■ Safe Mode With Command Prompt Loads basic files, services, and drivers, and then starts a command prompt instead of the Windows graphical interface. No networking services or drivers are started.
TIP In Safe Mode With Command Prompt, you can start the explorer shell from the command-line interface by pressing Ctrl+Shift+Esc and entering explorer.exe in the New Process window on the File menu of Task Manager.
■ Enable Boot Logging Enables you to create a record of all startup events in a boot log.
■ Enable Low-Resolution Video Enables you to start the system in lowresolution 640 × 480 display mode, which is useful if the system display is set to a mode that can’t be used with the current monitor or the system has a bad driver.
■ Last Known Good Configuration Starts the computer in safe mode by using registry information that Windows saved at the last shutdown, including the HKEY_CURRENT_CONFIG (HKCC) hive. This registry hive stores information about the hardware configuration with which you previously and successfully started the computer.
■ Debugging Mode Starts the system in debugging mode, which is useful only for troubleshooting operating system bugs.
■ Directory Services Restore Mode Starts the system in safe mode, and enables you to restore the directory service. This option is available on Windows Server 2008 R2 and later domain controllers.
■ Disable Automatic Restart On System Failure Prevents Windows Server from automatically restarting after an operating system crash.
■ Disable Driver Signature Enforcement Starts the computer in safe mode without enforcing digital signature policy settings for drivers. If a driver with an invalid or missing digital signature is causing startup failure, this option resolves the problem temporarily so that you can start the computer and resolve the problem by getting a new driver or changing the driver signature enforcement settings.
■ Disable Early Launch Anti-Malware Driver Starts the computer in safe mode without running the boot driver for the computer’s anti-malware software. If the boot driver for the computer’s anti-malware software is preventing startup, you need to check the software developer’s website for an update to resolve the boot problem or configure the software without boot protection.
■ Start Windows Normally Starts the computer with its regular settings.
4. If a problem doesn’t reappear when you start in safe mode, you can eliminate the default settings and basic device drivers as possible causes. If a newly added device or updated driver is causing problems, you can use safe mode to remove the device or reverse the update.
Backing up and restoring the system state
In Windows Server 2012 R2, there are approximately 50,000 system state files, which use approximately 4 GB of disk space in the default installation of an x64-based computer. The fastest and easiest way to back up and restore a server’s system state is to use Wbadmin. With Wbadmin, you can use the START SYSTEMSTATEBACKUP command to create a backup of the system state for a computer, and the START SYSTEMSTATERECOVERY command to restore a computer’s system state.
TIP When you select a system state restore on a domain controller, you have to be in the Directory Services Restore mode. To learn how to restore Active Directory, see the next section.
To back up a server’s system state, enter the following at an elevated command prompt:
wbadmin start systemstatebackup -backupTarget: VolumeName
Here VolumeName is the storage location for the backup, such as F:.
To restore a server’s system state, enter the following at an elevated command prompt:
wbadmin start systemstaterecovery -backupTarget: VolumeName
Here VolumeName is the storage location that contains the backup you want to recover, such as F:. Additionally, you can do the following:
■ Use the -recoveryTarget parameter to restore to an alternate location.
■ Use the -machine parameter to specify the name of the computer to recover if the original backup location contains backups for multiple computers.
■ Use the -authSysvol parameter to perform an authoritative restore of the SYSVOL.
You can also recover the system state by using a backup that includes the system state or by performing a recovery.
Restoring Active Directory
When restoring system state data to a domain controller, you must choose whether you want to perform an authoritative or nonauthoritative restore. The default is nonauthoritative. In this mode, Active Directory and other replicated data are restored from backup and any changes are replicated from another domain controller. Thus, you can safely restore a failed domain controller without overwriting the latest Active Directory information. On the other hand, if you’re trying to restore Active Directory throughout the network by using archived data, you must use an authoritative restore. With an authoritative restore, the restored data is restored on the current domain controller and then replicated to other domain controllers.
CAUTION An authoritative restore overwrites all Active Directory data throughout the domain. Before you perform an authoritative restore, you must be certain that the archive data is the correct data to propagate throughout the domain and that the current data on other domain controllers is inaccurate, outdated, or otherwise corrupted.
To restore Active Directory on a domain controller and enable the restored data to be replicated throughout the network, follow these steps:
1. Make sure the domain controller server is shut down.
2. Restart the domain controller server, and enter safe mode.
3. Select Directory Services Restore Mode.
4. When the system starts, use the Backup utility to restore the system state data and other essential files.
5. After restoring the data but before restarting the server, use the Ntdsutil.exe tool to mark objects as authoritative. Be sure to check the Active Directory data thoroughly.
6. Restart the server. When the system finishes startup, the Active Directory data should begin to replicate throughout the domain.
Restoring the operating system and the full system
As discussed previously, Windows Server 2012 R2 includes startup repair features that can recover a server in case of corrupted or missing system files. The startup repair process can also recover from some types of boot failures involving the boot manager. If these processes fail and the boot manager is the reason you cannot start the server, you can use the Windows Server 2012 R2 installation disc or system recovery options to restore the boot manager and enable startup.
System recovery options are available only with full server installations and not with Server Core installations. With Server Core installations, you need to use the installation disc to initiate recovery.