Situation
In an effort to improve the recovery
options available to users who
experienced system failures on their
Windows-based PCs, Microsoft IT
deployed the Microsoft Diagnostics and
Recovery Toolset 7.0 (DaRT).
Microsoft IT Implements Microsoft
Diagnostics and Recovery Toolset 7.0
Published: March 2012
The following content may no longer reflect Microsoft’s current position or infrastructure. This
content should be viewed as reference documentation only, to inform IT business decisions
within your own company or organization.
Solution
DaRT allows administrators to easily
recover unusable PCs, rapidly diagnose
probable causes of issues, and quickly
repair unbootable or locked-out systems,
all without requiring users to leave their
PCs.
Benefits
 Accelerated IT responsiveness and
streamlined PC manageability
 Boot DaRT remotely reducing time
lost for users in remote locations
 Multiple deployment options : local
drive, network-based, and remote
boot
 Improved employee experience and
positively impacted productivity
Products & Technologies
 Microsoft Desktop Optimization Pack
for Software Assurance
 Microsoft Diagnostics and Recovery
Toolset
 Microsoft Windows 7
Learn how Microsoft Information Technology (Microsoft IT) deployed
Microsoft® Diagnostics and Recovery Toolset 7.0 (DaRT) to help
troubleshoot, repair, and recover Windows®-based PCs. DaRT is part
of the Microsoft Desktop Optimization Pack (MDOP) suite of
technologies and provides administrators with the ability to recover
unusable PCs, diagnose issues and causes, and repair unbootable or
locked-out systems. By making DaRT available to Help Desk
Technicians and corporate network connected users worldwide,
Microsoft IT enabled Help Desk Technicians and users to work
together through a remote connection to troubleshoot and repair
system issues.
A common challenge among corporate IT departments is the continued effort to streamline
and improve processes while improving the user experience and reducing costs. To do this,
many IT departments take a proactive approach to ensuring network stability and to backing
up network data. However, they tend to be reactive in planning for desktop system failures.
When a system failure does occur and the desktop becomes unbootable, the most common
solution is to reimage the machine. However, reimaging a machine can result in loss of user
settings, personalization, and data; and machine reimaging is a costly and time-consuming
process.
After reviewing the current issues and user experiences related to desktop system failures,
Microsoft was compelled to find a proactive, efficient, and reliable way to resolve desktop
system failures. As the company's first and best customer, Microsoft IT regularly adopts early
releases of Microsoft technologies, tests them in a real-world environment, and provides
critical feedback to improve products before they are generally available to the public. In this
situation, the Microsoft Diagnostics and Recovery Toolset 7.0 was a viable solution for
Microsoft IT to evaluate and to determine if it met their business needs and goals. Microsoft
IT had three primary objectives. First, they wanted to provide users who had unbootable or
locked-out systems with alternative solutions to machine reimaging. Second, they realized it
was important to deploy a solution that could provide Help Desk Technicians with the ability
to connect to user machines remotely. And third, they wanted to provide users with selfservice capabilities that could reduce user down time.
Solution
With the Microsoft Diagnostics and Recovery Toolset 7.0 (DaRT), IT administrators can
easily recover PCs that have become unusable, rapidly diagnose probable causes of issues,
and quickly repair unbootable or locked-out systems. DaRT is a powerful toolset that extends
the Windows Recovery Environment (Windows RE), enabling more effective troubleshooting
and repair of Windows-based desktops.
Creating the DaRT Recovery Image
The first step in deploying DaRT is to create a DaRT Recovery Image. The DaRT Recovery
Image is the central component of the DaRT platform and is a bootable system image file
used to boot in parallel on an unstable desktop. The customizable DaRT Recovery Image
can contain some or all of the 14 DaRT tools and can include additional tools, drivers, and
files for specific organization hardware and troubleshooting requirements.
Note: DaRT is built on top of the Windows Recovery Environment and is deployed as a
temporary, local installation of the recovery OS into the user machine's memory. DaRT does
not remain on the machine after the repair is completed.
Deployment Options
DaRT includes flexible deployment options that meet a variety of organizational needs,
including:

Removable media (USB or CD) enables IT administrators to boot from DaRT manually
on a per-machine basis.

Local hard drive installation performed manually or using operating system
imaging tools like Microsoft System Center Configuration Manager 2007 or the
Microsoft Deployment Toolkit 2010 can deploy DaRT in a separate partition as part of
installing the operating system.

Windows Deployment Services (WDS) server configured to work via PXE can be
the quickest and simplest way to make the DaRT Recovery Image available to network
connected users in production.
Toolset
The Microsoft Diagnostics and Recovery Toolset is comprised of a robust set of tools that
enables Help Desk Technicians to quickly repair unbootable systems without reinstalling or
reimaging the operating system. DaRT users can also reset local passwords, detect and
remove malware, restore lost files, and perform many other recovery and repair tasks. The
toolset includes:

Registry Editor enables registry edits focused on helping repair systems that will not
boot or edit values that the installed Windows operating system locks while it is running.

