# <windows 2000 root>\system32\ntoskrnl.exe corrupt or missing



## tech-it-^

Hello All,

I've been having a lot of issues with a Windows 2000 Advanced server box. One of my colleagues was working on this server, and the next time they rebooted the system, they recieved the following error:



Code:


Windows 2000 could not start because the following file is missing or corrupt:

<windows 2000 root>\system32\ntoskrnl.exe.
Please re-install a copy of the above file

Now, I assumed that something was wrong with the boot.ini file and double checked this error online. I see the same solution for everything... Use your Windows disc to go into recovery console to fix the boot.ini, HDD, or insert/overwrite the ntoskrnl.exe file(s). I can't even do this though. When I boot the disc and try to go into recovery console (through Windows 2003 disc), after hitting R, no windows installations show up. So it makes me reboot. I know it exists, because I can get to the boot.ini through a UBCD. What it gives me is below. 



Code:


[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(3)\WINNT="Microsoft Windows 2000 Advanced Ser"

I recieve the a BSOD when trying to boot a Windows 2000 Server disc to get to recover console. See the attachment (sorry about the picture quality).


I've tried running the last known good configuration, using recovery console, FW updates... But nothing. Microsoft had a "solution" to the problem but it all required using the recovery console. Which I can't do, especially because it can't see the Windows 2000 Advance Server partition. It's not hardware related because I can see the RAID array and both disks are online (PowerEdge 1855). So I'm stumped, any help would be greatly appreciated. Thank you.


----------



## testengeer

With few choices, I see two possible solutions. 1). If you can boot to a command prompt, you should me able to copy the file from the CD and paste it to the hard drive.

2). CAREFUL!!, Instead of using the recovery console just choose to reinstall Windows. One of the options after you choose this is to "Repair a Windows Installation." Now here is the dangerous part. If you use a Microsoft Windows disk, it should just repair Windows files and leave all your other apps and files in place. But, I've seen some Windows disks that come from your server manufacturer that look like they will just repair Windows, but in fact will over write everything and return the server to the original factory config. 

It might be wise to upgrade to Server 2003 now. Should fix the problem and upgrade your system. Server 2003 is pretty cheap now since it is an older OS.

I would play around with this on another pc before attempting it on your server or at least try to back up all data before attempting it. Good Luck and I hope I've given you a couple of options to consider.


----------



## tech-it-^

Well... I can get to recovery console if I use a Win2k3 CD and load the PERC drivers for the controller... It wont work even by doing this with the Win2k server CD though. I'm running a chkdsk /r, and hopefully it will fix the issue if not, then maybe I can try something else. We can't upgrade this server if data still resides on the disks. Thank you for the info though.


----------



## tech-it-^

I don't think the chkdsk will work with the win2k3 CD when this is a win2k advance server box... I'm stumped here.


----------



## TheOutcaste

Stop 7B with the 2nd parameter of 0xC0000034 usually means it's missing the driver for the disk drive controller. If it's SATA or RAID, you need to provide the drivers on a floppy disk and press F6 when prompted right at the start after booting with the Win2K CD.

The partition numbers in the boot.ini don't match:


Code:


[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(3)\WINNT="Microsoft Windows 2000 Advanced Ser"

I'd create one with a few options, see if that's the problem:


Code:


[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(3)\WINNT="Microsoft Windows 2000 Advanced Ser"
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Part 1"
multi(0)disk(0)rdisk(0)partition(2)\WINNT="Part 2"
multi(0)disk(0)rdisk(0)partition(3)\WINNT="Part 3"

Then try each of the three options to see which partition it should be.

If you don't even see the menu with the choices, then the system is not reading that boot.ini.

chkdsk from the W2k3 disk should run with no problems, it'll be backwards compatible, but I wouldn't run the Win2K version on a Win2k3 system, as it may not understand the changes in the newer version of NTFS.

Have you checked to be sure the *ntoskrnl.exe* file is present?
You can use the UBCD to rename the current one and copy one from the CD or the *Winnt\System32\dllcache* folder.

Just be sure to use the correct file.
*NTKRNLMP.EXE* renamed to *NTOSKRNL.EXE* if a multiprocessor or multicore system, or the one already named *NTOSKRNL.EXE* if a single processor and singlecore system.
If you mix the versions of the *hal.dll, ntoskrnl.exe, and ntkrnlpa.exe* files, the system might not boot.


