14

I've run chkdsk /F many times over the years...and today I had to run it on one of my 2008 R2 servers and I get the normal message:

Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) y

This volume will be checked the next time the system restarts.

I've looked at the Technet doc here: http://technet.microsoft.com/en-us/library/cc730714.aspx as well as normal google searching and searching on Technet and site:microsoft.com on google, but can't find what I'm looking for...

The Question:

HOW/where does Windows schedule this on restart? It isn't in Task Scheduler or RunOnce or similar, which makes sense if it needs to run before Windows locks the volume...so where exactly does Windows set this "scheduled task" to occur so that the server knows about it even a week later during a maintenance window reboot?

MDMoore313
  • 5,531
  • 6
  • 34
  • 73
TheCleaner
  • 32,352
  • 26
  • 126
  • 188

1 Answers1

19

Great Question. the answer is that the VolumeDirty bit is set on the volume, which (I have to assume) is checked during bootup. Probably similar to the way it's checked when a flash drive is inserted and one gets the popup that says Scan or Continue Without Scanning.

I once tried to come up with a way to schedule a chkdsk for an automated server that had near zero maintenance, by setting the volumedirty bit via powershell script (dirtybitset = $true), but it wouldn't work. I may revisit that as it appears from my link there's a ScheduleAutoChk that does just that and works in conjunction with the dirtybit.

Further research here states:

Every time Windows restarts, Autochk.exe is called by the Kernel to scan all volumes to check if the volume dirty bit is set. If the dirty bit is set.

More info about autochk.exe can be found here to help explain what is going on in Microsoft Technet site and Wikipedia, where Wikipedia states:

Once all the Boot and System drivers have been loaded, the kernel (system thread) starts the Session Manager Subsystem (smss.exe).

Before any files are opened, Autochk is started by smss.exe. Autochk mounts all drives and checks them one at a time to see whether or not they were cleanly unmounted. If autochk determines one or more volumes are dirty, it will automatically run chkdsk

Specifically it appears if you look in the registry under:

HKLM\System\CurrentControlSet\Control\Session Manager

There is a value of BootExecute that gets changed from autocheck autochk * to something like autocheck autochk /p \\??\C: autocheck autochk *

Braiam
  • 622
  • 4
  • 23
MDMoore313
  • 5,531
  • 6
  • 34
  • 73
  • 1
    aha...OK cool I found additional detail I'll add to your answer...thank you sir! – TheCleaner Feb 13 '14 at 15:52
  • 1
    For reference: it appears you can use `chkntfs /c %SystemDrive%` to schedule the boot volume for checking on reboot without mucking around with the registry directly. (Of course, you have to have admin rights to do it.) – cHao Feb 13 '14 at 18:32
  • @cHao - you don't have to muck with the registry directly regardless. `chkdsk /f %SystemDrive% does the same thing. Maybe I'm not following your comment. – TheCleaner Feb 13 '14 at 19:03
  • @TheCleaner: With `chkntfs /c`, though, you don't get the "Would you like to schedule...?" prompt. That can be an important difference if you want to dirtify the drive as part of a scheduled task, for example. – cHao Feb 13 '14 at 19:24
  • @cHao so `/c` = confirm then? Typically that's the way it works, I just want to be sure. – MDMoore313 Feb 13 '14 at 19:27
  • 2
    @MDMoore313: `/c` is the option to schedule the check. Without it, `chkntfs` will just tell you whether a check has been scheduled. – cHao Feb 13 '14 at 19:30
  • Although as i look through stuff again, scheduling the check might just schedule Windows to check the dirty bit. You might also need to say `fsutil dirty set %SystemDrive%` in order to force a full scan. – cHao Feb 13 '14 at 19:37