3. Installation of Windows NT 4.0
NT can be installed on Intel x86, PowerPC, MIPS R4x00 and DEC Alpha AXP. The NT Hardware Qualifier
is used on Intel machines to identify hardware. You can install NT from a CD using DOS drivers if the
NT drivers do not exist. You can dual boot DOS/Win 95 and NT but DOS/Win 95 must be installed first
and applications must be installed twice.
The System Partition is for the hardware-specific files and is on the Active partition.
The Boot Partition is for the OS files and can be on the System partition.
NTFS is used if file-level security is required, Services for Macintosh, permission preserved
when moving files from a Netware server or NT file compression is required.
Setup automatically formats with FAT16 up to 4Gb. If NTFS is required than the partition is marked
for conversion after installation. Convert.exe will preserve data when changing from FAT16 to
NTFS. For dual boot, drive C: must be FAT16 and a minimum of 2Mb must be formatted on drive C: of
a RISC computer.
Member servers can move between Domains but PDCs and BDCs remain in the Domain because the Domain Security
Identifier (SID) is created on NT installation. Member servers just have their own SID rather
than the Domain one. Domain names can be changed though, starting with the PDC.
A user who connects to a folder on one workstation and then accesses a file from another workstation
is deemed to have two connections.
As far as licensing goes you need a Server License agreement for each server and a Client Access License (CAL).
For the CALs you can use Per Server Licensing which is the number of clients allowed to access a particular
server. You could opt for Per Seat Licensing which applies per client. With this any number of clients
can access any server. It is possible to convert ONCE from Per Server to Per Seat licencing. Per Seat
Licensing is more suitable in a multiple server environment.
You run the Licensing Program by double-clicking Licensing in Control Panel. This allows
you to view the licencing mode for each backoffice product including NT Server. You can add or remove
CALS and also specify how licensing information is replicated to a master server or Enterprise Server
that handles lots of domains.
License Manager is started from the Administrative Tools menu. You can view the licensing
for the whole organisation and look at the usage. In addition you can perfom the one-way change
from Per Server to Per Seat licensing. Licence Groups can be created if many users use one
computer or one user uses multiple computers, the idea is to enable correct licensing
information to be obtained.
Network Administration Tools for NT Workstation enables the computer to administer NT servers and domains.
The icons must be manually set up, the tools being installed in the \svrtools directory.
Services for Macintosh allows a Macintosh to share files and printers, simple network administration
and AppleTalk routing support. The Macintosh requires System OS 6.0.7 or later plus AppleShare.
Services for Macintosh is installed via the Services tab of the Network program a MacFile
menu is then added to the Server Manager.
You can run Winnt.exe from the CD in DOS/Win 95 to install NT rather than use the minimal
NT OS on the three floppy disks provided. For RISC computers, the Setupldr program is used
from the CD. Typical, Portable, Compact and Custom setups are the options for Workstation, NT only uses Custom.
A PDC requires a unique Domain name, the domain is then automatically created. A NetBios computer name
cannot be the same as a Domain name.
There are 4 phases to the NT installation:
- Initialising Installation - detection of hardware, partition, file system, NT files location.
- Gathering Information - Installation method (Workstation), licensing mode (Server), type of
Server, a password for Admin, Emergency Repair Disk.
- Installing Networking - LAN, RAS, Internet Information Server (IIS), network cards, network protocols,
workgroup or domain for this computer.
- Finishing - time, video, Exchange Inbox configurations.
For Winnt.exe the following switches control the setup process:
- /x - stops the setup disks being created.
- /ox - only create boot disks.
- /b - floppyless installation.
- /u - unattended installation followed by an answer file, used with /s switch.
- /udf - Uniqueness Database File is specified for unattended installations of unique computers
with individual settings.
- /s - location of NT source files used with /u switch.
- /f - prevents verification of files.
- /i - specify the file name (default Dosnet.inf) for the setup information.
- /c - skips the free space check on the setup boot disks.
- /t - specifies the drive used for the temporary setup files (default is the drive with
the most room).
- /l - creates log file $Winnt.log.
Winnt32.exe is used only for upgrading from earlier versions of NT.
The Unattend.txt answer file can be copied from the resource kit, renamed and used with the /u
switch to identify unique settings for a computer. It is best to use one answer file for an unattended
group install and use the UDFs for computer specific settings such as computer name. Uniqueness IDs
are listed in the answer file referencing the numerous UDFs (perhaps one per computer).
