Chapter 3. Boot configuration

Boot from hardware and firmware

Boot environment essentials

Managing startup and boot configuration

Managing the boot configuration data store and its entries

Unlike early releases of server operating systems for Microsoft Windows, Windows Server 2012 R2 doesn’t boot from an initialization file. Instead, the operating system uses the Windows Boot Manager to initialize and start the operating system. The boot environment dramatically changes the way the operating system starts, and it is designed to resolve issues related to boot integrity, operating system integrity, and firmware abstraction. The boot environment is loaded prior to the operating system, making it a pre–operating system environment. This ensures that the boot environment can be used to validate the integrity of the startup process and the operating system itself before actually starting the operating system.

Boot from hardware and firmware

At first glance, startup and shutdown seem to be the most basic features of an operating system, but as you get a better understanding of how computers work, you quickly see that there’s nothing simple or basic about startup, shutdown, or related processes and procedures. In fact, anyone who’s worked with computers probably has had a problem with startup or shutdown at one time or another. Problems with startup and shutdown can be compounded in modern computers because of their extended frameworks for advanced configuration and power management in firmware and hardware.

Note

Many administrators install Windows Server 2012 R2 on desktop-class systems without giving careful consideration to how this could affect the operation of the computer. When you install Windows Server 2012 R2 on a desktop-class system, it is critically important for you to understand how computers designed for desktop operating systems handle advanced configuration and power management in hardware and firmware. This will enable you to modify the hardware and firmware settings so that they work better with Windows Server 2012 R2.

Hardware and firmware power states

Before the boot environment is loaded, computers start up from hardware and firmware. Windows desktop operating systems do things a bit differently from Windows Server operating systems when it comes to power-state management features. In Windows desktops, turning off a computer and shutting down a computer are separate tasks. By default, when you turn off a computer running a Windows desktop operating system, the computer enters standby mode. When entering standby mode, the operating system automatically saves all work, turns off the display, and enters a low power-consumption mode with the computer’s fans and hard disks stopped. The state of the computer is maintained in the computer’s memory. When the computer wakes from standby mode, its state is exactly as it was when you turned off your computer.

You can turn off a computer running a Windows desktop operating system and enter standby mode by tapping or clicking the Settings charm, tapping or clicking Power, and then tapping or clicking Sleep. To wake the computer from the standby state, you can press the power button on the computer’s case or a key on the computer’s keyboard. Moving the mouse also wakes the computer.

If you install Windows 8.1 or Windows Server 2012 R2 on a mobile computer, the computer’s power state can be changed by closing the lid. By default with Windows 8.1, the computer enters the standby state when you close the lid. By default with Windows Server 2012 R2, the computer doesn’t change its power state when you close or open the lid, but you can configure the server to shut down when you close the lid.

There are, however, a few gotchas with the power button and the standby state in Windows desktop operating systems. The way the power button works depends on the following:

  • System hardware. For the power button to work, the computer hardware must support the standby state. If the computer hardware doesn’t support the standby state, the computer can’t use it, and turning off the computer powers it down completely.

  • System state. For the power button to work, the system must be in a valid state. If the computer has installed updates that require a reboot or you’ve installed programs that require a reboot, the computer can’t enter the standby state, and turning off the computer powers it down completely.

  • System configuration. For the power button to work, sleep mode must be enabled. If you reconfigured the power options on the computer and set the power button to Shut Down, the computer can’t use the standby state, and turning it off powers it down completely.

You can determine exactly how the power options are configured on a computer running Windows by tapping or clicking the Settings charm, tapping or clicking Control Panel, and tapping or clicking Power Options. The available options depend on the type of computing device.

Diagnosing hardware and firmware startup problems

Whether you are working with a Windows desktop operating system or a Windows Server operating system when trying to diagnose and resolve startup problems, be sure to keep in mind that power-state management capabilities are provided by the hardware but are enabled by the operating system. Because of this, to diagnose and resolve boot issues fully, you must look at the computer’s hardware and software, including the following items:

  • Motherboard/chipset

  • Firmware

  • Operating system

To understand the hardware aspects of boot issues better, let’s dig in and take a look at Advanced Configuration and Power Interface (ACPI). A computer’s motherboard/chipset, firmware, and operating system must support ACPI for the advanced power-state features to work. There are many types of motherboards/chipsets. Although older motherboards/chipsets might not be updateable, most of the newer ones have updateable firmware. Chipset firmware is separate from and different from the computer’s underlying firmware interface.

Currently, there are three prevalent firmware interfaces:

  • Basic Input Output System (BIOS)

  • Extensible Firmware Interface (EFI)

  • Unified Extensible Firmware Interface (UEFI)

A computer’s BIOS, EFI, or UEFI programming provides the hardware-level interface between hardware components and software. Like chipsets themselves, BIOS, EFI, and UEFI can be updated. ACPI-aware components track the power state of the computer. An ACPI-aware operating system can generate a request for the system to be switched into a different ACPI mode. BIOS, EFI, or UEFI responds to enable the requested ACPI mode.

ACPI 4.0 was finalized in June 2009, and ACPI 5.0 was finalized in December 2011. Computers manufactured prior to this time will likely not have fully compliant firmware, and you will probably need to update the firmware when a compatible revision becomes available. In some cases, and especially with older hardware, you might not be able to update a computer’s firmware to make it fully compliant with ACPI 4.0 or ACPI 5.0. For example, if you are configuring the power options, and you don’t have minimum and maximum processor-state options, the computer’s firmware isn’t fully compatible with ACPI 3.0 and likely will not fully support ACPI 4.0 or ACPI 5.0 either. Still, you should check the hardware manufacturer’s website for firmware updates.

ACPI defines active and passive cooling modes. These cooling modes are inversely related to each other:

  • Passive cooling reduces system performance but is quieter because there’s less fan noise. With passive cooling, Windows lessens power consumption to reduce the operating temperature of the computer but at the cost of system performance. Windows reduces the processor speed in an attempt to cool the computer before increasing fan speed, which would increase power consumption.

  • Active cooling allows maximum system performance. With active cooling, Windows increases power consumption to reduce the temperature of the machine. Windows increases fan speed to cool the computer before attempting to reduce processor speed.

