to deal with missing files. Like with MS-DOS, the No operating system found error could be caused by having left a formatted floppy disk with no boot loader in the floppy drive during boot.
If you have multiple hard drives, flash drives, or USB devices connected to your computer, they may have been placed higher in the boot order than your normal boot drive. Those devices may have been formatted with MS-DOS or Windows computers, and if that is the case, you may see messages related to missing boot files. If this is the case, your solution to the issue is to enter the BIOS configuration on your computer and select the correct device to be used as the boot device. The solution may be simpler with removable devices, because the device can simply be removed.
I have had one computer that would attempt to use my iPod as a boot device when it was connected; as you can guess, this did not work very well.
Missing boot files
Windows requires several core files to boot, and an optional file. The required files are
ntldr
ntdetect.com
boot.ini
bootmgr (Windows Vista and Windows 7)
Boot Configuration Database (BCD) (Windows Vista and Windows 7)
winload.exe (Windows Vista and Windows 7)
ntoskrnl.exe
The optional file is
ntbootdd.sys, which is the SCSI adapter driver that Windows XP boots from if the SCSI adapter doesn’t have an active BIOS
In the following sections, you get a look at what you can do if any of these files are missing or appear to be missing on your computer. For further information about the Windows XP boot processes, consult www.dummies.com/go/aplusaio.
ntldr
If ntldr is missing, you will receive the following error message when your computer tries to boot:
NTLDR is missing
Press any key to restart
This message often means that a formatted floppy was left in the disk drive. If this file is actually missing, it can be replaced with a working copy from any pre–Windows Vista computer, although try to replace the missing file with a copy from the same or a newer version of Windows to maintain full compatibility. To replace this file, you might have to make a boot disk to get your computer booted. This can be done with the following steps:
1. Format a disk on a working Windows XP computer.
2. Copy the files ntldr, ntdetect.com, and boot.ini from the root of the C: drive.
These files are hidden, system, and read-only, so you have to modify their attributes to copy them. Check out Book V, Chapter 4 for the lowdown on modifying attributes.
3. Edit the boot.ini file to reflect the boot configuration of your target computer (the one that will not boot).
Had this error message been Invalid system disk, this represents the fact that you are using a disk that was formatted with a Windows 9x–based operating system. Again, the first thing to do is to make sure that no floppy disk is in the drive.
boot.ini
If the boot.ini file is missing and you installed Windows XP in its default location, the system will boot but will not display a boot menu. The default location for the OS in Windows XP and newer versions of Windows is c:windows. If you have not installed Windows in its default location, you will receive a message stating that ntoskrnl.exe or hal.dll is corrupted or missing and that you should replace the file. The message will look similar to this, from Windows XP, stating that a dll file is missing:
Windows could not start because the following file is missing or corrupt:
<Windows root>system32hal.dll
Please re-install a copy of the above file.
This message is misleading because the problem is really with the boot.ini file. The reason for the message is that the boot loader (ntldr) has gone to the default location, and ntoskrnl.exe or hal.dll files were not there. If the boot.ini file is replaced and the boot path is correct for your installation, the boot process will continue as normal.
boot.ini is a text file and can be edited with any text editor, such as notepad.exe. To replace the boot.ini file, you might need to create a boot disk like you did to replace the missing ntldr file.
ntdetect.com
If ntdetect.com is missing, you receive the following error message:
NTDETECT failed
This file is generic, like the ntldr file, and can be replaced in the same way that you replace the ntldr file. See the earlier section, “ntldr.”
bootmgr
If bootmgr is missing, you receive the following error message when your computer tries to boot:
BOOTMGR is missing
Press Ctrl+Alt+Del to restart
To resolve this type of error, look at using the Startup Repair process or the repair Command Prompt with tools like bootrec.exe /fixboot. For more information about the Startup Repair process as well as repairing errors, see Chapter 3 of this minibook.
Boot Configuration Database (BCD)
If BCD is missing, you receive the following error message when your computer tries to boot:
Windows Boot Manager
Windows failed to start. A recent hardware or software change might be the
cause. To fix the problem:
1. Insert your Windows installation disc and restart your computer.
2. Choose your language settings, and then click “Next.”
3. Click “Repair your computer.”
If you do not have this disc, contact your system administrator or computer
manufacturer for assistance.
