Get IT Done: Recover from Ntldr problems in Windows 2000

Recover from Ntldr problems in Windows 2000

When a Windows 2000 user gets an error message or a blinking cursor on startup, the usual suspects are a boot sector virus or corruption of the master boot record. But it's also possible the user has a damaged or deleted Ntldr file. Fortunately, problems with Ntldr are easy to diagnose and even easier to fix. In this Drill Down, I’ll show you how to use common troubleshooting tools, such as the manual repair option and Recovery Console, to handle Ntldr problems.

Signs of a corrupted Ntldr
The signs of a corrupted Ntldr depend upon the location of the bad code in the file. By using a hex editor to overwrite portions of the file and copying the bad Ntldr to a virtual OS in VMware, you can test the results of tampering without danger to your main system. In some cases, you may see the bootstrap menu and be able to select an operating system to run, only to have the machine hang at the Starting Windows progress bar. In others, your system may freeze immediately after the CMOS power-up test. In either case, the file may be damaged in a way that prevents any error messages from being displayed. In some cases you may still be able to boot directly into the Recovery Console, if it’s installed.

Mimicking a corrupt Ntldr
Other computer problems can look like a missing or corrupt Ntldr. For instance, if your machine is configured with an NTFS file system and the computer hangs during startup, it could be a symptom of a fragmented system hive. This problem was fixed in a later version of Ntldr included in Service Pack 2 (as of this writing, the latest version is Service Pack 3, released Aug. 1, 2002). If you haven't yet installed this Service Pack, I recommend that you do so.

There's a workaround for this problem, given in Microsoft Knowledge Base article Q265509:
  1. ·  Start the recovery console.
  2. ·  Change to the \Winnt\System32\Config directory.
  3. ·  Type: rename system
  4. ·  Type: copy system.
  5. ·  Exit.

Copying the file to its original name creates a new, unfragmented (or nearly unfragmented) file. Though Microsoft doesn't spell this out, you can erase after you boot back in to Windows 2000. Here are some other possible startup problems that can mimic Ntldr problems, and their fixes:

Tools for fixing Ntldr problems
If all signs point to Ntldr as the culprit (Figure A), you can use the Windows 2000 Recovery Console or the manual repair option to fix the problem.

Figure A
Your first clue to NTLDR problems will be an error message at bootup.

Insert your Windows 2000 CD into the machine and boot from the CD. After the message "Setup is inspecting your computer's hardware configuration," the Windows 2000 Setup screen will appear. When Windows Setup is finished copying the necessary files, you'll see a menu allowing you to Set Up Windows 2000, Repair A Windows 2000 Installation, or Quit (Figure B). Choose R to Repair a Windows 2000 installation.

Figure B
Boot from the Windows 2000 CD and choose the Repair option.

Why not use an installed Recovery Console?
As you know, it's possible to install the Recovery Console so that it appears at boot time. You may be wondering why I don't advise booting into the Recovery Console from the bootstrap menu. Well, it’s because many problems that are associated with Ntldr prevent the bootstrap menu from appearing.Therefore, you can't get to the Recovery Console, because a failed Ntldr prevents the bootstrap menu from appearing.

Enabling CD-ROM boot
You may need to configure your BIOS to allow booting from the CD-ROM. Start your BIOS software at startup and go to the section that allows you to adjust the Boot settings. Make sure a CD-ROM is enabled, and change the order so that the CD-ROM is listed before the hard drive (Figure C).

Figure C
Adjust your BIOS settings, if necessary, to enable the machine to boot from a CD-ROM.

If you're supporting an older BIOS that doesn't have this option, check with your computer maker to see if an upgrade is available. Otherwise, you'll need to use the Windows 2000 Setup Disks to start Windows 2000 to access the Recovery Console and your Windows 2000 CD as a source for a fresh copy of Ntldr. The next screen in Windows Setup lets you choose the option of starting the Recovery Console (by pressing C) or using the Emergency Repair Process (by pressing R).

If you don't have setup disks, you'll need four floppies and your Windows 2000 CD. Windows 2000 contains a guide to creating these disks. Click Start and Help. In the Index, typesetup and choose the topic Boot Disks, Creating.