Locksmith permits password resets for any local account (not domain accounts) on the
Windows operating system that is being repaired; in the event that a password is
unknown or forgotten.

Crash Analyzer can quickly determine the cause of an issue by analyzing the memory
dump file on the Windows operating system under repair.

File Restore attempts to restore permanently deleted files, including files within volumes
that have been deleted.
MICROSOFT IT IMPLEMENTS MICROSOFT DIAGNOSTICS AND RECOVERY TOOLSET 7.0 Page 2

Disk Commander allows recovery and repair of disk partitions and/or volumes.

Disk Wipe can erase all data from a disk or volumes by using a single-pass overwrite or
four-pass overwrite, the latter of which meets U.S. Department of Defense standards.

Computer Management console diagnoses and repairs problems that can prevent the
Windows operating system from booting.

Explorer browses the computer’s file system and network shares, allowing access to
important data that the user stored on the local drive before you try to repair or reimage
the computer.

Solution Wizard helps determine which tool to use when the user is not familiar with the
tools in DaRT.

TCP/IP Config tool enables manual TCP/IP configuration.

Hotfix Uninstall can remove hotfixes or service packs from the Windows operating
system on the computer that is being repaired.

SFC Scan starts the System File Repair Wizard, which can automatically repair system
files that are corrupted or missing.

Search opens a File Search window that can be used to find documents when the file
path is unknown or to search for general kinds of files across all local hard disks.

Standalone System Sweeper scans a computer for and removes malware while the
installed Windows operating system is not running and, therefore, is able to identify and
remove viruses like root kits.

Remote Connection remotely runs the DaRT tools on an end-user computer.
MSIT’s Solution
To take full advantage of the Microsoft Diagnostics and Recovery Toolset, Microsoft IT
created their DaRT Recovery Image as a lightweight image generated alongside the
Windows 7 OS image to ensure that it met all hardware and driver requirements and
standards. Using Windows Deployment Services (WDS), Microsoft IT published DaRT as a
selectable image enabling users to PXE boot and access the recovery tools. This deployment
method provided users with the ability to load and use the toolset on demand.
Implementation
Pilot Deployment
In April 2011, Microsoft IT designed a pilot program to test and validate DaRT before
deploying it across all corporate domains. The pilot program's first task was to build the
Recovery Image as a lightweight image that was generated with the Windows 7 OS image.
After it was completed, the Recovery Image was published through the WDS environment,
allowing users to load DaRT as part of a PXE boot.
The objectives of the Pilot program were to determine:

If the remote connectivity feature can be used worldwide

If DaRT was a viable self-service option

If DaRT was ready for production-scale deployment
To account for a variety of variables and test locations worldwide, Microsoft managed the
beta pilot program using a two-pronged approach, conducting testing in both a contrived
scenario setting and in the Microsoft IT Help Desk environment.
MICROSOFT IT IMPLEMENTS MICROSOFT DIAGNOSTICS AND RECOVERY TOOLSET 7.0 Page 3

In the contrived scenario setting, global users were paired with a Help Desk Technician
to test the Remote Connectivity tool functionality. Global users were tasked with testing
the process to boot into DaRT from the WDS server and then to give control to the Help
Desk Technician. After the Help Desk Technician confirmed the Remote Connectivity
functionality was performing as expected, they took control of the system and tested one
or more of the repair tools to confirm functionality.

In the Help Desk test environment, the Microsoft IT Help Desk Technician's assignment
was to validate the PXE boot process and tool functionality on standard hardware. Their
objective was to understand the functionality and to provide expert feedback on the
experience.
Pilot Results
As a result of the DaRT pilot program, Microsoft IT successfully confirmed that the remote
connectivity functionality performed as designed in both the contrived scenario setting and in
the Microsoft IT Help Desk test environment.

Contrived scenario setting results. Help Desk Technicians confirmed they could easily
use the Remote Connection tool to access the global user's machine across the WAN,
and that they could run the DaRT toolset effectively.

Microsoft IT test environment results. Help Desk Technicians successfully validated
that the PXE boot process and toolset functionality performed as expected on standard
hardware.
Microsoft IT was able to provide valuable usability feedback to the DaRT product team that
helped to clarify and define UI wording and terminology and to refine the menu text, reducing
the potential for administrator error.
Note: An important consideration during any worldwide implementation is to plan
appropriately for potential language barriers. During the pilot, the communication process
between the Help Desk Technician and the user was briefly hindered by language
differences when relaying instructions prior to establishing the remote connection.
Production Deployment
After the pilot program was completed and the DaRT 7.0 RTM version was released,
Microsoft IT published the DaRT 7.0 RTM product as a self-service download on the
Microsoft corporate network by deploying it through Windows Deployment Services (WDS)
and by publishing an ISO image accessible from the software product servers. This
publishing approach enables users to install DaRT via PXE boot or to burn a CD and run the
tool locally.
Deployment Considerations

DaRT Recovery Image Maintenance. The DaRT Recovery Image is refreshed
quarterly, when the Windows 7 image is refreshed within the corporate environment.