File: BootBCD
Status: 0xc000000f
Info: An error occurred while attempting to read the boot configuration
data.
Enter=Continue ESC=Exit
To resolve this type of error, look at using the Startup Repair process or the repair Command Prompt which includes tools like bootrec.exe /RebuildBCD or bcdedit.exe. bcdedit.exe will allow you to manually rebuild the BCD.
winload.exe
If winload is missing, you will receive the following error message when your computer tries to boot:
Windows Boot Manager
Windows failed to start. A recent hardware or software change might be the
cause. To fix the problem:
1. Insert your Windows installation disc and restart your computer.
2. Choose your language settings, and then click “Next.”
3. Click “Repair your computer.”
If you do not have this disc, contact your system administrator or computer
manufacturer for assistance.
File: Windowssystem32winload.exe
Status: 0xc000000f
Info: The selected entry could not be loaded because the application is
missing or corrupt.
Enter=Continue ESC=Exit
To resolve this type of error, look at using the Vista Startup Repair process or the repair Command Prompt which includes tools like bootrec.exe /RebuildBCD or bcdedit.exe. bcdedit.exe will allow you to manually rebuild the BCD.
ntoskrnl.exe or hal.dll
You should be able to find the ntoskrnl.exe file in the <Windows XP root drive>windowssystem32 directory. If it’s missing, you receive a message like this, from Windows XP:
Windows could not start because the following file is missing or corrupt:
<Windows root>system32hal.dll
Please re-install a copy of the above file.
These messages may look familiar; they are the same messages that you receive if your boot.ini file is misconfigured. After checking the boot.ini file, if the ntoskrnl.exe or hal.dll files are actually missing, you have to do one of the following:
Perform an Emergency Repair Process for Windows XP or a Startup Repair in Windows Vista or Windows 7 to replace any missing or corrupted files on your system.
For more information on Emergency Repair Process, see Book VII, Chapter 3.
Attempt to replace the file by using the Recovery Console.
Reinstall the operating system.
Ninety-nine out of 100 times, the missing ntoskrnl.exe or hal.dll error message means an error with the boot.ini file or the BCD, and the ntoskrnl.exe or hal.dll file is fine. While hal.dll represents a missing dll file, many other dll files are integral to the OS operating correctly. If many of these are missing, the recovery option will be through the Emergency Repair process, which is covered in Chapter 3 of this minibook.
ntbootdd.sys
Most systems boot either from ATA/SATA hard drives or from SCSI drives attached to a SCSI controller or an adapter with a working BIOS. In either case, you will not find the ntbootdd.sys file on your drive. If you are booting from a SCSI drive attached to a SCSI controller that has its BIOS disabled, you will find the ntbootdd.sys file on the root of your bootable drive, along with ntldr, ntdetect.com, and boot.ini. This file is computer- specific because it is the SCSI driver for your SCSI controller. It can be replaced with a copy of the file found on any other computer that boots from the same SCSI controller. If you do not have another system with the same configuration, you can get a copy of the SCSI driver from either the driver disk for the SCSI controller or possibly from your Windows installation CD-ROM. This driver will have to be renamed to ntbootdd.sys and copied to the boot drive, and you might need to make a boot disk like the one described in the earlier section “ntldr.”
Device-Related Errors
It is unfortunate that the devices and their drivers that allow us to accomplish so much of our day-to-day work with computers are also one of the biggest factors in not being able to do work on our computers. Ideally, when all the devices are configured on your computer, you should be able to work with no problems from your drivers. Most people’s computers don’t remain in a static mode but are in constant flux. Even though devices are working fine, many people feel the need to try to improve performance by changing settings, upgrading drivers, or installing Service Packs. Although upgrading drivers and installing items such as Service Packs are common practice, they should be done carefully. A Service Pack, for instance, can change how all drivers on your computer function. In the rare case when something does go wrong, you may find that the fix is difficult, but in most cases, it will be related to a file version or configuration setting. This section takes a look at how to address these problems.
A device referenced in system files is not found
From time to time, you will find that one of your startup files still references a device that you thought had been removed from your system. The files that reference devices include system.ini, win.ini, and the Registry. If this happens, you might have to edit these files manually in order to fix the problem. If an error message tells you that a referenced device does not exist, take note of the device being referenced because you will have to search for it in your startup files. Most devices are found within your system.ini file, so this is the first file to check. Both INI files can be opened and edited with notepad.exe.
