Sometimes due to an improper shutdown (even outage), or sometimes due
to causes unknown, when I boot up cold, I am forced into Safe Mode.
And, of course, if I then shutdown to full restart, it will then boot
up in normal mode just fine.
Windows usually offers and defaults to Safe Mode, if the previous
attempt to boot Windows failed to complete. The reasoning is sound;
that if it's likely extra software or drivers caused the boot process
to fail, then Safe Mode (which reduces this load) will more likely
work, so the user can fix the problem from there.
But I am curious - what is actually happening here? Why does this
procedure do the trick? I can guess that certain things need repair
in order for a boot to work correctly, but that is pretty vague.
What is also happening, is that files damaged by the bad exit are
"fixed" by AutoChk (similar to the ChkDsk you use electively).
Unfortunately, "fixed" files are usually broken, and once fixed, you
can't tell which of the thousands of files on the system were damaged.
More unfortunately, AutoChk doesn't ask for permission before "fixing"
broken files, and doesn't really list them so you can see which ones
they were. Even more unfortunately, the only logging it does is deep
in the bowels of Event Viewer, filed under some non-intuitive name
like "WinLogon", and these logs can only be read from within XP. So
if XP is so barfed it can't boot, you can't read the logs to see why.
There are other automagical things going on, such as resetting of the
Last Known Good state, and there may (or damn well should be!) backups
of both system and oper-user registry files being maintained.
You can make life easier for yourself in several ways:
1) Shutdown properly, always
Any crashes that prevent you from being able tio shut down, must be
fixed - whether it's protecting against mains outages or cleaning up
bad software that destabalizes the system
2) Stop the PC from restarting on errors
Somewhere within Control Panel, System, there's a checkbox to
"automatically restart on system errors" that's checked by duhfault.
UNcheck that, so that at least you can see what the error was! If XP
had more sense, it would keep this setting implicitly off until boot
is complete, because even for unattended systems, there's no point in
continuously rebooting a PC if it never reaches a state of
functionality or visibility to remote administration.
3) Stop the PC from restarting on RPC service failures
It's impossible to avoid using the Remote Procedure Call services,
which has already been used as a malware battleground. XP SP2, and
earlier versions if patched, have known exploitable RPC defects
patched, and any firewall should help protect this too. You can and
IMO should stop RPC failures from restarting the system by setting the
Properties of the service to "Restart the Service" instead.
4) Minimize the impact of AutoChk
C: is always in use, and will thus always have files open when a bad
exit occurs. Typically these will be disposable; .LOG files, System
Restore data, temp files, .PF prefetch info, etc. but can also affect
your data files. So after every bad exit, the PC is likely to grind
away at AutoChk to "fix" C:'s damaged file system.
A way to reduce the impact of this, is to keep C: small, and keep your
data off C: so that it's no exposed to corruption from the constant
(interrupted?) writes to C:. That means the checking of C: will be
quicker, and you'd be less likely to skip this when in a hurry
Also, it's possible to suppress AutoChk on a per-volume basis. So you
could allow AutoChk to "fix" C: automatically, knowing your data is
not at risk there, but suppress it for the volume (e.g. D
where your
data is stored. You could then avoid use of the data volume until you
did an elective ChkDsk of that volume; once you know what ChkDsk would
have done if allowed to run wild off the leash, you could ChkDsk /F
My own practice is to use DOS mode boot instead, and do a Scandisk
from there. Scandisk is a better fixer than AutoChk and ChkDsk in
that it is interactive; it tells you what it's found, how it will
"fix", and *asks* before "fixing" things. It also saves the log as
C:\SCANDISK.LOG, which is far easier to read if the OS can't boot.
But Scandisk only runs in DOS mode, and cannot work on NTFS volumes.
So I avoid NTFS. One might mix NTFS and FATxx volumes to taste, based
on how you see their relative strengths as relevant to contents.
--------------- ----- ---- --- -- - - -
Tech Support: The guys who follow the
'Parade of New Products' with a shovel.