Power policy includes upper and lower limits for the processor state, referred to as the maximum processor state and the minimum processor state, respectively. These states are implemented by using a feature of ACPI 3.0 and later versions called processor throttling, and they determine the range of currently available processor performance states that Windows can use. By setting the maximum and minimum values, you define the bounds for the allowed performance states, or you can use the same value for each to force the system to remain in a specific performance state. Windows reduces power consumption by throttling the processor speed. For example, if the upper bound is 100 percent and the lower bound is 5 percent, Windows can throttle the processor within this range as workloads permit to reduce power consumption. In a computer with a 3 GHz processor, Windows would adjust the operating frequency of the processor between 0.15 GHz and 3.0 GHz.

Processor throttling and related performance states were introduced with early Windows operating systems, but these early implementations were designed for computers with discrete-socketed processors and not for computers with processor cores. As a result, they are not effective in reducing the power consumption of computers with logical processors. Beginning with Windows 7 and Windows Server 2008 R2, Windows reduces power consumption in computers with multicore processors by using a feature of ACPI 4.0 called logical processor idling and by updating processor-throttling features to work with processor cores.

Logical processor idling is designed to ensure that Windows uses the fewest processor cores for a given workload. Windows accomplishes this by consolidating workloads onto the fewest cores possible and suspending inactive processor cores. When additional processing power is required, Windows activates inactive processor cores. This idling functionality works in conjunction with the management of process performance states at the core level.

ACPI defines processor performance states, referred to as p-states, and processor idle sleep states, referred to as c-states. Processor performance states include P0 (the processor or core uses its maximum performance capability and can consume maximum power), P1 (the processor or core is limited below its maximum and consumes less than maximum power), and Pn (where state n is a maximum number that is processor dependent, and the processor or core is at its minimal level and consumes minimal power while remaining in an active state).

Processor-idle sleep states include C0 (the processor or core can execute instructions), C1 (the processor or core has the lowest latency and is in a nonexecuting power state), C2 (the processor or core has longer latency to improve power savings over the C1 state), and C3 (the processor or core has the longest latency to improve power savings over the C1 and C2 states).

Note

Windows switches processors or cores between any p-state and from the C1 state to the C0 state nearly instantaneously (fractions of milliseconds) and tends not to use the deep sleep states, so you don’t need to worry about the performance impact of throttling or waking up processors or cores. The processors or cores are available when they are needed. That said, the easiest way to limit processor power management is to modify the active power plan and set the minimum and maximum processor states to 100 percent.

Windows saves power by putting processor cores in and out of appropriate p-states and c-states. On a computer with four logical processors, Windows might use p-states 0 to 5, where P0 allows 100 percent usage, P1 allows 90 percent usage, P2 allows 80 percent usage, P3 allows 70 percent usage, P4 allows 60 percent usage, and P5 allows 50 percent usage. When the computer is active, logical processor 0 would likely be active with a p-state of 0 to 5, and the other processors would likely be at an appropriate p-state or in a sleep state.

ACPI 4.0 and ACPI 5.0 define four global power states. In G0, the working state (in which software runs), power consumption is at its highest, and latency is at its lowest. In G1, the sleeping state (in which software doesn’t run), latency varies with the sleep state, and power consumption is less than the G0 state. In G2 (also referred to as S5 sleep state), the soft off state when the operating system doesn’t run, latency is long, and power consumption is very near zero. In G3, the mechanical off state (in which the operating system doesn’t run), latency is long, and power consumption is zero. There’s also a special global state, known as S4 nonvolatile sleep, in which the operating system writes all system context to a file on nonvolatile storage media, allowing the system context to be saved and restored.

Within the global sleeping state, G1, are the sleep-state variations summarized in Table 3-1. S1 is a sleeping state in which the entire system context is maintained. S2 is a sleeping state similar to S1 except that the CPU and system-cache contexts are lost, and control starts from a reset. S3 is a sleeping state in which all CPU, cache, and chipset contexts are lost, and hardware maintains the memory context and restores some CPU and L2 cache configuration context. S4 is a sleeping state in which it is assumed that the hardware has powered off all devices to reduce power usage to a minimum, and only the platform context is maintained. S5 is a sleeping state in which it is assumed that the hardware is in a soft off state, in which no context is maintained, and a complete boot is required when the system wakes.

Table 3-1. Power states for ACPI in firmware and hardware

State

Type

Description

S0

ON state

The system is completely operational, fully powered, and completely retains the context (such as the volatile registers, memory caches, and RAM).

S1

Sleep state

The system consumes less power in this state than in the S0 state. All hardware and processor contexts are maintained.

S2

Sleep state

The system consumes less power in this state than in the S1 state. The processor loses power, and the processor context and contents of the cache are lost.

S3

Sleep state

The system consumes less power in this state than in the S2 state. The processor and hardware contexts, cache contents, and chipset context are lost. The system memory is retained.

S4

Hibernate state

The system consumes the least power in this state compared to all other sleep states. The system is almost in an OFF state. The context data is written to hard disk, and no context is retained. The system can restart from the context data stored on the disk.

S5

OFF state

The system is in a shutdown state, and the system retains no context. The system requires a full reboot to start.

Motherboard chipsets support specific power states. For example, a motherboard might support the S0, S1, S4, and S5 states, but it might not support the S2 or S3 states. In Windows operating systems, the sleep power transition refers to switching off the system to a Sleep or Hibernate mode, and the wake power transition refers to switching on the system from a Sleep or Hibernate mode. The Sleep and Hibernate modes allow users to switch off and switch on systems much faster than the regular shutdown and startup processes.

Thus, a computer is waking up when the computer is transitioning from the OFF state (S5) or any sleep state (S1–S4) to the ON state (S0), and the computer is going to sleep when the computer is transitioning from the ON state (S0) to the OFF state (S5) or sleep state (S1–S4). A computer cannot enter one sleep state directly from another because it must enter the ON state before entering any other sleep state. Sleep and hibernate are disabled in Windows Server.

Resolving hardware and firmware startup problems

On most computers, you can enter BIOS, EFI, or UEFI during boot by pressing F2 or another function key. When you are in firmware, you can open the Power screen or a similar screen to manage ACPI and related settings.

Power settings you might see include the following:

  • Restore AC Power Loss or AC Recovery. Determines the mode of operation if a power loss occurs and for which you see settings such as Stay Off/Off, Last State/Last, Power On/On. Stay Off means the system remains off after power is restored. Last State restores the system to the state it was in before power failed. Power On means the system turns on after power is restored.

