1. MCDST 70-271: Supporting Users and Troubleshooting a Microsoft Windows XP Operating System Chapter 4: Troubleshoot System Startup and User Logon Problems

2. Guide to MCDST 70-2712 Objectives Understand the Windows XP boot phases Understand advanced startup options Understand boot configuration and selecting an operating system Edit the Boot.ini file Understand the Windows XP load phase

3. Guide to MCDST 70-2713 Objectives (continued) Use the MS-DOS startup disk and the Recovery Console Troubleshoot the startup process Describe the Windows XP security model, and the types of logon Troubleshoot and customize the logon process

4. Guide to MCDST 70-2714 Windows XP Boot Phases Boot phase –Takes place when computer is first powered on or –When you choose Restart from the Turn Off Computer dialog box Load phase –Begins when boot phase is completed and a configuration is selected

5. Guide to MCDST 70-2715 Power-on Self Test First step in boot sequence for any computer with an operating system Determines –The amount of real memory that exists –Whether or not all necessary hardware components, such as a keyboard, are present The software for the POST resides in the system’s primary BIOS chip

6. Guide to MCDST 70-2716 Power-on Self Test (continued)

7. Guide to MCDST 70-2717 Initial Startup Master Boot Record (MBR) begins boot process by looking up the partition table Active partition contains OS files that must be loaded first Partition boot sector is completely dependent on the operating system and file system in use

8. Guide to MCDST 70-2718 Boot Loader Files on system partition used to initiate loading of the operating system Will display a boot menu if more than one OS is present Ntldr, Boot.ini, Bootsect.dos, Ntdetect.com, and Ntbootdd.sys may all be present in the root directory of the startup disk

9. Guide to MCDST 70-2719 Boot Loader (continued)

10. Guide to MCDST 70-27110 Selecting the Operating System Ntldr –Reads the Boot.ini file –Displays operating system selections Boot selection menu –Represents the point at which users can select which operating system they want to load

11. Guide to MCDST 70-27111 Selecting the Operating System (continued)

12. Guide to MCDST 70-27112 Detecting Hardware Ntdetect.com –Executed by the boot loader –Used to collect a list of hardware currently installed in the computer Ntdetect –Checks computer ID, bus/adapter type, video, keyboard, communication ports –Creates a system profile

13. Guide to MCDST 70-27113 Selecting a Configuration Once hardware is detected, the system needs to select a system configuration (hardware profile) –If a single hardware profile is defined, that is used –If two or more hardware profiles are present, the system selects a profile based on detected hardware –If the system cannot make an automatic selection, you are prompted to manually select a hardware profile

14. Guide to MCDST 70-27114 Advanced Startup Options Safe mode Safe Mode with Networking Safe Mode with Command Prompt Enable Boot Logging

15. Guide to MCDST 70-27115 Advanced Startup Options (continued) Enable VGA Mode Last Known Good Configuration (LKGC) Directory Services Restore Mode Debugging Mode

16. Guide to MCDST 70-27116 Boot Configuration and Selecting an Operating System [boot loader] –Timeout setting Defines number of seconds system waits for user to select an operating system before loading default operating system –Default setting Lists the path to the default operating system [operating systems] –Lists available operating systems

17. Guide to MCDST 70-27117 Editing Boot.ini Options include –Using Control Panel to edit the file indirectly –Using a text editor to change the file directly

18. Guide to MCDST 70-27118 Editing Boot.ini (continued)

19. Guide to MCDST 70-27119 Windows XP Load Phase Consists of the following stages –Loading the kernel –Initializing the kernel –Services load –Windows XP system startup –Logging on

20. Guide to MCDST 70-27120 Loading the Kernel Boot loader –Loads Windows XP kernel (Ntoskrnl.exe) and Hardware abstraction layer (HAL; file Hal.dll) into memory Control set –Special set of Registry values that describes a Windows XP machine’s startup configuration

21. Guide to MCDST 70-27121 Loading the Kernel (continued)

22. Guide to MCDST 70-27122 Initializing the Kernel Error levels –Ignore: error is ignored –Normal: boot process continues –Severe: management of error depends on whether the LKGC is in use or not –Critical: management of error depends on whether the LKGC is in use or not

23. Guide to MCDST 70-27123 Services Load Autocheck –Ensures that files stored on your hard drive are always consistent –Detects and attempts to repair damaged files and directories

24. Guide to MCDST 70-27124 Services Load (continued)

25. Guide to MCDST 70-27125 Windows XP System Startup Windows XP system can be considered fully started once: –Windows XP services have all started –The elements in the group of processes configured to launch on startup are fired off This phase is signaled by the appearance of the Windows XP logon screen as theWin32 subsystem starts winlogon.exe –Automatically launches the Local Security Authority (Lsass.exe) process

