This article, the third of seven in a series covering the Microsoft Desktop Optimization Pack (MDOP), will detail the Diagnostic and Recovery Toolset (DaRT).

No matter how well managed an IT environment is, unbootable machines are a fact of life. While IT administrators use a variety of methods to repair these machines, few compare to the Diagnostic and Recovery Toolset (DaRT). Now in the seventh major release, DaRT comprises of 14 tools designed to tackle the toughest problems with an unbootable machine.


The Diagnostics and Recovery Toolset welcome screen displays all included tools.

DaRT components ^

  1. Registry Editor: a registry editor capable of modifying an offline operating system
  2. Explorer: the familiar explorer interface that is even capable of mapping network drives. Very handy for uploading logs, crash files, or backing up data
  3. Locksmith: a local user password reset tool
  4. Solution Wizard: an automated tool designed to help you (or more specifically, an end user) choose the correct repair tool
  5. Crash Analyzer: an offline Windows debugger capable of pinpointing troublesome drivers
  6. TCP/IP Config: a tool used to change the DaRT IP configuration
  7. File Restore: this tool provides file restoration of accidentally deleted files even on Bitlocker encrypted drives
  8. Hotfix Uninstaller: when a hotfix makes a machine unbootable, this tool can remove the hotfix
  9. Disk Commander: a handy tool to repair volumes, master boot records, or partitions
  10. SFC Scan: the System File Repair wizard can repair systems files that are preventing Windows from loading
  11. Disk Wipe: capable of wiping a disk or volumes with a single pass or four pass overwriting
  12. Search: a simple file search tool that is useful before reimaging a computer
  13. Computer Management: the all-inclusive MMC from Windows – now in a Windows PE format
  14. Standalone System Sweeper: an offline malicious software remover capable of deletion and quarantine
  15. And finally, though technically not a tool for system recovery, the Remote Connection interface allows Windows Administrators to remotely connect to a machine in a Windows PE environment.

While most Windows administrators would simply image a machine if it became unbootable, the specific tools in DaRT are nearly always faster and more specific in their troubleshooting. Further, tools such as the crash analyzer and hotfix uninstaller help to increase the stability of images by sorting out bugs rather than simply reimaging.

DaRT recovery image deployment method ^

There are a variety of ways to deploy DaRT for client use. The most common are CD/DVD, USB, embedded during initial workstation imaging, and network bootable. The table below outlines major benefits to each:

Distribution MethodPositiveNegative
CD/DVDNearly all machines capable of booting off media, most familiar technologyBoot image becomes outdated quickly requiring new media to be produced and distributed
USBFaster than CD/DVD, easier to carryBoot images not updated become obsolete, easier to lose
EmbeddedNo need to carry around media, very quick to bootImage may not be available if hard drive fails, difficult to distribute updates.
NetworkNo physical media, updates very easy to distributeNot as quick as USB or embedded on boot up.

Deploying the DaRT recovery image ^

Most organizations, except those with a measurable percentage of non-networked machines, will probably choose to distribute their DaRT recovery image as a Windows Deployment Server boot image. This makes DaRT available to any machine capable of PXE booting. To create the recovery image, first install the DaRT 7 tools (these include the recovery image maker, online crash analyzer, and remote connection viewer). Next, launch the DaRT Recovery Image Wizard.

DaRT Recovery Image Wizard

The first screen of the DaRT Recovery Image Wizard

After specifying the Windows source files for the recovery image creation,