Alphabetical List of Tools

Resource Kit Tools Help for Windows Server 2003

Alphabetical List of Tools by File Name

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Tools are listed by their file names, followed by their full names. Hold the cursor over the name of a tool for a brief description. Tools that are not linked are included in the Resource Kit Tools but are documented only in the Release Notes (Readme.htm), not in this help file.

A

Acctinfo.dll (documented in Readme.htm)

Adlb.exe: Active Directory Load Balancing Tool

Admx.msi: ADM File Parser

Atmarp.exe: Windows ATM ARP Server Information Tool

Atmlane.exe: Windows ATM LAN Emulation Client Information

Autoexnt.exe: AutoExNT Service

B

No entries

C

Cdburn.exe: ISO CD-ROM Burner Tool

Checkrepl.vbs: Check Replication

Chklnks.exe: Link Check Wizard

Chknic.exe: Network Interface Card Compliance Tool for Network Load Balancing

Cleanspl.exe: Spooler Cleaner

Clearmem.exe: Clear Memory

Clusdiag.msi: Cluster Diagnostics and Verification Tool

Clusfileport.dll: Cluster Print File Port

Clusterrecovery.exe: Server Cluster Recovery Utility

Cmdhere.inf: Command Here

Cmgetcer.dll: Connection Manager Certificate Deployment Tool

Compress.exe: Compress Files

Confdisk.exe: Disk Configuration Tool

Consume.exe: Memory Consumers Tool

Creatfil.exe: Create File

Csccmd.exe: Client-Side Caching Command-Line Options

Custreasonedit.exe: Custom Reason Editor (documented in Readme.htm)

D

Delprof.exe: User Profile Deletion Utility

Dh.exe: Display Heap

Diskraid.exe: RAID Configuration Tool

Diskuse.exe: User Disk Usage Tool

Dnsdiag.exe: SMTP DNS Diagnostic Tool (documented in Readme.htm)

Dumpfsmos.cmd: Dump FSMO Roles

Dvdburn.exe: ISO DVD Burner Tool

E

Empty.exe: Free Working Set Tool

Eventcombmt.exe: Check Replication

F

Fcopy.exe: File Copy Utility for Message Queuing

Frsflags.vbs

G

Getcm.exe: Connection Manager Profile Update

Gpmonitor.exe: Group Policy Monitor

Gpotool.exe: Group Policy Objects

H

Hlscan.exe: Hard Link Display Tool

I

Ifilttst.exe: IFilter Test Suite

Ifmember.exe: User Membership Tool

Inetesc.adm: Internet Explorer Enhanced Security Configuration

Iniman.exe: Initialization Files Manipulation Tool

Instcm.exe: Install Connection Manager Profile

Instsrv.exe: Service Installer

Intfiltr.exe: Interrupt Affinity Tool

J

No entries

K

Kerbtray.exe: Kerberos Tray

Kernrate.exe: Kernel Profiling Tool

Klist.exe: Kerberos List

Krt.exe: Certification Authority Key Recovery

L

Lbridge.cmd: L-Bridge

Linkd.exe

Linkspeed.exe: Link Speed

List.exe: List Text File Tool

Lockoutstatus.exe: Account Lockout Status (documented in Readme.htm)

Logtime.exe

Lsreport.exe: Terminal Services Licensing Reporter

Lsview.exe: Terminal Services License Server Viewer

M

Mcast.exe: Multicast Packet Tool

Memmonitor.exe: Memory Monitor

Memtriage.exe: Resource Leak Triage Tool

Mibcc.exe: SNMP MIB Compiler

Moveuser.exe: Move Users

Mscep.dll: Certificate Services Add-on for Simple Certificate Enrollment Protocol

N

Nlsinfo.exe: Locale Information Tool

Now.exe: STDOUT Current Date and Time

Ntimer.exe: Windows Program Timer

Ntrights.exe

O

Oh.exe: Open Handles

Oleview.exe: OLE/COM Object Viewer

P

Pathman.exe: Path Manager

Permcopy.exe: Share Permissions Copy

Perms.exe: User File Permissions Tool

Pfmon.exe: Page Fault Monitor

Pkiview.msc: PKI Health Tool

Pmon.exe: Process Resource Monitor

Printdriverinfo.exe: Drivers Source

Prnadmin.dll: Printer Administration Objects

Q

Qgrep.exe

Qtcp.exe: QoS Time Stamp

Queryad.vbs: Query Active Directory

R

Rassrvmon.exe: RAS Server Monitor

Rcontrolad.exe: Active Directory Remote Control Add-On

Regini.exe: Registry Change by Script

Regview.exe (documented in Readme.htm)

Remapkey.exe: Remap Windows Keyboard Layout

Robocopy.exe: Robust File Copy Utility

Rpccfg.exe: RPC Configuration Tool

Rpcdump.exe

Rpcping.exe

RPing: RPC Connectivity Verification Tool

Rqc.exe: Remote Access Quarantine Client

Rqs.exe: Remote Access Quarantine Agent

S

Setprinter.exe: Spooler Configuration Tool

Showacls.exe

Showperf.exe: Performance Data Block Dump Utility

Showpriv.exe: Show Privilege

Sleep.exe: Batch File Wait

Sonar.exe: FRS Status Viewer

Splinfo.exe: Print Spooler Information

Srvany.exe: Applications as Services Utility

Srvcheck.exe: Server Share Check

Srvinfo.exe: Remote Server Information

Srvmgr.exe: Server Manager

Ssdformat.exe: System State Data Formatter

Subinacl.exe

T

Tail.exe

Tcmon.exe: Traffic Control Monitor

Timeit.exe (documented in Readme.htm)

Timezone.exe: Daylight Saving Time Update Utility

Tsctst.exe: Terminal Server Client License Dump Tool

Tsscalling.exe: Terminal Services Scalability Planning Tools

U

Uddicatschemeeditor.exe: UDDI Services Categorization Scheme Editor

Uddiconfig.exe: UDDI Services Command-line Configuration Utility

Uddidataexport.exe: UDDI Data Export Wizard

Usrmgr.exe: User Manager for Domains

V

Vadump.exe: Virtual Address Dump

Vfi.exe: Visual File Information

Volperf.exe: Shadow Copy Performance Counters

Volrest.exe: Shadow Copies for Shared Folders Restore Tool

Vrfydsk.exe: Verify Disk

W

Winexit.scr: Windows Exit Screen Saver

Winhttpcertcfg.exe: WinHTTP Certificate Configuration Tool

Winhttptracecfg.exe: WinHTTP Tracing Facility Configuration Tool

Winpolicies.exe: Policy Spy

Wins.dll: WINS Replication Network Monitor Parser

Wlbs_hb.dll & Wlbs_rc.dll: Windows Load Balancing Server Network Monitor Parsers

X, Y, Z

No entries


Introduction to Resource Kit Tools Help

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Introduction to Resource Kit Tools

Resource Kit Tools Help for Microsoft Windows Server 2003 describes the tools included on the Microsoft Windows Server 2003 Deployment Kit companion CD. The Resource Kit Tools are a set of software tools for network administrators, developers, and power users to manage TCP/IP, networks, the registry, security, remote administration, configuration, batch files, and many other areas of the Windows Server 2003 operating system. Before using the tools, you must first install them by running Rktools.msi from the companion CD.

To find Help for a tool

  • Click the Alphabetical List of Tools topic in the Contents pane to display a list of tools by the tool's file name.
  • Click a category on the Contents tab and then click the tool's file name.
  • Use the Index or Search tab to locate a tool by file name, friendly name, or keyword.

Each tool is covered in a main Help topic. Links to associated topics covering syntax, examples, or other features of the tool are available at the top of each topic for that tool. Links to glossary definitions that appear in pop-up windows are formatted in underlined dark green text. Tools with graphical user interfaces may include a separate Help file available from the Help menu in the tool window. For command-line tools, Help is also available by typing filename /? at the command prompt.

An extensive Glossary is available from the Contents tab. Links to glossary definitions that appear as pop-up windows are formatted in underlined dark green text.

Understanding Notation and Terminology

The following topics cover the conventions for notation, usage and terminology that are observed in this document:

Notational Conventions

Procedural Conventions

Terminology Conventions

This documentation assumes you are already familiar with the Windows operating system. For more general information about Windows, including keyboard equivalents to menu and mouse actions, see Windows Help.

Tools Documented Only in the Release Notes

The following tools are included in the Windows Resource Kit Tools, but not in this help file. They are documented in the Release Notes (Readme.htm).

  • Acctinfo.dll
  • Custreasonedit.exe: Custom Reason Editor
  • Dnsdiag.exe: SMTP DNS Diagnostic Tool
  • Lockoutstatus.exe: Account Lockout Status
  • Regview.exe
  • Timeit.exe

Disclaimer

Many of these tools were developed internally at Microsoft. These tools are provided "as is" without warranty of any kind. Use these tools at your own risk. Microsoft disclaims any implied warranty of merchantability and/or fitness for a particular purpose.

These tools are written and tested in English only. Using these tools with a non-English version of Windows might produce unpredictable results.

Resource Kit Tools Help is available only in English. If you install Resource Kit Tools Help on a non-English operating system or on an operating system with a Multilingual User Interface Pack (MUI), you will see some English content mixed with non-English content in Help and Support Center. This behavior should be expected if you browse through tools documentation in the Tools By Category listing in the Tools Center in Help and Support Center or if you search anywhere in Help and Support Center by a tool name.

Copyright Information

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, people and events depicted herein are fictitious and no association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

Microsoft, MS-DOS, Windows, Windows NT, Active Desktop, Active Directory, ActiveX, Win32, SQL Server, Visual Basic, Visual C++, and JScript are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries/regions.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

© 1985-2003 Microsoft Corporation. All rights reserved.


Notational Conventions

Convention | Meaning
bold | In syntax descriptions, characters that you type exactly as shown, including commands and switches. In text, menu names and menu commands are also bold.
bold monospace | Commands that you must type exactly as shown to get the results being discussed.
italic | In syntax descriptions, variables for which you supply a specific value. For example, Filename.ext represents any valid file name.
Initial Capitals
(Filename.ext) 		Names of files begin with an initial capital letter, for example, Filename.ext. Paths and folders may be uppercase, lowercase, or mixed, according to how they actually appear in a standard installation of the application or the operating system.
ALL CAPITALS | Used for acronyms.
monospace
 Examples of code or output.
[ ] (square brackets) | In syntax descriptions, square brackets enclose optional items. If you include the item, type only the information between them, not the square brackets themselves.
{choice1 | choice2} (braces) | In syntax descriptions, braces enclose items separated by pipes which require a choice, such as {yes | no}. Type only one of the choices, not the braces or the dividing pipe.


Procedural Conventions

Convention | Meaning
type | An instruction to type information means to press the key or keys and then press the ENTER key.
select | An instruction to select information means to highlight folders, file names, text boxes, menu bars, and options, or to select options in a dialog box.
+ | A plus sign ( + ) between two or more key names indicates that you must press the keys at the same time; for example, ALT + TAB.
, | A comma ( , ) between two or more key names indicates that you must press each key consecutively; for example, ALT, F, X.
Note | Alerts you to supplementary information.
Caution | Alerts you to possible data loss, breaches of security, or other more serious problems.


Terminology Conventions

Term | Meaning
MS-DOS | Microsoft MS-DOS
command prompt | The point in the command window or console where you enter commands, typically designated by "C:\>" (or other characters indicating the current drive and folder).
command-line application -or- console-based application | An application designed to run in a command window or console, and which cannot run in a Windows window.
Windows-based application -or- GUI application | An application that must run in a Windows window. All such applications follow similar conventions for the arrangement of menus, dialog box styles, and keyboard and mouse use.
Systemroot | The folder in which Windows is installed.
CD_drive: | The drive letter for the CD-ROM drive, which might vary from computer to computer depending on what other hardware is installed.
tool -or- utility | Used synonymously to refer to application programs in the Resource Kit Tools.


Debugging and Support Tools

Debugging Tools

For information about debuggers and to obtain debugging tools and documentation, see Microsoft Debugging Tools (http://go.microsoft.com/fwlink/?LinkId=1651).

Support Tools

The Windows Support Tools assist support personnel and network administrators in managing their networks and troubleshooting problems. Many of these tools were included in previous Windows Resource Kits. By default, the Support Tools are not installed with the Windows operating system; install them separately from the \Support\Tools folder of the Windows CD. See the Support Tools Help file for information on these tools.


Related Information on the Internet

There are many Microsoft Internet sites that provide information and updates regarding Windows Server 2003, Windows XP, Windows 2000, Windows NT, Windows 98, and the Windows Resource Kits.

If you have an Internet connection and a Web browser, you can click the following links to visit these sites.

Windows Resource Kits Web Site

Windows Resource Kits (http://go.microsoft.com/fwlink/?LinkId=286)

Windows Web Sites

Microsoft Windows (http://go.microsoft.com/fwlink/?LinkId=622)

Windows 2000 Server (http://go.microsoft.com/fwlink/?LinkId=623)

Windows NT Server (http://go.microsoft.com/fwlink/?LinkId=624)

Windows NT Workstation (http://go.microsoft.com/fwlink/?LinkId=626)

Microsoft Product Support Services (http://go.microsoft.com/fwlink/?LinkId=1679)

Microsoft Windows Server Catalog (http://go.microsoft.com/fwlink/?LinkId=14150)

Other Microsoft Web Sites of Interest

Microsoft Knowledge Base Search (http://go.microsoft.com/fwlink/?LinkId=1633)

Microsoft Internet Explorer (http://go.microsoft.com/fwlink/?LinkId=293)

Microsoft TechNet (http://go.microsoft.com/fwlink/?LinkId=1631)

MSDN (http://go.microsoft.com/fwlink/?LinkId=1630)

Microsoft Home Page

Microsoft Home Page (http://go.microsoft.com/fwlink/?LinkId=1681)


Active Directory Management Tools

Tools in this category are used to manage the following Windows features:

  • Active Directory


Adlb.exe: Active Directory Load Balancing Tool

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Adlb.exe: Active Directory Load Balancing

Overview | Remarks | Syntax | Examples | Related Tools Open Command Prompt

Active Directory Load Balancing (ADLB) is a command-line tool load that balances the existing connection objects among Active Directory site bridgehead servers and enables replication time schedule staggering on a bridgehead server. If the replication load is not balanced, the central processing unit (CPU) and memory performance of domain controllers can be affected, and an increase in replication latency for the domain can occur.

Active Directory replication uses connection objects to control inbound and outbound traffic between site bridgehead servers. Active Directory Load Balancing Tool (ADLB) balances replication traffic between the available bridgehead servers from the inbound and outbound perspective of a single site.

Corresponding Operating System Features

The Active Directory Sites and Services snap-in can be used to manually make changes to connection objects, but does not allow time schedule staggering on existing connection objects.

Caution

  • On the next replication cycle, the Knowledge Consistency Checker (KCC) may overwrite manual changes to connection objects. To avoid this, it may be necessary to disable automatic inter-site topology. If automatic inter-site topology is disabled, replication activities then become the responsibility of the administrator. Manual replication setup can be done via the Active Directory Sites and Services snap-in or through scripting.

Concepts

KCC, in Windows 2000 and Windows Server 2003, maintains the intra- and inter-site replication topology. It adjusts the replication topology (i.e. the set of connection objects) dynamically to accommodate new domain controllers, domain controllers moved to and from sites, changing costs and schedules, and domain controllers that are temporarily unavailable.

KCC checks the topology every 15 minutes by default, and makes changes to the topology, as necessary. In Windows 2000, KCC cannot use more than one bridgehead server per site per directory partition. In Windows Server 2003, KCC randomly distributes a replication load (by creating new or modifying existing connection objects) between all domain controllers capable of being bridgehead servers within a site. However, KCC is not capable of balancing the load of existing connection objects between a set of bridgehead servers (e.g. in a scenario where a new domain controller capable of being a bridgehead server is added to a site). Also, KCC does not stagger replication schedules for existing connection objects.

Note

  • KCC can make changes to connection objects that are modified with the ADLB tool. This could happen, for example, if one of the bridgehead servers becomes unavailable. However, KCC does not modify connection objects that are changed due to schedule staggering.

For more information about Active Directory replication, see the Active Directory Overview Web site.

(http://go.microsoft.com/fwlink/?LinkId=1646)

System Requirements

The following are the system requirements for ADLB:

  • Microsoft Windows 2000, Microsoft Windows Server 2003, Windows XP Professional operating systems
  • Active Directory domain environment

The following are the system requirements for ADLB when running schedule staggering:

  • Microsoft Windows 2000 domain controller, Microsoft Windows Server 2003 domain controller
  • Windows Server 2003 domain functional level (for schedule staggering only)
  • Inter-Site Messaging Service on the domain controller

File Required

  • Adlb.exe


Checkrepl.vbs: Check Replication

Overview | Remarks | Syntax | Examples | Related Tools Open Command Prompt

Check Replication (CheckRepl) is a command-line tool that monitors replication and enumerates the replication topology for a given domain controller.

Corresponding Operating System Features

The Active Directory Sites and Services snap-in allows you to view and manage replication.

Concepts

Replication is the process by which changes that are made on one domain controller are synchronized with all other domain controllers in the domain or forest that store copies of the same information. Data integrity is maintained by tracking changes on each domain controller and updating other domain controllers in a systematic way.

To maximize efficiency and reduce latency, Windows Server 2003 creates a replication topology automatically. This topology describes the physical connections between domain controllers and sites, and explains how changes are replicated throughout the domain and forest.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000 or Windows Server 2003 operating systems
  • Active Directory environment
  • Windows Management Instrumentation (WMI) Provider installed on the client computer

Files Required

  • Checkrepl.vbs
  • Iadstools.dll

Note

  • Iadstools.dll is located in the Support directory on the Windows Server 2003 CD and the Windows Server 2003 Deployment Kit CD. If support tools are not installed on the computer that is running CheckRepl, Iadstools.dll must be registered before running CheckRepl. See the Remarks page for instructions about registering the Iadstools.dll file.


Dumpfsmos.cmd: Dump FSMO Roles

Overview | Syntax | Examples | Related Tools

Dump FSMO Roles (DumpFSMOs) is a command-line tool that displays the operations master (also known as flexible single master operations or FSMO) roles target server's domain and forest. Using Dump FSMO Roles you can find the names of the domain controllers that are performing operations master roles.

There are five operation master roles. Two of them exist at the forest level, meaning that only one server fills that role for the entire forest. These are the schema master and the domain naming master. The remaining three roles exist at the domain level, meaning that one server fills that operations master role for every domain in the forest. These include RID master, primary domain controller emulator, and infrastructure master

Corresponding Operating System Features

The Active Directory snap-ins expose subsets of this tool.

Concepts

An operations master is a server that is designated to handle specific domain-wide or forest-wide Active Directory functions. Some Active Directory operations pose a potential threat to the directory if they can be modified at multiple servers at the same time. Modification of the schema is one such operation. It can only be performed at one domain controller in the forest, the domain controller that holds the Schema Master operations master role. By default, this is the first domain controller installed in the forest. If the Schema Master is down or unavailable, the schema cannot be modified, even if the currently logged-on user is a member of the Schema Admins group. The Schema Master operations master role can be transferred to another server if required, or seized if the original Schema Master is down and can never be available again. For more information on operations master, see Manage operations master roles in Help and Support Center.

System Requirements

The following are the system requirements for DumpFSMOs:

  • Windows XP, Windows 2000, or Windows Server 2003 operating systems
  • Active Directory domain environment

The following rights are required to run DumpFSMOs:

  • Builtin\Administrator, to run the tool locally.
  • Domain\Administrator or Enterprise\Administrator, to run the tool remotely.

File Required

  • Dumpfsmos.cmd


FrsFlags: File Replication Service Flags

Overview | Syntax | Related Tools

File Replication Service Flags (FrsFlags) is a command-line tool that enables and disables the Install Override feature of File Replication Service (FRS). It sets and clears the FrsFlags attribute of replica objects in Active Directory.

Note

  • The Install Override feature is defined per replica set. The user needs to supply the replica name and the domain name.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Windows Server 2003 uses FRS to replicate system policies and logon scripts stored in System Volume (SYSVOL). Each domain controller keeps a copy of SYSVOL for network clients to access. FRS can also replicate data for Distributed File System (DFS), synchronizing the content of each member in a replica set defined by DFS. FRS can copy and maintain shared files and folders on multiple servers simultaneously. When changes occur, content is synchronized immediately within sites and by schedule between sites.

System Requirement

The following is the system requirement for this tool:

  • Windows Server 2003

File Required

  • Frsflags.vbs


Ifmember.exe: User Membership Tool

User Membership (IfMember) is a command-line tool that checks whether or not the current user is a member of a specified group. It is typically used in Windows logon scripts and other batch files.

IfMember uses its own process token to discover group membership, rather than querying the relevant domain controller each time it runs. While this has a significant performance benefit, it means that IfMember will only be aware of groups on the local computer, on the computer's domain, and on trusted domains and will report on membership as it was when that token was obtained.

Corresponding Operating System Features

You can view the groups of which a user is a member in the Computer Management Local Users and Groups snap-in.

To open Local Users and Groups:

  • Click Start, point to Settings, and click Control Panel.
  • Click Administrative Tools, and then click Computer Management.
  • Click Local Users and Groups.

Concepts

Group memberships are the groups to which a user account belongs. Permissions and rights granted to a group are also provided to its members. In most cases, the actions a user can perform in Windows are determined by the group memberships of the user account to which the user is logged on.

As an administrator, you can use Group Policy to manage all computers and users in a domain. For more information on Group Policy, see Group Policy overview.

System Requirements

The following are the system requirements for this tool:

  • Windows XP and Windows Server 2003.

File Required

  • Ifmember.exe


Lbridge.cmd: LBridge

Overview | Remarks | Syntax | Examples | Related Tools

LBridge is a batch file that assists in managing file replication between domain controllers in mixed-mode environments. LBridge pushes files from the System Volume (sysvol) on a Microsoft Windows Server 2003 server to the Export folder on a Windows NT version 4.0 server.

LBridge provides a bridge between the replication architectures of Windows NT 4.0 and Windows 2000 or Windows Server 2003 . This batch file moves files from the Windows 2000 or Windows Server 2003 Sysvol to the Export directory used by LMRepl (the directory replication service in Windows NT 4.0) on Windows NT 4.0 servers. The benefit of this approach is that it keeps the two replication mechanisms physically separated from one another, so that no legacy services are introduced onto the Windows 2000 or Windows Server 2003 domain controller.

LBridge is a sample batch file that you can adapt to your own needs. It can use either XCopy or RoboCopy, or another copy utility as the file-copying application.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

On Windows NT 4.0 domains, LMRepl is generally used to replicate logon scripts to all domain controllers. Windows Server 2003, however, does not support LMRepl. Active Directory uses File Replication Service (FRS) to automatically replicate, to all domain controllers, the contents of Sysvol, a shared folder that contains shared information and logon scripts.

System Requirements

The following are the system requirements for LBridge:

  • Windows 2000 or Windows Server 2003 operating systems

Files Required

  • Lbridge.cmd
  • Copy program, such as XCopy or RoboCopy


Moveuser.exe: Move Users

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Moveuser.exe: Move User

Overview | Syntax | Examples | Related Tools Open Command Prompt

Move User (MoveUser) is a command-line tool that changes the security of a user profile so that it can be associated with a different user account. Use MoveUser after moving a user to a different domain so that the user can keep the user profile associated with the original user account.

Corresponding Operating System Features

You can use Regedit to edit the registry and System in Control Panel to modify permissions on a user profile.

To open the Registry Editor:

  1. Click Start, and then click Run.
  2. Type Regedit and press ENTER.

To open System in Control Panel:

  1. Click Start, and then click Control Panel.
  2. Double-click the System icon.
  3. Select the Advanced tab, and then select the User Profiles button.

Concepts

User profiles store settings that control the appearance of user desktops as well as information about the most recently used files. By default, user profiles are created and stored on the local computer. A user profile is associated with the security identifier (SID) of the user account and access permissions are only granted to the user account that created the user profile. When a user account is moved to a new domain, the user, by default, no longer has access to the old user profile.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP Professional, Windows Server 2003.
  • Permissions: Administrative rights in both the old and new domain.

File Required

  • Moveuser.exe


Queryad.vbs: Query Active Directory

Query Active Directory (QueryAD) is a command-line tool that is a Visual Basic script that submits a query to Active Directory.

Corresponding Operating System Features

The Active Directory snap-ins expose subsets of this tool.

Concepts

Active Directory provides directory services in the Windows 2000, and Windows Server 2003 operating systems. For more information about deploying and using Active Directory, see the Active Directory Overview Web site.

(http://go.microsoft.com/fwlink/?LinkId=1646)

System Requirements

The following are the system requirements for Queryad.vbs:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Queryad.vbs


Rcontrolad.exe: Active Directory Remote Control Add-On

Overview | Remarks | UI | Related Tools

Active Directory Remote Control Add-On (RControlAD) is a tool that opens a Remote Desktop connection from Active Directory MMC snap-ins to computers running Windows 2003 Server or Windows XP Professional. A connection can also be opened to a Terminal Server running on Windows 2003 Server or Windows 2000 Server. RControlAD makes it easier for administrators to remotely administer servers.

Corresponding Operating System Features

Terminal Services allows you to remotely connect to and control a remote computer.

Concepts

Remote Desktop for Administration provides remote access to the server desktop by using the Terminal Services Remote Desktop Protocol (RDP) on port 3389. RDP transmits the user interface to the client session, and also transmits keyboard and mouse clicks from the client to the server. You can create up to two simultaneous remote connections. Each session you log on to is independent of other client sessions and the server console session. In essence, you can use Remote Desktop for Administration to log on to the server remotely as though you were logged on locally.

System Requirements

The following are the system requirements for this tool:

  • Remote Desktop Connection for Windows XP Professional or Windows Server 2003 operating systems
  • Active Directory domain environment
  • Membership in the Domain Administrators group

File Required

  • Rcontrolad.exe


Sonar.exe: FRS Status Viewer

Overview | Remarks | Syntax | UI | Related Tools Open Command Prompt

FRS Status Viewer (Sonar) is a command-line tool that allows administrators to monitor key statistics and status about members of a file replication service (FRS) replica set. Administrators can use Sonar to watch key statistics on a replica set, allowing them to monitor traffic levels, backlogs, and free space.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

FRS is a replication engine that can handle multiple tasks at the same time. This ability allows FRS to replicate different files between different computers simultaneously. FRS does not guarantee the order in which files arrive. Files begin replication in sequential order based on the time when the files are closed, but file size and link speed determine the order of completion. Because FRS replicates only whole files, the entire file is replicated, even if you change only a single byte in the file.

The collection of servers all replicating a given set of directories is called a replica set. With an appropriate topology design and sufficient network support, a Windows FRS replica set can span thousands of computers. It is also possible for a single computer to be a member of multiple replica sets.

Common Language Runtime (CLR) provides an execution environment that manages running code and provides services that make software development easier. These services include automatic memory management, cross-language integration, interoperability with existing code and systems, simplified deployment, and a highly detailed security system.

CLR is flexible enough to run a variety of different types of applications. For example, the benefits provided by the CLR apply equally well to console applications, Web server scripts, downloaded controls, traditional Win32-based applications, database queries, and macros in business productivity applications.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems
    • It is not necessary to have the CLR on the computers being monitored.

Files Required

  • Sonar.exe
  • Ntfrsapi.dll (on local computers)
  • The Microsoft .NET Framework Common Language Runtime, if not already installed. The .NET Framework is not automatically installed with the Windows 2000 Operating System but it is with Windows XP Professional and Windows Server 2003. Sonar should be used with the latest version of the .NET Framework / CLR. This can be downloaded at the Microsoft .NET Framework Download Web site (http://go.microsoft.com/fwlink/?LinkID=13011).

    • Notes

    • If you want to run Sonar on a Windows 2000 Professional computer system, copy Ntfrsapi.dll from a Windows 2000 Server system.
    • There are some known issues with gathering FRS performance counters. If you experience Data Collection errors of type PerfCtr, try Sonar with the parameter /rpc (Repair Perf Counter). If the PerfCtr data collection error persists, use Sonar with the parameter /npc (No Perf Counter). Windows Server 2003 builds up to RC1 are known to not support FRS performance counters.
    • Due to an issue in the CLR, Sonar cannot be used through Windows Server 2003 RC1 or RC2 terminal server. The issue will be fixed in a future version of WinForms in the CLR.
    • The Performance Counters are sometimes known to get corrupted, causing a 1010 Event Log Error stating that the FileReplicaConn and FileReplicasets encounter an exception error and have been disabled. You can use the /rpc parameter to repair this situation using the /npc parameter.


Availability and Scalability Management Tools

Tools in this category are used to manage the following Windows features:

  • Enterprise Memory Architecture
  • Quality of Service (QoS)
  • Redundant Array of Independent Disks (RAID)
  • Windows Clustering


Clusdiag.exe: Cluster Diagnostics and Verification Tool

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Clusdiag.msi: Cluster Diagnostics and Verification Tool

Related Tools

Cluster Diagnostics and Verification (ClusDiag) is a graphical user interface (GUI) tool that provides administrators with an interface for performing diagnostic tests on a preproduction cluster and a log file interface that aids in troubleshooting cluster failures. ClusDiag can also generate various cluster-related reports from the information gathered during testing.

Note

  • This tool hosts its own help file. For details and more information on this tool, select Help from the main menu.

Corresponding Operating System Features

There is no additional user interface for this tool.

Concepts

A server cluster is a group of independent computer systems, known as nodes, that work together to run a common set of applications and to provide a single system image to the clients and to the application. The computers are physically connected by cables and programmatically connected by clustering software. The nodes in a cluster remain in constant communication through the exchange of periodic messages, called heartbeats. If one of the nodes becomes unavailable as a result of failure or maintenance, another node immediately begins providing service (a process known as failover).

Server clusters can be set up as one of three different cluster model configurations:

  • Single node server clusters can be configured with, or without, external cluster storage devices. For single node clusters without an external cluster storage device, the local disk is configured as the cluster storage device. This configuration is used for testing purposes.
  • Single quorum device server clusters have two or more nodes and are configured so that every node is attached to one or more cluster storage devices. The cluster configuration data is stored on a single cluster storage device.
  • Majority node set server clusters have two or more nodes but the nodes may or may not be attached to one or more cluster storage devices. The cluster configuration data is stored on multiple disks across the cluster and the Cluster service makes sure that this data remains consistent across the different disks.

System Requirements

The following are the system requirements for ClusDiag:

  • Windows XP Professional or Windows Server 2003 operating systems

File Required

  • Clusdiag.msi


Clusfileport.dll: Cluster Print File Port

Overview | Remarks | Syntax | Examples | Related Tools

Cluster Print File Port (ClusFilePort) is a tool that adds functionality to clustered print servers. ClusFilePort allows printers within a cluster to print to a file or redirect print jobs. ClusFilePort does this by adding a port type named Cluster File Ports to the list of available ports.

Corresponding Operating System Features

ClusFilePort does not work at a command prompt. It adds an additional port type to Printers and Faxes in Control Panel (Printers in Windows 2000).

Concepts

Windows 2000 and Windows Server 2003 include the ability to connect to devices that can only connect directly to a print server. Each also includes the ability to print to a file or redirect print jobs. These functions are not available from a print server within a Windows 2000 or Windows Server 2003 cluster; however, these functions are available in Windows NT Service Pack 3 clusters. This functionality was dropped due to changes in the port monitor interfaces. ClusFilePort restores these printing functions for clustered print servers in Windows 2000 and Windows Server 2003.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000 or Windows Server 2003 operating system
  • Permissions: Cluster administrator rights

Files Required

  • Clusfileport.dll
  • Clusfileport.inf


Clusterrecovery.exe: Server Cluster (MSCS) Recovery Utility

Overview | Remarks | UI | Examples | Related Tools Run Tool

Server Cluster (MSCS) Recovery Utility (ClusterRecovery) is a GUI tool that collects and stores information on a cluster to aid in recovering from the failure of a shared bus.

Note

  • ClusterRecovery hosts its own help file. For details and more information on this tool, select Help from the main menu.

There is no additional user interface for this tool.

Corresponding Operating System Features

To open Cluster Administrator:

  1. Click Start, and then click Programs.
  2. Double-click Administrative Tools, and then double-click Cluster Administrator.

Concepts

The cluster disks are an array of one or more hard disk drives or other storage-class devices that are accessed by a shared bus. The data for clustered applications or services is stored on these disks. In some cases, such as an active/active configuration of SQL Server on a server cluster, the program, as well as the data, reside on the cluster disk. One of the cluster disks is the quorum disk to which the quorum log and checkpoint files are written.

A resource on a cluster stores data and configuration information in the registry of the local server, just as other applications and services do. When a cluster moves a resource to a different node in the cluster due to a failure, the registry information must also move. To plan for this move, the cluster server automatically copies registry information for cluster resources to checkpoint files and stores it in the quorum.

If a resource must be moved to a different node in the cluster, the Cluster service also updates the local registry from the checkpoint files. If checkpoint files are lost or become out-of-date, the applications and services may not function correctly.

The server cluster physical disk resource uses the disk signature to identify a disk and to map the real device to a physical disk resource instance. When a physical disk fails and is replaced, or when a physical disk is re-formatted with a low-level format (may be required if the Input/Output (I/O) subsystem information on the disk becomes corrupt for any reason), the signature of the newly formatted disk no longer matches the signature stored by the physical disk resource. When this happens, the physical disk resource cannot be brought online. Action is required to restart the applications using that disk.

System Requirements

The following are the system requirements for this tool:
  • Windows Server 2003, Enterprise Edition, or Windows Server 2003, Datacenter Edition

File Required

  • Clusterrecovery.exe


Diskraid.exe: RAID Configuration Tool

RAID Configuration (DiskRaid) is a command-line tool that enables configuration and management of redundant array of independent (or inexpensive) disks (RAID) storage subsystems.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

RAID is a method used to standardize and categorize fault-tolerant disk systems. RAID levels provide various mixes of performance, reliability, and cost. Some servers provide three of the RAID levels: Level 0 (striping), Level 1 (mirroring), and Level 5 (striping with parity). RAID is usually used on servers.

A hardware RAID subsystem distinguishes physically addressable storage units from one another by using a Logical Unit Number (LUN).

Each plex contains a copy of the data on the LUN object. A LUN object must have at least one plex, and can have any number of additional plexes. Plexes can be added and removed from LUN objects.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003.
  • Permissions: Must be a member of the Administrators group.
  • At least one Virtual Disk Service Hardware Provider must be registered.

File Required

  • Diskraid.exe


Qtcp.exe

Qtcp measures end-to-end network service quality. Qtcp sends a sequence of test packets through a network, then reports on the queuing delay experienced by each packet. Packets that do not arrive at the destination are recorded as dropped packets. This tool can be used on either a production network or a controlled test network.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Qtcp:

  • Can report very precise delay variations, on the order of microseconds.
  • Invokes network Quality of Service (QoS) by default and is useful for evaluating QoS mechanisms.
  • Can simulate traffic flows shaped to a range of token bucket parameters for a range of user-selectable packet sizes.
  • Can be used on an isolated, controlled network or a production network.
  • Generates detailed result logs, and can collate multiple log files to produce a statistical summary across variables.

A Qtcp session is invoked on both a sending and a receiving host computer. After invocation, the tool sets up a TCP control channel between sender and receiver to properly negotiate the test. At the same time, it uses the GQoS application programming interface (API) (part of Winsock2) to invoke QoS from local traffic control and from the network.

When the test is finished, the receiving host parses the log of received packets and generates three log files:

  • Filename.sta reports summary statistics about the total number of packets received and specifies the sequence number of each dropped packet.
  • Filename.raw contains a detailed log showing normalized send time and receive time for each packet, latency (the difference between sent and received time), packet size, and sequence number.
  • Filename.log normalizes the results of Filename.raw to account for clock skew between the two hosts.

For more information about how to use Qtcp, see Using Qtcp to Measure Network Service Quality on the Remarks page.

Kernel-Mode Time-Stamping Module

Qtcp works with an optional kernel-mode time-stamping module that can be run only on Microsoft Windows 2000. Timestmp.sys is a separate tool also included in the Windows 2000 Resource Kit, and requires separate installation with its own installer, Tsinstl.exe. As packets are transmitted and received, TimeStmp stamps them with the local time to a precision of 100 ns. If the kernel-mode time-stamping module is not installed, Qtcp uses a user-mode time-stamp that is less accurate.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP, or Windows Server 2003 operating system

Note

  • RSVP Signaling and Admission Control Service (ACS) are supported only on Windows 2000. They are not implemented on subsequent versions of Windows.

Files Required

  • Qtcp.exe
  • Timestmp.sys - optional
  • Tsinstl.exe - installs Timestmp.sys

The files for Qtcp are installed by the Resource Kit setup program into the \Qostools subdirectory of the Resource Kit installation directory.


Command Shell and Scripting Tools

Tools in this category are used to manage the following Windows features:

  • ADSI
  • Command shell (Cmd.exe)
  • Logon scripts
  • Task Scheduler
  • Windows Server 2003 family framework
  • WMI
  • WSH


Autoexnt.exe: AutoExNT Service

Overview | Remarks | Related Tools

AutoExNT Service (AutoExNT) is a service that allows you to start a custom batch file named Autoexnt.bat at startup without having to log on to the computer on which it will run.

The AutoExNT Service permits an administrator to configure a computer running Windows to run a custom batch file when the computer is first started. A user or administrator is not required to be logged on at the time this custom batch file runs.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

The Services snap-in helps you manage the services on your computer, set up recovery actions to run if a service fails, and create custom names and descriptions for services so you can easily identify them.

The Windows command shell uses the command interpreter, Cmd.exe, which loads applications and directs the flow of information between applications to translate user input into a form that the operating system understands. You can perform operations more efficiently by using batch files than you can by using the user interface. Batch files accept all commands that are available at the command line.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems
  • Permissions: Administrator rights on the computer on which the tool is installed

Files Required

  • Autoexnt.exe
  • Servmess.dll
  • Instexnt.exe


Cmdhere.inf: Command Here

Overview | Remarks | Related Tools

Command Here (CmdHere) is a shell extension that adds a CMD Prompt Here item to the context menu that is available when you right-click in the Folders (left) pane of Windows Explorer. Selecting the Command Here option from the context menu opens a new command-line session with the same path as that of the object that you right-click.

Corresponding Operating System Features

The Command Prompt offers similar functionality to the CmdHere shell extension.

To open a command window in the Documents and Settings\<LocalUser> directory

  1. Click the Start menu and point to Accessories.
  2. Click Command Prompt.

Concepts

The Windows XP command shell uses the command interpreter Cmd.exe, which loads applications and directs the flow of information between applications, to translate user input into a form that the operating system understands.

System Requirement

The following is the system requirement for this tool:

  • Windows Server 2003

File Required

  • Cmdhere.inf


Iniman.exe: Initialization Files Manipulation Tool

Initialization Files Manipulation Tool (IniMan) is a command-line tool that enables you to add, delete, modify, or query sections or keys in an .ini file. Examples of .ini files are setup answer files, program initialization files, and .inf files. IniMan also allows you to create new answer files that contain only your chosen values.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Unattended setup is the method by which original equipment manufacturers (OEMs), corporations, and other users install programs in unattended mode. To accomplish an unattended setup, create and use an answer file—a customized script that answers the setup questions automatically. Then run Setup from the command line with the appropriate options for unattended setup.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems
  • .NET Framework
  • Permissions: Read and write permissions on the file being modified

    • Note

    • Windows Server 2003 installs .NET Framework by default.

File Required

  • Iniman.exe


Logtime.exe

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Logtime.exe: LogTime

Overview | Remarks | Syntax | Examples | Related Tools Open Command Prompt

LogTime is a command-line tool that logs the start or finish of command-line programs from a batch file. This is useful for timing and tracking batch jobs such as mail-address imports.

LogTime creates a log file called Logtime.log, with a date-and-time stamp next to the specified parameter (text_string in LogTime syntax). When called from within a batch file, the date-and-time stamp records when LogTime (with the given parameter) was run by the batch file. For example, if LogTime is run before and after a command-line program in a batch file, Logtime.log records the start and stop time of that program.

With each use of LogTime, new information is appended to Logtime.log; the file is not overwritten.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A batch file is an ASCII text file containing a sequence of operating system commands, possibly including parameters and operators supported by the batch command language. When the user types a batch file name at the command prompt, the commands are processed sequentially.

System Requirements

The following are the system requirements for LogTime:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Logtime.exe


Now.exe: STDOUT Current Date and Time

STDOUT Current Date and Time (Now) is a command-line tool that reads standard input (STDIN) and then displays, on standard output (STDOUT), the current date and time followed by the STDIN.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

STDIN and STDOUT are UNIX terms defined as follows:

  • STDIN. The defined source of input for a process. By default, STDIN comes from the terminal.
  • STDOUT. The defined receiver for output from a process. By default, STDOUT goes to the terminal.

System Requirements

The following are the system requirements for Now:

  • Windows XP Professional or Windows Server 2003 operating system

File Required

  • Now.exe


Oleview.exe: OLE/COM Object Viewer

Overview | Remarks | UI | Examples | Related Tools Run Tool

OLE/COM Object Viewer (OLEView) is a GUI tool that allows you to manage all Microsoft Component Object Model (COM) classes installed on your computer.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Object linking and embedding (OLE) is a way to transfer and share information between applications by copying information created in one application and pasting it into a document created in another application. For example, if you create an OLE object in Microsoft Word that contains your business address, you can use the same object in Microsoft Excel without reentering the information.

System Requirements

The following are the system requirements for OLEView:

  • Windows XP Professional, Windows Server 2003, Windows 2000, Windows NT version 4.0, Windows 98, or Windows 95 operating system
  • Microsoft Internet Explorer 3.0 or higher, or the Microsoft ActiveX Software Development Kit (SDK) installed

Note

  • OLE2View, the version of this tool that was included with Windows NT versions 3.5 and 3.51, is included with the Microsoft Win32 Software Development Kit (SDK) and Microsoft Visual C++.

Files Required

  • Oleview.exe
  • Comcat.dll
  • Iviewers.dll


Pathman.exe: Path Manager

Path Manager (PathMan) is a command-line tool that adds or removes components from system or user paths. PathMan can modify any number of paths in a single call, and it includes error checking that can handle path abnormalities such as repeated entries, missing entries, and adjacent semicolons.

Corresponding Operating System Features

The Environment Variables dialog box offers the ability to manually add or remove components from system or user paths.

To open the Environment Variables dialog box:

  1. In Control Panel, choose System.
  2. On the Advanced tab, click Environment Variables.

Concepts

Windows XP and Windows Server 2003 manage two types of paths: the current user path and the system path. Windows XP and Windows Server 2003 keep a separate user path for every user on a system, but there is only one global system path. When a user logs on to a computer running Windows XP or Windows Server 2003, the user and system paths are combined to create the user's full path. For backward compatibility, Windows also loads path information from old Autoexec.bat files in the root directory.

System Requirements

The following are the system requirements for PathMan:

  • Windows XP Professional or Windows Server 2003 operating system.
  • Administrator privileges to modify the system path. Users can modify their own user paths.

Files Required

  • Pathman.exe
  • Pathman.doc


Sleep.exe: Batch File Wait

Overview | Syntax | Examples | Related Tools Open Command Prompt

Batch File Wait (Sleep) is a command-line tool that causes the computer to wait for a specified amount of time.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

You can use batch files, which are also called batch programs or shell scripts, to simplify routine or repetitive tasks. A batch file is an ASCII (unformatted text) file that contains one or more operating system commands. When you type the file name at the command prompt, or when the batch program is run from another program, the commands are run sequentially as they appear in the file. The file name of a batch program has a .cmd or .bat extension. For more information about batch files and shell scripting, see Using batch files (http://go.microsoft.com/fwlink/?LinkID=13963) on the Microsoft TechNet Web site.

System Requirements

The following are the system requirements for Sleep:

  • Windows XP Professional or Windows Server 2003 operating system

File Required

  • Sleep.exe


Disk and Data Management Tools

Tools in this category are used to manage the following Windows features:

  • Disk Defrag
  • Disk Quotas
  • Distribute File System
  • Encrypting File System
  • FAT
  • Formatting disks
  • NTFS
  • Recovering disks
  • Remote Storage
  • Removable Storage


Cdburn.exe: ISO CD-ROM Burner Tool

ISO CD-ROM Burner Tool (CDBurn) is a command-line tool that allows the user to write (burn) data images from image files located on the hard drive to compact disc (CD) recordable (CD-R) and CD rewritable (CD-RW) media. The data image can be any kind of data, even raw data. This tool can also be used to erase CD-RW media.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

CDBurn allows users to burn image files containing any data, such as file systems like ISO9660 (Level 1, 2, or 3), Joliet, Universal Disk Format (UDF), or a combination of file systems. CDBurn's default mode is Track At Once (TAO). The tool also supports writing in Session At Once (SAO) mode, but not all drives support writing in this mode.

CDBurn automatically appends a postgap of 150 sectors prior to closing the disc. The appending of the postgap can be overridden by using the /imagehaspostgap option. The tool always finalizes the disc. This means that you cannot add any data to the disc after writing.

CDBurn writes data images to CD writable media from International Organization for Standardization (ISO) image files created by a variety of tools. One of these tools is Oscdimg.exe (available in the Microsoft original equipment manufacturer (OEM) preinstall kit (OPK)). Any other product that creates an ISO image file can also be used.

System Requirements

The following are the system requirements for CDBurn:

  • Windows XP Professional or Windows Server 2003 operating system
  • A CD burner

Files Required

  • Cdburn.exe
  • Mountvol.exe - an operating-system tool used to obtain volume names


Confdisk.exe: Disk Configuration Tool

Disk Configuration (ConfDisk) is a command-line tool that helps to recover failed disks in a cluster. ConfDisk uses Automated System Recovery (ASR) to create a file that saves the configuration information of a local cluster. The file created by ConfDisk can be later used to recover a failed cluster if the disk signature is incorrect or the ASR backup set is unavailable.

Corresponding Operating System Features

The Cluster Administrator (Cluadmin.exe) exposes a subset of this tool.

To open Cluster Administrator

  1. Click Start, and then click Programs.
  2. Double-click Administrative Tools.
  3. Double-click Cluster Administrator.

The Cluster Recovery Tool (Clusterrecovery.exe) also helps to restore clusters after a disk failure. The Cluster Recovery Tool is part of the Windows Server 2003 Resource Kit.

Concepts

A server cluster is a group of independent computer systems, known as nodes, that work together to run a common set of applications and to provide a single system image to the clients and to the application. The computers are physically connected by cables and programmatically connected by clustering software. The nodes in a cluster remain in constant communication through the exchange of periodic messages, called heartbeats. If one of the nodes becomes unavailable as a result of failure or maintenance, another node immediately begins providing service (a process known as failover).

Automated System Recovery (ASR) is a wizard that backs up the system state, system services and all disks associated with the operating system components; it also creates a floppy disk containing information about the backup that created the ASR set, the disk configurations (including basic and dynamic volumes), and how to accomplish a restore. When performing a restore, ASR reads the disk configurations from the floppy and restores all the disk signatures, volumes, and partitions on, at a minimum, the disks required to boot up. (It attempts to restore all the disk configurations, but under some circumstances, may not be able to).

System Requirements

The following are the system requirements for ConfDisk:

  • Windows Server 2003, Enterprise Edition, or Windows Server 2003, Datacenter Edition

File Required

  • Confdisk.exe


Delprof.exe: User Profile Deletion Utility

User Profile Deletion Utility (DelProf) is a command-line tool that can be used to delete user profiles on local and remote computers. User profiles can grow large and may take up considerable disk space (easily over a megabyte each), especially if there are several users using one computer. DelProf allows administrators to reclaim disk space by removing profiles that are no longer needed. The User Profile Deletion Utility Tool can also be configured to delete user profiles after a specified period of user inactivity.

Caution

  • This tool deletes everything in a user profile, including settings, colors, and documents.

Note

  • You must be logged on as administrator, or as a member of the administrator group to delete user profiles.

Corresponding Operating System Features

To manually view and manage user profiles, use one of the following methods to open the User Profiles dialog box.

Method 1:

  1. Right click the My Computer icon, and select Properties.
  2. On the System Properties dialog box, click the Advanced tab.
  3. Under User Profiles, click Settings. The User Profiles dialog box opens.

Method 2 (Classic Start Menu):

  1. Click Start, point to Settings, point to Control Panel, and then click System.
  2. On the System Properties dialog box, click the Advanced tab.
  3. Under User Profiles, click Settings. The User Profiles dialog box opens.

Method 3 (Standard Start Menu):

  1. Click Start, point to Control Panel, and then click System.
  2. On the System Properties dialog box, click the Advanced tab.
  3. Under User Profiles, click Settings. The User Profiles dialog box opens.

Concepts

Each computer running a Windows operating system records some configuration information on a user-by-user basis. The recorded information includes such things as the desktop arrangement, personal program groups and the program items in those groups, screen colors, screen savers, network connections, printer connections, mouse settings, and window size and position. This information is saved in user profiles.

When a user logs on, a user profile is loaded, and the specific Windows configuration recorded in the user profile is created. When a user logs off, changes to the Windows configuration are saved in the user profile. In this way, users automatically retain changes to their Windows configuration across logons at a particular computer. There is one exception: this information is not saved for Guest accounts.

By default, every Windows computer maintains this user profile information. But in many situations, it is advantageous to create custom user profiles and assign those profiles to user accounts. The reasons for doing so are:

  • To give a user the same user profile at any computer in the network.
  • With a custom user profile available on a network, the user has access to the same profile from any Windows computer in the user's domain.
  • To create one user profile for a set of users who perform similar tasks.

System Requirements

DelProf operates on the following server and client operating systems:

  • Windows NT 4.0, Windows 2000 Professional, or Windows XP Professional
  • Windows NT Server, Windows 2000 Server, or Windows Server 2003

Note

  • DelProf can be used on a computer running Windows NT 4.0 to remotely delete profiles of another computer running Windows 2000 Professional, or Windows XP Professional but cannot be used to delete profiles on a computer running Windows NT 4.0.
  • DelProf will not run on Microsoft Windows 95, Windows 98, or Windows Millennium Edition because the tool is Unicode-based.

File Required

  • Delprof.exe


Diskuse.exe: User Disk Usage Tool

User Disk Usage Tool (DiskUse) is a command-line tool that scans a single directory, a directory tree, or an entire drive and reports the amount of space used by each user or all users. The output for this tool is displayed in the command window, or is sent to a file in table or text format. DiskUse can also list all the files owned by a user or users, filtered in a variety of ways.

Corresponding Operating System Features

The Computer Management snap-in allows you to view the status of the hard disk drives installed on a computer.

To open Computer Management:

  • In Control Panel, choose Administrative Tools, and then choose Computer Management.
  • Click Storage.

Concepts

A hard disk drive is a device that contains one or more inflexible platters coated with material in which data can be recorded magnetically with read/write heads. The hard disk drive exists in a sealed case that protects it and allows the head to fly 10 millionths to 25 millionths of an inch above the surface of a platter. Data on a hard disk drive can be stored and accessed much more quickly than on a floppy disk.

You can use disk quotas to manage disk usage on an NTFS file system. See Disk quotas overview for more information about using disk quotas.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating system

File Required

  • Diskuse.exe


Dvdburn.exe: ISO DVD Burner Tool

ISO DVD Burner Tool (DVDBurn) is a command-line tool that allows the user to write (burn) Digital Video Disk (DVD) images from image files located on the hard drive to Digital Video Disk (DVD) media. The data image can be created by any program capable of producing DVD image files. You can also use this tool to erase DVD media.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Types of DVD Media

There are five types of recordable DVD media. Here is some basic information for each type of media:

  • DVD-R (DVD Recordable) DVD-R is a write-once, read-many storage format similar to CD-R and is used to master DVD-Video and DVD-ROM discs. Write-once media (of any type) typically offers higher compatibility with older drives and consumer devices.
  • DVD+R (DVD Recordable) DVD+R media is write-once media. Write-once media (of any type) typically offers higher compatibility with older drives and consumer devices.
  • DVD-RAM (DVD Random Access Memory) DVD-RAM is a cartridge-based rewritable DVD disc designed for recording and playback. DVD-RAM acts just like a removable hard disk. DVD-RAM bare discs are fragile and do not guarantee data integrity.
  • DVD-RW (DVD Rewritable) DVD-RW is a rewritable (erasable) DVD format that is similar to DVD+RW but its ability to work as a random access device is not as good as that of +RW. You can rewrite this media many times. It has a read-write capacity of 4.7 GB. It is the only media that supports the /ERASE parameter.
  • DVD+RW (DVD Rewritable) DVD+RW is a rewritable DVD format with full random data recording support. It has a read-write capacity of 4.7 GB. DVD+RW media is always formatted as part of the DVDBurn process. The formatting takes the place of an erasure, so an /ERASE switch is neither required nor supported. You can rewrite this media many times.

System Requirements

The following are the system requirements for DVDBurn:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems
  • DVD Burner

Files Required

  • Dvdburn.exe
  • MountVol.exe - used to obtain volume names


Volperf.dll: Shadow Copy Performance Counters

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Volperf.exe: Shadow Copy Performance Counters

Overview | Remarks | Syntax | Related Tools Open Command Prompt

Shadow Copy Performance Counters (VolPerf) is a command-line tool that enables administrators to use System Monitor to monitor their shadow copies.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Volume Shadow Copy service provides new backup functionality in Windows Server 2003, including the following features:

  • It backs up files that are open for exclusive access.
  • It provides backups of volumes that reflect the state of those volumes at the instant the backup is started, even if the data changes while the backup is in progress. This feature makes sure that all the data in the backup is internally consistent and reflects the state of the volumes at a single point in time.
  • It notifies programs and services that a backup is about to occur, which allows them to prepare for the backup by cleaning up on-disk structures and by flushing caches and log files.

Windows XP and Windows Server 2003 obtain performance data from components in your computer. As a system component performs work on your system, it generates performance data. That data is described as a performance object and is typically named for the component generating the data. For example, the Processor object is a collection of performance data about processors on your system. To learn more about performance, see Understanding the Performance console in Help and Support Center for Windows Server 2003.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003 operating system
  • Permissions: Administrator privileges

Files Required

  • Volperf.exe
  • Volperf.dll


Volrest.exe: Shadow Copies for Shared Folders Restore Tool

Overview | Syntax | Examples | Related Tools Open Command Prompt

The Shadow Copies for Shared Folders Restore Tool (VolRest) is a command-line tool that searches for and restores previous file versions from file shares protected by the Shadow Copies for Shared Folders feature. VolRest allows administrators to browse or restore previous versions of one or multiple files stored on a server on which Shadow Copies for Shared Folders has been enabled. For example, from a single command line you can list or restore all the previous versions of your documents on a server.

Corresponding Operating System Features

The Windows Server 2003 operating system provides GUI functionality that corresponds to this tool. You can use the corresponding UI on either a Windows Server 2003 computer or a Windows XP computer.

On a Windows Server 2003 computer, you can access a shadow copy on a local or remote Windows Server 2003 using the following steps:

  1. Click Start, then Run.
  2. Type the path to the folder using a UNC path name, and then click OK. For example, to access a remote server, use the format \\myserver\myshare, and for a local server use the format \\localhost\myshare.
  3. Right-click the file that is protected by Shadow Copies for Shared Folders, and click Properties.
  4. Click the Previous Version tab.

The client software for shadow copies of shared folders is shipped with Windows Server 2003 and must be deployed on client computers.

On a Windows XP computer, you can access a shadow copy on a Windows Server 2003 using the following steps:

  1. On a Windows Server 2003, navigate to the following directory:

    c:\windows\system32\clients\twclient

  2. Copy the file twclient.exe to the client computer.
  3. Install twclient.exe.
  4. Click Start, then Run.
  5. Type the path to the folder using a UNC path name, and then click OK.
  6. Right-click the file that is protected by Shadow Copies for Shared Folders, and click Properties.
  7. Click the Previous Version tab.

Concepts

Shadow Copies of Shared Folders is a feature of Windows Server 2003 that provides consistent point-in-time shadow copies for network shares. Shadow Copies for Shared Folders will allow customers to view the contents of network folders as they existed at points of time in the past. This feature assists knowledge workers in the following three scenarios.

  • Recover files that were accidentally deleted. This is the network equivalent of the Recycle Bin functionality. If a knowledge worker accidentally deletes a file, the worker can use Shadow Copies of Shared Folders to open an old version and copy it to a safe location. This feature has the additional advantage over the Recycle Bin because it recovers files deleted by any method, as long as the required shadow copies exist.
  • Recover from accidentally overwriting a file. A common scenario is to create a new file by opening an existing file, making modifications, and saving it with a new name. For example, a knowledge worker might open a financial modeling spreadsheet, make modifications based upon new scenario assumptions, and save the spreadsheet with a new name to create a new spreadsheet. The problem occurs when the customer forgets to save the file using a new name and erases the original file. Shadow Copies for Shared Folders allows the knowledge worker to recover the original version of the file.
  • Allow version-checking while working on documents. The previous scenarios involve recovering a file after a user deletes or overwrites a file. However, knowledge workers can also use this feature to review the differences between versions of files. For example, a lawyer might want to know how a particular paragraph read before another colleague modified it.

System Requirement

The following is the system requirement for this tool:

  • Windows Server 2003 operating system and Windows XP

File Required

  • Volrest.exe


Vrfydsk.exe: Verify Disk

Verify Disk (VrfyDsk) is a command-line tool that checks the consistency and integrity of the file system (FAT or NTFS) on a specified volume. It creates and displays a status report for the volume based on the file system and also lists the errors on that volume, if any. However, if any errors are discovered, VrfyDsk cannot correct them; to correct these errors, run Chkdsk in fix mode.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

VrfyDsk uses the Volume Shadow Copy service (vssadmin) to create a shadow copy of the volume, and then checks the file system consistency for this shadow copy. It generates a status report and lists any errors found on the shadow copy. After displaying this report, VrfyDsk deletes the shadow copy.

Understanding Shadow Copies

VrfyDsk creates a volume shadow copy to run Chkdsk on. This is a volume that represents a duplicate of the original volume at the time the copy began.

Checking a FAT Disk

Windows displays Chkdsk status reports for a FAT disk in the following format:

Volume Serial Number is B1AF-AFBF
72214528 bytes total disk space
73728 bytes in 3 hidden files
30720 bytes in 12 directories
11493376 bytes in 386 user files
61440 bytes in bad sectors
60555264 bytes available on disk
2048 bytes in each allocation unit
35261 total allocation units on disk
29568 available allocation units on disk

Checking an NTFS Disk

Windows displays Chkdsk status reports for an NTFS disk in the following format:

The type of the file system is NTFS.
CHKDSK is verifying files...
File verification completed.
CHKDSK is verifying indexes...
Index verification completed.
CHKDSK is verifying security descriptors...
Security descriptor verification completed.
12372 kilobytes total disk space.
3 kilobytes in 1 user files.
2 kilobytes in 1 indexes.
4217 kilobytes in use by the system.
8150 kilobytes available on disk.
512 bytes in each allocation unit.
24745 total allocation units on disk.
16301 allocation units available on disk.

Understanding Exit Codes

The following table lists the exit codes that Chkdsk reports after it has finished.

Exit Code | Description
0 | No errors were found.
1 | Errors were found and fixed.
2 | Disk cleanup—such as garbage collection—was performed, or cleanup was not performed because the /f parameter was not specified.
3 | Chkdsk could not check the disk, errors could not be fixed, or errors were not fixed because the /f parameter was not specified.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003 operating system
  • Membership in the Administrators group

File Required

  • Vrfydsk.exe


File and Folder Management Tools

Tools in this category are used to manage the following Windows features:

  • File compression
  • File server
  • Indexing service
  • Offline files
  • Shared folders
  • Shared folder shadow copy
  • Synchronization Manager


Chklnks.exe: Link Check Wizard

Overview | UI | Related Tools Run Tool

Link Check Wizard (ChkLnks) is a GUI tool that scans all the link (shortcut) files on a computer to determine whether or not the shortcuts point to existing applications or documents. When Link Check Wizard does not find an associated application or document, the wizard lists that file as a dead link, giving you the option to remove it.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Links are used to associate desktop shortcuts and Start Menu items with an application or document. A shortcut is a quick way to start a frequently used program or open a file or folder without having to go to its installed location. When applications or documents are manually removed, the link files to their shortcuts are often left on the system. These are known as "dead" links.

System Requirements

The following are the system requirements for ChkLnks:

  • Windows XP Professional or Windows Server 2003 operating systems
  • Microsoft Internet Explorer version 4.0 or later.

File Required

  • Chklnks.exe


Compress.exe: Compress Files

Compress is a command-line tool that can be used to create compressed copies of one or more files. These compressed files can be expanded with the Expand.exe - File Expansion Tool command.

Note

  • Do not use Compress.exe (Compress) to compress files or folders on the NTFS file system formatted files or folders. To compress or decompress NTFS-formatted files or folders, use the Compact command-line tool or set the Compressed attribute of the file or folder in Windows Explorer.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

NTFS is an advanced file system designed to support long file names, full security access control, file system recovery, extremely large storage media, and various features for the Windows NT POSIX subsystem. It also supports object-oriented applications by treating all files as objects with user-defined and system-defined attributes.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Compress.exe


Creatfil.exe: Create File

Overview | Syntax | Examples | Related Tools Open Command Prompt

Create File (CreatFil) is a command-line tool that creates a blank file of a specified size, filled with space characters. This is useful for testing the behavior of tools, applications, and setup programs under conditions of low available memory on a hard disk.

Note

  • CreatFil must be run from the command prompt; it cannot be run from the Run command on the Start menu.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Users can manipulate files (for example, move them from one directory or folder to another) if file access permissions are not restricted. Windows files must have unique names within their directories.

System Requirements

The following are the system requirements for CreatFil:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Creatfil.exe


Csccmd.exe: Client Side Caching Command Line Options

Client Side Caching Command Line Options (CSCcmd) is a command-line tool that allows you to manage the client side caching (CSC) database.

Corresponding Operating System Features

You can enable and disable the use of offline files in Windows Explorer. To disconnect from a server, move files within the CSC database from one server to another, or re-stamp the Security Identifier on offline files, you must use the Client Side Caching Command (CSCcmd) tool.

To use offline files in Windows Explorer:

  1. Click Start, and then click My Computer.
  2. On the Tools menu, click Folder Options.
  3. On the Offline Files tab, make sure that the Enable Offline Files check box is selected.
  4. Select Synchronize all offline files before logging off to get a full synchronization. Leave it unselected for a quick synchronization.

Concepts

Client side caching is also known as Offline File use. Caching files on a client computer allows users to access files on network shares, even when the client computer is disconnected from the network. While caching files provides benefits for the local user, it also provides benefits for network performance. If users can read files from the local cache while connected to the network, the amount of data transferred over the network is reduced.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000 Server or Windows Server 2003 or Windows XP
  • To run Client Side Caching Command (CSCcmd) with the /disable parameter, the client computer must be running Windows Server 2003, Windows XP, Windows 2000 SP3 clients, or Windows 2000 clients that have applied QFE Q293426.
  • Permissions
    • To run CSCcmd with the /enable and /disable parameters, you must be a member of the Administrators group on the local computer.
    • No special permissions are needed to run CSCcmd with other parameters.

File Required

  • Csccmd.exe


Fcopy.exe: File Copy Utility for Message Queuing

Overview | Related Tools

File Copy Utility for Message Queuing (FCopy) is a command-line tool that compresses files and folders to facilitate copying across local area networks (LANs) and wide area networks (WANs). Because it uses Message Queuing (also known as MSMQ), FCopy continues to copy files even if there are network problems. FCopy includes update options, which copy files only if they have been changed.

FCopy divides files into 64 or 32-kilobyte segments, compresses each segment, and sends it as a Message Queuing message (in express mode). FCopy does not need to be restarted when a network breakdown occurs, because Message Queuing guarantees that the messages will be delivered.

File compression in FCopy uses a fast algorithm. It works well on any computer, but is most useful for slow lines; on regular Ethernet, it does not affect copy speed very much unless the computer has a fast CPU. FCopy has been tested on files of more than 5 gigabytes (GB), but can theoretically copy much larger files.

Notes

  • Message Queuing must be installed on your computer in order for FCopy to work.
  • To install FCopy, you must run Fcsetup.exe. Fcsetup.exe is installed into the Windows Resource Kit Tools folder by the Windows Resource Kit Tools installer, Rktools.msi.
  • FCopy hosts its own Help file, Fcopy.chm, which is installed when you run Fcsetup.exe.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

File compression is a way of reducing the size of files so they take up less space on a server or hard disk, and can travel faster over a network. File compression is accomplished with software that uses mathematical equations (algorithms) to condense repeated data into smaller codes. You need a separate software program to decompress (expand) the data and restore it to its original form.

Message Queuing technology enables applications running at different times to communicate across heterogeneous networks and systems that may be temporarily offline. Applications send messages to queues and read messages from queues. Message Queuing provides guaranteed message delivery, efficient routing, security, and priority-based messaging. It can be used to implement solutions for both asynchronous and synchronous scenarios that require high performance.

System Requirements

The following are the system requirements for FCopy:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating system
  • Message Queuing

Note

  • The Multicast File Copy Utilities for Message Queueing, Mqcast.exe and Mqcatch.exe, can be used with FCopy to distribute files from a single server to multiple clients over a LAN or WAN. These tools are documented in Mqcast.doc. The three files, Mqcast.doc, Mqcast.exe and Mqcatch.exe, are not included in Fcsetup.exe, but rather are installed with the Windows Resource Kit Tools.

Files Required

  • Fcsetup.exe
  • Mqcast.doc
  • Mqcast.exe
  • Mqcatch.exe


HLScan.exe: Hard Link Display Tool

The Hard Link Display (HLScan) command-line tool displays hard links on an NTFS volume or in specified files or directories of the volume. Hard links are alternate logical names for a physical file. The HLScan display lists all files with more than one name and includes the NTFS file ID, the number of names established for the file, and all file names and paths.

HLScan helps administrators secure their volumes by listing all the hard links that have been created for files, with and without authorization.

Note

  • Displays of hard links in specified directories (hlscan /dir) list only the link names in those directories. Hard links in other directories are included in the name count and listed as "Missing." For a complete list of names of a file, search the entire volume.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

NTFS is an advanced file system designed to support long file names, full security access control, file system recovery, extremely large storage media, and various features for the Windows NT POSIX subsystem. It also supports object-oriented applications by treating all files as objects with user-defined and system-defined attributes.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003
  • Permissions:
    • The user must have read permissions on Active Directory objects.
    • To reapply a delegation template, the user must have modify permissions to the Active Directory object.

File Required

  • HLScan.exe


Linkd.exe

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Linkd.exe: LinkD

Overview | Remarks | Syntax | Examples | Related Tools Open Command Prompt

LinkD is a command-line tool that links an NTFS file system folder to a target object. If the source and destination folders are targeted to a mapped drive (to a remote computer share), LinkD reports that a successful link is created but the reparse does not work. LinkD grafts the target name directly into the name space at the specified source directory. The source directory subsequently acts as a name-surrogate or junction point, standing in for the target object in the directory tree.

The source directory:

  • Must reside on a drive formatted with NTFS 3.0.
  • Must be empty

The destination or target:

  • Can be any valid Microsoft Windows directory name, device name, or object name.
  • Both the source and target must reside on drive(s) attached to the same machine. LinkD will not work across machines.

When the target name does not resolve to a directory or a device, open calls fail.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A junction point is a physical location on a local hard disk that points to another location on that disk or another storage device. When you create a mounted drive, you create a junction point. A mounted drive is a device attached to an empty folder on an NTFS volume. It behaves the same as any other drive, but no drive letter is attached to the volume, just a label.

A reparse point is a collection of user-defined data. The format of this data is understood by the application that stores the data, and a file system filter, which you install to interpret the data and process the file. When an application sets a reparse point, it stores this data, plus a reparse tag, which uniquely identifies the data it is storing. When the file system opens a file with a reparse point, it attempts to find the file system filter associated with the data format identified by the reparse tag. If a file system filter is found, the filter processes the file as directed by the reparse data. If a file system filter is not found, the file open operation fails.

Reparse points are used to implement NTFS links and the Microsoft Remote Storage Server. Remote Storage Server uses an administrator-defined set of rules to move infrequently-used files to long term storage, such as tape or CD-ROM. It uses reparse points to store information about the file in the file system. This information is stored in a stub file that contains a reparse point for which the data points to the device where the actual file is currently located. The file system filter can use this information to retrieve the file.

The following restrictions apply to reparse points:

  • Reparse points can be established for a directory, but the directory must be empty. Otherwise, NTFS fails to establish the reparse point. In addition, you cannot create directories or files in a directory that contains a reparse point.
  • Reparse points and extended attributes are mutually exclusive. NTFS cannot create a reparse point when the file contains extended attributes, and it cannot create extended attributes on a file that contains a reparse point.
  • Reparse point data cannot exceed 16 kilobytes. Setting a reparse point fails if the amount of data to be placed in the reparse point exceeds this limit.

System Requirements

The following are the system requirements for LinkD:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Linkd.exe


List.exe: List Text File Tool

List Text File Tool (List) is a command-line tool that displays and searches one or more text files. Unlike other text display tools, List does not read the whole file into memory when you open it. It allows a user to edit a text file in a hexadecimal format.

List is useful for displaying text or log files remotely, and for use on servers where administrators are concerned with degradation of system performance.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Hexadecimal is a base-16 number system represented by the digits 0 through 9 and the uppercase or lowercase letters A (equivalent to decimal 10) through F (equivalent to decimal 15).

System Requirement

The following is the system requirement for this tool:

  • Windows Server 2003

File Required

  • List.exe


Permcopy.exe

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Permcopy.exe: Share Permissions Copy

Overview | Remarks | Syntax | Examples | Related Tools Open Command Prompt

Share Permissions Copy (PermCopy) is a command-line tool that copies share-level permissions (Full Control, Read, Change) from one share to another.

Important

  • Copying permissions to an administrative share located on an x86-based computer causes Services.exe to stop.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A shared resource is any device, data, or program that is used by more than one program or one other device. For Windows, shared resource refers to any resource that is made available to network users, such as folders, files, printers, and named pipes. Shared resource can also refer to a resource on a server that is available to network users. A shared resource provides access to applications, data, or a user's personal data. You can assign or deny permissions with a variety of methods. You can use share permissions that are simple to apply and manage. Or, you can use access control on the NTFS file system which provides more detailed control of the shared resource and its contents. You can also use a combination of these methods. If you use a combination of these methods, the more restrictive permission always applies. For example, if the share permission is set to Everyone = Read (which is the default), and the NTFS permission allows users to make changes to a shared file, the share permission applies, and the user is not allowed to change the file. It is not always necessary to explicitly deny a permission to a shared resource. Denying permission is usually necessary only when you want to override specific permissions that are already assigned.

System Requirements

The following are the system requirements for Share Permissions Copy (PermCopy):

  • Windows XP Professional or Windows Server 2003 operating systems

File Required

  • Permcopy.exe


Perms.exe: User File Permissions

User File Permissions (Perms) is a command-line tool that displays user access permissions for a file or directory on an NTFS file system volume. Perms queries the permissions associated with a specific access control entry (ACE), displaying only those permissions granted by that particular access control entry ACE.

Corresponding Operating System Features

You can also use Windows Explorer to view effective permissions on files and folders.

To view permissions with Windows Explorer:

  1. Right-click the file or folder and then click Properties.
  2. Click the Security tab.
  3. Click the Advanced button to view the Advanced Security Settings dialog box.
  4. Click the Effective Permissions tab.
  5. Click the Select button to open the Select User or Group dialog box.
  6. Type the name of the user name or group name for which you would like to view permissions and click OK.

Concepts

The ability of an operating system to access files on a volume depends on the file system with which the volume was formatted. The major types of formatting are File Allocation Table (FAT)16, FAT32, and NTFS.

The file allocation table in the FAT file system is located at the beginning of a logical volume. FAT was designed for small disks and simple folder structures. Two copies of the file allocation table are stored in the volume. In the event that one copy of the file allocation table is corrupt, the other file allocation table is used.

The NTFS file system provides performance, reliability, and functionality not found in FAT. Some of the new features are Active Directory directory service and the storage features based on reparse points. NTFS also includes security features required for file servers and high-end personal computers in a corporate environment, and data access control and ownership privileges important for data integrity.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003
  • Permissions:
    • Membership in the Administrators group for the domain or computer where the account of the user is defined.
    • "Backup files and folders" privileges on the computer where the files are stored.

File Required

  • Perms.exe

For More Information

  • For more information on file systems, see "File Systems" in Microsoft Windows 2000 Server Operations Guide in the Microsoft Windows 2000 Server Resource Kit (or see "File Systems"(http://go.microsoft.com/fwlink/?LinkID=12636) at http://www.microsoft.com/reskit).


Qgrep.exe: Qgrep

Overview | Syntax | Examples | Related Tools Open Command Prompt

Qgrep is a command-line tool that is used to search a file or list of files for a specific string or pattern and return the line containing the match. QGrep also allows you to search multiple files and subdirectories.

Qgrep is similar to the UNIX tool grep.exe.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Strings are a sequence of characters, usually representing human-readable text.

Algorithms are lists of instructions for accomplishing tasks. A task can be anything that has a recognizable end-point (or result). Often, some of the specific steps in the procedure are to be repeated until the task is done. Algorithms are essential to the way computers process information, because a computer program is essentially an algorithm that tells the computer what specific steps to perform and in what specific order to perform the steps.

String searching algorithms are an important class of string algorithms that try to find a place where one or several strings or patterns are found within a larger string or text. The various algorithms can be classified by the number of patterns each uses:

  • Single pattern algorithms
    • Naïve string search algorithm
    • Knuth-Morris-Pratt string search algorithm
    • Boyer-Moore string search algorithm
    • Baeza-Yates and Gonnet string search algorithm
  • Several patterns algorithm
    • Aho-Corasick algorithm
  • Algorithms using infinite number of patterns
    • Naturally, the patterns cannot be enumerated in this case. They are represented usually by a regular grammar or regular expression.

System Requirements

The following are the system requirements for Qgrep:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Qgrep.exe


Robocopy.exe: Robust File Copy Utility

This command-line tool simplifies the task of maintaining an identical copy of a folder tree in multiple locations, either on the same computer or in separate network locations. Robust File Copy Utility (RoboCopy) can provide time-efficient maintenance of mirror images of large folder trees on network servers separated by slow or unreliable wide area network (WAN) links.

By default, RoboCopy ignores source file attributes when selecting files to copy. It copies any file matching specified conditions, regardless of the attribute settings of the file.

RoboCopy writes a log of files and folders to its command-prompt window, listing the:

  • Folders processed
  • Files copied and why
  • Network errors
  • Incompatibilities between the source and destination folder-tree structures

This output can also be redirected to a disk file. Just before RoboCopy closes, it writes a summary of its activities during its session to its command-prompt window, or to a disk file, if redirected.

Note

  • RoboCopy does not run on Microsoft Windows 95, or Microsoft Windows NT, version 3.5x. RoboCopy is a Unicode application, and Windows 95 does not provide full Unicode support. Also, RoboCopy uses the CopyFileEx() Win32 API, which is supported on Microsoft Windows 2000 and Microsoft Windows NT version 4.0, but not on Windows NT 3.5x.

Corresponding Operating System Features

You can use Windows Explorer to copy files.

Concepts

NTFS file system is an advanced file system designed for use specifically with the Windows NT operating system. It supports long file names, full security access control, file system recovery, extremely large storage media, and various features for the Windows NT POSIX subsystem. It also supports object-oriented applications by treating all files as objects with user-defined and system-defined attributes.

System Requirement

The following is the system requirement for RoboCopy:

  • Windows XP or Windows Server 2003 operating system

Notes

  • This version of RoboCopy was developed and tested under Microsoft Windows XP. The recommended minimum operating system platform for this version of RoboCopy is, therefore, Microsoft Windows XP or Microsoft Windows Server 2003.
  • RoboCopy uses only standard, publicly documented Win32 application programming interfaces (APIs)s throughout. For example, the program uses CopyFileEx() to copy files, and FindFirstFile() and FindNextFile() to read directories. In theory, RoboCopy should run on any operating system that supports these APIs, such as Windows NT version 4.0 and Windows 2000. However, if you run this version of RoboCopy on Windows NT version 4.0 or Windows 2000, be aware that only limited testing has been performed on these platforms. The theoretical performance of RoboCopy might differ from practical results.
  • Because RoboCopy uses the CopyFileEx() Win32 API, it cannot run on Windows NT 3.1, Windows NT 3.5x, Windows 95, Windows 98, or Windows Millennium Edition.

Files Required

  • Robocopy.exe
  • Robocopy.doc


Srvcheck.exe: Server Share Check

Server Share Check (SrvCheck) is a command-line tool that lists nonhidden shares on a computer and enumerates the access control lists (ACLs) for each share.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

The ACL is a list associated with a file or a resource that contains information about the users or groups that have permissions to access a resource or modify the file.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating system

File Required

  • Srvchk.exe


Tail.exe: Tail

Overview | Syntax | Examples | Related Tools Open Command Prompt

Tail is a command-line tool that displays a user-specified number of the last lines of a text file, such as a log file, in a console window.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A log file lists actions that have occurred. For example, servers running Microsoft SQL Server maintain log files that list every query made to that server. With analysis software, it is possible to analyze these log files to improve database performance and to verify the data contained in the database is not being accessed without authorization.

System Requirement

The following is the system requirement for Tail:

  • Windows Server 2003 operating system

File Required

  • Tail.exe


Vfi.exe: Visual File Information

Overview | Remarks | UI | Examples | Related Tools Run Tool

This GUI tool uses a Cyclic Redundancy Checking (CRC) key to retrieve and generate file information. You can use this information for testing purposes to detect the files that have changed in different versions of applications or what the differences are between two seemingly identical computers. This information is also valuable for tracking different versions of resources that normally do not store version information.

The following information (if present) is displayed for each file:

  • File Path
  • File Name
  • Extension
  • Size
  • Date
  • Time
  • Attributes
  • File Version
  • Product Version
  • Language
  • Code Page
  • Operating System
  • Type
  • File Flags
  • CRC-32
  • ISO 9660 Level 1

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

CRC is a standards-based checksum method that computes a distinct 32-bit key that maps to each file being sum-checked. If the bytes in a stream of data (also known as a data packet) change, the key changes. Applications using CRC compare newly computed keys with previous ones to determine whether or not files have changed.

System Requirements

The following are the system requirements for VFI:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Vfi.exe


Group Policy Tools

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Group Policy Management Tools

Tools in this category are used to manage the following Windows features:

  • Group Policy


Admx.msi: ADM File Parser

Overview | Remarks | Syntax | Examples | Related Tools

ADM File Parser (AdmX) is a command-line tool that enables an administrator to export Group Policy settings to a tab-delimited text file. The administrator can then use the text produced by ADM File Parser (AdmX) to find changes for the policy settings between different versions of the operating systems. AdmX is only for use with policies based on administrative templates.

Corresponding Operating System Features

You can also view Group Policy settings in the Group Policy Editor, a Microsoft Management Console snap-in. However, Group Policy Editor does not provide a centralized way of viewing individual policy settings or allow a comparison of settings between different policy templates.

To open Group Policy Editor for a local policy

  • Click Start and then click Run.
  • In the Run dialog box, type gpedit.msc.

To open Group Policy Editor for other objects

  • Open an Active Directory snap-in such as Active Directory Users and Computers.
  • Navigate to the container of the group policy you would like to view.
  • Right-click the container and select Properties
  • Select the policy and click the Edit button. Group Policy Editor opens for the selected policy.

Concepts

Group Policy settings define various components of the desktop environment of the user. With Group Policy settings, a system administrator can manage and control this environment. For example, a Group Policy setting can control the programs that are available to users, the programs that appear on the user desktop, and options for the Start menu.

Group Policy includes policy settings for

  • User Configuration. These affect users regardless of the computers they log into.
  • Computer Configuration. These affect computers regardless of the users who are logged on to them.

When you specify Group Policy settings, they are contained in a Group Policy object (GPO), which, in turn, is associated with selected Active Directory objects such as sites, domains, or organizational units. Group Policy applies not only to users and client computers, but also to member servers, domain controllers, and any other Windows Server 2003 computers within the scope of management.

System Requirements

The following are the system requirements for this tool:

  • Microsoft Windows 2000, Microsoft Windows Server 2003, Windows XP Professional operating systems
  • .Net Framework 1.0

File Required

  • Admx.msi


Gpmonitor.exe: Group Policy Monitor

Overview | Related Tools

Group Policy Monitor (GPMon) creates reports when policy settings are refreshed and displays the reports so an administrator can view them. Admnistrators can then check Group Policy object (GPO) stability and monitor policy replication

GPMon hosts its own Help file. On the menu, click Help, and then click Help Topics.

Corresponding Operating System Features

You can also view Group Policy setttings in Group Policy Editor; however, Group Policy Editor does not provide a centralized way to view individual policy settings or compare settings between different policy templates.

To open Group Policy Editor for a local policy:

  1. Click Start, and then click Run.
  2. In the Run dialog box, type gpedit.msc

To open Group Policy Editor for other objects:

  1. Open an Active Directory snap-in, such as Active Directory Users and Computers.
  2. Navigate to the container of the policy setting you would like to view.
  3. Right-click the container, and then click Properties on the shortcut menu.
  4. On the Group Policy tab, select the policy you would like to view, and then click Edit. Group Policy Editor opens for the selected policy.

Concepts

Group Policy settings define various components of the desktop environment of the user. With Group Policy settings, a system administrator can manage and control this environment. For example, a Group Policy setting can control the programs that are available to users, the programs that appear on the user desktop, and options for the Start menu.

Group Policy includes policy settings for

  • User Configuration. These affect users regardless of the computers they log on to.
  • Computer Configuration. These affect computers regardless of the users who are logged on to them.

When you specify Group Policy settings, they are contained in a GPO which, in turn, is associated with selected Active Directory objects such as sites, domains, or organizational units. Group Policy applies not only to users and client computers, but also to member servers, domain controllers, and any other Windows Server 2003 computers within the scope of management.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003 operating system
  • Active Directory domain environment
  • Membership in the Administrators domain local group

File Required

  • Gpmonitor.exe


Gpotool.exe: Group Policy Verification Tool

Group Policy Verification Tool (GPOTool) is a command-line tool that allows administrators to check Group Policy object (GPO) stability and monitor policy replication. GPOTool can browse GPOs and check for GPO consistency within and across domains. This tool also displays information about GPOs, including properties that cannot be accessed through Group Policy Object Editor such as the functionality version number and extension globally unique identifiers (GUIDs).

Corresponding Operating System Features

You can also view Group Policy settings in Group Policy Object Editor; however, Group Policy Object Editor does not provide a centralized way of viewing individual policy settings or comparing policy settings between different Group Policy templates.

To open Group Policy Object Editor for a local policy setting:

  1. In the Run dialog box, type
    gpedit.msc
  2. Press ENTER.

To open Group Policy Object Editor for other objects:

  1. Open an Active Directory snap-in, such as Active Directory Users and Computers.
  2. Navigate to the container of the policy setting you would like to view.
  3. Right-click the container, and then click Properties on the shortcut menu.
  4. On the Group Policy tab, select the GPO you would like to view, and then click Edit.

Group Policy Object Editor opens for the selected GPO.

Concepts

Group Policy settings define various components of the desktop environment for the user. With Group Policy settings, a system administrator can manage and control this environment. For example, a Group Policy setting can control the programs that are available to users, the programs that appear on the user desktop, and options for the Start menu.

Group Policy includes policy settings for:

  • User Configuration. These affect users regardless of the computers they log on to.
  • Computer Configuration. These affect computers regardless of the users who are logged on to them.

When you specify Group Policy settings, they are contained in a GPO which, in turn, is associated with selected Active Directory objects such as sites, domains, or organizational units. Group Policy applies not only to users and client computers, but also to member servers, domain controllers, and any other Windows Server 2003 computers within the scope of management.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003 operating system
  • Active Directory domain environment
  • Membership in the Administrators domain local group

File Required

  • Gpotool.exe


Inetesc.adm: Internet Explorer Enhanced Security Configuration

Overview | Remarks | Related Tools

Internet Explorer Enhanced Security Configuration (InetESC) is a Group Policy template that will enhance the security configuration of Microsoft Internet Explorer.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Group Policy provides directory-based desktop configuration management. In Windows Server 2003, you use Group Policy to define configurations for groups of users and computers. With Group Policy, you can specify settings for registry-based policies, security, software installation, scripts, folder redirection, remote installation services, and Internet Explorer maintenance. The Group Policy settings that you create are contained in a Group Policy object (GPO). By associating a GPO with selected Active Directory service system containers (sites, domains, and organizational units), you can apply these settings to the users and computers in those Active Directory containers.

System Requirement

The following is the system requirement for InetESC:

  • Windows Server 2003 operating system

File Required

  • Inetesc.adm


Winpolicies.exe: Policy Spy

Overview | Related Tools Open Command Prompt

Policy Spy (WinPolicies) is a GUI tool that allows a user to view and refresh Group Policy settings applied to the current user account and local computer.

Note

  • This tool hosts its own Help file. For more information about this tool, click Help on the main menu.

Corresponding Operating System Features

You can view Group Policy setttings in Group Policy Object Editor; however, Group Policy Object Editor does not provide an interface to view all policy settings that have been applied to a specific user or computer account.

To open Group Policy Object Editor for a local policy setting:

  1. In the Run dialog box, type
    gpedit.msc
  2. Press ENTER.

To open Group Policy Object Editor for other objects:

  1. Open an Active Directory snap-in, such as Active Directory Users and Computers.
  2. Navigate to the container of the policy setting you would like to view.
  3. Right-click the container, and then click Properties on the shortcut menu.
  4. On the Group Policy tab, select the policy setting you would like to view, and then click Edit.

Group Policy Object Editor opens for the selected policy setting.

Concepts

Group Policy settings define various components of the desktop environment for the user. With Group Policy settings, a system administrator can manage and control this environment. For example, a Group Policy setting can control the programs that are available to users, the programs that appear on the user desktop, and options for the Start menu.

Group Policy includes policy settings for

  • User Configuration. These affect users regardless of the computers they log on to.
  • Computer Configuration. These affect computers regardless of the users who are logged on.

When you specify Group Policy settings, they are contained in a Group Policy object (GPO), which, in turn, is associated with selected Active Directory objects such as sites, domains, or organizational units. Group Policy applies not only to users and client computers, but also to member servers, domain controllers, and any other Windows Server 2003 computers within the scope of management.

System Requirements

  • Windows Server 2003, Windows XP Professional, or Windows 2000 operating system

File Required

  • Winpolicies.exe


Hardware Management Tools

Tools in this category are used to manage the following Windows features:

  • Device Manager
  • Driver signing
  • Hardware devices
  • UPS


Intfiltr.exe: Interrupt Affinity Filter

Overview | Remarks | UI | Examples | Related Tools Run Tool

Interrupt Affinity Filter (IntFiltr) is a GUI tool that allows you to change the CPU affinity of a device interrupt. Use IntFiltr to specify that a device's interrupt signal processing occurs on a specific set of CPUs. For multiprocessor systems, this can improve system performance.

Corresponding Operating System Features

You can use Device Manager to verify whether a device has interrupt resources. To create or change the association between an interrupt and a CPU, you must use IntFiltr.

To open Device Manager:

  1. In Control Panel, choose Administrative Tools, and then choose Computer Management.
  2. In the Computer Management console tree pane, right-click Device Manager, point to View on the shortcut menu, and then click Resources by type.

Concepts

In Windows Server 2003, all CPUs can receive interrupts by default.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP, or Windows Server 2003 operating system
  • An account that has Administrators group membership

Files Required

  • Intfiltr.exe
  • Intfiltr.reg
  • Intfiltr.sys


Mibcc.exe: SNMP MIB Compiler

SNMP MIB Compiler (MIBCC) is a command-line tool that compiles Simple Network Management Protocol (SNMP) Management Information Base (MIB) files. Use this tool when you want SNMP Management application program interface (API) to use a new or updated MIB.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

The SNMP service uses MIB files to store and retrieve information on monitored objects. The %systemroot$/system32 folder contains a binary file, mib.bin, that the SNMP Management API uses to perform the translation between a numerical object identifier (OID) and its corresponding human readable name. For example, the name corresponding to OID .1.3.6.1.2.1 is .iso.org.dod.internet.mgmt.mib-2.

Several MIBs are included in Windows XP and Windows Server 2003. If a change is made to a MIB, or you want to use additional MIBs, the mib.bin file needs to be recompiled. Use the SNMP MIB Compiler to recompile a .bin file for the SNMP Management API.

System Requirements

The following are the system requirements for MIBCC:

  • Windows XP Professional or Windows Server 2003 operating systems
  • SNMP service on the target computer
  • Permissions: The user must have Administrative rights on the target computer.

File Required

  • Mibcc.exe


Remapkey.exe: Remap Windows Keyboard Layout

Overview | Remarks | UI | Syntax | Examples | Related Tools Run Tool

Remap Windows Keyboard Layout (RemapKey) is a GUI tool that changes the layout of a keyboard by remapping the scan codes of the keys.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Remapping the keys on a keyboard can be especially helpful when using your personal computer to access a mainframe. By using RemapKey, you can remap keys on the keyboard to emulate keys that mainframe keyboards have, but that personal computer keyboards do not have.

System Requirements

The following are the system requirements for RemapKey:

  • Windows XP Professional or Windows Server 2003 operating system
  • Administrator privileges

File Required

  • Remapkey.exe


Internet Services Management Tools

Tools in this category are used to manage the following Windows features:

  • Internet Explorer
  • Internet Information Services
  • POP3
  • SharePoint Team Services
  • Windows Media Services
  • UDDI


Ifilttst.exe: IFilter Test Suite

IFilter Test Suite (IFilttst) is a command-line tool that helps validate IFilter implementations for compliance with the IFilter specification. Follow the IFilter specification to create document filters for the Indexing Service in Microsoft products. The IFilter Test must be run on the local computer.

Ifilttst performs the following tests:

  • Validation Test. Verifies that the filter is breaking the document into chunks of text that the Indexing Service can use.
  • Consistency Test. Verifies that a document is broken down in the same manner each time it is filtered.
  • Invalid Input Test. Checks to see if the filter correctly handles errors.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Document search capability is included Windows Server 2003 and in Windows 2000 Server. A document must be indexed by Microsoft Indexing Service before you can search it. This service breaks down documents, removes noise words, and converts them to a generic format, usually Unicode. Noise words are words not subject to search, such as the and of. Filtered documents are saved into catalogs for easier searching.

Microsoft Indexing Service uses a filter to break down a document. A Microsoft Excel spreadsheet would not be broken down in the same manner as a Microsoft Word document, so a filter must exist for Indexing Service, but filters for other document types must be created by the vendor of the application that creates those documents.

The IFilter interface specification defines the way a filter should be created to work with Microsoft Indexing Service. If you create a filter for use with Microsoft Indexing Service, use Ifilttst to ensure that the filter follows the IFilter specification and filters documents correctly.

System Requirements

To run Ifilttst on your computer, you must have the following installed and running:

  • Microsoft Windows 2000, Microsoft Windows Server 2003
  • Microsoft Indexing Service

Files Required

  • Ifilttst.exe
  • Ifilttst.ini

For More Information

  • See IFilter (http://go.microsoft.com/fwlink/?LinkID=11580) in the Platform SDK.


Uddicatschemeeditor.exe: UDDI Services Categorization Scheme Editor

Overview | Remarks | UI | Related Tools Run Tool

UDDI Services Categorization Scheme Editor (UDDICatSchemeEditor) is a GUI tool that provides an interface for creating and modifying UDDI Services–compliant categorization schemes. You can use UDDICatSchemeEditor to modify existing categorization schemes, or you can create one or more new schemes and save them to an XML document that can be imported into a UDDI Services site.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

UDDI is an industry specification for publishing and locating information about Web services. It defines an information framework that enables you to describe and classify your organization, its services, and the technical details about the interfaces of the Web services you expose. The framework enables consistent discovery of services or interfaces of a particular type, classification, or function. UDDI also defines a set of application programming interfaces (APIs) that can be used by applications and services to directly interact with UDDI data. For example, you can develop services that automatically publish and update their UDDI data, react dynamically to service availability, or automatically discover interface details for other services with which they interact. For more information about UDDI, see UDDI in the MSDN Library (http://go.microsoft.com/fwlink/?LinkID=12424).

UDDI Services is a Microsoft Windows Server 2003 Web service that provides UDDI capabilities for use within an enterprise or between business partners. It includes a Web interface with searching, publishing, and coordinating features that are compatible with Microsoft Internet Explorer 4.0 or later and Netscape Navigator 4.5 or later. UDDI Services supports the UDDI version 1.0 and 2.0 APIs, enabling enterprise developers to publish, discover, share, and reuse Web services directly through their development tools and business applications. For more information about UDDI services, see the Enterprise UDDI Services Web page (http://go.microsoft.com/fwlink/?LinkID=12423).

Categorization schemes are an important part of UDDI because they provide a consistent means of describing and discovering Web service information. For example, a geographical categorization scheme allows publishers to classify their physical location, as well as facilitate queries based upon geographical location. To get the most out of UDDI Services categorizations, provide schemes that are logically ordered and applicable to the types of information being published and discovered in the site. For additional information about UDDI Services categorization schemes, see the Remarks page.

System Requirements

The following are the system requirements for UDDICatSchemeEditor:

  • Windows XP Professional or Windows Server 2003 operating systems
  • .NET Framework version 1.1

File Required

  • Uddicatschemeeditor.exe

For More Information

  • For more information about the UDDI data model and UDDI Services categorization schemes, see Enterprise UDDI Services (http://go.microsoft.com/fwlink/?LinkID=12423).
  • For more information about the UDDI initiative in general, see Universal Description, Discovery and Integration of Web Services (http://go.microsoft.com/fwlink/?LinkID=12422).


Uddiconfig.exe: UDDI Services Command-line Configuration Utility

UDDI Services Command-Line Configuration Utility (UDDIConfig) is a command-line tool that applies configuration settings from an XML document to UDDI Services components operating on a target computer, or it captures configuration settings from UDDI Services components and saves them to an XML document. You can use this tool to adjust any of the configuration settings exposed by the UDDI Services MMC snap-in. When you apply configuration settings, all the setting stored in the configuration file are applied to the corresponding UDDI Services components operating on the target computer. When you capture settings, all the configuration settings from all the UDDI Services components operating on the target computer are written to the output file.

Corresponding Operating System Features

The UDDI Services MMC Snap-in exposes an interface for adjusting these configuration settings.

To open the UDDI Services MMC Snap-in, click Start, point to Programs, point to Administrative Tools, and then click UDDI Services.

Concepts

UDDI is an industry specification for publishing and locating information about Web services. It defines an information framework that enables you to describe and classify your organization, its services, and the technical details about the interfaces of the Web services you expose. The framework enables consistent discovery of services or interfaces of a particular type, classification, or function. UDDI also defines a set of Application Programming Interfaces (APIs) that can be used by applications and services to directly interact with UDDI data. For example, you can develop services that automatically publish and update their UDDI data, react dynamically to service availability, or automatically discover interface details for other services with which they interact. For more information about UDDI, see UDDI (http://go.microsoft.com/fwlink/?LinkID=12424) in MSDN.

UDDI Services is a Web service included with the Microsoft Windows Server 2003 operating systems. It provides UDDI capabilities for use within an enterprise or between business partners. It includes a Web interface with searching, publishing, and coordinating features that are compatible with Microsoft Internet Explorer 4.0 or later and Netscape Navigator 4.5 or later. UDDI Services supports the UDDI version 1.0 and 2.0 APIs, enabling enterprise developers to publish, discover, share, and reuse Web services directly through their development tools and business applications. For more information about UDDI services, see Enterprise UDDI Services (http://go.microsoft.com/fwlink/?LinkID=12423) on the Microsoft Windows Server 2003 site.

System Requirements

The following are the system requirements for this tool:

  • Windows XP Professional or Windows Server 2003 operating systems
  • .NET Framework v1.1
  • Permissions: Local or domain level administrative credentials on the target computer (to change configuration settings).

File Required

  • Uddiconfig.exe

For More Information

  • For more information about the UDDI data model and UDDI Services Categorization schemes, see Enterprise UDDI Services http://go.microsoft.com/fwlink/?linkid=5202).
  • For more information about the UDDI initiative at large, see the Universal Description, Discovery and Integration (UDDI) (http://go.microsoft.com/fwlink/?LinkID=12422) site.


UddiDataExport.exe: UDDI Data Export Wizard

Overview | Remarks | UI | Related Tools Run Tool

UDDI Data Export Wizard (UddiDataExport) is a GUI tool that allows you to select entities, providers, or tModels hosted in a UDDI registry, and export their details to an XML file.

Note

  • The UDDI site from which you want to export must support the UDDI 2.0 application program interface (API).

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

UDDI is an industry specification for publishing and locating information about Web services. It defines an information framework that enables you to describe and classify your organization, its services, and the technical details about the interfaces of the Web services you expose. The framework enables consistent discovery of services or interfaces of a particular type, classification, or function. UDDI also defines a set of APIs that can be used by applications and services to directly interact with UDDI data. For example, you can develop services that automatically publish and update their UDDI data, react dynamically to service availability, or automatically discover interface details for other services with which they interact. For more information about UDDI, see UDDI (http://go.microsoft.com/fwlink/?LinkID=12424) in MSDN.

UDDI Services is a Web service included with Microsoft Windows Server 2003 operating systems. It provides UDDI capabilities for use within an enterprise or between business partners. It includes a Web interface with searching, publishing, and coordinating features that are compatible with Microsoft Internet Explorer 4.0 or later and Netscape Navigator 4.5 or later. UDDI Services supports the UDDI version 1.0 and 2.0 APIs, enabling enterprise developers to publish, discover, share, and reuse Web services directly through their development tools and business applications. For more information about UDDI services, see Enterprise UDDI Services (http://go.microsoft.com/fwlink/?LinkID=12423) on the Microsoft Windows Server 2003 site.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003
  • .NET Framework v1.1
  • Permissions: Query privileges on the UDDI site from which entities will be exported

File Required

  • UddiDataExport.exe

For More Information

  • For more information about UDDI services, see Enterprise UDDI Services (http://go.microsoft.com/fwlink/?LinkID=12423) on the Microsoft Windows Server 2003 site.
  • For more information about the UDDI initiative at large, see the Universal Description, Discovery and Integration (UDDI) (http://go.microsoft.com/fwlink/?LinkID=12422) site.


Winhttpcertcfg.exe: WinHTTP Certificate Configuration Tool

Overview | Syntax | Examples | Related Tools Open Command Prompt

WinHTTP Certificate Configuration Tool (WinHTTPCertCfg) is a command-line tool that enables administrators to import certificates and their private keys for use on client computers.

Corresponding Operating System Features

Users can export and import client certificates by using a Web browser such as Internet Explorer. However, importing a certificate only allows access to that certificate's private key for the original account that installed the certificate. To grant access to other user accounts, you need WinHTTPCertCfg.

Concepts

Windows Hypertext Transfer Protocol (HTTP) Services (WinHTTP) implements the client side of the HTTP protocol on a server running Windows Server 2003. WinHTTP replaces WinInet as an HTTP client application programming interface (API) platform because of its ability to support middle-tier and server applications.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000 with Service Pack 3, Windows XP Professional with Service Pack 1, or Windows Server 2003 operating system.
  • Membership in the Administrators local or domain local group.
  • If the client certificate is installed before WinHTTPCertCfg is used, the user of the tool must be the same user account that installed the certificate.

File Required

  • Winhttpcertcfg.exe

For More Information

  • For more information see the MSDN article WinHttpTraceCfg.exe, a Trace Configuration Tool (http://go.microsoft.com/fwlink/?LinkID=14980).


Winhttptracecfg.exe: WinHTTP Tracing Facility Configuration Tool

WinHTTP Trace Facility Configuration Tool (WinHTTPTraceCfg) is a command-line tool that enables an administrator to configure tracing features in Windows Hypertext Transfer Protocol (HTTP) Services (WinHTTP). WinHTTPTraceCfg allows an administrator to set and display these settings from the command prompt instead of having to make changes in the registry.

Corresponding Operating System Features

Network Monitor captures network packets. However, Network Monitor cannot display the contents of packets that are encrypted by protocols such as IP Security (IPSec) or Secure Sockets Layer (SSL). WinHTTP has trace features that capture and display packets after decryption.

Concepts

WinHTTP implements the client side of the HTTP protocol on a server running Windows Server 2003. WinHTTP replaces WinInet as an HTTP client application programming interface (API) platform because of its ability to support middle-tier and server applications.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000 with Service Pack 3, Windows XP Professional with Service Pack 1, or Windows Server 2003 operating system
  • Membership in the Administrators domain local group

File Required

  • Winhttptracecfg.exe


Network Management Tools

Tools in this category are used to manage the following Windows features:

  • Connection Manager
  • DHCP
  • DNS
  • Internet Authentication Service (IAS)
  • Internet Protocol (IP)
  • Internet Protocol Security (IPSEC)
  • Modems
  • Novell NetWare Integration
  • Routing and Remote Access
  • Quality of Service (QoS)
  • Services for Macintosh
  • Session Initiation Protocol (SIP)
  • Simple Network Management Protocol (SNMP)
  • TCP/IP
  • Telephony
  • Virtual Private Networks (VPN)
  • Windows ATM services
  • Wireless networking


Atmarp.exe: Windows ATM ARP Server Information Tool

Windows ATM ARP Server Information Tool (AtmArp) is a command-line tool that assists network administrators and support personnel in troubleshooting the status of the Asynchronous Transfer Mode (ATM) Address Resolution Protocol (ARP)/multicast address resolution service (MARS). ATM refers to a group of related, standards-based technologies that provide high-speed communication over various media.

Windows ATM ARP Server Information Tool provides information about Atmarps.sys, the IP/ATM combined ARP/MARS/multicast server (MCS) server. This service provides the server side connectivity support for an IP/ATM network.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

ATM describes several related, standards-based technologies that provide high-speed communication over a broad range of media. The International Telecommunication Union (ITU-T) defines ATM as "a high-speed, connection-oriented multiplexing and switching method specified in international standards utilizing fixed-length cells to support multiple types of traffic."

The TCP/IP stack supports the existence of more than one ARP module. ARP for Ethernet and Token Ring is built into the Tcpip.sys driver. ARP support for ATM (AtmArpC.sys and AtmArpS.sys) is provided in separate drivers, which insert themselves into the stack between IP and the Network Driver Interface Specification (NDIS) interface.

System Requirements

The following are the system requirements for AtmArp:

  • Windows XP Professional or Windows Server 2003 operating systems

File Required

  • Atmarp.exe

For More Information

  • For more detailed information on Asynchronous Transfer Mode, see the ATM Forum Web page (http://go.microsoft.com/fwlink/?LinkID=3764) for the specification on local area network (LAN) Emulation over ATM 1.0.


Atmlane.exe: Windows ATM LAN Emulation Client Information

Windows ATM LAN Emulation Client Information (AtmLanE) is a command-line tool that assists administrators in troubleshooting the status of the Asynchronous Transfer Mode (ATM) Local Area Network (LAN) Emulation client that ships with the Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems. ATM refers to a group of related, standards-based technologies that provide high-speed communication over various media.

When an ATM adapter is installed on a computer running a Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems, the Local Area Network Emulation (LANE) client is installed by default. If this system is connected to a switch that has LANE services configured (ask your system administrator or refer to the ATM switch documentation), the client allows network connectivity to other clients within its emulated local area network (LAN).

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

ATM describes several related, standards-based technologies that provide high-speed communication over a broad range of media. The International Telecommunication Union (ITU-T) defines ATM as "a high-speed, connection-oriented multiplexing and switching method specified in international standards utilizing fixed-length cells to support multiple types of traffic."

When an ATM adapter is installed on a Windows computer, the LANE client is installed by default. If this system is connected to a switch that has LANE services configured, the client allows network connectivity to other clients within its emulated LAN.

A LAN Emulation module and call manager, designed to Network Driver Interface Specification (NDIS) 3.0 or 4.0, allows an ATM card to function smoothly in a heterogeneous ATM/Ethernet environment, allowing network administrators to incrementally upgrade their systems to ATM.

System Requirements

The following are the system requirements for AtmLanE:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Atmlane.exe

For More Information

  • For more detailed information on Asynchronous Transfer Mode, see the ATM Forum Web page (http://go.microsoft.com/fwlink/?LinkID=3764") for the specification on LAN Emulation over ATM 1.0.


Chknic.exe: Check NIC

Overview | Syntax | Examples | Related Tools Open Command Prompt

Check NIC (ChkNIC) is a command line tool that checks network adapter of the local computer for Network Load Balancing (NLB) compatibility.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

NLB is a clustering technology included in Windows Server 2003, Enterprise Edition, and Windows Server 2003, Datacenter Edition operating systems. It enhances the scalability and availability of mission-critical, TCP/IP-based services, such as Web, Terminal Services, virtual private networking, and streaming media servers. The unique and fully-distributed architecture of NLB enables it to deliver very high performance and failover protection, especially in comparison with dispatcher-based load balancers.

System Requirements

The following is the system requirement for this tool:

  • Windows Server 2003

File Required

  • Chknic.exe


Getcm.exe: Get Connection Manager

Overview | Syntax | Examples | Related Tools Open Command Prompt

Get Connection Manager (GetCM) is a command-line tool that downloads a new Connection Manager profile from the Web or file share to the local system. GetCM is used in conjunction with the Connection Manager Administration Kit (CMAK).

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Connection Manager provides a customized remote access client to allow customers to connect to your service by using connection features that you define.

For more information, see Connection Manager Administration Kit in Help and Support Center for Windows Server 2003.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003 operating system
  • CMAK

Files Required

  • Getcm.exe
  • Instcm.exe


Instcm.exe: Install Connection Manager Profile

Overview | Syntax | Examples | Related Tools Open Command Prompt

Install Connection Manager (InstCM) is a command-line tool that installs the Connection Manager profile that you downloaded by using GetCM. InstCM is used in conjunction with the Connection Manager Administration Kit (CMAK).

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Connection Manager provides a customized remote access client to allow customers to connect to your service by using connection features that you define.

For more information, see Connection Manager Administration Kit in Help and Support Center for Windows Server 2003.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003 operating system
  • CMAK

Files Required

  • Getcm.exe
  • Instcm.exe


Linkspeed.exe: Link Speed

Overview | Syntax | Examples | Related Tools Open Command Prompt

Link Speed (LinkSpeed) is a command-line tool that displays the speed of the connection between computers on a network.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

The Windows Server 2003 operating system includes a variety of network protocols and technologies to extend the capabilities of your server. When something goes wrong on a network, you need to troubleshoot the problem to successfully identify and resolve it. Successful troubleshooting depends on the ability to identify the source of the problem. When solving networking problems, a good first step is to identify the process that created the problem. You can often determine this by testing the connections between computers, using tools designed to give readings on specific connections. Tools like this are available from many sources, such as the operating system, the Support folder on the operating system CD, or in the Windows Server 2003 Resource Kit.

System Requirements

The following are the system requirements for this tool:

  • Windows XP Professional or Windows Server 2003 operating system

File Required

  • Linkspeed.exe


Mcast.exe: Multicast Packet Tool

Multicast Packet Tool (Mcast) is a command-line tool that can be used to send multicast packets or to listen for packets being sent to a multicast group address. Mcast is useful for testing multicast connectivity between computers on your network.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Multicasting is a method of point-to-multipoint delivery of information over a network. In contrast to sending multiple packets to multiple unicast addresses, this method sends all information in a single packet and requires no overhead for keeping lists of recipients. And, unlike broadcast packets, multicast traffic does not disturb those nodes that are not listening for it. Multicast-capable routers can forward the multicast packet to all networks where there is at least one node belonging to a multicast group.

System Requirements

The following are the system requirements for Mcast:

  • Windows XP Professional or Windows Server 2003 operating systems

File Required

  • Mcast.exe


Rassrvmon.exe: RAS Server Monitor

Overview | Remarks | UI | Syntax | Examples | Related Tools Show Usage

RAS Server Monitor (RASSrvMon) is a GUI tool that monitors remote access server (RAS) activities in greater detail than the standard Windows tools allow.

Corresponding Operating System Features

The Routing and Remote Access snap-in allows you to manually view and manage remote access servers.

To open the Routing and Remote Access snap-in

  • In Control Panel, choose Administrative Tools, and then choose Routing and Remote Access.

Concepts

A remote access server is a Windows-based computer that runs the Routing and Remote Access service and has been configured to provide remote access.

Remote access is part of the integrated Routing and Remote Access service that provides remote networking for telecommuters, mobile workers, and system administrators who monitor and manage servers at multiple branch offices. Users with a computer running Windows and network connections can dial in to remotely access their networks for services such as file and printer sharing, e-mail, scheduling, and structured query language (SQL) database access.

System Requirements

The following are the system requirements for RAS Server Monitor (RASSrvMon):

  • Windows Server 2003
  • Permissions: Administrator privileges on the target machine

Note

  • Because the RASSrvMon GUI lacks window size controls, it is best viewed at a screen resolution of 1024×768.

Files Required

  • Rassrvmon.exe
  • Reportgen.exe


Rpccfg.exe: RPC Configuration Tool

RPC Configuration Tool (RpcCfg) is a command-line tool that configures Microsoft Remote Procedure Call (RPC) to listen on specified ports. It also displays the port settings and resets ports to the default settings.

Developers and administrators can use this tool to set, reset, and verify ports used for RPC instead of editing the registry.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A remote procedure call (RPC) is a message-passing facility that allows a distributed application to call services that are available on various computers on a network. Used during remote administration of computers. For detailed information on RPC configuration, see "Configuring the XP/2000/NT Registry for Port Allocations and Selective Binding"(http://go.microsoft.com/fwlink/?LinkID=12040) in the MSDN Library.

System Requirements

The following are the system requirements for RpcCfg:

  • Windows XP Professional or Windows Server 2003

File Required

  • Rpccfg.exe


Rpcdump.exe: RPC Endpoint Diagnostic Utility

RPC Endpoint Diagnostic Utility (RCPDump) is a command-line tool that queries Remote Procedure Call (RPC) endpoints and reports on the status of RPC services on the system.

RPCDump queries the endpoint mapper database to obtain a list of every registered endpoint. If the /i switch is specified, the tool pings each endpoint to determine whether or not the service that registered the endpoint is listening. After gathering statistics, RPCDump sorts them and displays the data.

This tool can help to isolate network troubles involving services using RPCs.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

RPC is a facility that enables a program on one Windows-based computer (the client computer) to invoke the services of another program that is running on a separate Windows-based computer (the server) in a distributed network. RPC is a program-level protocol that can use the communications services of any of the Windows networking protocols, which includes TCP/IP. Services in Windows 2000 and Windows Server 2003 use RPCs to communicate with clients.

A server can return a successful PING even if some services are not working. Since many services in Windows 2000 and Windows Server 2003 use RPCs to communicate with clients, RPC information can help to troubleshoot a server that has a successful PING, yet has some unresponsive services.

System Requirements

The following are the system requirements for RPCDump:

  • Windows 2000, Windows XP Professional or Windows Server 2003 operating systems

File Required

  • Rpcdump.exe


Rpcping.exe: RPC Ping

RPC Ping (RPCPing) is a command-line tool that enables users to troubleshoot connection problems between computers involving remote procedure calls (RPCs). RPCPing works much like the Packet Internet Groper (PING) utility for TCP/IP connections, except that it tests RPC connectivity instead of IP connectivity.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

RPC is a message-passing facility that enables a program on one Windows-based computer (the client computer) to call services of another program that is running on a separate Windows-based computer (the server) in a distributed network. RPC is a program-level protocol that can use the communications services of any of the Windows networking protocols, which includes TCP/IP. Services in Windows 2000 and Windows Server 2003 use RPCs to communicate with clients.

A server can return a successful ping even if some services are not working. Because many services in Windows 2000 and Windows Server 2003 use RPCs to communicate with clients, RPC information can help to troubleshoot a server that has a successful ping, yet has some unresponsive services.

System Requirements

The following are the system requirements for this tool:

  • Windows XP or Windows Server 2003 operating system

Note

  • Some RPC parameters require specific service packs or Quick Fix Engineering (QFE) files. See the Syntax page for more information.

File Required

  • Rpcping.exe


RPing: RPC Connectivity Verification Tool

Overview | Remarks | UI | Syntax | Examples | Related Tools Open Command Prompt

This tool tests Remote Procedure Call (RPC) connectivity between RPC servers and clients on a network. RPC Connectivity Verification Tool (RPing) checks to see if RPC services are responding to RPC requests from client computers.

There are two components in the RPing tool: RPingS and RPingC. RPingS is the server-side RPing tool. It responds to two Remote Procedure Call (RPC) functions: Echo and Stats. These functions are called by the GUI client side RPC Ping Tool (RpingC.exe). Its interface is documented on the RPing UI page.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

RPC is a message-passing facility that enables a program on one Windows-based computer (the client computer) to call services of another program that is running on a separate Windows-based computer (the server) in a distributed network. RPC is a program-level protocol that can use the communications services of any of the Windows networking protocols, including TCP/IP. Services in Windows 2000 and Windows Server 2003 use RPCs to communicate with clients.

A server can return a successful PING even if some services are not working. Since many services in Windows 2000 and Windows Server 2003 use RPCs to communicate with clients, RPC information can help to troubleshoot a server that has a successful PING, yet has some unresponsive services.

System Requirement

The following is the system requirement for this tool:

  • Windows Server 2003

Files Required

  • Rpings.exe
  • Rpingc.exe


Rqc.exe: Remote Access Quarantine Client

Overview | Remarks | Syntax | Related Tools Open Command Prompt

Remote Access Quarantine Client (RQC) is a tool that works as part of Windows Server 2003 Network Access Quarantine Control, which restricts remote access clients from full access to a network until they meet the requirements of the network.

Windows Resource Kit Tools include two components that work as part of Windows Server 2003 Network Access Quarantine Control: RQC and Remote Access Quarantine Agent (RQS). RQS works on the remote access server as a listener component. It informs the remote access server when a client can be taken out of quarantine mode. RQC works on the remote access client as a notification component. It verifies to the listener component that the remote access client has met network requirements.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Network administrators today often must support allowing home computers and roaming laptop users to connect to their corporate network, even though those computers may not fully comply with the corporation's security policies. Network Access Quarantine Control gives a remote access client only partial access to a network until it meets network requirements. Examples of the kinds of checks that Network Access Quarantine Control can perform on a client include service pack version number, virus protection and signature file version number, the presence of client firewall software, the use of a client screen saver password, and whether the client has routing enabled.

You can implement Network Access Quarantine Control with one or more servers running Windows Server 2003 Routing and Remote Access service, one or more servers running Windows Server 2003 and IAS, a Connection Manager (CM) profile created with Connection Manager Administration Kit (CMAK), an administrator-created script, and two additional components: the notifier component and the listener component. You can create your own notifier and listener components, or you can use RQS (a listener component) and RQC (a notifier component).

CM provides a way for administrators to create a customized self-installing service profile for users. Use the CMAK wizard to create a custom service profile. This .exe file is then distributed to users. When they double-click the file, it installs a service profile customized with the information the administrator entered in the CMAK wizard.

By implementing connection request policies and remote access policies on the remote access or IAS servers, you can apply the MS-Quarantine-IPFilter attribute, the MS-Quarantine-Session-Timeout attribute, or both attributes to restrict clients to quarantine mode. During quarantine mode, the administrator-created network policy requirements script is run on the client computer. After the client computer configuration is determined to be in accordance with your organization's network policy, the notifier component is called to send a removal request to the server based listener agent, which then evaluates the request, and if appropriate requests that the client computer be removed from quarantine mode. The network access server then applies the standard remote access policy is to the connection.

Network Access Quarantine Control does not protect against a client computer operated by a malicious user. It is designed to prevent the compromise of the network from a client computer that does not meet corporate security requirements.

System Requirements

The following are the system requirements for RQC:

  • Windows Server 2003, Windows XP Professional, Windows XP Home Edition, Windows 2000, Windows Millennium Edition, or Windows 98 operating system
  • CM profile

File Required

  • Rqc.exe


Rqs.exe: Remote Access Quarantine Agent

Overview | Remarks | Syntax | Related Tools Open Command Prompt

Remote Access Quarantine Agent (RQS) is a tool that works as part of Windows Server 2003 Network Access Quarantine Control, which restricts remote access clients from full access to a network until they meet the requirements of the network.

Windows Resource Kit Tools include two components that work as part of Windows Server 2003 Network Access Quarantine Control: RQS and Remote Access Quarantine Client (RQC). RQS works on the remote access server as a listener component. It informs the remote access server when a client can be taken out of quarantine mode. RQC works on the remote access client as a notification component. It verifies to the listener component that the remote access client has met network requirements.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Network administrators today often must support allowing home computers and roaming laptop users to connect to their corporate network, even though those computers may not fully comply with the corporation's security policies. Network Access Quarantine Control gives a remote access client only partial access to a network until it meets network requirements. Examples of the kinds of checks that Network Access Quarantine Control can perform on a client include service pack version number, virus protection and signature file version number, the presence of client firewall software, the use of a client screen saver password, and whether the client has routing enabled.

You can implement Network Access Quarantine Control with one or more servers running Windows Server 2003 Routing and Remote Access service, one or more servers running Windows Server 2003 and IAS, a Connection Manager (CM) profile created with Connection Manager Administration Kit (CMAK), an administrator-created script, and two additional components: the notifier component and the listener component. You can create your own notifier and listener components, or you can use RQS (a listener component) and RQC (a notifier component).

CM provides a way for administrators to create a customized self-installing service profile for users. Use the CMAK wizard to create a custom service profile. This .exe file is then distributed to users. When they double-click the file, it installs a service profile customized with the information the administrator entered in the CMAK wizard.

By implementing connection request policies and remote access policies on the remote access or IAS servers, you can apply the MS-Quarantine-IPFilter attribute, the MS-Quarantine-Session-Timeout attribute, or both attributes to restrict clients to quarantine mode. During quarantine mode, the administrator-created network policy script is run on the client computer. After the client computer configuration is determined to be in accordance with your organization's network policy, the notifier component is called to send a removal request to the server based listener agent, which then evaluates the request, and if appropriate requests that the client computer be removed from quarantine mode. The network access server then applies the standard remote access policy is to the connection.

Network Access Quarantine Control does not protect against a client computer operated by a malicious user. It is designed to prevent the compromise of the network from a client computer that does not meet corporate security requirements.

System Requirements

The following are the system requirements for RQS:

  • Server running Windows Server 2003 Routing and Remote Access service, configured with dial-in ports. The dial-in ports can be any valid media (for example, modem, ISDN, PPTP, or L2TP), as long as the user can make a remote access connection to the server.
  • Remote Access Policy with authorization and connection constraints for remote access connections.

Files Required

  • Rqs_setup.bat
  • Rqs.exe
  • Rqsmsg.dll


Srvmgr.exe: Server Manager for Domains

Related Tools Run Tool

Server Manager for Domains (SrvMgr) is a GUI-based tool that is used to manage Microsoft Windows NT version 4.0 or Microsoft Windows NT version 3.51 domains and computers. To manage Windows 2000 and Windows Server 2003 domains and computers, use Active Directory™ directory service and other administrative tools instead.

Corresponding Operating System Features

Most of the capabilities provided by Server Manager are also offered by the Services and Server tools in Control Panel in Windows NT 4.0. However, Server Manager can manage both local and remote computers, while these Windows NT 4.0 Control Panel tools manage only the local computer.

Warning

  • Using this tool on Active Directory domains or Windows 2000, Windows XP or Windows Server 2003 computers may cause corruption, or the tool may refuse to target such domains or computers. Always use the Active Directory administrative tools for Active Directory domains.

Concepts

To administer a Windows NT 4.0 domain and its servers using Server Manager for Domains, you must be logged on to a user account that is a member of the Administrators, Domain Admins, or Server Operators group for that domain. Members of the Account Operators group can also use Server Manager, but only for the purpose of adding computers to the domain.

To use Server Manager to administer a workstation computer or server running Windows NT that is not a domain controller, you must be logged on to a user account that is a member of the Administrators or Power Users group for that computer.

A few Server Manager functions are allowed for only Administrators or Domain Admins. When Server Operators, Account Operators, or Power Users attempt to perform these functions, a message appears indicating that access is denied.

With Server Manager you can:

  • Select a Windows NT 4.0 domain, workgroup, or computer to administer.
  • Manage a Windows NT 4.0 computer. For a selected computer you can view a list of connected users, view shared and open resources, manage Windows NT 4.0 directory replication, manage the list of administrative alert recipients, manage services and shared directories, and send messages to connected users.
  • Manage a Windows NT 4.0 domain. When administering a domain you can promote a backup domain controller to become the primary domain controller, synchronize servers with the primary domain controller, and add computers to and remove computers from the domain.

System Requirements

The following are the system requirements for SrvMgr:

  • Windows Server 2003
  • Administrator privileges on the target Windows NT 4.0 domain or computer.

Files Required

  • Srvmgr.exe
  • Srvmgr.hlp
  • Srvmgr.cnt


Tcmon.exe: Traffic Control Monitor

Overview | Remarks | UI | Related Tools Run Tool

Traffic Control Monitor (TCMon) is a GUI tool that allows you to view and set traffic control flows on different network adaptors.

TCMon includes the following features:

  • Application Monitoring. You can monitor the traffic control flows set up by applications that use the following APIs and services:
    • GQoS APIs
    • Traffic Control APIs
    • IIS 6 (Bandwidth Throttling)
  • Administrative Traffic Flow and Filter Management. You can mark, prioritize or limit traffic by creating flows and filters.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Networking Quality of Service (QoS) refers to a variety of techniques that prioritize one type of traffic or program when these operate across a network connection rather than relying solely on "best effort" connectivity. QoS mechanisms are built into both Windows 2000 and Windows XP.

System Requirements

The following are the system requirements for TCMon:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems
  • Permissions: Membership in the Administrators local or domain local group

Files Required

  • Tcmon.bat
  • Tcmon.inf
  • Comctl32.ocx
  • Msvbvm60.dll
  • Tccom.exe
  • Tcmon.exe


Tsctst.exe: Terminal Server Client License Dump Tool

Terminal Server Client License Dump (TscTst) is a command-line tool that dumps the Terminal Services client license information present on the Terminal Services client. This license is the one that the client acquired while connecting to a Terminal Server.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Terminal Services in Windows Server 2003 provides new options for application deployment, more efficient access to data over low bandwidth, reuse of older hardware, remote management, and other tasks. For more information, see the Windows Server 2003 Terminal Services (http://go.microsoft.com/fwlink/?LinkID=14341) Web site.

System Requirements

The following are the system requirements for Terminal Server Client License Dump Tool (TscTst):

  • Client must be running Windows Server 2003, Windows XP, Windows 2000, or Windows NT 4.0

File Required

  • Tsctst.exe


Tsscalling.exe: Terminal Services Scalability Planning Tools

Related Tools Open Command Prompt

Terminal Services Scalability Planning Tools (TSSCalling) is a suite of tools that assists organizations with Microsoft Windows 2003 Terminal Services capacity planning. They allow organizations to easily place and manage simulated loads on a server. This in turn can allow an organization to determine whether or not its environment is able to handle the load that the organization expects to place on it.

The suite includes the following automation tools:

  • Robosrv.exe, the tool that drives the server side of the load simulation testing. Together RoboServer and RoboClient drive the server-client automation. RoboServer is typically installed on the test controller computer, and must be running before an instance of RoboClient can be started. After an instance of both RoboServer and RoboClient are running, RoboServer commands the RoboClients to run scripts that load the terminal server at operator-specified intervals.
  • Robocli.exe, the tool that drives the client side of the load simulation testing. Together RoboServer and RoboClient drive the server-client automation. RoboClient is typically installed on the test client computers, and requires RoboServer to be running before an instance of RoboClient can be started. RoboClient receives commands from RoboServer to run scripts that load the terminal server at operator specified intervals.

The suite includes the following test tools:

  • Qidle.exe Used in an automation environment, it determines whether any of the currently running scripts have failed and require an administrator to intervene. QIdle determines this by periodically checking to see if any of the sessions logged on to the terminal server has been idle more than a specific period of time. If there are any idle sessions, QIdle notifies the administrator with a beeping sound.
  • Tbscript.exe This is a script interpreter that executes Visual Basic Scripting Edition scripts and supports specific extensions for controlling the terminal server client.

The suite includes the following Help files:

  • TBScript.doc This file provides Terminal Services bench scripting documentation.
  • TSScalingSetup.doc This file provides a scalability test environment setup guide. It includes information on the following topics:
    • Required Hardware
    • Domain Controller Setup
    • Exchange Server Setup
    • Terminal Server Setup
    • Client Computer Setup
    • List of Required Files
  • TSScalingTesting.doc This file provides a testing guide. It includes information about the following topics:
    • Procedure for installing Windows Server 2003
    • Procedure for Installing Windows 2000
    • Procedure for Configuring Windows 2000 after Install
    • Procedure for Configuring Windows Server 2003 after Install
    • Procedure for Installing and Configuring Office 2000
    • Procedure for Installing and Configuring Office XP
    • Setting Up Performance Counters
    • Procedure for Deleting the Exchange Store
    • Procedure for Running Config Scripts
    • Selecting Test Configuration
    • Special settings for Task Worker Test
    • Procedure for Starting Test
    • Evaluating the Response Time for User Actions

Installing the Suite of Tools

To install the suite of tools:

  1. At the command prompt, type the following:

    tsscalling

  2. Press ENTER. This opens the Terminal Services Scalability Planning Tools window.
  3. Type the path to the location where you want to place the extracted files.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003 operating system
  • Permissions: Administrator

File Required

  • Tsscalling.exe


Wins.dll: WINS Replication Network Monitor Parser

Overview | Remarks | Related Tools

WINS Replication Network Monitor Parser tool is a DLL that parses Windows Internet Name Service (WINS) data from within Network Monitor, a feature of Microsoft Windows. This tool is useful as a way to view and troubleshoot network issues related to WINS replication.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Microsoft Network Monitor, which is included with Microsoft Systems Management Server (SMS), Microsoft Windows 2000, Windows Server 2003, and Windows NT, is a software-based network sniffer that runs on most personal computers that have a network card installed. Sniffers can capture and analyze most forms of Local Area Network (LAN) traffic. Sniffers are used to troubleshoot LAN protocols at all levels of the Open Systems Interconnection (OSI) reference model. Network sniffers can be software programs or hardware devices. They are used to capture LAN traffic and to allow you to analyze and filter packets that use specific protocols transmitted and received from specific network devices.

For more information on Network Monitor, please see Monitoring Network Performance.(http://go.microsoft.com/fwlink/?LinkID=11805)

System Requirements

The following are the system requirements for Wins.dll:

  • Windows 2000 Server or Windows Server 2003
  • Network Monitor Version 1.x or 2.x

File Required

  • Wins.dll


Wlbs_hb.dll and Wlbs_rc.dll: Windows Load Balancing Server Network Monitor Parsers

Overview | Remarks | Related Tools

Windows Load Balancing Server Network Monitor Parsers (WLBS_hb and WLBS_rc) are tools that parse Network Load Balancing (formerly known as Windows Load Balancing Server, or WLBS) data from within Network Monitor.

The WLBS Network Monitor Parsers are useful as a way to view and troubleshoot network issues related to Network Load Balancing. With them, Network Monitor users can view Network Load Balancing heartbeats (with WLBS_hb) and remote control data (with WLBS_rc), when such network activity is captured.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Network Load Balancing is a technique used by Windows Clustering to scale the performance of a server-based application by distributing its client requests across multiple servers within a cluster. Each host can specify the load percentage that it will handle, or the load can be equally distributed across all the hosts. If a host fails, Windows Clustering dynamically redistributes the load among the remaining hosts.

Microsoft Network Monitor — which is included with Microsoft Systems Management Server (SMS), Microsoft Windows 2000, Windows Server 2003, and Windows NT — is a software-based network sniffer that runs on most personal computers that have a network adapter installed. Sniffers can capture and analyze most forms of local area network (LAN) traffic. Sniffers are used to troubleshoot LAN protocols at all levels of the ISO Open Systems Interconnection (OSI) model. Network sniffers can be software programs or hardware devices. They are used to capture LAN traffic and to allow you to analyze and filter packets that use specific protocols transmitted and received from specific network devices.

System Requirements

The following are the system requirements for WLBS_hb and WLBS_rc:

  • Windows 2000 Server or Windows Server 2003
  • Network Monitor version 1.x or 2.x

Files Required

  • Wlbs_hb.dll
  • Wlbs_rc.dll

For More Information

  • For more information about Network Monitor, see Monitoring Network Performance. (http://go.microsoft.com/fwlink/?LinkID=11805).
  • For more information about Network Load Balancing and Windows Clustering, see Clustering Services. (http://go.microsoft.com/fwlink/?LinkID=12683)


Performance Monitoring Tools

Tools in this category are used to manage the following Windows features:

  • Device Manager
  • Event Viewer
  • Network monitoring
  • Performance monitoring
  • Memory management


Clearmem.exe: Clear Memory

Overview | Remarks | Syntax | Examples | Related Tools Run Tool

Clear Memory (ClearMem) is a command-line tool that determines the size of the computer's physical memory, allocates enough data to fill it, and references the data as quickly as possible. ClearMem also accesses files to clear the cache. This reduces, to a minimum, the memory available to other processes. Then, the Clear Memory tool releases the allocated memory to restore normal system functions.

Running ClearMem twice forces most applications out of memory. ClearMem has to run multiple times to present a real-life memory load because the system does not immediately trim all possible pages in a process working set. Instead, it does so gradually over time. When ClearMem runs, the system pauses because of the flood of high priority activity.

Note

  • Use Vadump to see the contents of the working set.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

In Windows, working sets are allowed to grow until memory pressure forces them to decline. Flushing the file cache is important because some pages in the process working set are part of the file cache (for example, code loaded from a file).

System Requirements

ClearMem operates on the following server and client operating systems:

  • Windows 95, Windows 98, or Windows ME
  • Windows NT 4.0, Windows 2000 Professional, or Windows XP Professional
  • Windows NT Server, Windows 2000 Server, or Windows Server 2003

File Required

  • Clearmem.exe


Consume.exe: Memory Consumers Tool

Memory Consumers Tool (Consume) is a command-line tool that is used in conjunction with functional tests and stress tests to verify that software applications can operate properly during low resource conditions. Consume is used to generate these low resource simulations. The Memory Consumers Tool is capable of consuming machine resources such as physical memory, page file memory, disk space, CPU time and kernel pool.

Note

  • Consume.exe is a replacement for the LeakyApp tool.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

The ability to limit system resources helps developers and system administrators to predict how a new application will perform in a variety of situations. For more information on performance, see Performance console overview in the Help and Support Center.

System Requirement

The following is the system requirement for this tool:

  • Windows Server 2003

File Required

  • Consume.exe


Dh.exe: Display Heap

Display Heap (DH) is a command-line tool that displays information about heap allocation for user-mode processes or pool usage in kernel-mode memory. It also enables you to lock heaps, tags, stacks, and objects. DH allows you to identify the process for which you need to display information, and it allows you to identify the information that you need to display. The tool then writes formatted output to a text file.

One of most useful functions of DH is to display a list of potential memory hogs and the memory allocation calls that have reserved the most memory. To identify call sites symbolically, the system needs the ability to capture a stack back trace at run time. This capability is supported only on Intel Itanium-based platforms.

You can use DH to dump all memory allocations for a program that you are testing. Start the program and write DH output to a file (dh1.dmp, for example). Next, run the application for some time and then pause in a state that should be identical to the first pause. While the program is paused, take another DH reading and write it to a second file (dh2.dmp).

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A heap is a region of reserved address space in memory. As programs allocate memory dynamically from the heap, the heap manager commits physical storage to the heap. As allocations in the heap are freed, the heap manager frees physical memory from the heap. When programs do not deallocate unused memory, or when the heap manager is unable to free physical storage, the memory available to the system is depleted.

Some programs and operating system code run in kernel-mode where they enjoy a privileged mode of code execution in which all memory is totally accessible and all Central Processing Unit (CPU) instructions can be issued by the program. In kernel-mode operation, processes are allocated physical storage as memory pools. When a memory pool allocates some of its memory to a process and the process does not return the memory, the memory pool is depleted. This type of memory depletion is known as a memory pool leak.

System Requirements

The following are the system requirements for DH:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Dh.exe


Eventcombmt.exe: Event Comb

Related Tools Run Tool

Event Comb (EventCombMT) is a GUI tool that searches event logs on multiple DCs/Servers and collects EventID records matching the specified criteria.

Note

  • This tool hosts its own help file. For details and more information on this tool, select Help from the main menu.

Corresponding Operating System Features

The Event Viewer exposes a subset of the functionality of this tool.

Concepts

An event is any significant occurrence in the operating system or in a program that requires users to be notified or an entry to be added to a log. These events are saved into logs and can be viewed through Event Viewer. Event Comb (EventCombMT) parses event logs so that specific events or event types can be quickly found.

System Requirements

The following are the system requirements for EventCombMT:

  • Windows 2000, Windows XP, or Windows Server 2003

File Required

  • Eventcombmt.exe


Kernrate.exe: Kernel Profiling Tool

Overview | Related Tools Open Command Prompt | Open Kernrate.doc

Kernel Profiling Tool (KernRate) is a command-line tool that is a CPU sample profiler. A sample profiler monitors performance and reports back to the user. KernRate reports on kernel and user-mode processes to provide information about CPU activity. Use KernRate to identify which processes are causing a CPU bottleneck.

KernRate divides memory address space into manageable chunks. Each chunk (also called a bucket) is monitored separately. The administrator can "zoom" (preselect) a module.

Note

  • This tool hosts its own Help file. For details and more information about this tool, see the KernRate Usage Guide (Kernrate.doc) for more information.

Corresponding Operating System Features

You can also use the Performance snap-in to monitor kernel and user mode processes.

To open Performance:

  • In Control Panel, choose Administrative Tools, and then choose Performance.

