Emergency Management Services in Windows Server 2003

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

To manage a server from a remote computer when the server is not available on the network, you must enable Emergency Management Services. Emergency Management Services is a Windows Server 2003 service that runs on the managed server. This service is not enabled by default when you install the Windows Server 2003 operating system, but you can enable it during installation or at any later time.

Emergency Management Services features are available when the Windows Server 2003 loader or kernel is at least partially running. You can access all Emergency Management Services output by using terminal emulator software that supports VT100, VT100+, or VT-UTF8 protocols on the management computer, although VT-UTF8 is the preferred protocol. For more information about terminal emulator software and the supported protocols, see "Management Software for Out-of-Band Connections" later in this chapter. For more information about enabling, configuring, and using Emergency Management Services, see the Storage Technologies Collection of the Windows Server 2003 Technical Reference (or see the Storage Technologies Collection on the Web at http://www.microsoft.com/reskit).

When Emergency Management Services is enabled:

  • Console redirection automatically sends output to the out-of-band port for any supported operating state, as indicated in Table 5.4.

  • You can use SAC to issue supported commands or switch to the command shell (cmd.exe) whenever the kernel is running.

  • You can view logs during the GUI-mode phase of Setup.

  • !SAC automatically becomes available whenever a system failure occurs.

Table 5.4 shows when you can use Emergency Management Services features for remote management, with or without special out-of-band hardware.

Table 5.4 Using Emergency Management Services Features

Task Feature

Selecting operating system during system load

Console redirection

Running Recovery Console

Console redirection

Viewing text mode setup messages

Console redirection

Viewing GUI mode setup messages

SAC, including setup logs

Viewing RIS loading messages

Console redirection

Viewing Stop error messages

Console redirection

Monitoring and managing with out-of-band connections


Performing last-resort system recovery


Emergency Management Services Console Redirection

Emergency Management Services console redirection redirects the output from supported Windows Server 2003 functions to the out-of-band port. When Emergency Management Services is enabled, you can perform remote management through the out-of-band port, as shown in Table 5.5.

Table 5.5 Emergency Management Services Console Redirection

Managed Operating State Example Tasks

Windows Server 2003 Loader

  • Select the operating system to load on x86-based multiple-boot systems.

  • Verify the load of Windows Server 2003 components before in-band tools become available.

Kernel at least partially functioning

  • Perform SAC commands, such as changing the priority of a process.

  • Perform !SAC commands, such as viewing Stop messages when a system problem occurs.

Recovery Console running

  • Troubleshoot startup problems.

Text-mode Setup

  • View Windows Server 2003 Setup progress.

  • Respond to text-mode Setup prompts.

GUI-mode Setup

  • Perform SAC commands and monitor setup logs.

RIS-based Setup

  • Respond to the F12 prompt to initiate RIS-based Setup.


  • You must have firmware redirection to view server information before the Windows Server 2003 operating system starts.

Special Administration Console

When Emergency Management Services is enabled, SAC is always available through the specified out-of-band port, as long as the Windows Server 2003 kernel is running. You can use SAC at any time to carry out out-of-band management commands during the following system operating states:

  • Normal system operation

  • Windows Server 2003 components initialization

  • Safe mode

  • GUI-mode during Windows Server 2003 Setup

The SAC prompt appears when you connect to a server that is running Emergency Management Services. The SAC command-line environment supports a specific set of commands. For information about SAC commands, see "Special Administration Console (SAC) and SAC commands" in Help and Support Center for Windows Server 2003.

Using SAC, you can perform management tasks such as the following:

  • Gathering server information, such as computer name and IP address.

  • Changing a server’s TCP/IP networking information to resolve issues caused by incorrect parameters or a duplicate IP address.

  • Obtaining a list of processes and threads running on the computer to determine if they are causing a system performance problem, if you cannot perform this task by using in-band tools.

  • Raising or lowering the priority of a process, or ending a process that is consuming excessive server processor resources or other system resources to eliminate performance issues.

  • Restarting or shutting down a server as part of unplanned maintenance task, when the in-band mechanism fails.

  • Setting the system time and date, for example, for Kerberos authentication.

  • Starting a command shell and running text-based tools, and switching between the command prompt and SAC.

  • Viewing setup logs during GUI mode setup and switching between the setup logs and SAC.

!Special Administration Console

When Emergency Management Services is enabled and a system failure occurs, !SAC — an abbreviated form of SAC — automatically replaces SAC as the command-line environment. For information about !SAC commands, see " !Special Administration Console (!SAC) and !SAC commands" in Help and Support Center for Windows Server 2003.


  • !SAC is not available if the debugger is running or the system is set to restart automatically when Stop errors occur.

Using !SAC, you can perform tasks such as the following:

  • View redirected Stop messages.

  • Display computer identification information.

  • View an abbreviated log of loaded drivers and some kernel events.

  • Restart the computer.