26. Guide to MCDST 70-27126 Logging On Until a user successfully logs on, the boot process is not complete until the Clone control set is copied to the LKGC set This procedure provides values to be used the next time the machine is powered up, if the user elects to use the LKGC

27. Guide to MCDST 70-27127 MS-DOS Startup Disk Used to troubleshoot problems with Windows XP For Windows XP systems that use only or mostly FAT partitions –Any file on a FAT partition can be edited, replaced, moved, copied, deleted, renamed, etc. If system uses NTFS partitions –MS-DOS startup disk will be of little use

28. Guide to MCDST 70-27128 Recovery Console To access: –From a command prompt, change directories to your Windows XP CD Run \i386\winnt32.exe /cmdcons to install the Recovery Console –Use the Windows XP CD or startup disks to start your computer Select the Recovery Console option when you are prompted to choose repair options

29. Guide to MCDST 70-27129 Troubleshooting Startup General troubleshooting procedure –Use the LKGC boot option –Boot into Safe Mode –Uninstall or remove the suspect component –Use a System Restore point if available –Use the Recovery Console

30. Guide to MCDST 70-27130 Troubleshooting Startup (continued) General troubleshooting procedure –Verify the Boot.ini configuration and the presence of required system files –Install a second instance of the OS onto a different partition –Use Automated System Recovery (ASR) –Perform an upgrade install –Perform a clean install

31. Guide to MCDST 70-27131 Security Within the Logon Process Windows Welcome –Designed for use on standalone or workgroup member systems –Fast User Switching allows Windows XP Professional to switch users without logging off Classic logon method –Logon mode is set to classic logon automatically when Windows XP system becomes a domain member

32. Guide to MCDST 70-27132 Logon Identification Before user can access Windows XP resource, he or she must log on to the system by supplying a valid user ID and password Identification requires that user supply a valid account name

33. Guide to MCDST 70-27133 Logon Authentication Authentication –User must use some method to verify his or her identity Access token includes the following components: –The unique SID for the account –List of groups (via group SIDs) to which the user belongs –List of rights and privileges associated with the specific user’s account

34. Guide to MCDST 70-27134 Troubleshooting Logon Domain controller –Authenticates domain logons and maintains the security policies and account database for a domain Cached credentials –Does not represent true domain authentication –Re-uses old authentication and access token

35. Guide to MCDST 70-27135 Mapped Network Drive If unable to connect over a mapped network drive, create a new mapping to the drive Forces a new authentication procedure and assigns the user account a current access token

36. Guide to MCDST 70-27136 First Time Logons If user has not logged on to a specific system before and domain controller is unavailable, an error message states that logon could not be performed –Check if system has correct network connectivity and contact system or network administrator to confirm an issue or problem with the network or local domain controllers –If user had logged on in the past, Windows XP Professional would have used cached credentials to provide access when the domain controller could not be reached

37. Guide to MCDST 70-27137 Typing Errors User may mistype his logon credentials or the CAPS LOCK key was engaged If password included numbers and the numerical keypad was used, the NUM LOCK key may not have been engaged If still unable to log on, check with the system or network administrator –May need to have the password on domain user account reset or account may be locked out due to too many repetitive logon failures

38. Guide to MCDST 70-27138 Customizing the Logon Process Winlogon –Alters the default logon process appearance and function –Controls automated logon, warning text, the display of the Shutdown button Reasons for customizing the logon process –To change the default username –To add a security warning message

39. Guide to MCDST 70-27139 Disabling the Default Username Logon window displays the name of the last user to log on by default Possible to change the default by altering the value of its associated Registry key or Local Security Policy value

40. Guide to MCDST 70-27140 Adding a Security Warning Message LegalNoticeCaption –Puts a label on the title bar of the legal notice window that appears during logon LegalNoticeText –Contains text information that provides the details of the warning to be issued to system users

41. Guide to MCDST 70-27141 Disabling the Shutdown Button Value named ShutdownWithoutLogon –Edited in the Registry or Local Security Policy console –Enabled by default –To disable, change its value assignment to 0 –To re-enable, reset its value to 1

42. Guide to MCDST 70-27142 Automating Logons To set up an automated logon, these Registry value entries must be defined and set –DefaultDomainName –DefaultUserName –DefaultPassword –AutoAdminLogon

43. Guide to MCDST 70-27143 Summary The Windows XP boot process –After the POST BIOS loads the MBR, which then loads the partition boot sector –When boot menu appears You can press F8 to access the Windows Advanced Options Menu –After the boot loader The kernel is loaded into memory

44. Guide to MCDST 70-27144 Summary (continued) Boot process can be altered by changing the Boot.ini file Recovery Console used to recover system configurations and user settings in the event of a system failure Winlogon –Controls how users identify themselves and log on –Supports a number of logon controls