Concepts

A kernel is the core of layered architecture that manages the most basic operations of the operating system and the computer's CPU. The kernel schedules different blocks of executing code (called threads) for the CPU to keep it as busy as possible, and coordinates multiple CPUs to optimize performance. The kernel also synchronizes activities among executive-level subcomponents, such as I/O Manager and Process Manager, and handles hardware exceptions and other hardware-dependent functions. The kernel works closely with the hardware abstraction layer (HAL).

System Requirements

The following are the system requirements for this tool:

  • Windows XP, Windows 2000, or Windows Server 2003 operating system

File Required

  • Kernrate.exe


Memmonitor.exe: Memory Monitor

Memory Monitor (MemMonitor) is a command-line tool that monitors the memory a process uses, and runs the process through a debugger when a given threshold is reached.

Corresponding Operating System Features

Windows Task Manager shows memory usage for individual processes; however, unlike MemMonitor, it cannot debug a process. Press CTRL+SHIFT+ESC to open Task Manager.

Concepts

RAM is memory that can be read from or written to by a computer or other devices. Information stored in RAM is lost when the computer is turned off.

For optimal performance, your servers need to have enough physical memory to avoid excessive use of the system page file. Because accessing the page file is much slower than accessing physical memory, increasing the amount of memory can greatly improve performance.

A memory leak can be another drain on computer performance. A memory leak is caused when processes do not release memory after they are terminated. Memory leaks reduce the amount of virtual memory available to programs running on the system. Memory leaks can eventually cause performance degradation and interfere with the correct behavior of other programs when memory is exhausted.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating system

File Required

  • Memmonitor.exe


Memtriage.exe: Resource Leak Triage Tool

Resource Leak Triage Tool (MemTriage) is a command-line tool that detects a possible resource leak on a running system. MemTriage records process information or current kernel pool information and saves it to a log file. Then you use MemTriage to analyze the log file and diagnose issues with any system resource, including memory, handles, Graphics Device Interface (GDI), user resources, and the kernel. After issues are identified, MemTriage generates a report and instructions about what to do next.

Corresponding Operating System Features

There are two other tools available for detecting memory leaks: Task Manager and System Monitor. These tools provide only raw resource usage information; understanding and interpreting this information can require advanced knowledge of how a system works.

Use the following table to determine which tool to use.

Scenario | Tool | Description
System performance is still being degraded. | Task Manager and System Monitor | Use to get a report of the usage increase by comparing resource usage from time to time.
The system is already in a failed state. | MemTriage | Use when, for example, the volume address space is too fragmented and no more memory can be allocated.
You have a single troubleshooting purpose. | Task Manager and System Monitor | Use to find either a memory leak or a pool leak.
When you are not sure if it is a memory leak or another resource leak. | MemTriage | Use when, for example, you need to differentiate a memory leak from a heap fragmentation.

To open Task Manager:

  1. Click Start, and then click Command Prompt.
  2. Type taskmgr.exe, and then press ENTER.

To open System Monitor:

  • In Control Panel, choose Administrative Tools, and then choose Performance.

Concepts

To understand how to manage the system resources, you should be familiar with the following concepts:

  • Page file and physical memory usage. See Making sure you have enough memory (http://go.microsoft.com/fwlink/?LinkID=14207).
  • Heap fragmentation. See Low-fragmentation Heap (http://go.microsoft.com/fwlink/?LinkID=14209).
  • Kernel non-paged and paged pool usage. See Evaluating Memory and Cache Usage (http://go.microsoft.com/fwlink/?LinkID=14210).

    Note

    • Pool tagging is always enabled in Windows Server 2003. You do not need to do anything to enable it.
  • GDI resources. See Graphics Device Interface (http://go.microsoft.com/fwlink/?LinkID=14211).

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003 operating system
  • Logon account that has Administrators group membership

Files Required

  • Memtriage.exe
  • Memtriage.ini
  • Msdis130.dll
  • Msvcp70.dll
  • Msvcr70.dll


Ntimer.exe: Windows Program Timer

Overview | Syntax | Examples | Related Tools Open Command Prompt

Windows Program Timer (NTimer) is a command-line tool that measures how long a program runs. NTimer shows elapsed time, time in user mode, and time in privileged mode. Time is accurate only to the resolution of the timer, which is 10 milliseconds on x86-based architecture.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Measuring the time that a program takes to run can be a valuable tool for building effective applications.

System Requirement

The following is the system requirement for this tool:

  • Windows Server 2003 operating system

File Required

  • Ntimer.exe


Oh.exe: Open Handles

Open Handles (OH) is a command-line tool that shows the handles of all open windows. OH can also be used to show only information about a specific process, object type, or object name. This feature is useful for finding the process that has a file open when a sharing violation occurs.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A handle is a 32-bit positive integer that Windows uses to identify a window or other object, such as a font or bitmap.

In Windows, a window is any window that you see on the screen as well as many objects that you cannot see. A window can be a bounded rectangular area of the screen (such as a Microsoft Word window) or a control on a form (such as a list box or a scroll bar), although not all types of controls are windows. The desktop and the icons that appear on it are windows.

Because all of these types of objects are windows, Windows can treat them similarly. Windows gives every window a unique handle when it is created and uses that handle to control that window. When the window is destroyed, Windows frees the handle it used to control the window. A window retains the same handle during its lifetime, but each time the window is recreated, a new handle is assigned. In other words, a window probably will not have the same handle if it is destroyed and recreated.

System Requirement

The following is the system requirement for OH:

  • Windows XP Professional or Windows Server 2003 operating system

File required

  • Oh.exe


Pfmon.exe: Page Fault Monitor

Page Fault Monitor (PFMon) is a command-line tool that allows a developer or system administrator to monitor page faults that occur while an application is running. PFMon is especially useful for tracing hard and soft page faults because it shows the source of the fault.

Notes

  • You must run PFMon from the command window.
  • If you run PFMon on an existing process and close the command window, the process stops without giving the user an opportunity to save changes.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A page is a fixed amount of data. When you run a program, the microprocessor stores pages of data that it predicts you will need in main memory (also known as RAM). Pages of data that are not needed are left on a storage device, such as your hard disk.

A page fault occurs when a process refers to a virtual memory page that is not in the working set (the physical memory visible to the program) in main memory.

There are two kinds of page faults: soft and hard. A soft page fault occurs when a process refers to a virtual memory page that is not in the working set, but does not require that the page be retrieved from disk. This can happen when the page is on the standby list in main memory or when the page is being shared with another process. A hard page fault occurs when a virtual memory page is not found in main memory and must therefore be retrieved from disk. Neither type of page fault is an error.

Hard page faults indicate that your application is reading from and writing to disk. A rise in the number of hard page faults generated by a specific application increases the possibility of a disk bottleneck. PFMon helps you determine the number, type, and source of soft and hard page faults that your application generates.

System Requirement

The following is the system requirement for PFMon:

  • Windows XP Professional or Windows Server 2003 family operating system

Files Required

  • Pfmon.exe
  • Psapi.dll


Pmon.exe: Process Resource Monitor

Process Resource Monitor (PMon) is a command-line tool that displays several measures of the CPU and memory use of processes running on the system. The PMon display appears in the command window. It is updated automatically every few seconds and requires no configuration.

You can use PMon to measure paged and nonpaged pool usage, and to identify kernel mode memory leaks.

Corresponding Operating System Features

Windows Task Manager offers both a list of processes with CPU and memory usage and a GUI view of performance information.

To open Task Manager:

  1. Press CTRL+ALT+DEL.
  2. Click Task Manager.

Concepts

A paged pool is system virtual memory that has been charged to a process and can be paged. Paging is the moving of infrequently used parts of a program's working memory from RAM to another storage medium, usually the hard disk.

A nonpaged pool is system virtual memory charged to a process that is guaranteed not to be paged out by the operating system.

System Requirements

The following are the system requirements for PMon:

  • Windows XP Professional or Windows Server 2003 operating system

File required

  • Pmon.exe


Showperf.exe: Performance Data Block Dump Utility

Overview | Remarks | UI | Related Tools Run Tool

Performance Data Block Dump Utility (ShowPerf) is a GUI tool that loads and runs the dynamic-link libraries (DLLs) of installed performance counters on local and remote computers. ShowPerf then takes this data, unformatted, from the internal data buffers of performance counters, and displays it.

Administrators and performance counter developers can use ShowPerf to identify counters that the system cannot load and counters that the system disables because the DLL fails system run-time reliability tests. They can also use ShowPerf to detect errors in the performance counter data.

ShowPerf displays the following data:

  • Performance objects and object instances that are enabled on the system (Disabled objects do not appear.)
  • Index of the object in the performance registry (HKEY_PERFORMANCE_DATA)
  • Individual performance counters for each object
  • Index of the counter in the performance registry (HKEY_PERFORMANCE_DATA)
  • Type of data that each performance counter gathers
  • Unformatted content of the data block gathered by the performance counter

Corresponding Operating System Features

The Performance snap-in monitors performance counters. The Performance snap-in is located in Administrative Tools.

Concepts

Windows XP and Windows Server 2003 obtain performance data from components in your computer. As a system component performs work on your system, it generates performance data. That data is described as a performance object and is typically named for the component generating the data. For example, the Processor object is a collection of performance data for the processor or processors on your system. To learn more about performance, see Understanding the Performance Console in Help and Support Center for Windows Server 2003.

System Requirements

The following are the system requirements for ShowPerf:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems
  • Membership in the Administrators local or domain local group

File required

  • Showperf.exe


Printer and Fax Management Tools

Tools in this category are used to manage the following Windows features:

  • Printers
  • Print services
  • Print spoolers


Cleanspl.exe: Spooler Cleaner

Overview | Remarks | UI | Related Tools Run Tool

Spooler Cleaner (CleanSpl) is a GUI tool that restores the print spooler to its original state. It deletes all print jobs, printers, printer drivers, and spool files on a specified local or remote server.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A print spooler intercepts a print job on its way to the printer and sends it to disk or memory instead, where the print job is held until the printer is ready for it. The term spooler is an acronym created from "simultaneous peripheral operations on line."

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003 operating system
  • Administrator privileges on the target machine

File Required

  • Cleanspl.exe


Printdriverinfo.exe: Drivers Source

Drivers Source (PrintDriverInfo) is a command-line tool that is used to collect information about printer drivers and is primarily used for support purposes. The information the tool collects includes the format and the mode of the driver. The tool also has the ability to map a driver file back to the printer that uses it.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A software driver is a device-specific control program that enables a computer to work with a particular device, such as a printer or a disk drive. Because the driver handles device-specific features, the operating system is freed from the burden of having to understand and support the needs of individual hardware devices.

System Requirements

The following are the system requirements for PrintDriverInfo:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems
  • Permissions: Administrator rights to the server are required to display printer driver information.

Files Required

  • Printdriverinfo.exe


Prnadmin.dll: Printer Administration Objects

Overview | Related Tools Open Prnadmin.doc

Printer Administration Objects (PrnAdmin) is a COM-based tool that provides large-scale, noninteractive control of printers, drivers, and ports on local and remote computers.

Using PrnAdmin, you can:

  • Add and delete a local or remote printer.
  • Add and delete printer connections.
  • Add and delete a local or remote form.
  • Add and delete a local or remote standard TCP/IP port (of type Line Printer Remote (LPR) or RAW).
  • Add and delete a local or remote driver.
  • View a list of printers, ports, drivers, and forms on a local or remote computer.
  • Control and configure a local or remote printer.

PrnAdmin consists of several scriptable COM objects residing in Prnadmin.dll, which functions as a wrapper around Printui.dll. Several Microsoft Visual Basic Script (VBScript) sample files are included with the tool.

Note

  • For more detailed information on how to use PrnAdmin.DLL, see Prnadmin.doc. This white paper provides additional information on printer, drivers, ports and forms to help administrators and programmers manage a large number of local and remote printers.

Corresponding Operating System Features

All the functionality of prnadmin.dll can be duplicated using the printers folder and various wizards. Converting printer ports from LPR to Standard TCP/IP is the only functionality in prnadmin.dll for which there is no corresponding GUI.

Concepts

PrnAdmin consists of several COM objects residing in Prnadmin.dll. You need to know a scripting language (for example, VBScript or JScript), or you can make use of the objects provided by PrnAdmin in any programming language that supports COM programming.

For more information about COM, see Microsoft Component Object Model (http://go.microsoft.com/fwlink/?LinkID=12420).

For more information about PrnAdmin and the Windows Management Instrumentation (WMI) scripts in Windows Server 2003, see Designing and Deploying Print Servers (http://go.microsoft.com/fwlink/?LinkID=4745) in the Windows Server 2003 Deployment Kit.

System Requirements

The following are the system requirements for this tool:

  • Windows 2000 or Windows Server 2003 operating systems.

    Notes

    • PrnAdmin does not run on Windows NT 4.0; however, it can target a remote Windows NT 4.0 server. You cannot use the WMI print classes on Windows NT 4.0.
    • There is limited support for WMI print classes in Windows 2000. These print classes are read-only.
    • There is more support for WMI print classes in Windows Server 2003 and Windows XP. These WMI print classes are read- and write-enabled.
  • The user must have Administrator permissions on printer objects in Active Directory.

Files Required

  • Prnadmin.dll
  • Prnadmin.doc

The following sample VBScript files are also required:

  • Clean.vbs
  • Clone.vbs (there is no WMI equivalent for the cloning script)
  • Conall.vbs
  • Defprn.vbs
  • Drvmgr.vbs
  • Forms.vbs
  • Persist.vbs
  • Portconv.vbs
  • Portmgr.vbs
  • Prncfg.vbs
  • Prnctrl.vbs
  • Prndata.vbs
  • Prnmgr.vbs


Setprinter.exe: Spooler Configuration Tool

Spooler Configuration Tool (SetPrinter)is a command-line tool that is used to set configurations or states of local and remote printers, for an individual printer or for all printers on a print server

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

The Windows printing processor normally supports five data types. The two most commonly used data types, enhanced metafile (EMF) and ready-to-print ("raw"), affect performance in different ways on both the client computer and the print server computer.

EMF

EMF is the default data type for most Windows-based programs. With EMF, the printed document is converted to a metafile format that is more portable than raw files, and usually can be printed on any printer. EMF files tend to be smaller than raw files that contain the same print job. Only the first portion of a print job is altered, or rendered on the client computer; most of the performance impact is on the print server computer. This helps the application on the client computer to return control to the user more quickly.

Raw

Raw is the default data type for clients other than Windows-based programs. The raw data type tells the spooler not to alter the print job at all prior to printing. With this data type, the entire process of preparing the print job is done on the client computer.

The following table shows the five different data types supported by the default Windows print processor.

Data type | Directions to the Spooler | Use
Raw | Print the document with no changes. | This is the data type for all clients that are not based on Windows.
Raw (form feed appended) | Append a form-feed character (0x0C), but make no other changes. (A PCL printer omits the document's last page if there is no trailing form feed.) | Required for some applications. It can be set as the default in the Print Processor dialog box.
Raw (form feed auto) | Check for a trailing form feed, and add one if it is not already there, but make no other changes. | Required for some applications. It can be set as the default in the Print Processor dialog box.
EMF 1.00x | Treat the document as an EMF file rather than the raw data that the printer driver produces. | EMF documents are created by Windows-based programs.
Text | Treat the entire job as ANSI text, and add print specifications by using the factory defaults of the print device. | This is useful when the print job is simple text and the target print device cannot interpret simple text.

System Requirement

The following is the system requirement for this tool:

  • Windows Server 2003 operating system

File Required

  • Setprinter.exe


Splinfo.exe: Print Spooler Information

Print Spooler Information (SplInfo) is a command-line tool that collects information from the print spooler and displays it.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A print spooler intercepts a print job on its way to the printer and sends it to disk or memory instead, where the print job is held until the printer is ready for it. The term spooler is an acronym created from "simultaneous peripheral operations on line."

System Requirements

The following are the system requirements for Print Spooler Information (SplInfo):

  • Windows NT 3.51, Windows NT 4.0, Windows 2000, Windows XP, or Windows Server 2003

File Required

  • Splinfo.exe


Process and Service Management Tools

Tools in this category are used to manage the following Windows features:

  • System or Network Monitoring
  • Performance Counters
  • Processes
  • Services


Empty.exe: Free Working Set Tool

Overview | Syntax | Examples | Related Tools

Free Working Set Tool (Empty) is a command-line tool that frees the working set of a specified task or process, making those page frames available for other processes.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A working set is a subset of virtual pages resident in physical memory.

System Requirement

The following is the system requirement for the Free Working Set Tool:

  • Windows Server 2003

File Required

  • Empty.exe


Instsrv.exe: Service Installer

Service Installer (InstSrv) is a command-line tool that installs and uninstalls executable services and assigns names to them.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A service is a program, routine, or process that performs a specific system function to support other programs, particularly at a low (close to the hardware) level. When services are provided over a network, they can be published in Active Directory, facilitating service-centric administration and usage. Some examples of services are the Security Accounts Manager service, File Replication service, and Routing and Remote Access service.

System Requirements

The following are the system requirements for InstSrv:

  • Windows XP Professional or Windows Server 2003 family operating system
  • Administrators group membership

File Required

  • Intsrv.exe


Srvany.exe: Applications as Services Utility

Overview | Remarks | Syntax | Examples | Related Tools

Applications as Services Utility (SrvAny) is a tool that enables 32-bit or 16-bit applications to run as services. Although SrvAny only runs on the Windows Server 2003 operating system, it can work with 32-bit applications written for Windows Server 2003, Windows 2000, or Windows NT. You can also use this tool to run 16-bit Windows applications as services, but some 16-bit applications will stop running when a user logs off of the computer.

The advantages of running applications as services are listed below.

  • When a user logs off, 32-bit applications running as services do not stop. This is beneficial because users do not need to restart the application each time they log on.
  • Applications running as services can handle requests without user intervention. Unless an application is interactive, requests are processed even when no user is logged on to the server.
  • Applications running as services can run with their own logon accounts. This means an application can continue running and processing requests even when the user currently logged on to the server does not have permissions to administer the application.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A service is a program, routine, or process that performs a specific system function to support other programs, particularly at a low (close to the hardware) level. When services are provided over a network, they can be published in Active Directory, facilitating service-centric administration and usage. Some examples of services are the Security Accounts Manager service, File Replication service, and Routing and Remote Access service.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003
  • Permissions: You must have Administrator privileges to use this tool.

Files Required

  • Instsrv.exe
  • Srvany.exe


Vadump.exe: Virtual Address Dump

Virtual Address Dump (VaDump) is a command-line tool that creates a list containing information about the memory usage of a specified process. You can use VaDump to make sure virtual address space is not over-allocated.

VaDump examines the virtual address of a running process. Depending on the options specified, the output of VaDump can include:

  • Each address, along with its size, state, protection, and type.
  • Total committed memory for the image, the .exe file, and each .dll file, including system .dll files.
  • Total mapped committed, private committed, and reserved memory.

Note

  • Because VaDump can generate a very large amount of output, it is advisable to redirect the output to a file.

Note

  • There are a number of tools that you can use to find a Process Identification (PID), including the operating system tool TaskList or the Support Tool Pviewer.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A process is a running instance of an application or executable file, along with all the system resources that have been allocated to that instance. In general, a process is equivalent to a single application or service; for example, Microsoft Word runs in the Winword.exe process.

Each process is composed of a set of threads. A thread is a unit of work that runs simultaneously with other units of work on the computer; each process must have at least one thread.

Threads represent the basic unit of execution in an operating system. When a thread starts, the operating system Memory Manager allocates enough physical memory and page file space to allow the thread to run. While a thread is running, it can request additional memory to enable it to complete its task. When a thread ends, it releases the memory it was using back to the Memory Manager for reallocation.

Memory is also allocated based on the number of threads spawned by each process. For example, consider a computer running two processes. Process A has 5 threads and Process B has 15 threads. Assuming the two processes have equal priority, Process A is allocated 25 percent (5 / 20) of the memory being used and Process B is allocated 75 percent (15 / 20) of the memory being used.

This method of thread allocation helps ensure that applications receive the memory they need. However, this same method can also result in memory leaks. A memory leak occurs when an application receives an increasing amount of memory but does not relinquish that memory back to the Memory Manager. This typically happens when a process creates threads but does not destroy those threads when they have finished their work.

System Requirements

The following are the system requirements for VaDump:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Vadump.exe


Remote Administration Tools

Tools in this category are used to manage the following Windows features:

  • Emergency Management Services
  • Remote Desktop
  • Telnet
  • Terminal Services


Lsreport.exe: Terminal Services Licensing Reporter

Terminal Services Licensing Reporter (LsReport) is a command-line tool that creates a report on licenses granted by Terminal Services license servers. It connects to Terminal Services license servers to obtain information about the client access license packages installed on the available servers. Then, LsReport, by default, writes information about licenses to Lsreport.txt, a file in the working directory.

LsReport is useful for recording license data to tab-delimited log files. This exported data can then be used to track license consumption and usage trends within your organization.

Corresponding Operating System Features

You can view information about terminal servers in the following tools:

  • Terminal Server Licensing (licmgr.exe)

    Terminal Server Licensing lists client access license package information in addition to the names and types of licensing servers in a domain.

    To view information in Terminal Server Licensing:

    1. Click Start, point to Programs and then Administrative Tools.
    2. Click Terminal Server Licensing.
    3. For information about how to use Terminal Server Licensing, right-click All Servers, and then click Help.
  • Terminal Services Manager (tsadmin.exe)

    Terminal Services Manager allows you to view information about terminal servers in trusted domains, including all sessions, users, and processes for each terminal server. You can also use this tool to perform various actions to manage the server.

    To view information in Terminal Services Manager:

    1. Click Start, point to Programs and then Administrative Tools.
    2. Click Terminal Services Manager.
    3. For information about how to use Terminal Services Manager, from the Help menu, click Help.

Concepts

A Terminal Server License Server stores all client licenses that have been installed for a Terminal Server and tracks the licenses that have been issued to client computers or terminals. A terminal server must be able to connect to an activated Terminal Server License Server before clients can be issued licenses.

You can use Terminal Server Licensing to manage your Terminal Server licenses. This tool helps you perform tasks such as activating a terminal server license server and installing client license key packs. You can also use Terminal Server Licensing to connect to any Terminal Server License Server on your network and view information about the licenses on that server. However, to export this data to a log file, you must use LsReport.

A Terminal Server License Server can issue temporary licenses for clients without valid licenses. This allows them to use a terminal server for up to 120 days from the date of the first client logon. After this evaluation period ends, a terminal server can no longer allow clients to connect unless it locates a Terminal Server License Server to issue client licenses.

System Requirements

The following are the system requirements for LsReport:

  • Windows XP Professional or Windows Server 2003 operating systems

  • Permission to access license information on the Terminal Services license servers being queried.

File Required

  • Lsreport.exe


Lsview.exe: Terminal Services License Server Viewer

Overview | Remarks | UI | Examples | Related Tools Run Tool

Terminal Services License Server Viewer (LSView) is a GUI tool that displays information about all available Terminal Services license servers in the current domain and current site of the computer. It is useful for monitoring and logging the status of license servers.

LsView displays the following information:

  • The names of all license servers in the current domain and site. This includes new license servers added to the domain and all license servers from the current Active Directory Site within the domain.
  • The types of all license servers in the domain. There are two types of license servers, Enterprise License Servers and Domain License Servers. The Workgroup License Server type for workgroups is Domain. It is important to know the type of license server when troubleshooting.
  • The date and time each license server is available. By default, LsView updates server availability every five minutes.

Corresponding Operating System Features

The following application exposes a subset of the functionality of this tool:

  • Terminal Server Licensing (licmgr.exe). Licmgr lists client access license package information in addition to the names and types of licensing servers in a domain. However, licmgr does not list license servers that are outside its Active Directory Site. The Active Directory Site is determined by the membership of the machine running licmgr.

    To view information in Terminal Server Licensing:

    1. Click Start, point to Programs and then Administrative Tools.
    2. Click Terminal Server Licensing.
    3. For information about how to use Terminal Server Licensing, right-click All Servers, and then click Help.

Concepts

Terminal servers allow unlicensed clients to connect for 120 days from the date of the first client logon. After this evaluation period ends, a terminal server can no longer allow clients to connect unless it locates a Terminal Server License Server to issue client licenses.

A Terminal Server License Server stores all client licenses that have been installed for a Terminal Server and tracks the licenses that have been issued to client computers or terminals.

Three types of license servers are available:

  • Enterprise License Server. This type of license server is appropriate when a network includes several domains. An Enterprise License Server can serve terminal servers on any domain, but the domain must be a Windows Server 2003 domain or Windows 2000 domain.
  • Domain License Server. This type of license server is appropriate when a separate license server must be maintained for each domain. Keep in mind that terminal servers can access domain license servers only if they are in the same domain as the license server. If your network includes workgroups or Windows NT 4.0 domains, the domain license server is the only type of license server that you can install and use.
  • Workgroup License Server. This type of server is appropriate when a server is in a workgroup, and not joined to a domain. A Workgroup License Server can serve Terminal Servers in the same workgroup and in the same subnet.

System Requirements

The following are the system requirements for Lsview.exe:

  • Windows XP or Windows Server 2003 operating systems

File Required

  • Lsview.exe


Srvinfo.exe: Remote Server Information

Overview | Syntax | Examples | Related Tools Open Command Prompt

Remote Server Information (SrvInfo) is a command-line tool that displays information about a server or workstation, including available disk space, partition types, and the status of services.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A server computer is a computer on a network that sends files to, or runs applications for, other computers on the network; the software that runs on the server computer performs the work of serving files or running applications.

System Requirements

The following are the system requirements for SrvInfo:

  • Windows NT 4.0, Windows 2000, Windows XP Professional, or Windows Server 2003 operating system

Note

  • SrvInfo output varies depending on the permission the person running the tool has on the target computer. If you do not have administrative credentials on the target computer, SrvInfo output will be limited.

File Required

  • Srvinfo.exe


Security Management Tools

Tools in this category are used to manage the following Windows features:

  • Access control
  • Authentication
  • Encrypting File System
  • Public Key Infrastructure
  • Software restriction policies
  • Windows Time service


Cmgetcer.dll: Connection Manager Certificate Deployment Tool

Overview | Remarks | Syntax | Related Tools

Connection Manager Certificate Deployment Tool (CMGetCer) is a tool that enables remote users who require secure virtual private network (VPN) access to enroll for certificates. Getting certificates installed on a client computer takes several steps. CMGetCer allows the administrator to automate the process of enrolling for the certificate and then downloading it to the client.

Corresponding Operating System Features

The Certification Authority snap-in in Administrative Tools exposes a subset of this tool.

Concepts

Certificates are used for network access authentication because they provide strong security for authenticating users and computers. For more information about certificate services, see Certificate Services overview in Help and Support Center for Windows Server 2003.

System Requirements

The following are the system requirements for configuring CMGetCer:

  • Windows XP Professional or Windows Server 2003 family operating system
  • Connection Manager
  • Membership in the Administrators domain local group

The following are the system requirements for clients to run a profile containing CMGetCer:

  • Windows Server 2003, Windows XP Professional, Windows XP Home Edition, Windows 2000, Windows Millennium Edition (Me), or Windows 98 operating system

File Required

  • Cmgetcer.dll


Kerbtray.exe: Kerberos Tray

Overview | Remarks | UI | Related Tools Run Tool

Kerberos Tray (KerbTray) is a GUI tool that displays ticket information for a computer running the Microsoft implementation of Kerberos version 5 authentication protocol.

You can view and purge the ticket cache by using the KerbTray tool icon located in the notification area of the desktop. By positioning the cursor over the icon, you can see the time left on the initial ticket-granting ticket (TGT) before it expires. The icon also changes in the last hour before the Local Security Authority (LSA) renews the ticket.

Note

  • You receive the initial ticket-granting ticket when you first log on to the domain.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Kerberos is an authentication protocol designed to enable a party to prove its identity on a network and assert that identity when establishing communications. The Kerberos protocol establishes a unique package of information, called a ticket, for each security principle (normally a user or computer) at the time of logon to a Windows Server 2003 or Windows 2000 domain. The ticket is then used to prove the identity of the principle when establishing communications.

System Requirements

The following are the system requirements for KerbTray:

  • Windows Server 2003 or Windows 2000 domain environment

File Required

  • Kerbtray.exe

For More Information

  • See The Kerberos Network Authentication Service (v5). (http://go.microsoft.com/fwlink/?LinkID=9203)


Klist.exe: Kerberos List

Overview | Syntax | Examples | Related Tools Open Command Prompt

Kerberos List (KList) is a command-line tool that is used to view and delete Kerberos tickets granted to the current logon session. To use KList to view tickets, you must run the tool on a computer that is a member of a Kerberos realm.

When KList is run from a client, it shows:

  • Ticket-granting ticket (TGT) to a Windows Kerberos key distribution center (KDC)
  • Ticket-granting ticket (TGT) to Ksserver on UNIX

Caution

  • Deleting Kerberos tickets can diminish or disable the functionality of the current logon session.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Kerberos is an authentication system designed to enable two parties to exchange private information across an otherwise open network. It assigns a unique key, called a ticket, to each user who logs on to the network. The ticket is embedded in messages to identify the sender of the message.

System Requirements

The following are the system requirements for KList:

  • Windows 2000
  • Windows Server 2003 operating systems
  • Target computer must be a member of a Kerberos realm.

File Required

  • Klist.exe

For More Information

For more information on the Kerberos authentication protocol, see the following references:

  • RFC-1510 "The Kerberos Network Authentication Service V5" (http://go.microsoft.com/fwlink/?LinkID=9203)
  • Windows Deployment and Resource Kits Web site (http://go.microsoft.com/fwlink/?LinkID=286)


Krt.exe: Key Recovery Tool

Overview | Remarks | UI | Related Tools Run Tool

Key Recovery Tool (KRT) is a GUI tool that enables a key recovery agent (KRA) with appropriate permissions to recover private keys from a Windows Server 2003 certification authority (CA).

Corresponding Operating System Features

The Certification Authority snap-in exposes a subset of this tool's functionality. The command-line tool Certutil provides functionality equivalent to this tool.

To open Certification Authority:

  • In Control Panel, choose Administrative Tools, and then choose Certification Authority.

Concepts

Windows Server 2003 CAs can be configured to store a copy of the private encryption key for each corresponding public key certificate issued. This private key is protected by the CA and can only be retrieved by an authorized Certificate Manager. The Certificate Manager must retrieve the desired private key from the CA. Then, a KRA must use their private key to decrypt the retrieved private key. This process can be somewhat difficult to manage at a command line, so KRT provides a simple utility to locate and recover private keys. For more information, see Certutil tasks for key archival and recovery.

System Requirements

The following are the system requirements for KRT:

  • Windows Server 2003 CA configured for key archival.
  • Certutil must be installed for KRT to work. On computers running Windows XP Professional, Certutil is installed by the Windows Server 2003 Administration Tools Pack.

Files Required

  • Krt.exe
  • Crutredir.dll


Mscep.dll: Certificate Services Add-on for Simple Certificate Enrollment Protocol

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Mscep.dll: Microsoft Simple Certificate Enrollment Protocol

Overview | Remarks | Examples | Related Tools

MSCEP.dll is a dynamic-link library (DLL) that is a Certificate Services add-on Internet Service Application Program Interface (ISAPI). This application implements Microsoft Simple Certificate Enrollment Protocol (MSCEP) on a Windows Server 2003 Certification Authority (CA), enabling routers to obtain certificates using the Simple Certificate Enrollment Protocol (SCEP).

Note

  • MSCEP does not install with other Resource Kit tools for Windows Server 2003. It requires separate installation. Furthermore, MSCEP can only be installed on a Windows Server 2003 certification authority (CA).

Corresponding Operating System Features

The Certification Authority Microsoft Management Console (MMC) snap-in (Certsrv.msc) offers a graphical user interface (GUI) for working with existing certificates and certificate requests submitted through SCEP. There is no GUI component for SCEP enrollment.

Concepts

Simple Certificate Enrollment Protocol (SCEP) is a communication protocol that allows simplified certificate enrollment and download requests. This protocol is widely used by routers and other network devices to obtain certificates for network services such as Internet Protocol Security (IPSec).

System Requirements

The following are the system requirements for MSCEP:

  • Windows Server 2003 Certification Authority running Internet Information Services (IIS)

The following privileges are required to install MSCEP:

  • To install MSCEP on an enterprise CA: Membership in the Enterprise Administrators group and the root Domain Administrators group.
  • To install MSCEP on an enterprise or stand-alone CA: Membership in the administrators group for the local computer.

File Required

  • Cepsetup.exe

For More Information

  • To issue or deny a pending certificate request on a stand-alone CA, see Review pending certificate requests in Help and Support Center in Windows Server 2003.
  • To revoke a certificate and publish a CRL, see Revoke an issued certificate and Manually publish the certificate revocation list in Help and Support Center in Windows Server 2003.
  • If you are issuing certificates to routers from a CA, you might want to view all issued certificates with the unstructuredName, unstructuredAddress, and serialNumber columns. To add these columns to the MMC view, see Customize the display of columns in Certification Authority in Help and Support Center in Windows Server 2003. This reference contains general instructions for adding columns to the Certification Authority snap-in display.


Ntrights.exe

NTRights is a command-line tool that allows you to grant or revoke a right for a user or group of users on a local or remote computer. You can also place an entry in the event log of the computer, noting the change.

NTRights is useful in unattended or automated installations during which you may want to change the default rights. You can also use it in situations where you need to change a right in an existing installation, but you cannot access and log on to all computers.

Corresponding Operating System Features

The Computer Management snap-in and the Active Directory Users and Computers snap-in both offer subsets of the functionality of this tool.

Concepts

Users are allowed to perform tasks on computers in a domain, based on rights assigned to them. Rights are usually assigned to groups and users receive these rights when they become members of those groups. By default, built-in groups already have a set of rights assigned to them.

System Requirements

The following are the system requirements for NTRights:

  • Windows 2000, Windows XP Professional or Windows Server 2003 operating systems
  • Permissions: Administrator privileges are required to set a right for a user or group.

File Required

  • Ntrights.exe


Pkiview.msc: PKI Health Tool

Overview | Remarks | UI | Related Tools Run Tool

PKI Health Tool (PKIView) is an MMC Snap-in component that displays the status of one or more Microsoft Windows Server 2003 Certification Authorities that comprise a public key infrastructure (PKI).

PKIView gathers information from each certification authority (CA) in the enterprise about the CA certificates and certificate revocation lists (CRLs) and validates them to ensure that they are working correctly. If they are not working, or if they are about to fail, PKIView provides detailed warning or error information.

PKIView displays the status of Windows Server 2003 Certification Authorities installed in an Active Directory forest. You can use it to discover all PKI components including subordinate and root CAs associated with an enterprise CA. The tool can also manage important PKI containers such as root CA trust and NTAuth stores that are also contained in the configuration partition of an Active Directory forest.

Corresponding Operating System Features

The information gained by examining the certification authority (CA) certificate and certificate revocation list for each CA in an enterprise can be obtained manually by using the Certification Authority MMC Snap-in individually on each CA and directly examining Active Directory with tools such as ADSIEdit.exe.

PKIView also provides a tree view of a PKI, which is not available in other tools.

Concepts

Numerous data objects are used in the operation of a PKI. Each CA uses a CA certificate to sign issued certificates. In addition, each CA is normally configured to publish its signing certificate and a certificate revocation list (CRL) to one or more locations on the network. These locations may include file shares, LDAP locations within Active Directory, or URL locations available through a web server.

All these objects can become invalid or unreachable by clients. If this happens, PKI functionality can be impaired or destroyed. Use regular administrative housekeeping to help ensure that these objects are maintained properly. PKIView is an automated tool that helps identify and manage potential PKI problems.

System Requirements

The following are the system requirements for PKIView:

  • Windows Server 2003 or Windows XP Professional with the Windows Server 2003 Administration Pack installed
  • Windows 2000 or Windows Server 2003 Enterprise Certification Authority
  • The computer must be a member of the Active Directory domain that contains the managed PKI
  • Read permission for the logged-on user on the various PKI objects in Active Directory is required to view the PKI objects. To manage the objects, you must have administrative privileges on those objects. In addition, you must have permission to view or manage each CA.

Files Required

  • Pkiview.msc
  • Pkiview.dll


Showpriv.exe: Show Privilege

Show Privilege (ShowPriv) is a command-line tool that displays the rights assigned to users and groups. ShowPriv must be run locally on the target computer or on a domain controller to display users and groups that have domain privileges.

Corresponding Operating System Features

The Local Security Policy snap-in provides a subset of this tool.

To open the Local Security Policy snap-in:

  • Click Start and then click Run.
  • In the Run dialog box, type gpedit.msc.

Concepts

Users are allowed to perform tasks on computers in a domain, based on privileges assigned to them. Privileges are usually assigned to groups, and users receive these privileges when they become members of such groups. By default, built-in groups already have a set of privileges assigned to them.

System Requirements

The following are the system requirements for ShowPriv:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating systems

File Required

  • Showpriv.exe


Subinacl.exe

SubInACL is a command-line tool that enables administrators to obtain security information about files, registry keys, and services, and transfer this information from user to user, from local or global group to group, and from domain to domain.

For example, if a user has moved from one domain (DomainA) to another (DomainB), the administrator can replace DomainA\User with DomainB\User in the security information for the user's files. This gives the user access to the same files from the new domain.

SubInACL enables administrators to do the following:

  • Display security information associated with files, registry keys, or services. This information includes owner, group, permission access control list (ACL), discretionary ACL (DACL), and system ACL (SACL).
  • Change the owner of an object.
  • Replace the security information for one identifier (account, group, well-known security identifier (SID)) with that of another identifier.
  • Migrate security information about objects. This is useful if you have reorganized a network's domains and need to migrate the security information for files from one domain to another.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

For an introduction to security descriptors and the role they play in access control, see Understanding access control in Help and Support Center for Windows Server 2003.

System Requirements

The following are the system requirements for SubInACL:

  • Windows XP Professional or Windows Server 2003 operating system

This tool is designed for use by administrators. Some actions may fail or generate error messages if the user does not have the following privileges:

  • SeBackupPrivilege (Back Up Files and Directories)
  • SeChangeNotifyPrivilege (Bypass Traverse Checking)
  • SeRestorePrivilege (Restore Files and Directories)
  • SeSecurityPrivilege (Manage Auditing and Security Log)
  • SeTakeOwnershipPrivilege (Take Ownership of Files or Other Objects)
  • SeTcbPrivilege (Act As Part of the Operating System)

File Required

  • Subinacl.exe


Winexit.scr: Windows Exit Screen Saver

Overview | Remarks | UI | Related Tools

Windows Exit Screen Saver (WinExit) is a screen saver that logs off the current user after a specified period of inactivity. In other respects, it is similar to other screen savers and can be configured and tested on the Screen Saver tab of the Display Properties dialog box in Control Panel.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A screen saver is a moving picture or pattern or a blank screen that appears on your computer monitor when you have not used the mouse or keyboard for a specified period of time. Screen savers that come standard with Windows Server 2003 allow you to password protect a computer by requiring a password to be entered if the screen saver has been activated.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003

File Required

  • Winexit.scr


Software and System Deployment Tools

Tools in this category are used to manage the following Windows features:

  • OLE
  • RIS


Usrmgr.exe: User Manager for Domains

Related Tools Run Tool

User Manager for Domains (UsrMgr) is a GUI tool that allows you to manage security for Windows NT version 3.51 or 4.0 domains, member servers, and client computers from a Windows Server 2003 computer.

Warning

  • Using this tool on Active Directory domains or Windows 2000, Windows XP or Windows Server 2003 computers may cause corruption, or the tool may refuse to target such domains or computers. Always use the Active Directory administrative tools for Active Directory domains.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

To administer a user account by using UsrMgr, you must be logged on to a user account that is a member of the Administrators, Domain Admins, or Server Operators group for that domain.

To use UsrMgr to administer a workstation computer or server running Windows NT that is not a domain controller, you must be logged on to a user account that is a member of the Administrators or Power Users group for that computer.

With UsrMgr, you can:

  • Select the domain or computer to be administered.
  • Create and manage user accounts.
  • Create and manage groups.
  • Manage security policies.

System Requirements

The following are the system requirements for UsrMgr:

  • Windows Server 2003 operating system
  • Administrator privileges on the target domain or computer.

Files Required

  • Usrmgr.exe
  • Usrmgr.hlp
  • Usrmgr.cnt


System Management Tools

Tools in this category are used to manage the following Windows features:

  • Locale settings
  • Logon scripts
  • Message Queuing (MSMQ)
  • Registry
  • System shutdown
  • Task Scheduler


Nlsinfo.exe: Locale Information Tool

Overview | Syntax | Examples | Related Tools Open Command Prompt

Locale Information Tool (NLSInfo) is a command-line tool that displays information about the locale settings for a computer.

Corresponding Operating System Feature

Date and Time Properties and Regional and Language Options in Control Panel show the locale and regional options for a computer.

To open Date and Time Properties and Regional and Language Options:

  1. In Control Panel, choose Date and Time.
  2. In Control Panel, choose Regional and Language Options.

Concepts

The locale setting for a computer affects the display of numbers, currency, dates, and times. Windows provides settings that allow a user to choose how dates, time, currency amounts, large numbers, and numbers with decimal fractions are displayed. The user can also choose from a large number of input languages and text services, such as different keyboard layouts, Input Method Editors (IMEs), and speech and handwriting-recognition programs.

System Requirement

The following is the system requirement for NLSInfo:

  • Windows Server 2003 operating system

File Required

  • Nlsinfo.exe


Regini.exe: Registry Change by Script

Overview | Remarks | Syntax | Related Tools Open Command Prompt

Registry Change by Script (RegIni) is a command-line tool that allows you to add and modify keys and values in the registry by specifying a registry script.

Caution

  • Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall the Windows operating system. To configure or customize the Windows operating system, use the programs in Control Panel or Microsoft Management Console (MMC) whenever possible.

Corresponding Operating System Features

You can use a registry editor to perform similar tasks as an interactive process, but RegIni supports a wider range of data types than the registry editors do. RegIni also provides a quick way to add or modify drivers in the registry.

Concepts

The registry is a central hierarchical database in Windows used to store information necessary to configure the system for one or more users, applications, and hardware devices. The registry contains information that Windows continually references during operation, such as profiles for each user, the applications installed on the computer and the types of documents each can create, property sheet settings for folders and applications, what hardware exists on the system, and which ports are being used.

System Requirements

The following are the system requirements for RegIni:

  • Windows 2000, Windows XP Professional, or Windows Server 2003 operating system

Files Required

  • Regini.exe
  • Regini.doc
  • User-defined script file


Ssdformat.exe: System State Data Formatter

System State Data Formatter (SSDFormat) is a command-line tool that creates a formatted copy of a system state data (SSD) log file. SSDFormat.exe opens an SSD log file, adds an XSL file header to format the data, and saves the changes to a new XML file. When you open the XML file created by SSDFormat in any XML-capable viewer, such as Internet Explorer, the XSL style sheet correctly displays any special characters and formats the data into tabular form.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

Windows Server 2003 automatically creates a system state data log file if you restart or shut down a server unexpectedly.

The SSD log file contains special XML characters that are displayed incorrectly in Microsoft Internet Explorer and other XML readers until reformatted. Viewing system state data helps you understand the events that occur before an unplanned server reboot or shutdown, and it is useful for troubleshooting. You can use SSDFormat to attach an XML style sheet to the log file data. Attaching an XSL style sheet corrects any invalid characters and displays the data in tabular form.

The Windows SSD log file contains the following properties:

  • The file name uses the Shutdown_yyyymmddhhmmss.xml naming convention.
  • The file is saved in the root directory under %windir%\system32\logfiles\shutdown.
  • All system state data is written in a raw XML format.

System Requirements

The following are the system requirements for this tool:

  • Windows Server 2003
  • Permissions:
    • By default, the %windir%\system32\logfiles\shutdown\ directory, where SSD log files are saved, requires Administrator permissions.
    • An administrator can add read permissions to the %windir%\system32\logfiles\shutdown\ directory to allow non-administrators to review the system state data files that are created here.

Files Required

  • Ssdformat.exe
  • SSS_1.1.xsl


Timezone.exe: Daylight Saving Time Update Utility

Overview | Syntax | Examples | Related Tools Open Command Prompt

Daylight Saving Time Update Utility (TimeZone) is a command-line tool that updates the daylight saving information for the current time zone in the registry. In some countries and regions, the start and end of daylight saving time are changed every year, and there is no fixed start or end date. TimeZone allows you to adjust the start and end of daylight saving time so that the computer's time setting is automatically updated on the correct dates.

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

A locale setting for a computer affects the display of numbers, currency, dates, and times. Windows provides settings that allow a user to choose how dates, time, currency amounts, large numbers, and numbers with decimal fractions are displayed. Time zones include automatic adjustments for the start and end of daylight saving time.

System Requirements

The following are the system requirements for TimeZone:

  • Windows XP Professional, or Windows Server 2003 family operating system

File Required

  • Timezone.exe


Showacls.exe: Show ACLs

Show ACLs (ShowACLs) is a command-line tool that enumerates access rights for files, folders, and trees. It allows masking so that you can enumerate only specific access control lists (ACLs). ShowACLs works on NTFS file system partitions only.

ShowACLs also allows you to view permissions for a particular user. ShowACLs does this by enumerating the local and global groups to which the particular user belongs, and matching the user's security identifier (SID)—and the SIDs of the groups to which the user belongs—to the SIDs in each access control entry (ACE).

Corresponding Operating System Features

The operating system provides no GUI functionality that corresponds to this tool.

Concepts

NTFS uses ACLs to set permissions for users and groups on objects. ACLs are made up of ACEs. Each ACE has information that controls the permissions for a specific user or group. There are currently four ACE types defined: Access Allowed, Access Denied, System Alarm, and System Audit. Each ACE has a common ACE header and unique data structure. The SID associated with each ACE is contained in the data that follows the ACE header.

System Requirements

The following are the system requirements for ShowACLs:

  • Windows XP Professional or Windows Server 2003 operating systems

Files Required

  • Showacls.exe
  • Showacls.doc


Glossary

Symbols A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Symbols

.cab file

Cabinet file. A single cabinet file that stores multiple compressed files. These files are commonly used in software installation and to reduce the file size and the associated download time for Web content.

.inf

The file name extension for files that contain device information or scripts to control hardware operations.

.ini

The file name extension for a file that contains configuration information for the Windows operating system.

A

access control

A security mechanism that determines which operations a user, group, service, or computer is authorized to perform on a computer or on a particular object, such as a file, printer, registry subkey, or directory service object.

See also: permission; registry; service

access control entry (ACE)

An entry in an object's discretionary access control list (DACL) that grants permissions to a user or group. An ACE is also an entry in an object's system access control list (SACL) that specifies the security events to be audited for a user or group.

See also: access control; access control list (ACL); permission; security descriptor

access control list (ACL)

A list of security protections that apply to an entire object, a set of the object's properties, or an individual property of an object. There are two types of access control lists: discretionary and system.

See also: access control entry (ACE); security descriptor

ACL

See definition for: access control list (ACL)

Active Directory

The Windows-based directory service. Active Directory stores information about objects on a network and makes this information available to users and network administrators. Active Directory gives network users access to permitted resources anywhere on the network using a single logon process. It provides network administrators with an intuitive, hierarchical view of the network and a single point of administration for all network objects.

See also: directory service; domain; forest; replication

active volume

The volume from which the computer starts up. The active volume must be a simple volume on a dynamic disk. You cannot mark an existing dynamic volume as the active volume, but you can upgrade a basic disk containing the active partition to a dynamic disk. After the disk is upgraded to dynamic, the partition becomes a simple volume that is active.

See also: basic disk; dynamic disk; simple volume

ActiveX

A set of technologies that allows software components to interact with one another in a networked environment, regardless of the language in which the components were created.

American Standard Code for Information Interchange (ASCII)

A standard single-byte character encoding scheme used for text-based data. ASCII uses designated 7-bit or 8-bit number combinations to represent either 128 or 256 possible characters. Standard ASCII uses 7 bits to represent all uppercase and lowercase letters, the numbers 0 through 9, punctuation marks, and special control characters used in U.S. English. Most current x86-based systems support the use of extended (or "high") ASCII. Extended ASCII allows the eighth bit of each character to identify an additional 128 special symbol characters, foreign-language letters, and graphic symbols.

See also: Unicode

answer file

A text file used to automate Setup or other installation processes. Using this text file, you can provide custom answers to Setup-related questions. Typically, you must point the Setup program to use the answer file at the same time Setup is started. Answer files can only be used on applications and operating systems that support them.

API

See definition for: application programming interface (API)

application programming interface (API)

A set of routines that an application uses to request and carry out lower-level services performed by a computer's operating system. These routines usually carry out maintenance tasks such as managing files and displaying information.

ASCII (American Standard Code for Information Interchange)

See definition for: American Standard Code for Information Interchange (ASCII)

B

base priority

A precedence ranking that determines the order in which the threads of a process are scheduled for the processor. Use Task Manager to view and change base priorities.

For Message Queuing, a property that specifies the queue's priority in a public queue. You can set the base priority from -32,768 to 32,767; the default priority is 0. Private queues do not support base priority. Message Queuing routes and delivers messages first by base priority, then by message priority.

basic disk

A physical disk that can be accessed by MS-DOS and all Windows-based operating systems. Basic disks can contain up to four primary partitions, or three primary partitions and an extended partition with multiple logical drives. If you want to create partitions that span multiple disks, you must first convert the basic disk to a dynamic disk by using Disk Management or the Diskpart.exe command-line tool.

See also: dynamic disk

basic input/output system (BIOS)

On x86-based computers, the set of essential software routines that test hardware at startup, start the operating system, and support the transfer of data among hardware devices. The BIOS is stored in read-only memory (ROM) so that it can be executed when you turn on the computer. Although critical to performance, the BIOS is usually invisible to computer users.

See also: Extensible Firmware Interface (EFI)

batch program

An ASCII (unformatted text) file that contains one or more operating system commands. A batch program's file name has a .cmd or .bat extension. When you type the file name at the command prompt, or when the batch program is run from another program, its commands are processed sequentially. Also called batch files.

See also: American Standard Code for Information Interchange (ASCII)

BIOS

See definition for: basic input/output system (BIOS)

bit (binary digit)

The smallest unit of information handled by a computer. One bit expresses a 1 or a 0 in a binary numeral, or a true or false logical condition. A group of 8 bits makes up a byte, which can represent many types of information, such as a letter of the alphabet, a decimal digit, or other character. Also known as a binary digit.

broadcast

The transmission of packets by an Internet Protocol version 4 (IPv4) host to all computers on the subnet.

See also: packet

browser

Software that interprets the markup of files in HTML, formats them into Web pages, and displays them to the end user. Some browsers also permit end users to send and receive e-mail, read newsgroups, and play sound or video files embedded in Web documents.

bytes

A unit of data that typically holds a single character, such as a letter, a digit, or a punctuation mark. Some single characters can take up more than one byte.

See also: bit (binary digit)

C

cabinet files

See definition for: .cab file

capture

To assign a port to a printer. Documents that you print are sent to the printer through the captured port.

For Network Monitor, the process by which frames are copied.

See also: frame

capture trigger

A set of conditions that, when met, stop the capture or execute a program or command file to perform another type of action related to the capture.

CCP

See definition for: Compression Control Protocol (CCP)

certification authority (CA)

An entity responsible for establishing and vouching for the authenticity of public keys belonging to subjects (usually users or computers) or other certification authorities. Activities of a certification authority can include binding public keys to distinguished names through signed certificates, managing certificate serial numbers, and certificate revocation.

CGI

See definition for: common gateway interface (CGI)

checked build

A version of Windows that consists of binaries that provide additional error checking, argument verification, and system debugging code. Much of the extra code in the checked binaries is in the form of ASSERT macros that test an expression. If the expression evaluates to FALSE, the macro generates a kernel debugger error message and breaks into the debugger. This lets you immediately determine the cause and location of the error. Because of the additional error checking code and debugging information, the checked binaries are larger and run slower than the free binaries. This can conceal synchronization or other timing-related problems, such as race conditions, that become apparent only in the free build. If you run the checked build of Windows NT without having enabled kernel debugging, unexpected system shutdowns can occur. This is because the additional checks in the checked build increase the likelihood of encountering a breakpoint.

checksum

A calculated value that is used to test data for the presence of errors that can occur when data is transmitted or when it is written to disk.

cluster

In data storage, the smallest amount of disk space that can be allocated to hold a file. All file systems used by Windows organize hard disks based on clusters, which consist of one or more contiguous sectors. The smaller the cluster size, the more efficiently a disk stores information. If no cluster size is specified during formatting, Windows picks defaults based on the size of the volume. These defaults are selected to reduce the amount of space that is lost and the amount of fragmentation on the volume. Also called an allocation unit.

In computer networking, a group of independent computers that work together to provide a common set of services and present a single-system image to clients. The use of a cluster enhances the availability of the services and the scalability and manageability of the operating system that provides the services.

See also: volume

cluster storage

Storage where one or more attached disks hold data used either by server applications running on the cluster or by applications for managing the cluster. Each disk on the cluster storage is owned by only one node of the cluster. The ownership of disks moves from one node to another when the disk group fails over or moves to the other node.

See also: cluster

code page

A means of providing support for character sets and keyboard layouts for different countries or regions. A code page is a table that relates the binary character codes used by a program to keys on the keyboard or to characters on the display.

COM

See definition for: Component Object Model (COM)

common gateway interface (CGI)

A server-side interface for initiating software services. For example a set of interfaces that describe how a Web server communicates with software on the same computer. Any software can be a CGI program if it handles input and output according to the CGI standard.

compatible ID

An ID used by the Plug and Play Manager. If Plug and Play does not locate a match for the device hardware ID, Plug and Play installs the driver .inf file associated with the compatible ID.

Component Object Model (COM)

An object-based programming model designed to promote software interoperability; it allows two or more applications or components to easily cooperate with one another, even if they were written by different vendors, at different times, in different programming languages, or if they are running on different computers running different operating systems. OLE technology and ActiveX are both built on top of COM.

See also: ActiveX

Compression Control Protocol (CCP)

A protocol used in the negotiation process in a Point-to-Point Protocol (PPP) connection. CCP is one type of Network Control Protocol. Network Control Protocols are used to establish and configure different network protocol parameters for Internet Protocol (IP), Internetwork Packet Exchange (IPX), and NetBIOS Extended User Interface (NetBEUI).

See also: NetBIOS Extended User Interface (NetBEUI)

connection-specific DNS suffix

A DNS suffix specific to an adapter, rather than global to the computer. During the name resolution process, it is appended to an incomplete name. An incomplete name might be a single-label name or a multiple-label name that is not dot-terminated and can not be resolved as an fully qualified domain name. Connection-specific DNS suffixes can also be used for registration of the computers name.

See also: Domain Name System (DNS)

console tree

The left pane in Microsoft Management Console (MMC) that displays the items contained in the console. The items in the console tree and their hierarchical organization determine the capabilities of a console.

See also: Microsoft Management Console (MMC)

credentials

A set of information that includes identification and proof of identification that is used to gain access to local and network resources. Examples of credentials are user names and passwords, smart cards, and certificates.

cyclic redundancy check (CRC)

A procedure used in checking for errors in data transmission. CRC error checking uses a complex calculation to generate a number based on the data transmitted. The sending device performs the calculation before transmission and sends its result to the receiving device. The receiving device repeats the same calculation after transmission. If both devices obtain the same result, it is assumed that the transmission was error-free. The procedure is known as a redundancy check because each transmission includes not only data but extra (redundant) error-checking values. Communications protocols such as XMODEM and Kermit use cyclical redundancy checking.

D

daemon

A networking program, usually associated with UNIX systems, that runs in the background performing tool functions such as housekeeping or maintenance without user intervention or awareness. Pronounced "demon."

DFS

See definition for: Distributed File System (DFS)

DHCP

See definition for: Dynamic Host Configuration Protocol (DHCP)

DHCP client

Any network-enabled device that supports the ability to communicate with a DHCP server for the purpose of obtaining dynamic leased IP configuration and related optional parameters information.

See also: DHCP server; Dynamic Host Configuration Protocol (DHCP)

DHCP server

A computer running the Microsoft DHCP service that offers dynamic configuration of IP addresses and related information to DHCP-enabled clients.

See also: Dynamic Host Configuration Protocol (DHCP); IP address

dial-up connection

The connection to your network if you use a device that uses the telephone network. This includes modems with a standard telephone line, ISDN cards with high-speed ISDN lines, or X.25 networks.

If you are a typical user, you might have one or two dial-up connections, for example, to the Internet and to your corporate network. In a more complex server situation, multiple network modem connections might be used to implement advanced routing.

directory service

Both the directory information source and the service that makes the information available and usable. A directory service enables the user to find an object when given any one of its attributes.

See also: Active Directory

disk mirroring

A set of software processes that maintains a backup copy of a volume at all times. Each mirror of a volume resides on a different disk; ideally, each disk has its own controller. If one mirror becomes unavailable (due to a disk failure, for example), you can use the other mirror to gain access to the volume's data.

See also: mirror; volume

distinguished name

A name that uniquely identifies an object by using the relative distinguished name for the object, plus the names of container objects and domains that contain the object. The distinguished name identifies the object as well as its location in a tree. Every object in Active Directory has a distinguished name. A typical distinguished name might be

CN=MyName,CN=Users,DC=Microsoft,DC=Com

This identifies the MyName user object in the microsoft.com domain.

See also: Active Directory; domain

Distributed File System (DFS)

A service that allows system administrators to organize distributed network shares into a logical namespace, enabling users to access files without specifying their physical location and providing load sharing across network shares.

See also: service

DLL

See definition for: dynamic-link library (DLL)

DNS

See definition for: Domain Name System (DNS)

DNS server

A server that maintains information about a portion of the DNS database and that responds to and resolves DNS queries.

See also: Domain Name System (DNS)

domain

In Active Directory, a collection of computer, user, and group objects defined by the administrator. These objects share a common directory database, security policies, and security relationships with other domains.

In DNS, any tree or subtree within the DNS namespace. Although the names for DNS domains often correspond to Active Directory domains, DNS domains should not be confused with Active Directory domains.

See also: Active Directory; Domain Name System (DNS)

domain controller

In an Active Directory forest, a server that contains a writable copy of the Active Directory database, participates in Active Directory replication, and controls access to network resources. Administrators can manage user accounts, network access, shared resources, site topology, and other directory objects from any domain controller in the forest.

See also: Active Directory; forest; shared resource

domain DFS

An implementation of Distributed File System (DFS) in which DFS topological information is stored in Active Directory. Because this information is made available on multiple domain controllers in the domain, domain DFS provides fault tolerance for any distributed file system in the domain.

See also: Active Directory; Distributed File System (DFS); fault tolerance

Domain Name System (DNS)

A hierarchical, distributed database that contains mappings of DNS domain names to various types of data, such as IP addresses. DNS enables the location of computers and services by user-friendly names, and it also enables the discovery of other information stored in the database.

See also: IP address; service; Transmission Control Protocol/Internet Protocol (TCP/IP)

dynamic disk

A physical disk that provides features that basic disks do not, such as support for volumes that span multiple disks. Dynamic disks use a hidden database to track information about dynamic volumes on the disk and other dynamic disks in the computer. You convert basic disks to dynamic by using the Disk Management snap-in or the DiskPart command-line tool. When you convert a basic disk to dynamic, all existing basic volumes become dynamic volumes.

See also: active volume; basic disk; partition; volume

Dynamic Host Configuration Protocol (DHCP)

A TCP/IP service protocol that offers dynamic leased configuration of host IP addresses and distributes other configuration parameters to eligible network clients. DHCP provides safe, reliable, and simple TCP/IP network configuration, prevents address conflicts, and helps conserve the use of client IP addresses on the network.

DHCP uses a client/server model where the DHCP server maintains centralized management of IP addresses that are used on the network. DHCP-supporting clients can then request and obtain lease of an IP address from a DHCP server as part of their network boot process.

See also: DHCP client; DHCP server; IP address; service; Transmission Control Protocol/Internet Protocol (TCP/IP)

dynamic-link library (DLL)

An operating system feature that allows executable routines (generally serving a specific function or set of functions) to be stored separately as files with .dll extensions. These routines are loaded only when needed by the program that calls them.

See also: Resource DLL

E

EFI

See definition for: Extensible Firmware Interface (EFI)

Encrypting File System (EFS)

A feature in this version of Windows that enables users to encrypt files and folders on an NTFS volume disk to keep them safe from access by intruders.

See also: NTFS file system

environment variable

A string consisting of environment information, such as a drive, path, or file name, associated with a symbolic name that can be used by Windows. You use System in Control Panel or the set command from the command prompt to define environment variables.

See also: variable

Extensible Firmware Interface (EFI)

In computers with the Intel Itanium processor, the interface between a computer's firmware, hardware, and the operating system. EFI defines a new partition style called GUID partition table (GPT). EFI serves the same purpose for Itanium-based computers as the basic input/output system (BIOS) found in x86-based computers. However, it has expanded capabilities that provide a consistent way to start any compatible operating system and an easy way to add EFI drivers for new bootable devices without the need to update the computer's firmware.

See also: basic input/output system (BIOS)

F

FAT

See definition for: file allocation table (FAT)

FAT32

A derivative of the file allocation table (FAT) file system. FAT32 supports smaller cluster sizes and larger volumes than FAT, which results in more efficient space allocation on FAT32 volumes.

See also: file allocation table (FAT)

fault tolerance

The ability of computer hardware or software to ensure data integrity when hardware failures occur. Fault-tolerant features appear in many server operating systems and include mirrored volumes, RAID-5 volumes, and server clusters.

See also: cluster; RAID-5 volume

file allocation table (FAT)

A file system used by MS-DOS and other Windows operating systems to organize and manage files. The file allocation table is a data structure that Windows creates when you format a volume by using FAT or FAT32 file systems. Windows stores information about each file in the file allocation table so that it can retrieve the file later.

See also: FAT32; NTFS file system

File Share resource

A file share accessible by a network path that is supported as a cluster resource by a Resource DLL.

See also: Resource DLL

File Transfer Protocol (FTP)

A member of the TCP/IP suite of protocols, used to copy files between two computers on the Internet. Both computers must support their respective FTP roles: one must be an FTP client and the other an FTP server.

See also: Transmission Control Protocol/Internet Protocol (TCP/IP)

filter

For Indexing Service, software that extracts content and property values from a document to index them.

For Internet Protocol security (IPSec), a specification of Internet Protocol (IP) traffic that provides the ability to trigger security negotiations for a communication based on the source, destination, and type of IP traffic.

For Internet Information Services (IIS), a feature of Internet Server Application Programming Interface (ISAPI) that allows preprocessing of requests and postprocessing of responses, permitting site-specific handling of Hypertext Transfer Protocol (HTTP) requests and responses.

In IP and Internetwork Packet Exchange (IPX) packet filtering, a definition in a series of definitions that indicates to the router the type of traffic allowed or disallowed on each interface.

See also: Internet Server Application Programming Interface (ISAPI)

flexible single-master operations (FSMO)

See definition for: operations master

flow

A stream of data sent or received by a host. Also known as network traffic.

forest

One or more Active Directory domains that share the same class and attribute definitions (schema), site and replication information (configuration), and forest-wide search capabilities (global catalog). Domains in the same forest are linked with two-way, transitive trust relationships.

See also: Active Directory; domain; global catalog; schema; two-way trust

frame

In synchronous communication, a package of information transmitted as a single unit from one device to another.

See also: capture

FSMO

See definition for: operations master

FTP

See definition for: File Transfer Protocol (FTP)

G

gateway

A dedicated device (or a set of services running on a dedicated computer) that routes network traffic and enables communication between different networking protocols. A gateway is a multiprotocol Internet Protocol (IP) router that translates between different transport protocols or data formats.

global catalog

A directory database that applications and clients can query to locate any object in a forest. The global catalog is hosted on one or more domain controllers in the forest. It contains a partial replica of every domain directory partition in the forest. These partial replicas include replicas of every object in the forest, as follows: the attributes most frequently used in search operations and the attributes required to locate a full replica of the object.

In Microsoft Provisioning System, the Exchange server maintains a list of global catalogs, and it maintains a load balance across global catalogs.

See also: Active Directory; domain controller; forest; replication

globally unique identifier (GUID)

A 16-byte value generated from the unique identifier on a device, the current date and time, and a sequence number. A GUID is used to identify a particular device or component.

GPO

See definition for: Group Policy object (GPO)

graphical user interface (GUI)

A display format, like that of Windows, that represents a program's functions with graphic images such as buttons and icons. GUIs enable a user to perform operations and make choices by pointing and clicking with a mouse.

Group Policy

The infrastructure within Active Directory directory service that enables directory-based change and configuration management of user and computer settings, including security and user data. You use Group Policy to define configurations for groups of users and computers. With Group Policy, you can specify policy settings for registry-based policies, security, software installation, scripts, folder redirection, remote installation services, and Internet Explorer maintenance. The Group Policy settings that you create are contained in a Group Policy object (GPO). By associating a GPO with selected Active Directory system containers—sites, domains, and organizational units—you can apply the GPO's policy settings to the users and computers in those Active Directory containers. To create an individual GPO, use the Group Policy Object Editor. To manage Group Policy objects across an enterprise, you can use the Group Policy Management console.

See also: Active Directory; Group Policy object (GPO)

Group Policy object (GPO)

A collection of Group Policy settings. GPOs are essentially the documents created by the Group Policy Object Editor. GPOs are stored at the domain level, and they affect users and computers that are contained in sites, domains, and organizational units. In addition, each computer has exactly one group of policy settings stored locally, called the local Group Policy object.

See also: Group Policy

GUID

See definition for: globally unique identifier (GUID)

H

handle

In the user interface, an interface added to an object that facilitates moving, sizing, reshaping, or other functions pertaining to an object. In programming, a pointer to a pointer, that is, a token that lets a program access an identified resource.

hardware abstraction layer (HAL)

A thin layer of software provided by the hardware manufacturer that hides, or abstracts, hardware differences from higher layers of the operating system. By means of the filter provided by the HAL, different types of hardware look alike to the rest of the operating system. This enables the operating system to be portable from one hardware platform to another. The HAL also provides routines that enable a single device driver to support the same device on all platforms.

hardware ID

A vendor-defined string used by the Plug and Play Manager to find the correct .inf file to install a particular device.

See also: Plug and Play

heaps

A portion of memory reserved for a program to use for the temporary storage of data structures whose existence or size cannot be determined until the program is running.

high performance file system (HPFS)

The file system designed for the OS/2 version 1.2 operating system.

hive

A file in which the system stores a portion of the registry (named for their resemblance to the cellular structure of a beehive). A hive is backed by a single file and a .log file, which are in either the systemroot\System32\Config folder or the systemroot\Profiles\username folder.

By default, most hive files (Default, SAM, Security, and System) are stored in the systemroot\System32\Config folder. The systemroot\Profiles folder contains the user profile for each user of the computer. Because a hive is a file, it can be moved from one system to another. However, you must use the Registry Editor, Regedit.exe, to edit the file.

See also: key; registry

Hosts file

A local text file in the same format as the 4.3 Berkeley Software Distribution (BSD) UNIX /etc/hosts file. This file maps host names to IP addresses, and it is stored in the \%Systemroot%\System32\Drivers\Etc folder.

HTML

See definition for: Hypertext Markup Language (HTML)

HTTP

See definition for: Hypertext Transfer Protocol (HTTP)

Hypertext Markup Language (HTML)

A simple markup language used to create hypertext documents that are portable from one platform to another. HTML files are simple ASCII text files with codes embedded (indicated by markup tags) to denote formatting and hypertext links.

See also: American Standard Code for Information Interchange (ASCII)

Hypertext Transfer Protocol (HTTP)

The protocol used to transfer information on the World Wide Web. An HTTP address (one kind of Uniform Resource Locator (URL)) takes the following form: http://www.microsoft.com.

See also: protocol; Uniform Resource Locator (URL)

I

incorrect delegation

A condition in which the resource records establishing a Domain Name System (DNS) zone delegation contain incorrect data or indicate a DNS server that does not have authority for the delegated zone. An improper delegation causes a DNS resolver to direct queries to an incorrect server and the query fails.

See also: Domain Name System (DNS)

infrastructure master

A domain controller that holds the infrastructure operations master role in Active Directory. The infrastructure master updates the group-to-user reference whenever group memberships change and replicates these changes across the domain. At any time, the infrastructure master role can be assigned to only one domain controller in each domain.

See also: Active Directory; domain controller; operations master

IntelliMirror

A set of change and configuration management features based on Active Directory that enables management of user and computer data and settings, including security data. IntelliMirror also provides limited ability to deploy software to Windows 2000 and later workstations or servers.

See also: Active Directory

Internet Server Application Programming Interface (ISAPI)

An application programming interface (API) that resides on a server computer for initiating software services tuned for Windows operating systems.

In Microsoft Provisioning System, ISAPI resides on the Web server.

See also: application programming interface (API)

Internetwork Packet Exchange/Sequenced Packet Exchange (IPX/SPX)

Transport protocols used in Novell NetWare networks, which together correspond to the combination of TCP and IP in the TCP/IP protocol suite. Windows implements IPX through NWLink.

See also: NWLink IPX/SPX/NetBIOS Compatible Transport Protocol (NWLink); Transmission Control Protocol/Internet Protocol (TCP/IP)

IP address

For Internet Protocol version 4 (IPv4), a 32-bit address used to identify an interface on a node on an IPv4 internetwork. Each interface on the IP internetwork must be assigned a unique IPv4 address, which is made up of the network ID, plus a unique host ID. This address is typically represented with the decimal value of each octet separated by a period (for example, 192.168.7.27). You can configure the IP address statically or dynamically by using Dynamic Host Configuration Protocol (DHCP).

For Internet Protocol version 6 (IPv6), an identifier that is assigned at the IPv6 layer to an interface or set of interfaces and that can be used as the source or destination of IPv6 packets.

See also: Dynamic Host Configuration Protocol (DHCP)

IPX/SPX

See definition for: Internetwork Packet Exchange/Sequenced Packet Exchange (IPX/SPX)

ISAPI

See definition for: Internet Server Application Programming Interface (ISAPI)

J

junction point

A physical location on a hard disk that points to data located at another location on your hard disk or another storage device. Junction points are created when you create a mounted drive. You can also create a junction point using the linkd command.

K

KDC

See definition for: Key Distribution Center (KDC)

Kerberos V5 authentication protocol

An authentication mechanism used to verify user or host identity. The Kerberos V5 authentication protocol is the default authentication service. Internet Protocol security (IPSec) can use the Kerberos protocol for authentication.

See also: Key Distribution Center (KDC); ticket-granting service (TGS); ticket-granting ticket (TGT)

kernel

The core of layered architecture that manages the most basic operations of the operating system and the computer's processor. The kernel schedules different blocks of executing code, called threads, for the processor to keep it as busy as possible and coordinates multiple processors to optimize performance. The kernel also synchronizes activities among Executive-level subcomponents, such as I/O Manager and Process Manager, and handles hardware exceptions and other hardware-dependent functions. The kernel works closely with the hardware abstraction layer.

kernel mode

A highly privileged mode of operation where program code has direct access to all memory, including the address spaces of all user-mode processes and applications, and to hardware. Also known as supervisor mode, protected mode, or Ring 0.

key

In Registry Editor, a folder that appears in the left pane of the Registry Editor window. A key can contain subkeys and entries. For example, Environment is a key of HKEY_CURRENT_USER.

In IP security (IPSec), a value used in combination with an algorithm to encrypt or decrypt data. Key settings for IPSec are configurable to provide greater security.

See also: registry

Key Distribution Center (KDC)

A network service that supplies session tickets and temporary session keys used in the Kerberos V5 authentication protocol.

See also: Kerberos V5 authentication protocol; ticket-granting service (TGS); ticket-granting ticket (TGT)

Knowledge Consistency Checker (KCC)

A built-in process that runs on all domain controllers and generates the replication topology for the Active Directory forest. At specified intervals, the KCC reviews and makes modifications to the replication topology to ensure propagation of data either directly or transitively.

See also: Active Directory; domain controller; forest; replication topology

Korn shell (ksh)

A command shell that provides the following functionality: file input and output redirection; command-line editing by using vi; command history; integer arithmetic; pattern matching and variable substitution; command name abbreviation (aliasing); and built-in commands for writing shell programs.

ksh

See definition for: Korn shell (ksh)

L

lame delegation

See definition for: incorrect delegation

LAN

See definition for: local area network (LAN)

Layer Two Tunneling Protocol (L2TP)

An industry-standard Internet tunneling protocol that provides encapsulation for sending Point-to-Point Protocol (PPP) frames across packet-oriented media. For IP networks, L2TP traffic is sent as User Datagram Protocol (UDP) messages. In Microsoft operating systems, L2TP is used in conjunction with Internet Protocol security (IPSec) as a virtual private network (VPN) technology to provide remote access or router-to-router VPN connections. L2TP is described in RFC 2661.

See also: frame

LDAP

See definition for: Lightweight Directory Access Protocol (LDAP)

Lightweight Directory Access Protocol (LDAP)

The primary access protocol for Active Directory. LDAP is an industry-standard protocol, established by the Internet Engineering Task Force (IETF), that allows users to query and update information in a directory service. Active Directory supports both LDAP version 2 and LDAP version 3.

See also: Active Directory; directory service; protocol

local area network (LAN)

A communications network connecting a group of computers, printers, and other devices located within a relatively limited area (for example, a building). A LAN enables any connected device to interact with any other on the network.

See also: NetBIOS Extended User Interface (NetBEUI); network basic input/output system (NetBIOS); virtual local area network (VLAN)

Local Security Authority (LSA)

A protected subsystem that authenticates and logs users on to the local computer. In addition, the LSA maintains information about all aspects of local security on a computer (collectively known as the local security policy), and it provides various services for translation between names and identifiers.

loopback address

The address of the local computer used for routing outgoing packets back to the source computer. This address is used primarily for testing.

M

MAC

See definition for: media access control (MAC)

majority node set server cluster

A cluster configuration that has two or more nodes and that is configured so that the nodes may or may not be attached to one or more cluster storage devices. The cluster configuration data is stored on multiple disks across the cluster, and the Cluster service makes sure that this data is kept consistent across the different disks. There are advantages and limitations for each cluster configuration (single node server cluster, single quorum device server cluster, and majority node set server cluster).

See also: cluster; cluster storage; single quorum device server cluster

management information base (MIB)

A set of objects that represent various types of information about a device, used by Simple Network Management Protocol (SNMP) to manage the device. Because different network management services are used for different types of devices and protocols, each service has its own set of objects.

See also: service; Simple Network Management Protocol (SNMP)

master boot record (MBR)

The first sector on a hard disk, which begins the process of starting the computer. The MBR contains the partition table for the disk and a small amount of executable code called the master boot code.

MBR

See definition for: master boot record (MBR)

media access control (MAC)

A sublayer of the IEEE 802 specifications that defines network access methods and framing.

Message Authentication Code (MAC)

An algorithm that ensures the quality of a block of data.

MIB

See definition for: management information base (MIB)

Microsoft Management Console (MMC)

A framework for hosting administrative tools called snap-ins. A console might contain tools, folders or other containers, World Wide Web pages, and other administrative items. These items are displayed in the left pane of the console, called a console tree. A console has one or more windows that can provide views of the console tree. The main MMC window provides commands and tools for authoring consoles. The authoring features of MMC and the console tree itself might be hidden when a console is in User Mode.

See also: console tree; snap-in

mirror

One of the two volumes that make up a mirrored volume. Each mirror of a mirrored volume resides on a different disk. If one mirror becomes unavailable (due to a disk failure, for example), Windows can use the remaining mirror to gain access to the volume's data.

See also: fault tolerance; volume

MMC

See definition for: Microsoft Management Console (MMC)

multicasting

The process of sending a message simultaneously to more than one destination on a network.

N

native mode

In Windows 2000 domains, the domain mode in which all domain controllers in a domain are running Windows 2000 and a domain administrator has switched the domain operation mode from mixed mode to native mode. Native mode supports universal groups and nesting of groups. In native mode, domain controllers running Windows NT 4.0 or earlier are not supported.

In Windows Server 2003 domains, native mode is referred to as Windows 2000 native, and it is one of three domain functional levels available.

See also: Active Directory

Net Logon service

A user-mode service that runs in the Windows security subsystem. The Net Logon service passes the user's credentials through a secure channel to the domain database and returns the domain security identifiers and user rights for the user. In addition, the Net Logon service performs a variety of other functions related to the user logon process, such as periodic password updates for computer accounts and domain controller discovery.

NetBEUI

See definition for: NetBIOS Extended User Interface (NetBEUI)

NetBIOS

See definition for: network basic input/output system (NetBIOS)

NetBIOS Extended User Interface (NetBEUI)

A network protocol native to Microsoft Networking. It is usually used in small, department-size local area networks (LANs) of 1 to 200 clients. NetBEUI can use Token Ring source routing as its only method of routing. NetBEUI is the Microsoft implementation of the NetBIOS standard.

See also: Compression Control Protocol (CCP); local area network (LAN); network basic input/output system (NetBIOS); protocol

Netsh

A command-line and scripting tool for networking components for local or remote computers running Windows 2000, Windows XP Professional, or Windows Server 2003.

network basic input/output system (NetBIOS)

An application programming interface (API) that can be used by programs on a local area network (LAN). NetBIOS provides programs with a uniform set of commands for requesting the lower-level services required to manage names, conduct sessions, and send datagrams between nodes on a network.

See also: application programming interface (API); basic input/output system (BIOS); local area network (LAN); service

nonpaged pool

Operating system memory that is never paged to disk. Paging is the moving of infrequently used parts of a program's working memory from RAM to another storage medium, usually the hard disk. In Task Manager, the amount of memory used by a process, in kilobytes.

notification area

The area on the taskbar to the right of the taskbar buttons. The notification area displays the time and can also contain shortcuts that provide quick access to programs, such as Volume Control and Power Options. Other shortcuts can appear temporarily, providing information about the status of activities. For example, the printer shortcut icon appears after a document has been sent to the printer and disappears when printing is complete.

NTFS file system

An advanced file system that provides performance, security, reliability, and advanced features that are not found in any version of file allocation table (FAT). For example, NTFS guarantees volume consistency by using standard transaction logging and recovery techniques. If a system fails, NTFS uses its log file and checkpoint information to restore the consistency of the file system. NTFS also provides advanced features, such as file and folder permissions, encryption, disk quotas, and compression.

See also: FAT32; file allocation table (FAT)

NTLM authentication protocol

A challenge/response authentication protocol. The NTLM authentication protocol is supported in Windows 2000, Windows XP, and the Windows Server 2003 family, but it is not the default. It was the default authentication protocol for earlier versions of Windows.

See also: protocol

NWLink

See definition for: NWLink IPX/SPX/NetBIOS Compatible Transport Protocol (NWLink)

NWLink IPX/SPX/NetBIOS Compatible Transport Protocol (NWLink)

The Microsoft implementation of the Internetwork Packet Exchange/Sequenced Packet Exchange (IPX/SPX) protocol used on NetWare networks. NWLink allows connectivity between Windows-based computers and NetWare networks running IPX/SPX. NWLink also provides network basic input/output system (NetBIOS) functionality and the Routing Information Protocol (RIP).

See also: Internetwork Packet Exchange/Sequenced Packet Exchange (IPX/SPX); network basic input/output system (NetBIOS); Routing Information Protocol over IPX (RIPX)

O

object linking and embedding (OLE)

A method for sharing information among applications. Linking an object, such as a graphic, from one document to another inserts a reference to the object into the second document. Any changes you make in the object in the first document will also be made in the second document. Embedding an object inserts a copy of an object from one document into another document. Changes you make in the object in the first document will not be updated in the second unless the embedded object is explicitly updated.

ODBC

See definition for: Open Database Connectivity (ODBC)

one-way trust

A trust relationship between two domains in which only one of the two domains trusts the other domain. For example, domain A trusts domain B, and domain B does not trust domain A. One-way trusts are often used to enable authenticated access to resource domains.

See also: domain; trust relationship; two-way trust

Open Database Connectivity (ODBC)

An application programming interface (API) that enables database applications to access data from a variety of existing data sources.

See also: application programming interface (API)

operations master

A domain controller that has been assigned one or more special roles in an Active Directory domain. The domain controllers assigned these roles perform operations that are single-master (not permitted to occur at different places on the network at the same time). Examples of these operations include resource identifier allocation, schema modification, PDC emulation, adding and removing domains to and from the forest, and tracking changes to security principals across all domains in a forest.

See also: Active Directory; domain controller; infrastructure master

organizational unit

An Active Directory container object used within domains. An organizational unit is a logical container into which users, groups, computers, and other organizational units are placed. It can contain objects only from its parent domain. An organizational unit is the smallest scope to which a Group Policy object (GPO) can be linked, or over which administrative authority can be delegated.

See also: Active Directory; Group Policy object (GPO)

orphan

A member of a mirrored volume or a RAID-5 volume that has failed due to a severe cause, such as a loss of power or a complete hard-disk head failure. When this happens, the fault-tolerant driver determines that it can no longer use the orphaned member and directs all new reads and writes to the remaining members of the fault-tolerant volume.

See also: fault tolerance; RAID-5 volume

P

packet

An Open Systems Interconnection (OSI) network layer transmission unit that consists of binary information representing both data and a header containing an identification number, source and destination addresses, and error-control data.

packet header

In network protocol communications, a specially reserved field of a defined bit length that is attached to the front of a packet for carry and transfer of control information. When the packet arrives at its destination, the field is then detached and discarded as the packet is processed and disassembled in a corresponding reverse order for each protocol layer.

See also: packet

page fault

The interrupt that occurs when software attempts to read from or write to a virtual memory location that is marked not present.

In Task Manager, page fault is the number of times data has to be retrieved from disk for a process because it was not found in memory. The page fault value accumulates from the time the process started.

paged pool

The system-allocated virtual memory that has been charged to a process and that can be paged. Paging is the moving of infrequently used parts of a program's working memory from random access memory (RAM) to another storage medium, usually the hard disk.

In Task Manager, the amount of system-allocated virtual memory, in kilobytes, used by a process.

parity

A calculated value that is used to reconstruct data after a failure. RAID-5 volumes stripe data and parity intermittently across a set of disks. When a disk fails, some server operating systems use the parity information together with the data on good disks to recreate the data on the failed disk.

See also: fault tolerance; RAID-5 volume; striped volume

parity bit

In asynchronous communications, an extra bit used in checking for errors in groups of data bits transferred within or between computer systems. In modem-to-modem communications, a parity bit is often used to check the accuracy with which each character is transmitted.

See also: parity

partition

A portion of a physical disk that functions as though it were a physically separate disk. After you create a partition, you must format it and assign it a drive letter before you can store data on it.

On basic disks, partitions are known as basic volumes, which include primary partitions and logical drives. On dynamic disks, partitions are known as dynamic volumes, which include simple, striped, spanned, mirrored, and RAID-5 volumes.

See also: basic disk

partition table

On a hard disk, the data structure that stores the offset (location) and size of each primary partition on the disk. On MBR disks, the partition table is located in the master boot record. On GPT disks, the partition table is located in the GUID partition entry array.

See also: globally unique identifier (GUID); master boot record (MBR); partition

path

A sequence of directory (or folder) names that specifies the location of a directory, file, or folder within the Windows directory tree. Each directory name and file name within the path must be preceded by a backslash (\). For example, to specify the path of a file named Readme.doc located in the Windows directory on drive C, type C:\Windows\Readme.doc.

PCMCIA device

A removable device, approximately the size of a credit card, that can be plugged into a PCMCIA slot in a portable computer. PCMCIA devices can include modems, network adapters, and hard disk drives.

Some PCMCIA cards can be connected to and disconnected from your computer without restarting it. Before you remove the PCMCIA card, however, you should use the Add Hardware Wizard to notify Windows that you are doing so. Windows will then notify you when you can remove the device.

PDC

See definition for: primary domain controller (PDC)

Performance Monitor

A Windows NT administrative tool that monitors performance on local or remote computers. Performance Monitor was replaced by the Performance console in Windows 2000.

permission

A rule associated with an object to regulate which users can gain access to the object and in what manner. Permissions are assigned or denied by the object's owner.

Plug and Play

A set of specifications developed by Intel Corporation that enables a computer to detect and configure a device automatically and install the appropriate device drivers.

See also: universal serial bus (USB)

POP

See definition for: Post Office Protocol

Portable Operating System Interface for UNIX (POSIX)

An Institute of Electrical and Electronics Engineers (IEEE) standard that defines a set of operating-system services. Programs that adhere to the POSIX standard can be easily ported from one system to another. POSIX was based on UNIX system services, but it was created in a way that allows it to be implemented by other operating systems.

See also: service

POSIX

See definition for: Portable Operating System Interface for UNIX (POSIX)

Post Office Protocol

A maildrop service that allows a client to retrieve mail that the server is holding for it. The most recent implementation is Version 3, or POP3.

primary domain controller (PDC)

In a Windows NT domain, a domain controller running Windows NT Server 4.0 or earlier that authenticates domain logon attempts and updates user, computer, and group accounts in a domain. The PDC contains the master read-write copy of the directory database for the domain. A domain has only one PDC.

In a Windows 2000 or Windows Server 2003 domain, the PDC emulator master supports compatibility with client computers that are not running Windows 2000 or Windows XP Professional.

See also: Active Directory

printer

A device that puts text or images on paper or other print media. Examples are laser printers or dot-matrix printers.

process

An operating system object that consists of an executable program, a set of virtual memory addresses, and one or more threads. When a program runs, a process is created.

Product Key

A 25-character, alpha-numeric string. Customers must enter this string to activate their installation of Windows. The product key is located on the certificate of authenticity, which is attached to the computer chassis.

promiscuous mode

A mode in which a network device listens to all traffic present on the local network segment. A device operating in promiscuous mode reads every frame it receives, whether the frames are broadcast, multicast, or unicast. Certain devices typically operate in promiscuous mode, such as bridges, which must listen to all traffic in order to build their media access control (MAC) address tables, and network troubleshooting devices, which capture and analyze all traffic on a particular local area network (LAN) segment.

See also: broadcast; local area network (LAN)

protocol

A set of rules and conventions for sending information over a network. These rules govern the content, format, timing, sequencing, and error control of messages exchanged among network devices.

See also: Transmission Control Protocol/Internet Protocol (TCP/IP)

Q

QoS

See definition for: Quality of Service (QoS)

Quality of Service (QoS)

A set of quality assurance standards and mechanisms for data transmission, implemented in this version of Windows.

R

RAID

See definition for: Redundant Array of Independent Disks (RAID)

RAID-5 volume

A fault-tolerant volume with data and parity striped intermittently across three or more physical disks. Parity is a calculated value that is used to reconstruct data after a failure. If a portion of a physical disk fails, Windows recreates the data that was on the failed portion from the remaining data and parity. You can create RAID-5 volumes only on dynamic disks on computers running the Windows 2000 Server or Windows Server 2003 families of operating systems. You cannot mirror or extend RAID-5 volumes. In Windows NT 4.0, a RAID-5 volume was known as a striped set with parity.

See also: dynamic disk; fault tolerance; parity; volume

RAM

See definition for: random access memory (RAM)

random access memory (RAM)

Memory that can be read from or written to by a computer or other devices. Information stored in RAM is lost when the computer is turned off.

RAS

See definition for: Remote Access Service (RAS)

reduced instruction set computing

A type of microprocessor design that focuses on rapid and efficient processing of a relatively small set of instructions. RISC architecture limits the number of instructions that are built into the microprocessor, but optimizes each so it can be carried out very rapidly{bmct emdash.bmp}usually within a single clock cycle.

Redundant Array of Independent Disks (RAID)

A method used to standardize and categorize fault-tolerant disk systems. RAID levels provide various mixes of performance, reliability, and cost. Some servers provide three of the RAID levels: Level 0 (striping), Level 1 (mirroring), and Level 5 (RAID-5).

See also: fault tolerance; RAID-5 volume

registry

A database repository for information about a computer's configuration. The registry contains information that Windows continually references during operation, such as:

  • Profiles for each user
  • The programs installed on the computer and the types of documents that each can create
  • Property settings for folders and program icons
  • What hardware exists on the system
  • Which ports are being used

The registry is organized hierarchically as a tree, and it is made up of keys and their subkeys, hives, and entries.

See also: hive; key

registry key

An identifier for a record or group of records in the registry.

See also: registry

relative ID (RID)

The part of a security ID (SID) that uniquely identifies an account or group within a domain.

See also: domain; forest; security ID (SID)

remote access

Part of the integrated Routing and Remote Access service that provides remote networking for telecommuters, mobile workers, and system administrators who monitor and manage servers at multiple branch offices. Users can use Network Connections to dial in to remotely access their networks for services such as file and printer sharing, electronic mail, scheduling, and SQL database access.

See also: remote access server; service

remote access server

A Windows-based computer running the Routing and Remote Access service and configured to provide remote access.

See also: remote access

Remote Access Service (RAS)

A Windows NT 4.0 service that provides remote networking for telecommuters, mobile workers, and system administrators who monitor and manage servers at multiple offices.

remote procedure call (RPC)

A message-passing facility that allows a distributed application to call services that are available on various computers on a network. Used during remote administration of computers.

See also: service

reparse points

NTFS file system objects that have a definable attribute containing user-controlled data and that are used to extend functionality in the input/output (I/O) subsystem.

See also: NTFS file system

replica set

One or more shared folders that participates in replication.

See also: replication

replication

The process of copying updated data from a data store or file system on a source computer to a matching data store or file system on one or more destination computers to synchronize the data.

In Active Directory, replication synchronizes schema, configuration, application, and domain directory partitions between domain controllers.

In Distributed File System (DFS), replication synchronizes files and folders between DFS roots and root targets.

See also: Active Directory; Distributed File System (DFS); topology

replication topology

In Active Directory replication, the set of physical connections that domain controllers use to replicate directory updates among domain controllers within sites and between sites.

In the File Replication service (FRS), the interconnections between replica set members. These interconnections determine the path that data takes as it replicates to all replica set members.

See also: Active Directory; Distributed File System (DFS); domain controller; replica set; replication

Request for Comments (RFC)

An official document of the Internet Engineering Task Force (IETF) that specifies the details for protocols included in the TCP/IP family.

See also: protocol; Transmission Control Protocol/Internet Protocol (TCP/IP)

resource

Generally, any part of a computer system or network, such as a disk drive, printer, or memory, that can be allotted to a running program or a process.

For Device Manager, any of four system components that control how the devices on a computer work. These four system resources are interrupt request (IRQ) lines, direct memory access (DMA) channels, input/output (I/O) ports, and memory addresses.

For server clusters, a physical or logical entity that is capable of being managed by a cluster, brought online and taken offline, and moved between nodes. A resource can be owned only by a single node at any point in time.

Resource DLL

A dynamic-link library (DLL) containing an implementation of the Resource application programming interface (API) for a specific type of resource. The Resource DLL is loaded into the address space of its Resource Monitor.

See also: application programming interface (API); dynamic-link library (DLL)

RID

See definition for: relative ID (RID)

ring transition

A ring transition or kernel-mode transition occurs when user-mode processes use application program interfaces (APIs) to switch their threads from user mode to kernel mode.

RIPX

See definition for: Routing Information Protocol over IPX (RIPX)

RISC

See definition for: reduced instruction set computing

router

A device or computer that forwards packets between interfaces based on a network layer destination address. For example, an Internet Protocol (IP) router forwards IP packets based on the destination IP address in the IP header. Routers typically use a routing table, which contains a series of entries for destinations and the corresponding next-hop address and interface to use to forward a packet to its eventual destination.

See also: local area network (LAN); packet header; Routing Information Protocol over IPX (RIPX); static routes; wide area network (WAN)

Routing Information Protocol over IPX (RIPX)

A protocol used by routers to exchange information between routers on an Internetwork Packet Exchange (IPX) network and by hosts to determine the best router to use when forwarding IPX traffic to a remote IPX network.

See also: NWLink IPX/SPX/NetBIOS Compatible Transport Protocol (NWLink); protocol; router

RPC

See definition for: remote procedure call (RPC)

S

SAM

See definition for: Security Accounts Manager (SAM)

schema

The set of definitions for the universe of objects that can be stored in a directory. For each object class, the schema defines which attributes an instance of the class must have, which additional attributes it can have, and which other object classes can be its parent object class.

script

A type of program consisting of a set of instructions to an application or tool program. A script usually expresses instructions by using the application's or tool's rules and syntax, combined with simple control structures such as loops and if/then expressions. "Batch program" is often used interchangeably with "script" in the Windows environment.

SCSI

See definition for: small computer system interface (SCSI)

Security Accounts Manager (SAM)

A Windows service used during the logon process. SAM maintains user account information, including groups to which a user belongs.

See also: service

security descriptor

A data structure that contains security information associated with a protected object. Security descriptors include information about who owns the object, who can access it and in what way, and what types of access are audited.

See also: permission

security ID (SID)

A data structure of variable length that identifies user, group, and computer accounts. Every account on a network is issued a unique SID when the account is first created. Internal processes in Windows refer to an account's SID rather than the account's user or group name.

Server Message Block (SMB)

A file-sharing protocol designed to allow networked computers to transparently access files that reside on remote systems over a variety of networks. The SMB protocol defines a series of commands that pass information between computers. SMB uses four message types: session control, file, printer, and message.

See also: protocol

service

A program, routine, or process that performs a specific system function to support other programs, particularly at a low (close to the hardware) level. When services are provided over a network, they can be published in Active Directory, facilitating service-centric administration and usage. Some examples of services are the Security Accounts Manager service, File Replication service, and Routing and Remote Access service.

See also: Security Accounts Manager (SAM)

sh

See definition for: shell (sh)

share

To make resources, such as folders and printers, available to others.

See also: resource

shared resource

Any device, data, or program that is used by more than one program or one other device. For Windows, shared resource refers to any resource that is made available to network users, such as folders, files, printers, and named pipes. Shared resource can also refer to a resource on a server that is available to network users.

See also: resource; share

shell (sh)

A command-line POSIX tool that contains a large subset of Korn shell functionality (though no variable arrays).

SID

See definition for: security ID (SID)

Simple Mail Transfer Protocol (SMTP)

A member of the TCP/IP suite of protocols that governs the exchange of electronic mail between message transfer agents.

See also: protocol; Transmission Control Protocol/Internet Protocol (TCP/IP)

Simple Network Management Protocol (SNMP)

A network protocol used to manage TCP/IP networks. In Windows, the SNMP service is used to provide status information about a host on a TCP/IP network.

See also: protocol; service; Transmission Control Protocol/Internet Protocol (TCP/IP)

simple volume

A dynamic volume made up of disk space from a single dynamic disk. A simple volume can consist of a single region on a disk or multiple regions of the same disk that are linked together. If the simple volume is not a system volume or boot volume, you can extend it within the same disk or onto additional disks. If you extend a simple volume across multiple disks, it becomes a spanned volume. You can create simple volumes only on dynamic disks. Simple volumes are not fault tolerant, but you can mirror them to create mirrored volumes on computers running the Windows 2000 Server or Windows Server 2003 families of operating systems.

See also: dynamic disk; fault tolerance; spanned volume; volume

single quorum device server cluster

A cluster configuration that has two or more nodes and that is configured so that every node is attached to one or more cluster storage device. The cluster configuration data is stored on a single cluster storage device. There are advantages and limitations for each cluster configuration (single node server cluster, single quorum device server cluster, and majority node set server cluster).

See also: cluster; cluster storage; majority node set server cluster

small computer system interface (SCSI)

A standard high-speed parallel interface defined by the American National Standards Institute (ANSI). A SCSI interface is used for connecting microcomputers to peripheral devices, such as hard disks and printers, and to other computers and local area networks (LANs).

See also: local area network (LAN)

SMB

See definition for: Server Message Block (SMB)

SMTP

See definition for: Simple Mail Transfer Protocol (SMTP)

snap-in

A type of tool that you can add to a console supported by Microsoft Management Console (MMC). A stand-alone snap-in can be added by itself; an extension snap-in can be added only to extend the function of another snap-in.

See also: Microsoft Management Console (MMC)

spanned volume

A dynamic volume consisting of disk space on more than one physical disk. You can increase the size of a spanned volume by extending it onto additional dynamic disks. You can create spanned volumes only on dynamic disks. Spanned volumes are not fault tolerant and cannot be mirrored.

See also: dynamic disk; fault tolerance; simple volume; volume

SQL

See definition for: structured query language (SQL)

standard error (STDERR)

In UNIX, the defined receiver of error messages about a process. By default, the standard error goes to the terminal.

standard input (STDIN)

In UNIX, the defined source of input for a process. By default, standard input comes from the terminal.

standard output (STDOUT)

In UNIX, the defined receiver for output from a process. By default, the standard output goes to the terminal.

static routes

Routes in a routing table that are permanent until changed by a network administrator or by an automatically scheduled auto-static update.

See also: router

striped volume

A dynamic volume that stores data in stripes on two or more physical disks. Data in a striped volume is allocated alternately and evenly (in stripes) across the disks. Striped volumes offer the best performance of all the volumes that are available in Windows, but they do not provide fault tolerance. If a disk in a striped volume fails, the data in the entire volume is lost. You can create striped volumes only on dynamic disks. Striped volumes cannot be mirrored or extended.

See also: dynamic disk; fault tolerance; volume

structured query language (SQL)

A widely accepted standard database sublanguage used in querying, updating, and managing relational databases.

subnet mask

A 32-bit value that enables the recipient of Internet Protocol version 4 (IPv4) packets to distinguish the network ID and host ID portions of the IPv4 address. Typically, subnet masks use the format 255.x.x.x. IPv6 uses network prefix notations rather than subnet masks.

See also: IP address

system tray

See definition for: notification area

SYSVOL

A shared directory that stores the server copy of the domain's public files, which are replicated among all domain controllers in the domain.

See also: domain; domain controller

T

TAPI

See definition for: Telephony API (TAPI)

TCP

See definition for: Transmission Control Protocol/Internet Protocol (TCP/IP)

TCP/IP

See definition for: Transmission Control Protocol/Internet Protocol (TCP/IP)

TDI

See definition for: Transport Driver Interface (TDI)

Telephony API (TAPI)

An application programming interface (API) used by communications programs to work with telephony and network services. Communications programs like HyperTerminal and Phone Dialer use TAPI to dial, answer, and route telephone calls on conventional telephony devices, including PBXs, modems, and fax machines. TAPI 3.0 also provides Internet Protocol (IP) telephony support, which Phone Dialer and other programs use to transmit, route, and control real-time audio and video signals over IP-based networks such as the Internet.

See also: application programming interface (API); service

Telnet

A protocol that enables an Internet user to log on to and enter commands on a remote computer linked to the Internet, as if the user were using a text-based terminal directly attached to that computer. Telnet is part of the TCP/IP suite of protocols. The term telnet also refers to the software (client or server component) that implements this protocol.

See also: protocol; Transmission Control Protocol/Internet Protocol (TCP/IP)

Terminal Services

The underlying technology that enables Remote Desktop, Remote Assistance, and Terminal Server.

TGS

See definition for: ticket-granting service (TGS)

TGT

See definition for: ticket-granting ticket (TGT)

thread

A type of object within a process that runs program instructions. Using multiple threads allows concurrent operations within a process and enables one process to run different parts of its program on different processors simultaneously. A thread has its own set of registers, its own kernel stack, a thread environment block, and a user stack in the address space of its process.

See also: kernel

ticket

A set of identification data for a security principal, issued by a domain controller for purposes of user authentication. Two forms of tickets in Windows are ticket-granting tickets (TGTs) and service tickets.

See also: domain controller; ticket-granting ticket (TGT)

ticket-granting service (TGS)

A Kerberos V5 service provided by the Kerberos V5 Key Distribution Center (KDC) service that issues service tickets that allow users to authenticate to services in a domain.

See also: Kerberos V5 authentication protocol; Key Distribution Center (KDC); ticket-granting ticket (TGT)

ticket-granting ticket (TGT)

A credential issued to a user by the Kerberos Key Distribution Center (KDC) when the user logs on. The user must present the TGT to the KDC when requesting session tickets for services. Because a TGT is normally valid for the life of the user's logon session, it is sometimes called a user ticket.

See also: Kerberos V5 authentication protocol; Key Distribution Center (KDC); ticket-granting service (TGS)

token

Any nonreducible textual element in data that is being parsed. For example, the use in a program of a variable name, a reserved word, or an operator. Storing tokens as short codes shortens program files and speeds execution.

For networking, a unique structured data object or message that circulates continuously among the nodes of a token ring and describes the current state of the network. Before any node can send a message on the network, it must first wait to control the token.

topology

The physical layout of computers, cables, switches, routers, and other components of a network. Topology also refers to the underlying network architecture, such as Ethernet or Token Ring.

In Active Directory replication, the set of connections that domain controllers use to replicate information among themselves.

See also: domain controller

touch

Command-line POSIX tool which changes the modification date of files.

Transmission Control Protocol/Internet Protocol (TCP/IP)

A set of networking protocols widely used on the Internet that provides communications across interconnected networks of computers with diverse hardware architectures and various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and routing traffic.

See also: protocol

Transport Driver Interface (TDI)

A common set of routines for network layer components that communicate with the session layer of the Open Systems Interconnection (OSI) model. These routines allow software components above and below the transport layer to be mixed and matched without reprogramming.

transport protocol

A protocol that defines how data should be presented to the next receiving layer in the Windows NT and Windows 2000 networking model and packages the data accordingly. The transport protocol passes data to the network adapter driver through the Network Driver Interface Specification (NDIS) interface and to the redirector through the Transport Driver Interface (TDI).

trust relationship

A logical relationship established between domains to allow pass-through authentication, in which a trusting domain honors the logon authentications of a trusted domain. User accounts and global groups defined in a trusted domain can be given rights and permissions in a trusting domain, even though the user accounts or groups don't exist in the trusting domain's directory.

See also: domain; permission

tunnel server

A server or router that terminates tunnels and forwards traffic to the hosts on the target network.

See also: router

two-way trust

A trust relationship between two domains in which both domains trust each other. For example, domain A trusts domain B, and domain B trusts domain A. All parent-child trusts are two-way.

See also: domain; one-way trust; trust relationship

U

UCS

See definition for: Universal Character Set (UCS)

UDDI

See definition for: Universal Description, Discovery, and Integration (UDDI)

UNC

See definition for: Universal Naming Convention (UNC)

UNC (Universal Naming Convention) name

The full name of a resource on a network. It conforms to the \\servername\sharename syntax, where servername is the name of the server and sharename is the name of the shared resource. UNC names of directories or files can also include the directory path under the share name, with the following syntax:

\\servername\sharename\directory\filename

See also: resource

Unicode

A character encoding standard developed by the Unicode Consortium that represents almost all of the written languages of the world. The Unicode character repertoire has multiple representation forms, including UTF-8, UTF-8, and UTF-32. Most Windows interfaces use the UTF-16 form.

See also: American Standard Code for Information Interchange (ASCII); Universal Character Set (UCS)

Uniform Resource Locator (URL)

An address that uniquely identifies a location on the Internet. A URL for a World Wide Web site is preceded by http://, as in the fictitious URL http://www.example.microsoft.com. A URL can contain more detail, such as the name of a page of hypertext, usually identified by the file name extension .html or .htm.

uninterruptible power supply (UPS)

A device that connects a computer and a power source to ensure that electrical flow is not interrupted. UPS devices use batteries to keep the computer running for a period of time after a power failure. UPS devices usually provide protection against power surges and brownouts as well.

Universal Character Set (UCS)

An international standard character set reference that is part of the Unicode standard. The most widely held existing version of the UCS standard is UCS-2, which specifies 16-bit character values currently accepted and recognized for use to encode most of the world's languages.

See also: American Standard Code for Information Interchange (ASCII); Unicode

Universal Description, Discovery, and Integration (UDDI)

An industry specification for publishing and locating information about Web services. UDDI defines a standards-based way to store and retrieve information about Web services, Web service providers, binding information, and technical interface definitions—all classified using a set of standard or custom classification schemes.

See also: service

Universal Naming Convention (UNC)

A convention for naming files and other resources beginning with two backslashes (\), indicating that the resource exists on a network computer. UNC names conform to the \\servername\sharename syntax, where servername is the server's name and sharename is the name of the shared resource. The UNC name of a directory or file can also include the directory path after the share name, by using the following syntax: \\servername\sharename\directory\filename.

universal serial bus (USB)

An external bus that supports Plug and Play installation. Using USB, you can connect and disconnect devices without shutting down or restarting your computer. You can use a single USB port to connect up to 127 peripheral devices, including speakers, telephones, CD-ROM drives, joysticks, tape drives, keyboards, scanners, and cameras. A USB port is usually located on the back of your computer near the serial port or parallel port.

See also: Plug and Play

UNIX

A powerful, multiuser, multitasking operating system initially developed at AT&T Bell Laboratories in 1969 for use on minicomputers. UNIX is considered more portable, that is, less computer-specific, than other operating systems because it is written in C language. Newer versions of UNIX have been developed at the University of California at Berkeley and by AT&T.

UPS

See definition for: uninterruptible power supply (UPS)

URL

See definition for: Uniform Resource Locator (URL)

USB

See definition for: universal serial bus (USB)

user profile

A file that contains configuration information for a specific user, such as desktop settings, persistent network connections, and application settings. Each user's preferences are saved to a user profile that Windows uses to configure the desktop each time a user logs on.

UUEncoding/Decoding

A form of encoding and decoding that allows binary files to be sent as e-mail. A binary file, such as a program or image, cannot be sent directly over the Internet by e-mail. To send such a file, you must first encode it to hide the control characters. This encoding can be accomplished by converting the binary file to a text file. UUEncoding carries out this conversion, and UUDecoding regenerates the original file.

V

variable

In programming, a named storage location capable of containing a certain type of data that can be modified during program execution.

System environment variables are defined by the operating systems in the Windows Server 2003 family, and they are the same no matter who is logged on to the computer. Administrator group members can add new variables or change the values, however.

User environment variables can be different for each user of a particular computer. They include any environment variables you want to define or variables defined by your applications, such as the path where application files are located.

See also: environment variable

virtual local area network (VLAN)

A logical grouping of hosts on one or more local area networks (LANs) that allows communication to occur between hosts as if they were on the same physical LAN.

See also: local area network (LAN)

VLAN

See definition for: virtual local area network (VLAN)

VoIP (Voice over Internet Protocol)

A method for sending voice over a local area network (LAN), a wide area network (WAN), or the Internet using TCP/IP packets.

See also: local area network (LAN); Transmission Control Protocol/Internet Protocol (TCP/IP); wide area network (WAN)

volume

An area of storage on a hard disk. A volume is formatted by using a file system, such as file allocation table (FAT) or NTFS, and has a drive letter assigned to it. You can view the contents of a volume by clicking its icon in Windows Explorer or in My Computer. A single hard disk can have multiple volumes, and volumes can also span multiple disks.

See also: file allocation table (FAT); NTFS file system; simple volume; spanned volume

volume set

A volume that consists of disk space on one or more physical disks. A volume set is created by using basic disks and is supported only in Windows NT 4.0 or earlier. Volume sets were replaced by spanned volumes, which use dynamic disks.

See also: basic disk; dynamic disk; partition; spanned volume; volume

voluntary tunnel

A tunnel that is initiated by the client. A voluntary tunnel tunnels Point-to-Point Protocol (PPP) over Internet Protocol (IP) from the client to the tunnel server, and then the data is forwarded to the target host by the tunnel server.

See also: tunnel server

W

WAN

See definition for: wide area network (WAN)

wc

Word count. Command-line POSIX tool that returns the number of bytes, words, and lines in files.

wide area network (WAN)

A communications network connecting geographically separated locations that uses long-distance links of third-party telecommunications vendors.

See also: local area network (LAN)

Windows Internet Name Service (WINS)

A Windows name resolution service for network basic input/output system (NetBIOS) names. WINS is used by hosts running NetBIOS over TCP/IP (NetBT) to register NetBIOS names and to resolve NetBIOS names to Internet Protocol (IP) addresses.

See also: IP address; network basic input/output system (NetBIOS); resource; service; WINS resource

Windows Support Tools

Tools that administrators, developers, or support personnel can use to diagnose and troubleshoot operating system configuration problems. Although Windows Support Tools are included on the operating system CD, they are not guaranteed or supported by Microsoft, and they must be installed separately from the operating system.

WINS

See definition for: Windows Internet Name Service (WINS)

WINS resource

A resource type that provides Windows Internet Name Service (WINS) from a cluster.

See also: cluster; Windows Internet Name Service (WINS)

working set

For a process, the amount of physical memory assigned to the process by the operating system.

X

X.500

A set of standards defining a distributed directory service, developed by the International Standards Organization (ISO).

See also: directory service

Y

There are no glossary terms that begin with this letter.

Z

There are no glossary terms that begin with this letter.


ADLB Examples

Example 1: Run ADLB with Required Parameters Only

The task in this example is to run ADLB, with only the /server and /site parameters, to produce a list of the connection objects found in server1. Server1 belongs to site1.

Type the following at the command prompt:

adlb /server:server1 /site:site1

Press ENTER. The following output displays:

ADLB - Active Directory Load Balancing Tool v1.1
Written by Ajit Krishnan, Nicholas Harvey, and William Lees
LHMatch technology by Nicholas Harvey and Laszlo Lovasz
(c) Copyright 2001 Microsoft Corp.

==============================================
Starting Destination Bridgehead Load Balancing
==============================================

=========================================
Starting Source Bridgehead Load Balancing
=========================================

dn: CN=555da5fd-555d-5b5a-5555-5555cbdded5d,CN=NTDS Settings,CN=server2,CN=Serv
changetype: modrdn
newrdn: CN=555da5fd-555d-5b5a-5555-5555cbdded5d
deleteoldrdn: 1
newsuperior: CN=NTDS Settings,CN=Server3,CN=Servers,CN=Sites,CN=Co

No changes are made to the connections objects. The output shows that one connection object is found on server1. ADLB suggests changes to the connection object to better balance replication traffic.

  • The first line (dn:) specifies the current distinguished name of the connection object. This line names server2 as the current replication partner.
  • Line 2 specifies the type of change (changetype) that ADLB suggests.
    • "modrdn" specifies that ADLB would like to change the replication partner to another server.
    • "newsuperior" shows that ADLB suggests that server3 should be the replication partner for this connection object. In this example no changes are made.

The /commit parameter must be used for ADLB to make this change. Running ADLB without the /commit parameter allows the administrator to view the changes proposed by ADLB. After viewing the changes run the same parameters and append the /commit parameter to allow ADLB to make the proposed changes.

Example 2: Create a Log File to Determine If Changes Are Needed

The task in this example is to have ADLB create a log file that allows the administrator to determine whether or not changes proposed by ADLB will provide the needed effect. The example includes the /stagger parameter so that replication time schedules are also examined.

Type the following on the command line of a domain controller:

adlb /server:server1 /site:site1 /log:adlb.log /stagger /perf

Press ENTER. ADLB creates the log file Adlb.log, saves it to the current directory, and displays the following output:

adlb /server:server1 /site:site1 /log:adlb.log
ADLB - Active Directory Load Balancing Tool v1.1
Written by Ajit Krishnan, Nicholas Harvey, and William Lees
LHMatch technology by Nicholas Harvey and Laszlo Lovasz
(c) Copyright 2001 Microsoft Corp.


ADLB Remarks

Using ADLB with Required Parameters Only

The required parameters for ADLB are /server and /site. If these are the only parameters used, ADLB lists all connection objects for the named site. No load balancing can occur unless the /commit parameter is used.

Time Scheduling Cannot Be Altered Remotely

ADLB can load balance replication between site bridgehead servers remotely, but it cannot load balance replication time schedules remotely. You must run ADLB locally on a domain controller on which the Inter-Site Messaging Service (ISM) is running to load balance time schedules.

Interpreting ADLB Output

ADLB output is written in LDAP Data Interchange Format (LDIF). For more information on LDIF files see RFC 2849, LDAP Data Interchange Format - Technical Specification in the RFC Database (http://go.microsoft.com/fwlink/?LinkID=3952).

Creating Log Files with ADLB

The /log parameter is used by itself or in conjunction with the /perf and /verbose parameters. By itself, the /log parameter provides metrics that demonstrate how much more optimal the load balancing changes are when implemented. When used with the /verbose parameter, intermediate output is logged for debugging purposes. Including the /perf parameter adds ADLB performance statistics to the log.


ADLB Syntax

ADLB uses the following general syntax:

One Step adlb /server:ServerName {/site:SiteName | /s:SiteName} [{/commit | /c}] [/disown:FileName] [/ldif:FileName] [{/log:FileName | /l:FileName}] [{/maxbridge:Number| /mb:Number}] [{/maxperserver:Number| /mps:Number}] [{/maxsched:Number| /ms:Number}] [/perf] [/showinput] [{/verbose | /v:}] [{/user:UserName | /u:UserName}] [{/domain:DomainName| /d:DomainName}] [/password:Password | /pw:{Password | *}]

Parameters

/server:ServerName
Specifies the name of a domain controller that belongs to the forest. fully qualified domain names ((FQDNs), host names, NetBIOS names, and IP addresses are all acceptable entries.
/site:SiteName | /s:SiteName
Specifies the name of the site on which ADLB checks load balancing and time scheduling.
/commit | /c
Writes changes to Active Directory. By default, ADLB displays information about the domain controllers, but does not perform any load balancing or scheduling changes until the /commit parameter is used.
/disown
Allows changes ADLB makes to replication time schedules to be overwritten by the Knowledge Consistency Checker (KCC). Once ADLB makes a manual change to the replication time schedule, the KCC no longer automatically propagates the schedule changes throughout the forest. Use ADLB to keep the scheduling changes made by ADLB and to propagate the changes throughout the forest.
/ldif:FileName
Writes display information to a file in the LDAP Data Interchange Format (LDIF). Any file name and extension can be used, though the expected extension is .ldif.
/log:FileName | /l:FileName
Writes display and optimization information to a file in log file format. This way, an administrator can study the information to decide whether or not the changes are beneficial enough to implement. The changes can then be implemented using the /commit parameter. If no file name is given, the output is displayed at the command prompt. Any file name and extension can be used, though the expected extension is .log.
/maxbridge:Number| /mb:Number
Specifies the maximum number of connection objects that ADLB displays when enumerating bridgehead servers. By default, all connection objects on all bridgehead servers are enumerated.
/maxperserver:Number| /mps:Number
Specifies the maximum number of connection objects that ADLB can create on a domain controller. By default, 10 is the maximum number of connection objects.
/maxsched:Number| /ms:Number
Specifies the maximum number of schedules that ADLB enumerates when examining replication schedules. By default, no schedules are staggered.
/perf
Includes performance statistics in the display, ldif file, or log file.
/showinput
Includes all objects read from the directory in the display, ldif file, or log file.
/stagger
Staggers all replication schedules.
/verbose | /v:}
Indicates that the tool should display detailed output.
/user:UserName | /u:UserName} /password:Password | /pw:{Password | *} [{/domain:DomainName| /d:DomainName}]
Specifies a user account that has permissions to perform operations in Active Directory. If the domain is not specified when specifying a user account and password, the local domain is assumed.
  • User level permissions are required for all operations other than /commit.
  • Administrative permissions are required to commit the changes to Active Directory.


AdmX Examples

Overview | Remarks | Syntax | Examples | Related Tools

Example 1: Run AdmX with the Minimum Required Parameters

The task in this example is to parse a custom Group Policy template named New.adm. This template is located in the same folder that contains the Group Policy templates installed with the operating system.

Type the following at the command line.

admx c:\windows\inf\new.adm

Press ENTER. AdmX displays the contents of the template.

Computer/User Node      Policy Path     Symbolic Policy Name    Full Policy Name
        Registry Settings       Supported on
USER    Administrative Templates\AutoComplete   AutoCompletePol AutoComplete Set
tings   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete!App
end Completion PW Ask
USER    Administrative Templates\Display settings       FontSize        Text Siz
e       HKLM\Software\Microsoft\Internet Explorer\International\Scripts!Default_
IEFontSize
MACHINE Administrative Templates\Component Updates      UpdateCheck     Periodic
 check for updates to Internet Explorer and Internet Tools      HKLM\Software\Mi
crosoft\Internet Explorer\Main!Update_Check_Page, HKLM\Software\Microsoft\Intern
et Explorer\Main!Update_Check_Interval
MACHINE Administrative Templates\Component Updates      HelpAbout128    Help Men
u > About Internet Explorer     HKLM\Software\Microsoft\Windows\CurrentVersion!I
EAKUpdateUrl

Example 2: Direct AdmX Output to a File

The task in this example is to use AdmX to parse the custom template and direct the output to a tab-delimited text file. You can view this file in either a spreadsheet application or a text editor.

Type the following at the command line:

admx c:\windows\inf\new.adm /output:new.txt

Press ENTER. No output displays, but the file is created and saved to the current directory.


AdmX Remarks

Overview | Remarks | Syntax | Examples | Related Tools

Installing AdmX

AdmX is a Microsoft Windows Installer package that needs to be installed. After installing Windows Server 2003 Resource Kit Tools, complete the following steps to install AdmX.

  1. Double-click admx.msi to begin the AdmX installation.
  2. Click Next at the welcome screen. The Select Installation Folder screen appears, displaying a default installation path in the Folder input box.
  3. Type in or click Browse to select an alternate path. By default, only the user logged on during the installation of AdmX can run AdmX. To allow the Everyone group permission to run AdmX, select Everyone.
  4. Click Next. The Confirm Installation screen appears.
  5. Check your selections. Use Back to make changes. Click Next to continue the installation. The Installation Complete screen appears.
  6. Click Close to exit the AdmX installation.

Notes

  • Running admx.msi after AdmX is installed will only allow the options of repairing or removing AdmX.
  • By default, during installation, AdmX creates a folder under the Program Files\Microsoft directory. The default name of the folder is /admparse Installer

Using AdmX Remotely

When a created file or .adm template is located on a remote computer, a drive must be mapped to a share on the remote computer. AdmX syntax does not allow the use of Universal Naming Conventions (UNCs).


AdmX Syntax

Overview | Remarks | Syntax | Examples | Related Tools

AdmX uses the following syntax:

One Step admx AdmTemplate [/diff:AdmTemplate2] [output:FileName] [/all] [/title:"Text"]

Parameters

AdmTemplate
Specifies a full path and file name to a Group Policy template. The .adm extension must be included in the file name. If only the file name is specified, AdmX searches the current directory. The default location for %windir%\inf directory. For files located on remote computers, map a drive and use the drive letter as part of the full path. Universal naming convention (UNC) names are not accepted.
/diff:AdmTemplate2
Specifies a full path and file name of a second .adm file to which AdmX will compare AdmTemplate. AdmX finds and displays the differences between the two adm templates. The .adm extension must be included in the file name. For files located on remote computers, map a drive and use the drive letter as part of the full path. Universal naming convention (UNC) names are not accepted.
/output:FileName
Directs display information to a tab-delimited text file. If FileName already exists, AdmX overwrites the existing file.
/all
Adds a column to the display or output file. The added column is for help text that explains more about the policy setting and its use.
/title:"Text"
Adds a table title to the tab-delimited file. Enclose the desired title Text in quotation marks.


This program could not start.

The operating system could not start this program. Some possible solutions are:

If your computer is on a network, contact your system administrator.

If a system administrator controls your computer, you should ask the administrator why you cannot start the program. Your administrator may have removed the program or set a policy that prevents you from starting it.

Install the necessary hardware.

Some programs are installed automatically when you install the hardware associated with them. To install new hardware click Start, point to Settings, click Control Panel, and then double-click Add Hardware.

Install the necessary software.

The program might not be installed on your computer because:

  • It is an optional component. To install optional components, click Start, point to Settings, click Control Panel, and then double-click Add or Remove Programs.
  • You have not installed the hardware that uses this program. To install new hardware click Start, point to Settings, click Control Panel, and then double-click Add Hardware.
  • If your computer is on a network, your system administrator may have removed this program or set a policy that prevents you from starting it.

Reinstall the program file.

The program file may have been accidentally deleted or corrupted. If you know the name of the file that is missing, you can copy the compressed version from the operating system installation compact disc to your hard drive, and then restore it by doing the following:

  1. Insert the installation compact disc.
  2. Click Browse the CD.
  3. In the folder list, open either the Alpha or I386 folder.
  4. Find the name of the missing file.

    NOTE: The last letter in the file name extension will be replaced by an underscore because it is a compressed version of the file. For example, notepad.exe is called notepad.ex_ on the installation compact disc.

  5. Copy the compressed file to your systemroot\System32 folder on your hard drive.
  6. Click Start, point to Programs, and then click Command Prompt.
  7. At the command prompt, type:
    expand %systemroot%\system32\
my_file_name.ex_

%systemroot%\system32\
my_file_name.exe
    and then press ENTER.


This information is not available

The information you are trying to locate is not available on this computer.

Try the following Web sites:

  • Windows Resource Kits (http://go.microsoft.com/fwlink/?LinkId=291)
  • Microsoft Press (http://go.microsoft.com/fwlink/?LinkId=215)
  • Microsoft Windows (http://go.microsoft.com/fwlink/?LinkId=622)
  • Microsoft Product Support (http://go.microsoft.com/fwlink/?LinkId=281)
  • Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=170)
  • Microsoft MSDN (http://go.microsoft.com/fwlink/?LinkId=140)


AtmArp Examples

Example 1: Display ARP Server Statistics

Type the following at the command line:

atmarp

Press ENTER. Output similar to the following is displayed:

Windows ATM ARP Server Information

Adapter: Toshiba ATM Meteor 155 PCI Adapter

Arp Server Statistics
    Elapsed Time: 185   seconds
    Recvd. Pkts.: 8     total           (0 discarded)
         Entries: 1     current         (1 max)
       Responses: 1     acks            (0 naks)
      Client VCs: 1     current         (1 max)
  Incoming Calls: 2     total

Mars Server Statistics
    Recvd. Pkts.: 7     total           (0 discarded)
    MCData Pkts.: 53    total           (0 discarded, 53 reflected)
         Members: 1     current         (1 max)
         Promis.: 0     current         (0 max)
       Add Party: 1     total           (0 failed)
    Registration: 1     requests        (0 failed)
           Joins: 4     total           (1 failed, 3 dup's)
          Leaves: 0     total           (0 failed)
        Requests: 2     total
       Responses: 2     acks            (0 naks)
         VC Mesh: 0     joins           (0 acks)
          Groups: 0     current         (0 max)
      Group Size: 0     max

Example 2: Display ARP and MARS Caches

Type the following at the command line:

atmarp /c

Press ENTER. Output similar to the following is displayed:

Windows ATM ARP Server Information

Adapter: Toshiba ATM Meteor 155 PCI Adapter

Arp Cache
169.254.155.215 -> 39.840f.80.000000.0000.2490.76b5.0800a0010029.01

Mars Cache


AtmArp Remarks

Arp Server Statistics Description

Statistic | Description
Elapsed time | Seconds of elapsed since the ARP/MARS/MCS service was started, or the last time AtmArp/reset was executed.
Recvd. Pkts. (total) | Total number of control packets received by the server on this adapter. This total includes both ARP and MARS control packets.
Recvd. Pkts. (discarded) | Number of packets that were discarded before being classified as ARP or MARS control packets. These packets were discarded either because they were badly formed, or because the server ran out of resources. A high number of discarded packets indicates a communications or resource-related problem.
Entries (current) | Number of ARP entries currently in the internal ARP table.
Entries (max) | Maximum number of entries in the ARP table since the start of statistics collection.
Responses (acks) | Total number of ARP acknowledgement (ACK) responses sent.
Responses (naks) | Total number of ARP negative acknowledgement (NACK) responses sent since the start of statistics collection.
Client virtual circuits (VCs) (current) | Current number of incoming client Virtual Circuits (VCs).
Client VCs (max) | Maximum number of incoming client VCs at any one point of time since the start of statistics collection.
Incoming Calls (total) | Sum of incoming client VC calls since the start of statistics collection.

Mars Server Statistics

Statistic | Description
Recvd. Pkts. (total) | Total number of MARS control packets received.
Recvd. Pkts. (discarded) | Total number of MARS control packets that were discarded, either because they were invalid or because the server ran out of resources. A high number of discarded packets indicates a communications, or resource-related problem.
MCData Pkts. (total) | Total number of multicast data packets received from clients.
MCData Pkts. (discarded) | Number of multicast data packets that were discarded, either because they were invalid or because the server ran out of resources. A high number of discarded packets indicates a communications or resource-related problem.
MCData Pkts. (reflected) | Total number of multicast data packets that were reflected on the cluster control VC.
Members (current) | Current number of multicast clients.
Members (max) | Maximum number of multicast clients at any one time since the start of statistics collection.
Promis.(current) | Current number of clients that have requested promiscuous join, which is a request to receive all multicast data.
Promis.(max) | Maximum number of multicast clients that have requested promiscuous joins, at any one time since the start of statistics collection.
Add Party (total) | Total number of times an attempt was made to add a party to the cluster control VC.
Add Party (failed) | Number of times that add party attempt failed. A high number of failures indicates a communications, or resource-related problem.
Registration (requests) | Total number of multicast client registrations requests received.
Registration (failed) | Number of registration requests that failed.
Joins (total) | Total number of request by clients to join a multicast group (includes promiscuous join requests).
Joins (failed) | Number of join requests that were denied.
Joins (duplicates) | Number of join requests that were (1) a duplicate of, or (2) a subset of an earlier join request by the same client, or (3) for an address range that is MCS-served.
Leaves (total) | Total number of requests to leave a multicast group (includes promiscuous leave requests).
Leaves (failed) | Number of leave requests that were denied.
Requests (total) | Total number of MARS requests, which are requests asking for the ATM addresses associated with a particular IP multicast group address.
Responses (acks) | Total number of MARS requests that were successfully answered. For example, there was at least one ATM address associated with the IP multicast group address.
Responses (nacks) | Total number of MARS requests that were negatively acknowledged because no ATM addresses were associated with the IP multicast group address.
VC Mesh (joins) | Total number of successful joins involving VC-Mesh IP multicast group addresses.
VC Mesh (acks) | Total number of MARS requests for one of these VC-Mesh-served IP multicast group addresses. If this number is 0, it typically means that no client has attempted to send to a VC-Mesh served address.
Groups (current) | Current number of VC-Mesh IP multicast group addresses.
Groups (max) | Maximum number of VC-Mesh IP multicast group addresses at any one time since the start of statistics collection.
Group Size (max) | Maximum number of clients that requested to receive the same VC-Mesh IP multicast address group at any one time.


AtmArp Syntax

AtmArp uses the following syntax:

One Step atmarp [/s] [/c] [/reset] [/?]

Parameters

/reset
Resets the ARP and MARS statistics.
/c
Displays the ARP and MARS caches.
/s
Displays statistics for the ARP and MARS server.
/?
Displays help.

Note

  • The default is to display only the ARP and MARS statistics.


AtmLanE Examples

Example: Display ATM LAN Emulation Client Information

Type the following at the command line and press ENTER:

atmlane

The following output is displayed:

Windows ATM LAN Emulation Client Information

Adapter: \DEVICE\{C776BD23-245F-4670-A23F-23B30C2F03EA}

ELAN: \Device\{ECEFD0E3-72BE-4D31-8A91-B42761359447}

    ELAN Number:        0
    ELAN State:         OPERATIONAL
C1  ATM Address:        39.840f.80.000000.0000.2490.76b5.0800a0010029.00
C2  LAN Type:           Ethernet/802.3
C3  MaxFrameSize:       1516
C4  Proxy:              Off
C5  ELAN Name:          EtherNet
C6  MAC Address:        08.00.a0.01.00.29
C7  ControlTimeout:     10 sec
C8  RouteDescriptors:   None
    LECS Address:       47.0079.00.000000.0000.0000.0000.00a03e000001.00
C9  LES Address:        39.840f.80.000000.0000.2490.7689.000024907689.00
    BUS Address:        39.840f.80.000000.0000.2490.7689.000024907689.00
C10 MaxUnkFrameCount:   1
C11 MaxUnkFrameTime:    1 sec
C12 VccTimeout:         1200 sec
C13 MaxRetryCount:      1
C14 LEC ID:             22541
C15 MulticastMacAddrs:  Broadcast,All_Multicast
C16 LE_ARP Cache:       See below
C17 AgingTime:          300 sec
C18 ForwardDelayTime:   15 sec
C19 TopologyChange:     Off
C20 ArpResponseTime:    1 sec
C21 FlushTimeout:       4 sec
C22 PathSwitchingDelay: 6 sec
C23 LocalSegmentId:     0
C24 McastSendVcType:    Best Effort
C25 McastSendVcRate:    0 cps
C26 McastSendPeakRate:  0 cps
C27 RemoteMacAddrs:     None
C28 ConnComplTimer:     4 sec

C16 LE_ARP Cache

0a.22.48.2d.0c.5a -> 39.840f.80.000000.0000.2490.7689.0020482d0c5a.02
ff.ff.ff.ff.ff.ff -> 39.840f.80.000000.0000.2490.7689.000024907689.00

Connection Cache

PEER 39.840f.80.000000.0000.2490.7689.0020482d0c5a.02 DataDirect
BUS  39.840f.80.000000.0000.2490.7689.000024907689.00 McastSend + McastFwd
LES  39.840f.80.000000.0000.2490.7689.000024907689.00 CtrlDirect + CtrlDistr


AtmLanE Remarks

General Information

The Emulated Local Area Network (ELAN) State indicates the status of the emulated LAN. A value of OPERATIONAL indicates that the emulated LAN is ready for use.

The LAN Emulation Address Resolution Protocol (LE_ARP) Cache displays the mapping of MAC addresses to ATM addresses currently in the AtmLanE driver. The Connection Cache displays all active connections terminating at this machine.


AtmLanE Syntax

AtmLanE uses the following syntax:

One Step atmlane

There are no parameters for this tool.


AutoExNT Remarks

Overview | Remarks | Related Tools

Installing AutoExNT

You use Instexnt.exe to install AutoExNT.

To install AutoExNT:

  1. Copy Autoexnt.exe and Servmess.dll into the SystemRoot/System32 directory.
  2. Using a text editor, create a batch file containing the commands you want to include.
  3. Name the file Autoexnt.bat.
  4. Copy Autoexnt.bat into the SystemRoot/System32 directory.
  5. Type one of the following statements at the command line:

    instexnt install

    instexnt install /interactive

  6. Press ENTER. Both statements install AutoExNT, but the second allows you to view the installation processes running on the desktop.

    7. Note

    • If you use the /interactive parameter, any users who are logged on locally will be able to stop the processes from running.

  7. You will see the following message when installation has completed successfully:
    AutoExNT service is starting.
AutoExNT service was started successfully.

    The interactive flag will be either OFF or ON, depending on your use of the /interactive parameter.

Creating the Autoexnt.bat File

No user-environment variables will have been declared when AutoExNT runs at system startup, so you must use full path names in the Autoexnt.bat file that you create.

If you need a service (such as the Server or Schedule service) to be running before you start running a dependent process, include a net start service command at the beginning of your Autoexnt.bat file.

Testing AutoExNT

To test AutoExNT, log on as an administrator and type the following at the command line:

net start autoexnt

Press ENTER. If the service starts correctly, the Autoexnt.bat file that you created will run in a command window.

Configuring AutoExNT to Run at Startup

To configure AutoExNT to run when you start your computer:

  1. In Control Panel, double-click Administrative Tools, and then double-click Services.
  2. In the Services pane, right-click AutoExNT, and then click Properties.
  3. On the General tab, in the Startup type box, select Automatic.
  4. Click Apply, and then click OK.

Note

  • When you need to access an area outside your local system (for example, by using the net use command), click the Log On tab, click This account, specify an account that has adequate permissions on the domain, and provide a password as required.


CDBurn Examples

Example 1: Burn a CD From an Image File When a Drive Letter is Assigned to the CD Burner

Type the following at the command line:

cdburn.exe d: c:\dotnet_usa_3678.IDS_x86fre_srv.iso

Press ENTER. Output similar to the following is displayed:

Number of blocks in ISO image is 3d1d6
|  25.6% done
/  45.2% done
/  55.3% done
-  68.9% done
\  89.3% done
- 100.0% done
Finished Writing
Synchronizing Cache: burn successful!

Notes

  • The drive letter assigned to the burner in this example is D and the image file being written is located at c:\dotnet_usa_3678.IDS_x86fre_srv.iso
  • The default burn speed for this tool is 4x. The maximum burn speed is limited by the maximum speed of the burner. Use the speed parameter to set the burn speed. The max parameter sets the burn speed of the CD burner to maximum.

Example 2: Burn a CD From an Image File Using a Volume Name (Globally Unique Identifier (GUID)) For the CD Burner Instead of a Drive Letter

Type the following at the command line:

cdburn.exe Volume{b24ff56a-e2d8-11d6-b428-806e6f6e6963} WinPE.iso /erase

Press ENTER. Output similar to the following is displayed:

Erasing media before burning
Number of blocks in ISO image is 3d1d6
Erasing target media
Media erased
|  25.6% done
/  45.2% done
-  68.9% done
/  55.3% done
\  89.3% done
- 100.0% done
Finished Writing
Synchronizing Cache: burn successful!

Notes

  • The GUID is obtained by using the tool mountvol.exe, which is included with the operating system.
  • Erasing the media is only possible when using rewritable media (CD-RW).
  • The default burn speed for this tool is 4x. The maximum burn speed is limited by the maximum speed of the burner.
  • Use the speed parameter to set the burn speed. The max parameter sets the burn speed of the CD burner to maximum.

Example 3: Use Mountvol.exe to Obtain Volume Names

To obtain volume names, instead of using drive letters, type the following at the command line

mountvol

Press ENTER. Output similar to the following is displayed:

Creates, deletes, or lists a volume mount point.

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L

    path        Specifies the existing NTFS directory where the mount
                point will reside.
    VolumeName  Specifies the volume name that is the target of the mount
                point.
    /D          Removes the volume mount point from the specified directory.
    /L          Lists the mounted volume name for the specified directory.