  • Wake On LAN From S4/S5 or Auto Power On. Determines the action taken when the system power is off and a Peripheral Component Interconnect (PCI) Power Management wake event occurs. You see settings such as Stay Off or Power On.

  • ACPI Suspend State or Suspend Mode. Sets the suspend mode. Typically, you can set S1 state or S3 state as the suspend mode.

Note

I provide two standard labels for each setting because your computer hardware might not have these exact labels. The firmware variant you are working with determines the actual labels that are associated with boot, power, and other settings.

Because Intel and AMD also have other technologies to help reduce startup and resume times, you might also see the following power settings:

  • Enhanced Intel SpeedStep Technology (EIST), which can be either Disabled or Enabled

  • Intel Quick Resume Technology, which can be either Disabled or Enabled

Enhanced Intel SpeedStep Technology (EIST or SpeedStep) allows the system to adjust processor voltage and core frequency dynamically, which can result in decreased average power consumption and decreased average heat production. When EIST or a similar technology is enabled and in use, you see two processor speeds on the System page in Control Panel. The first speed listed is the specified speed of the processor. The second speed is the current operating speed, which should be less than the first speed. If Enhanced Intel SpeedStep Technology is off, the processor speeds will be equal. Advanced Settings for Power Options under Processor Power Management can also affect how this technology works. Generally speaking, although you might want to use this technology with a Windows desktop operating system, you won’t want to use it with a Windows Server operating system.

Intel Quick Resume Technology Driver (QRTD) allows an Intel Viiv technology–based computer to behave like a consumer electronic device with instant on/off after an initial boot. Intel QRTD manages this behavior through the Quick Resume mode function of the Intel Viiv chipset. Pressing the power button on the computer or a remote control puts the computer in the Quick Sleep state, and the computer can Quick Resume from sleep when you move the mouse, press an on/off key on the keyboard (if available), or press the sleep button on the remote control. Quick Sleep mode is different from standard sleep mode. In Quick Sleep mode, the computer’s video card stops sending data to the display, the sound is muted, and the monitor LED indicates a lowered power state on the monitor, but the power continues to supply vital components on the system such as the processor, fans, and so on. Because this technology was originally designed for earlier Windows operating systems, it does not work in many cases with later Windows desktop operating systems and generally should not be used with Windows Server operating systems. You might need to disable this feature in firmware to enable a Windows desktop operating system to sleep and resume properly.

After you look at the computer’s power settings in firmware, you should also review the computer’s boot settings in firmware. Typically, you have a list of bootable devices and can select which one to boot. You also might be able to configure the following boot settings:

  • Boot Drive Order. Determines the boot order for fixed disks

  • Boot To Hard Disk Drive. Determines whether the computer can boot to fixed disks, and can be set to Disabled or Enabled

  • Boot To Removable Devices. Determines whether the computer can boot to removable media, and can be set to Disabled or Enabled

  • Boot To Network. Determines whether the computer can perform a network boot, and can be set to Disabled or Enabled

  • USB Boot. Determines whether the computer can boot to USB flash devices, and can be set to Disabled or Enabled

As with power settings, your computer might not have these exact labels, but the labels should be similar. You need to optimize these settings for the way you plan to use the computer. In most cases, with server hardware, you’ll only want to enable Boot To Hard Disk Drive. The exception is when you use BitLocker Drive Encryption. With BitLocker, you’ll want to enable Boot To Removable Devices, USB Boot, or both to ensure that the computer can detect the USB flash drive with the encryption key during the boot process.

Boot environment essentials

Windows Server 2012 R2 supports several processor architectures and several disk partitioning styles. EFI was originally developed for Itanium-based computers. Computers with EFI use the globally unique identifier (GUID) partition table (GPT) disk type for boot and system volumes. Computers based on x86 use BIOS and the master boot record (MBR) disk type for boot and system volumes. Computers based on x64 use UEFI wrapped around BIOS or EFI.

With the increasing acceptance and use of UEFI and the ability of Windows to use both MBR and GPT disks regardless of firmware type, the underlying chip architecture won’t necessarily determine which firmware type and disk type a computer uses for boot and startup. That said, generally, BIOS-based computers use MBR for booting or for data disks and GPT only for data disks. EFI-based computers can have both GPT and MBR disks, but you typically must have at least one GPT disk that contains the EFI system partition (ESP) and a primary partition or simple volume that contains the operating system for booting.

With early releases of the server operating system for Windows, BIOS-based computers use Ntldr and Boot.ini to boot into the operating system. Ntldr handles the task of loading the operating system, whereas Boot.ini contains the parameters that enable startup, including the identity of the boot partitions. Through Boot.ini parameters, you can add options that control the way the operating system starts, the way computer components are used, and the way operating system features are used.

However, with early releases of the server operating system for Windows, EFI-based computers use Ia64ldr.efi, Diskpart.efi, and Nvrboot.efi to boot into the operating system. Ia64ldr.efi handles the task of loading the operating system; Diskpart.efi identifies the boot partitions. Through Nvrboot.efi, you set the parameters that enable startup.

Windows Server 2008 and later don’t use these boot facilities. Instead, they use a pre–operating system boot environment. Figure 3-1 provides a conceptual overview of how the boot environment fits into the overall computer architecture.

This diagram shows the operating system on top. Below that is the boot environment, which is made up of the boot application and the Boot Manager. The next level down is made up of the device drivers, the microkernel, and the HAL. Underneath all of this is the hardware.

Figure 3-1. A conceptual view of how the boot environment works.

The boot environment is an extensible abstraction layer that allows the operating system to work with multiple types of firmware interfaces without requiring the operating system to be specifically written to work with these firmware interfaces. Within the boot environment, startup is controlled by using the parameters in the boot configuration data (BCD) store.

The BCD store is contained in a file called the BCD registry. The location of this registry depends on the computer’s firmware:

  • On BIOS-based operating systems, the BCD registry file is stored in the BootBcd directory of the active partition.

  • On EFI-based operating systems, the BCD registry file is stored on the EFI system partition.

Entries in the BCD store identify the boot manager to use during startup and the specific boot applications available. The default boot manager is Windows Boot Manager. It controls the boot experience, and you can use it to choose which boot application is run. Boot applications load a specific operating system or operating system version. For example, a Windows Boot Loader application loads Windows Server 2012 R2. Because of this, you can boot BIOS-based and EFI-based computers in much the same way.

