This section describes troubleshooting problems that might occur from the time NTLDR starts executing through the time that you successfully log onto Windows NT. This phase of startup begins when you see the following message:
NTDETECT V1.0 Checking Hardware . . .
On x86-based computers, NTDETECT detects installed hardware components.
There is a debug version of Ntdetect.com on the Windows NT Workstation product CD, called Ntdetect.chk. If Ntdetect.com fails to detect all of the hardware that you think it should find, you can use the debug version to help isolate the problem. A mouse or a disk controller are the components that typically cause problems.
To use the checked version:
The utility Installd on the Windows NT Workstation Resource Kit CD performs the same functions.
Ntdetect.com has attributes of Hidden, System, and Read Only set when you install Windows NT. You need to clear these attributes to make the file visible. You can change the attributes by using My Computer, Windows NT Explorer, or the command prompt.
1. On the View menu, click Options.
2. On the View tab, select Show all files. Click OK.
3. Click the filename NTLDR at the root of the C drive.
4. On the File menu, click Properties.
5. In the Attributes box of the General tab, clear the Read Only and Hidden check boxes, and then click OK.
To change the attributes by using the command prompt, enter:
attrib -s -h -r ntldr
Shutdown Windows NT and restart the computer. When Ntdetect.chk executes, it displays information on the screen as it detects the hardware. This is a sample of the kind of information you might see:
Detecting System Component . . .
Reading BIOS date . . .
Done reading BIOS date (1/20/1994)
Detecting Bus/Adapter Component . . .
Collecting Disk Geometry . . .
Detecting Keyboard Component . . .
After it finishes displaying information about the components, press ENTER so Ntdetect.chk will continue. Ntdetect.chk next displays information about the current nodes for the controllers and peripherals. You need to press ENTER at the end of each screen of information.
When you have finished using Ntdetect.chk, you should rename Ntdetect.com to Ntdetect.chk and rename Ntdetect.bak to Ntdetect.com.
For x86-based computers, the Boot.ini file has a /maxmem switch that enables you to specify the maximum amount of RAM memory that Windows NT can use. You can use this switch to troubleshoot memory parity errors, mismatched SIMM speeds, and other memory-related problems. To use this switch, the memory must be contiguous. You should never specify a value less than 8 for Windows NT Workstation.
Note
Windows NT Workstation can run in 8 MB RAM, although it will probably run quite slowly.
You include this switch at the end of the ARC path specified in the [operating systems] section of the Boot.ini file. This example restricts Windows NT Workstation to using only the first 12 MB RAM.
multi(0)disk(0)rdisk(0)partition(1)\winnt=Windows NT Workstation 4.0 /MAXMEM=12
Chapter 36, "General Troubleshooting," contains more information about troubleshooting memory problems.
You can add the /sos switch to the Boot.ini file to have NTLDR display the Kernel and device driver names while they are being loaded. Use this switch if Windows NT does not startup and you think a driver is missing or corrupted. See the section "Boot.ini Switches" in Chapter 17, "Disk and File System Basics," for information about changing Boot.ini switches.
These examples assume that you have installed Windows NT Workstation in the folder winnt40 on partition 2.
First, you should see this message:
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\ntoskrnl.exe
And then this one:
Press spacebar now to invoke Hardware Profile/Last Known Good Menu
Regardless of whether you press the spacebar, you should see these two messages:
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\hal.dll
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\config.sys
The Hardware Profile/Last Known Good menu displays at this time if you pressed the spacebar or you have more than one hardware profile. After NTLDR finishes processing the hardware profile information, it clears the screen and displays information such as:
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\c_1252.nls
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\c_437.nls
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\n_intl.nls
multi(0)disk(0)rdisk(0)partition(2)\winnt40\FONTS\vgaoem.fon
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Drivers\Atdisk.sys
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Disk.sys
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\CLASS2.SYS
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Diskperf.sys
multi(0)disk(0)rdisk(0)partition(2)\winnt40\System32\Ntfs.sys
In some cases on ESDI disks with more than 1024 cylinders, Windows NT Workstation appears to have been successfully installed. However, the first time that you attempt to start from the hard disk, NTLDR loads various files and then produces a Fatal System Error: 0x0000006b with the message that Phase 1 Process Initialization failed. Following this message is a hexadecimal dump and system lockup. If you experience this problem, read the section "ESDI Hard Disk" in Chapter 17, "Disk and File System Basics," for information about the ESDI controllers that Microsoft has tested.
This Kernel STOP error means that Windows NT is unable to access the Partition Boot Sector or the required information is not found. A common cause of this error is a virus.
Another cause of the problem is incompatible Logical Block Addressing (LBA). The system BIOS is designed to allow access to fixed disks that use fewer than 1024 cylinders. Many modern disks, however, exceed 1024 cylinders. LBA is used to provide support for these disks. Such support is often built into the system BIOS. However, there are potential problems with LBA:
A corrupt Partition Boot Sector can also cause this problem, depending upon what part is corrupt. This problem is like a virus, except that the corruption is caused by such things as a defective disk or controller, or a bug in a program that somehow has corrupted the Partition Boot Sector.