DaRT Overview
DaRT Overview
Microsoft Diagnostics and Recovery Toolset (DaRT) provides a set of tools that
help IT shift desktop repair planning from reactive to proactive, saving time
and reducing the challenges associated with troubleshooting and repairing
desktop system failures. This white paper offers an overview of DaRT: its
benefits, its capabilities, and how to evaluate it.
DART OVERVIEW
| INTRODUCTION 1
Introduction
A user frantically calls the Help desk. His PC keeps crashing, and your manager sends you to fix
the problem. At the users desk, you log on to the Windows operating system and use the
troubleshooting tools available. You look in Event Viewer for clues, and you determine that the
problem is a faulty device driver. You then use the Computer Management console to disable
that driver. Windows includes many such tools to help you diagnose and fix problems. But what
do you do if you cannot start Windows?
Part of the Microsoft Desktop Optimization Pack (MDOP), illustrated below, DaRT helps IT:
DART OVERVIEW
| INTRODUCTION 2
DaRT includes fourteen administrative, system and network tools for troubleshooting and
desktop recovery, even when Windows Safe Mode or normal boot will not function. For
example, recover deleted files or partitions with File Restore or reset lost or forgotten local
passwords with Locksmith. Additionally, the DaRT Defender tool ensures that malware is not
loaded into the computers memory and cannot remain hidden by scanning the infected
operating system while it is offline.
The tools in DaRT provide a foundation for shifting desktop repair procedures from reactive to
proactive. Organizations can develop recovery image deployment and support plans that best fit
their IT staffing and infrastructure requirements. A proactive approach can help save time and
reduce the challenges associated with troubleshooting and repairing system failures, while
getting users back to productivity faster without compromising settings, preferences, or user
data, as with reimaging.
With a desktop repair plan in place, the simple image creation process, coupled with an easy to
use tool menu, allows organizations to rapidly deploy, use, and benefit from DaRT. Deploying
via bootable media such as CD, DVD, or USB is one of the fastest routes to deployment.
However, depending on a companys infrastructure, deploying locally to end-user machines or
via network boot servers may provide more long term benefit.
DART OVERVIEW
A reimagined DaRT
Recovery Image Wizard:
Improved Windows
PowerShell scripting:
Built on Windows
PowerShell cmdlets
Transparent Unified
Extensible Firmware
Interface (UEFI) machine
boot integration
DART OVERVIEW
Creating recovery images by using the DaRT Recovery Image Wizard is simple. On the Start
screen, type DaRT and click DaRT Recovery Image to start the wizard. Table 2 on page 5
describes each page of the wizard.
DART OVERVIEW
Description
The wizard bases DaRT recovery images
on Windows RE, which Windows 8 and
Windows Server 2012 provide. You must
use x86 Windows to build 32-bit DaRT
recovery images. Likewise, use x64
Windows to build 64-bit DaRT recovery
images. You can create recovery images
for both system types on a single PC, but
you cannot create cross-platform
recovery images (i.e., one image that
works on both x86 and x64 system types).
DART OVERVIEW
DART OVERVIEW
DART OVERVIEW
Local installation. By installing the DaRT recovery image locally, users can start it by
using advanced startup options in Windows 8. You can deploy the DaRT recovery image
locally by using Microsoft System Center 2012 Configuration Manager, the Microsoft
Deployment Toolkit 2012 (MDT 2012), or any other electronic software distribution (ESD)
tool. The process automates local installation of DaRT tools on each system by using
Reagentc.exe so that DaRT is always available.
Network boot. To network-boot the DaRT recovery image, deploy it by using Windows
Deployment Services (Windows DS). Deployment via Windows DS can be the quickest
and simplest way to make the DaRT recovery image available to connected users in
production. This method can also make updating recovery images simpler because you
store them centrally instead of locally on each PC.
USB drives. DaRT 8 now offers native support in the DaRT Recovery Image Wizard for
creating USB media. In previous versions, additional tools (e.g., the Windows 7 USB/DVD
Download Tool) were required to install the DaRT recovery image on USB drives.
Removable disks. Of course, DaRT has always supported burning the recovery image to
CDs or DVDs. However, the new alternatives are far simpler and more convenient.
DART OVERVIEW
Portability
Infrastructure
Requirement
Availability
Centralized
Updates
Network
Requirement
Remote
Support
Window DS
USB Drive
CD or DVD
Deployment Method
DART OVERVIEW
10
DART OVERVIEW
11
DART OVERVIEW
12
Registry Editor
You can use Registry Editor, which Figure 3 shows, to edit the registry of the offline Windows
installation that you are troubleshooting. Tasks include adding, removing, and editing keys and
values; and importing REG files. Registry Editor enables you to make registry edits that could
help repair a system that will not boot. You can also use Registry Editor to edit values that the
offline Windows installation locks while it is running.
DART OVERVIEW
13
DART OVERVIEW
14
Locksmith
The Locksmith Wizard (Figure 4) is a simple tool that allows you to set the password for any
local account on the offline Windows installation that you are troubleshooting. You do not need
to know the current password. However, the password you set must comply with any
requirements that a local Group Policy Object (GPO) defines, including password length and
complexity. Use this tool in the event that the password for a local account (e.g., the local
Administrator account) is unknown. This tool cannot set passwords for domain accounts.
DART OVERVIEW
15
information, you can take corrective action. Crash Analyzer can eliminate much of the guesswork
involved in diagnosing crashes.
For example, if Crash Analyzer reports that a device driver called myfault.sys is the cause, as
Figure 5 shows, you can disable the device driver by using the Services and Drivers item in
Computer Management (see the Computer Management section). After discovering and
disabling the faulty device driver, you can try to start the repaired Windows installation.
DART OVERVIEW
16
meaningful information for troubleshooting. You download the symbol files when you use Crash
Analyzer to troubleshoot a PC. (An Internet connection is required while troubleshooting.)
Even if you plan to reimage the PC, running Crash Analyzer to determine
the cause of the issue is a good idea. The image might have a bad driver
that is causing intermittent problems in your environment, and Crash
Analyzer can help you see these patterns and improve its stability.
If you do not have access to symbols or the Debugging Tools on the PC that you are
troubleshooting, you can copy the memory dump file to another PC and use the standalone
version of Crash Analyzer to diagnose the issue. After installing DaRT on the PC, type Crash
Analyzer on the Start screen, and click Crash Analyzer.
File Restore
In Windows, the Recycle Bin helps prevent users from permanently deleting files by mistake.
However, users sometimes realize that they need a particular deleted file only after emptying
the Recycle Bin. In other cases, files are too big to fit in the Recycle Bin, or an application deletes
the files.
File Restore can help restore such deleted files. Figure 6 on page 17 shows the File Restore user
interface. First, you must find the file you want to restore. File Restore has filtering capabilities to
help expedite this process. For instance, you can use a file mask to search for specific filename
patterns. Additionally, you can limit results to a certain path, date range, or size range. File
Restore can even find files in deleted directories. For each file that File Restore finds, it indicates
whether recovery is likely or unlikely.
DART OVERVIEW
17
DART OVERVIEW
18
Disk Commander
By using Disk Commander, you can recover and repair disk partitions or volumes. As Figure 7 on
page 19 shows, you can choose from the following recovery processes:
Restore the Master Boot Record (MBR) or the header of the GUID Partition Table
(GPT). This option repairs damaged boot code in the MBR on a disk or the header of the
GPT, without affecting existing partition tables.
Recover one or more lost volumes. This option scans a disk for lost volumes and allows
you to recover them.
Restore partition tables from Disk Commander backup. This option restores partition
tables from a backup. Disk Commander gives you the opportunity to back up partition
tables before making changes.
Save partition tables to Disk Commander backup. This option backs up partition
tables. The backup includes partition table entries and boot sectors for each partition.
DART OVERVIEW
19
DART OVERVIEW
20
Disk Wipe
Many organizations simply format PCs hard disks when they donate, recycle, or discard them.
However, just formatting the hard disk might not destroy sensitive company or personal data on
that disk. As various news accounts have shown, malicious people can get their hands on PCs
that companies discard and can recover sensitive data.
Disk Wipe, which Figure 8 shows, can erase all data from a disk or volume. Two algorithms are
available: You can use a single-pass overwrite or four-pass overwrite, the latter of which meets
U.S. Department of Defense standards. After wiping a disk or volume, you cannot recover the
data, so verify the size and label of a volume before erasing it.
DART OVERVIEW
21
Computer Management
The Computer Management console that you see in Figure 9 on page 22 will be familiar to any
IT professional. DaRT tailors the console for the purpose of diagnosing and repairing problems
that can prevent the offline Windows installation from booting. The items in this console include
the following:
System Information. This item displays information about the system that you are
repairing. Information includes the Windows version, registered owner and organization,
the computer name as known by the installed operating system, and the computer name
that DaRT randomly assigned to the system.
Event Viewer. This item enables you to view the event logs of the offline Windows
installation that you are troubleshooting. You can use Event Viewer to look for entries
that can help you diagnose the problem.
Autoruns. This item configures the programs that start automatically when the
operating system starts. By using Autoruns, you can stop a program from starting
automatically when you suspect that the program is preventing Windows from starting.
Services and Drivers. This item manages the services and device drivers that start when
the target Windows installation starts. For every service and device driver, you see an
entry that indicates its startup type, a description, a display name, and so on. You can
change the startup type to Boot, System, Automatic, Disabled, or Delayed Auto-start.