Possible values for VolumeName along with current mount points are:

 \\?\Volume{a07f2ffe-cc0a-11d6-aaf0-806e6f6e6963}\
    R:\
\\?\Volume{c0745867-cc0a-11d6-aaf0-808592984efe}\
    T:\CD_Drives\CDBurner2\
\\?\Volume{b24ff56a-e2d8-11d6-b428-806e6f6e6963}\
    T:\CD_Drives\CDBurner3\

Note

  • The tool Mountvol.exe is included with the operating system.


CDBurn Remarks

General Information

The image file is a 2048-byte-per-sector raw image of the final disc.

In Track At Once (TAO) mode, the recording laser is turned off after each track is finished, and on again when a new track must be written. When recording the new track, the laser is recalibrated and a new recording is initialized. The CD's table of contents is not written until the last track has been written. All current CD recorders support Track At Once.

In Session At Once (SAO) mode, a first session is recorded in a single pass and then the laser is turned off. Not all drives support writing in this mode.

In both modes, CDBurn always finalizes the disc. This means that you cannot add any data to the disc after writing.

Note

  • CDBurn adds 150 sectors of postgap to the burned image by default. This behavior can be overridden by using the /imagehaspostgap option. Therefore, if CDBurn is used without the /imagehaspostgap option, the tool used to create the image file (for example, Oscdimg.exe) should not add these sectors.


CDBurn Syntax

CDBurn uses the following syntax:

One Step cdburn Drive [/Erase] [ Image [[/SAO] | [/speed] [/imagehaspostgap]]]

One Step cdburn Drive Image [ [/Erase] | [/SAO] | [/speed] [/imagehaspostgap]]

Parameters

/Erase
Erases the disc before the burning process begins (valid for rewritable discs only).
/SAO
Writes the image out in Session At Once or cue sheet mode. The default is Track At Once.
Drive
Specifies the drive letter of the CD burner.
Image
Specifies the location and name of the image to burn to the CD.
/speed Value | max
Specifies the speed of the burn. Use max to specify the maximum speed of the CD burner. The default burn speed for this tool is 4x.
/imagehaspostgap
Specifies that 150 sectors of zero data should not be added to the end of the disc. Use this parameter if your image already contains a 150 sector postgap.

Note

  • The image must be provided unless the erase parameter is used. If both an image and erase parameter are provided, the media will be erased prior to burning the image to the disc.


CheckRepl Examples

Example: Use CheckRepl to Display the Replication Topology of a Server

The task in this example is to display the replication topology of a server named DC2. DC2 belongs to the corp.contoso.com domain and to the NA site. Type the following at the command line:

cscript checkrepl.vbs dc2

Press ENTER. Output similar to the following is displayed:

Inbound Neighbors
    1)NA\DC1
    2)NA\DC3

Configuration.corp.contoso.com
    NA\DC1
    NA\DC3

Schema.corp.contoso.com
    NA\DC1

corp.contoso.com
    NA\DC1
    NA\DC3

ForestDnsZones.corp.contoso.com
    NA\DC1

DomainDnsZones.corp.contoso.com
    NA\DC1
    NA\DC3

Outbound Neighbors:
    NA\DC1 via RPC
        object GUID: 11A1AA11-A111-1A11-AAAA-AAAAA111111


CheckRepl Remarks

Running CheckRepl

WMI Provider must be installed to run this script tool.

Registering Iadstools.dll

Iadstools.dll is located in the Support directory on the Windows Server 2003 CD and the Windows Server 2003 Deployment Kit CD. The Iadstools.dll file must be registered so that CheckRepl can use it. To register Iadstools.dll, open the command prompt and navigate to the folder that contains Iadstools.dll. Type the following at the command line:

regsvr32 iadstools.dll

Press ENTER.


CheckRepl Syntax

CheckRepl uses the following syntax:

One Step cscript checkrepl.vbs ServerName

Parameter

ServerName
Specifies the name of a domain controller. Fully qualified domain names (FQDNs), host names, NetBIOS names, and IP address are all acceptable entries.


ChkLnks UI

Overview | UI | Related Tools Run Tool

Link Check Wizard has the following pages:

Welcome to the Link Check Wizard

First, the Link Check Wizard displays a page containing a synopsis of the ChkLnks tool and its function. Click the Next button to proceed to the next page of the wizard after scanning the computer for dead links. If ChkLnks does not find any dead links, an informational diologue box appears, which contains the text: "No Dead Link Files were found." "Click OK to Terminate this wizard." Click the OK button to terminate the wizard.

Select the links to remove

The "Select the links to remove" page provides an interface to remove dead links found by the ChkLnks tool. This page has the following options:

Option | Description
Links to remove window | Inside the Links to remove window is a list of dead links. Click a link to mark it for deletion. Right-click a file name to view the details of that dead link. The details included are File name, Location of the shortcut file on the hard disk, Resolves to physical location, and Error Status.
Select/Deselect all button The Select/Deselect all button selects or deselects all dead links.
  • To select all the links, click the Select all button. The button toggles to read "Deselect all."
  • To deselect all the links, click the Deselect all button. The button toggles to read "Select all."
Next button | Deletes the selected dead links and exits the Link Check Wizard
Back button | Returns to the previous wizard page
Cancel Button | Cancels the wizard.


ChkNIC Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Check the Network Adapter of the Local Computer for NLB Compatibility

To check the installed network adapters of local computers for NLB compatibility, type the following at the command line:

chknic

Press ENTER. Output similar to the following is displayed:

Device : 3Com EtherLink XL 10/100 PCI For Complete PC Management NIC (3C905C-TX)
Physical address : 00-01-03-D0-D1-83
Device is supported by NLB


ChkNIC Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

ChkNIC uses the following syntax:

One Step chknic [/?]

Parameter

/?
Displays command line usage.


CleanSpl Remarks

Overview | Remarks | UI | Related Tools Run Tool

Understanding CleanSpl

CleanSpl is a tool for removing all printing components from the spooler that are not installed by default. If printer drivers, spool files, or other spooler components become corrupt, this tool will delete them, so you can reinstall these components later. The components of the spooler that are deleted include: all printer drivers, printers, ports, port monitors, print processors, and print job spool files.

If corruption has affected the default spooler components (for example, Spoolsv.exe, Localspl.dll, Winprint.dll, Winspool.drv, or Tcpmon.dll), these components are not restored; you will likely need to reinstall the operating system.

Before removing any components, save the existing configuration information to a file to use as a reference when you reinstall printers and other printing components.

Caution

  • When CleanSpl is run, the spooler on the specified machine is stopped and all print jobs, printers, printer drivers, and print monitors are deleted. The spooler will be restored to its original, default, unconfigured condition.


CleanSpl UI

Overview | Remarks | UI | Related Tools Run Tool

Clean Spooler Dialog Box

Use the Clean Spooler dialog box to specify the computer to delete spooler objects from and restore the spooler to its default configuration. The Clean Spooler dialog box contains the following options.

Option | Description
Computer Name box | Allows you to enter the host name of the computer to be cleaned.
Select button | Opens a standard Browse dialog box. You can use this interface to select the computer to be cleaned.
Save Spooler Registry to File check box | Allows you to save the print spooler section of the registry to a text file.
File box | Allows you to specify a file name for the file that contains the spooler registry settings. The default name is Spooler.txt. Universal Naming Convention (UNC) paths can be used.
Browse button | Allows you to browse the local file system for an existing file to save the registry information in. The file will be overwritten
Clean Spooler button | Starts the cleaning of the spooler specified in the Computer Name box.
Close button | Closes CleanSpl without making any changes to a print spooler.


ClearMem Examples

Example 1: Use ClearMem to Specify the Number of Megabytes to Allocate

To allocate a particular number of megabytes of memory (32 in this example), type the following at the command line:

clearmem /m32

Press ENTER. The following output is displayed:

NT Win 32 Clear Memory.
Copyright 1990-1993, Microsoft Corporation.
Version 1.17x  (93.05.12)

/-------------------------------
| CLEARMEM.EXE:
|
|         o argv[0]=obj\i386\clearmem
|         o argv[1]=-m32
\-------------------------------
| ==> Start Flushing:  Access Section of size: 33554432
| ==> Start Flushing:  Read File: FLUSH1
Elapsed Time for Flushing: 5157 milliseconds
| ==> Exiting PROCESS:  CLEARMEM.EXE

Example 2: Use ClearMem to Specify the Number of Times to Touch a Page

To specify the number of times to touch a page (2 in this example), type the following at the command line:

clearmem /t2

Press ENTER. The following output is displayed:

NT Win 32 Clear Memory.
Copyright 1990-1993, Microsoft Corporation.
Version 1.17x  (93.05.12)

/-------------------------------
| CLEARMEM.EXE:
|
|         o argv[0]=clearmem
|         o argv[1]=/t2
\-------------------------------
| ==> Start Flushing:  Access Section of size: 133738496
| ==> Start Flushing:  Read File: FLUSH1
Elapsed Time for Flushing: 0 milliseconds
| ==> Exiting PROCESS:  CLEARMEM.EXE


ClearMem Remarks

Overview | Remarks | Syntax | Examples | Related Tools Run Tool

Using ClearMem

To run ClearMem, the paging file of the computer must be at least as large as its RAM. If you are running Windows Server configured for "Maximize Throughput for Network Applications," you might have to run ClearMem more than twice to reduce application working sets to the minimum. Use System Monitor to check on progress.

Working Set Information

The working set is a set of memory pages. It consists of all the physical pages owned by a process. Each memory page can be:

  • Shared — memory that is shared with some other process or processes. If these other processes are usually running (for example, services.exe or explorer.exe), the effect of these pages can be ignored because, while they are still in use, removing them from the working set does not free any pages.
  • Shareable — memory that could potentially be shared with another process but is not. This memory is not shared because there is no demand for its content elsewhere.
  • Private — memory which cannot be shared.


ClearMem Syntax

Overview | Remarks | Syntax | Examples | Related Tools Run Tool

ClearMem uses the following syntax:

One Step clearmem [/q] [/d] [/m Num] [/p Num] [/w] [/b][/t Num] [/?]

Parameters

/q
Suppresses output (quiet mode). Nothing is printed.
/d
Displays the debug break on entry into and exit from the application.
/m Num
Specifies the number of megabytes to allocate. The default is to use all physical memory.
/p Num
Specifies number of pages to read. The number of pages must be fewer than 63.
/w
Writes to the virtual memory section.
/b
Reads and writes the virtual memory section.
/t Num
Specifies the number of times to touch a page.
/?
Displays command-line help.

Notes

  • The Num that follows the m, p, and t parameters indicates how much memory to clear (m Num), how many pages to read/write at a time (p Num), and how many times to touch a page (t Num).
  • The default for the p parameter is 63 and the default for the t parameter is 1.
  • When run with no paramters, ClearMem will flush all available memory. This is the same as running ClearMem with the /m parameter.


ClusFilePort Examples

Overview | Remarks | Syntax | Examples | Related Tools

Example: Set Up Cluster File Ports

In this example, ClusFilePort is installed but no port is yet configured. To configure a port, do the following:

  1. Open the virtual cluster server by typing \\VirtualServerName in the Run dialog box, where VirtualServerName is the name of the cluster virtual server.
  2. On the Start menu, click Printers and Faxes. In Windows 2000, click Start, point to Settings, and then click Printers.
  3. On the File menu, click Server Properties.
  4. Click the Ports tab.
  5. Click Add Port.
  6. Select Cluster File Ports as an available port type, and then click New Port.
  7. Type the full path of either a printer or a place on a network or local drive where print files are stored.


ClusFilePort Remarks

Overview | Remarks | Syntax | Examples | Related Tools

Installing ClusFilePort

ClusFilePort cannot be installed remotely; however, it can be installed by using Remote Desktop Services.

Important

  • The following steps must be done locally on each node in the cluster.

Complete the following steps to use Remote Desktop Service to install ClusFilePort:

  1. If you are installing ClusFilePort on Windows 2000, the INF must be named "Monitor.inf." Before installing ClusFilePort, search for the INF file named "Clusfileport_win2000.inf" and rename it to "Monitor.inf."
  2. On the Start menu, click Printers and Faxes. In Windows 2000, click Start, point to Settings, and then click Printers.
  3. On the File menu, click Server Properties.
  4. Click the Ports tab.
  5. Click Add Port.
  6. Click New Port Type.
  7. Enter or browse for the location of the Clusfileport.inf file. The Clusfileport.inf file must be present in the same folder as Clusfileport.dll. Select Clusfileport.inf, and then click Open. If you are installing ClusFilePort on Windows 2000, select Clusfileport_win2000.inf, and then click Open. In the Installing Port Monitor dialog box, click OK.
  8. If a dialog box appears, click Continue Anyway to complete the installation.

    9. If the installation is a success, Cluster File Ports is added to the Printer Ports dialog box.
  9. In the Printer Ports dialog box, click Cancel. Click OK to close the Print Server Properties dialog box.

The cluster spooler resources must be taken offline and brought back online to make Cluster File Ports available to all cluster servers. This can be done by using Cluster Administrator or the Cluster.exe command-line tool. To set up Cluster File Ports, see Example: Set Up Cluster File Ports on the Examples page.

Note

  • Do not add any Cluster File Ports ports on the node. The Port Monitor is installed on the nodes, but the ports themselves are installed on the cluster virtual servers.

Using ClusFilePort

ClusFilePort.dll is not configurable and has no direct user interface.

Installing ClusFilePort Outside of a Cluster

ClusFilePort can be installed on a print server that is not a member of cluster; however, the functionality ClusFilePort provides already exists through the Local Ports port type.


ClusFilePort Syntax

Overview | Remarks | Syntax | Examples | Related Tools

There is no syntax for ClusFilePort. See the Remarks page for instructions on how to install and use ClusFilePort.


ClusterRecovery Examples

Overview | Remarks | UI | Examples | Related Tools Run Tool

Example: Recovering a shared disk

To recover a shared disk, complete the following steps:

  1. Add a new disk drive to the cluster. In a storage area network environment, adding a new disk drive may involve creating a new logical unit and exposing it to the server cluster nodes with appropriate logical unit number (LUN) masking, security, and zoning properties.
  2. Make sure that the new disk is only visible to one node in the cluster. All nodes that can see the disk can also access it until the Cluster service takes control of the new disk, and a physical disk resource is created. To avoid file system issues, refrain from exposing a disk to more than one node until it has been added to the cluster. In some cases (such as with low-end fiber channel RAID devices, or devices in a shared SCSI storage cabinet), there is no way to avoid multiple machines from accessing the same disk. In these cases, a CHKDSK may run when the disk resource is brought online, as described in step 5 of this procedure. Although this situation is recoverable through CHKDSK, you can avoid it by shutting down the other cluster nodes, although this may not be appropriate if the cluster is hosting other, currently functioning, applications and services.
  3. Partition and format the new disk drive as required. For a disk drive to be considered as a cluster-capable disk drive, it must be a Master Boot Record (MBR) format disk and must contain at least one NTFS file system partition. As an interim step, assign it a drive letter other than the drive letter it is replacing.
  4. Create a new physical disk resource for the new disk drive, using Cluster Administrator (or the cluster.exe command line utility).
  5. Make the disk drive visible to the same set of nodes as the disk drive that it is replacing (in a typical configuration, a disk driver is visible to all nodes in the server cluster). In the event that the device does not appear to the cluster nodes, you can perform a manual rescan for new hardware, using the device manager. At this stage, try to bring the disk resource online and then fail it over all nodes of the cluster, in turn, to ensure that the new physical disk is correctly configured and can be viewed from all nodes.
  6. Use ClusterRecovery to substitute the newly created physical disk resource for the failed resource. The Server Cluster Recovery Utility requires that the old and new disk resources are in the same resource group. It takes the resource group offline and transfers the properties of the old resource (such as failover policies and chkdsk settings) to the new resource. It also renames the old resource to have "(lost)" appended to the name and renames the new resource to be the same as the old resource. Any dependencies on the old resource are changed to point to the new resource.
  7. Change the drive letter of the new physical disk to match that of the failed disk. The new physical disk resource must be brought online first and then you can change the drive letter (on the node hosting the physical disk resource), using the Disk Management snap-in available via Computer Management.
  8. Once you have validated that the new resource is correctly installed, you should delete the old physical disk resource, as it no longer represents a real resource on the cluster.
  9. Once the cluster is configured, you should restore the application data to the new disk drive.


ClusterRecovery Remarks

Overview | Remarks | UI | Examples | Related Tools Run Tool

Disk failure recovery limited to physical disk types

Server cluster configurations manage disks on a shared storage infrastructure. These disks are visible from multiple nodes, although only one node in a server cluster can access any given disk at any point in time. In the event of the failure or corruption of a disk on the shared storage interconnect, take special care to restore the data and recover the applications.

The recovery capability provided by ClusterRecovery is only valid for disks that are managed in the cluster using the physical disk resource type. The recovery procedures for other types of cluster disks vary according to their configurations and features.


ClusterRecovery UI

Overview | Remarks | UI | Examples | Related Tools Run Tool

The ClusterRecovery Wizard has the following pages:

Connecting to a cluster

Connecting to a Cluster Wizard page options:

Option | Description
Cluster Name | Enter the name of a cluster or select the Browse button.
Browse | Opens a dialog box that allows you to select an available domain and view the names of existing clusters in that domain. After selecting the appropriate Domain and Cluster, select the Done button.
Recovery Options | Choose between Replace a physical disk resource and Restore cluster resource checkpoints. The choice you make determines which of the rest of the ClusterRecovery wizard pages become available to you.

Replace a physical disk resource

Replace a Physical Disk Resource Wizard page options:

Option | Description
Old physical disk resource | Select the disk that you are replacing.
New physical disk resource | Select the new disk.
Replace | Opens dialog box that reminds you to delete the old physical disk and rename the new physical disk with the drive letter of the old disk, once the disk replacement is complete. Click OK to continue with the disk replacement.
Cancel | Closes wizard without making any changes to the cluster.

Note

  • The old and new physical disk resources must belong to the same resource group for the replacement to succeed.

Restore cluster resource checkpoints

Restore Cluster Resource Checkpoints Wizard page options:

Option | Description
All resources | Re-creates checkpoint files for every cluster resource. Use this option if you are unsure which checkpoint files are missing or corrupt.
Specific resource | Re-creates the checkpoint files for a named resource. Enter the name of the resource, or use the Resource name dropdown box to select the resource.
Restore | Performs the restore for the checkpoint files of the selected cluster resources.
Cancel | Closes the wizard without making any changes.

The Connecting to a cluster page provides the options that determine which of the other two pages you need to access.


CmdHere Remarks

Overview | Remarks | Related Tools

Installing CmdHere

CmdHere is not installed by the Windows Server 2003 Resource Kit Setup.

To install CmdHere:

  1. In Windows Explorer, navigate to the directory where the Resource Kit is installed.
  2. Right-click Cmdhere.inf.
  3. Select Install on the shortcut menu.

Using CmdHere

To open a command-prompt session in a specific folder:

  1. Open Windows Explorer.
  2. In the Folders pane, right click the folder in which you want to open a command-prompt session.
  3. Click CMD Prompt Here on the shortcut menu.

Note

  • Not all objects visible in the Folders pane of Windows Explorer have the CMD Here Prompt item displayed on their shortcut menus.


CMGetCer Remarks

Overview | Remarks | Syntax | Related Tools

Creating a CM Profile by Using CMAK

To use CMGetCer, you need to create a Connection Manager (CM) profile by using the Connection Manager Administration Kit (CMAK). The CM profile must have a custom action of calling CMGetCer as a pre-tunnel or as a connect action.

To create a CM profile by using CMAK:

  1. Run the CMAK Wizard.
  2. Select Create a custom action.
  3. Select Client Policy-checking Script as the custom action for the policy.
  4. Under Edit Custom Action, enter cmgetcer.dll in the Program to run box, set Action type to Pre-tunnel or to Connect, and then set Run this custom action for to All connections.

    5. Note

    • Choose a pre-tunnel action if your certification authority (CA) is a third party with a Web site located outside the corporate local area network (LAN). Choose a connect action if are providing your own CA services within your corporate network by using a service like Microsoft Certificate Services.
  5. Select Include the custom action program with this service profile. In Parameters, enter the following:

    6. GetCertificate /type ProfileType /name %servicename% /dir %servicedir% /f ConfigFileName /a Action

    Note

    • For more information about syntax parameters, see CMGetCer Syntax.
  6. Click Next.

The profile you created is a self-extracting .exe file that you can distribute to users for installation on remote client computers. Distribution methods include CD, internal Web site, or manual installation. See CMAK Help for more information about distribution methods.

Sample Configuration File

The configuration file is required for the profile containing CMGetCer to run correctly. The configuration file looks and works much like an .ini file, with section headings set off by brackets ([]). The following table shows each section of the configuration file, and the possible settings for each.

The Main Section

Parameter/Value | Description
CertEnrolProfileName=Name | Names the enroll/bootstrap profile. This parameter is required if you have a bootstrap/enroll profile.
FullAccessProfileName=Name | Names the profile needed for full access to the corporate network. This parameter is required.
EnableCertDetection={0|1|2|3} Indicates whether or not to check for a valid certificate before proceeding.
  • 0 Do not check for a valid certificate, and do not enroll the user.
  • 1 Check for a valid certificate.
  • 2 Do not check, and always enroll the user.
  • 3 Check for a valid certificate, and check whether the certificate needs renewal.
This parameter is required.
CertRequestMethod={0|1|2|3} Indicates how to enroll for the certificate.
  • 0 Internet Web page.
  • 1 Corporate intranet Web page.
  • 2 Direct connection to the corporate network.
  • 3 Try a direct corporate network connection; if unsuccessful, try the Web page.
This parameter is required.
RenewalPeriod=Number | Specifies when a renewal should be attempted for the certificate. Number indicates the number of days before the expiration date of a certificate. This parameter is not required. If omitted, the default is seven days.
ShowUI={1|2} Indicates whether the UI is displayed.
  • 1 Display the UI.
  • 2 Hide the UI.
This parameter is not required. If omitted, the default setting is 1.

The UpdateConfigFile Section

Parameter/Value | Description
CheckForConfigFileUpdate={0|1} Indicates whether or not to perform a check for an updated configuration file.
  • 0 No
  • 1 Yes
This parameter is not required. If omitted, the default setting is 0.
UpdateURL=URL | Specifies the URL for a Web page that contains the updated configuration file. This parameter is not required.
Version=Number | Specifies the expected version number of the current configuration file. Decimal places are not acceptable; use integers only. This parameter is not required.

The CertDetection Section

Parameter/Value Description
CaseSensitiveDetect={0|1} Indicates whether the case of the text must match when checking the Issuer and Subject fields of the certificate.
  • 0 Case does not need to match.
  • 1 Case must match.
This parameter is not required. If omitted, the default setting is 1.
CertDetectIssues={0|1} Indicates whether there is a [CheckDetectIssuer] section in the configuration file.
  • 0 Ignore the [CheckDetectIssuer] section.
  • 1 Use the values in the [CheckDetectIssuer] section, and compare them to values in the Issuer field of the certificate.
This parameter is not required. If omitted, the default setting is 0.
CertDetectSubject={0|1} Indicates if there is a [CheckDetectSubject] section in the configuration file.
  • 0 Ignore the [CheckDetectSubject] section.
  • 1 Use the values in the [CheckDetectSubject] section, and compare them to values in the Subject field of the certificate.
This parameter is not required. If omitted the default setting is 0.
CertDetectAltSubject={0|1} Indicates whether there is a [CheckDetectAltSubject] section in the configuration file.
  • 0 Ignore the [CheckDetectAltSubject] section.
  • 1 Use the values in the [CheckDetectAltSubject] section, and compare them to values in the Subject field of the certificate.
This parameter is not yet implemented.
CertDetectUsage={0|1} Indicates whether there is a [CheckDetectUsage] section in the configuration file.
  • 0 Ignore the [CheckDetectUsage] section.
  • 1 Use the values in the [CheckDetectUsage] section, and compare them to values in the Usage field of the certificate.
This parameter is not required. If omitted, the default setting is 0.
LogicalLocation={0|1} Indicates the name of the certificate store.
  • 0 MY
  • 1 ROOT
This parameter is not required. If omitted, the default setting is 0. This setting is not available for Windows 98 or Windows Me operating systems.
SystemStore={0|1} Indicates where to check for the client certificate.
  • 0 LOCAL_MACHINE hive of the registry.
  • 1 CURRENT_USER hive of the registry.
This parameter is not required. If omitted, the default setting is 0. This setting is not available for Windows 98 or Windows Me operating systems.

The CertDetectIssuer Section

Include this section only if you want to check the values in the Issuer field of the certificate.

The CertDetectSubject Section

Include this section only if you want to check the values in the Subject field of the certificate.

The CertDetectAltSubject Section

Do not include this section. It is not yet implemented.

The CertDetectUsage Section

Include this section only if you want to check the values in the Usage field of the certificate.

The WebCertEnroll Section

Parameter/Value | Description
EnrollURL=URL | Specifies the URL for a Web page that allows the user to enroll for a certificate. This parameter is required.
CertDetectPollTimeOut=Number | Specifies the number of seconds to allow the certificate store to be polled for a specific certificate. This parameter is not required. If omitted, the default setting is 180 seconds.
CertDetectPollInterval=Number | Specifies the number of seconds allowed between polling attempts. This parameter is not required. If omitted, the default setting is 15 seconds.
CertDetectSleep=Number | Specifies the number of seconds to sleep after a certificate is detected. This parameter is not required. If omitted, the default setting is 10 seconds.

The DirectCertEnroll Section

Parameter/Value | Description
CertServer=Name | Specifies the name of the certificate server. This parameter is required.
CertServerCAName=Name | Specifies the name of the certification authority (CA) server. This parameter is required.
RequestStoreFlags={0|1} Indicates where the certificate store is located in the registry.
  • 0 Save the certificate in the LOCAL_MACHINE hive.
  • 1 Save the certificate in the CURRENT_USER hive.
This parameter is not required. If omitted, the default value is 0.
Template=Name | The name of the template for the certificate server to use. This parameter is not required.
Usage=OID | Specifies a valid object identifier (OID). If this parameter is not specified, the default is szOID_PKIX_KP_CLIENT_AUTH = 1.3.6.1.5.5.7.3.2.
Properties=Values | Lists other certificate properties and values that can be used. This parameter is not required. Other valid properties are DC= OU= O= L= S= C= CN= E= G= I= Street= SN= T=.

The following is a sample configuration file:

[Main]
CertEnrollProfileName=EnrollProfileName
FullAccessProfileName=FullAccessName
EnableCertDetection=1
CertRequestMethod=0
RenewalPeriod=7
ShowUI=1

[UpdateConfigFile]
CheckForConfigFileUpdate=0
UpdateURL=http://websrv/update/configfile.txt
Version=3

[CertDetection]
CertDetectIssuer=0
CertDetectSubject=1
CertDetectUsage=0
CertDetectAltSubject=0
LogicalLocation=0
SystemStore=0
;SystemStore=1
CaseSensitiveDetect=0

[CertDetectIssuer]
CN=SrvRootCA

[CertDetectSubject]
S=CA

[CertDetectAltSubject]
domain.com

[CertDetectUsage]
1.3.6.1.5.5.7.3.2

[WebCertEnroll]
EnrollURL=http://websrv/certsrv
CertDetectPollTimeOut=10
CertDetectPollInterval=20
CertDetectSleep=5

[DirectCertEnroll]
CertServer=Websrv
CertServerCAName=SrvRootCA
GetMachineName=1
CAStore=0
Template=Machine
Usage=1.3.6.1.5.5.8.2.2
CN=Computers
DC=contoso
DC=com
OU=IT
O=Template
L=City
S=WA
C=US

Note

  • If only one profile is configured, it should be set as /type 0 (full access profile), and the CertEnrollProfileName value in the configuration file must be empty or not present.


CMGetCer Syntax

Overview | Remarks | Syntax | Related Tools

CMGetCer does not work at the command line. This syntax can only be used in Connection Manager (CM) as part of a profile. For information about creating the profile by using the Connection Manager Administration Kit (CMAK), see the Remarks page.

CMGetCer uses the following syntax:

One Step getcertificate /type ProfileType /name ProfileName /dir ConfigPath /f ConfigFileName /a Action

Parameters

/type ProfileType
Specifies the type of profile. Use 0 to indicate a full access profile. Use 1 to indicate a certificate enroll/bootstrap profile. If your certification authority (CA) is located within the corporate network, you will need to configure a full access profile and a bootstrap/enroll profile. The bootstrap/enroll profile is for use before users have downloaded a certificate. The full access profile is for use once remote users have a certificate loaded on their computer.
/name ProfileName
Enter a profile name. This name must exactly match the name in the section labeled [Main] in the configuration file specified in the /f parameter. You can use the CM variable %servicename% for ProfileName.
/dir ConfigPath
Enter the full path to the location of the profile specified in the /name parameter. You can use the CM variable %servicedir% for ConfigPath.
/f ConfigFileName
Specifies the name of the configuration file. This file contains all enrollment-specific settings for the connection.
/a Action
Specifies the action that the profile should perform. Use 0 to check whether a certificate exists for the user. No other processing is done with this action. Use 1 to process the profile normally and follow the instructions in the configuration file.


Compress Examples

Example 1: Compress a File Using MS-ZIP Compression

To compress a file using MS-ZIP compression, type the following at the command line:

compress /z C:\test.txt c:\temp

Output similar to the following displays:

Microsoft (R) File Compression Utility  Version 5.00.2134.1
Copyright (C) Microsoft Corp. 1990-1999.  All rights reserved.

Compressing c:\test.txt to c:\temp\test.txt using MS-ZIP compression.
c:\test.txt: 905 bytes compressed to 277 bytes, 70% savings.

Example 2: Compress a File Using Quantum Compression

To compress a file using quantum compression, type the following at the command line:

compress /zq7 c:\temp\test.txt c:\results

Press ENTER. Output similar to the following displays:

Microsoft (R) File Compression Utility  Version 5.00.2134.1
Copyright (C) Microsoft Corp. 1990-1999.  All rights reserved.

Compressing c:\temp\test.txt to c:\results\test.txt using QUANTUM compression.
Compression level : 7.
Memory window size: 15.
c:\temp\test.txt: 905 bytes compressed to 259 bytes, 72% savings.


Compress Remarks

File Compression

Many large files are compressed to make efficient use of disk space, . Compression allows you to reduce the overall number of bits and bytes in a file so it can be transmitted faster over slow Internet connections, or take up less space on a disk. Compressed files may contain single files or groups of files that have been bundled together into a single compressed file. This type of file sometimes contains video or graphics files within it, and often contains software programs with related documentation.

Compression software uses complex mathematical equations such as algorithms to scan a file for repeating patterns in the data. It replaces the data with smaller codes that take up less room. For example, one way that compression software works is to replace repeating text characters with a code that also notes the locations of those characters in the data. With a picture for example, it would find all of the red pieces and replace them with a code. To view compressed files, you need a compatible decompression program that can read these codes and convert the data back to its original form.

Quantum compression is a large-window compressor combined with an integer arithmetic coder that achieves compressed file sizes ten to fifteen percent smaller than MSZIP. In order to achieve these results, quantum compression can require a large amount of memory (up to 12 MB) at compress time, and even at decompress time (configurable from 1K to 2 MB). Quantum compression gets its best results on large data streams. For this reason, cabinet files and quantum compression work well together, because cabinet files with large folders ensure that quantum compression is always compressing big blocks of data.

The .cab file format is a nonproprietary compression format, also known as MSZIP, that is based on the Lempel-Ziv data-compression algorithm. Lempel-Ziv (LZ) Compression is an algorithm that encodes a string of bits by dividing it into phrases, and then describes the stream as a series of pairs. Each pair forms a new phrase, and contains a number (identifier of a previous phrase) and a bit (which is appended to the previous phrase). This encoding is bulky, but once applied to a suitable string, it results in an efficient encoding (compression). The algorithm is easily implemented even in low level languages.


Compress Syntax

Compress uses the following syntax:

One Step compress [/r] [/d] [/zx] [/z] [/zq[n]] Source Destination [/?]

Parameters

/r
Renames expanded files. Compressed files are renamed with the last character in the file name extension set to an underscore ("_") character. The underscore identifies the file as a compressed file.
/d
Specifies that only out of date files within Destination are updated.
/zx
Specifies Lempel-Ziv (LZX) compression. The LZX compression can reduce the package size by up to 18 percent and increase the self-extracting speed by approximately 50 percent.
/z
Specifies MS-ZIP compression. This compression is also known as the .cab file format. It is based on the Lempel-Ziv data-compression algorithm.
/zq[n]
Specifies quantum compression. Valid values for n are in the range 1 to 7 (1 yields the fastest speed while 7 gives best compression). The default value for n is 4.
Source
Specifies the source file. The * and ? wildcard characters can be used.
Destination
Specifies the destination file or path. The Destination can be a directory. If Source specifies multiple files and /r is not specified, then Destination must be a directory. If the destination listed on the command line does not include a new file name for the compressed file, the file's original name is used (a new name is required to save the compressed file in the same folder as the original).
-?
Shows command-line help.


ConfDisk Examples

Example 1: Save a Configuration to a SaveFile

To save a configuration to SaveFile, type the following at the command line:

confdisk /save c:\asr.sif

Press ENTER. This saves the configuration to the file asr.sif.

Note

  • SaveFile is a file with a .sif file type.

Example 2: Restore a Configuration from a SaveFile

To restore a configuration from SaveFile, type the following at the command line:

confdisk /restore c:\asr.sif

Press ENTER. This restores the configuration from the file asr.sif.

Note

  • SaveFile is a file with a .sif file type.


ConfDisk Remarks

Using ConfDisk

Running ConfDisk Remotely

ConfDisk must be run on the a server that belongs to the cluster.

.sif files must be created before a failure

ConfDisk uses a .sif file to restore a cluster after a hard disk failure. If the .sif file is not created prior to the failure, ConfDisk does not have the information it needs to restore the cluster.

Viewing a Sample .sif file created by ConfDisk

ConfDisk uses Automated System Recovery (ASR) to create a file that saves the configuration information of a local cluster. A .sif file created by ConfDisk looks similar to the following:

;
; Microsoft Windows Automated System Recovery State Information File
;

[VERSION]
Signature="$Windows NT$"
ASR-Version="1.0"

[SYSTEMS]
1="CLUSTER1","x86","5.2","C:\WINDOWS",1,0x00030112,"480 0 -60 0-10-0-5 2:00:00.0 0-4-0-1 2:00:00.0","Pacific Standard Time","Pacific Daylight Time"

[BUSES]
1=1,3

[DISKS.MBR]
1=1,1,1,0xdd8fdd8f,512,63,255,8440992

[DISKS.GPT]

[PARTITIONS.MBR]
1=1,0,0,,0x00,0x05,0x05,16065,5108670,0x0
2=1,1,2,"\??\Volume{0e463253-5399-11d6-8ea4-806d6172696f}",0x80,0x07,0x07,5124735,3309390,0x800
3=1,4,1,"\??\Volume{0e463256-5399-11d6-8ea4-806d6172696f}",0x00,0x07,0x07,16128,5108607,0x1000

[PARTITIONS.GPT]

[COMMANDS]
1=1,3000,0,"%SystemRoot%\system32\asr_fmt.exe","/restore"
2=1,2000,1,"%SystemRoot%\system32\asr_ldm.exe","/restore"
3=1,4990,1,"%SystemRoot%\system32\asr_pfu.exe","/restore"

[ASRFMT.FIXEDVOLUMES]
1=1,"\??\Volume{0e463256-5399-11d6-8ea4-806d6172696f}","\DosDevices\C:",NTFS,"",0x1000
2=1,"\??\Volume{0e463253-5399-11d6-8ea4-806d6172696f}","\DosDevices\D:",NTFS,"New Volume",0x800

[ASRFMT.REMOVABLEMEDIA]
1=1,"\Device\CdRom0","\??\Volume{0e463251-5399-11d6-8ea4-806d6172696f}","\DosDevices\E:"
2=1,"\Device\Floppy0","\??\Volume{0e463250-5399-11d6-8ea4-806d6172696f}","\DosDevices\A:"

[ASRLDM.VOLUMESTATE]
0,      34,   1, 125,"LDM Configuration","Microsoft0"

Files created by ASR may be edited. See the MSDN Knowledge Base article Q299044 (http://go.microsoft.com/fwlink/?LinkID=14982) for more information.


ConfDisk Syntax

ConfDisk uses the following syntax:

One Step confdisk {/save SaveFile|/restore RestoreFile}

Parameters

/save SaveFile
Specifies that the cluster configuration information be saved to SaveFile. SaveFile is created by ASR as a .sif file type.

Note

  • If SaveFile already exists, it will be overwritten with no warning.
/restore RestoreFile
Specifies that the configuration be restored from RestoreFile. RestoreFile is a file with a .sif file type.

Note

  • If RestoreFile does not exist, the following error is displayed:

    Error 2 876 The system cannot find the file specified.

Note

  • When run without parameters, ConfDisk displays command-line help.


Consume Examples

Example 1: Consume Physical Memory for a Fixed Time

To test an application in a low memory situation, type the following at the command line:

consume -physical-memory -time 120

Press ENTER. Output similar to the following is displayed:

Consume: Message: Time out after 120 seconds.
Consume: Message: Successfully assigned process to a job object ...
Consume: Message: Total physical memory: FF7C000
Consume: Message: Available physical memory: A1C6000
Consume: Message: Will attempt to create 1 baby consumers ...
Consume: Message: Sleeping ...

After the output display is complete, a second command window opens and fills with periods while Consume runs. This is the time to run the application being tested to see if the low memory situation affects the way it runs and, if so, for how long.

At the end of the 120 second interval, the secondary window closes, and the command prompt is displayed in the primary command window.

Example 2: Consume Processor Resources Indefinitely

To test your application on a system with less processor power, type the following at the command line:

consume -cpu-time

Press ENTER. Output similar to the following is displayed:

Consume: Message: Attempting to start 128 threads ...
................................................................................
................................................
Consume: Message: Sleeping ...

This is the time to run the application being tested to see if the low processor resources affect the way it runs, and, if so, for how long.

Important

  • Consume continues to tie up cpu-processor resources until you choose to stop it. To stop running Consume and return to the command prompt, press CTRL+C in the command window.


Consume Remarks

Monitoring Consumed Resources

Consume uses up a specified resource so that software applications can be tested in a low-resource situation. You can observe the effects of this resource consumption by using Task Manager or System Monitor, both of which are included with Windows Server 2003.


Consume Syntax

Consume uses the following syntax:

One Step consume {-physical-memory | -page-file | -disk-space | -cpu-time | -kernel-pool} [-time Seconds]

Parameters

-physical-memory
Consumes as much physical memory as possible to force applications to operate on less than normal memory amounts.
-page-file
Consumes the page file. This parameter simulates the most typical out-of-memory condition. When you use this parameter and other processes try to allocate memory, they start failing.
-disk-space
Consumes disk space.
-cpu-time
Consumes processor time by creating 128 normal priority threads.
-kernel-pool
Consumes the kernel pool. This parameter consumes as much of the kernel pool (non-paged pool) as possible. Virtually all kernel-mode components use the non-paged pool to allocate memory. Using this parameter creates memory pressure conditions for them.
-time Seconds
Specifies the number of seconds to consume the specified resource.

Note

  • Consume parameters do not use the slash (/) character.


CreatFil Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Create a Dummy File

To create a dummy file as part of a test, type the following at the command line:

creatfil workfile.dat 100

This creates a 100 KB (102,400 byte) blank file called Workfile.dat. Each of the bytes is a space character.


CreatFil Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

CreatFil uses the following syntax:

One Step creatfil [Path] FileName [FileSize] [/?]

Parameters

Path
Specifies the path to an existing directory on the hard disk where the file is to be created. The default is the folder from which Creatfil.exe is run.
FileName
Specifies the name of the file to create.
FileSize
Specifies the size of the file to create, in units of one kilobyte (1024 bytes). This argument is optional. The default is 1024 kilobytes.
/?
Displays command-line usage.


CSCcmd Examples

Example 1: Discontinue Caching the Large Number of Files From the \\SalesDocs Server to the Client Computer When the Client is Working Offline

The task in this example is to disconnect the availability of network files on the \\SalesDocs server when the client is working offline.

To disconnect from the \\SalesDocs server, type the following at the command line:

csccmd /Disconnect:\\SalesDocs\DocArchive

Press ENTER. Now the client can only access files from the server that are already in the CSC cache. This is the same behavior as if the client had lost connectivity to the server. The client can still access the contents of the share but only what is in the CSC cache.

Output similar to the following is displayed:

The command completed successfully.

Note

  • You can reconnect to the server by forcing a synchronization of files. For more information, see the Reconnecting to a Server section on the Remarks page.

Example 2: Disable Caching Between All Connected Servers and the Client

The task in this example is to disable the use of network files when the client is working offline.

To disable client side caching, type the following at the command line:

csccmd /Disable

Press ENTER. This disables client side caching and does not allow the client an opportunity to reconnect.

Output similar to the following is displayed:

The command completed successfully.


CSCcmd Remarks

Using CSCcmd

Client Side Caching (CSC), also known as the Offline Files, uses a folder structure located in the %SystemRoot%\CSC folder. This folder is hidden by default because modifying it directly can result in data loss and a complete breakdown of Offline Files functionality. Instead of modifying it directly, you can use CSCcmd to enable client side caching, disable caching, disconnect a client computer from an offline share, and move all files in the database to a new share. You can also use this tool to re-stamp your user account with a new SID to gain access to your files after your account has been migrated from one type of domain to another.

Enabling CSC

If you run CSCCmd and receive an error indicating that CSC is not enabled on this computer, you can use Windows Explorer or the CSCcmd tool to enable CSC.

To enable CSC using CSCcmd,

  1. Type the following at the command line:

    csccmd /enable

  2. Press ENTER.

Note

  • If you receive an error, make sure that Remote Desktop is not enabled.

To enable CSC using Windows Explorer,

  1. Click Start, and then click My Computer.
  2. On the Tools menu, click Folder Options.
  3. On the Offline Files tab, make sure that the Enable Offline Files check box is selected.
  4. Select Synchronize all offline files before logging off to get a full synchronization. Leave it unselected for a quick synchronization.

Note

  • If you cannot use Offline files, such as when your server is an application server, this will be explained on the Offline Files tab.

Using Client Side Caching with Fast User Switching

Fast User Switching, a feature of Windows XP Home Edition and Windows XP Professional when it is not joined to a domain, makes it possible for you to quickly switch between users without actually logging off the computer. Multiple users can share a computer and use it simultaneously, switching back and forth without closing the programs they are running.

Fast user switching and client side caching do not interoperate on Windows XP. If you are running Windows XP and want to use fast user switching, disable client side caching.

Reconnecting to a Server

After you run the Client Side Caching Command (CSCcmd) tool to disconnect from a server, an icon appears in your system icon tray and displays the following message:

Offline Files - Working offline

You are no longer connected to 'ServerName'.
You can continue working normally.
Click this icon to view status.

You cannot reconnect to the server using CSCcmd. To reconnect with the server and reestablish offline file use, you must re-synchronize.

To reconnect with the server:

  1. Click the computer icon in the system icon tray.
  2. In the Offline Files Status window, under Computer, check the box next to the computer name with which you want to synchronize, and click OK.

A Synchronizing window opens and begins to synchronize files with the server. Only after a successful synchronization are you successfully reconnected to the server.


CSCcmd Syntax

Client Side Caching Command (CSCcmd) uses the following syntax:

One Step csccmd [/resid] [/enable] [/disable] [/disconnect:\\server\share] [/moveshare:\\server\share1 \\server\share2] [/?]

Parameters

/enable
Allows you to access and synchronize network files while working offline.

Note

  • You must be an Administrator on the local computer to use this parameter.
/disable
Denies all access to network files while working offline.

Notes

  • You must be an Administrator on the local computer to use this parameter.
  • You must close all files in the cache before using this parameter. Otherwise, you will get an error message stating that the requested resource is in use.
/resid
Re-stamps all the entries in the Client Side Caching (CSC) database with a new user Security Identifier (SID). Use this parameter after your user account is migrated from one type of domain, such as Windows NT 4.0, to another domain, such as Windows 2000.
/disconnect:\\server\share
Disconnects the client computer from the specified server. Use this option when network connectivity is so poor that it is not feasible to stay connected to shares that are offline.

Notes

  • To use this option, the client computer must be running Windows Server 2003, Windows XP, Windows 2000 SP3 clients, or Windows 2000 clients that have applied QFE Q293426.
  • To re-connect you must force a synchronization of files from Windows Explorer, or by clicking on the icon tray at the bottom of your screen.
/moveshare: \\server\share1 \\server\share2
Remaps the files in the CSC cache on \\server\share1 to the \\server\share2 location. Use this parameter to migrate to a new namespace. To move the CSC cache itself between two locations, use the cachemov tool.
/?
Displays the command-line usage.


DelProf Examples

Example 1: Using DelProf to Delete User Profiles

Type the following at the command line:

delprof /p /c:\\server1

Press ENTER. The following output is displayed:

Delete \\SERVER1\D$\Documents and Settings\User1? (Yes/No/All)

For each user profile that you are prompted to delete, Type y, and then press ENTER.

Example 2: Using DelProf to Delete User Profiles After a Specified Period of Inactivity

To delete user profiles after 30 days of inactivity, type the following at the command line:

delprof /p /d:30

Press ENTER. A message is displayed for each user profile that has not been used on the computer for 30 days, prompting you to confirm its deletion:

Delete \\MYCOMPUTER\D$\Documents and Settings\User2? (Yes/No/All)

For each user profile that you are prompted to delete, type y, and then press ENTER.


DelProf Remarks

Deleting Your Own Profile

If a user is logged on locally to a machine and attempts to delete his or her own profile, a message will appear stating that the profile is currently in use and cannot be deleted. The user must log off, log back on using a different account with administrator privileges, and delete the profile. In addition, if a service is running for a particular user account, the same message may appear. If this happens, stop the service and then delete the profile.

Troubleshooting DelProf

When you try to run DelProf against a remote computer on the network, the tool may not work. This can occur when the remote computer name includes a hyphen or a space. To resolve this behavior, upgrade your computer to Microsoft Windows 2000 Professional, Windows XP Professional, Windows 2000 Server, or Windows Server 2003 operating systems. Alternatively, you can change the remote computer name so that it does not contain a hyphen or a space.


DelProf Syntax

DelProf uses the following syntax:

One Step delprof [/q] [/i] [/p] [/r] [/c:\\ComputerName] [/d:days] [/?]

Parameters:

/q
Runs DelProf in quiet mode, with no confirmation for each profile to be deleted.
/i
Indicates that DelProf should ignore errors and continue deleting.
/p
Prompts for confirmation before deleting each profile.
/r
Specifies that DelProf should only delete cached roaming profiles. Local Profiles will not be deleted.
/c:\\ComputerName
Specifies a remote computer name on which to run DelProf.
/d:days
Specifies the number of days of inactivity (days is an integer). Profiles with longer inactivity are deleted.
/?
Displays command-line syntax.


DH Examples

Example 1: Use the UMDH Parameter to Get a Quick Snapshot of Memory Dumped to a Log File

Type the following at the command line:

umdh.exe -p:704 -f:umdh.dmp

Press ENTER. Output similar to the following is displayed:

UMDH: version 5.2.3678.0: Logtime 2002-10-21 10:53 - Machine=NBATCHU-DEV2 - PID=3812
//

// Operating System version 5.2
// Umdh Operating System version 5.2
// Debug privilege has been enabled.
// Connecting to process 3812 ...
// Process 3812 opened  (handle=2004) ...
// Debug options set: 00000007
// Debug library initialized ...
// Module enumeration completed.
// Reading target process trace database ...
// Database size 00800000
// Trace database read.
// Stack trace data base @ 00090000
// # traces in the data base 146

 - - - - - - - - - - Heap summary - - - - - - - - - -

    00890000
    00990000
    009A0000
    00F70000
    00FB0000

*- - - - - - - - - - Start of data for heap @ 00890000 - - - - - - - - - -

    Flags: 58000062
    Number Of Entries: 76
    Number Of Tags: <unknown>
    Bytes Allocated: 00006EB0
    Bytes Committed: 00008000
    Total FreeSpace: 00001150
    Number of Virtual Address chunks used: 1
    Address Space Used: <unknown>
    Entry Overhead: 8
    Creator:  (Backtrace00000)
No trace was saved for this allocation (Index == 0).
*- - - - - - - - - - Heap 00890000 Hogs - - - - - - - - - -

00000118 bytes in 0x5 allocations (@ 0x00000038) by: BackTrace00065
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        kernel32!InitializeCriticalSectionAndSpinCount+00000012

00000118 bytes in 0x5 allocations (@ 0x00000038) by: BackTrace00123
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        kernel32!InitializeCriticalSectionAndSpinCount+00000012
        UxTheme!ProcessStartUp+00000032
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpLoadDll+00000343
        ntdll!LdrLoadDll+0000013C
        kernel32!LoadLibraryExW+000001AF
        kernel32!LoadLibraryExA+0000001D
        COMCTL32!__tailMerge_UxTheme+0000000D

000000E0 bytes in 0x4 allocations (@ 0x00000038) by: BackTrace00018
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        kernel32!InitializeCriticalSectionAndSpinCount+00000012
        msvcrt!_mtinitlocks+0000002B
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

000000E0 bytes in 0x4 allocations (@ 0x00000038) by: BackTrace00063
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        kernel32!InitializeCriticalSectionAndSpinCount+00000012
        SHELL32!_DllMainCRTStartup+00000050
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

000000A8 bytes in 0x3 allocations (@ 0x00000038) by: BackTrace00070
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        ntdll!RtlInitializeCriticalSection+0000000B
        SHELL32!ATL::CComModule::Init+00000028
        SHELL32!_DllMainCRTStartup+00000050
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

000000A8 bytes in 0x3 allocations (@ 0x00000038) by: BackTrace00089
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        kernel32!InitializeCriticalSectionAndSpinCount+00000012
        WINSPOOL!PerfClose+000018C7
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

000001E0 bytes in 0x2 allocations (@ 0x000000F0) by: BackTrace00061
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpInsertAssemblyStorageMapEntry+00000082
        ntdll!RtlpResolveAssemblyStorageMapEntry+0000058F

00000070 bytes in 0x2 allocations (@ 0x00000038) by: BackTrace00081
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        kernel32!InitializeCriticalSectionAndSpinCount+00000012
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000070 bytes in 0x2 allocations (@ 0x00000038) by: BackTrace00121
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        kernel32!InitializeCriticalSectionAndSpinCount+00000012
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpLoadDll+00000343
        ntdll!LdrLoadDll+0000013C
        kernel32!LoadLibraryExW+000001AF
        kernel32!LoadLibraryExA+0000001D
        COMCTL32!__tailMerge_UxTheme+0000000D

00001048 bytes by: BackTrace00094
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!LocalAlloc+00000058
        notepad!InitStrings+0000001D
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

00000940 bytes by: BackTrace00006
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        RPCRT4!I_RpcProxyNewConnection+0001156A
        RPCRT4!NdrTypeFlags+00002BF6
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000630 bytes by: BackTrace00056
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateActivationContextStackFrame+000000C7
        ntdll!RtlActivateActivationContextEx+00000050
        ntdll!RtlActivateActivationContext+00000029
        kernel32!ActivateActCtx+0000001E
        SHELL32!DelayLoadCC+00000015
        SHELL32!SHFusionInitializeFromModuleID+0000003A
        SHELL32!_ProcessAttach+00000030
        SHELL32!_DllMainCRTStartup+00000050
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000618 bytes by: BackTrace00142
        ntdll!RtlReAllocateHeap+000001B0
        COMCTL32!Edit_SetFont+000001D5
        COMCTL32!Edit_WndProc+0000031F
        USER32!InternalCallWinProc+0000001B
        USER32!UserCallWinProcCheckWow+00000151
        USER32!SendMessageWorker+000004AB
        USER32!SendMessageW+0000007D
        notepad!NPInit+0000036B
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

00000418 bytes by: BackTrace00129
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        GDI32!bGetANSISetMap+0000006C
        GDI32!pcfLocateCFONT+00000168
        GDI32!GdiGetCharDimensions+0000007A
        COMCTL32!UserGetCharDimensionsEx+0000003D
        COMCTL32!Edit_SetFont+000000A9
        COMCTL32!EditML_Create+000000C1
        COMCTL32!Edit_WndProc+00000BD9
        USER32!InternalCallWinProc+0000001B
        USER32!UserCallWinProcCheckWow+00000151
        USER32!DispatchClientMessage+000000A3
        USER32!__fnINLPCREATESTRUCT+00000089
        ntdll!KiUserCallbackDispatcher+00000013
        USER32!_CreateWindowEx+000001EB
        USER32!CreateWindowExW+00000031
        notepad!NPInit+000001EF
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

000002C0 bytes by: BackTrace00138
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        GDI32!pcfAllocCFONT+0000005C
        GDI32!pcfLocateCFONT+0000020D
        GDI32!GetTextMetricsW+00000066
        COMCTL32!CIInitialize+00000064
        COMCTL32!InitStatusWnd+00000056
        COMCTL32!StatusWndProc+000002D9
        USER32!InternalCallWinProc+0000001B
        USER32!UserCallWinProcCheckWow+00000151
        USER32!DispatchClientMessage+000000A3
        USER32!__fnINLPCREATESTRUCT+00000089
        ntdll!KiUserCallbackDispatcher+00000013
        USER32!_CreateWindowEx+000001EB
        USER32!CreateWindowExW+00000031
        COMCTL32!SHFusionCreateWindowEx+0000004B
        COMCTL32!CreateStatusWindowW+00000032
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

000002C0 bytes by: BackTrace00141
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        GDI32!pcfAllocCFONT+0000005C
        GDI32!pcfLocateCFONT+0000020D
        GDI32!GdiGetCharDimensions+0000007A
        COMCTL32!UserGetCharDimensionsEx+0000003D
        COMCTL32!Edit_SetFont+00000071
        COMCTL32!Edit_WndProc+0000031F
        USER32!InternalCallWinProc+0000001B
        USER32!UserCallWinProcCheckWow+00000151
        USER32!SendMessageWorker+000004AB
        USER32!SendMessageW+0000007D
        notepad!NPInit+0000036B
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

00000220 bytes by: BackTrace00020
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!FlsAlloc+000000A5
        msvcrt!_mtinit+0000009A
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000218 bytes by: BackTrace00019
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!FlsAlloc+0000005A
        msvcrt!_mtinit+0000009A
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000140 bytes by: BackTrace00110
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        COMCTL32!Edit_WndProc+00000486
        USER32!InternalCallWinProc+0000001B
        USER32!UserCallWinProcCheckWow+00000151
        USER32!DispatchClientMessage+000000A3
        USER32!__fnINLPCREATESTRUCT+00000089
        ntdll!KiUserCallbackDispatcher+00000013
        USER32!_CreateWindowEx+000001EB
        USER32!CreateWindowExW+00000031
        notepad!NPInit+000001EF
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

00000118 bytes by: BackTrace00044
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!LocalAlloc+00000058
        USER32!RealSystemParametersInfoW+000001B5
        USER32!SystemParametersInfoW+00000056
        COMCTL32!InitGlobalMetrics+0000016F
        COMCTL32!_ProcessAttach+00000049
        COMCTL32!LibMain+0000001F
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

000000F8 bytes by: BackTrace00041
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlCreateActivationContext+000000B3
        kernel32!CreateActCtxW+0000065E
        COMCTL32!SHFusionInitializeIDCC+0000006F
        COMCTL32!SHFusionInitializeID+0000000F
        COMCTL32!LibMain+0000001F
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

000000F8 bytes by: BackTrace00054
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlCreateActivationContext+000000B3
        kernel32!CreateActCtxW+0000065E
        SHELL32!SHFusionInitializeIDCC+0000006E
        SHELL32!SHFusionInitializeFromModuleID+0000003A
        SHELL32!_ProcessAttach+00000030
        SHELL32!_DllMainCRTStartup+00000050
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

000000A0 bytes by: BackTrace00135
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!LocalAlloc+00000058
        COMCTL32!InitStatusWnd+00000018
        COMCTL32!StatusWndProc+000002D9
        USER32!InternalCallWinProc+0000001B
        USER32!UserCallWinProcCheckWow+00000151
        USER32!DispatchClientMessage+000000A3
        USER32!__fnINLPCREATESTRUCT+00000089
        ntdll!KiUserCallbackDispatcher+00000013
        USER32!_CreateWindowEx+000001EB
        USER32!CreateWindowExW+00000031
        COMCTL32!SHFusionCreateWindowEx+0000004B
        COMCTL32!CreateStatusWindowW+00000032
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

00000068 bytes by: BackTrace00137
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        GDI32!plfCreateLOCALFONT+0000002A

00000060 bytes by: BackTrace00022
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!GetStartupInfoA+0000003F
        msvcrt!_ioinit+0000001B
        msvcrt!_CRTDLL_INIT+000000F2
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000058 bytes by: BackTrace00111
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!LocalAlloc+000000C3
        COMCTL32!Edit_NcCreate+00000119

00000058 bytes by: BackTrace00140
        ntdll!RtlReAllocateHeap+000001B0
        kernel32!LocalReAlloc+000001B6
        COMCTL32!CCLocalReAlloc+0000001D
        COMCTL32!SetStatusParts+000000B1
        COMCTL32!StatusWndProc+000006EE
        USER32!InternalCallWinProc+0000001B
        USER32!UserCallWinProcCheckWow+00000151
        USER32!SendMessageWorker+000004AB
        USER32!SendMessageW+0000007D
        notepad!NPInit+0000027C
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

00000040 bytes by: BackTrace00146
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!LocalAlloc+00000058
        COMCTL32!SetStatusText+000000C6
        COMCTL32!SBSetText+00000076
        COMCTL32!StatusWndProc+00000097
        USER32!InternalCallWinProc+0000001B
        USER32!UserCallWinProcCheckWow+00000151
        USER32!SendMessageWorker+000004AB
        USER32!SendMessageW+0000007D
        notepad!SetTitle+000000FC
        notepad!NPInit+000003A9
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

00000038 bytes by: BackTrace00027
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        ntdll!RtlInitializeCriticalSection+0000000B
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000038 bytes by: BackTrace00042
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        kernel32!InitializeCriticalSectionAndSpinCount+00000012
        COMCTL32!LibMain+0000001F
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000038 bytes by: BackTrace00083
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlpAllocateDebugInfo+00000022
        ntdll!RtlCreateHeap+000004CE
        ntdll!RtlDebugCreateHeap+0000018C
        ntdll!RtlCreateHeap+00000224
        kernel32!HeapCreate+00000051
        WINSPOOL!PerfClose+00000747
        WINSPOOL!PerfClose+000018C7
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000028 bytes by: BackTrace00024
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!NtdllpAllocateStringRoutine+00000017
        kernel32!GetStartupInfoA+000000EA
        msvcrt!_ioinit+0000001B
        msvcrt!_CRTDLL_INIT+000000F2
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000028 bytes by: BackTrace00025
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!NtdllpAllocateStringRoutine+00000017
        kernel32!GetStartupInfoA+00000103
        msvcrt!_ioinit+0000001B
        msvcrt!_CRTDLL_INIT+000000F2
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000028 bytes by: BackTrace00097
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!LocalAlloc+00000058
        USER32!AddAccResource+0000000B
        USER32!LoadAcceleratorsW+0000001C
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

00000020 bytes by: BackTrace00008
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!LocalAlloc+00000058
        ADVAPI32!AppmgmtInitialize+0000001E
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000020 bytes by: BackTrace00023
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!NtdllpAllocateStringRoutine+00000017
        kernel32!GetStartupInfoA+000000D1
        msvcrt!_ioinit+0000001B
        msvcrt!_CRTDLL_INIT+000000F2
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000020 bytes by: BackTrace00128
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!LocalAlloc+00000058
        COMCTL32!EditML_Create+0000002C
        COMCTL32!Edit_WndProc+00000BD9
        USER32!InternalCallWinProc+0000001B
        USER32!UserCallWinProcCheckWow+00000151
        USER32!DispatchClientMessage+000000A3
        USER32!__fnINLPCREATESTRUCT+00000089
        ntdll!KiUserCallbackDispatcher+00000013
        USER32!_CreateWindowEx+000001EB
        USER32!CreateWindowExW+00000031
        notepad!NPInit+000001EF
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

00000020 bytes by: BackTrace00145
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        kernel32!LocalAlloc+000000C3
        notepad!NPInit+00000386
        notepad!WinMain+00000048
        notepad!WinMainCRTStartup+00000182
        kernel32!BaseProcessStart+00000023

*- - - - - - - - - - End of data for heap @ 00890000 - - - - - - - - - -

*- - - - - - - - - - Start of data for heap @ 00990000 - - - - - - - - - -

    Flags: 58001062
    Number Of Entries: 28
    Number Of Tags: <unknown>
    Bytes Allocated: 00002928
    Bytes Committed: 00006000
    Total FreeSpace: 000036D8
    Number of Virtual Address chunks used: 1
    Address Space Used: <unknown>
    Entry Overhead: 8
    Creator:  (Backtrace00000)
No trace was saved for this allocation (Index == 0).
*- - - - - - - - - - Heap 00990000 Hogs - - - - - - - - - -

00000068 bytes by: BackTrace00120
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!LdrpAllocateDataTableEntry+0000002D
        ntdll!LdrpLoadDll+0000017E
        ntdll!LdrLoadDll+0000013C
        kernel32!LoadLibraryExW+000001AF
        kernel32!LoadLibraryExA+0000001D
        COMCTL32!__tailMerge_UxTheme+0000000D

00000058 bytes by: BackTrace00118
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!LdrpAllocateUnicodeString+00000032
        ntdll!LdrpMapDll+00000149
        ntdll!LdrpLoadDll+0000017E
        ntdll!LdrLoadDll+0000013C
        kernel32!LoadLibraryExW+000001AF
        kernel32!LoadLibraryExA+0000001D
        COMCTL32!__tailMerge_UxTheme+0000000D

*- - - - - - - - - - End of data for heap @ 00990000 - - - - - - - - - -

*- - - - - - - - - - Start of data for heap @ 009A0000 - - - - - - - - - -

    Flags: 58008060
    Number Of Entries: 1
    Number Of Tags: <unknown>
    Bytes Allocated: 00000680
    Bytes Committed: 00001000
    Total FreeSpace: 00000980
    Number of Virtual Address chunks used: 1
    Address Space Used: <unknown>
    Entry Overhead: 8
    Creator:  (Backtrace00000)
No trace was saved for this allocation (Index == 0).
*- - - - - - - - - - Heap 009A0000 Hogs - - - - - - - - - -

*- - - - - - - - - - End of data for heap @ 009A0000 - - - - - - - - - -

*- - - - - - - - - - Start of data for heap @ 00F70000 - - - - - - - - - -

    Flags: 58001062
    Number Of Entries: 141
    Number Of Tags: <unknown>
    Bytes Allocated: 00005460
    Bytes Committed: 00006000
    Total FreeSpace: 00000BA0
    Number of Virtual Address chunks used: 1
    Address Space Used: <unknown>
    Entry Overhead: 8
    Creator:  (Backtrace00014)
        ntdll!RtlCreateHeap+00000224
        kernel32!HeapCreate+00000051
        msvcrt!_heap_init+00000017
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

*- - - - - - - - - - Heap 00F70000 Hogs - - - - - - - - - -

000079C0 bytes in 0x83 allocations (@ 0x00000020 + 0x00001A58) by: BackTrace00026
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        msvcrt!malloc+00000057

000001E0 bytes in 0x4 allocations (@ 0x00000040 + 0x00000038) by: BackTrace00125
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        msvcrt!_heap_alloc+00000022
        UxTheme!ProcessStartUp+00000032
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpLoadDll+00000343
        ntdll!LdrLoadDll+0000013C
        kernel32!LoadLibraryExW+000001AF
        kernel32!LoadLibraryExA+0000001D
        COMCTL32!__tailMerge_UxTheme+0000000D

00001F10 bytes in 0x2 allocations (@ 0x000000A8 + 0x00000770) by: BackTrace00021
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        msvcrt!calloc+000000EE
        msvcrt!_calloc_crt+00000011

00001818 bytes by: BackTrace00013
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlCreateHeap+00000610
        ntdll!RtlDebugCreateHeap+0000018C
        ntdll!RtlCreateHeap+00000224
        kernel32!HeapCreate+00000051
        msvcrt!_heap_init+00000017
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

00000118 bytes by: BackTrace00051
        ntdll!RtlReAllocateHeap+000001B0
        msvcrt!realloc+0000031F
        msvcrt!_realloc_crt+00000011

*- - - - - - - - - - End of data for heap @ 00F70000 - - - - - - - - - -

*- - - - - - - - - - Start of data for heap @ 00FB0000 - - - - - - - - - -

    Flags: 58001062
    Number Of Entries: 2
    Number Of Tags: <unknown>
    Bytes Allocated: 00001E98
    Bytes Committed: 00003000
    Total FreeSpace: 00001168
    Number of Virtual Address chunks used: 1
    Address Space Used: <unknown>
    Entry Overhead: 8
    Creator:  (Backtrace00087)
        ntdll!RtlCreateHeap+00000224
        kernel32!HeapCreate+00000051
        WINSPOOL!PerfClose+00000747
        WINSPOOL!PerfClose+000018C7
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

*- - - - - - - - - - Heap 00FB0000 Hogs - - - - - - - - - -

00001818 bytes by: BackTrace00086
        ntdll!RtlAllocateHeapSlowly+00000041
        ntdll!RtlAllocateHeap+00000E91
        ntdll!RtlCreateHeap+00000610
        ntdll!RtlDebugCreateHeap+0000018C
        ntdll!RtlCreateHeap+00000224
        kernel32!HeapCreate+00000051
        WINSPOOL!PerfClose+00000747
        WINSPOOL!PerfClose+000018C7
        ntdll!LdrpCallInitRoutine+00000014
        ntdll!LdrpRunInitializeRoutines+000002F3
        ntdll!LdrpInitializeProcess+00000E28

*- - - - - - - - - - End of data for heap @ 00FB0000 - - - - - - - - - -

// UMDH version: 5.2.3678.0
// Peak heap usage: 000010A4 bytes
// Elapse time 20071 msecs.
// CPU time  User: 671 msecs. Kernel: 1156 msecs.

Example 2: Obtain the Heap Information

Type the following at the command line:

dh.exe -p <PID> -f <LogFile>

Press ENTER. Output similar to the following is displayed:

DH: Logtime 10/23/2002-06:34 - Machine=NBATCHU-DEV2 - PID=2852

*********** Heap 00890000 Information ********************

    Flags: 58000062
    Number Of Entries: 81
    Number Of Tags: 0
    Bytes Allocated: 00007500
    Bytes Committed: 00008000
    Total FreeSpace: 00000b00
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [00890000 .. 00990000) 00008000 committed
    Address Space Used: 00100000
    Entry Overhead: 8
    Creator:  (Backtrace00000)

*********** Heap 00890000 Hogs ********************

00000020 bytes by: BackTrace00145
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0xc3
        notepad!NPInit+0x386
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000020 bytes by: BackTrace00008
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        ADVAPI32!AppmgmtInitialize+0x1e
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000020 bytes by: BackTrace00128
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        COMCTL32!EditML_Create+0x2c
        COMCTL32!Edit_WndProc+0xbd9
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        notepad!NPInit+0x1ef
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000020 bytes by: BackTrace00023
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!NtdllpAllocateStringRoutine+0x17
        kernel32!GetStartupInfoA+0xd1
        msvcrt!_ioinit+0x1b
        msvcrt!_CRTDLL_INIT+0xf2
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000020 bytes by: BackTrace00025
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!NtdllpAllocateStringRoutine+0x17
        kernel32!GetStartupInfoA+0x103
        msvcrt!_ioinit+0x1b
        msvcrt!_CRTDLL_INIT+0xf2
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000028 bytes by: BackTrace00024
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!NtdllpAllocateStringRoutine+0x17
        kernel32!GetStartupInfoA+0xea
        msvcrt!_ioinit+0x1b
        msvcrt!_CRTDLL_INIT+0xf2
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000028 bytes by: BackTrace00097
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        USER32!AddAccResource+0xb
        USER32!LoadAcceleratorsW+0x1c
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000038 bytes by: BackTrace00042
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        COMCTL32!LibMain+0x1f
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000038 bytes by: BackTrace00083
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        ntdll!RtlCreateHeap+0x4ce
        ntdll!RtlDebugCreateHeap+0x18c
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        WINSPOOL!PerfClose+0x747
        WINSPOOL!PerfClose+0x18c7
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000038 bytes by: BackTrace00027
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        ntdll!RtlInitializeCriticalSection+0xb
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000040 bytes by: BackTrace00146
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        COMCTL32!SetStatusText+0xc6
        COMCTL32!SBSetText+0x76
        COMCTL32!StatusWndProc+0x97
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!SendMessageWorker+0x4ab
        USER32!SendMessageW+0x7d
        notepad!SetTitle+0xfc
        notepad!NPInit+0x3a9
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000058 bytes by: BackTrace00140
        ntdll!RtlReAllocateHeap+0x1b0
        kernel32!LocalReAlloc+0x1b6
        COMCTL32!CCLocalReAlloc+0x1d
        COMCTL32!SetStatusParts+0xb1
        COMCTL32!StatusWndProc+0x6ee
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!SendMessageWorker+0x4ab
        USER32!SendMessageW+0x7d
        notepad!NPInit+0x27c
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000058 bytes by: BackTrace00111
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0xc3
        COMCTL32!Edit_NcCreate+0x119

00000060 bytes by: BackTrace00022
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!GetStartupInfoA+0x3f
        msvcrt!_ioinit+0x1b
        msvcrt!_CRTDLL_INIT+0xf2
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000068 bytes by: BackTrace00137
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        GDI32!plfCreateLOCALFONT+0x2a

00000070 bytes in 0002 allocations (@ 0038) by: BackTrace00121
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpLoadDll+0x343
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

00000070 bytes in 0002 allocations (@ 0038) by: BackTrace00081
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000a0 bytes by: BackTrace00135
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        COMCTL32!InitStatusWnd+0x18
        COMCTL32!StatusWndProc+0x2d9
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        COMCTL32!SHFusionCreateWindowEx+0x4b
        COMCTL32!CreateStatusWindowW+0x32
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

000000a8 bytes in 0003 allocations (@ 0038) by: BackTrace00070
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        ntdll!RtlInitializeCriticalSection+0xb
        SHELL32!ATL__CComModule__Init+0x28
        SHELL32!_DllMainCRTStartup+0x50
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000a8 bytes in 0003 allocations (@ 0038) by: BackTrace00089
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        WINSPOOL!PerfClose+0x18c7
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000e0 bytes in 0004 allocations (@ 0038) by: BackTrace00018
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        msvcrt!_mtinitlocks+0x2b
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000e0 bytes in 0004 allocations (@ 0038) by: BackTrace00063
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        SHELL32!_DllMainCRTStartup+0x50
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000f8 bytes by: BackTrace00054
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlCreateActivationContext+0xb3
        kernel32!CreateActCtxW+0x65e
        SHELL32!SHFusionInitializeIDCC+0x6e
        SHELL32!SHFusionInitializeFromModuleID+0x3a
        SHELL32!_ProcessAttach+0x30
        SHELL32!_DllMainCRTStartup+0x50
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000f8 bytes by: BackTrace00041
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlCreateActivationContext+0xb3
        kernel32!CreateActCtxW+0x65e
        COMCTL32!SHFusionInitializeIDCC+0x6f
        COMCTL32!SHFusionInitializeID+0xf
        COMCTL32!LibMain+0x1f
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000118 bytes by: BackTrace00044
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        USER32!RealSystemParametersInfoW+0x1b5
        USER32!SystemParametersInfoW+0x56
        COMCTL32!InitGlobalMetrics+0x16f
        COMCTL32!_ProcessAttach+0x49
        COMCTL32!LibMain+0x1f
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000118 bytes in 0005 allocations (@ 0038) by: BackTrace00065
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12

00000118 bytes in 0005 allocations (@ 0038) by: BackTrace00123
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        UxTheme!ProcessStartUp+0x32
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpLoadDll+0x343
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

00000140 bytes by: BackTrace00110
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        COMCTL32!Edit_WndProc+0x486
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        notepad!NPInit+0x1ef
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

000001e0 bytes in 0002 allocations (@ 00f0) by: BackTrace00061
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpInsertAssemblyStorageMapEntry+0x82
        ntdll!RtlpResolveAssemblyStorageMapEntry+0x58f

00000218 bytes by: BackTrace00019
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!FlsAlloc+0x5a
        msvcrt!_mtinit+0x9a
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000220 bytes by: BackTrace00020
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!FlsAlloc+0xa5
        msvcrt!_mtinit+0x9a
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000002c0 bytes by: BackTrace00141
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        GDI32!pcfAllocCFONT+0x5c
        GDI32!pcfLocateCFONT+0x20d
        GDI32!GdiGetCharDimensions+0x7a
        COMCTL32!UserGetCharDimensionsEx+0x3d
        COMCTL32!Edit_SetFont+0x71
        COMCTL32!Edit_WndProc+0x31f
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!SendMessageWorker+0x4ab
        USER32!SendMessageW+0x7d
        notepad!NPInit+0x36b
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

000002c0 bytes by: BackTrace00138
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        GDI32!pcfAllocCFONT+0x5c
        GDI32!pcfLocateCFONT+0x20d
        GDI32!GetTextMetricsW+0x66
        COMCTL32!CIInitialize+0x64
        COMCTL32!InitStatusWnd+0x56
        COMCTL32!StatusWndProc+0x2d9
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        COMCTL32!SHFusionCreateWindowEx+0x4b
        COMCTL32!CreateStatusWindowW+0x32
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000418 bytes by: BackTrace00129
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        GDI32!bGetANSISetMap+0x6c
        GDI32!pcfLocateCFONT+0x168
        GDI32!GdiGetCharDimensions+0x7a
        COMCTL32!UserGetCharDimensionsEx+0x3d
        COMCTL32!Edit_SetFont+0xa9
        COMCTL32!EditML_Create+0xc1
        COMCTL32!Edit_WndProc+0xbd9
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        notepad!NPInit+0x1ef
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000618 bytes by: BackTrace00142
        ntdll!RtlReAllocateHeap+0x1b0
        COMCTL32!Edit_SetFont+0x1d5
        COMCTL32!Edit_WndProc+0x31f
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!SendMessageWorker+0x4ab
        USER32!SendMessageW+0x7d
        notepad!NPInit+0x36b
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000630 bytes by: BackTrace00056
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateActivationContextStackFrame+0xc7
        ntdll!RtlActivateActivationContextEx+0x50
        ntdll!RtlActivateActivationContext+0x29
        kernel32!ActivateActCtx+0x1e
        SHELL32!DelayLoadCC+0x15
        SHELL32!SHFusionInitializeFromModuleID+0x3a
        SHELL32!_ProcessAttach+0x30
        SHELL32!_DllMainCRTStartup+0x50
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000940 bytes by: BackTrace00006
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        RPCRT4!I_RpcProxyNewConnection+0x1156a
        RPCRT4!NdrTypeFlags+0x2bf6
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00001048 bytes by: BackTrace00094
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        notepad!InitStrings+0x1d
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00002aa8 bytes in 0010 allocations (@ 02aa) by: BackTrace99999

*********** Heap 00990000 Information ********************

    Flags: 58001062
    Number Of Entries: 30
    Number Of Tags: 0
    Bytes Allocated: 00002928
    Bytes Committed: 00006000
    Total FreeSpace: 000036d8
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [00990000 .. 009a0000) 00006000 committed
    Address Space Used: 00010000
    Entry Overhead: 8
    Creator:  (Backtrace00000)

*********** Heap 00990000 Hogs ********************

00000058 bytes by: BackTrace00118
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!LdrpAllocateUnicodeString+0x32
        ntdll!LdrpMapDll+0x149
        ntdll!LdrpLoadDll+0x17e
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

00000068 bytes by: BackTrace00120
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!LdrpAllocateDataTableEntry+0x2d
        ntdll!LdrpLoadDll+0x17e
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

000021e8 bytes in 0019 allocations (@ 015b) by: BackTrace99999

*********** Heap 009A0000 Information ********************

    Flags: 58008060
    Number Of Entries: 3
    Number Of Tags: 0
    Bytes Allocated: 00000680
    Bytes Committed: 00001000
    Total FreeSpace: 00000980
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [009a0000 .. 009b0000) 00001000 committed
    Address Space Used: 00010000
    Entry Overhead: 8
    Creator:  (Backtrace00000)

*********** Heap 009A0000 Hogs ********************

*********** Heap 00F70000 Information ********************

    Flags: 58001062
    Number Of Entries: 79
    Number Of Tags: 0
    Bytes Allocated: 00004680
    Bytes Committed: 00005000
    Total FreeSpace: 00000980
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [00f70000 .. 00f80000) 00005000 committed
    Address Space Used: 00010000
    Entry Overhead: 8
    Creator:  (Backtrace00014)
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        msvcrt!_heap_init+0x17
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

*********** Heap 00F70000 Hogs ********************

00000118 bytes by: BackTrace00051
        ntdll!RtlReAllocateHeap+0x1b0
        msvcrt!realloc+0x31f
        msvcrt!_realloc_crt+0x11

00000138 bytes in 0004 allocations (@ 004e) by: BackTrace00125
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        msvcrt!_heap_alloc+0x22
        UxTheme!ProcessStartUp+0x32
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpLoadDll+0x343
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

00000ab8 bytes in 0005 allocations (@ 0224) by: BackTrace00021
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        msvcrt!calloc+0xee
        msvcrt!_calloc_crt+0x11

00001818 bytes by: BackTrace00013
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlCreateHeap+0x610
        ntdll!RtlDebugCreateHeap+0x18c
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        msvcrt!_heap_init+0x17
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00001ae0 bytes in 0040 allocations (@ 006b) by: BackTrace00026
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        msvcrt!malloc+0x57

*********** Heap 00FB0000 Information ********************

    Flags: 58001062
    Number Of Entries: 4
    Number Of Tags: 0
    Bytes Allocated: 00001e98
    Bytes Committed: 00003000
    Total FreeSpace: 00001168
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [00fb0000 .. 00fc0000) 00003000 committed
    Address Space Used: 00010000
    Entry Overhead: 8
    Creator:  (Backtrace00087)
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        WINSPOOL!PerfClose+0x747
        WINSPOOL!PerfClose+0x18c7
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

*********** Heap 00FB0000 Hogs ********************

00001818 bytes by: BackTrace00086
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlCreateHeap+0x610
        ntdll!RtlDebugCreateHeap+0x18c
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        WINSPOOL!PerfClose+0x747
        WINSPOOL!PerfClose+0x18c7
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

Example 3: Obtain the Heap Information Along with Heap Entries Information for Each Heap

Type the following at the command line and press ENTER:

dh.exe -p <PID> -h -f  <LogFile>

Output similar to the following displayed:

DH: Logtime 10/23/2002-06:35 - Machine=NBATCHU-DEV2 - PID=2852

*********** Heap 00890000 Information ********************

    Flags: 58000062
    Number Of Entries: 82
    Number Of Tags: 0
    Bytes Allocated: 00007720
    Bytes Committed: 00008000
    Total FreeSpace: 000008e0
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [00890000 .. 00990000) 00008000 committed
    Address Space Used: 00100000
    Entry Overhead: 8
    Creator:  (Backtrace00000)

*********** Heap 00890000 Hogs ********************

00000020 bytes by: BackTrace00145
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0xc3
        notepad!NPInit+0x386
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000020 bytes by: BackTrace00008
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        ADVAPI32!AppmgmtInitialize+0x1e
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000020 bytes by: BackTrace00128
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        COMCTL32!EditML_Create+0x2c
        COMCTL32!Edit_WndProc+0xbd9
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        notepad!NPInit+0x1ef
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000020 bytes by: BackTrace00023
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!NtdllpAllocateStringRoutine+0x17
        kernel32!GetStartupInfoA+0xd1
        msvcrt!_ioinit+0x1b
        msvcrt!_CRTDLL_INIT+0xf2
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000020 bytes by: BackTrace00025
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!NtdllpAllocateStringRoutine+0x17
        kernel32!GetStartupInfoA+0x103
        msvcrt!_ioinit+0x1b
        msvcrt!_CRTDLL_INIT+0xf2
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000028 bytes by: BackTrace00024
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!NtdllpAllocateStringRoutine+0x17
        kernel32!GetStartupInfoA+0xea
        msvcrt!_ioinit+0x1b
        msvcrt!_CRTDLL_INIT+0xf2
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000028 bytes by: BackTrace00097
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        USER32!AddAccResource+0xb
        USER32!LoadAcceleratorsW+0x1c
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000038 bytes by: BackTrace00042
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        COMCTL32!LibMain+0x1f
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000038 bytes by: BackTrace00083
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        ntdll!RtlCreateHeap+0x4ce
        ntdll!RtlDebugCreateHeap+0x18c
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        WINSPOOL!PerfClose+0x747
        WINSPOOL!PerfClose+0x18c7
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000038 bytes by: BackTrace00027
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        ntdll!RtlInitializeCriticalSection+0xb
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000040 bytes by: BackTrace00146
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        COMCTL32!SetStatusText+0xc6
        COMCTL32!SBSetText+0x76
        COMCTL32!StatusWndProc+0x97
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!SendMessageWorker+0x4ab
        USER32!SendMessageW+0x7d
        notepad!SetTitle+0xfc
        notepad!NPInit+0x3a9
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000058 bytes by: BackTrace00140
        ntdll!RtlReAllocateHeap+0x1b0
        kernel32!LocalReAlloc+0x1b6
        COMCTL32!CCLocalReAlloc+0x1d
        COMCTL32!SetStatusParts+0xb1
        COMCTL32!StatusWndProc+0x6ee
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!SendMessageWorker+0x4ab
        USER32!SendMessageW+0x7d
        notepad!NPInit+0x27c
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000058 bytes by: BackTrace00111
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0xc3
        COMCTL32!Edit_NcCreate+0x119

00000060 bytes by: BackTrace00022
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!GetStartupInfoA+0x3f
        msvcrt!_ioinit+0x1b
        msvcrt!_CRTDLL_INIT+0xf2
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000068 bytes by: BackTrace00137
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        GDI32!plfCreateLOCALFONT+0x2a

00000070 bytes in 0002 allocations (@ 0038) by: BackTrace00121
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpLoadDll+0x343
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

00000070 bytes in 0002 allocations (@ 0038) by: BackTrace00081
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000a0 bytes by: BackTrace00135
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        COMCTL32!InitStatusWnd+0x18
        COMCTL32!StatusWndProc+0x2d9
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        COMCTL32!SHFusionCreateWindowEx+0x4b
        COMCTL32!CreateStatusWindowW+0x32
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

000000a8 bytes in 0003 allocations (@ 0038) by: BackTrace00070
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        ntdll!RtlInitializeCriticalSection+0xb
        SHELL32!ATL__CComModule__Init+0x28
        SHELL32!_DllMainCRTStartup+0x50
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000a8 bytes in 0003 allocations (@ 0038) by: BackTrace00089
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        WINSPOOL!PerfClose+0x18c7
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000e0 bytes in 0004 allocations (@ 0038) by: BackTrace00018
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        msvcrt!_mtinitlocks+0x2b
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000e0 bytes in 0004 allocations (@ 0038) by: BackTrace00063
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        SHELL32!_DllMainCRTStartup+0x50
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000f8 bytes by: BackTrace00054
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlCreateActivationContext+0xb3
        kernel32!CreateActCtxW+0x65e
        SHELL32!SHFusionInitializeIDCC+0x6e
        SHELL32!SHFusionInitializeFromModuleID+0x3a
        SHELL32!_ProcessAttach+0x30
        SHELL32!_DllMainCRTStartup+0x50
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000000f8 bytes by: BackTrace00041
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlCreateActivationContext+0xb3
        kernel32!CreateActCtxW+0x65e
        COMCTL32!SHFusionInitializeIDCC+0x6f
        COMCTL32!SHFusionInitializeID+0xf
        COMCTL32!LibMain+0x1f
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000118 bytes by: BackTrace00044
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        USER32!RealSystemParametersInfoW+0x1b5
        USER32!SystemParametersInfoW+0x56
        COMCTL32!InitGlobalMetrics+0x16f
        COMCTL32!_ProcessAttach+0x49
        COMCTL32!LibMain+0x1f
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000118 bytes in 0005 allocations (@ 0038) by: BackTrace00065
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12

00000118 bytes in 0005 allocations (@ 0038) by: BackTrace00123
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateDebugInfo+0x22
        kernel32!InitializeCriticalSectionAndSpinCount+0x12
        UxTheme!ProcessStartUp+0x32
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpLoadDll+0x343
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

00000140 bytes by: BackTrace00110
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        COMCTL32!Edit_WndProc+0x486
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        notepad!NPInit+0x1ef
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

000001e0 bytes in 0002 allocations (@ 00f0) by: BackTrace00061
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpInsertAssemblyStorageMapEntry+0x82
        ntdll!RtlpResolveAssemblyStorageMapEntry+0x58f

00000218 bytes by: BackTrace00019
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!FlsAlloc+0x5a
        msvcrt!_mtinit+0x9a
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000220 bytes by: BackTrace00020
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!FlsAlloc+0xa5
        msvcrt!_mtinit+0x9a
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

000002c0 bytes by: BackTrace00141
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        GDI32!pcfAllocCFONT+0x5c
        GDI32!pcfLocateCFONT+0x20d
        GDI32!GdiGetCharDimensions+0x7a
        COMCTL32!UserGetCharDimensionsEx+0x3d
        COMCTL32!Edit_SetFont+0x71
        COMCTL32!Edit_WndProc+0x31f
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!SendMessageWorker+0x4ab
        USER32!SendMessageW+0x7d
        notepad!NPInit+0x36b
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

000002c0 bytes by: BackTrace00138
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        GDI32!pcfAllocCFONT+0x5c
        GDI32!pcfLocateCFONT+0x20d
        GDI32!GetTextMetricsW+0x66
        COMCTL32!CIInitialize+0x64
        COMCTL32!InitStatusWnd+0x56
        COMCTL32!StatusWndProc+0x2d9
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        COMCTL32!SHFusionCreateWindowEx+0x4b
        COMCTL32!CreateStatusWindowW+0x32
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000418 bytes by: BackTrace00129
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        GDI32!bGetANSISetMap+0x6c
        GDI32!pcfLocateCFONT+0x168
        GDI32!GdiGetCharDimensions+0x7a
        COMCTL32!UserGetCharDimensionsEx+0x3d
        COMCTL32!Edit_SetFont+0xa9
        COMCTL32!EditML_Create+0xc1
        COMCTL32!Edit_WndProc+0xbd9
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!DispatchClientMessage+0xa3
        USER32!__fnINLPCREATESTRUCT+0x89
        ntdll!KiUserCallbackDispatcher+0x13
        USER32!_CreateWindowEx+0x1eb
        USER32!CreateWindowExW+0x31
        notepad!NPInit+0x1ef
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000618 bytes by: BackTrace00142
        ntdll!RtlReAllocateHeap+0x1b0
        COMCTL32!Edit_SetFont+0x1d5
        COMCTL32!Edit_WndProc+0x31f
        USER32!InternalCallWinProc+0x1b
        USER32!UserCallWinProcCheckWow+0x151
        USER32!SendMessageWorker+0x4ab
        USER32!SendMessageW+0x7d
        notepad!NPInit+0x36b
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00000630 bytes by: BackTrace00056
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlpAllocateActivationContextStackFrame+0xc7
        ntdll!RtlActivateActivationContextEx+0x50
        ntdll!RtlActivateActivationContext+0x29
        kernel32!ActivateActCtx+0x1e
        SHELL32!DelayLoadCC+0x15
        SHELL32!SHFusionInitializeFromModuleID+0x3a
        SHELL32!_ProcessAttach+0x30
        SHELL32!_DllMainCRTStartup+0x50
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00000940 bytes by: BackTrace00006
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        RPCRT4!I_RpcProxyNewConnection+0x1156a
        RPCRT4!NdrTypeFlags+0x2bf6
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00001048 bytes by: BackTrace00094
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        kernel32!LocalAlloc+0x58
        notepad!InitStrings+0x1d
        notepad!WinMain+0x48
        notepad!WinMainCRTStartup+0x182
        kernel32!BaseProcessStart+0x23

00002cc8 bytes in 0011 allocations (@ 02a2) by: BackTrace99999

*********** Heap 00890000 Entries ********************

[00890000 : 00008000]
00890680: 00001818 - BUSY [11] (BackTrace00000)

00891E98: 00000038 - BUSY [11] (BackTrace00000)

00891ED0: 00000020 - BUSY [11] (BackTrace00000)

00891EF0: 00000300 - BUSY [11] (BackTrace00000)

008921F0: 00000330 - BUSY [11] (BackTrace00000)

00892520: 00000330 - BUSY [11] (BackTrace00000)

00892850: 00000040 - BUSY [11] (BackTrace00000)

00892890: 00000040 - BUSY [11] (BackTrace00000)

008928D0: 00000028 - BUSY [11] (BackTrace00000)

008928F8: 00000058 - BUSY [11] (BackTrace00000)

00892950: 00000058 - BUSY [11] (BackTrace00000)

008929A8: 00000030 - BUSY [11] (BackTrace00000)

008929D8: 000000F0 - BUSY [11] (BackTrace00000)

00892AC8: 00000940 - BUSY [11] (BackTrace00006)

00893408: 00000020 - BUSY [11] (BackTrace00008)

00893428: 00000038 - BUSY [11] (BackTrace00018)

00893460: 00000038 - BUSY [11] (BackTrace00018)

00893498: 00000038 - BUSY [11] (BackTrace00018)

008934D0: 00000038 - BUSY [11] (BackTrace00018)

00893508: 00000218 - BUSY [11] (BackTrace00019)

00893720: 00000220 - BUSY [11] (BackTrace00020)

00893940: 00000060 - BUSY [11] (BackTrace00022)

008939A0: 00000020 - BUSY [11] (BackTrace00023)

008939C0: 00000028 - BUSY [11] (BackTrace00024)

008939E8: 00000020 - BUSY [11] (BackTrace00025)

00893A08: 00000038 - BUSY [11] (BackTrace00027)

00893A40: 000000F8 - BUSY [11] (BackTrace00041)

00893B38: 00000038 - BUSY [11] (BackTrace00042)

00893B70: 00000118 - BUSY [11] (BackTrace00044)

00893C88: 000000F8 - BUSY [11] (BackTrace00054)

00893D80: 00000630 - BUSY [11] (BackTrace00056)

008943B0: 000000F0 - BUSY [11] (BackTrace00061)

008944A0: 00000038 - BUSY [11] (BackTrace00063)

008944D8: 00000038 - BUSY [11] (BackTrace00063)

00894510: 00000038 - BUSY [11] (BackTrace00063)

00894548: 00000038 - BUSY [11] (BackTrace00065)

00894580: 00000038 - BUSY [11] (BackTrace00065)

008945B8: 00000038 - BUSY [11] (BackTrace00063)

008945F0: 00000038 - BUSY [11] (BackTrace00070)

00894628: 00000038 - BUSY [11] (BackTrace00070)

00894660: 00000038 - BUSY [11] (BackTrace00070)

00894698: 00000038 - BUSY [11] (BackTrace00081)

008946D0: 00000038 - BUSY [11] (BackTrace00081)

00894708: 00000038 - BUSY [11] (BackTrace00083)

00894740: 00000038 - BUSY [11] (BackTrace00089)

00894778: 00000038 - BUSY [11] (BackTrace00089)

008947B0: 00000038 - BUSY [11] (BackTrace00089)

008947E8: 00001048 - BUSY [11] (BackTrace00094)

00895830: 00000028 - BUSY [11] (BackTrace00097)

00895858: 00000140 - BUSY [11] (BackTrace00110)

00895998: 00000058 - BUSY [31] (BackTrace00111) (Handle: 1020004)

008959F0: 00000418 - BUSY [11] (BackTrace00129)

00895E08: 00000220 - BUSY [11] (BackTrace00000)

00896028: 00000220 - BUSY [11] (BackTrace00000)

00896248: 00000868 - FREE

00896AB0: 00000038 - BUSY [11] (BackTrace00121)

00896AE8: 00000038 - BUSY [11] (BackTrace00123)

00896B20: 00000038 - BUSY [11] (BackTrace00123)

00896B58: 00000038 - BUSY [11] (BackTrace00123)

00896B90: 00000038 - BUSY [11] (BackTrace00123)

00896BC8: 00000038 - BUSY [11] (BackTrace00123)

00896C00: 00000038 - BUSY [11] (BackTrace00121)

00896C38: 00000038 - BUSY [11] (BackTrace00065)

00896C70: 00000038 - BUSY [11] (BackTrace00065)

00896CA8: 00000038 - BUSY [11] (BackTrace00065)

00896CE0: 00000020 - BUSY [11] (BackTrace00128)

00896D00: 00000618 - BUSY [11] (BackTrace00142)

00897318: 00000040 - BUSY [11] (BackTrace00146)

00897358: 00000220 - BUSY [11] (BackTrace00000)

00897578: 00000220 - BUSY [11] (BackTrace00000)

00897798: 00000028 - FREE

008977C0: 000000F0 - BUSY [11] (BackTrace00061)

008978B0: 000000A0 - BUSY [11] (BackTrace00135)

00897950: 00000020 - BUSY [31] (BackTrace00145) (Handle: 102000c)

00897970: 00000018 - FREE

00897988: 00000068 - BUSY [11] (BackTrace00137)

008979F0: 000002C0 - BUSY [11] (BackTrace00138)

00897CB0: 00000058 - BUSY [11] (BackTrace00140)

00897D08: 000002C0 - BUSY [11] (BackTrace00141)

00897FC8: 00000038 - FREE

00898000: 000F8000 - UNCOMMITTED

*********** Heap 00990000 Information ********************

    Flags: 58001062
    Number Of Entries: 30
    Number Of Tags: 0
    Bytes Allocated: 00002928
    Bytes Committed: 00006000
    Total FreeSpace: 000036d8
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [00990000 .. 009a0000) 00006000 committed
    Address Space Used: 00010000
    Entry Overhead: 8
    Creator:  (Backtrace00000)

*********** Heap 00990000 Hogs ********************

00000058 bytes by: BackTrace00118
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!LdrpAllocateUnicodeString+0x32
        ntdll!LdrpMapDll+0x149
        ntdll!LdrpLoadDll+0x17e
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

00000068 bytes by: BackTrace00120
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!LdrpAllocateDataTableEntry+0x2d
        ntdll!LdrpLoadDll+0x17e
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

000021e8 bytes in 0019 allocations (@ 015b) by: BackTrace99999

*********** Heap 00990000 Entries ********************

[00990000 : 00006000]
00990680: 00001818 - BUSY [11] (BackTrace00000)

00991E98: 00000068 - BUSY [11] (BackTrace00000)

00991F00: 00000068 - BUSY [11] (BackTrace00000)

00991F68: 00000060 - BUSY [11] (BackTrace00000)

00991FC8: 00000068 - BUSY [11] (BackTrace00000)

00992030: 00000060 - BUSY [11] (BackTrace00000)

00992090: 00000068 - BUSY [11] (BackTrace00000)

009920F8: 00000058 - BUSY [11] (BackTrace00000)

00992150: 00000068 - BUSY [11] (BackTrace00000)

009921B8: 00000058 - BUSY [11] (BackTrace00000)

00992210: 00000068 - BUSY [11] (BackTrace00000)

00992278: 00000058 - BUSY [11] (BackTrace00000)

009922D0: 00000068 - BUSY [11] (BackTrace00000)

00992338: 00000060 - BUSY [11] (BackTrace00000)

00992398: 00000068 - BUSY [11] (BackTrace00000)

00992400: 00000058 - BUSY [11] (BackTrace00000)

00992458: 00000068 - BUSY [11] (BackTrace00000)

009924C0: 00000058 - BUSY [11] (BackTrace00000)

00992518: 00000068 - BUSY [11] (BackTrace00000)

00992580: 000000F8 - BUSY [11] (BackTrace00000)

00992678: 00000068 - BUSY [11] (BackTrace00000)

009926E0: 00000058 - BUSY [11] (BackTrace00000)

00992738: 00000068 - BUSY [11] (BackTrace00000)

009927A0: 00000060 - BUSY [11] (BackTrace00000)

00992800: 00000068 - BUSY [11] (BackTrace00000)

00992868: 00000058 - BUSY [11] (BackTrace00118)

009928C0: 00000068 - BUSY [11] (BackTrace00120)

00992928: 000036D8 - FREE

00996000: 0000A000 - UNCOMMITTED

*********** Heap 009A0000 Information ********************

    Flags: 58008060
    Number Of Entries: 3
    Number Of Tags: 0
    Bytes Allocated: 00000680
    Bytes Committed: 00001000
    Total FreeSpace: 00000980
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [009a0000 .. 009b0000) 00001000 committed
    Address Space Used: 00010000
    Entry Overhead: 8
    Creator:  (Backtrace00000)

*********** Heap 009A0000 Hogs ********************

*********** Heap 009A0000 Entries ********************

[009A0000 : 00001000]
009A0680: 00000980 - FREE

009A1000: 0000F000 - UNCOMMITTED

*********** Heap 00F70000 Information ********************

    Flags: 58001062
    Number Of Entries: 80
    Number Of Tags: 0
    Bytes Allocated: 00004728
    Bytes Committed: 00005000
    Total FreeSpace: 000008d8
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [00f70000 .. 00f80000) 00005000 committed
    Address Space Used: 00010000
    Entry Overhead: 8
    Creator:  (Backtrace00014)
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        msvcrt!_heap_init+0x17
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

*********** Heap 00F70000 Hogs ********************

00000118 bytes by: BackTrace00051
        ntdll!RtlReAllocateHeap+0x1b0
        msvcrt!realloc+0x31f
        msvcrt!_realloc_crt+0x11

00000138 bytes in 0004 allocations (@ 004e) by: BackTrace00125
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        msvcrt!_heap_alloc+0x22
        UxTheme!ProcessStartUp+0x32
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpLoadDll+0x343
        ntdll!LdrLoadDll+0x13c
        kernel32!LoadLibraryExW+0x1af
        kernel32!LoadLibraryExA+0x1d
        COMCTL32!__tailMerge_UxTheme+0xd

00000b60 bytes in 0006 allocations (@ 01e5) by: BackTrace00021
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        msvcrt!calloc+0xee
        msvcrt!_calloc_crt+0x11

00001818 bytes by: BackTrace00013
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlCreateHeap+0x610
        ntdll!RtlDebugCreateHeap+0x18c
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        msvcrt!_heap_init+0x17
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

00001ae0 bytes in 0040 allocations (@ 006b) by: BackTrace00026
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        msvcrt!malloc+0x57

*********** Heap 00F70000 Entries ********************

[00F70000 : 00005000]
00F70680: 00001818 - BUSY [11] (BackTrace00013)

00F71E98: 000000A8 - BUSY [11] (BackTrace00021)

00F71F40: 00000498 - BUSY [11] (BackTrace00026)

00F723D8: 00000040 - BUSY [11] (BackTrace00125)

00F72418: 00000040 - BUSY [11] (BackTrace00125)

00F72458: 000000A8 - BUSY [11] (BackTrace00021)

00F72500: 000000A8 - BUSY [11] (BackTrace00021)

00F725A8: 000000A8 - BUSY [11] (BackTrace00021)

00F72650: 000000A8 - BUSY [11] (BackTrace00021)

00F726F8: 000008A8 - FREE

00F72FA0: 00000238 - BUSY [11] (BackTrace00026)

00F731D8: 00000108 - BUSY [11] (BackTrace00026)

00F732E0: 00000050 - BUSY [11] (BackTrace00026)

00F73330: 00000070 - BUSY [11] (BackTrace00026)

00F733A0: 00000058 - BUSY [11] (BackTrace00026)

00F733F8: 00000040 - BUSY [11] (BackTrace00026)

00F73438: 00000088 - BUSY [11] (BackTrace00026)

00F734C0: 00000048 - BUSY [11] (BackTrace00026)

00F73508: 00000050 - BUSY [11] (BackTrace00026)

00F73558: 00000038 - BUSY [11] (BackTrace00026)

00F73590: 00000040 - BUSY [11] (BackTrace00026)

00F735D0: 00000028 - BUSY [11] (BackTrace00026)

00F735F8: 00000028 - BUSY [11] (BackTrace00026)

00F73620: 00000048 - BUSY [11] (BackTrace00026)

00F73668: 00000068 - BUSY [11] (BackTrace00026)

00F736D0: 00000040 - BUSY [11] (BackTrace00026)

00F73710: 00000030 - BUSY [11] (BackTrace00026)

00F73740: 00000060 - BUSY [11] (BackTrace00026)

00F737A0: 00000038 - BUSY [11] (BackTrace00026)

00F737D8: 00000030 - BUSY [11] (BackTrace00026)

00F73808: 00000028 - BUSY [11] (BackTrace00026)

00F73830: 00000420 - BUSY [11] (BackTrace00026)

00F73C50: 00000058 - BUSY [11] (BackTrace00026)

00F73CA8: 00000038 - BUSY [11] (BackTrace00026)

00F73CE0: 00000060 - BUSY [11] (BackTrace00026)

00F73D40: 00000030 - BUSY [11] (BackTrace00026)

00F73D70: 00000030 - BUSY [11] (BackTrace00026)

00F73DA0: 00000038 - BUSY [11] (BackTrace00026)

00F73DD8: 00000028 - BUSY [11] (BackTrace00026)

00F73E00: 00000030 - BUSY [11] (BackTrace00026)

00F73E30: 00000028 - BUSY [11] (BackTrace00026)

00F73E58: 00000030 - BUSY [11] (BackTrace00026)

00F73E88: 00000030 - BUSY [11] (BackTrace00026)

00F73EB8: 00000030 - BUSY [11] (BackTrace00026)

00F73EE8: 00000040 - BUSY [11] (BackTrace00026)

00F73F28: 00000030 - BUSY [11] (BackTrace00026)

00F73F58: 00000030 - BUSY [11] (BackTrace00026)

00F73F88: 00000048 - BUSY [11] (BackTrace00026)

00F73FD0: 00000068 - BUSY [11] (BackTrace00026)

00F74038: 00000030 - BUSY [11] (BackTrace00026)

00F74068: 00000030 - BUSY [11] (BackTrace00026)

00F74098: 00000030 - BUSY [11] (BackTrace00026)

00F740C8: 00000038 - BUSY [11] (BackTrace00026)

00F74100: 00000038 - BUSY [11] (BackTrace00026)

00F74138: 00000030 - BUSY [11] (BackTrace00026)

00F74168: 00000030 - BUSY [11] (BackTrace00026)

00F74198: 00000040 - BUSY [11] (BackTrace00026)

00F741D8: 00000030 - BUSY [11] (BackTrace00026)

00F74208: 00000030 - BUSY [11] (BackTrace00026)

00F74238: 00000030 - BUSY [11] (BackTrace00026)

00F74268: 00000030 - BUSY [11] (BackTrace00026)

00F74298: 00000030 - BUSY [11] (BackTrace00026)

00F742C8: 00000040 - BUSY [11] (BackTrace00026)

00F74308: 00000030 - BUSY [11] (BackTrace00026)

00F74338: 00000038 - BUSY [11] (BackTrace00026)

00F74370: 00000030 - BUSY [11] (BackTrace00026)

00F743A0: 00000030 - BUSY [11] (BackTrace00026)

00F743D0: 00000030 - BUSY [11] (BackTrace00026)

00F74400: 00000030 - BUSY [11] (BackTrace00026)

00F74430: 00000060 - BUSY [11] (BackTrace00026)

00F74490: 00000098 - BUSY [11] (BackTrace00026)

00F74528: 00000818 - BUSY [11] (BackTrace00021)

00F74D40: 00000118 - BUSY [11] (BackTrace00051)

00F74E58: 00000098 - BUSY [11] (BackTrace00026)

00F74EF0: 00000028 - BUSY [11] (BackTrace00026)

00F74F18: 00000048 - BUSY [11] (BackTrace00125)

00F74F60: 00000070 - BUSY [11] (BackTrace00125)

00F74FD0: 00000030 - FREE

00F75000: 0000B000 - UNCOMMITTED

*********** Heap 00FB0000 Information ********************

    Flags: 58001062
    Number Of Entries: 4
    Number Of Tags: 0
    Bytes Allocated: 00001e98
    Bytes Committed: 00003000
    Total FreeSpace: 00001168
    Number of Virtual Address chunks used: 1
        Chunk[  1 ]: [00fb0000 .. 00fc0000) 00003000 committed
    Address Space Used: 00010000
    Entry Overhead: 8
    Creator:  (Backtrace00087)
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        WINSPOOL!PerfClose+0x747
        WINSPOOL!PerfClose+0x18c7
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

*********** Heap 00FB0000 Hogs ********************

00001818 bytes by: BackTrace00086
        ntdll!RtlAllocateHeapSlowly+0x41
        ntdll!RtlAllocateHeap+0xe91
        ntdll!RtlCreateHeap+0x610
        ntdll!RtlDebugCreateHeap+0x18c
        ntdll!RtlCreateHeap+0x224
        kernel32!HeapCreate+0x51
        WINSPOOL!PerfClose+0x747
        WINSPOOL!PerfClose+0x18c7
        ntdll!LdrpCallInitRoutine+0x14
        ntdll!LdrpRunInitializeRoutines+0x2f3
        ntdll!LdrpInitializeProcess+0xe28

*********** Heap 00FB0000 Entries ********************

[00FB0000 : 00003000]
00FB0680: 00001818 - BUSY [11] (BackTrace00086)

00FB1E98: 00001168 - FREE

00FB3000: 0000D000 - UNCOMMITTED

Example 4: Display Information About the Object Handles and the Kernel Memory

Type the following at the command line:

dh.exe -p 0 -f <LogFile>

Press ENTER. Output similar to the following is displayed:

DH: Logtime 10/23/2002-11:19 - Machine=NBATCHU-DEV2 - PID=0

*********** Module Information ********************

Number of loaded modules: 109
Module01 (00,00,01): [804DC000 .. 806C4BFF] \WINDOWS\system32\ntoskrnl.exe
Module02 (01,00,01): [806C5000 .. 806E4F7F] \WINDOWS\system32\hal.dll
Module03 (02,00,03): [F8A36000 .. F8A37FFF] \WINDOWS\system32\KDCOM.DLL
Module04 (03,00,02): [F8946000 .. F8949FFF] \WINDOWS\system32\BOOTVID.dll
Module05 (04,00,01): [F84E8000 .. F8514FFF] ACPI.sys
Module06 (05,00,19): [F8A38000 .. F8A39FFF] \WINDOWS\system32\DRIVERS\WMILIB.SYS
Module07 (06,00,01): [F84D7000 .. F84E7FFF] pci.sys
Module08 (07,00,01): [F8536000 .. F853EFFF] isapnp.sys
Module09 (08,00,01): [F8546000 .. F8554FFF] ohci1394.sys
Module10 (09,00,01): [F8556000 .. F8562FFF] \WINDOWS\system32\DRIVERS\1394BUS.SYS
Module11 (10,00,01): [F8A3A000 .. F8A3BFFF] intelide.sys
Module12 (11,00,01): [F87B6000 .. F87BBFFF] \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
Module13 (12,00,01): [F8566000 .. F856FFFF] MountMgr.sys
Module14 (13,00,01): [F84B8000 .. F84D6FFF] ftdisk.sys
Module15 (14,00,01): [F8A3C000 .. F8A3DFFF] dmload.sys
Module16 (15,00,01): [F8492000 .. F84B7FFF] dmio.sys
Module17 (16,00,01): [F87BE000 .. F87C3FFF] PartMgr.sys
Module18 (17,00,01): [F8478000 .. F8491FFF] VolSnap.sys
Module19 (18,00,01): [F8461000 .. F8477FFF] atapi.sys
Module20 (19,00,01): [F8448000 .. F8460FFF] adpu160m.sys
Module21 (20,00,01): [F8430000 .. F8447FFF] \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
Module22 (21,00,01): [F8576000 .. F857EFFF] disk.sys
Module23 (22,00,02): [F8586000 .. F8591FFF] \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
Module24 (23,00,01): [F87C6000 .. F87CDFFF] Dfs.sys
Module25 (24,00,01): [F87CE000 .. F87D2FFF] ino_flpy.sys
Module26 (25,00,06): [F8419000 .. F842FFFF] KSecDD.sys
Module27 (26,00,01): [F838E000 .. F8418FFF] Ntfs.sys
Module28 (27,00,14): [F8363000 .. F838DFFF] NDIS.sys
Module29 (28,00,01): [F8349000 .. F8362FFF] Mup.sys
Module30 (29,00,01): [F87D6000 .. F87DCFFF] agp440.sys
Module31 (30,00,01): [F894A000 .. F894DFFF] crcdisk.sys
Module32 (31,00,01): [F8926000 .. F892DFFF] \SystemRoot\System32\DRIVERS\processr.sys
Module33 (32,00,01): [F77CA000 .. F7832FFF] \SystemRoot\system32\DRIVERS\ati2mtag.sys
Module34 (33,00,04): [F7719000 .. F7729FFF] \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
Module35 (34,00,01): [F76F2000 .. F7703FFF] \SystemRoot\System32\DRIVERS\el90xbc5.sys
Module36 (35,00,01): [F883E000 .. F8843FFF] \SystemRoot\system32\DRIVERS\fdc.sys
Module37 (36,00,01): [F86D6000 .. F86E2FFF] \SystemRoot\System32\DRIVERS\i8042prt.sys
Module38 (37,00,01): [F887E000 .. F8883FFF] \SystemRoot\System32\DRIVERS\kbdclass.sys
Module39 (38,00,01): [F8896000 .. F889BFFF] \SystemRoot\System32\DRIVERS\mouclass.sys
Module40 (39,00,01): [F8736000 .. F8745FFF] \SystemRoot\system32\DRIVERS\serial.sys
Module41 (40,00,01): [F8A06000 .. F8A09FFF] \SystemRoot\system32\DRIVERS\serenum.sys
Module42 (41,00,01): [F75F3000 .. F7605FFF] \SystemRoot\System32\DRIVERS\parport.sys
Module43 (42,00,01): [F8676000 .. F8681FFF] \SystemRoot\System32\DRIVERS\cdrom.sys
Module44 (43,00,01): [F8716000 .. F8723FFF] \SystemRoot\System32\DRIVERS\redbook.sys
Module45 (44,00,07): [F75D3000 .. F75F2FFF] \SystemRoot\System32\DRIVERS\ks.sys
Module46 (45,00,01): [F88CE000 .. F88D2FFF] \SystemRoot\system32\DRIVERS\usbuhci.sys
Module47 (46,00,01): [F75B1000 .. F75D2FFF] \SystemRoot\system32\DRIVERS\USBPORT.SYS
Module48 (47,00,01): [F7599000 .. F75B0FFF] \SystemRoot\system32\drivers\ac97intc.sys
Module49 (48,00,01): [F7578000 .. F7598FFF] \SystemRoot\system32\drivers\portcls.sys
Module50 (49,00,02): [F8726000 .. F8734FFF] \SystemRoot\system32\drivers\drmk.sys
Module51 (50,00,01): [F8BEC000 .. F8BECFFF] \SystemRoot\System32\DRIVERS\audstub.sys
Module52 (51,00,01): [F8786000 .. F8795FFF] \SystemRoot\System32\DRIVERS\rasl2tp.sys
Module53 (52,00,02): [F7F6E000 .. F7F70FFF] \SystemRoot\System32\DRIVERS\ndistapi.sys
Module54 (53,00,01): [F7562000 .. F7577FFF] \SystemRoot\System32\DRIVERS\ndiswan.sys
Module55 (54,00,01): [F8596000 .. F859FFFF] \SystemRoot\System32\DRIVERS\raspppoe.sys
Module56 (55,00,01): [F87A6000 .. F87B3FFF] \SystemRoot\System32\DRIVERS\raspptp.sys
Module57 (56,00,10): [F87F6000 .. F87FAFFF] \SystemRoot\System32\DRIVERS\TDI.SYS
Module58 (57,00,02): [F8846000 .. F884AFFF] \SystemRoot\System32\DRIVERS\ptilink.sys
Module59 (58,00,01): [F8856000 .. F885AFFF] \SystemRoot\System32\DRIVERS\raspti.sys
Module60 (59,00,01): [F7533000 .. F7561FFF] \SystemRoot\System32\DRIVERS\rdpdr.sys
Module61 (60,00,03): [F85A6000 .. F85AFFFF] \SystemRoot\System32\DRIVERS\termdd.sys
Module62 (61,00,01): [F8B05000 .. F8B05FFF] \SystemRoot\System32\DRIVERS\swenum.sys
Module63 (62,00,01): [F7511000 .. F7532FFF] \SystemRoot\System32\DRIVERS\update.sys
Module64 (63,00,01): [F612A000 .. F6133FFF] \SystemRoot\System32\Drivers\NDProxy.SYS
Module65 (64,00,01): [F6972000 .. F697EFFF] \SystemRoot\system32\DRIVERS\usbhub.sys
Module66 (65,00,01): [F8A9C000 .. F8A9DFFF] \SystemRoot\system32\DRIVERS\USBD.SYS
Module67 (66,00,01): [F6905000 .. F6909FFF] \SystemRoot\System32\DRIVERS\flpydisk.sys
Module68 (67,00,01): [F8AC4000 .. F8AC5FFF] \SystemRoot\System32\Drivers\Fs_Rec.SYS
Module69 (68,00,01): [F5FE9000 .. F5FE9FFF] \SystemRoot\System32\Drivers\Null.SYS
Module70 (69,00,01): [F8ABA000 .. F8ABBFFF] \SystemRoot\System32\Drivers\Beep.SYS
Module71 (70,00,01): [F68D5000 .. F68DAFFF] \SystemRoot\System32\drivers\vga.sys
Module72 (71,00,01): [F8ABC000 .. F8ABDFFF] \SystemRoot\System32\Drivers\mnmdd.SYS
Module73 (72,00,01): [F5FE8000 .. F5FE8FFF] \SystemRoot\System32\DRIVERS\RDPCDD.sys
Module74 (73,00,01): [F8936000 .. F893AFFF] \SystemRoot\System32\Drivers\Msfs.SYS
Module75 (74,00,01): [F68DD000 .. F68E3FFF] \SystemRoot\System32\Drivers\Npfs.SYS
Module76 (75,00,01): [F6367000 .. F6369FFF] \SystemRoot\System32\DRIVERS\rasacd.sys
Module77 (76,00,01): [EBF8D000 .. EBF9FFFF] \SystemRoot\System32\DRIVERS\ipsec.sys
Module78 (77,00,01): [F85E6000 .. F85EFFFF] \SystemRoot\System32\DRIVERS\msgpc.sys
Module79 (78,00,02): [EBF3E000 .. EBF8CFFF] \SystemRoot\System32\DRIVERS\tcpip.sys
Module80 (79,00,01): [EBF15000 .. EBF3DFFF] \SystemRoot\System32\DRIVERS\netbt.sys
Module81 (80,00,01): [F774A000 .. F7752FFF] \SystemRoot\System32\DRIVERS\wanarp.sys
Module82 (81,00,01): [F8636000 .. F863EFFF] \SystemRoot\System32\DRIVERS\netbios.sys
Module83 (82,00,02): [EBEEC000 .. EBF14FFF] \SystemRoot\System32\DRIVERS\rdbss.sys
Module84 (83,00,01): [EBE86000 .. EBEEBFFF] \SystemRoot\System32\DRIVERS\mrxsmb.sys
Module85 (84,00,01): [F779A000 .. F77A2FFF] \SystemRoot\System32\Drivers\Fips.SYS
Module86 (85,00,01): [F8646000 .. F8654FFF] \SystemRoot\System32\Drivers\Cdfs.SYS
Module87 (86,00,02): [F8A1A000 .. F8A1DFFF] \SystemRoot\System32\Drivers\dump_diskdump.sys
Module88 (87,00,01): [EBE6D000 .. EBE85FFF] \SystemRoot\System32\Drivers\dump_adpu160m.sys
Module89 (88,00,02): [BF800000 .. BF9BEFFF] \??\C:\WINDOWS\system32\win32k.sys
Module90 (89,00,02): [F8A22000 .. F8A25FFF] \??\C:\WINDOWS\system32\watchdog.sys
Module91 (90,00,02): [BFF80000 .. BFF90FFF] \SystemRoot\System32\drivers\dxg.sys
Module92 (91,00,02): [F8B5C000 .. F8B5CFFF] \SystemRoot\System32\drivers\dxgthk.sys
Module93 (92,00,01): [EBE52000 .. EBE6CFFF] \??\C:\WINDOWS\system32\Drivers\ino_fltr.sys
Module94 (93,00,01): [EBE08000 .. EBE29FFF] \SystemRoot\System32\drivers\afd.sys
Module95 (94,00,01): [EBE42000 .. EBE45FFF] \SystemRoot\System32\DRIVERS\ndisuio.sys
Module96 (95,00,01): [EBD3B000 .. EBD67FFF] \SystemRoot\System32\DRIVERS\mrxdav.sys
Module97 (96,00,01): [F8AF0000 .. F8AF1FFF] \SystemRoot\System32\Drivers\ParVdm.SYS
Module98 (97,00,01): [EBABA000 .. EBB0AFFF] \SystemRoot\System32\DRIVERS\srv.sys
Module99 (98,00,01): [F5F1D000 .. F5F22FFF] \SystemRoot\System32\Drivers\TDTCP.SYS
Module100 (99,00,01): [EB8D4000 .. EB8F0FFF] \SystemRoot\System32\Drivers\RDPWD.SYS
Module101 (100,00,01): [F5CFE000 .. F5D10FFF] \SystemRoot\system32\drivers\wdmaud.sys
Module102 (101,00,01): [EB9A1000 .. EB9ADFFF] \SystemRoot\system32\drivers\sysaudio.sys
Module103 (102,00,01): [F541E000 .. F5441FFF] \SystemRoot\System32\Drivers\Fastfat.SYS
Module104 (103,00,02): [BFFA0000 .. BFFE3FFF] \SystemRoot\System32\ATMFD.DLL
Module105 (104,00,01): [BFF60000 .. BFF76FFF] \SystemRoot\System32\RDPDD.dll
Module106 (105,00,01): [BF9BF000 .. BF9F0FFF] \SystemRoot\System32\ati2dvag.dll
Module107 (106,00,01): [BF9F1000 .. BFABBFFF] \SystemRoot\System32\ati3d1ag.dll
Module108 (107,00,01): [F40ED000 .. F4114FFF] \SystemRoot\system32\drivers\kmixer.sys
Module109 (108,108,01): [77F40000 .. 77FF2FFF] \WINDOWS\system32\ntdll.dll

*********** Object Information ********************

*********** Directory Object Type ********************

    NumberOfObjects: 46
    Object: E10015E0  Name: \  Creator: System (00000004) (Backtrace00000)

        PointerCount: 42  HandleCount: 0  Security: E1001510  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E1000430  Name: \KernelObjects  Creator: System (00000004) (Backtrace00000)

        PointerCount: 5  HandleCount: 0  Security: E1000368  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E1001340  Name: \ObjectTypes  Creator: System (00000004) (Backtrace00000)

        PointerCount: 24  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E1001158  Name: \GLOBAL??  Creator: System (00000004) (Backtrace00000)

        PointerCount: 125  HandleCount: 1  Security: E10017A8  Flags: 36 KernelMode Permanent DefaultSecurityQuota
        Handle: 00000018  Access:000f000f  Process: smss.exe (00000130)

    Object: E1006D20  Name: \Callback  Creator: System (00000004) (Backtrace00000)

        PointerCount: 7  HandleCount: 0  Security: E1006C68  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E10064E8  Name: \Security  Creator: System (00000004) (Backtrace00000)

        PointerCount: 5  HandleCount: 0  Security: E1007B80  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E10062D8  Name: \ArcName  Creator: System (00000004) (Backtrace00000)

        PointerCount: 8  HandleCount: 0  Security: E1001510  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E10061E8  Name: \Device  Creator: System (00000004) (Backtrace00000)

        PointerCount: 189  HandleCount: 0  Security: E1001510  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E12F4800  Name: \Driver  Creator: System (00000004) (Backtrace00000)

        PointerCount: 73  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E12F4720  Name: \FileSystem  Creator: System (00000004) (Backtrace00000)

        PointerCount: 25  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E12F4640  Name: \FileSystem\Filters  Creator: System (00000004) (Backtrace00000)

        PointerCount: 2  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E1353C80  Name: \Device\Ide  Creator: System (00000004) (Backtrace00000)

        PointerCount: 7  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E1366E58  Name: \Device\DmControl  Creator: System (00000004) (Backtrace00000)

        PointerCount: 9  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E13794E0  Name: \Device\HarddiskDmVolumes  Creator: System (00000004) (Backtrace00000)

        PointerCount: 3  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E137C3B8  Name: \Device\DmControl\RawDmVolumes  Creator: System (00000004) (Backtrace00000)

        PointerCount: 2  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E13796C0  Name: \Device\HarddiskDmVolumes\PhysicalDmVolumes  Creator: System (00000004) (Backtrace00000)

        PointerCount: 2  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E1377D18  Name: \Device\Scsi  Creator: System (00000004) (Backtrace00000)

        PointerCount: 5  HandleCount: 0  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota

    Object: E1380320  Name: \Device\Harddisk0  Creator: System (00000004) (Backtrace00000)

        PointerCount: 9  HandleCount: 1  Security: E1001698  Flags: 36 KernelMode Permanent DefaultSecurityQuota
        Handle: 000000e0  Access:000f000f  Process: System (00000004)

    Object: E1366AD0  Name: \Device\WinDfs  Creator: System (00000004) (Backtrace00000)

        PointerCount: 4  HandleCount: 1  Security: E1001698  Flags: 26 KernelMode DefaultSecurityQuota
        Handle: 000000ac  Access:000f000f  Process: System (00000004)

    Object: E15CA500  Name: \Windows  Creator: smss.exe (00000130) (Backtrace00000)

        PointerCount: 6  HandleCount: 1  Security: E14EFC28  Flags: 34 Permanent DefaultSecurityQuota
        Handle: 00000024  Access:000f000f  Process: csrss.exe (00000160)

    Object: E15DAE10  Name: \RPC Control  Creator: smss.exe (00000130) (Backtrace00000)

        PointerCount: 85  HandleCount: 0  Security: E15DDDD0  Flags: 34 Permanent DefaultSecurityQuota

    Object: E15CDB90  Name: \Sessions  Creator: smss.exe (00000130) (Backtrace00000)

        PointerCount: 6  HandleCount: 1  Security: E137E7A8  Flags: 34 Permanent DefaultSecurityQuota
        Handle: 0000001c  Access:000f000f  Process: smss.exe (00000130)

Note

  • The first portion of the output for this example is very large so it has been truncated at this point. What follows this note is the end of the output.
    •

*********** 00000DC8 (Unknown Process (00000DC8)) Information ********************

    BasePriority:       0
    VirtualSize:        00000000
    PeakVirtualSize:    00000000
    WorkingSetSize:     00000000
    PeakWorkingSetSize: 00000000
    PagefileUsage:      00000000
    PeakPagefileUsage:  00000000
    PageFaultCount:     00000000
    PrivatePageCount:   00000000
    Number of Threads:  0

*********** 00000120 (Unknown Process (00000120)) Information ********************

    BasePriority:       0
    VirtualSize:        00000000
    PeakVirtualSize:    00000000
    WorkingSetSize:     00000000
    PeakWorkingSetSize: 00000000
    PagefileUsage:      00000000
    PeakPagefileUsage:  00000000
    PageFaultCount:     00000000
    PrivatePageCount:   00000000
    Number of Threads:  0

*********** 00000E74 (Unknown Process (00000E74)) Information ********************

    BasePriority:       0
    VirtualSize:        00000000
    PeakVirtualSize:    00000000
    WorkingSetSize:     00000000
    PeakWorkingSetSize: 00000000
    PagefileUsage:      00000000
    PeakPagefileUsage:  00000000
    PageFaultCount:     00000000
    PrivatePageCount:   00000000
    Number of Threads:  0


DH Remarks

Preparing to Run DH

Before you can use DH, you must enable several flags in the registry and install debug symbols on your computer.

Follow these steps before running DH:

  1. Back up your registry settings.

    2. Note

    • Make sure you understand how to restore the registry if a problem occurs. For information on restoring the registry, see the Restore a registry key help topic in Regedit.exe.
  2. Start Registry Editor (Regedit.exe)

    3. Caution

    • The registry editors bypass standard safeguards, allowing settings that can degrade performance, damage your system, or even require you to reinstall Windows. You can safely alter most registry settings by using the programs in Control Panel or Microsoft Management Console (MMC). If you must edit the registry directly, back it up first. Read the Registry Editor Help for more information.
  3. From the HKEY_LOCAL_MACHINE subtree, go to the following key:

    SYSTEM\CurrentControlSet\Control\Session Manager

  4. Change the value of the GlobalFlag entry to 23000. For example:

    5. GlobalFlag:REG_DWORD:0X00023000

    Note

    • By default, this value is ZERO or 0x00000000.
  5. Run Global Flags Editor (GFlags), one of the Windows Support Tools. Select System Registry as the destination to change, and make sure that the following options are enabled:
    • Create user mode stack trace DB
    • Create kernel mode stack trace DB
    • Enable debugging of Win32 subsystem
    • Enable loading of kernel debugger symbols
  6. Click OK to close the Global Flags dialog box, and then quit the Registry Editor.
  7. If you have a checked build of Windows, install the checked symbol table files into the %WINDIR% directory.

    8. Note

    • Symbol table files must match the version of the image from which they were made. The Windows XP Professional or Windows Server 2003 CD contains these files. If you install a service pack, you must also install the updated symbol table files.
  8. Shut down and restart the computer.
  9. After restarting, open a command prompt, type the following command to set the location of the symbol files:

    SET _NT_SYMBOL_PATH=C:\%WINDIR%

    Press ENTER.

Using DH

When setting up development practices for a new project, many developers like to use a common memory allocation routine, exposed as a macro, which can easily be switched to use a memory leak-tracking version. When the process ends, this memory leak-tracking version dumps any remaining allocated memory chunks, typically stored in a linked list, along with the file name and line-number information about where each allocation was made.

Older projects might not have a plan for such memory leak-tracking features. In this case, you can use Dh.exe to dump all memory allocations at a beginning point in the test program to a file (Dh_1.dmp, for example), run the stress application for some time, have the stress program pause in a state that should be identical to the first pause, then take another reading with Dh.exe (Dh_2.dmp).

Displaying a List of All Windows Kernel Objects

Use the -p 0 parameter to display:

  • A list of all Windows kernel objects in the system
  • All handles to those objects for each process

Note

  • Global flag settings still apply when you use DH.

Using the UMDH Parameter

Introduction

The User Mode Dump Heap Utility (UMDH) is used for dumping the heap contents of a running process.

Most processes have more than one active heap. The UMDH log contains all of them. When dumping the heap contents for notepad.exe:

  • Your first action is to enable the stack trace acquisition for the application you plan to test.

    • This feature is not enabled by default. If you wish to enable it, type the following on the command line and press:

    ENTERCODE> gflags -i notepad.exe +ust

    The command does not enable stack tracing for processes already running, but does enable it for all future runs of notepad.exe.

  • Your second action is to set the correct symbols.

    • In this example, assume that the correct symbols have been copied to the test machine in the %windir%\symbols directory. To set the symbol path so that UMDH can find the symbol files, type the following at the command line and press ENTER.

    set _NT_SYMBOL_PATH=%windir%\symbols
  • Your next action is to launch Notepad.

    • When that is done, you can determine the Process Identification (PID) of the Notepad process you just started. Type the following at the command line and press ENTER:

    tlist

    You can determine the PID from the output of the tlist command. You can also obtain the PID information from Task Manager. In the following example, the PID for the Notepad process just started is 124. To use UMDH to get a heap dump, type the following at the command line and press ENTER:

    umdh -p:124 -f:notepad-124.dmp

    The results are a complete heap dump of the Notepad process into the notepad-124.dmp file.

Stack Traces

The most important information in UMDH logs is the stack traces of the heap allocations. By analyzing them, you can determine whether or not a process leaks heap memory. These stack traces are not acquired by default. You can enable the feature on either a per-process or system-wide basis.

  • To enable stack tracing system-wide, type the following at the command line and press ENTER:
    • gflags -r +ust
  • Reboot the machine.
  • To enable stack tracking per process:
    • Type the following at the command line and press ENTER:
      • gflags -i APP-NAME +ust

      APP-NAME is the file name of the executable including the extension (For example, services.exe, lsass.exe).

      The command does not enable stack tracing for a process already running . For this reason, in case of non-restartable processes (services, lsass, winlogon), the test machine needs to be rebooted.

  • To verify the settings that have been set system-wide, or for a specific process, type the following at the command line and press ENTER:
    • System-wide:
      • gflags -r
    • Specific process:
      • gflags -i APP-NAME

The internal algorithms used to get runtime stack traces are reliable on checked builds. On free builds they are not reliable due to some compiler optimizations used for building system binaries (For example, frame pointer omission and others). That is why the UMDH logs often contain incomplete or null stacks on free builds. When running a checked build is not an option, you can improve your chances of getting good stack traces on a free build if all binaries of interest are replaced with checked versions.

Symbols

The parameter UMDH uses the Debug Help library (dbghelp)to resolve symbols. Therefore, the _NT_SYMBOL_PATH must be set appropriately. The best way to set the symbol path is by initializing the _NT_SYMBOL_PATH environment variable to the path to be used. This can be done once when the test machine is set up by going to System/Control Panel (Advanced, Environment Variables …) or inside a command window before running UMDH. Normally the symbols are copied to the test machine in the %windir%\symbols directory. In this case, to set the variable, type the following at the command line and press ENTER:

set _NT_SYMBOL_PATH=%windir%\symbols

If the symbols are not copied to the test machine, and you want to use a remote symbol repository, type the following at the command line and press ENTER:

set _NT_SYMBOL_PATH= symsrv*symsrv.dll*\\symbols\\symbols

This symbol path uses an internal symbols repository and an automatic way to figure out the symbols that are needed.

Command Line

The only required command line parameter for UMDH is the -p parameter which specifies the PID of the process from which a heap dump will be obtained. The PID can be obtained using the Task Manager or the tlist program. For a command like umdh -p:PID, the log is dumped to the standard output. UMDH also displays various informational messages to standard error and, therefore, if not redirected, it is mixed with the real log.

  • To gather the UMDH informational messages in a file, type the following at the command line and press ENTER:
    • umdh -p:PID 2>umdh.msg
  • To gather the log dumped by UMDH in a file, use one of the following equivalent commands:
    • umdh -p:PID >umdh.log
    umdh -p:PID -f:umdh.log

    The default log obtained by UMDH contains a list of heap consumers sorted by allocation count. If, for debugging purposes, you also need a dump of all allocated blocks with their corresponding stack traces, use the -d option:

    umdh -p:PID -d
  • For complete dumps of specific stack traces, use the trace index (it is displayed in the log for every heap consumer).
    • umdh -p:PID -d:INDEX
  • If the log contains too much information, it can be limited to users who have the allocation count above a certain threshold. For this purpose, the command is:
    • umdh -p:PID -t:THRESHOLD

    All the previously-described command line parameters (-p, -f, -t, -d) can be specified simultaneously in any order.

    The following example shows all four parameters being used in a single command:

    umdh -p:123 -t:1000 -f:umdh.log -d

    This command dumps the heaps for a process with PID 123 into the umdh.log file. It dumps only stack traces that account for more than 1000 allocations. It also dumps the addresses of the heap blocks allocated through each stack trace.

Output Explained

If you redirect the log to a file (umdh -p:PID -f:umdh.dmp), the contents resemble the following output, which was obtained from a running Notepad process.

UMDH: Logtime 2000-06-28 10:54 - Machine=SILVIUC2 - PID=704
*********** Heap 00270000 Information ********************
    Flags: 58000062
    Number Of Entries: 87
    Number Of Tags: <unknown>
    Bytes Allocated: 00008DF0
    Bytes Committed: 0000A000
    Total FreeSpace: 00001210
    Number of Virtual Address chunks used: 1
    Address Space Used: <unknown>
    Entry Overhead: 8
    Creator:  (Backtrace00007)
        ntdll!RtlDebugCreateHeap+0x00000196
        ntdll!RtlCreateHeap+0x0000023F
        ntdll!LdrpInitializeProcess+0x00000369
        ntdll!LdrpInitialize+0x0000028D
        ntdll!KiUserApcDispatcher+0x00000007
*********** Heap 00270000 Hogs ********************
000001A0 bytes in 0x4 allocations (@ 0x00000068) by: BackTrace00031
        ntdll!RtlDebugAllocateHeap+0x000000FB
        ntdll!RtlAllocateHeapSlowly+0x0000005B
        ntdll!RtlAllocateHeap+0x00000D81
        ntdll!LdrpAllocateDataTableEntry+0x00000039
        ntdll!LdrpMapDll+0x000002A4
        ntdll!LdrpLoadImportModule+0x0000010D
        ntdll!LdrpWalkImportDescriptor+0x0000008B
        ntdll!LdrpLoadImportModule+0x0000011D
        ntdll!LdrpWalkImportDescriptor+0x0000008B
        ntdll!LdrpLoadImportModule+0x0000011D
        ntdll!LdrpWalkImportDescriptor+0x0000008B
        ntdll!LdrpInitializeProcess+0x000009DC
        ntdll!LdrpInitialize+0x0000028D
        ntdll!KiUserApcDispatcher+0x00000007

000001A0 bytes in 0x4 allocations (@ 0x00000068) by: BackTrace00034
        ntdll!RtlDebugAllocateHeap+0x000000FB
        ntdll!RtlAllocateHeapSlowly+0x0000005B
        ntdll!RtlAllocateHeap+0x00000D81
        ntdll!LdrpAllocateDataTableEntry+0x00000039
        ntdll!LdrpMapDll+0x000002A4
        ntdll!LdrpLoadImportModule+0x0000010D
        ntdll!LdrpWalkImportDescriptor+0x0000008B
        ntdll!LdrpLoadImportModule+0x0000011D
        ntdll!LdrpWalkImportDescriptor+0x0000008B
        ntdll!LdrpLoadImportModule+0x0000011D
        ntdll!LdrpWalkImportDescriptor+0x0000008B
        ntdll!LdrpLoadImportModule+0x0000011D
        ntdll!LdrpWalkImportDescriptor+0x0000008B
        ntdll!LdrpInitializeProcess+0x000009DC
        ntdll!LdrpInitialize+0x0000028D
        ntdll!KiUserApcDispatcher+0x00000007

Most of the time, the information is read and interpreted by other leak analysis tools. However, if you need to inspect the log, it contains a dump of every heap in the process. In the preceding example, the log starts with heap at address 270000. After a few global counters for the heap, the log contains a dump in decreasing sorted order of stack traces that are responsible for the most allocations. By comparing the dynamics of memory used at different moments, you can deduce what happened in the process and determine whether or not any heap usage looks like a leak.


DH Syntax

DH uses the following general syntax:

One Step dh {/p n | /p /1 | /p 0 [/k] [/o]} [/l] [/m] [/s] [/g] [/h] [/t] [/b] [/i] [/f fileName] [/-] [umdh] [/?]

Parameters

/p n
Displays information about process with client ID of n in dh_n.dmp. Default flags for -p n are -s -g.
/p /1
Displays information about Win32 subsystem process in dh_win32.dmp.
/p 0
Displays information about kernel memory and objects in dh_sys.dmp. Default flags for -p 0 are -m -s -g -t -k -o.
/k
Displays information about processes and threads (valid only with -p 0).
/o
Displays information about object handles (valid only with -p 0).
/l
Displays information about locks.
/m
Displays information about module table.
/s
Displays summary information about heaps.
/g
Displays information about memory hogs. This option displays a sorted list of call sites that have allocated the most memory. Each call site is identified by a symbolic stack back trace of up to 16 levels that must uniquely identify the code path that resulted in the memory allocations.
/h
Displays information about heap entries for each heap.
/t
Displays information about heap tags for each heap.
/b
Displays information about stack back trace database.
/i
Ignores information about stack back trace database.
/f filename
Specifies the file to write the dump to.
/# n
Sets the buffer size to n Megs.
/-
Specifies that the dump output should be written to STDOUT.
/r n
Generates a log every n minutes with _# appended to the filename.
/?
Displays this usage information.
/UMDH
The UMDH parameter can be used in two modes. Use the first mode to dump the heap information into a log file. Use the second mode to compare the two log files generated by UMDH in mode one.

Note

  • The parameter umdh uses the Debug Help (dbghelp) library to resolve symbols. Therefore, _NT_SYMBOL_PATH must be set appropriately.

Mode One

In mode one, UMDH allows the user to dump heap information into a log file.

Syntax

One Step umdh [/h] {/p:(int)Process-id | /t(int)Threshold | [/f] (char *)Filename | [/d] {:(int)Trace-Number}} [/v] {:(char *)Filename} [/i:](int)Infolevel} [/l] [/r] {:(int)Index}

Parameters

/t
Dumps stacks that account for more allocations than a specified value. The defaults is 0; dump all stacks.
/f
Indicates the output file. Destroys an existing file of the same name. The default is to dump to the stdout handle.
/p
Indicates the Process-ID to examine.
/d
Indicates the dump address of each outstanding allocation. An optional inclusion of an integer numeric argument causes a dump of only those blocks allocated from this BackTrace.
/v
Dumps debug output to the Standard Error (STDERR) buffer or to a file.
/i
Writes information to the log file. The default is Zero. The greater the number, the more data is displayed. Supported numbers are 0 and 1.
/l
Prints file and line number information for traces.
/r
Prints a raw dump of the trace database without any heap information. If an index is specified, only the trace with that particular index will be dumped.
/h
Indicates a usage message.

Mode Two

In mode two, umdh allows the user to compare the two log files generated by umdh in mode one. This is useful in finding leaks.

Syntax

One Step umdh [/h] {[/d] [/v] File1 File2}

Parameters

/h
Indicates a usage message.
/d
Prints a raw dump of the trace database without any heap information. If an index is specified, only the trace with that particular index is dumped.
/v
Indicates verbose output. It includes the actual backtraces and summary information.


DiskRaid Examples

Example: Interactively View Status of Subsystem

If you want to view the status of subsystem 0 on your computer, type the following at the command line:

diskraid

Press ENTER. The following is displayed:

Microsoft Diskraid version 5.2.xxxx
Copyright (c) 2003 Microsoft Corporation
On computer: COMPUTER_NAME

To select subsystem 0, type the following at the DiskRaid prompt:

select subsystem 0

Press ENTER. Output similar to the following is displayed:

Subsystem 0 is now the selected subsystem.

DISKRAID> list drives

  Drive ###  Status      Health          Size      Free    Bus  Slot  Flags
  ---------  ----------  ------------  --------  --------  ---  ----  -----
  Drive 0    Online      Healthy         107 GB    107 GB    0     1
  Drive 1    Offline     Healthy          29 GB     29 GB    1     0
  Drive 2    Online      Healthy         107 GB    107 GB    0     2
  Drive 3    Not Ready   Healthy          19 GB     19 GB    1     1

To exit DiskRaid, type the following at the DiskRaid prompt:

exit

Press ENTER. The following output is displayed:

Leaving Diskraid ...


DiskRaid Remarks

Run DiskRaid without parameters to use it interactively. To return to the command prompt, type exit.

Using DiskRaid Interactive Mode Operations

DiskRaid makes use of the following commands:

HELP

One Step [operation] {help | /?}

operation
When used with /help or /? displays detailed help for the specified operation.
{help | /?}
Displays a list of all DiskRaid operation.

ADD

One Step add plex lun=n [NOERR]

Warning

  • All data on the LUN being added as a plex will be lost.
plex lun=n
Specifies the LUN number to add as a plex to the currently selected LUN. A LUN must be selected for this operation to succeed.
noerr
Specifies that any failures that occur while performing this operation be ignored. This is useful in script mode.

Warning

  • All data on the LUN being added as a plex will be lost.

ASSOCIATE

One Step associate controllers [add] [n, n, ...]

associate controllers
This operation adds to or replaces the list of controllers that are associated with the currently selected LUN. A LUN must be selected for this operation to succeed.
add
Specifies that the selected controllers be added to the existing list of controllers associated with the LUN. If this parameter is not specified, the list of controllers replaces the existing list of controllers associated with this LUN.
[n, n, ...]
Specifies the number of the raid controller to add.

AUTOMAGIC

One Step automagic {set | clear | apply} all flag=value [flag=value [...]]

Used with no parameters, the automagic operation displays a list of flags. The flags are identified by three-letter acronyms.

set
Sets the specified flags to the specified values.
clear
Clears the specified flags. The all keyword clears all the automagic flags.
apply
Applies the current flags to the selected LUN. A LUN must be selected for this operation to succeed.

BREAK

One Step break plex=plex_number [noerr]

Removes the plex from the currently selected LUN.

plex
Specifies the number of the plex to remove. The plex will not be retained, and the resources used by this plex will be reclaimed.
noerr
Specifies that any failures that occur while performing this operation will be ignored. This is useful in script mode.

Note

  • A LUN of type MIRROR must be selected for this operation to succeed.

Warning

  • All data on the plex will be lost.

CREATE

One Step create lun type {size=LUN_size | drives=drive_number, [drive_number, ...]} [stripesize=interleave_size] [noerr]

This operation creates a new LUN.

type
Specifies the type of LUN to create. The LUN types are: simple, stripe, RAID, mirror, or automagic. Specifying the automagic type will create a LUN using the automagic hints currently in effect. See the automagic operation for more information .
size=
Specifies the total LUN size in megabytes. If the size= parameter is not specified, the LUN created will be the largest possible size allowed by all the specified drives.

To specify the size using other units, use one of the following recognized suffixes immediately after the size:

  • B for byte.
  • KB for kilobyte
  • MB for megabyte
  • GB for gigabyte
  • TB for terabyte
  • PB for petabyte
drives=
Specifies the drive_number for the drives to use to create a LUN. If the size= parameter is not specified, the LUN created is the largest possible size allowed by all the specified drives.
stripesize=
Specifies the interleave_size in megabytes for a stripe or RAID LUN.

To specify the size using other units, use one of the following recognized suffixes immediately after the size:

  • B for byte.
  • KB for kilobyte
  • MB for megabyte
  • GB for gigabyte
  • TB for terabyte
  • PB for petabyte
noerr
Specifies that any failures that occur while performing this operation will be ignored. This is useful in script mode.

Notes

  • Either the size= or the drives= parameter must be specified. They can also be used together.
  • A subsystem must be selected for this operation to succeed.
  • The stripe size for a LUN cannot be changed after creation.

DELETE

One Step delete lun [noerr]

This operation deletes the currently selected LUN. A LUN must be selected for this operation to succeed.

noerr
Specifies that any failures that occur while performing this operation will be ignored. This is useful in script mode.

DETAIL

One Step detail object_type [verbose]

Displays detailed information about the selected object of the specified type. An object of the specified type must be selected for this operation to succeed.

object_type
Displays detailed information about the specified object_type. The valid object types are: provider, subsystem, controller, drive, or LUN.
verbose
Specifying the verbose parameter displays additional information, including the list of plexes. The verbose parameter can only be used with the object_type LUN.

DISSOCIATE

One Step dissociate controllers controller_number[, controller_number, ...]

The dissociate operation allows the user to set controllers as inactive for the selected LUN.

controller_number
Specifies the controller to dissociate.

Note

  • A LUN must be selected for this operation to succeed.

EXIT

Exits Diskraid.

EXTEND

One Step extend lun {size=LUN_size | drives=drive_number, [drive_number, ...]} [noerr]

size=
specifies the size in megabytes to extend the LUN.

To specify the size using other units, use one of the following recognized suffixes immediately after the size:

  • B for byte.
  • KB for kilobyte
  • MB for megabyte
  • GB for gigabyte
  • TB for terabyte
  • PB for petabyte
noerr
Specifies that any failures that occur while performing this operation should be ignored. This is useful in script mode.
drives=
Specifies the drive_number for the drives to use when creating a LUN. If the size= parameter is not specified, the LUN created is the largest possible size allowed by all the specified drives.
noerr
Specifies that any failures that occur while performing this operation should be ignored. This is useful in script mode.

Notes

  • Either the size or the drive parameter must be specified. They can also be used together.
  • A LUN must be selected for this operation to succeed.

FLUSHCACHE

One Step flushcache controller

Flushes the cache on the currently selected controller.

Note

  • A controller must be selected for this operation to succeed.

INVALIDATECACHE

One Step invalidatecache controller

Invalidates the cache on the currently selected controller.

LIST

One Step list object

The list operation displays a list of objects of the specified type.

object
Specifies the type of object for which to display the list. The object type can be providers, subsystems, controllers, drives or LUNS.

Note

  • For displaying the list of controllers, drives and LUNS, a subsystem must be selected. The list displayed for these objects is specific to the currently selected subsystem.

MAINTENANCE

One Step maintenance object operation [count=iteration]

The maintenance operation maintains the currently selected object of the specified type.

object
specifies the type of object on which to perform the operation. The object type can be a provider, subsystem, controller, drive or LUN.
operation
Specifies the maintenance operation to perform. The operation type can be spinup, spindown, blink, beep or ping. An operation must be specified.
count=
Specifies the number of times to repeat the operation. This is typically used with blink, beep or ping.

Note

  • An object of the specified type must be selected for this operation to succeed.

OFFLINE

One Step offline object

Sets the state of the selected object of the specified type to offline.

object
Specifies the type of object on which to perform this operation. The object type can be subsystem, controller, drive, or LUN.

Note

  • An object of the specified type must be selected for this operation to succeed.

ONLINE

One Step online object

Sets the state of the selected object of the specified type to online.

object
Specifies the type of object on which to perform this operation. The object type can be subsystem, controller, drive, or LUN.

Note

  • An object of the specified type must be selected for this operation to succeed.

RECOVER

One Step recover lun

Performs operations necessary to repair the currently selected LUN.

Note

  • A LUN must be selected for this operation to succeed.

REENUMERATE

One Step reenumerate {subsystems | drives}

Reenumerates objects of the specified type.

subsystems
Queries the available subsystems to discover any new subsystems that were added. A subsystem must be selected for this operation to succeed.
drives
Inventories the drives in the currently selected subsystem. A subsystem must be selected for this operation to succeed.

REFRESH

One Step refresh provider

Refreshes internal data for the currently selected provider. A provider must be selected for this operation to succeed.

REM

Used to comment scripts.

REPLACE

One Step replace drive target=drive_number

Replaces the specified drive with the currently selected drive.

target=
Specifies the drive_number for the drive to be replaced.

Notes

  • This drive may not be the currently selected drive.
  • A drive must be selected for this operation to succeed.

RESET

Resets the currently selected controller.

SELECT

One Step select object [object_number]

Displays or changes the currently selected object.

object
Specifies the type of object to select. The object type can be provider, subsystem, controller, drive, or LUN.
object_number
Specifies the object_number to select. If the object_number specified is not valid, any existing selections for objects of the specified type are cleared. If no object_number is specified, the current object is displayed.

SETFLAG

One Step setflag drive hotspare={true | false}

true
Selects the currently selected drive as a hot spare.
false
Unselects the currently selected drive as a hot spare.

Note

  • Hot spares cannot be used for ordinary LUN binding operations. They are reserved for fault handling only. The drive must not be currently bound to any existing LUN.

UNMASK

One Step unmask LUN {all | none | [add] wwn=hexadecimal_number[;hexadecimal_number;...]}

Makes the currently selected LUN accessible from the specified hosts

all
Specifies that the LUN should be made accessible from all hosts.
none
Specifies that the LUN should not be accessible to any host.
add
Specifies that the hosts specified must be added to the existing list of hosts that this LUN is accessible from. If this parameter is not specified, the list of hosts supplied replaces the existing list of hosts that this LUN is accessible from.
WWN=
Specifies a list of hexadecimal numbers representing world-wide names from which the LUN should be made accessible.

Using Virtual Disk Service

Windows Server 2003 introduces the Virtual Disk Service (VDS). VDS is a set of APIs that provides a single interface for managing disks. Each hardware vendor writes a VDS hardware provider that translates the general-purpose VDS APIs into specific instructions for their hardware. With this abstraction layer provided by VDS, Windows Server 2003 simplifies storage management because storage applications no longer need to take into account the specific hardware being targeted. Instead, you can use compatible storage applications, such as DiskRaid to manage any hardware that has a VDS provider.

Scripting DiskRaid

DiskRaid supports scripted operations. To invoke a DiskRaid script, use

diskraid /s script.txt

DiskRaid may be scripted on any Windows Server 2003 system with an associated VDS hardware provider.

By default, DiskRaid will quit command processing and return an error code if there is a problem in the script. To continue script execution, include the NOERR parameter on the command. This permits such useful practices as using a single script to delete all LUNs in a subsystem regardless of the total number of LUNs. Not all commands support the NOERR parameter. Regardless of the NOERR parameter, an error will always be returned on command syntax errors.

Error codes for DiskRaid:

Error Code | Error Description
0 | No error occurred. The entire script ran without failure
1 | A fatal exception occurred.
2 | The arguments specified on a DiskRaid command line were incorrect.
3 | DiskRaid was unable to open the specified script or output file.
4 | One of the services DiskRaid uses returned a failure.
5 | A command syntax error occurred. The script failed because an object was improperly selected or was invalid for use with that command.


DiskRaid Syntax

DiskRaid uses the following syntax:

One Step diskraid [/?] [/s path] [/v]

Parameters

/?
Displays command-line usage.
/s path
Specifies that DiskRaid execute commands from the script file at the designated location.
/v
Specifies that DiskRaid run in verbose mode, printing out additional information about each command being executed.

Note

  • Run DiskRaid without parameters to use it interactively. After invoking interactive mode, type exit to return to the command prompt. See Using DiskRaid Interactive Mode Operations for more information about using DiskRaid.


DiskUse Examples

Example 1: Display Disk Use for a Drive

To display the disk use for an entire drive, type the following at the command line:

diskuse c:\ /s

Press ENTER. Output similar to the following is displayed:

DiskUse                   Version 1.3

Scanning Path c:\...............................................................
................................................................................
................................................................................
................................................................................
........
WARNING: Could not get SID for c:\hiberfil.sys

WARNING: Could not get SID for c:\PAGEFILE.SYS
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
...........................
Resolving Names....
Sorting....

User: BUILTIN\Administrators
Space Used: 1721166131

User: NT AUTHORITY\SYSTEM
Space Used: 42989498

User: PC1\Administrator
Space Used: 3949664

User: PC1\Jane Smith
Space Used: 1323946499

Example 2: Display Disk Usage in Verbose Mode

To display disk use in verbose mode, type the following at the command line:

diskuse c:\windows\system32\drivers /s /v

Press ENTER. Output similar to the following is displayed:

DiskUse                   Version 1.3

Scanning Path c:\windows\system32\drivers\...
Resolving Names..
Sorting..

User: BUILTIN\Administrators
Space Used: 14818669

           179328 : 08/29/2002 : c:\windows\system32\drivers\acpi.sys
            11648 : 08/23/2001 : c:\windows\system32\drivers\acpiec.sys
           142208 : 08/29/2002 : c:\windows\system32\drivers\aec.sys
           131968 : 08/29/2002 : c:\windows\system32\drivers\afd.sys
            32000 : 08/29/2002 : c:\windows\system32\drivers\amdk6.sys
            57344 : 08/29/2002 : c:\windows\system32\drivers\arp1394.sys
            13568 : 08/23/2001 : c:\windows\system32\drivers\asyncmac.sys
            86912 : 08/29/2002 : c:\windows\system32\drivers\atapi.sys
            57216 : 08/23/2001 : c:\windows\system32\drivers\atmarpc.sys
            31360 : 08/23/2001 : c:\windows\system32\drivers\atmepvc.sys
            53888 : 08/29/2002 : c:\windows\system32\drivers\atmlane.sys
           352256 : 08/23/2001 : c:\windows\system32\drivers\atmuni.sys
             3072 : 08/17/2001 : c:\windows\system32\drivers\audstub.sys
             4224 : 08/23/2001 : c:\windows\system32\drivers\beep.sys
            68864 : 08/29/2002 : c:\windows\system32\drivers\bridge.sys
            13952 : 08/23/2001 : c:\windows\system32\drivers\cbidf2k.sys
            18688 : 08/23/2001 : c:\windows\system32\drivers\cdaudio.sys
            59648 : 08/29/2002 : c:\windows\system32\drivers\cdfs.sys
            47488 : 08/29/2002 : c:\windows\system32\drivers\cdrom.sys
           262528 : 08/23/2001 : c:\windows\system32\drivers\cinemst2.sys
            46336 : 08/29/2002 : c:\windows\system32\drivers\classpnp.sys
            11776 : 08/23/2001 : c:\windows\system32\drivers\cpqdap01.sys
            31488 : 08/29/2002 : c:\windows\system32\drivers\crusoe.sys
            33792 : 08/29/2002 : c:\windows\system32\drivers\disk.sys
            13184 : 08/29/2002 : c:\windows\system32\drivers\diskdump.sys
           780928 : 08/23/2001 : c:\windows\system32\drivers\dmboot.sys
           146304 : 08/23/2001 : c:\windows\system32\drivers\dmio.sys
             5888 : 08/23/2001 : c:\windows\system32\drivers\dmload.sys
            50048 : 08/17/2001 : c:\windows\system32\drivers\DMusic.sys
            57856 : 08/29/2002 : c:\windows\system32\drivers\drmk.sys
             2816 : 08/29/2002 : c:\windows\system32\drivers\drmkaud.sys
            10496 : 08/23/2001 : c:\windows\system32\drivers\dxapi.sys
            68992 : 08/29/2002 : c:\windows\system32\drivers\dxg.sys
             3328 : 08/23/2001 : c:\windows\system32\drivers\dxgthk.sys
              734 : 08/23/2001 : c:\windows\system32\drivers\etc\hosts
             3683 : 08/23/2001 : c:\windows\system32\drivers\etc\lmhosts.sam
              407 : 08/23/2001 : c:\windows\system32\drivers\etc\networks
              799 : 08/23/2001 : c:\windows\system32\drivers\etc\protocol
             7116 : 08/23/2001 : c:\windows\system32\drivers\etc\services
           145152 : 08/29/2002 : c:\windows\system32\drivers\fastfat.sys
            26240 : 08/23/2001 : c:\windows\system32\drivers\fdc.sys
            34944 : 08/23/2001 : c:\windows\system32\drivers\fips.sys
            19712 : 08/29/2002 : c:\windows\system32\drivers\flpydisk.sys
            12160 : 08/23/2001 : c:\windows\system32\drivers\fsvga.sys
             7936 : 08/23/2001 : c:\windows\system32\drivers\fs_rec.sys
           125056 : 08/23/2001 : c:\windows\system32\drivers\ftdisk.sys
             9856 : 08/29/2002 : c:\windows\system32\drivers\gameenum.sys
          3440660 : 08/23/2001 : c:\windows\system32\drivers\gm.dls
              646 : 08/23/2001 : c:\windows\system32\drivers\gmreadme.txt
            34560 : 08/29/2002 : c:\windows\system32\drivers\hidclass.sys
            23680 : 08/23/2001 : c:\windows\system32\drivers\hidparse.sys
            51072 : 08/29/2002 : c:\windows\system32\drivers\i8042prt.sys
            39808 : 08/29/2002 : c:\windows\system32\drivers\imapi.sys
            32896 : 08/23/2001 : c:\windows\system32\drivers\ipfltdrv.sys
            19584 : 08/23/2001 : c:\windows\system32\drivers\ipinip.sys
            79488 : 08/29/2002 : c:\windows\system32\drivers\ipnat.sys
            57984 : 08/29/2002 : c:\windows\system32\drivers\ipsec.sys
            10496 : 08/23/2001 : c:\windows\system32\drivers\irenum.sys
            35840 : 08/23/2001 : c:\windows\system32\drivers\isapnp.sys
            23424 : 08/29/2002 : c:\windows\system32\drivers\kbdclass.sys
           159360 : 08/29/2002 : c:\windows\system32\drivers\kmixer.sys
           131712 : 08/29/2002 : c:\windows\system32\drivers\ks.sys
            79744 : 08/23/2001 : c:\windows\system32\drivers\ksecdd.sys
             7680 : 08/23/2001 : c:\windows\system32\drivers\mcd.sys
            62208 : 08/23/2001 : c:\windows\system32\drivers\mf.sys
             4224 : 08/23/2001 : c:\windows\system32\drivers\mnmdd.sys
            28800 : 08/23/2001 : c:\windows\system32\drivers\modem.sys
            22016 : 08/29/2002 : c:\windows\system32\drivers\mouclass.sys
            37504 : 08/23/2001 : c:\windows\system32\drivers\mountmgr.sys
            67200 : 08/29/2002 : c:\windows\system32\drivers\mqac.sys
           172672 : 08/23/2001 : c:\windows\system32\drivers\mrxdav.sys
           407552 : 08/29/2002 : c:\windows\system32\drivers\mrxsmb.sys
            18048 : 08/23/2001 : c:\windows\system32\drivers\msfs.sys
            33792 : 08/23/2001 : c:\windows\system32\drivers\msgpc.sys
             7040 : 08/29/2002 : c:\windows\system32\drivers\mskssrv.sys
             2944 : 08/17/2001 : c:\windows\system32\drivers\msmpu401.sys
             5120 : 08/17/2001 : c:\windows\system32\drivers\MSPCLOCK.sys
             4608 : 08/17/2001 : c:\windows\system32\drivers\MSPQM.sys
           104064 : 08/29/2002 : c:\windows\system32\drivers\mup.sys
           167552 : 08/29/2002 : c:\windows\system32\drivers\ndis.sys
             9600 : 08/23/2001 : c:\windows\system32\drivers\ndistapi.sys
            12288 : 08/29/2002 : c:\windows\system32\drivers\ndisuio.sys
            87552 : 08/29/2002 : c:\windows\system32\drivers\ndiswan.sys
            38016 : 08/23/2001 : c:\windows\system32\drivers\ndproxy.sys
            33152 : 08/29/2002 : c:\windows\system32\drivers\netbios.sys
           157056 : 08/29/2002 : c:\windows\system32\drivers\netbt.sys
            57984 : 08/29/2002 : c:\windows\system32\drivers\nic1394.sys
            12032 : 08/23/2001 : c:\windows\system32\drivers\nikedrv.sys
            38272 : 08/29/2002 : c:\windows\system32\drivers\nmnt.sys
            29568 : 08/23/2001 : c:\windows\system32\drivers\npfs.sys
           561920 : 08/29/2002 : c:\windows\system32\drivers\ntfs.sys
             2944 : 08/23/2001 : c:\windows\system32\drivers\null.sys
           731648 : 08/17/2001 : c:\windows\system32\drivers\nv4.sys
            12416 : 08/23/2001 : c:\windows\system32\drivers\nwlnkflt.sys
            32512 : 08/23/2001 : c:\windows\system32\drivers\nwlnkfwd.sys
            84864 : 08/23/2001 : c:\windows\system32\drivers\nwlnkipx.sys
            63232 : 08/23/2001 : c:\windows\system32\drivers\nwlnknb.sys
            55936 : 08/23/2001 : c:\windows\system32\drivers\nwlnkspx.sys
           156544 : 08/29/2002 : c:\windows\system32\drivers\nwrdr.sys
             3456 : 08/23/2001 : c:\windows\system32\drivers\oprghdlr.sys
            37504 : 08/29/2002 : c:\windows\system32\drivers\p3.sys
            76032 : 08/29/2002 : c:\windows\system32\drivers\parport.sys
            18688 : 08/23/2001 : c:\windows\system32\drivers\partmgr.sys
             6784 : 08/23/2001 : c:\windows\system32\drivers\parvdm.sys
            62976 : 08/29/2002 : c:\windows\system32\drivers\pci.sys
             3328 : 08/23/2001 : c:\windows\system32\drivers\pciide.sys
            23680 : 08/29/2002 : c:\windows\system32\drivers\pciidex.sys
           115712 : 08/29/2002 : c:\windows\system32\drivers\pcmcia.sys
           134272 : 08/29/2002 : c:\windows\system32\drivers\portcls.sys
            30592 : 08/29/2002 : c:\windows\system32\drivers\processr.sys
            66048 : 08/29/2002 : c:\windows\system32\drivers\psched.sys
            17792 : 08/23/2001 : c:\windows\system32\drivers\ptilink.sys
             8832 : 08/23/2001 : c:\windows\system32\drivers\rasacd.sys
            48384 : 08/29/2002 : c:\windows\system32\drivers\rasl2tp.sys
            38912 : 08/23/2001 : c:\windows\system32\drivers\raspppoe.sys
            46208 : 10/02/2002 : c:\windows\system32\drivers\raspptp.sys
            16512 : 08/23/2001 : c:\windows\system32\drivers\raspti.sys
            34432 : 08/23/2001 : c:\windows\system32\drivers\rawwan.sys
           163328 : 08/29/2002 : c:\windows\system32\drivers\rdbss.sys
             4224 : 08/23/2001 : c:\windows\system32\drivers\rdpcdd.sys
           182400 : 08/29/2002 : c:\windows\system32\drivers\rdpdr.sys
           115976 : 08/29/2002 : c:\windows\system32\drivers\rdpwd.sys
            56576 : 08/29/2002 : c:\windows\system32\drivers\redbook.sys
            12032 : 08/23/2001 : c:\windows\system32\drivers\rio8drv.sys
            12032 : 08/23/2001 : c:\windows\system32\drivers\riodrv.sys
           200064 : 08/23/2001 : c:\windows\system32\drivers\RMCast.sys
            27648 : 08/23/2001 : c:\windows\system32\drivers\rndismp.sys
             5888 : 08/23/2001 : c:\windows\system32\drivers\rootmdm.sys
            90240 : 08/29/2002 : c:\windows\system32\drivers\scsiport.sys
            27440 : 08/23/2001 : c:\windows\system32\drivers\secdrv.sys
            14976 : 08/23/2001 : c:\windows\system32\drivers\serenum.sys
            62464 : 08/29/2002 : c:\windows\system32\drivers\serial.sys
            10496 : 08/29/2002 : c:\windows\system32\drivers\sfloppy.sys
            26112 : 08/17/2001 : c:\windows\system32\drivers\SISAGP.SYS
            66048 : 09/29/2001 : c:\windows\system32\drivers\sisnic.sys
            14592 : 08/23/2001 : c:\windows\system32\drivers\smclib.sys
            24448 : 08/29/2002 : c:\windows\system32\drivers\sonydcam.sys
             5888 : 08/29/2002 : c:\windows\system32\drivers\splitter.sys
            69248 : 08/29/2002 : c:\windows\system32\drivers\sr.sys
           330368 : 08/23/2001 : c:\windows\system32\drivers\srv.sys
            44416 : 08/29/2002 : c:\windows\system32\drivers\stream.sys
             3840 : 08/23/2001 : c:\windows\system32\drivers\swenum.sys
            54272 : 08/17/2001 : c:\windows\system32\drivers\swmidi.sys
            56832 : 08/29/2002 : c:\windows\system32\drivers\sysaudio.sys
            13824 : 08/29/2002 : c:\windows\system32\drivers\tape.sys
           332928 : 08/29/2002 : c:\windows\system32\drivers\tcpip.sys
           196288 : 08/29/2002 : c:\windows\system32\drivers\tcpip6.sys
            16256 : 08/23/2001 : c:\windows\system32\drivers\tdi.sys
            11144 : 08/23/2001 : c:\windows\system32\drivers\tdpipe.sys
            20232 : 08/23/2001 : c:\windows\system32\drivers\tdtcp.sys
            38024 : 08/29/2002 : c:\windows\system32\drivers\termdd.sys
            51712 : 08/23/2001 : c:\windows\system32\drivers\tosdvd.sys
            21376 : 08/23/2001 : c:\windows\system32\drivers\tsbvcap.sys
            64000 : 08/29/2002 : c:\windows\system32\drivers\udfs.sys
           137088 : 08/23/2001 : c:\windows\system32\drivers\update.sys
            11136 : 08/23/2001 : c:\windows\system32\drivers\usb8023.sys
            23808 : 08/23/2001 : c:\windows\system32\drivers\usbcamd.sys
            23936 : 08/23/2001 : c:\windows\system32\drivers\usbcamd2.sys
             4736 : 08/23/2001 : c:\windows\system32\drivers\usbd.sys
            51968 : 08/29/2002 : c:\windows\system32\drivers\usbhub.sys
            15232 : 08/29/2002 : c:\windows\system32\drivers\usbintel.sys
            15744 : 08/29/2002 : c:\windows\system32\drivers\usbohci.sys
           135552 : 08/29/2002 : c:\windows\system32\drivers\usbport.sys
            58112 : 08/23/2001 : c:\windows\system32\drivers\vdmindvd.sys
            19712 : 08/29/2002 : c:\windows\system32\drivers\vga.sys
            70912 : 08/29/2002 : c:\windows\system32\drivers\videoprt.sys
            49152 : 08/23/2001 : c:\windows\system32\drivers\volsnap.sys
            33280 : 08/23/2001 : c:\windows\system32\drivers\wanarp.sys
            77440 : 08/29/2002 : c:\windows\system32\drivers\wdmaud.sys
             4352 : 08/23/2001 : c:\windows\system32\drivers\wmilib.sys
            12032 : 08/23/2001 : c:\windows\system32\drivers\ws2ifsl.sys

User: PC1\Jane Smith
Space Used: 2565178

            32512 : 08/29/2002 : c:\windows\system32\drivers\amdk7.sys
           327040 : 08/29/2002 : c:\windows\system32\drivers\ati2mtaa.sys
           450176 : 08/29/2002 : c:\windows\system32\drivers\ati2mtag.sys
            56591 : 08/29/2002 : c:\windows\system32\drivers\atinbtxx.sys
            11615 : 08/29/2002 : c:\windows\system32\drivers\atinmdxx.sys
            12047 : 08/29/2002 : c:\windows\system32\drivers\atinpdxx.sys
            30671 : 08/29/2002 : c:\windows\system32\drivers\atinraxx.sys
            63663 : 08/29/2002 : c:\windows\system32\drivers\atinrvxx.sys
            26367 : 08/29/2002 : c:\windows\system32\drivers\atinsnxx.sys
            21343 : 08/29/2002 : c:\windows\system32\drivers\atinttxx.sys
            36463 : 08/29/2002 : c:\windows\system32\drivers\atintuxx.sys
            29455 : 08/29/2002 : c:\windows\system32\drivers\atinxbxx.sys
            34735 : 08/29/2002 : c:\windows\system32\drivers\atinxsxx.sys
             6912 : 08/29/2002 : c:\windows\system32\drivers\hidir.sys
            20288 : 11/08/2001 : c:\windows\system32\drivers\ino_flpy.sys
           111872 : 09/01/2002 : c:\windows\system32\drivers\ino_fltr.sys
            17792 : 08/29/2002 : c:\windows\system32\drivers\irbus.sys
            11904 : 08/29/2002 : c:\windows\system32\drivers\mutohpen.sys
            67866 : 04/16/2002 : c:\windows\system32\drivers\netwlan5.img
           981466 : 09/26/2002 : c:\windows\system32\drivers\nv4_mini.sys
           166656 : 01/18/2002 : c:\windows\system32\drivers\sis7012.sys
             5504 : 08/29/2002 : c:\windows\system32\drivers\smbali.sys
             9856 : 08/29/2002 : c:\windows\system32\drivers\tunmp.sys
            19328 : 08/29/2002 : c:\windows\system32\drivers\usbehci.sys
            13056 : 08/29/2002 : c:\windows\system32\drivers\wacompen.sys


Disuse Remarks

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

DiskUse Remarks

Overview | Remarks | Syntax | Examples | Related Tools Open Command Prompt

Understanding Restriction Files

The restriction file is an ASCII file that lists the disk space an administrator assigns to users. Restriction files do not restrict anything; they only indicate whether users have exceeded the disk space allotted to them by the administrator. The administrator can also use the restriction file to change the amount of disk space allotted to users.

Creating a Restriction File

To create a restriction file:

  1. Open a word processing program such as Word, Wordpad, or Notepad.
  2. Type the names and disk size limits for each user whose disk space you want to restrict. In the following example, Bob and Sally have been assigned 100 megabytes (MB) of disk space, and Frank and Beth have been assigned 1 gigabyte (GB).

    3. Note

    • You can add a comment line to restriction files by adding a semicolon at the beginning of the line. The following example shows two comment lines, ;Normal Users and ;CAD Users. Blank space is ignored.
    ; Normal Users
BOB    104857600
SALLY  104857600

; CAD Users
FRANK 1073741824
BETH  1073741824
  3. When you have added all the user names and their disk space restrictions, save the file. For this example, the file is named TestFile. You can change the disk space values, add or delete user names, or make any other changes at any time. To make changes, open the restriction file, make the desired changes, and save the changes.

Using a Restriction File

To use the restriction file, run DiskUse with the /r:RestrictionFile parameter, substituting the actual file name (in this case, TestFile) for RestrictionFile. This allows you to read use restrictions from the restriction file.

To see a list of users who have exceeded their disk size limits, run DiskUse with the /o parameter. The output will display only those users who have exceeded their disk size allotments.


DiskUse Syntax

DiskUse uses the following general syntax:

One Step diskuse [Path] [/f:OutputFile] [/e:ErrorFile][/u:User] [/s] [/t] [/w] [/q] [/r:RestrictionFile] [/o] [/v] [/d:{a|c|w}] [/n:NumberFiles] [/x:Size] [/?|/h]

Parameters

Path
Specifies the path to list directory space used by each user. Path can be a full path, relative path, or Universal Naming Convention (UNC) path. If you do not specify a path, the default is the current directory.
/f:OutputFile
Directs the output to OutputFile instead of displaying it in the command window. The name of OutputFile can be a full name, relative name, or UNC path. When the /e parameter is used with the /f parameter, errors and warning messages are not displayed. When the /t parameter is added, the file is comma-delimited. If you specify the /t parameter and end the file name with the .csv extension (the extension for comma-delimited files), OutputFile can be loaded directly into a Microsoft Excel spreadsheet.
/e:ErrorFile
Directs all error and warning messages to ErrorFile instead of displaying them in the command window or in OutputFile. The name of ErrorFile can be a full name, relative name, or UNC path.
/u:User
Specifies that DiskUse only scan for and report information about User. User should be in the format Domain\UserName. If you do not specify a domain, DiskUse scans the first instance of a user it finds.
/s
Scans all subdirectories of the specified path.
/t
Specifies that output be displayed in a table format. If the output is written to a file, the table is comma-delimited. If the output is displayed in the command window, the table is space-delimited.
/w
Specifies that output is displayed in Unicode (wide characters). By default, all output is in ANSI characters. Use this parameter if you have Unicode file names on your server and wish to have them reported in Unicode format. Unicode is still read, even if this parameter is not used. This parameter only affects the output.

Note

  • Most command windows cannot display Unicode characters, so Unicode output may not be displayed correctly. If you send the Unicode output to a file, ensure that the program you are using to read the file supports Unicode as well as ANSI (for example, Notepad).
/q
Specifies that DiskUse run in quiet mode (that is, no information is displayed in the command window).
/r:RestrictionFile
Specifies that DiskUse read use restrictions from RestrictionFile.
/o
Specifies that DiskUser display only the names of users who are over the limit specified in the RestrictionFile. This parameter can only be used in conjunction with the /r parameter.
/v
Specifies that DiskUse display file name, size, and date for the files of each user. If you do not specify the type of date by using the /d parameter, the date displayed is the date when the file was last updated.
/d:{a|c|w}
Specifies which date to display in verbose output. This parameter must be used in conjunction with the /v parameter.The following values are valid for the /d parameter:
Value | Description
a | Date when the file was last accessed.
c | Date when the file was created.
w | Date when the file was last updated.
/n:NumberFiles
Specifies the number of the largest files to be displayed, per user. This parameter must be used in conjunction with the /v parameter.
/x:Size
Displays files that are Size bytes or larger. This parameter must be used in conjunction with the /v parameter.
/?|/h
Displays command-line usage.


DumpFSMOs Examples

Overview | Syntax | Examples | Related Tools

Example: Use DumpFSMOs to List the Operations Master (Also Known as Flexible Single Master Operations or FSMO) Roles for a Domain Controller

In this example, the task is to obtain a list of the operations master roles that Server1 holds in the contoso.com domain. To do this, type the following on the command line

dumpfsmos Server1

Press ENTER. The following output is displayed:

ntdsutil: roles
fsmo maintenance: Connections
server connections: Connect to server Server1
Binding to Server1 ...
Connected to Server1 using credentials of locally logged on user.
server connections: Quit
fsmo maintenance: select Operation Target
select operation target: List roles for connected server
Server "Server1" knows about 5 roles
Schema - CN=NTDS Settings,CN=SERVER1,CN=Servers,CN=NewSite,CN=
Sites,CN=Configuration,DC=contoso,DC=com
Domain - CN=NTDS Settings,CN=SERVER1,CN=Servers,CN=NewSite,CN=
Sites,CN=Configuration,DC=contoso,DC=com
PDC - CN=NTDS Settings,CN=SERVER1,CN=Servers,CN=NewSite,CN=Sit
es,CN=Configuration,DC=contoso,DC=com
RID - CN=NTDS Settings,CN=SERVER1,CN=Servers,CN=NewSite,CN=Sit
es,CN=Configuration,DC=contoso,DC=com
Infrastructure - CN=NTDS Settings,CN=SERVER1,CN=NewSite,CN=Sites,CN=Configuration,DC=contoso,DC=com
select operation target: Quit
fsmo maintenance: Quit
ntdsutil: Quit
Disconnecting from Server1...


DumpFSMOs Syntax

Overview | Syntax | Examples | Related Tools

DumpFSMOs uses the following syntax:

One Step dumpfsmos DomainController

Parameters

DomainController
Specifies the name of a domain controller in any domain in the forest.


DVDBurn Examples

Example 1: Using Mountvol.exe to Obtain Volume Names

To obtain volume names instead of using drive letters, type the following at the command line:

mountvol

Press ENTER. Output similar to the following is displayed:

Creates, deletes, or lists a volume mount point.

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L

    path        Specifies the existing NTFS directory where the mount
                point will reside.
    VolumeName  Specifies the volume name that is the target of the mount
                point.
    /D          Removes the volume mount point from the specified directory.
    /L          Lists the mounted volume name for the specified directory.

Possible values for VolumeName along with current mount points are:

 \\?\Volume{a07f2ffe-cc0a-11d6-aaf0-806e6f6e6963}\
    R:\
\\?\Volume{c0745867-cc0a-11d6-aaf0-808592984efe}\
    T:\DVD_Drives\DVDBurner2\
\\?\Volume{950f7691-cc22-11d6-9f44-505054503030}\
    T:\DVD_Drives\DVDBurner3\

Note

  • The tool Mountvol is included with the operating system.

Example 2: Burn a DVD From an Image File When a Drive Letter is Assigned to the DVD Burner

To burn a DVD from an image file when a drive letter is assigned to the DVD Burner, type the following at the command line and press ENTER:

dvdburn R: c:\WinPE.iso

Output similar to the following is displayed:

Media type: DVD-R
Preparing media...
|  25.6% done
/  45.2% done
-  68.9% done
\  89.3% done
- 100.0% done
Finished Writing
Waiting for drive to finalize disc (this may take up to 30 minutes).................
Success: Finalizing media took 1312 seconds
Burn successful!

Note

  • The drive letter assigned to the burner in this example is R and the image file being burned is WinPE.iso.

Example 3: Burn a DVD From an Image File Using a Volume Name (Globally Unique Identifier (GUID)) for the DVD Burner Instead of a Drive Letter

To burn a DVD from an image file when a volume name is assigned to the DVD, type the following at the command line:

dvdburn Volume{b24ff56a-e2d8-11d6-b428-806e6f6e6963} WinPE.iso

Press ENTER. Output similar to the following is displayed:

Media type: DVD+RW
Preparing media...
DVD+RW media will always be formatted.
Formatting may take 1-2 minutes.
DVD+RW Disc is formatting in background -- format succeeded
|  25.6% done
/  45.2% done
-  68.9% done
\  89.3% done
- 100.0% done
Finished Writing
Waiting for drive to finalize disc (this may take up to 4 minutes).................
Success: Finalizing media took 131 seconds
Burn successful!

Notes

  • The volume name assigned to the burner in this example is {b24ff56a-e2d8-11d6-b428-806e6f6e6963} and the image file being burned is WinPE.iso.
  • References to DVD+RW in the example appear in the output only when DVD+RW media is used.

Example 4: Erase a DVD Before Burning an Image File to It

To erase a DVD before burning an image file to it, type the following at the command line:

dvdburn Volume{950f7691-cc22-11d6-9f44-505054503030} c:\WinPE.iso /erase

Press ENTER. Output similar to the following is displayed:

Erasing media before burning
Media type: DVD-RW
Erasing media
Attempting to blank media..........................................
Preparing media...
|  25.6% done
/  45.2% done
-  68.9% done
\  89.3% done
Finished Writing
Waiting for drive to finalize disc (this may take up to 30 minutes).................
Success: Finalizing media took 1278 seconds
Burn successful!

Notes

  • The volume name assigned to the burner in this example is {950f7691-cc22-11d6-9f44-505054503030} and the image file being burned is WinPE.iso.
  • DVD-RW is the only kind of media that supports the /erase parameter.


DVDBurn Remarks

How DVDBurn Detects Media Type

The ISO DVD Burner tool (DVDBurn) uses GET_CONFIGURATION information to automatically detect the type of media being used (DVD-R/DVD-RW/DVD+R/DVD+RW). This is necessary because of the divergence in the methods used to record to these types of media.


DVDBurn Syntax

DVDBurn uses the following syntax:

One Step dvdburn Drive Image [/erase]

Parameters

Drive
Specifies the volume name or drive letter of the DVD burner.

Note

  • Volume names can be obtained by the command line tool MountVol.exe, which is included with the operating system.
Image
Specifies the location and name of the image to burn to the DVD.
/erase
Specifies that the DVD be erased.

Note

  • The /erase parameter can only be used with DVD-RW (DVD rewritable) media. DVD+RW media is always formatted prior to writing to it and DVD-R and DVD+R (DVD writeable) media is write-once media and cannot be erased.


Empty Examples

Overview | Syntax | Examples | Related Tools

Example: Free the Working Set of a Process

The task in this example is to clear the working set of a process for Notepad, using its process ID. To do that, you must first run TaskList to determine the process ID of the task.

Type the following at the command line:

tasklist

Press ENTER. The following output is displayed:

Image Name                   PID Session Name     Session#    Mem Usage
========================= ====== ================ ======== ============
System Idle Process            0 Console                 0         20 K
System                         4 Console                 0         28 K
smss.exe                     420 Console                 0         44 K
csrss.exe                    492 Console                 0      2,300 K
winlogon.exe                 516 Console                 0      2,452 K
services.exe                 560 Console                 0      1,128 K
lsass.exe                    572 Console                 0      1,440 K
svchost.exe                  748 Console                 0      1,176 K
svchost.exe                  812 Console                 0      7,336 K
svchost.exe                  916 Console                 0        620 K
svchost.exe                  940 Console                 0      1,632 K
spoolsv.exe                 1016 Console                 0        516 K
InoRpc.exe                  1132 Console                 0        708 K
InoRT.exe                   1156 Console                 0      5,584 K
InoTask.exe                 1168 Console                 0      1,140 K
nvsvc32.exe                 1276 Console                 0        128 K
explorer.exe                1740 Console                 0      7,772 K
Realmon.exe                 1948 Console                 0        904 K
Eudora.exe                  1056 Console                 0     10,808 K
Homesite5.exe                272 Console                 0     21,652 K
hh.exe                      1672 Console                 0      9,212 K
WINWORD.EXE                 1048 Console                 0      8,660 K
iexplore.exe                1944 Console                 0     19,948 K
EXCEL.EXE                   1272 Console                 0     20,552 K
notepad.exe                  292 Console                 0      4,640 K
wmiprvse.exe                2604 Console                 0      4,464 K
cmd.exe                     3040 Console                 0      1,316 K
tasklist.exe                3052 Console                 0      3,052 K

You can see that the process ID for Notepad is 292. Use this information to clear the working set by typing the following at the command line:

empty 292

Press ENTER. Then, use TaskList again to verify that the working set for Notepad has been cleared.

Type the following at the command line:

tasklist

Press ENTER. The following output is displayed:

Image Name                   PID Session Name     Session#    Mem Usage
========================= ====== ================ ======== ============
System Idle Process            0 Console                 0         20 K
System                         4 Console                 0         28 K
smss.exe                     420 Console                 0         44 K
csrss.exe                    492 Console                 0      2,376 K
winlogon.exe                 516 Console                 0        816 K
services.exe                 560 Console                 0      1,136 K
lsass.exe                    572 Console                 0      1,628 K
svchost.exe                  748 Console                 0      1,184 K
svchost.exe                  812 Console                 0      7,376 K
svchost.exe                  916 Console                 0        620 K
svchost.exe                  940 Console                 0      1,632 K
spoolsv.exe                 1016 Console                 0        516 K
InoRpc.exe                  1132 Console                 0        708 K
InoRT.exe                   1156 Console                 0      5,584 K
InoTask.exe                 1168 Console                 0      1,140 K
nvsvc32.exe                 1276 Console                 0        128 K
explorer.exe                1740 Console                 0      7,792 K
Realmon.exe                 1948 Console                 0        904 K
Eudora.exe                  1056 Console                 0     10,812 K
Homesite5.exe                272 Console                 0     23,280 K
hh.exe                      1672 Console                 0      9,184 K
WINWORD.EXE                 1048 Console                 0      8,676 K
iexplore.exe                1944 Console                 0      1,604 K
EXCEL.EXE                   1272 Console                 0     20,568 K
notepad.exe                  292 Console                 0        472 K
cmd.exe                     3040 Console                 0      1,540 K
tasklist.exe                3220 Console                 0      2,528 K
wmiprvse.exe                2484 Console                 0      3,772 K

Notice that the memory usage for Notepad was 4640 K before running Empty and 472 K afterwards.


Empty Syntax

Overview | Syntax | Examples | Related Tools

Empty uses the following syntax:

One Step empty {PID|ProgramName}

Parameters

PID
Specifies a currently-running process ID. Use TaskList to list process IDs. TaskList is included with Windows Server 2003.
ProgramName
Specifies the name of a currently-running program.


FrsFlags Syntax

Overview | Syntax | Related Tools Open Command Prompt

To run this script you must be running CScript, if CScript is not used frsflags output will be unreadable. The default scripting engine for Windows Server 2003 is WScript. To change the default scripting engine from WScript to CScript, type the following line:

cscript //h:cscript //s

For more information on running cscript see To run Windows Script Host in Windows Server 2003 Help and Support Center.

FrsFlags uses the following syntax:

One Step frsflags [-s | -u | -d] [ReplicaName] [DomainName]

Parameters

-s
Sets the flag for a given replica.
-u
Unsets the flag for a given replica.
-d
Displays current value of the flag.
ReplicaName
Specifies the name of the replica set. It can be either a domain based DFS replica or SYSVOL replica.
DomainName
Specifies the full domain name in dotted format.

Notes

  • For a SYSVOL replica, enter sysvol (case-insensitive).
  • If a replica is not found in the Active Directory, the script returns (NULL) : 0x80005000.


GetCM Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Use GetCM with CMAK

Although GetCM is a command-line tool, it is most often used within the CMAK Wizard. The task in this example is to use GetCM to automatically download updates for Connection Manager. The CMAK must be installed and a functioning Connection Manager profile must have been created. After this is done, follow the steps below to enable the new profiles to be downloaded to the client automatically.

  1. In Control Panel, choose Administrative Tools, and then choose Connection Manager Administration Kit.
  2. At the Welcome to the Connection Manager Administration Kit Wizard screen, click Next.
  3. At the Service Profile Selection screen, click Existing Profile, and then select an existing profile from the list.
  4. Click Next until you see the Custom Actions screen.
  5. At the Custom Actions screen, click New.
  6. In the New Custom Action dialog box, enter an action name in the Description field.
  7. In the Program to run field, enter getcm.exe
  8. In the Parameters field, enter the configuration parameters for GetCM. A typical syntax would look like this:

    /n %ServiceName% /d %ServiceDir% /l cmversion.txt /serververfile http://server1/share1/cmsrvver.txt /serverinstall http://server/cm/selfhost/profile.exe /mbtype 1 /text "A new version of CM will be downloaded."

    This syntax will prompt the user with an OK dialog box before installing.
  9. In the Action type list, select Post-connect.
  10. In the Run this custom action for list, select All connections.
  11. Click to select the Include the custom action program with this service profile and Program interacts with the user check boxes.
  12. Finish the wizard and save the new profile. After a user installs this profile, it will check for new versions each time the user connects.


GetCM Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

GetCM uses the following general syntax:

One Step getcm /n ServiceName /d ServiceDirectory /l [Path] LocalVersionFileName /serververfile {URL | UNC}ServerVersionFile /serverinstall [Path]ProfileFileName /fileshare ShareName [/sleep Seconds] [/mbtype {0 | 1 | 2}] [/text "UserTextMessage"] [/maxbytes MaxBytesToDownload]

Parameters

/n ServiceName
Specifies the name of the Connection Manager service profile to update. If the variable %ServiceName% is used, Connection Manager will use the name of the current profile.
/d ServiceDirectory
Specifies the directory containing the Connection Manager service profile. If the variable %ServiceDir% is used, Connection Manager will use the directory in which the current profile is installed.
/l [Path]LocalVersionFileName
Specifies the name of a local file that contains the version number of the installed profiles (for example, a simple text file containing a version string formatted like this: 1.0.0.0).
/serververfile {URL | UNC}ServerVersionFile
Specifies the Hypertext Transfer Protocol (HTTP) Uniform Resource Locator (URL) or Universal Naming Convention (UNC) location of the new profiles version text file.
/serverinstall [Path]ProfileFileName
Specifies the HTTP URL or UNC location of the new Connection Manager profile to download.
/fileshare {0 | 1}
Specifies whether to use a file share or a URL. The default value is 0, use an HTTP URL. Set this value to 1 to use UNC.
/sleep Seconds
Specifies the number of seconds to sleep before beginning to download the new profile.
/mbtype {0 | 1 | 2}
Specifies the type of message box, if any, for GetCM to display at the time of download. The following table lists the message box type values.
Code | Description
0 | This is the default value. Will not display any message boxes to the user.
1 | This value displays an OK message box.
2 | This value displays a Yes/No message box that gives the user a choice of whether or not to download the update.
/text "UserTextMessage"
Specifies a message to display to the user if a message box is displayed. The quotation marks are required.
/maxbytes "UserTextMessage"
Specifies the maximum number of bytes to download. The default is 1 megabyte. This parameter only applies when you are using an HTTP URL to download files; it does not apply when UNC names are used.


GPOTool Examples

Example 1: Run GPOTool with No Parameters

The task in this example is to run GPOTool with no parameters. When run with no parameters, GPOTool finds and lists all GPOs in the domain. Type the following at the command line:

gpotool

Press ENTER. Output similar to the following is displayed:

Validating DCs...
Available DCs:
dc1.contoso.com
dc2.contoso.com
Searching for policies...
Found 2 policies
============================================================
Policy {11B1F111-111D-11D1-111D-11A11FB111F1}
Friendly name: Default Domain Policy
Policy OK
============================================================
Policy {2BB2222B-222B-22B2-222B-22B22BB222B2}
Friendly name: Default Domain Controllers Policy
Policy OK
============================================================

Policies OK

The first part of the output provides a complete list of the domain controllers currently online and available to service requests, followed by the number of unique GPOs—displayed as GUIDs—that are found across all available domain controllers. Policy OK indicates that the GPO passed all tests.

Example 2: Check a Specific GPO

The task in this example is to demonstrate how GPOTool displays information for a GPO that contains errors. The GPO in this example is missing the template directory and version number property. The GPO name used in the sample code is Corrupt, which allows GPOTool to locate the GPO based on a partial match of the friendly name. Type the following at the command line:

gpotool /gpo:corrupt

Press ENTER. Output similar to the following is displayed:

Error: Property versionNumber not found on SERVER4
Error: Cannot access sysvol template on SERVER4, error 2
============================================================
Policy {2A22E22A-CB22-22D2-2222-22A2A2222C22}
------------------------------------------------------------
DC: SERVER4
Friendly name: Test Corruption Policy
Created: 1/24/03 2:42:47 AM
Changed: 1/24/03 3:01:27 AM
DS version: not found
Sysvol version: not found
Flags: 0
User extensions: not found
Machine extensions: not found
Functionality version: 2
------------------------------------------------------------

Errors found.

Example 3: Generate Verbose Output

The task in this example is to generate verbose output from GPOTool so that the output can be analyzed and explained. Type the following at the command line:

gpotool /verbose

Press ENTER. Output similar to the following is displayed:

Domain: domain1.microsoft.com
Validating DCs...
DC4: down
DC5.domain1.contoso.com: OK
DC1.domain1.contoso.com: OK
DC3.domain1.contoso.com: OK
NTDSDC0: down
Available DCs:
DC5.domain1.contoso.com
DC1.domain1.contoso.com
DC3.domain1.contoso.com

The first part of the output provides a complete list of the domain controllers currently online and available to service requests.

Searching for policies...
Found 2 policies

Following this output, the tool displays the health of each GPO. A healthy GPO that passes all tests run by GPOTool generates output similar to the following:

============================================================
Policy {333B3BB3-A333-33D3-3BBB-33A333333A33}
Policy OK
Details:
------------------------------------------------------------

Output details for healthy GPOs:

  • Policy identifies the GPO by its GUID.
  • Policy OK indicates that the GPO passed all tests.
============================================================
Policy {444C4CC4-C444-44C4-4CCC-44C444444C44}
gpotool: e,     ERROR: Err: CreateTime different between Applications

Error: DC1.domain1.contoso.com - DC1.domain1.contoso.com sysvol mismatch
Details:
------------------------------------------------------------

Error output details:

  • Policy identifies the GPO by its GUID.
  • gpotool: e, does not provide any additional information.
  • ERROR: provides information about the test the GPO failed.
  • Error: provides information about the domain controllers that are affected.

Following this, detailed information about the GPO is displayed individually for each domain controller that contains a copy of the GPO. Therefore, if you have five domain controllers and each has a copy of the GPO, the data below will be detailed five times in the output to cover each of the five copies. The status information looks similar to the following:

------------------------------------------------------------
DC: DC1.domain1.contoso.com
Friendly name: EU-SlowLinkPolicy
Created: 2/8/03 7:55:04 PM
Changed: 6/24/03 7:58:08 PM
DS version:     7(user) 2(machine)
Sysvol version: 7(user) 2(machine)
Flags: 0
User extensions: [{11111EAC-111F-11D2-A11A-11C11BBBAAA1}{1A1A111E-111E-11A1-A1CC-0000F11111E3}]
Machine extensions: [{11111EAC-111F-11D2-A11A-11C11BBBAAA1}{1A1A111E-111E-11A1-A1CC-0000F11111E3}]
Functionality version: 2
------------------------------------------------------------
  • DC: specifies the domain controller on which this copy of the GPO resides.
  • Friendly name: specifies the friendly name of the GPO. This is the name that is displayed in Active Directory Users and Computers.
  • Created: specifies when the GPO was created.
  • Changed: specifies the last time the GPO was modified.
  • DS version: specifies GPO version for the directory services portion of the GPO.
  • Sysvol version: specifies GPO version for the SYSVOL portion of the GPO.
  • Flags: indicates whether the GPO has been fully or partially disabled by the administrator.
  • User extensions: specifies Group Policy user-based extensions by GUID that are included and configured in the GPO.
  • Machine extensions: specifies Group Policy computer-based extensions that are included and configured in the GPO.
  • Functionality version: specifies the version of the GPO. The version number must be equal to 2 or higher to work correctly on Windows 2000 or Windows Server 2003. Upgrading GPOs is not supported.


GPOTool Remarks

Running GPOTool

  • GPOTool reads mandatory and optional directory services properties (version, friendly name, extension GUIDs, and SYSVOL data (Gpt.ini)), compares directory services and SYSVOL version numbers, and performs other consistency checks. Functionality version must be 2 and user/computer version must be greater than 0 if the extensions property contains any GUIDs.
  • A command-line option can search GPOs based on friendly name or GUID. A partial match is also supported for both name and GUID.
  • By default, all available domain controllers in the domain will be used; this can be overwritten by using the /dc: parameter.


GPOTool Syntax

GPOTool has the following syntax:

One Step gpotool [/gpo:GPO[,GPO…]] [/domain:DNSname] [/dc:DC[,DC…]] [/checkacl] [/verbose]

Parameters

/gpo:GPO[,GPO…]
Specifies which GPOs should be processed. Partial GUID and friendly name matches are accepted for GPO. If this parameter is not used, GPOTool processes all GPOs in the domain.
/domain:DNSname
Specifies the Domain Name System (DNS) name for the domain that hosts the GPOs. If this parameter is not used, the domain to which the user account belongs is used.
/dc:DC[,DC…]
Specifies which domain controllers should be contacted. If not specified, GPOTool contacts all available domain controllers.
/checkacl
Verifies the SYSVOL access control list (ACL). For faster processing, this step is skipped by default.
/verbose
Adds extra information to the display. This includes an individual listing of each GPO and information about any errors found.


HLScan Examples

Example 1: Scan all NTFS Volumes on the Local System

To scan all NTFS volumes on the local system, type the following at the command line:

hlscan /all

Press ENTER. Output similar to the following is displayed:

Hard Links Report for \\RKT-RC1
Report Time: 02/04/2003 13:27:35
Scanned Areas: C:\

Hard Links Found in C:\ (recursive search):
None

Summary:
        Files scanned: 16716
        Physical files with more than one name: 0
        Hard links: 0

Warning: 27 files or directories could not be scanned.
Check C:\HLScan.err for details

Example 2: Scan a Specified File

To scan a specified file, type the following at the command line:

hlscan /file c:\test.txt

Press ENTER. Output similar to the following is displayed:

Hard Links Report for \\RKT-RC1
Report Time: 02/04/2003 13:00:53
Scanned Areas: c:\test.txt

Hard Links Found in c:\test.txt (non recursive search):
None

Summary:
        Files scanned: 1
        Physical files with more than one name: 0
        Hard links: 0


HLScan Remarks

Displaying Output

You can direct HLScan to display its output in a command window or to save it to a log file.

Using the Error Log

HLScan generates an error log, hlscan.err, in which it records conditions that prevent it from thoroughly scanning a volume for hard links. The error log is created in the local directory or in the directory where the output log is saved, if the output has been redirected. Administrators should examine the output and the error log when searching for hard links.


HLScan Syntax

HLScan uses the following syntax:

One Step HLScan [/all] [/dir] [/file <file names> ] [/?] [/log [location]

Parameters

/all
Scans all NTFS volumes on the local system.
/dir
Scans recursively from <directory name>.
/file <file names>
Scans only files specified by <file names> (non recursively).
/?
Displays command-line use.
/log [location]
Specifies that the output is logged to a file, in addition to printing them on the screen. The location defaults to Hlscan.log in the current directory.


Ifilttst Examples

Example: Use Ifilttst to Filter a File

You want to filter the Test.htm file and redirect both the log and dump messages. The three files Ifilttst.exe, Ifilttst.ini, and Test.htm must all be in the current directory for this example to work. To filter Test.htm, type the following at the command line:

ifilttst /i test.htm /l /d /v 1

Press ENTER. Ifilttst performs the following actions:

  • Filters the Test.htm file.
  • Redirects the log messages to Test.htm.log.
  • Redirects the dump messages to Test.htm.dmp.
  • Sets the verbosity to 1.


Ifilttst Remarks

Ifilttst.ini File Overview

An IFilter object is initialized by calling IFilter::Init(). Init() takes the following parameters:

  • grfFlags
  • cAttributes
  • aAttributes
  • pdwFlags

The user of the Ifilttst can specify the values for these parameters in a file called Ifilttst.ini. (A sample Ifilttst.ini file is provided later in this section.)

The file is broken up into sections, with the section name enclosed in square brackets. In the example, the sections are named Test1, Test2, and so on. All section names must be unique. The test reads the values from the first section and initializes the filter with them. Then it runs all its tests using this filter configuration. The test then releases the filter and reinitializes it, using parameters from the next section. It repeats the process until there are no more configurations left to test.

Each section contains a complete description of the parameters for IFilter::Init(). The parameters are described in separate fields, called entries.

ENTRY | VALUE OF ENTRY
Flags | The names of the IFILTER_INIT flags that are to be concatenated (using a "bitwise or") to form the grfFlags parameter. They must be entirely in caps and must appear on the same line.
cAttributes | A decimal integer representing the value of the cAttributes parameter.
aAttributes | The first token must be a globally unique identifier (GUID). The GUID must be formatted exactly as shown in the [Test3] section in the example below. The second token may be either a propid (consisting of a number in hexadecimal notation) or a lpwstr (a pointer to a wide character string). You can specify the wide string character lpwstr by enclosing the string in double quotes (see the [Test6]section).

If the Flags and cAttributes entries are not specified, they default to zero. If you set cAttributes equal to 2, you usually specify 2 aAttributes; however, it is not required. In the [Test5] section, cAttributes is 1, but no aAttributes have been specified. The test then calls IFilter::Init(), with cAttributes equal to 1, and aAttributes equal to NULL. This is a useful test case, since it is likely to cause an access violation in IFilter::Init().

There is no entry for the pdwFlags parameter since this parameter is used solely to return a value to the caller. It does not need to have any special value prior to the call to Init().

If Ifilttst cannot find a file named Ifilttst.ini in the present working directory, it uses a default configuration to initialize the filter object. Below is the default configuration:

[default]
grfFlags = IFILTER_INIT_APPLY_INDEX_ATTRIBUTES
cAttributes = 0

Sample Ifilttst.ini file

; Only extract text from the object
[Test1]
Flags =
cAttributes = 0

; Get all attributes (text and pseudo-properties)
[Test2]
Flags = IFILTER_INIT_APPLY_INDEX_ATTRIBUTES
cAttributes = 0

; This also extracts just text from the object (the GUID is PSGUID_STORAGE,
; and the propid is PID_STG_CONTENTS)
[Test3]
Flags = IFILTER_INIT_CANON_PARAGRAPHS IFILTER_INIT_HARD_LINE_BREAKS
cAttributes = 1
aAttributes1 = b725f130-47ef-101a-a5f1-02608c9eebac 13

; Only extract requested attribute from the html object
; (the GUID corresponds to the html filter)
[Test4]
Flags = IFILTER_INIT_CANON_HYPHENS IFILTER_INIT_CANON_SPACES
cAttributes = 1
aAttributes1 = 70eb7a10-55d9-11cf-b75b-00aa0051fe20 3

; What happens if cAttributes is non-zero, but aAttributes is empty?
[Test5]
Flags = IFILTER_INIT_CANON_SPACES IFILTER_INIT_APPLY_INDEX_ATTRIBUTES IFILTER_INIT_APPLY_OTHER_ATTRIBUTES
cAttributes = 1

; Here is an attribute with a lpwstr instead of a propid
; (the lpwstr is enclosed in quotes)
; The GUID corresponds to the meta tag clsid for the HTML filter.
[Test6]
Flags =
cAttributes = 1
aAttributes1 = D1B5D3F0-C0B3-11CF-9A92-00A0C908DBF1 "GENERATOR"

IFilter Test Procedure

Once the filter has been initialized, the program conducts a series of tests on the filter. These tests are described below.

Validation Test

The validation test steps through the object one chunk at a time, verifying each individual chunk and all return codes. This function saves all returned STAT_CHUNK objects in a list. The validation test verifies the following information:

  • Chunk IDs are unique and increasing.
  • STAT_CHUNK.flags is a recognized chunk state (CHUNK_TEXT or CHUNK_VALUE).
  • STAT_CHUNK.breakType is a recognized break type (0,1,2,3,4).
  • If the filter initialization attributes specify that the filter should only return chunks containing pseudo-properties, idChunkSource must equal 0.
  • If chunk is not derived, i.e., it is not a pseudo-property, idChunkSource must equal idChunk.
  • GetChunk() returns S_OK or an accepted value (FILTER_E_END_OF_CHUNKS, FILTER_E_LINK_UNAVAILABLE, etc.).
  • If the chunk contains text, GetText() returns S_OK, FILTER_S_LAST_TEXT, or FILTER_E_NO_MORE_TEXT.
  • If GetText() returns FILTER_S_LAST_TEXT, the next call to GetText() should return FILTER_E_NO_MORE_TEXT.
  • If the chunk contains a value, GetValue() returns S_OK or FILTER_E_NO_MORE_VALUES.

Consistency Test

The test suite reinitializes the IFilter with the same parameters as before and performs a consistency test. This test checks to make sure that the STAT_CHUNK structures returned are identical to those returned earlier in the validation test. The consistency test verifies the following information:

  • Each STAT_CHUNK returned by GetChunk() is exactly identical to the corresponding STAT_CHUNK returned in the validation test.
  • GetChunk() returns S_OK or an accepted value (FILTER_E_END_OF_CHUNKS, FILTER_E_LINK_UNAVAILABLE, etc.).

Invalid Input Test

The test suite reinitializes the IFilter with the same parameters and performs an invalid input test, which steps through the document one chunk at a time making incorrect function calls, such as GetValue() when the current chuck contains text. The test checks all return codes for compliance with the IFilter specification. The invalid input test verifies the following:

  • If the current chunk contains text, GetValue() returns FILTER_E_NO_VALUES. Then, a call to GetText() should succeed.
  • If the current chunk contains a value, GetText() should return FILTER_E_NO_TEXT. Then a call to GetValue() should succeed.
  • If the previous call to GetText() returned FILTER_E_NO_MORE_TEXT, successive calls to GetText() should return FILTER_E_NO_MORE_TEXT.
  • If the previous call to GetValue() returned FILTER_E_NO_MORE_VALUES, successive calls to GetValue() should return FILTER_E_NO_MORE_VALUES.
  • If the previous call to GetChunk() returned FILTER_E_END_OF_CHUNKS, successive calls to GetChunk() should return FILTER_E_END_OF_CHUNKS.
  • The current chunk structures are identical to those returned in the validation test.

Testing Different IFilter Configurations

The test suite releases the IFilter object and rebinds, this time initializing it with the next set of parameters. The test repeats the cycle: validation test, consistency test, and invalid input test, until all the desired IFilter configurations, as specified in Ifilttst.ini, have been tested.

Sample Log File

Here are some excerpts from a log file, with the verbosity set to 3 (highest verbosity):

1.	INFO----**** New configuration ****
2.
3.	Section name : Test2
4.	grfFlags  : 63
5.	cAttributes : 0
6.	aAttributes : NONE
7.	pdwFlags  : 0
8.
9.	INFO----Successfully bound filter.
10.
11.	PASS----Init() returned a valid value for pdwFlags.
12.
13.	INFO----Successfully initialized filter.
14.
15.	INFO----Performing validation test. In this part of the test, the chunks structures
16.	  returned by the filter are checked for correctness, and the return values
17.	  of the filter calls are checked.
18.
19.	PASS----GetChunk() succeeded.
20.
21.	PASS----The current chunk has a legal value for the flags field.

The first line is an informational message, indicating that a new configuration has been loaded from the Ifilttst.ini file. Line (3) indicates the section name in the Ifilttst.ini file from which the current configuration has been read. Lines (4) through (7) list the parameters to IFilter::Init(). The lines starting with "INFO" are informational messages about the binding of the filter and start of the validation test. Lines starting with "PASS" are messages regarding specific tests which have passed.

Sample Warning

The following line is an example of a warning. Warnings call attention to filter behavior that is suspicious, although legal. This warning indicates that GetChunk() has returned a text chunk with no text in it.

WARNING-First call to GetText() returned FILTER_E_NO_MORE_TEXT.
Sample Error Messages

The following example of an error message indicates that the filter has emitted a chunk with a propid of 0x5. Inspection of section (Test1) in Ifilttst.ini shows that the filter was configured to not emit chunks with this propid. For instance, if neither IFILTER_INIT_ APPLY_INDEX_ATTRIBUTES nor IFILTER_INIT_APPLY_OTHER_ATTRIBUTES was specified in the Flags entry, and cAttributes is 0, the filter should only emit chunks with a propid of 0x13, corresponding to PID_STG_CONTENTS.

ERROR---The filter has emitted a chunk which it was not requested to emit. Check the initialization parameters in the Test1 section  of the initialization file.

INFO----Current chunk propid : 0x5

Sample Dump File

The following is an excerpt from a dump file:

1.	Chunk ID: ...... 2
2.	Chunk Break Type: .. END OF SENTENCE
3.	Chunk State: .... TEXT
4.	Chunk Locale: .... 0x411
5.	Chunk Source ID: .. 2
6.	Chunk Start Source . 0x0
7.	Chunk Length Source . 0x0
8.	GUID ........ b725f130-47ef-101a-a5f1-02608c9eebac
9.	Property ID ..... 0x13

10.	This is a HTML filter test page

11.	Chunk ID: ...... 3
12.	Chunk Break Type: .. END OF SENTENCE
13.	Chunk State: .... TEXT
14.	Chunk Locale: .... 0x411
15.	Chunk Source ID: .. 2
16.	Chunk Start Source . 0x0
17.	Chunk Length Source . 0x0
18.	GUID ........ f29f85e0-4ff9-1068-ab91-08002b27b3d9
19.	Property ID ..... 0x2

1.	This is a HTML filter test page

2.	Chunk ID: ...... 4
3.	Chunk Break Type: .. END OF SENTENCE
4.	Chunk State: .... VALUE
5.	Chunk Locale: .... 0x411
6.	Chunk Source ID: .. 2
7.	Chunk Start Source . 0x0
8.	Chunk Length Source . 0x0
9.	GUID ........ f29f85e0-4ff9-1068-ab91-08002b27b3d9
10.	Property ID ..... 0x2

11.	This is a HTML filter test page

The first nine lines describe the current chunk structure. Note that the GUID and the Property ID correspond to PSGUID_STORAGE / PID_STG_CONTENTS. This is a chunk containing plain text. The text follows the chunk structure: "This is a HTML filter test page."

The next chunk, starting at line 11, has a different GUID, corresponding to the HTML filter, and a different propid, corresponding to an HTML Href. This is a pseudo-property, exported by the HTML filter. The next chunk, starting at line 21, has the same GUID and propid, but its chunk state is VALUE instead of TEXT.

Note

  • The text in these last two chunks is the same as for the first chunk. The filter required three attributes (plain text, HTML Href as text, and HTML Href as a value) to be applied to this particular phrase, so it was emitted in three separate chunks.


Ifilttst.exe Syntax

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

Ifilttst Syntax

Overview | Remarks | Syntax | Examples | Related Tools Open Command Prompt

Ifilttst uses the following syntax:

One Step ifilttst /i InputFilename[..] [/ini IniFilename ] [/l [Logname]] [/d] [/-l] [/-d] [/legit] [/stress] [/v VerbosityLevel] [/t Threads] [/r [Depth]] [/c Loops] [/?]

Parameters

/ini IniFilename
Specifies the name of the initialization file used. If none is specified, the default is Ifilttst.ini.
/i InputFilename
Names the input file or directory to be filtered. The file name can contain the wildcard characters * and ?. You can list multiple files, separated by spaces.
/l [LogName]
Directs log messages to a file instead of to the screen. These messages describe the individual tests performed and the pass/fail result of the test. By default, the log file name is the same as the input file name, but with a .log extension. Only one log file is created, even if you specify multiple input files.
/d
Directs dump messages to a file and describes the contents of the chunks. The chunk structure is dumped when the verbosity level is 3. The dump file name is the same as the input file name, but with a .dmp extension.
/-l
Disables logging. This flag overrides /l.
/-d
Disables dumping. This flag overrides /d.
/legit
Forces the tool to run only the Validation Test. The Consistency Test and Invalid Input Tests are skipped.
/stress
Runs the test in stress mode. This is the same as specifying /-l /-d /v 0 /c 0 /legit.
/v VerbosityLevel
Sets the verbosity level. The default level is 3. VerbosityLevel has the following values:
Value | Description
0 | Logs only messages concerning specific IFilter failures and displays the chunk contents.
1 | Logs warning messages.
2 | Logs messages concerning tests that passed.
3 | Logs informational messages and displays the structure of the chunks.
/t Threads
Determines the number of threads to launch. The default is 1.
/r [Depth]
Sets the depth for recursively filtering subdirectories. If no integer is specified, or if the integer is 0, full recursion is assumed. The default is 1.
/c Loops
Sets the number of times to loop. If the integer is 0, the test loops infinitely. By default, the test loops only once.

Note

  • You must include a space between the command-line switch and the value.


IfMember Examples

Example 1: List Group Memberships for Current User

If you want to list the groups of which the current user is a member, type the following at the command line:

ifmember /l

Press ENTER. Output similar to the following is displayed:

User is a member of group TRINA\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.

Notes

  • If there is no group match, there will be no output.
  • Group names should not include the domain.

Example 2: Check the Current User's Membership in the Administrators Group

If you want to interactively check the current user's membership in the Administrators group, type the following at the command line:

ifmember /v administrators

Press ENTER. Output similar to the following is displayed:

Group BUILTIN\Administrators matches list.

The output indicates that the current user is a member of the Administrator group for the local computer.

Notes

  • If there is no group match, there will be no output.
  • Group names should not include the domain.


IfMember Remarks

Using IfMember

If you are using IfMember interactively, you must use the /v parameter to get output in the command window. No results return when you specify a GroupName without using the /v parameter.

Using IfMember in a Batch File or Script to Map a Network Drive

IfMember is often used in Windows logon scripts and other batch files. In the following example, the batch file containing IfMember maps a network drive based on group membership. If the user logs on to a computer using this batch file and is a member of the HR group, the batch file maps the following share for the user:

\\server1\hr_share$

If the user is a member of the Marketing group, the batch file maps the following share for the user:

\\server1\marketing_share$

If the user is a member of the Administrtors group, the batch file maps the following share for the user:

\\server1\admin_share$

The share being mapped for the user appears as a network connection in Windows Explorer on the user's computer. The mapped share is assigned the next available drive letter.

Batch File

echo off

ifmember hr
if errorlevel 1 goto hr

ifmember marketing
if errorlevel 1 goto marketing

ifmember administrators
if errorlevel 1 goto administrators

goto end

:hr
net use * \\server1\hr_share$
goto end

:marketing
net use * \\server1\marketing_share$
goto end

:administrators
net use * \\server1\admin_share$
goto end

:end
Exit

Using IfMember in a Batch File to Query Multiple Groups Simultaneously

IfMember is often used in Windows logon scripts and other batch files. In the following example, the batch file containing IfMember queries multiple groups simultaneously. If the user logs on to a computer using this batch file and is a member of the HR or Marketing group, the batch file maps the following share for the user:

echo off

ifmember hr marketing
if errorlevel 2 goto hrANDmarketing
if errorlevel 1 goto hrORmarketing

ifmember administrators
if errorlevel 1 goto administrators

goto end

:hrANDmarketing
net use * \\server1\marketinghr_share$
goto end

:hrORmarketing
net use * \\server1\standard_share$
goto end

:administrators
net use * \\server1\admin_share$
goto end

:end
Exit


IfMember Syntax

IfMember uses the following syntax:

One Step ifmember [/v|/verbose [/l|/list]|[GroupName1 [GroupName2] ...]

/v|/verbose GroupName1 [GroupName2] ...]
Prints all group matches.

Note

  • If you are using IfMember interactively, you must use the /v parameter to determine whether or not the current user is a member of the specified group.
/l|/list
Lists all groups of which the user is a member.
GroupName
Specifies one or more group names (separated by a spaces).

Note

  • When run without parameters, IfMember displays the command-line use.


InetESC Remarks

Overview | Remarks | Related Tools

Using InetESC

When launching the browser, users are presented with a first-run page that alerts them that browser security has been hardened (this does not happen if the browser is launched with a URL, as is the case when an application launches the browser).

Upon navigating to a site, users are presented with a dialog box alerting them to the fact that browser security has been hardened. The user can select a check box so the dialog box will not be displayed; by default, this check box will not be selected.

On the Help menu, there will be a new entry that points to a local HTML file that explains hardening in detail.

Because some sites cannot run if security is high, users can add these trusted sites to either the Local intranet or Trusted sites zones. Although administrators are most likely to manage sites through policy settings, they can also do this interactively by using a new entry on the File menu; two submenus have been added for adding sites to the Local intranet or Trusted sites (for Internet sites) zones.

An optional component enables administrators to turn the feature off, either in general or specifically for members of the Administrators or Users groups.

Changing Permissions

By default, only administrators are allowed to change security settings; administrators can change this through a policy setting.

Understanding InetESC

When hardening is applied, sites in the Trusted sites and Local intranet zones will be read from a different location than in the past. The new zone map for hardening will be read from and written to ESCDomains rather than Domains.

Setting Internet Zone Security

The Internet zone will be set to the High security template to prevent ActiveX, script, or the Virtual Machine from being instantiated by any site in this zone. File downloads will also be disabled in this zone. The complete list of settings included in the High security template can be found in Internet Options in Control Panel (on the Security tab, click Restricted sites, and then click Custom Level). If you decide to soften the server, the Medium security template will be applied to the Internet zone. Unless a site has been added to the Local intranet or Trusted sites zone, all Web sites will run in the Internet zone by default.

Setting Local Intranet Zone Security

The Local intranet zone is where administrators are instructed to add their intranet sites that need relaxed security settings in order to function properly. Many administrator scenarios may require the Medium-low security template for two particular URLActions:

  • User authentication and
  • Launching applications and unsafe files

To enable the scenarios that require relaxed settings for these URLActions, the Local intranet zone will remain at the Medium-low security template.

To prevent attackers from exploiting the server by spoofing the Local intranet zone, automatic detection of intranet sites will be disabled. Universal Naming Convention (UNC) paths and intranet sites will not automatically resolve to the Internet zone as they do with softened settings.

The check boxes for these settings are disabled as well, to prevent accidental softening of the Local intranet zone. As a result, all sites will default to the Internet zone. Administrators can add specific sites to the Local intranet zone by using deployment tools and the Add to Intranet zone user interface.

Some sites will be added to the Local intranet zone by default. Administrators need access to tools exposed as http://localhost and https://localhost. These will be added by default by writing these values.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings\
ZoneMap\ESCDomains\localhost]
    "http"=dword:00000001
    "https"=dword:00000001

Setting the Local intranet zone to Medium-low security allows NTLM credentials to be sent to sites. This is a design change from the earlier implementation. This also means that arbitrary Internet sites should not be added to this zone, because credentials will be disclosed to these sites.

If the server is softened:

  • The Local intranet zone goes back to automatically detecting intranet sites.
  • The check boxes for those settings are reenabled.

Setting Trusted Sites Zone Security

The Trusted sites zone is where the administrator is instructed to add Internet sites that need more privileges in order to function properly (for example, to run script or ActiveX controls). The Trusted sites zone will be upgraded from the Low security template to the Medium security template (the same as the Internet zone in previous versions of Internet Explorer).

Because the administrator needs Windows Update to keep the server up to date, windowsupdate.com will be added to the hardened Trusted sites zone.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ZoneMap\ESCDomains\*.windowsupdate.com]
    "http"=dword:00000002
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings\
ZoneMap\ESCDomains\
*.windowsupdate.microsoft.com]
    "http"=dword:00000002

Remote Assistance depends on script and ActiveX running on the local computer but exposed via hcp://system. This will be added by default by writing this value.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings\
ZoneMap\ESCDomains\system]
    "hcp"=dword:00000001

If the administrator decides to soften the server, the Trusted sites zone returns to the Low security template corresponding to the softened state.

Notes

  • When the user adjusts the slider for the security level of a zone or customizes it, the security slider disappears for that zone and the Reset to default button is enabled.
  • When the user clicks Reset to default, Internet Explorer applies the correct hardened template for the zone that is selected in the selection box at the top of the Security tab of InetCPL.

Deploying Hardening and Softening by Using an Administrative Template

To configure a GPO for hardening, administrators need to install the Administrative Template InetESC.ADM (from the Windows Server 2003 Resource Kit) on their server. The administrator then opens Group Policy Object Editor and selects the target organizational unit to receive the GPO. If the policy setting is applied to an organizational unit of users, it will result in the user hardening any server that they log on to with administrative credentials.

The administrator then selects the Hardening Component to be added to the GPO. This will set the master Hardening registry key in HKLM for administrators, users, or both on a given computer. The registry value is the IsInstalled value for the Hardening Optional Components.

The GPO writes the key to the organizational unit of servers to be hardened. When Optional Component Manager (OCM) detects that this value has changed, OCM will apply hardening to the correct user accounts. Thus, on a computer where this key is written, hardening will not be applied to a user until the subsequent logon.

To deploy hardening:

  1. Copy the preference ADM to %Windows%\Inf.
  2. Launch GPEdit.msc.
  3. Right-click Administrative Templates.
  4. On the Add/Remove templates page, click Add.
  5. Select InetESC.adm.
  6. Select View>Filtering.
  7. Click to clear the Only show policies that can be fully managed check box.
  8. Navigate to Computer>Admin Templates>Windows Components>Internet Explorer>Enhanced Security Configuration
  9. Select one of the preferences and enable it for the target organizational unit.
  10. Log on to a computer in the organizational unit. Settings are not applied until the next logon.

To deploy softening:

  1. Copy the preference ADM to %Windows%\Inf.
  2. Launch GPEdit.msc.
  3. Right-click Administrative Templates.
  4. On the Add/Remove templates page, click Remove.
  5. Select InetESC.adm
  6. View>Filtering
  7. Uncheck "Only show policies that can be fully managed"
  8. Navigate to Computer>Admin Templates>Windows Compoents>Internet Explorer>Enhanced Security Configuration
  9. Select one of the preferences and disable it for the target prganizational unit.
  10. Log on to a copmputer in the organizational unit (settings not applied until the next logon).


IniMan Examples

Example 1: Display All Section Names of an .Ini File

The task in this example is to display all section names of an .ini file. Type the following at the command line:

iniman c:\windows\win.ini /s

Press ENTER. Output similar to the following is displayed:

[AeDebug]
[Clock]
[Colors]
[Compatibility]
[Console]
[Cursors]
[DeskTop]
[Devices]
[Embedding]
[Extensions]
[Fonts]
[FontSubstitutes]
[GRE_Initialize]
[Intl]
[IOProcs]
[MCI Extensions]
[ModuleCompatibility]
[MSCharMap]
[Net_Files]
[NWCS]
[Ports]
[PrinterPorts]
[Sounds]
[TrueType]
[Twain]
[Windows Help]
[Winlogon]
[Network]
[Windows]
[fonts]
[extensions]
[mci extensions]
[files]
[MCI Extensions.BAK]
[Mail]

Example 2: Display All Sections and Content of an .Ini File

The task in this example is to display all sections and content of an .ini file. Type the following at the command line:

iniman c:\windows\win.ini

Press ENTER. Output similar to the following is displayed:

[AeDebug]
    Auto=1
    Debugger=drwtsn32 -p %ld -e %ld -g

[Clock]
    iFormat=1

[Colors]
    ActiveBorder=212 208 200
    ActiveTitle=10 36 106
    AppWorkSpace=128 128 128
    Background=58 110 165
    ButtonAlternateFace=181 181 181
    ButtonDkShadow=64 64 64
    ButtonFace=212 208 200
    ButtonHilight=255 255 255
    ButtonLight=212 208 200
    ButtonShadow=128 128 128
    ButtonText=0 0 0
    GradientActiveTitle=166 202 240
    GradientInactiveTitle=192 192 192
    GrayText=128 128 128
    Hilight=10 36 106
    HilightText=255 255 255
    HotTrackingColor=0 0 128
    InactiveBorder=212 208 200
    InactiveTitle=128 128 128
    InactiveTitleText=212 208 200
    InfoText=0 0 0
    InfoWindow=255 255 225
    Menu=212 208 200
    MenuText=0 0 0
    Scrollbar=212 208 200
    TitleText=255 255 255
    Window=255 255 255
    WindowFrame=0 0 0
    WindowText=0 0 0
    MenuHilight=210 210 255
    MenuBar=212 208 200

[Compatibility]
    _3DPC=0x00400000
    _BNOTES=0x224000
    _LNOTES=0x00100000
    ACAD=0x8000
    ACROBAT=0x04000008
    ACT!=0x400004
    AD=0x10000000
    ADW30=0x10000000
    ALARMMGR=0x0040000
    ALDSETUP=0x00400000
    AMIPRINT=0x04000000
    AMIPRO=0x04000010
    APORIA=0x0100
    APPROACH=0x0004
    BALER=0x08000000
    BMAPP=0x0004
    CASMONEY=0x00200000
    CAVOIDE=0x00200000
    CCMAIL=0x00200000
    CCMCWFY=0x80
    CHARISMA=0x2000
    CONFIG=0x00400000
    CORELCHT=0x04000000
    CORELDRW=0x04048000
    CORELPNT=0x0C000000
    CORELVP5=0x04000000
    COSTAR=0x0004
    CP=0x0040
    CROSSTIE=0x00000400
    DARCH=0x80
    DELPHI=0x40000000
    DESIGNER=0x00002000
    DIRECTOR=0x00800000
    DPLANNER=0x00200000
    DRAW=0x2000
    DS40=0x8000
    DTWIN20=0x00000400
    EAP=0x0004
    ED=0x00010000
    EXCEL=0x1000
    EXPASTRO=0x04000000
    EXTYPWND=0x00200000
    FAXVIEW=0x04000000
    FAXWORKS=0x00000400
    FH4=0x04E08000
    FLW2=0x8000
    FMPRO=0x00200000
    FREEHAND=0x04008000
    FULLTEXT=0x20000000
    GIFTMAKE=0x20000000
    GUIDE=0x1000
    HDW=0x04800000
    HGW=0x8000
    HGW2EXE=0x8000
    HGW3EXE=0x8000
    HJDRAW=0x00400000
    IDAPICFG=0x00400000
    IDRAW=0x04008000
    ILLUSTRA=0x04000000
    ILLUSTRATOR=0x04008000
    IMPROV2=0x00000000
    INFOCENT=0x04000000
    INSIGHT=0x00000400
    INSTAL1=0x00400000
    INSTALL=0x00400000
    INSTBIN=0x00200000
    INTERMIS=0x10000000
    IS20INST=0x00000000
    ISSET_SE=0x00200000
    IVIHEALT=0x00400000
    JEOPARDY=0x00200000
    JW=0x00000000
    KALOAD2=0x00400000
    KEYCAD=0x8000
    LE_ADMIN=0x00400000
    LUI=0x20000000
    MAILSPL=0x10000000
    MAKER=0x04200000
    MAPS1=0x04008022
    MATH=0x00000001
    MAVIS=0x00200000
    MCOURIER=0x0800
    MFWIN20=0x02000000
    MILESV3=0x1000
    MILESV40=0x4
    MOZART=0x40000000
    MSARTIST=0x00100000
    MSBHUMAN=0x4
    MSREMIND=0x10000000
    MVIEWER2=0x40200000
    MYINV=0x00200000
    MYMWIN=0x40000000
    MYST=0x08000000
    NAFTA1=0x4008022
    NBAMW4V4=0x04000000
    NETSET2=0x0100
    NOTES=0x200000
    NOTSHELL=0x0001
    OPERATOR=0x02000000
    OUTPOST=0x00000000
    OWLAPP=0x00400000
    PACKRAT=0x0800
    PAINTER=0x00000000
    PAWC8DC3=0x00400000
    PAWIN=0x4
    PEACHW=0x04800004
    PIXIE=0x0040
    PLANIT=0x0004
    PLANNER=0x2000
    PLUS=0x1000
    PM4=0x0400A000
    PM5APP=0x04008000
    PN4APP=0x00200000
    PP4=0x00000000
    PR2=0x2000
    PRINTHLP=0x0004
    QAPLUSW=0x0004
    QAWRITE=0x42080
    QLIIFAX=0x00400000
    QUAKE=0x80
    QW=0x08000000
    RELAY=0x20000000
    REM=0x8022
    RR2CD=0x00200000
    RX=0x00000400
    RXL=0x00000400
    SCHUBERT=0x40000000
    SETUP=0x00000000
    SIDEKICK=0x0004
    SLEEPER=0x10000000
    SPCB=0x04008000
    SPORTJEP=0x00200000
    SPWIN20=0x00400000
    SSBWIN=0x00200000
    ST2=0x4008022
    STRAUSS=0x40000000
    STRAV=0x40000000
    SWCWIN=0x00800004
    TCVWIN=0x00200000
    TCW=0x00400000
    TCWIN=0x0004
    TERRAIN=0x00400000
    TISETUP=0x00200000
    TL6=0x08000000
    TME=0x0100
    TMSWIN=0x20000000
    TMTWIN=0x00200000
    TMTWINCD=0x00200000
    TOUCHUP=0x00400000
    TURBOTAX=0x00080000
    VB=0x0200
    VEWINFIL=0x00400000
    VISIO=0x00000004
    VISIOHM=0x00000004
    VISION=0x0040
    W4GL=0x4000
    W4GLR=0x4000
    WGW=0x00440000
    WIN2WRS=0x1210
    WINCIM=0x4
    WINLINK=0x20000000
    WINPHONE=0x0004
    WINSIM=0x3000
    WINTACH=0x00200000
    WORDSCAN=0x02200000
    WPWIN60=0x00000400
    WPWIN61=0x02000400
    WPWINFIL=0x00000006
    WS32=0x00200000
    WSETUP=0x00200000
    XPRESS=0x04000008
    ZETA01=0x00400000
    ZIFFBOOK=0x00200000
    NOTIFIER=0x400000

[Console]
    FaceName=

[Cursors]
    =Windows default

[DeskTop]
    AutoEndTasks=0
    CoolSwitch=1
    CoolSwitchColumns=7
    CoolSwitchRows=3
    CursorBlinkRate=530
    DragFullWindows=0
    DragHeight=4
    DragWidth=4
    FontSmoothing=0
    GridGranularity=0
    HungAppTimeout=5000
    LowPowerActive=0
    LowPowerTimeOut=0
    MenuShowDelay=400
    PowerOffActive=0
    PowerOffTimeOut=0
    ScreenSaveActive=1
    ScreenSaverIsSecure=0
    ScreenSaveTimeOut=600
    SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
    TileWallpaper=0
    WaitToKillAppTimeout=20000
    Wallpaper=
    WheelScrollLines=3
    LameButtonText=Comments?
    WallpaperStyle=2
    Pattern Upgrade=TRUE

[Embedding]
    PBrush=Paintbrush Picture,Paintbrush Picture,pbrush.exe,picture
    SoundRec=Sound,Sound,sndrec32.exe,picture

[Extensions]
    ini=notepad.exe ^.ini
    txt=notepad.exe ^.txt
    wtx=notepad.exe ^.wtx

[Fonts]
    Roman (All res)=ROMAN.FON
    Script (All res)=SCRIPT.FON
    Modern (All res)=MODERN.FON
    Small Fonts (VGA res)=SMALLE.FON
    Arial (TrueType)=ARIAL.TTF
    Arial Bold (TrueType)=ARIALBD.TTF
    Arial Bold Italic (TrueType)=ARIALBI.TTF
    Arial Italic (TrueType)=ARIALI.TTF
    Courier New (TrueType)=COUR.TTF
    Courier New Bold (TrueType)=COURBD.TTF
    Courier New Bold Italic (TrueType)=COURBI.TTF
    Courier New Italic (TrueType)=COURI.TTF
    Lucida Console (TrueType)=LUCON.TTF
    Lucida Sans Unicode (TrueType)=L_10646.TTF
    Times New Roman (TrueType)=TIMES.TTF
    Times New Roman Bold (TrueType)=TIMESBD.TTF
    Times New Roman Bold Italic (TrueType)=TIMESBI.TTF
    Times New Roman Italic (TrueType)=TIMESI.TTF
    WingDings (TrueType)=WINGDING.TTF
    Symbol (TrueType)=SYMBOL.TTF
    Symbol 8,10,12,14,18,24 (VGA res)=SYMBOLE.FON
    Verdana (TrueType)=verdana.TTF
    Verdana Bold (TrueType)=verdanab.TTF
    Verdana Italic (TrueType)=verdanai.TTF
    Verdana Bold Italic (TrueType)=verdanaz.TTF
    Arial Black (TrueType)=ariblk.TTF
    Comic Sans MS (TrueType)=comic.TTF
    Comic Sans MS Bold (TrueType)=comicbd.TTF
    Impact (TrueType)=impact.TTF
    Georgia (TrueType)=georgia.TTF
    Georgia Bold (TrueType)=georgiab.TTF
    Georgia Bold Italic (TrueType)=georgiaz.TTF
    Georgia Italic (TrueType)=georgiai.TTF
    Franklin Gothic Medium (TrueType)=Framd.TTF
    Franklin Gothic Medium Italic (TrueType)=Framdit.TTF
    Palatino Linotype (TrueType)=pala.TTF
    Palatino Linotype Bold (TrueType)=palab.TTF
    Palatino Linotype Bold Italic (TrueType)=palabi.TTF
    Palatino Linotype Italic (TrueType)=palai.TTF
    Tahoma Bold (TrueType)=tahomabd.TTF
    Trebuchet MS (TrueType)=trebuc.TTF
    Trebuchet MS Bold (TrueType)=trebucbd.TTF
    Trebuchet MS Bold Italic (TrueType)=trebucbi.TTF
    Trebuchet MS Italic (TrueType)=trebucit.TTF
    Webdings (TrueType)=webdings.TTF
    Estrangelo Edessa (TrueType)=estre.TTF
    Gautami (TrueType)=gautami.TTF
    Latha (TrueType)=latha.TTF
    Mangal (TrueType)=mangal.TTF
    Mv Boli (TrueType)=mvboli.TTF
    Raavi (TrueType)=raavi.TTF
    Shruti (TrueType)=shruti.TTF
    Tunga (TrueType)=tunga.TTF
    Sylfaen (TrueType)=sylfaen.TTF
    WST_Czec (All res)=wst_czec.FON
    WST_Engl (All res)=wst_engl.FON
    WST_Fren (All res)=wst_fren.FON
    WST_Germ (All res)=wst_germ.FON
    WST_Ital (All res)=wst_ital.FON
    WST_Span (All res)=wst_span.FON
    WST_Swed (All res)=wst_swed.FON
    Courier 10,12,15 (VGA res)=COURE.FON
    MS Sans Serif 8,10,12,14,18,24 (VGA res)=SSERIFE.FON
    MS Serif 8,10,12,14,18,24 (VGA res)=SERIFE.FON
    Tahoma (TrueType)=TAHOMA.TTF
    Microsoft Sans Serif (TrueType)=MICROSS.TTF

[FontSubstitutes]
    Arial CE,238=Arial,238
    Arial CYR,204=Arial,204
    Arial Greek,161=Arial,161
    Arial TUR,162=Arial,162
    Courier New CE,238=Courier New,238
    Courier New CYR,204=Courier New,204
    Courier New Greek,161=Courier New,161
    Courier New TUR,162=Courier New,162
    Helv=MS Sans Serif
    Helvetica=Arial
    MS Shell Dlg 2=Tahoma
    Times=Times New Roman
    Times New Roman CE,238=Times New Roman,238
    Times New Roman CYR,204=Times New Roman,204
    Times New Roman Greek,161=Times New Roman,161
    Times New Roman TUR,162=Times New Roman,162
    Tms Rmn=MS Serif
    Arial Baltic,186=Arial,186
    Courier New Baltic,186=Courier New,186
    Times New Roman Baltic,186=Times New Roman,186
    MS Shell Dlg=Microsoft Sans Serif

[GRE_Initialize]
    FIXEDFON.FON=vgafix.fon
    FONTS.FON=vgasys.fon
    OEMFONT.FON=vgaoem.fon

[Intl]
    iCountry=1
    iCurrDigits=2
    iCurrency=0
    iDate=0
    iDigits=2
    iLZero=1
    iMeasure=1
    iNegCurr=0
    iTime=0
    iTLZero=0
    Locale=00000409
    s1159=AM
    s2359=PM
    sCountry=United States
    sCurrency=$
    sDate=/
    sDecimal=.
    sLanguage=ENU
    sList=,
    sLongDate=dddd, MMMM dd, yyyy
    sShortDate=M/d/yyyy
    sThousand=,
    sTime=:
    sTimeFormat=h:mm:ss tt
    iTimePrefix=0
    sMonDecimalSep=.
    sMonThousandSep=,
    iNegNumber=1
    sNativeDigits=0123456789
    NumShape=1
    iCalendarType=1
    iFirstDayOfWeek=6
    iFirstWeekOfYear=0
    sGrouping=3;0
    sMonGrouping=3;0
    sPositiveSign=
    sNegativeSign=-

[IOProcs]
    MVB=mvfs32.dll

[MCI Extensions]
    avi=avivideo
    cda=CDAudio
    Mid=Sequencer
    rmi=Sequencer
    Wav=WaveAudio
    aif=MPEGVideo
    aifc=MPEGVideo
    aiff=MPEGVideo
    asf=MPEGVideo
    asx=MPEGVideo
    au=MPEGVideo
    m1v=MPEGVideo
    m3u=MPEGVideo
    mp2=MPEGVideo
    mp2v=MPEGVideo
    mp3=MPEGVideo
    mpa=MPEGVideo
    mpe=MPEGVideo
    mpeg=MPEGVideo
    mpg=MPEGVideo
    mpv2=MPEGVideo
    snd=MPEGVideo
    wax=MPEGVideo
    wm=MPEGVideo
    wma=MPEGVideo
    wmp=MPEGVideo2
    wmv=MPEGVideo
    wmx=MPEGVideo
    wvx=MPEGVideo
    wpl=MPEGVideo

[ModuleCompatibility]
    CWD=0x8000
    INSTBI01=0x0002
    INSTBI02=0x0002
    INSTBIN=0x0002
    INSTSCR=0x0002
    LTSPRINT=0x0002
    MYST=0x8000
    OUTPOST=0x0002
    PALED40=0x0002
    SETUP=0x0002
    SETUP16=0x0002
    USA=0x8000
    VB=0x0002
    VB40016=0x0002
    WISE0001=0x0002

[Net_Files]
    SaveConnections=yes

[Ports]
    COM1:=9600,n,8,1
    COM2:=9600,n,8,1
    COM3:=9600,n,8,1
    COM4:=9600,n,8,1
    FILE:=
    LPT1:=
    LPT2:=
    LPT3:=
    =

[TrueType]
    TTEnable=1
    TTonly=0

[Windows Help]
    Maximized=0
    Xl=166
    Xr=474
    Yd=444
    Yu=120

[Winlogon]
    DefaultDomainName=ASEANL-TEST3
    DefaultUserName=administrator
    LegalNoticeCaption=
    LegalNoticeText=
    PowerdownAfterShutdown=0
    ReportBootOk=1
    Shell=Explorer.exe
    ShutdownWithoutLogon=0
    System=
    Userinit=C:\WINDOWS\system32\userinit.exe,
    VmApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
    allocatecdroms=0
    allocatedasd=0
    allocatefloppies=0
    cachedlogonscount=10
    scremoveoption=0
    AppSetup=UsrLogon.Cmd
    DebugServerCommand=no
    WinStationsDisabled=0
    AltDefaultUserName=administrator
    AltDefaultDomainName=ASEANL-TEST3
    AutoAdminLogon=0

[Network]
    SaveConnections=yes

[Windows]
    AppInit_DLLs=
    Beep=yes
    BorderWidth=-15
    CoolSwitch=1
    CursorBlinkRate=530
    DefaultSeparateVDM=no
    DeviceNotSelectedTimeout=15
    DoubleClickHeight=4
    DoubleClickSpeed=500
    DoubleClickWidth=4
    DragFullWindows=0
    InitialKeyboardIndicators=0
    KeyboardDelay=1
    KeyboardSpeed=31
    LowPowerActive=0
    LowPowerTimeOut=0
    MouseSpeed=1
    MouseThreshold1=6
    MouseThreshold2=10
    PowerOffActive=0
    PowerOffTimeOut=0
    ScreenSaveActive=1
    ScreenSaveTimeOut=600
    SnapToDefaultButton=0
    Spooler=yes
    swapdisk=
    SwapMouseButtons=0
    TransmissionRetryTimeout=90
    DebugOptions=2048
    Documents=
    DosPrint=no
    load=
    NetMessage=no
    NullPort=None
    Programs=com exe bat pif cmd

[fonts]
    Roman (All res)=ROMAN.FON
    Script (All res)=SCRIPT.FON
    Modern (All res)=MODERN.FON
    Small Fonts (VGA res)=SMALLE.FON
    Arial (TrueType)=ARIAL.TTF
    Arial Bold (TrueType)=ARIALBD.TTF
    Arial Bold Italic (TrueType)=ARIALBI.TTF
    Arial Italic (TrueType)=ARIALI.TTF
    Courier New (TrueType)=COUR.TTF
    Courier New Bold (TrueType)=COURBD.TTF
    Courier New Bold Italic (TrueType)=COURBI.TTF
    Courier New Italic (TrueType)=COURI.TTF
    Lucida Console (TrueType)=LUCON.TTF
    Lucida Sans Unicode (TrueType)=L_10646.TTF
    Times New Roman (TrueType)=TIMES.TTF
    Times New Roman Bold (TrueType)=TIMESBD.TTF
    Times New Roman Bold Italic (TrueType)=TIMESBI.TTF
    Times New Roman Italic (TrueType)=TIMESI.TTF
    WingDings (TrueType)=WINGDING.TTF
    Symbol (TrueType)=SYMBOL.TTF
    Symbol 8,10,12,14,18,24 (VGA res)=SYMBOLE.FON
    Verdana (TrueType)=verdana.TTF
    Verdana Bold (TrueType)=verdanab.TTF
    Verdana Italic (TrueType)=verdanai.TTF
    Verdana Bold Italic (TrueType)=verdanaz.TTF
    Arial Black (TrueType)=ariblk.TTF
    Comic Sans MS (TrueType)=comic.TTF
    Comic Sans MS Bold (TrueType)=comicbd.TTF
    Impact (TrueType)=impact.TTF
    Georgia (TrueType)=georgia.TTF
    Georgia Bold (TrueType)=georgiab.TTF
    Georgia Bold Italic (TrueType)=georgiaz.TTF
    Georgia Italic (TrueType)=georgiai.TTF
    Franklin Gothic Medium (TrueType)=Framd.TTF
    Franklin Gothic Medium Italic (TrueType)=Framdit.TTF
    Palatino Linotype (TrueType)=pala.TTF
    Palatino Linotype Bold (TrueType)=palab.TTF
    Palatino Linotype Bold Italic (TrueType)=palabi.TTF
    Palatino Linotype Italic (TrueType)=palai.TTF
    Tahoma Bold (TrueType)=tahomabd.TTF
    Trebuchet MS (TrueType)=trebuc.TTF
    Trebuchet MS Bold (TrueType)=trebucbd.TTF
    Trebuchet MS Bold Italic (TrueType)=trebucbi.TTF
    Trebuchet MS Italic (TrueType)=trebucit.TTF
    Webdings (TrueType)=webdings.TTF
    Estrangelo Edessa (TrueType)=estre.TTF
    Gautami (TrueType)=gautami.TTF
    Latha (TrueType)=latha.TTF
    Mangal (TrueType)=mangal.TTF
    Mv Boli (TrueType)=mvboli.TTF
    Raavi (TrueType)=raavi.TTF
    Shruti (TrueType)=shruti.TTF
    Tunga (TrueType)=tunga.TTF
    Sylfaen (TrueType)=sylfaen.TTF
    WST_Czec (All res)=wst_czec.FON
    WST_Engl (All res)=wst_engl.FON
    WST_Fren (All res)=wst_fren.FON
    WST_Germ (All res)=wst_germ.FON
    WST_Ital (All res)=wst_ital.FON
    WST_Span (All res)=wst_span.FON
    WST_Swed (All res)=wst_swed.FON
    Courier 10,12,15 (VGA res)=COURE.FON
    MS Sans Serif 8,10,12,14,18,24 (VGA res)=SSERIFE.FON
    MS Serif 8,10,12,14,18,24 (VGA res)=SERIFE.FON
    Tahoma (TrueType)=TAHOMA.TTF
    Microsoft Sans Serif (TrueType)=MICROSS.TTF

[extensions]
    ini=notepad.exe ^.ini
    txt=notepad.exe ^.txt
    wtx=notepad.exe ^.wtx

[mci extensions]
    avi=avivideo
    cda=CDAudio
    Mid=Sequencer
    rmi=Sequencer
    Wav=WaveAudio
    aif=MPEGVideo
    aifc=MPEGVideo
    aiff=MPEGVideo
    asf=MPEGVideo
    asx=MPEGVideo
    au=MPEGVideo
    m1v=MPEGVideo
    m3u=MPEGVideo
    mp2=MPEGVideo
    mp2v=MPEGVideo
    mp3=MPEGVideo
    mpa=MPEGVideo
    mpe=MPEGVideo
    mpeg=MPEGVideo
    mpg=MPEGVideo
    mpv2=MPEGVideo
    snd=MPEGVideo
    wax=MPEGVideo
    wm=MPEGVideo
    wma=MPEGVideo
    wmp=MPEGVideo2
    wmv=MPEGVideo
    wmx=MPEGVideo
    wvx=MPEGVideo
    wpl=MPEGVideo

[MCI Extensions.BAK]
    aif=MPEGVideo
    aifc=MPEGVideo
    aiff=MPEGVideo
    asf=MPEGVideo2
    asx=MPEGVideo2
    au=MPEGVideo
    m1v=MPEGVideo
    m3u=MPEGVideo2
    mp2=MPEGVideo
    mp2v=MPEGVideo
    mp3=MPEGVideo2
    mpa=MPEGVideo
    mpe=MPEGVideo
    mpeg=MPEGVideo
    mpg=MPEGVideo
    mpv2=MPEGVideo
    snd=MPEGVideo
    wax=MPEGVideo2
    wm=MPEGVideo2
    wma=MPEGVideo2
    wmp=MPEGVideo2
    wmv=MPEGVideo2
    wmx=MPEGVideo2
    wvx=MPEGVideo2
    wpl=MPEGVideo

[Mail]
    MAPI=1

Example 3: Display a Specific Section from an .Ini File

The task in this example is to display a specific section from an .ini file. Type the following at the command line:

iniman c:\windows\win.ini [colors]

Note

  • The brackets ([]) around the section are optional. They specify the exact section name.

Press ENTER. Output similar to the following is displayed:

[colors]
    ActiveBorder=212 208 200
    ActiveTitle=10 36 106
    AppWorkSpace=128 128 128
    Background=58 110 165
    ButtonAlternateFace=181 181 181
    ButtonDkShadow=64 64 64
    ButtonFace=212 208 200
    ButtonHilight=255 255 255
    ButtonLight=212 208 200
    ButtonShadow=128 128 128
    ButtonText=0 0 0
    GradientActiveTitle=166 202 240
    GradientInactiveTitle=192 192 192
    GrayText=128 128 128
    Hilight=10 36 106
    HilightText=255 255 255
    HotTrackingColor=0 0 128
    InactiveBorder=212 208 200
    InactiveTitle=128 128 128
    InactiveTitleText=212 208 200
    InfoText=0 0 0
    InfoWindow=255 255 225
    Menu=212 208 200
    MenuText=0 0 0
    Scrollbar=212 208 200
    TitleText=255 255 255
    Window=255 255 255
    WindowFrame=0 0 0
    WindowText=0 0 0
    MenuHilight=210 210 255
    MenuBar=212 208 200

Example 4: Display the Value of a Key from a Section in an .Ini File

The task in this example is to display the value of a key from a section in an .ini file. Type the following at the command line:

iniman c:\windows\win.ini [colors].menubar

Note

  • The brackets ([]) around the section are optional. They specify the exact section name.

Press ENTER. Output similar to the following is displayed:

212 208 200

Example 5: Set a Key with a Value

The task in this example is to set a key with a value. Type the following at the command line:

iniman c:\windows\win.ini [colors].menubar=212

Note

  • The brackets ([]) around the section are optional. They specify the exact section name.

Press ENTER. Output similar to the following is displayed:

[colors]
    menubar=212 (Was <212 208 200>)

Notes

  • The key will be deleted if the key value is null.
  • The section will be deleted if the key value and key are null.
  • Use a backslash (\) to add quoted values (for example, "test value").


IniMan Remarks

Understanding Answer Files

Answer files contain the values needed by the setup tools to complete an installation without requiring user interaction. Answer files consist of section headers and keys, and values for those keys. Most of the section headers are predefined (although some may be user-defined). It is not necessary to specify all the possible keys in the answer file if the installation does not require them. The file format is as follows:

 [Section]

key1=value1
key2=value2
key3=value3

[Section2]
key4=value4

Notes

  • Sections contain keys and the corresponding values for those keys.
  • Keys and values are separated by an equal sign (=).


IniMan Syntax

IniMan uses the following syntax:

One Step iniman [FileName] [/s] [Section] [.Key [=[Value]]]

Parameters

FileName
Specifies the name of the .ini file to modify or create. The file will be created if it does not exist.
/s
Displays all section names of a specified .ini file.
Section
Specifies the section in a file to parse, modify, or create. Use brackets [] to specify the section.
.Key
Specifies the key to query or set.
Value
Specifies the key value to set.
=
Sets the value of the key in Section to a specified value.


InstCM Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Use InstCM with CMAK

Although InstCM is a command-line tool, it is most often used within the CMAK Wizard. The task in this example is to use InstCM to automatically install updates for Connection Manager profile. CMAK must be installed and a functioning Connection Manager profile must have been created. After this is done, follow the steps below to enable the new profiles to be installed on the client automatically.

  1. In Control Panel, choose Administrative Tools, and then choose Connection Manager Administration Kit.
  2. At the Welcome to the Connection Manager Administration Kit Wizard screen, click Next.
  3. At the Service Profile Selection screen, click Existing Profile, and then select an existing profile from the list.
  4. Click Next until you see the Custom Actions screen.
  5. At the Custom Actions screen, click New.
  6. In the New Custom Action dialog box, enter an action name in the Description field.
  7. In the Program to run field, enter instcm.exe
  8. In the Parameters field, enter the configuration parameters for InstCM. A typical syntax would look like this:

    /n %ServiceName% /d %ServiceDir% /e profile.exe /mbtype 2 /text "Do you want to install a newer version?"

    This syntax will prompt the user with an OK dialog box before installing.

  9. In the Action type list, select Disconnect.
  10. In the Run this custom action for list, select All connections.
  11. Click to select the Include the custom action program with this service profile and Program interacts with the user check boxes.
  12. Finish the wizard and save the new profile. After a user installs this profile, it will check for new versions each time the user connects.


InstCM Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

InstCM has the following general syntax:

instcm /n ServiceName /d ServiceDirectory /e NewProfileName [/sleep Seconds] /mbtype {0 | 1 | 2}] [/text "UserTextMessage"] [/o OptionalParameters]

Parameters

/n ServiceName
Specifies the name of the Connection Manager service profile to update. If the variable %ServiceName% is used, Connection Manager will use the name of the current profile.
/d ServiceDirectory
Specifies the directory containing the Connection Manager service profile. If the variable %ServiceDir% is used, Connection Manager will use the directory in which the current profile is installed.
/e NewProfileName
/sleep Seconds
Specifies the number of seconds to sleep before beginning to install the new profile.
/mbtype {0 | 1 | 2}
Specifies the type of message box, if any, for InstCM to display at the time of installation. The following table lists the message box type values.
Code | Description
0 | This is the default value. Will not display any message boxes to the user.
1 | This value displays an OK message box.
2 | This value displays a Yes/No message box that gives the user a choice of whether or not to install the update.
/text "UserTextMessage"
Specifies a message to display to the user if a message box is displayed. The quotation marks are required.
[/o OptionalParameters
Specifies optional parameters. The /o parameter must be the last parameter specified.


InstSrv Examples

Example 1: Install a Service

The task in this example is to install Srvany.exe as a service named ServiceAnyApp. From the directory where Srvany.exe is located, type the following at the command line:

instsrv ServiceAnyApp "srvany.exe"

Press ENTER. You can then use SC to start the service. Type the following at the command line:

sc start serviceanyapp

Press ENTER.

Note

  • By default, services are not "started" when they are installed. After they are installed with InstSrv, some services also require that you import a registry entry before they will run.

Example 2: Install a Service to Run As a Specific User

The task in this example is to install Srvany.exe as a service called ServiceAnyApp and have it run as a specific user. From the directory where Srvany.exe is located, type the following at the command line:

instsrv ServiceAnyApp srvany.exe -a MYDOMAIN\auser -p My1Password

Press ENTER. You can then use SC to start the service. Type the following at the command line:

sc start serviceanyapp

Press ENTER.

Example 3: Uninstall a Service

The task in this example is to uninstall the service MyService. The service must be stopped before you can remove it. Use SC to stop the service. Type the following at the command line:

sc stop myservice

Press ENTER. The MyService service has been stopped. You can now remove the service by using InstSrv. Type the following at the command line:

instsrv MyService Remove

Press ENTER.


InstSrv Remarks

Starting a Service

By default, services that you add by using InstSrv are not started. To start a service via the command line, see SC, a tool included in the Windows Server 2003 operating system.

Removing a Service

Services must be stopped before they can be removed.


InstSrv Syntax

InstSrv uses the following syntax:

One Step instsrv ServiceName PathToExecuteable [-a AccountName] [-p AccountPassword] [ServiceName Remove]

Parameters

ServiceName
Specifies the name you want to assign to the service. This name will appear in listings such as those in the Services snap-in or in NetSvc/WinNetSvc.
PathToExecuteable
Specifies the fully qualified path, including drive letter, of the executable file for the service. The drive must be fixed and local.
ServiceName Remove
Specifies the service you want to remove.
-a AccountName
Specifies the account the service will run under.
-p AccountPassword
Specifies the password for the account the service will run under.


IntFiltr Examples

Overview | Remarks | UI | Examples | Related Tools Run Tool

Example 1: Specify That the Printer Port Interrupt Utilizes Only CPU Number 4 on a Multiprocessor System

The task in this example is to use IntFiltr to assign the Printer Port interrupt to use only CPU 4 on a multiprocessor system. You must have completed the steps listed in Completing Prerequisite Installation Steps on the Remarks page.

To run IntFiltr, type the following at the command line:

intfiltr

Press ENTER. This opens the Interrupt Filter Configuration Tool window.

To specify the Printer Port interrupt CPU affinity settings:

  1. In the Devices list, click Printer Port.
    If you do not want to restart the device when making changes, check Don't Restart Device When Making Changes.
  2. To turn interrupt filtering on for the Printer Port, click Add Filter.
  3. To choose the CPU, under Interrupt Affinity Mask, click Set Mask.
  4. In the Processor Affinity window, click to select the check box labeled CPU 4. If any other check boxes are selected, click to clear them.

Note

  • Once configured, IntFiltr runs in the background with no interaction until it is reconfigured.

Example 2: Verify That the Printer Port Interrupt Utilizes Only CPU Number 4

The task in this example is to use IntFiltr to verify that the Printer Port interrupt uses CPU 4 on a multiprocessor system.

To run IntFiltr, type the following at the command line:

intfiltr

Press ENTER. This opens the Interrupt Filter Configuration Tool window.

To verify the Printer Port interrupt CPU affinity settings:

  1. In the Devices list, click Printer Port.
  2. In the Upper Filters list, verify that InterruptAffinityFilter is listed.
  3. To verify the CPU, under Interrupt Affinity Mask, click Set Mask.
  4. In the Processor Affinity window, verify that only the check box labeled CPU 4 is selected.

Example 3: Remove the CPU Affinity Mask of the Printer Port from the Registry

The task in this example is to use IntFiltr to remove the Printer Port interrupt's restriction to use only CPU 4.

To run IntFiltr, type the following at the command line:

intfiltr

Press ENTER. This opens the Interrupt Filter Configuration Tool window.

To remove the Printer Port interrupt CPU affinity settings:

  1. In the Devices list, click Printer Port.
    If you do not want to restart the device when making changes, check Don't Restart Device When Making Changes.
  2. To remove the CPU mapping, under Interrupt Affinity Mask, click Delete Mask.
  3. To turn interrupt filtering off for the Printer Port, click Remove Filter.

Note

  • If no CPU affinity mask exists for a device, leaving the interrupt filter turned on has no effect.


IntFiltr Remarks

Overview | Remarks | UI | Examples | Related Tools Run Tool

Understanding IntFiltr

IntFiltr works by intercepting a specific Plug and Play (PnP) I/O Request Packet (IRP) that is passed to devices (IRP_MN_START_DEVICE).

IntFiltr reads the resource list that is passed along with the IRP and modifies the affinity mask according to settings specified by the user. IntFiltr can do this for any of the interrupt resources in the device's resource list. The modified IRP is then passed on to lower-level drivers in the stack.

Because lower-level drivers use entries in this resource list when they set up their Interrupt Service Routines (ISRs), they will only install ISRs on the set of CPUs that the user has specified in IntFiltr.

Running IntFiltr on Windows Server 2003

Interrupt filtering can affect the overall performance of the computer. No single algorithm produces the best performance under all possible workloads. For Itanium-based computers, Windows Server 2003 selects a specific CPU to handle interrupts for each adapter on the system. On these computers, the adapter will only interrupt either the processor Windows selects or the one you set by using IntFiltr. For any other type of computer, Windows Server 2003 directs interrupts to any available CPU by default. In either case, you might be interested in experimenting with various configurations to find out which is optimal. This tool allows any configuration, even those that are not optimal.

Note

  • On Itanium-based computers, it is necessary to add the boot option/MAXPROCSPERCLUSTER=0 to use Intfiltr.

Completing Prerequisite Installation Steps

There are two tasks that you must complete before you can use IntFiltr:

  • Use Device Manager to verify that a device has an interrupt resource. Although all computer devices will appear in IntFiltr in the Devices list, it only makes sense to use IntFiltr with devices that have interrupt resources.
  • Install IntFiltr. This requires you to copy a system file to your system32\drivers directory and update your registry to include the changes, as described below.
    1. Copy Intfiltr.sys from the installation directory, %programfiles%\Windows Server 2003 Resource Kit, to your system32 directory, <systemroot>\system32\drivers.
    2. Click Start, and then click Run.
    3. Type the following
      regedit intfiltr.reg
    4. Press ENTER.
    5. In the Registry Editor dialog box that asks if you want to add IntFiltr information to the registry, click Yes.
    6. In the Registry Editor dialog box that tells you the IntFiltr information has been added successfully to the registry, click OK.


IntFiltr UI

Overview | Remarks | UI | Examples | Related Tools Run Tool

IntFiltr Windows

IntFiltr includes two windows in which you can configure an interrupt's CPU affinity mask. The Interrupt Filter Configuration Tool window opens when you run the tool and allows you to select the device whose interrupt you want to configure. The Processor Affinity window opens when you click Set Mask and allows you to select the target CPUs for the device.

Interrupt Filter Configuration Tool Window

The following commands and options are available:

Command or Option | Description
Devices | Lists all devices available on this computer, regardless of whether the device has interrupt resources. Select the device whose interrupt signal you want to process on specific CPUs.
Add Filter Turns on interrupt filtering for the selected device, adds the InterruptAffinityFilter string to the Upper Filters list, and—if specified—restarts the device. Click this button to turn filtering on so that any CPU affinity mask created is used.

Note

  • If no CPU affinity mask exists for a device, leaving the interrupt filter turned on has no effect.
Remove Filter | Turns off interrupt filtering for the selected device, removes the InterruptAffinityFilter string from the Upper Filters list, and—if specified—restarts the device. Click this button to turn filtering off so that any CPU affinity mask created is not used.
Location Info | Displays information about where the device is installed in the computer; N/A is displayed if there is no information available. This information is retrieved from the motherboard. If N/A is displayed, it either means that there is nothing written on the motherboard or the firmware does not exist to relay what is written on the motherboard.
DevObj Name | Displays the following string: \Device\xxxxxxxx.
Upper Filters | Displays the name of any upper-level filters installed on the device. Upper-level filter drivers typically provide added-value features for a device.
Don't Restart Device When Making Changes | Allows you to control whether a device is restarted after you change the settings for it. Settings are changed any time you use the Add Filter, Remove Filter, Set Mask, or Delete Mask commands. If this check box is selected, any changes you make will not take effect until the next time the device is restarted. If this check box is not selected, the device is restarted any time you change its settings.
Interrupt Affinity Mask: Set Mask | Opens the Processor Affinity window. Click this button to choose the specific set of CPUs that will process interrupt signals from the selected device.
Interrupt Affinity Mask: Delete Mask | Removes the CPU affinity mask, restarts the device, and clears the mask from Current Value. Click this button to delete the CPU affinity mask.
Interrupt Affinity Mask: Current Value | Displays the selected CPUs that will process interrupt signals from the selected device.

Processor Affinity Window

The following option is available:

Option | Description
CPU List | Lists all CPUs available on this computer. Select the check box for each CPU you want to process the interrupt signals from the selected device.


KerbTray Remarks

Overview | Remarks | UI | Related Tools Run Tool

Using KerbTray

Open KerbTray by double-clicking Kerbtray.exe. KerbTray opens, but no dialog box is displayed by default. Instead, an icon for KerbTray appears in the notification area.

Double-click the tool icon in the notification area to display a dialog box with a list of tickets obtained since logon. You can also display a shortcut menu by right-clicking the tool icon to view the following options: List Tickets and Purge Tickets.

  • Select List Tickets to display the same dialog box that appears when you double-click the icon.
  • Select Purge Tickets to destroy all tickets that you have cached.

Caution

  • Purge Tickets destroys all tickets without providing a warning dialog box. Using Purge Tickets requires the system to reauthenticate your access token the next time you access a resource. However, this does not require user intervention.

Removing KerbTray from the Notification Area

To exit KerbTray and remove it from the notification area, right-click the KerbTray icon in the notification area, and select Exit Kerb Tray.


KerbTray UI

Overview | Remarks | UI | Related Tools Run Tool

KerbTray Dialog Box

The KerbTray dialog box contains the following sections:

  • Client Principal Section:
    • Client principal name. Lists the name of the Kerberos client for which ticket information is displayed.
    • Domain list. Contains a list of domains and tickets for services used since logon. When you select an item on the list, its properties are displayed in the remaining sections and property pages in the dialog box.
  • Service Principal Section:
    • Service Principal Name. Displays the name of the service the client is accessing by using the ticket that is displayed in the Client Principal section of the dialog box.
    • Property Pages. Describes attributes of the ticket selected in the Client Principal section of the dialog box. (Names, Times, Flags, and Encryption types). Attributes are not displayed for expired tickets.

The following options are available in the bottom section of the KerbTray dialog box:

Names Tab

Option | Description
Client Name | Requester of the ticket. In most cases, this is the client principal name.
Service Name | Name of the service to which the ticket is granting access. This is the same as the samAccountName property in the directory for that account. A ticket-granting-ticket (TGT) is a ticket for the key distribution center (KDC) service. The initial TGT is obtained when you log on to the domain, using your account. The service name for a TGT is krbtgt.
Target Name | The service principal name of the service to which the ticket is granting access.

Times Tab

Option | Description
Start time | Time when the ticket becomes valid.
End time | Time when the validity of the ticket ends. After a ticket is past this time, it can no longer be used to authenticate to a service.
Renew Until | If the ticket is renewable, this is the maximum lifetime of the ticket. To continue using a ticket, you must renew it. Tickets must be renewed before the End time and Renew Until times expire.

Flags Tab

Option | Description
Forwardable | Indicates to the Ticket Granting Service (TGS) that it can issue tickets that do not require direct access between the client and server. A client uses this type of ticket when it needs a front-end server to access a back-end server for it. The client must specify, in the address field, the address(es) it is trying to access. The client can use this type of ticket without knowing the name of the back-end server ticket.
Forwarded | Indicates that the ticket was issued based on the FORWARDABLE flag. Front-end servers provide an audit trail that requires additional authentication when a forwarded ticket is presented. Used when a client cannot have direct access to a server.
HW Authenticated | Used when a hardware device provides the initial authentication of a ticket. Indicates that additional information about the authentication must be included in the ticket. This flag is not used in the Microsoft implementation of the Kerberos protocol.
Initial | Indicates that the ticket was issued through the authentication server (AS) protocol, not through a TGT.
Invalid | This flag is typically set for postdated tickets. Indicates the TGS must verify the authenticity and start time of the ticket from the KDC before it can be used.
May Postdate | Indicates to the TGS that it can issue a POSTDATED ticket.
OK as delegate | Indicates that the server (not the client) specified in the ticket can act as a delegate for the client. This is required so that the server can act on proxied or forwarded tickets for a client.
Postdated | Allows a ticket to have a future start time. When the KDC issues a POSTDATED ticket, it is also marked INVALID. The ticket is dormant until the actual start time. This type of ticket must be validated by the KDC before use.
Preauthenticated | Indicates that the holder of the ticket provided authentication before the ticket was issued. Indicates that additional information about the authentication must be included in the ticket.
Proxiable | Indicates to the Ticket Granting Service (TGS) that it can issue tickets that do not require direct access between the client and server. A client uses this type of ticket when it must go through a front-end server to access to a back-end server. The client must know the name of the back-end server to use this type of ticket.
Proxy | Indicates that the ticket was granted based on the PROXIABLE flag. Front-end servers provide an audit trail that requires additional authentication when a proxy ticket is presented. Used when a client cannot have direct access to a server.
Renewable | Allows the ticket holder to maintain a valid ticket for long periods of time. By default Kerberos policy limits tickets to 10 hours. This flag allows the ticket holder to get a new session key without having to obtain a new ticket. Renewable tickets have two expiration times: (1) the ticket expiration of the current ticket; and (2), the latest permissible expiration value for the ticket.

Encryption Types

Option | Description
Ticket Encryption Type | Encryption type that is used to encrypt the Kerberos ticket.
Key Encryption Type | Encryption type that is used with the enclosed session key.


Kerberos List Examples

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

KList Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: List Details About a Current Ticket

To determine whether a ticket to the krbtgt/DOMAIN.NAME@REALM.NAME principal is valid, type the following at the command line:

klist tgt

Press ENTER. The following output is displayed:

Cached TGT:

ServiceName: krbtgt
TargetName: krbtgt
FullServiceName: imauser
DomainName: MYDOMAIN.CORP.EXAMPLE.COM
TargetDomainName: MYDOMAIN.CORP.EXAMPLE.COM
AltTargetDomainName: MYDOMAIN.CORP.EXAMPLE.COM
TicketFlags: 0x40e00000
KeyExpirationTime: 0/256/1 1:00:29928
StartTime: 10/6/2002 7:43:02
EndTime: 11/5/2002 7:43:02
RenewUntil: 12/5/2002 7:43:02
TimeSkew: 12/5/2002 7:43:02

Example 2: List All Current Cached Tickets

To see a list of current cached tickets, type the following at the command line:

klist tickets

Press ENTER. The following output is displayed:

Cached Tickets: (23)

   Server: krbtgt/MYDOMAIN.CORP.EXAMPLE.COM@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/5/1999 7:43:02
      Renew Time: 12/5/1999 7:43:02

   Server: krbtgt/MYDOMAIN.CORP.EXAMPLE.COM@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 15:31:40
      Renew Time: 12/3/1999 15:31:38

   Server: DOMCON-01$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 5:09:08
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-04$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 5:09:08
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-11$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 3:37:07
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-07$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 3:37:07
      Renew Time: 12/4/1999 8:28:53

   Server: RED-ADC-02$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 0:35:06
      Renew Time: 12/4/1999 8:28:53

   Server: CPITGDCR01$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 23:05:05
      Renew Time: 12/4/1999 8:28:53

   Server: LDAP/DOMCON-03.mydomain.corp.EXAMPLE.COM/mydomain.corp.EXAMPLE.COM@
MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 21:20:04
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-03$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 21:20:04
      Renew Time: 12/4/1999 8:28:53

   Server: LDAP/DOMCON-06.mydomain.corp.EXAMPLE.COM/mydomain.corp.EXAMPLE.COM@
MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 19:37:04
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-06$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 19:37:03
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-02$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 14:19:02
      Renew Time: 12/4/1999 8:28:53

   Server: RED-ADC-01$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 12:42:53
      Renew Time: 12/4/1999 8:28:53

   Server: LDAP/DOMCON-12.mydomain.corp.EXAMPLE.COM/mydomain.corp.EXAMPLE.COM@
MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 12:42:53
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-12$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 12:42:53
      Renew Time: 12/4/1999 8:28:53

   Server: LDAP/CPITGDCR01.mydomain.corp.EXAMPLE.COM/mydomain.corp.EXAMPLE.COM
@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 22:49:46
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/DOMCON-02.mydomain.corp.EXAMPLE.COM/mydomain.corp.EXAMPLE.COM@
MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 21:06:46
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/DOMCON-07.mydomain.corp.EXAMPLE.COM/mydomain.corp.EXAMPLE.COM@
MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 19:24:45
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/RED-ADC-02.mydomain.corp.EXAMPLE.COM/mydomain.corp.EXAMPLE.COM
@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 17:27:44
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/DOMCON-11.mydomain.corp.EXAMPLE.COM/mydomain.corp.EXAMPLE.COM@
MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 15:41:10
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/DOMCON-04.mydomain.corp.EXAMPLE.COM/mydomain.corp.EXAMPLE.COM@
MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 15:31:41
      Renew Time: 12/3/1999 15:31:38

   Server: IMAUSERSCOMPUTER$@MYDOMAIN.CORP.EXAMPLE.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 15:31:39
      Renew Time: 12/3/1999 15:31:38


Kerberos List Syntax

Windows Resource Kit Tools Help

Windows Resource Kit Tools Help

KList Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

KList uses the following syntax:

One Step klist [tickets | tgt | purge] [-?]

Parameters

tickets
Lists the current cached tickets of services to which you have authenticated since logging on. Displays the following attributes of all cached tickets:
Option | Description
End Time | Time at which that the ticket becomes invalid. After a ticket is past this time, it cannot be used to authenticate to a service.
KerbTicket Encryption Type | Encryption type used to encrypt the Kerberos ticket.
Renew Time | Maximum lifetime of a renewable ticket (see TicketFlags). To continue using this ticket, you must renew it before reaching the established End Time and before the expiration date established in RenewUntil.
Server | Server and domain for the ticket.
tgt
Lists the initial Kerberos ticket-granting-ticket (TGT). Displays the following attributes of the currently cached ticket:
Option | Description
AltTargetDomainName | Name supplied to InitializeSecurityContext that generated this ticket, typically a service principal name (SPN).
DomainName | Domain name of the service.
End Time | Time when the ticket becomes invalid. When a ticket is past the end time, it cannot be used to authenticate to a service.
FullServiceName | Canonical name of the account principal for the service.
KeyExpirationTime | Expiration time from the KDC reply.
RenewUntil | Maximum lifetime of a renewable ticket (see TicketFlags). To continue using a ticket, you must renew it. Tickets must be renewed before the expiration time set in End Time and in RenewUntil.
ServiceName | A TGT is a ticket for the key distribution center (KDC) service. The service name for a TGT is "krbtgt."
Start time | Time when the ticket becomes valid.
TargetDomainName | For a cross-realm ticket, this is the realm, rather than the issuing realm, in which the ticket is good.
TargetName | Service name for which the ticket was requested. This is the name of a servicePrincipalName property on an account in the directory.
TicketFlags | Kerberos ticket flags set on the current ticket in hexadecimal. The KerbTray tool displays these flags on the Flags tab.
TimeSkew | The reported time difference between the client computer and the server computer for a ticket.
purge
Allows you to delete a specific ticket. Purge tickets destroy all tickets that you have cached, so use this with caution. It might stop you from being able to authenticate to resources. If this happens you must log off, and then log on again.
-?
Displays command-line help.


