Windows故障恢复控制台
>>1. <<
月有阴晴圆缺,人有祸福旦夕,是系统就有挂的时候。Win2000挂了,你怎么办?可能你有bluecon,有ERD Commander,有Winresume等等等等,但是可能在极端环境下我们使用更多的还是
win2000自带的故障恢复控制台。说道故障恢复控制台,大家多半用的都是它的紧急自动修复过程,这个功能在处理简单的故障,例如系统程序损坏或引导分区丢失等问题上还是不错的,但是对于更多的复杂问题可能还是需要系统管理员们手工解决。在没有其他辅助工具的情况下,我们就尽量发掘一下win2000安装光盘上自带的故障恢复控制台的潜力吧。
故障恢复控制台最简单的用法,就是使用Windows安装光盘(Windows2000/XP/2003)引导系统。
使用步骤如下:
1. 将 Windows 2000 启动盘插入软盘驱动器中,或者将 Windows 2000 CD-ROM 插入
CD-ROM 驱动器中,然后重新启动计算机;
2. 按照提示,单击选中从 CD-ROM 驱动器启动计算机所需的任何选项;
3. 出现“欢迎使用安装程序”屏幕时,按 "R" 键启动故障恢复控制台;
4. 如果使用的是双启动或多启动计算机,请选择需要从故障恢复控制台访问的系统路径;
5. 键入管理员密码;如果管理员密码为空,则按 ENTER 键。
6. 进入故障恢复控制台命令行界面。
之后就会进入一个受限的命令行界面,在这个命令行界面下,可以使用故障恢复控制台启用和禁用服务、格式化驱动器、读写本地驱动器上的数据,还可以执行许多其他管理任务。可以使用故障恢复控制台将磁盘或 CD-ROM 中的文件复制到硬盘上以修复计算机,或者重新配置使计算机无法正常启动的服务。之所以说它是受限的,因为它并不能提供完整的cmd.exe以及附加命令行程序的功能,而仅仅能够提供有限的对系统核心服务操作的功能。尤其是出于安全考虑,默认情况下是不允许修改,替换,覆盖和引用文件的。就是这个原因也让很多人对这个看似无用的控制台极为反感和头大。至于如何打开这些限制,在后面讲解。
进入故障恢复控制台后,可以输入 recovery console commands 或 help 察看所有的命令和帮助;有关特定命令的信息,可以使用help commandname察看详细信息和命令参数。
要退出故障恢复控制台并重新启动计算机,请在命令提示处键入 exit,然后按 ENTER 键。
在故障恢复控制台中支持的所有命令:
attrib delete fixboot md type
cd dir fixmbr mkdir systemroot
chdir disable format more
chkdsk diskpart help rd
cls enable listsvc ren
copy exit logon rename
del expand map rmdir
>>2. <<
详细的命令功能和参数如下:
* ATTRIB
可以使用attrib 命令和下面任何参数更改文件或文件夹的属性:
-r: 设置只读文件属性
+r: 重置只读文件属性
-s: 设置系统文件属性
+s: 重置系统文件属性
-h: 设置隐藏文件属性
+h: 重置隐藏文件属性
备注: 必须设置或清除至少一个属性。要查看属性,请使用dir 命令。
* BATCH
batch inputfile
可以使用此命令运行文本文件中指定的命令。在命令语法中,inputfile 指定包含要运行的命令列表的文本文件,outputfile 指定包含指定命令的输出的文件。如果不指定输出文件,将在屏幕上显示输出。
* CD 和 CHDIR
可以使用cd 和chdir 命令更改文件夹。键入 cd .. 说明您要转到父文件夹。键入 cd drive:以显示指定驱动器中的当前文件夹。键入不带参数的命令以显示当前驱动器和文件夹。
chdir 命令将空格作为分隔符处理。因此,必须用引号将包含空格的子文件夹名引起来,例如:
cd "\winnt\profiles\username\programs\start menu"
chdir 命令的操作范围仅限于当前 Windows 安装的系统文件夹、可移动媒体、所有硬盘分区的根文件夹或本地安装源。
* CHKDSK
chkdsk drive /p /r
此命令(其中,drive 指定要检查的驱动器)检查驱动器并在必要时修复或恢复该驱动器。此命令还标记损坏的扇区并恢复可读信息。
/p 开关指示 Chkdsk 工具对驱动器执行详尽的检查(即使没有将驱动器标记为有问题也是如此),并纠正所发现的任何错误。/r 开关查找损坏的扇区并恢复可读信息。注意,如果指定/r 开关,则暗示包含 /p 开关。可以指定不带参数的 chkdsk 命令,在这种情况下,暗示当前驱动器不带任何开关。不必按顺序接受列出的开关。chkdsk 命令需要 Autochk.exe 文件。Chkdsk 自动在启动文件夹中查找此文件。通常,如果预先安装了命令控制台,则该文件夹为 Cmdcons 文件夹。如果在启动文件夹中找不到该文件夹,Chkdsk 就会尝试查找 Windows CD-ROM 安装媒体。如果找不到安装媒体,Chkdsk 将提示您提供 Autochk.exe 文件的位置。
* CLS
可以使用此命令清除屏幕内容。
* COPY
