Category Archives: Disaster & Recovery

SBS 2011 failed restore – KSOD black screen with cursor

Crisis compounded …a business is critically impacted and NOW like as in NOW need to use their Windows Backup to restore back to a known good point.  You go through the 1-2 hour process and when the server reboots you get …a Black Screen of Death (KSOD) aka black screen a cursor and an unhealthy server OS that you cannot access.

When I hit this issue I immediately called a colleague who laser beamed onto the source of this issue.  Even with that information of the general cause and fix in hand, I had a very difficult time finding the needed detailed information so I could apply it and quickly overcome the issue.  My client needed to get back up and in business – my ass was now on the line!

…So I’m rectifying this info sprawl disconnect and putting it all in one place  – here.

In the interest of helping other businesses get back up from this scenario as fast as possible, below is this assemblage blog post.  This assembled information resolved my issue and can resolve yours as well.  It really isn’t very complicated to execute and you will find yourself quickly de-stressed once you again see the Ctrl-Alt-Delete screen following the server’s startup.

This also can apply to SBS 2008 too; just remember to copy the directory mentioned below from an SBS 2008 source.

First – What, Why, When

  • The reason you aren’t fully booting into the OS GUI is due to a previously installed Microsoft tool that you will later want to remove. This tool is the NTbackup & Restore Tool.  It is installed as a individually downloadable KB (.msu) which means it doesn’t appear as a standalone Role, Feature, or Program.  Unlike those things which you are commonly used to manipulating this tool has to be removed via the “Installed Updates” list …more on that later.
  • This Microsoft Tool is interfering with a specific directory that is now incomplete and without it your recovery fails.  You end up at a KSOD (Black Screen of Death).

Second – Help!

  • The ‘kinda’ good news is that if you can get a copy of this directory from a known good installation of the same OS at another of your clients or from someone you trust to provide you the same …then you are ‘in like Flynn’

The reason for this is that a specific folder is omitted from the backups – c:\Windows\Registration – if this condition exists.

This condition is now noted in Update Rollup 3 for SBS 2011 –

The simple fix for this is as follows:

  1. Copy the contents of C:\Windows\Registration from a working SBS2011 server
  2. Boot into the Windows Repair/Recovery mode using SBS2011 Disc 1
  3. Open up a command prompt and browse to C:\Windows\Registration
  4. Copy the files (from a USB drive or something) over to the server

The server should now boot up

(see reference link to PowerBiz Solutions post by Boon Tee below)

Third – Cleanup

  • once the OS is back up and running you’ve got some critically important work to do
  • uninstall the NTbackup & Restore Tool by bringing up either Programs and Feature or the Widows Updates Windows and then selecting the ‘Installed Updates’ choice on the left column.  Within the list of updates find and remove
    “Update for Microsoft Windows Windows (KB974674)”
  • install, review, and take remediation steps from the Microsoft Windows Server Solutions BPA 1.3 – avoid aka ignore the direction to alter the webconfig as instructed with the EWS error (see references below for further information)
  • run a full image backup immediately


(click above to enlarge)


The Copier Man Rings Twice …and Then Some–A Tale of a Spanning Tree Loop (a Sequel Every Millisecond)

Have you ever wondered …what would happen if?  …if say …say

…if say you decide to plug that unknown loose wire into say …some open port on that switch that is conveniently close by? …well let’s just pretend even if you wouldn’t – I mean you are a mere copier printer tech guy …why should you be sloppy and leave loose wires sitting around unplugged? …you remembered unplugging it from the business machine you worked on moments ago and so you know it shouldn’t be loose …its like extra bolts when working on your engine – they gotta go somewhere – that machine is a network aware device and logic might dictate that a network cable should plug into the port on the side that magically happens to have a matching shape to that thing at the end of the loose cable …but that switch has lots of other wires in it – that looks like a better place …right?  I mean it does look inviting. [DOH!]

…so if you take a mini-switch that expands your limited one port wall plate in the corner to use a couple of printers, an IP phone, scanner …etc. you have a time-bomb waiting to detonate your network with ARP traffic.  Perhaps labeling the switch exactly as it is to be used would help to idiot proof it …or maybe taping over the unused ports.  The above fun was done at the expense of a real scenario but the names were changed to protect the guilty.   Unplugging all hosts from the main relay rack switches and adding them back one at a time was the methodology that first brought relief and ultimately led to the conclusion that a spanning tree loop condition existed somewhere out in the office.  The pain of seeing a network go berserk and not know why was unsettling for many hours of down-time until the client remembered that a copier/printer guy had done work the previous day.   It was a matter of minutes then to get things rectified.

SBS 2008 – How to repair Exchange 2007

FYI – just published repair documentation:

SBS Exchange Repair Documentation Live Today

More announcements from the SBS documentation team today.

How to repair Exchange

  • Reinstall the Client Access Role in Windows Small Business Server 2008
  • Reinstall the Hub Transport Role in Windows Small Business Server 2008
  • Reinstall the Mailbox Server Role in Windows Small Business Server 2008

    Nicholas King’s blog

    Post SBS 2008 migration and now need data from SBS 2003 NTBackup media – what to do now?


    (picture is linked to download)

    If you find that there is missing information after the migration has completed (or someone in organization suspects this) then you need to access your NTBackup created media and potentially recover data.  But Windows Server 2008 no longer has NTbackup; Vista did the same thing.

    What to do?  Download the above nifty utility or go to a Windows 2003 Server you still have access to.  With the utility you can keep it all in house at the business network which keeps thing simple.

    KISS is a DU-IT best practice.

    ShadowProtect Success – Vista and Server 2008 Restores – Phillip is THE Man

    Tomorrow morning some of the good folks from ShadowProtect are in town buying me and many colleagues breakfast and Molly Malone’s Irish Pub and having a nice presentation.  So I thought I’d publish this topical reference I found this past week.

    Found this great article by accident and wanted to say thanks to Phillip Elder for figuring this out and sharing this information.  I know a few colleagues that will appreciate learning this ShadowProtect trick.

    **below from the linked post***

    First Successful Windows Vista ShadowProtect Restore! No Winload.exe Error!

    We have had a very disappointing series of problems with restoring any Windows Vista images made by ShadowProtect.

    Many black screens later, there is finally information out there on the “why” the problem happens. The main reason has to do with the way Vista keeps track of the system’s partitioning and OS location.

    Apparently the newer versions of Acronis’ imaging product compensates for this new partition management structure in Windows Vista. Unfortunately, the folks at StorageCraft are a little behind the game on this topic.

    The last restore attempt we made with a client’s system failed with a WinLoad.exe error.

    So, it turns out, after a lot of searching, that one needs to perform a preparatory step on the Windows Vista box before creating the ShadowProtect image:

    bcdedit /set {default} device boot
    bcdedit /set {default} osdevice boot
    bcdedit /set {bootmgr} device boot
    bcdedit /set {memdiag} device boot

    Place the above series of commands into a batch file and run the batch file As Administrator on the soon to be imaged Windows Vista box.