How to “Offline” a Disk using Windows PE/Recovery Enviroment?

The Disk Management MMC snapin has a “Offline” function:

Screenshot of Disk Managment showing the "Offline" context menu item

Once used, a disk shows as Offline, with hover text “This disk is offline because of policy set by an administrator”.


However, if the OS does not boot due to the contents of the disk this state can not be reached.

How can this be done to an offline system, using the recovery/Windows PE environment?

Answer

This information is stored in the registry under

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\(disk\device\path)\Device Parameters\Partmgr

There is a DWORD value named “Attributes” with the following values:

0 = Online

3 = Offline

(decimal or hexadecimal are the same)

Device paths tend to contain some part of the device bus and name. The device path on my test system was SCSI\Disk&Ven_&Prod_LITEONIT_LMT-256\4&35b1cb49&0&040000.

Screenshot of registry tree

So the generalised steps are:

  1. Boot into the recovery environment
  2. Mount the registry offline.
  3. Edit the registry key. In an offline system there is no “Current” ControlSet so change all of ControlSet001, ControlSet002, etc as appropriate.

Attribution
Source : Link , Question Author : Fowl , Answer Author : Fowl

Leave a Comment