What is Windows RE and How Windows RE works

source: http://technet.microsoft.com/en-us/library/cc765966(WS.10).aspx

What is Windows RE?
Windows Recovery Environment (Windows RE) is an extensible recovery platform based on Windows Preinstallation Environment (Windows PE). When the computer fails to start, Windows automatically fails over into this environment, and the Startup Repair tool in Windows RE automates the diagnosis and repair of an unbootable Windows Vista® installation. Furthermore, Windows RE is a starting point for various tools for manual system recovery. The primary audience of this technology includes original equipment manufacturers (OEMs), original device manufacturers (ODMs), and corporate IT professionals.

This topic includes:

Benefits of Windows RE

Common scenarios

Image-based recovery from Windows RE

Security considerations

Technologies related to Windows RE

Benefits of Windows RE
Windows RE provides the following benefits:

Can help reduce support costs by up to 80 percent through automatic repair of common root causes of unbootable operating system installations.

Can add customized recovery tools to Windows RE.

Can be used as the platform for image recovery.

Supports mass-storage drivers and language packs through Windows PE tools.

Can run automatically or manually.

Provides diagnostic and repair logs.

Common Scenarios
End-user Scenario
A home user installs a video card driver from Fabrikam and restarts his computer. While Windows Vista restarts, the computer stops unexpectedly and an error message appears on a blue screen because of the driver. The computer automatically restarts. The user then sees a message that the computer failed to start and that Windows will attempt to repair it. Once in Windows RE, the Startup Repair wizard actively diagnoses the computer and determines that System Restore must repair the problematic video card driver. The user chooses to repair the video card driver, and the computer restarts after the repair. Now the computer successfully restarts, and the user sees the logon screen for Windows.

System Administrator Scenario
A system administrator for an enterprise is attempting to fix a client computer that cannot start. The administrator presses F8 during startup and selects the Recovery Environment entry, which boots the computer into Windows RE. He logs on by using a local administrator account, and selects the full-volume restore application from the list of available tools. Once the restore has completed, the administrator clicks the Reset button in Windows RE, and the computer restarts.

Unsupported Scenario
A user attempts to log on to their Windows user account by typing their password. However, the computer encounters a problem and crashes, triggering a restart. The computer restarts to Windows Vista without failing over into Windows RE. The user is back at the logon screen, and the error in Windows Vista is not repaired automatically.

Image-based Recovery from Windows RE
In the event that the Windows installation cannot be repaired with Startup Repair or other manual repair steps, Windows RE can be used to launch an image-based recovery tool.

User-created Recovery Image
Windows Vista provides end users with the ability to create a backup image of their entire operating system. End users can do this by using the Backup tool. The system image can be stored on an external hard disk, on a hard disk partition other than those imaged, or on a DVD. To restore the computer by using this system image, users must launch the restore interface from the list of Windows RE manual tools.

Factory-created Recovery Image
To facilitate restoring a computer to its factory state, a recovery image can be placed on the Windows RE partition. This eliminates the need for a separate recovery media in most cases.

If the Windows image format is used in the manufacturing process, the same operating system image can be used for recovery as well. A computer manufacturer can develop an application by using the Imaging APIs for Windows and the Windows image to restore the operating system volume. This application can be launched from the Windows RE user interface (UI) by using customizations provided by the ODM.

Security Considerations
When working with Windows RE, keep in mind the following security considerations:

When launching Windows RE from hard disk by using the F8 advanced boot options screen, users are required to use a local user name and password for authentication. To gain access to the Command Prompt window, the built-in administrator account must be used. Any local user can gain access to tools such as System Restore and the customized recovery application from the list of manual tools.

By default, networking is turned off in Windows RE. Applications can turn on networking dynamically if needed but are advised to disable it when network connectivity is no longer needed.

Because Windows RE does not include the security infrastructure present in the Windows Vista operating system, manufacturers and system administrators should not install Windows RE on hard disks of high-security risk computers, such as public kiosk computers running Windows Vista.

Technologies Related to Windows RE
Windows RE is related to the following technologies:

Windows Preinstallation Environment (Windows PE)
Windows Preinstallation Environment (Windows PE) is a minimal Win32 operating system with limited services. Windows RE is built from Windows PE.

ImageX is a command-line tool that enables the capture, the modification, and the application of file-based Windows images for rapid deployment. Windows RE is a customized Windows PE image (.wim) file that can be modified only by using ImageX. Windows RE scripts also rely on ImageX to install Windows RE images

How Windows RE Works
This topic describes how Windows RE works, specifically the automatic failover behavior, manual diagnosis and repair process and how Startup Repair tool works.

Automatic Failover
A computer running Windows Vista can automatically fail over into the on-disk Windows RE only if a boot failure is detected. At startup, the Windows loader sets a status flag to indicate that the boot process has started, and this flag is typically cleared before the Windows logon screen is displayed. If the boot attempt fails, the flag is not cleared. The next time the computer starts, the loader detects the flag and assumes that a boot failure occurred. When this happens, the loader launches Windows RE instead of Windows Vista.

The detection of boot failure relies on boot completion and not on whether an error occurred in Windows Vista. One example of a false-positive is when power is lost during the boot process, and Windows RE is launched even though the Windows installation is bootable.

Because the failover mechanism relies on the Windows boot manager and Windows boot loader, some failures will render Windows RE inaccessible. In the following scenarios, the user must use bootable Windows RE media to recover the computer:

Disk metadata corruption in the master boot record (MBR), partition table, or boot sector of Windows RE partition.

Missing or corrupt boot manager.

Missing or corrupt boot configuration data.

Sometimes the boot status flag cannot be read or written to by the boot loader, in which case Windows will not automatically fail over into Windows RE. However, the user can still manually launch into the on-disk Windows RE through the F8 menu.

Manual Diagnosis and Repair
When starting from a Windows RE CD/DVD or using the F8 advanced boot option menu to launch the on-disk Windows RE, the user can manually launch various system recovery tools:

Startup Repair (when not launched automatically)

System Restore (on rollback, by using existing restore points)

Windows Backup Disaster Recovery (to restore from a volume backup image)

Command prompt, from which all standard Windows PE console tools, such as Regedit and ChkDsk, are available

Custom OEM support/recovery tool

Startup Repair
Startup Repair is a tool that automates common diagnostic and repair tasks of unbootable Windows Vista installations. If the computer fails over into Windows RE because of a detected boot failure, Startup Repair launches automatically. If automatic failover to an on-disk Windows RE is not available, Startup Repair can also be launched as a manual recovery tool from a Windows RE CD/DVD.

Startup Repair Process
Startup Repair will try to repair computers that are unbootable because of the following reasons:

Registry corruption

Missing or damaged system and driver files

Disk metadata corruption (MBR, partition table, and boot sector)

File system metadata corruption

Installation of problematic or incompatible drivers

Installation of incompatible Windows service packs and patches

Corrupt boot configuration data

Bad memory and hard disk hardware (detection only)

Startup Repair will not repair unbootable systems caused by the following issues:

Malfunctioning firmware and other hardware components

Problems with clean Windows installations or Windows upgrades (for example, from Windows XP to Windows Vista)

Windows logon errors

Viruses and malicious software

Startup Repair Log
After Startup Repair has run, a text log with diagnostic information and repair results is generated. This log file is located at %WINDIR%\System32\LogFiles\Srt\SrtTrail.txt

source: http://technet.microsoft.com/en-us/library/cc765966(WS.10).aspx


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: