Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows Server 2003 R2 with 48 GB of RAM; server has been running strong for quite some time. Recently our boot.ini was modified causing issues, most likely by our remote administrators. Now the server is only showing 14 GB of RAM. This has caused major performance issues for our end users.

Our remote administrators have stated "we don't change the boot.ini settings(switches)". However, I know for a fact that all of the local administrators have not modified the switches (due to lack of permissions).

The real question.. Is it possible to "audit" who has modified the boot.ini? If thats not possible, can the boot.ini be set via startup?

Any help would be greatly appreciated. This is an ongoing issue that I would love to resolve.

share|improve this question
up vote 1 down vote accepted
Is it possible to "audit" who has modified the boot.ini? 

Not in hindsight, no. There are a ways of auditing in future, but unless you have previously configured some kind of monitoring then, no, this will just remain one of those mysteries.

If thats not possible, can the boot.ini be set via startup?

Please clarify what you mean by this as it doesn't really make sense.

share|improve this answer
I'm trying to narrow down their "genius" responses. Can the boot.ini be modified during startup to revert back to the previous settings. – Oct 11 '12 at 15:13
The boot.ini file is a text file. There's no such thing as "revert back to previous settings". You need to know what the contents of the file should be to know whether it's been changed or not. If the file was backed up you could look at it from a backup from before the problem and look at it now and make a comparison. – joeqwerty Oct 11 '12 at 15:20
I understand its a text file, I have the previous settings and current incorrect one. I'm trying to narrow down why this is "reverting" back to the old settings. I'm sure its the remote admins but I had to ask if there was some crazy way it could be modified. – Oct 11 '12 at 15:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.