Managing startup and boot configuration

You can press F8 during startup of the operating system to access the Advanced Boot Options menu and then use this menu to select one of several advanced startup modes, including Safe Mode, Enable Boot Logging, and Disable Driver Signature Enforcement. Although these advanced modes temporarily modify the way the operating system starts to help you diagnose and resolve problems, they don’t make permanent changes to the boot configuration or to the BCD store. Other tools you can use to modify the boot configuration and manage the BCD store include the Startup And Recovery dialog box, the System Configuration utility, and BCD Editor. The sections that follow discuss how these tools are used.

Managing startup and recovery options

The Startup And Recovery dialog box controls the basic options for the operating system during startup. You can use these options to set the default operating system, the time to display the list of available operating systems, and the time to display recovery options when needed. Whether you start a computer to different operating systems or not, you want to optimize these settings to reduce the wait time during startup and, in this way, speed up the startup process.

You can access the Startup And Recovery dialog box by completing the following steps:

  1. In Control PanelSystem And Security, tap or click System to access the System window.

  2. In the System window, tap or click Advanced System Settings in the left pane. This opens the System Properties dialog box.

  3. On the Advanced tab of the System Properties dialog box, tap or click Settings under Startup And Recovery. This opens the Startup And Recovery dialog box, as shown in Figure 3-2.

    Note

    Open the Advanced tab of the System Properties dialog box directly by typing SystemPropertiesAdvanced.exe in the Apps Search box and pressing Enter.

    A screen shot showing startup and recovery configuration.

    Figure 3-2. Configuring system startup options.

  4. On a computer with multiple operating systems, use the Default Operating System list to specify the operating system you want to start by default.

  5. Set the timeout interval for the operating system list by selecting the Time To Display List Of Operating Systems check box and specifying a timeout in seconds in the field provided. To speed up the startup process, you might want to use a value of five seconds.

  6. Set the timeout interval for the recovery options list by selecting the Time To Display Recovery Options When Needed check box and specifying a timeout in seconds in the field provided. Again, to speed up the startup process, you might want to use a value of five seconds.

  7. Tap or click OK to save your settings.

Managing System Boot Configuration

You can use the System Configuration utility (Msconfig.exe) to fine-tune the way a computer starts. Typically, you use this utility during troubleshooting and diagnostics. For example, as part of troubleshooting, you can configure the computer to use a diagnostic startup so only basic devices and services are loaded.

The System Configuration utility is available on the Tools menu in Server Manager. You can also start the System Configuration utility by pressing the Windows key, typing msconfig.exe in the Apps Search box, and pressing Enter. As shown in Figure 3-3, this utility has a series of tabs with options.

Use the General tab options to configure the way startup works. Start your troubleshooting and diagnostics efforts on this tab. You can use these options to perform a normal startup, diagnostic startup, or selective startup. After you restart the computer and resolve any problems, access the System Configuration utility again, select Normal Startup on the General tab, and then tap or click OK.

A screenshot showing configuring system startup while troubleshooting startup issues.

Figure 3-3. Performing a diagnostic or selective startup as part of troubleshooting.

Use the Boot tab options, shown in Figure 3-4, to control the way the individual startup-related processes work. You can configure the computer to start in one of various Safe Boot modes and set additional options, such as No GUI Boot. If after troubleshooting you find that you want to keep these settings, you can select the Make All Boot Settings Permanent check box to save the settings to the boot configuration startup entry.

A screenshot showing boot option configuration in System Configuration.

Figure 3-4. Fine-tuning the boot options.

Tapping or clicking the Advanced Options button on the Boot tab opens the BOOT Advanced Options dialog box shown in Figure 3-5. In addition to being able to lock PCI, detect the correct hardware abstraction layer (HAL), and enable debugging, you can use the advanced options to do the following:

  • Specify the number of processors the operating system should use. You should use this option when you suspect there is a problem with additional processors you installed in a server, and you want to pinpoint which processors are possibly causing startup problems. Consider the following scenario: a server shipped with two processors, and you installed two additional processors. Later, you find that you cannot start the server. You could eliminate the new processors as the potential cause by limiting the computer to two processors.

  • Specify the maximum amount of memory the operating system should use. You should use this option when you suspect there is a problem with additional memory you installed in a server. Consider the following scenario: a server shipped with 4 GB of RAM, and you installed an additional 4 GB of RAM. Later, you find that you cannot start the server. You could eliminate the new RAM as the potential cause by limiting the computer to 4,096 MB of memory.

If you suspect services installed on a computer are causing startup problems, you can quickly determine this by choosing a diagnostic or selective startup on the General tab. After you identify that services are indeed causing startup problems, you can temporarily disable services using the Services tab options and then reboot to see whether the problem goes away. If the problem no longer appears, you might have pinpointed it. You can then permanently disable the service or check with the service vendor to see whether an updated executable is available for the service. As shown in Figure 3-6, you disable a service by clearing the related check box on the Services tab.

A screen shot showing configuration options for advanced boot settings.

Figure 3-5. Setting advanced boot options as necessary to help troubleshoot specific types of problems.

A screen shot of System Configurations showing the disabling of services as part of troubleshooting.

Figure 3-6. Disabling services to pinpoint the source of a problem.

Similarly, if you suspect applications that run at startup are causing problems, you can quickly determine this by using the options on the Startup tab. You disable a startup application by clearing the related check box on the Startup tab. If the problem no longer appears, you might have pinpointed the cause of it. You can then permanently disable the startup application or check with the software vendor to see whether an updated version is available.

Working with BCD Editor

The BCD store contains multiple entries. On a BIOS-based computer, you see the following entries:

  • One Windows Boot Manager entry. There is only one boot manager, so there is only one boot manager entry.

  • One or more Windows Boot Loader application entries, with one for each version of Windows installed on the computer.

Windows Boot Manager is itself a boot loader application. There are other boot loader applications, including the following:

  • Operating system loader, identified as OSLOADER

  • Windows Boot Sector Application, identified as BOOTSECTOR

  • Firmware Boot Manager, identified as FWBOOTMGR

  • Windows Resume Loader, identified as RESUME

You can view and manage the BCD store directly by using BCD Editor (BCDEdit.exe). BCD Editor is a command-line utility. You can use it to view the entries in the BCD store by following these steps:

  1. Press and hold or right-click the lower-left corner of the Start screen on the desktop. This displays a shortcut menu.