copy source destination
可以使用此命令(其中,source 指定要复制的文件,destination 指定新文件的文件夹或文件名)复制文件。不允许使用通配符或进行文件夹复制。在复制 Windows CD-ROM 中的压缩文件时,将自动解压缩该文件。
如果没有指定 destination,此命令默认为当前文件夹。如果该文件已经存在,系统将提示您覆盖它。
* DEL 和 DELETE
del drive:path filename
delete drive:path filename
可以使用此命令(其中,drive:path filename 指定要删除的文件)删除文件。
delete 命令的操作范围仅限于当前 Windows 安装的系统文件夹、可移动媒体、所有硬盘分区的根文件夹或本地安装源。delete 命令不接受通配符 (*)。
* DIR
dir drive:path filename
可以使用此命令(其中,drive:path filename 指定要列出的驱动器、文件夹和文件)显示文件夹中文件和子文件夹的列表。dir 命令列出所有文件,包括隐藏文件和系统文件。文件可能具有以下属性:
D - Directory R - Read-only file
H - Hidden file A - Files ready for archiving
S - System file C - Compressed
E - Encrypted P - Reparse Point
dir 命令的操作范围仅限于当前 Windows 安装的系统文件夹、可移动媒体、所有硬盘分区的根文件夹或本地安装源。
** DISABLE
disable servicename
可以使用此命令(其中,servicename 指定要禁用的服务或驱动程序的名称)禁用 Windows 系统服务或驱动程序。
可以使用listsvc 命令显示所有要禁用的适当服务或驱动程序。disable 命令打印在将服务重置为 SERVICE_DISABLED 之前该服务的旧启动类型。因此,您应当将旧的启动类型记录下来,以便在必要时重新启用该服务。
可以使用disable 命令显示以下启动类型值:
SERVICE_DISABLED
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START
** DISKPART
diskpart /add /delete device_name drive_name partition_name size
可以使用此命令管理硬盘卷上的分区。
/add: 可以使用此参数创建新的分区。
/delete: 可以使用此参数删除现有的分区。
device_name: 可以使用此参数指定创建新分区所使用的设备名。可以从 map 命令的输出中找到该名称,例如:\Device\HardDisk0。
drive_name: 可以使用此参数指定删除现有分区所使用的基于驱动器号的名称,例如D:
partition_name: 可以使用此参数指定删除现有分区所使用的基于分区的名称。可以使用此参数代替驱动器名称参数,例如:\Device\HardDisk0\Partition1。
size: 可以使用此参数指定新分区的大小 (MB)。
备注: 如果不使用参数,则显示用来管理分区的用户界面。
警告: 如果磁盘已经升级到动态磁盘配置,那么此命令可能会损坏分区表。除非使用磁盘管理工具,否则不要修改动态磁盘的结构。
** ENABLE
enable servicename start_type
您可以使用enable 命令(其中,servicename 指定要启用的服务或驱动程序的名称)启用 Windows 系统服务或驱动程序。
可以使用listsvc 命令显示所有要启用的适当服务或驱动程序。enable 命令打印在将服务重置为新值之前该服务的旧启动类型。您应当将旧的值记录下来,以便在必要时还原该服务的启动类型。以下启动类型是有效的:
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START
备注: 如果没有指定新的启动类型,则 enable 命令打印旧的启动类型。
* EXIT
可以使用exit 命令退出命令控制台,并重新启动计算机。
** EXPAND
expand source
expand source /d
可以使用此命令(其中,source 指定要展开的文件的名称,destination 指定新文件的文件夹)展开文件。
备注: 不能包含通配符。
如果没有指定 destination,则该命令默认使用当前的文件夹。
该命令可以使用以下参数:
/y: 如果不希望系统在覆盖现有文件之前提示您,则使用此参数。
/f:filespec: 如果源包含多个文件,则使用此参数。需要使用此参数指定要展开的特定文件。可以包含通配符。
/d: 如果不想展开文件夹,则使用此参数;它只显示源中包含的文件的文件夹。
目标可以是当前 Windows 安装的系统文件夹中、驱动器的根中、本地安装源中或者 Cmdcons 文件夹中的任何文件夹。目标不能是可移动媒体。目标文件不能是只读文件。可以使用attrib 命令删除只读属性。
