5.4.2. OS Recovery Tools and Techniques
💡 First Principle: OS recovery tools exist on a spectrum from least invasive (service restart) to most invasive (OS reload). Always start with the least invasive option that could plausibly fix the problem — avoiding unnecessary data risk and downtime.
Recovery Options (Least to Most Invasive)
| Option | What It Does | When to Use |
|---|---|---|
| Service restart | Restarts a specific service | Service crashed or hung |
| Scheduled reboot | Full OS restart on schedule | Memory leaks, accumulated state issues |
| Safe mode | Windows boots with minimal drivers | Driver or software conflict prevents normal boot |
| Single user mode | Linux boots to root shell only | Root password reset, filesystem repair |
| Boot options (recovery) | Windows Recovery Environment (WinRE), Linux boot options | Startup repair, System Restore, chkdsk |
| Snapshot rollback | Restore VM to pre-change snapshot | VM change caused failure |
| OS reload | Reinstall operating system | Severe corruption, unrecoverable state |
Package and Patch Management
- Windows: Windows Update, WSUS, SCCM. Can upgrade patches (to newer), downgrade (to previous), or uninstall.
- Linux (apt):
apt install,apt remove,apt upgrade. Dependency resolution automatic. - Linux (yum/dnf):
yum install,yum downgrade,yum remove. RPM-based systems.
Privilege Escalation Tools
Running commands with elevated privileges when needed:
| Tool | Platform | Usage |
|---|---|---|
| runas / Run As | Windows | runas /user:DOMAIN\admin cmd — run command as different user |
| sudo | Linux | sudo command — run as root temporarily; controlled by sudoers |
| su | Linux | su - — switch to root shell; requires root password |
Configuration Management Tools
Automating consistent configuration across many servers:
| Tool | Approach | Platform |
|---|---|---|
| SCCM | Centralized; agent-based; strong Windows integration | Windows |
| Puppet | Declarative (define desired state); agent-based | Cross-platform |
| Chef | Procedural (define steps); agent-based | Cross-platform |
| Ansible | Agentless (SSH-based); push model; simple YAML | Cross-platform |
| GPO (Group Policy Objects) | Domain-based policy enforcement | Windows/AD |
Services and Processes Management
| Task | Windows | Linux |
|---|---|---|
| Start service | net start servicename / Services MMC | systemctl start service |
| Stop service | net stop servicename | systemctl stop service |
| Check status | sc query servicename | systemctl status service |
| Check dependencies | Services MMC → Dependencies tab | systemctl list-dependencies |
⚠️ Exam Trap: GPO (Group Policy Object) settings can override local configurations silently. A server that keeps reverting to an unwanted configuration may be having GPO applied that overrides your manual change. Check gpresult /R (Windows) to see applied policies before making repeated manual changes.
Reflection Question: A Linux server's web service fails to start after a patch was applied. The service log shows "port 80 already in use." The previous service is no longer running. What Linux command would you use to identify what is using port 80, and what might the cause be?