KRT Remarks

Overview | Remarks | UI | Related Tools Run Tool

Identifying Archived Private Keys

KRT provides a way for you to query one or more CA databases to locate archived private keys. It will only show results that contain a certificate and an archived private key pair that was issued by the currently selected CA. If the desired results are not displayed, one of three causes is most likely:

  • The search criteria specified was not found. This is the most common error and is caused by simple errors such as mistyping the search criteria or specifying the wrong search criteria for a value. For example, providing a certificate hash in the value field but selecting "certificate serial number" as the search criteria would cause KRT to return no results. To resolve this issue, verify the data and resubmit.
  • The currently selected CA did not issue the certificate and therefore did not archive the private key. Although the certificate can be distributed in a number of ways, the archived private key is always stored in the issuing CA's database. To resolve the issue, select the correct CA from the list provided in KRT.
  • The CA did not archive the private key when the certificate was issued. This is normally a configuration error. The CA and the certificate template must both be configured properly for private key archival to function. For more information about configuring key archival, see Help and Support Center for Windows Server 2003.

Separating KRA and Certificate Manager Roles

In many PKI environments, the Certificate Manager and the KRA are separate people. This means that the person who can retrieve the encrypted private key from the CA is not the same person who can decrypt the key. In these environments, a Certificate Manager must retrieve the data from the CA and save it as encrypted binary data. Then the data is transferred to the KRA, who decrypts it and saves the certificate and private key to a file. Finally, that file can be transferred to the subject who needs the recovered private key.

When the data must be extracted and decrypted in two distinct steps, a binary large object (BLOB) is used to store the intermediate data. The Retrieve Blob command in KRT allows the Certificate Manager to retrieve the encrypted data object, and the Decrypt Blob command is used to decrypt a saved data object that was previously retrieved.

Understanding CA Server Requirements

Although other CAs might have the ability to archive private keys, there is no universal standard governing how these keys are stored and protected. KRT is designed to recover private keys based on the protection and storage implementation of Windows Server 2003 CAs only. It will not work on any other CA.


KRT UI

Overview | Remarks | UI | Related Tools Run Tool

KRT has one window consisting of three sections:

Search Criteria

Use this section to search the CA database for archived private keys. The following table lists the options available in this section.

Option | Description
Certification authority (CA) | Lists the enterprise CAs available. This CA's database will be searched for the archived private key. The default setting is to search all available CAs.
Search Criteria | Lists the fields that can be searched, and provides a text box to specify the desired search value.
Value | Provides a space to type the value that will be searched for.
Search | Searches the selected CA database, or all enterprise CA databases, for the search criteria specified.

Certificates

This section displays a list of certificates that matched the last search performed and the details of the certificates. Only certificates that have an archived private key are displayed.

Recovery Actions

Use this section to perform the various private key retrieval and decryption tasks. One or more certificates must be selected in the Certificates list before these options are available. The following table lists the options available in this section.

Option | Description
Show KRA | Displays the details of the certificate or certificates associated with the archival of this private key. Only the private key for the displayed certificate or certificates can be used to decrypt the archived private key. Only one certificate can be selected for this option.
Retrieve Blob | Obtains the selected certificates and encrypted private keys and saves them to a file. One file is created for each data object retrieved. This option is used when the retrieval and decryption tasks must be performed separately.
Decrypt Blob | Reads the specified file that contains the certificates and encrypted private keys, decrypts the private keys, and then saves the decrypted information to a file. This option is used when the retrieval and decryption tasks must be performed separately.
Recover | Obtains the selected certificates and encrypted private keys, decrypts the private keys, and then saves the decrypted information to one or more files. This option encompasses both the Retrieve Blob and Decrypt Blob options.


LBridge Examples

Overview | Remarks | Syntax | Examples | Related Tools

Example 1: Running LBridge with XCopy

The task in this example is to edit the LBridge batch file so that XCopy can copy the files from sysvol to the Export directory. The /s and /d parameters are used so that XCopy includes subdirectories in the copy and only copies new files.

Open the LBridge file in a text editor, such as NotePad, and look for the following line:

Echo XCopy %L-Source%  %L-Destination%  /s /D

Remove "Echo" from the line, leaving the following text:

XCopy %L-Source%  %L-Destination%  /s /D

Note

  • All optional parameters for XCopy are included by default. Edit the end of the command to reflect the desired parameters.

Save the file before closing.

Copy the files to the scripts directory located in the export share. In this example, the Export directory is shared on a Windows NT backup domain controller (BDC) named NTServer. The files are copied to the scripts directory located in the Export share. Type the following at the command line:

lbridge \\ntserver\export\scripts

Press ENTER. LBridge uses the %UserDNSDomain% variable to find the Sysvol share on a domain controller. Output similar to the following is displayed:

----------------------------------------
Now running:  lbridge
     Source:  \\domain1\sysvol\domain1\scripts
Destination:  \\NTServer\export\scripts

Example 2: Running LBridge with RoboCopy

The task in this example is to edit the LBridge batch file so that RoboCopy can copy the files from Sysvol to the Export directory. The /e and /purge parameters are used so that RoboCopy includes subdirectories in the copy and deletes, from the target, files that do not exist in the source.

Open the LBridge file in a text editor, such as NotePad. By default, LBridge calls x Copy. The command for calling RoboCopy is included in LBridge but, by default, it is commented out. Look for the following lines:

Call :XCopy
@Rem Call :RoboCopy

Cut "@Rem" from the second line and paste it to the beginning of the first line. The following result is displayed:

@Rem Call :XCopy
Call :RoboCopy

Remove "Echo" from the following line:

Echo RoboCopy %L-Source%  %L-Destination%  /E /PURGE

The following text remains:

RoboCopy %L-Source%  %L-Destination%  /E /PURGE

Note

  • All optional parameters for RoboCopy are included by default. Edit the end of the command to reflect the desired parameters.

Save the file before closing.

Copy the files to the \scripts directory located in the Export share. In this example, the Export directory is shared on a Windows NT BDC named NTServer. Type the following at the command line:

lbridge \\NTServer\export\scripts

Press ENTER. LBridge uses the %UserDNSDomain% variable to find the Sysvol share on a domain controller. Output similar to the following is displayed:

----------------------------------------
Now running:  lbridge
     Source:  \\domain1\sysvol\domain1\scripts
Destination:  \\NTServer\export\scripts


LBridge Remarks

Overview | Remarks | Syntax | Examples | Related Tools

Preparing the Domain for LBridge

LBridge is designed to bridge the differences in file replication services between domain controllers during an upgrade from a Windows NT domain environment to an Active Directory domain environment. In a Windows NT domain environment, the primary domain controller (PDC) is usually the export server for the LMRepl service. Before upgrading the PDC, these export duties must be transferred to a backup domain controller (BDC); then the LMRepl service should be removed from the PDC.

Set up LBridge to copy files from the sysvol to the Export directory on the BDC. The BDC then replicates those files to the rest of the Windows NT domain controllers using the LMRepl service.

Running LBridge

LBridge does not have run locally on a domain controller. LBridge uses the %UserDNSDomain% system variable to find the Sysvol share on a domain controller. A best practice is to edit the file so that it runs without user intervention. Then, schedule it to run every two hours with the Scheduling service.

Calling a Copy Program

LBridge contains code for calling Xcopy or RoboCopy to copy files from sysvol to an Export directory, but you can use other programs that copy files. To do that, load the program on the computer on which LBridge is running, and edit LBridge to call that application. Make sure that you comment out all lines that call XCopy and Robocopy.


LBridge Syntax

Overview | Remarks | Syntax | Examples | Related Tools

LBridge.cmd uses the following syntax:

One Step lbridge [\\Server\Share] [/s] [/d] [/e] [/purge] /?

Parameters

\\Server\Share
Specifies a Universal Naming Convention (UNC) for the Export directory on a Windows NT backup domain controller (BDC) to which LBridge should copy files.
/s
Specifies that subdirectories should also be copied. Use this parameter only when using XCopy.
/d
Specifies that only new files should be copied. Use this parameter only when using XCopy.
/e
Specifies that subdirectories should also be copied. Use this parameter only when using RoboCopy.
/purge
Deletes, from the target directory, files that no longer exist in the source directory. Use this parameter only when using RoboCopy.
/?
Displays command-line usage.


LinkD Examples

Example 1: Create a Link From a Folder to a Target Object

To get a listing of all files in the root directory of C:\folder, type the following at the command line:

dir

Press ENTER. Output similar to the following is displayed:

Directory of C:\folder
10/21/2002  04:33 PM    <DIR>          .
10/21/2002  04:33 PM    <DIR>         ..
               0 File(s)              0 bytes
               2 Dir(s)  12,460,773,376 bytes free

To change to the D drive, type the following at the command line:

d:

Press ENTER. To change to the DOCS folder on the D drive, type the following at the command line:

cd DOCS

Press ENTER. To list the files in the DOCS folder on the D drive, type the following at the command line:

dir

Press ENTER. Output similar to the following is displayed:

Directory of D:\DOCS

08/23/2001  05:00 AM    <DIR>          .
08/23/2001  05:00 AM    <DIR>          ..
08/23/2001  05:00 AM            22,398 PRO.TXT
08/23/2001  05:00 AM             6,859 READ1ST.TXT
08/23/2001  05:00 AM            39,045 RELNOTES.HTM
08/23/2001  05:00 AM             6,895 WINXP_LOGO_HORIZ_SM.GIF
               4 File(s)         75,197 bytes
               2 Dir(s)               0 bytes free

To return to the Folder directory on the C drive, type the following at the command line:

C:

Press ENTER. To create a link at C:\Folder\Ddrive to the D:\DOCS folder, type the following at the command line:

linkd Ddrive D:\DOCS

Press ENTER. Output similar to the following is displayed:

Link created at: Ddrive

To test the new link, type the following at the command line:

cd Ddrive

Press ENTER. To list the contents of Ddrive, type the following at the command line:

dir

Press ENTER. Output similar to the following is displayed:

Directory of C:\folder\Ddrive

08/23/2001  05:00 AM    <DIR>          .
08/23/2001  05:00 AM    <DIR>          ..
08/23/2001  05:00 AM            22,398 PRO.TXT
08/23/2001  05:00 AM             6,859 READ1ST.TXT
08/23/2001  05:00 AM            39,045 RELNOTES.HTM
08/23/2001  05:00 AM             6,895 WINXP_LOGO_HORIZ_SM.GIF
               4 File(s)         75,197 bytes
               2 Dir(s)               0 bytes free

Notice that the contents of Ddrive are the same as the contents of the D:\DOCS folder.

Example 2: Create an NTFS Junction Point to Your Desktop

Type the following at the command line:

linkd YourDeskTop "<Your Profile> \desktop"

Note

  • <Your Profile> can be the path or %UserProfile%.

Press ENTER. Output similar to the following is displayed:

Link created at: YourDeskTop

Notes

  • Use NTFS Access Control Lists (ACLs) to protect junction points from inadvertent deletion.
  • Use NTFS ACLs to protect files and directories targeted by junction points from inadvertent deletion or other file system operations.
  • Never delete a junction point using Explorer, a del /s command, or other file system utilities that walk recursively into directory trees. These utilities affect the target directory and all subdirectories.
  • Use caution when applying ACLs or changing file compression in a directory tree that includes NTFS Junction Points.
  • Do not create namespace cycles with NTFS or DFS junction points.
  • Place all your junction points at a secure location in a namespace where you can test them out in safety, and other users cannot mistakenly delete or change them.


LinkD Remarks

Background

With operating systems earlier than Windows 2000, you could access resources in storage under a fully qualified path name (i.e., \\resource\sharename) without having to map a drive letter to that resource. If you wanted a persistently available resource, however, the usual approach was to map remote storage to a drive letter. That option was not available for local storage; it received a drive letter whether you liked it or not. Furthermore, the addition of new drives sometimes played havoc with the default order of the drives, requiring considerable caution when new drives were installed.

The Advantages of NTFS Junction Points

Windows 2000, Windows XP Professional, and Windows Server 2003 operating systems are not subject to the 26 drive letter limitation. These operating systems have a feature called NTFS Junction Points. A junction point is a physical location on a local hard disk that points to another location on that disk or another storage device. When you create a mounted drive, you create a junction point. A mounted drive is a device attached to an empty folder on an NTFS volume. It behaves the same as any other drive, but no drive letter is attached to the volume, just a label.

You can mount an entire drive to a directory on another drive. When users access that directory, they have access to that entire drive, regardless of size. For example, you could have any number of drives physically installed on one system, but the users and applications might see only a single C drive letter.

Creating a Mounted Drive

The easiest way to create a mounted drive is to use the Disk Management portion of the Computer Management Console.

To add a drive or change existing drives

  1. Right-click the drive or partition and select Change Drive Letter and Paths.
  2. From that dialog box, add, edit, or remove drive letters and mount points, as appropriate.
    • To add a drive letter:
      1. Select Add, Add New Drive Letter or Path.
      2. Select a drive letter from the drop-down menu of available letters.
    • To select a new mount point:
      1. Click Mount in this NTFS folder
      2. Type in the fully qualified path name to the empty folder you want to use as the mount point.

The Browse button lets you look at the directory tree for the available volumes that support mount points and lets you select an existing folder or create a new empty folder to use as the junction point. This procedure lets you perform all disk and drive management activities from the same application.

Manually Creating a Mounted Drive

To manually create a mounted drive, type mountvol at the command line, without adding any parameters. Then press ENTER.

Output similar to the following is displayed:

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L

    path        Specifies the existing NTFS directory where the mount point will reside.
    VolumeName  Specifies the volume name that is the target of the mount   point.
    /D          Removes the volume mount point from the specified directory
    /L          Lists the mounted volume name for the specified directory.
Possible values for VolumeName along with current mount points are:

    \\?\Volume{08a4ee15-86cd-11d4-a06e-806d6172696f}        C:
    \\?\Volume{08a4ee16-86cd-11d4-a06e-806d6172696f}        D:
    \\?\Volume{08a4ee17-86cd-11d4-a06e-806d6172696f}        E:
    \\?\Volume{08a4ee14-86cd-11d4-a06e-806d6172696f}        G:
    \\?\Volume{08a4ee13-86cd-11d4-a06e-806d6172696f}        F:
    \\?\Volume{08a4ee12-86cd-11d4-a06e-806d6172696f}        A:\

The output lists all possible values and current mount points for the local system, which means that your system will not return the same response that you see in the preceding example.

Note

  • The primary identification of the drive volumes provided is not the drive letter but the Global Unique ID (GUID), which identifies the drive, even if you later change the drive letter. Of course, Windows 2000, Windows XP Professional, or Windows Server 2003 do not require that you use drive letters beyond the boot device. Also remember that you can cut and paste in the command windows, so you do not need to retype the GUID information.


LinkD Syntax

LinkD uses the following syntax:

One Step linkd [Source] [Source /d] [Source Destination] [/?]

Parameters

Source
Specifies the Source to be linked to the target specified in Destination or the object to be deleted by the /d parameter. Examples of Source objects are a valid Microsoft Windows directory name, device name, or object name.

Note

  • If Source contains spaces, the name must be surrounded by quotation marks. All characters in the source name must be in the ASCII character set; use of Unicode characters is not supported.
Source /d
Deletes Source, regardless of whether or not a link to a destination exists for that source.
Source Destination
Specifies the target to which the object specified by Source should be linked. Examples of Destination objects are a valid Microsoft Windows directory name, device name, or object name.

Note

  • If Destination contains spaces, the name must be surrounded by quotation marks. All characters in the destination name must be in the ASCII character set; use of Unicode characters is not supported.
/?
Displays command-line use.


LinkSpeed Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Check the Speed of a Network Connection

The task in this example is to check the speed of the network connection between the local computer and a server on the network. The server name is Server1.contoso.com, but only the host name is used. Type the following at the command line:

linkspeed /s server1

Press ENTER. Output similar to the following is displayed:

Evaluating the performance using MultiNetGetConnectionPerformance:
System                              : 10.1.1.1
Flag                                : WNCON_DYNAMIC
Link Speed ( in Mbps )              : 353
Delay ( in milliseconds )           : 550
Data Packet Size                    : Unknown.

Evaluating the performance using PING routine:
System                              : 10.1.1.1
Link Speed ( in Mbps )              : 31
Delay ( in milliseconds )           : 3
Threshold value                     : TRUE

Evaluating the performance using QOS:
System                              : 10.1.1.1
Flag                                : MEDIUM
Link Speed ( in Mbps )[incoming]    : 95
Link Speed ( in Mbps )[outgoing]    : 95

Example 2: Determine the Speed of the Connection to a Domain Controller

The task in this example is to determine the speed of the network connection between the local computer and a domain controller. The local computer name is Client1. Type the following at the command line:

linkspeed /dc

Press ENTER. Output similar to the following is displayed:

Evaluating the performance using MultiNetGetConnectionPerformance:
System                              : CLIENT1
Flag                                : WNCON_DYNAMIC
Link Speed ( in Mbps )              : 76
Delay ( in milliseconds )           : 550
Data Packet Size                    : Unknown.

Evaluating the performance using PING routine:
This is a fast link .

Evaluating the performance using QOS:
System                              : CLIENT1
Flag                                : MEDIUM
Link Speed ( in Mbps )[incoming]    : 95
Link Speed ( in Mbps )[outgoing]    : 95


LinkSpeed Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

LinkSpeed uses the following syntax:

One Step linkspeed {/s Server|/dc} [/t Value]

Parameters

/s Server
Specifies the name or IP address of a computer. Fully qualified domain names (FQDNs), host names, and NetBIOS names in the Universal Naming Convention (UNC) (for example, \\Servername) are all accepted.
/dc
Checks the speed of the connection to a domain controller from the local computer.
/t Value
Specifies a threshold, in bytes, that adds information to the output of the tool.
Output | Description
4 | Threshold specified is less than the actual value.
5 | Threshold specified is equal to the actual value.
6 | Threshold specified is greater than the actual value.
9 | The threshold comparison errored.

Note

  • When run without parameters, LinkSpeed displays command-line usage.


List Examples

Example 1: Search for a Text String in a File

To search for a text string in a file, type the following at the command line:

list /s:host c:\Windows\debug\netsetup.log

Press ENTER. Output similar to the following is displayed:

08/29 10:44:22  Options: 0x40001                                               ?
08/29 10:44:22  OS Version: 5.1                                                ¦
08/29 10:44:22  Build number: xxxx                                             ¦
08/29 10:44:22 NetpValidateName: checking to see if 'My Computer' is valid as type ¦
08/29 10:44:22 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0¦
08/29 10:44:22 NetpValidateName: name 'My Computer' is valid for type 3            ¦
08/29 10:44:22 NetpDsGetDcName: trying to find DC in domain 'My Computer', flags: 0¦
08/29 10:44:37 NetpDsGetDcName: failed to find a DC having account 'John Doe$': 0¦
08/29 10:44:37 NetpDsGetDcName: found DC '\\xx-xx-xx' in the specified domain ¦
08/29 10:44:37 NetpJoinDomain: status of connecting to dc '\\xx-xx-xx': 0x0   ¦
08/29 10:44:37 NetpGetLsaPrimaryDomain: status: 0x0                            ¦
08/29 10:44:37 NetpGetDnsHostName: Read NV Hostname: John Doe                   ¦
08/29 10:44:37 NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain nam¦
08/29 10:44:37 NetpLsaOpenSecret: status: 0xc0000034                           ¦
08/29 10:44:38 SamLookupNamesInDomain on John Doe$ failed with 0xc0000073        ¦
08/29 10:44:38 NetpJoinDomain: status of setting machine password: 0x534       ¦
08/29 10:44:38 NetpJoinDomain: initiaing a rollback due to earlier errors      ¦
08/29 10:44:38 NetpLsaOpenSecret: status: 0x0                                  ¦
08/29 10:44:39 NetpJoinDomain: rollback: status of deleting secret: 0x0        ¦
08/29 10:44:39 NetpJoinDomain: status of disconnecting from '\\xx-xx-xx': 0x0 ¦
08/29 10:44:39 NetpDoDomainJoin: status: 0x534                                 ¦
08/29 10:44:49 ----------------------------------------------------------------?

Note

  • The text in red is the first instance in the specified file that the text string occurred. In the comand prompt window, this text would actually appear highlighted instead of red.

Example 2: Display the entire contents of a file

To Display the Entire Contents of a File, Type the Following at the Command Line:

list c:\Windows\debug\netsetup.log

Press ENTER. Output similar to the following is displayed:

netsetup.log          Line: 0 of 221                                 M      8/29/2002   9:45a
08/29 10:41:43 -----------------------------------------------------------------             ?
08/29 10:41:43 NetpValidateName: checking to see if 'WORKGROUP' is valid as type 2 name      ¦
08/29 10:41:43 NetpCheckNetBiosNameNotInUse: for 'WORKGROUP' returned: 0x858                 ¦
08/29 10:41:43 NetpCheckNetBiosNameNotInUse for 'WORKGROUP' [ Workgroup as MACHINE]  returned 0x858¦
08/29 10:41:43 NetpValidateName: name 'WORKGROUP' is valid for type 2                        ¦
08/29 10:41:43 -----------------------------------------------------------------             ¦
08/29 10:41:43 NetpValidateName: checking to see if 'WORKGROUP' is valid as type 2 name      ¦
08/29 10:41:43 NetpCheckNetBiosNameNotInUse: for 'WORKGROUP' returned: 0x858                 ¦
08/29 10:41:43 NetpCheckNetBiosNameNotInUse for 'WORKGROUP' [ Workgroup as MACHINE]  returned 0x858¦
08/29 10:41:43 NetpValidateName: name 'WORKGROUP' is valid for type 2                        ¦
08/29 10:41:43 -----------------------------------------------------------------             ¦
08/29 10:41:43 NetpValidateName: checking to see if 'WORKGROUP' is valid as type 2 name      ¦
08/29 10:41:43 NetpCheckNetBiosNameNotInUse: for 'WORKGROUP' returned: 0x858                 ¦
08/29 10:41:43 NetpCheckNetBiosNameNotInUse for 'WORKGROUP' [ Workgroup as MACHINE]  returned 0x858¦
08/29 10:41:43 NetpValidateName: name 'WORKGROUP' is valid for type 2                        ¦
08/29 10:41:43 -----------------------------------------------------------------             ¦
08/29 10:41:43 NetpDoDomainJoin                                                              ¦
08/29 10:41:43 NetpMachineValidToJoin: 'John Doe'                                              ¦
08/29 10:41:43 NetpGetLsaPrimaryDomain: status: 0x0                                          ¦
08/29 10:41:43 NetpMachineValidToJoin: status: 0x0                                           ¦
08/29 10:41:43 NetpJoinWorkgroup: joining computer 'John Doe' to workgroup 'WORKGROUP'         ¦
08/29 10:41:43 NetpValidateName: checking to see if 'WORKGROUP' is valid as type 2 name      ¦
08/29 10:41:43 NetpCheckNetBiosNameNotInUse: for 'WORKGROUP' returned: 0x858                 ¦
08/29 10:41:43 NetpCheckNetBiosNameNotInUse for 'WORKGROUP' [ Workgroup as MACHINE]  returned 0x858¦
08/29 10:41:43 NetpValidateName: name 'WORKGROUP' is valid for type 2                        ¦
08/29 10:41:44 NetpSetLsaPrimaryDomain: for 'WORKGROUP' status: 0x0                          ¦
08/29 10:41:44 NetpControlServices: open service 'NETLOGON' failed: 0x424                    ¦
08/29 10:41:44 NetpJoinWorkgroup: status:  0x0                                               ¦
08/29 10:41:44 NetpDoDomainJoin: status: 0x0                                                 ¦
08/29 10:42:32 -----------------------------------------------------------------             ¦
08/29 10:42:32 NetpValidateName: checking to see if 'John Doe' is valid as type 1 name         ¦
08/29 10:42:32 NetpCheckNetBiosNameNotInUse for 'John Doe' [MACHINE] returned 0x0              ¦
08/29 10:42:32 NetpValidateName: name 'John Doe' is valid for type 1                           ¦
08/29 10:44:22 -----------------------------------------------------------------             ¦
08/29 10:44:22 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:44:22 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:44:22 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:44:22 -----------------------------------------------------------------             ¦
08/29 10:44:22 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:44:22 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:44:22 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:44:22 -----------------------------------------------------------------             ¦
08/29 10:44:22 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:44:22 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:44:22 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:44:22 -----------------------------------------------------------------             ¦
08/29 10:44:22 NetpDoDomainJoin                                                              ¦
08/29 10:44:22 NetpMachineValidToJoin: 'John Doe'                                              ¦
08/29 10:44:22 NetpGetLsaPrimaryDomain: status: 0x0                                          ¦
08/29 10:44:22 NetpMachineValidToJoin: status: 0x0                                           ¦
08/29 10:44:22 NetpJoinDomain                                                                ¦
08/29 10:44:22  Machine: John Doe                                                              ¦
08/29 10:44:22  Domain: My Computer                                                              ¦
08/29 10:44:22  MachineAccountOU: (NULL)                                                     ?
08/29 10:44:22  Account: My computer\John Doe                                                 ?
08/29 10:44:22  Options: 0x40001                                                             ¦
08/29 10:44:22  OS Version: 5.1                                                              ¦
08/29 10:44:22  Build number: xxxx                                                           ¦
08/29 10:44:22 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:44:22 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:44:22 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:44:22 NetpDsGetDcName: trying to find DC in domain 'My Computer', flags: 0x1020         ¦
08/29 10:44:37 NetpDsGetDcName: failed to find a DC having account 'John Doe$': 0x525          ¦
08/29 10:44:37 NetpDsGetDcName: found DC '\\xx-xx-xx' in the specified domain               ¦
08/29 10:44:37 NetpJoinDomain: status of connecting to dc '\\xx-xx-xx': 0x0                 ¦
08/29 10:44:37 NetpGetLsaPrimaryDomain: status: 0x0                                          ¦
08/29 10:44:37 NetpGetDnsHostName: Read NV Hostname: John Doe                                  ¦
08/29 10:44:37 NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain name: My computer¦
08/29 10:44:37 NetpLsaOpenSecret: status: 0xc0000034                                         ¦
08/29 10:44:38 SamLookupNamesInDomain on John Doe$ failed with 0xc0000073                      ¦
08/29 10:44:38 NetpJoinDomain: status of setting machine password: 0x534                     ¦
08/29 10:44:38 NetpJoinDomain: initiaing a rollback due to earlier errors                    ¦
08/29 10:44:38 NetpLsaOpenSecret: status: 0x0                                                ¦
08/29 10:44:39 NetpJoinDomain: rollback: status of deleting secret: 0x0                      ¦
08/29 10:44:39 NetpJoinDomain: status of disconnecting from '\xx-xx-xx': 0x0               ¦
08/29 10:44:39 NetpDoDomainJoin: status: 0x534                                               ¦
08/29 10:44:49 -----------------------------------------------------------------             ¦
08/29 10:44:49 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:44:49 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:44:49 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:44:49 -----------------------------------------------------------------             ¦
08/29 10:44:49 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:44:49 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:44:49 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:44:49 -----------------------------------------------------------------             ¦
08/29 10:44:49 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:44:49 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:44:49 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:44:49 -----------------------------------------------------------------             ¦
08/29 10:44:49 NetpDoDomainJoin                                                              ¦
08/29 10:44:49 NetpMachineValidToJoin: 'John Doe'                                              ¦
08/29 10:44:49 NetpGetLsaPrimaryDomain: status: 0x0                                          ¦
08/29 10:44:49 NetpMachineValidToJoin: status: 0x0                                           ¦
08/29 10:44:49 NetpJoinDomain                                                                ¦
08/29 10:44:49  Machine: John Doe                                                              ¦
08/29 10:44:49  Domain: My Computer                                                              ¦
08/29 10:44:49  MachineAccountOU: (NULL)                                                     ¦
08/29 10:44:49  Account: My Computer\John Doe                                                   ¦
08/29 10:44:49  Options: 0x40001                                                             ¦
08/29 10:44:49  OS Version: 5.1                                                              ¦
08/29 10:44:49  Build number: xxxx                                                           ¦
08/29 10:44:49 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:44:49 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:44:49 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:44:49 NetpDsGetDcName: trying to find DC in domain 'My Computer', flags: 0x1020         ¦
08/29 10:45:04 NetpDsGetDcName: failed to find a DC having account 'John Doe$': 0x525          ¦
08/29 10:45:04 NetpDsGetDcName: found DC '\\xx-xx-xx' in the specified domain               ¦
08/29 10:45:04 NetpJoinDomain: status of connecting to dc '\\xx-xx-xx': 0x0                 ?
08/29 10:45:04 NetpGetLsaPrimaryDomain: status: 0x0                                          ?
08/29 10:45:04 NetpGetDnsHostName: Read NV Hostname: John Doe                                  ¦
08/29 10:45:04 NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain name: My Computer¦
08/29 10:45:04 NetpLsaOpenSecret: status: 0xc0000034                                         ¦
08/29 10:45:05 SamLookupNamesInDomain on John Doe$ failed with 0xc0000073                      ¦
08/29 10:45:05 NetpJoinDomain: status of setting machine password: xxxx                     ¦
08/29 10:45:05 NetpJoinDomain: initiaing a rollback due to earlier errors                    ¦
08/29 10:45:05 NetpLsaOpenSecret: status: 0x0                                                ¦
08/29 10:45:05 NetpJoinDomain: rollback: status of deleting secret: 0x0                      ¦
08/29 10:45:05 NetpJoinDomain: status of disconnecting from '\\xx-xx-xx': 0x0               ¦
08/29 10:45:05 NetpDoDomainJoin: status: 0x534                                               ¦
08/29 10:45:15 -----------------------------------------------------------------             ¦
08/29 10:45:15 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:45:15 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:45:15 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:45:15 -----------------------------------------------------------------             ¦
08/29 10:45:15 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:45:15 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:45:15 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:45:15 -----------------------------------------------------------------             ¦
08/29 10:45:15 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:45:15 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:45:15 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:45:15 -----------------------------------------------------------------             ¦
08/29 10:45:15 NetpDoDomainJoin                                                              ¦
08/29 10:45:15 NetpMachineValidToJoin: 'John Doe'                                              ¦
08/29 10:45:15 NetpGetLsaPrimaryDomain: status: 0x0                                          ¦
08/29 10:45:15 NetpMachineValidToJoin: status: 0x0                                           ¦
08/29 10:45:15 NetpJoinDomain                                                                ¦
08/29 10:45:15  Machine: John Doe                                                              ¦
08/29 10:45:15  Domain: My Computer                                                              ¦
08/29 10:45:15  MachineAccountOU: (NULL)                                                     ¦
08/29 10:45:15  Account: My Computer\John Doe                                                   ¦
08/29 10:45:15  Options: 0x40001                                                             ¦
08/29 10:45:15  OS Version: 5.1                                                              ¦
08/29 10:45:15  Build number: xxxx                                                           ¦
08/29 10:45:15 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:45:15 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:45:15 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:45:15 NetpDsGetDcName: trying to find DC in domain 'My Computer', flags: 0x1020         ¦
08/29 10:45:30 NetpDsGetDcName: failed to find a DC having account 'John Doe$': 0x525          ¦
08/29 10:45:30 NetpDsGetDcName: found DC '\\xx-xx-xx' in the specified domain               ¦
08/29 10:45:30 NetpJoinDomain: status of connecting to dc '\\xx-xx-xx': 0x0                 ¦
08/29 10:45:30 NetpGetLsaPrimaryDomain: status: 0x0                                          ¦
08/29 10:45:30 NetpGetDnsHostName: Read NV Hostname: John Doe                                 ¦
08/29 10:45:30 NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain name: xxxxxxxxxxx¦
08/29 10:45:30 NetpLsaOpenSecret: status: 0xc0000034                                         ¦
08/29 10:45:31 SamLookupNamesInDomain on John Doe$ failed with 0xc0000073                      ¦
08/29 10:45:31 NetpJoinDomain: status of setting machine password: xxxx                    ¦
08/29 10:45:31 NetpJoinDomain: initialing a rollback due to earlier errors                    ¦
08/29 10:45:31 NetpLsaOpenSecret: status: 0x0                                                ¦
08/29 10:45:31 NetpJoinDomain: rollback: status of deleting secret: 0x0                      ¦
08/29 10:45:31 NetpJoinDomain: status of disconnecting from '\\xx-xx-xx': 0x0               ¦
08/29 10:45:31 NetpDoDomainJoin: status: 0x534                                               ?
08/29 10:45:41 -----------------------------------------------------------------             ?
08/29 10:45:41 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:45:41 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:45:41 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:45:41 -----------------------------------------------------------------             ¦
08/29 10:45:41 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:45:41 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:45:41 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:45:41 -----------------------------------------------------------------             ¦
08/29 10:45:41 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:45:41 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:45:41 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:45:41 -----------------------------------------------------------------             ¦
08/29 10:45:41 NetpDoDomainJoin                                                              ¦
08/29 10:45:41 NetpMachineValidToJoin: 'John Doe'                                              ¦
08/29 10:45:41 NetpGetLsaPrimaryDomain: status: 0x0                                          ¦
08/29 10:45:41 NetpMachineValidToJoin: status: 0x0                                           ¦
08/29 10:45:41 NetpJoinDomain                                                                ¦
08/29 10:45:41  Machine: John Doe                                                             ¦
08/29 10:45:41  Domain: My Computer                                                              ¦
08/29 10:45:41  MachineAccountOU: (NULL)                                                     ¦
08/29 10:45:41  Account: My Computer\John Doe                                                  ¦
08/29 10:45:41  Options: 0x40003                                                             ¦
08/29 10:45:41  OS Version: 5.1                                                              ¦
08/29 10:45:41  Build number: xxxx                                                         ¦
08/29 10:45:41 NetpValidateName: checking to see if 'My Computer' is valid as type 3 name        ¦
08/29 10:45:41 NetpCheckDomainNameIsValid [ Exists ] for 'My Computer' returned 0x0              ¦
08/29 10:45:41 NetpValidateName: name 'My Computer' is valid for type 3                          ¦
08/29 10:45:41 NetpDsGetDcName: trying to find DC in domain 'My Computer', flags: 0x1020         ¦
08/29 10:45:56 NetpDsGetDcName: failed to find a DC having account 'John Doe$': 0x525          ¦
08/29 10:45:56 NetpDsGetDcName: found DC '\\xx-xx-xx' in the specified domain               ¦
08/29 10:45:57 NetpJoinDomain: status of connecting to dc '\\xx-xx-xx': 0x0                 ¦
08/29 10:45:57 NetpGetLsaPrimaryDomain: status: 0x0                                          ¦
08/29 10:45:57 NetpGetDnsHostName: Read NV Hostname: John Doe                                  ¦
08/29 10:45:57 NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain name: xxxxxxxxxxxx¦
08/29 10:45:57 NetpLsaOpenSecret: status: 0xc0000034                                         ¦
08/29 10:45:57 NetpJoinDomain: status of creating account: 0x0                               ¦
08/29 10:45:57 NetpGetComputerObjectDn: Cracking account name My Computer\John Doe$ on \\xx-xx-xx ¦
08/29 10:45:57 NetpGetComputerObjectDn: Crack results:  (Account already exists) DN = CN=xxxx¦
08/29 10:45:57 NetpModifyComputerObjectInDs: Initial attribute values:                       ¦
08/29 10:45:57          DnsHostName  =  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx                    ¦
08/29 10:45:57          ServicePrincipalName  =  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
08/29 10:45:57 NetpModifyComputerObjectInDs: Computer Object already exists in OU:           ¦
08/29 10:45:57          DnsHostName  =                                                       ¦
08/29 10:45:57          ServicePrincipalName  =                                              ¦
08/29 10:45:57 NetpModifyComputerObjectInDs: Attribute values to set:                        ¦
08/29 10:45:57          DnsHostName  =  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx                    ¦
08/29 10:45:57          ServicePrincipalName  =  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx¦
08/29 10:45:57 ldap_unbind status: 0x0                                                       ¦
08/29 10:45:57 NetpJoinDomain: status of setting DnsHostName and SPN: 0x0                    ¦
08/29 10:45:57 NetpGetLsaPrimaryDomain: status: 0x0                                          ¦
08/29 10:45:58 NetpSetLsaPrimaryDomain: for 'My Computer' status: 0x0                            ¦
08/29 10:45:58 NetpJoinDomain: status of setting LSA pri. domain: 0x0                        ¦
08/29 10:45:58 NetpJoinDomain: status of managing local groups: 0x0                          ?
08/29 10:45:58 NetpJoinDomain: status of setting netlogon cache: 0x0                         ¦
08/29 10:45:58 NetpJoinDomain: status of setting ComputerNamePhysicalDnsDomain to 'xxxxxxxxxxxxx¦
08/29 10:45:59 NetpUpdateW32timeConfig: 0x0                                                  ¦
08/29 10:45:59 NetpJoinDomain: status of disconnecting from '\\xx-xx-xx: 0x0               ¦
08/29 10:45:59 NetpDoDomainJoin: status: 0x0                                                 ?


List Remarks

Using List Scenarios

List allows you to do the following:

  • Open several files at the same time, copy the elements from each that you want, and paste them into a new file. Since you can jump directly to the portion of the file that you are interested in copying, and since the entire file is not loaded, you can open a number of files without taxing system performance.
  • Edit files in hexadecimal mode.

Understanding Keyboard Command References

Use the following commands in the List interface:

Keyboard Command | Description
Up, Down | Move one line up or down.
Left, Right | Move one character left or right.
PageUp | Move up one page.
PageDown | Move down one page.
Home | Move to top of listing.
End | Move to end of listing.
W | Toggle word wrap.
Ctrl+L | Refresh display.
Q, Esc | Quit
/ | Search for string.
\ | Search for string, any case.
F4 | Toggle multifile search.
n, F3 | Find next occurrence of string; "n" must be lowercase.
N | Find previous occurrences of string; "N" must be uppercase.
C | Clear highlighted line.
J | Jump to highlighted line.
M | Mark line highlighted.
Ctrl+Up | Pull up copy buffer.
Ctrl+Down | Pull down copy buffer.
Ctrl+Home | Slide up copy buffer.
Ctrl+End | Slide down copy buffer.
G | Go to line number.
Ctrl+PageUp | Move to previous file.
Ctrl+PageDown | Move to next file.
F | Create new file.
H | Toggle to Hexadecimal edit and display mode; Esc to exit
F1 | Display keyboard reference commands.

Understanding Additional Hexadecimal Keyboard Commands

The following additional commands are available in Hexadecimal Mode:

Keyboard Command | Description
F1 | Toggle view between 16-column, 8-column, and 4-column display.
F2 | Go to
F3 | Search
F4 | Export
F5 | Import
F10 | Undo
Esc | Exit Hexadecimal Mode.


List Syntax

List uses the following syntax:

One Step list [/s:SearchString] [/g:LineNumber] FileName[, FileName, ...]

Parameters

/s:SearchString
Specifies the string to search for after opening the file.
/g:LineNumber
Specifies the line to go to after opening the file.
FileName
Specifies the name of the file or files to open and display. Use Ctrl+PageUp and Ctrl+PageDown to toggle between open files.


LogTime Examples

Example: Use LogTime in Batch File

When you want to write the time and a message to a log file, create a batch file similar to the following sample:

 logtime "start time for installation program"
 install.exe
 logtime "end time for installation program"

When you run the batch file, it creates a Logtime.log text file with the following output:

08/01/02  15:10:05  start time for installation program
08/01/02  15:20:17  end time for installation program


LogTime Remarks

Understanding Run Time

Understanding the run time of a program or process can be valuable in planning system maintenance activities. If you need to update the corporate directory information through an automated import procedure, but have a policy to do that within a given time window, you need to understand how long that process might take. The number and types of changes that you introduce affect the amount of time required. You can use LogTime to calculate the run time of an executable program by reviewing the log and subtracting the start time from the end time. This can be useful in a lab environment prior to a production run or it can be useful to gauge the increase and/or decrease in executable run time as your input file changes.

It is also useful to know that an automated process has completed and, if so, what time it completed. For example, using a terminal session, a remote system manager can monitor the LogTime.Log file for successful completion of an executable process that is used in a remote troubleshooting or system maintenance scenario.


LogTime Syntax

LogTime uses the following syntax:

One Step logtime [TextString] [/?]

Parameters

TextString
Specifies the message to display.
/?
Displays command-line usage.


LsReport Examples

Example 1: Query All Available License Servers for Information About All Types of Currently Valid Licenses

The task in this example is to query all available license servers for currently valid licenses. After obtaining the data, LsReport creates Lsout2.txt, a log file in the root directory of drive C. This log file contains information about currently valid licenses. Saving license information to a new file allows you to save the current license information without overwriting any pre-existing data. If you run LsReport on a regular basis, you can create a history of license use by creating a new file each time you run LsReport.

To run this query, type the following at the command line:

lsreport /f c:\lsout2.txt

Press ENTER. A log file named Lsout2.txt is created in the root directory of the C: drive. The log file contains the following data:

Server			License ID	Keypack ID	Client	User	  	Start	 	End		Issue Type	License Type
contoso-NTLS-1.com 	201		3		BDiaz	BrendaDiaz	10/15/2002	1/12/2003	Temporary 	A02-5.02-S Windows Server 2003 Per Device
contoso-NTLS-2.com	878		2 		TAdams	TerryAdams	5/15/2002	No Expiration	Active		A02-5.00-S Existing Windows 2000 Server - Terminal Services CAL Token (per device)
contoso-NTLS-2.com	1234		2		DBarber	DaveBarber	2/15/2002	No Expiration	Active 		A02-5.00-EX Existing Windows 2000 License

Example 2: Query Specified License Servers for Information about Temporary Licenses

The task in this example is to query the specified license servers, NTLS-1 and NTLS-2, for information on temporary licenses only. After obtaining the data, LsReport creates a log file containing this information, using the default file name Lsreport.txt in the working directory, which is in the default location.

To run this query, type the following at the command line:

lsreport /t NTLS-1 NTLS-2

Press ENTER. A log file named Lsreport.txt is created in the working directory. The log file contains the following data:

Server			License ID	Keypack ID	Client	User	  	Start	 	End		Issue Type	License Type
contoso-NTLS-1.com 	201		3		BDiaz	BrendaDiaz	10/15/2002	1/12/2003	Temporary 	A02-5.02-S Windows Server 2003 Per Device

Example 3: Query All Available License Servers for License Types Valid During a Specified Period

The task in this example is to query all available license servers for information on all types of licenses that were valid during the interval between January 1, 2002 and March 1, 2002. After obtaining the data, LsReport creates a log file in the root directory. The log file contains the information about the valid licenses, using the specified file name LsoutFirstQuarter2002.txt in the specified location. Saving license information based on a date range is another way to create reports about license use. The date range option allows you to run LsReport once to gather license information over a period of time, rather than running LsReport multiple times and saving the data in separate files.

To run this query, type the following at the command line:

lsreport /f c:\lsoutFirstQuarter2002.txt /d 01/01/2002 03/01/2002

Press ENTER. A log file named LsoutFirstQuarter2002.txt is created in the working directory. The log file contains the following data:

Server			License ID	Keypack ID	Client	User	  	Start	 	End		Issue Type	License Type
contoso-NTLS-2.com	1234		2		DBarber	DaveBarber	2/15/2002	No Expiration	Active 		A02-5.00-EX Existing Windows 2000 License

Note

  • Each time you run LsReport, it saves the most current data to Lsreport.txt, the default file in the working directory. Unless you specify another file name and location, the most current data is saved in the default file, and any pre-existing data is overwritten. To prevent overwriting data in previous log files, you must run LsReport with the option to save the information to a file with a different name.


LsReport Remarks

Creating LsReport Reports

You can use LsReport to create the following tab-delimited reports:

Type | Information Included | Comments
Default
  • Server
  • License ID
  • Keypack ID
  • Client
  • User
  • Start
  • End
  • Issue Type
  • License Type

The default information is provided for all currently valid licenses, including active and temporary licenses.
Date Sensitive | Writes, to the output file, all default information, but only for those licenses that are valid between the start and end dates. | A valid license includes both active and temporary licenses.
Temporary Licenses | Lists all default information, but only for temporary licenses. | This is useful for tracking temporary licenses and their expiration dates.
Server Specific | Lists all default information, but only for the specified servers. | This is useful for creating reports on license usage in specific domains.

Using LsReport to Create a History of License Usage

Each time you run LsReport, it saves the most current data to Lsreport.txt,the default file in the working directory. Unless you specify another file name and location, the most current data is saved in the default file, and any pre-existing data is overwritten. If you want to record license information on a monthly basis, for example, you should run LsReport with the option to save the information to a file with a different name. If you want to record license information over a different period of time, you can also use the option to specify a date range.

For examples that create these reports, see LsReport Examples.


LsReport Syntax

LsReport uses the following general syntax:

One Step lsreport [/f [Path]FileName] [/d Start [End]] [/t] [ServerList] [/?]

Parameters

/f [Path]FileName
Allows an alternate file name (and optional path) to be specified for the log file. If an output file by the same name exists, it is overwritten. By default, LsReport writes all data to Lsreport.txt, a file in the working directory.
/d Start [End]
Writes, to the output file, only licenses considered to be valid between the start and end dates. If the end date is not specified, it defaults to the current date. Use the following format for specifying a date: mm/dd/yyyy.
/t
Restricts the report to temporary licenses. By default, LsReport reports on all licenses, temporary or otherwise.
/w
Writes, to the output file, the hardware identification of a licensed client if the license server is running Windows Server 2003. If the license server is running Windows 2000, LsReport does not write hardware information to the output file and does not display an error message.
ServerList
Lists Terminal Services license servers to be queried, separating the entries with spaces. If no list is specified, a list is obtained from the domain controller and all discoverable domain and enterprise Terminal Services license servers are queried. Use this option only to query specific servers.
/?
Displays command-line usage.


LsView Examples

Overview | Remarks | UI | Examples | Related Tools Run Tool

Check Availability of Terminal Services License Servers in the //cohowinery Domain

The task in this example is to use LSView to check the availability of Terminal Services license servers in the //cohowinery domain.

To run LSView, type the following at the command line:

lsview

Press ENTER. This open the License Server Viewer window. When the traffic light icon turns green, the window is populated with information about all available license servers in the current domain. The same information is also written to a log file.

COHO-DC-06	Thursday, October 17, 2002 3:31 PM	Enterprise
COHO-TSLS-01	Thursday, October 17, 2002 3:31 PM	Enterprise


LsView Remarks

Overview | Remarks | UI | Examples | Related Tools Run Tool

Using LsView

You can run LsView from the command line or by double-clicking LsView.exe in Windows Explorer. After LsView starts, it runs a terminal server discovery process to acquire a list of Terminal Services license servers in the current domain. By default, LsView updates this list every five minutes.

You can change the default polling interval when you create a log file. See step 6 in the following "To create a log file" procedure.

To create a log file:

  1. Start LsView.
  2. Wait for LsView to finish polling for license servers. The traffic light icon in the status area changes from yellow to green when polling is complete.
  3. In the License Server Viewer dialog box, click File, and then click Create Log File.
  4. In the Save As window, in the File name box, type a name for the LsView log file and, in the Save as type drop-down box, select Log files, if it is not already selected.
  5. Create one of the following files:
    • A basic log file, by clearing the Log Diagnostic Information check box.
    • A diagnostic log file, by checking the Log Diagnostic Information check box.
  6. To automatically save changes to the log file whenever LSView updates the server list, check Use the file for automatic log.
  7. To change the frequency with which LsView updates the server list and the log file, in the Search for license server interval (in minutes) box, select or type a number for the new polling interval.
  8. To create the log file, click Save.


LsView UI

Overview | Remarks | UI | Examples | Related Tools Run Tool

Displaying the Results

You can access the list of license servers found by LsView in three ways. You can:
  • Monitor the server status in the License Server Viewer window
  • Double-click the traffic light icon to open the License Server Viewer window
  • Open a log file to view the latest polling results

The License Server Viewer Window

When you start LsView, the License Server Viewer window opens. If you minimize this window, you can open it again by double-clicking the traffic light icon. The License Server Viewer window contains one pane with three columns that display the polling results. You can sort the polling results by name, time, or type by clicking the corresponding column heading.

File menu

Two file menu options are available:

Option | Description
Create Log File

Opens a dialog box to create a basic or diagnostic log file with a specific name, and saves the file in a specific location. LsView creates the following types of log files:

  • A basic log file that records the most recent polling results displayed in the License Server Viewer window. In the log file, each available server name is listed, followed by the last date and time available, and the type of server.
  • A diagnostic log file that records information about the discovery process. You can use it for troubleshooting. The diagnostic log file lists data such as the type of discovery, (Enterprise, Domain, or Registry-bypass), the remote calls made on the server, and their return values.

Choose the type of log file you want to create in the Create Log File dialog box. If you check Log Diagnostic Information, LsView creates a diagnostic log file. If you clear the Log Diagnostic Information check box, LsView creates a basic log file. For either type of log file, you can specify whether or not you want updates saved automatically to the log file, and how often you want LsView to update the information.
Exit | Closes the License Server Viewer window, removes the traffic light icon from the status area of your Start bar, and stops polling for servers.

Help menu

The following Help menu option is available:

Option | Description
About License Server Viewer | Opens a dialog box that displays the current version of the operating system and LsView. You can also view copyright information, the End End License Agreement, and check to see the name of the individual to whom LsView is licensed. The bottom of the dialog box displays the current amount of physical memory available to Windows for troubleshooting purposes.

The Traffic Light Icon

When you start LsView, a traffic light icon is added to the status area of your Start bar. You can monitor the polling status of LsView from the traffic light icon.

Discover the Current State of LSView Polling

Allow your cursor to hover over the traffic icon. This action displays the current state of LsView polling.
  • If LsView is currently polling, the traffic icon displays a yellow light and a status of Querying license servers.
  • If LsView is waiting for the next polling interval to occur, it displays a green light and a status of Preparing to poll for servers.

Use the Color of the Traffic Light to Get Quick Indication of Polling Status

The table below shows the meaning of each traffic light color.

Color | Meaning
Green | LsView is running and waiting for the next polling interval.
Yellow | LsView is busy polling for available license servers.
Red | LsView has encountered errors and is unable to poll for license server availability.

The Log File

You can save an LsView log file in any location. The default location is in My Documents. The basic log file records each available server name, followed by the last date and time available, and the type of server. The diagnostic log file records data such as the type of discovery, (Enterprise, Domain, or Registry-bypass), and the remote calls made on the server and their return values.

Note

  • This log file does not contain a history of polling results; it only contains the most recent results.


Mcast Examples

Example 1: Send Multicast Packets

The task in this example is to send 10 multicast packets from a computer with an IP address of 172.31.253.55 to the group address 230.1.1.1 with a 1,000 millisecond interval between packets. Type the following at the command line:

mcast /send /srcs:172.31.253.55 /grps:230.1.1.1 /intvl:1000 /numpkts:10

Press ENTER. Mcast begins a packet count with the following:

Send Packet -

A counter after the dash "-" keeps track of the number of packets sent. After the test is complete, the packet count for this example displays the following:

Send Packet - 10

Example 2: Receive Multicast Packets

The task in this example is to listen for multicast packets on the group address 230.1.1.1 for 1 minute. Type the following on the command line:

mcast /recv /grps:230.1.1.1 /runtime:1

Press ENTER. The following response is displayed:

Started.. Waiting to receive packets..
Received [1]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Received [2]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Received [3]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Received [4]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Received [5]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Test ran for the specified time - 1 Minutes

Example 3: Receive Multicast Packets and Display Packet Information

The tasks in this example are to listen for multicast packets on the group address 230.1.1.1 and to display the contents of each packet. Since no time limit is placed on Mcast, a CTRL+BREAK key sequence is used to stop the operation. A packet summary is displayed before Mcast quits.

Type the following on the command line:

mcast /recv /grps:230.1.1.1 /dump:3

Press ENTER. Results similar to the following are displayed:

Started.... Waiting to receive packets...
Received [1]: [GOOD] SRC- 10.193.36.210 GRP- 230.1.1.1    TTL- 5 Len- 256
00000000    FF FF FF FF FF FF FF FF 01 02 03 04 05 06 07 08 |................|
00000010    09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 |................|
00000020    19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 |....... !"#$&'(|
00000030    29 2A 2B 2C 2D 2E 2F 30 31 32 33 34 35 36 37 38 |)*+,-./012345678|
00000040    39 3A 3B 3C 3D 3E 3F 40 41 42 43 44 45 46 47 48 |9:;<=>?@ABCDEFGH|
00000050    49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 |IJKLMNOPQRSTUVWX|
00000060    59 5A 5B 5C 5D 5E 5F 60 61 62 63 64 65 66 67 68 |YZ[\]^_`abcdefgh|
00000070    69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 |ijklmnopqrstuvwx|
00000080    79 7A 7B 7C 7D 7E 7F 80 81 82 83 84 85 86 87 88 |yz{|}~¦.........|
00000090    89 8A 8B 8C 8D 8E 8F 90 91 92 93 94 95 96 97 98 |................|
000000A0    99 9A 9B 9C 9D 9E 9F A0 A1 A2 A3 A4 A5 A6 A7 A8 |................|
000000B0    A9 AA AB AC AD AE AF B0 B1 B2 B3 B4 B5 B6 B7 B8 |................|
000000C0    B9 BA BB BC BD BE BF C0 C1 C2 C3 C4 C5 C6 C7 C8 |................|
000000D0    C9 CA CB CC CD CE CF D0 D1 D2 D3 D4 D5 D6 D7 D8 |................|
000000E0    D9 DA DB DC DD DE DF E0 E1 E2 E3 E4 E5 E6 E7 E8 |................|
000000F0    E9 EA EB EC ED EE EF F0 F1 F2 F3 F4 F5 F6 F7 F8 |................|

Received [2]: [GOOD] SRC- 10.193.36.210 GRP- 230.1.1.1    TTL- 5 Len- 256
00000000    FF FF FF FF FF FF FF FF 01 02 03 04 05 06 07 08 |................|
00000010    09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 |................|
00000020    19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 |....... !"#$&'(|
00000030    29 2A 2B 2C 2D 2E 2F 30 31 32 33 34 35 36 37 38 |)*+,-./012345678|
00000040    39 3A 3B 3C 3D 3E 3F 40 41 42 43 44 45 46 47 48 |9:;<=>?@ABCDEFGH|
00000050    49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 |IJKLMNOPQRSTUVWX|
00000060    59 5A 5B 5C 5D 5E 5F 60 61 62 63 64 65 66 67 68 |YZ[\]^_`abcdefgh|
00000070    69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 |ijklmnopqrstuvwx|
00000080    79 7A 7B 7C 7D 7E 7F 80 81 82 83 84 85 86 87 88 |yz{|}~¦.........|
00000090    89 8A 8B 8C 8D 8E 8F 90 91 92 93 94 95 96 97 98 |................|
000000A0    99 9A 9B 9C 9D 9E 9F A0 A1 A2 A3 A4 A5 A6 A7 A8 |................|
000000B0    A9 AA AB AC AD AE AF B0 B1 B2 B3 B4 B5 B6 B7 B8 |................|
000000C0    B9 BA BB BC BD BE BF C0 C1 C2 C3 C4 C5 C6 C7 C8 |................|
000000D0    C9 CA CB CC CD CE CF D0 D1 D2 D3 D4 D5 D6 D7 D8 |................|
000000E0    D9 DA DB DC DD DE DF E0 E1 E2 E3 E4 E5 E6 E7 E8 |................|
000000F0    E9 EA EB EC ED EE EF F0 F1 F2 F3 F4 F5 F6 F7 F8 |................|

Received [3]: [GOOD] SRC- 10.193.36.210 GRP- 230.1.1.1    TTL- 5 Len- 256
00000000    FF FF FF FF FF FF FF FF 01 02 03 04 05 06 07 08 |................|
00000010    09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 |................|
00000020    19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 |....... !"#$&'(|
00000030    29 2A 2B 2C 2D 2E 2F 30 31 32 33 34 35 36 37 38 |)*+,-./012345678|
00000040    39 3A 3B 3C 3D 3E 3F 40 41 42 43 44 45 46 47 48 |9:;<=>?@ABCDEFGH|
00000050    49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 |IJKLMNOPQRSTUVWX|
00000060    59 5A 5B 5C 5D 5E 5F 60 61 62 63 64 65 66 67 68 |YZ[\]^_`abcdefgh|
00000070    69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 |ijklmnopqrstuvwx|
00000080    79 7A 7B 7C 7D 7E 7F 80 81 82 83 84 85 86 87 88 |yz{|}~¦.........|
00000090    89 8A 8B 8C 8D 8E 8F 90 91 92 93 94 95 96 97 98 |................|
000000A0    99 9A 9B 9C 9D 9E 9F A0 A1 A2 A3 A4 A5 A6 A7 A8 |................|
000000B0    A9 AA AB AC AD AE AF B0 B1 B2 B3 B4 B5 B6 B7 B8 |................|
000000C0    B9 BA BB BC BD BE BF C0 C1 C2 C3 C4 C5 C6 C7 C8 |................|
000000D0    C9 CA CB CC CD CE CF D0 D1 D2 D3 D4 D5 D6 D7 D8 |................|
000000E0    D9 DA DB DC DD DE DF E0 E1 E2 E3 E4 E5 E6 E7 E8 |................|
000000F0    E9 EA EB EC ED EE EF F0 F1 F2 F3 F4 F5 F6 F7 F8 |................|

Received [4]: [GOOD] SRC- 10.193.36.210 GRP- 230.1.1.1    TTL- 5 Len- 256
00000000    FF FF FF FF FF FF FF FF 01 02 03 04 05 06 07 08 |................|
00000010    09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 |................|
00000020    19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 |....... !"#$&'(|
00000030    29 2A 2B 2C 2D 2E 2F 30 31 32 33 34 35 36 37 38 |)*+,-./012345678|
00000040    39 3A 3B 3C 3D 3E 3F 40 41 42 43 44 45 46 47 48 |9:;<=>?@ABCDEFGH|
00000050    49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 |IJKLMNOPQRSTUVWX|
00000060    59 5A 5B 5C 5D 5E 5F 60 61 62 63 64 65 66 67 68 |YZ[\]^_`abcdefgh|
00000070    69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 |ijklmnopqrstuvwx|
00000080    79 7A 7B 7C 7D 7E 7F 80 81 82 83 84 85 86 87 88 |yz{|}~¦.........|
00000090    89 8A 8B 8C 8D 8E 8F 90 91 92 93 94 95 96 97 98 |................|
000000A0    99 9A 9B 9C 9D 9E 9F A0 A1 A2 A3 A4 A5 A6 A7 A8 |................|
000000B0    A9 AA AB AC AD AE AF B0 B1 B2 B3 B4 B5 B6 B7 B8 |................|
000000C0    B9 BA BB BC BD BE BF C0 C1 C2 C3 C4 C5 C6 C7 C8 |................|
000000D0    C9 CA CB CC CD CE CF D0 D1 D2 D3 D4 D5 D6 D7 D8 |................|
000000E0    D9 DA DB DC DD DE DF E0 E1 E2 E3 E4 E5 E6 E7 E8 |................|
000000F0    E9 EA EB EC ED EE EF F0 F1 F2 F3 F4 F5 F6 F7 F8 |................|

Number of Packets Received = 4 Corrupt Packets = 0
^C


Mcast Remarks

Mcast Cannot Be Used Remotely

When specifying IP addresses with the /srcs and /intf parameters, only IP addresses from local network adapters can be used. Mcast does not work remotely.

Specifying Alternate IP Addresses

Any IP address may be specified with the /srcs parameter. Since Mcast does not work remotely, it sends packets from the local computer, even when the IP address of a different or a nonexistent computer is listed in the /srcs parameter. If the IP address in the /srcs is from the local computer, Mcast sends the packets from the interface that has the specified IP address assigned to it. If no local IP address is specified by the /srcs parameter, and more than one network adapter is present on the local computer, the /intf parameter can be used to specify the adapter that Mcast should use.


Mcast Syntax

Mcast uses the following syntax:

One Step mcast /send /srcs:SourceAddress /grps:GroupAddress [/intvl:[PacketInterval]] [/numpkts:[NumberPackets]] [/ttl:[TimeToLive]] [/pktsize:[PacketSize]] [/intf:[InterfaceAddress]]

One Step mcast /recv /grps:GroupAddress [/dump:[packettype]] [/runtime:[Duration]] [/intf:[InterfaceAddress]]

Parameters

/send
Sends packets out on the network.
/srcs:SourceAddress
Specifies the address(es) that are listed as the source in the sent multicast packets; this is a mandatory argument for the /send operation. Separate multiple source IP addresses with a comma.
/grps:GroupAddress
Specifies the multicast group address to which packets should be sent or from which packets should be received; this is a mandatory argument for both the /send and /recv operations.
/intvl:[PacketInterval]
Specifies the interval between sent packets, in milliseconds. If omitted, the default setting is 10.
/numpkts:[NumberPackets]
Specifies the number of packets to be sent from each source address provided to each group address provided. If omitted, the default setting is 100.
/ttl:[TimeToLive]
Specifies the time-to-live value of sent packets. If omitted, the default setting is 5.
/pktsize:[PacketSize]
Specifies the size of sent packets in bytes. If omitted, the default setting is 256.
/intf:[IPAddress]
Specifies the local interface to use for the Mcast tests. By default, Mcast uses the local adapter that is assigned the IP address specified in the Mcast packets.
/recv
Listens for multicast packets.
/dump:[packettype]
Displays the contents of received packets. Packettype specifies which packet types to display. Valid packet types are:
Value | Description
1 | bad packets
2 | good packets
3 | all packets
If /dump: is omitted, the contents of the packet do not display.
/runtime:[Duration]
Specifies, in minutes, the duration for which Mcast should run. If omitted, Mcast continues to run until manually stopped.

Note

  • To stop a send operation before all packets are sent, or to manually stop a receive operation, use the CTRL+BREAK key sequence.


MemMonitor Examples

Example 1: Gather a Baseline of Memory Usage

The task in this example is to show memory statistics for a process. MemMonitor gathers a baseline of information about a process that is suspected of using too much memory. In this example, Notepad is monitored with readings of memory usage taken every 30 seconds. Type the following at the command line:

memmonitor /pn notepad.exe /nodbg /int 30

Press ENTER. Output similar to the following is displayed:

Monitor process 3948  (Name: notepad.exe)
MemMon - 0:00:00
    PageFaults       :  724
    PeakWSSize       : 2832K     WorkingSetSize: 2832K
    PeakPagedPool    :   32K     PagedPool     :   28K
    PeakNonPagedPool :    2K     NonPagedPool  :    2K
    PeakPagefile     :  776K     Pagefile      :  772K
MemMon - 0:00:30
    PageFaults       :  730
    PeakWSSize       : 2856K     WorkingSetSize: 2856K
    PeakPagedPool    :   32K     PagedPool     :   28K
    PeakNonPagedPool :    2K     NonPagedPool  :    2K
    PeakPagefile     :  776K     Pagefile      :  772K
MemMon - 0:01:00
    PageFaults       :  757
    PeakWSSize       : 2864K     WorkingSetSize: 2332K
    PeakPagedPool    :   32K     PagedPool     :   28K
    PeakNonPagedPool :    2K     NonPagedPool  :    2K
    PeakPagefile     :  816K     Pagefile      :  816K
MemMon - 0:01:30
    PageFaults       :  762
    PeakWSSize       : 2864K     WorkingSetSize: 2344K
    PeakPagedPool    :   32K     PagedPool     :   28K
    PeakNonPagedPool :    2K     NonPagedPool  :    2K
    PeakPagefile     :  816K     Pagefile      :  816K
MemMon - 0:01:34^C

MemMonitor begins monitoring Notepad and keeps a running timer for the duration of the monitoring process. Press CTRL+C to stop MemMonitor.

Example 2: Debug the Memory Usage of a Process

The task in this example is to show MemMonitor reaching a threshold and beginning the debugging of a process. In this example, a program named Application is monitored with readings of memory usage taken at the default interval of 60 seconds. A threshold of 1,000 KB of virtual memory is set for the Application process. Once the process uses this much virtual memory, MemMonitor stops monitoring and begins debugging. Type the following at the command line:

memmonitor /pn application.exe -int 10 /VM 1000

Press ENTER. Output similar to the following is displayed:

Monitor process 2304 (Name: application.exe)
MemMon - 0:00:00
    PageFaults       :  501
    PeakWSSize       : 1868K     WorkingSetSize: 1856K
    PeakPagedPool    :   32K     PagedPool     :   25K
    PeakNonPagedPool :    2K     NonPagedPool  :    1K
    PeakPagefile     :  548K     Pagefile      : 508K
MemMon - 0:00:30
    PageFaults       :  504
    PeakWSSize       : 1868K     WorkingSetSize: 1868K
    PeakPagedPool    :   32K     PagedPool     :   25K
    PeakNonPagedPool :    2K     NonPagedPool  :    1K
    PeakPagefile     :  548K     Pagefile      : 	508K
MemMon - 0:00:40
    PageFaults       :  3536
    PeakWSSize       : 5300K     WorkingSetSize:  5052K
    PeakPagedPool    :   42K     PagedPool     :   34K
    PeakNonPagedPool :    3K     NonPagedPool  :    3K
    PeakPagefile     : 1360K     Pagefile      :  1356K

Process application.exe VM Usage (1360) is larger than expected
(1000)

Breaking process into the debugger ....
MemMon - 0:51:00
. . . . . . . .^C

MemMonitor begins monitoring a process named Application and keeps a running timer for the duration of the monitoring process. After three minutes, the threshold is reached and MemMonitor begins debugging the Application process.


MemMonitor Remarks

Interpreting MemMonitor Output

MemMonitor displays information on a specified process. The following counters are displayed in MemMonitor output:

Counter | Description
PageFaults | The number of times data was retrieved from the disk for this process because it could not be found in memory.
PeakWSSize | The maximum amount of memory used by this process.
PeakPagedPool | The maximum amount of pageable memory used by this process.
PeakNonPagedPool | The maximum of nonpageable memory used by this process.
PeakPagefile | The maximum amount of page file memory used by this process.
WorkingSetSize | The amount of memory allocated to this process by the operating system.
PagedPool | The amount of memory allocated to this process that is allowed to be paged to the hard disk.
NonPagedPool | The amount of memory allocated to this process that is not allowed to be paged.
Pagefile | The size of the file on the hard disk to which memory may be paged.

Terminating MemMonitor

MemMonitor runs continuously until it is terminated. Press CTRL+C or close the command window to terminate MemMonitor.


MemMonitor Syntax

MemMonitor uses the following syntax:

One Step memmonitor {/p ProcessID | /pn Name | /ps Service} [/wait] [/nodbg] [/assumedbg] [/int Seconds] [/ws Value] [/ppool Value] [/nppool Value] [/vm Value]

Parameters

/p ProcessID
Monitors the process specified by a ProcessID, a numerical ID assigned by the operating system to the process while it runs.
/pn Name
Monitors a process by using a specified Name. To find the name of a process, look in Task Manager or use the TaskList tool.
/ps Service
Monitors a process by using a specified Service name. To find the name of a service, look in the Services snap-in.
/wait
Notifies MemMonitor to wait for the specified process, if the process has not yet started.
/nodbg
Notifies Memmonitor that no debugger is present on the local computer. If no debugger is present on the local computer and the /nodbg parameter is not used, the following error message is displayed:
MemMon: Selected process does not have a debugger attached!
/assumedbg
Instructs MemMonitor not to check for a debugger on the local computer. MemMonitor does this check by default. Use the /assumedbg parameter if a debugger is present on the local computer, but MemMonitor has displayed an error message stating that a debugger is not attached.
/int Seconds
Sets the interval, in seconds, between checks by MemMonitor. If omitted, the interval is 60 seconds.
/ws Value
Sets a threshold for the amount of memory, in KB, that the monitored process can use. If the threshold is met or exceeded, MemMonitor stops the currently monitored process and begins debugging it.
/ppool Value
Sets a threshold for the amount of memory in the paged pool, in KB, that the monitored process can use. If the threshold is met or exceeded, MemMonitor stops the currently monitored process and begins debugging it.
/nppool Value
Sets a threshold for the amount of memory in the nonpaged pool, in KB, that the monitored process can use. If the threshold is met or exceeded, MemMonitor stops the currently monitored process and begins debugging it.
/vm Value
Sets a threshold for the amount of virtual memory, in KB, that the monitored process can use. If the threshold is met or exceeded, MemMonitor stops the currently monitored process and begins debugging it.


MemTriage Examples

Example 1: Capture Three Snapshots of System, Process, and Kernel Information with 10 Minutes Between Each Capture

The task in this example is to take multiple snapshots of system resources over a period of time to generate a report on a system whose performance is being degraded, before it fails completely. A total of five snapshots will be taken every 10 minutes, and saved to a log file named Memdeg.log. Type the following at the command line:

memtriage /mp memdeg.log /t 3 /w 10

Press ENTER. Output similar to the following is displayed:

Taking snapshot 1 @ 2003/02/18 14:04:11(Pacific Standard Time)
Poolsnap: Scan local pool tag file: localtag.txt
Poolsnap: Scan pool tag file: C:\Program Files\Windows Server 2003 Resource Kit\
pooltag.txt
Sleeping 10 minutes
Taking snapshot 2 @ 2003/02/18 14:14:11(Pacific Standard Time)
Sleeping 10 minutes
Taking snapshot 3 @ 2003/02/18 14:24:11(Pacific Standard Time)

MemTriage captures current process and kernel information and saves it to the log file named Memdeg.log. Then MemTriage waits for 10 minutes before taking the next snapshot. This process is repeated five times.

To analyze the log file and display resources for which there was a usage increase every time a snapshot was taken, use the memtriage command with the /a analyze parameter.

Example 2: Record the Most Current Information on a Failed System and Create a Log File

The task in this example is to record the most current information on a system that has failed due to having no available resources. Type the following at the command line:

memtriage /mp Memone.log

Press ENTER. Output similar to the following is displayed:

Taking snapshot 1 @ 2003/02/18 15:31:20(Pacific Standard Time)
Poolsnap: Scan local pool tag file: localtag.txt
Poolsnap: Scan pool tag file: C:\Program Files\Windows Server 2003 Resource Kit\
pooltag.txt

MemTriage captures current process and kernel information and saves it to the log file named Memone.log.

To analyze and display the log file containing a single snapshot, use the memtriage command with the /s analyze parameter.

Example 3: Record Heap Information for Process 1283

The task in this example is to record heap information for a specific process—process 1283—and save the information to a log file named Memheap.log. Type the following at the command line:

memtriage /h 1283 Memheap.log

Press ENTER. Output similar to the following is displayed:

Taking snapshot 1 @ 2003/02/18 15:58:21(Pacific Standard Time)
Done ...

MemTriage captures current heap information and saves it to the log file named Memheap.log.

To analyze and display the log file based on a rule file, use the memtriage command with the /r RuleFile.ini /pid ProcID parameters.


MemTriage Remarks

Display Processes Running on Local or Remote Computers

To use MemTriage with the /h heap parameter, you must know which process you want to record information about, and know its process ID. If you do not know how to find this information, you can use a support tool named PUList.exe. For more information, see Pulist.exe (http://go.microsoft.com/fwlink/?LinkID=14240).

Changing Thresholds by Using RuleFile.ini

MemTriage uses a rule file to define the thresholds it uses to determine if there is a problem with system resource usage. MemTriage uses the default rule file named Memtriage.ini in the %programfiles%\Windows Server 2003 Resource Kit directory. To change thresholds to accommodate your system resource usage, you can either specify a different rule file or change the thresholds in the Memtriage.ini file.

Using Task Manager to Find a Process ID

You can also use Task Manager, which is available with Windows Server 2003, to find a process ID (PID).

To use Task Manager to find a PID:

  1. Click Start, and then click Command Prompt.
  2. Type
    taskmgr.exe
  3. Press ENTER.
  4. Click the Processes tab.
  5. On the View menu, click Select Columns.
  6. Click to select the PID (Process Identifier) check box.

Using Pooltag Files to Troubleshoot Drivers

The file Pooltag.txt is included with Windows Server 2003 Resource Kit, but it is not required to run MemTriage. You can use this file with MemTriage to identify which driver might be responsible for abnormal pool usage.

MemTriage has the capability to scan the driver files in the %windir%\system32\drivers directory and build a Pooltag file on your local computer (only on an x86-based computer). This local Pooltag file and the global Pooltag file will help you to identify which driver is responsible for most of the pool allocation.

To create a local Pooltag file, run Memtriage with the /p parameter.

Note

  • Make sure you have the required DLL files. If they do not exist, Memtriage will only use the global Pooltag.txt file.


MemTriage Syntax

MemTriage uses the following general syntax:

One Step memtriage /m /p /mp /h ProcID /t /w Length /a [/pid ProcID] /s [/r RuleFile.ini /pid ProcID] LogFile.log

Parameters

/m
Takes a snapshot of the current system and process information and saves it to a log file.
/p
Takes a snapshot of the current kernel pool information and saves it to a log file.
/mp
Takes a snapshot of the current system, process, and kernel pool information and saves it to a log file.
/h ProcID
Takes a snapshot of the current heap information for the specified process and saves it to a log file. ProcID identifies the process for which you are recording or analyzing heap information. This parameter is required by the /h and /pid parameters.
/t
Takes a snapshot of the current requested type of information, adds information about when the snapshot was taken, and saves the information to a log file. The information about the snapshot includes:
  • Date MemTriage uses the format YYYY/MM/DD.
  • Time MemTriage uses Coordinated Universal Time (Greenwich Mean Time).
/w Length
Specifies that there will be a specific number of minutes (Length) between multiple snapshots.
/a [/pid ProcID]
Analyzes the log file containing several snapshots of the same type (process or pool information) and displays resources for which there was an increase every time a snapshot was taken. If you are analyzing heap information, you must use the /pid parameter and specify the process ID.
/s [/r RuleFile.ini /pid ProcID]
Analyzes a log file containing a single snapshot and displays resources for which there was an increase every time a snapshot was taken. If you are analyzing heap information, you must specify that it be analyzed according to a rule file and specify the process ID.
LogFile.log
Records resource usage. This is a required parameter.


MIBCC Examples

Example 1: MIBCC Does Nothing When the Syntax Does Not Include Parameters

In this example, MIBCC is run with no parameters. Type the following command:

mibcc

Press ENTER. The following output is displayed:

Microsoft (R) SNMP MIB Compiler Version 2.00
Copyright (c) Microsoft Corporation 1998.  All rights reserved.
mibcc: total files processed: 0

Example 2: Running MIBCC Without Processing Msft.mib

In this example, MIBCC is run without listing the msft.mib. Type the following command:

mibcc -oNewmib.bin mib_ii.mib wins.mib dhcp.mib

Press ENTER. The following output is displayed:

Microsoft (R) SNMP MIB Compiler Version 2.00
Copyright (c) Microsoft Corporation 1998.  All rights reserved.
mibcc: parsing mib_ii.mib
mibcc: parsing wins.mib
mibcc: parsing dhcp.mib
mibcc: total files processed: 3
Err [mibcc.cpp:251] - Resolve() failed!

MIBCC appears to work and then fails.

Example 3: Troubleshooting MIBCC

In this example, MIBCC is run with the -w parameter set to 3. This provides extra information that may aid in tracking down processing errors in MIBCC. Type the following command:

mibcc -w3 -oNewmib.bin wins.mib dhcp.mib mib_ii.mib

Press ENTER. The following output is displayed:

Microsoft (R) SNMP MIB Compiler Version 2.00
Copyright (c) Microsoft Corporation 1998.  All rights reserved.
mibcc: parsing wins.mib
mibcc: parsing dhcp.mib
mibcc: parsing mib_ii.mib
mibcc: total files processed: 3
Err [mibcc.cpp:251] - Resolve() failed!
<1070,Fatal>: "wins.mib" (line 11, col 18): MIB Module MSFT-MIB, from which symbol software is IMPORTed, is not present in the  input
<1070,Fatal>: "wins.mib" (line 11, col 18): MIB Module MSFT-MIB, from which symbol software is IMPORTed, is not present in the  input
<1070,Fatal>: "dhcp.mib" (line 11, col 18): MIB Module MSFT-MIB, from which symbol software is IMPORTed, is not present in the  input
<1070,Fatal>: "dhcp.mib" (line 11, col 18): MIB Module MSFT-MIB, from which symbol software is IMPORTed, is not present in the  input

The extra information displays the reason for the MIBCC error. Each of the .mib files provided is dependent on the msft.mib file. Without this file, the processing of wins.mib, dhcp.mib, and mib_ii.mib fails.

Example 4: Running MIBCC With Msft.mib

In this example, msft.mib is listed before all other .mib files. Type the following command:

mibcc -w3 -oNewmib.bin msft.mib wins.mib dhcp.mib mib_ii.mib

Press ENTER. The following output is displayed:

Microsoft (R) SNMP MIB Compiler Version 2.00
Copyright (c) Microsoft Corporation 1998.  All rights reserved.
mibcc: parsing msft.mib
mibcc: parsing wins.mib
mibcc: parsing dhcp.mib
mibcc: parsing mib_ii.mib
mibcc: total files processed: 4
mibcc: writing compiled file 'Newmib.bin'


MIBCC Remarks

MIB File Msft.mib Must Be Processed First By MIBCC

When processing any .mib files that have IMPORTS for MSFT-MIB MIB Module, the msft.mib file must be processed first by MIBCC. See the MIBCC Examples page for more information.


MIBCC Syntax

MIBCC uses the following syntax:

One Step mibcc [-e x] [-l] [-n] [-o FileName] [-t] [-w] [Files...]

Parameters

-e x
Stops after x number of errors. (Default = 10)
-l
Supresses the MIBCC logo display. By default this logo displays before any output.
-n
Displays information on each node as it is added.
-o FileName
Directs output to a file. By default, no file is generated.
-t
Displays the updated MIB tree when the MIBCC command is complete.
-w x
Sets warning level of x
Value | Description
0 | Silent (default value)
1 | Errors Only
2 | Warnings
3 | Errors and Warnings
File File
Specifies the name(s)of the .mib file(s) to be compiled. You must include, in this list, all MIBs that you want SNMP to use. If the files are not in the current directory, include the full path of the file in quotation marks.

Note

  • When run without parameters, MIBCC processes no files.


MoveUser Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Move a User Profile Between Domains

In this example, the task is to move the user profile for the joejones user account from domain1 to domain2. The user account had been moved from domain1 to domain2 previously.

Type the following at the command prompt:

moveuser domain1\joejones domain2\joejones

Press ENTER. The following response is displayed:

Moving profile from DOMAIN1\joejones to DOMAIN2\joejones...

Example 2: Move a User Profile Remotely

In this example, the administrator is working from a remote computer to move the user profile for the joejones user account from domain1 to domain2. The administrator wants the user profile moved to Server1. The user account had been moved from domain1 to domain2 previously.

Type the following at the command prompt:

moveuser domain1\joejones domain2\joejones /c:server1

Press ENTER. The following response is displayed:

Moving profile from DOMAIN1\joejones to DOMAIN2\joejones...


MoveUser Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

MoveUser uses the following syntax:

One Step moveuser [Domain\]OldUserAccount [Domain\]NewUserAccount [/c:Computer] [/k] [/y]

Parameters

OldUserAccount
Specifies a user who has a local profile. Specify domain and user names in the Domain/User or the user principal name (UPN) format. If Domain is omitted, OldUserAccount is assumed to belong to the domain of the current user.
NewUserAccount
Specifies the user who will own the OldUserAccount profile. This account must already exist. Specify domain and user names in the Domain/User or the user principal name (UPN) format. If Domain is omitted, NewUserAccount is assumed to belong to the domain of the current user.
/c:Computer
Specifies a remote computer on which to make the changes. If omitted, the local computer is assumed. Use this parameter to move the user profile to a new computer.
/k
Specifies that OldUserAccount resides in the local database of the computer and should not be deleted after the profile is moved.
/y
Directs MoveUser to overwrite any existing profiles.


MSCEP Examples

Overview | Remarks | Examples | Related Tools

Example 1: Install MSCEP in a Separate Application Pool

Internet Information Services (IIS) provides the Web interface for MSCEP-based certificate enrollment. To provide separate security for Web-based applications, IIS allows different applications to run in different application pools. This allows each application pool to run in a security context specific to that application.

To create, for CertSrv1, a separate application pool called MSCEPCA, complete the following tasks:
  1. Create a computer account for CertSrv1 with the Active Directory Users and Computers MMC snap-in.
  2. Create, for CertSrv1, in Domain Name System (DNS), an A resource record that points to the CertSrv1 Internet Protocol IP address. Use the DNS MMC snap-in.
  3. Install the Microsoft Certification Authority (CA) on CertSrv1.
  4. Create, for http/MSCEPCA, in DNS, an A resource record that points to the CertSrv1 IP address.
  5. Create a new service principal name (SPN) that specifies service http/MSCEPCA on computer CertSrv1, using the Setspn.exe tool.

    Type the following at the command line:

    Setspn.exe -A http/MSCEPA CertSrv1

  6. Install the Microsoft Simple Certification Enrollment Protocol (MSCEP) add-on on CertSrv1. During setup, make sure that you select Use a service account for the account type that MSCEP uses.

The CA is now configured to accept MSCEP requests as MSCEPCA. A router can enroll for certificates by providing its enrollment request to http://MSCEPCA/certsrv/mscep/mscep.dll.

Two separate DNS resource records address the CA, both pointing at the IP address for CertSrv1. However, the resource record http/MSCEPCA has been configured with an SPN that allows it to run as a separate security principal.

For more information on the tasks listed and IIS application pools, see Help and Support Center for Windows Server 2003.

Example 2: Use Separate Certificate Templates for Signature and Encryption

The Windows Server 2003 enterprise certification authority (CA) can use version 2 certificate templates. These templates can be customized to suit most certificate purposes and they are extensively documented in Help and Support Center for Windows Server 2003. MSCEP supports the use of customized version 2 certificate templates. Because routers can use either data encryption, data signature or both, you can configure MSCEP to use one or two certificate templates. You need to use two templates when separate certificates are required for data encryption and data signature.

To specify the certificate templates used for certificate enrollment and issuance, complete the following tasks:

  1. Install MSCEP by running CEPSetup.exe.
  2. Create two new certificate templates by cloning IPSec (Offline request) template. In this example, IPSecEncryption and IPSecSignature are the template names. Use the Certificate Templates MMC snap-in to create and modify certificate templates.
  3. Configure the permissions on the Security tab of both certificate templates to allow access to the template to only router administrators and the CA used for enrollment. Both entities need both Read and Enroll permissions to the templates.
  4. Configure the Purpose setting on the Request Handling tab of IPSecEncryption to Encryption and set Minimum key size to 512. Make no other changes to the template.
  5. Configure the Purpose setting on the Request Handling tab of IPSecSignature to Signature and set Minimum key size to 512. Make no other changes to the template.
  6. Add the new certificate templates to the list of the templates that the desired CA issues, using the Certification Authority MMC snap-in.
  7. In the registry editor, navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\MSCEP.
  8. Click Edit, point to New, and then click String Value.
  9. For the first new entry name, type SignatureTemplate and then press ENTER.
  10. Double-click the entry you just typed to open the Edit String dialog box. In the Value data box, type IPSecSignature and then press ENTER.
  11. Click Edit, point to New, and then click String Value.
  12. For the second new entry name, type EncryptionTemplate and then press ENTER.
  13. Double-click the entry you just typed to open the Edit String dialog box. In the Value data box, type IPSecEncryption and then press ENTER.
  14. Click File, and then click Exit to close the registry editor.

    15. Caution

    • The registry editor bypasses standard safeguards, allowing settings that can damage your system, or even require you to reinstall Windows. If you must edit the registry, back it up first and see the Registry Reference on the Microsoft Windows Server 2003 Deployment Kit companion CD, the Windows Server 2003 Resource Kit companion CD, or Windows Deployment and Resource Kits (http://go.microsoft.com/fwlink/?LinkID=4617).
  15. Restart the World Wide Web Publishing Service.

When you complete these tasks, routers enroll for certificates, based on the specified certificate templates.

Example 3: Install and Configure MSCEP with Multiple Domains

Windows Server 2003 Active Directory environments are often made up of more than one domain in a forest. In these environments, the CA that accepts MSCEP enrollment requests is usually not located in the root domain. Some simple additional steps must be taken in these cases to ensure that enrollment works properly.

To ensure proper enrollment when the MSCEP CA is not in the root domain, complete the following tasks:

  1. Set permissions for the certificate templates used by MSCEP according to the criteria in the following table:
    Certificate template User and group accounts Permissions
    Exchange Enrollment Agent (Offline request)
    • Enterprise Administrators group
    • Root Domain Administrators group
             Read and Enroll
    CEP Encryption
    • Enterprise Administrators group
    • Root Domain Administrators group
             Read and Enroll
    IPSec (Offline request)
    • Local computer account
    • Service account for the application pool (if selected)
    • Enterprise Administrators group
    • Root Domain Administrators group
             Read and Enroll
  2. Make sure that Active Directory replication of the modified certificate templates is complete. For information on verifying replication, see Help and Support Center.
  3. Add the three modified certificate templates to the list of the templates the desired CA issues. Use the Certification Authority MMC snap-in.
  4. Restart the Certificate Services service.
  5. Install MSCEP by running Cepsetup.exe and following the instructions provided.

Example 4: Renew a Registration Authority Certificate with MSCEP

When MSCEP is installed, it obtains a certificate to act as a registration authority (RA) for enrolling new certificates. This certificate, like all certificates, has an expiration date based on the enrolled certificate template. When the expiration date is near, an administrator must manually renew the certificate to ensure that MSCEP-based enrollment continues without interruption.

To renew the RA certificate, complete the following tasks:

  1. Restart the World Wide Web Publishing Service.
  2. Install the Microsoft Simple Certification Enrollment Protocol add-on by running Cepsetup.exe. Because MSCEP is already installed, setup automatically removes and reinstalls the add-on and renews the certificate.

Note

  • Reinstallation of the MSCEP add-on is the only method available for renewing the RA certificate.


MSCEP Remarks

Overview | Remarks | Examples | Related Tools

Installing and Configuring MSCEP

MSCEP runs on Windows Server 2003. It provides support for the SCEP protocol, which allows Cisco routers and other intermediate network devices to obtain certificates.

MSCEP does not install with other Resource Kit tools for Windows Server 2003. It requires separate installation.

Preparing for Installation

As you plan your installation of the SCEP Add-on for Certificate Services, you need to be aware of a number of requirements:

Condition | Requirement
You want to install the MSCEP
  • You must install MSCEP on a certification authority (CA). Both enterprise CAs and stand-alone CAs are supported. You can install MSCEP on a root or subordinate CA.
  • By default, you need to be a member of the Enterprise Administrators group and the root Domain Administrators group to install MSCEP on an enterprise CA, or you need to be a member of the administrators group for the local computer to install MSCEP on a stand-alone CA.
  • You cannot install MSCEP on a CA that has any non-alphanumeric characters (&,*, :, ;, ', ", etc.) in its name.
You are using Cisco routers to enroll for certificates | They must be running Cisco IOS Release 12.2(6) or later.
You are using a stand-alone CA | Place the CA in a separate certification hierarchy from all other CAs in your organization. This helps prevent any unintended trust of SCEP clients. When using a stand-alone CA with SCEP as a separate certification hierarchy, certificate and chain of the root CAs should not be trusted by other clients in the enterprise. In this configuration, the SCEP-oriented public key infrastructure (PKI) is only intended for trust by intermediate network devices that use SCEP.
The CA that issues the SCEP certificate needs to publish its certificate revocation list (CRL). | The CA must publish its certificate revocation list (CRL) to an HTTP URL that the router can contact. The CRL location must be an HTTP location for the router to be able to retrieve it and verify the revocation status of its certificate. In addition, the CRL location must be specified as a CRL Distribution Point in the issued certificate for the router to be able to locate it.
You want to configure MSCEP to use the local system account or to use a user account to connect to the CA for certificate enrollment. | The user account must be a member of the IIS_WPG security group and have Read and Enroll permission for the IPSec (Offline request) certificate template. If the CA is an enterprise CA, the user account must be an Active Directory user account and must have additional configuration steps performed.

Installing MSCEP on a Windows Server 2003 CA

To install MSCEP on a Windows Server 2003 CA, take the following steps:

  1. Log on with the appropriate administrative privileges to the server on which the CA is installed.
  2. Click Start, then click Run, and then type drive:cepsetup.exe where drive is the CD-ROM drive where the Windows Server 2003 Deployment Kit companion CD or the Windows Server 2003 Resource Kit companion CD is located or the disk drive where you have downloaded Cepsetup.exe. This starts the SCEP Add-on for Certificate Services Setup wizard.
  3. Use the SCEP Add-on for Certificate Services Setup Wizard to make the appropriate selections:
    • Click the appropriate radio button to indicate whether you want MSCEP to operate in the context of the local system account or in a specific service account. If you choose the service account option, you must provide, on the next screen, the account name and password for the account that MSCEP will use to enroll for certificates.
    • Click the check box if you want to require a challenge phrase for router certificate enrollment. If you check it, the installation will overwrite the existing CA. For guidelines on challenge phrases, see Installation Recommendations.
    • Use the text boxes to enter identifying information about who is enrolling for the Registration Authority (RA) certificate, that will later allow certificates to be requested from the CA on behalf of the router.
    • (Optional) Select Advanced Enrollment Options if you want to specify the cryptographic service provider (CSP) and key lengths for the RA signature and encryption keys. When the next wizard screen appears, make your selections from a pair of list boxes for each signature and encryption key. You can also use a drop-down menu to select the cypher strength for the signature and encryption key types.
  4. Click Finish to complete the installation wizard. The URL http://URLHostName/certsrv/mscep/mscep.dll is displayed when the wizard finishes and confirms a successful installation. URLHostName is the name of the CA.

Installation Recommendations

  • Specify a challenge phrase when installing MSCEP. If you do not specify a challenge phrase, any user can enroll for an IPSec (Offline request) certificate.
  • Use Internet Explorer on a Windows Server 2003 computer when performing procedural steps that require you to connect to the URL: http://URLHostName/certsrv/mscep/mscep.dll .
  • If Internet Explorer is configured to use a proxy server, make sure that the Bypass proxy server for local addresses check box is selected in the Tools, Internet Options, Connections, LAN Settings dialog box in Internet Explorer.
  • Make sure that the Web pages are installed and that Internet Information Services (IIS) is configured correctly. MSCEP relies on the Certification Authority Web pages to work correctly, so if the Web pages are not installed or IIS is configured incorrectly, MSCEP will fail.

    For information about configuring Certification Authority Web pages, see Set up certification authority Web enrollment support in Help and Support Center for Windows Server 2003.

  • To increase security of certificate requests on an enterprise CA, configure the permissions on the Security tab of the IPSec (Offline requests) certificate template to restrict access to the template to router administrators and the CA used for enrollment. Both entities need both Read and Enroll permissions to the template.
  • To identify issues during MSCEP installation, configuration, or operation, use Event Viewer to review entries.

Enrolling for Certificates from a Cisco Router

Extensive documentation for enrolling and installing a certificate on a Cisco router is available on the Cisco Systems (http://go.microsoft.com/fwlink/?LinkID=635) Web site. Because the procedure may vary by equipment and Internet Operating System (IOS) release, locate the appropriate procedure for your router by searching on your Cisco model name/number and the terms Microsoft SCEP.

During the enrollment process, use Internet Explorer to connect to the CA to retrieve the certificate fingerprint of the CA and a valid challenge password. Connect to the Internet and enter the following URL:

http://URLHostName/certsrv/mscep/mscep.dll

URLHostName is the name of the CA.

The challenge password is an important component of certificate enrollment. There are several important facts to consider when using this password:

  • A different challenge password is displayed each time you connect to the SCEP URL. Each challenge password is valid for 60 minutes and can be used only once.
  • The password displayed is both the challenge password for certificate enrollment and the password for certificate revocation. Record this password in case you need to revoke the certificate.
  • If you connect to the URL shown above and do not see a challenge password displayed, that means that MSCEP was not configured to require a challenge password. In such a case, you can make up a password of your own choosing, but you can use this password for certificate revocation only.

Configuring Service Wait Time

MSCEP must wait for both IIS and the CA to be started before it can start, as it depends on these other services to provide some of its functionality. Several configuration options can affect the length of time these services require to start up. If these services take longer to start than expected, MSCEP may fail when it starts. To avoid that situation, you can configure MSCEP to wait a defined number of seconds before it starts. This gives the other services the time they need to start.

To configure the amount of time MSCEP waits before starting:

  1. In the registry editor, navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\MSCEP.
  2. Click Edit, point to New, and then click DWORD Value.
  3. For the new entry name, type ServiceWaitPeriod and then press ENTER.
  4. Double-click the entry you just typed to open the Edit DWORD Value dialog box.
  5. Leave the data type as Decimal (the default).
  6. In the Value data box, type the number of seconds you want MSCEP to wait before it starts.
  7. Click OK.
  8. Click File, and then click Exit to close the registry editor.

Caution

  • The registry editor bypasses standard safeguards, allowing settings that can damage your system, or even require you to reinstall Windows. If you must edit the registry, back it up first and see the Registry Reference on the Microsoft Windows Server 2003 Deployment Kit companion CD, the Windows Server 2003 Resource Kit companion CD, or Windows Deployment and Resource Kits (http://go.microsoft.com/fwlink/?LinkID=4617).

Configuring Access to MSCEP Passwords

It is strongly recommended that you use password-based SCEP enrollment to ensure that only intended parties are able to obtain IPSec certificates. On a stand-alone CA, Active Directory-based certificate templates provide no additional security. Instead, MSCEP is configured to provide only enrollment passwords to the local administrator. However, in some scenarios such as a physically isolated enrollment environment, this may not be appropriate.

To configure MSCEP to provide enrollment passwords to any user:

  1. In the registry editor, navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\MSCEP.
  2. Click Edit, point to New, and then click DWORD Value.
  3. For the new entry name, type AllowAll and then press ENTER.
  4. Double-click the entry you just typed to open the Edit DWORD Value dialog box.
  5. Leave the data type as Decimal (the default).
  6. In the Value data box, type
    1
  7. Click OK.
  8. Click File, and then click Exit to close the registry editor.

Caution

  • The registry editor bypasses standard safeguards, allowing settings that can damage your system, or even require you to reinstall Windows. If you must edit the registry, back it up first and see the Registry Reference on the Microsoft Windows Server 2003 Deployment Kit companion CD, the Windows Server 2003 Resource Kit companion CD, or Windows Deployment and Resource Kits (http://go.microsoft.com/fwlink/?LinkID=4617).

Note

  • You must restart Internet Information Services (IIS) before this setting can take effect. For more information, see Help and Support Center for Windows Server 2003.

Protecting the Enrollment Password from Compromise

The SCEP protocol encrypts the enrollment password during enrollment from the router to the CA. However, no other communications that carry the password are guaranteed to be secure. For this reason, an attacker could intercept the password during transmission and use that password to obtain a fraudulent IPSec certificate.

To ensure that the enrollment password is not compromised, protect all communication between the client computer and the CA and the router against eavesdropping. You can accomplish this through physical security, such as using an isolated network. You can also use IPSec or secure sockets layer (SSL), where appropriate, to protect client-based communication.


NLSInfo Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Display Locale Information

The task in this example is to display locale information using NLSInfo. Type the following at the command line:

nlsinfo

Press ENTER. Output similar to the following is displayed :

Host Name:                    SERVER1
System Default UI Language:   English (United States)
System Locale:                English (United States)
User Locale:                  English (United States)
Input Locale:                 English (United States)
Windows Code Page:            437   (OEM - United States)
Console Code Page:            437   (OEM - United States)
Number Format:                123,456,789.00
Currency Format:              $123,456,789.00
Time Format:                  h:mm:ss tt
Short Date Format:            M/d/yyyy
Long Date Format:             dddd, MMMM dd, yyyy
Time Zone:                    (GMT-08:00) Pacific Standard Time
Daylight Saving Changes:      Enabled
Installed Keyboards:
          English (United States)
Installed Code Pages:
          10000 (MAC - Roman),
          10001 (MAC - Japanese),
          10002 (MAC - Traditional Chinese Big5),
          10003 (MAC - Korean),
          10004 (MAC - Arabic),
          10005 (MAC - Hebrew),
          10006 (MAC - Greek I),
          10007 (MAC - Cyrillic),
          10008 (MAC - Simplified Chinese GB 2312),
          10010 (MAC - Romania),
          10017 (MAC - Ukraine),
          10021 (MAC - Thai),
          10029 (MAC - Latin II),
          10079 (MAC - Icelandic),
          10081 (MAC - Turkish),
          10082 (MAC - Croatia),
          1026  (IBM EBCDIC - Turkish (Latin-5)),
          1047  (IBM EBCDIC - Latin-1/Open System),
          1140  (IBM EBCDIC - U.S./Canada (37 + Euro)),
          1141  (IBM EBCDIC - Germany (20273 + Euro)),
          1142  (IBM EBCDIC - Denmark/Norway (20277 + Euro)),
          1143  (IBM EBCDIC - Finland/Sweden (20278 + Euro)),
          1144  (IBM EBCDIC - Italy (20280 + Euro)),
          1145  (IBM EBCDIC - Latin America/Spain (20284 + Euro)),
          1146  (IBM EBCDIC - United Kingdom (20285 + Euro)),
          1147  (IBM EBCDIC - France (20297 + Euro)),
          1148  (IBM EBCDIC - International (500 + Euro)),
          1149  (IBM EBCDIC - Icelandic (20871 + Euro)),
          1250  (ANSI - Central Europe),
          1251  (ANSI - Cyrillic),
          1252  (ANSI - Latin I),
          1253  (ANSI - Greek),
          1254  (ANSI - Turkish),
          1255  (ANSI - Hebrew),
          1256  (ANSI - Arabic),
          1257  (ANSI - Baltic),
          1258  (ANSI/OEM - Viet Nam),
          1361  (Korean - Johab),
          20000 (CNS - Taiwan),
          20001 (TCA - Taiwan),
          20002 (Eten - Taiwan),
          20003 (IBM5550 - Taiwan),
          20004 (TeleText - Taiwan),
          20005 (Wang - Taiwan),
          20105 (IA5 IRV International Alphabet No.5),
          20106 (IA5 German),
          20107 (IA5 Swedish),
          20108 (IA5 Norwegian),
          20127 (US-ASCII),
          20261 (T.61),
          20269 (ISO 6937 Non-Spacing Accent),
          20273 (IBM EBCDIC - Germany),
          20277 (IBM EBCDIC - Denmark/Norway),
          20278 (IBM EBCDIC - Finland/Sweden),
          20280 (IBM EBCDIC - Italy),
          20284 (IBM EBCDIC - Latin America/Spain),
          20285 (IBM EBCDIC - United Kingdom),
          20290 (IBM EBCDIC - Japanese Katakana Extended),
          20297 (IBM EBCDIC - France),
          20420 (IBM EBCDIC - Arabic),
          20423 (IBM EBCDIC - Greek),
          20424 (IBM EBCDIC - Hebrew),
          20833 (IBM EBCDIC - Korean Extended),
          20838 (IBM EBCDIC - Thai),
          20866 (Russian - KOI8),
          20871 (IBM EBCDIC - Icelandic),
          20880 (IBM EBCDIC - Cyrillic (Russian)),
          20905 (IBM EBCDIC - Turkish),
          20924 (IBM EBCDIC - Latin-1/Open System (1047 + Euro)),
          20932 (JIS X 0208-1990 & 0212-1990),
          20936 (Simplified Chinese GB2312),
          21025 (IBM EBCDIC - Cyrillic (Serbian, Bulgarian)),
          21027 (Ext Alpha Lowercase),
          21866 (Ukrainian - KOI8-U),
          28591 (ISO 8859-1 Latin I),
          28592 (ISO 8859-2 Central Europe),
          28593 (ISO 8859-3 Latin 3),
          28594 (ISO 8859-4 Baltic),
          28595 (ISO 8859-5 Cyrillic),
          28596 (ISO 8859-6 Arabic),
          28597 (ISO 8859-7 Greek),
          28598 (ISO 8859-8 Hebrew: Visual Ordering),
          28599 (ISO 8859-9 Latin 5),
          28605 (ISO 8859-15 Latin 9),
          37    (IBM EBCDIC - U.S./Canada),
          38598 (ISO 8859-8 Hebrew: Logical Ordering),
          437   (OEM - United States),
          500   (IBM EBCDIC - International),
          708   (Arabic - ASMO),
          720   (Arabic - Transparent ASMO),
          737   (OEM - Greek 437G),
          775   (OEM - Baltic),
          850   (OEM - Multilingual Latin I),
          852   (OEM - Latin II),
          855   (OEM - Cyrillic),
          857   (OEM - Turkish),
          858   (OEM - Multilingual Latin I + Euro),
          860   (OEM - Portuguese),
          861   (OEM - Icelandic),
          862   (OEM - Hebrew),
          863   (OEM - Canadian French),
          864   (OEM - Arabic),
          865   (OEM - Nordic),
          866   (OEM - Russian),
          869   (OEM - Modern Greek),
          870   (IBM EBCDIC - Multilingual/ROECE (Latin-2)),
          874   (ANSI/OEM - Thai),
          875   (IBM EBCDIC - Modern Greek),
          932   (ANSI/OEM - Japanese Shift-JIS),
          936   (ANSI/OEM - Simplified Chinese GBK),
          949   (ANSI/OEM - Korean),
          950   (ANSI/OEM - Traditional Chinese Big5),
          28603 (ISO 8859-13 Latin 7),
          54936 (GB18030 Simplified Chinese),
          65000 (UTF-7),
          65001 (UTF-8)


NLSInfo Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

NLSInfo uses the following syntax.

One Step nlsinfo

There are no parameters for this tool.


Now Examples

Example: Create a Time-Stamped "Download Completed" Message

The task in this example is to use Now to create a time-stamped message that tells you when a download has been completed.

To create the message, type the following at the command line:

now Download Completed

Press ENTER. Output similar to the following is displayed:

Tue Feb 24 11:27:45 2003 Download Completed


Now Remarks

Using Now for Tracking

Now is useful for logging times from batch (*.bat) or command (*.cmd) files to track progress.

Understanding Similar Tools

Now is similar to the MS-DOS echo command, but with a time stamp. However, you cannot use the ON or OFF options in Now that are available in echo.

Displaying the Time

When run without parameters, Now displays the current date and time on STDOUT in the following format:

  • Day Month Date Time (HH:MM:SS) Year


Now Syntax

Now uses the following syntax:

One Step now Message /?

Parameters

Message
Specifies the text message you want to display.
/?
Displays command-line usage.

Note

  • When run without parameters, Now displays the current date and time on STDOUT.


NTimer Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Measure How Long ShowPerf Takes to Run

The task in this example is to measure how much time it takes to run ShowPerf. From the directory where ShowPerf is located, type the following at the command line:

ntimer /f showperf

Press ENTER. The ShowPerf dialog box opens. After using ShowPerf, close the dialog box. Output similar to the following is displayed:

ContextSwitches - 9247
First level fills = 0
Second level fills = 0

ETime(   0:00:12.928 ) UTime(   0:00:00.120 ) KTime(   0:00:00.150 )
ITime(   0:00:12.407 )

Process PageFaultCount      4910
Total Interrupts            4193
Total Context Switches      9247
Total System Calls          56237

Example 2: Measure How Long the List Tool Takes to Run

The task in this example is to measure how much time it takes to use List to look at the Vfi.ini file. From the directory where List is located, type the following at the command line:

ntimer list /g:5 vfi.ini

Press ENTER. List opens, displaying the beginning of the Vfi.ini file. After editing Vfi.ini, close List. Output similar to the following is displayed:

ContextSwitches - 503
First level fills = 0
Second level fills = 0

ETime(   0:00:02.125 ) UTime(   0:00:00.000 ) KTime(   0:00:00.000 )
ITime(   0:00:02.062 )


NTimer Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

NTimer uses the following syntax:

One Step ntimer [/?] [/1] [/f] [/s] Application [ApplicationParameters]

Parameters

/?
Displays command-line usage.
/1
Displays output on one line.
/f
Displays the number of process page faults, total system interrupts, context switches, and system calls.
/s
Specifies that Application is a server process. Press CTRL+C to get the times.
Application
Specifies the name of the application you want to time.
ApplicationParameters
Specifies the parameters with which you want to run Application.

Note

  • When run without parameters, NTimer displays command-line usage.


NTRights Examples

Example 1: Grant a Right on the Local Computer

In this example, the right to change the system time is granted to the Users group. Type the following at the command line:

ntrights +r SeSystemtimePrivilege -u Users

Press ENTER. The following output is displayed:

 Granting SeSystemtimePrivilege to Users   ... successfulGranting SeSystemtimePrivilege to Users   ... successful

Example 2: Revoke a Right on the Local Computer

In this example, the right to access the local computer from the network is revoked to the Everyone group. Type the following at the command line:

ntrights -r SeNetworkLogonRight -u Everyone

Press ENTER. The following output is displayed:

Revoking SeNetworkLogonRight from Everyone   ... successful

Example 3: Grant a Right Remotely

In this example, the user account ServiceAcc001 is given the right to log on as a service. This account resides on the computer named Computer1. Type the following at the command line:

ntrights +r SeServiceLogonRight -u ServiceAcc001 -m \\COMPUTER1

Press ENTER. The following output is displayed:

Granting SeServiceLogonRight to ServiceAcc001... successful


NTRights Remarks

List of Rights

These are the rights (and their meanings) that can be granted or revoked with NTRights.

Names of rights are case-sensitive. You must type the privilege name exactly as it appears. For example, SeSystemtimePrivilege and not sesystemtimeprivilege.

Privilege Name | Windows Privilege | Description
SeTcbPrivilege | Act as part of the operating system | Allows a process to authenticate like a user and thus gain access to the same resources as a user. Only low-level authentication services should require this privilege.
SeMachineAccountPrivilege | Add computers to a domain | Allows the user to add a computer to a specific domain. For the privilege to be effective, it must be assigned to the user as part of local security policy for domain controllers in the domain.
SeBackupPrivilege Back up files and directories Allows the user to circumvent file and directory permissions to back up the system. The privilege is checked only when an application attempts access through the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply.

By default, this privilege is assigned to Administrators and Backup Operators. See also Restore files and directories in this table.

SeChangeNotifyPrivilege Bypass traverse checking Allows the user to pass through folders to which the user otherwise has no access while navigating an object path in any Windows file system or in the registry. This privilege does not allow the user to list the contents of a folder; it allows the user only to traverse its directories.

By default, this privilege is assigned to Administrators, Backup Operators, Power Users, Users, and Everyone.

SeSystemTimePrivilege Change the system time Allows the user to set the time for the internal clock of the computer.

By default, this privilege is assigned to Administrators and Power Users.

SeCreatePagefilePrivilege Create a page file Allows the user to create and change the size of a page file.

By default, this privilege is assigned to Administrators.

SeCreateTokenPrivilege | Create a token object | Allows a process to create an access token by calling NtCreateToken() or other token-creating APIs.
SeCreatePermanentPrivilege | Create permanent shared objects | Allows a process to create a directory object in the Windows 2000 or Windows Server 2003 object manager.
SeRemoteShutdownPrivilege Force shutdown from a remote system Allows a user to shut down a computer from a remote location on the network. See also Shut down the system in this table.

By default, this privilege is assigned to Administrators.

SeAuditPrivilege | Generate security audits | Allows a process to create, generate, and add entries in the security log. The security log is used to track unauthorized system access. See also Manage auditing and security log in this table.
SeIncreaseQuotaPrivilege Increase quotas Allows a process that has Write Property access to another process to increase the processor quota that is assigned to the other process. This privilege is useful for system tuning, but it can be misused, as in a denial of service attack.

By default, this privilege is assigned to Administrators.

SeIncreaseBasePriorityPrivilege Increase scheduling priority Allows a process that has Write property access to another process so that it can increase the execution priority of the other process. A user with this privilege can change the scheduling priority of a process in the Task Manager dialog box.

By default, this privilege is assigned to Administrators.

SeLoadDriverPrivilege Load and unload device drivers Allows a user to install and uninstall Plug and Play device drivers. Device drivers that are not Plug and Play are not affected by this privilege and can be installed only by Administrators. Because device drivers run as trusted (highly privileged) programs, this privilege can be misused to install hostile programs and give them destructive access to resources.

By default, this privilege is assigned to Administrators.

SeLockMemoryPrivilege | Lock pages in memory | Allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege can significantly degrade system performance. This privilege is obsolete and should therefore never be selected.
SeSecurityPrivilege Manage auditing and security log Allows a user to specify object access auditing options on individual resources such as files, Active Directory objects, and registry keys. Object access auditing must first be enabled in Audit Policy (under Security Settings, Local Policies). With this privilege a user can then specify individual objects for auditing in Windows Explorer. A user who has this privilege can also view and clear the security log from Event Viewer.

By default, this privilege is assigned to Administrators.

SeSystemEnvironmentPrivilege Modify firmware environment values Allows modification of system environment variables either by a process through an API or by a user through System Properties.

By default, this privilege is assigned to Administrators.

SeProfileSingleProcessPrivilege Profile a single process Allows a user to run Windows 2000® and Windows Server 2003 performance-monitoring tools to monitor the performance of nonsystem processes.

By default, this privilege is assigned to Administrators and Power Users.

SeSystemProfilePrivilege Profile system performance Allows a user to run Windows 2000 and Windows Server 2003 performance-monitoring tools to monitor the performance of system processes.

By default, this privilege is assigned to Administrators.

SeAssignPrimaryTokenPrivilege | Replace a process-level token | Allows a parent process to replace the access token associated with a child process.
SeRestorePrivilege Restore files and directories Allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principal as the owner of an object. See also Back up files and directories in this table.

By default, this privilege is assigned to Administrators and Backup Operators.

SeShutdownPrivilege Shut down the system Allows a user to shut down the local computer. See also Force shutdown from a remote system in this table. In Windows XP Professional:

By default, this privilege is assigned to Administrators, Backup Operators, Power Users, and Users. In Windows Server 2003 :

By default, this privilege is not assigned to Users, only to Administrators, Backup Operators, and Power Users.

SeTakeOwnershipPrivilege Take ownership of files or other objects Allows a user to take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads.

By default, this privilege is assigned to Administrators.


NTRights Syntax

NTRights uses the following syntax:

One Step ntrights {-r Right | +r Right} -u UserOrGroup [-m \\Computer] [-e Entry] [-?]

Parameters

-r Right
Revokes Right from specified user or group. For a full list, see List of Rights.
+r Right
Grants Right to specified user or group. For a full list, see List of Rights.
-u UserOrGroup
Specifies the user or group for whom rights are to be granted or revoked.
-m \\Computer
Specifies the computer on which to perform the operation. The default is the local computer. FQDNs, NetBIOS names and IP addresses are all acceptable entries. If the right exists at the domain then the computer must be a domain controller.
-e Entry
Adds a text string Entry to the event log of the computer.

Notes

  • To be able to set a right for a user or group, you must have Administrator privileges.
  • Names of rights are case-sensitive. You must type the privilege name exactly as it appears. For example, you need to type SeSystemtimePrivilege and not sesystemtimeprivilege.


OH Examples

Example 1: List All Open Windows with Names for a Specified Process

If you want to list all open windows for a specified process, you must first determine the process ID. If you have not already enabled the object type list flag, you must do so before running OH. To enable the object type list flag, type the following at the command line:

oh +otl

Press ENTER. The following output is displayed:

Enabled `object type list' flag needed by the OH utility.
Will take effect next time you boot.

After you have rebooted your computer, you can use OH. To determine the process ID for HomeSite 5, type the following at the command line:

tasklist

Press ENTER. Output similar to the following is displayed:

Image Name                   PID Session Name     Session#    Mem Usage
========================= ====== ================ ======== ============
System Idle Process            0 Console                 0         20 K
System                         4 Console                 0        220 K
smss.exe                     420 Console                 0        376 K
csrss.exe                    492 Console                 0      3,764 K
winlogon.exe                 516 Console                 0      6,312 K
services.exe                 560 Console                 0      3,624 K
lsass.exe                    572 Console                 0      2,808 K
svchost.exe                  748 Console                 0      2,912 K
svchost.exe                  812 Console                 0     21,752 K
svchost.exe                  916 Console                 0      1,604 K
svchost.exe                  940 Console                 0      4,296 K
spoolsv.exe                 1016 Console                 0      4,784 K
InoRpc.exe                  1140 Console                 0      6,096 K
InoRT.exe                   1160 Console                 0      9,560 K
InoTask.exe                 1172 Console                 0      5,516 K
nvsvc32.exe                 1316 Console                 0      1,168 K
explorer.exe                1668 Console                 0     22,352 K
Realmon.exe                  216 Console                 0      4,360 K
cmd.exe                      280 Console                 0      2,556 K
Homesite5.exe                296 Console                 0     43,788 K
MDM.EXE                      404 Console                 0      2,524 K
notepad.exe                 1272 Console                 0      2,040 K
tasklist.exe                1464 Console                 0      2,748 K
wmiprvse.exe                1508 Console                 0      3,948 K

The process ID for HomeSite is 296. Now use this process ID in your OH command statement. To see all open windows for HomeSite and send the output to Ohlog.txt in the current directory, type the following at the command line:

oh /p 296 /o ohlog.txt

Press ENTER. When the command prompt is displayed, you can view the output in Ohlog.txt. Your output will look similar to the following:

Expand to see OH output.

//
// TIME: 2003-01-02 18:21
// MACHINE: USER1
// BUILD: 2600
// OH version:  (Lab03_DEV.021126-1716)
//
//
00000128 Homesite5.exe  KeyedEvent     0004 \KernelObjects\CritSecOutOfMemoryEvent
00000128 Homesite5.exe  Directory      0008 \KnownDlls
00000128 Homesite5.exe  Semaphore      000c \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
00000128 Homesite5.exe  Directory      0014 \Windows
00000128 Homesite5.exe  Key            001c \REGISTRY\MACHINE
00000128 Homesite5.exe  WindowStation  0024 \Windows\WindowStations\WinSta0
00000128 Homesite5.exe  Desktop        0028 \Default
00000128 Homesite5.exe  WindowStation  002c \Windows\WindowStations\WinSta0
00000128 Homesite5.exe  Directory      0030 \BaseNamedObjects
00000128 Homesite5.exe  Key            003c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
00000128 Homesite5.exe  Semaphore      0048 \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
00000128 Homesite5.exe  File           0050 \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805
00000128 Homesite5.exe  Key            005c \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
00000128 Homesite5.exe  Key            0068 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows NT\CurrentVersion\Windows
00000128 Homesite5.exe  File           0078 \Program Files\Macromedia\HomeSite 5\Homesite5.exe
00000128 Homesite5.exe  Key            0084 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003_CLASSES
00000128 Homesite5.exe  Key            0088 \REGISTRY\MACHINE\SYSTEM\Setup
00000128 Homesite5.exe  Semaphore      008c \BaseNamedObjects\Macromedia_Client5_SEM
00000128 Homesite5.exe  Key            0090 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Internet Explorer\Security\P3Global
00000128 Homesite5.exe  Key            0094 \REGISTRY\MACHINE\SOFTWARE\Classes
00000128 Homesite5.exe  File           009c \WINDOWS\system32\stdole32.tlb
00000128 Homesite5.exe  Key            00a4 \REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000128 Homesite5.exe  Key            00ac \REGISTRY\USER
00000128 Homesite5.exe  Key            00b4 \REGISTRY\MACHINE\SOFTWARE\Classes
00000128 Homesite5.exe  Key            00bc \REGISTRY\USER
00000128 Homesite5.exe  Key            00c4 \REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000128 Homesite5.exe  Key            00cc \REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000128 Homesite5.exe  Key            00d4 \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000128 Homesite5.exe  Key            00dc \REGISTRY\MACHINE\SOFTWARE\Classes
00000128 Homesite5.exe  Key            00e4 \REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000128 Homesite5.exe  Key            00ec \REGISTRY\USER
00000128 Homesite5.exe  Key            00f4 \REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000128 Homesite5.exe  Key            00fc \REGISTRY\MACHINE\SOFTWARE\Microsoft\COM3
00000128 Homesite5.exe  Key            0104 \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
00000128 Homesite5.exe  Section        010c \BaseNamedObjects\__R_000000000008_SMem__
00000128 Homesite5.exe  Port           012c \RPC Control\OLE8
00000128 Homesite5.exe  Event          0144 \BaseNamedObjects\MSFT.VSA.IEC.STATUS.6c736db0
00000128 Homesite5.exe  Key            0148 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Multimedia\DrawDib
00000128 Homesite5.exe  Semaphore      015c \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
00000128 Homesite5.exe  File           0174 \ntsvcs
00000128 Homesite5.exe  Mutant         0178 \BaseNamedObjects\ShimCacheMutex
00000128 Homesite5.exe  Key            017c \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
00000128 Homesite5.exe  Semaphore      0180 \BaseNamedObjects\shell.{090851A5-EB96-11D2-8BE4-00C04FA31A66}
00000128 Homesite5.exe  Section        0184 \BaseNamedObjects\ShimSharedMemory
00000128 Homesite5.exe  File           018c \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805
00000128 Homesite5.exe  File           0190 \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805
00000128 Homesite5.exe  Event          0198 \BaseNamedObjects\userenv:  User Profile setup event
00000128 Homesite5.exe  File           019c \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805
00000128 Homesite5.exe  File           01a0 \WINDOWS\system32\cfvalidator.dll
00000128 Homesite5.exe  Key            01a4 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer
00000128 Homesite5.exe  Semaphore      01a8 \BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
00000128 Homesite5.exe  Key            01ac \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows\Shell
00000128 Homesite5.exe  Key            01b0 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
00000128 Homesite5.exe  Key            01b4 \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
00000128 Homesite5.exe  Semaphore      01b8 \BaseNamedObjects\shell.BitBucket.GlobalDirtyCount
00000128 Homesite5.exe  Semaphore      01bc \BaseNamedObjects\shell.BitBucket.NumDeleters
00000128 Homesite5.exe  Key            01c4 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows\ShellNoRoam
00000128 Homesite5.exe  Key            01c8 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache
00000128 Homesite5.exe  File           01dc \Documents and Settings\User1\Local Settings\History\History.IE5\MSHist012003010220030103\index.dat
00000128 Homesite5.exe  Mutant         01f4 \BaseNamedObjects\c:!documents and settings!User1!local settings!history!history.ie5!mshist012003010220030103!
00000128 Homesite5.exe  Key            0210 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
00000128 Homesite5.exe  Semaphore      0214 \BaseNamedObjects\shell._ie_sessioncount
00000128 Homesite5.exe  Key            0218 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Internet Explorer\Security\P3Sites
00000128 Homesite5.exe  Key            021c \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings
00000128 Homesite5.exe  Event          0220 \BaseNamedObjects\crypt32LogoffEvent
00000128 Homesite5.exe  File           0228 \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805
00000128 Homesite5.exe  Mutant         022c \BaseNamedObjects\_!MSFTHISTORY!_
00000128 Homesite5.exe  File           0230 \Documents and Settings\User1\Local Settings\Temporary Internet Files\Content.IE5\index.dat
00000128 Homesite5.exe  Mutant         0234 \BaseNamedObjects\c:!documents and settings!User1!local settings!temporary internet files!content.ie5!
00000128 Homesite5.exe  Section        0238 \BaseNamedObjects\C:_Documents and Settings_User1_Local Settings_Temporary Internet Files_Content.IE5_index.dat_3686400
00000128 Homesite5.exe  Mutant         023c \BaseNamedObjects\c:!documents and settings!User1!cookies!
00000128 Homesite5.exe  File           0240 \Documents and Settings\User1\Cookies\index.dat
00000128 Homesite5.exe  Mutant         0244 \BaseNamedObjects\c:!documents and settings!User1!local settings!history!history.ie5!
00000128 Homesite5.exe  File           0248 \Documents and Settings\User1\Local Settings\History\History.IE5\index.dat
00000128 Homesite5.exe  Section        024c \BaseNamedObjects\C:_Documents and Settings_User1_Local Settings_History_History.IE5_index.dat_589824
00000128 Homesite5.exe  Mutant         0254 \BaseNamedObjects\WininetStartupMutex
00000128 Homesite5.exe  Section        0258 \BaseNamedObjects\C:_Documents and Settings_User1_Cookies_index.dat_49152
00000128 Homesite5.exe  Mutant         025c \BaseNamedObjects\WininetConnectionMutex
00000128 Homesite5.exe  Mutant         0264 \BaseNamedObjects\WininetProxyRegistryMutex
00000128 Homesite5.exe  Key            027c \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
00000128 Homesite5.exe  Key            0280 \REGISTRY\USER
00000128 Homesite5.exe  Mutant         0284 \BaseNamedObjects\ZonesCacheCounterMutex
00000128 Homesite5.exe  Mutant         0288 \BaseNamedObjects\ZonesCounterMutex
00000128 Homesite5.exe  File           028c \WINDOWS\system32\shdocvw.dll
00000128 Homesite5.exe  Key            0294 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003
00000128 Homesite5.exe  File           02a4 \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805
00000128 Homesite5.exe  File           02a8 \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805
00000128 Homesite5.exe  Section        02ac \BaseNamedObjects\UrlZonesSM_User1
00000128 Homesite5.exe  Key            02b4 \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
00000128 Homesite5.exe  File           02b8 \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805
00000128 Homesite5.exe  Key            02bc \REGISTRY\USER\S-1-5-21-73586283-1343024091-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
00000128 Homesite5.exe  Mutant         0338 \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-73586283-1343024091-1060284298-1003
00000128 Homesite5.exe  Section        033c \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-73586283-1343024091-1060284298-1003
00000128 Homesite5.exe  Mutant         0340 \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-73586283-1343024091-1060284298-1003
00000128 Homesite5.exe  Mutant         0344 \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-73586283-1343024091-1060284298-1003
00000128 Homesite5.exe  Mutant         0348 \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-73586283-1343024091-1060284298-1003
00000128 Homesite5.exe  Mutant         034c \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-73586283-1343024091-1060284298-1003
00000128 Homesite5.exe  Key            0354 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
00000128 Homesite5.exe  Key            0374 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
00000128 Homesite5.exe  Key            0378 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
00000128 Homesite5.exe  File           0388 \WINDOWS\system32\mshtml.tlb
00000128 Homesite5.exe  Section        03bc \BaseNamedObjects\C:_Documents and Settings_User1_Local Settings_History_History.IE5_MSHist012003010220030103_index.dat_32768
00000128 Homesite5.exe  File           03c0 \DOCUME~1\EVEGOR~1\LOCALS~1\Temp
00000128 Homesite5.exe  Mutant         0414 \BaseNamedObjects\_!SHMSFTHISTORY!_
00000128 Homesite5.exe  Section        0418 \BaseNamedObjects\MSIMGSIZECacheMap
00000128 Homesite5.exe  Key            0424 \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type
00000128 Homesite5.exe  Key            0428 \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type
00000128 Homesite5.exe  Event          042c \BaseNamedObjects\mixercallback
00000128 Homesite5.exe  Section        0438 \BaseNamedObjects\mmGlobalPnpInfo
00000128 Homesite5.exe  Event          043c \BaseNamedObjects\hardwaremixercallback
00000128 Homesite5.exe  File           0444 \{9B365890-165F-11D0-A195-0020AFD156E4}
00000128 Homesite5.exe  Section        0448 \BaseNamedObjects\WDMAUD_Path_Size
00000128 Homesite5.exe  Section        044c \BaseNamedObjects\WDMAUD_Callbacks
00000128 Homesite5.exe  Mutant         0454 \BaseNamedObjects\MidiMapper_Configure
00000128 Homesite5.exe  Mutant         0460 \BaseNamedObjects\MidiMapper_modLongMessage_RefCnt

Example 2: List All Opened Windows with Summary Information

If you want to list all open windows on your computer, including both named and unnamed ones, type the following at the command line:

oh /s /a

Press ENTER. Output similar to the following is displayed:

Expand to see OH output.

//
// TIME: 2003-01-02 19:31
// MACHINE: USER1
// BUILD: 2600
// OH version:  (Lab03_DEV.021126-1716)
//
//
00000004 System         Process        0004
00000004 System         Thread         0008
00000004 System         Key            000c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Memory Management\PrefetchParameters
00000004 System         Key            0010 \REGISTRY
00000004 System         Key            0014 \REGISTRY\MACHINE\SYSTEM\Setup
00000004 System         Key            0018 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter
00000004 System         Key            001c \REGISTRY\MACHINE\SYSTEM\WPA\Key-G4XTBRDJMGP7G4WJTJK48
00000004 System         Key            0020 \REGISTRY\MACHINE\SYSTEM\WPA\MediaCenter
00000004 System         Key            0024 \REGISTRY\MACHINE\SYSTEM\WPA\PnP
00000004 System         Key            0028 \REGISTRY\MACHINE\SYSTEM\WPA\SigningHash-XKDVQR6363B4W3
00000004 System         Key            002c \REGISTRY\MACHINE\SYSTEM\WPA\SigningHash-XKRMQ9D4WDJPKK
00000004 System         Key            0030 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ProductOptions
00000004 System         Key            0034 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog
00000004 System         Event          0038 \Security\TRKWKS_EVENT
00000004 System         File           0080 \PAGEFILE.SYS
00000004 System         Directory      0088 \Device\WinDfs
00000004 System         Thread         008c
00000004 System         Event          0090 \Device\DmControl\VxKernel2VoldEvent
00000004 System         Thread         009c
00000004 System         Directory      00b4 \Device\Harddisk0
00000004 System         Directory      00b8 \Device\Harddisk1
00000004 System         Process        0464
00000004 System         File           0468
00000004 System         Event          0478 \LanmanServerAnnounceEvent
00000004 System         Port           047c \SeRmCommandPort
00000004 System         File           0490
00000004 System         File           0494
00000004 System         File           0498
00000004 System         File           049c
00000004 System         File           04a0
00000004 System         Thread         04a8
00000004 System         Key            04d8 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&13\Device Parameters
00000004 System         Key            04dc \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&13\Device Parameters
00000004 System         Key            04e0 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\USB\ROOT_HUB\4&8667fc7&0\Device Parameters
00000004 System         Key            04e8 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&13\Device Parameters
00000004 System         Key            04ec \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&13\Device Parameters
00000004 System         Key            04f0 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            04f8 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            04fc \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&13\Device Parameters
00000004 System         Thread         0500
00000004 System         Key            0504 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&12\Device Parameters
00000004 System         Key            0508 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            050c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
00000004 System         Key            0510 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&13\Device Parameters
00000004 System         Key            0514 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&12\Device Parameters
00000004 System         Key            0518 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&12\Device Parameters
00000004 System         Key            051c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&12\Device Parameters
00000004 System         Key            0520 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_1039&DEV_7001&SUBSYS_0A141019&REV_07\3&61aaa01&0&12\Device Parameters
00000004 System         Key            0524

Example 3: Compare OH Output to Find Leaks

You want to determine if your system has any leaks in it. First you need to generate an initial log. Then, after using your computer, you generate a final log. Finally, you want to compare the two output files. To generate the initial log file, type the following at the command line:

oh /o default.txt

Press ENTER. Output similar to the following is stored in Default.txt in the current directory:

Expand to see OH output file Default.txt:

//
// TIME: 2003-01-10 11:50
// MACHINE: user1-DEV2
// BUILD: 3663
// OH version:  (dnsrv.021205-1823)
//
//
00000004 System         Key            000c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Memory Management\PrefetchParameters
00000004 System         Key            0010 \REGISTRY
00000004 System         Key            0014 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Executive
00000004 System         Key            0018 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter
00000004 System         Key            001c \REGISTRY\MACHINE\SYSTEM\WPA\Key-TJYCM2CJX7CX928T7GJ7R
00000004 System         Key            0020 \REGISTRY\MACHINE\SYSTEM\WPA\Key-DPVRFTG833Y3HYRFYHGQ6
00000004 System         Key            0024 \REGISTRY\MACHINE\SYSTEM\WPA\PnP
00000004 System         Key            0028 \REGISTRY\MACHINE\SYSTEM\WPA\SigningHash-BQTJFPR7F6HFHW
00000004 System         Key            002c \REGISTRY\MACHINE\SYSTEM\WPA\SigningHash-Q8BYBWYR6D8B32
00000004 System         Key            0030 \REGISTRY\MACHINE\SYSTEM\WPA\SigningHash-YQ7CVB73Q6DVT4
00000004 System         Key            0034 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ProductOptions
00000004 System         Key            0038 \REGISTRY\MACHINE\SYSTEM\Setup
00000004 System         Key            003c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog
00000004 System         Event          0040 \Security\TRKWKS_EVENT
00000004 System         Key            0044 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter
00000004 System         Event          00a0 \Device\DmControl\VxKernel2VoldEvent
00000004 System         Key            00a8 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1
00000004 System         Event          00ac \Device\DmControl\ReSyncKernelEvent
00000004 System         Key            00b4 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0
00000004 System         Key            00bc \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Initiator Id 7
00000004 System         Key            00c0 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi
00000004 System         Key            00c4 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0
00000004 System         Key            00c8 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0
00000004 System         Directory      00d0 \Device\WinDfs
00000004 System         Directory      00e0 \Device\Harddisk0
00000004 System         File           0184 \Documents and Settings\LocalService\NTUSER.DAT
00000004 System         File           0188 \Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           018c \Documents and Settings\NetworkService\NTUSER.DAT
00000004 System         File           0190 \Documents and Settings\NetworkService\ntuser.dat.LOG
00000004 System         File           0194 \Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         File           0198 \Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           01a0 \Documents and Settings\LocalService\ntuser.dat.LOG
00000004 System         File           01ac \Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         Event          0238 \BaseNamedObjects\StuckThreadEvent
00000004 System         Key            026c

When you are ready to run the final log file, type the following at the command line:

oh /o default2.txt

Press ENTER. Output similar to the following is stored in Default2.txt:

Expand to see OH output file Default2.txt.

//
// TIME: 2003-01-10 12:06
// MACHINE: user1-DEV2
// BUILD: 3663
// OH version:  (dnsrv.021205-1823)
//
//
00000004 System         Key            000c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Memory Management\PrefetchParameters
00000004 System         Key            0010 \REGISTRY
00000004 System         Key            0014 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Executive
00000004 System         Key            0018 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter
00000004 System         Key            001c \REGISTRY\MACHINE\SYSTEM\WPA\Key-TJYCM2CJX7CX928T7GJ7R
00000004 System         Key            0020 \REGISTRY\MACHINE\SYSTEM\WPA\Key-DPVRFTG833Y3HYRFYHGQ6
00000004 System         Key            0024 \REGISTRY\MACHINE\SYSTEM\WPA\PnP
00000004 System         Key            0028 \REGISTRY\MACHINE\SYSTEM\WPA\SigningHash-BQTJFPR7F6HFHW
00000004 System         Key            002c \REGISTRY\MACHINE\SYSTEM\WPA\SigningHash-Q8BYBWYR6D8B32
00000004 System         Key            0030 \REGISTRY\MACHINE\SYSTEM\WPA\SigningHash-YQ7CVB73Q6DVT4
00000004 System         Key            0034 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ProductOptions
00000004 System         Key            0038 \REGISTRY\MACHINE\SYSTEM\Setup
00000004 System         Key            003c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog
00000004 System         Event          0040 \Security\TRKWKS_EVENT
00000004 System         Key            0044 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter
00000004 System         Event          00a0 \Device\DmControl\VxKernel2VoldEvent
00000004 System         Key            00a8 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1
00000004 System         Event          00ac \Device\DmControl\ReSyncKernelEvent
00000004 System         Key            00b4 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0
00000004 System         Key            00bc \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Initiator Id 7
00000004 System         Key            00c0 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi
00000004 System         Key            00c4 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0
00000004 System         Key            00c8 \REGISTRY\MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0
00000004 System         Directory      00d0 \Device\WinDfs
00000004 System         Directory      00e0 \Device\Harddisk0
00000004 System         File           0100 \{9B365890-165F-11D0-A195-0020AFD156E4}
00000004 System         File           0128 \PersonalFiles\OutlookFiles\personal-folders.pst
00000004 System         File           0184 \Documents and Settings\LocalService\NTUSER.DAT
00000004 System         File           0188 \Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
00000004 System         File           018c \Documents and Settings\NetworkService\NTUSER.DAT
00000004 System         File           0190 \Documents and  \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_8086&DEV_2442&SUBSYS_00D81028&REV_04\3&172e68dd&0&FA\Device Parameters
00000004 System         Key            0654 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter
00000004 System         Key            0658 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter
00000004 System         Key            065c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\PCI\VEN_8086&DEV_2442&SUBSYS_00D81028&REV_04\3&172e68dd&0&FA\Device Parameters
00000004 System         Key            0660 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0001
00000004 System         Key            0664 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Video\{5790B36E-8ABF-43AC-81F7-C88D68265247}\0000\VolatileSettings
00000004 System         File           0668 \Documents and Settings\user1\ntuser.dat.LOG
00000004 System         File           069c {146F1A80-4791-11D0-A5D6-28DB04C10000}\
00000004 System         File           06d8 \47
00000004 System         File           070c \Topology
00000004 System         File           0738 \Documents and Settings\user1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
00000004 System         Key            0774 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Video\{5790B36E-8ABF-43AC-81F7-C88D68265247}\0001\VolatileSettings
00000004 System         Key            077c \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0001
00000004 System         Key            0780 \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0001
00000004 System         Key            0784

To compare the output in the two files, type the following at the command line:

oh /c /l default.txt default2.txt

Press ENTER. Output similar to the following is stored in Def12.txt:

Expand to see OH output file Def12.txt.