如果使用 expand 命令并且目标文件已经存在,则除非使用 /y,否则系统就会给出提示。
** FIXBOOT
fixboot drive name:
可以使用此命令(其中,drive name 是在其中写入启动扇区的驱动器号)在启动扇区上写入新的 Windows 启动扇区代码。此命令修复了导致 Windows 启动扇区被破坏的问题。紧急修复过程也能修复启动扇区。此命令重写系统启动分区的写入默认值。
** FIXMBR
fixmbr device name
可以使用此命令(其中,device name 是可选的设备名,用于指定需要新 MBR 的设备)修复系统分区的主启动记录 (MBR)。如果病毒损坏了 MBR 并且 Windows 无法启动,则可以使用此命令。
警告: 如果出现病毒或者存在硬件问题,则此命令可能会损坏分区表。该命令可能导致无法访问分区。Microsoft 建议您在使用此命令之前运行防病毒软件。
可以从 map 命令的输出中找到该名称。如果没有此名称,则修复启动设备的 MBR,例如:
fixmbr \device\harddisk2
如果 Fixmbr 检测到无效的或非标准的分区表签名,则在重新写入 MBR 之前,它提示您是否同意重新写入。
** FORMAT
format drive:/q /fs:file_system
可以使用此命令(其中,drive 是要格式化的分区的驱动器号,file_system 指定要使用的文件系统的类型 )将指定的驱动器格式化为指定的文件系统。可以使用此命令和 /q 参数对驱动器执行快速格式化。
如果没有指定文件系统,则使用现有的文件系统格式(如果有的话)。
** LISTSVC
listsvc 命令列出所有可用的服务、驱动程序及其当前 Windows 安装的启动类型。在使用 disable 和 enable 命令时,您可能需要使用此命令。
备注: 此信息是从 %SystemRoot%\System32\Config\SYSTEM 配置单元中提取的。如果 SYSTEM 配置单元被破坏或丢失,则可能会出现无法预计的后果。
* LOGON
logon
当使用logon 命令时,将显示检测到的所有 Windows 安装的列表,并提示您输入要登录的 Windows 副本的本地管理员密码。如果登录失败超过三次,控制台将退出并重新启动计算机。
* MAP
map arc
可以使用此命令(其中,arc 参数告诉map 命令使用 ARC 路径而不是 Windows 设备路径)列出驱动器号、文件系统类型、分区大小和物理驱动器的映射情况。
* MD 和 MKDIR
可以使用md 或mkdir 命令创建新的文件夹。不支持通配符。mkdir 命令的操作范围仅限于当前 Windows 安装的系统文件夹、可移动媒体、所有硬盘分区的根文件夹或本地安装源。
* MORE
more filename
可以使用此命令在屏幕上显示文本文件。
* RD 和 RMDIR
可以使用rd 和rmdir 命令删除文件夹。这些命令的操作范围仅限于当前 Windows 安装的系统文件夹、可移动媒体、所有硬盘分区的根文件夹或本地安装源。
* REN 和 RENAME
可以使用ren 和rename 命令重命名文件。注意,您不能为目标文件指定新的驱动器或路径。这些命令的操作范围仅限于当前 Windows 安装的系统文件夹、可移动媒体、所有硬盘分区的根文件夹或本地安装源。
** SET
可以使用set 命令显示或修改 4 个环境选项。
AllowWildCards = FALSE
AllowAllPaths = FALSE
AllowRemovableMedia = FALSE
NoCopyPrompt = FALSE
** SYSTEMROOT
可以使用systemroot 命令将当前工作文件夹设置为您当前所登录的 Windows 安装的 %SystemRoot% 文件夹。
* TYPE
type filename
可以使用type 命令显示文本文件。
>>3. << 基本任务
在上面一节列出了Win2000故障恢复控制台的所有命令,其中**标注的都是相关系统故障比较密切的命令,与他们相关的可能遇到的故障和解决方法如下。
1. 安装Linux或其他操作系统后不能引导Windows 2000系统了......
# 原因可能是主引导块(MBR)或Windows分区引导记录被修改,可以用FIXBOOT和FIXMBR
命令修复MBR和引导块,FIXMBR的功能就相当于DOS下的fdisk /mbr 。FIXBOOT可能需要指定
Win2000的系统安装分区路径,格式是\Device\HardDisk0\Partition1类似的。
另一个可能是系统分区改变,导致c:\boot.ini中记录的系统文件路径错误,从而系统无法引导。这样需要修改boot.ini文件,由于故障恢复控制台中没有可用的文本编辑器...所以可能你只能把它拷贝到移动媒体上,在别的系统中编辑正确之后再拷贝回来。注意,这个文件是系统隐含只读属性,需要先attrib -s -r -h c:\boot.ini才能够修改和替换。至于
修改的方法和问题,见第四条和第五条。
如果你使用Bluecon或者WinPE这样强大的工具的话,那么可以直接修改这个文件,工作就更简单了。
2. 我新加了一个硬盘,如何分区和格式化?
