den 13 maj 2012, 00:29:52
Almost the proverbial Swiss Army Knife of many an Administrator, DaRT is known to be able to get one out of trouble when needed… For those who do know of it that is, all too often I get a blank stare and total non-comprehension when asking a customer if they have it and if so, do they know how to use it?
Well, since Microsoft is just about to rev. its Desktop Optimization Pack (The Microsoft Desktop Optimization Pack 2011 R2 as it is really known is currently in beta and about to be released pretty soon.), I figured I’d write a series of blog posts about its different components and I am starting with the DaRT.
Microsoft Diagnostic and Recovery Toolkit is used to diagnose and repair non-starting or malfunctioning computers and often used as a first attempt of solving a particualr problem, before resorting to re-imaging the machine; Which although fast, most likely take longer to do and thereby being less conveniant for the user. It can also be used to break into computers one has lost access too, therefore it is advisable to remember that if left laying around or installed on machines, some of the tools in it will essentially serve as potential hacking tools.
But let’s start from the beginning. DaRT is one of the tools that you get as part of the larger packade MDOP, which is an add-on product that Microsoft’s Enterprise customers with Software Assurance can add to their licensing. The DaRT itself is free to test and play with but to be used in production it needs to be properly licensed.
Microsoft DaRT is essentially really the successor to a toolkit in wide use and popular among administrators all over the world, known as ERD Commander by Winternals (Which later changed its name to SysInternals and eventually was bought all together by Microsoft on July 17, 2006.).
One important aspect of using the DaRT is that since you boot into it, your normal installation of Windows will be as it is known – offline. I.e. as your normal Windows installation is not running in itself, a root kit for example will have a harder time of cloaking itself, as it is not running. You can also remove faulty drivers, non-functioning hotfixes and other hindrances that may stop your machine from booting properly.
So, I thought that I’d take you through the tools included in DaRT and also provide you with some information regarding system requirements and limitations.
PLEASE NOTE: DaRT v.8 is intended for the upcoming Windows 8 and Windows Server 2012 releases of Windows. If you want to try it out on anything older than that, you need to use older versions of DaRT!
From an interview that Stephen L Rose did with Craig Ashley, product manager for DaRT at Microsoft, published on the Springboard Blog on March 28, 2012, we can gather that the following is new for the upcoming release:
- Create DaRT for Windows 8 and Windows Server 2012
- Generate both 32- and 64-bit images, no matter what platform it’s made on
- Support for BIOS and UEFI (Unified Extensible Firmware Interface)
- Support for GPT (GUID Partition Table) as well as MBR (Master Boot Record) partition schemes
- Windows To Go is not supported
The Tools included in DaRT v.8 are as follows:
| Locksmith |
A tool that can reset the password for local (not domain) accounts on the machine. Great when one has forgotten the Administrator password on an old machine for example. |
| Crash Analyzer |
With help from the Crash Analyzer Wizard, one can analyze a crash dump and thereafter through either the Services & Devices node in DaRT or through Computer Management, disable whatever driver that caused the blue screen. |
| File Restore |
Can be used to restore accidentally deleted files, including such ones being too big for the Recycle Bin. It also handles restoring deleted files on Bitlocker encrypted drives, provided that you can gain access to the partition of course. |
| Diskcommander |
Recover and Repair disk partions and volumes. |
| Disk Wipe |
Securely wipes the disk to prevent restoration of deleted files. Either single-pass for consumers or four-pass wipe which is the current U.S. Department of Defense requriement. |
| Computer Management |
Get access to System Info, Event logs, manage disks, list autoruns and manage services and drivers. |
| File Explorer |
Warrents no further explanation save one, since DaRT lets you map network shares, it makes it very easy to browse the file system (including search) and then copying important files off the computer before it gets re-imaged for example. |
| SFC Scan |
System File Checker with its System File Repair Wizard, can inspect all your system files and automatically fix any errors that may cause the machine not to boot or experience weird startup behaviours. |
So… what does the toolkit look like? Let’s first take a look at the installation of it. There are three ways that you can set up DaRT in your corporate network:
- Stand-alone or from bootable media
- Remote administration from an adminsitrative console
- Remote administration with an administrative machine set up for creation and administration of the entire toolkit and one or more support workstations, where for example a helpdesk engineer can remotelly analyze and troubleshoot an user workstation.