----------



## tech-it-^

Alright,

I did try loading the controllers driver and using the Win2k disc to get to the recover console but I would still get that error (BSOD that you've seen in my first post). The Win2k3 disc worked though. I ran the chkdsk /r and I let it finish. Rebooted and I still get the same ntoskrnl.exe error. So I moved on to your second approach with modifiying the boot.ini file with the extra boot options. When I pulled up the boot.ini I noticed that the partition information has changed from partition 1 to 3... Like this:



Code:


[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(3)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(3)\WINNT="Microsoft Windows 2000 Advanced Server"

I then added the information you suggested, saved, and rebooted the system. The boot screen did come up with four options:



Code:


Microsoft Windows 2000 Advance Server
Part 1
Part 2
Part 3

So it is seeing that file. Now as far as replacing the ntoskrnl.exe file via UBCD. How would I got about doing that exactly? I tried doing it via recovery console by doing expand d:\i386\ntoskrnl.ex_ c:\windows\system32... But I get Access denied. How should I proceed? Thanks.


----------



## TheOutcaste

On Win2K the Windows folder is *WINNT*, not *WINDOWS*.
The default settings for the Recovery Console only allows access to the SystemRoot folder, and the root of the drive, so it gives an Access Denied message even for folders that don't exist.
If the files are present in the DLL cache, this should work:


Code:


Copy C:\Winnt\System32\dllcache\ntoskrnl.exe C:\Winnt\System32

Or if you need the multiprocessor or multicore version:


Code:


Copy C:\Winnt\System32\dllcache\ntkrnlmp.exe C:\Winnt\System32\ntoskrnl.exe

If not present you can copy them from the Win2K CD.


----------



## tech-it-^

Alright,

Well I tried doing the following on the multicore system:



Code:


Copy C:\Winnt\System32\dllcache\ntkrnlmp.exe C:\Winnt\System32\ntoskrnl.exe

the file did not exist. So I tried copying it off of the Win2k CD to the directory itself, like so:



Code:


Copy D:\I386\ntkrnlmp.ex_ C:\Winnt\System32\ntoskrnl.exe

It asked if I'd like to overwrite the file, I said yes. I reboot the server and the same error message shows up. So that did not work. Is there anything else I can do? Thanks for the help.


----------



## TheOutcaste

Check here for a copy of the file:
*C:\WinNT\servicepackfiles\i386*
If the file on the CD is an older version (no SP) and the system has SP4, a version mismatch might cause the same error.

Did you try all 3 partition options from the modified boot.ini file?


tech-it-^ said:


> One of my colleagues was working on this server


By any chance did they disconnect and reconnect the hard drive(s)?
If they changed jumpers, or hooked it back to a different controller, the disk number might be different. The BIOS just looks for an Active partition to start the boot process, it doesn't care what the number of the disk is, but the Boot.ini file looks at a specific disk (the rdisk(x) number).
Here's a generic boot.ini you can use when you are not sure of the drive or partition the OS is on:


Code:


[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="OS on Disk 1 Partition 1 (WinNT)"
multi(0)disk(0)rdisk(0)partition(2)\WINNT="OS on Disk 1 Partition 2 (WinNT)"
multi(0)disk(0)rdisk(0)partition(3)\WINNT="OS on Disk 1 Partition 3 (WinNT)"
multi(0)disk(0)rdisk(0)partition(4)\WINNT="OS on Disk 1 Partition 4 (WinNT)"
multi(0)disk(0)rdisk(1)partition(1)\WINNT="OS on Disk 2 Partition 1 (WinNT)"
multi(0)disk(0)rdisk(1)partition(2)\WINNT="OS on Disk 2 Partition 2 (WinNT)"
multi(0)disk(0)rdisk(1)partition(3)\WINNT="OS on Disk 2 Partition 3 (WinNT)"
multi(0)disk(0)rdisk(1)partition(4)\WINNT="OS on Disk 2 Partition 4 (WinNT)"

I'm still puzzled by why the Win2K disk won't work and the Win2k3 disk does. i wouldn't think the Recovery Console is that different.


----------



## tech-it-^

I did not disconnect any of the drives. Apparently, a colleague was uninstalling an application (Citrix), and after the reboot, the system didn't want to come back up. 

As far as looking in this location: C:\WinNT\servicepackfiles\i386 it does not exist. Even though they have patched Windows 2000 to SP4. I did try modifying the boot.ini and even though I seen the changes (the different options) that did not fix the problem, nor did the version that you just posted with the options for disk 1 and 2. So... I'm pretty confused as to why this is still not working.


----------



## TheOutcaste

I'm pretty much out of ideas as well. One more thing comes to mind; try replacing the *NTLDR* file with the version from the Win2003 CD.
Here's my thinking:
The *Windows could not start because the following file is missing or corrupt: <windows 2000 root>\system32\ntoskrnl.exe* error occurs if the *Boot.ini* file does not point to a valid *<windows 2000 root>* folder (be it named Windows, WINNT, or even FRED, boot.ini just has to have the right name).
If *NTLDR* can't find the *boot.ini* file, it looks for a *Windows* folder on the same partition that *NTLDR* resides on. I don't know if *NTLDR* looks for either WinNT or Windows, or just Windows, or if different versions of NTLDR are different in that respect.