If the device is listed in the Registry, it should be listed in Device Manager. Choose Start⇒Control Panel⇒System, click the Hardware tab of the resulting dialog box, and then click the Device Manager button. For Windows Vista and Windows 7, choose Start⇒Control Panel⇒System and Security⇒Device Manager. Locate the device in Device Manager and delete it. If the device is still physically present in the computer, it will be re-added to Device Manager when your computer is rebooted. If you keep removing the device and it keeps coming back, that is because it is still physically present. Physically remove the device first, and then remove it from Device Manager.
In Windows, if you do not see the device that you want to remove in Device Manager, choose Show Hidden Devices from the View menu. If you can’t find the device in the Windows GUI, you can attempt to search the Registry to locate the device and correct the issue. To find out about editing the Registry, see Book VI, Chapter 4.
Registry corruption
The two main ways that the system Registry can become corrupted are updates to the Registry via one of the Registry editing tools or an import of a registry settings file, and by the files that make up the Registry becoming damaged or deleted.
Of the many ways to import data into the Registry, most of them involve storing settings in a file and importing that file into the Registry. If the settings in the file are incorrect, you might be able to just continue computing without any problems, or you could end up with a system that no longer boots normally. If your system will not boot normally, your only option is to boot the system by using an alternative method, such as the Recovery Console, and replace the base Registry files with an untainted version.
You also need to use an alternative method to boot the system if the Registry files on the drive itself have become corrupted, and then you have to replace the Registry files. The user portion of the Registry — ntuser.dat — is found in your user profile directory. Your user profile directory is in C:Documents and Settings<username> (C:Users<username> for Windows Vista and Windows 7). The system portion of the registry is found in %systemroot%sysetm32config, in the files SAM, SECURITY, system, and software. For information about editing the Registry, see Book VI, Chapter 4.
Safe Mode
In order to let you repair the OS from within the OS, Microsoft provides Safe Mode. Safe Mode is available with most versions of Windows and is a special boot of Windows that loads a minimal set of drivers and services. The only drivers that are loaded are the ones that are required to get the OS running. Instead of loading the normal video driver, Safe Mode loads a 16-color VGA graphics driver. The config.sys and autoexec.bat files are skipped completely, if they exist on the computer. If you have issues with drivers or driver configuration, booting into Safe Mode can allow you to bypass these driver-related problems so that they can be fixed.
Enter Safe Mode by pressing the F8 key when the OS is booting. If your computer boots into Safe Mode, the words Safe Mode appear in each corner of your desktop. If Windows fails to boot properly, it will suggest — and attempt — to boot into Safe Mode on the next boot. If your computer boots into Safe Mode automatically, the last boot process was likely interrupted (usually by the user). For more information about Safe Mode and other boot methods, consult Book VII, Chapter 3.
Other Errors
Like with all things in life, some things cannot easily be categorized, so this section discusses errors that do not fit in the other categories in this chapter.
Paging file errors
The Windows paging file is a hard drive file that is used as additional RAM memory. Typically with Windows, the file is called the paging file or page file, but some people may still use the Windows 9x name for the file: “swap file.” The location of the paging file is recorded in the Registry. If the drive that contains the paging file becomes too full, you might encounter errors informing you of this fact. If this happens, create some additional space for the paging file by deleting some unnecessary files, reducing the size of the paging file, or moving the paging file to a new location. The default location for the paging file is in the same drive as your Windows directory. Windows allows you to move the paging file to an alternate drive. If you have done so and that drive has been removed from your system, you encounter errors telling you that the paging file could not be created. If this happens, configure Windows to use another drive for the paging file as shown in Book VI, Chapter 3.
Failure to start GUI
Sometimes, Windows cannot complete the boot process, but it will not generate an error, either. Instead, it seems to hang at one spot in the boot process without going any further. You can deal with this problem in a number of ways.
First, see whether the OS has loaded the networking components, which you can do using the ping utility discussed in Book VIII, Chapter 3. If the networking services are running, you might be able to connect to the computer using Computer Management or Event Viewer, as described in Book VI, Chapter 4, which will allow you to view information about the OS and read the event logs. The event log might show errors that let you know what the problem is.