  2. Select the Command Prompt (Admin) to open an elevated command prompt.

  3. Enter bcdedit at the elevated command prompt.

Table 3-2 summarizes commands you can use when you are working with the BCD store. These commands enable you to:

  • Create, import, export, and identify the entire BCD store.

  • Create, delete, and copy individual entries in the BCD store.

  • Set or delete entry option values in the BCD store.

  • Control the boot sequence and the boot manager.

  • Configure and control Emergency Management Services (EMS).

  • Configure and control boot debugging and hypervisor debugging.

Table 3-2. Commands for BCD Editor

Commands

Description

/bootdebug

Enables or disables boot debugging for a boot application.

/bootems

Enables or disables EMS for a boot application.

/bootsequence

Sets the one-time boot sequence for the boot manager.

/copy

Makes copies of entries in the store.

/create

Creates new entries in the store.

/createstore

Creates a new (empty) boot configuration data store.

/dbgsettings

Sets the global debugger parameters.

/debug

Enables or disables kernel debugging for an operating system entry.

/default

Sets the default entry that the boot manager uses.

/delete

Deletes entries from the store.

/deletevalue

Deletes entry options from the store.

/displayorder

Sets the order in which the boot manager displays the multiboot menu.

/ems

Enables or disables EMS for an operating system entry.

/emssettings

Sets the global EMS parameters.

/enum

Lists entries in the store.

/export

Exports the contents of the system store to a file. This file can be used later to restore the state of the system store.

/hypervisorsettings

Sets the hypervisor parameters.

/import

Restores the state of the system store by using a backup file created with the /export command.

/mirror

Duplicates a specified entry by mirroring it in the data store.

/set

Sets entry option values in the store.

/store

Sets the BCD store to use. If not specified, the system store is used.

/sysstore

Sets the system store device. Note that this affects only EFI systems.

/timeout

Sets the boot manager timeout value.

/toolsdisplayorder

Sets the order in which the boot manager displays the tools menu.

/v

Sets output to verbose mode.

Managing the boot configuration data store and its entries

BCD Editor (BCDEdit.exe) is an advanced command-line tool for viewing and manipulating the configuration of the pre–operating system boot environment. Although I discuss tasks related to modifying the BCD store in the sections that follow, you should attempt to modify the BCD store only if you are an experienced IT pro. As a safeguard, make a full backup of the computer prior to making any changes to the BCD store. Why? If you make a mistake, your computer might end up in a nonbootable state, and you would then need to initiate recovery.

Viewing BCD entries

Computers can have system and nonsystem BCD stores. The system BCD store contains the operating system boot entries and related boot settings. Whenever you work with the BCD Editor, you will be working with the system BCD store.

On a computer with only one operating system, the BCD entries will look similar to those in Entries in the BCD store on a single-boot computer. As the listing shows, the BCD store for this computer has two entries: one for Windows Boot Manager and one for Windows Boot Loader. Here, the Windows Boot Manager calls the boot loader, and the boot loader uses Winload.exe to boot Windows Server 2012 R2.

BCD entries for Windows Boot Manager and Windows Boot Loader have similar properties, which are summarized in Table 3-3.

Table 3-3. BCD entry properties

Property

Description

Description

Shows descriptive information to help identify the type of entry.

Device

Shows the physical device path. For a partition on a physical disk, you see an entry such as partition=C:.

FileDevice

Shows the path to a file device, such as partition=C:.

FilePath

Shows the file path to a necessary file, such as hiberfil.sys.

Identifier

Shows a descriptor for the entry. This can be a boot loader application type such as BOOTMGR or NTLDR. Or it can be a reference to the current operating system entry or the GUID of a specific object.

Inherit

Shows the list of entries to be inherited.

Locale

Shows the computer’s locale setting, such as en-us. The locale setting determines the UI language shown. In the Boot folder, there are locale subfolders for each supported locale, and each of these subfolders has language-specific UI details for the Windows Boot Manager (BootMgr.exe) and the Memory Diagnostics Utility (MemDiag.exe).

OSDevice

Shows the path to the operating system device, such as partition=C:.

Path

Shows the actual file path to the boot loader application, such as WindowsSystem32winresume.exe.

When you are working with the BCD store and BCD Editor, you see references to well-known identifiers, summarized in Table 3-4, and GUIDs. When a GUID is used, it has the following format, where each N represents a hexadecimal value:

{NNNNNNNN-NNNN-NNNN-NNNN-NNNNNNNNNNNN}

Such as:

{fcb757a2-7476-11e1-8312-bd48864d9bf1}

The dashes that separate the parts of the GUID must be entered in the positions shown.

Table 3-4. Well-known identifiers

Identifier

Description

{badmemory}

Contains the global RAM defect list that can be inherited by any boot application entry.

{bootloadersettings}

Contains the collection of global settings that should be inherited by all Windows boot loader application entries.

{bootmgr}

Indicates the Windows Boot Manager entry.

{current}

Represents a virtual identifier that corresponds to the operating system boot entry for the operating system that is currently running.

{dbgsettings}

Contains the global debugger settings that can be inherited by any boot application entry.

{default}

Represents a virtual identifier that corresponds to the boot manager default application entry.

{emssettings}

Contains the global EMS settings that can be inherited by any boot application entry.

{fwbootmgr}

Indicates the firmware boot manager entry. This entry is used on EFI systems.

{globalsettings}

Contains the collection of global settings that should be inherited by all boot application entries.

{hypervisorsettings}

Contains the hypervisor settings that can be inherited by any operating system loader entry.

{legacy}

Indicates that Windows Legacy OS Loader (Ntldr) can be used to start operating systems earlier than Windows Vista.

{memdiag}

Indicates the memory diagnostic application entry.

{ntldr}

Indicates that Windows Legacy OS Loader (Ntldr) can be used to start operating systems earlier than Windows Vista.

{ramdiskoptions}

Contains the additional options the boot manager requires for RAM disk devices.

{resumeloadersettings}

Contains the collection of global settings that should be inherited by all Windows resume-from-hibernation application entries.

When additional operating systems are installed on a computer, the BCD store for it has additional entries for each additional operating system. For example, the BCD store might have one entry for Windows Boot Manager and one Windows Boot Loader for each operating system.