//
// Possible leaks (DELTA <PROCESS/PID/TYPE/VALUE>::NAME):
//
// Note that the NAME can appear as `(TRACEID) NAME' if output
// is generated by comparing OH files containing traces. In this case
// just search in the `AFTER' OH log file for the trace id to
// find the stack trace creating the handle possibly leaked.
//
//

1	<oh.exe/00000B48/KeyedEvent/07fc>::\KernelObjects\CritSecOutOfMemoryEvent
1	<oh.exe/00000B48/Directory/07f4>::\KnownDlls
1	<oh.exe/00000B48/File/07f0>::\Documents and Settings\user1
1	<oh.exe/00000B48/Key/07e8>::\REGISTRY\MACHINE
1	<oh.exe/00000B48/WindowStation/07dc>::\Windows\WindowStations\WinSta0
1	<oh.exe/00000B48/File/07d8>::\Documents and Settings\user1\default2.txt
1	<oh.exe/00000B48/Mutant/0010>::\NlsCacheMutant
1	<notepad.exe/000004AC/File/0050>::\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B
1	<notepad.exe/000004AC/File/004c>::\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B
1	<notepad.exe/000004AC/Key/0048>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441
1	<notepad.exe/000004AC/Key/003c>::\REGISTRY\MACHINE
1	<notepad.exe/000004AC/WindowStation/0038>::\Windows\WindowStations\WinSta0
1	<notepad.exe/000004AC/Desktop/0034>::\Default
1	<notepad.exe/000004AC/WindowStation/0030>::\Windows\WindowStations\WinSta0
1	<notepad.exe/000004AC/File/0024>::\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B
1	<notepad.exe/000004AC/Mutant/001c>::\NlsCacheMutant
1	<notepad.exe/000004AC/File/0018>::\Documents and Settings\user1
1	<notepad.exe/000004AC/Directory/0014>::\KnownDlls
1	<notepad.exe/000004AC/KeyedEvent/0004>::\KernelObjects\CritSecOutOfMemoryEvent
1	<cmd.exe/00000420/Key/005c>::\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups
1	<cmd.exe/00000420/Key/0058>::\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
1	<cmd.exe/00000420/Key/0054>::\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale
1	<cmd.exe/00000420/Key/0050>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441
1	<cmd.exe/00000420/Key/0044>::\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
1	<cmd.exe/00000420/Desktop/0038>::\Default
1	<cmd.exe/00000420/WindowStation/0034>::\Windows\WindowStations\WinSta0
1	<cmd.exe/00000420/WindowStation/0028>::\Windows\WindowStations\WinSta0
1	<cmd.exe/00000420/Key/0020>::\REGISTRY\MACHINE
1	<cmd.exe/00000420/Mutant/0014>::\NlsCacheMutant
1	<cmd.exe/00000420/File/0010>::\Documents and Settings\user1
1	<cmd.exe/00000420/Directory/000c>::\KnownDlls
1	<cmd.exe/00000420/KeyedEvent/0004>::\KernelObjects\CritSecOutOfMemoryEvent
1	<devenv.exe/00000964/File/01f0>::\lsarpc
1	<devenv.exe/00000964/Section/0100>::\BaseNamedObjects\RotHintTable
1	<cmd.exe/00000F7C/File/0064>::\

//
// Handle types (DELTA <PROCESS/PID/TYPE/VALUE>):
//
// DELTA is the additional number of handles found in the `AFTER' log.
// PROCESS is the process name having a handle increase.
// PID is the process PID having a handle increase.
// TYPE is the type of the handle
// VALUE is the handle value
//
//

1	<IEXPLORE.EXE/00000B88/File/0654>
1	<IEXPLORE.EXE/00000B88/File/06e4>
1	<IEXPLORE.EXE/00000B88/File/0790>
1	<IEXPLORE.EXE/00000B88/File/081c>
1	<IEXPLORE.EXE/00000B88/File/083c>
1	<IEXPLORE.EXE/00000B88/File/0884>
1	<IEXPLORE.EXE/00000B88/Key/0378>
1	<IEXPLORE.EXE/00000B88/Key/037c>
1	<IEXPLORE.EXE/00000B88/Key/03c0>
1	<IEXPLORE.EXE/00000B88/Key/03d0>
1	<IEXPLORE.EXE/00000B88/Key/03d4>
1	<IEXPLORE.EXE/00000B88/Key/0424>
1	<IEXPLORE.EXE/00000B88/Key/0538>
1	<IEXPLORE.EXE/00000B88/Key/0598>
1	<IEXPLORE.EXE/00000B88/Key/06d8>
1	<IEXPLORE.EXE/00000B88/Key/06fc>
1	<IEXPLORE.EXE/00000B88/Key/077c>
1	<IEXPLORE.EXE/00000B88/Key/07e4>
1	<IEXPLORE.EXE/00000B88/Key/0838>
1	<IEXPLORE.EXE/00000B88/Key/08c0>
1	<IEXPLORE.EXE/00000B88/Key/08e4>
1	<IEXPLORE.EXE/00000B88/Key/08f0>
1	<IEXPLORE.EXE/00000B88/Mutant/0794>
1	<IEXPLORE.EXE/00000B88/Section/079c>
1	<OUTLOOK.EXE/00000BF0/File/04e8>
1	<OUTLOOK.EXE/00000BF0/File/0998>
1	<OUTLOOK.EXE/00000BF0/Key/00e0>
1	<OUTLOOK.EXE/00000BF0/Key/06d0>
1	<OUTLOOK.EXE/00000BF0/Key/0908>
1	<OUTLOOK.EXE/00000BF0/Key/0924>
1	<OUTLOOK.EXE/00000BF0/Key/09d0>
1	<System/00000004/File/0100>
1	<System/00000004/File/0128>
1	<System/00000004/File/069c>
1	<System/00000004/File/0a10>
1	<System/00000004/File/0ad4>
1	<System/00000004/File/0ef0>

//
// Objects (named and anonymous) (DELTA <PROCESS/PID/TYPE/VALUE>::NAME):
//
// DELTA is the additional number of handles found in the `AFTER' log.
// PROCESS is the process name having a handle increase.
// PID is the process PID having a handle increase.
// TYPE is the type of the handle
// NAME is the name of the handle. Anonymous handles appear with name <<noname>>.
// VALUE is the handle value
//
// Note that the NAME can appear as `(TRACEID) NAME' if output
// is generated by comparing OH files containing traces. In this case
// just search in the `AFTER' OH log file for the trace id to
// find the stack trace creating the handle possibly leaked.
//
//

1	<IEXPLORE.EXE/00000B88/File/0654>::\Endpoint
1	<IEXPLORE.EXE/00000B88/File/06e4>::\Endpoint
1	<IEXPLORE.EXE/00000B88/File/0790>::\Documents and Settings\user1\Local Settings\History\History.IE5\MSHist012003011020030111\index.dat
1	<IEXPLORE.EXE/00000B88/File/081c>::\Endpoint
1	<IEXPLORE.EXE/00000B88/File/083c>::\Documents and Settings\user1\Local Settings\Temporary Internet Files\Content.IE5\FJCC7ERE\Popup113[1].jsp
1	<IEXPLORE.EXE/00000B88/File/0884>::\Endpoint
1	<IEXPLORE.EXE/00000B88/File/08cc>::\lsarpc
1	<IEXPLORE.EXE/00000B88/Key/0378>::\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
1	<IEXPLORE.EXE/00000B88/Key/037c>::\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
1	<IEXPLORE.EXE/00000B88/Key/03c0>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
1	<IEXPLORE.EXE/00000B88/Key/03d0>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
1	<IEXPLORE.EXE/00000B88/Key/03d4>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
1	<IEXPLORE.EXE/00000B88/Key/0424>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441\Software\Microsoft\Internet Explorer\TypedURLs
1	<IEXPLORE.EXE/00000B88/Key/0538>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441\Software\Microsoft\Internet Explorer\Security\P3Global
1	<IEXPLORE.EXE/00000B88/Key/0598>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441_CLASSES
1	<IEXPLORE.EXE/00000B88/Key/06b4>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441_CLASSES
1	<IEXPLORE.EXE/00000B88/Key/06d8>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441
1	<IEXPLORE.EXE/00000B88/Key/06fc>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441_CLASSES
1		<svchost.exe/00000368/Key/05ac>::\REGISTRY\USER\S-1-5-21-397955417-626881126-188441444-2956441_CLASSES
1	<svchost.exe/000003A0/File/0168>::\lsarpc
1	<svchost.exe/00000428/Key/1378>::\REGISTRY\MACHINE\SOFTWARE\Classes

Investigate the processes listed at the top of the file for possible leaks.


OH Remarks

Preparing to Use OH

You must enable the kernel mode stack traces flag before using the /h parameter. You must enable the object type list flag before using any OH parameters.

To enable the kernel mode stack traces flag:

  1. Type the following at the command line:

    oh +kst

  2. Press ENTER.
  3. Reboot your computer. The flag will be enabled after your computer has been rebooted.

To enable the object type list flag:

  1. Type the following at the command line:

    oh +otl

  2. Press ENTER.
  3. Reboot your computer. The flag will be enabled after your computer has been rebooted.

Using Traces in OH

If an OH file has been created with the /h parameter, it contains traces, and handle names will be printed as (TRACEID) NAME. In the case of a potential leak, search for the trace ID in the original OH file to find the stack trace.

Determining Process IDs

Use Tasklist to determine the process ID of the process you want to use with the /p parameter. Tasklist is a part of the Windows Server 2003 operating system.

Disabling OH Flags

If you are finished using OH, you can disable any flags you may have enabled.

To disable the kernel mode stack traces flag:

  1. Type the following at the command line:

    oh -kst

  2. Press ENTER.
  3. Reboot your computer. The flag will be disabled after your computer has been rebooted.

To disable the object type list flag:

  1. Type the following at the command line:

    oh -otl

  2. Press ENTER.
  3. Reboot your computer. The flag will be disabled after your computer has been rebooted.


OH Syntax

OH uses the following syntaxes:

One Step oh {+kst | -kst} {+otl | -otl}

One Step oh [/p [ProcessID [/h]]] [/t TypeName] [/o FileName] [/a] [/s] [/u] [/v] [Name] [/?]

One Step oh /c [/l] [/t] [/all] BeforeLog AfterLog

Parameters

+kst
Enables the kernel mode stack traces flag.

Note

  • The kernel mode stack traces flag must be enabled before the /h parameter can be used.
-kst
Disables the kernel mode stack traces flag.
+otl
Enables the object type list flag.

Note

  • The object type list flag must be enabled before you use any OH parameters (except those parameters that enable or disable flags).
-otl
Disables the object type list flag.
/p [ProcessID]
Displays open handles for the process with an ID of ProcessID. If ProcessID is omitted, OH performs a systemwide dump.
/t TypeName
Displays open named objects of the specified type. Examples include Key, File, Directory, Desktop, Semaphore, Mutant, Section, Event, and Thread.

Note

  • Use the /a parameter to display unnamed objects of the specified type.
/o FileName
Specifies the name of the file to which output is written.
/a
Includes objects with no name.
/s
Displays summary information.
/h
Displays stack traces for handles. This parameter must be used in conjunction with the /p parameter.

Note

  • The kernel mode stack traces flag must be enabled before the /h parameter can be used.
Name
Displays handles that contain the specified name.
/l
Sorts output based on increases and prints output in a separate initial section in decreasing order. If the /l parameter is not specified, OH sorts output by key name.
/t
Omits Trace ID if files contain traces.
/all
Reports decreases as well as increases.
/?
Displays command-line usage.

Note

  • When run without parameters, OH displays information about open handles in the system not specific to any process.


OLEView Examples

Overview | Remarks | UI | Examples | Related Tools Run Tool

Example 1: Activate a Remote Server in OLEView by Using CoGetClassObject

The task in this example is to use OLEView to activate a remote server named \\computer1 by using CoGetClassObject. To run OLEView, type the following at the command line:

oleview

Press ENTER. This opens the OLEView window.

To activate the remote server:

  1. On the View menu, select Expert Mode if it is not already selected.
  2. In the left pane, if the Object Classes folder is not expanded, double-click it.
  3. In the left pane, double-click COM Library Objects.
  4. In the left pane, right-click StdOleLink, and then click Create Instance On on the shortcut menu.
  5. In the Connect To Another Machine window, in the Machine Name box, type:
    \\computer1
    and then click OK.

Example 2: Activate a Remote Server in OLEView by Using a File Moniker

The task in this example is to use OLEView to activate a remote server named \\computer1 by using a file moniker bind to the Mydoc.doc file and ActivateAtStorage. To run OLEView, type the following at the command line:

oleview

Press ENTER. This opens the OLEView window.

To activate the remote server by using a bind:

  1. On the File menu, click Bind To File.
  2. In the Open window, in the File name box, type:
    \\computer1\docs\mydoc.doc
    and then click OK.


OLEView Remarks

Overview | Remarks | UI | Examples | Related Tools Run Tool

Using OLEView

You can use OLEView to complete the following tasks:

  • Browse, in a structured way, all of the COM classes installed on your computer.
  • View the registry entries for each class in an easy-to-read format.
  • Configure any COM class on your system. This includes DCOM activation and security settings.
  • Configure systemwide COM settings, including enabling or disabling DCOM.
  • Test any COM class simply by double-clicking its name. The list of interfaces that class supports will be displayed. Double-clicking an interface entry allows you to invoke a viewer that will run that interface.
  • Activate COM classes locally or remotely. This is helpful for testing DCOM setups.
  • View type library contents. Use this to figure out what methods, properties, and events an ActiveX control supports.
  • Copy a properly formatted OBJECT tag to the Clipboard so you can insert it into an HTML document.

Reading and Writing Component Category Information

One of the required files for OLEView is Comcat.dll, which is installed with Windows Server 2003. Applications use this DLL to read and write component category information to and from the registry. OLEView uses Comcat.dll to list the installed components on a system by category.

Understanding OLEView Interface Viewers

COM Objects

In OLEView, interface viewers are COM objects. OLEView provides viewers for the following COM objects:

  • IDataObject (Uniform Data Transfer)
  • IDispatch
  • IPersistXXX
  • ITypeLib
  • ITypeInfo

There is a default interface viewer for IUnknown, so that no matter what interface you click, you get at least the default. OLEView accomplishes this by using the default class capabilities of component categories.

Type Library Decompilers

The ITypeLib viewer is a type library decompiler. Its output shows the Object Description Language (ODL) source for the given type library (or the part you have selected).

Plug-In Interfaces

OLEView supports plug-in interface viewers. If you design a COM interface, or would like to use an existing interface, you can create your own interface viewers (see the interface definition libraries (IDL) file for the IInterfaceViewer interface). Create an in-process COM server that implements the IInterfaceViewer interface, and then have it register the following information:

HKCR\Interface\{the IID you want to view}\OleViewerIViewerCLSID = {your clsid}

Note

  • IID, an interface identifier, is a 128-bit number that uniquely identifies the interface.

Use the Component Category Manager to register your viewer's CLSID by implementing the OLEViewer Interface Viewer CATID: {64454F82-F827-11CE-9059-080036F12502}.

Activating a Remote Server in OLEView

You can activate remote servers from within OLEView in either of two ways.

  • Use CoGetClassObject:
    1. Right-click an object in the left pane of the OLEView window.
    2. Click Create Instance On on the shortcut menu, and enter a computer name. For example, to activate an object on \\computer1, type:
      computer1
      and then press OK.
  • Use a file moniker bind and ActivateAtStorage:
    1. On the File menu, click Bind To File.
    2. Specify the Universal Naming Convention (UNC) name of the file you want to bind to. For example, type:
      \\computer1\docs\any.doc

      3. Or, you can specify a moniker display name on the command line.

Viewing the Contents of the IDL for IInterfaceViewer

This section contains the interface definition libraries (IDL) for OLEView interface viewers. The include file, Iview.h, can be used to import the interface definition into your own project.

// iview.idl
//
// Interface definitions for Ole2View Interface Viewers
//
import "unknwn.idl";

// DEFINE_GUID(IID_IInterfaceViewer,0xfc37e5ba,0x4a8e,0x11ce, 0x87,0x0b,0x08,0x00,0x36,0x8d,0x23,0x02);
//
// IInterfaceViewer::View can return the following SCODEs
//
// S_OK
// E_INVALIDARG
// E_UNEXPECTED
// E_OUTOFMEMORY
//
[
    uuid(fc37e5ba-4a8e-11ce-870b-0800368d2302),
    object
]
interface IInterfaceViewer : IUnknown
{
    HRESULT View([in]HWND hwndParent, [in]REFIID riid, [in]IUnknown* PointerToIUnknownObject);
}


OLEView UI

Overview | Remarks | UI | Examples | Related Tools Run Tool

OLEView displays the registry entries for each class in one window, called the OLE/COM Object Viewer window. From this window you can manage all COM objects on your computer by using the following UI:

  • File menus. Click the File, Object, View, or Help menus to see available commands.
  • Toolbar. Click a button on the toolbar underneath the file menus to perform a task with one click.
  • Shortcut menus in the left pane. Right-click an object in the left pane to see its shortcut menu.
  • Tabs in the right pane. After selecting an object in the left pane, click the Registry, Implementation, Activation, Launch Permissions, or Access Permissions tab to perform a related task.

File Menus

The following menus are available in the OLEView window.

  • File Menu

    The following commands are always available, no matter what object is selected in the OLEView window:

    • Bind to File. Opens a window to select a file containing an embedded object. Use this command to identify a file that is a container for OLE objects.
    • View TypeLib. Opens a window to select a type library file. Use this command to view the contents of a type library file. You can select files with the following extensions:
      • .tlb
      • .olb
      • .dld
      • .ocx
      • .exe
    • System Configuration. Opens the System Configuration window. Use this command to perform the following tasks:
      • Enable/disable DCOM.
      • Enable/disable remote connections (Windows 95 only).
      • Modify which users or groups have default launch permissions.
      • Modify which users or groups have default access permissions.
    • Run the Registry Editor. Opens Registry Editor. Use this command to view or edit registry entries.
    • Exit. Closes the OLEView window.

  • Object Menu

    The following commands are available, depending on the type of item selected in the left pane:

    • CoCreateInstance Flags. Displays a submenu of flags that you can set. Use this command to view which flags are set, and to set or remove the flags. This command is always available. The following flags are displayed:
      • CLSCTX_INPROC_SERVER
      • CLSCTX_INPROC_HANDLER
      • CLSCTX_LOCAL_SERVER
      • CLSCTX_REMOTE_SERVER
    • View Type Information. This command is never available.
    • Create Instance. Creates an instance of an OLE 1.0 object or a COM library object.
    • Create Instance On. Opens the Connect to Another Machine window. Use this command to create an instance of an OLE 1.0 object or a COM library object on another computer.
    • Release Instance. Releases the currently selected object instance. This command is only available to an OLE 1.0 object or COM library objects that have an instance running.
    • Copy CLSID to Clipboard. Copies to the Clipboard the CLSID, a globally unique identifier that refers to component object classes. This command is always available. For example, the CLSID looks like the following when pasted into Notepad:

      {0000031D-0000-0000-C000-000000000046}

    • Copy HTML <object> Tag to Clipboard. Copies the class OBJECT tag to the Clipboard. This option is only available to COM object classes, OLE 1.0 objects, and COM library objects. For example, the OBJECT tag looks like the following when pasted into Notepad:

      <object classid="clsid:0000031D-0000-0000-C000-000000000046" > </object>

    • View. Opens the following windows to view more information:
      • Default Interface Viewer. For object class interfaces, use this window to view the Interface Name and IID.
      • ITypeLib Viewer. For type libraries, use this window to view the contents of the file.

  • View Menu

    The following commands are always available, no matter what type of item is selected in the left pane:

    • Expert Mode. Changes how items are displayed in the left pane. Use this command to turn Expert Mode on or off and change the views accordingly.
      • Expert Mode On. Displays items in the left pane by component category and according to their type: Object Classes, Application ID's, Type Libraries, and Interfaces.
      • Expert Mode Off. Displays items in the left pane by component category only.
    • Hidden Component Categories. Changes how hidden classes are displayed. Use this command to turn on or off the display of hidden categories.
    • Toolbar. The toolbar displays six command buttons for Bind to File, View TypeLib, Run RegEdit, Create Instance, Release Instance, and View. Use this command to turn on or off the display of the toolbar.
    • Status Bar. The status bar displays messages at the bottom of the window about the status of an action, or provides textual help about menu items. Use this command to turn on or off the display of the status bar in the bottom of the window.
    • Refresh. Searches your computer for new COM objects, updates the list in the OLEView window, and resets the display. Use this command to check for new COM objects and display them in the OLEView window.

  • Help Menu

    The following command is always available, no matter what type of item is selected in the left pane:

    • About OLEViewer. Displays the About OLE/COM Object Viewer window. Use this command to view the version of OLEView you are running, end-user license information, and the amount of physical memory available to Windows.

Toolbar

Displays six command buttons to complete one of the following tasks:

  • Bind to File
  • View TypeLib
  • Run RegEdit
  • Create Instance
  • Release Instance
  • View

All commands on the toolbar can also be accessed from the file menus. The availability of commands on the toolbar follow the same guidelines as when a command is available on a file menu. For more information about a command or when it is available, see its description in File Menus in this topic.

You can turn the toolbar on or off by clicking the Toolbar command on the View menu.

Shortcut Menus

You can access the same tasks available from the file menus and the toolbar by right-clicking an object in the left pane. This displays a shortcut menu, which lists the appropriate actions for the selected item.

All commands on the shortcut menu can also be accessed from the file menus. The availability of commands on the shortcut menu follow the same guidelines as when a command is available on a file menu. For more information about a command or when it is available, see its description in File Menus in this topic.

Tabs in the Right Pane

Depending on the item you selected in the left pane, the right pane is populated with a tabbed window. The tabbed window allows you to perform additional actions on the item. Some of these actions are not listed in the file menus, the toolbar, or the shortcut menus. The following table lists the tabs, the actions available on the tab, and which items display the tab.

Tab Actions Available on the Tab Items That Display the Tab
Registry View registry information only.

Viewing registry information is available from the file menus, the toolbar, and the shortcut menus.

  • OLE 1.0 Objects
  • COM Library Objects
  • Application ID's
  • Type Libraries
  • Interfaces
Implementation

The following actions are not available from the file menus, the toolbar, or the shortcut menus.

  • Select a new class.
  • Set the Application ID.
  • For the Inproc Server, specify the path to the implementation.
  • For the Inproc Server implementation, specify if this is a Java class.
  • For the Inproc Server implementation, select a threading model.
  • For the Inproc Server, specify that a surrogate process should be used.
  • For the Inproc Server surrogate process, specify the path.
  • For the Local Server, specify the path to the implementation.
  • For the Inproc Handler, specify the path to the implementation.
  • For the Inproc Handler implementation, select a threading model.
  • OLE 1.0 Objects
  • COM Library Objects
Activation

The following actions are not available from the file menus, the toolbar, or the shortcut menus.

  • Enable At Storage activation.
  • Launch the item as an inactive user.
  • Activate a remote computer name.
  • OLE 1.0 Objects
  • COM Library Objects
Launch Permissions

The following actions are available on the File menu when you select System Configuration.

  • Use default launch permissions.
  • Modify custom launch permissions.
  • OLE 1.0 Objects
  • COM Library Objects
Access Permissions

The following actions are available on the File menu when you select System Configuration.

  • Use default activation permissions.
  • Modify custom activation permissions.
  • OLE 1.0 Objects
  • COM Library Objects


PathMan Examples

Example 1: Add Paths to the Current Path

The task in this example is to add three paths to the user path if they do not already exist in the path statement. Type the following at the command line:

pathman /au c:\temp;c:\users\name;d:\utils

Press ENTER.

The /au parameter tells PathMan that the set of semicolon-separated paths should be added to the current user path. All three paths (c:\temp, c:\users\name, and d:\utils) will be added to the user path if they are not already in it.

Example 2: Modify System and User Paths

The task in this example is to add three paths to the user path if they do not already exist in the path statement, remove a path from the user path, and add two paths to the system path. Type the following at the command line:

pathman /au c:\temp;c:\users\name;d:\utils /ru d:\data /as d:\data;c:\reskit

Press ENTER.

This command adds c:\temp, c:\users\name, and d:\utils to the user path, and it removes d:\data from the user path. It also adds d:\data and c:\reskit to the system path.

Example 3: Add Paths to the User Path and Delete Paths from the System Path

The task in this example is to add two paths to the user path if they do not already exist, and remove %systemroot% from the system path. Type the following at the command line:

pathman /au c:\temp;c:\app\bin /rs %systemroot% /au c:\app2\bin

Press ENTER.


PathMan Remarks

Understanding PathMan vs. the Path Command

The Path command that ships with the Windows XP and Windows Server 2003 operating systems displays or sets the command path in the PATH environment variable. You can specify a full path by using the Path command, or you can specify a path name to append to the existing path.

PathMan allows you to both append and remove paths from the PATH environment variable.

Checking for Path Abnormalities

PathMan can handle many path abnormalities. These include the following cases:

  • Additional leading semicolons
  • Additional trailing semicolons
  • Multiple consecutive semicolons
  • Double path additions (added by using /au or /as)
  • Double path removal (removed by using /ru or /rs)
  • Addition and removal of the same path (results in removal)
  • Addition of an already existing path
  • Removal of a nonexistent path

PathMan does not, however, check the validity of new paths.

Understanding PathMan Return Values

In order to return status information for each of the four possible parameters it accepts as arguments, PathMan treats its return value as four separate 8-bit bytes instead of one 32-bit integer. Each of the four bytes in the return value indicates what action was taken with respect to each of the four parameters that PathMan accepts. The return value (wwxxyyzz) is described in the following table.

Byte | Description
4 (ww) | System path additions
3 (xx) | User path additions
2 (yy) | System path removals
1 (zz) | User path removals

The following table describes the return values that can be displayed in each byte.

Value | Description
0 | No changes were made.
1 | At least one change was made.
2 | An error has occurred. No changes were made.

For example, type the following at the command line:

pathman /au c:\temp;c:\users\name;d:\utils

Press ENTER. Assuming that no errors occurred, you might see the following return value:

0x00010000 (65536)

This means that there were no errors, and at least one of the paths was added to the user's path.

The following table shows possible return values for this command:
pathman /au c:\temp;c:\users\name;d:\utils /ru d:\data /as d:\data;c:\reskit

Return Value | Description
0x01010001 ( 16842753) | At least one path was added to the system path, at least one path was added to the user path, no paths were removed from the system path, and at least one path was removed from the user path.
0x02010001 ( 33619969) | An error occurred when the system path change was attempted, at least one path was added to the user path, no paths were removed from the system path, and at least one path was removed from the user path. The error in the first part of the return code probably indicates that the user did not have administrator privileges.

If PathMan is called with incorrect parameters, the return value looks like the following:

0x02020202 (33686018)


PathMan Syntax

PathMan uses the following general syntax:

One Step pathman [/as Path[;Path[Path ..]]] [/au Path[;Path[Path ..]]] [/rs Path[;Path[Path ..]]] [/ru Path[;Path[Path ..]]] [/?|/h\/help]

Parameters

/as
Adds the paths separated by semicolons to the system path.
/au
Adds the paths separated by semicolons to the user path.
/rs
Removes the paths separated by semicolons from the system path.
/ru
Removes the paths separated by semicolons from the user path.
Path
Specifies the path to add to, or remove from, the user path or system path.
/?
Displays command-line usage.
/h
Displays command-line usage.
/help
Displays command-line usage.

Note

  • When run without parameters, PathMan displays command-line usage.


PermCopy Examples

Example: Copy Share Permissions

In this example, the assumption is that your organization has files related to manufacturing processes and stores the files on a server named \\MFG, in a share named PROCESSES. You want to consolidate file servers, and you want to share those files from a server named \\PUBLICINFO, from a share named MFG-PROCESSES.

  1. Ensure that the source share has the correct permissions. For more information about how to set permissions, see Set permissions on a shared resource.
  2. Ensure that the destination share already exists. If it does not, then use another tool to create a folder, if necessary, and then share that folder with the name MFG-PROCESSES. For more information about how to share a folder, see Share a folder or drive. For example, if the folder you want to share already exists, and is located at C:\PUBLIC\MFG-PROC, and you want to share it as \\PUBLICINFO\MFG-PROCESSES, then type the following at the command line:

    net share mfg-processes=c:\public\mfg-proc

    Press ENTER. Output similar to the following is displayed:

    mfg-processes was shared successfully.
  3. Copy the files and folders from \\MFG\PROCESSES to \\PUBLICINFO\MFG-PROCESSES. You can use a graphical tool such as Windows Explorer, or a command-line tool such as Xcopy. If you use Xcopy, consider using the /o parameter to copy file permissions, and possibly the /x parameter to copy audit settings.
    • For more information about copying files with Windows Explorer, see Copy a file or folder.
    • For more information about copying files with Xcopy, see Xcopy.

    To copy all files and folders, including hidden files, from \\MFG\PROCESSES to \\PUBLICINFO\MFG-PROCESSES, and to retain all associated attributes, file permissions, and audit settings, type the following at the command line:

    xcopy \\MFG\PROCESSES \\PUBLICINFO\MFG-PROCESSES /e /h /k /o /x

    Press ENTER. Output similar to the following is displayed:

    150 File(s) copied.
  4. Copy share permissions using PermCopy. Type the following at the command line:

    permcopy \\MFG PROCESSES \\PUBLICINFO MFG-PROCESSES

    Press ENTER. Output similar to the following is displayed:

    The command completed successfully.


PermCopy Remarks

PermCopy Limitation

Do not copy permissions to an administrative share.

Copying permissions to an administrative share located on an x86-based computer causes Services.exe to stop. For more information about administrative shares, see Special shared resources.

What PermCopy Does

PermCopy copies share permissions (ACLs) from one share to another.

PermCopy cannot create a share on a destination server. Furthermore, PermCopy copies only the share permissions; it does not copy files, and it does not affect the permissions of shared files on either the source or destination share.

Using PermCopy

To copy share permissions using PermCopy:

  1. Confirm that the source share has the correct permissions. For more information about how to set permissions, see Set permissions on a shared resource.
  2. Ensure that the destination share already exists. If it does not, use another tool to create it. Tools with this capability include Windows Explorer and the Net share command.
  3. Ensure that the files and folders of the source share have been copied to the destination share. If they have not been copied, then use another tool to copy them. Tools with this capability include Windows Explorer and the Xcopy command.
  4. Use PermCopy to copy the share permissions of the source share to the destination share.

For a detailed example and specific instructions, see PermCopy Examples.


PermCopy Syntax

PermCopy uses the following syntax:

One Step permcopy \\SourceServer SourceShare \\DestinationServer DestinationShare

Parameters

\\SourceServer
Specifies the server that controls the source share.
SourceShare
Specifies the name of the source share.
\\DestinationServer
Specifies the server that controls the destination share.
DestinationShare
Specifies the name of the destination share.

Notes

  • PermCopy does not follow the Universal Naming Convention (UNC) standard, in which you specify the server name and share name together: \\ServerName\ShareName. Instead, PermCopy requires that you type a space character between the server name and the share name. If you do not type the space character, then PermCopy displays a syntax summary and does not copy share permissions.
  • The destination share must already exist. If the destination share does not exist, then PermCopy displays a network error and does not copy share permissions.


Perms Examples

Example: View Permissions for a File

To view the permissions granted by the ACE to rkt-harndom\administrator, type the following at the command line:

perms rkt-harndom\administrator "C:\Program Files\Windows Server 2003 Resource Kit\tmp"

Press ENTER. The following output is displayed:

C:\Program Files\Windows Server 2003 Resource Kit\tmp\         perms: #-------

This output means that another member of a group, of which rkt-harndom\administrator is a member, owns the file, but that rkt-harndom\administrator does not have access to the file.


Perms Remarks

Setting Permissions

NTFS is the primary Windows Server 2003 file system. Partitions formatted with NTFS can have their files and folders secured using NTFS permissions. You can set file permissions on files and folders that specify which groups and users have access to them, and what level of access is permitted. NTFS file and folder permissions apply both to users working at the computer where the file is stored and to users accessing the file over the network where the file is in a shared folder. You can also use file attributes (read-only, hidden, system) to limit file access.

Yet another feature for managing security is the use of inheritable permissions. The Security dialog box offers the option to Allow inheritable permissions from parent to propagate to this file object and it is enabled by default. This feature significantly reduces the time and input and output work required to change the permissions of many files and subfolders. For example, suppose a user wants to change the permissions on a tree consisting of several thousand files. With Windows NT 4.0, each file and folder needs to be individually changed. However, with subsequent releases of Windows, if the folders and files inherit permissions, they only need to be set for the top-level folder.

Note

  • The FAT16 and FAT32 file system are not recommended for most purposes because they lack the permissions feature.

To configure NTFS permissions on a file, folder, or NTFS volume, you must be a member of the Administrators group, have full control permission or be the owner of the file, folder, or volume. NTFS permissions must be explicitly applied to a file or folder to grant a user access to it. If a file has no permissions specified for a particular user or for the groups to which the user belongs, the user does not have access to the file.

When you assign permissions to an existing folder, all subfolders and files within the parent folder inherit, by default, the permissions assigned to the parent. When you create a new file or folder on an NTFS volume, the new file or folder automatically inherits the permissions assigned to its parent folder. If you assign a user or group permission on a folder, the user of group is granted, by default, read and execute, List Folder Contents, and Read permissions for the folder. You can then change these permissions to whatever kind of access you want the user or group to have. Similarly, if you assign a user or group permission on a file, the user or group is granted, by default, two permissions for the file: Read, and Execute and Read. You can change these permissions to whatever kind of access you want the user or group to have. When you assign a particular NTFS permission to a file or folder, you can either explicitly allow the permission to grant the user or group access to the object, or you can explicitly deny the permission to prevent the user or group from accessing it. For more information on permissions, see "File Systems" in Microsoft Windows 2000 Server Operations Guide in the Microsoft Windows 2000 Server Resource Kit (or see "File Systems (http://go.microsoft.com/fwlink/?LinkID=12636)" on the Web at http://www.microsoft.com/reskit).

Interpreting Access Masks in Perms Output

The following masks are used in Perms output:

Access Mask | Description
R | Read. Allows or denies the viewing of attributes of a file or folder, such as read-only and hidden. Attributes are defined by NTFS.
W | Write. Allows or denies changes to attributes of a file or folder, such as read-only or hidden. Attributes are defined by NTFS.
X | Execute. Allows or denies the running of program files (applies to files only).
D | Delete. Allows or denies deletion of a file or folder. If you do not have Delete permission on a file or folder, you can still delete it if you have been granted the Delete Subfolders and Files permission on the parent folder.
P | Change Permissions. Allows or denies changes to permissions for the file or folder, such as Full Control, Read, and Write.
O | Take Ownership. Allows or denies the taking of ownership of the file or folder. The owner of a file or folder can always change permissions on it, regardless of any existing permissions that protect the file or folder.
A | General All.
- | No Access.
* | The specified user is the owner of the file or directory.
# | A group the user is a member of owns the file or directory.
? | The access permissions of the user cannot be determined.


Perms Syntax

Perms uses the following syntax:

One Step perms [Domain\|Computer\]UserName [Path\]FileName [/i] [/s] [/?]

Parameters

Domain\|Computer\UserName
Specifies the name of user whose permissions are to be checked, in the Domain\Username or Computer\UserName or local UserName format.
[Path\]FileName
Specifies the path and name of a file or folder in any legal format, including the Universal Naming Convention (UNC)(\\) . You can use the * or ? wildcard characters.
/i
Indicates that the specified user is logged on interactively to the computer where the file or folder resides. If the /i parameter is omitted, Perms assumes that the user is a logged on over the network and is a member of the Network security group.
/s
Checks permissions on files in subdirectories.
/?
Displays command-line usage.


PFMon Examples

Example 1: Monitor an Existing Process

In this example, system performance slows down while a certain application is running. You want to determine the number of hard page faults this existing process is generating. First, use Task Manager to determine the process identifier (PID) of the existing process. Then type the following at the command line, replacing 1640 with the PID you found in Task Manager:

pfmon /h /p 1640

Press ENTER. Output similar to the following is displayed:

HARD: wdCommandDispatch+0x4fd1d : 307be774
HARD: 3018541a : 307d35ac
HARD: MsoFAddPruldepDependent+0x6b : 307a837c
HARD: MsoFAddPruldepDependent+0xdb : 307aab7c
HARD: 300fb83f : 30791030
HARD: 30136545 : 30794c60

HARD: wdCommandDispatch+0xa7c9a : 00125ac4
HARD: CoFreeAllLibraries+0x6861 : 03c99000

HARD: DsFreeNameResultW+0xa1e : 77bfe2fc
HARD: AccRewriteGetExplicitEntriesFromAcl+0x8370 : 69c07e00
HARD: CoFreeAllLibraries+0x6861 : 042c6000

                 Caused     78 faults had     75 Soft      6 Hard faulted VA's
           ntdll Caused     38 faults had     10 Soft      0 Hard faulted VA's
        advapi32 Caused      4 faults had      4 Soft      0 Hard faulted VA's
        kernel32 Caused      7 faults had      4 Soft      0 Hard faulted VA's
          rpcrt4 Caused      0 faults had      0 Soft      0 Hard faulted VA's
           gdi32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
          user32 Caused      8 faults had      6 Soft      0 Hard faulted VA's
                 Caused     45 faults had     16 Soft      0 Hard faulted VA's
           ole32 Caused     83 faults had      8 Soft      0 Hard faulted VA's
         shell32 Caused      4 faults had      0 Soft      0 Hard faulted VA's
         shlwapi Caused      4 faults had      0 Soft      0 Hard faulted VA's
        comctl32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        winspool Caused      0 faults had      0 Soft      0 Hard faulted VA's
         clbcatq Caused      1 faults had      1 Soft      0 Hard faulted VA's
        oleaut32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      2 faults had      1 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        MSVBVM60 Caused     10 faults had     10 Soft      0 Hard faulted VA's
             msi Caused      3 faults had      3 Soft      0 Hard faulted VA's
        MSAddnDr Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
         version Caused      0 faults had      0 Soft      0 Hard faulted VA's
            lz32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
           cscui Caused      0 faults had      0 Soft      0 Hard faulted VA's
          cscdll Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      2 faults had      2 Soft      0 Hard faulted VA's
        AgentMpx Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      1 faults had      1 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        linkinfo Caused      0 faults had      0 Soft      0 Hard faulted VA's
         ntshrui Caused      0 faults had      0 Soft      0 Hard faulted VA's
                 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        netapi32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
         secur32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
          NetRap Caused      0 faults had      0 Soft      0 Hard faulted VA's
          samlib Caused      0 faults had      0 Soft      0 Hard faulted VA's
          ws2_32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
         ws2help Caused      0 faults had      0 Soft      0 Hard faulted VA's
         wldap32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
          dnsapi Caused      0 faults had      0 Soft      0 Hard faulted VA's
         wsock32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        riched20 Caused      0 faults had      0 Soft      0 Hard faulted VA's
        unidrvui Caused      0 faults had      0 Soft      0 Hard faulted VA's
          unidrv Caused      0 faults had      0 Soft      0 Hard faulted VA's
           mscms Caused      0 faults had      0 Soft      0 Hard faulted VA's
           icm32 Caused      0 faults had      0 Soft      0 Hard faulted VA's
         ntmarta Caused     11 faults had     12 Soft      1 Hard faulted VA's
         ntdsapi Caused      4 faults had      3 Soft      1 Hard faulted VA's

PFMON: Total Faults 305  (KM 141 UM 305 Soft 294, Hard 11, Code 127, Data 178)

PFMon displays a list of hard page faults in the command window while the process is running. When you terminate the process, PFMon displays summary information about the types of page faults that the process generated.

Your report might look similar to the preceding output. If it does, you can see that the process used in this example did not generate a large number of hard page faults.

Example 2: Monitor an Invoked Process

In this example, you suspect that an application you developed is generating a large number of hard page faults and is causing a disk bottleneck. You invoke your application (in this example, it is Notepad) and specify that output data be written to the Pfmon.log file, not to the command window. Type the following at the command line:

pfmon /h /n notepad

Press ENTER. Output similar to the following is displayed:

HARD: RtlTryEnterCriticalSection+0xf : NlsMbOemCodePageTag+0x00000034
HARD: ZwOpenProcessToken+0x166 : NlsAnsiCodePage+0x00000672
HARD: RtlAppendUnicodeToString+0x15e : modf+0x00003DE0
HARD: RtlGetControlSecurityDescriptor+0x4b : 0006ef54
HARD: SetWaitableTimer+0xa1 : 77edf060
HARD: SetWaitableTimer+0xa7 : 77ee0800
HARD: UserClientDllInitialize+0x48 : 77e694bc
HARD: RtlInitializeCriticalSectionAndSpinCount+0xb : 77f784f4
HARD: RpcBindingInqAuthInfoExW+0x2ab : 77da9038
HARD: RtlInitializeCriticalSectionAndSpinCount+0xb : 77e02134
HARD: RegCloseKey+0x2ee : 77e010fc
HARD: RtlInitializeCriticalSectionAndSpinCount+0xb : 77cb4034
HARD: ImageList_SetOverlayImage+0x1326 : 77bb6068
HARD: Ordinal211+0x151e : 776bc248
HARD: ftol+0xc3 : osplatform
HARD: control87+0x1d8 : iob+0x00001290
HARD: GetFileTitleA+0x381 : 76b5b1ac
HARD: InitializeDll+0x3c : 778182b8
HARD: 01004c4b : 0100885c
         notepad Caused      8 faults had     11 Soft      1 Hard faulted VA's
           ntdll Caused     97 faults had     48 Soft      2 Hard faulted VA's
        comdlg32 Caused      3 faults had      2 Soft      1 Hard faulted VA's
         shlwapi Caused      2 faults had      3 Soft      1 Hard faulted VA's
           gdi32 Caused     24 faults had     12 Soft      1 Hard faulted VA's
        kernel32 Caused     48 faults had     37 Soft      2 Hard faulted VA's
          user32 Caused     46 faults had     41 Soft      1 Hard faulted VA's
        advapi32 Caused      7 faults had      7 Soft      2 Hard faulted VA's
          rpcrt4 Caused      6 faults had      5 Soft      1 Hard faulted VA's
        comctl32 Caused      6 faults had      6 Soft      1 Hard faulted VA's
         shell32 Caused      6 faults had      6 Soft      1 Hard faulted VA's
                 Caused     10 faults had     11 Soft      3 Hard faulted VA's
        winspool Caused      4 faults had      3 Soft      1 Hard faulted VA's

PFMON: Total Faults 267  (KM 22 UM 267 Soft 248, Hard 19, Code 131, Data 136)

PFMon writes a list of hard page faults to the Pfmon.log file. When you close your application, summary information about the process is written to the log file, and the final line of the summary is also displayed in the command window.

Based on the small number of hard page faults in the sample output, you can see that your application is not generating a large number of hard page faults. You might try to rerun PFMon while limiting the amount of memory to see how your application behaves under those conditions. For instructions on how to limit memory, see Limiting Available Memory.

If your application continues to generate a low number of hard page faults after you limit memory, try using another tool to investigate other aspects of your application's behavior.


PFMon Remarks

Limiting Available Memory

An application might appear to generate a negligible number of hard page faults when it is run on a computer that has few other processes running (and, therefore, has ample available memory). The performance of the application might degrade, however, when it is run on a computer that has other processes running and reduced amounts of available memory. To test this case, limit memory by using Consume before you run PFMon and the application you want to test.

Determining the Amount of Available Memory

To determine the amount of available memory:

  1. Open Task Manager.
  2. Click the Performance tab. Available memory is listed under Physical Memory.
  3. Wait until the amount of available memory is at a minimum, and then run the application you want to test.


PFMon Syntax

PFMon uses syntax in the following order:

One Step pfmon [/n | /l] [/c | /h] [/k | /K] [/p ProcessID] [/d] [/?] AppCommandLine

Parameters

/n
Writes faults to Pfmon.log as they occur in the running application, but does not display those faults in the command window.
/l
Writes faults to Pfmon.log as they occur in the running application.
/c
Displays only soft page faults and summary information.
/h
Displays only hard page faults and summary information.
/k
Displays page faults that occur in both kernel mode and user mode.
/K
Displays only those page faults that occur in kernel mode.
/p ProcessID
Attaches to an existing process ID (PID). When the command window is closed, the attached process is terminated. Do not use the /p parameter when specifying AppCommandLine.
/d
Displays the following tab-delimited information:
  • Page fault number
  • Page fault type—hard or soft
  • Program counter's module
  • Symbol for the program counter
  • Decimal value of the program counter
  • Decimal value of the program counter of the virtual address (VA) accessed
  • Symbol for the VA
  • Value of the VA

Note

  • The env variable _nt_symbol_path is used for symbol lookup.
/?
Displays command-line usage.
AppCommandLine
Specifies the command line of the application you want to monitor. If the application is not located in the current directory, you might need to enter the path along with the application name. Do not specify AppCommandLine if you are using /p ProcessID. When you terminate the application specified by AppCommandLine, PFMon displays a summary of the faults that occurred while the application was being executed.


PKIView Remarks

Overview | Remarks | UI | Related Tools Run Tool

Starting PKIView

When you start PKIView, it immediately begins retrieving data from the Active Directory domain that the computer is joined to. This may take a short amount of time, depending on several factors, including the size of your Active Directory, the number of PKI objects to be retrieved, and the network connectivity between the computer running PKIView and the computers it must contact. These computers include a domain controller and each CA in the enterprise. As a result, you may see a delay between the time when PKIView starts and the time when you can completely explore and manage your PKI.

Managing Certification Authorities with PKIView

PKIView can be used to manage any certification authority (CA) in the PKI by right-clicking the appropriate online enterprise CA and choosing Manage. This invokes the Certification Authority MMC snap-in to manage the desired CA. The MMC snap-in is installed on computers that have installed a Windows Server 2003 CA. If you are running PKIView on a computer that does not have a CA installed, you must install the Windows Server 2003 Administration Pack before you can manage those CAs.

For more information on the Windows Server 2003 Administration Pack, see Windows Server 2003 Help and Support Center.

Managing Standalone PKI Hierarchies

PKIView is provided to manage enterprise PKIs and works primarily by retrieving information from Active Directory. It cannot manage standalone hierarchies that are not integrated with Active Directory.

Understanding Object Status Codes

PKIView displays status for all objects in the PKI hierarchy. The status description varies depending on the object. The possible status codes and descriptions are as follows:

Certification Authority (CA) objects:

Status | Description
Loading | Retrieving information from the CA.
OK | CA certificate is valid.
Unable to load | Could not retrieve the CA certificate. This could be due to an inability to connect to the CA or the CA not providing the certificate.
Warning | This CA or one or more child nodes contains a warning condition.
Error | This CA or one or more child nodes contains an error condition.

Authority Information Access (AIA) objects:

Status | Description
Not verified | Verification has not yet begun or the AIA location cannot be reached or verified.
Verifying | The information is currently being retrieved and verified.
OK | The AIA information was successfully retrieved and verified.

CRL Distribution Point (CDP) and Delta CRL nodes:

Status | Description
Not verified | Verification has not yet begun or the location cannot be reached or verified.
Verifying | The information is currently being retrieved and verified.
OK | The AIA information was successfully retrieved and verified.
Unable to download | PKIView could not connect to the specified location, or a connection was established but the CRL could not be retrieved.
Not time valid | The CRL has expired or not yet become effective.
Expired | The CRL has expired and is no longer valid.
Expiring | The CRL will be expiring within the time threshold configured in PKIView and should be refreshed.
Unknown error | PKIView has encountered an unexpected error, such as being unable to read necessary information from the registry.


PKIView UI

Overview | Remarks | UI | Related Tools Run Tool

PKIView runs within Microsoft Management Console and displays the enterprise PKI in tree form. To view details of any CA in the hierarchy, click the name of the CA in the scope pane. The objects associated with that CA and their status are then displayed in the details pane.

PKIView provides three options for managing the entire PKI view: Manage Templates, Manage AD Containers, and Options. These are available by right-clicking the Enterprise PKI node and clicking the corresponding option.

Manage Templates

This option launches the Certificate Templates MMC snap-in to manage the certificate templates within Active Directory.

For more information on certificate templates, see Windows Server 2003 Help and Support Center.

Manage AD Containers

This option allows you to view and modify the Active Directory containers used by your PKI. The tabs available within this option correspond to different configuration containers, and are as follows:

Tab | Description
NTAuthCertificates | Displays and allows you to manage all enterprise CA certificates contained in the NTAuth container in Active Directory. The status for each certificate is also displayed.
AIA Container | Displays all AIA certificates and cross certificates configured for your PKI and the status for each.
CDP Container | Displays the CRL distribution point (CDP) for all base and delta CRLs configured for the CAs in your PKI and the status for each.
KRA Container | Displays each key recovery agent (KRA) certificate configured within your PKI and the status for each.
Certification Authorities Container | Displays all root CA certificates contained in the Certification Authorities container in Active Directory and the status for each.
Enrollment Services Container | Displays all issuing CA certificates contained in the Enrollment Services container in Active Directory and the status for each.

Options

This option allows you to configure the following settings for PKIView:

Option | Description
Set certificate status to Expiring when expiring in | Allows you to configure the number of days before the expiration of a certificate that PKIView will show a warning status for that certificate.
Set CRL status to Expiring when expiring in | Allows you to configure the amount of time before the expiration of a CRL that PKIView will show a warning status for that CRL.
Set Delta CRL status to Expiring when expiring in | Allows you to configure the amount of time before the expiration of a delta CRL that PKIView shows a warning status for that delta CRL.


PMon Examples

Example: Run PMon

Type the following at the command line:

pmon

Press ENTER. Output similar to the following is displayed:

 Memory:  130612K Avail:  28660K  PageFlts:   338 InRam Kernel: 1988K P:10868K
 Commit: 190684K/ 135668K Limit: 314732K Peak: 251772K  Pool N: 9000K P:12484K

                Mem  Mem   Page   Flts Commit  Usage   Pri  Hnd Thd  Image
CPU  CpuTime  Usage Diff   Faults Diff Charge NonP Page     Cnt Cnt  Name

              27348   28   917631    7                             File Cache
95  30:35:30     20    0        1    0      0    0    0  0    0  1 Idle Process
 0   0:01:39     24    0     9976    0     36    0    0  8  695 56 System
 0   0:00:00     44    0      736    0    212    0    5 11   28  4 smss.exe
 0   0:00:27   1788    0    14097    0   1816    5   51 13  564 11 csrss.exe
 0   0:00:22   3780    0    29807    0   8804   46   63 13  595 19 winlogon.exe
 0   0:00:25   1864    0    25678    0   4284   11   36  9  391 20 services.exe
 0   0:00:18   3096    0    10682    0   9076   11   41  9  450 28 lsass.exe
 0   0:00:01   1344    0     2934    0   1196   14   20  8  275  9 svchost.exe
 0   0:00:02   2280    0     7440    0   2340    6   23  8  202 19 svchost.exe
 0   0:03:41  14136    0  1619633    0  19512   37   92  8 1589 50 svchost.exe
 0   0:00:00    976    0     3461    0    748    2   14  8   76  6 svchost.exe
 0   0:02:30   2304    0     6611    0   2936   39   37  8  376 19 svchost.exe
 0   0:00:01    576    0     6409    0   2976    4   34  8  133 11 spoolsv.exe
 0   0:00:00    460    0     1823    0   1576   11   21  8  158 20 msdtc.exe
 0   0:05:44   2676    0     8358    0   5612   14   18  8  103 21 inojobsv.exe
 0   0:03:30   2376    0   586307    0   2896    8   34  8  331 18 cisvc.exe
 0   0:00:17    188    0    31233    0   1912    3   32  8  120  5 clisvcl.exe
 0   0:00:01   2156    0    12183    0   7660   46   66  8  568 37 inetinfo.exe
 0   0:00:00    736    0     2265    0    692    2   16  8   76  8 llssrv.exe
 0   0:00:00    148    0      582    0    300    1    9  8   31  2 svchost.exe
 0   0:00:02    968    0     9925    0   2728    5   20  8  187  5 snmp.exe
 0   0:00:00     52    0      648    0    564    2   16  8   41  3 dfssvc.exe
 0   0:00:00     60    0     1044    0    912    2   29  8   88  5 svchost.exe
 0   0:00:01    716    0     2618    0   1628    3   32  8  142  9 svchost.exe
 0   0:00:02   1004    0     3466    0   2752    5   28  8  246 18 dllhost.exe
 0   0:04:29    284   28   512534    7   3640    4   39  4  182  4 cidaemon.exe
 0   0:00:24    372    0    15924    0   2384    3   31  4  118  4 cidaemon.exe
 0   0:00:00    260    0     1081    0   2040    7   20  8  216 13 svchost.exe
 0   0:00:05    392    0    12480    0  10232    7   55  8  288 10 HelpSvc.exe
 0   0:00:08    508    0    15805    0   1452    4   28  8  191  5 SMSAPM32.exe
 0   0:00:03    248    0     2522    0    940    3   29 13  118 11 csrss.exe
 0   0:00:04   1680    0    10199    0   5080    9   48 13  298 15 winlogon.exe
 0   0:00:00    172    0      918    0    696    1   26  8   58  3 rdpclip.exe
 0   0:00:10   1720    0    10863    0   4912    6   48  8  243  8 explorer.exe
 0   0:00:00    656    0     1398    0   1160    2   26  8   38  2 realmon.exe
 0   0:01:15  10188    0    38586    0  12188   11  107  8  428 13 explorer.exe
 0   0:00:00    304    0     3431    0   1284    3   34  8   84  2 launch32.exe
 0   0:00:00   1436    0     1475    0    448    3   21  8   76  1 ctfmon.exe
 0   0:00:00    780    0      957    0   1204    2   27  8   48  2 realmon.exe
 0   0:00:00    156    0     7769    0   1132    2   31  8  120  4 SMSMon32.exe
 0   0:00:00   1376    0      346    0   1404    1   15  8   22  1 cmd.exe
 0   0:00:00    996    0      245    0    352    1    7 13    9  1 pmon.exe


PMon Remarks

Understanding PMon

  • PMon collects its data from the same source as System Monitor. You can use either tool to monitor the performance of a process.
  • The PMon output table is updated automatically every few seconds. To monitor PMon output over time, copy the table to a Notepad file periodically. You cannot redirect PMon output.
  • To identify a process, PMon lists the process name in the Image Name column. Processes are named for the executable file (image file) that started the process.
  • To detect a memory leak, monitor the Commit values on the second row of the output display. Constantly increasing values over several hours indicate a probable leak. Also, monitor the Commit Charge column over time. The process with increasing Commit Charge values is likely to be the one that is leaking memory.

Using PMon

  • To quit PMon, press CTRL+C, ESC, or q.
  • To scroll up and down the list of currently running processes, press the UP ARROW and DOWN ARROW keys, respectively.
  • To update the display on demand, press any other key.

Using PMon Output

This table describes the columns in the PMon output.

Column | Description
CPU | Displays the percentage of current CPU use that is attributable to the process.
CpuTime | Displays the accumulated time that the CPU has spent executing threads in the process since the process began.
MemUsage | Displays the current size of the working set of the process, in kilobytes.
Page Faults | Displays the page faults generated by the process since it began. A page fault occurs when a process accesses virtual memory that is not currently located in physical memory and must be read from disk.
Flts Diff | Displays the change in the number of page faults for the process recorded since the last update.
Commit Charge | Displays the amount of virtual memory allocated to and reserved for the process, in kilobytes. This field has the same value as the Process\Private Bytes counter in System Monitor.
Usage NonP | Displays the amount of memory in the nonpaged pool used by the process, in kilobytes.
Usage Page | Displays the amount of memory in the paged pool used by the process, in kilobytes.
Pri | Displays the base priority of the process. The base priority, which is established by the program running in the process, determines the range within which the operating system can vary the dynamic priorities of the process threads. Dynamic priority determines the order in which threads run on the CPU.
Hnd Cnt | Displays the number of open handles currently attributed to the process.
Thd Cnt | Displays the number of threads currently running in the process.
Image Name | Displays the name of the executable file that started the process.


PMon Syntax

PMon uses the following syntax:

One Step pmon

There are no parameters for this tool.


PrintDriverInfo Examples

Example 1: Finding all Printer Driver Information on a Local Computer

To find all the printer driver information on a local computer, type the following at the command line:

printdriverinfo

Press ENTER. Output similar to the following is displayed:

Finding all drivers on local machine:

--------------Report by driver name--------------
Driver Name: Xerox Document Centre 460
Environment: Windows NT x86
Kernel Mode Driver: FALSE
Using inf : C:\WINDOWS\inf\ntprint.inf
Inbox Driver: TRUE
Driver Technology: UNIDRV
Driver Stack File: UNIDRV.DLL , Date: 03/10/2002 , Version: 5.00
Driver Stack File: XRDC460.GPD , Date: 28/10/2002 , Version: 5.00
Driver Stack File: UNIDRVUI.DLL , Date: 03/10/2002 , Version: 5.00
Driver Stack File: UNIDRV.HLP , Date: 03/10/2002 , Version: 5.00
Driver Stack File: PCL5ERES.DLL , Date: 28/10/2002 , Version: 5.00
Driver Stack File: XXPCLIN1.INI , Date: 28/10/2002 , Version: 5.00
Driver Stack File: XrxIDS_1.Gpd , Date: 28/10/2002 , Version: 5.00
Driver Stack File: XXPCLRU1.DLL , Date: 28/10/2002 , Version: 1.02
Driver Stack File: XXUI1.DLL , Date: 28/10/2002 , Version: 1.02
Driver Stack File: xpclres1.dll , Date: 28/10/2002 , Version: 5.00
Driver Stack File: XXWH1HLP.HLP , Date: 28/10/2002 , Version: 5.00
Driver Stack File: ttfsub.gpd , Date: 03/10/2002 , Version: 5.00
Driver Stack File: UNIRES.DLL , Date: 03/10/2002 , Version: 5.00
Driver Stack File: STDNAMES.GPD , Date: 03/10/2002 , Version: 5.00

-=Misc Driver Info=-
DriverPath: C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\UNIDRV.DLL
Data File: C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\XRDC460.GPD
Config File: C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\UNIDRVUI.DLL
Help file: C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\UNIDRV.HLP
Monitor Name: (null)
Default Data Type: (null)
Manufacturer Name: Xerox
OEM Url: http://go.microsoft.com/fwlink/?LinkID=49&prd=10798&sbp=Printers
Hardware ID: xeroxxerox_document_1eeb
Provider Name: Microsoft

--------------Report by driver name--------------
Driver Name: Lexmark Optra S 2455 (MS)
Environment: Windows NT x86
Kernel Mode Driver: FALSE
Using inf : C:\WINDOWS\inf\ntprint.inf
Inbox Driver: TRUE
Driver Technology: UNIDRV
Driver Stack File: UNIDRV.DLL , Date: 03/10/2002 , Version: 5.00
Driver Stack File: LXOS2455.GPD , Date: 03/10/2002 , Version: 5.00
Driver Stack File: UNIDRVUI.DLL , Date: 03/10/2002 , Version: 5.00
Driver Stack File: UNIDRV.HLP , Date: 03/10/2002 , Version: 5.00
Driver Stack File: LMPCLRES.DLL , Date: 03/10/2002 , Version: 5.00
Driver Stack File: TTFSUB.GPD , Date: 03/10/2002 , Version: 5.00
Driver Stack File: UNIRES.DLL , Date: 03/10/2002 , Version: 5.00
Driver Stack File: STDNAMES.GPD , Date: 03/10/2002 , Version: 5.00

-=Misc Driver Info=-
DriverPath: C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\UNIDRV.DLL
Data File: C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\LXOS2455.GPD
Config File: C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\UNIDRVUI.DLL
Help file: C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\UNIDRV.HLP
Monitor Name: (null)
Default Data Type: (null)
Manufacturer Name: Lexmark
OEM Url: http://go.microsoft.com/fwlink/?LinkID=40&prd=10798&sbp=Printers
Hardware ID: lexmark_internationa28bb
Provider Name: Microsoft

Example 2: Finding Printer Driver Information for a Network Printer

To display printer driver information about a network printer, type the following at the command line:

printdriverinfo /d:"Lexmark Optra S 2455" /s:rktprnsrv

Press ENTER. Output similar to the following is displayed:

--------------Report by driver name--------------
Driver Name: Lexmark Optra S 2455
Environment: Windows NT x86
Kernel Mode Driver: FALSE
Using inf : \\rktprnsrv\admin$\inf\ntprint.inf
Inbox Driver: FALSE
Driver Technology: Monolithic
Driver Stack File: LMPCL2A.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCL2AC.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCL2AC.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCLNA.HLP , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCL2A$.INI , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LEXUNST.ZIP , Date: 03/05/2002 , Version: 7.00
Driver Stack File: PTZIPW32.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LEXEDF.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMNET2PP.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LEXDRVX.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LEXCFI.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCL2A.ALL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LEXDRVIN.EXE , Date: 21/02/2002 , Version: 7.00
Driver Stack File: DRVNPANT.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LEXMV95.HLP , Date: 21/02/2002 , Version: 7.00
Driver Stack File: PTRESW32.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: PTGUIW32.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: PTAPIW32.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCLHOW.HLP , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCLNA.CNT , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMHB.HLP , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMHBNDX.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMHBNDD1.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCL2AX.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCL2DD.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: C910BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: C750BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: E32XBM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: T62XBM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: J110BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: C720BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: T61XBM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: C710BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: W820BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: W810BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: M410BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: E855BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: OC1200BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: K1220BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: SC1275BM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: OPTRASBM.DLL , Date: 21/02/2002 , Version: 7.00
Driver Stack File: LMPCLTHK.DLL , Date: 21/02/2002 , Version: 7.00

-=Misc Driver Info=-
DriverPath: \\rktprnsrv\print$\W32X86\3\LMPCL2A.DLL
Data File: \\rktprnsrv\print$\W32X86\3\LMPCL2AC.DLL
Config File: \\rktprnsrv\print$\W32X86\3\LMPCL2AC.DLL
Help file: \\rktprnsrv\print$\W32X86\3\LMPCLNA.HLP
Monitor Name: Lexmark Network Port
Default Data Type: RAW
Manufacturer Name: Lexmark PCL Drivers
OEM Url: http://www.lexmark.com
Hardware ID: LPTENUM\Lexmark_Internationa28BB
Provider Name: (null)

Example 3: Finding Printer Driver Information for a Local Printer

To display printer driver information about a local printer, type the following at the command line:

printdriverinfo /p:"HP laserJet 5"

Press ENTER. Output similar to the following is displayed:

--------------Report by printer name--------------
Printer Name: HP LaserJet 5
Server Name: (null)
Driver Name: HP LaserJet 5
Environment: Windows NT x86
Kernel Mode Driver: FALSE
Using inf : C:\WIN\inf\ntprint.inf
Inbox Driver: TRUE
Driver Technology: UNIDRV
Driver Stack File: UNIDRV.DLL , Date: 06/03/2002 , Version: 5.00
Driver Stack File: HPLJ5.GPD , Date: 06/03/2002 , Version: 5.00
Driver Stack File: UNIDRVUI.DLL , Date: 06/03/2002 , Version: 5.00
Driver Stack File: UNIDRV.HLP , Date: 06/03/2002 , Version: 5.00
Driver Stack File: PCL5ERES.DLL , Date: 06/03/2002 , Version: 5.00
Driver Stack File: TTFSUB.GPD , Date: 06/03/2002 , Version: 5.00
Driver Stack File: UNIRES.DLL , Date: 06/03/2002 , Version: 5.00
Driver Stack File: STDNAMES.GPD , Date: 06/03/2002 , Version: 5.00

-=Misc Printer Info=-
Share Name: HPLaserJ
Port Name: LPT1:
Print Processor Name: WinPrint
Data type Name: RAW

-=Misc Driver Info=-
DriverPath: C:\WIN\system32\spool\DRIVERS\W32X86\3\UNIDRV.DLL
Data File: C:\WIN\system32\spool\DRIVERS\W32X86\3\HPLJ5.GPD
Config File: C:\WIN.NET\system32\spool\DRIVERS\W32X86\3\UNIDRVUI.DLL
Help file: C:\WIN\system32\spool\DRIVERS\W32X86\3\UNIDRV.HLP
Monitor Name: PJL Language Monitor
Default Data Type: (null)
Manufacturer Name: HP
OEM Url: http://go.microsoft.com/fwlink/?LinkID=37&prd=10798&sbp=Printers
Hardware ID: hewlett-packardhp_lae238
Provider Name: Microsoft


PrintDriverInfo Remarks

PrintDriverInfo General Information

PrinterDriverInfo collects information about all drivers installed on a local server, or about a driver on the local system. It can do the same for a remote server but needs to use the context of that remote server in the determination (for example, the NTPrint.inf version on that server).

PrintDriverInfo returns the format of the driver as one of the following:

  • Inbox (unidrv/PS/plotter)
  • Non-inbox (OEM), UniDrv/PS
  • Non-inbox (OEM) Monolithic

PrintDriverInfo returns the mode of the driver as one of the following:

  • Kernel mode
  • User mode

PrintDriverInfo returns the file versions and Date and Time stamps of all the files comprising the driver.

The table below defines driver formats:

Driver format | Definition
Inbox | Drivers whose names match ntprint.inf
UniDrv/PS | Drivers that do not match ntprint.inf but are unidrv/postscript based
Monolithic | All other drivers


PrintDriverInfo Syntax

PrintDriverInfo uses the following syntax:

One Step PrintDriverInfo [/s: ServerName] [/p: PrinterName] [/d: DriverName] [/f: FileName]

Parameters

/s: ServerName
Displays printer driver information contained on a specific server.

Notes

  • You must have administrator rights to the server to display printer driver information.
  • Do not include the '\\' in the name of the server.
  • PrintDriverInfo uses the admin$ and print$ shares that are on a server by default.
/p: PrinterName
Displays printer driver information about a specific printer.

Note

  • If the name of the printer contains spaces, place it in quotes.
/d: DriverName
Displays information about the specified driver.
/f: FileName
Displays information about the specified file.

Note

  • You can obtain file information only when one or more printers on a server are shared.

Note

  • When run without parameters, PrintDriverInfo displays all printer driver information on the local computer.


Qgrep Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Find a Text String in a File

The task in this example is to conduct a search for the string "EGA" in the System.ini file.

Type the following at the command line:

qgrep "EGA" c:\windows\system.ini

Press ENTER. Output similar to the following is displayed:

EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON

The two lines above are the only lines in the System.ini file that contained the text string EGA.


Qgrep Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

Qgrep uses the following general syntax:

One Step qgrep [-B] [-E] [-L] [-O] [-X] [-l] [-n] [-z] [-v] [-x] [-y] [-e String] [-f File] [-i File] [Strings] [Files] [-?]

Parameters

-B
Matches the pattern at the beginning of the line.
-E
Matches the pattern at the end of the line.
-L
Treats search strings literally.
-O
Prints seek offset before each matching line.
-X
Treats search strings as regular expressions.
-l
Prints only the file name if the file contains a match.
-n
Prints line numbers before each matching line.
-z
Prints matching lines in Most Significant Character (MSC) error message format.
-v
Prints only lines that do not contain a match.
-x
Prints lines that match exactly.
-y
Treats uppercase and lowercase as equivalent.
-e String
Treats the next argument as a literal search string.
-f File
Reads search strings from File named by the next argument.
-i File
Reads file list from File named by the next argument.
Strings
Specifies the search string(s). White space separates search strings unless the argument is prefixed with -e. For example, use qgrep "all out" x.y to find either "all" or "out" in x.y, and use qgrep -e "all out" x.y to find "all out."
Files
Specifies the file(s) to search. Wildcard characters (* and ?) can be used instead of file names.
-?, /?
Displays command-line usage.


Qtcp Examples

Example: Use Qtcp to Examine the Utility of RSVP

The task in this example is to examine the utility of RSVP in protecting the signal flow on a wide area network (WAN) link driven to near saturation. Two trials will be run across an isolated network consisting of two RSVP-capable routers connected by a 128 Kbps serial line. Each router is also equipped with an Ethernet interface. The Qtcp sender is connected to one of the router's Ethernet interfaces, the Qtcp receiver is connected to the other.

In addition, the sending port of a Smartbits noise generator is connected to the same Ethernet network as the Qtcp sender. The receiving port of the Smartbits is connected to the same Ethernet network as the Qtcp receiver. The Smartbits is programmed to send 100 Kbps of noise traffic from sending port to receiving port so that the traffic generated by the Smartbits competes with the traffic generated by the Qtcp session for resources on the 128 Kbps link. The Smartbits is programmed to generate a mix of packet sizes that simulates the typical load on a real corporate WAN link.

The first trial is run without RSVP enabled on the routers. The second trial is run with RSVP enabled on the routers. In both cases, RSVP signaling is used between the sender and receiver.

To start the first trial while RSVP is not enabled on the routers, type the following at the command line on the sending host:

qtcp /l64 /R3 /c1000 /n1000 /t 2.2.2.2

Press ENTER. Type the following at the command line on the receiving host:

qtcp /f"test" /c1000 /r

Press ENTER. When you plot the resulting data from the Test.log file in Microsoft Excel, the following graph results:

Trial 1: Latency experienced by signal packets without RSVP protection

The x-axis represents the packet sequence number. The y-axis represents the normalized latency in units of 100 nanoseconds.

This graph illustrates the latency experienced by the signal packets without RSVP protection. The first 1000 packets (sent during the no-noise calibration phase) show negligible latency. However, the second 1000 packets, which were sent while background noise was generated, show a steadily increasing latency, up to more than 1.6 seconds. Also, the set of points aligned horizontally near the top of the plot correspond to the entries generated for dropped packets (which are represented by the maximum latency experienced by any of the received packets).

To start the second trial while RSVP is enabled on the routers, type the following at the command line on the sending host:

qtcp /l64 /R3 /c1000 /n1000 /t 2.2.2.2

Press ENTER. Type the following at the command line on the receiving host:

qtcp /f"test" /c1000 /r

Press ENTER. When you plot the resulting data from the Test.log file in Microsoft Excel, the following graph results:

Trial 2: Latency experienced by signal packets with RSVP protection

The x-axis represents the packet sequence number. The y-axis represents the normalized latency in units of 100 nanoseconds.

This graph illustrates the latency experienced by the signal packets with RSVP protection. Again, the first 1000 calibration packets show very low latency (the y-axis scale differs between the Trial 1 and Trial 2 graphs). The second 1000 packets show a distribution of latencies; however, the maximum latency is limited to 100 milliseconds. Furthermore, no packets have been dropped.

Note

  • RSVP Signaling and Admission Control Service (ACS) are supported only on Windows 2000. They are not implemented on subsequent versions of Windows.


Qtcp Remarks

Understanding Qtcp Features

  • Qtcp is able to report very precise delay variations, on the order of microseconds.
  • By default, Qtcp invokes network QoS and is useful for the purpose of evaluating QoS mechanisms.
  • Qtcp can simulate traffic flows for a range of user-selectable packet sizes.
  • Qtcp can simulate traffic flows shaped to a range of token bucket parameters.
  • Qtcp can be used on an isolated, controlled network or a production network.
  • Qtcp generates detailed result logs.
  • Qtcp can collate a group of .sta files and produce a statistics summary across variables.

Note

  • RSVP Signaling and Admission Control Service (ACS) are supported only on Windows 2000. They are not implemented on subsequent versions of Windows.

Using Qtcp to Measure Network Service Quality

Qtcp can be used on either a production network or on a controlled network that might be artificially congested. Devices in the network under test can provide quality of service through any number of QoS mechanisms, or they might not provide quality of service at all. The following diagram illustrates the use of Qtcp on a production network:

Qtcp used on a production network

In this diagram, a Qtcp sender and a Qtcp receiver are located at opposite ends of the network. The network under test is a production network. Other senders and receivers compete with the Qtcp session for network resources. In this scenario, the Qtcp user has no control over the current network load.

The following diagram illustrates the use of Qtcp on a controlled network:

Qtcp used on a controlled network

In this diagram, the Qtcp sender and receiver are again located at the opposite ends of the network under test. In these scenarios, the network under test tends to be smaller and simpler to facilitate the evaluation of specific network elements in isolation. Note that, unlike the production network, there are only four hosts attached to this network. Two hosts are used to run the Qtcp test session. The other two hosts act as a noise source and noise sink. In these types of tests, the user controls the amount of noise generated across the network during any specific test run. Generally, noise sources are selected to mimic the distribution of packet sizes and the traffic level that would be encountered on a production network.

Understanding the Qtcp Theory of Operation

A Qtcp session is invoked on both a sending and a receiving host. After invocation, Qtcp sets up a TCP control channel between sender and receiver to properly negotiate the test. At the same time, it uses the GQoS API (part of Winsock2) to invoke QoS from local traffic control and from the network. The Qtcp sender will cause an RSVP PATH message to be sent toward the receiver and will wait until a response is received. The Qtcp receiver will wait for an RSVP PATH message from the sender and will respond by transmitting an RSVP RESV message.

Receipt of the RESV message at the sender triggers the measurement phase. At this time, the sender begins submitting buffers to the kernel for transmission. The kernel paces the transmission of traffic according to the token bucket parameters and service type selected by the user via the Qtcp command line. As packets are transmitted, the TimeStmp module stamps a sequence number and the local time (to a precision of 100 nanoseconds) in each packet. If the TimeStmp module is not installed, Qtcp uses a user-mode time stamp that is less accurate than the kernel-mode module.

When packets are received at the receiver's traffic control, the TimeStmp module stamps the local time of the receiving host in each packet and then passes the packet up to the receiving Qtcp peer. The receiving Qtcp process maintains a list of all received packets, including the packet sequence number, the time sent, and the time received.

The test is terminated on the sending side when the transmitter has sent the required number of packets (the default is 2048 packets, but this can be overridden via the Qtcp command line). Following transmission of the last packet, the sender sends a terminating sequence of 10 termination packets. The test is terminated on the receiving side upon receipt of a termination packet, or upon receipt of the required number of packets (the default is 2048, but this can be overridden via the receiver Qtcp command line).

Note

  • On particularly congested links, the receiver might never receive the required number of packets and the termination packets might be dropped. The TCP control channel should still get through its DONE message, in which case the receiver will terminate normally. If both of these methods fail, the receiver can be terminated manually by typing q Enter.

Upon termination, the receiver Qtcp parses and processes the log of received packets. The following logs are generated:

File | Description
Filename.sta | Contains summary statistics. It reports the total number of packets received and specifies the sequence number of each dropped packet.
Filename.raw | Contains a detailed log showing normalized send time and receive time for each packet, latency (the difference between sent and received time), packet size, and sequence number.
Filename.log | Contains the result of normalizing the results of the second file, to account for clock drift between the two hosts (for more information, see Understanding Qtcp and Latency).

Understanding Qtcp and Latency

Upon receiver termination and before the Qtcp receiving application exits, it parses the list of sent and received times in its received packet log. Assume for the purpose of this example that receiving time stamps are always later than sender time stamps (logic is implemented to allow for the case in which the receiver's time stamps are actually earlier than the sender's time stamps). Qtcp looks for the lowest sent time stamp, which should be the first, and for the lowest difference between sent time and received time across all pairs of time stamps (lowest latency). It records these two values as LowestSendTime and LowestLatency. These are used in the subsequent normalizing process.

Once Qtcp has completed parsing the list, it subtracts the LowestSendTime from all sent time stamps. This has the effect of normalizing the first packet's send time stamp to zero, and each following packet's time stamp to the difference between the time the first packet was sent and the time the following packet was sent. Next, Qtcp subtracts the LowestSendTime from all received time stamps. Finally, Qtcp subtracts LowestLatency from each packet's received time stamp. This has the effect of normalizing all received time stamps such that they represent the latency in excess of the minimum latency seen. For example, consider the following set of time stamps:

Time Sent | Time Received | Latency
10 | 13 | 3
11 | 19 | 8
12 | 18 | 6

Upon parsing the records, Qtcp determines that LowestSendTime is 10 and LowestLatency is 3. After the first normalizing step, the set of time stamps consists of the following values:

Time Sent | Time Received | Latency
0 | 13 | 3
1 | 19 | 8
2 | 18 | 6

During the next normalizing step, LowestSendTime is subtracted from all received time stamps, yielding the following results:

Time Sent | Time Received | Latency
0 | 3 | 3
1 | 9 | 8
2 | 8 | 6

In the final normalizing step, LowestLatency is subtracted from all received time stamps and the latency is updated to reflect the difference between the normalized send and receive time-stamp pairs. This yields the following results:

Time Sent | Time Received | Latency
0 | 0 | 0
1 | 6 | 5
2 | 5 | 3

Note

  • The first packet shows a latency of zero. This does not mean that the transmission delay is zero. It means that this packet's delay represents the best case or fixed delay that occurs between sender and receiver. Normalized latencies that are greater than zero indicate the amount of delay beyond the fixed delay or beyond the minimum delay. As such, these latencies represent the variable delay component that results from queuing and congestion. This is considered more interesting than the fixed delay component from the perspective of Qtcp.

Determining the Validity of Results

No attempts are made to determine the actual latency between sender and receiver. Instead, Qtcp attempts to determine the variable delay component that is considered to be indicative of queuing delays and congestion effects. This approach will not always yield valid results. It is based on the assumption that one of the following two requirements are met:

  1. The test includes a calibration phase. If the network under test is an isolated network, controlled exclusively by the tester, it is recommended that the calibration parameter (/c) be used. During the calibration phase, no noise should be generated on the network. This assures that queues in network devices will be empty and that the minimal latency logged by Qtcp will indeed be indicative of the fixed delay component of the network.
  2. Sufficient packets are sent. If a large enough number of packets is sent during a test run, it is statistically very likely that at least one of the packets will end up in a very short (or zero length) queue and will not be subjected to congestion delay. The minimum delay used by Qtcp will be the delay experienced by this packet. This assumption fails on a heavily congested network in which queues never drop to zero length.

Normalizing for Clock Skew: the Difference Between Raw and Log Files

Computer clocks are based on a crystal oscillator time base. Oscillators are subject to deviation from their nominal frequency, which is on the order of several parts per million. As a result, send time stamps and receiving time stamps are generated based on a slightly different speed clock. When measuring queuing delays on the order of milliseconds over a period of seconds or minutes, the skew between the sending oscillator's rate and the receiving oscillator's rate is negligible. However, when measuring queuing delays that are much lower (such as on a high-speed LAN) or when measuring delays over a long period of time, the clock skew might become significant.

To compensate for clock skew, Qtcp normalizes the output of the raw file into the log file. This normalizing step is based on the assumption that the clock skew is constant, while queuing delay is variable. In order to normalize for the effects of clock skew, Qtcp attempts to fit the latency reports to a constant slope line. There are several options for this clock skew normalization. The /k0 parameter turns off the normalization. The /k1 parameter fits to a straight line by using the sum of squared error as the "goodness-of-fit" measure (this makes an implicit assumption that latency is normally distributed). The default, /k2, parameter uses absolute deviation as the goodness-of-fit measure (the assumption here is that latency is more like a double exponential about the mean).

The /k3 paramter is only to be used in special cases. It is designed to fix a known problem. On certain computers, those with a piix4 timer chip (Qtcp should warn you if you have a clock chip whose frequency matches that of the piix4), the clock sets itself forward or backward a specific amount every so often. The /k3 parameter tells Qtcp to try to detect and compensate for this. It is not certain to detect the clock jumps and only the clock jumps, but it has succeeded in tests so far.

As a consequence of all this, any constant variation in latency will be removed from the log file. In the rare case that the user is interested in measuring constant changes in latency over time, the user should work from the raw file (not the log file) and should account for the fact that part of the latency is attributable to clock skew. (Clock skew measured on current-technology computers between two computers is on the order of 10 microseconds per second).

Avoiding Fragmentation: the Relationship Between Token Bucket Size, Buffer Size, and Packet Size

Under certain conditions, the protocol stack on the sending host must fragment user-level buffers into multiple packets to transmit them over the network. Fragmentation is undesirable for the following reasons:

  1. Certain network QoS mechanisms are unable to handle fragmented packets.
  2. The loss of a single packet results in the loss of the entire corresponding buffer at the receiving host, even though all packets might have successfully traversed the network.
  3. The user-level Qtcp process on the receiving host recognizes buffers, not individual packets. As a result, time stamps and sequence numbers would be recovered only from the first packet comprising each buffer. Information stamped by the sending TimeStmp module in the remaining packets of the buffer would not be recoverable.

The size of user-level buffers generated by the sending Qtcp is determined by the /l parameter. The default is 1472 bytes because 1472 (buffer size) + 20 (IP header) + 8 (UDP header) = 1500 (MTU size). If the buffer is larger than the token bucket size (selected by the /B parameter) used by traffic control, or larger then the MTU size defined for the network interface, the sending protocol stack must fragment each buffer into multiple packets. Since fragmentation is undesirable, this condition should be avoided. Qtcp will prevent the user from defining a buffer size that is larger than the token bucket size. However, the user is responsible for determining the MTU size for the interface and assuring that the buffer size is no larger than the MTU size.

On the other hand, if the buffer size is smaller than the token bucket size, multiple user-level buffers might be transmitted by sending traffic control in a single burst. As a result, the transmit time stamps in these packets will be closely related. This tends to distort the results of the measurement. Optimal results are obtained when packets are sent at a steady rate, with equal interpacket gaps between successive packets.

Therefore, it is recommended that the buffer size be equal to the token bucket size and that both be equal to or smaller than the MTU size.

Understanding Token Rate

Optimal results are obtained when the sending host sends packets at a constant rate (for more information, see Avoiding Fragmentation: the Relationship Between Token Bucket Size, Buffer Size, and Packet Size). If the token bucket size is chosen to be equal to the buffer size, the token rate (determined by the /R parameter) will determine the constant packet rate. So, for example, for a token bucket and buffer size of 64 bytes and a token rate of 16, packets will be sent at the uniform rate of 250 packets per second.

Each packet can be considered to be taking a snapshot of the network conditions at the time it is sent. Therefore, the token rate can be used to select a sampling interval for the network under test. On one hand, too low a sampling interval can cause transient network conditions to be missed. On the other hand, the token rate should be selected so that the packet rate is relatively low compared to the measuring processes in the sending and receiving hosts. Measurement error increases with higher packet rates.

The token rate selected should be lower than the media rate. For example, when using Qtcp to evaluate the effects of QoS on telephony traffic, we usually select token rates on the order of 3 to 10 kilobytes per second.

Selecting the Service Type

The /S parameter is used to select the Intserv service type requested by the RSVP signaling messages and to control the mode of the sending host's traffic control. The two types of service are guaranteed service (GR) and controlled load service (CL). See RFC 2210 for a description of these services. If the /S parameter is omitted, guaranteed service is assumed.

If there are RSVP-/Intserv–aware devices in the network under test, the choice of service type will affect the handling of the test traffic by these devices (as described in RFC 2210). Regardless of the existence of RSVP-/Intserv–aware network devices, the choice of service will affect traffic control on the sending host by determining the mode in which the packet scheduler operates. Unless configured otherwise, the packet scheduler on the sending host will operate in shape mode for guaranteed service and in borrow mode for controlled load service. In shape mode, the packet scheduler shapes transmitted traffic to the token bucket parameters. In borrow mode, the packet scheduler does not shape traffic to the token bucket parameters; instead, it transmits traffic up to the media rate, demoting in priority those packets that are transmitted in excess of the media rate.

Operating Qtcp in borrow mode tends to result in bursts of traffic and is not recommended for measurement purposes. However, it might be desirable to select controlled load service to compare the effect of various service types when there are RSVP-/Intserv–aware devices in the network under test. In this case, we recommend configuring the packet scheduler to operate in shape mode for controlled load flows. This can be accomplished by specifying the /e parameter when running Qtcp.

Using the No Wait Parameter

By default, Qtcp will not begin data transmission until an RSVP reservation is in place. The /W parameter allows data transmission to proceed even when there is no reservation in place. This parameter can be invoked in order to enable testing when the network under test prevents a reservation from being installed. This could happen for the following reasons:

  1. A firewall in the path between sender and receiver is configured to block RSVP messages.
  2. An RSVP-aware device in the network is rejecting the RSVP request due to lack of resources, policy settings, or other reasons.

Note

  • By using the /W parameter, the synchronization inherent in RSVP is lost. This means that the sender will not wait for the receiver to be started; therefore, you must start the receiver before the sender.

Selecting the Number of Buffers

Use the /n parameter to select the number of buffers that the transmitter sends or the receiver expects to receive during a test run.

Too small a number of buffers results in the error message "Time interval too short for valid measurement." Too large a number of buffers on the receiver results in the error message "Could not allocate X bytes for log buffer." This indicates that the receiver was unable to allocate sufficient memory to record timing data for the number of buffers it has to receive.

Note

  • Both sender and receiver use 2048 as the default number of buffers. If the /n parameter is used on the sender to restrict the number of buffers sent to less than the default, no action is required on the receiver. However, if the sender is configured to transmit more than the default, the corresponding option must also be used on the receiver to prevent it from terminating after the default number of buffers have been received.

If you want to send buffers for an approximate amount of time, use the /n Num s parameter. For example, if you want to send buffers for 3600 seconds, specify /n3600s.

Calibrating

Use the /c parameter to enforce a calibration phase. This parameter takes a number of calibration buffers as an argument. On the sender, the specified number of calibration buffers is sent in addition to the number of buffers specified by the /n parameter (or the default of 2048). On the receiver, the best-fit curve calculations used to normalize for clock skew (see Understanding Qtcp and Latency) are based on the calibration buffers received unless none are specified, in which case they are based on all buffers. Other statistics are based on all buffers, including both calibration buffers and noncalibration buffers.

When calibration buffers are specified on the sender, it sends the number of calibration buffers specified, then pauses and prompts the user with the message "Calibration complete. Type 'c' to continue." When the network under test is isolated and under user control, this mechanism facilitates the evaluation of the network. In this case, the user should begin the test run on a quiescent network. Data obtained during the calibration phase of the run is used by the receiving Qtcp to improve the integrity of the latency reports generated and of clock skew normalizing (see Understanding Qtcp and Latency). After the calibration phase is complete, the user starts any noise-generating tools being used to congest the network under test. After noise generation has been started, the user types c to continue with the measurement phase of the test.

For example, the following commands can be used:

On sending host: qtcp -c1000 -n1000 -l64 -t 2.3.4.5
On receiving host: qtcp -c1000 -f"filename" -r

This causes the sender to transmit 1000 calibration buffers, followed by 1000 noncalibration buffers. The receiver will use the first 1000 buffers received to normalize for clock skew.

Converting a Raw File

The /F parameter will convert a specified raw file into a log file, sending no network traffic of any kind. This can be used in case there are improvements to the normalizing algorithm, for instance, on an old raw file. If you used calibration packets in the run that created the raw file, you should specify their number when invoking this conversion by adding the /c parameter (for example, for 1000 calibration packets, /c1000).

For example, to convert Test.raw into a log file, use qtcp -F"test" The output will be in Test.log.

Understanding Diffserv Codepoint, TOS/Precedence, and 802.1p

Because Qtcp invokes QoS on the sending host, it will cause traffic control to mark transmitted packets for certain QoS service levels. Specifically, traffic control will mark the diffserv codepoint (DSCP, formerly known as TOS and precedence bits) in the IP header. It will also mark 802.1p tags in the media access control (MAC) header of packets sent on an 802.1p-capable network (such as 802.1p-enabled Ethernet). Consider the effects of these packet markings when evaluating the results of Qtcp tests.

You can control the markings applied by traffic control in order to study the effects of particular markings on network service quality. By default, packet markings are determined by the service level (guaranteed or controlled load) selected for test traffic. Default mappings are as follow:

Service Level | DSCP | 802.1p
Guaranteed | IP precedence 5 | 5
Controlled Load | IP precedence 3 | 3
Best effort | IP precedence 0 | 0
Non-conforming traffic | IP precedence 0 | 1

You can alter the markings by creating a marking table in the registry under the Psched/Parameter subkey for the appropriate interface.

Using TCMon to Observe Traffic Control Behavior

TCMon enables you to observe traffic control behavior. Install TCMon on the Qtcp sender, then select the interface over which Qtcp will be running and enable auto-refresh. As soon as Qtcp is invoked on the sender, TCMon should indicate two flows: one for the RSVP messages themselves (identifiable by the service type Network Control). The other flow is for the Qtcp data. This flow is identifiable initially by the service type Best Effort. However, upon completion of the RSVP reservation, the service type of the data flow should change to either Guaranteed or Controlled Load.

Note

  • The rate indicated for the data flow will actually be higher than the token rate specified. This is because the QoS service provider prorates the requested data rate to account for network layer packet headers. As data is being sent, the Bytes Sent counter in TCMon should increase in value.

Troubleshooting Qtcp

Waiting for RSVP Reservations

Before Qtcp begins sending test data, it waits for an RSVP reservation to be established between the sender and receiver. Reservations can take up to 30 seconds to be established, and might not be established at all under certain conditions. If an RSVP reservation is failing to be established, it might be because there is a network device in the path between sender and receiver that is rejecting or blocking the reservation. Firewalls might do so by simply blocking all RSVP messages. RSVP-enabled routers might do so if they are not provisioned to allow the requested reservation. Check for the presence of such devices. If it is not possible to complete the RSVP reservation, it might be necessary to run Qtcp by using the /W parameter, which allows Qtcp to transmit test data without a reservation in place.

Invalid Log File Data

If the data in the log file appears invalid, it might be a result of a number of conditions. The receive and send time stamps should each be monotonically increasing. If either the receive time stamps or the send time stamps are all equal, it is likely that the TimeStmp module was not correctly installed on the corresponding host. Remove and reinstall TimeStmp.

If time stamps are not equal, but appear to vary widely, it might be the result of an error in the processing step that normalizes for clock skew. This can be confirmed by comparing the contents of the log file to the contents of the raw file. The raw file is generated before any normalizing processing is applied. The results in the raw file can be used if clock skew is considered negligible.

If the log file is completely empty, check the .sta file. It might indicate that all packets have been dropped.

Receiver Termination

If the network under test is extremely congested, the Qtcp receiver might not receive its termination sequence and might not receive sufficient packets to be terminated automatically. It should still get the message to terminate over its control channel. If it does not, however, type qEnter at the receiver console some time after the sender has indicated that its transmission is complete. This terminates the receiver session, causing the log files to be generated based on whatever data was successfully received at that time.

"Network Transmission Rejected" Error Message

The Network transmission rejected error message indicates that the sender attempted to send to a closed socket. This can occur when the RSVP session is torn down by an RSVP-aware network device on the path from sender to receiver. In this case, the offending device should be corrected and the test should be rerun.

This message can also be received under normal conditions at the end of a test. In this case, it indicates that one of the first termination sequences caused the receiving Qtcp session to shut down the Qtcp receiving socket, sending an RSVP tear-down message to the sender. This can cause the sending socket to close before the last termination sequence has been submitted to the network, resulting in the behaviour described. In this case, the logged data can still be considered valid.

Interpreting Qtcp Output

The log file and the raw file data should be interpreted as follows:

Column | Description
1 | Send time stamp in units of 100 nanoseconds.
2 | Receive time stamp in units of 100 nanoseconds.
3 | Latency in units of 100 nanoseconds.
4 | Packet size.
5 | Sequence number.

To interpret the results of the test runs, it is helpful to plot the data captured in the log file. You can use a Microsoft Excel macro contained in the file Qtcpmacros.xls to read the log file and plot the results. Instructions are contained in the Qtcpmacros.xls file itself. If you do not have this macro file, simply use the File Open menu to load the data file. Specify that a colon will be used as the delimiter. Once Excel has loaded the data file, highlight the third column (latency). Next, chart it by using the Line chart. You can also select the Data Analysis tools to obtain statistics and histograms regarding the distributions of latencies. When applying the data analysis tools, do not include log entries generated during the calibration phase of the test (if calibration was used), because this will skew the results.


Qtcp Syntax

Qtcp uses the following general syntax:

One Step qtcp [Options] Operation

Operations

/t

This operation specifies that the computer is the Qtpc sending host.

Syntax

One Step qtcp [/B Num] [/m Num] [/R Num] [/R Num B] [/e] [/M] [/l Num] [/n Num] [/n Num s] [/ni] [/c Num] [/y] [/p Num] [/S{CL|GR}] [/W] [/v] [/F"FileName"] [/A"Path"] [/i] /t HostIPAddress

Parameters

/B Num
Sets TokenBucket size signaled to network and to traffic control to Num. The default size is equal to the buffer size.
/m Num
Sets MinPolicedSize signaled to network and to traffic control to Num. The default size is equal to the buffer size.
/R Num
Specifies TokenRate in kilobytes per second (KBps). The default is 100 KBps.
/R Num B
Specifies TokenRate in bytes per second.
/e
Forces shaping to TokenRate.
/M
Specifies that MaxSDUSize is used in signaling messages. The default is the buffer size.
/l Num
Sets the length of buffers to transmit to Num. The default is 1472 bytes.
/n Num
Sets the number of source buffers written to network to Num. The default is 2048 bytes.
/n Num s
Sets the number of seconds to send buffers for to Num. The number of buffers will be calculated based on other parameters.
/ni
Specifies that Qtcp run indefinitely. Qtcp will stop when q is pressed on either computer.
/c Num
Specifies the number of calibration packets to be sent. Calibration packets will be sent immediately. After calibration packets are sent, Num additional packets will be sent. This parameter is useful if you want to change network conditions after a set calibration phase.
/y
Suppresses the display of a confirmation message after the calibration phase.
/p Num
Specifies the port number to send to or listen to. The default port number is 5003.
/S{CL|GR}
Specifies the Intserv service type that will be signaled to the network and used for local traffic control. The following values are valid:
Value | Description
CL | Controlled load service.
GR | Guaranteed service. This is the default.
/W
Suppresses waiting for QoS reservation.
/v
Sets up QoS reservation only; sends no data.
/F"FileName"
Specifies the name prefix of the raw file to be converted to a log file.
/A"Path"
Sets the "Path" to the directory for aggregate statistics computation.
/i
Uses more compressible buffer data.
HostIPAddress
Specifies the IP address of the receiving host.

Sample Usage

qtcp -l64 -t 2.3.4.5

/r

This operation specifies that the computer is the Qtpc receiving host.

Syntax

One Step qtcp [/f"FileName"] [/c Num] [/k{0|1|2|3}] [/d] [/N] [/P] [/u] [/q Num] [/S{CL|GR}] [/W] [/v] [/F"FileName"] [/A"Path"] /r

Parameters

/f"FileName"
Specifies the name prefix to be used in generating the log file and statistics summary. If /f is omitted, no file is generated.
/c Num
Specifies the number of buffers to use in clock-skew calibration.
/k{0|1|2|3}
Specifies the method to use to calculate clock skew. The following values are valid:
Value | Description
0 | Do not calculate clock skew.
1 | Calculate clock skew based on a linear regression, with "goodness-of-fit" measured by sum of squared error.
2 | Calculate clock skew based on a bracketing and bisection root-finding method, with goodness-of-fit measured by sum of absolute error.
3 | Calculate clock skew based on a bracketing and bisection root-finding method ,with goodness-of-fit measured by sum of absolute error, except also try to compensate for clock jumps (for more information, see Understanding Qtcp and Latency on the Remarks page).
/d
Suppresses the insertion of dummy log records for lost packets.
/N
Normalize data before dumping the raw file. The default is to normalize after the data is dumped to the raw file.
/P
Enables console reporting of dropped packets.
/u
Uses user-mode time stamps instead of kernel-mode time stamps in logs.
/q Num
Logs only every Numth packet.
/S{CL|GR}
Specifies the Intserv service type that will be signaled to the network and used for local traffic control. The following values are valid:
Value | Description
CL | Controlled load service.
GR | Guaranteed service. This is the default.
/W
Suppresses waiting for QoS reservation.
/v
Sets up QoS reservation only; sends no data.
/F"FileName"
Specifies the name prefix of the raw file to be converted to a log file.
/A"Path"
Sets the "Path" to the directory for aggregate statistics computation.

Sample Usage

qtcp /f"filename" /r


QueryAD Examples

Example 1: Searching for a Specific User Account

To search for a user account use the -u parameter. Type the following at the command line:

cscript queryad.vbs -u "Joe Smith"

Press ENTER. The following output lets you know that Queryad.vbs has begun the search:

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Once the search is complete, Queryad.vbs displays the number of objects found in the forest. If no objects are found, the following output is displayed:

Found 0 objects in the forest

If objects are found, Queryad.vbs displays the mandatory properties of the object(s) followed by the optional properties and any child objects.

Example 2: Searching for a Set of Objects

To search for an object without specifying what type of object it is use the -cn parameter. Type the following at the command line:

cscript queryad.vbs -cn "Th*"

Press ENTER. The following appears to let you know that Queryad.vbs has begun the search:

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Once the search is complete, Queryad.vbs displays the number of objects found in the forest. In this example, four objects were found in Active Directory whose common name started with a "Th."

Found 4 objects in the forest

Queryad.vbs lists the mandatory properties of each object,followed by the optional properties and child objects.


QueryAD Remarks

Using the Queryad.vbs Script

The Windows Management Instrumentation (WMI) Provider must be installed before you can run this script tool.

Ending a Search Before It Is Complete

Use the CTRL-BREAK key combination to end a search before it is complete.

Using Wildcard Characters

The Name parameter allows the use of wildcard characters. This parameter is required with all searches performed with Queryad.vbs.

For example, to search for all computers that start with the letter "s" type the following at the command line:

cscript queryad.vbs -c "s*"

Press ENTER.


QueryAD Syntax

QueryAD uses the following syntax:

One Step cscript queryad.vbs {-cn|-c|-u|-ou|-dl|-attribute} Name [GlobalCatalogServer]

Parameters

-cn
Specifies that Name is the common name of an object. Use this parameter when you do not know the type of object that you are searching for.
-c
Specifies that Name is a computer object.
-u
Specifies that Name is a user object.
-ou
Specifies that Name is an organizational unit (OU).
-dl
Expands the distribution list that is specified in Name.
-attribute
Specifies that Name is a schema attribute.
Name
Specifies a full or partial computer name, object CN, OU, attribute, or an alias for a distribution list, depending on the preceding parameter. Wildcards can be used in this parameter.
GlobalCatalogServer
Names a specific Global Catalog (GC) server for the script to query.


RASSrvMon Examples

Overview | Remarks | UI | Syntax | Examples | Related Tools Show Usage

Example 1: Use ReportGen to Sort Logs Based on Date

The task in this example is to show all the connections to a remote access server since March 1, 1999. Type the following at the command line:

reportgen /d:3/1/99

Press ENTER. Output similar to the following is displayed:

Username                         Connect Count        Bytes         Connect Time
================================================================================
userone                                1           7,897,391            02:17:01
usertwo                                5             625,304            00:11:30
userthree                              2           3,442,873            00:44:26
userfour                               1           1,044,271            00:05:51
userfive                               2             650,063            00:12:32
usersix                                1               4,236            00:01:48
------------------------
Total                                 12          13,664,138            03:33:08

Example 2: Use ReportGen to Sort Logs Based on Time and Date

The task in this example is to show all the connections to a remote access server since 4 P.M. on March 1, 1999. Type the following at the command line:

reportgen /d:3/1/99 /t:16:00

Press ENTER. Output similar to the following is displayed:

Username                         Connect Count        Bytes         Connect Time
================================================================================
usertwo-auto                            4             493,378            00:08:54
userfour                                1             211,982            00:11:18
usernine                                2             650,063            00:12:32
------------------------
Total                                   7           1,355,423            00:32:44

Example 3: Use ReportGen to Sort Logs Based on Frequency Distribution

The task in this example is to sort the remote access server logs by frequency distribution, in order to see when peak usage occurs and how long it lasts. Type the following at the command line:

reportgen /f

Press ENTER. Output similar to the following is displayed:

Time                           New    Total
===========================================
Fri Mar 05 04:01:00 1999        4       8
Fri Mar 05 08:01:00 1999        28      31
Fri Mar 05 12:01:00 1999        15      24
Fri Mar 05 16:01:00 1999        27      35
Fri Mar 05 20:01:00 1999        13      21
Sat Mar 06 00:01:00 1999        7       18
Sat Mar 06 04:01:00 1999        2       9
Sat Mar 06 08:01:00 1999        11      16
Sat Mar 06 12:01:00 1999        20      27
Sat Mar 06 16:01:00 1999        29      37
Sat Mar 06 20:01:00 1999        23      34
Sun Mar 07 00:01:00 1999        3       18
Sun Mar 07 04:01:00 1999        3       12
Sun Mar 07 08:01:00 1999        21      29
Sun Mar 07 12:01:00 1999        30      47
Sun Mar 07 16:01:00 1999        45      59
Sun Mar 07 20:01:00 1999        40      54
Mon Mar 08 00:01:00 1999        17      32
Mon Mar 08 04:01:00 1999        30      41
Mon Mar 08 08:01:00 1999        30      45
Mon Mar 08 12:01:00 1999        46      56
Mon Mar 08 16:01:00 1999        54      62
Mon Mar 08 20:01:00 1999        39      54

Example 4: Use ReportGen to Find Stale Accounts

The task in this example is to find stale accounts by displaying the first and last recorded connection for each user. Type the following at the command line:

reportgen /c

Press ENTER. Output similar to the following is displayed:

Name                     First                          Most Recent
================================================================================
usertwo                  Mon Nov 30 08:57:11 1998       Mon Mar 08 19:15:44 1999
someone1                 Thu Dec 17 18:32:58 1998       Sun Mar 07 16:52:31 1999
someone2                 Mon Dec 21 21:04:48 1998       Mon Mar 08 21:11:38 1999
someone3                 Mon Dec 28 23:04:49 1998       Mon Dec 28 23:04:49 1998
someone4                 Tue Dec 01 14:51:12 1998       Mon Mar 08 21:46:19 1999
someone8                 Thu Dec 03 09:16:17 1998       Fri Feb 05 10:12:56 1999


RASSrvMon Remarks

Overview | Remarks | UI | Syntax | Examples | Related Tools Show Usage

Overcoming RASSrvMon Limitations

RASSrvMon has the following limitations:

  • If the server takes more than 30,000 calls, the log files get too large. Periodically archive the data files, and restart RASSrvMon.
  • RASSrvMon can only monitor one remote access server at a time. To monitor multiple computers, run multiple instances of RASSrvMon.

Using RASSrvMon Monitoring Information

RASSrvMon provides the following monitoring information:

  • Server information, including the time of the first call to the server, the time of the most recent call to the server, total calls, total bytes passed through the server, peak connection count, total connect time, and currently connected users and their connection information.
  • Per-port information, including the time of the first call to the port, the time of the most recent call to the port, total connections to this port since the server was started, total bytes passed on this port, total errors on this port, and the current port status.
  • Summary information, which consists of statistics kept for each unique user/computer combination since the start of the monitoring: total connect time, total bytes transmitted, connection count, average connect time, and total error count.
  • Individual connection information, which consists of per-connection statistics for each connection: user name/computer name, IP address, connection establishment time, duration, bytes transmitted, error count, and line speed.

Configuring RASSrvMon Alerts

RASSrvMon allows you to configure alerts for the following conditions:

Alert | Description
Dead Server | RASSrvMon uses the MprAdminPortEnum application programming interface (API) to get statistics from the server. If this API fails, it means the remote access server was unreachable or in a nonresponsive state. You can set RASSrvMon to alert you if the MprAdminPortEnum API fails x times. By default, x is 120, which is 10 minutes. This alert is configured on the Monitor Configuration tab.
No Incoming Calls | If the remote access server has not taken a call in a while, it could indicate a nonfunctioning server, a problem with the lines, or any of a number of other conditions. Or it could be that you just do not have anyone calling in. This alert is configured on the Monitor Configuration tab.

Note

  • To allow for more flexibility, alerts are set up to run a program of your choosing. You can configure an alert to send e-mail or a page, display a network pop-up message box, or take any other action you can automate with an executable file or a batch script.

Understanding the Files Generated by RASSrvMon

RASSrvMon generates three files for each remote access server it monitors.

Servername.webstatus

This file summarizes the status of each remote access server monitored. It is updated every 30 seconds.

Note

  • These files can be collected and posted every minute or so to a Web server. Anyone who wants to know the current server load can just view the Web page.
Server:                 192.168.170.24
Monitored Uptime:       29d 18:52:06
Peak Connections:       10
Current Connections:
        user22:         13:06:47
        user22:         13:06:48
        user17:         01:30:23
        user17:         01:30:23
Total Calls:            129
Total Bytes:            3,333,164,636
Total Connect Time:     11d 01:57:14
Last Status Update:     Wed Mar 10 09:10:04 1999

Servername.userdetails

Each line in this file represents a link connection. The fields are tab-delimited so they can easily be imported into Microsoft Excel or a database. The fields in each line are as follows:

  1. User name
  2. Computer name
  3. Bytes transmitted
  4. The date the connection was established
  5. Connection duration
  6. Port name
  7. Remote access server connection flags
    • #define RAS_FLAGS_PPP_CONNECTION 0x00000001
    • #define RAS_FLAGS_MESSENGER_PRESENT 0x00000002
    • #define RAS_FLAGS_RAS_CONNECTION 0x00000004
    • #define RAS_FLAGS_ARAP_CONNECTION 0x00000008
  8. IP address
  9. Connection speed
user17  USER121 1,610,877,608   Fri Mar 05 09:54:38 1999        2d 19:52:47     EICON S2M ISDN adapter (ISA)    3       192.168.170.105  64000
user17  USER121 1,611,662,435   Fri Mar 05 09:54:39 1999        2d 19:52:46     EICON S2M ISDN adapter (ISA)    3       192.168.170.105  64000
user17  USER121 7,193   Mon Mar 08 05:47:39 1999        00:18:48        EICON S2M ISDN adapter (ISA)    3       192.168.170.111  64000
user17  USER121 7,614   Mon Mar 08 05:47:38 1999        00:18:49        EICON S2M ISDN adapter (ISA)    3       192.168.170.111  64000
user1   ISDNPIP 2,052   Mon Mar 08 12:53:07 1999        00:00:16        EICON S2M ISDN adapter (ISA)    3       192.168.170.109  64000
user1   ISDNPIP 1,516   Mon Mar 08 12:53:08 1999        00:00:15        EICON S2M ISDN adapter (ISA)    3       192.168.170.109  64000
user1   ISDNPIP 708,610 Mon Mar 08 13:11:58 1999        00:09:32        EICON S2M ISDN adapter (ISA)    1       192.168.170.110  64000
user1   ISDNPIP 1,974,212       Mon Mar 08 13:11:59 1999        00:09:34        EICON S2M ISDN adapter (ISA)    1       192.168.170.110  64000

Servername.userlist

This file is used by ReportGen to generate the data dumps.


RASSrvMon Syntax

Overview | Remarks | UI | Syntax | Examples | Related Tools Show Usage

RASSrvMon uses the following syntax:

One Step rassrvmon {/s:ServerName | /p:Svchost_Pid} [/t:TimeOffset]

Parameters

/s:ServerName
Specifies the name or IP address of a remote access server (use when you are not running RASSrvMon on that server).
/t:TimeOffset
Reflects the amount of time the remote access server has been running before the monitoring tool was started. This will show up in the Servername.webstatus file.
/p:Svchost_Pid
Specifies the process ID of the svchost process under which the remote access server is running. Use /p instead of /s if you are running RASSrvMon on the remote access server itself.

Note

  • It is not ideal to run RASSrvMon on the server you are monitoring. One of the primary uses of RASSrvMon is to alert you if the remote access server quits. If RASSrvMon is running on the computer that quits, you obviously cannot be alerted.

Note

  • When run without parameters, RASSrvMon displays a dialog box describing its usage.

ReportGen uses the following syntax:

One Step reportgen [/d:dd/mm/yy] [/t:hh:mm] [/f:minutes] [/c] [/p:{PPP|ARAP}] [/a] [/s]

Parameters

/d:dd/mm/yy
Specifies a date on which you want to start listing connections.
/t:hh:mm
Specifies a time at which you want to start listing connections. Commonly used in conjunction with the /d: parameter
/f:minutes
Creates a frequency distribution.
/c
Lists first and last connection dates for each user.
/p:{PPP|ARAP}
Lists only Point-to-Point Protocol (PPP) or only AppleTalk Remote Access Protocol (ARAP) connections.
/a
Inserts tabs into output.
/s
Prevents the display of a progress indicator.


RASSrvMon UI

Overview | Remarks | UI | Syntax | Examples | Related Tools Show Usage
RASSrvMon has the following pages:

RAS Monitor Window

The RAS Monitor window has five tabs and three command buttons. The five tabs are Port Status, Users - Active, Users - History Summary, Users - History Detail, and Monitor Configuration. The three command buttons are Exit, Refresh, and Configure. The buttons are always visible even as the user switches between tabs. The Exit button exits RASSrvMon. Use the Configure button to change the refresh interval or force a manual refresh.

The Port Status Tab

The Port Status tab displays the status of each port on the selected remote access server.

The Users - Active Tab

The Users - Active tab displays the status of each user currently connected to the selected remote access server.

The Users - History Summary Tab

The Users - History Summary tab displays a summary for each user who has connected to the selected remote access server.

The Users - History Details Tab

The Users - History Details tab displays a detailed history of each user who has connected to the selected remote access server. Each user's historical statistics are sorted by the host name of the machine the user connected to. Use the User drop-down menu to change the current user information displayed in the main window of the Users - History Details tab.

The Monitor Configuration Tab

The Monitor Configuration tab allows the RASSrvMon user to run a script or program when certain criteria are reached. This tab consists of two parts: MprAdminPortEnum Failure and No Incoming Calls.

  • The MprAdminPortEnum box allows RASSrvMon to run a script or program when MprAdminPortEnum fails x times. In addition, it allows the same script or program to run after an additional x failures.
  • The No Incoming Calls box allows RASSrvMon to run a script or program after not reciving a call for x seconds, or receiving no calls exceeding x bytes of data. The Re-Run every text field allows the same script or program to be rerun after x seconds.


RControlAD Remarks

Overview | Remarks | UI | Related Tools

Installing RControlAD

Rcontrol.exe is a self extracting file that contains all files needed to install and run RControlAD.

To install RControlAD:

  1. After installing the Windows Server 2003 Resource Kit tools, navigate to the Program Files\Windows Resource Kit Tools folder and double-click rcontrolad.exe.
  2. When the files are done extracting double-click rcontrol_setup.exe to begin the installation.
  3. When prompted, click Install.
  4. A dialog box warning that RControlAD should only be installed once within an Active Directory forest appears. Click Yes to continue the installation.
  5. A dialog box stating that RControlAD successfully modified Active Directory MMC snap-ins appears. Click OK.
  6. Click Exit to dismiss the dialog box and end the installation.
  7. On the computer that you use to remotely connect to others, place Rcontrol.exe in the %systemroot%. By default in Windows XP Professional and Windows Server 2003, this is the \Windows directory.

Using RControlAD

To use RControlAD, right-click a computer object in an Active Directory snap-in, such as Active Directory Users and Computers or Active Directory Sites and Services. Click Remote Control on the shortcut menu.


RControlAD UI

Overview | Remarks | UI | Related Tools

Once installed, RControlAD adds a Remote Control menu option to Active Directory snap-ins. In an Active Directory snap-in such as Active Directory Users and Computers or Active Directory Sites and Services, right-click a computer object, and then click Remote Control on the shortcut menu. This opens a Terminal Services session to the selected computer, which works like all other Terminal Services sessions.


RegIni Remarks

Overview | Remarks | Syntax | Related Tools Open Command Prompt

Creating a RegIni Script File

Use the following syntax and formatting when creating RegIni script files.

    Script File Syntax

    In a RegIni script file specifying registry changes, you must identify the key or subkey containing the entry to be added or changed on the first line, followed by the intended value of that entry on the second line, using the following format:

    \Registry\Key [ACL]
ValueEntryName = DataType Value

    The following table contains the elements used in a Regini script file.

    Element | Description
Key | Specifies the name of the key or subkey containing the entry you wish to add or change.
ValueEntryName | Specifies the name of the entry whose value is to be modified.
DataType | Specifies the data type of the entry.
Value | Specifies the intended result.
ACL | Specifies an access control list (ACL) you can choose to include.

    If a line contains an equal sign (=), RegIni interprets that line as specifying the value of a registry entry. If a line does not contain an equal sign, RegIni interprets that line as specifying the name of a registry key or subkey.

    Note

    • Make sure the text editor you use to create the script file inserts a carriage return at the end of each line. Missing carriage returns can cause unpredictable results.

    For example, a RegIni script file named Srv.ini, in the shared directory \\Myserver\Public\Myfolder, contains the following text:

    \Registry\Machine\System\CurrentControlSet\Services\Lanmanserver \ParametersDiskSpaceThreshhold = REG_DWORD 0x00000000

    This Srv.ini script file adds the DiskSpaceThreshhold entry to the registry, or changes the entry that is already there. Type the following at the command line:

    regini \\Myserver\Public\Myfolder\Srv.ini

    Press ENTER.

    Note

    • Script files can have any extension. They must be saved in ANSI format, but are converted to Unicode when read from the disk. Currently, there is no way to specify a Unicode text file as the script file.

    Line Formatting

    The format of the script file is line-based. If you are unable to fit all the information for a registry subkey name or entry on one line, use the backslash character (\) as a line-continuation character.

    For example, the following lines are treated as a single line that reads 1234561234 12:

    123456\
1234 \
12

Registry Key Names

The following are RegIni key name syntax conventions.

Key Name Syntax

If a line does not contain an equal sign (=), the line specifies the name of a registry key or subkey. In a RegIni script file, the key or subkey name consists of all text from the first non-blank character to the end of the line, including spaces, on any line that does not contain an equal sign.

Leading spaces are significant. If there are no leading spaces, the named key or subkey is an absolute path in the registry. For example:

\Registry\Machine\Software

- Or -

USER:Control Panel

In the second example, USER: is replaced by the full path to the root of the currently logged-on user's profile (for example, \Registry\Users\S-x-x-xxxx..). If a line in the script file does not contain an equal sign, and there are one or more spaces at the beginning of that line, the subkey name on that line is defined in relation to the subkey preceding it in the registry hierarchy. If the number of leading spaces is the same as in the preceding subkey, RegIni locates the subkey at the same level. If the number of leading spaces is lower, RegIni locates the subkey one level higher; if the number is higher, RegIni locates the subkey one level lower. For example:

\Registry\Machine\Software
    Level1a
        Level2a
        Level2b
            Level3a
    Level1b

Kernel and User Key Names

RegIni works with kernel registry strings. When you access the registry in user mode to modify the HKEY_LOCAL_MACHINE, HKEY_USERS, or HKEY_CURRENT_USER subtrees, the string is converted to the following in kernel mode:

  • HKEY_LOCAL_MACHINE is converted to \Registry\Machine.
  • HKEY_USERS is converted to \Registry\User.
  • HKEY_CURRENT_USER is converted to \Registry\User\User_SID, where User_SID is the current user's security identifier (SID).

ACL

After the key or subkey name, you can optionally specify an access control list (ACL). The ACL is a list of decimal numbers separated by spaces within square brackets. The decimal numbers represent the following user rights:

  1. Administrator Full
  2. Administrator R
  3. Administrator RW
  4. Administrator RWD
  5. Creator Full
  6. Creator RW
  7. World Full
  8. World R
  9. World RW
  10. World RWD
  11. Power Users Full
  12. Power Users RW
  13. Power Users RWD
  14. System OpFull
  15. System OpRW
  16. System OpRWD
  17. System Full
  18. System RW
  19. System R
  20. Administrator RWX

Registry Entries

If a line in a script file contains an equal sign, that line specifies a value for a registry entry. The text to the left of the equal sign, if any, is the name of the entry. The text to the right of the equal sign specifies the data type and value of the entry. Syntax for specifying a value is as follows:

EntryName = DataType Value

The following table defines the values used in the syntax statement.

Value | Description
EntryName | Specifies the name of the entry.
DataType | Specifies the data type of the entry.
Value | Specifies the value of the entry.

The entry name consists of all characters from the first nonblank character on the line to the last nonblank character before the equal sign. The value consists of the first nonblank character after the data type to the end of the line.

Eight data type keywords are supported by RegIni. If none is specified, the default data type, REG_SZ, is used. The data types and the format of the values for each are described in the following table.

Data Type | Value Data | Sets the Registry Data Type to | Notes
REG_SZ | A string | REG_SZ | REG_SZ is the default data type.
REG_EXPAND_SZ | A string | REG_EXPAND_SZ |
REG_MULTI_SZ | One or more strings, each within quotes | REG_MULTI_SZ |
REG_MULTISZFILE | A path to a file | REG_MULTI_SZ | The file is opened and each quoted string is added to the value.
REG_DWORD | A decimal number | REG_DWORD | Use 0x to specify a hexadecimal value, 0o to specify an octal value, and 0b to specify a binary value. You can use the strings On, Yes, or True, which are converted to 0x00000001, and the strings Off, No, or False, which are converted to 0x00000000.
REG_BINARY | Two or more decimal numbers. | REG_BINARY | The first decimal number must be the number of bytes of data that follow. The remaining numbers are converted into 32-bit numbers. The value length is always a multiple of 4 bytes.
REG_BINARYFILE | A path to a file | REG_BINARY | The named file is opened and its contents stored in the registry as the value. The length of the value is the length of the file.
DELETE |  |  | If this keyword is specified as the data type, the entry name is deleted.

Sample Script Files

The sample RegIni script files included in this section show how to:

  • Store a user name to use for automatic logon.
  • Add a value for the current user in the Exchange client subkey.
  • Set the default user name.

Storing a User Name for Automatic Administrative Logon

This example shows how to use a RegIni script to set a user name for an administrative account that can log on automatically to Windows. When you start the computer and press CTRL+ALT+DEL to log on to Windows, you are asked to type a user name and password into the Logon Information dialog box. The user name you type is stored in the DefaultUserName registry entry in the Winlogon subkey. To ensure that the value of DefaultUserName never changes, create a script file containing the following text:

\Registry\Machine
    Software
        Microsoft
            Windows NT
                CurrentVersion
                    Winlogon
                        DefaultUserName = REG_SZ USERNAME

where DefaultUserName is the value name, REG_SZ is the data type, and USERNAME is the desired result or value. Save this script file as Username.ini.

Note

  • To log on automatically to Windows, you must supply the password associated with the user name. The password is stored in the DefaultPassword registry entry in the Winlogon subkey. If no password was entered in the Logon Information dialog box, you do not need to supply a password in the script file.

To reference the script file, create a batch file containing the following command:

c:\reskit\regini c:\username.ini

To ensure that the DefaultUserName entry will not change, regardless of how many users log on, place this batch file in the Systemroot\Profiles\All Users\Start Menu\Programs\Startup directory.

Adding a Value for the Current User in the Exchange Client Subkey

These examples show how to add an entry for the current user in the Exchange client subkey. You can change the value of Exchange client options in either HKEY_USERS or HKEY_CURRENT_USER. The following two sample scripts show how to use this information with RegIni when you want to add or modify multiple registry keys.

    Example 1

    \registry\user\software\microsoft\exchange\client\options
    DictionaryLangId = REG_SZ 1033
    PickLogonProfile = REG_SZ 0

    Example 2

    \registry\user\S-1-5-21-2185238159-1414228629-1939875897-1000\software\microsoft\exchange\client\options
    DictionaryLangId = REG_SZ 1033
    PickLogonProfile = REG_SZ 0

Setting the Default User Name

This example shows how to use RegIni to set the default user name to bmiller in the Logon Information dialog box. This script modifies HKEY_LOCAL_MACHINE.

\Registry\Machine
    Software
        Microsoft
            Windows NT
                CurrentVersion
                    Winlogon
                        DefaultUserName = REG_SZ bmiller

Complex Sample Script Files

The following scripts were obtained by running the Regdmp tool.

\Registry\Machine\Software
    Classes
        AudioCD [10 1 17 5]
            EditFlags = REG_BINARY 0x00000004 0x00000002
            DefaultIcon
                = REG_EXPAND_SZ %SystemRoot%\system32\shell32.dll,40
            shell
                = play
                play
                    = &Play
                    command
                        = REG_EXPAND_SZ %SystemRoot%\system32\cdplayer.exe \
                                        /play %1

    Microsoft
        Rpc
            DCOM Protocols = REG_MULTI_SZ  "ncadg_ip_udp" \
                                           "ncadg_ipx"    \
                                           "ncacn_ip_tcp" \
                                           "ncacn_spx" \
                                           "ncacn_nb_nb" \
                                           "ncacn_nb_ipx"
            NameService
                Protocol=ncacn_np
                NetworkAddress=\\.
                ServerNetworkAddress=\\.
                Endpoint=\pipe\locator
                DefaultSyntax=3
            NetBios
            ServerProtocols
                ncacn_np=rpclts1.dll
                ncalrpc=ncalrpc
                ncacn_vns=rpclts8.dll
            ClientProtocols
                ncacn_np=rpcltc1.dll
                ncalrpc=ncalrpc
                ncacn_vns=rpcltc8.dll

        NetDDE [17 1]
            DDE Shares
                SerialNumber = REG_BINARY 8 0x09000005 0x01000000
                CLPBK$
                    fuCmdShow = REG_DWORD 0x7
                    ItemList = REG_MULTI_SZ
                    NewStyleLink = REG_SZ
                    NumItems = REG_DWORD 0x0
                    OldStyleLink = REG_SZ
                    Revision = REG_DWORD 0x1
                    SecurityDescriptor = REG_BINARY 0x6C \
                        0x80040001 \
                        0x0000004C \
                        0x0000005C \
                        0x00000000 \
                        0x00000014 \
                        0x00380002 \
                        0x00000002 \
                        0x00180200 \
                        0x000F03FF \
                        0x00000201 \
                        0x05000000 \
                        0x00000020 \
                        0x00000220 \
                        0x00180200 \
                        0x000002BD \
                        0x00000101 \
                        0x01000000 \
                        0x00000000 \
                        0x00000220 \
                        0x00000201 \
                        0x05000000 \
                        0x00000020 \
                        0x00000220 \
                        0x00000201 \
                        0x05000000 \
                        0x00000020 \
                        0x00000220
                    SerialNumber = REG_BINARY 8 0x09000005 0x01000000
                    Service = REG_DWORD 0x1
                    SharedFlag = REG_DWORD 0x1
                    ShareName = REG_SZ CLPBK$
                    ShareType = REG_DWORD 0x4
                    StartAppFlag = REG_DWORD 0x0
                    StaticDataLink = REG_SZ ClipSrv|System


RegIni Syntax

Overview | Remarks | Syntax | Related Tools Open Command Prompt

RegIni uses the following syntax:

One Step regini ScriptFile [ScriptFile..]

Parameter

ScriptFile
Specifies the file name (and, optionally, the full path) of the script file you want to use to modify the registry.


RemapKey Examples

Overview | Remarks | UI | Syntax | Examples | Related Tools Run Tool

Example 1: Swap the CTRL and CAPS LOCK Keys

The task in this example is to remap the functions of the left CTRL key to CAPS LOCK. Start by logging on to your computer with a user ID that has administrator privileges.

Start RemapKey. The RemapKey dialog box is displayed on the screen.

  • Click the left CTRL key on the Base keyboard, and drag it to CAPS LOCK on the Base keyboard. CAPS LOCK on the Remapped keyboard is changed to CTRL. The letters on that key are red.
  • Click CAPS LOCK on the Base keyboard and drag it to the left CTRL key on the Remapped keyboard. The left CTRL key on the Remapped keyboard is changed to CAPS LOCK.
  • On the File menu, click Exit. Before closing the dialog box, RemapKey prompts you to restart the computer. If you are ready to restart, click OK. After the computer restarts, the functions of the left CTRL key and CAPS LOCK are traded.

Note

  • The key remapping is effective for the Logon dialog box.

Use RemapKey to confirm the remapping status after you have logged on.

Example 2: Clear All Key Remapping

The task in this example is to clear all key remapping, resetting all keys to their original mapping. Start by logging on to your computer with a user ID that has administrator privileges. When you have completed logging on, type the following at the command line:

remapkey -c

Press ENTER. A dialog box is displayed that tells you that all key remappings are cleared.

After the computer restarts, the keyboard returns to its default mapping.

Note

  • The original key mapping is effective for the Logon dialog box.

Use RemapKey to confirm the remapping status after you have logged on.


RemapKey Remarks

Overview | Remarks | UI | Syntax | Examples | Related Tools Run Tool

Understanding RemapKey

Remapping is done on a whole-key basis. For example, RemapKey can trade the functions of the CTRL key and the CAPS LOCK key, but it cannot trade a function of just the shift state of a key. Instead, the functionality of the whole key is traded.

RemapKey also cannot trade the symbol of the shift state of a regular key or just a lowercase letter by itself. For example, if you traded the A key with the B key, then a, A, CTRL+A, SHIFT+A, and ALT+A would be traded with b, B, CTRL+B, SHIFT+B, and ALT+B, respectively.

Remapped key settings are effective for the current user and for all the users of the computer. Because remapping is done at the operating-system level, key remapping changes are transparent to all the applications installed, the Logon dialog box, and the command prompt.

You can set your computer to automatically log on so that even if you lose the functions of the CTRL, ALT, or DELETE keys, you will be able to log on to the computer.

Remapping a Key

To remap a key:

  1. Start RemapKey.
  2. On the Base keyboard, click the key you want to remap.
  3. Drag it to the new key on the Base keyboard. The Remapped keyboard reflects your key remapping.
  4. Exit RemapKey.
  5. Restart your computer to enable the new mappings.

    6. Note

    • RemapKey performs an integrity check before prompting you to restart your computer. If it finds risky key settings, it displays a warning.

Clearing a Single Key Remapping

To clear a single key remapping:

  1. Start RemapKey.
  2. Click the remapped key on the Remapped keyboard.
  3. Exit RemapKey.
  4. Restart your computer.

Clearing All Key Remapping

To clear all your key remapping and return the keys to their default settings, you can use either the GUI method or the command-line method.

To clear all key remapping (GUI method):

  1. Start Remapkey.
  2. On the Edit menu, click Delete All.
  3. Exit RemapKey.
  4. Restart your computer.

To clear all key remapping (command-line method):

  1. Run RemapKey from the command line with the -c parameter.
  2. Restart your computer.

Canceling a Key Remapping

To cancel key remapping that you have begun in RemapKey and restore your current key settings:

  • On the Edit menu, click Unedit.

Understanding Potential RemapKey Problems

Remapping can cause the following problems:

  • You might not be able to type all keys.
  • If you remap the CTRL, ALT, or DELETE key, you might not be able to log on to your computer.

    To make sure you will be able to log on even if you accidentally remap any of the required keys, you can set your computer to automatically log on with RemapKey. On the Option menu, click Setup Auto Logon.


RemapKey Syntax

Overview | Remarks | UI | Syntax | Examples | Related Tools Open Command Prompt

RemapKey uses the following syntax:

One Step remapkey -c

Parameter

-c
Clears all remappings.

Notes

  • RemapKey parameters do not work with slashes (/).
  • All other RemapKey functions are performed through the GUI.


RemapKey UI

Overview | Remarks | UI | Syntax | Examples | Related Tools Run Tool

The RemapKey window contains two keyboards. The upper keyboard, the Base keyboard, shows your keyboard before any remapping. This is where you define your new key mappings.

The lower keyboard, the Remapped keyboard, shows the current key mappings of your keyboard. Keys that have been remapped are displayed with red lettering.


RoboCopy Examples

Example: Copy a Directory Tree

In this example, the task is to

  • Copy the directory tree whose root is c:\old, except subdirectories named "bin," and the subdirectory c:\old\unwanted
  • Copy those files whose extensions begin with "c" except those whose extension is ".cpp."

To do this, type the following at the command line:

robocopy c:\old d:\new *.c* /XF *.cpp /S /XD bin c:\old\unwanted

Press ENTER. Output similar to the following is displayed:

-------------------------------------------------------------------------------
 ROBOCOPY ::  Robust File Copy for Windows XP and .NET Server :: Version XP001
-------------------------------------------------------------------------------

  Started : Mon Oct 21 14:56:41 2002

   Source : c:\old\
     Dest : c:\new\

    Files : *.c*

Exc Files : *.cpp

 Exc Dirs : bin
            c:\old\unwanted

  Options : /S /COPY:DAT /Z /R:1000000 /W:30

------------------------------------------------------------------------------

          New Dir          2    c:\old\
100%        New File                   0        blah.c

------------------------------------------------------------------------------

                Total    Copied   Skipped  Mismatch    FAILED    Extras
     Dirs :         1         1         0         0         0         0
    Files :         2         1         1         0         0         0
    Bytes :         0         0         0         0         0         0
    Times :   0:00:00   0:00:00                       0:00:00   0:00:00

    Ended : Mon Oct 21 14:56:42 2002


RoboCopy Remarks

Running RoboCopy

When you run RoboCopy, both the source and destination folders should reside on an NTFS file system partition whenever possible. You can use RoboCopy to copy to other file systems such as high performance file system (HPFS) or file allocation table (FAT), but if you do so, you might lose long file names, and rounding errors might occur in file modification times at the destination.

For more detailed help please see the file Robocopy.doc, a white paper in the Windows Server 2003 Resource Kit Tools installation directory.

Understanding the New Features in RoboCopy XP010

RoboCopy version XP010 includes a number of enhancements. For example, you can now do the following:

  • Copy Junctions, Volume Mount Points, and Directory Links. By default these are copied as normal directories, as it might not be possible to create an equivalent Junction in the destination, especially if the source and destination reside on different machines. Copying a tree that contains a Volume Mount Point can result in unexpectedly large volumes of data being copied. Use /XJ if you prefer that RoboCopy skip Junctions.

  • Act on and modify more file attributes. In addition to support for the R, A, S, and H attributes: /XA and /IA now also accept and select on the following file attributes:

    Attribute | Description
    C | Compressed files
    E | Encrypted files

    /A+ and /A- now also accept and modify the following additional attribute type:

    Attribute | Description
    N | Files not content indexed
  • Select files based on their Last Accessed Dates.
    • /MAXLAD: excludes files with a Last Access Date older than n.
    • /MINLAD: excludes files with a Last Access Date newer than n.

    If n<1900, n is taken to be a time span in days. If n>=1900, n must be a date in the form YYYYMMDD.

  • Copy a new class of file called Tweaked files. Use /IT to include and process Tweaked files. A Tweaked file is defined to be one that exists in both the source and destination, with identical size and time stamp, but different attribute settings.

  • Copy very long paths (longer that 256 characters). Previous versions of RoboCopy would fail to copy any path longer than 256 characters. The program has now been enhanced to handle path of any length, up to the internal Windows limit of nearly 32,000 characters.

  • Get better information on data volumes for large copies. Previous versions of RoboCopy used 32-bit counters that would overflow when more than 2 gigabytes of data were processed, resulting in incorrect output in the run summary. This version now uses 64-bit counters to avoid this problem.

  • More easily correlate RoboCopy errors to network errors. RoboCopy now displays the date and time of error occurrences. This information can assist you in tracking down communication problems.

  • Skip temporary and offline files by default. By default, RoboCopy now skips temporary and offline files. Use the /ITEM switch if you really want to copy temporary files. Use the /IOFF switch if you want to copy offline files.

  • Recover more quickly and robustly from file copy failures. This version of RoboCopy now time stamps destination files with a January 1980 date during copies. Thus, if a copy of a newer file is interrupted and re-run, the destination file will seem to be older than the source file and it will be copied correctly

  • Copy files in backup mode. Use the /B switch to copy all files in backup mode. Use the /ZB switch to try to copy files in restartable mode, and automatically switch to backup mode if the restartable copy fails, showing an Access Denied error.

  • Create, edit, view, and take parameters from RoboCopy job files (.RCJ).

  • Monitor the source directory tree for changes, and copy changes when they occur. When monitoring is specified, RoboCopy never terminates. Instead, it enters a loop that performs a normal RoboCopy pass and then monitors the source directory tree for changes, until both the specified number of changes have been detected and the specified period of time has elapsed. This whole process of copying and monitoring is repeated, until the user manually terminates the RoboCopy process.

  • Control bandwidth usage. Use /RH to specify RoboCopy run hours. When run hours have been specified, RoboCopy will only start new copies when the local system time is between the two specified times. Use the /PF switch to tell RoboCopy to check its run hours on a per file basis. By defaul,t RoboCopy checks its run hours on a per pass basis. Use the /IPG: switch to specify an inter-packet gap in milliseconds. RoboCopy then sleeps for the given time interval between each 64k chunk of file data transferred. This can be used to free up some bandwidth on slow links.

  • Exercise tighter control over what is copied. Copy NTFS file system file ownership information, and copy NTFS file auditing information.

  • Control what is written to the output log. Use the /TS switch to include source file time stamps in the output. Use the /FP switch to include full file paths in the output. Use the /NC switch to remove RoboCopy file classes from the output. Use the /NS switch to remove file and directory sizes from the output. Use the /NFL switch to suppress logging of file names. Use the /NDL switch to suppress logging of directory names.

  • Log output to both the console window and a log file on disk simultaneously. Use /TEE to request simultaneous output to both the screen and to a log file specified by /LOG or /LOG+. This enables you visually monitor progress in a small console window on screen, while the full log is also written to disk.

Notes

  • Temporary files are normally deleted by the owning application when they are no longer needed. When present on the system, they are often in use, and therefore copy delays or failures might occur if you try to copy them.
  • Offline files have been physically removed to offline storage, and severe delays might be encountered in copying them while the system retrieves them.
  • File copy failures are still logged, even if /NFL is used.
  • If /NDL is used on its own, log files contain fewer lines but might use more disk space, as full paths of files are logged instead of simple names.
  • If file data is copied, then file time stamps are also copied.
  • The /TIMFIX or /SECFIX switches are no longer supported.If you have scripts that use these switches, you must edit them to use /COPY: instead.
    • /COPY:T replaces the old /TIMFIX
    • /COPY:S replaces the old /SECFIX.
  • You must have the manage audit logs privilege to copy file auditing information using /COPYALL or /COPY:U.
  • You must have the backup files and restore files privileges to copy files in backup mode using /B or /ZB.
  • Backup mode copies are not restartable, but they enable you to copy some files as a Backup Operator that you would not be able to copy as a normal user.

Using RoboCopy in a UNIX Shell

You can specify all RoboCopy parameters in UNIX-style (e.g. you can use -ETA instead of the /ETA) parameter, and you can specify source and destination directory paths using the UNIX-style delimiter "/" rather than "\", the native Windows-style delimiter.

The only restriction is that any argument that starts with a "/" is taken to be a parameter if it only contains a single "/". Thus, //server/share/dir and /download/test are treated as paths, but an argument that reads /dir is treated as a parameter. This is to avoid any possible confusion between parameters and single-level paths subordinate to the root of a drive. To specify such a directory as an argument, use an alternate expression for its path, such as x:/dir or //server/C$/dir.