System Management Server (SMS) is used for large rollouts, and can also be used to pull
down other applications.
The Initial Parameter Files created from the command line switches, the Unattend.txt file
or the graphical menus in Setup. The text mode version is called Winnt.sif whilst the
graphical mode one is called $winnt$.inf in the system32 directory. You can use these
files to create your own Unattend.txt file.
Other applications can be installed by creating a directory called $oem$\Oemfiles and placing
the extra components in there. For hardware components that need extra files installed need
individual directories in $oem$\Oemfiles\Textmode.
If an application does not support scripted installation, then the Sysdiff.exe utility must
be used. this works by first creating a snapshot of a reference computer using sysdiff /snap
snapshot_file, install the applications required on the reference computer, use
sysdiff /diff snapshot_file difference_file to create a difference file. You can then
place the difference file in $oem$\Oemfiles\$$root and add the sysdiff /apply difference_file
to the $oem$\Oemfiles\Cmdlines.txt, or apply it to an existing NT installation.
To remove NT, boot from a DOS/Win 95 floppy and type sys c: to remove the NT boot loader.
Restart the system from the hard disk, delete the following:
- The Winnt folder
- Program files\Windows NT
You can remove an NTFS partition from the NT Setup program. Fdisk in DOS 6.22 will remove an NTFS
partition but not a logical drive.
Directory Replication makes the same files available at multiple servers so not overburdening
any one server when commonly used files are being accessed by many users. User's logon
scripts must reside on the domain controller that validates the user. When there are more
than one domain controller in a domain, the logon scripts should be replicated to them all.
Directory replication allows you to just maintain one directory. The same goes for System Policy
files, telephone lists etc. typically read only files.
An NT Server can act as an Export Server and uses \System32\Repl\Export\subdir
to hold the group of files. An account is created for the replication purpose for each Import computer.
The account must be a member of the Backup and Replicators Group, the password must never expire
and the account must have 24 hours access. The Directory Replicator Service can be set to start
automatically from Server Manager or the Services program in Control Panel. The Import Computer
must log on as a member of the local Replicators Group and be configured to receive files.
On a periodic update the Export Server on seeing updated files in the subdirectory sends an update notice
to each of the Import Computers. They in turn download the updated files and delete the old files.
The boot sequence files required on an Intel x86 machine are as follows:
- Ntldr - loads the OS
- Boot.ini - builds the OS selection menu
- Bootsect.dos - contains the boot sector of another operating system such as Win 95.
- Ntdetect.com - hardware detect program
- Ntbootdd.sys - used only for SCSI based systems that have the BIOS disabled on the SCSI adapter.
- Ntoskrnl.exe - The NT Kernel
- System - contains the system configuration files
- Device drivers
The Boot sequence is as follows:
- Power on self test
- Master Boot Record (MBR) is loaded and ran from the first sector. The first sector also contains
the Partition Table which is scanned by the MBR for the System Partition.
- Boot sector from the active partition is loaded into memory
- Ntldr is loaded (this is the responsibility of the Partition Boot Sector Code) and this controls
the operating system selection process and hardware detection.
- Microprocessor changed to flat memory mode
- Start minifile system drivers which is code to access files on FAT and NTFS systems.
- Read Boot.ini and build OS selection screen
- (Load the selected operating system and Bootsect.dos if the OS is not to be NT)
- Run Ntdetect.com
- Load NT
The NT load process then starts and operates as follows:
- Ntoskrnl.exe loads
- The Hardware Abstraction Layer (HAL) and the System Hive is loaded with the drivers
- The Kernel is initialised along with the drivers
- The services load which involves starting Smss.exe which is Session Manager.
- The Win32 Subsystem starts, beginning with Winlogon.exe and the Local Security Authority
- The User logs on whilst the Service Controller (Screg.exe) makes a final pass through the
registry looking for services marked to load automatically.
The message Couldn't find NTLDR means that Ntldr.exe is missing.
The message NTDETECT failed means that Ntdetect.com is missing.
The message the following file is missing or corrupt: \winnt root\system32\ntoskrnl.exe
means that Ntoskrnel.exe is missing.
The message I/O Error accessing boot sector file multi(0)disk(0)rdisk(0)partition(1)\\bootss
means that Bootsect.dos is missing.
Editing the Boot.ini file in the root of the active partition needs the Read-only option to be turned off.