When a previous operating system is installed on a computer, the BCD store has three entries: one for Windows Boot Manager, one for Windows Legacy OS Loader, and one for Windows Boot Loader. Generally, the entry for Windows Legacy OS Loader will look similar to Sample Legacy OS Loader entry.

Although Windows Boot Manager, Windows Legacy OS Loader, and Windows Boot Loader are the primary types of entries that control startup, the BCD also stores information about boot settings and boot utilities. The Windows Boot Loader entry can have parameters that track the status of boot settings, such as whether No Execute (NX) policy is set for Opt In or Opt Out. The Windows Boot Loader entry also can provide information about available boot utilities such as the Memory Diagnostics utility.

To view the actual value of the GUIDs needed to manipulate entries in the BCD store, type bcdedit /v at an elevated command prompt.

Creating and identifying the BCD store

Using BCD Editor, you can create a new, nonsystem BCD store by using the following command:

bcdedit /createstore StorePath

Here, StorePath is the actual folder path to where you want to create the nonsystem store, such as:

bcdedit /createstore c:
on-syscd

On an EFI system, you can temporarily set the system store device by using the /sysstore command. Use the following syntax:

bcdedit /sysstore StoreDevice

Here, StoreDevice is the actual device identifier store, such as:

bcdedit /sysstore C:

Note

The device must be a system partition. Note that this setting does not persist across reboots and is used only when the system store device is ambiguous.

Importing and exporting the BCD store

BCD Editor provides separate commands for importing and exporting the BCD store. You can use the /export command to export a copy of the system BCD store’s contents to a specified folder. Use the following command syntax:

bcdedit /export StorePath

Here, StorePath is the actual folder path to which you want to export a copy of the system store, such as:

bcdedit /export c:ackupcd.dat

To restore an exported copy of the system store, you can use the /import command. Use the following command syntax:

bcdedit /import ImportPath

Here, ImportPath is the actual folder path from which you want to import a copy of the system store, such as:

bcdedit /import c:ackupcd.dat

On an EFI system, you can add /clean to the import to specify that all existing firmware boot entries should be deleted. Here is an example:

bcdedit /import c:ackupcd.dat /clean

Creating, copying, and deleting BCD entries

BCD Editor provides separate commands for creating, copying, and deleting entries in the BCD store. You can use the /create command to create identifier, application, and inherit entries in the BCD store.

As shown previously, in Table 3-4, BCD Editor recognizes many well-known identifiers, including {dbgsettings} used to create a debugger settings entry, {ntldr} used to create a Windows Legacy OS entry, and {ramdiskoptions} used to create a RAM disk additional options entry. To create identifier entries, you use the following syntax:

bcdedit /create Identifier /d "Description"

Here, Identifier is a well-known identifier for the entry you want to create, such as:

bcdedit /create {ntldr} /d "Earlier Windows OS Loader"

You also can create the following entries for specific boot-loader applications:

  • Bootsector. A real-mode, boot-sector application, used to set the boot sector for a real-mode application

  • OSLoader. An operating-system loader application, used to load a Windows Vista or later operating system

  • Resume. A Windows Resume Loader application, used to resume the operating system from hibernation

  • Startup. A real-mode application, used to identify a real-mode application

Use the following command syntax:

bcdedit /create /application AppType /d "Description"

Here, AppType is one of the previously listed application types, such as:

bcdedit /create /application osloader /d "Windows 8.1"

You can delete entries in the system store by using the /delete command and the following syntax:

bcdedit /delete Identifier

If you are trying to delete a well-known identifier, you must use the /f command to force deletion, such as:

bcdedit /delete {ntldr} /f

By default, when using the /delete command, the /cleanup option is implied, and this means BCD Editor cleans up any other references to the entry being deleted. This ensures that the data store doesn’t have invalid references to the identifier you removed. Because entries are also removed from the display order, this can result in a different default operating system being set. If you want to delete the entry and clean up all other references except the display order entry, you can use the /nocleanup command.

Setting BCD entry values

After you create an entry, you then need to set additional entry option values as necessary. Here is the basic syntax for setting values:

bcdedit /set Identifier Option Value

Here, Identifier is the identifier of the entry to be modified, Option is the option you want to set, and Value is the option value, such as:

bcdedit /set {current} device partition=d:

To delete options and their values, use the /deletevalue command with the following syntax:

bcdedit /deletevalue Identifier Option

Here, Identifier is the identifier of the entry to be modified, and Option is the option you want to delete, such as:

bcdedit /deletevalue {current} badmemorylist

Note

When you are working with options, Boolean values can be entered in several ways. For true, you can use 1, ON, YES, or TRUE. For false, you can use 0, OFF, NO, or FALSE.

To view the BCD entries for all boot utilities and values for settings, type bcdedit /enum all /v at an elevated command prompt. This command enumerates all BCD entries regardless of their current state and lists them in Verbose mode. The additional entries will look similar to those in Additional entries in the BCD store on a single-boot computer (shown later in the chapter). Each additional entry has a specific purpose and lists values that you can set, including the following:

  • Resume From Hibernate. The Resume From Hibernate entry shows the current configuration for the resume feature. The pre–operating system boot utility that controls resume is Winresume.exe, which in this example is stored in the C:Windowssystem32 folder. The hibernation data, as specified in the filepath parameter, is stored in the Hiberfil.sys file in the root folder on the osdevice (C: in this example). Because the resume feature works differently if the computer has Physical Address Extension (PAE) and debugging enabled, these options are tracked by the PAE and Debugoptionenabled parameters.

  • Windows Memory Tester. The Windows Memory Tester entry shows the current configuration for the Windows Memory Diagnostics utility. The pre–operating system boot utility that controls memory diagnostics is Memtest.exe, which in this example is stored in the C:Boot folder. Because the Memory Diagnostics utility is designed to detect bad memory by default, the badmemoryaccess parameter is set to yes by default. You can turn this feature off by entering bcdedit /set {memdiag} badmemoryaccess NO. With memory diagnostics, you can configure the number of passes by using Passcount and configure the test mix as BASIC or EXTENDED by using Testmix. Here is an example: bcdedit /set {memdiag} passcount 2.

  • Windows Legacy OS Loader. The Windows Legacy OS Loader entry shows the current configuration for loading earlier versions of Windows. The Device parameter sets the default partition to use, such as C:, and the Path parameter sets the default path to the loader utility, such as Ntldr.

