mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-25 11:47:23 +00:00
* Updated deployment-vdi-windows-defender-antivirus.md * Updated deployment-vdi-windows-defender-antivirus.md * Updated deployment-vdi-windows-defender-antivirus.md * updates for new vdi stuff * Adding important note to solve #3493 * Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> * Typo "<"→"<", ">"→">" https://docs.microsoft.com/en-us/windows/application-management/manage-windows-mixed-reality * Issue #2297 * Update windows/security/identity-protection/hello-for-business/hello-identity-verification.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> * Clarification * Update windows/security/identity-protection/hello-for-business/hello-identity-verification.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> * Update windows/security/identity-protection/hello-for-business/hello-identity-verification.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * update troubleshoot-np.md * update configure-endpoints-gp.md * Removing a part which is not supported * Name change * update troubleshoot-np.md * removed on-premises added -hello * Added link into Domain controller guide * Line corections * corrected formatting of xml code samples When viewing the page in Win 10/Edge, the xml code samples stretched across the page, running into the side menu. The lack of line breaks also made it hard to read. This update adds line breaks and syntax highlighting, replaces curly double quotes with standard double quotes, and adds a closing tag for <appv:appconnectiongroup>for each code sample * Update windows/security/identity-protection/hello-for-business/hello-identity-verification.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> * Update windows/deployment/update/waas-delivery-optimization-reference.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> * Update windows/deployment/update/waas-delivery-optimization-reference.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> * corrected formating of XML examples The XML samples here present the same formatting problems as in about-the-connection-group-file51.md (see https://github.com/MicrosoftDocs/windows-itpro-docs/pull/3847/) Perhaps we should open an issue to see if we have more versions of this code sample in the docs * corrected formatting of XML example section In the XML example on this page, the whitespace had been stripped out, so there were no spaces between adjacent attribute values or keys. This made it hard to read, though the original formatting allowed for a scroll bar, so the text was not running into the side of the page (compare to https://github.com/MicrosoftDocs/windows-itpro-docs/pull/3847 and https://github.com/MicrosoftDocs/windows-itpro-docs/pull/3850, where the uncorrected formatting forced the text to run into the side menu). * update configure-endpoints-gp.md * Fixed error in registry path and improved description * Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> * Removing extra line in 25 Suggested by * update windows-analytics-azure-portal.md * re: broken links, credential-guard-considerations Context: * #3513, MVA is being retired and producing broken links * #3860 Microsoft Virtual Academy video links This page contains two links to deprecated video content on Microsoft Virtual Academy (MVA). MVA is being retired. In addition, the Deep Dive course the two links point to is already retired, and no replacement course exists. I removed the first link, as I could not find a similar video available describing which credentials are covered by credential guard. I replaced the second link with a video containing similar material, though it is not a "deep dive". Suggestions on handling this problem, as many pages contain similar links, would be appreciated,. * removed link to retired video re: #3867 Context: * #3513, MVA is being retired and producing broken links * #3867, Microsoft Virtual Academy video links This page contains a broken link to deprecated video content on Microsoft Virtual Academy (MVA). MVA is being retired. In addition, the Deep Dive course is already retired, and no replacement course exists. I removed the whole _See Also_ section, as I could not find a video narrowly or deeply addressing how to protect privelaged users with Credential Guard. The most likely candidate is too short and general: https://www.linkedin.com/learning/cism-cert-prep-1-information-security-governance/privileged-account-management * addressing broken mva links, #3817 Context: * #3513, MVA is being retired and producing broken links * #3817, Another broken link This page contains two links to deprecated video content on Microsoft Virtual Academy (MVA). MVA is being retired. In addition, the Deep Dive course the two links point to is already retired, and no replacement course exists. I removed the first link, as we no longer have a video with similar content for a similar audience. The most likely candidate is https://www.linkedin.com/learning/programming-foundations-web-security-2/types-of-credential-attacks, which is more general and for a less technical audience. I removed the second link and the _See Also_ section, as I could not find a similar video narrowly focused on which credentials are covered by Credential Guard. Most of the related material available now describes how to perform a