# 很多人都抱怨win20系统下找不到fdisk,这是当然的,因为它已经被另一个命令DISKPART
取代了。DISKPART的命令行参数见上一节,设备名也是如上所述格式,可以按字符控制界面
和命令行操作两种模式运行。 至于格式化,format命令和以前并没有什么大的区别,参数格式很简单,比较有用的参数主要是/FS:,可以指定格式化分区类型。提示:可以使用MAP命令查看当前所有识别出的设备路径。
3. 我为了防止冲击波病毒,按照网上一些文档所述关掉了RPC/DCOM服务,所以......
# 所以遭遇不幸了是不是?我就说这个不能关的么...
可以用如下命令打开: ENABLE Remote Procedure Call (RPC) SERVICE_SYSTEM_START 如果误关了其他服务,也可以用LISTSVC查看服务信息,然后用ENABLE打开。在LISTSVC中会列出所有的系统服务,包含隐含服务以及驱动服务,比Services.msc强大多了... 同样,由于其统服务启动失败引起的故障,例如你看Norton的杀毒引擎不爽,也可以在这里用DISABLE禁掉他。 ENABLE和DISABLE的最后一个参数,是启动类型,分别定义为服务启动的阶段和类型,详细地看注册表中的键值,以及其他资料。
4. 我不小心替换了某个系统服务程序/驱动,系统起不来了......
# 有两种方法,一种比较干净的方法,就是从系统安装光盘中的驱动安装包释放出原始的驱动
文件: expand d:\i386\driver.cab /f:文件名
在此命令中,使用 CD-ROM 驱动器号替换 d:,使用要扩展的文件名替换文件名,然后使用要在其中复制驱动程序文件的文件夹替换路径。通常情况下,驱动程序 (.sys) 文件存储在 %SystemRoot%\System32\Drivers 文件夹中.例如,要替换 Atimpab.sys 驱动程序文件,您可以键入:
expand d:\i386\driver.cab /f:atimpab.sys %systemroot%\System32\Drivers\
注意,在此命令中,您必须使用 /f 开关,因为 Driver.cab 压缩文件包含多个文件。
安装文件存储在 Windows 2000 安装 CD-ROM 的压缩文件夹(称为 CAB (.cab) 文件)中。驱动程序文件存储在 Driver.cab 文件中。
另外,也可以使用copy命令使用移动媒体(主要是软盘)从别的机器上拷贝一份干净的备份过来。copy 源文件名 目标文件名
范例:copy a:\atimpab.sys c:\winnt\system32\drivers\atimpab.sys 需要注意的是,故障恢复控制台中的“copy”命令不支持通配符。因此,您每次只能复制一个文件。如果您必须替换多个文件,请使用多个“copy”命令。
5. 唔唔唔,你骗人...我用了copy命令,可是她说我权限不够,copy失败......
# 嗯,这个么,其实我早就知道了(其实当年我也这样的)。记得前面说过这是一个"有限控制
台"么?嗯,在Win2000故障恢复控制台中,出于安全因素考虑,是不允许直接修改系统内的
文件的,这些是由系统中的几个环境变量决定的,这些变量可以用set命令查看。
默认情况下,使用下列规则:
AllowAllPaths = FALSE: 此规则禁止访问您在进入故障恢复控制台时选定的系统安装以外的文件夹和子文件夹。
AllowRemovableMedia = FALSE: 此规则禁止访问作为复制文件目标的可移动媒体。
AllowWildCards = FALSE: 此规则禁止命令的通配符支持,例如,copy 和del。
NoCopyPrompt = FALSE: 此规则意味着当您覆盖现有文件时,故障恢复控制台将提示您进行确认。
我们只需要执行 set allowremovablemedia = true ,就可以使用移动媒体拷贝文件了。
同样,set AllowAllPaths = true,就可以访问所有路径下的文件了。 你可以看一下其他的环境变量,或许有意外的惊喜哦,现在是不是觉得这个无用的控制台功能强大了许多?
备注:在每次进入故障恢复控制台时,必须重新键入 set 命令。
6. 每次都要用光盘启动,很烦哪...
# 好吧,其实,这个也是可以安装在硬盘上的...嘿嘿嘿,不过和普通的应用程序可不同。
若要安装故障恢复控制台,请:
& 将 Windows 2000 光盘插到 CD-ROM 驱动器中;
& 单击<开始菜单>,然后单击"运行";
& 在打开 框中,键入drive:\i386\winnt32.exe /cmdcons,其中 drive 是 CD-ROM
驱动器的驱动器号。
& 启动安装过程,然后重新启动计算机。 下次启动计算机时,在启动菜单上就会多出一项“Microsoft Windows 故障恢复控制台”。
7. 我的机器是AD域控制器,用你的方法不能修复...