  • EMS Settings. The EMS Settings entry shows the configuration used when booting with Emergency Management Services (EMS). Individual Windows Boot Loader entries control whether EMS is enabled. If EMS is provided by BIOS and you want to use the BIOS settings, you can enter bcdedit /emssettings bios. With EMS, you can set an EMS port and an EMS baud rate. Here is an example: bcdedit /emssettings EMSPORT:2 EMSBAUDRATE:115200. You can enable or disable EMS for a boot application by typing /bootems followed by the identity of the boot application with the desired state, such as ON or OFF.

  • Debugger Settings. The Debugger Settings entry shows the configuration used when booting with the debugger turned on. Individual Windows Boot Loader entries control whether the debugger is enabled. You can view the hypervisor debug settings by entering bcdedit /dbgsettings. When debug booting is turned on, DebugType sets the type of debugger as SERIAL, 1394, or USB. With SERIAL debugging, DebugPort specifies the serial port being used as the debugger port, and BaudRate specifies the baud rate to be used for debugging. With 1394 debugging, you can use Channel to set the debugging channel. With Universal Serial Bus (USB) debugging, you can use TargetName to set the USB target name to be used for debugging. With any debug type, you can use the /Noumex flag to specify that user-mode exceptions should be ignored. Here are examples of setting the debugging mode: bcdedit /dbgsettings SERIAL DEBUGPORT:1 BAUDRATE:115200, bcdedit /dbgsettings 1394 CHANNEL:23, and bcdedit /dbgsettings USB TARGETNAME:DEBUGGING.

  • Hypervisor Settings. The Hypervisor Settings entry shows the configuration used when working with the Hypervisor with the debugger turned on. Individual Windows Boot Loader entries control whether the debugger is enabled. You can view the hypervisor debug settings by entering bcdedit /hypervisorsettings. When hypervisor debug booting is turned on, HypervisorDebugType sets the type of debugger, HypervisorDebugPort specifies the serial port being used as the debugger port, and HypervisorBaudRate specifies the baud rate to be used for debugging. These parameters work the same as with Debugger Settings. Here is an example: bcdedit /hypervisorsettings SERIAL DEBUGPORT:1 BAUDRATE:115200. You can also use FireWire for hypervisor debugging. When you do, you must set the debug channel, such as shown in this example: bcdedit /hypervisorsettings 1394 CHANNEL:23.

Table 3-5 summarizes key options that apply to entries for boot applications (BOOTAPP). Because Windows Boot Manager, Windows Memory Diagnostics, Windows OS Loader, and Windows Resume Loader are boot applications, these options apply to them as well.

Table 3-5. Key options for boot application entries

Option

Value Description

BadMemoryAccess

When true, allows an application to use the memory on the bad memory list. When false, applications are prevented from using memory on the bad memory list.

BadMemoryList

An integer list that defines the list of Page Frame Numbers of faulty memory in the system.

BaudRate

Sets an integer value that defines the baud rate for the serial debugger.

BootDebug

Sets a Boolean value that enables or disables the boot debugger.

BootEMS

Sets a Boolean value that enables or disables EMS.

Channel

Sets an integer value that defines the channel for the 1394 debugger.

DebugAddress

Sets an integer value that defines the address of a serial port for the debugger.

DebugPort

Sets an integer value that defines the serial port number for the serial debugger.

DebugStart

Can be set to ACTIVE, AUTOENABLE, or DISABLE.

DebugType

Can be set to SERIAL, 1394, or USB.

EMSBaudRate

Defines the baud rate for EMS.

EMSPort

Defines the serial port number for EMS.

GraphicsModeDisabled

Sets a Boolean value that enables or disables graphics mode.

GraphicsResolution

Defines the graphics resolution, such as 1024 by 768 or 800 by 600.

Locale

Sets the locale of the boot application.

Noumex

When set to TRUE, user-mode exceptions are ignored. When set to FALSE, user-mode exceptions are not ignored.

NoVESA

Sets a Boolean value that enables or disables the use of Video Electronics Standards Association (VESA) display modes.

RelocatePhysical

Sets the physical address to which an automatically selected Non-Uniform Memory Access (NUMA) node’s physical memory should be relocated.

TargetName

Defines the target name for the USB debugger as a string.

TruncateMemory

Sets a physical memory address at or above which all memory is disregarded.

Table 3-6 summarizes key options that apply to entries for Windows OS Loader (OSLOADER) applications.

Table 3-6. Key options for Windows OS Loader applications

Option

Value Description

AdvancedOptions

Sets a Boolean value that enables or disables advanced options.

BootLog

Sets a Boolean value that enables or disables the boot initialization log.

BootStatusPolicy

Sets the boot status policy. It can be DisplayAllFailures, IgnoreAllFailures, IgnoreShutdownFailures, or IgnoreBootFailures.

ClusterModeAddressing

Sets the maximum number of processors to include in a single Advanced Programmable Interrupt Controller (APIC) cluster.

ConfigFlags

Sets processor-specific configuration flags.

DbgTransport

Sets the file name for a private debugger transport.

Debug

Sets a Boolean value that enables or disables kernel debugging.

DetectHal

Sets a Boolean value that enables or disables hardware abstraction layer (HAL) and kernel detection.

DriverLoadFailurePolicy

Sets the driver load failure policy. It can be Fatal or UseErrorControl.

Ems

Sets a Boolean value that enables or disables kernel EMS.

Hal

Sets the file name for a private HAL.

HalBreakPoint

Sets a Boolean value that enables or disables the special HAL breakpoint.

HypervisorLaunchType

Configures the hypervisor launch type. It can be Off or Auto.

IncreaseUserVA

Sets an integer value that increases the amount of virtual address space that the user-mode processes can use.

Kernel

Sets the file name for a private kernel.

LastKnownGood

Sets a Boolean value that enables or disables boot to last known good configuration.

MaxProc

Sets a Boolean value that enables or disables the display of the maximum number of processors in the system.

Msi

Sets the MSI to use. It can be Default or ForceDisable.

NoCrashAutoReboot

Sets a Boolean value that enables or disables automatic restart on crash.

NoLowMem

Sets a Boolean value that enables or disables the use of low memory.

NumProc

Sets the number of processors to use on startup.