task. * Update deployment-vdi-windows-defender-antivirus.md * typo fix re: #3876; DMSA -> DSMA * Addressing dead MVA links, #3818 This page, like its fellows in the mva-links label, contains links to a retired video course on a website that is retiring soon. The links listed by the user in issue #3818 were also on several other pages, related to Credentials Guard. These links were addressed in the pull requests #3875, #3872, and #3871 Credentials threat & lateral threat link: removed (see PR #3875 for reasoning) Virtualization link: replaced (see #3871 for reasoning) Credentials protected link: removed (see #3872 for reasoning) * Adding notes for known issue in script Solves #3869 * Updated the download link admx files Windows 10 Added link for April 2018 and Oct 2018 ADMX files. * added event logs path Referenced : https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard * Update browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md Suggestions applied. Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> * Update browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> * Update deployment-vdi-windows-defender-antivirus.md * screenshot update * Add files via upload * update 4 scrrenshots * Update deployment-vdi-windows-defender-antivirus.md * Update browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> * Update browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> * Re: #3909 Top link is broken, #3909 > The link here does not work: > Applies to: Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) The link to the pdf describing MDATP was broken. Thankfully, PR #2897 updated the same link in another page some time ago, so I didn't have to go hunting for an equivalent * CI Update * Updated as per task 3405344 * Updated author * Update windows-analytics-azure-portal.md * added the example query * Updated author fields * Update office-csp.md * update video for testing * update video * Update surface-hub-site-readiness-guide.md line 134 Fixed video link MD formatting * fixing video url * updates from Albert * Bulk replaced author to manikadhiman * Bulk replaced ms.author to v-madhi * Latest content is published (#371) * Added 1903 policy DDF link and fixed a typo * Reverted the DDF version * Latest update (#375) * Update deployment-vdi-windows-defender-antivirus.md * Update deployment-vdi-windows-defender-antivirus.md
208 lines
9.5 KiB
Markdown
208 lines
9.5 KiB
Markdown
---
|
|
title: How to Recover Remote Computers by Using the DaRT Recovery Image
|
|
description: How to Recover Remote Computers by Using the DaRT Recovery Image
|
|
author: msfttracyp
|
|
ms.assetid: c0062208-39cd-4e01-adf8-36a11386e2ea
|
|
ms.reviewer:
|
|
manager: dansimp
|
|
ms.author: tracyp
|
|
ms.pagetype: mdop
|
|
ms.mktglfcycl: support
|
|
ms.sitesec: library
|
|
ms.prod: w10
|
|
ms.date: 08/30/2016
|
|
---
|
|
|
|
|
|
# How to Recover Remote Computers by Using the DaRT Recovery Image
|
|
|
|
|
|
Use the Remote Connection feature in Microsoft Diagnostics and Recovery Toolset (DaRT) 10 to run the DaRT tools remotely on an end-user computer. After the end user provides the administrator or help desk worker with certain information, the IT administrator or help desk worker can take control of the end user's computer and run the necessary DaRT tools remotely.
|
|
|
|
If you disabled the DaRT tools when you created the recovery image, you still have access to all of the tools. All of the tools, except Remote Connection, are unavailable to end users.
|
|
|
|
**To recover a remote computer by using the DaRT recovery image**
|
|
|
|
1. Boot an end-user computer by using the DaRT recovery image.
|
|
|
|
You will typically use one of the following methods to boot into DaRT to recover a remote computer, depending on how you deploy the DaRT recovery image. For more information about deploying the DaRT recovery image, see [Deploying DaRT 10](deploying-dart-10.md).
|
|
|
|
- Boot into DaRT from a recovery partition on the problem computer.
|
|
|
|
- Boot into DaRT from a remote partition on the network.
|
|
|
|
For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md).
|
|
|
|
Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user.
|
|
|
|
**Note**
|
|
Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization.
|
|
|
|
|
|
|
|
~~~
|
|
As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears.
|
|
~~~
|
|
|
|
2. When you are asked whether you want to initialize network services, select one of the following:
|
|
|
|
**Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address.
|
|
|
|
**No** - skip the network initialization process.
|
|
|
|
3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process.
|
|
|
|
4. On the **System Recovery Options** dialog box, select a keyboard layout.
|
|
|
|
5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver.
|
|
|
|
6. Select the installation that you want to repair or diagnose, and then click **Next**.
|
|
|
|
**Note**
|
|
If the Windows Recovery Environment (WinRE) detects or suspects that Windows 10 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about how to resolve this issue, see [Troubleshooting DaRT 10](troubleshooting-dart-10.md).
|
|
|
|
|
|
|
|
~~~
|
|
If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available.
|
|
|
|
The **System Recovery Options** window appears and lists various recovery tools.
