William Stanek - Windows Server 2012 R2 Storage, Security, & Networking Pocket Consultant

Many startup problems occur because something on the system has changed; for example, a device might have been incorrectly installed. The system configuration or registry might have been updated improperly, causing a conflict. Often you can resolve startup issues by using safe mode to recover or troubleshoot system problems. When you have finished using safe mode, be sure to restart the server by using a normal startup. You will then be able to use the server as you usually would.

In safe mode, Windows Server 2012 R2 loads only basic files, services, and drivers. The drivers loaded include those for the mouse, monitor, keyboard, mass storage, and base video. The monitor driver sets the basic settings and modes for the server’s monitor; the base video driver sets the basic options for the server’s graphics card. No networking services or drivers are started unless you choose the Safe Mode With Networking option. Because safe mode loads a limited set of configuration information, it can help you troubleshoot problems.

You can start a server in safe mode by following these steps:

1.If the computer won’t start as usual, the Recovery screen is displayed during startup. On the Recovery screen, tap or click Troubleshoot.

2.On the Advanced Options screen, tap or click Startup Settings. Next, on the Windows Startup Settings screen, tap or click Restart.

3.Use the arrow keys to select the safe mode you want to use, and then press Enter. The safe mode option you use depends on the type of problem you’re experiencing. The key options are as follows:

■ Repair Your ComputerLoads the Startup Repair tool. Choose this option to restart the server and go back to the Recovery screen.

■ Safe ModeLoads only basic files, services, and drivers during the initialization sequence. The drivers loaded include the mouse, monitor, keyboard, mass storage, and base video. No networking services or drivers are started.

■ Safe Mode With NetworkingLoads basic files, services, and drivers, in addition to services and drivers needed to start networking.

■ Safe Mode With Command PromptLoads basic files, services, and drivers, and then starts a command prompt instead of the Windows graphical interface. No networking services or drivers are started.

TIP In Safe Mode With Command Prompt, you can start the explorer shell from the command-line interface by pressing Ctrl+Shift+Esc and entering explorer.exe in the New Process window on the File menu of Task Manager.

■ Enable Boot LoggingEnables you to create a record of all startup events in a boot log.

■ Enable Low-Resolution VideoEnables you to start the system in lowresolution 640 × 480 display mode, which is useful if the system display is set to a mode that can’t be used with the current monitor or the system has a bad driver.

■ Last Known Good ConfigurationStarts the computer in safe mode by using registry information that Windows saved at the last shutdown, including the HKEY_CURRENT_CONFIG (HKCC) hive. This registry hive stores information about the hardware configuration with which you previously and successfully started the computer.

■ Debugging ModeStarts the system in debugging mode, which is useful only for troubleshooting operating system bugs.

■ Directory Services Restore ModeStarts the system in safe mode, and enables you to restore the directory service. This option is available on Windows Server 2008 R2 and later domain controllers.

■ Disable Automatic Restart On System FailurePrevents Windows Server from automatically restarting after an operating system crash.

■ Disable Driver Signature EnforcementStarts the computer in safe mode without enforcing digital signature policy settings for drivers. If a driver with an invalid or missing digital signature is causing startup failure, this option resolves the problem temporarily so that you can start the computer and resolve the problem by getting a new driver or changing the driver signature enforcement settings.

■ Disable Early Launch Anti-Malware DriverStarts the computer in safe mode without running the boot driver for the computer’s anti-malware software. If the boot driver for the computer’s anti-malware software is preventing startup, you need to check the software developer’s website for an update to resolve the boot problem or configure the software without boot protection.

■ Start Windows NormallyStarts the computer with its regular settings.

4.If a problem doesn’t reappear when you start in safe mode, you can eliminate the default settings and basic device drivers as possible causes. If a newly added device or updated driver is causing problems, you can use safe mode to remove the device or reverse the update.

In Windows Server 2012 R2, there are approximately 50,000 system state files, which use approximately 4 GB of disk space in the default installation of an x64-based computer. The fastest and easiest way to back up and restore a server’s system state is to use Wbadmin. With Wbadmin, you can use the START SYSTEMSTATEBACKUP command to create a backup of the system state for a computer, and the START SYSTEMSTATERECOVERY command to restore a computer’s system state.

TIP When you select a system state restore on a domain controller, you have to be in the Directory Services Restore mode. To learn how to restore Active Directory, see the next section.

To back up a server’s system state, enter the following at an elevated command prompt:

wbadmin start systemstatebackup -backupTarget: VolumeName

Here VolumeName is the storage location for the backup, such as F:.

To restore a server’s system state, enter the following at an elevated command prompt:

wbadmin start systemstaterecovery -backupTarget: VolumeName

Here VolumeName is the storage location that contains the backup you want to recover, such as F:. Additionally, you can do the following:

■Use the -recoveryTarget parameter to restore to an alternate location.

■Use the -machine parameter to specify the name of the computer to recover if the original backup location contains backups for multiple computers.

■Use the -authSysvol parameter to perform an authoritative restore of the SYSVOL.

You can also recover the system state by using a backup that includes the system state or by performing a recovery.

When restoring system state data to a domain controller, you must choose whether you want to perform an authoritative or nonauthoritative restore. The default is nonauthoritative. In this mode, Active Directory and other replicated data are restored from backup and any changes are replicated from another domain controller. Thus, you can safely restore a failed domain controller without overwriting the latest Active Directory information. On the other hand, if you’re trying to restore Active Directory throughout the network by using archived data, you must use an authoritative restore. With an authoritative restore, the restored data is restored on the current domain controller and then replicated to other domain controllers.

CAUTION An authoritative restore overwrites all Active Directory data throughout the domain. Before you perform an authoritative restore, you must be certain that the archive data is the correct data to propagate throughout the domain and that the current data on other domain controllers is inaccurate, outdated, or otherwise corrupted.