If you cannot connect to the computer, your only options are to continue to wait or to cycle the power on the computer. If the computer has locked up hard enough, the soft power button might not work, and you might have to unplug the computer. For a laptop, you have to remove the battery.
This action, like any power interruption, risks causing corruption to the file system, and should be used as a last resort.
On reboot, the system might boot properly, or you might want to use one of the F8 boot options discussed in Book VII, Chapter 3, such as Safe Mode. Safe Mode allows you to view the Event Logs via Event Viewer, and that might give you insight into the problem. The F8 boot options also allow you to create a bootlog, which if your next boot is unsuccessful, will let you know approximately where the failure is occurred. If you are unable to find the solution, disconnect all peripherals (such as USB devices) and attempt to reboot the computer. If the problem is with a peripheral or its driver, you might see a successful boot. In some cases, I have seen errors with peripherals occur after the system has successfully booted for years, and the problem can usually be traced to an OS update, a drive update, or file system corruption of the driver.
If you think you know what is causing the problem, perhaps a driver or service that will not start, you could also use Recovery Console to try to fix those problems. For more information about Recovery Console and its use, consult Book VII, Chapter 3.
Error Diagnostic Tools
The following sections examine the different tools you can use when diagnosing errors.
Dr. Watson
Dr. Watson, first included with Windows 3.x, has been designed to help troubleshoot problems on your system. It helps troubleshoot problems after they occur by generating log files and system snapshots.
Figure 1-1 shows Dr. Watson’s configuration screen for a Windows XP computer. Configure Dr. Watson in a Windows XP computer by running drwtsn32.exe from the Run command. Dr. Watson can take the entire contents of an applications memory space, and write that information to a file on your disk (also called a “crash dump file”). This can be useful for the application developer to troubleshoot the error. Dr. Watson also logs and creates crash dump files for a variety of OS background services, which are really just applications, as shown in Figure 1-2. With Windows XP, Dr. Watson is always ready to generate these logs and crash dump files.
Figure 1-1: Dr. Watson provides the Diagnosis tab for you to describe what you were doing when the error occurred.
Figure 1-2: How Dr. Watson deals with applications that crash.
Windows Error Reporting
With Windows XP, Microsoft introduced a tool for error reporting that replaced most of the functionality originally covered by Dr. Watson. The Error Reporting tool allows you various levels of reporting. By default, it is configured to report errors in both applications and the OS directly to Microsoft, which allows its programmers the potential to use the information when creating new patches for the operating system. This “call home” functionality can be disabled by going to Error Reporting button on the Advanced tab of the System Control Panel applet. Clicking the Error Reporting button opens the Error Reporting dialog shown in Figure 1-3. From this dialog, you can disable the “call home” functionality but still have Windows report the errors to you; specify that Error Reporting works for both OS components and program; or use the Choose Programs button to specify which programs you want to have Error Reporting work with, or exclude.
Figure 1-3: Windows Error Reporting helps Microsoft fix problems with the OS.
When an application crashes, you will see a message similar to the one in Figure 1-3. If Windows has a Stop error, though (described in Book VII, Chapter 2), you see the message after you reboot and log in. Click the link at the bottom of the dialog box to find additional information related to the error. When you see this dialog, you can send a summary of the error data and system state to Microsoft, as shown in Figure 1-4. If you disabled Error Reporting but kept the notify option enabled, you get a smaller dialog box without the option for notifying Microsoft, but only an OK button to acknowledge the error.
Figure 1-4: Even with Error Reporting enabled, you can control what errors go to Microsoft.
Event Viewer
Windows offers various logging tools, the greatest of which uses the Event Log service. The Event Log service logs errors and events into several different log files. The Event Viewer is the application you use to view the contents of these log files.
Windows always has at least three default logs: Application, Security, and System. These log files have a default size of 512KB each and automatically overwrite events after seven days in Windows XP and have a default size of 20MB each and automatically overwrite events as needed in Windows 7. These settings can be adjusted for each file by right-clicking the log file in Event Viewer and choosing Properties to open the Log Properties dialog box, shown in Figure 1-5.
In the event that any log fills up, you receive a pop-up message.
On Windows XP, open the Event Viewer by choosing Start⇒Control Panels⇒Administrative Tools and then Event Viewer. To clear the log, right-click the log and choose Clear All Events.