For the remote scenarios to work, both the helpee and the helper machine need to be on the same network. There is no support for address translation or other forms of network traversal.
In my example below, I have set-up a bootable media version of the toolkit, for screenshot purposes in a Hyper-V-based virtual machine (another new roll in Windows 8 client) but I always keep a bootable USB-stick with the toolkit on my keychain.
Prerequisites:
- Windows 8 Source Files
- Windows Debugging Tools
- Assessment and Deployment Kit
- Windows Driver Kit or Software Development Kit
- Stand-alone sweeper definitions (optional)
- Symbol Files (for crash debugging)
Memory requirements:
- Windows 8 Consumer Preview (64bit) – 2,5 GB RAM
- Windows 8 Consumer Preview (32bit) – 1,5 GB RAM
- Windows Server 2012 – 1 GB RAM
Network requirements:
- Wireless is NOT supported.
Disk space requirements (important consideration for reployment scenarios for example):
- Minimum 300 MB
- Recommended 450 MB
First you need to download MDOP and install it to your machine and thereafter you can access DaRT. However as DaRT 8 is in beta still, one can download it by itself from the Microsoft Connect Site. When you launch the DaRT Recovery Image Wizard you get the following welcome screen.
Firstly, you get to choose which platform you want to build for, new for this version is that you can build for both architectures on the same physical machine. Earlier versions required bit compatibility.
Thereafter you get to choose which tools you want to include. I have choosen them all, but you don’t have to and in some cases you may not want to. For example if you decide to always deploy your DaRT-image to the recovery partition on your client machines, you most likely do not want to include Locksmith for example 
or it’d be a little bit like playing Russian Roulette with an automatic pistol – you’ll loose every time!
Note also that some of the choices here will require some extra bits to build, for example crash debugging which requries both the debugging tools to be available as well as the symbol files…
DaRT is built on top of Windows PE and thus one can of course choose what framworks and functionality in general one want to have available in Windows PE. Remember, the normal installtion will be offline as you boot to your USB-drive, so for some tools to work, you need to include for example the .Net Framwworks, DISM, Powershell etc. etc.
This is where you point to your debugging tools. They have to be installed on the machine where you are building your media. The debugging tools can come out of the WDK (Windows Driver Kit) or the SDK (Software Development KIt) but should be the latest available at the time of building your media.
What kinds of media do you want to build?
- WIM – bootable Windows PE image
- ISO – bootable WIndows PE image
- Powershell Script – will automatically build the same thing as you have now, at a later time.
After this the wizard will go ahead and create your files and unless you’ve specified differently above, you’ll find them in a folder on the desktop.
This is what you will see once you boot to your image. First you get to choose language settings etc. which I haven’t included a screenshot of. Then you’ll get this screen.
Here you can optionally exit the DaRT image and go ahead and boot into your regular system, or you can decide to troubleshoot. Let’s choose troubleshoot…
The next step will allow for either refreshing or reseting your machine. The difference being that the first one keeps your personal files and settings whereas a reset doesn’t. Let’s quickly look behind the Advanced Options tab to see what we find there…
Here you can revert to a System Restore point, if you have such, or apply a System Image Recovery image. You can also let DaRT try and automatically check for errors in your machine’s settings, automatically fix them and restart.
But let’s say that neither of those work either, so we hit the back arrow and then let’s click MIcrosoft Diagnostic and Recovery Toolset…
This is the gut of the tool, where all the most powerful tools are located. They can help you tremendously but please remember that it is very easy to shoot yourself in the foot with them too… so I urge you to practice on an functioning non-productive machine before you have to use the tool in action for real the first time.
Most of these tools have been covered up above in this blogpost… yet I will most likely return to these and cover them in more detail in future posts… please let me know if you’d find this useful and I’ll try to prioritize it.
Thanks! I hope you’ve found this post informative and useful. DaRT is an increadibly powerful tool and I am sure, that if you are not already a fan – you will be once you try it out!
/MIke
This post was orginally posted by michand at Michael Anderberg's Blog. Thank you for supporting the original blog and author.