The [boot loader] determines the OS to boot to plus a timeout setting. The default is the path
to the default OS when the timeout expires. The [operating systems] lists the OSs.
Switches can be added to the [operating systems] and these are the following:
- /basevideo for loading NT in VGA mode (vga.sys and vga.dll in case of video driver failure.
- /baudrate=nnnn default is 9600Kb/s when a modem is attached and 19200Kb/s with a null modem cable attached.
- /crashdebug automatic recovery and restart.
- /debug this automatically loads debugger when windows starts
- /nodebug no debugging information being monitored.
- /maxmem=n the maximum amount of RAM that windows will use, good for troubleshooting parity errors.
- /sos causes the names of drivers being loaded to be shown instead of the dots on the blue load screen.
If the Boot.ini file is missing you get the message that ntoskrnl.exe is missing or corrupt. You can either
edit Boot.ini directly or use the Emergency Repair disk to fix it.
The Drivers Resource Kit provides a command line utility called Drivers.exe which can be used to
show which drivers have loaded.
An NT boot disk is created FROM NT. NT automatically Syss the floppy and the files that are required
on the floppy are Ntldr, Ntdetect.com, Boot.ini and Ntbotdd.sys (for a BIOS-disabled
SCSI adapter). The ARC may need to be modified. When booting from the floppy some files are loaded
from the hard disk.
The Last Known Configuration is good if a new device driver is faulty or the video driver is bad
or SCSIport driver is accidentally disabled. It loses all configuration changes since the last
If files are missing or corrupted, then you can use the Emergency Repair Disk or expand r to
install new versions of the files or use rdisk.
Run Rdisk.exe to either update or create an Emergency Repair disk. The rdisk /s option
saves user account information and can take up more than a floppy disk's worth. The operator
needs to be a member of the administrators group or the Power Users Group. It is important to make
regular updates of the emergency repair disk as not only account information but disk drive
configurations like mirror sets or volume sets are kept on the disk and if these are not up to date
then it may be impossible to recover some data.
The Emergency Repair Disk contains the following files:
Compressed files (using the _) can be expanded using Expand.exe.
To use the ERD, boot the computer with the Setup boot disk and then select the r option when
asked if you wish to repair files. The following options can be selected for the repair process:
- Inspect registry files
- Inspect startup environment
- Verify Windows NT system files
- Inspect boot sector
The blue Stop screen has some codes that are helpful in determining the cause of the error. The five
sections to the Stop screen are:
- Debug Port Status Indicators - MDM, CD, RI, DSR, CTS, SND, RCV, FRM, OVL, PRT.
- Error Code
- Driver Information - preferred load address, the link time stamp and the names of the drivers loaded at the
time of the crash.
- Kernel Build Number and Stack Dump - the build number of the kernel.
- Debug port information - COM port parameters used by the Kernel Debugger on the target computer.
When debugging the following terms are often used:
- Symbol file - this is a file that has been compiled debug code built in and can replace the
'debug free' version which is normally used by the OS.
- Exception - an event that disrupts the process.
- Structured Exception Handling (SEH) - exceptions in software are trapped to see if they can
be handled so that the process can continue.
- Stack Trace - this is the recent history of events that occurred in the stack (recently
- Host Computer - runs the debugger.
- Target Computer - where the stop errors occur.
Debuggers include NT Symbolic Debugger (NTSD) (User mode), CDB (User Mode), Kernel Debugger
(Kernel mode) and WinDBG (User and Kernel Mode).
Debugging can be done locally using a null modem cable, remotely using a modem RAS connection or
using a Crashdump.
Kernel Debugger displays the files loaded during the boot and load sequences. The boot.ini file of the Target computer
must have the /debug switch set, or maybe the /crashdebug switch if the computer
is prone to crashing. The Kernel Debugger files must be copied to the Host computer and decompressed
before installing, the files are found in Support\Debug\platform directory.
CrashDump is enabled in the Startup/Shutdown tab of System Properties and this
dumps the RAM contents to the pagefile when a Stop occurs. The utilities used to examine the contents
are dumpflop, dumpchk and dumpexam. Dumpchk performs a validity check on a crash dump
to make sure that it can be read by a debugger. The Dumpexam creates a text file called memory.txt
from the dump file memory.dmp.
Debugging application crashes is carried out by Dr. Watson (use the command drwatson). The
text file created is called Drwtsn32.log. There is also an option to create a binary crash dump file.