|
|
~~~
|
|
|
|
7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset**.
|
|
|
|
8. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**.
|
|
|
|
The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information.
|
|
|
|
9. On the help desk computer, open the **DaRT Remote Connection Viewer**.
|
|
|
|
10. Click **Start**, click **All Programs**, click **Microsoft DaRT 10**, and then click **DaRT Remote Connection Viewer**.
|
|
|
|
11. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information.
|
|
|
|
**Note**
|
|
This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer.
|
|
|
|
|
|
|
|
12. Click **Connect**.
|
|
|
|
The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely.
|
|
|
|
**Note**
|
|
A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32.
|
|
|
|
|
|
|
|
**To customize the Remote Connection process**
|
|
|
|
1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413).
|
|
|
|
Specify the following commands and parameters to customize how a remote connection is established with an end-user computer:
|
|
|
|
<table>
|
|
<colgroup>
|
|
<col width="33%" />
|
|
<col width="33%" />
|
|
<col width="33%" />
|
|
</colgroup>
|
|
<thead>
|
|
<tr class="header">
|
|
<th align="left">Command</th>
|
|
<th align="left">Parameter</th>
|
|
<th align="left">Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr class="odd">
|
|
<td align="left"><p><strong>RemoteRecovery.exe</strong></p></td>
|
|
<td align="left"><p>-nomessage</p></td>
|
|
<td align="left"><p>Specifies that the confirmation prompt is not displayed. <strong>Remote Connection</strong> continues just as if the end user had responded "Yes" to the confirmation prompt.</p></td>
|
|
</tr>
|
|
<tr class="even">
|
|
<td align="left"><p><strong>WaitForConnection.exe</strong></p></td>
|
|
<td align="left"><p>none</p></td>
|
|
<td align="left"><p>Prevents a custom script from continuing until either <strong>Remote Connection</strong> is not running or a valid connection is established with the end-user computer.</p>
|
|
<div class="alert">
|
|
<strong>Important</strong><br/><p>This command serves no function if it is specified independently. It must be specified in a script to function correctly.</p>
|
|
</div>
|
|
<div>
|
|
|
|
</div></td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
|
|
|
|
2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT:
|
|
|
|
``` syntax
|
|
[LaunchApps]
|
|
"%windir%\system32\netstart.exe -network -remount"
|
|
"cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage"
|
|
"%windir%\system32\WaitForConnection.exe"
|
|
"%SYSTEMDRIVE%\sources\recovery\recenv.exe"
|
|
```
|
|
|
|
When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the RAM disk. This file contains connection information: IP address, port, and ticket number. You can copy this file to a network share to trigger a Help desk workflow. For example, a custom program can check the network share for connection files, and then create a support ticket or send email notifications.
|
|
|
|
**To run the Remote Connection Viewer at the command prompt**
|
|
|
|
1. To run the **DaRT Remote Connection Viewer** at the command prompt, specify the **DartRemoteViewer.exe** command and use the following parameters:
|
|
|
|
<table>
|
|
<colgroup>
|
|
<col width="50%" />
|
|
<col width="50%" />
|
|
</colgroup>
|
|
<thead>
|
|
<tr class="header">
|
|
<th align="left">Parameter</th>
|
|
<th align="left">Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr class="odd">
|
|
<td align="left"><p>-ticket=<<em>ticketnumber</em>></p></td>
|
|
<td align="left"><p>Where <<em>ticketnumber</em>> is the ticket number, including the dashes, that is generated by Remote Connection.</p></td>
|
|
</tr>
|
|
<tr class="even">
|
|
<td align="left"><p>-ipaddress=<<em>ipaddress</em>></p></td>
|
|
<td align="left"><p>Where <<em>ipaddress</em>> is the IP address that is generated by Remote Connection.</p></td>
|
|
</tr>
|
|
<tr class="odd">
|
|
<td align="left"><p>-port=<<em>port</em>></p></td>
|
|
<td align="left"><p>Where <<em>port</em>> is the port that corresponds to the specified IP address.</p></td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
|
|
|
|
~~~
|
|
**Note**
|
|
The variables for these parameters are created on the end-user computer and must be provided by the end user.
|
|
~~~
|
|
|
|
|
|
|
|
2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified.
|
|
|
|
## Related topics
|
|
|
|
|
|
[Operations for DaRT 10](operations-for-dart-10.md)
|
|
|
|
[Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|