Nx

Controls No Execute (NX) protection. It can be OptIn, OptOut, AlwaysOn, or AlwaysOff.

OneCPU

Sets a Boolean value that forces only the boot CPU to be used.

OptionsEdit

Sets a Boolean value that enables or disables the options editor.

OSDdevice

Defines the device that contains the system root.

Pae

Controls PAE. It can be Default, ForceEnable, or ForceDisable.

PerfMem

Sets the size (in megabytes) of the buffer to allocate for performance data logging.

RemoveMemory

Sets an integer value that removes memory from the total available memory that the operating system can use.

RestrictAPICCluster

Sets the largest APIC cluster number to be used by the system.

SafeBoot

Sets the computer to use a Safe boot mode. It can be Minimal, Network, or DsRepair.

SafeBootAlternateShell

Sets a Boolean value that enables or disables the use of the alternate shell when booted into Safe mode.

Sos

Sets a Boolean value that enables or disables the display of additional boot information.

SystemRoot

Defines the path to the system root.

UseFirmwarePCISettings

Sets a Boolean value that enables or disables the use of BIOS-configured Peripheral Component Interconnect (PCI) resources.

UsePhysicalDestination

Sets a Boolean value that forces the use of the physical APIC.

Vga

Sets a Boolean value that forces the use of the VGA display driver.

WinPE

Sets a Boolean value that enables or disables boot to Windows Preinstallation Environment (Windows PE).

Changing Data Execution Prevention and physical address extension options

Data Execution Prevention (DEP) is a memory-protection technology. Windows Server 2012 and Windows Server 2012 R2 are the first versions of Windows Server that require a processor that supports DEP. Windows Server 2012 and Windows Server 2012 R2 will not install on computers that aren’t DEP-enabled.

With DEP enabled, the computer’s processor marks all memory locations in an application as nonexecutable unless the location explicitly contains executable code. If code is executed from a memory page marked as nonexecutable, the processor can raise an exception and prevent the code from executing. This behavior prevents malicious application code, such as virus code, from inserting itself into most areas of memory.

For computers with processors that support the No Execute (NX) page protection feature, you can configure the operating system to opt in to NX protection by setting the nx parameter to OptIn or opt out of NX protection by setting the nx parameter to OptOut. Here is an example:

bcdedit /set {current} nx optout

When you configure NX protection to OptIn, DEP is turned on only for essential Windows programs and services. This is the default. When you configure NX protection to OptOut, all programs and services—not just standard Windows programs and services—use DEP. Programs that shouldn’t use DEP must be specifically opted out. You can also configure NX protection to be always on or always off using AlwaysOn or AlwaysOff, such as:

bcdedit /set {current} nx alwayson

Processors that support and opt in to NX protection must be running in PAE mode. You can configure PAE by setting the PAE parameter to Default, ForceEnable, or ForceDisable. When you set paeState to Default, the operating system will use the default configuration for PAE. When you set paeState to ForceEnable, the operating system will use PAE. When you set paeState to ForceDisable, the operating system will not use PAE. You can set DebugOptionEnabled to true or false. Here is an example:

bcdedit /set {current} pae default

Note

You opt out programs by using advanced system settings. In Control Panel, select System And Security, select System, and then select Advanced System Settings. This opens the System Properties dialog box to the Advanced tab. Select Settings on the Performance panel of the Advanced tab. On the Data Execution Prevention tab of the Performance Options dialog box, select Turn On DEP For All Programs Except Those I Select. Finally, click Add to specify a program that shouldn’t use DEP.

Changing the operating system display order

You can change the display order of boot managers associated with a particular Windows operating system by using the /displayorder command. The syntax is:

bcdedit /displayorder id1 id2 ... idn

Here, id1 is the operating system identifier of the first operating system in the display order, id2 is the identifier of the second, and so on. Thus, you could change the display order of the operating systems identified in these BCD entries:

Windows Boot Loader
-------------------
identifier              {fcb757a2-7476-11e1-8312-bd48864d9bf1}
Windows Boot Loader
-------------------
identifier              {16b857b4-9e02-11e0-9c17-b7d085eb0682}

You can do this by using the following command:

bcdedit /displayorder {16b857b4-9e02-11e0-9c17-b7d085eb0682}
{fcb757a2-7476-11e1-8312-bd48864d9bf1}

You can set a particular operating system as the first entry by using /addfirst with /displayorder, such as:

bcdedit /displayorder {fcb757a2-7476-11e1-8312-bd48864d9bf1} /addfirst

You can set a particular operating system as the last entry by using /addlast with /displayorder, such as:

bcdedit /displayorder {fcb757a2-7476-11e1-8312-bd48864d9bf1} /addlast

Changing the default operating system entry

You can change the default operating system entry by using the /default command. The syntax for this command is:

bcdedit /default id

Here, id is the operating system ID in the boot loader entry. Thus, you could set the operating system identified in this BCD entry as the default:

Windows Boot Loader
-------------------
identifier             {fcb757a2-7476-11e1-8312-bd48864d9bf1}

You can do this by using the following command:

bcdedit /default {fcb757a2-7476-11e1-8312-bd48864d9bf1}

If you want to use a pre–Windows Server 2008 operating system as the default, use the identifier for the Windows Legacy OS Loader. The related BCD entry looks like this:

Windows Legacy OS Loader
------------------------
identifier              {466f5a88-0af2-4f76-9038-095b170dc21c}
device                  partition=C:
path                    
tldr
description             Earlier Microsoft Windows Operating System

Following this, you could set Ntldr as the default by entering the following:

bcdedit /default {466f5a88-0af2-4f76-9038-095b170dc21c}

Changing the default timeout

You can change the timeout value associated with the default operating system by using the /timeout command. Set the /timeout command to the desired wait time in seconds, such as:

bcdedit /timeout 30

To boot automatically to the default operating system, set the timeout to zero seconds.

Changing the boot sequence temporarily

Occasionally, you might want to boot to a particular operating system one time and then revert to the default boot order. To do this, you can use the /bootsequence command. Follow the command with the identifier of the operating system to which you want to boot after restarting the computer, such as:

bcdedit /bootsequence {14504de-e96b-11cd-a51b-89ace9305d5e}

When you restart the computer, the computer will set the specified operating system as the default for that restart only. Then, when you restart the computer again, the computer will use the original default boot order.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset