Configuring Windows 7 (Training Kit) - Part 79 docx

Lesson 2: System Recovery CHAPTER 14 753
The Last Known Good Configuration (Advanced)
The Last Known Good Configuration (Advanced) feature in Advanced Boot Options is
a recovery option that you use to start your computer with the most recent settings that
worked. Last Known Good Configuration (Advanced) restores registry information and driver
settings that were in effect the last time the computer started successfully.
You should use the Last Known Good Configuration (Advanced) feature when you cannot
start Windows 7 after you make a change to your computer, or when you suspect that
a change that you just made is causing a problem—for example, if you cannot start Windows
after you install a new video driver. When you start your computer by using the Last Known
Good Configuration (Advanced) feature, Windows 7 uses the configuration stored in the
following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet
Figure 14-13 shows the Control key within the CurrentControlSet registry key. When
your computer restarts and you log on, your current configuration in ControlSet001 is
copied to CurrentControlSet and becomes the Last Known Good Configuration. Take care,
therefore, if you see messages about error events being written to Event Viewer while your
logon screen is active. If you log on at this point, you cannot return to the previous Last
Known Good Configuration, although you can perform a system restore to previous restore
points.
FIGURE 14-13 The CurrentControlSet registry key
7 5 4 CHAPTER 14 Recovery and Backup
Windows 7 Boot Options
Windows 7 implements a boot loader, a boot configuration and storage system called
Boot Configuration Data (BCD), and a boot option editing tool called Bcdedit. In Chapter 2,
you saw how you can use the Bcdedit tool to make VHDs bootable on computers running
Windows 7 Enterprise and Ultimate editions.
Windows 7 includes the following boot loader features:
n
Windows boot manager (Bootmgr.exe)
n

Windows operating system loader (Winload.exe)
n
Windows resume loader (Winresume.exe)
When a computer with multiple boot entries includes at least one entry for Windows 7,
Windows Boot Manager starts the system and interacts with the user. It displays the boot
menu, loads the selected system-specific boot loader, and passes the boot parameters to the
boot loader.
Boot Configuration Data
On Windows 7, boot options and BCD are stored in the BCD store. BCD provides a common
interface for all computers running Windows 7 and enables administrators to assign rights for
managing boot options. BCD is available at run time and during all phases of setup, including
resuming after hibernation.
You can use the Bcdedit utility to manage BCD remotely and manage BCD when the
system boots from media other than the media on which the BCD store resides. This feature is
important for debugging and troubleshooting, especially when a BCD store must be restored
while running Startup Repair from DVD-ROM, from USB-based storage media, or remotely.
For example the following command forces the use of the Video Graphics Array (VGA; low
resolution) display driver on reboot:
bcdedit /set vga on
The following command enables kernel debugging for the current operating system boot
entry:
bcdedit /debug on
The following command disables kernel debugging for an operating system boot entry
specified by its global unique identifier (GUID):
bcdedit /debug <GUID> off
You can use the Bcdedit utility to do the following:
n
Create a BCD store
n
Rebuild BCD

n
Add entries to a existing BCD store
n
Modify existing entries in a BCD store
Lesson 2: System Recovery CHAPTER 14 755
n
Delete entries from a BCD store
n
Export entries to a BCD store
n
Import entries from a BCD store
n
List currently active settings
n
Query entries of a particular type
n
Apply a global change to all entries
n
Change the default time-out value
More Info BCD BOOT OPTIONS
For more information about BCD boot options, see
library/aa906217.aspx.
You can use the Bcdedit utility to edit boot options in Windows 7. You must be a member
of the local Administrators group to use Bcdedit. You can also use the Windows Management
Instrumentation (WMI) interface to programmatically change the boot options. Chapter 13,
“Monitoring and Performance,” discussed WMI in detail.
More Info THE BCD WMI INTERFACE
For more information about the BCD WMI interface and the Windows Software
Development Kit (SDK), see />Rolling Back Drivers
Sometimes you can encounter problems because a recently installed driver for a hardware