Copying Directory Trees

By default, RoboCopy processes only the single source directory specified on the command line. To process the entire directory tree, including subdirectories, use /S or /E. To limit the copy to only the top specified number of levels of the source directory tree, use /LEV:. For example, /LEV:2 causes RoboCopy to process the top two directory levels only—just the root directory of the source and any directory directly under the root. Subdirectories of directories under the root are not skipped.

By default, RoboCopy handles file and directory paths up to almost 32,000 characters in length. If, for any reason, you wish to disable support for very long paths, use the /256 switch. This causes RoboCopy to revert to normal path semantics and a maximum path length of 256 characters. If the /256 switch is used, and RoboCopy encounters a path longer than 256 characters, one of the following errors might be reported, depending on the operation being performed at the time:

  • The file name, directory name, or volume label syntax is incorrect.
  • The system cannot find the file specified.
  • The file name or extension is too long.

While enumerating a directory tree, RoboCopy might encounter junction points in the file system. These might be Volume Mount Points created using the MOUNTVOL command, or Directory Links created using the LINKD command. RoboCopy handles Junctions in the source by creating a normal Directory of the same name in the destination because it might not be possible to replicate the Junction in the destination. This is often the case if the source and destination are on different machines, because the target volume or directory of the Junction might not exist on the destination machine. Note that copying Junctions in this way can result in unexpectedly large volumes of data being copied if, for example, the source directory tree contains a Volume Mount Point. You can disable processing of Junctions by specifying the /XJ switch, which causes RoboCopy to exclude Junctions from further processing. If /XJ is specified, Junctions are skipped.

Retrying File System Operations

Most file system operations that fail and return an error cause the program to wait and then retry the operations until they either succeed or reach the retry limit. By default, there are 30 seconds between retries, and up to one million (1000000) retries.

  • Use the /W parameter:WaitTime to change the wait time in seconds between retries.
  • Use the /R parameter:RetryNumber to change the retry limit, where RetryNumber is a positive decimal integer, or zero if you do not want retries or wait times between retries.

If invalid values are given for the /W parameter or the /R parameter, the respective default value is used. To change the default retry parameters, use the /REG switch on a valid RoboCopy command that specifies non-default values for /W and /R. When the /REG parameter is used, the values you specify for /W and /R are stored in the Registry. These values are used as the default values for /W and /R in future RoboCopy runs where /W and /R are not specified on the command line. Specify the /W parameter and/or the /R parameter on the command line to override the stored settings.

Certain errors in some operations are not retried where practical experience indicates that retries are futile. For example, an error of Network Name Not Found usually indicates that a remote computer exists, but that it does not have a share point with the given name. Experience shows that manual intervention is required to correct this problem (by creating a suitable sharename on the remote computer); therefore, this error is generally not retried, and the attempted operation fails.

In some instances, however, this might not be the correct action for this error. For example, in a software publishing environment, it is quite common to delete a sharename, update the contents of the share point, and then recreate the sharename. In such a situation, use the /TBD parameter, which instructs the program to retry when it encounters a Network Name Not Found error, on the assumption that we are waiting for the sharename to be defined.

Normally, RoboCopy restarts failed copies from the beginning of the file. You can override this default behaviour by specifying the /Z switch (or the /ZB switch), which requests restartable copies. When you use /Z, failed copies usually restart from close to the point of failure, rather than from the beginning of the file.

Note

  • Use of /Z, /B, or /ZB can decrease RoboCopy performance and throughput significantly, because these options involve extra overhead. These options are, therefore, only recommended when experience indicates that you really need them.

Specifying File and Directory Names

By default, RoboCopy assumes that any non-parameter command-line argument is some form of file name, path, or wildcard character. These might be intermingled with parameter arguments, but the command line is easier to read if they are grouped together. The actual meaning of such a name depends on where they appear in the command in relation to any /XF or /XD parameters.

The command line is parsed from left to right. There must be two parameter arguments before any /XF or /XD parameter. The only exception is when /NOSD or /NODD is used as a directory placeholder to define a template job file.

Thereafter, any non-parameter argument is taken to be an include filespec, either a file name or wildcard character (but not a path) naming one or more files (or sets of files) to include and consider as candidates for copying, until a /XF or /XD parameter is found.

If there are no include filespecs in the command line, a default of *.* (all files) is assumed. Any include filespecs must be specified as individual arguments separated from other arguments by white space, and not appended to the source or destination directory paths like they are in the xcopy command.

The /XF parameter informs the program that subsequent file names, paths, and wildcard characters are files to exclude from copying until a subsequent /XD parameter is found. until an /XF or /IF switch is found. The /IF switch specifies that all subsequent file names and wildcard characters are candidates for copying until an /XD or /XF switch is found. /IF is intended for use within RoboCopy job files, but it can also be used on the command line.

The following table denotes the differences in allowed values:
Arguments | Names | Paths | Wildcard Characters
Source Directory | Yes | Yes | No
Destination Directory | Yes | Yes | No
Include Filespecs | Yes | No | Yes
Exclude Filespecs | Yes | Yes | Yes
Exclude Dirspecs | Yes | Yes | No

Preventing File Time and File Name Problems

Make sure that both the source and destination directories reside on an NTFS partition, wherever possible. You can copy to file systems that do not support 8.3 file names (HPFS or FAT), but you might lose long file names, and rounding errors might affect the accuracy of file times on the destination file or directory.

For example, NTFS records file times in 100 nanosecond intervals, but FAT records in only 2 seconds intervals, so copying a file from NTFS to FAT always causes file times to round to a value that the FAT file system can handle. Accordingly, RoboCopy considers file times to be identical if they are within two seconds of each other. Without this 2-second leeway, the program might erroneously classify many otherwise unmodified files as Older or Newer files, and cause considerable unnecessary copying of unchanged files. When both the source and destination volumes read NTFS, file times are compared exactly. When either the source or destination volume is not an NTFS volume

Sometimes this handling of file times needs to be overridden. For example, assume an NTFS tree is copied temporarily to FAT; then, later, the FAT tree (and all its rounded FAT file times) is copied to a local NTFS drive. Eventually, there might be need to recreate the original tree exactly. Refreshing the whole tree would do the job, but it would inefficient for a large tree. In such a scenario, use the /T parameter to force the copying of just file times for same files, rather than the whole file that would be copied using the /IS parameter. In this scenario, you can use the /IS and /COPY:T switches together to copy just file times independently of file data for same files, rather than copying the files themselves again.

When the destination is on a FAT or HPFS partition, you might also experience problems when copying files and directories with long names, or with names that include extended Unicode characters. To overcome these problems, use the /FAT parameter. This tells RoboCopy to create destination files using system-generated names in the standard 8.3 FAT file system format, rather than trying to create long or extended file names on file systems that do not support 8.3 file names.

Some third-party operating systems declare that their volumes are NTFS, but only implement FAT-style file times with a 2-second interval. When copying to such a destination from a true NTFS volume, file time rounding might occur, along with unnecessary copying of file data in subsequent jobs. If you encounter this situation, you can use the /FFT (FAT File Times) switch to tell RoboCopy to consider file times to be identical if they are within 2 seconds of each other, even though both source and destination appear to be NTFS. This eliminates unnecessary copying in this scenario.

Understanding RoboCopy File Classes

For each directory processed, RoboCopy constructs, in both the source and destination directories, a list of files matching the include filespecs. The program then cross-references these lists, checking the locations of each file, comparing file times and sizes where possible, and placing each selected file in one of the following classes:

File Class | Exists in Source | Exists in Destination | Source/Dest File Times | Source/Dest File Sizes | Source/Dest Attributes
Lonely | Yes | No | n/a | n/a | n/a
Tweaked | Yes | Yes | Equal | Equal | Different
Same | Yes | Yes | Equal | Equal | Equal
Changed | Yes | Yes | Equal | Different | n/a
Newer | Yes | Yes | Source > Dest | n/a | n/a
Older | Yes | Yes | Source < Dest | n/a | n/a
Extra | No | Yes | n/a | n/a | n/a
Mismatched | Yes (file) | Yes (directory) | n/a | n/a | n/a

By default, changed, newer, and older files are considered candidates for copying. Same files are skipped and not copied. Extra files, mismatched files, and directories are reported in the output log.

Normally, Tweaked files are neither identified nor copied. They are usually identified as same files by default. The distinction between same and Tweaked files is made only when /IT is used. Only then can Tweaked files be copied.

Changing RoboCopy Default Behavior

Use the following parameters to override the default behavior:

Parameter | Description
/XL | Excludes lonely files
/IT | Includes Tweaked files.
/IS | Includes same files
/XC | Excludes changed files
/XN | Excludes newer files
/XO | Excludes older files

Use the /XX parameter to suppress the reporting and processing of extra files.

You do not need to specify any of these arguments to ensure that the destination tree includes the current version of all source files. The default behavior of RoboCopy is all you need for most situations.

Use the /XO parameter cautiously. If you terminate RoboCopy while it is copying, any incompletely copied file will almost certainly have a later file time than the source file. If you restart the same copy, RoboCopy sees the file as an older file, and skips it if you use the /XO parameter. Bear this in mind if you are using the /XO parameter and need to cancel a copy. The most appropriate use for /XO is to synchronize two directory trees that can each be updated simultaneously. Using the /XO parameter and copying first in one direction, and then the other, ensures that the latest files are present in both directory trees.

Specifying the /XL parameter restricts the program to copying files from the source directory tree only if a corresponding file of the same name already exists in the destination. The /XL parameter provides a convenient mechanism for maintaining a copy of a selected subset of the source tree.

Use switches to exclude files based on their size or time stamp.

  • /MAX: excludes files larger than n bytes.
  • /MIN: excludes files smaller than n bytes.
  • /MAXAGE: excludes files with a last modified date older than n.
  • /MINAGE: excludes files with a last modified date newer than n, where n is either a time span in days (if n<1900), or a date in the form YYYYMMDD (if n>=1900).
  • /MAXLAD: excludes files with a last accessed date older than n.
  • /MINLAD: excludes files with a last accessed date newer than n, where n is either a time span in days (if n<1900), or a date in the form YYYYMMDD (if n>=1900).

You can force a total refresh of the destination tree, if necessary, by specifying the /IS parameter on its own, with no other selection parameters.

Modifying Default Attribute Processing

By default, RoboCopy ignores most source file attributes when selecting files to copy. Any file matching other specified conditions is copied regardless of its attribute settings. The /A and /M parameters both modify this behavior, causing only those source files with the archive attribute set to be selected for copying.

  • Use the /A parameter to leave the archive attribute of the source file unmodified (still set).
  • Use the /M parameter to reset (remove) the archive attribute of the source file.

Furthermore, you can use the /XA: parameter to exclude files from being copied if one or more of the given attributes is set. For example, you can specify /XA:R to prevent read-only files from being copied. Similarly, use the /XA:SH parameter to prevent the copying of any files with either or both of the system or hidden attributes set.

After successfully copying a file to the destination, the attributes of the destination file are set to match those of the source file, except the archive bit, which is always set (turned on) so that newly copied files can be identified and backed up. To modify this default behavior, you can use /A+: and /A-:. For example, the /A-:A parameters cause the archive attribute to be reset, and /A+:R parameters render all copied files read-only in the destination.

The following list shows the exact order of attribute operations on newly copied destination files:

  1. Attributes are copied from the corresponding source file.
  2. The Archive attribute is set (turned on).
  3. Attributes specified by /A+: are set (turned on).
  4. Attributes specified by /A-: are reset (turned off).

For a list of attributes of the /A+: and /A-: parameters, see the Syntax page.

By default, RoboCopy skips files that have the temporary file attribute set. Use the /ITEM switch if you really want to copy temporary files.

The /IA: switch includes only files with one or more of the specified attributes set. Files that do not have any of the specified attributes set are excluded from further processing and are not copied. /IA can be useful in data staging applications. For example, you can specify /IA:R to copy only read-only files from a test Web server to a live Web server. Developers can remove the read-only attribute from files on the test server while they edit and test the files. Until the read-only attribute is turned on again, these files are not replicated on the live server.

Another switch, /XA:, can be used to exclude files if one or more of the specified attributes is set. For example, you can specify /XA:R to prevent read-only files from being copied. Similarly, /XA:SH excludes files with either the system or hidden attribute set.

For a list of attributes of the /XA: and /IA: parameters, see the Syntax page.

Notes

  • RoboCopy processes /IA before /XA when both switches are specified in the same RoboCopy command.
  • Temporary files are normally deleted by the owning application when they are no longer needed. When present on the system, they are usually in use and therefore copy delays or failures might occur if you try to copy them.
  • Offline files have been physically removed to offline storage, and severe delays might be encountered in copying them, while the system retrieves them.

Moving Files

Rather than copying files, it is often desirable to move them instead, especially if disk space is at a premium on your network. The RoboCopy /MOVE parameter provides this facility. It causes source files to be deleted from the source directory tree after they have been successfully copied to the destination.

Even with the /MOVE parameter specified, RoboCopy only deletes those source files that it successfully copies to the destination. This applies even to skipped same files as there is no absolute guarantee that a skipped source file is identical to its corresponding destination file, even if the file times and sizes are identical

Therefore, it is perfectly normal for files and directories to remain in the source tree even after RoboCopy has enumerated the directory structure with the /MOVE parameter specified. The user must decide whether or not it is safe to delete the remaining entries, and, if it is, to delete them manually

Replicating a Destination Directory as an Exact Mirror of the Source Directory

If you need to maintain the destination directory tree as an exact mirror of the source directory tree, and have files and directories deleted from the destination whenever they disappear from the source, you can use the /PURGE parameter (at your own risk).

The /PURGE parameter causes RoboCopy to delete all extra and mismatched destination files and directories. After a mismatched destination entry has been deleted, the corresponding source entry is then treated as a lonely file or directory, and processed accordingly.

Whenever using the /PURGE parameter results in the deletion of an extra or mismatched destination directory, the entire destination directory tree, including all subordinate files and subdirectories, is deleted.

Warning

  • Use the /PURGE parameter with extreme caution. If you specify /PURGE along with an incorrect (but existing) destination directory, RoboCopy deletes lots of data from the destination very quickly. Use the /PURGE option at your own risk.

Note

  • The /XX parameter excludes extra files from further processing, so using the /PURGE parameter has no effect if /XX is also used.

Scheduling RoboCopy

You can use the Windows NT AT command with the Windows NT Schedule Service to create RoboCopy jobs that run regularly in the background, to automatically maintain local mirrors of remote directory trees.

By default, the schedule service logs on as the system account for the local system, which has no network access. Scheduled jobs run in the same context as the schedule service. So, in order to successfully schedule a RoboCopy job, some extra configuration is required. Basically, two options are available:

  1. Leave the schedule service running in the context of the local system sccount, and schedule batch files of the following form:

    net use \\remote_server\IPC$ /USER:userid password
    robocopy \\remote_server\source_path \\local_server\destination_path
    net use \\remote_server\IPC$ /DEL

    Within each such job, credentials with remote servers are established by connecting to the Inter Process Communication (IPC$) share on remote machines, using an appropriate user account rather than the local system account. The disadvantage of this approach is that user passwords are stored in the batch files. Although they can be protected by storing the batch files on an NTFS partition, and appropriate NTFS file security can be applied to the batch files, storing user passwords in batch files is not an ideal solution

  2. In Control Panel/Services/Schedule Service/Startup, configure the schedule service to use a "real" user account that you have created. Specify an appropriate user account and password in the Log On As section. Then stop and start the schedule service to get it running in the new user context. Once the nominated user has been granted appropriate access to source and destination servers, you can schedule RoboCopy jobs to copy files between them.

Finally, because users can change drive mappings, it is generally best to use Universal Naming Convention (UNC) names for source and destination directories in scheduled RoboCopy jobs, since these explicitly specify file locations, and are more reliable. For example, rather than scheduling a command of the following form:

robocopy X:\source Y:\destination

use commands of the form shown below for increased reliability:

robocopy \\server1\share1\source \\server2\share2\destination

Selectively Copying File Data

Once a file has been selected for copying, you can use the /COPY:copyflags command line argument to choose precisely which data associated with the file is copied. Copyflags can be any combination of the following:

  • D to copy file Data
  • A to copy file Attributes
  • T to copy file time stamps
  • S to copy NTFS Security information (ACLs)
  • O to copy NTFS Ownership information
  • U to copy NTFS aUditing information

For ease of use, the following alternative switches are also provided:

  • /COPYALL copies everything (equivalent to /COPY:DATSOU).
  • /NOCOPY copies nothing (which can be useful if /PURGE is also used).
  • /SEC copies data, attributes, and NTFS ACLs (like /COPY:DATS).

Any combination of these flags can be used, if you have the appropriate access rights. However, if file data is copied, file time stamps are also copied. By default RoboCopy assumes /COPY:DAT, and copies file data, attributes, and time stamps.

  • To refresh security information for existing destination files and directories without copying file data, use the /IS switch together with the /COPY switch, but without the D flag. For example, /IS /COPY:SOU would refresh all security information for all selected files, without copying any file data.
  • To refresh time stamps on existing destination files and directories without copying file data, use the /IS switch together with the /COPY switch, but without the D flag. For example, /IS /COPY:T would refresh all security information for all selected files, without copying any file data.
  • To refresh security information for existing destination files and directories without copying file data, use the /IS switch together with the /COPY switch, but without the D flag. For example /IS /COPY:SOU would refresh all security information for all selected files, without copying any file data.

If you copy NTFS security information (ACLs) along with file data, it is possible to copy files to which you have read access, but not write access. After such a file is copied once, and the ACLs are applied, you might find that you get an "Access Denied" error when you try to copy the file again. In this situation you should use the /B or /ZB switch to copy the files in Backup Mode. /B copies all files with backup semantics (Backup Mode). /ZB first attempts to copy files in restartable mode (for greater resiliency), but if that fails, giving an "Access Denied" error, it automatically retries the copy using Backup Mode.

Notes

  • You must have the manage audit logs privilege to copy file auditing information using /COPYALL or /COPY:U.
  • You must have the Backup Files and Restore Files privileges to copy files in Backup Mode using /B or /ZB.
  • Backup mode copies are not restartable, but they do enable you to copy some files as a Backup Operator that you would not be able to copy as a normal user.
  • If you use /Z, /B, or /ZB, RoboCopy performance and throughput might decrease significantly, as these options involve extra overhead. These options are, therefore, only recommended when experience indicates you really need them.

Interpreting the Output Log

RoboCopy writes a log of processed files and directories to its console window. This output can be redirected to a disk file, if required.

Each log line starts with a brief text tag, which is formatted according to the following rules:

Text/Formatting | Indicates
*CAPITALS | An anomaly that should be investigated
Leading Caps | A file that was selected for copying
lowercase | A file that was skipped
Left-aligned | Copying
Right-aligned | Skipping
To the left of other tags | Anomalies
Start in Column 1 | Error messages

Note

  • The skipped files will only be included in the log file if the /V parameter is used.

This arrangement simplifies the task of scanning through even a verbose listing, and makes it easier to spot new downloads, anomalies, and network errors.

If few files are copied, the left margin of the output log is mostly blank. You can easily spot copied files and anomalies in non-blank entries in the left margin of the output log.

Not counting error reporting and retries, one line of output, at most, is produced per source file or directory. Lines for directories show the number of files matching the include filespecs in the directory (where known), and the full path of the directory. Lines for files indicate what was done with the file, the size of the file, and its name.

One line of output is also produced for each mismatched file and directory, and also for each extra file and directory in the destination. These resemble lines for normal directories and files, except that lines for extra files include the full path of the file, as an aid to rapid housekeeping.

By default, only extra files that match the include filespecs on the command line are reported. The rationale for this is that you are probably not interested in spurious *.TXT files in the destination when you are refreshing *.CPP files. However, if you really do need a list of all extra files in the destination, irrespective of their types, you can obtain one by using the /X parameter.

By default, no output is produced for skipped files. To obtain a verbose listing which shows all source files matching the include filespecs, including skipped files, use the /V parameter.

By default, RoboCopy produces copy progress information in the form of a display of the percentage of the file copied so far (% copied). You can use the /NP parameter to suppress the display of %copied progress information. This is useful when you plan to redirect output to a disk file.

To see the start time of each file copy, and the estimated time that the copy should complete (based on the observed throughput of previous copies), use the /ETA parameter. These times are displayed after the file name in the format "hh:mm -> hh:mm" (start time -> ETA).

Finally, to obtain a list the files that would be copied, without committing to the overhead of actually doing the copying, you can use the /L parameter.

File Tags

The following tags apply to files:

File Tag | Meaning
*MISMATCH | The source file corresponds to a destination directory of the same name. The source file is skipped as it cannot be copied. Housekeeping of the destination tree is recommended.
*EXTRA File | The file exists in the destination but not the source (an extra file). Some housekeeping of the destination tree might be required.
New File | The file exists in the source but not in the destination (a Lonely file). The file is copied because the /XL parameter was not used. To skip this file, use the /XL parameter.
lonely | The file exists in the source but not in the destination (a Lonely file). The file is skipped because the /XL parameter was used. To copy this file, omit the /XL parameter.
Newer | The source file has a later time stamp than the destination file. The file is copied because the /XN parameter was not used. To skip this file, use the /XN parameter.
newer | The source file has a later time stamp than the destination file. The file is skipped because the /XN parameter was used. To copy this file, omit the /XN parameter.
Older | The source file has an earlier time stamp than the destination file. The file is copied because the /XO parameter was not used. To skip this file, use the /XO parameter.
older | The source file has an earlier time stamp than the destination file. The file is skipped because the /XO parameter was used. To copy this file, omit the /XO parameter.
Changed | The source and destination files have identical time stamps, different sizes. The file is copied because the /XC parameter was not used. To skip this file use the /XC parameter.
changed | The source and destination files have identical time stamps, different sizes. The file is skipped because the /XC parameter was used. To copy this file, omit the /XC parameter.
Tweaked | The source and destination files have identical time stamps and file sizes but different attributes. The file is copied because /IT has been specified; to skip this file, omit /IT.
Same | The source and destination files have identical time stamps and sizes. The file is copied because the /IS parameter was used. To skip this file, omit the /IS parameter.
same | The source and destination files have identical time stamps and sizes.
temporary | The attributes of the file indicate that it is a temporary file. The file is skipped; to copy this file, use /ITEM.
offline | The attributes of the file indicate that it is an offline file. The file is skipped; to copy this file, use /IOFF. The file is skipped because the /IS parameter was not used. To copy this file, use the /IS parameter.
attrib | At least one source file attribute matches the attributes specified by the /XA parameter. The file is skipped because of this. To copy this file, modify or omit the /XA parameter.
named | The file is skipped because it was named in the exclude filespecs. To process this file, amend the exclude filespecs following the /XF parameter.
large | The file is skipped because it is larger than /MAX:n bytes. To process this file, increase the value of n.
small | The file is skipped because it is smaller than /MIN:n bytes. To process this file, reduce the value of n
too old | The file is skipped because it is older than the date defined by /MAXAGE:n or /MAXLAD:n. To process this file, amend n to specify an earlier date.
too new | The file is skipped because it is newer than the date defined by /MINAGE:n or /MINLAD:n. To process this file, amend n to specify a more recent date.
Directory Tags

The following tags apply to directories:

Directory Tag | Meaning
(blank) | A normal directory.
*MISMATCH | This source directory corresponds to a destination file of the same name. It cannot be processed. Housekeeping of the destination is recommended.
*EXTRA Dir | The directory exists in the destination but not the source (an extra directory). Some housekeeping of the destination tree might be required.
lonely | The directory exists in the source but not the destination (a Lonely dir). The directory is skipped because the /XL parameter was used. To process this, omit the /XL parameter.
named | The directory is skipped because it was named in the Exclude Dirspecs. To process this directory, amend the Exclude Dirspecs following the /XD parameter.
junction | The entry is actually a junction, and is skipped because /XJ was specified. To process this junction and copy it as a directory, omit /XJ.

Interpreting the Run Summary

Just before RoboCopy terminates, it writes a summary of its activities during the run to its console window (or disk file if redirected). The summary displays the output in the following format:

            Total    Copied   Skipped  Mismatch    FAILED    Extras
 Dirs :        75         0        75         0         0         0
Files :       960        13       947         0         0         1
Bytes :    19.8 m   190.0 k    19.6 m         0         0    12.5 k
Times :  0:16.914  0:03.504                      0:00.000  0:13.410

The output summarizes the volume of data processed.

The first section of the summary contains columns showing the total number of files and directories processed, and the total size of files matching the Include Filespecs in the source. The remaining columns provide the following breakdown of these grand totals:

Total | Description
Copied | Subtotals for directories created and files actually copied
Skipped | Subtotals for directories enumerated but not created, and files skipped
Mismatch | Subtotals for mismatched files and directories
FAILED | Subtotals for items not processed successfully within the retry limit
Extras | Subtotals for items present in the destination but not the source

The second section of the summary provides timing information for the run. Total time should be self-explanatory. This is broken down as follows:

Total | Description
Copied | Time spent actually copying files, but excluding retry wait times.
FAILED | Time spent waiting between retries for failed operations.
Extra | Time spent scanning directories, and doing everything else.

Large times in the FAILED column usually indicate that network problems were experienced.

Preparing and Running Job Files With RoboCopy

Given the large number of command-line options available, it is easy to create RoboCopy commands that are extremely long, and unwieldy to manipulate. Use RoboCopy job files to greatly simplify your task.

RoboCopy job files are simple text files. Each contains one RoboCopy parameter per line that you can create, view, and edit manually using a text editor. You can also use RoboCopy itself for all these tasks.

Three basic switches are used in RoboCopy job file processing.

  • The /SAVE: switch tells RoboCopy to save its current set of parameters to the named file.
  • The /JOB: switch tells RoboCopy to read parameters from the named file.
  • The /QUIT switch tells RoboCopy to terminate after processing the command line.

For example, you might use a RoboCopy command to back up source files as follows:

ROBOCOPY C:\SRC D:\SRC /E *.C* *.H*

To encapsulate this command in a RoboCopy Job File, enter the following on the command line:

ROBOCOPY C:\SRC D:\SRC /E *.C* *.H* /SAVE:SBACKUP

This creates a RoboCopy job file named SBACKUP.RCJ in the current directory. This job file encapsulates all the RoboCopy parameters you specified prior to the /SAVE switch.

To run the resulting RoboCopy job file at a later date, assuming the same working directory, you can use the following, much simpler, command:

ROBOCOPY /JOB:SBACKUP

Actually, the command given above to create a RoboCopy job file might not be ideal, since, after processing the /SAVE switch and creating the RoboCopy job file, RoboCopy would continue and run with the given parameters.

To just create the RoboCopy job file without running the job, you can use the /QUIT switch as follows:

ROBOCOPY C:\SRC D:\SRC /E *.C* *.H* /SAVE:SBACKUP /QUIT

To view the verbatim contents of the generated .RCJ file you can either load it into a text editor or display its contents in the console window. Alternatively, you can get a more succinct idea of its contents by running:

ROBOCOPY /JOB:SBACKUP /QUIT

This causes RoboCopy to load the file, display its parameters, and then quit.

To edit a job file, you can use /JOB /SAVE and /QUIT together as follows:

ROBOCOPY /JOB:SBACKUP /XF *.HLP /SAVE:SBACKUP /QUIT

This loads the named job, adds parameters to exclude .HLP files from the job, and updates it on disk.

Alternatively, you can edit job files using a text editor. The format of RoboCopy Job Files is straightforward. They contain one RoboCopy parameter per line (parameters containing colons, e.g. /LOG:logfile or /MAX:n, count as one parameter and must be specified on a single line, with no spaces around the colon). Leading white space is ignored, as is any text after two consecutive colons, which is considered to be a comment. View a Robocopy-generated .RCJ file to examine the format in more detail.

Multiple RoboCopy Job Files can be specified on the RoboCopy command line. For example, you might have a large list of files to be excluded from copying. You could use an editor to create a text file containing this exclusion list as follows:

    /XF
        file1
        file2
        file3
        ...

Once this is saved with a .RCJ suffix, e.g. EXCLUDE.RCJ, it can be used in conjunction with other RoboCopy Job Files, for example as follows:

ROBOCOPY /JOB:SBACKUP /JOB:EXCLUDE

It is sometimes useful to create RoboCopy job files that can be used as templates for similar types of copies, and for this purpose, it is perfectly valid to save a job file without specifying a source directory or destination directory or both. Such a job file cannot be run on its own, of course, unless the source and destination directories are specified at run time. For example, the following RoboCopy syntax could be used create a template job SBACKUP.RCJ for backing up source files:

ROBOCOPY *.c* *.h* /SAVE:SBACKUP /QUIT

To use this template to back up different projects you can later run:

ROBOCOPY /JOB:SBACKUP C:\PROJECTS\PROG1 D:\PROJECTS\PROG1
ROBOCOPY /JOB:SBACKUP C:\PROJECTS\PROG2 D:\PROJECTS\PROG2

However, if the list of files you wish to include contains a specific file name (as opposed to wild cards like *.c*), such as MAKEFILE, then this approach will fail. You might attempt to create such a template job as follows:

ROBOCOPY *.c* *.h* MAKEFILE /SAVE:SBACKUP /QUIT

The problem here is that RoboCopy assumes that the first three non-switch, non-wild card arguments are the source path, the destination path, and the first of a list of files to include, repectively, and therefore assumes that MAKEFILE is the source directory, rather than a file name to include.

To handle this situation, you can use the /NOSD and /NODD switches in place of the source and destination directories respectively. In the preceding example, you should use the /NOSD switch to declare that no source directory is being specified, and the /NODD switch to declare that no destination Directory is being specified, as follows:

ROBOCOPY /NOSD /NODD *.c* *.h* MAKEFILE /SAVE:SBACKUP /QUIT

Obviously, both a source directory and a destination directory must be specified, so /NOSD and /NODD are only useful in the creation of template job files. However, template job files can be a powerful tool, as multiple job files can be specified on a single RoboCopy command line.

Extending the example of backing up source files further, you could create a template job apecifying file section options, then further jobs for specific source code projects:

ROBOCOPY /NOSD /NODD *.c* *.h* MAKEFILE /SAVE:SB /QUIT ROBOCOPY C:\PROJECTS\PROG1 D:\PROJECTS\PROG1 /SAVE:P1 /QUIT ROBOCOPY C:\PROJECTS\PROG2 D:\PROJECTS\PROG2 /SAVE:P2 /QUIT

Such a job structure would enable you to back up your projects simply and consistently, using brief commands like the following:

ROBOCOPY /JOB:SB /JOB:P1
ROBOCOPY /JOB:SB /JOB:P2

Notes

  • /SAVE is executed as soon as it is encountered on the command line. Arguments on the command line after /SAVE are not saved.
  • /SAVE writes to the specified file immediately, with no warning if the target file already exists. Take care that you do not overwrite existing files when you use /SAVE to create a new RoboCopy job file.
  • When multiple job files are used, their contents are cumulative. For example, if a job specifies /XA:R and is used in conjunction with another that specifies /XA:SH, then the result will be /XA:RSH. This also means that you must make sure that only one source directory and only one destination directory are specified in any set of job files that are used together.
  • Both /SAVE and /JOB expect the file to have a .RCJ suffix. They append a .RCJ suffix to the provided file name if it does not have one.

Monitoring a Directory Tree

By using the /MON: and /MOT: switches, you can monitor the source directory tree for changes, and copy changes as and when they occur.

  • The /MON: switch specifies the minimum number of changes that must occur before running again.
  • The /MOT: switch specifies the minimum time, in minutes, that must elapse before running again.
If you only specify one of these switches, the other is assumed to have a value of 1.

When monitoring is specified, RoboCopy never terminates. Instead, it enters a loop that performs a normal RoboCopy pass and then monitors the source directory tree for changes, until both n changes have been detected and m minutes have elapsed. When both conditions are met, another RoboCopy pass starts. This whole process of copying and monitoring is repeated,indefinitely, until the user manually terminates the RoboCopy process.

As a minimum, RoboCopy monitors the source directory tree for changes to file and directory names, sizes, and last write times. If attributes are to be copied RoboCopy also monitors the tree for attribute changes. Similarly, if security information is to be copied, RoboCopy also monitors the tree for security changes.

Consequently, a user performing an edit and saving a single new file, might cause multiple changes of various types to be reported back to RoboCopy. Therefore some experimentation might be required to determine appropriate threshold values for /MON and /MOT for each RoboCopy job, especially those monitoring busy trees.

Controlling Bandwidth Usage

Using the /RH: switch to specify the run hours for RoboCopy, you can define a time slot in which starting new copies is allowed; new copies will not be started, outside this time slot, and RoboCopy will sleep, waiting for the start time to come around. Both times must be in 24-hour format, must be exactly 4 digits long in the range 0000 to 2359, and must be different so as to specify a minimum two-minute window in which new copies might be started.

For example, /RH:2200-0600 specifies that copies can be started when the local system time is between 10 P.M.. and 6 A.M. (or, to be exact, between 10:00:00 P.M. and 06:00:59 A.M., as RoboCopy only looks at the hours and minutes components of the local system time when deciding whether or not to allow new copies to start).

By default, RoboCopy checks to see if it is within the defined run hours time slot at the start of each RoboCopy pass (i.e. before starting the initial copy pass; and, if /MON or /MOT was used at the start of each subsequent copy pass).

Use the /PF switch if you want the run hours check to be performed before each individual file copy is started.

Once a copy is actually started, it always runs to completion, and, therefore, it is probable that a copy pass or file copy that starts close to the end of the Run Hours time slot will not complete until some time after the end time specified. Experimentation might, therefore, be required to determine an appropriate end time for your needs.

The most obvious use of /RH is to limit the copy activity of RoboCopy to a time slot that is outside normal business hours (e.g. /RH:2200-0600), to limit use of network bandwidth by RoboCopy, and to improve network performance for interactive users during the day. This is particularly useful for RoboCopy jobs that run for extended periods of time, for example those that process very large trees, or monitoring jobs.

However, you can also use /RH to schedule a job to start at a later time. For example, you could start RoboCopy in a command window with /RH:1900-1901 just before you leave work to go home, and the job would start copying at 7 P.M., and run overnight.

On very slow links, heavy RoboCopy activity can easily consume large percentages to the available network bandwidth, and seriously impact network performance. In such a case you can use the /IPG: switch to specify an inter-packet gap of n milliseconds.

RoboCopy usually copies files in 64 kilobyte packets with no delay between receiving a packet and requesting the next. When /IPG is used, RoboCopy will wait for the given time interval before requesting the next packet, thereby freeing up network bandwidth. Again, experimentation might be required to determine an appropiate value for /IPG.

Controlling Log Output

After copying, RoboCopy displays a log of processed files and directories at the command prompt. This output can be redirected to a file, either by using the standard command-line operators (> or >>), or by using one of the command-line options:

  • /LOG:file redirects output to the specified file, overwriting the file, if it already exists.
  • /LOG+:file redirects output to the specified file, appending it to the file, if it already exists.

You can also use /TEE in conjunction with either one of the previous options. This causes RoboCopy to log its output to both the command prompt (for visual progress monitoring) and the specified file (for a permanent record of the RoboCopy run).

Aside from error reporting and retries, RoboCopy produces one line of output per source file or directory. Lines for directories show the number of files in that directory specified for copying (where known) and the full path of the directory. Lines for files indicate the name of the file, the size of the file, and what was done with the file.

One line is also generated for each mismatched file and directory and each extra file and directory in the destination. Lines for extra files include the full path and name of the file. By default, the only extra files reported are those that match files specified for copying on the command line. In most cases, this is more efficient. For example, if you are refreshing CPP files, you probably do not need information about TXT files in the destination. If you want a list of all extra files in the destination, regardless of their type, use the /X switch. No output is produced for skipped files. To obtain a verbose listing that shows all source files specified for copying on the command line, including skipped files, use the /V switch.

RoboCopy provides copy progress information (% copied) by default. You can use the /NP switch to suppress the display of progress information. This can be useful when output is redirected to a file. To see the start time of each file copy and the estimated time of completion based on the observed throughput of previous copies, use the /ETA switch. Times are displayed after the file name in the format HH:MM ->HH:MM (start ->finish). Finally, to obtain only a list of the files that would be copied (without actually copying them), use the /L switch.

This default contents of the output log can be modified using the following command line switches:

  • /TS displays the file time stamps for every file processed.
  • /FP replaces simple file names with full file paths in the output.
  • /NS (No dizes) suppresses output of file sizes.
  • /NC (No classes) suppresses output of file class Text Tags.
  • /NDL (No directory list) suppresses output of the directory list. When /NDL is used, full paths of processed files are logged instead of the simple file names, so that problems can be pinpointed. Because of this, log files can actually increase in size if /NDL is used. Directories deleted by /PURGE (or which would be deleted if /L is omitted, if /PURGE and /L are both used) are always logged even if /NDL is used.
  • /NFL (No File List) suppresses output of files processed. File copy failures are still logged even if /NFL is used, so that problems can be isolated. Files deleted by /PURGE (or which would be deleted if /L is omitted, if /PURGE and /L are both used) are always logged even if /NFL is used.

Combinations of these switches allow quite a bit of logging flexibility. For example, you could use /NDL /NC /NS to produce a list of just the full paths of files that are processed during the run, or you could use /NDL /NFL to produce just the summary report for the run.


RoboCopy Syntax

RoboCopy uses the following general syntax:

One Step robocopy Source Destination [File [File]..] [/S | /E] [/LEV:n] [/Z] [/B] [/ZB] [/COPY:Copy_Flags] [/SEC] [/COPYALL] [/NOCOPY] [/PURGE] [/MIR] [/MOV] [/MOVE] [/CREATE] [/FAT] [/FFT] [/256] [/MON:n] [/MOT:m] [/A+:{R | A | S | H | N}] [/A-:{R | A | S | H | N}] [/RH:hhmm-hhmm] [/PF] [/IPG:ms] [/A] [/M] [/IA:{R | A | S | H | N | C | E}] [/XA:{R | A | S | H | N | C | E}] [/XF ExFile [ExFile]..] [/XD Directory [Directory]..] [{/XC|/XN|/XO}] [{/XX|/XL}] [/IS] [/IT] [/MAX:bytes] [/MIN:bytes] [/MAXAGE:{days | YYYYMMDD}] [/MINAGE:{days | YYYYMMDD}] [/MAXLAD:{days | YYYYMMDD}] [/MINLAD:{days | YYYYMMDD}] [/ITEM] [/IOFF] [/XJ] [/R:RetryNumber] [/W:WaitTime] [/REG] [/TBD] [/L] [/X] [/V] [/TS] [/FP] [/NS] [/NC] [/NFL] [/NDL] [/NP] [/ETA] [/LOG:file_name] [/LOG+:file_name] [/TEE] [/JOB:job_name] [/SAVE:job_name] [/QUIT] [/NOSD] [/NODD] [/IF] [/SD:path] [/SD:path] [/?]

Parameters

Source
Specifies the source directory. Source can use the Universal Naming Convention (UNC) format ("\\myserver") or reference a local drive.
Destination
Specifies the destination directory. Destination can use the Universal Naming Convention (UNC) format ("\\myserver") or reference a local drive.
File
Specifies the file or files to copy. Wildcard characters can also be used. *.* is the default value of File. It specifies all files in the directory specified by Source.
/S
Copies all subdirectories, excluding empty ones.
/E
Copies all subdirectories, including empty ones.
/LEV:n
Copies only the top n levels of the source directory tree. n indicates the number of levels.
/Z
Copies files in restartable mode.
/B
Copy files in Backup mode. Copying files in backup mode is not restartable. Backup mode may be able to copy files that restartable mode cannot.
/ZB
Use restartable mode; if access is denied, use backup mode.
/COPY:Copy_Flag
The /COPY: parameter copies specified file properties. The default is /COPY:DAT
Flag | Description
D | File data
A | File attributes
T | File time time stamps
S | File security. This attribute copies the NTFS Access Control Lists (ACL).
O | File ownership. This attribute copies the NTFS file ownership information.
U | File auditing. This attribute copies the NTFS file auditing information.

Note

  • Source and destination volumes must both be NTFS to copy Security, Ownership or Auditing information.
/SEC
Copy files with security. Equivalent to /COPY:DATS.
/COPYALL
Copy all file attributes. Equivalent to /COPY:DATSOU.
/NOCOPY
Does not copy any file attributes.
/PURGE
Deletes destination files and directories that no longer exist in the source directory.
/MIR
Mirror a directory tree. The equivalent of /E /PURGE.
/MOV
Moves files, deleting the source after copying to the destination.
/MOVE
Moves files and directories, deleting the source after copying to the destination.
/A+:{R | A | S | H | N}
Adds the given attributes to copied files. The following table lists the valid attributes:
Attribute | Description
R | Read only
S | System
A | Archive
H | Hidden
N | Not content indexed
/A-:{R | A | S | H | N}
Removes the given Attributes from copied files. The following table lists the valid attributes:
Attribute | Description
R | Read only
S | System
A | Archive
H | Hidden
N | Not content indexed
/CREATE
Create directory tree and zero-length files only.
/FAT
Creates destination files using 8.3 FAT file names only.
/FFT
Assume FAT File Times (2-second interval). Useful for copying to third-party systems that declare a volume to be NTFS but only implement file times with a 2-second interval.
/256
Turn off very long path support. Very long path names are those longer than 256 characters
/MON:n
Monitors the source for change. The n parameter specifies the number of changes allowed in the source. If this number is exceeded, processing restarts.
/MOT:m
Monitors the source for change. The m parameter specifies the number of minutes to wait before checking for changes. If there are changes, processing restarts.
/RH:hhmm-hhmm
Defines the time slot during which starting new copies is allowed. Useful for restricting copies to certain times of the day. Both values must be 24–hour times in the range 0000 to 2359.
/PF
Makes more frequent checks to see if starting new copies is allowed (per file rather than per pass). Useful in stopping copy activity more promptly at the end of the run hours time slot.
/IPG:ms
Inter-Packet Gap in milliseconds. This parameter is used to free bandwidth on slow network links
/A
Copies only files with the archive attribute set.
/M
Copies only files with the archive attribute set, but removes the archive attribute from source files.
/IA:{R | A | S | H | N | C | E}
Includes only files with any of the given Attributes set. The following table lists the valid attributes:
Attribute | Description
R | Read only
A | Archive
S | System
H | Hidden
N | Not content indexed
C | Compressed
E | Encrypted
/XA:{R | A | S | H | N | C | E}
Excludes files with any of the given attributes. The following table lists the valid attributes:
Attribute | Description
R | Read only
A | Archive
S | System
H | Hidden
N | Not content indexed
C | Compressed
E | Encrypted
/XF ExFile
Excludes files matching given names, paths, or wildcard characters.
/XD Directory
Excludes directories matching given names/paths.
/XC
Excludes changed files.
/XN
Excludes newer files.
/XO
Excludes older files.
/XX
Excludes extra files and directories.
/XL
Excludes lonely files and directories.
/IS
Includes same files.
/IT
Include files tagged as tweaked.
/MAX:bytes
Excludes files larger than specified.
/MIN:bytes
Excludes files smaller than specified.
/MAXAGE:{days | YYYYMMDD}
Excludes files with a Last Modified Date older than n days or specified date. If n is less than 1900, then n is expressed in days. Otherwise, n is a date expressed as YYYYMMDD.
/MINAGE:{days | YYYYMMDD}
Excludes files with a Last Modified Date newer than n days or specified date. If n is less than 1900, then n is expressed in days. Otherwise, n is a date expressed as YYYYMMDD.
/MAXLAD:{days | YYYYMMDD}
Excludes files with a Last Access Date older than n days or specified date. If n is less than 1900, then n is expressed in days. Otherwise, n is a date expressed as YYYYMMDD.
/MINLAD:{days | YYYYMMDD}
Excludes files with a Last Access Date newer than n days or specified date. If n is less than 1900, then n is expressed in days. Otherwise, n is a date expressed as YYYYMMDD.
/IOFF
Includes Offline files. Excluded by default.
/ITEM
Includes Temporary files. Excluded by default.
/IOFF
Includes Offline files. Excluded by default.
/XJ
Excludes Junction points.
/R:RetryNumber
Specifies the number of retries on failed copies. The default value of RetryNumber is 1 million.
/W:WaitTime
Specifies the wait time between retries. The default value for WaitTime is 30 seconds.
/REG
Saves /R:RetryNumber and /W:WaitTime in the Registry as default settings.
/TBD
Waits for sharenames to be defined (retry error 67).
/L
Lists files without copying, time stamping, or deleting any files.
/X
Reports all extra files, not just those selected.
/V
Produces verbose output, showing skipped files.
/TS
Include source file time stamp in the output.
/FP
Include full path in the output.
/NS
Excludes the file size from the log file.
/NC
Excludes the file class from the log file.
/NFL
Excludes the file names from the log file.
/NDL
Excludes the directory names from the log file.
/NP
Suppresses progress display.
/ETA
Displays estimated time of arrival for copied files.
/LOG:file_name
Writes status to a log file. If the file exists, it is overwritten.
/LOG+:file_name
Writes status to a log file. If the file already exists, the status is appended to it.
/TEE
Displays output in the console window, in addition to directing it to the log file specified by /LOG or /LOG+.
/JOB:job_name
Gets parameters from the job file.
/SAVE:job_name
Saves parameters to the job file
/QUIT
Quits after processing the command line. No files will be copied. Use /QUIT with /JOB to view job file contents.
/NOSD
Declares that no source directory is specified. Useful in template Jobs for which the source is provided at run time.
/NODD
Declares that no destination directory is specified. Useful in template Jobs for which the destination is provided at run time.
/IF
Includes files with the specified names, paths, or wildcard characters. Intended for use in Job files only.
/SD:path
Explicitly specifies the source directory for the copy. Intended for use in Job files only.
/?
Displays command-line usage.


RpcCfg Examples

Example 1: Use Default Internet Ports

The task in this example is to assign default Internet ports from the set of ports marked as Internet-available. Type the following at the command line:

rpccfg /d 0

Press ENTER. Output similar to the following is displayed:

RPCCFG: Using default port settings

Example 2: Set Default Intranet Ports

The task in this example is to specify the ports to use as intranet-available ports. Type the following at the command line:

rpccfg /pi 500 700-800

Press ENTER. Output similar to the following displayed:

The following ports/port ranges will be used for Intranet ports
        500
        700-800

Default port allocation is from Intranet ports

Example 3: Restore Default Port Settings

The task in this example is to restore the default settings after the default port settings have been modified. Type the following at the command line:

rpccfg /r

Press ENTER. The /r parameter does not display output when the operation completes successfully.

Example 4: Display Port Settings

The task in this example is to display the current port settings. Type the following at the command line:

rpccfg /q

Press ENTER. Output similar to the following displayed:

RPCCFG: Using default selective binding settings

The following ports/port ranges will be used for Intranet ports
        500
        700-1000

Default port allocation is from Intranet ports

Example 5: Display Available Interfaces

The task in this example is to display a table of the locally accessible subnets. Type the following at the command line:

rpccfg /l

Press ENTER. Output similar to the following displayed:

      Subnet             Description
1    127.0.0.0       1  MS TCP Loopback interface

2    157.59.248.0    1  3Com EtherLink XL 10/100 PCI For Complete PC Management NIC (3C905C-TX)


RpcCfg Remarks

Configuring RPC Registry Settings

RPC stores its configuration data under the registry entry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Internet. In this registry location the following keys are used to configure the ports on which RPC listens:

  • UseInternetPorts
  • PortsInternetAvailable

Note

  • These registry keys do not appear unless you change the default value for the computer.

You can manipulate the default ports setting, as follows, with the /d parameter:

  • Use /d 0 to set UseInternetPort to Y.
  • Use /d 1 to set UseInternetPort to N.

Users can manipulate the Internet/intranet port settings with the PortsInternetAvailable registry key /pi and /pe parameters as follows:

  • Use /pi to set a specific port or range of ports to be stored as intranet available.
  • Use /pe to set a specific port or range of ports to be stored as Internet available.

The valid values for the PortsInternetAvailable registry key are Y or N

Handling Registry Formatting and Admit/Deny Lists

Block/allow lists are stored in the registry. The list consists of the index of each interface.

Old Format:

The old format stored the interface indices in the registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rpc\Linkage under the "Bind" key as type REG_MULTI_SZ. The indices were stored in the order in which they were specified with the /a parameter. Each index was converted to a zero-terminated string and these zero-terminated strings were placed one after another in the key. This list of strings were also NULL terminated.

New Format:

If RpcCfg detects that an old version of the runtime is installed, it uses the old format to create the indices. If it detects a new version running, it creates subnets instead. The new format stores subnets instead of indices.

Configuring RPC over Hypertext Transfer Protocol (HTTP)

RPC over HTTP uses the Client/Proxy/Server model. The administrator can configure the proxy, via a registry key, to only forward client requests to a particular set of servers. Furthermore, the administrator can specify a range of ports to which the proxy will forward requests on each server.

The user can list the existing settings, add new settings, or remove all settings for a given proxy. The user can also load or save registry settings to a file.


RpcCfg Syntax

RpcCfg uses the following general syntax:

One Step rpccfg [/pi PortNumber | PortRange...] | [/pe PortNumber PortRange] [/d {0|1}] [/r] [/q] [/l] [/ha ComputerName {PortNumber | PortRange}] [/hr ComputerName] [/hd] [/hl FileName] [/hs FileName] [/?]

Parameters

/pi PortNumber | PortRange [PortNumber | PortRange...]
Specifies the intranet-available ports for RPC. Type a single port number or a range, such as /pi 555 600-700 900. You cannot use /pi and /pe in the same command.
/pe PortNumber | PortRange [PortNumber | PortRange...]
Specifies the Internet-available ports for RPC. Type a single port number or a range, such as /pi 555 600-700 900. You cannot use /pi and /pe in the same command.
/d {0|1}
Sets the default port settings used by RPC. An argument of 0 (zero) indicates that the Internet ports should be used. An argument of 1 (one) indicates that the Intranet ports should be used.
/r
Restores the default port settings for RPC. This parameter deletes customized port settings.
/q
Displays the current port settings.
/l
Displays all subnets available to the computer (by network number) and lists the network interfaces that listen on each subnet.
/a index [index...]
Creates an exclusive list of subnets that can be used for RPC calls. The index argument identifies the subnet. To find the index of a subnet, use the /l (list) parameter. If you create an allow list, the system cannot use any subnets except those on the allow list for RPC calls. Interfaces that use other subnets cannot handle RPC communication.
/b index [index...]
Creates a list of subnets that cannot be used for RPC calls. The index identifies the subnet. To find the index of a subnet, use the /l (list) parameter. If you create a block list, the system can use any subnet that is not on the block list for RPC calls. Interfaces that use blocked subnets cannot handle RPC communication.
/ha ComputerName {PortNumber | PortRange}
Adds one or more proxy settings to the registry string for one computer. This does not modify any existing settings for the given proxy.
/hr ComputerName
Removes all settings for a given computer name. The /hr parameter is case insensitive.
/hd
Displays the current proxy settings.
/hl FileName
Retrieves the registry settings from a unicode file and commits them to the registry.
/hs FileName
Saves the current registry settings to a unicode file.
/?
Displays command-line usage.

Notes

  • When run without parameters, RpcCfg displays Help.
  • Block lists are supported only on Windows Server 2003
  • You cannot create an allow list and a block list on the same computer. If you try to create both, RpcCfg uses only the most recent list.
  • You cannot edit allow and block lists. The list you create by using the /a or /b parameters replaces any previously established lists.


RPC Endpoint Diagnostic Utility Examples

Example 1: Verify that Services are Registered and Responsive

In this example, a client tests the RPC connections to services. Type the following at the command line:

rpcdump /p:ncacn_np

Press ENTER. Output similar to the following displays all registered endpoints:

Querying Endpoint Mapper Database...
45 registered endpoints found.

ncacn_np(Connection-oriented named pipes)
  \\SERVER1[\PIPE\protected_storage] [12345678-1234-abcd-ef00-0123456789ab] IPSe
c Policy agent endpoint :YES
  \\SERVER1[\PIPE\lsass] [12345678-1234-abcd-ef00-0123456789ab] IPSec Policy age
nt endpoint :YES
  \\SERVER1[\PIPE\protected_storage] [12345778-1234-abcd-ef00-0123456789ac]  :YES
  \\SERVER1[\PIPE\lsass] [12345778-1234-abcd-ef00-0123456789ac]  :YES
  \\SERVER1[\PIPE\atsvc] [0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53]  :YES
  \\SERVER1[\PIPE\atsvc] [378e52b0-c0a9-11cf-822d-00aa0051e40f]  :YES
  \\SERVER1[\PIPE\atsvc] [1ff70682-0a51-30e8-076d-740be8cee98b]  :YES
  \\SERVER1[\pipe\HydraLsPipe] [493c451c-155c-11d3-a314-00c04fb16103]  :YES
  \\SERVER1[\pipe\HydraLsPipe] [12d4b7c8-77d5-11d1-8c24-00c04fa3080d]  :YES
  \\SERVER1[\pipe\HydraLsPipe] [3d267954-eeb7-11d1-b94e-00c04fa3080d]  :YES

ncacn_ip_tcp(Connection-oriented TCP/IP)
  10.10.249.136[1025] [12345778-1234-abcd-ef00-0123456789ac]  :YES
  10.10.249.136[1026] [0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53]  :YES
  10.10.249.136[1026] [378e52b0-c0a9-11cf-822d-00aa0051e40f]  :YES
  10.10.249.136[1026] [1ff70682-0a51-30e8-076d-740be8cee98b]  :YES
  10.10.249.136[1027] [906b0ce0-c70b-1067-b317-00dd010662da]  :YES
  10.10.249.136[1027] [906b0ce0-c70b-1067-b317-00dd010662da]  :YES
  10.10.249.136[1027] [906b0ce0-c70b-1067-b317-00dd010662da]  :YES
  10.10.249.136[1027] [906b0ce0-c70b-1067-b317-00dd010662da]  :YES
  10.10.249.136[1033] [493c451c-155c-11d3-a314-00c04fb16103]  :YES
  10.10.249.136[1033] [12d4b7c8-77d5-11d1-8c24-00c04fa3080d]  :YES
  10.10.249.136[1033] [3d267954-eeb7-11d1-b94e-00c04fa3080d]  :YES
  10.10.249.136[1025] [12345678-1234-abcd-ef00-0123456789ab] IPSec Policy agent
 endpoint :YES

rpcdump completed sucessfully after 1 seconds

Note

  • Some endpoints might not have a friendly name or annotation. The service that registers the endpoint fills in this field.

Example 2: Troubleshoot Client E-mail Service Responsiveness

In this example, a client is unable to start mail because it cannot connect to the server. You can run RPCDump on the Microsoft Exchange server to verify that the proper services (such as directory and store) are registered and responding to RPC calls. Type the following at the command line:

rpcdump /s server1 /i /v

Press ENTER. Output similar to the following is displayed:

ProtSeq:ncacn_np
Endpoint:\pipe\0000011C.001
NetOpt:
Annotation:Exchange Server STORE ADMIN Interface
IsListening:YES
StringBinding:ncacn_np:\\\\SERVER1[\\pipe\\0000011C.001]
UUID:a4f1db00-ca47-1067-b31e-00dd010662da
ComTimeOutValue:RPC_C_BINDING_DEFAULT_TIMEOUT
VersMajor 1  VersMinor 0

In the sample output, the Exchange server has registered its endpoints and is listening for RPC calls. In verbose mode, additional information is displayed, such as version and ComTimeOutValue.


RPC Endpoint Diagnostic Utility Remarks

Error Message for Unused Transports

The transport protocol specified when using the /p parameter must be installed on the client computer. Otherwise, RPCDump returns an error.

Type the following at the command line:

rpcdump /p ncacn_at_dsp

Press ENTER. If the transport protocol ncacn_at_dsp is not installed on the client, the following output is displayed:

ERROR:RpcNetworkIsProtseqValid:(The RPC protocol sequence is not supported. ).

Interpreting RPCDump Output

RPCDump output is formatted into three columns:

  • Column 1 contains the name of the server followed by the name of the tested service.
  • Column 2 contains the GUID of the service.
  • Column 3 contains the result of the PING.

The output looks similar to that in the sample below:

 \\SERVER1[\PIPE\protected_storage] [12345678-1234-abcd-ef00-0123456789ab] IPSe
c Policy agent endpoint :YES
 \\SERVER1[\PIPE\lsass] [12345678-1234-abcd-ef00-0123456789ab] IPSec Policy age
nt endpoint :YES
 \\SERVER1[\PIPE\protected_storage] [12345778-1234-abcd-ef00-0123456789ac]  :YES
 \\SERVER1[\PIPE\lsass] [12345778-1234-abcd-ef00-0123456789ac]  :YES
 \\SERVER1[\PIPE\atsvc] [0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53]  :YES
 \\SERVER1[\PIPE\atsvc] [378e52b0-c0a9-11cf-822d-00aa0051e40f]  :YES
 \\SERVER1[\PIPE\atsvc] [1ff70682-0a51-30e8-076d-740be8cee98b]  :YES
 \\SERVER1[\pipe\HydraLsPipe] [493c451c-155c-11d3-a314-00c04fb16103]  :YES


RPC Endpoint Diagnostic Utility Syntax

RPCDump uses the following syntax:

One Step rpcdump [/s] [/v] [/i] [/p Protocol]

Parameters

/s
Specifies the name of the server to interrogate. Defaults to local if not specified.
/v
Runs in verbose mode.
/i
Pings all registered RPC endpoints to determine whether or not the service that registered the endpoint is responsive.

Note

  • This can take a while over slow network links. RPCDump is multithreaded to help performance in this area. A status bar displays the progress.
/p Protocol
Specifies the name of one of the supported transport mechanisms of RPC. The default is ncacn_ip_tcp. Valid protocols include the following:
Protocol | Description
ncacn_np | Connection-oriented named pipes
ncacn_mq | Datagram using Microsoft Message Queue Server
ncadg_ipx | Datagram IPX
ncacn_spx | Connection-oriented SPX
ncacn_http | Connection-oriented TCP/IP using Microsoft Internet Information Services as HTTP proxy.
ncacn_nb_nb | Connection-oriented NetBEUI
ncacn_nb_tcp | Connection-oriented NetBIOS over TCP
ncacn_nb_ipx | Connection-oriented NetBIOS over IPX
ncacn_ip_tcp | Connection-oriented TCP
ncacn_at_dsp | AppleTalk DSP
ncadg_ip_udp | Datagram UDP
ncacn_vns_spp | Connection-oriented Vines SPP transport
ncacn_dnet_nsp | Connection-oriented DECnet transport
ncacn_nb_xns | Connection-oriented XNS


RPCPing Examples

Example 1: Ping a Server Through the RPC Connection

The task in this example is to verify RPC connectivity between two computers. RPCPing works much like the PING utility in that you only need to provide an IP address to test basic connectivity. Using just the /s parameter and no others, RPCPing assumes a TCP/IP connection and does not authenticate with the server. Type the following at the command line:

rpcping /s 10.0.0.100

Press ENTER. Output similar to the following is displayed:

Completed 1 calls in 1 ms
1000 T/S or   1.000 ms/T

This shows the output for a successful RPCPing. The output for an error contains more detail; see the next example to view the output displayed when RPCPing generates an error.

Example 2: View an RPCPing Error

The task in this example is to view output that displays when the ping sent by RPCPing is not returned successfully. In this example, a server name is given instead of an IP address. Type the following at the command line:

rpcping /s server1

Press ENTER. Output similar to the following is displayed:

Exception 1722 (0x000006BA)
Number of records is: 2
ProcessID is 2956
System Time is: 2/26/2003 21:28:48:130
Generating component is 8
Status is 1722
Detection location is 322
Flags is 0
NumberOfParameters is 0
ProcessID is 2956
System Time is: 2/26/2003 21:28:48:130
Generating component is 8
Status is 11001
Detection location is 320
Flags is 0
NumberOfParameters is 1
Unicode string: server1

Example 3: Ping a Server Through an RPC Connection Using Authentication

The task in this example is to verify RPC connectivity between two computers. Generally, when two computers establish an RPC session they authenticate each other. If an RPC ping without authentication is successful, the next step is to add authentication to the ping to see if the connectivity problem is in the authentication process. RPCPing includes several parameters that involve authentication. In this example, the basic security parameters /u and /a are used: The /u parameter specifies that the server and client will negotiate the highest mutual level of security, and the /a parameter specifies when the authentication occurs. Type the following at the command line:

rpcping /s 10.0.0.100 /u 9 /a connect

Press ENTER. Output similar to the following is displayed:

Completed 1 calls in 10 ms
100 T/S or  10.000 ms/T

Note

  • Although most RPCPing parameters allow a space between the parameter and the value, the /u and /a parameters do not.

Example 3: Display Verbose Output

The task in this example is to verify RPC connectivity between two computers and display verbose output. In this example, the basic security parameters /u and /a are used: The /u parameter specifies that the server and client will negotiate the highest mutual level of security, and the /a parameter specifies when the authentication occurs. The verbosity level of the output is set to 2. Type the following at the command line:

rpcping /s 10.0.0.100 /u 9 /a connect /v 2

Press ENTER. Output similar to the following is displayed:

RPCPing v2.12. Copyright (C) Microsoft Corporation, 2002
Operating System Version is: 5.2
Completed 1 calls in 10 ms
100 T/S or  10.000 ms/T


RPCPing Remarks

Using Case-Sensitive RPCPing Parameters

Parameters in RPCPing are case-sensitive. Some parameters, such as /s and /S, use the same letter but have different functions.

Using RPCPing

Since RPCPing is only checking for connectivity, it does not attempt to interpret the response received from the server. Any response from the server means that there is RPC connectivity between the computers.

Running RPCPing with No Parameters

RPCPing has an optional parameter, /s, that identifies the IP address of the server to ping. If this parameter is omitted, RPCPing uses its own IP address and pings itself.


RPCPing Syntax

RPCPing uses the following general syntax:

One Step rpcping [/t prot_sequence] [/s IP_address] [/e endpoint] [/f interface_UUID[,major_ver]] [/o binding_options] [/i iterations] [/r seconds] [/I user,domain,password] [/v level] [/l filename [/p]] [/u security_package_ID] [/a auth_level] [/N principal_name] [/C Capabilities] [/T {static|dynamic}] [/M impersonation_type] [/S server_sid] [/B server_certificate_subject] [/E] [/R proxy_server] [/H RPC/HTTP_auth_schemes] [/F RPC/HTTP_flags] [/P user,domain,password] [/b] [/q]

Parameters

/t prot_sequence
Specifies a sequence of protocols that the computers are using to communicate. If omitted, TCP/IP is assumed. For a list of valid protocol sequences, see MSDN article RPC Structures (http://go.microsoft.com/fwlink/?LinkID=14981).
/s IP_address
Specifies the IP address, computer name or DNS name of the server to ping. If omitted, the local computer's IP address is used and the computer pings itself.
/e endpoint
Specifies a port to use for the ping. If omitted, the server's endpoint mapper is pinged.
/f interface_UUID,major_ver
Specifies the universally unique identifier (UUID) of the interface to ping on the server. An interface, like an application programming interface (API), is a developer-defined specification of how the client and server communicate over a specific application's RPC. The interface has a version number in the form of #.# (where # represents a number). Majorver refers to the number on the left side of this version number. For a successful connection, the major version numbers of the client and server must match. If majorver is omitted, version 1 is assumed.
/o binding_options
Specifies extra network options to include in the binding handle. When making an RPC connection, the client sends the server a binding handle, which consists of the interface UUID (provided by the /f parameter), the protocol sequence (provided by the /t parameter), the server's IP address (provided by the /s parameter), and the endpoint (provided by the /e parameter).
/i iterations
Specifies the number of pings to send. If omitted, the default is one.
/r seconds
Displays ping results after a given number of seconds. This option is only available if the /i parameter is used and more than one ping is performed. If omitted, RPCPing only displays the results of the final ping.
/I user,domain,password
Specifies an alternate set of credentials to send to the server. Type a star (*) instead of the password and RPCPing will prompt for the password. If omitted, the credentials of the currently logged-on user are sent.
/v level
Specifies the verbosity level of the output. If omitted, the default level is 1.
Level | Description
1 | Includes the number of calls completed and the time it took for a successful ping to complete.
2 | Adds the RPCPing and operating system version numbers to the output.
3 | Displays the same output as verbosity level 2.
/l filename
Directs all output to a log file specified by filename. If omitted, no log file is created.
/p
Appends output to a previously created log file. This option is only available if the /l parameter is used. If omitted, a log file with the same name is overwritten.
/u security_package_ID
Specifies which security provider to use. Each level is identified by a number. If omitted, RPCPing does not use security as part of the ping. When you use the /u parameter, the /a parameter is also required. Valid numbers include those in the following table.
Security Package ID | Description
9 | Negotiate the highest mutual security package level.
10 | Use NTLM.
14 | Use SChannel.
16 | Use Kerberos.
/a auth_level
Specifies when authentication occurs. If this parameter is used, the /u parameter is also required. If omitted, RPCPing does not use security as part of the ping.
Level | Description
connect | Authentication occurs when the connection is established.
call | Authentication occurs when each RPC is made. If this level of authentication is set and a connection-oriented protocol is used, the pkt authentication level is used instead.
pkt | Verifies that all data packets received are from the expected client.
integrity | Verifies that all data packets received are from the expected client, then ensures that the data in the packets has not been modified.
privacy | Encrypts the data. Verifies that all data packets received are from the expected client, then ensures that the data has not been modified. For local calls, a secure channel is used instead of encryption.
/N principal_name
Specifies the principal name of the server. Use this parameter only if the /u and /a parameters are also specified.
/C Capabilities
Sets flags that send additional information required for security settings. Use this parameter only if the /u and /a parameters are also specified.
Flag | Description
0x0 | No additional flags are needed.
0x1 | Requests mutual authentication from the server. If the server is not configured to provide mutual authentication and this flag is set, the ping will fail.
0x4 | Allows the server to accept the client's credentials even if the client's certificate is not listed as a trusted certification authority (CA) on the server. This option only works when the /u parameter sets security_package_ID to 14 (SChannel).
/T {static|dynamic}
Specifies whether security is reestablished if client identity settings change during the RPC session. Specify static to not check for changes once the secure channel is established. Specify dynamic to reestablish security if the client's identity settings are modified during the RPC session. Use this parameter only if the /u and /a parameters are specified. If omitted, the default is dynamic.
/M impersonation_type
Specifies if and how the server can impersonate the client to other services, if needed. Use this parameter only if the /u and /a parameters are specified. If omitted, the default is impersonate.
Type | Description
anonymous | The client does not provide identification information to the server, and the server cannot impersonate the client. Many servers do not accept this impersonation level.
identify | The server can obtain information about client identification and privileges, but cannot impersonate the client. Some servers assume that this level actually means impersonate.
impersonate | The server can impersonate the client to local services on the server only.
delegate | Specifies that the impersonation type is delegation. For more information see the MSDN Library Reference RPC_SECURITY_QOS (http://go.microsoft.com/fwlink/?LinkID=14992).
/S server_sid
Specifies the expected security identifier (SID) of the server. This parameter requires that the computer be running Windows Server 2003 and is available only if the /u and /a parameters are specified.
/B server_certificate_subject
Compares the server principal name with the name in the Subject field of the server's certificate. If these names do not match, the ping fails. This parameter requires that the server be running Windows Server 2003 or Windows XP with Service Pack 2 or later applied (Service Pack 1 also works if QFE 331320 has been applied). This parameter also requires that the /u and /a parameters be specified.
/E
Pings the HTTP proxy server only and does not continue the ping to the RPC server. This parameter requires that the server be running Windows Server 2003 or Windows XP with Service Pack 2 or later applied (Service Pack 1 also works if QFE 331320 has been applied). This parameter also requires that the /u and /a parameters be specified.
/R proxy_server
Specifies an HTTP proxy server to use. If omitted, RPCPing finds the proxy server from the settings in Internet Explorer. If http_proxy is set to none, RPCPing does not use a proxy and attempts a direct connection to the RPC server. This parameter requires that the server be running Windows Server 2003 or Windows XP with Service Pack 2 or later applied (Service Pack 1 also works if QFE 331320 has been applied).
/H RPC/HTTP_auth_schemes
Specifies the method of authentication to use for RPC/HTTP connections. This parameter requires that the server be running Windows Server 2003 or Windows XP with Service Pack 2 or later applied (Service Pack 1 also works if QFE 331320 has been applied). This parameter also requires that the /u, /a, and /H parameters be specified. Valid numbers include those listed in the following table. The flag is a hexadecimal number with any of the following being set:
Number | Description
0x1 | Basic: do not encrypt the user name or password.
0x2 | Use NTLM to encrypt the user name and password.
0x4 | Passport: not yet supported. Do not use.
0x8 | Digest: not yet supported. Do not use.
0x10 | Negotiate: not yet supported. Do not use.
/F RPC/HTTP_flags
Specifies how RPC/HTTP front-end authentication is performed. This parameter requires that the server be running Windows Server 2003 or Windows XP with Service Pack 2 or later applied (Service Pack 1 also works if QFE 331320 has been applied). The flag is a hexadecimal number with any of the following being set:
Flag | Description
0x1 | Use Secure Sockets Layer (SSL) for all communication with the proxy server.
0x2 | Use the first authentication scheme specified in the /H parameter without querying the server.
/P user,domain,password
Specifies an alternate set of credentials to use for authentication with the RPC/HTTP proxy server. Type a star (*) instead of the password and RPCPing will prompt for the password. If omitted, the credentials of the currently logged-on user are used. This parameter requires that the server be running Windows Server 2003 or Windows XP with Service Pack 2 or later applied (Service Pack 1 also works if QFE 331320 has been applied). This parameter also requires that the /u, /a, and /H parameters be specified.
/b
Retreives the server principal name of the RPC/HTTP proxy server from the Subject field in the server's certificate and displays it in human readable form. If these names do not match, the ping fails. This parameter requires that the server be running Windows Server 2003 or Windows XP with Service Pack 2 or later applied (Service Pack 1 also works if QFE 331320 has been applied). This parameter also requires that the /u, /a, and /E parameters be specified and that the /F parameter specifies the SSL flag.
/q
Places RPCPing in quiet mode. In quiet mode, RPCPing assumes that the answer to all prompts is y, which means yes.


RPing Examples

Overview | Remarks | UI | Syntax | Examples | Related Tools Open Command Prompt

Use RPingS and RPingC together

The task in this example is to test RPC connectivity over a network. To do this, you will need both RPingS and RPingC. In this example, the RPC server is named Server1 and the RPC client is named Client1. To start RPingS on the server, type the following at the command line:

RpingS

Press ENTER. Output similar to the following is displayed:

+endpoint \pipe\rping on protocol sequence ncacn_np is set for use.
 -protocol Sequence ncacn_nb_nb not supported on this host
+endpoint rping on protocol sequence ncalrpc is set for use.
+endpoint 2256 on protocol sequence ncacn_ip_tcp is set for use.
 -protocol Sequence ncacn_nb_tcp not supported on this host
 -protocol Sequence ncacn_spx not supported on this host
+endpoint 2256 on protocol sequence ncadg_ip_udp is set for use.
 -protocol Sequence ncadg_ipx not supported on this host
 -protocol Sequence ncacn_vns_spp not supported on this host

Enter '@q' to exit rpings.

Do not exit RPingS.
From Client1, start RPingC. Enter the name or IP address of the Server1 and click Start. By default, RPingC sends one RPC ping on the first available protocol.

Output similar to the following is displayed in the RPingC window:

Successful RPC binding using these parameters:
    network address = client1
    endpoint = \pipe\rping
    UUID =

    protocol sequence = ncacn_np
Ping #1 Succeeded
Server Statistics:
   #Calls Received at Server = 2
   #Calls Initiated by Server = 0
   #Packets Received at Server = 2
   #Packets Initiated by Server = 2


RPing Remarks

Overview | Remarks | UI | Syntax | Examples | Related Tools Open Command Prompt

Starting RPingC

Start RPingC by double-clicking the rpingc.exe file in the \Program Files\Windows Resource Kit Tools folder, or by running rpingc.exe at the command prompt.

Running RPingS Without Parameters

When run without parameters, RPingS lists all protocol sequences and specifies the ones that are available on the local computer. Run RPingS on the RPC server to discover which protocol sequences are available.

Exiting RPingS

RPingS runs continuously until stopped. Run RPingS on the RPC server continuously if you want to use RPingC on client computers to test RPC connectivity on the RPC server. To stop and exit RPingS, enter @ and then q.


RPingS Syntax

Overview | Remarks | UI | Syntax | Examples | Related Tools Open Command Prompt

The RPing tool has two components:

  • RPingS is the server side component and works at the command line.
  • RPingC is the client component of the RPing tool and has a GUI interface. See RPingC UI for information on using RPingC.

RPingS uses the following syntax:

One Step rpings [-p ProtocolSequence]

Parameters

ProtocolSequence
Specifies a friendly name for one of the transport protocol sequences that an RPC can use and starts the server component of RPing. Once entered, RPingS discovers if the listed protocol sequence is available on the local computer. The available friendly names are as follows:
Friendly Name | Description
namedpipes | Network Computing Architecture (NCA) connection over Named Pipes (ncacn_np)
tcpip | NCA connection over TCP/IP (ncacn_ip_tcp)
netbios | NCA connection over NetBIOS on NetBEUI (ncacn_nb_nb)
ipx/spx | NCA connection over SPX (ncacn_spx)
vines | NCA connection over Banyan Vines (ncacn_vns_spp)

Note

  • Run RPingS on the RPC server continuously if you want to use RPingC on client computers to test RPC connectivity on the RPC server.


RPingC UI

Overview | Remarks | UI | Syntax | Examples | Related Tools Open Command Prompt

The RPing tool has two components:

  • RPingS is the server side component and only works at the command line. See RPingS Syntax for information on using RPingS.
  • RPingC is the client component of the RPing tool and has a GUI interface.

RPingC Options

Option | Description
Exchange Server | Specifies the name or IP address of the RPC server. The RPC server must have RPingS running to return a successful ping.
Protocol Sequence Lists a name that represents a protocol sequence that RPingC can use to ping the RPC server. Select from the following:
  • Any: Uses the first available protocol sequence
  • Named Pipes: Uses only the ncacn_np protocol sequence
  • IPX/SPX: Uses only the ncacn_spx protocol sequence
  • TCPIP: Uses only the ncacn_ip_tcp protocol sequence
  • Netbios: Uses only the ncacn_nb_nb protocol sequence
  • Vines: Uses only the ncacn_vns_spp protocol sequence
Endpoint Specifies an port to use for the ping.
  • RPing: Queries the endpoint map for a port
  • Store: Queries the endpoint map for port that includes _store_ as part of its name
  • Admin: Queries the endpoint map for port that includes _admin_ as part of its name
Number of Pings | Select Continuous to send pings to the RPC server until the Stop button is pressed or select Stop at: and specify the number of pings to perform.
Mode | Select Ping only to send pings to the RPC server. Select Enpoint Search to query the endpoint mapper of the RPC server and display a list of available endpoints.
Run with Security | If checked, the ping includes authentication to verify that authenticated RPC connections are working.
Start | Starts sending pings using the current settings.
Stop | Stops sending pings.
Exit | Closes the RPingC dialog box.
Help | Lists the version number of RPingC.


RQC Remarks

Overview | Remarks | Syntax | Related Tools Open Command Prompt

Creating the Script

An administrator-created script is an integral part of Network Access Quarantine Control. The script can check clients for settings like service pack version number, virus protection and signature file version number, the presence of client firewall software, the use of a client screen saver password, and whether the client has routing enabled. The specifics of what the script checks for varies depending on the security and software requirements of your network.

The first part of the script sets the information needed for the RQC parameters. Next is the section that sets the MYSTATUS variable. This is the section that tests the client for compliance with network standards. If at any time the client does not meet network standards, the script should end with an error. After the checks are completed, the script calls RQC if the machine meets the criteria set out in the script. RQC notifies the listener component on the server running Routing and Remote Access that the client has successfully met all network standards, and that the client can have the normal remote access policy applied instead of the quarantine policy.

@echo off
setlocal

echo    RAS Connection = %1
echo Tunnel Connection = %2
echo            Domain = %3
echo         User Name = %4

set MYSTATUS=0

REM
REM  Validate policy...
REM

REM
REM  Check if Microsoft ICS is turned on.
REM

REM You must add in script code here to set MYSTATUS, as appropriate.

REM
REM  Check if Microsoft Firewall is turned on.
REM

REM You must add in script code here to set MYSTATUS, as appropriate.

REM
REM  Based on the results, call RQC.
REM

if not "%MYSTATUS%" == "1" goto :EOF

rqc.exe %1 %2 7250 %3 %4 Version1

REM
REM  Print out the status.
REM

if "%ERRORLEVEL%" == "0" (
      set MYERRMSG=Success!
) else if "%ERRORLEVEL%" == "1" (
      set MYERRMSG=Unable to contact remote access gateway.  Quarantine support appears disabled.

REM You must add in script code to redirect to web page.

) else if "%ERRORLEVEL%" == "2" (
      set MYERRMSG=Access denied.  The client will remain in quarantine until a new Connection Manager profile is downloaded.

REM You must add in script code to redirect to web page.

) else (
      set MYERRMSG=Unknown failure.  The client will remain in quarantine.

REM You must add in script code to redirect to web page.

)
echo %MYERRMSG%

In this example, the script is named Quarantine.bat. When creating the profile, call the script from a Post-Connect custom action box in the CMAK wizard. Following the name of the script are CM variables, used to provide information needed for the RQC parameters. For more information about RQC parameters and the CM variables that are used, see the Syntax page. The script is called with the following entry:

quarantine.bat %DialRasEntry% %TunnelRasEntry% %Domain% %UserName%

If the script does not run successfully, it should redirect users to an internal Web page accessible from the quarantine network that allows them to install the software that they are missing or fix the settings that are not configured correctly.

Configuring Network Access Quarantine Control

Network Access Quarantine Control requires a few services. Your network needs to have the following:

  • Server(s) running the Windows Server 2003 Routing and Remote Access service
  • Connection Manager

You can create a CM profile by using CMAK, configuring the CM profile to incorporate the custom action of calling the administrator-created script as a post-connect action. You must also add the client-side executable Rqc.exe to the CM profile when you create the profile.

To configure Network Access Quarantine Control:

  1. Create a script that verifies client settings and services. For more information, see Creating the Script.
  2. Create a CM profile by using CMAK. Complete the following steps:
    • Run the CMAK Wizard.
    • Select Create a custom action.
    • Select Client Policy-checking Script as the custom action for the policy.
    • Under Edit Custom Action, enter the name of the administrator-created script or batch file in the Program to run box.
    • Set Action type to Post-connect, and then set Run this custom action for to All connections.

      • Note

      • If you do not want all remote access server connections to be placed in quarantine mode, you can place users that need quarantine in a group and apply this policy only to that group. In such a case, instead of applying the custom action to All connections, specify the group to place in quarantine mode.
    • Select Include the custom action program with this service profile. In Parameters, enter the following:
      • %DialRasEntry% %TunnelRasEntry% 7250 %Domain% %UserName% Version1

      Note

      • The variables used are CM variables. The use of these variables is explained on the Syntax page. The port number (7250) and version number are the only RQC parameters that do not accept CM variables. You can modify these entries with different parameters as appropriate.
    • On the Additional Files page of the CMAK Wizard, click Add. Browse to the file Rqc.exe and select it, and then proceed with the rest of the wizard by clicking Next.
  3. Distribute the profile to users for installation on remote client computers. The profile you created is a self-extracting .exe file. Distribution methods include CD, internal Web site or manual installation. See CMAK Help for more information about distribution methods.
  4. Create a quarantine policy by using the New Remote Access Policy Wizard. In Windows Server 2003, if IAS is installed, remote access policies are created and administered on the IAS server.
    • Open the IAS snap-in by clicking Start, Administrative Tools, and then selecting Internet Authentication Service.
    • Start the Remote Access Policy Wizard by right-clicking the Remote Access Policies container and selecting New Remote Access Policy.
    • Click Next on the welcome page.
    • On the Policy Configuration Method page, select Use the wizard to set up a typical policy for a common scenario, and then type a descriptive name (such as Quarantine) in the Policy Name box. Click Next.
    • On the Access Method page, select VPN for the method of access. Click Next.
    • On the User or Group Access page, select Group, and then click Add. In the Select Groups dialog box, select the groups that need quarantine control. Click OK to go back to the User or Group Access page, and then click Next.
    • On the Authentication Methods page, select the level of authentication required by the server running Routing and Remote Access.
    • On the Policy Encryption Level page, clear the Basic encryption and Strong encryption check boxes. Make sure the Strongest encryption check box is selected.
    • Click Finish.

    Note

    • This generic policy must be edited to so that it contains the necessary settings to use it as a quarantine policy. You cannot access the options needed for a quarantine policy when you first create the policy, but you can access them by editing the policy.
  5. Edit the generic policy created in the previous step to turn it into a quarantine policy.
    • Right-click the newly created quarantine policy in the contents pane of the IAS server, and then click Properties.
    • Click the Advanced tab.
    • Select MS-Quarantine-IPFilter from the Attribute list, and then click Add. The IP filter Attribute Information dialog box opens. Click Input Filters to open the Inbound Filters dialog box. Click New, and the Add IP Filter dialog box opens. Click to select the Destination network check box, and then type values in IP address and Subnet mask that match your network's configuration. In the Protocol box, select TCP. Type 7250 in the Source port and the Destination port boxes, and then click OK. In Inbound Filters, for Filter action, click Permit only the packets listed below, and then click OK.
    • If your remote users need services such as DHCP, DNS, or WINS you need to repeat the previous steps to add input filters for these types of traffic. Also, include an input filter for HTTP traffic if users are redirected to an internal Web site when they are placed in quarantine.
    • To add a quarantine session timer in the Attribute list, select MS-Quarantine-Session-Timeout, and then click Add. The Attribute Information dialog box opens. In Attribute value, type the number of seconds you want client computers to be connected in quarantine mode. Once the seconds have elapsed, the user is disconnected from the server running Routing and Remote Access. Click OK and Close before closing the profile properties dialog box.
  6. Place this quarantine policy at the top of the list of Remote Access Policies.
  7. Make sure you have another Remote Access Policy that allows access to users once they are out of quarantine.


RQC Syntax

Overview | Remarks | Syntax | Related Tools Open Command Prompt
RQC has the following syntax:

One Step rqc ConnName TunnelConnName Port Domain UserName String

Parameters

ConnName
Specifies the name of the remote access server connection on the host. The value of this parameter can be inherited from the CM profile %DialRasEntry% variable.
TunnelConnName
Specifies the name of the remote access server tunnel connection on the host. The value of this parameter can be inherited from the CM profile %TunnelRasEntry% variable.
Port
Specifies the port to which the quarantine string is sent. The default port used by Remote Agent Quarantine Agent (RQS) on the remote access server is TCP port 7250. Specify a different port number for RQC only if RQS is using a different port number.
Domain
Specifies the domain of the connecting user. The value of this parameter can be inherited from the CM profile %Domain% variable.
UserName
Specifies the user name of the connecting user. The value of this parameter can be inherited from the CM profile %UserName% variable.
String
Specifies a text string that contains the version of the administrator-created script. All characters are accepted except for the /0 character sequence.


RQS Remarks

Overview | Remarks | Syntax | Related Tools Open Command Prompt

Installing Remote Access Quarantine Agent service

  1. Install the Windows Server 2003 Resource Kit on a server running Routing and Remote Access.
  2. In the folder that contains the Resource Kit tools (by default, \Program Files\Windows Resource Kit Tools), right-click rqs_setup.bat, and then click Edit on the shortcut menu. This batch file installs the service and places the version number of the script in the AllowedSet value in the registry.
  3. To edit the version numbers, go to the following line:
    4. REM REG ADD %ServicePath% /v AllowedSet /t REG_MULTI_SZ /d Version1\0Version1a\0Test

    Remove REM, so the line reads as follows:

    REG ADD %ServicePath% /v AllowedSet /t REG_MULTI_SZ /d Version1\0Version1a\0Test
  4. Edit the version numbers so they reflect the version numbers that you are using. The example text shows multiple version numbers, each separated with a backslash (\). Remove all except the version numbers that you allow clients to use.

    5. Note

    • The version number in Rqs_setup.bat must match the version number used by clients in the administrator-created script. This version number is contained in the line that calls the RQC notifier component. For more information, see "Creating the Script" on the RQC Remarks page.
  5. Save and close Rqs_setup.bat.
  6. Type the following at the command line:

    7. rqs_setup.bat /install

    Press ENTER. Output similar to the following is displayed:

    RQS.EXE
RQS_SETUP.BAT
        2 file(s) copied.
[SC] CreateService SUCCESS
[SC] ChangeServiceConfig2 SUCCESS
The operation completed successfully.
The operation completed successfully.
The operation completed successfully.

    The batch file adds the included version numbers in the registry entry AllowedSet in the HKLM\System\CurrentControlSet\Services\Rqs subkey.

    Note

    • The installation program saves all necessary files to the %systemroot%\System32\Ras folder.
  7. Start the RQS service by using the Services snap-in or by typing net start rqs at the command line.
  8. For more information, see Configuring Network Access Quarantine Control.

Note

  • By default, the RQS service is configured on remote access servers with a startup type of Automatic. To start the service, use the Services snap-in or the RQS /run parameter. For information about setting the syntax for RQS, see the Syntax page.

Configuring Network Access Quarantine Control

Once RQS is installed, the client side of Network Access Quarantine Control must be configured. This includes creating a script and profile that call a notifier component. The notifier component included in the Windows Server 2003 Resource Kit is RQC. For information about configuring this script and profile, see the RQC Remarks page.

Uninstalling RQS

To uninstall RQS, type the following at the command line:

rqs_Setup /remove

Press ENTER. Output similar to the following is displayed:

[SC] DeleteService SUCCESS
Permanently delete the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\EventLog\System\Rqs
(Yes/No)?

Type y, and press ENTER to continue. Output similar to the following is displayed:

y
The operation completed successfully.


RQS Syntax

Overview | Remarks | Syntax | Related Tools Open Command Prompt
RQS has the following syntax:

One Step rqs /run

Parameter

/run
Displays current client connection information for the RQS service.

Note

  • RQS keeps running until stopped. Press CTRL+C or CTRL+BREAK to stop it.


SetPrinter Examples

Examples for Printer Information Level 0

Example 1: Change the Print Queue Status

The task in this example is to change the print queue status. Type the following at the command line:

setprinter \\woodgrovebank\jrl-22 0 "status=notavailable" setstatus

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl-22' succeeded.

Note

  • To change the print spooler status back to Ready, enter "status=0" instead of "status=notavailable" in the command statement.

Example 2: Delete All Print Jobs from All Printers on a Server

The task in this example is to delete all print jobs from all printers on a server. Type the following at the command line:

setprinter \\woodgrovebank 0 purge

Press ENTER. The following output is displayed:

Printer (1 of 1): \\woodgrovebank\jrl-22
Set printer on '\\woodgrovebank\jrl-22' succeeded.

Example for Printer Information Level 1

Example: Show Level 1 Settings

The task in this example is to view level 1 settings. Type the following at the command line:

setprinter /show \\woodgrovebank\jrl-22 1

Press ENTER. The following output is displayed:

       Flags=8388608
pDescription="\\woodgrovebank\jrl-22 Optra S 2455 (MS),Lexmark Optra S 2455 (MS),"
       pName="\\woodgrovebank\jrl-22 Optra S 2455 (MS)"
    pComment=""

Note

  • SetPrinter does not support the setting of level 1 values.

Examples for Printer Information Level 2

Example 1: Rename a Printer

The task in this example is to rename a printer. Type the following at the command line:

setprinter \\woodgrovebank\jrl 2 "pPrinterName=jrl-22"

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl' succeeded.

Example 2: Add Printer Shares

The task in this example is to share a remote printer by using SetPrinter. Type the following at the command line:

SetPrinter \\rktprnsrv\lexmark 2 "pShareName=jrl-22" "Attributes=+shared"

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl-22' succeeded.

Example 3: Create a Printer Pool

The task in this example is to create a print spooler that has many printers attached to it (also called printer pooling). Type the following at the command line:

setprinter PrinterName 2 "pPortName=LPT1,LPT2,IP_10.0.0.0"

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl-22' succeeded.

Example for Printer Information Level 3

Example: Change Print Queue Security

Caution

  • Changing the security descriptor might make the print queue inaccessible, and require the use of a registry editor to fix.
  • No support is provided for partial modifications.

The task in this example is to change the security settings of a printer. Type the following at the command line:

setprinter \\woodgrovebank\jrl-22 3 "pSecurityDescriptor=O:BAG:DUD:(A;CIIO;RC;;;CO)(A;OIIO;GA;;;CO)(A;;SWRC;;;WD)(A;CIIO;GX;;;WD)(A;;LCSWSDRCWDWO;;;BA)(A;OICIIO;GA;;;BA)(A;;LCSWSDRCWDWO;;;PU)(A;OICIIO;GA;;;PU)"

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl-22' succeeded.

Example for Printer Information Level 4

Example: Change the Printer Name

The task in this example is to rename a printer. Type the following at the command line:

setprinter \\woodgrovebank\jrl-22 4 "pPrinterName=jrl"

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl-22' succeeded

Note

  • Level 4 is not often used, because level 2 provides the same functionality with more control.

Example for Printer Information Level 5

Example: Change the Transmission Retry Timeout

The task in this example is to change the transmission retry timeout. Type the following at the command line:

setprinter \\woodgrovebank\jrl-22 5 "TransmissionRetryTimeout=800"

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl-22' succeeded/

Example for Printer Information Level 6

Example: Change the Print Queue Status

The task in this example is to change the print queue status. Type the following at the command line:

setprinter \\woodgrovebank\jrl-22 6 "dwstatus=+notavailable"

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl-22' succeeded

Note

  • To change the print spooler status back to Ready, enter "status=0" instead of "dwstatus=+notavailable" in the command statement.

Examples for Printer Information Level 7

Example 1: Add a Printer in Active Directory

The task in this example is to publish a printer in Active Directory. Type the following at the command line:

setprinter \\woodgrovebank\jrl-22 0 7 "dwAction=publish"

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl-22' succeeded (DS operation pending).

Example 2: Remove a Printer from Active Directory

The task in this example is to remove a printer from Active Directory. Type the following at the command line:

setprinter \\woodgrovebank\jrl-22 0 7 "dwAction=unpublish"

Press ENTER. The following output is displayed:

Set printer on '\\woodgrovebank\jrl-22' succeeded (DS operation pending).

Example 3: Add All Printers Attached to a Server in Active Directory

The task in this example is to publish a all printers attached to a print server in Active Directory. Type the following at the command line:

setprinter \\woodgrovebank 0 7 "dwAction=publish"

Press ENTER. The following output is displayed:

Printer (1 of 1): \\rktprnsrv\Lexmark
Set printer on '\\rktprnsrv\Lexmark' succeeded (DS operation pending).

Example for Printer Information Level 8

Example: Disable a Printer's Collate Feature

The task in this example is to disable a printer's collate feature. Type the following at the command line:

setprinter \\rktprnsrv\jrl-22 8 "pdevmode=dmCollate=0"

Press ENTER. The following output is displayed:

Set printer on '\\rktprnsrv\lexmark' succeeded.

Example for Printer Information Level 9

Example: Enable Long-Side Duplex Printing and Collation

The task in this example is to enable long-side duplex printing and collation on a printer. Type the following at the command line:

setprinter \\rktprnsrv\rkl-22 9 "pdevmode=dmduplex=2,dmCollate=1,dmFields=|duplex collate"

Press ENTER. The following output is displayed:

Set printer on '\\rktprnsrv\lexmark' succeeded.


SetPrinter Remarks

Introduction

SetPrinter uses the SetPrinter application programming interface (API) to configure printers. For more information about this API, see MSDN article SetPrinter API (http://go.microsoft.com/fwlink/?LinkId=14299).

Special Names

The following are special names for printer status:

  • paused
  • error
  • pending
  • delete
  • paperjam
  • paperout
  • manualfeed
  • paperproblem
  • offline
  • ioactive
  • busy
  • printing
  • outputfull
  • notavailable
  • waiting
  • processing
  • initializing
  • warmingup
  • tonerlow
  • notoner
  • pagepunt
  • userintervention
  • outofmemory
  • dooropen
  • serverunknown
  • powersave
    •

The following are special names for printer attributes:

  • queued
  • direct
  • default
  • shared
  • network
  • hidden
  • local
  • devq
  • keepjobs
  • docompletefirst
  • workoffline
  • bidi
  • rawonly
  • published
  • fax
  • TS
    •

The following are special names for Active Directory printer operations:

  • publish
  • update
  • unpublish
  • republish
  • pending
    •

SetPrinter Levels

SetPrinter uses levels to distinguish between different data types located in memory.

Level 0

Level 0 is normally used with any one of four parameters:

  • pause - Pauses the specified print queue.
  • resume - Resumes a specified print queue that has been paused.
  • purge - Deletes all print jobs from the specified print queue.
  • setstatus - Changes the status of the specified print queue; must be used with the Status= keyword/value pair.
Keyword | Value Description
Status= | Specifies the printer status. This keyword can accept a list of numbers or special names as values. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x. See Special Names for the list of valid names. Separate items in the list with a space or tab, and enclose the list with quotation marks.

Note

  • See the Syntax and Examples pages for usage.

Level 1

SetPrinter does not support the setting of level 1 data. This information is provided only for completeness, because level 1 data can be shown with the /show parameter. The following table lists the valid keyword/value pairs for level 1.

Keyword | Value Description
Flags= | A 32-bit number. May start with 0x to specify a hexadecimal value.
pDescription= | Pointer to a NULL-terminated string that describes the contents of the structure. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value
pName= | Pointer to a NULL-terminated string that names the contents of the structure. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pComment= | Pointer to a NULL-terminated string that contains additional data describing the structure. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.

Level 2

Level 2 is used to configure most print queue settings. The following table lists the valid keyword/value pairs for level 2.

Keyword | Value Description
pServerName= | Pointer to a NULL-terminated string identifying the server that controls the printer. If this string is NULL, the printer is controlled locally. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pPrinterName= | Pointer to a NULL-terminated string that specifies the name of the printer.The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pShareName= | Pointer to a NULL-terminated string that identifies the share point for the printer. (This string is used only if the PRINTER_ATTRIBUTE_SHARED constant was set for the Attributes member.) The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pPortName= | Pointer to a NULL-terminated string that identifies the port or ports used to transmit data to the printer. If a printer is connected to more than one port, the names of each port must be separated by commas (for example, "LPT1:,LPT2:,LPT3:").
pDriverName= | Pointer to a NULL-terminated string that specifies the name of the printer driver. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pComment= | Pointer to a NULL-terminated string that provides a brief description of the printer. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pLocation= | Pointer to a NULL-terminated string that specifies the physical location of the printer. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pDevMode= | Pointer to a DEVMODE structure that defines default printer data such as paper orientation and resolution. pDevMode= can be "NULL" (that is, use the default) or a comma-delimited sequence of keyword/value pairs. For a list of pDevMode= keyword/value pairs, see DEVMODE Information.
pSepFile= | Pointer to a NULL-terminated string that specifies the name of the file used to create the separator page. This page is used to separate print jobs sent to the printer. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pPrintProcessor= | Pointer to a NULL-terminated string that specifies the name of the print processor used by the printer. You can use the EnumPrintProcessors function to obtain a list of print processors installed on a server. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pDatatype= | Pointer to a NULL-terminated string that specifies the data type used to record the print job. Can use the EnumPrintProcessorDatatypes function to obtain a list of data types supported by a specific print processor. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pParameters= | Pointer to a NULL-terminated string that specifies the default print-processor parameters. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pSecurityDescriptor= | Pointer to a SECURITY_DESCRIPTOR structure for the printer. This value is a string in Security Descriptor Definition Language (SDDL) format. NULL pointer values are allowed. For more information, see SDDL Format.
Attributes= | Specifies the printer attributes. This keyword can accept a list of numbers or special names as values. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x. See Special Names for the list of valid names. Separate items in the list with a space or tab, and enclose the list with quotation marks.
Priority= | Specifies a priority value that the spooler uses to route print jobs. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x.
DefaultPriority= | Specifies the default priority value assigned to each print job. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x.
StartTime= | Specifies the earliest time at which the printer will print a job. This value is expressed as minutes elapsed since 12:00 A.M. Coordinated Universal Time (Greenwich Mean Time). Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x.
UntilTime= | Specifies the latest time at which the printer will print a job. This value is expressed as minutes elapsed since 12:00 A.M. Coordinated Universal Time (Greenwich Mean Time). Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x.
Status= | Specifies the printer status. This keyword can accept a list of numbers or special names as values. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x. See Special Names for the list of valid names. Separate items in the list with a space or tab, and enclose the list with quotation marks.
cJobs= | Specifies the number of print jobs that have been queued for the printer. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x.
AveragePPM= | Specifies the average number of pages per minute that have been printed on the printer. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x.

Level 3

Level 3 is used to set print queue security. The following table lists the valid keyword/value pair for level 3.

Keyword | Value Description
pSecurityDescriptor= | Pointer to a SECURITY_DESCRIPTOR structure for the printer. This value is a string in SDDL format. NULL pointer values are allowed. For more information, see SDDL Format.

Level 4

Level 4 is not often used, because level 2 provides the same functionality and more control; however, level 2 is slower. The following table lists the valid keyword/value pairs for level 4.

Keyword | Value Description
pServerName= | Pointer to a NULL-terminated string identifying the server that controls the printer. If this string is NULL, the printer is controlled locally. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pPrinterName= | Pointer to a NULL-terminated string that specifies the name of the printer. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
Attributes= | Specifies the printer attributes. This keyword can accept a list of numbers or special names as values. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x. See Special Names for the list of valid names. Separate items in the list with a space or tab, and enclose the list with quotation marks.

Level 5

Level 5 is used primarily to change timeout values for LPT ports. The following table lists the valid keyword/value pairs for level 5.

Keyword | Value Description
pPrinterName= | Pointer to a NULL-terminated string that specifies the name of the printer. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
pPortName= | Pointer to a NULL-terminated string that identifies the port or ports used to transmit data to the printer. If a printer is connected to more than one port, the names of each port must be separated by commas (for example, "LPT1:,LPT2:,LPT3:").
Attributes= | Specifies the printer attributes. This keyword can accept a list of numbers or special names as values. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x. See Special Names for the list of valid names. Separate items in the list with a space or tab, and enclose the list with quotation marks.
DeviceNotSelectedTimeout= | For Windows NT, Windows 2000, and Windows XP, this value is not used.
TransmissionRetryTimeout= | For Windows NT, Windows 2000, and Windows XP, this value is not used.

Level 6

Level 6 is used to set the status of a print queue, similar to the level 0 setstatus parameter. The following table lists the valid keyword/value pair for level 6.

Keyword | Value Description
dwStatus= | Specifies the printer status. This keyword can accept a list of numbers or special names as values. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x. See Special Names for the list of valid names. Separate items in the list with a space or tab, and enclose the list with quotation marks.

Level 7

Level 7 is used to publish or unpublish a printer in Active Directory. The following table lists the valid keyword/value pairs for level 7.

Keyword | Value Description
pszObjectGUID= | Pointer to a NULL-terminated string containing the globally unique identifier (GUID) of the directory service print queue object associated with a published printer. Use the GetPrinter function to retrieve this GUID. Before calling SetPrinter, set pszObjectGUID to NULL. The value must be enclosed in quotation marks if it contains blank space. The string NULL means to use the NULL pointer value.
dwAction= | Indicates the action for SetPrinter to perform. For the GetPrinter function, this member indicates whether the specified printer is published. This keyword can accept a list of numbers or special names as values. Numbers may be decimal or hexadecimal; hexadecimal numbers start with 0x. See Special Names for the list of valid names. Separate items in the list with a space or tab, and enclose the list with quotation marks.

Level 8

Level 8 is used to set global document printing defaults. The following table lists the valid keyword/value pair for level 8.

Keyword | Value Description
pDevMode= | Pointer to a DEVMODE structure that defines default printer data such as paper orientation and resolution. pDevMode= can be "NULL" (that is, use the default) or a comma-delimited sequence of keyword/value pairs. For a list of pDevMode= keyword/value pairs, see DEVMODE Information.

Level 9

Level 9 is used to set current-user document printing defaults. This level is not really useful for remote servers and printers, because for them there is no associated current user. The following table lists the valid keyword/value pair for level 9.

Keyword | Value Description
pDevMode= | Pointer to a DEVMODE structure that defines default printer data such as paper orientation and resolution. pDevMode= can be "NULL" (that is, use the default) or a comma-delimited sequence of keyword/value pairs. For a list of pDevMode= keyword/value pairs, see DEVMODE Information.

DEVMODE Information

Many of these members have specific values they can be set to. For the purposes of SetPrinter, it is advisable to configure a print queue by using the Printer Properties dialog box, then use the /show parameter to display the resulting configuration. This will provide the appropriate values for use in subsequent SetPrinter calls. Also note that SetPrinter will set the dmFields member appropriately provided it is not explicitly set, and any other members that are not explicitly set will not be changed from their preexisting values.

Keyword | Value Description
dmDeviceName | Specifies the friendly name of the printer or display. This string is unique among device drivers. Note that this name may be truncated to fit in the dmDeviceName array.
dmSpecVersion | Specifies the version number of the initialization data specification on which the structure is based. To ensure the correct version is used for any operating system, use DM_SPECVERSION.
dmDriverVersion | Specifies the driver version number assigned by the driver developer.
dmDriverExtra | Specifies the size, in bytes, of the DEVMODE structure, not including any private driver-specific data that might follow the structure's public members. Set this member to sizeof(DEVMODE) to indicate the version of the DEVMODE structure being used.
dmSize | Contains the number of bytes of private driver data that follow this structure. If a device driver does not use device-specific information, set this member to zero.
dmFields | Specifies whether certain members of the DEVMODE structure have been initialized. If a member is initialized, its corresponding bit is set; otherwise the bit is clear. A driver supports only those DEVMODE members that are appropriate for the printer or display technology.
dmOrientation | For printer devices only, selects the orientation of the paper.
dmPaperSize | For printer devices only, selects the size of the paper to print on. This member can be set to zero if the length and width of the paper are both set by the dmPaperLength and dmPaperWidth members.
dmPaperLength | For printer devices only, overrides the length of the paper specified by the dmPaperSize member, either for custom paper sizes or for devices such as dot-matrix printers that can print on a page of arbitrary length. These values, along with all other values in this structure that specify a physical length, are in tenths of a millimeter.
dmPaperWidth | For printer devices only, overrides the width of the paper specified by the dmPaperSize member.
dmScale | Specifies the factor by which the printed output is to be scaled. The apparent page size is scaled from the physical page size by a factor of dmScale/100. For example, a letter-sized page with a dmScale value of 50 would contain as much data as a 17-by-22-inch page, because the output text and graphics would be half their original height and width.
dmDefaultSource | Specifies the paper source. To retrieve a list of the available paper sources for a printer, use the DeviceCapabilities function with the DC_BINS flag.
dmPrintQuality | Selects duplex or double-sided printing for printers capable of duplex printing.
dmColor | Switches between color and monochrome on color printers.
dmDuplex | Specifies the y-resolution, in dots per inch, of the printer. If the printer initializes this member, the dmPrintQuality member specifies the x-resolution, in dots per inch, of the printer.
dmYResolution | Specifies the printer resolution.
dmTTOption | Specifies how TrueType fonts should be printed.
dmCollate | Specifies whether collation should be used when printing multiple copies. This member is ignored unless the printer driver indicates support for collation by setting the dmFields member to DM_COLLATE.
dmFormName | Specifies the name of the form to use, for example "Letter" or "Legal". A complete set of names can be retrieved by using the EnumForms function.
dmLogPixels | Specifies the number of pixels per logical inch. Printer drivers do not use this member.
dmBitsPerPel | Specifies the color resolution, in bits per pixel, of the display device (for example, 4 bits for 16 colors, 8 bits for 256 colors, or 16 bits for 65,536 colors). Display drivers use this member, for example in the ChangeDisplaySettings function. Printer drivers do not use this member.
dmPelsWidth | Specifies the width, in pixels, of the visible device surface. Display drivers use this member, for example in the ChangeDisplaySettings function. Printer drivers do not use this member.
dmPelsHeight | Specifies the height, in pixels, of the visible device surface. Display drivers use this member, for example in the ChangeDisplaySettings function. Printer drivers do not use this member.
dmNup | Specifies where the processing for NUP is done. NUP is a method Postscript printers use to print several logical pages on one physical page.
dmDisplayFrequency | Specifies the frequency, in hertz (cycles per second), of the display device in a particular mode. This value is also known as the display device's vertical refresh rate. Display drivers use this member. It is used, for example, in the ChangeDisplaySettings function. Printer drivers do not use this member.
dmICMMethod | Specifies how Image Color Matching (ICM) is handled. For a non-ICM application, this member determines if ICM is enabled or disabled. For ICM applications, the system examines this member to determine how to handle ICM support.
dmICMIntent | Specifies which color matching method, or intent, should be used by default. This member is primarily for non-ICM applications. ICM applications can establish intents by using the ICM functions.
dmMediaType | Specifies the type of media being printed on.
dmDitherType | Specifies how dithering is to be done.
dmReserved1 | Not used; must be zero.
dmReserved2 | Not used; must be zero.
dmPanningWidth | Not used; must be zero.
dmPanningHeight | Not used; must be zero.

SDDL Format

Because it is difficult to manually build a correct security descriptor string, use the Printer Properties dialog box to set the desired security context on a printer. After the correct security context is displayed, it may be viewed in string format with the SetPrinter /show parameter, then used in subsequent SetPrinter invocations.

The Security Descriptor Definition Language (SDDL) format is a text format for storing or transporting information in a security descriptor. The format is a NULL-terminated string with tokens to indicate each of the four main components of a security descriptor: owner (O:), primary group (G:), DACL (D:), and SACL (S:), as shown below.

O:owner_sid
G:group_sid
D:dacl_flags(string_ace1)(string_ace2)... (string_acen)
S:sacl_flags(string_ace1)(string_ace2)... (string_acen)
owner_sid
A security identifier (SID) string that identifies the object's owner.
group_sid
An SID string that identifies the object's primary group.
dacl_flags
Security descriptor control flags that apply to the discretionary access control list (DACL). The dacl_flags string can be a concatenation of zero or more of the strings listed in the following table.
Flag | Description
P | The SE_DACL_PROTECTED flag is set.
AR | The SE_DACL_AUTO_INHERIT_REQ flag is set.
AI | The SE_DACL_AUTO_INHERITED flag is set.
sacl_flags
Security descriptor control flags that apply to the system access control list (SACL). The sacl_flags string uses the same control bit strings as the dacl_flags string.
string_ace
A string that describes an access control entry (ACE) in the security descriptor's DACL or SACL. For a description of the ACE string format, see ACE Strings later in this topic. Each ACE string is enclosed in parentheses.
SID Strings
An SID string in a security descriptor string can use either the standard string representation of a SID or one of the well-known SIDs. The following table lists well-known SIDs
SID | Description
"AO" | Account operators
"RU" | Alias to grant permissions to accounts using applications compatible with downlevel versions of the Windows operating system
"AN" | Anonymous logon user
"AU" | Authenticated users
"BA" | Built-in administrators
"BG" | Built-in guests
"BO" | Backup operators
"BU" | Built-in users
"CA" | Certificate publishers
"CG" | Creator group
"CO" | Creator owner
"DA" | Domain administrators
"DC" | Domain computers
"DD" | Domain controllers
"DG" | Domain guests
"DU" | Domain users
"EA" | Enterprise administrators
"ED" | Enterprise domain controllers
"WD" | Everyone
"PA" | Group Policy administrators
"IU" | Interactively logged-on user
"LA" | Local administrator
"LG" | Local guest
"LS" | Local service account
"SY" | Local system
"NU" | Network logon user
"NO" | Network configuration operators
"NS" | Network service account
"PO" | Printer operators
"PS" | Personal self
"PU" | Power users
"RS" | RAS servers group
"RD" | Terminal server users
"RE" | Replicator
"RC" | Restricted code
"SA" | Schema administrators
"SO" | Server operators
"SU" | Service logon user
ACE Strings
Each ACE in a security descriptor string is enclosed in parentheses. The fields of the ACE are in the following order, separated by semicolons:
ace_type;ace_flags;rights;object_guid;inherit_object_guid;account_sid
Ace_type
A string that indicates the value of the AceType member of the ACE_HEADER structure.
"A" | ACCESS_ALLOWED_ACE_TYPE
"D" | ACCESS_DENIED_ACE_TYPE
"OA" | ACCESS_ALLOWED_OBJECT_ACE_TYPE
"OD" | ACCESS_DENIED_OBJECT_ACE_TYPE
"AU" | SYSTEM_AUDIT_ACE_TYPE
"AL" | SYSTEM_ALARM_ACE_TYPE
"OU" | SYSTEM_AUDIT_OBJECT_ACE_TYPE
"OL" | SYSTEM_AUDIT_OBJECT_ACE_TYPE
Ace_flags
A string that indicates the value of the AceFlags member of the ACE_HEADER structure.
"CI" | CONTAINER_INHERIT_ACE
"OI" | OBJECT_INHERIT_ACE
"NP" | NO_PROPAGATE_INHERIT_ACE
"IO" | INHERIT_ONLY_ACE
"ID" | INHERITED_ACE
"SA" | SUCCESSFUL_ACCESS_ACE_FLAG
"FA" | FAILED_ACCESS_ACE_FLAG
Rights
A string that indicates the access rights controlled by the ACE. This string can be a hexadecimal string representation of the access rights, such as 0x7800003F, or it can be a concatenation of the strings contained in the following tables.

The following table lists generic access rights.

ACE | ACE String
"GR" | GENERIC_READ
"GW" | GENERIC_WRITE
"GA" | GENERIC_ALL
"GX" | GENERIC_EXECUTE

The following table lists standard access rights

ACE | ACE String
"RC" | READ_CONTROL
"SD" | DELETE
"WD" | WRITE_DAC
"WO" | WRITE_OWNER

The following table lists directory service object access rights.

ACE | ACE String
"RP" | ADS_RIGHT_DS_READ_PROP
"WP" | ADS_RIGHT_DS_WRITE_PROP
"CC" | ADS_RIGHT_DS_CREATE_CHILD
"DC" | ADS_RIGHT_DS_DELETE_CHILD
"LC" | ADS_RIGHT_DS_LIST
"SW" | ADS_RIGHT_DS_SELF
"LO" | ADS_RIGHT_DS_LIST_OBJECT
"DT" | ADS_RIGHT_DS_DELETE_TREE
"CR" | ADS_RIGHT_DS_CONTROL_ACCESS

The following table lists file access rights.

ACE | ACE String
"FA" | FILE_ALL_ACCESS
"FR" | FILE_GENERIC_READ
"FW" | FILE_GENERIC_WRITE
"FX" | FILE_GENERIC_EXECUTE

The following table lists registry key access rights.

ACE | ACE String
"KA" | KEY_ALL_ACCESS
"KR" | KEY_READ
"KW" | KEY_WRITE
"KX" | KEY_EXECUTE
Object_guid
A string representation of a GUID that indicates the value of the ObjectType member of an object-specific ACE structure, such as ACCESS_ALLOWED_OBJECT_ACE.
Inherit_object_guid
A string representation of a GUID that indicates the value of the InheritedObjectType member of an object-specific ACE structure.
Account_sid
SID string that identifies the trustee of the ACE.


SetPrinter Syntax

SetPrinter uses the following general syntax:

One Step setprinter [/show] {\\server | \\server\printer | printer} {printer_info_level} [keyword="[- | +]value" ...] [{pause | resume | purge | setstatus}]

One Step setprinter {/help | /examples} {printer_info_level}

Parameters

/show
Specifies that SetPrinter show current settings and make no changes.
\\server | \\server\printer | printer
Specifies the printer or printers to act on. The printer can be specified with a universal naming convention (UNC) path that includes the printer name, or just a printer name if the printer is attached to the local computer. If a UNC server name is specified without a printer name, SetPrinter will act on all printers attached to the server specified. Use double quotes ("") to act on all printers attached to the local computer.
printer_info_level
Specifies the printer information level. The valid values are 0 though 9. The printer information level is part of the SetPrinter application programming interface (API). For more information, see MSDN article SetPrinter API (http://go.microsoft.com/fwlink/?LinkId=14299). For more information about printer information levels, see the Remarks page.
keyword="[- | +]value" ...
Specifies the new printer settings. The keyword=value parameter is level-specific. If no data is specified, no changes will be made. See the Remarks page for detailed descriptions of each keyword="[- | +]value". The value parameter uses several special characters. These characters are explained in the table below.
Character | Description
Quotation marks | Surround the list of values (special names or numbers).
Space or tab | Separates the values in a list.
- Specifies that the value will be unset.
+ Specifies that the value will be added to the current value with an exclusive OR operation.
{pause | resume | purge | setstatus}
Changes the status of the target printer or printers. This parameter must be used with level 0. For more information, see the Examples page.
/help
Displays Help for SetPrinter. If the printer_info_level is specified, detailed Help for the specified level is displayed.
/examples
Displays examples for the printer_info_level specified. Must be used with printer_info_level.


ShowACLs Examples

Example 1: Display Access Rights for a Specified Directory

The task in this example is to show the file access for a specific directory. To do so, specify the directory path. To display file access rights for the C:\Data directory, type the following at the command line:

showacls c:\data

Press ENTER. Output similar to the following is displayed:

c:\data
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

You can see that keelyw has all rights to the C:\Data directory. You can use the Access Mask Values table from the Remarks page to determine what access deblo has.

Example 2: Display Access Rights for a Specified Directory Tree

The task in this example is to show the file access for a specific directory and its subdirectories. Specify the directory path and use the /s parameter. To display file access rights for the C:\Data directory tree, type the following at the command line:

showacls c:\data /s

Press ENTER. Output similar to the following is displayed:

c:\data
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

c:\data\Forms
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

c:\data\Program Updates & Patches
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

c:\data\Reports
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

c:\data\Letters
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

c:\data\Status
        BOMBAYS\karenzol          Read [RX]
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

c:\data\Vendors
        BOMBAYS\inorav            Read [RX]
        BOMBAYS\inorav            Special Access [dSrwarEwE]
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

c:\data\Vendors\Billing
        BOMBAYS\inorav            Read [RX]
        BOMBAYS\inorav            Special Access [dSrwarEwE]
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

c:\data\Vendors\Corres
        BOMBAYS\inorav            Read [RX]
        BOMBAYS\inorav            Special Access [dSrwarEwE]
        BOMBAYS\keelyw            Full Control [ALL]
        BOMBAYS\deblo             Special Access [dSrwarEwEfx]

You can see that keelyw has all rights to the C:\Data directory tree, and karenzol has Read access to the C:\Data\Status directory. You can use the Access Mask Values table from the Remarks page to determine what access deblo and inorav have to the folders for which they are listed as having file access rights.


ShowACLs Remarks

Understanding ShowACLs Output

One of the problems with a command-line tool like ShowACLs is the amount of information that is contained in the ACL. The first version of ShowACLs attempted to display all the data in the access mask, which was very confusing. The latest version has adopted the "standard" permissions—Full, Change, and Read-Only—where appropriate. If a mask does not match these predefined values, a raw dump of the mask is performed.

Interpreting ShowACLs Output

The following tables include the access mask values and the ACE header values that ShowACLs displays.

Access Mask Values | Description
D | Delete. Allows or denies deleting the file or folder. If you do not have Delete permission on a file or folder, you can still delete it if you have been granted the Delete Subfolders and Files permission on the parent folder.
a | File Append. Append Data allows or denies making changes to the end of the file, but not changing, deleting, or overwriting existing data (applies to files only).
fx | File Execute. Execute File allows or denies running program files (applies to files only).
r | File Read. File Read allows or denies viewing the attributes of a file or folder, such as read-only and hidden. Attributes are defined by NTFS.
w | File Write. Write Data allows or denies making changes to the file and overwriting existing content (applies to files only).
A | Generic All
X | Generic Execute. Execute File allows or denies running program files (applies to files only).
R | Generic Read. Allows or denies viewing the attributes of a file or folder, such as read-only and hidden. Attributes are defined by NTFS.
W | Generic Write. Allows or denies changing the attributes of a file or folder, such as read-only or hidden. Attributes are defined by NTFS.
l | List Directory. List Folder allows or denies viewing file names and subfolder names within the folder (applies to folders only).
d | Read Data. Read Data allows or denies viewing data in files (applies to files only).
rE | Read extended attributes (EA). Allows or denies viewing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary.
S | Synchronize. Allows or denies different threads to wait on the handle for the file or folder, and synchronize with another thread that may signal it. This permission applies only to multithreaded, multiprocess programs.
rW | Write EA. Allows or denies changing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary.
ACE Header Values | Description
0x1 | Object Inherit ACE
0x2 | Container Inherit ACE
0x4 | No Propagate Inherit ACE
0x8 | Inherit Only ACE


ShowACLs Syntax

ShowACLs uses the following syntax.

One Step showacls [/s] [/u:Domain\User] [FileSpec]

Parameters

/s
Includes subdirectories
/u:Domain\User
Specifies domain\user


ShowPerf Remarks

Overview | Remarks | UI | Related Tools Run Tool

Using ShowPerf to Troubleshoot a Questionable Performance Counter

If your performance monitor tool is working properly, but the data being displayed does not seem to be correct, try the following troubleshooting suggestions:

  • Some counter names can be interpreted in several ways. Use the explain text included in the Performance snap-in to see detailed information about the information gathered by a specific counter.
    1. Open the Performance snap-in located in Administrative Tools.
    2. Double-click Performance Logs and Alerts, and then click Counter Logs.
    3. In the details pane, double-click the System Overview sample log.
    4. View text that explains objects or individual counters.
      • To view text that explains objects, click the Add Objects button to open the Add Objects dialog box.
      • To view text that explains individual counters, click the Add Counters button to open the Add Counters dialog box.
    5. In the Add Objects or the Add Counters dialog box click Explain to open the Explain Text dialog box. As you select different objects and counters the Explain Text dialog box automatically updates to display information about the currently selected object or counter.
  • Look at related counters to see if something unexpected is occurring, and verify that the data you see is actually correct. If possible, use corroborating counters to verify your finding.
  • If you created the performance counter, use ShowPerf to help troubleshoot the data returned by your counter. ShowPerf displays the raw data and the counter type information that is used to compute the displayed value. Verify that the ShowPerf display is correct for the data that the performance counter should present.

Investigating Performance Counters That Do Not Appear in System Monitor

If the data structures for your performance counter are not built and indexed properly, System Monitor does not display the counter (System Monitor is a component of the Performance snap-in). This is because System Monitor checks performance counters before it displays them. Counters that are not valid are disabled in the registry. You can use ShowPerf together with ExCtrLst to troubleshoot suspected problems in the performance registry or problems with a specific performance DLL. ExCtrLst is a support tool located on the Windows Server 2003 CD.

If you want to investigate a missing performance counter, follow these steps:

  1. Start ExCtrLst to open the Extensible Counters List dialog box. For information on configuring and running ExCtrLst, install Support Tools from the Windows Server 2003 CD and see Support Tools Help.
  2. The Extensible Performance Counters section of this dialog box displays the extensible performance counters that are enabled or disabled for each service. Begin by disabling the extensible counters for every service except those beginning with Perf (such as PerfProc, PerfNet, PerfCtrs). To do this, select every service, except those beginning with Perf and clear the Performance Counters Enabled check box.
  3. Start ShowPerf and pull down the Object list to view all objects associated with the services that are still enabled.
  4. Switch to ExCtrLst and enable an extensible performance counter for a service.
  5. Close ShowPerf and restart it. The Object list for ShowPerf will reflect the change in enabled extensible performance counters. Verify that the objects, their associated counters, and the counter data are valid.
  6. Repeat steps 4 and 5 for every service listed in ExCtrLst until you get an error.
  7. If you get an error, disable the last extensible performance counter that you enabled in ExCtrLst. Then stop and restart ShowPerf and see if the error goes away. If the error does not go away, leave that performance counter disabled until you can reinstall a good copy of the counter.


ShowPerf UI

Overview | Remarks | UI | Related Tools Run Tool

You can use ShowPerf to select the computer, object type, and object instance that you want to monitor. ShowPerf then displays counters according to your selections.

Selection Controls

Using the following controls, select the items you want to monitor:

Item | Description
Computer | Enter the name of the computer to view. By default, the name of the local computer displays.
Show "Costly" Objects | When checked, lists only those objects that report technical data about kernel objects and that require a comparatively high overhead. Typically, costly counters are either memory or processor intensive and are not displayed in System Monitor. After selecting this check box, click Refresh to display and updated set of objects and associated counters.
Object | Select the object to view. Each object has counters that are used to measure various aspects of performance. Data for these associated counters is displayed when you select an object.
Instance | Choose the occurrence of the selected object that you want to view. A computer might have more than one occurrence of an object selected from the Object list. Each occurrence is an instance. In cases where multiple instances of an object exist, you will see the _Total option. If you choose this option, ShowPerf displays counter data for the sum of all instances of the selected object. This control is only enabled if there is more than one occurrence of a selected object.

Displayed Information

The following fields show identifying information and data for the object or objects you choose to monitor:

Item | Description
Counter Index | The number used to look up the name string of the counter stored in the registry.
Counter Name | The name of the counter. The Performance snap-in gives explanations of objects and counters. For instructions on viewing these explanations see Using ShowPerf to Troubleshoot a Questionable Performance Counter on the Remarks page.
Counter Type | The method used to calculate and display counter data.
Counter Data | The actual raw performance data of the counter. Click Refresh to update the data with the latest readings.


ShowPriv Examples

Example 1: Show All Users With Backup Rights on This Computer

In this example, ShowPriv is asked to display which accounts have the right to perform backups. Type the following at the command ilne:

showpriv SeBackupPrivilege

Press ENTER. The following output is displayed:

2 account(s) with the SeBackupPrivilege user right:
BUILTIN\Backup Operators
BUILTIN\Administrators
All accounts enumerated

Example 2: Show All Users Who Can Remotely Shut Down This Computer

In this example, ShowPriv is asked to display which accounts have the right to shutdown the server remotely. Type the following at the command line:

showpriv SeRemoteShutdownPrivilege

Press ENTER. The following output is displayed:

showpriv SeRemoteShutdownPrivilege
1 account(s) with the SeRemoteShutdownPrivilege user right:
BUILTIN\Administrators
All accounts enumerated


ShowPriv Remarks

Information on ShowPriv Error Codes

For information on error codes returned by ShowPriv, type the following at the command line:

net helpmsg errorNumber


ShowPriv Syntax

ShowPriv uses the following syntax:

One Step showpriv privilege

Parameters

privilege
Specifies a privilege. All local users who have the specified privilege are listed.

Use the following priviledges with the ShowPriv tool:

Privilege Name | Windows Privilege | Description
SeTcbPrivilege | Act as part of the operating system | Allows a process to authenticate like a user and thus gain access to the same resources as a user. Only low-level authentication services should require this privilege.
SeMachineAccountPrivilege | Add computers to a domain | Allows the user to add a computer to a specific domain. For the privilege to be effective, it must be assigned to the user as part of local security policy for domain controllers in the domain.
SeBackupPrivilege | Back up files and directories | Allows the user to circumvent file and directory permissions to back up the system. The privilege is checked only when an application attempts access through the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply. By default, this privilege is assigned to Administrators and Backup Operators. See also Restore files and directories in this table.
SeChangeNotifyPrivilege | Bypass traverse checking | Allows the user, while navigating an object path in any Windows file system or in the registry, to pass through folders to which the user otherwise has no access. This privilege does not allow the user to list the contents of a folder; it only allows the user to traverse its directories. By default, this privilege is assigned to Administrators, Backup Operators, Power Users, Users, and Everyone.
SeSystemTimePrivilege | Change the system time | Allows the user to set the time for the internal clock of the computer. By default, this privilege is assigned to Administrators and Power Users.
SeCreatePagefilePrivilege | Create a page file | Allows the user to create and change the size of a page file. By default, this privilege is assigned to Administrators.
SeCreateTokenPrivilege | Create a token object | Allows a process to create an access token by calling NtCreateToken() or other token-creating APIs.
SeCreatePermanentPrivilege | Create permanent shared objects | Allows a process to create a directory object in the Windows 2000 or Windows Server 2003 object manager.
SeDebugPrivilege | Debug programs | Allows the user to attach a debugger to any process. By default, this privilege is assigned to Administrators.
SeEnableDelegationPrivilege | Enable computer and user accounts to be trusted for delegation | Allows the user to change the Trusted for Delegation setting on a User or Computer object in Active Directory. The user or computer that is granted this privilege must also have write access to the account control flags on the object.
SeRemoteShutdownPrivilege | Force shutdown from a remote system | Allows a user to shut down a computer from a remote location on the network. See also Shut down the system in this table. By default, this privilege is assigned to Administrators.
SeAuditPrivilege | Generate security audits | Allows a process to create, generate, and add entries in the security log. The security log is used to track unauthorized system access. See also Manage auditing and security log in this table.
SeIncreaseQuotaPrivilege | Increase quotas | Allows a process that has Write Property access to another process to increase the processor quota that is assigned to the other process. This privilege is useful for system tuning, but it can be misused, as in a denial of service attack. By default, this privilege is assigned to Administrators.
SeIncreaseBasePriorityPrivilege | Increase scheduling priority | Allows a process that has Write property to access another process so that it can increase the execution priority of the other process. A user with this privilege can change the scheduling priority of a process in the Task Manager dialog box. By default, this privilege is assigned to Administrators.
SeLoadDriverPrivilege | Load and unload device drivers | Allows a user to install and uninstall Plug and Play device drivers. Device drivers that are not Plug and Play are not affected by this privilege and can be installed only by Administrators. Because device drivers run as trusted (highly privileged) programs, this privilege can be misused to install hostile programs and give them destructive access to resources. By default, this privilege is assigned to Administrators.
SeLockMemoryPrivilege | Lock pages in memory | Allows a process to keep data in physical memory, preventing the system from paging the data to virtual memory on disk. Exercising this privilege can significantly degrade system performance. This privilege is obsolete and should therefore never be selected.
SeSecurityPrivilege | Manage auditing and security log | Allows a user to specify object access auditing options on individual resources such as files, Active Directory objects, and registry keys. Object access auditing must first be enabled in Audit Policy (under Security Settings, Local Policies). With this privilege a user can then specify individual objects for auditing in Windows Explorer. A user who has this privilege can also view and clear the security log from Event Viewer. See also Generate security audits in this table.By default, this privilege is assigned to Administrators.
SeSystemEnvironmentPrivilege | Modify firmware environment values | Allows modification of system environment variables, either by a process through an API or by a user through System Properties. By default, this privilege is assigned to Administrators.
SeProfileSingleProcessPrivilege | Profile a single process | Allows a user to run Microsoft Windows 2000 and Microsoft Windows Server 2003 performance-monitoring tools to monitor the performance of nonsystem processes. By default, this privilege is assigned to Administrators and Power Users.
SeSystemProfilePrivilege | Profile system performance | Allows a user to run Windows 2000 and Windows Server 2003 performance-monitoring tools to monitor the performance of system processes. By default, this privilege is assigned to Administrators.
SeUndockPrivilege | Remove computer from docking station | Allows the user of a portable computer to undock the computer by clicking Eject PC on the Start menu. By default, this privilege is assigned to Administrators, Power Users, and Users.
SeAssignPrimaryTokenPrivilege | Replace a process-level token | Allows a parent process to replace the access token associated with a child process.
SeRestorePrivilege | Restore files and directories | Allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principal as the owner of an object. See also Back up files and directories in this table. By default, this privilege is assigned to Administrators and Backup Operators.
SeShutdownPrivilege | Shut down the system | Allows a user to shut down the local computer. See also Force shutdown from a remote system in this table. In Windows XP Professional by default, this privilege is assigned to Administrators, Backup Operators, Power Users, and Users. In Windows Server 2003 by default, this privilege is not assigned to Users, only to Administrators, Backup Operators, and Power Users.
SeSynchAgentPrivilege | Synchronize directory service data | Allows a process to provide directory synchronization services. This privilege is relevant only on domain controllers. By default, this privilege is assigned to Administrators and LocalSystem accounts on domain controllers.
SeTakeOwnershipPrivilege | Take ownership of files or other objects | Allows a user to take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. By default, this privilege is assigned to Administrators.


Sleep Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Use Sleep in a Batch File

The task in this example is to set your computer to pause for a minute at the end of a script by using the sleep 60 command line. Create the following batch file:

@echo off

echo * Message of the Day - 7/22/97 *
echo.
echo Don't forget the company picnic!
echo Buses leave at 4 P.M.

sleep 60


Sleep Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

Sleep uses the following syntax:

One Step sleep Time

Parameter

Time
Specifies the number of seconds to pause.


Sonar Remarks

Overview | Remarks | Syntax | UI | Related Tools Open Command Prompt

Employing Best Practices

Sonar was designed to run against thousands of computers if necessary. When running Sonar in a large environment that has more than 500 members in a replica set, follow these best practices:

  • Run it against all the computers in a replica set, but configure it to run with a long period of time between refreshes (for example, 8 hours for an environment with many hundreds of systems to monitor).
  • If running Sonar against all computer in a replica set is too slow, run it against the hub members and a selection of spoke computers from selected sites. If you have replication problems on spokes that are not being directly monitored by Sonar, the problems will show up as backlogs and not as direct failures on the outbound partner. In this event, use Sonar to monitor the downstream computers.

Enabling CLR

By default, the CLR is configured to only execute programs that are stored locally on a machine. If you want to execute Sonar from a network share (\\server\share\sonar.exe), you need to enable the CLR to execute code from a remote server. To do this, perform the following steps:

  1. Access Administrative Tools and click .NET Framework Configuration.
  2. Right-click Runtime Security Policy and select Adjust Security.
  3. Select Make changes to this computer and set the Local Intranet policy to Full Trust.

Troubleshooting

The Sonar display shows statistics in a per-member view. This provides a way of monitoring a replica set at a high level for FRS members that are experiencing problems. However, the problem may be connection-specific, so Sonar can be used to find a member experiencing trouble. Further troubleshooting procedures are also included here for drilling into connection-level issues.

FRS Troubleshooting

    Troubleshooting FRS Events 13508 without FRS Event 13509

    Event 13508 in the FRS log is a warning that FRS has been unable to complete the Remote procedure call (RPC) connection to a specific replication partner. It indicates that FRS is having trouble enabling replication with that partner and that it will keep trying to establish the connection. A single event 13508 does not mean that something is broken or not working. Make sure you locate event 13509 so you can be certain that the problem was resolved. Based on the time between events 13508 and 13509, you can determine whether or not there is a real problem that needs to be addressed.

    Note

    • If FRS is stopped after an event 13508 interval, and then later started at a time when the communication issue has been resolved, event 13509 will not be entered in the event log. When FRS starts without generating an event 13508 message, it indicates that replication connections are being made correctly.

    Since FRS servers gather their replication topology information from their closest Active Directory domain controller (itself on a domain controller that is also an FRS member), it can happen that a replica partner in another site does not become aware of the replica set until the topology information has been replicated to domain controllers in that site. When the topology information finally reaches that distant domain controller, the FRS partner in that site can participate in the replica set FRS event ID 13509.

    Intra-site Active Directory replication partners replicate every 5 minutes. Inter-site replication only occurs when the schedule is open (shortest delay is 15 minutes). In addition, FRS polls the topology in the active directory at defined intervals. This interval is every 5 minutes on domain controllers and every hour on other member servers of a replica set. These delays and schedules, and especially in topologies with multiple hops, can delay propagation of the FRS replication topology

    Troubleshooting FRS Event 13508 without FRS Event 13509

    To troubleshoot FRS Event 13508 when FRS Event 13509 does not occur, perform the following steps:

    1. Examine the Event 13508 in the FRS Event Log to determine the computer with which FRS has been unable to communicate.
    2. Determine whether or not the remote computer is working properly, and verify that FRS is running on it. A good method for doing this to execute NTFRSUTL VERSION <FQDN_of_remote_DC_name> from the computer logging the 13508 event. If this fails, check network connectivity by sending an ICMP packet to the <FQDN_of_remote_DC_name> from the machine logging the 13508 event. If this fails, troubleshoot as a Domain Name System (DNS) or TCP/IP issue. If it succeeds, confirm that FRS is started on the remote domain controller.
    3. Determine whether or not FRS has ever been able to communicate with the remote computer by looking for event 13509 in the event log and review recent change management to networking, firewalls, DNS configuration and Active Directory infrastructure to see if there is a correlation.
    4. Determine whether there is anything between the two machines that is capable of blocking Remote Procedure Call (RPC) traffic, such as a firewall or router.
    5. Confirm that Active Directory replication is working.

    Troubleshooting FRS Event 13511

    FRS event ID 13511 is logged when the FRS Database is out of disk space. To correct this situation, free up some disk space on the volume containing the FRS Database. If this is not possible, then consider moving the database to a larger volume with more free space. For more information about how to move the database to a larger volume, see Knowledge Base article Q221093: How to Relocate the NTFRS Jet Database and Log Files (http://go.microsoft.com/fwlink/?LinkID=12918).

    Troubleshooting FRS Event 13526

    FRS Event ID 13526 is logged when a domain controller becomes unreachable. The following is an example of the message that appears when Event 13526 is logged:

    Event ID:13526
The file replication service cannot replicate d:\Systemroot\sysvol\domain with the computer DC1 because the computer SID cannot be determined from the distinguished name "cn=dc1,ou=domain controller,dc=corp,dc=com". The file Replication Service will try later.
SYSVOL and DFS content are not being replicated.
For additional domain controllers, FRS replication failures can prevent the sharing of netlogon and sysvol shares, the application of policy, and the machine registering itself in the Active Directory as a domain controller.
For existing computers, files and folders in SYSVOL or DFS replica set are inconsistent between replica members.

    This problem occurs because FRS polls Active Directory at regular intervals to read FRS configuration information. During the polling, an operation is performed to resolve the security identifier (SID) of an FRS replication partner. The binding handle might become invalid if the bound domain controller becomes unreachable over the network or restarts in a single polling interval (default 5 minutes). To resolve this issue, restart FRS on the computer logging the error message.