# 如果计算机是使用 Active Directory 的域控制器,那么应该使用启动模式菜单中的 “目录服务还原模式”,并且输入将服务器升级为域控制器时选择的“目录服务还原模式”
密码。
8. 我用安装光盘启动,可是却认不出我的硬盘,怎么办啊?
# 其实在安装操作系统时你一定就已经遇到过这个问题了,因为Windows系统内没有你的硬件
驱动,所以需要你自己提供第三方的驱动程序。在故障恢复控制台启动前,可以按 F6 键安
装第三方 SCSI 或 RAID 驱动程序,然后向天祈祷,如果RP不是太差的话,那么就可以访
问你的硬盘了。
9. 最后提醒一点,系统恢复工作最重要的一点,还是及时备份...备份注册表,备份驱动,
# 备份系统文件...等等;最起码的工作就是一定要创建一份当前系统的紧急修复磁盘,
否则有可能出现紧急修复控制台找不到系统安装的现象...到时候你就欲哭..吧。方法:
我的电脑 -> 右键点击 C: -> 工具 -> 备份 -> 紧急修复磁盘。
10. 这个东东的命令还是太少了么,什么都米有的...
# 这个...那个...完咧...你还是用O&O BlueCon去吧,那个的功能强大太多;
http://www.freedemon.org/download/bluecon.iso
或者可以使用WindowsPE,或ERD Commander,那些还有图形界面和网络支持的,相当于
光盘运行的mini windows,不过那是后话,也不在这里多提啦。
### Windows Recovery Console
>>1. <<
The moon has its cloudy and sunny phases, and people have good and bad fortunes. Every system can crash. What do you do when Win2000 crashes? Maybe you have bluecon, ERD Commander, Winresume, etc. But in extreme environments, we often use the built-in Windows 2000 Recovery Console. When it comes to the Recovery Console, most people use its emergency automatic repair process. This function is good for simple failures such as damaged system programs or lost boot partitions. But for more complex problems, system administrators may need to solve them manually. In the absence of other auxiliary tools, we try to explore the potential of the Recovery Console built into the Windows 2000 installation disc.
The simplest way to use the Recovery Console is to boot the system using a Windows installation disc (Windows 2000/XP/2003).
The steps are as follows:
1. Insert the Windows 2000 boot disk into the floppy drive, or insert the Windows 2000 CD-ROM into the CD-ROM drive, then restart the computer;
2. Follow the prompts and click to select any options required to boot the computer from the CD-ROM drive;
3. When the "Welcome to Setup" screen appears, press the "R" key to start the Recovery Console;
4. If you are using a dual-boot or multi-boot computer, select the system path that you need to access from the Recovery Console;
5. Type the administrator password; if the administrator password is empty, press the ENTER key.
6. Enter the Recovery Console command line interface.
Then you will enter a restricted command line interface. In this command line interface, you can use the Recovery Console to enable and disable services, format drives, read and write data on local drives, and perform many other management tasks. You can use the Recovery Console to copy files from a disk or CD-ROM to the hard disk to repair the computer, or reconfigure services that prevent the computer from starting normally. The reason it is restricted is that it does not provide the functions of a complete cmd.exe and additional command line programs, but only provides limited functions for operating system core services. Especially for security reasons, by default, it is not allowed to modify, replace, overwrite, and reference files. It is for this reason that many people are extremely disgusted and troubled by this seemingly useless console. How to open these restrictions will be explained later.
After entering the Recovery Console, you can enter recovery console commands or help to view all commands and help; for information about specific commands, you can use help commandname to view detailed information and command parameters.
To exit the Recovery Console and restart the computer, type exit at the command prompt and press the ENTER key.
All commands supported in the Recovery Console:
attrib delete fixboot md type
cd dir fixmbr mkdir systemroot
chdir disable format more
chkdsk diskpart help rd
cls enable listsvc ren
copy exit logon rename
del expand map rmdir
>>2. <<
The detailed command functions and parameters are as follows:
* ATTRIB
You can use the attrib command and any of the following parameters to change the attributes of a file or folder:
-r: Set the read-only file attribute
+r: Reset the read-only file attribute
-s: Set the system file attribute
+s: Reset the system file attribute
-h: Set the hidden file attribute
+h: Reset the hidden file attribute
Note: At least one attribute must be set or cleared. To view attributes, use the dir command.
* BATCH
batch inputfile
You can use this command to run the commands specified in the text file. In the command syntax, inputfile specifies the text file containing the list of commands to be run, and outputfile specifies the file containing the output of the specified commands. If no output file is specified, the output will be displayed on the screen.
* CD and CHDIR
You can use the cd and chdir commands to change folders. Type cd .. to indicate that you want to go to the parent folder. Type cd drive: to display the current folder in the specified drive. Type the command without parameters to display the current drive and folder.