device is incompatible with other drivers or with the hardware in your computer. The classic
situation is when you update a video driver and find that when you restart your computer,
you cannot see your screen.
In this case, you need to return your computer to its state before you updated the driver.
If you have not logged on since the driver was updated, you can boot using Last Known
Good Configuration (Advanced) in Advanced Boot Options. If you cannot use Last Known Good
Configuration (Advanced) you would next consider performing a system restore.
Typically, you would boot into Advanced Boot Options by using the F8 key and selecting
Debugging Mode or boot from DVD-ROM and select Repair Your Computer. In either case,
you would access the System Restore option and restore your system settings to the system
restore point that was created before you installed the problem driver. It is a good idea to
create a system repair point before you make any significant changes to a computer, such as
installing a new driver.
However, it is not always convenient to use Last Known Good Configuration (Advanced)
or a system restore. The driver could have been installed through Windows Update with
7 5 6 CHAPTER 14 Recovery and Backup
other important and recommended updates that you do not want to roll back. In this case,
you need to boot the computer either into Safe Mode or Enable Low Resolution Video
(if your problem is a video driver) and roll back the driver. Managing drivers and using Device
Manager were discussed in detail in Chapter 4, “Managing Devices and Disks.”
On the Drivers tab of the device’s Properties dialog box, shown in Figure 14-14, you can
choose to uninstall or disable the driver. If the device was a monitor, this would result in the
default low-resolution driver being used, but in other types of devices, it would probably
result in the device not working at all.
FIGURE 14-14 Drivers tab of a device Properties box
Your choice, therefore, should be to roll back the driver. This rolls back to the previous
driver that was used (and worked satisfactorily) before the new device driver was installed.
One of the main functions of Safe Mode and the Enable Low Resolution Video option is to
allow you to make changes to device drivers when these are causing problems. Note that the
Roll Back option is enabled only if a driver for a device has been installed that overwrote a

previous driver.
Practice Configuring System Protection, Creating a Restore Point,
and Performing a System Restore
In this practice, you configure system protection on a hard disk on which it is not configured
by default. You then manually create a restore point. You make a system change (uninstall
a driver) and then perform a system restore to the restore point you created. Finally, you
check that the system change has been reversed.
Lesson 2: System Recovery CHAPTER 14 757
exercise 1 Configure System Protection
In this exercise, you configure system protection on a hard disk that does not hold a system
partition and therefore does not have system protection on by default. You can choose any
hard disk you want, but you will likely use the second internal hard disk if one exists on your
computer. If you are saving your backups on an external hard disk, you can choose to do
this provided that this disk is formatted with the NTFS filing system, although in practice
you are unlikely to enable system protection on a device used only to store backups. System
protection configuration is discussed in more detail in Lesson 3. Perform the following
procedure:
1. If necessary, log on to the Canberra computer with the Kim_Akers account.
2. In Control Panel, click System And Security. In the System And Security window, click
System.
3. In the System window, click System Protection. This accesses the System Protection tab
of the System Properties dialog box, as shown in Figure 14-15.
FIGURE 14-15 The System Protection tab of the System Properties dialog box
4. Select the drive on which you want to configure system protection and then click
Configure.
5. In the System Protection dialog box for the selected drive, select Restore System
Settings And Previous Versions Of Files. Configure the Maximum Usage setting (the
maximum disk capacity that you want to use to store restore points) by using the slider
control, as shown in Figure 14-16.
7 5 8 CHAPTER 14 Recovery and Backup

FIGURE 14-16 Configuring system protection for a selected disk drive
6. Click OK.
7. On the System Protection tab of the System Properties dialog box, ensure that system
protection for the disk drive you selected is set to On. Click OK.
exercise 2 Create a Restore Point Manually
In this exercise, you manually create a restore point named Trial Restore Point.
1. If necessary, log on to the Canberra computer with the Kim_Akers account and access
the System Protection tab of the System Properties dialog box, as described in Exercise 1.
2. Click Create.
3. In the Create A Restore Point dialog box, type Trial Restore Point. Click Create.
Windows 7 creates a restore point. This can take some time.
4. Click Close.
exercise 3 Perform a System Restore
In this exercise, you make a system change. You then perform a system restore to the Trial
Restore Point and check the system change is reversed.
1. If necessary, log on to the Canberra computer with the Kim_Akers account.
2. On the Start menu, right-click Computer and choose Manage.
3. In the left pane of the Computer Management console, select Device Manager.
4. Choose a device that you are not using right now. Right-click the device and choose
Properties.
5. Click Driver to access the Driver tab, as shown in Figure 14-17.
Lesson 2: System Recovery CHAPTER 14 759
FIGURE 14-17 The Driver tab for the chosen device
6. Click Uninstall. Click OK to confirm that you want to uninstall the driver.
7. Access the System Protection tab of the System Properties dialog box, as described in
Exercise 1.
8. Click System Restore.
9. On the Restore System Files And Settings page of the System Restore Wizard, click Next.
10. In the Restore Your Computer To The State It Was In Before The Selected Event dialog
box, ensure that Trial Restore Point is selected, as shown in Figure 14-18. Click Next.