If you have identified a service or device driver that is preventing the operating system
from starting, you can disable it here.
Disk Management. This item displays drive information, creates new partitions or
volumes, and formats drives. Disk Management in DaRT is similar to Disk Management in
Windows.
DART OVERVIEW
22
DART OVERVIEW
23
Explorer
Sometimes, before you attempt to repair or reimage a system, you need to salvage businesscritical information that the user stored on a local drive. In DaRT, you can use Explorer to browse
the PCs file system and network shares. Because you can map drive letters to network shares,
you can easily copy and move files from the system to the network for safekeeping or from the
network to the system to restore them. Figure 10 shows Explorer.
Figure 10Explorer
Solution Wizard
DaRT has many tools, and figuring out which one to use can be confusing initially. The Solution
Wizard (Figure 11 on page 24) asks you a series of questions and then recommends the best
tool for the job, based on your answers. This wizard helps you determine which tool to use when
DART OVERVIEW
you are not familiar with the tools in DaRT. After becoming familiar with DaRT, you are more
likely to start the correct tool for each job, without the help of the Solution Wizard.
24
DART OVERVIEW
25
DART OVERVIEW
26
Hotfix Uninstall
The Hotfix Uninstall Wizard, which Figure 13 shows, can remove hotfixes or service packs from
the offline Windows installation that you are troubleshooting. Use this tool when a hotfix or
service pack is potentially preventing the operating system from starting. Microsoft
recommends that you use this tool to uninstall only one hotfix at a time, even though the tool
allows you to uninstall more than one at a time. Be aware that programs that you have installed
or updated after installing the hotfix might not work correctly after you uninstall the hotfix.
DART OVERVIEW
27
SFC Scan
Use the System File Repair Wizard (Figure 14) to repair system files that are preventing the
Windows installation from starting. The System File Repair Wizard can automatically repair
system files that are corrupted or missing. Alternatively, the wizard can prompt you before
performing any repairs.
DART OVERVIEW
28
(Figure 15) enables you to search the PC for files. You can search for specific filename patterns in
specific paths. Additionally, you can limit results to a date range or size range. In recovery
scenarios, when repairing the installed operating system is not possible, you can use File Search
to find users documents and copy them from the PC.
DART OVERVIEW
29
tools can no longer see it or remove it. Because Windows Defender Offline scans while the
installed operating system is offline, you can attack the rootkit without it hiding from you.
Figure 16 shows Windows Defender Offline. It can help detect malware and unwanted software
and alert you to security risks. When Windows Defender Offline detects malicious or unwanted
software, it prompts you to remove, quarantine, or allow each item.
DART OVERVIEW
30
DART OVERVIEW
31
You then use the Remote Connection Viewer to connect to the DaRT tools remotely (Figure 18).
To simplify the process and reduce the amount of handholding required to get Remote
Connection started, you can optionally configure the DaRT recovery image to start Remote
Connection automatically whenever users start their PCs with the recovery image. See the DaRT
8 Help for more information.
DART OVERVIEW
32
WaitForConnection.exe. This prevents the script from continuing until either Remote
Connection is not running or a valid connection is established with the users PC.
To customize Remote Connection, modify winpeshl.ini on the Create Image page of the DaRT
Recovery Image Wizard. Listing 1 shows an example that starts Remote Connection and waits
for the connection before starting Windows RE.
Listing 1Winpeshl.ini
[LaunchApps]
"%windir%\system32\netstart.exe -network -remount"
"cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage"
"%windir%\system32\WaitForConnection.exe"
"%SYSTEMDRIVE%\sources\recovery\recenv.exe"
When DaRT starts, it creates the file inv32.xml in \Windows\System32\ on the RAM disk. This file
contains connection information: IP address, port, and ticket number. You can copy this file to a
network share to trigger a Help desk workflow. For example, a custom program can check the
network share for connection files, then create a support ticket or send email notifications.
DART OVERVIEW
| EVALUATING DART
33
Evaluating DaRT
DaRT helps IT easily recover PCs that have become unusable, rapidly diagnose probable causes
of issues, and quickly repair unbootable or locked-out systems, all without leaving their desks
and much faster than the average time it takes to reimage the machine. DaRT allows
administrators to shift desktop repair planning from reactive to proactive, saving time and
reducing the challenges associated with troubleshooting and repairing system failures. With a
plan in place, the simple image creation process, coupled with an easy to use tool menu, allows
organizations to rapidly deploy, use, and
benefit from the toolset.
DaRT is part of the Microsoft Desktop
Optimization Pack (MDOP), which is an add-on
license available to Software Assurance
customers. Begin your evaluation today:
See MDOP on TechNet. For technical information about DaRT and MDOP for Software
Assurance, see http://www.microsoft.com/technet/mdop.