The chdir command treats spaces as delimiters. Therefore, the subfolder name containing spaces must be enclosed in quotes, for example:
cd "\winnt\profiles\username\programs\start menu"
The scope of operation of the chdir command is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.
* CHKDSK
chkdsk drive /p /r
This command (where drive specifies the drive to be checked) checks the drive and repairs or recovers it if necessary. This command also marks bad sectors and recovers readable information.
The /p switch instructs the Chkdsk tool to perform an exhaustive check of the drive (even if the drive is not marked as problematic) and correct any errors found. The /r switch finds bad sectors and recovers readable information. Note that if the /r switch is specified, the /p switch is implied. You can specify the chkdsk command without parameters, in which case the current drive is implied without any switches. The switches listed do not need to be accepted in order. The chkdsk command requires the Autochk.exe file. Chkdsk automatically looks for this file in the startup folder. Usually, if the command console is pre-installed, this folder is the Cmdcons folder. If this folder is not found in the startup folder, Chkdsk will try to find the Windows CD-ROM installation media. If the installation media is not found, Chkdsk will prompt you for the location of the Autochk.exe file.
* CLS
You can use this command to clear the screen content.
* COPY
copy source destination
You can use this command (where source specifies the file to be copied and destination specifies the folder or filename of the new file) to copy the file. Wildcards are not allowed and folder copying is not allowed. When copying a compressed file from a Windows CD-ROM, the file will be automatically uncompressed.
If destination is not specified, this command defaults to the current folder. If the file already exists, the system will prompt you to overwrite it.
* DEL and DELETE
del drive:path filename
delete drive:path filename
You can use this command (where drive:path filename specifies the file to be deleted) to delete the file.
The scope of operation of the delete command is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source. The delete command does not accept wildcards (*).
* DIR
dir drive:path filename
You can use this command (where drive:path filename specifies the drive, folder, and file to be listed) to display a list of files and subfolders in the folder. The dir command lists all files, including hidden files and system files. Files may have the following attributes:
D - Directory R - Read-only file
H - Hidden file A - Files ready for archiving
S - System file C - Compressed
E - Encrypted P - Reparse Point
The scope of operation of the dir command is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.
** DISABLE
disable servicename
You can use this command (where servicename specifies the name of the service or driver to be disabled) to disable a Windows system service or driver.
You can use the listsvc command to display all appropriate services or drivers to be disabled. The disable command prints the old start type of the service before resetting the service to SERVICE_DISABLED. Therefore, you should record the old start type so that you can re-enable the service when necessary.
The following start type values can be displayed using the disable command:
SERVICE_DISABLED
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START
** DISKPART
diskpart /add /delete device_name drive_name partition_name size
You can use this command to manage partitions on a hard disk volume.
/add: You can use this parameter to create a new partition.
/delete: You can use this parameter to delete an existing partition.
device_name: You can use this parameter to specify the device name used to create a new partition. You can find this name from the output of the map command, for example: \Device\HardDisk0.
drive_name: You can use this parameter to specify the drive letter-based name used to delete an existing partition, for example D:
partition_name: You can use this parameter to specify the partition-based name used to delete an existing partition. You can use this parameter instead of the drive name parameter, for example: \Device\HardDisk0\Partition1.
size: You can use this parameter to specify the size (MB) of the new partition.
Note: If no parameters are used, the user interface for managing partitions is displayed.
Warning: If the disk has been upgraded to a dynamic disk configuration, this command may damage the partition table. Do not modify the structure of a dynamic disk unless you use a disk management tool.
** ENABLE
enable servicename start_type
You can use the enable command (where servicename specifies the name of the service or driver to be enabled) to enable a Windows system service or driver.
You can use the listsvc command to display all appropriate services or drivers to be enabled. The enable command prints the old start type of the service before resetting the service to the new value. You should record the old value so that you can restore the start type of the service when necessary. The following start types are valid:
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START
Note: If the new start type is not specified, the enable command prints the old start type.
* EXIT
You can use the exit command to exit the command console and restart the computer.
** EXPAND
expand source
expand source /d
You can use this command (where source specifies the name of the file to be expanded and destination specifies the folder of the new file) to expand the file.
Note: Wildcards cannot be included.
If destination is not specified, the command defaults to the current folder.
This command can use the following parameters:
/y: Use this parameter if you do not want the system to prompt you before overwriting an existing file.
/f:filespec: Use this parameter if the source contains multiple files. You need to use this parameter to specify the specific file to be expanded. Wildcards can be included.
/d: Use this parameter if you do not want to expand the folder; it only displays the folder of the files contained in the source.
The destination can be any folder in the system folder of the current Windows installation, the root of the drive, the local installation source, or the Cmdcons folder. The destination cannot be removable media. The destination file cannot be a read-only file. You can use the attrib command to remove the read-only attribute.