FIGURE 14-18 Selecting a restore point
7 6 0 CHAPTER 14 Recovery and Backup
WarnIng YOUR COMPUTER WILL RESTART
The next step in this exercise restarts your computer. Ensure that all your work is saved and
any applications you are not currently using are closed before continuing.
11. Click Finish. Click Yes to confirm that you want to continue. Windows 7 performs
a system restore and the Canberra computer reboots.
12. Log on to the Canberra computer with the Kim_Akers account.
13. Click Close to close the System Restore Completed Successfully box.
14. Access the Driver tab of the device you chose earlier, as described in steps 2 through 5
in this exercise.
15. Check that the device driver is no longer uninstalled (that is, the Uninstall button is
enabled).
Lesson Summary
n
If system protection is configured on a disk drive, restore points are created
automatically when you make significant system changes. You can also manually create
a restore point.
n
You can restore your system settings to a selected restore point.
n
You can restore your entire computer from a System Image backup to how it was when
the backup was taken.
n
You can boot from the Windows 7 installation DVD-ROM and run a System Repair, or
you can access the Advanced Boot Options by pressing the F8 key during a reboot.
Both techniques access tools that let you investigate boot and system problems.
Lesson Review
You can use the following questions to test your knowledge of the information in Lesson 2,
“System Recovery.” The questions are also available on the companion DVD if you prefer to

review them in electronic form.
note ANSWERS
Answers to these questions and explanations of why each answer choice is correct or incorrect
are located in the “Answers” section at the end of the book.
1. You are testing unsigned device drivers on a computer on an isolated test network.
You install a display driver and find that the computer boots to a blank screen. You
restart the computer and press F8. What Advanced Boot Options could you choose to
help remedy the situation? (Choose all that apply.)
a. Safe Mode
B. Enable Boot Logging
Lesson 2: System Recovery CHAPTER 14 761
c. Enable Low Resolution Video
D. Last Known Good Configuration (Advanced)
e. Disable Driver Signal Enforcement
2. You are deciding on which storage devices you want to configure system protection.
System protection is enabled by default on your C: drive, which holds your system files.
No other storage device on your computer has system protection enabled. On which
of the following storage devices can you enable system protection? (Choose all that
apply.)
a. Your second internal hard disk, formatted with NTFS
B. An external USB hard disk formatted with FAT
c. A USB flash drive
D. Your optical drive
e. A mounted VHD created on your second internal hard disk
3. You are investigating instability and boot problems on a computer running Windows 7
Enterprise. You boot using the Last Known Good Configuration (Advanced) option and
perform a system restore. This does not solve your problems, and you want to undo
the system restore. Can you do this, and what is the reason for your answer?
a. No. You can undo a system restore only if you initiate it from the System Recovery
tools.

B. No. You can undo a system restore only if you carry it out after booting normally.
c. Yes. You can always undo a system restore, no matter how you booted the
computer or how you initiated the restore.
D. Yes. You can undo a system restore that you perform after either booting normally
or booting using Last Known Good Configuration (Advanced).
4. You are troubleshooting instability problems on a computer running Windows 7
Ultimate and suspect that they might be related to hardware faults in RAM. You access
the System Recovery options. Which option is most likely to help you diagnose the
problem?
a. Windows Memory Diagnostic
B. Startup Repair
c. System Restore
D. System Image Recovery
5. What command-line utility can you use in Windows 7 to edit boot options?
a. Bootmgr.exe
B. Winload.exe
c. Bcdedit.exe
D. Winresume.exe
7 6 2 CHAPTER 14 Recovery and Backup
Lesson 3: Recovering Files and Folders
This lesson looks at previous versions of files and folders created as shadow copies by the
Volume Shadow Copy Service (VSS) when a restore point is created or held in backup sets
created by a file and folder backup. It discusses how you can restore previous versions of files
even when these files have been renamed or deleted.
The lesson looks at file and folder recovery and the Recover Files Wizard and describes
how you use this wizard to restore user profile information. System Protection was introduced
in Lesson 2, and this lesson considers System Protection settings in more detail.
After this lesson you will be able to:
n
Recover a previous version of a file or folder.

n
Recover a file and folder from backup.
n
Restore a renamed or deleted file.
n
Restore a user profile.
Estimated lesson time: 35 minutes
Restoring Damaged or Deleted Files by Using
Previous Versions
Previous versions are either backups of files and folders that you create by using the
Backup And Restore console and restore by accessing the same tool and using the Restore
Files Wizard, or they are shadow copies. Shadow copies are copies of files and folders that
Windows 7 automatically saves when it creates a restore point. You can decide whether to
restore from backup or restore from a shadow copy. The file you restore from backup will be
the version of the file that was current when the backup was taken. You may have a shadow
copy that is more recent than the backed-up file, or you may want to restore an older version.
You can use previous versions of files to restore damaged files or files that you, or users
you support, accidentally modify or delete. You can access previous versions, save them to
a different location, or restore a previous version of a damaged file to its original location.
Restoring Files and Folders
Windows 7 makes restoring files and folders from backup straightforward. You can restore
a file or folder to its original location or to a different location. Typically, you restore a file to
its original location if it is corrupted or has been accidentally overwritten, but sometimes you
want to restore to a different location to test that your backup and restore procedures are
working correctly without the risk of overwriting your current files and folders. This is known
as a dummy restore.