Technical Notes: How to enable software RAID (mirroring) in Windows XP

I recently installed Windows XP on a system with two hard drives, intending to use the drives as mirrors. I then found out, much to my surprise, that mirroring is not enabled in Windows XP, not even in the so-called "professional" (?) version.

Fortunately, it appears that this is one of those features that are actually present in the operating system, only disabled. Thanks to a page I found with Google, from Tom's Hardware Guide, I knew exactly how to enable it.

The bottom line is that you need to hand-edit three binary system files and then install them even if Windows insists on "repairing" them by replacing your copies with the original versions.

Files to edit

The three files to edit are dmadmin.exe, dmconfig.dll, and dmboot.sys. The first two of these are in the system32 directory, while dmboot.sys is in system32\drivers. Here are the changes that need to be made (I use the elvis editor under Linux, which allows me to edit binary files).

  dmadmin.exe
Before 00001c30  73 65 72 76 65 72 6e 74 00 00 00 00 6c 61 6e 6d  servernt....lanm
00001c40  61 6e 6e 74 00 00 00 00 50 72 6f 64 75 63 74 54  annt....ProductT
After 00001c30  77 69 6e 6e 74 00 00 00 00 00 00 00 6c 61 6e 6d  winnt.......lanm
00001c40  61 6e 6e 74 00 00 00 00 50 72 6f 64 75 63 74 54  annt....ProductT
  dmconfig.dll
Before 00005140  4c 41 4e 4d 41 4e 4e 54 00 00 00 00 53 45 52 56  LANMANNT....SERV
00005150  45 52 4e 54 00 00 00 00 57 49 4e 4e 54 00 00 00  ERNT....WINNT...
After 00005140  4c 41 4e 4d 41 4e 4e 54 00 00 00 00 57 49 4e 4e  LANMANNT....WINN
00005150  54 00 00 00 00 00 00 00 53 45 52 56 45 52 4e 54  T.......SERVERNT
  dmboot.sys
Before 00011070  54 00 79 00 70 00 65 00 00 00 57 49 4e 4e 54 00  T.y.p.e...WINNT.
00011080  00 00 53 45 52 56 45 52 4e 54 00 00 00 00 4c 41  ..SERVERNT....LA
After 00011070  54 00 79 00 70 00 65 00 00 00 53 45 52 56 45 52  T.y.p.e...SERVER
00011080  4e 54 57 49 4e 4e 54 00 00 00 00 00 00 00 4c 41  NTWINNT.......LA

Note that these are slightly different from what is in Tom's Hardware Guide; I suspect the driver has been changed by Microsoft since that page has been last edited. Yes, there's a slight concern that possible future driver changes by Microsoft may render unbootable a system that was modified this way and set to boot from a RAID volume.

Replacing system files

Simply copying the edited version over the original will not work. Windows XP has a feature where it protects sensitive system files from accidental overwrites; if you copy, say, your modified version of dmboot.sys over the original, you will notice that after a few seconds, it'll revert back to the original version, even if you do the copying from the command line.

One way to overcome this difficulty is by booting from the Windows XP CD-ROM to the Windows Recovery Console, which is a DOS-like command-line environment that lets you, among other things, replace protected system files.

Establishing the mirror

From this point on you proceed as you would with Windows 2003 Server: Go into Administrative Tools, Computer Management, Disk Management, and go nuts with your dynamic volumes.

Legal and practical implications

"Hacking" a device with intentionally disabled features has been a long established practice. Is it legal? I am no expert, but I doubt that Microsoft would go after anyone with a legally obtained Windows XP license who made this modification. Just to be on the safe side, it doesn't hurt to have a valid Windows 2003 Server license (I do, through MSDN) so you could argue that you just "downgraded" from that to the "modified" version of Windows XP.

On the practical side, running a hacked version of any operating system in a production environment can be very problematic. However simple the hack is, it probably hasn't been tested for regressions the same way as real operating system components are. It may be incompatible with future hotfixes released by the vendor. Or, the vendor may release a hotfix for the hacked component, causing it to revert to an unhacked version, rendering the system unbootable.