DaRT Recovery Image Toolset Options. One of the considerations when releasing
DaRT 7.0 to the internal Microsoft population was to determine the appropriate toolset
options to make readily available to users as part of the DaRT Recovery Image. The
deciding factor hinged on counter-balancing the user's ability to damage their machine
through misuse of the toolset with the technical nature of the workforce. Microsoft IT
decided to provide most functionality found in the toolset. However, based on
MICROSOFT IT IMPLEMENTS MICROSOFT DIAGNOSTICS AND RECOVERY TOOLSET 7.0 Page 4
advisement from the Microsoft security team, the Locksmith tool is not available to the
interactive user and is only available to the Help Desk Technician when they assist the
user through the Remote Connection feature.
Production Results
Since the DaRT production rollout:

Self-service DaRT downloads average about 1,000 downloads per month.

Help Desk Technicians use DaRT approximately 30 times per month. Usage reports
indicate that DaRT is primarily used for data recovery, for Master Boot Record recovery,
and to wipe the hard drive prior to re-assigning or recycling the machine.

When used, DaRT resolves 80 to 100 percent of the issues, leading to a better user
experience.

Machine reimage is no longer the first and only option available to users.
Benefits
By implementing DaRT, Microsoft has realized a number of benefits:

Improved user experience and cost savings. Using DaRT, Microsoft IT has simplified
Help Desk support and is able to deliver solutions quickly, reducing overall support
costs, improving the user experience, as well as reducing lost productivity caused by
down time.

Rapid recovery. The toolset provides many options for recovery, even when Windows
Safe Mode or normal boot will not function. The offline boot environment helps IT teams
quickly restart computers, recover deleted files, and remove malware from infected
systems while the computer is offline. This helps protect other computers on the network
and reduces the amount of time the computer is unavailable.

Improved IT responsiveness. DaRT helps IT professionals quickly respond to and
resolve user issues. Key features include Remote Connectivity, Crash Analyzer, System
Restore and Locksmith, enabling Help Desk Technicians to access and safely repair
PCs.

Shift in service philosophy. An unexpected benefit of the DaRT 7.0 rollout was the
shift in Microsoft IT service philosophy. Microsoft IT realized that they were not only
resolving a poor user experience related to machine recovery but that they were also
developing a dynamic support structure that better met the needs of all users worldwide
across multiple service points, including phone support, onsite technicians, and selfservice options.
Conclusion
Microsoft IT needed a proactive, efficient, and reliable way to resolve desktop system failures
that could be deployed easily to users worldwide, provide remote connectivity access to Help
Desk Technicians and a dynamic toolset that would benefit self-service users.
Microsoft IT began testing DaRT in a pilot program starting in April 2011. This program was
designed to test DaRT's ease of deployment, remote connectivity and extensive toolset. At
the end of the pilot program and with the RTM release, DaRT moved into production and was
rolled out as a self-service download on the corporate network.
MICROSOFT IT IMPLEMENTS MICROSOFT DIAGNOSTICS AND RECOVERY TOOLSET 7.0 Page 5
As a result of the pilot program, DaRT is now a sustained Microsoft IT service that includes
approximately 1,000 self-service downloads per month, and the product is used about 30
times per month by Help Desk Technicians. In those situations, DaRT resolves 80 to 100
percent of the issues, leading to a better experience for users and reduced challenges for
Microsoft IT. Overall, DaRT helps Microsoft IT make desktops safer to use and easier and
less expensive to manage while also providing an alternative to dispatching an on-site
technician.
For More Information
For more information about Microsoft products or services, call the Microsoft Sales
Information Center at (800) 426-9400. In Canada, call the Microsoft Canada Order Centre at
(800) 933-4750. Outside the 50 United States and Canada, please contact your local
Microsoft subsidiary. To access information via the World Wide Web, go to:
http://www.microsoft.com
http://www.microsoft.com/technet/itshowcase
© 2012 Microsoft Corporation. All rights reserved.
This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR
IMPLIED, IN THIS SUMMARY. Microsoft and Windows are either registered trademarks or trademarks of
Microsoft Corporation in the United States and/or other countries. The names of actual companies and products
mentioned herein may be the trademarks of their respective owners.
MICROSOFT IT IMPLEMENTS MICROSOFT DIAGNOSTICS AND RECOVERY TOOLSET 7.0 Page 6