If you are using Windows Vista or Windows 7, choose Start⇒Search, type Event Viewer, and press Enter. Then expand Windows Logs in the navigation pane, right-click the log, and choose Clear Log.
When you clear the log, you have the opportunity to save the events to a file.
Before clearing the filled log, examine the most recent events for an error that might have caused the log to fill quickly.
Figure 1-5: The default settings for the Windows 7 log files will prevent them from filling.
Getting an A+
This chapter examines a number of common errors that you are likely to encounter with Windows computers. These errors range from configuration settings and files to boot files and driver-related problems. You also see some common resolution methods, such as booting into Safe Mode. Some key elements to remember in this chapter are
No operating system found is an MS-DOS error message and might mean that a floppy disk was left in your Windows XP computer.
Most Windows boot sector or boot file errors can be fixed with either the Emergency Repair Process or Recovery Console.
Safe Mode is used to diagnose and resolve driver or startup problems.
Event Viewer should always be checked as part of the troubleshooting process to see what error messages are being reported by Windows.
Prep Test
1 Which of the following options are valid procedures for trying to resolve corrupted boot files with Windows XP? Choose all that apply.
A 
Recovery Console
B sys.com
C fdisk.exe
D Emergency Repair Process
2 Which of the following are loaded when you boot into Safe Mode? Choose all that apply.
A Your normal video driver
B Your mouse driver
C config.sys
D autoexec.bat
3 What is the purpose of a swap file?
A To prepare files to be copied to other disks
B To act as additional memory for the system
C To act as an extension to the hard drive
D To prepare files that are saved to disk
4 Where do you go to read and clear the Windows XP Event Log?
A Event Log
B Event Viewer
C Log Reader
D Disk Cleanup
5 You installed Windows XP in the default location, C:windows. What will be the effect of deleting your boot.ini file?
A Your system will boot as normal but will not display a boot menu.
B Your system will not boot and will display a missing boot.ini error message.
C Your system will not boot and will display a missing ntoskrnl32.exe error message.
D Your system will not boot and will display a missing ntdetect.com error message.
6 You are missing your copy of ntldr, and your Windows XP computer will not boot. How can you replace your copy of ntldr?
A Use the retrieve.exe command to get a copy from the Windows XP installation CD-ROM.
B The only way you can replace this file is through the Recovery Console.
C This file is not required and does not have to be replaced.
D Copy it from any other computer that is running Windows XP.
7 You just noticed that your ntbootdd.sys file is missing from your computer. What is the ntbootdd.sys file?
A Text configuration information for your Windows XP system
B The boot loader
C The SCSI driver for your SCSI adapter if the BIOS is disabled on the adapter
D The boot menu configuration file
8 When should you boot into Safe Mode?
A At every boot-up
B When your system will not boot normally
C When your computer is connected to the Internet
D Only to play freecell.exe
9 The system Registry for Windows XP is extremely important. What file or files make up the user portion of the Registry?
A registry.dat
B system.ini and registry.dat
C user.dat
Answers
1 A, D. Both Recovery Console and the Emergency Repair Process allow you to repair problems with the boot files. Check out “Windows Boot Files and Boot Errors.”
2 B. Your mouse driver is the only item on the list that loads when you enter Safe Mode. It also loads a VGA-compatible video driver and a minimal set of device drivers. Peruse “Safe Mode.”
3 B. The Windows swap file acts as additional memory, or virtual memory, for the OS. Take a look at “Paging file errors.”
4 B. Event Viewer is used to read, back up, and clear your event logs. Look over “Event Viewer.”
5 A. Your system will boot as normal; when boot.ini is missing, Windows attempts to boot from the default installation location. Study “Windows Boot Files and Boot Errors.”
6 D. ntldr is identical across all copies of Windows XP, so it can be copied from any working installation of Windows XP. Refer to “ntldr.”
7 C. The ntbootdd.sys file contains the SCSI driver for your SCSI adapter if the BIOS on the adapter has been disabled. Examine “ntbootdd.sys.”
8 B. You should enter Safe Mode to correct problems when your computer won’t boot normally. See “Safe Mode.”
9 D. The file that makes up the user portion of the Registry in Windows XP is ntuser.dat. Review “Registry corruption.”