If you use the expand command and the destination file already exists, the system will prompt you unless /y is used.
** FIXBOOT
fixboot drive name:
You can use this command (where drive name is the drive letter in which the boot sector is written) to write new Windows boot sector code on the boot sector. This command fixes the problem that caused the Windows boot sector to be damaged. The emergency repair process can also repair the boot sector. This command overwrites the write default of the system boot partition.
** FIXMBR
fixmbr device name
You can use this command (where device name is an optional device name used to specify the device that needs a new MBR) to repair the master boot record (MBR) of the system partition. If the virus damages the MBR and Windows cannot start, you can use this command.
Warning: This command may damage the partition table if there is a virus or hardware problem. This command may cause the partition to be inaccessible. Microsoft recommends that you run antivirus software before using this command.
You can find this name from the output of the map command. If there is no this name, repair the MBR of the boot device, for example:
fixmbr \device\harddisk2
If Fixmbr detects an invalid or non-standard partition table signature, it prompts you whether to agree to rewrite before rewriting the MBR.
** FORMAT
format drive:/q /fs:file_system
You can use this command (where drive is the drive letter of the partition to be formatted and file_system specifies the type of file system to be used ) to format the specified drive to the specified file system. You can use this command and the /q parameter to perform a quick format on the drive.
If the file system is not specified, the existing file system format (if any) is used.
** LISTSVC
The listsvc command lists all available services, drivers, and their current start types of the Windows installation. You may need to use this command when using the disable and enable commands.
Note: This information is extracted from the %SystemRoot%\System32\Config\SYSTEM hive. If the SYSTEM hive is damaged or lost, unexpected consequences may occur.
* LOGON
logon
When using the logon command, a list of all detected Windows installations is displayed, and you are prompted to enter the local administrator password of the copy of Windows you want to log on to. If the logon fails more than three times, the console will exit and restart the computer.
* MAP
map arc
You can use this command (where the arc parameter tells the map command to use the ARC path instead of the Windows device path) to list the mapping of drive letters, file system types, partition sizes, and physical drives.
* MD and MKDIR
You can use the md or mkdir command to create a new folder. Wildcards are not supported. The scope of operation of the mkdir command is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.
* MORE
more filename
You can use this command to display the text file on the screen.
* RD and RMDIR
You can use the rd and rmdir commands to delete folders. The scope of operation of these commands is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.
* REN and RENAME
You can use the ren and rename commands to rename files. Note that you cannot specify a new drive or path for the target file. The scope of operation of these commands is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.
** SET
You can use the set command to display or modify 4 environment options.
AllowWildCards = FALSE
AllowAllPaths = FALSE
AllowRemovableMedia = FALSE
NoCopyPrompt = FALSE
** SYSTEMROOT
You can use the systemroot command to set the current working folder to the %SystemRoot% folder of the Windows installation you are currently logged on to.
* TYPE
type filename
You can use the type command to display the text file.
>>3. << Basic Tasks
In the previous section, all the commands of the Win2000 Recovery Console are listed. The ones marked are all commands closely related to system failures. The possible failures and solutions related to them are as follows.
1. After installing Linux or other operating systems, Windows 2000 cannot boot...
# The reason may be that the master boot record (MBR) or the Windows partition boot record is modified. You can use the FIXBOOT and FIXMBR commands to repair the MBR and boot sector. The function of FIXMBR is equivalent to fdisk /mbr in DOS. FIXBOOT may need to specify the system installation partition path of Win2000, in the format like \Device\HardDisk0\Partition1.
Another possibility is that the system partition has changed, resulting in an incorrect system file path recorded in c:\boot.ini, so the system cannot boot. In this case, you need to modify the boot.ini file. Since there is no available text editor in the Recovery Console... so you may only be able to copy it to a removable media, edit it correctly in another system, and then copy it back. Note that this file has system implicit read-only attributes, and you need to first use attrib -s -r -h c:\boot.ini to be able to modify and replace it. For the method and problem of modification, see points 4 and 5.
If you use a powerful tool like Bluecon or WinPE, you can directly modify this file, and the work is simpler.
2. I added a new hard disk, how to partition and format it?
# Many people complain that there is no fdisk in the Win20 system, which is natural because it has been replaced by another command DISKPART. The command line parameters of DISKPART are as described in the previous section, and the device name is also in the format described above. It can run in both character control interface and command line operation modes. As for formatting, the format command is not much different from before, and the parameter format is very simple. The more useful parameters mainly include /FS:, which can specify the partition type for formatting. Tip: You can use the MAP command to view all currently recognized device paths.