Using the manual repair option
To access the manual repair option, press R at the Windows Setup screen. On the next screen, press M for manual repair. Manual repair begins with three options selected: Inspect Startup Environment, Verify Windows 2000 System Files, and Inspect Boot Sector. Press [Enter] to begin the manual repair.

You don't want to use F, Fast Repair, because you don't want to restore the registry, only the Ntldr file.

If you have an Emergency Repair Disk (ERD), you can place it in the drive and press [Enter]. However, an ERD isn't necessary for replacing Ntldr. You can press L to skip inserting an Emergency Repair Disk. When Windows Setup finds your Windows 2000 installation on disk, press [Enter] to begin repairing the files. Windows will examine the disks and display a progress bar as it does so. When a file is missing or differs from the version on the CD, you'll be prompted to skip the file, repair the file, or let the program repair all files without asking.

If Windows Setup reports, as expected, that Ntldr is not the original file, press [Enter] to repair the file. (Setup won't tell you anything different if the file is actually missing, so the message is a tad inaccurate.) Figure D shows this blue screen, which I call the Blue Screen of Life, in comparison with the usual Windows Blue Screen of Death error message.

Figure D
When manual repair detects a problem with Ntldr, choose Enter to repair the file.

Once the file is repaired, Windows will continue examining files. Chances are it will find many files that don't match, especially if you've applied any Service Packs. Since the problem is confined to Ntldr, you can press [F3] to quit setup. You'll be warned that Windows Setup isn't complete. Ignore the warning and press [F3] again to quit. Windows will reboot, so remove any floppy disks and the Windows 2000 CD from their drives before it does. If the problem was indeed a missing or corrupt Ntldr, you'll now be rewarded with the bootstrap menu's return, or you'll proceed to the Windows logon screen.

Check for viruses
If a virus infects the machine, no amount of manual copying is going to fix the problem: the machine will just keep getting reinfected. It's a good idea to keep an updated floppy disk or CD with virus scanning software and other utilities for emergencies such as this.

An alternative: Using the Recovery Console
If the manual repair option doesn't work, as it didn't during one test after I followed Microsoft's instructions, choose C at the Windows Setup screen to start the Recovery Console. The Recovery Console will list all Windows 2000 operating systems installed on your computer. Enter the number corresponding to the one you wish to repair, and press [Enter]. You'll need to enter your administrator password before continuing. The computer will display a prompt showing the command line interface is ready for instructions. You'll be logged in to the WINNT directory of your choice.

Learn about the Recovery Console
The Recovery Console is a command line interface similar to DOS and the Windows 2000 command prompt. If you're unfamiliar with the Recovery Console, type Help and hit [Enter] to see a list of available commands. For an explanation of these utilities, start Windows 2000 Help and enter Recovery Console Commands in the Index.

Copying Ntldr from the Windows 2000 CD is easy. First change to the root directory by typing CD and hitting [Enter] at the command line. Next, place the Windows 2000 CD in the drive and type the following:
  • ·        Copy D:\i386\Ntldr

  • Substitute your CD-ROM drive letter for D, if necessary. If the copy is successful, you'll see the message 1 File(s) Copied. You can now type exit to quit the Recovery Console. Your computer will reboot, and Windows should start.

    If this doesn't solve your problem, other essential startup files could be corrupted. Use the recovery console to copy and Boot.ini from your Windows 2000 CD. Note: Boot.ini uses a certain naming convention to describe each computer's hard drive geometry. It's a wise precaution to make a backup copy of Boot.ini on your hard drive or on a data CD in case you need it later. You can read more about manually configuring Boot.ini at

    VMware aids troubleshooting
    Finally, to test recovery steps when faced with a deleted or corrupted Ntldr file, I used VMware to run a virtual installation of Windows 2000 within my normal Windows 2000 operating system. That way, I can remove Ntldr or change its contents and watch the results of different repair methods without risking damage to my OS.

    Watch out for errors in Microsoft’s instructions
    Not surprisingly, I found that some of the Microsoft instructions for recovery were in error. For example, the Windows 2000 Startup and Shutdown Troubleshooter recommends using a manual repair with only Inspect Startup Environment selected. Actually, it was necessary to select Verify Windows 2000 System Files to fix a corrupted or missing Ntldr. In addition, error messages were slightly different than reported.


    Editor's Picks