It's displaying the boot menu so it's finding the *boot.ini* file, so we are past that point anyway.

The next step in the boot process *NTLDR* loads *ntdetect.com*
After *ntdetect.com* does it's detection, *NTLDR* loads *ntoskrnl.exe* and *hal.dll* from the chosen boot location.
At this point you can get *ntoskrnl.exe* or *hal.dll* errors if they are missing or corrupt.

*NTLDR* is version dependent. Newer versions are backwards compatible, so for example if you replace the XP version with the Win2K version, XP won't boot, but you can use the Win 2003 version as it knows about the previous versions of Windows.

I still don't understand how any of that would prevent the Win2K Recovery Console from being able to access the drive after loading the PERC drivers, while the Win2K3 version works unless the version of the PERC drivers is just not compatible with the Win2K Recovery Console. If the driver requires SP4 but the Win2K disk is an earlier version that might be possible.


----------



## djaburg

Having read through this I know what I might try depending on the kind of RAID you're running...providing you're running RAID. If you're running a mirrored array with IDE drives, you could try something that I've had to resort to before. I had to take one of the mirrored IDE drives (imaging it of course before I did ANYTHING else) from the array and hook it to the standard IDE port on the mobo and then run through the process of the repair install to get things running again. After ensuring that everything was fixed I also made sure the drivers for the RAID controller were installed. Then I put the drive back in to the array, rebuilding it using the known good drive as the source for the rebuild. Once that finished, I was able to reboot as normal and it worked. It was surely a tedious process, but it worked. Of course if you're running RAID5 or RAID0, that won't work.


----------



## tech-it-^

Alright,

I put the old boot.ini information back and then I replaced both the NTLDR and ntdetect.com files from the Win2k3 disc like so:



Code:


copy D:\i386\NTLDR C:\
copy D:\i386\ntdetect.com C:\

I then rebooted the system, and now I am experiencing a different error message:



Code:


Windows could not start because the following file is missing or corrupt
<windows root>\system32\hal.dll
Please reinstall a copy of the above file.

I think this is better right? What should I do now?


----------



## TheOutcaste

Double check the *boot.ini* file for typos. Something as simple as a single space in front of *[boot loader]* will cause the missing *hal.dll* error.
These three files, *hal.dll*, *ntoskrnl.exe*, and *ntkrnlpa.exe*, are closely tied together. Mismatched types (single mixed with multi core) or different versions can cause boot failures.
I'd replace all three files from the same source, either the Win2K CD, or the *dllcache* folder on the drive.
If the *hal.dll* files are not in the *dllcache* folder, check the *driver.cab* file. There should be a copy here:
*C:\WINNT\Driver Cache\i386\driver.cab*
(May also be a copy of the other files here as well)
Use this command to extract and rename the files if needed:


Code:


expand [I]drive[/I]:\i386\driver.cab /F:[I]filename[/I] %systemroot%\system32\[I]filename[/I]

.

I'm not sure if using the Win2K3 versions would work. *NTLDR* is designed to be backwards compatible, but the other files might not be.

There are 7 different versions of the *hal.dll* file. When Windows is installed, it selects the correct file from one of the following and renames it to *hal.dll*


Code:


HAL File Copied    Computer Description in Device Manager
Halmacpi.dll       ACPI Multiprocessor PC
Halaacpi.dll       ACPI Uniprocessor PC
Halacpi.dll        Advanced Configuration and Power Interface (ACPI) PC
Halmps.dll         MPS Multiprocessor PC
Halapic.dll        MPS Uniprocessor PC
Hal.dll            Standard PC
Halsp.dll          Compaq SystemPro Multiprocessor or 100% Compatible

The first three are the most common. If you have two processors, or a dual/quad core processor, the *ACPI MultiProcessor PC* hal (*halmacpi.dll*) is the one to use.
If a Single core/Single processor, one of the next two should be chosen, *Halaacpi.dll* or *Halacpi.dll*.
There are two other files that are tied to the *hal.dll*. They are:
*ntoskrnl.exe
ntkrnlpa.exe*
For single processor systems, the files are named the same as above.
For multi-processor systems, these two files get renamed:
*ntkrnlmp.exe* -> *ntoskrnl.exe
ntkrpamp.exe* -> *ntkrnlpa.exe*


----------



## tech-it-^

I'll keep working on this. I'll try and get those files over ASAP. Luckily, we have another server with the same application on it. We can use that. Thank you for all of your help


----------