3. I turned off the RPC/DCOM service according to some documents on the Internet to prevent the Slammer virus, so...
# So you encountered misfortune, didn't you? I said you shouldn't turn it off...
You can use the following command to turn it on: ENABLE Remote Procedure Call (RPC) SERVICE_SYSTEM_START. If you accidentally turned off other services, you can also use LISTSVC to view service information, and then use ENABLE to turn it on. LISTSVC will list all system services, including implicit services and driver services, which is much more powerful than Services.msc... Similarly, for failures caused by the failure of the system service to start, for example, if you don't like the Norton antivirus engine, you can also use DISABLE to disable it here. The last parameter of ENABLE and DISABLE is the start type, which is respectively defined as the stage and type of service startup. For details, see the key values in the registry and other materials.
4. I accidentally replaced a certain system service program/driver, and the system can't start...
# There are two methods. One relatively clean method is to extract the original driver file from the driver installation package in the system installation disc: expand d:\i386\driver.cab /f:filename
In this command, replace d: with the CD-ROM drive letter, replace filename with the name of the file to be expanded, and replace path with the folder where the driver program file is to be copied. Usually, the driver (.sys) file is stored in the %SystemRoot%\System32\Drivers folder. For example, to replace the Atimpab.sys driver file, you can type:
expand d:\i386\driver.cab /f:atimpab.sys %systemroot%\System32\Drivers\
Note that in this command, you must use the /f switch because the Driver.cab compressed file contains multiple files.
The installation files are stored in the compressed folder (called CAB (.cab) file) of the Windows 2000 installation CD-ROM. The driver files are stored in the Driver.cab file.
In addition, you can also use the copy command to copy a clean backup from another machine using a removable media (mainly a floppy disk). copy source filename target filename
Example: copy a:\atimpab.sys c:\winnt\system32\drivers\atimpab.sys. It should be noted that the "copy" command in the Recovery Console does not support wildcards. Therefore, you can only copy one file at a time. If you must replace multiple files, use multiple "copy" commands.
5. Wuwuwu, you lied... I used the copy command, but it said I don't have enough permissions and the copy failed...
# Well, this... I already knew it (actually, I was like this back then). Remember that it was mentioned earlier that this is a "limited console"? Well, in the Win2000 Recovery Console, for security reasons, it is not allowed to directly modify the files in the system. These are determined by several environment variables in the system, which can be viewed with the set command.
By default, the following rules are used:
AllowAllPaths = FALSE: This rule prohibits access to folders and subfolders other than the system installation you selected when entering the Recovery Console.
AllowRemovableMedia = FALSE: This rule prohibits access to removable media as the target of copying files.
AllowWildCards = FALSE: This rule prohibits wildcard support for commands, such as copy and del.
NoCopyPrompt = FALSE: This rule means that when you overwrite an existing file, the Recovery Console will prompt you for confirmation.
We only need to execute set allowremovablemedia = true, and then we can use the removable media to copy files.
Similarly, set AllowAllPaths = true, and then we can access files in all paths. You can take a look at other environment variables, maybe there are unexpected surprises. Now, don't you think this useless console is much more powerful?
Note: You must retype the set command every time you enter the Recovery Console.
6. It's annoying to have to boot with the disc every time...
# Well, actually, this can also be installed on the hard disk... Hehe.
To install the Recovery Console, please:
& Insert the Windows 2000 disc into the CD-ROM drive;
& Click the <Start menu>, then click "Run";
& In the open box, type drive:\i386\winnt32.exe /cmdcons, where drive is the drive letter of the CD-ROM drive.
& Start the installation process, then restart the computer. The next time you start the computer, there will be an additional item on the boot menu "Microsoft Windows Recovery Console".
7. My machine is an AD domain controller, and your method can't repair it...
# If the computer is a domain controller using Active Directory, then you should use the "Directory Services Restore Mode" in the boot mode menu, and enter the "Directory Services Restore Mode" password you selected when promoting the server to a domain controller.
8. I boot with the installation disc, but it can't recognize my hard disk, what should I do?
# Actually, you must have encountered this problem when installing the operating system. Because the Windows system does not have the driver for your hardware, so you need to provide your own third-party driver program. Before the Recovery Console starts, you can press the F6 key to install a third-party SCSI or RAID driver program, and then pray to God. If the RP is not too bad, then you can access your hard disk.
9. Finally, remind one point. The most important thing in system recovery work is to back up in time... back up the registry, back up the driver,
# Back up system files... and so on; the most basic work is to create an emergency repair disk of the current system. Otherwise, there may be a phenomenon that the emergency repair console cannot find the system installation... then you will want to cry.. right. Method:
My Computer -> Right-click on C: -> Tools -> Backup -> Emergency Repair Disk.
10. There are still too few commands for this thing, nothing at all...
# This... that... it's over... You still use O&O BlueCon, its functions are much more powerful;
http://www.freedemon.org/download/bluecon.iso
Or you can use WindowsPE or ERD Commander, which also have graphical interfaces and network support, equivalent to a mini Windows running from a disc. But that's a later story, and I won't mention it here.