    Troubleshooting FRS Event 13548

    FRS Event ID 13548 is logged when two replica partners have divergent time settings.The following is an example of the message that appears when Event 13548 is logged:

    Event ID: 13548
The File Replication Service is unable to replicate with its partner computer because the difference in clock times is outside the range of plus or minus 30 minutes.
The detected time difference is:  XX minutes

    This error could be caused by the selection of an incorrect time zone on the local computer or its replication partner. Check that the time zone and system clock are correctly set on both computers. They must be within 30 minutes of each other, but preferably much closer.

    Troubleshooting FRS Event 13522

    The Staging Directory is an area where modified files are stored temporarily, either prior to being propagated to other replication partners, or when received from other replication partners. FRS encapsulates the data and attributes associated with a replicated file (or directory) object in a staging file. FRS needs adequate staging area space on both upstream and downstream computers to replicate files.

    On Windows 2000 before Service Pack 3, event 13522 indicates that FRS has paused because the staging area is full. Replication resumes if staging space becomes available or if the staging space limit is increased.

    On Windows 2000 before Service Pack 3, you must clear the replication backlog. There are four common reasons why the staging area may fill up:

    1. One or more downstream partners are not accepting changes. This could be a temporary condition due to the schedule being turned off and FRS waiting for it to open, or a permanent state because the service is turned off, or the downstream partner is in an error state.
    2. The rate of change in files exceeds the rate at which FRS can process them.
    3. No obvious changes are made but the staging area is filling up anyway. This is typically the excessive replication issue described in Troubleshooting FRS Event 13567.
    4. A parent directory for a large number of changes is failing to replicate, causing all changes underneath it to be blocked.

    Often, there is a combination of two or more problems. These problems are changes that cannot be replicated and the number of change orders do not map to the number of changes made.

    Troubleshooting FRS Event 13557

    FRS Event ID 13557 is logged when duplicate connections are detected between members. The following is an example of the message that appears when Event 13557 is logged:

    Event ID: 13557
The File Replication Service has detected a duplicate connection object between this computer "<Computer 1>" and a computer named "<Computer 2>".
This was detected for the following replica set:
"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"

    To resolve this problem, delete duplicate connection objects that are noted in the event text between the direct replication partners.

    Troubleshooting FRS Event 13567

    FRS Event 13567 in the FRS event log is generated on computers running Windows 2000 Service Pack 3 and later when there is unnecessary file change activity.

    Unnecessary file change activity means that a file has been written by some user/application, but that no change has actually been made to the file. FRS detects that the file has not changed, and maintains a count of how often this happens. If the condition is detected more than 15 times per hour during a 3 hour period, FRS logs the 13567 event.

    Investigate such events to find the application or user that is modifying file content. Refer to the Troubleshooting excessive disk/CPU usage by NTFRS.EXE section for details on this procedure.

    Troubleshooting FRS Event 13568

    The following is an example of the message that appears when Event 13568 is logged:

    The File Replication Service has detected that the replica set "1" is in JRNL_WRAP_ERROR.

    The NTFS file system maintains a special log called the NTFS USN journal, which is a high-level description of all the changes to files and directories on an NTFS file system volume. FRS uses this mechanism to track changes to the file system in directories of interest, and queue those changes for replication to other machines. The NTFS USN journal has defined size limits and discards old log information on a first in, first out basis to maintain its correct size.

    If FRS processing falls behind the NTFS USN journal, and if USN journal information that FRS needs has been discarded, then FRS enters a journal wrap condition. FRS then needs to rebuild its current replication state with respect to the file system and other replication partners.

    Each file change on the NTFS volume occupies approximately 100 bytes in this journal and possibly more, depending on the file name size. As a rule of thumb, the NTFS USN journal for an NTFS volume should be sized at 128 megabytes per 100,000 files being managed by FRS on that NTFS volume.

    Prior to Windows 2000 SP3, the default journal size was 32 megabytes and the maximum journal size was 128 megabytes. In Windows 2000 Service Pack 3 and later, the default journal size is 128 megabytes, and the maximum journal size is 10,000 megabytes.

    You can change the size of the journal by modifying a registry entry. However, once the size of the journal is increased, you should not subsequently decrease it, since doing so will cause a journal wrap. Knowledge base article Q221111 (http://go.microsoft.com/fwlink/?LinkID=12880) describes how the USN journal size can be increased.

    FRS can encounter journal wrap conditions in the following cases:

    • Many files are added at once to a replica tree while FRS is very busy, starting up, or not running.
    • On a server being used for authoritative restore, or as the primary for a new replica partner, there is a lot of file activity at the start of this process, a condition that can consume USN journal records. Following the rule of thumb mentioned earlier in this section is sufficient to avoid this condition.
    • An NTFS file system needs to be processed with Chkdsk and Chkdsk corrects the file system structure. Chkdsk is an operating system tool and is located in the system32 folder. In this case, NTFS creates a new NTFS USN journal for the volume or deletes the corrupt entries from the end of the journal.
    • The NTFS USN journal is deleted or reduced in size.
    • NTFRS is in an error state that prevents it from processing changes in the USN journal.

    If FRS is experiencing journal wrap errors on a particular server, it cannot replicate files until the condition has been cleared. To continue replication, the administrator must stop FRS on that server and perform a non-authoritative restore of the data so that the system may synchronize with its replication partners.

    Notes

    • Windows 2000 Service Pack 1 cannot perform the non-authoritative restore automatically.
    • In Windows 2000 Service Pack 2, FRS performs this process automatically.
    • In Windows 2000 Service Pack 3 and later, FRS does not perform this process automatically. The reason for this change was that it was typically being performed at times that were not planned by administrators. Modification of a registry setting allows FRS to perform non-authoritative restoration automatically, just as in Windows 2000 Service Pack 2. However, making this modification is not recommended and, for most organizations, non-authoritative restoration should remain a manual process.

    Knowledge base article Q292438 (http://go.microsoft.com/fwlink/?LinkID=12881) describes how to perform the non-authoritative restore process on a server.

    Understanding FRS Event Log Messages

    The following are the main event viewer events that may be caused by File Replication Service (FRS). These events are displayed in the FRS log.

    Event ID | Event Type | Details
    13501 | Informational | File Replication Service is starting.
    13502 | Informational | File Replication Service is stopping.
    13503 | Informational | The File Replication Service has stopped.
    13504 | Error | The File Replication Service stopped without cleaning up.
    13505 | Error | The File Replication Service has stopped after taking an assertion failure.
    13506 Error The File Replication Service failed a consistency check (%3) in "%1" at line %2. The File Replication Service will restart automatically at a later time. If this problem persists, a subsequent entry in this event log describes the recovery procedure.

    For more information about the automatic restart, right-click My Computer and then click Manage, System Tools, Services and Applications, Services, and File Replication Service.
    13507 | Error | The File Replication Service cannot start replica set %1 on computer %2 for directory %3 because the type of volume %4 is not NTFS 5.0 or later. The type of the volume can be found by typing chkdsk %4. The volume can be upgraded to NTFS 5.0 or later by typing chkntfs /E %4.
    13508 Warning The File Replication Service is having trouble enabling replication from %1 to %2 for %3 using the DNS name %4. FRS will keep trying. The following are some of the reasons you would see this warning:
    1. FRS cannot correctly resolve the DNS name %4 from this computer.
    2. FRS is not running on %4.
    3. The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.

    This event log message appears once for each connection. After the problem is fixed, another event log message indicates that the connection has been established.
    13509 | Warning | The File Replication Service has enabled replication from %1 to %2 for %3 after repeated retries.
    13510 Error

    The File Replication Service on the computer %1 cannot communicate with the File Replication Service on the computer %2. Verify that the computer %2 is running.

    • Verify that the File Replication Service is running on %2 by typing net start ntfrs on %2.
    • Verify that the network is functioning between %1 and %2 by typing ping %1 on %2 and ping %2 on %1. If the pings succeed, retry the failed operation. If the pings fail, there may be problems with the DNS server.
    The DNS server is responsible for mapping computer names to IP addresses. The commands ipconfig and nslookup help diagnose problems with the DNS server.

    • Typing ipconfig /all lists the IP address of the computer and the IP address of the DNS servers of the computer. Type ping DNS [server's IP address] to verify that a DNS server is available.
    • The DNS mapping for %2 or %1 can be verified by typing nslookup and then typing %2 and then %1 on %1 and %2. Be sure to check out the DNS server on both %1 and %2; a DNS problem on either computer prevents proper communication.

    You can clear up some network problems between %1 and %2 by flushing the DNS Resolver Cache. Type ipconfig /flushdns. You can clear up some network problems between %1 and %2 by renewing the IP address. Type ipconfig /release followed by ipconfig /renew.

    You can clear up some network problems between %1 and %2 by:
    • Resetting the DNS entry. Type net stop NetLogon followed by net start NetLogon.
    • Restarting the File Replication Service. Type net stop ntfrs followed by net start ntfrs.
    • Restarting the computers %1 and %2 after closing running applications, especially dcpromo. Click Start, Shut down, select Restart, and click OK.

    Other network and computer problems are beyond the scope of this event log message.
    13511 Error

    The File Replication Service is stopping on computer %1 because there is no free space on the volume containing %2. The available space on the volume can be found by typing dir %2. Once free space is available on the volume containing %2, the File Replication Service can be restarted immediately by typing net start ntfrs. Otherwise, the File Replication Service restarts automatically at a later time. For more information about the automatic restart, right-click My Computer and then click Manage, System Tools, Services and Applications, Services, and File Replication.

    For more information about managing space on a volume, type copy /?, rename /?, del /?, rmdir /?, and dir /?.
    13512 | Warning | The File Replication Service has detected an enabled disk write cache on the drive containing the directory %2 on the computer %1. The File Replication Service might not recover when power to the drive is interrupted and critical updates are lost.
    13513 | Error | The File Replication Service on computer %1 is stopping because the database %2 is corrupted. The database can be recovered by typing esentutl /d %2 /l%3 /s%4. Once the database has been successfully recovered, you can restart the File Replication Service by typing net start ntfrs.
    13514 Warning

    File Replication Service may be preventing the computer %1 from becoming a domain controller while the system volume is being initialized with data from another domain controller and then shared as SYSVOL. Type net share to check for the SYSVOL share. The File Replication Service stops preventing the computer from becoming a domain controller once the SYSVOL share appears.

    The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume, the availability of other domain controllers, and the replication interval between domain controllers.
    13515 | Warning | The File Replication Service may be preventing the computer %1 from becoming a domain controller while the system volume is being initialized and then shared as SYSVOL. Type net share to check for the SYSVOL share.
    13516 | Informational | The File Replication Service is no longer preventing the computer %1 from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL. Type net share to check for the SYSVOL share.
    13517 Warning

    The File Replication Service will not check access to the API "%1". You can enable access checks for "%1" by modifying the registry.

    Click Start, Run, and type regedit. In the Registry Editor window, double-click HKEY_LOCAL_MACHINE. Then double-click System, CurrentControlSet, Services, NtFrs, Parameters, Access Checks, %1, and %2. Set the value to Enabled. You can change permissions by highlighting %1 , clicking the Edit menu, and clicking Permissions.
    13518 Warning

    The File Replication Service did not grant the user "%3" access to the API "%1". You can change permissions for "%1" by modifying the registry.

    Click Start, Run, and type regedit. In the Registry Editor window, double-click HKEY_LOCAL_MACHINE. Then double-click System, CurrentControlSet, Services, NtFrs, Parameters, Access Checks, and highlight %1. Change permissions by highlighting %1 , clicking the Edit menu, and clicking Permissions. Access checks can be disabled for %1. Double-click %2 and Set the value to Disabled.
    13519 Error

    The File Replication Service could not grant an unknown user access to the API "%1". You can disable access checks for "%1" by modifying the registry.

    Click Start, Run, and type regedit. In the Registry Editor window, double-click HKEY_LOCAL_MACHINE. Then double-click System, CurrentControlSet, Services, NtFrs, Parameters, Access Checks, %1, and %2. Set the value to Disabled. You can change permissions by highlighting %1 , clicking the Edit menu, and clicking Permissions.
    13520 | Warning | The File Replication Service moved the preexisting files in %1 to %2. The File Replication Service may delete the files in %2 at any time. Files can be saved from deletion by copying them from %2. Copying the files into %1 may lead to name conflicts if the files already exist on some other replicating partner. In some cases, the File Replication Service may copy a file from %2 into %1 instead of replicating the file from some other replicating partner. Space can be recovered at any time by deleting the files in %2.
    13521 Error

    The File Replication Service cannot enable replication until a backup/restore application completes. A backup/restore application has set a registry entry that prevents the File Replication Service from starting until the registry entry is deleted or the system is rebooted. The backup/restore application may still be running. Check with your local administrator before proceeding further.

    You can reboot the computer by clicking Start, Shutdown, and selecting Restart.

    Warning

    • Deleting the Registry entry is not recommended.
    Applications may fail in unexpected ways. The Registry entry can be deleted by running regedit.

    Click Start, Run, and type regedit. In the Registry Editor window, double-click HKEY_LOCAL_MACHINE. Then double-click System, CurrentControlSet, Services, NtFrs, Parameters, Backup/Restore, and Stop NtFrs from Starting. On the toolbar, click Edit and then Delete.

    Warning

    • Deleting a Registry entry other than Stop NtFrs From Starting can have unexpected side effects.
    13522 Warning

    The File Replication Service paused because the staging area is full. Replication resumes if staging space becomes available or if the staging space limit is increased. The current entry of the staging space limit is %1 KB. To change the staging space limit, modify the registry.

    Click Start, Run and type regedit. In the Registry Editor window, double-click HKEY_LOCAL_MACHINE. Then double-click System, CurrentControlSet, Services, NtFrs, Parameters, and the entry Staging Space Limit in KB.
    13523 Warning

    The File Replication Service paused because the size of a file exceeds the staging space limit. Replication resumes only if the staging space limit is increased. The staging space limit is %1 KB and the file size is %2 KB. To change the staging space limit, modify the registry.

    Click Start, Run and type regedit. In the Registry Editor window, double-click HKEY_LOCAL_MACHINE. Then double-click System, CurrentControlSet, Services, NtFrs, Parameters, and the entry Staging Space Limit in KB.
    13524 Error

    The File Replication Service is stopping on the computer %1 because a universally unique ID (UUID) cannot be created. The SDK function UuidCreate() returned the error "%2". The problem may be the lack of an Ethernet address, token ring address, or network address. The lack of a network address implies an unsupported netcard. The File Replication Service restart automatically at a later time.

    For more information about the automatic restart, right-click My Computer and then click Manage, System Tools, Services, File Replication Service, and Recovery.
    13525 | Warning | The File Replication Service cannot find the DNS name for the computer %1 because the "%2" attribute could not be read from the distinguished name "%3". The File Replication Service tries using the name "%1" until the DNS name appears.
    13526 | Error | The File Replication Service cannot replicate %1 with the computer %2 because the SID of the computer cannot be determined from the distinguished name "%3". The File Replication Service retries later.
    13539 | Error | The File Replication Service cannot replicate %1 because the path of the replicated directory is not the fully qualified path of an existing, accessible local directory.
    13540 | Error | The File Replication Service cannot replicate %1 because the path of the customer designated staging directory: %2 is not the fully qualified path of an existing, accessible local directory.
    13541 | Error | The File Replication Service cannot replicate %1 because it overlaps the File Replication Service logging path %2.
    13542 | Error | The File Replication Service cannot replicate %1 because it overlaps the File Replication Service working directory %2.
    13548 Error The File Replication Service is unable to replicate with its partner computer because the difference in clock times is outside the range of plus or minus %1 minutes. The connection to the partner computer is: "%2" The detected time difference is: %3 minutes.

    Note

    • If this time difference is close to a multiple of 60 minutes, it is likely that either this computer or its partner computer was set to the incorrect time zone when the computer time was initially set. Check that the time zone and the system time are correctly set on both computers. If necessary, the default entry used to test for computer time consistency may be changed in the registry on this computer. However, this is not recommended.

      • To change this parameter, run regedit. Click Start, Run and type regedit.

      In the Registry Editor window, double-click HKEY_LOCAL_MACHINE. Then double-click System, CurrentControlSet, Services, NtFrs, Parameters. Double-click the entry name Partner Clock Skew In Minutes and update the entry. If the entry name is not present, you can add it by selecting the appropriate subkey, then clicking the Edit Menu, select New, and click Key. Type the entry name exactly as shown above using the registry data type REG_DWORD.

    13549 Error The File Replication Service is unable to replicate from a partner computer because the event time associated with the file to be replicated is too far into the future. It is %1 minutes greater than the current time. This can happen if the system time on the partner computer was set incorrectly when the file was created or updated. To preserve the integrity of the replica set, this file update will not be performed or propagated further. The file name is: "%2" The connection to the partner computer is: "%3"

    Note

    • If this time difference is close to a multiple of 60 minutes, it is likely that this file may have been created or updated on the partner computer while the computer was set to the incorrect time zone when its computer time was initially set. Check that the time zone and time are correctly set on the partner computer.
    13555 | Error | The File Replication Service is in an error state. Files will not replicate to or from one or all of the replica sets on this computer until the following recovery step is performed: Recovery Step: [1] The error state may clear itself.
    13559 Error

    The File Replication Service has detected that the replica root path has changed from "%2" to "%3". If this is intentional, a file with the name NTFRS_CMD_FILE_MOVE_ROOT needs to be created under the new root path. This was detected for the following replica set: "%1"

    Changing the replica root path is a two step process which is triggered by the creation of the NTFRS_CMD_FILE_MOVE_ROOT file.

    1. At the first poll, which occurs in %4 minutes, this computer will be deleted from the replica set.
    2. At the poll following the deletion, this computer will be added to the replica set with the new root path. This addition will trigger a full tree synchronization for the replica set. At the end of the synchronization, all files will be at the new location. The files may or may not be deleted from the old location, depending on whether or not they are needed.
    13561 Error The File Replication Service has detected that the replica set "%1" is inJRNL_WRAP_ERROR. Replica set name is: "%1" Replica root path is: "%2" Replica root volume is: "%3" A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found. This can occur for one of the following reasons.
    1. Volume "%3" has been formatted.
    2. The NTFS USN journal on volume "%3" has been deleted.
    3. The NTFS USN journal on volume "%3" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
    4. File Replication Service was not running on this computer for a long time.
    5. File Replication Service could not keep up with the rate of Disk IO activity on "%3".
    Perform the following steps to automatically recover from this error state.
    1. At the first poll, which occurs in %4 minutes, this computer will be deleted from the replica set.
    2. At the poll following the deletion, this computer will be added to the replica set. The addition will trigger a full tree synchronization for the replica set.
    13562 Warning Rule: Alert suppressed based on ID, source, computer - state to look for event ID 13560 to indicate that the error is auto recover.

    Message Text:

    Following is the summary of warnings and errors encountered by File Replication Service while polling the Domain Controller %1 for FRS replica set configuration information. %2
    13563 | Warning | The File Replication Service has detected that the staging path for the replica set %1 has changed. Current staging path = %2 New staging path = %3. The service will start using the new staging path after it restarts.
    13564 Warning

    The File Replication Service has detected that the volume holding the FRS debug logs is running out of disk space. This does not affect replication unless this volume hosts database, staging, or replica root paths as well. You can change the number and size of logs by changing the value of registry entries Debug Log Severity, Debug Maximum Log Messages, and REG_DWORD 0x2710 in the subkey HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/NtFrs/Parameters/Debug Log Files.

    You can also change the path to the logs directory by changing the file system path stored by Debug Log File, which is in the same subkey. Changes to the registry entries take effect at the next polling cycle.
    13565 Warning

    File Replication Service is initializing the system volume with data from another domain controller. Computer %1 cannot become a domain controller until this process is complete. The system volume is then shared as SYSVOL. To check for the SYSVOL share, type net share at the command prompt.

    When File Replication Service completes the initialization process, the SYSVOL share appears. The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume, the availability of other domain controllers, and the replication interval between domain controllers.
    13566 Warning

    File Replication Service is scanning the data in the system volume. Computer %1 cannot become a domain controller until this process is complete. The system volume will then be shared as SYSVOL. To check for the SYSVOL share, type net share at the command prompt.

    When File Replication Service completes the scanning process, the SYSVOL share will appear.The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume.
    13567 Warning File Replication Service has detected and suppressed an average of %1 or more file updates every hour for the last %2 hours because the updates did not change the contents of the file. The tracking records in FRS debug logs have the file name and event time for the suppressed updates. The tracking records have the date and time followed by :T: as their prefix. Updates that do not change the content of the file are suppressed to prevent unnecessary replication traffic. The following list shows common examples of updates that do not change the contents of the file.
    1. Overwriting a file with a copy of the same file.
    2. Setting the same ACLs on a file multiple times.
    3. Restoring an identical copy of the file over an existing one.
    You can disable suppression of updates by running regedit. Click Start, Run, and type regedit. Expand HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters and create or update the entry Suppress Identical Updates To Files to 0 (Default is 1) to force identical updates to replicate
    13568 Error The File Replication Service has detected that the replica set "%1" is in JRNL_WRAP_ERROR.
    Replica set name is : "%1"
Replica root path is : "%2"
Replica root volume is : "%3"

    A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found. This can occur for any of the following reasons:

    1. Volume "%3" has been formatted.
    2. The NTFS USN journal on volume "%3" has been deleted.
    3. The NTFS USN journal on volume "%3" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
    4. File Replication Service has not been running on this computer for a long time.
    5. File Replication Service could not keep up with the rate of Disk IO activity on "%3".
    Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 causes the following recovery steps to be taken to automatically recover from this error state:
    1. At the first poll, which occurs in %4 minutes, this computer is deleted from the replica set. If you do not want to wait %4 minutes, then run net stop ntfrs followed by net start ntfrs to restart the File Replication Service.
    2. At the poll following the deletion this computer will be added to the replica set. The addition will trigger a full tree sync for the replica set.

    Warning

    • During the recovery process, data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.

    To change this registry parameter, run regedit.

    Click Start, Run, and type regedit. In the Registry Editor window, double-click HKEY_LOCAL_MACHINE. Then double-click System, CurrentControlSet, Services, NtFrs, and Parameters. Double-click the entry name Enable Journal Wrap Automatic Restore and update the entry. If the entry name is not present, you can add it. Select Parameters in the navigation pane, and then on the Edit Menu, point to New, and click DWORD Value. Type the entry name exactly as shown above.

    Changing Journal Size

    There is a crucially important configuration parameter that must be considered when using FRS, the size of the NTFS USN Change Journal.

    The NTFS USN Change Journal is a log file that NTFS maintains and that describes the nature of changes that have occurred on the file system. NTFS updates this log transactionally and so it is kept in synchronization with the file system state, even in the case of power failure or computer crash. The USN Change Journal has a bounded maximum size. If it exceeds the defined size, NTFS discards a number of the older records to keep the Journal within the defined size limits.

    FRS uses this mechanism to track changes on the file tree being replicated. If items are discarded from the NTFS USN Change Journal before FRS has processed them, FRS loses track of the file system state and causes a a state known as journal wrap. If this happens, the computer must undergo the non-authoritative (D2) restore process.

    Under most circumstances, the NTFS USN Change Journal for an NTFS volume should be sized at 128 megabytes per 100,000 files managed by FRS on that NTFS volume.

    Notes

    • Multiple FRS replication trees may exist on the same NTFS volume. Thus, base your decision about the size of the journal on the total number of files managed by FRS on that volume.
    • Other files may also be stored on the same NTFS volume. File operations on these files are entered in the USN Change Journal, even though they are ignored by FRS. A rule of thumb in this case is to consider an extra 8 megabytes per 100,000 files, but this is really very approximate. The number of extra megabytes depends upon how much activity might occur on those files.
    • For best results, put FRS-related shares on their own NTFS volume so that the USN journal cannot be affected by other file activity.
    • Refer to Microsoft Knowledge base article Q221111 (http://go.microsoft.com/fwlink/?LinkID=12880) for procedures to help you increase the USN journal size.

    Using D4. Authoritative Restore

    The D4 operation (authoritative restore) takes the existing files in the replica set on the D4 machines, and makes the authoritative set of files in the replica set. This is done by stamping a new unique file ID on every file and directory. To get these new files replicated to all the partners, initiate a non-authoritative (D2) restore on every member of the replica set. This D4 (authoritative restore) procedure should be performed only in consultation with your support provider. The process is a last resort only used in selected situations.

    Warning

    • FRS must be stopped on all replication partners of a replica set before you perform the D4 process. Failure to do so causes morphed directories to appear on all replica partners. You can use the Sonar tool with the Settings column set to confirm that all members are stopped and have the correct D2 BURFLAGS set.

    Detecting and Resolving Sharing Violations on Targets

    If a user or process holds a file open on a replication target, FRS can be prevented from replacing the file with updated content. In this case, the file is staged on the target computer, and FRS retries installation of the file. A sharing violation on a folder, however, can block changes that reside in and under that locked folder.

    If sharing violations are preventing a file from being installed, the NTFRSUTL INLOG report shows such files in the INSTALL_RETRY status. This continues until FRS is finally able to replace the file. The following methods can be used to confirm that this is the cause of the file not replicating:

    Method | Details
NET File | Use this method to execute the NET FILE command on the target computer. This tells you the users who are holding the file open via the network, though it does not report any files being held open by local processes. If files are being held open by remote users, it is possible to use the NET FILE <id> /CLOSE command to force closure of the file.
OH.EXE | You can use the OH.EXE command in the Windows Server 2003 Resource Kit to find locally opened files.
Log files | You can use this method to confirm from the FRS debug logs that sharing violations are preventing a file from being installed.

    Note

    • If a file is locked on a computer from which the replication should originate, FRS cannot read the file to generate the staging file, hence delaying replication. If a file is locked on the replication target, FRS cannot update the file. In this case FRS continues to retry the update until it succeeds. The retry interval is 30 to 60 seconds.

    Troubleshooting the SYSVOL Share

    The SYSVOL folder is not shared after DCPROMO of new dc in existing domain

    Confirm that Active Directory replication is occurring to and from a domain controller in the same domain. You can do so by examining the value of the registry entry SYSVOLREADY in HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters..

    • If the value of SYSVOLREADY is 0, then this domain controller has not completed FRS replication from a source server. Review the FRS event log on the new domain controller and the domain controller used to source Active Directory during DCPROMO (found by reading the %systemroot%\debug\DCPROMO log).
    • Review the NTFRSAPI.log to see which domain controller attempted to source SYSVOL Make sure that FRS is in good working order on that server.
    • If the value of SYSVOLREADY is 1:
      • Confirm that directory junctions exist. Refer to Verifying the Directory Junctions.
      • Confirm that the SYSVOL\domain\scripts folder exists, and if it does not, troubleshoot it as a replication problem.
      • If the directory junctions are correct, and the scripts folder exists, troubleshoot as a NETLOGON problem.

      Note

      • Do not change the SYSVOLREADY manually unless instructed to do so by technical support since doing so can create unpredictable ramifications.

    Verifying the Directory Junctions

    The SYSVOL share (\\domain\SYSVOL) contains two folders that are not ordinary folders; they are directory junctions which point to other folders, much like a symbolic link.

    Use the DIR command against the "Drive:\Path\SYSVOL\SYSVOL" and "Drive:\Path\SYSVOL\Staging Areas" paths to verify that junction points are in place (evidenced by the "JUNCTION" string in the DIR output).

    D:\WINNT\SYSVOL\sysvol>dir

06/26/2001  01:23p      <DIR>         .
06/26/2001  01:23p      <DIR>          ..
06/26/2001  01:23p      <JUNCTION>     a.com

D:\WINNT\SYSVOL\staging areas>dir

06/26/2001  01:23p      <DIR>          .
06/26/2001  01:23p      <DIR>          ..
06/26/2001  01:23p      <JUNCTION>     a.com

    If either of two junction points is missing, use LINKD.EXE from the Windows Server 2003 Resource Kit to recreate them as in the example below:

    c:\>Linkd d:\winnt\sysvol\sysvol\<FQDN> <drive>\<path>\sysvol\domain

    where <FQDN> is the fully qualified domain name. Make sure that you verify that you have the same path for staging and staging areas.

    Note

    • Take great care when copying folders that include Directory Junctions. When XCOPY copies such a tree in Windows Server 2003, it copies the junction, not the contents of the folder to which the junction points. If you are not careful, you can accidentally delete SYSVOL if you do a RD /S on a copy made of SYSVOL. This happens because RD /S follows the directory junction, whereas RD with no /S does not.

    For additional information on Xcopy refer to Microsoft Knowledge Base article Q323007 HOW TO: Copy a Folder to another Folder and retain permissions (http://go.microsoft.com/fwlink/?LinkID=12913).

    Troubleshooting Excessive Disk/CPU Usage by NTFRS.EXE

    Excessive replication generators are applications that change all or most of the files in a replica set on a regular basis without actually altering the file content; they perform writes that do not change the file. If FRS finds a change when it monitors the USN journal, it has to replicate this file. Common cases of applications that create extensive replication are those that re-write the existing ACL (for example, file security policy, anti virus) or rewrite the existing file ( for example, de-fragmentation).

    With FRS, this condition can cause FRS to appear to use excessive amounts of disk I/O or CPU as it tracks this activity.

    The effect of this depends on the version of FRS being used:

    • From Windows 2000 Service Pack 3 onwards, an Event 13567 in the FRS event log records indicates that this kind of non-change was suppressed to prevent unnecessary replication. HOWEVER, the underlying cause should still be investigated – since it is causing unnecessarily high disk and CPU usage on that FRS server.
    • For Windows 2000 versions prior to SP3, extensive replication generators were the most common cause of replication backlogs and full staging areas. On these versions of FRS, administrators should investigate this problem urgently.

    Methods to identify the cause of excessive replication include:

    • Selectively turn off common causes such as AntiVirus products, defragmentation tools, and file system policy and determine if this activity declines.
    • Use the “FileSpy” tool from the Windows 2000 Resource Kit to identify file information.
    • Inspect the NTFRSUTL OUTLOG report to see the files that are being replicated.

    Relevant KB articles include:

    • Microsoft Knowledge Base Article Q284947 – Antivirus Programs May Modify Security Descriptors and Cause Excessive Replication of FRS Data in Sysvol and DFS (http://go.microsoft.com/fwlink/?LinkID=12914)
    • Microsoft Knowledge Base Article Q282791 – FRS: Disk Defragmentation Causes FRS Replication Traffic (http://go.microsoft.com/fwlink/?LinkID=12915)
    • Microsoft Knowledge Base Article Q279156 – The Effects of Setting the File System Policy on a Disk Drive or Folder Replicated by the File Replication Service (http://go.microsoft.com/fwlink/?LinkID=12916)
    • Microsoft Knowledge Base Article Q307777 – Possible Causes of a Full File Replication Service Staging Area (http://go.microsoft.com/fwlink/?LinkID=12917)

    Understanding Morphed Folders in FRS

    All files and folders that FRS manages are uniquely identified by a special file ID called a file GUID. FRS uses file GUIDs as the canonical identifiers of files/folders that are being replicated. FRS attempts to ensure that the GUID for each file or folder is identical on all members of the replica set. To FRS, the file or folder name visible in Windows Explorer or the DIR command is just a property of a file/folder. The name/path is not the identifier of the file; the GUID is.

    If an FRS member receives a change order to create a folder whose name already exists but has a different file GUID from that of the pre-existing folder, FRS detects a naming conflict. Because the file GUIDs for the two directories are different, it cannot be a change to the existing directory. In this case, the conflicting folder will be given a new name of the form FolderName_NTFRS_<guidname> in which FolderName is the original name of the folder and GUID is a unique XX character string like "001a84b2" There are two common causes of this condition:

    1. A folder has been created on multiple machines in the replica set before the folder has been able to replicate. This could happen if the administrator or application creates duplicate folders on multiple FRS members, perhaps in an effort by the administrator to make data consistent among all members by using a manual copy.
    2. You initiated an authoritative restore (D4) on one server and either:
      • Did not stop the service on all other members of the reinitialized replica set prior to restarting NTFRS after the authoritative restore.
      • Did not set the D2 registry entry on all other members of the reinitialized replica set prior to such a server replicating outbound changes to reinitialized members of the replica set.

    To recover from this condition, the best practice is to rename the original folders and the morphed folders, and wait for the renames to propagate through the system. This ensures that the folder then has a common name throughout the SYSVOL, and that the names and GUIDS match on all members.

    Notes

    • You cannot delete the unwanted folder and rename the other one because this could lead to even more naming conflicts. After the rename propagates, choose the one you want to keep, and rename it to its original name. You can then safely delete other morphs.
    • Before deleting any of the folders, it is a best practice to ensure that you have a backup of the original and complete folder.


Sonar Syntax

Overview | Remarks | Syntax | UI | Related Tools Open Command Prompt

Sonar uses the following syntax:

One Step Sonar [/i] [/s] [/npc] [/rpc] [/u] [file] [/?]

Parameters

/i
Installs Sonar.exe.
/s
Starts the log.
/npc
Specifies no performance counters.
/rpc
Directs Sonar to repair performance counters (reset Disable Performance Counters reg key).
/u
Uninstalls Sonar.
file
Specifies the configuration file to load.
/?
Displays command-line usage.


Sonar UI

Overview | Remarks | Syntax | UI | Related Tools Run Tool

Sonar Windows File Replication Service Status Viewer Dialog Box

The Sonar Windows File Replication Service Status Viewer dialog box allows you to define a query. You do so by choosing a domain and a replica set within the domain. You can also choose to view only the hub computers in the domain.

The Sonar Windows File Replication Service Status Viewer dialog box contains the following options:

Option | Description
Domain | Allows you to choose a domain to monitor.
Replica Set | Allows you to choose a replica set within a domain.
Refresh Rate | Allows you to set a refresh rate. The refresh rate range ranges from 1 minute to 24 hours.
Initially display only highly connected (hub) computers | Allows you to display only highly connected (hub) computers in a domain.
View Results | Displays the replica member status in a grid view.
Load Query | Loads an existing query.

File Menu

The File menu provides a way to create a new query, open an existing query, or save the current query.

The File menu contains the following options:

Option | Description
New | Creates a new query.
Open | Opens an existing query.
Save | Saves the current query.
Save As | Saves a copy of a query under a different name or in a different location.
Log | Logs output to a comma-separated file.
Exit | Closes the dialog box without making any changes.

Configure Log Dialog Box

The Configure Log dialog box provides a means to log output to a comma-separated file so that it can be analyzed by another tool.

The Configure Log dialog box contains the following options:

Option | Description
Log Path | The path of the log.
Log File Name | The name of the log file.
Log Type | The type of file to which the log is saved. Queries are stored as XML files with the .SNR file extension.
End Log With | Provides the option of ending the log with a date in the ddMM format.
Cycle Log | Cycles the log on a periodic basis. The default is daily.

Options Menu

The Options menu allows definition of:

  • Servers in the query
  • Filters
  • Notifications
  • Column sets

The Options menu contains the following options:

Option | Description
Select Servers | Allows you to select the server to query.
Edit Filters & Notifications | Opens a drop-down menu that provides filters that restrict the rows that display on the grid view. This option also allows you to notify a specified person by e-mail concerning all filters that result in a non-empty rowset.
Edit Columns | Allows you to edit the grid view. The SNR files are in XML format. They can be edited externally, using a text/xml editor.
Copy | Allows you to copy selected rows to the clipboard for pasting into applications such as Word, Excel, or Notepad.
Refresh | Refreshes selected rows.
Select All | Selects all the columns in the grid view.

Select Servers Dialog Box

The Select Servers dialog box provides a way to define the replica set members that are queried for status. The Select Servers dialog box contains the following options:

Option | Description
Domain | Defines the domain being queried for status.
Replica Set | Defines the replica set being queried for status.
All Servers | Allows you to add all members of the replica set to the query.
Hub Servers (guess) | Allows you add members of the replica set with a greater than average number of connections to the query.
Add All | Adds all servers in the replica set to the query. The available servers are listed in the text box on the left. Clicking Add All adds them to the text box on the right.
Add | Allows you to select a server or servers to query from the list of all servers in the text box on the left. To accomplish this, highlight, in the text box on the left, the server you want. Click Add. The server you select appears in the text box on the right.
Remove | Removes a server or servers from the list of servers to query in the text box on the right. To accomplish this, highlight, in the text box on the right, the server you want to remove. Click Remove. The selected server is removed form the list of servers to be queried.
Remove All | Removes all servers to be queried from the text box on the right.
List Boxes | The left-hand list box lists servers in the replica set that can be added to the query. This list can show candidates from either the list of all members of the replica set, or only members of the replica set with a greater than average number of connections. Those with a greater than average number of connections are considered hubs. The right-hand column lists the members of the replica set that are part of the current query.

Filter & Notification Selection Drop-Down Menu

The filters and notification selections are located in a drop down menu above the grid view. Default filters are created in any new query, but you can define new filters using the Options menu.

The following are rules should be used for filtering rows:

Comparison | > < >= <= > LIKE IN
Arithmetic | + - * / %
String Ops | * LIKE
Aggregate | Sum Avg Min Max Count StDev Var
Functions | IIF (if operator)
Operators | AND OR NOT

Edit Filter & Notifications Dialog Box

This dialog box allows you to create, edit, and delete filters and to send notifications. Filters can also be defined as notifications. If enabled, Sonar executes each query marked as a notification at the end of each refresh cycle. An e-mail message is sent listing all filters that result in a non-empty rowset.

Option | Description
Create | Allows you to create a new filter.
Edit | Allows you to edit an existing filter.
Delete | Allows you to delete an existing filter.
Notifications | Opens the Notifications dialog box and allows you to send an e-mail to a specified recipient.
Close | Closes the Filter & Notifications dialog box.

Notifications Dialog Box

The Notifications Dialog Box contains the following options:

Option | Description
SMTP Server | Allows you to choose an SMTP server.
Send To | Allows you to choose the recipient of the e-mail.
Min Notify Interval | Allows you to use the choose the minimum time between e-mail notifications.
Enable Notifications | Allows you to enable or disable the Notification option.

Column Sets Drop-Down Box

The column sets are located in a drop down box above the grid view. Default column sets are created in any new query, but you can define new filters by clicking Edit Columns on the Options menu.

In the Sonar grid view, there are column heading names whose meaning may not be clear. A brief explanation for these is included here:

  • Total – This means data that is displayed as an absolute value or string. For some parameters, it is defined as the total number of occurrences since the server last started. For others, it is a quantity expressed by the service (for example, staging space in use).
  • Delta – This column shows the delta (difference) during this refresh period.
  • Cycle – This is the total number of occurrences within a 24 hours period. If a 24 hour period has not elapsed (for example, the server started less than 24 hours ago), this value is null.

The following are column sets in the grid view together with a brief explanation of the entries on each column set.

    Error Conditions Column Set

    The following is the default column set. It represents the most common situations that require attention. Issues that occur in this column set should be addressed first.

    DataCollectionState

    DataCollectionState is not an FRS-reported error. Instead, it indicates that Sonar was unable to collect one or more pieces of status information about the FRS system. You can determine the details of the failure by either allowing the mouse pointer to hover over the cell, or by looking at the DataCollectionError column. The following are the common entries in this column and a brief description of each.

    Entry | Description
PerfCtr | Failed to read Performance counter. Known to fail on Windows 2000 Service Pack 2 systems. On other operating systems, issues are normally resolved with a refresh.
Registry | Failed to read registry
SCM | Failed to query Service Control Manager
DS | Failed to query Active Directory
TimeZone | Failed to get time zone information
Proc | Failed to collect process information
WMI | Failed to query information via WMI
EventLog | Failed to query Event log
Sysvol | Failed to connect to SYSVOL share.
FRSVer | Failure of the FRS Version RPC interface
FRSInlog | Failure of the FRS Inlog RPC interface
FRSSets | Failure of the FRS Sets RPC interface

    FRS State

    Servers are normally in the active state. The following table lists other states and a brief description of each.

    Entry | Description
Allocated | The replica set is in an initializing state.
Initializing | The replica set is in an initializing state and yields more granular state changes than the Allocated state.
Starting | Starting the replica set.
Stopped | Replica set is now stopped, typically because the set no longer has connections to any partners.
Error | Replica set is stopped due to an error.
Jrnl_Wrap_Error | Replica set is stopped due to data loss in the NTFS file system journal.
Replica Deleted | Replica set is marked as deleted.

    Note

    • If a member is in Stopped, Error, or Jrnl_Wrap_Error status, it requires attention before it can replicate again.

    SCM State

    The Service Control Manager (SCM) state displays whether the FRS Service is running according to the Windows Service Control Manager. Look for servers that are not in the running state and investigate. FRS Servers should normally be left running.

    SYSVOLShared

    If the replica set is a SYSVOL, look for Not shared or Not a junction in this column. If either of these appear in this column, investigate the problem as described in the Troubleshooting the SYSVOL share in the Remarks page Troubleshooting section.

    LongJoinCycle

    High numbers in this column indicate servers that had problems joining with a replication partner. For troubleshooting details, refer to Troubleshooting FRS Event 13508 without FRS Event 13509 in the Remarks page Troubleshooting section.

    ExcessiveReplicationCycle

    This column displays servers that have detected files that have been touched, but not updated, by some process. If the number in this column is non-zero, refer to Troubleshooting excessive Disk/CPU Usage by NTFRS.EXE in the Remarks page Troubleshooting section for more details.

    Huge File Cycle

    This column shows the number of events logged on this member in the preceding 24 hours. A large number in this column may indicate that a file could not be replicated since it was larger than the staging area size. It cannot be replicated until the staging area is reconfigured. To increase the staging area on computers in the replica set so that these files can be replicated, do the following:

    • Use Regedit to navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters
    • On the Edit menu, click New, DWORD Value, and enter Staging Space Limit in KB in the name section.
    • Exit regedit.
    • For more information, refer to the Microsoft Knowledge Base article Q221111 – Description of FRS Entries in the Registry (http://go.microsoft.com/fwlink/?LinkID=12880) for more details.

    Staging Full Cycle

    This column shows the number of events logged on a member during the last 24 hours. If the staging area is full, file cannot be replicated until you increase the size of the staging area.

    ChangeOrdersMorphedCycle and ChangeOrdersMorphedTotal

    This column shows the number of directories morphed to foldername_NTFRS_xxxxxxxx names because of conflicting updates. See the Understanding Morphed Folders in FRS in the Troubleshooting section for details on the causes and solution to this situation.

    CommTimeoutDelta, CommTimeoutCycle, and CommTimeoutTotal

    This column is a list of computers with high numbers of communication timeouts. This is an indication of network connectivity problems. If it persists, investigate the problem.

    Backlog Column Set

    After addressing issues in the Error Conditions column set section, the next column set to investigate is Backlog. This column set shows the most common backlog situations that require attention. Additional information in this column set is:

    OutConnections

    This column displays the number of outbound connections for a member in a replica set. This is helpful for identifying the computers that are hubs in the replication topology.

    BacklogConnections

    This column indicates that a number of connections from a member are in a condition in which the maximum number of files are being replicated in parallel.

    BacklogFiles and BacklogSize

    This column lists servers with unusually high numbers of files backlogged and awaiting replication, or large total quantities of data to replicate.

    Notes

    • Backlogs are a per-connection property. Since Sonar shows only per-member information, it only displays the most backlogged connection for this member.
    • The number of files backlogged is determined by examining the difference between the change order sequence numbers:
      BacklogFiles = NextChangeOrderSeq - TrailingChangeOrderSeq However, there are some cases where this metric gets distorted. One example: A vvjoin operation creates directed change orders that only go to one partner, but Sonar does not take this possibility into account in this metric.

    LongJoinCycle

    High numbers in this column indicate servers that had problems joining with a replication partner. For troubleshooting details, refer to Troubleshooting FRS Event 13508 without FRS Event 13509 in the Remarks page Troubleshooting section.

    SharingViolations

    This column displays the number of files waiting to be installed on the computer running Sonar. This list is known as the inlog or inbound log. It is most common for files to be in this state if there is a sharing violation preventing a file from being installed. However, there are other potential reasons why a change order might wait in the inlog. See the Detecting and Resolving Sharing Violations on Targets in the Troubleshooting section for details on this process.

    VVjoinsActive

    This column displays the number of computers in the process of joining (performing an initial synchronization) with their replication partners. This process can occur in normal operation, and may cause a temporary replication backlog.

    JoinsTotal

    This column displays the total number of joins (or attempted joins) the computer running Sonar has been involved in since it restarted. This is not an indication of an error; it is only informational.

    Replication Status Column Set

    This is an expanded column set that is useful when drilling down into issues with backlogs. It shows more context about what the cause of a backlog might be. Information in this column set includes:

    InConnections

    This column displays the number of inbound connections for a member in a replica set. This is helpful for identifying which computers are hubs in the replication topology.

    InJoinedConnections and OutJoinedConnections

    This column displays the number of inbound/outbound connections that are currently joined (and hence able to replicate).

    LastInJoinInterval

    This column displays the time interval since the last inbound partners of a member joined to replicate.

    LastOutJoinInterval

    This column displays the time interval since the last outbound partners of a member joined to replicate.

    LocalChangeOrdersCycle

    This column displays changes initiated by a member in the last 24 hours. Regularly look at this column to see that changes are being initiated from the expected computers. Look for unusual cases of many members suddenly originating changes, or for one computer unexpectedly initiating a lot of changes.

    StagingFilesRegeneratedCycle

    On Windows 2000 Service Pack 3 and later, this column shows whether or not the staging area is too small and whether or not files are being purged from this cache. If this persists:

    • Confirm that all direct outbound replication partners receiving updates from this member are online and receiving updates.
    • Verify that the replication schedule for receiving partners is open or on for a sufficient window of time to accommodate the number of files being replicated.
    • Consider increasing the staging area to improve system performance. To do so, perform the following:
      • Use regedit to navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters
      • On the Edit menu, click New, DWORD Value, and enter Staging Space Limit in KB in the name section.
      • For more information, refer to the Microsoft Knowledge Base article Q221111 – Description of FRS Entries in the Registry (http://go.microsoft.com/fwlink/?LinkID=12880) for more details.

    Resource Usage Column Set

    The Resource Usage column set displays the disk space available to support FRS Replication. Information in this column set includes:

    DiskSpaceReplicaRoot

    This column displays the megabytes of free space on the replica root.

    DiskSpaceStagingRoot

    This column displays the megabytes of free space in the staging area.

    DiskSpaceDB

    This column displays the megabytes of free space on the volume holding the FRS database.

    StagingFilesRegeneratedCycle

    On Windows 2000 Service Pack 3 and later, this column shows whether or not the staging area is too small and whether or not files are being purged from this cache. If this persists:

    • Confirm that all direct outbound replication partners receiving updates from this member are online and receiving updates.
    • Verify that the replication schedule for receiving partners is open or on for a sufficient window of time to accommodate the number of files being replicated.
    • Consider increasing the staging area to improve system performance. To do so, perform the following:
      • Use regedit to navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters
      • On the Edit menu, click New, DWORD Value, and enter Staging Space Limit in KB in the name section.
      • For more information, refer to the Microsoft Knowledge Base article Q221111 – Description of FRS Entries in the Registry (http://go.microsoft.com/fwlink/?LinkID=12880) for more details.

    Settings Column Set

    This column set displays some key parameters of the FRS members. Information in this column set includes:

    UpdateTime

    This column displays the last time Sonar collected data from a member.

    VerLatestChanges

    This column displays the FRS version string for a member.

    BURFLAGS

    This column displays the backup restore flags active for a member. This is useful to confirm that the entire replica set has been correctly configured during the Authoritative Restore Process. Refer to the When to use D4. Authoritative Restore section of Troubleshooting for more details.

    USNJournalSize

    This column displays the FRS registry setting for the NTFS Update Sequence Number (USN) journal size. A value of 0 indicates default (32 megabytes before Windows 2000 Service Pack 3, 128 megabytes for later versions). The recommendation is 128 megabytes of journal per 100,000 files in the replica set. Refer to the Change Journal Size section of Troubleshooting for more details.

    Sources of Change Column Set

    This column set displays statistics about sources of change in the replica set. In normal use, most computers have a limited number of systems that generate change in the replica set. Use this column set on a regular basis to confirm that change is being originated from the expected systems. New information in this column set includes:

    UpdateTime

    This column displays the time Sonar last collected data from this member.

    ExcessiveReplicationCycle

    This column displays a list of servers that have detected files that have been touched by some process but not updated. Refer to the Troubleshooting Excessive Disk/CPU Usage by NTFRS.EXE section of Troubleshooting for more details.

    LocalChangeOrdersDelta, LocalChangeOrdersCycle, and LocalChangeOrdersTotal

    These columns show changes initiated by a member in the last 24 hours. Look at these columns regularly to see that changes are being initiated from computers you expect. Look for unusual cases of multiple members suddenly originating changes, or for one computer unexpectedly initiating a lot of change.

    ChangeOrdersMorphedCycle and ChangeOrdersMorphedTotal

    These columns display the number of directories morphed to foldername_NTFRS_xxxxxxxx names due to conflicting updates. Refer to the Understanding Morphed folders in FRS section of Troubleshooting for details on the causes and solution for this situation.

Using Event Logs to Monitor Information

The FRS Event logs are key sources of monitored information. The following table summarizes the main FRS event log entries that should be monitored on a regular basis and the actions required in each case.

Event ID | Priority | Summary | Action Required
13508 | Varies | Unable to remote procedure call (RPC) to a replication partner. | Wait for Event 13509. If Event 13509 does not follow within 4 hours, investigate.
13509 | None | Able to RPC to a replication partner. | No action - this indicates that Event 13508 wait is over.
13511 | P1 | FRS database is out of disk space. | Make more space available for FRS database.
13512 | None | Enabled disk cache detected. | No action required.
13522 | SP2: P1 SP3: P3 | Staging area is full. | On Windows 2000 before Service Pack 3, administrator must clear replication backlog. In Windows 2000 Service Pack 3 and later, automatic processes trim the size of the staging area and treat it like a cache. Administrators should investigate increase as an optimization if this is repeatedly logged.
13526 | P1 | Security identifier (SID) cannot be determined from the distinguished name. | Restart FRS.
13548 | P1 | Systems clocks are too far apart. | Correct clocks on one or more replica members.
13557 | P1 | Duplicate connections are configured. | Delete the unnecessary connection object.
13567 | P2 | Excessive replication is detected and suppressed. | Investigate the cause of excessive replication. In the meantime, the FRS server is using excessive amounts of CPU and disk resources to damp the replication traffic by comparing files to previously sent copies.
13568 | SP2: P2 SP3: P1 | Journal wrap. | Depends on FRS version. See the FRS Troubleshooting section of the Remarks page for details.

Refresh All Button

This button is used to refresh the grid view containing the list of servers. You can also refresh selected rows in the grid view by right-clicking them and clicking Refresh on the Options menu. To modify the default refresh period, use the drop-down box to the right of the Refresh All button.

Status Bar

A status bar at the bottom of the grid view displays the status of the query.

The status bar contains the following:
Queued | Number of requests in the queue.
Pending | Number of requests currently being serviced (up to 25).
Succeeded | Number of successful requests.
Failed | Number of failed requests.
Notify | Notifications that are enabled/disabled.
Refresh in | Time to next scheduled refresh.
Log | Indicates that the log is enabled (started) or disabled (stopped).


SplInfo Examples

Example 1: Run SplInfo on a Local Computer

The task in this example is to run SplInfo on a local computer. Type the following at the command line:

splinfo

Press ENTER. Output similar to the following is displayed:

Number Local Printers    10
Windows Version          5.2 Build 3678 FREE
Number of Processors     1 PROCESSOR_INTEL Level 15
Total Jobs Spooled       9
Total Bytes Printed      1,545,128
Total GDI Pages Printed  30
Average Bytes/Job        171,680
Average Pages/Job        3
Average Bytes/Page       51,504
Browse List Requested    0
Browse Printer Added     0
Spooler Up Time          11 Days 17:20:49
Server Up Time           11 Days 17:20:49

If there is no printer installed on the local computer, the following text is displayed instead:

splinfo: No local printers installed

Example 2: Run SplInfo on a Remote Server

The task in this example is to run SplInfo on a remote server. Type the following at the command line:

splinfo \\woodgrovebank

Press ENTER. Output similar to the following is displayed:

Number Remote Printers  86 on \\woodgrovebank
Windows Version         5.2 Build XXXX FREE
Number of Processors    2 PROCESSOR_INTEL Level 6
Total Jobs Spooled      6
Total Bytes Printed     2,847,061
Total GDI Pages Printed 67
Average Bytes/Job       474,510
Average Pages/Job       11
Average Bytes/Page      42,493
Browse List Requested   0
Browse Printer Added    0
Spooler Up Time         02:11:00
Server Up Time          02:11:27


SplInfo Remarks

Understanding Normal Mode vs. Verbose Mode

In normal mode, SplInfo displays the following information about the print server:

  • Number of printers on the specified server
  • Windows version
  • Number of processors
  • Total jobs spooled
  • Total bytes printed
  • Total Graphics Device Interface (GDI) pages printed
  • Average bytes/job
  • Average pages/job
  • Average bytes/page
  • Browse list requested
  • Browse printer added
  • Spooler up time
  • Server up time (approximate)

In verbose mode, SplInfo displays the following additional information about each printer:

  • Printer name
  • Total print jobs
  • Total printed bytes
  • Total NT pages printed
  • Printer up time
  • Number of jobs in queue
  • cRef
  • cRefIC
  • Max cRef
  • Number spooling
  • Maximum number spooling
  • Printer started (date and time)
  • Average bytes/job
  • Average pages/job
  • Average bytes/page
  • Printer change count identification (ID)
  • Printer status


SplInfo Syntax

SplInfo uses the following syntax:

One Step splinfo [/z] [/v] [/d] [\\UNC_Name]

Parameters

/z
Resets the counters to 0. When you use this parameter, the verbose flag is implied, and information about all printers will be displayed before the counters are reset. This function requires Administrative access to the server/printers.
/v
Provides additional ("verbose") information about all printers on the server, in addition to the information displayed during normal mode.
/d
Provides debugging information.
\\UNC_Name
Displays infomation for the print server specified in the \\UNC_Name path. This parameter takes Universal Naming Convention (UNC) names.


SrvAny Examples

Overview | Remarks | Syntax | Examples | Related Tools

Example 1: Specify a Working Directory if SrvAny Fails to Start an Application.

The task in this example is to specify the directory that contains the application as the working directory. Because SrvAny can run under an account that is different from the user currently logged on, the different accounts can be using different environment variables. As a result, the system might be unable to find a required DLL. Running the application from its root directory might solve the problem.

To specify the working directory, use either:

    RegEdit

    1. Click the Start button, and then click Run.
    2. In the Open box, type regedit, and then click OK.
    3. Navigate to the following registry location:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyService\Parameters
    4. Right-click AppDirectory, and then click Modify on the shortcut menu.
    5. In the Edit String window, in Value Data, enter the full path to the directory that contains the application you want to run as a service. For example:

      D:\Tools\

      6. Caution

      • The registry editors bypass standard safeguards, allowing settings that can degrade performance, damage your system, or even require you to reinstall Windows. You can safely alter most registry settings by using the programs in Control Panel or Microsoft Management Console (MMC). If you must edit the registry directly, back it up first. Read the Registry Editor Help for more information.

    Services snap-in

    1. In Control Panel, choose Administrative Tools, and then choose Services.
    2. In the details pane, right-click a service, and then select Properties on the shortcut menu.
    3. On the General tab, in Start Parameters, type the following:

      \\D %windir%\\PathToDirectory

Example 2: Remove a SrvAny Service

The task in this example is to removes one instance of SrvAny. If you installed multiple instances of Srvany.exe, you must repeat these steps for each instance.

To remove an SrvAny service:

  1. Stop the service.
  2. Type the following at the command line:
    instsrv MyService remove

    Parameters

    MyService
    Specifies the name you want to uninstall.

This removes MyService from the list of available services in the Service MMC snap-in. It also removes any registry entries that were set for this service.

Output similar to the following is displayed:

The service was successfully removed!


SrvAny Remarks

Overview | Remarks | Syntax | Examples | Related Tools

Use the following procedures after you install SrvAny and create a service name.

  • Configure a Service. After you install SrvAny and create a service name, you must configure the service. To configure a service you must specify a target application, an account name, and password for the service to use. Then you can configure optional settings such as startup parameters and a default working directory. You can configure your service either in the MMC Services snap-in or the registry.
  • Handle Special Requirements. After you configure your service, you may need to further customize applications that have special requirements when they run as a service. If you are using an application that meets any of the following criteria, you must follow additional steps before running your service.
    • The application is interactive and must run under the Local System account.
    • The application is a Win32 application.
    • The application is a Presentation Manager application.
  • Manage a Service. After you address special requirements, you can manage your service by starting, pausing, or stopping it. This section explains how to use the Services snap-in, the SC command which communicates with the Service Controller, and the Net commands to perform each of these operations.

Note

  • None of the strings used in these procedures is case-sensitive.

Configuring a Service

To configure a service, use either:

  • RegEdit. Use RegEdit if you want the application running as a service to start automatically and always use the same start parameters.
  • Services MMC Snap-in. Use Services if you want the application running as a service to start automatically or manually, or if you want to frequently change the start parameters.

RegEdit

Caution

  • The registry editors bypass standard safeguards, allowing settings that can degrade performance, damage your system, or even require you to reinstall Windows. You can safely alter most registry settings by using the programs in Control Panel or Microsoft Management Console (MMC). If you must edit the registry directly, back it up first. Read the Registry Editor Help for more information.

To configure a service in RegEdit:

  1. Click the Start button, and then click Run.
  2. In the Open box, type regedit, and click OK.
  3. Add a new subkey named Parameters in the following registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
  4. Right-click the newly created service name, point to New, and then click Key.
  5. In the console pane, for the name of the new key, type Parameters.
  6. To specify the target application, right-click the Parameters subkey, point to New, and then click String Value.
  7. Type the name of the new entry as Application.
  8. Right-click Application and then click Modify.
  9. In the Edit String window, in Value Data, type the full path to the application, including the application name and extension. For example:

    D:\Windows\MSagent\agentsvr.exe

  10. Set any of the following optional parameters:

    • start parameters

      To set start parameters:

      1. Right-click the Parameters subkey, point to New, and then click String Value.
      2. Type the name of the new entry as AppParameters.
      3. Right-click AppParameters and then click Modify.
      4. In the Edit String window, in Value Data, type the parameters for the application. For example:

        D:\Windows\MSagent\ParameterList

      environment variables

      To set environment variables:

      1. Right-click the Parameters subkey, point to New, and then click Multi-String Value.
      2. Type the name of the new entry as AppEnvironment.
      3. Right-click AppEnvironment and then click Modify.
      4. In the Edit Multi-String window, in Value Data, type one new parameter per line, making sure to press ENTER after every line.

      • a working directory

      To set a working directory:

      1. Right-click the Parameters subkey, point to New, and then click String Value.
      2. Type the name of the new entry as AppDirectory.
      3. Right-click AppDirectory and then click Modify.
      4. In the Edit String window, in Value Data, type the type the full path to the working directory you want to use. For example:

        D:\Windows\MSagent\Tmp

Services

To configure a service in Services:

  1. Click Start, point to Administrative Tools, and then click Services.
  2. In the details pane, right-click the service you added in step #1, and then select Properties.
  3. On the General tab, in Startup Type, select Automatic or Manual.
  4. On the General tab, in Start Parameters, type any parameters you want passed to the application when it starts as a service. For example:

    \\Parameter1\\Parameter2

    Notes

    • The start parameters you specify here are only applied when the service is started from the Service MMC snap-in.
    • A backslash (\) is treated as an escape character. You must type two backslashes (\\) to specify a single backslash (\).
  5. To set a working directory, on the General tab, in Start Parameters, type the following:

    /D %windir%\\PathToDirectory

  6. To choose the type of account the service will use, on the Log On tab, select either Local System Account or This Account. Use the following information to decide which account to use:
    • The type of log on account you should select is usually determined by the requirements of the specific application.
    • Local System Account does not have network access.
    • If you need access to the screen and keyboard, you must choose System Account and allow the service to interact with desktop.
  7. If you chose Local System Account, to allow access to the screen and keyboard, check the Allow Service To Interact With Desktop check box.
  8. If you chose This Account, type or browse to specify a valid account name, and in Password and Confirm Password, type the same correct password for the account.

Handling Special Requirements

To determine if your application requires special configuration, follow the procedures shown the following sections.

  • Interactive versus Network Access. Use if the application is interactive and must run under the Local System account.
  • User Exit Programming Considerations. Use if the application is a Win32 application.
  • Presentation Manager Applications. Use if the application is a Presentation Manager application.

Interactive versus Network Access

Due to a restriction on services enforced by Windows, an application running as a service can either be interactive or have network access, but not both at the same time. A server is interactive if, for example, it prompts a user for information and reads keyboard input. In the installation and configuration instructions, if an application running as a service is interactive, you are required to select the service to run under the Local System account. Running under this type of account limits network access. If your service is interactive and requires a connection to known servers, you can configure a registry key to allow network access to a share or named pipe. A named pipe is an Inter-Process Communications (IPC) method that provides a name through which remote services can to make network connections.

Caution

  • When you provide network access to your interactive service, you are allowing all services in the domain running under the Local System account to log on to other network resources with null credentials. Modifying registry keys to allow all services in the domain access to other servers without providing any authentication is a security risk.

To allow all Local System services on any computer in the domain to connect to a specific share on a server:

  1. Click the Start button, and then click Run.
  2. In the Open box, type regedit, and click OK.
  3. In the console pane, navigate to the following registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    LanmanServer\Parameters
  4. In the details pane, right-click NullSessionShares, and then click Modify.
  5. In the Edit Multi String Data window, in Value Data, enter the name of the share, making sure not to type over any existing entries.

To allow all Local System services access to named pipes on a server:

  1. Click the Start button, and then click Run.
  2. In the Open box, type regedit, and click OK.
  3. In the console pane, navigate to the following registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    LanmanServer\Parameters
  4. In the details pane, right-click NullSessionPipes, and then click Modify.
  5. In the Edit Multi String Data window, in Value Data, enter the name of the pipe, making sure not to type over any existing entries.

To allow all Local System services access to all shares and named pipes on a server:

  1. Click the Start button, and then click Run.
  2. In the Open box, type regedit, and click OK.
  3. In the console pane, navigate to the following registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    LanmanServer\Parameters
  4. In the details pane, right-click RestrictNullSessAccess, and then click Modify.
  5. In the Edit DWORD Value window, in Value Data, enter 0.

User Exit Programming Considerations

After a user exits a Win32 graphical application, all top-level windows receive the WM_QUERYENDSESSION and WM_ENDSESSION messages. Some Win32 applications stop running when they receive these messages. To keep a Win32 application running after a user exits, all Win32 applications must use the default Windows procedure when they receive these messages.

After a user exits a Win32 character-based application, the application receives a CTRL_LOGOFF_EVENT event from the console. To continue running a Win32 character-based application after a user exits, if the application registers a console event handler using SetConsoleCtrlHandler, it must ignore the CTRL_LOGOFF_EVENT event.

Presentation Manager Applications

Presentation Manager is a Microsoft add-on product that allows you to run 16-bit Presentation Manager 1.x applications in addition to the OS/2 character-mode applications supported by the Windows OS/2 subsystem.

To use SrvAny with Presentation Manager applications, you must consult the Readme.wri file for special configuration instructions.

The Readme.wri file is shipped on Disk#1 of the Windows NT Add-On Subsystem for Presentation Manager, version 3.51.

Managing Services

Use the following procedures to manage your service.

  • Start a Service. Services can be configured to start automatically or manually. If you configure a service to start automatically, it is started by the operating system when the computer is started. If you configure a service to start up manually, you can start the service from the Services snap-in, from the SC command line tool which is used to communicate with the Service Control Manager, and from Net Start, which is also a command line tool that can start services. It does not matter which tool you use.
  • Pause a Service. Services can be paused to give users time to complete jobs or disconnect from resources before a service is stopped. Normally, using pause puts a service on hold without removing the software from memory. Users who already have a connection to the resource are able to finish their tasks, but new connections to the resource are prevented. However, not all services can be paused and not all services perform the same when paused. Some continue to service existing clients, but refuse to accept new clients. Others cease to service existing clients and also refuse to accept new ones.
  • Stop a Service. This action stops a service and removes the software from memory. If you plan to stop a service that affects shared resources, it is good practice to pause the service first and provide people with enough time to finish using the resource. Some services, such as Remote Procedure Call (RPC), Event Log, and Plug and Play, cannot be stopped using the Service snap-in or the net stop command. These services are required for the operating system to function properly.
  • Disable a Service. You must disable all SrvAny services before you install or upgrade an operating system or a software program. You can also disable a service for a specific hardware profile. You may want to set up a hardware profile to test any newly installed services. For example, you can create two hardware profiles for a newly installed service: one profile in which the service is enabled and a second profile in which the service is not enabled. This way, you can troubleshoot any problems that may occur, such as a driver not loading properly.

Starting a Service

Caution

  • If you stop, start, or restart a service, any dependent services are also affected. Starting a service does not automatically restart its dependent services.

To configure a Service to start automatically:

  1. Click Start, point to Administrative Tools, and then click Services.
  2. In the details pane, right-click the service you want to configure, and then select Properties.
  3. On the General tab, in Startup Type, select Automatic.

To configure a Service to start manually:

  1. Click Start, point to Administrative Tools, and then click Services.
  2. In the details pane, right-click the service you want to configure, and then select Properties.
  3. On the General tab, in Startup Type, select Manual.

To manually start a Service in the Services snap-in:

  1. Click Start, point to Administrative Tools, and then click Services.
  2. In the details pane, right-click the service you want to start, and then select Start.

To manually start a Service using the SC command:

  1. Type the following at the command line:
    sc RemoteServerNamestart MyService ServiceArguments

    Parameters

    RemoteServerName
    Specifies the name of the remote server on which the service is located. The name must use the UNC format ("\\myserver"). If you are running SC.exe locally, do not use this parameter.
    MyService
    Specifies the service name to start. If you do not know the correct name to use, run the sc getkeyname command.
    ServiceArguments
    Specifies service arguments, such as start up parameters, that are passed to the service when it is started.

To manually start a Service using the Net Start command:

  1. Type the following at the command line:
    net start MyService

    Parameters

    MyService
    Specifies the service name to start. For a list of currently operating services, run the net start command without any parameters.

Pausing a Service

To pause a service in the Services snap-in:

  1. Click Start, point to Administrative Tools, and then click Services.
  2. In the details pane, right-click the service you want to pause, and then select Pause.
  3. To restart the service, in the details pane, right-click the paused service, and then select Resume.

To pause a service, use the SC command:

  1. Type the following at the command line:
    sc RemoteServerName pause MyService

    Parameters

    RemoteServerName
    Specifies the name of the remote server on which the service is located. The name must use the UNC format ("\\myserver"). If you are running SC.exe locally, do not use this parameter.
    MyService
    Specifies the service name to pause. If you do not know the correct name to use, run the sc getkeyname command.
  2. To stop the service, use sc stop.

To pause a service using the Net Pause command:

  1. Type the following at the command line:
    net pause MyService

    Parameters

    MyService
    Specifies the service name to pause. For a list of currently operating services, run the net start command without any parameters.
  2. To restart the service, type the following at the command line:
    3. net continue MyService

    Parameters

    MyService
    Specifies the service name to continue.

Stopping a Service

Important

  • When you stop an application running as a service, the operating system uses the Win32 TerminateProcess() API to stop the application. This process does not allow the application to prompt the user and save changes. For this reason, you should close the application before the service is stopped.

To stop a Service in the Services snap-in:

  1. Click Start, point to Administrative Tools, and then click Services.
  2. In the details pane, right-click the service you want to stop, and then select Stop.

To stop a service using the SC command:

  1. Type the following at the command line:
    sc RemoteServerName stop MyService

    Parameters

    RemoteServerName
    Specifies the name of the remote server on which the service is located. The name must use the UNC format ("\\myserver"). If you are running SC.exe locally, do not use this parameter.
    MyService
    Specifies the service name to stop. If you do not know the correct name to use, run the sc getkeyname command.

To stop a service using the Net Stop command:

  1. If you plan to stop a service that affects shared resources, use the net pause command to pause the service first.
  2. Use the net send command to broadcast a message that you are going to stop the service.
  3. Type the following at the command line:
    net stop MyService

    Parameters

    MyService
    Specifies the service name to stop. For a list of currently operating services, run the net start command without any parameters.

Disable a Service

To disable a service:

  1. Click Start, point to Administrative Tools, and then click Services.
  2. In the details pane, right-click the service, and then select Properties.
  3. On the General tab, in Startup Type, select Disabled.

To disable a service for a hardware profile in the Services snap-in:

  1. Click Start, point to Administrative Tools, and then click Services.
  2. In the details pane, right-click the service, and then select Properties.
  3. On the Log On tab, under Hardware Profile, select the profile name, and then click Disable.

Important

  • Use caution when disabling services for a specific hardware profile. When you do this, the Hardware Profile settings override the Startup type setting for the service.


SrvAny Syntax

InstSrv uses the following syntax to install SrvAny on Windows Server 2003 and create a service name:

instsrv ServiceName %windir%:\Path\srvany.exe

Parameters

%windir%
Specifies the root system directory, such as C.
Path
Specifies the full path to the location of Srvany.exe.
ServiceName
Specifies the name you want to assign the service.

Notes

  • Output similar to the following is displayed:
    • The service was successfully added!
Make sure that you go into the Control Panel and use the Services applet
to change the Account Name and Password that this newly installed service
will use for its Security Context.
  • Use the Service Installer tool (InstSrv) to install SrvAny and create a service name. After you install SrvAny, you must configure the service to specify the application that will run as a service and under what conditions. Then you can start the service and SrvAny will allow the target application to run as a service.
  • You can install SrvAny several times to create different services that use different registry settings and run different target applications. If you are installing srvany multiple times, you must use a distinct service name for each instance you install. For example, for database applications you want to run as a service, use DatabaseService, and for e-mail applications, use EmailService.
  • To specify a long path that includes directory names longer than eight characters and spaces between words, you must use the auto-complete feature. To use the auto-complete feature, type the first part of the directory path, the part that does not include more than eight characters or spaces, and then press the TAB key. Quotes will surround the path. Continue using the TAB key until the complete path is displayed in the command.


SrvCheck Examples

Example: Enumerate the ACL for a Share

To enumerate the ACL for a share, type the following at the command line.

srvcheck \\aseanl-test1

Press ENTER. Output similar to the following is displayed:

\\aseanl-test1\latestbuild$
                Everyone                Read

C:\Documents and Settings\Administrator>


SrvCheck Remarks

Share Permissions

Sharing is initiated from the Properties menu of the object. A shared resource refers to any resource that is made available to network users, such as directories, files, printers, and named pipes.

Share permissions are used to restrict the availability of a shared resource over the network to specific users.

Permission available:

  • No Access
  • Read: read files and execute programs
  • Change: read, execute, modify, and delete items
  • Full Control

Administrative shares are created for maintenance and support issues. They are hidden shares and cannot be unshared. Deleting administrative shares can cause the system to crash, and/or not participate in browsing or other network activities.


SrvCheck Syntax

Srvcheck uses the following syntax:

One Step srvcheck [\\ComputerName] [/?]

Parameters

\\ComputerName
Indicates the computer on which to run SrvCheck. If not specified, the default is the local computer.
/?
Displays command-line usage.


SrvInfo Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Display Server Information for the Current Computer

The task in this example is to display information about the computer on which SrvInfo is run. Type the following at the command line:

srvinfo

Press ENTER. Output similar to the following is displayed:

Server Name: WOODBRIDGE
Security: Users
Registered Owner:
Registered Organization:
ProductID: xxxxx-xxx-xxxxxxx-xxxxx
Original Install Date: Tue Nov 19 09:40:49 2002
Base Source Path: c:\
Service Pack Source Path: c:\
Version: 5.2
Build: xxxx - Evaluation version expires 11/14/2003
Current Type: Uniprocessor Free
Product Name: Microsoft Windows Server 2003

Product Options: Server, Enterprise, Terminal Server
HAL.DLL is  5.2.xxxx.0 - Microsoft Corporation - 5.2:xxxx.0
CPU[0]: x86 Family 6 Model 5 Stepping 3: 448 MHz
System BIOS Date: 11/17/98
System BIOS Version:
Drive:  [FileSys]  [ Size ]  [ Free ]  [ Used ]
  C$      NTFS        8668      6259      2409
Services:
   [Stopped]    Alerter
   [Stopped]    Application Layer Gateway Service
   [Stopped]    Application Management
   [Running]    Windows Audio
   [Stopped]    Background Intelligent Transfer Service
   [Running]    Computer Browser
   [Stopped]    Indexing Service
   [Stopped]    ClipBook
   [Running]    COM+ System Application
   [Running]    Cryptographic Services
   [Running]    Distributed File System
   [Running]    DHCP Client
   [Stopped]    Logical Disk Manager Administrative Service
   [Running]    Logical Disk Manager
   [Running]    DNS Client
   [Running]    Error Reporting Service
   [Running]    Event Log
   [Running]    COM+ Event System
   [Running]    Help and Support
   [Stopped]    Human Interface Device Access
   [Stopped]    HTTP SSL
   [Stopped]    IMAPI CD-Burning COM Service
   [Stopped]    Intersite Messaging
   [Stopped]    Kerberos Key Distribution Center
   [Running]    Server
   [Running]    Workstation
   [Running]    License Logging
   [Running]    TCP/IP NetBIOS Helper
   [Stopped]    Messenger
   [Stopped]    NetMeeting Remote Desktop Sharing
   [Running]    Distributed Transaction Coordinator
   [Stopped]    Windows Installer
   [Stopped]    Network DDE
   [Stopped]    Network DDE DSDM
   [Stopped]    Net Logon
   [Running]    Network Connections
   [Running]    Network Location Awareness (NLA)
   [Stopped]    File Replication
   [Stopped]    NT LM Security Support Provider
   [Stopped]    Removable Storage
   [Running]    Plug and Play
   [Running]    IPSEC Services
   [Running]    Protected Storage
   [Stopped]    Remote Access Auto Connection Manager
   [Running]    Remote Access Connection Manager
   [Stopped]    Remote Desktop Help Session Manager
   [Stopped]    Routing and Remote Access
   [Running]    Remote Registry
   [Stopped]    Remote Procedure Call (RPC) Locator
   [Running]    Remote Procedure Call (RPC)
   [Stopped]    Resultant Set of Policy Provider
   [Stopped]    Special Administration Console Helper
   [Running]    Security Accounts Manager
   [Stopped]    Smart Card
   [Running]    Task Scheduler
   [Running]    Secondary Logon
   [Running]    System Event Notification
   [Stopped]    Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
   [Running]    Shell Hardware Detection
   [Running]    Print Spooler
   [Stopped]    Windows Image Acquisition (WIA)
   [Stopped]    Microsoft Software Shadow Copy Provider
   [Stopped]    Performance Logs and Alerts
   [Running]    Telephony
   [Running]    Terminal Services
   [Stopped]    Themes
   [Stopped]    Telnet
   [Stopped]    Distributed Link Tracking Server
   [Running]    Distributed Link Tracking Client
   [Stopped]    Terminal Services Session Directory
   [Stopped]    Upload Manager
   [Stopped]    Uninterruptible Power Supply
   [Stopped]    Virtual Disk Service
   [Stopped]    Volume Shadow Copy
   [Running]    Windows Time
   [Stopped]    WebClient
   [Stopped]    WinHTTP Web Proxy Auto-Discovery Service
   [Running]    Windows Management Instrumentation
   [Stopped]    Portable Media Serial Number Service
   [Stopped]    Windows Management Instrumentation Driver Extensions
   [Stopped]    WMI Performance Adapter
   [Running]    Automatic Updates
   [Running]    Wireless Configuration
Network Card [0]: 3Com EtherLink XL 10/100 PCI For Complete Computer Management Network Card (3C905C-TX)
        IP Address(es): 10.0.0.1
        MAC Address: xxxxxxxxxxxx
Protocols:
   Point to Point Tunneling Protocol
   Remote Access NDIS WAN Driver
   Point to Point Protocol Over Ethernet
   Internet Protocol (TCP/IP)
   Layer 2 Tunneling Protocol
   Message-oriented TCP/IP Protocol (SMB session)
   NDIS Usermode I/O Protocol
   WINS Client(TCP/IP) Protocol
System Up Time: 138 Days, 3 Hr, 22 Min, 37 Sec

Example 2: Display Server Information for a Remote Computer

The task in this example is to display information about a remote computer that is part of a cluster. Type the following at the command line:

srvinfo \\woodbridge-cluster

Press ENTER. Output similar to the following is displayed:

Server Name: WOODBRIDGE-CLUSTER
Cluster name: PRODUCTS
Security: Users
Registered Owner:
Registered Organization:
ProductID: xxxxx-OEM-xxxxxxx-xxxxx
Original Install Date: Sun Aug 20 14:08:08 2000
Base Source Path: \\woodbridge-cluster01\dtc
Service Pack Source Path: \\woodbridge-cluster01\dtc\i386\sp3
Version: 5.0
Build: 2195, Service Pack 3
Current Type: Multiprocessor Free
Product Name: Microsoft Windows 2000
Product Options: Server, Enterprise, Terminal Server
HAL.DLL is 5.00.2195.4864 - Microsoft Corporation - 5.0:2195.0
PDC: \\wb-dc-09.corp.woodbridgebank.net
Domain: corp.woodbridge.com
Domain Guid: {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
DNS Forest Name: corp.woodbridgebank.net
PDC Site Name: NA-WA-SEA
Computer Site Name: NA-WA-SEA
CPU[0]: x86 Family 6 Model 1 Stepping 9: 199 MHz
CPU[1]: x86 Family 6 Model 1 Stepping 9: 199 MHz
System BIOS Date: 12/01/99
Hotfixes:
Windows 2000:
SP3
[IPAKNT_506 (RTM 2195.SP3 v1.0)]: Installed on 10/20/2002 by rf637
SP4
[Q256507]: Installed on 10/20/2002 by rf637
[Q289261]: Installed on 10/20/2002 by rf637
[Q311444]: Installed on 10/20/2002 by rf637
[Q320063]: Installed on 10/20/2002 by rf637
[Q320373]: Installed on 10/20/2002 by rf637
[Q321091]: Installed on 10/20/2002 by rf637
[Q322599]: Installed on 10/20/2002 by rf637
[Q322760]: Installed on 10/20/2002 by rf637
[Q322953]: Installed on 10/20/2002 by rf637
[q323172]: Installed on 10/20/2002 by rf637
[Q323255]: Installed on 10/20/2002 by rf637
[Q323256]: Installed on 10/20/2002 by rf637
[Q323498]: Installed on 10/20/2002 by rf637
[Q323653]: Installed on 10/20/2002 by rf637
[Q323668]: Installed on 10/20/2002 by rf637
[Q324039]: Installed on 10/20/2002 by rf637
[Q324096]: Installed on 10/20/2002 by rf637
[Q324183]: Installed on 10/20/2002 by rf637
[Q324223]: Installed on 10/20/2002 by rf637
[Q324380]: Installed on 10/20/2002 by rf637
[Q324615]: Installed on 10/20/2002 by rf637
[Q324627]: Installed on 10/20/2002 by rf637
[Q325463]: Installed on 10/20/2002 by rf637
[Q325775]: Installed on 10/20/2002 by rf637
[Q325840]: Installed on 10/20/2002 by rf637
[Q326531]: Installed on 10/20/2002 by rf637
[Q326569]: Installed on 10/20/2002 by rf637
[Q326572]: Installed on 10/20/2002 by rf637
[Q326800]: Installed on 10/20/2002 by rf637
[Q326830]: Installed on 10/20/2002 by rf637
[Q326886]: Installed on 10/20/2002 by rf637
[Q327020]: Installed on 10/20/2002 by rf637
[Q327477]: Installed on 10/20/2002 by rf637
[Q328145]: Installed on 10/20/2002 by rf637
[smss.28075]: Installed on 6/18/2002 8:22 PM by /f
Internet Explorer:
SPX
[Q323759]: Installed on 10/20/2002 by rf637
Drive: [FileSys] [ Size ] [ Free ] [ Used ] [Owner]
C$ NTFS 4057 1476 2581 Local
D$ NTFS 17336 17264 72 Cluster - Quorum resource
Services:
[Running] Alerter
[Stopped] Application Management
[Running] Backup Exec Remote Agent for Windows NT/2000
[Stopped] Computer Browser
[Stopped] Compaq Event Notifier
[Stopped] Indexing Service
[Stopped] ClipBook
[Running] Cluster service
[Running] Compaq Network Card Agents
[Running] Compaq Remote Monitor Service
[Stopped] Compaq Version Control Agent
[Stopped] Compaq Web Agent
[Running] Compaq Foundation Agents
[Running] Compaq Server Agents
[Running] Compaq Storage Agents
[Running] Distributed File System
[Running] DHCP Client
[Stopped] Logical Disk Manager Administrative Service
[Running] Logical Disk Manager
[Running] DNS Client
[Stopped] SeNTry EKG
[Running] Event Log
[Running] COM+ Event System
[Stopped] Fax Service
[Running] eTrust Antivirus RPC Server
[Running] eTrust Antivirus Realtime Server
[Running] eTrust Antivirus Job Server
[Stopped] Intersite Messaging
[Stopped] Kerberos Key Distribution Center
[Running] Server
[Running] Workstation
[Stopped] License Logging Service
[Running] TCP/IP NetBIOS Helper Service
[Running] Messenger
[Stopped] NetMeeting Remote Desktop Sharing
[Running] Distributed Transaction Coordinator
[Stopped] Windows Installer
[Stopped] Network DDE
[Stopped] Network DDE DSDM
[Running] NetIQccm
[Running] NetIQmc
[Running] Net Logon
[Running] Network Connections
[Running] NetWorker Remote Exec Service
[Stopped] NetWorker Power Monitor
[Stopped] File Replication
[Running] NTLM Security Support Provider
[Running] Removable Storage
[Running] OnePoint
[Running] Plug and Play
[Running] IPSEC Policy Agent
[Running] Process Control Service
[Running] Protected Storage
[Stopped] Remote Access Auto Connection Manager
[Running] Remote Access Connection Manager
[Stopped] Routing and Remote Access
[Stopped] RemotePrompt
[Running] Remote Registry Service
[Stopped] Remote Procedure Call (RPC) Locator
[Running] Remote Procedure Call (RPC)
[Running] Security Accounts Manager
[Stopped] Smart Card Helper
[Stopped] Smart Card
[Running] Task Scheduler
[Running] RunAs Service
[Running] System Event Notification
[Running] Sentry Alert Sender (SASS)
[Stopped] Internet Connection Sharing
[Running] SNMP Service
[Stopped] SNMP Trap Service
[Running] Print Spooler
[Running] Surveyor
[Running] Compaq System Shutdown Service
[Stopped] Performance Logs and Alerts
[Running] Telephony
[Running] Terminal Services
[Stopped] Time Service
[Stopped] Telnet
[Stopped] Distributed Link Tracking Server
[Stopped] Distributed Link Tracking Client
[Stopped] Uninterruptible Power Supply
[Stopped] Utility Manager
[Running] Windows Time
[Running] Windows Management Instrumentation
[Running] Windows Management Instrumentation Driver Extensions
Network Card [0]: Netelligent 10/100TX PCI Embedded UTP/AUI Controller
IP Address(es): 10.0.0.32
MAC Address: xxxxxxxxxxx
Network Card [1]: Compaq NC3120 Fast Ethernet Network Card
IP Address(es): 10.0.0.31
MAC Address: xxxxxxxxxxxx
Network Card [2]: Compaq NC3120 Fast Ethernet Network Card
IP Address(es): 10.0.0.30
MAC Address: xxxxxxxxxxx
Protocols:
WINS Client(TCP/IP) Protocol
Internet Protocol (TCP/IP)
Point to Point Tunneling Protocol
Layer 2 Tunneling Protocol
Remote Access NDIS WAN Driver
Network Monitor Driver
Message-oriented TCP/IP Protocol (SMB session)
System Up Time: 14 Days, 18 Hr, 32 Min, 51 Sec


SrvInfo Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

SrvInfo uses the following syntax:

One Step srvinfo [-d] [-ns] [-nf] [-r] [-s] [-v] [\\ComputerName] [-?]

Parameters

-d
Shows service drivers and services.
-ns
Does not show any service information.
-nf
Does not show hotfix information.
-r
Shows service internal names.
-s
Shows shares.
-v
Gets version information for Exchange Server, Internet Information Services (IIS), and Microsoft SQL Server.
\\ComputerName
Specifies the name of a remote server. If omitted, information about the local computer is displayed.
-?
Displays command-line usage.

Note

  • These parameters can only be used with dashes, not slashes.


SSDFormat Examples

The following examples show you how to use SSDFormat to create a formatted copy of a System State Data (SSD) log file.

Note

  • The following examples require that:
    • You are logged on with an account that is a member of the local Administrators group on the server where you are running SSDFormat.
    • The server has at least one existing SSD log file after it has been shut down for an unplanned reason.

In all the following examples, running SSDFormat creates one or more new XML files. The new files have the same data as the original SSD log file, with the addition of a file header. When you open the XML file created by SSDFormat in any XML-capable viewer, such as Microsoft Internet Explorer, the XSL style sheet included in the file header corrects any invalid characters and displays the data in tabular form.

Example 1: Format a New SSD Log File After a Server Shutdown

The task in this example is to format a new SSD log file, using the default XSL style sheet, the first time a server is shut down for an unplanned reason.

Type the following at the command line:

SSDFormat -d %windir%\system32\logfiles\shutdown\ -s "C:\Program Files\Windows Server 2003 Resource Kit\SSS_1.1.xsl"

Press ENTER. Output similar to the following is displayed.

Formatting  ShutDown_20021205171423.xml

This SSDFormat command opens an SSD log file in the default %windir%\system32\logfiles\shutdown directory, and for formatting purposes, adds a file header to include the XSL style sheet in the C:\Program Files\Windows Server 2003 Resource Kit directory called SSS_1.1.xsl. Then SSDFormat saves the modified file to the %windir%\system32\logfiles\shutdown directory using a naming convention of Shutdown_*f.xml.

Notes

  • This example shows how to run SSDFormat after the first SSD log file is created. It is important to note that SSDFormat creates one formatted file for every SSD log file in a directory that uses a naming convention of Shutdown_*.xml. If there are a large number of files in the %windir%\system32\logfiles\shutdown directory, and there is only one SSD log file that you want to format, you can copy the single file to a separate directory and run SSDFormat on that directory as explained in Example 2.
  • This example leaves the XSL style sheet in the C:\Program Files\Windows Server 2003 Resource Kit installation directory. Because this directory is different from where you save the formatted files, in this example you enter the path to the style sheet at the command line. If you do not want to specify the path to the XSL style sheet at the command line, you can copy the XSL file to the %windir%\system32\logfiles\shutdown directory, and omit the XSL file path used in this example.
  • To specify a long path name that includes directory names longer than eight characters and spaces between words, you must use the auto-complete feature. To use the auto-complete feature, type the first part of the directory path, the part that does not include more than eight characters or spaces, and then press the TAB key. Quotes will surround the path. Continue using the TAB key until the complete path is displayed in the SSDFormat command.

Example 2: Format a Specific set of SSD Log Files in a Temporary Directory

The task in this example is to format a specific set of SSD log files in a temporary directory using the default XSL style sheet

Type the following at the command line:

SSDFormat -d C:\Temporary -s SSS_1.1.xsl -o C:\Temporary

Press ENTER. Output similar to the following is displayed:

Formatting  ShutDown_20021220171423.xml

Formatting  ShutDown_20021222021158.xml

Formatting  ShutDown_20021223053271.xml

This SSDFormat command opens an SSD log file in the C:\Temporary directory, and for formatting purposes, adds a file header to include the XSL style sheet that is in the same directory and is called SSS_1.1.xsl. Then SSDFormat saves the modified file to the C:\Temporary directory using a naming convention of Shutdown_*f.xml. SSDFormat repeats this process for all files in the C:\Temporary directory where the file names use the Shutdown_*.xml naming convention.

Notes

  • Before you can use the SSDFormat command, you must copy the specific SSD log files you want formatted from the %windir%\system32\logfiles\shutdown directory where Windows saves them to the C:\Temporary directory. If you run SSDFormat on the default directory that Windows uses, and there are a large number of files, SSDFormat creates one formatted file for every existing file, causing you to use disk space to save a large number of unnecessary files. To avoid this, copy only the specific files you want formatted to a temporary directory, using the command prompt or the Windows Explorer graphical user interface.
  • Before you use the SSDFormat command, you must also copy the XSL style sheet to the C:/Temporary directory using either the command prompt or the Windows Explorer graphical user interface.


SSDFormat Remarks

Creating SSD Log Files

To create an SSD log file:

  1. Click the Start menu, then click Shut Down.
  2. In the What Do You Want the Computer To Do list box, select either Restart or Shut Down.
  3. In the Shut Down Windows dialog box, clear the Planned check box, and select any reason from the Option drop down list.

Understanding SSD Input File Names

You do not need to specify the names of the files you want to format using SSDFormat. This is because you run SSDFormat on a directory and SSDFormat creates a new file for each file in the directory that uses a naming convention of Shutdown_*.xml.

Notes

  • Windows Server 2003 uses a similar naming convention, Shutdown_yyyymmddhhmmss.xml, when it creates the SSD log files. If you rename the Windows SSD log files, you must follow the Shutdown_*.xml naming convention or SSDFormat will not recognize or create a formatted copy of the log files.
  • If you do not want to run SSDFormat on a directory that contains a large number of SSD log files, you can copy the specific files to a temporary directory and then run SSDFormat on the temporary directory. For an example, see Examples.

Working With XSL Style Sheets

SSDFormat provides a default XSL stylesheet named SSS_1.1.xsl. SSDFormat replaces any raw special XML characters in the SSD log file with valid XML characters in the formatted file. The stylesheet organizes the raw XML data into tabular form in the formatted file. If you want to display the XML data differently, you can create your own style sheet and save it to the same directory where SSDFormat saves the formatted files. By default, SSDFormat saves the new formatted files to the ShutdownDirectory.

SSDFormat Output File Names

SSDFormat uses the name of the raw SSD log file to create the name of the formatted file. To create the new formatted SSD file name, SSDFormat appends an "f" to the original SSD log file name. For example, if the SSD log file name is Shutdown_yyyymmddhhmmss.xml, then the new formatted file name is Shutdown_yyyymmddhhmmssf.xml.

Accessing Directories

By default, the %windir%\system32\logfiles\shutdown\ directory where SSD log files are saved requires Administrator permissions. An administrator can add read permissions to the %windir%\system32\logfiles\shutdown\ directory to allow non-administrators to review the system state data files that are created here.


SSDFormat Syntax

SSDFormat uses the following syntax:

One Step SSDFormat [-h] -d ShutdownDirectory -s XSL file directory XSL file name [-o] [OutputDirectory]

Parameters

-h
Displays command-line usage.
-d ShutdownDirectory
Specifies the full path to the directory that contains the SSD log files in the form of Shutdown_*.xml. You can specify the directory where Windows saves SSD log files by default, %windir%\system32\logfiles\shutdown, or you can copy the SSD log files to another directory. SSDFormat applies an XSL stylesheet to all files in ShutdownDirectory.
-s XSLFileDirectory XSLFileName
Specifies the full path to the directory that contains the XSL stylesheet. You have two options when specifying the XSL stylesheet name:
  • If the XSL file is in the same directory where you save formatted files, then you only need to specify the XSL file name.
  • If the XSL file is not in the same directory where you save formatted files, then you must specify both the path to the directory and the XSL file name.

Note

  • SSDFormat checks the SSD log file for a file header that includes a valid XSL file. If the SSD file already contains an XSL file header, then SSDFormat ignores any XSL file you specify at the command line.
-o OutputDirectory
Specifies the complete path to the directory where SSDFormat saves the formatted log files. SSDFormat saves the new formatted file as Shutdown_*f.xml. If you do not specify an OutputDirectory, SSDFormat saves the new formatted file to the ShutdownDirectory.


SubInACL Examples

Scenario Examples

Scenario Example 1

The task in this example is to adjust the files on \\Server\Share after you move User1 from OldDomain to NewDomain. Type the following at the command line:

subinacl /subdirec \\server\share\*.* /replace=OLDDOMAIN\USER1=NEWDOMAIN\User1

Press ENTER.

Note

  • The two domains must have a trust relationship.

Scenario Example 2

The task in this example is to migrate a backup domain controller (BDC) named MigrControl with all its files to NewDomain, and migrate users from OldDomain to NewDomain.

  1. Reinstall MigrControl as a primary domain controller (PDC) of NewDomain, and do not erase the files.
  2. Create the users on NewDomain.
  3. Create a trust relationship with OldDomain.
  4. To migrate the files, type the following at the command line:
    subinacl /noverbose /subdirectories x:\*.* /changedomain=OLDDOMAIN=NEWDOMAIN
  5. Press ENTER.
  6. To verify the changes, type the following at the command line:
    subinacl /noverbose /subdirectories x:\*.*
  7. Press ENTER.

Scenario Example 3

The task in this example is to move a stand-alone server and its users to NewDomain.

  1. Move the server to NewDomain.
  2. Create the users in NewDomain.
  3. Type the following at the command line:
    subinacl /noverbose /subdirectories \\SERVER\SHARE /changedomain=SERVER=NEWDOMAIN
  4. Press ENTER.

Scenario Example 4

The task in this example is to replace "Jim" with "Kim" in each .txt file in the C:\Temp folder, display the security descriptor for each such file, and apply any changes. Type the following at the command line:

subinacl /file c:\temp\*.txt /replace=Jim=Kim/display

Press ENTER.

Option Syntax Examples

/help

  • The task in this example is to display Help about the topic of domain migration. Type the following at the command line:

    • subinacl /help domain_migration

    Press ENTER.

  • The task in this example is to display Help about the /setowner action. Type the following at the command line:

    • subinacl /help /setowner

    Press ENTER.

/outputlog

  • The task in this example is to obtain security information about the file C:\Test.txt and record all output of the command (including errors) in the file C:\Alloutput.txt. Type the following at the command line:

    • subinacl /outputlog=C:\ALLOUTPUT.TXT /file C:\TEST.TXT /display

    Press ENTER.

/errorlog

  • The task in this example is to obtain security information about the file C:\Test.txt, record all errors generated by the command in the file C:\Errorlog.txt, and record all other output in the file C:\Nonerrors.txt. Type the following at the command line:

    • subinacl /outputlog=c:\NONERRORS.TXT /errorlog=C:\ERRORLOG.TXT /file C:\TEST.TXT /display

    Press ENTER.

/alternatesamserver

  • The task in this example is to display the security settings of the file C:\Test.txt and use the server \\Server1 to resolve SIDs if SubInACL is unable to resolve them on the server where the file is located. Type the following at the command line:

    • subinacl /alternatesamserver=\\server1 /file C:\TEST.TXT /display

    Press ENTER.

/offlinesam

  • The task in this example is to migrate the security settings of the files on a server from one domain to another. This example assumes that you have access to the source domain and know you will not have access to it during the migration.
    1. Store a record of user names and their corresponding SIDs from the source domain in a text file named C:\Samfile.txt. Use the following format:
      • _cachefileonly_=s-1-9-cacheonly
      • [Domain\UserName | Server\UserName]=SID
    2. Type the following at the command line:
      subinacl /offlinesam=C:\SAMFILE.TXT /subdirect \\SERVER\SHARE\*.* /migratedomain=SOURCEDOMAIN=DESTDOMAIN
    3. Press ENTER.

/stringreplaceonoutput

  • The task in this example is to move the files from the E: drive of \\Server1 to the E: drive of \\Server2.
    1. To record the security settings of the files on the E: drive of \\Server1 in the file C:\Commandfile.txt, but replace references to \\Server1 with \\Server2, type the following at the command line:
      subinacl /outputlog=c:\commandfile.txt /stringreplaceonoutput=\\server1=\\server2 /subdirectories E:\*.* /noverbose /display
    2. Press ENTER.
    3. Copy all files from the E: drive of \\Server1 to the E: drive of \\Server2.
    4. Copy Commandfile.txt to the C: drive of \\Server2.
    5. To reapply the security settings to the files on the E: drive of \\Server2, type the following at the command line:
      subinacl /playfile c:\commandfile.txt
    6. Press ENTER.

/noexpandenvironmentsymbols

  • The task in this example is to prevent SubInACL from interpreting any strings as environment variables. Type the following at the command line:

    • subinacl /noexpandenvironmentsymbols /object_type object_name /action

    Press ENTER.

/separator

  • The task in this example is to temporarily define the tilde (~) as the separator character so that options such as /stringreplaceonoutput can manipulate strings that contain the default separator character (=). Type the following at the command line:

    • subinacl /separator=~ /stringreplaceonoutput~=europe\~=southerneurope /file *.* /noverbose /display

    Press ENTER.

/noverbose

  • The task in this example is to display a summary of the security settings of the file C:\Test.txt. Type the following at the command line:

    • subinacl /noverbose /file c:\test.txt

    Press ENTER.

  • The task in this example is to save the security settings of all files on the C: drive to the file D:\Filesettings.txt, so that they can be reapplied if necessary by using the /playfile and /display actions. Type the following at the command line:

    • subinacl /noverbose /outputlog=D:\FILESETTINGS.TXT /subdirectories C:\*.* /display

    Press ENTER.

/verbose

  • The task in this example is to display the full details of the security settings of the file C:\Test.txt. Type the following at the command line:

    • subinacl /verbose /file C:\TEST.TXT

    Press ENTER.

/testmode

  • The task in this example is to test a command and verify that you have used the correct syntax, without applying changes. You want to change the name of the domain in all security descriptors of all files in the subdirectories of Share1 on \\Server1 from DomA to DomB; however, you want to test the command first. Type the following at the command line:

    • subInacl /subdirec \\SERVER1\SHARE1\*.* /changedomain=DOMA=DOMB /ifchangecontinue /noverbose /display /testmode

    Press ENTER.

Object Syntax Examples

/file

  • The task in this example is to display the security settings of all .obj files in the current folder. Type the following at the command line:

    • subinacl /file *.obj /display

    Press ENTER.

  • The task in this example is to display the security settings of all .obj files in the C:\Temp folder. Type the following at the command line:

    • subinacl /file C:\TEMP\*.obj /display

    Press ENTER.

  • The task in this example is to display the security settings of all .exe files in the folder that is shared as \\Server1\Share1. Type the following at the command line:

    • subinacl /file \\server1\share1\*.exe /display

    Press ENTER.

  • The task in this example is to display the security settings of the folder that is shared as \\Server1\Share1 (rather than acting on the files within that folder). Type the following at the command line:

    • subinacl /file=directoriesonly \\server1\share1 /display

    Press ENTER.

  • The task in this example is to display the security settings of all files in the folder that is shared as \\Server1\Share1, and not on folders or subfolders. Type the following at the command line:

    • subinacl /file=filesonly \\server1\share1 /display

    Press ENTER.

/subdirectory

  • The task in this example is to display the security settings of all .obj files in the C:\Temp folder and all its subfolders. Type the following at the command line:

    • subinacl /subdirectory C:\TEMP\*.obj /display

    Press ENTER.

  • The task in this example is to display the security settings of all .obj files in the C:\Temp\Test folder and all its subfolders. Type the following at the command line:

    • subinacl /subdirectory C:\TEMP\TEST\*.OBJ /display

    Press ENTER.

  • The task in this example is to display the security settings of folders only, and not files. Type the following at the command line:

    • subinacl /subdirectory=directoriesonly C:\*.* /display

    Press ENTER.

/onlyfile

  • The task in this example is to display the security settings of the named pipe PipeName. Type the following at the command line:

    • subinacl /onlyfile \\.\pipe\PipeName /display

    Press ENTER.

/samobject

  • The task in this example is to display the security settings of the local group Group1 on the Server1 server. Type the following at the command line:

    • subinacl /samobject \\SERVER1\GROUP1 /display

    Press ENTER.

  • The task in this example is to display the security settings of local users defined on the Server1 server. Type the following at the command line:

    • subinacl /samobject \\SERVER1\*users* /display

    Press ENTER.

  • The task in this example is to display the security settings of local groups defined on the Server1 server. Type the following at the command line:

    • subinacl /samobject \\SERVER1\*groups* /display

    Press ENTER.

  • The task in this example is to grant the power user named Poweruser1 full control over the TestGroup local group, which was created by another power user. Type the following at the command line:

    • subinacl /samobject \\SERVER1\TESTGROUP /grant=poweruser1=f

    Press ENTER.

/share

  • The task in this example is to display the security settings of the network file share named \\Server1\Share1. Type the following at the command line:

    • subinacl /share \\SERVER1\SHARE1 /share

    Press ENTER.

/clustershare

  • The task in this example is to specify that SubInACL act on the cluster share named \\Cluster1\Share1. Type the following at the command line:

    • subinacl /clustershare \\CLUSTER1\SHARE1 /display

    Press ENTER.

/keyreg

  • The task in this example is to display the security settings of the registry keys located on the server \\Server1, at the location HKEY_LOCAL_MACHINE\SOFTWARE. Type the following at the command line:

    • subinacl /keyreg \\SERVER1\HKEY_LOCAL_MACHINE\SOFTWARE /display

    Press ENTER.

/subkeyreg

  • The task in this example is to display the security settings of the registry keys and subkeys located on the server \\Server1, at the location HKEY_LOCAL_MACHINE\SOFTWARE. Type the following at the command line:

    • subinacl /subkeyreg \\SERVER1\HKEY_LOCAL_MACHINE\SOFTWARE /display

    Press ENTER.

/service

  • The task in this example is to display the security settings of the Messenger service on the local computer. Type the following at the command line:

    • subinacl /service Messenger /display

    Press ENTER.

  • The task in this example is to display the security settings of the Messenger service on \\Server1. Type the following at the command line:

    • subinacl /service \\SERVER1\MESSENGER /display

    Press ENTER.

/printer

  • The task in this example is to display the security settings of the printer shared as \\Server1\Printer1. Type the following at the command line:

    • subinacl /printer \\SERVER1\PRINTER1 /display

    Press ENTER.

/kernelobject

  • The task in this example is to display the security settings of the mutex named _outlook_mutex_. Type the following at the command line:

    • subinacl /kernelobject _outlook_mutex_ /display

    Press ENTER.

/process

  • The task in this example is to display the security settings of Notepad. Type the following at the command line:

    • subinacl /process notepad.* /display

    Press ENTER.

  • The task in this example is to display the security settings of the process that has process identifier (PID) 1234. Type the following at the command line:

    • subinacl /process 1234 /display

    Press ENTER.

/metabase

  • The task in this example is to grant administrators full control over the properties at \LM\W3SVC on the server \\Server1. Type the following at the command line:

    • subinacl /metabase \\SERVER1\LM\W3SVC /grant=administrators=f

    Press ENTER.

Action Syntax Examples

/display

  • The task in this example is to display the security settings of the files on the C: drive. Type the following at the command line:

    • subinacl /file C:\*.* /display

    Press ENTER.

  • The task in this example is to save the security settings of the files on the C: drive to the file D:\Securitysettings.txt. Type the following at the command line:

    • subinacl /file /outputlog=D:\SECURITYSETTINGS.TXT C:\*.* /display /noverbose

    Press ENTER.

/owner

  • The task in this example is to set Domain1\User1 to be the owner of the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /owner=DOMAIN1\USER1

    Press ENTER.

/replace

  • The task in this example is to replace Domain1\User1 with Domain2\User2 throughout the ACEs of all files on the C: drive. Type the following at the command line:

    • subinacl /file C:\*.* /replace=DOMAIN1\USER1=DOMAIN2\USER2

    Press ENTER.

/changedomain

  • The task in this example is to replace all ACEs that have an SID from Domain1 with the SID of the same user from Domain2, for all files on the C: drive. Type the following at the command line:

    • subinacl /subdirectory C:\*.* /changedomain=domain1=domain2

    Press ENTER.

  • The task in this example is to replace all ACEs that have the SID of User1 from Domain1 with the SID of User2 from Domain2, for all files on the C: drive. Use a mapping file.
    1. Create a mapping file containing only the line "USER1=USER2" and save this file as Mapfile.txt.
    2. Type the following at the command prompt:

      subinacl /subdirectory C:\*.* /changedomain=domain1=domain2=MAPFILE.TXT

    3. Press ENTER.

/migratetodomain

  • The task in this example is to leave intact each ACE on every file on the C: drive that has an SID from Domain1, and create a new ACE with the same user from Domain2. Type the following at the command line:

    • subinacl /subdirectory C:\*.* /changedomain=domain1=domain2

    Press ENTER.

  • The task in this example is to create a new ACE with the SID of Domain2\User2 for each ACE on every file on the C: drive that has an SID from Domain1\User1. Use a mapping file:
    1. Create a mapping file containing only the line USER1=USER2 and save this file as Mapfile.txt.
    2. Type the following at the command line:
      subinacl /subdirectory C:\*.* /changedomain=domain1=domain2=mapfile.txt
    3. Press ENTER.

/findsid

  • The task in this example is to display the names of files on the C: drive that have security descriptors that reference the SID of Domain1\User1. Type the following at the command line:

    • subinacl /subdirectory C:\*.* /findsid=DOMAIN1\USER1

    Press ENTER.

  • The task in this example is to display the names of files on the C: drive that have security descriptors that reference the SID of Domain1\User1, and—if any are found—not to execute any other parameters and not to apply changes. Type the following at the command line:

    • subinacl /subdirectory C:\*.* /findsid=DOMAIN1\USER1=stop

    Press ENTER.

/suppresssid

  • The task in this example is to remove all ACEs that reference Domain1\User1 from the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /suppresssid=DOMAIN1\USER1

    Press ENTER.

/confirm

  • The task in this example is to begin cleaning up deleted SIDs from Domain1, searching only the DACL and SACL parts of the security descriptors of each file, and prompting the user to continue after deleting the first ACE that contains an invalid SID. Type the following at the command line:

    • subinacl /file *.* /cleandeletedsidsfrom=domain1=dacl /cleandeletedsidsfrom=domain1=sacl /ifchangcontinue /confirm

    Press ENTER.

/perm

  • The task in this example is to suppress all existing permission ACEs (PACEs) on the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /perm

    Press ENTER.

/audit

  • The task in this example is to suppress all existing auditing ACEs (AACEs) on the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /audit

    Press ENTER.

/accesscheck

  • The task in this example is to display the access granted to Domain1\User1 on the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /accesscheck=domain1\user1

    Press ENTER.

/setprimarygroup

  • The task in this example is to set the primary group of C:\Test.txt to be Domain1\Group1. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /setprimarygroup=domain1\group1

    Press ENTER.

/grant

  • The task in this example is to grant Domain1\User1 the PACE of Take Ownership on the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /grant=domain1\user1=o

    Press ENTER.

  • The task in this example is to grant Domain1\User1 the PACEs of Execute and Take Ownership on the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /grant=domain1\user1=xo

    Press ENTER.

/deny

  • The task in this example is to deny Domain1\User1 the PACE of Take Ownership on the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /deny=domain1\user1=o

    Press ENTER.

  • The task in this example is to deny Domain1\User1 the PACEs of Execute and Take Ownership on the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /deny=domain1\user1=xo

    Press ENTER.

/revoke

  • The task in this example is to revoke all PACEs for Domain1\User1 on the file C:\Test.txt. Type the following at the command line:

    • subinacl /file C:\TEST.TXT /revoke=domain1\user1

    Press ENTER.

/compactsecuritydescriptor

  • The task in this example is to compact the size of security descriptors created by a disk utility. You used the /display=sdsize action to examine the sizes of these security descriptors, and determined that the utility created large security descriptors that included very little data. You want to compact these security descriptors on disk. Type the following at the command line:

    • subinacl /subdirectories C:\*.* /compactsecuritydescriptor

    Press ENTER.

/pathexclude

  • The task in this example is to prevent a SubInACL command from displaying information about any folder that has a name that begins with "TESTING". Type the following at the command line:

    • subinacl /file C:\*.* /display /pathexclude=TESTING*

    Press ENTER.

/objectexclude

  • The task in this example is to prevent a SubInACL command from displaying information about any file with an .asp extension. Type the following at the command line:

    • subinacl /file *.* /display /objectexclude=*.asp

    Press ENTER.

/playfile

  • The task in this example is to grant everyone Read permission on the file C:\Test1.txt, and both Read and Write permission on the file C:\Test2.txt. You could type the following SubInACL commands at the command line:

    subinacl /file C:\TEST1.TXT /grant=everyone=r /noverbose /display
    subinacl /file C:\TEST2.TXT /grant=everyone=rw /noverbose /display

    To perform the same action with a command file (a playfile), do the following:

    1. Create a text file named Commandfile.txt that contains only these lines:

      +file C:\TEST1.TXT
      /grant=everyone=r
      /noverbose
      /display
      +file C:\TEST2.TXT
      /grant=everyone=rw
      /noverbose
      /display
    2. Type the following at the command line:

      3. subinacl /playfile COMMANDFILE.TXT

      Press ENTER.

  • The task in this example is to save the security settings of all files on the C: drive to the file D:\Subinaclsave.txt by using a format that the /playfile command can replay. Type the following at the command line:

    • subInacl /noverbose /outputlog=D:\SUBINACLSAVE.TXT /subdirectories c:\*.* /display

    Press ENTER.

    To reapply the saved settings, type the following at the command line:

    subInAcl /playfile D:\SUBINACLSAVE.TXT

    Press ENTER.


SubInACL Remarks

Comparing SubInACL to the find Tool in UNIX

The syntax of SubInAcl is analogous to that of the find tool in UNIX. For each object, SubInAcl:

  • Retrieves the security descriptor of the ObjectName object. For more information, see Using SIDs in SubInAcl.
  • Applies one or more actions, which are executed in the order in which they appear on the command line.

If the security descriptor has been modified and the /testmode switch has not been specified, the changes are applied to the object. You can specify as many actions as you need. You must specify at least three characters for each action. The syntax is not case-sensitive.

Editing in SubInACL

SubInAcl allows you to modify each part of a security descriptor:

  • Owner
  • Primary group
  • System access control list (ACL) and access control entries (ACEs) (referred to by SubInACL as audit ACL and AACE, respectively)
  • Discretionary ACL and ACEs (referred to by SubInACL as permission ACL and PACE, respectively)

Using SIDs in SubInAcl

The security descriptor references a user group by using a security identifier (SID). An SID can be expressed in one of the following forms:

  • DomainName\Account (for example, DOM\Administrators)
  • StandaloneServer\Group
  • Account
  • s-1-x-x-x-x-x-x
    Where x is expressed in decimal (for example, S-1-5-21-56248481-1302087933-1644394174-1001).

    Caution

    • No check is done to verify the existence of a given SID.

SubInAcl maintains a local cache of SIDs to minimize "SID-to-human name" translation costs for the network.

Using PACEs in SubInAcl

The following permission ACEs (PACEs) are used with the /grant and /deny parameters.

File PACEs

The following PACEs are valid for file objects:

PACE | Description
F | Full Control
C | Change
R | Read
P | Change Permissions
O | Take Ownership
X | eXecute
E | Read eXecute
W | Write
D | Delete

Cluster Share PACEs

The following PACEs are valid for cluster share objects:

PACE | Description
F | Full Control
R | Read
C | Change

Printer PACEs

The following PACEs are valid for printer objects:

PACE | Description
F | Full Control
M | Manage Documents
P | Print

Registry PACEs

The following PACEs are valid for registry key and registry subkey objects:

PACE | Description
F | Full Control
R | Read
A | ReAd Control
Q | Query Value
S | Set Value
C | Create SubKey
E | Enumerate Subkeys
Y | NotifY
L | Create Link
D | Delete
W | Write DAC
O | Write Owner

Services PACEs

The following PACEs are valid for services:

PACE | Description
F | Full Control
R | Generic Read
W | Generic Write
X | Generic eXecute
L | Read controL
Q | Query Service Configuration
S | Query Service Status
E | Enumerate Dependent Services
C | Service Change Configuration
T | Start Service
O | Stop Service
P | Pause/Continue Service
I | Interrogate Service
U | Service User-Defined Control Commands

Share PACEs

The following PACEs are valid for share objects:

PACE | Description
F | Full Control
R | Read
C | Change

Metabase PACEs

The following PACEs are valid for metabase objects:

PACE | Description
F | Full Control
R | Read - MD_ACR_READ
W | Write - MD_ACR_WRITE
I | Restricted Write - MD_ACR_RESTRICTED_WRITE
U | Unsecure Props Read - MD_ACR_UNSECURE_PROPS_READ
E | Enum Keys - MD_ACR_ENUM_KEYS
D | Write DAC - MD_ACR_WRITE_DAC

Process PACEs

The following PACEs are valid for process objects:

PACE | Description
F | Full Control
R | Read
W | Write
E | Execute

SAM Object PACEs

The following PACEs are valid for Security Accounts Manager (SAM) objects:

PACE | Description
F | Full Control
R | Read
W | Write
E | Execute

Minimizing Bandwidth Usage

  • To minimize network bandwidth used when SubInACL resolves SIDs, place multiple commands that involve the same SIDs in the same command file. When SubInACL resolves a SID, it caches the result to improve its performance and to minimize network traffic. When a SubInACL command finishes, the cache is cleared. Therefore, if you issue four commands and each one requires SubInACL to resolve the same set of SIDs, SubInACL will resolve each of those SIDs four times. However, if you place those four commands in the same command file, SubInACL resolves each SID only once.


SubInACL Syntax

The syntax descriptions below are grouped by how you use SubInACL: getting Help about its features, using it interactively in a console window, or using it within its own scripting environment.

Syntax for Getting Help

One Step subinacl /help [/full | Keyword]

Parameters

/full
Displays all of the information about SubInACL.
Keyword
[ /noverbose | /verbose | /verbose=1 | /verbose=2 | /testmode | /notestmode | /file | /subdirectories | /onlyfile | /share | /clustershare | /keyreg | /subkeyreg | /service | /printer | /kernelobject | /metabase | /display | /setowner | /replace | /changedomain | /migratetodomain | /findsid | /suppresssid | /confirm | /perm | /audit | /ifchangecontinue | /cleandeletedsidsfrom | /accesscheck | /setprimarygroup | /grant | /deny | /revoke ]
Displays information about the specified option, object_type, or action.
/option
Displays information about all SubInACL options.
/action
Displays information about all SubInACL actions.
/object_type
Displays information about all SubInACL object_types.
features
Displays information about the feature set.
usage
Displays a summary of SubInACL syntax.
syntax
Displays an conceptual overview of the SubInACL syntax.
sids
Displays information about how SIDs are expressed, and how SubInACL attempts to translate SIDs.
view_mode
Displays information about using SubInACL to view security information.
test_mode
Displays information about using a testing mode to ensure that a SubInACL command is correct.
object_type
Displays information about the types of object that SubInACL can work with.
domain_migration
Displays information about moving a user from one domain to another.
server_migration
Displays information about moving the file system of a server from one domain to another.
editing_features
Displays information about features of SubInACL that edit security descriptors.

For more information, see /help under Option Syntax Examples on the Examples page.

Syntax for Using SubInACL in a Console Window

One Step subinacl [/Option] /object_type object_name [[/Action[=Parameter]..]

Parameters

/Option can be any of the following:
/outputlog=FileName
Redirects the output of the command to the specified file. The output will include errors unless the /errorlog option is used, in which case errors are sent to the error log file and all other output is sent to the output log file.
/errorlog=FileName
Redirects all errors to the specified file.
/alternatesamserver=ServerName
Specifies the server that SubInACL will use to look up SIDs, if its first attempt fails. This is useful during some server and domain migrations.
/offlinesam=FileName
Specifies a text file that matches user names to their SIDs, and directs SubInACL to look up SIDs in this file instead of on the server on which the object is located. This is useful if the domain is unaccessible or no longer exists.
/stringreplaceonoutput=String1=String2
Causes SubInAcl to replace all occurrences of String1 in its output with String2.
/expandenvironmentsymbols
Allows SubInAcl to use environment variables, such as %username%. This is the default value, and the opposite of /noexpandenvironmentvariables.
/noexpandenvironmentsymbols
Prevents SubInACL from using environment variables. This is useful when SubInACL operates on command files.
/statistic
Displays statistics when processing is finished. This is the default value.
/nostatistic
Suppresses the display of statistics when processing is finished.
/dumpcachedsids=FileName
After you run SubInACL, you can dump the contents of the local cache SIDs to a file. This file can be used for future SubInACL execution (see /offlinesam) to speed up the SIDs resolution process.
/separator=character
Specifies a character for SubInACL to use in place of the equal sign (=) when it interprets a command. This allows you to specify a string that contains an equal sign within a SubInACL command.
/noverbose
Causes SubInAcl to produce shortened output that is easier for people to read. The output of a SubInACL command in /noverbose mode can be saved in a command file and replayed later.
/verbose
Causes SubInAcl to produce detailed output. This is the default level of detail.
/verbose=1
This display mode is identical to /verbose mode.
/verbose=2
This display mode is identical to /verbose mode.
/testmode
Runs SubInAcl in testing mode so that changes will not be applied to the specified object's security descriptor.
/notestmode
Runs SubInAcl in update mode, so that any changes defined by a SubInACL command will be applied. This is the default value.
/object_type can be any of the following:
/file [=directoriesonly | =filesonly]
Specifies that object_name is a file object. When the /file parameter is specified, object_name can identify files by using the Universal Naming Convention (UNC) format or by using a local drive letter and path. object_name can contain the * wildcard character.

Note

  • SubInAcl is not supported on distributed file system (DFS) volumes.

/subdirectories | /subdirec [=directoriesonly | =filesonly]
Specifies that object_name is a folder (directory) and that SubInAcl will use all the files in it and in all its subfolders. When either the /subdirectories or /subdirec parameter is specified, object_name can identify files by using the UNC format or by using a local drive letter and path. object_name can include the * wildcard character.
/onlyfile
Opens a file without using the FindFilexxx mechanism. Valid values for object_name when the /onlyfile parameter is specified are named pipes or mailslots.
/samobject
Specifies that object_name is a Security Accounts Manager (SAM) object, such as a user, local group, or global group.
/share
Specifies that object_name is a network file share.
/clustershare
Specifies that object_name is a cluster file share.
/keyreg
Specifies that object_name is a registry key.
/subkeyreg
Specifies that object_name is a registry subkey.
/service
Specifies that object_name is a service.
/process
Specifies that object_name is a process.
/printer
Specifies that object_name is a printer.
/kernelobject
Specifies that object_name is a kernel object. Valid values for object_name can include mutexes, sections, or event objects.
/metabase
Specifies that object_name is an AdminACL metabase property of the Microsoft Internet Information Services (IIS) metabase.

Notes

  • This object_type can be used only with the following metabase paths:
    • \LM\MSFTPSVC
    • \LM\MSFTPSVC/n
    • \LM\W3SVC
  • This object_type does not support enumeration.
object_name
Specifies the name of the object. For examples, see specific object_type descriptions.
/Action can be any of the following:
/display [=dacl | =sacl | =owner | =primarygroup | =sdsize | =sddl]
Displays the security descriptor for the specified object. This is the default action. The optional parameters allow you to specify which parts of the security descriptor SubInACL should search. When used in conjunction with /noverbose, /display reapplies the security descriptor to the specified object.
/setowner
Changes the owner of the object. Using /owner=SID or /setowner=SID owner = DomainName\Administrators will retrieve the Administrators SID on the server where the object is located.
/owner=Owner
Changes the owner of the specified object. Owner is a valid SID that can be expressed in four different formats. For more information, see Using SIDs in SubInACL on the Remarks page.
/replace=[DomainName\]OldAccount=[DomainName\]NewAccount
Replaces all access control entries (ACEs) (audit ACEs and permissions ACEs) in the specified object.
/accountmigration=DomainName\OldAccount=DomainName\NewAccount
Replaces the owner or primary group if one of them is DomainName\OldAccount. For example: /accountmigration=DOM_MARKETING\ChairMan=NEWDOM\NewChairMan will duplicate all ACEs containing DOM_MARKETING\ChairMan with NewChairMan SID retrieves from NEWDOM domain. For more information, see the /replace action.

Caution

  • If DomainName\NewAccount has an ACE already, ACE replacement is skipped.
/changedomain=OldDomainName=NewDomainName
Replaces all ACEs with an SID from OldDomainName with the equivalent SID found in NewDomainName.
/migratetodomain=SourceDomain=DestinationDomain
Adds ACEs found in SourceDomain for the specified object to DestinationDomain, while preserving the ACEs in SourceDomain.
/findsid=DomainName\Account[=stop | =continue]
Displays the object_name containing a reference to DomainName\Account in the security descriptor. If =stop is specified and the Account is found, the next parameters will be skipped and changes will not be applied. If =stop is specified and the Account is not found, the next parameters will be executed. If =continue is specified and the Account is found, the next parameters will be executed. If =continue is specified and the Account is not found, the next parameters will be skipped and changes will not be applied.
/suppresssid=[DomainName\]Account
Suppresses (deletes) all ACEs containing the [DomainName\]Account. If the object's owner is [DomainName\]Account, the owner is set to Everyone's SID.
/confirm
If placed inside a set of actions, prompts the user before processing the next action.
/perm
Suppresses all existing PACEs.
/audit
Suppresses all existing AACEs.
/ifchangecontinue
Continues to process the next actions only if changes have been made by the previous actions.
/cleandeletedsidsfrom=DomainName [=dacl | =sacl | =owner | =primarygroup | =sdsize]
Deletes all ACEs containing deleted (not valid) SIDs from DomainName. The optional parameters allow you to specify certain parts of the security descriptor in which to search for invalid SIDs.
/testmode
Prevents changes from being applied to the object. This allows you to test the modifications that SubInACL will make.
/accesscheck=[DomainName\]UserName
Displays the access granted to the [DomainName\]UserName. This option requires the SeTcbName privilege (Act As Part of the Operating System), and cannot be used with remote objects.
/setprimarygroup=[DomainName\]Group
Changes the primary group.
/grant=[DomainName\]UserName[=Access]
Adds a PACE for UserName. Valid values for Access depend on the type of object specified in object_name. Valid PACEs are listed in Using PACEs in SubInAcl on the Remarks page. If Access is not specified, Full Control access is granted.
/deny=[DomainName\]UserName[=Access]
Adds a denied PACE for the specified user or group. Valid values for Access depend on the type of object specified in object_name. Valid PACEs are listed in Using PACEs in SubInAcl on the Remarks page. If Access is not specified, all accesses are denied.
/sgrant=[DomainName\]UserName[=Access]
Adds a successful AACE for the specified user. If Access is not specified, Full Control access is granted. Valid permission ACEs are listed in Using PACEs in SubInAcl on the Remarks page.
/sdeny=[DomainName\]UserName[=Access]
Adds a failed AACE for the specified user. If Access is not specified, all accesses are denied. Valid PACEs are listed in Using PACEs in SubInAcl on the Remarks page.
/revoke=[DomainName\]UserName
Denies all PACEs for the specified user or group.
/compactsecuritydescriptor
Compresses security descriptors by removing unused entries.
/pathexclude=Pattern
Excludes all containers matching the description of Pattern, and all the objects within those paths. The * wildcard character can be used within Pattern to represent any number of any characters.
/objectexclude=Pattern
Excludes all objects with names that match Pattern. The * wildcard character can be used within Pattern to represent any number of any characters.
Parameter
The parameter of /Action, if required.

Syntax for Using SubInACL Within Its Own Scripting Environment

One Step subinacl [/Option ..] /playfile FileName

Parameters

/Option
Any of the SubInACL options defined above.
FileName
The name of the SubInACL command file (script file). You can create the file manually, or by issuing a SubInACL command that uses the /noverbose and /display options.

The syntax of the /playfile command file is the same as the syntax of SubInACL when used in a console window, except that:
  • /Option is not used.
  • Each /object_type is preceded by a plus symbol (+) rather than a slash (/).
  • Each /object_type and object_name pair appear together, on the same line.
  • Each action appears on its own line, followed by any applicable parameters.

For more information, see /playfile under Action Syntax Examples on the Examples page.


Tail Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Display the Last 10 Lines of Output from a Sample Text File

The task in this example is to display the last 10 lines of output from a file. Type the following at the command line:

tail C:\WINDOWS\Debug\netsetup.log

Press ENTER. Output similar to the following is displayed:

02/10 05:11:48 NetpCheckNetBiosNameNotInUse for 'COMPUTER_NAME' [MACHINE] returned 0x0
02/10 05:11:48 NetpValidateName: name 'COMPUTER_NAME' is valid for type 1
02/11 05:11:07 -----------------------------------------------------------------
02/11 05:11:07 NetpValidateName: checking to see if 'COMPUTER_NAME' is valid as type 1 name
02/11 05:11:07 NetpCheckNetBiosNameNotInUse for 'COMPUTER_NAME' [MACHINE] returned 0x0
02/11 05:11:07 NetpValidateName: name 'COMPUTER_NAME' is valid for type 1
02/12 05:11:40 -----------------------------------------------------------------
02/12 05:11:40 NetpValidateName: checking to see if 'COMPUTER_NAME' is valid as type 1 name
02/12 05:11:40 NetpCheckNetBiosNameNotInUse for 'COMPUTER_NAME' [MACHINE] returned 0x0
02/12 05:11:40 NetpValidateName: name 'COMPUTER_NAME' is valid for type 1


Tail Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

Tail has the following syntax:

One Step tail [/?] {[/n] [/f] [[Path]FileName]

Parameters

/?
Displays command-line usage.
/n
Allows the user to specify the number of lines from the end of the file to display, where n is a decimal number. If /n is not specified, Tail shows the last 10 lines of the file.
/f
Shows the last 10 lines of the specified file name, then keeps checking for new lines. If a new line exists, it is displayed at the end of the output that is already on the screen. To exit, press CTRL+C.


TCMon Remarks

Overview | Remarks | UI | Related Tools Run Tool

Installing TCMon

TCMon consists of several components and it must be installed before it can run correctly. After installing the Resource Kit Tools for Windows Server 2003,

  1. Navigate to the \Windows Resource Kit Tools folder.
  2. Run the Tcmon.bat file. This file calls Tcmon.inf for installation instructions and registers all the needed components required by TCMon.
  3. After TCMon is installed, double-click Tcmon.exe to run TCMon.

Using TCMon Remotely

You can run TCMon remotely by clicking Computer, and then clicking Select computer. Enter the name of the remote computer in the dialog box and click OK.

Using TCCom at the Command Line

Tccom.exe is the service used by TcMon to communicate with the traffic control server. It can also be called by applications or scripts in VBScript or other scripting languages. Network administrators can use it to remotely configure traffic control on a host. TCCom has one parameter for use at the command line.

Type the following at the command line:

tccom /service

The TCCom service starts after you press ENTER. TCCom only works after TCMon is installed.


TCMon UI

Overview | Remarks | UI | Related Tools Run Tool

TCMon Menus

The following menus are available at the top of the TCMon dialog box:

Computer

The Computer menu contains the following options:

Option | Description
Select Computer | Allows the administrator to run TCMon remotely. Enter the host name or IP address of a remote computer. The remote computer must have TCMon installed locally.
Exit | Closes TCMon.

Refresh

The Refresh menu contains the following options:

Option | Description
Refresh Now | Updates the display with the latest readings.
Auto Refresh | When selected, automatically updates the display.

TCMon Dialog Box

The following options are available on the TCMon dialog box:

Option | Description
Interface | Select from the list of network interfaces available on the local computer.
Flows Tab | Describes flows, service type, token rate, filters, and size in bytes.
Parameters Tab | Displays individual settings for the selected network interface.
Statistics Tab | Enumerates traffic-control statistics.

Flows Tab

The display area in the Flows tab identifies and lists statistics on individual streams of traffic:

Column | Information
Description | Identifies a traffic stream with the process that created it.
Service type | Identifies the priority of the traffic stream.
Token rate | Displays the current token rate for this stream of traffic.
Filters | Displays the number of filters on this stream of traffic.
Bytes sent | Displays the number of bytes that the local computer has sent out for this stream of traffic.

To control which traffic flows are visible in the display area configure the following options:

Option | Description
Diffserv Mode | This option is used to change the filtering mode that a traffic control interface uses. If unchecked, Psched.sys will use 5-tuple style filtering (protocol, source and destination IP address, source and destination port). If it is checked, flows will filter on DSCP rules. This second form of filtering is only useful when marked traffic flows across the server such as a router or dial-up server.
Window Adjust | Controls whether Psched.sys overwrites the tcp window size. Use this on slow links.
Properties | Displays the properties of the selected flow.
Add | Adds a flow to the list.
Delete | Deletes the selected flow.

Parameters Tab

The Parameters tab contains the following information:

Column | Information
Parameter | Lists an individual setting.
Value | Lists the current value of Parameter.
Units | Lists the unit of measurement for Value.

Statistics Tab

The display area in the Statistics tab contains the following information:

Column | Information
Statistic | Enumerates traffic-control statistics.
Value | Lists the current value of Statistic.
Units | Lists the unit of measurement for Value.

To control how the information in the display area is presented configure the following options:

Option | Description
Enable Average Statistics | This setting is always checked. Enable averaged statistic value in addition to the last reading. You cannot change this setting on versions of Windows earlier than Windows Server 2003.
Reset | Resets individual statistics to zero.


TimeZone Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example: Change the Start and End Dates for Daylight Saving Time

The task in this example is to change the start and end dates for daylight saving time. Type the following at the command line:

timezone /s 02:0:5:04 02:2:1:10

Press ENTER. The following output is displayed:

Daylight saving time begins at 2:00 on the last Sunday in April (02:0:5:04).

Daylight saving time ends at 2:00 on the fourth Tuesday in October (02:2:4:10).


TimeZone Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

TimeZone uses the following syntax:

One Step timezone [/g] [/s StartDate EndDate]

Parameters

/g
Displays the current start and end dates for daylight saving time. The computer automatically adjusts the computer's current time display on these dates.
/s StartDate EndDate
Specifies a StartDate, the date that daylight saving time begins, and an EndDate, the date that daylight saving time ends. The computer automatically adjusts the computer's time display on these dates.

StartDate and EndDate use the format:
Hour:DayOfWeek:Day:Month

Hour specifies a number representing the hour of the day using a 24-hour clock. Valid values are 00 to 23.

DayOfWeek specifies a number representing the day of the week: Sunday = 0, Monday = 1, and so on. Valid values are 0 to 6.

Day specifies a number representing the occurrence of DayOfWeek during the month: 1 = first occurrence of day, 2 = second occurrence of day, and so on. Valid values are 1 to 5. For example, if DayOfWeek is 0 and Day is 1, TimeZone interprets this to mean the first Sunday of the specified month.

Month specifies a number representing the month: January = 1, February = 2, and so on. Valid values are 01 to 12.


TscTst Examples

Example 1: Use TscTst to Display Licensing Information

The task in this example is to display basic licensing information. Type the following at the command line:

tsctst

Press ENTER. Output similar to the following is displayed:

*** License # 1 ***
Issuer - RKT-RC1
Scope - WORKGROUP
Issued to machine - A-SEANL
Issued to user - a-seanl
        License ID - A02-5.02-S
Temporary       Beta
Valid from - 1c2dc39 ac320100 Mon Feb 24 11:19:38 2003
Expires on - 1c322f2 955f8100 Sun May 25 11:19:38 2003

Example 2: Use TscTst to Display Detailed Licensing Information

The task in this example is to display detailed licensing information. Type the following at the command line:

tsctst /a

Press ENTER. Output similar to the following is displayed:

*** License # 1 ***
TS Certificate Version - 0x00050001
Licensed Product
        HWID - 0x00000002, 0xd1f48051, 0xce4bf337, 0x99c5f2f5, 0x8650cee4
        Client Platform ID - 0x000000ff
        Company Name - Microsoft Corporation
Issuer - RKT-RC1
Scope - WORKGROUP
Issued to machine - A-SEANL
Issued to user - a-seanl
        TS Locale ID - 0x00000409
        License ID - A02-5.02-S
Licensed Product Version 0005.0002, Flag 0x80548000
Temporary       Beta
Valid from - 1c2dc39 ac320100 Mon Feb 24 11:19:38 2003
Expires on - 1c322f2 955f8100 Sun May 25 11:19:38 2003


TscTst Remarks

Understanding the License Fields Displayed by TscTst

  • TS Certificate Version. The version of the certificate issued by the license server. All certificates from a Windows 2000 or Windows Server 2003 license server will be shown as 0x00050001.
  • Issuer. Name of the license server that issued the license.
  • Scope. Name of the workgroup/domain/enterprise.
  • Issued to machine. Name of the client machine that received the license.
  • Issued to user. User name on the client machine that received the license.
  • HWID. Displays the client hardware identification (HWID) stored in the field ClientHWID of the registry subkey HKLM\Software\Microsoft\MSLicensing\HardwareID
  • TS Locale_ID. Displays the Terminal Server's license server number.
  • Client Platform ID. The client platform ID number is four bytes long. The most significant byte is used for identifying the operating system platform which the client is running. The second most significant byte is used for identifying the independent software vendor (ISV) that has provided the client image. The last two bytes are used by the ISV to specify the build of the client operating system.
  • Company Name. Name of the organization.
  • License ID Full form of the license version.
  • Temporary/Permanent. Displays whether the client license version is temporary or permanent.
  • Flag. Contains information about the license type.
  • Beta/RTM. Displays whether the client has a Beta license or an RTM license.
  • Valid from. Displays the date from which this license is valid.
  • Expires on. Displays the date after which this license is no longer valid.


TscTst Syntax

TscTst uses the following syntax:

One Step tsctst [/a] [/?]

Parameters

/a
Displays advanced license information in addition to default basics.
/?
Displays command-line usage.


UDDICatSchemeEditor Remarks

Overview | Remarks | UI | Related Tools Run Tool

Creating a New Categorization Scheme

To create a new categorization scheme:

  1. Open UDDICatSchemeEditor.
  2. On the File menu, click New. A new document with a categorization scheme named New Categorization Scheme appears in the Categorization Scheme pane.
  3. Select the New Categorization Scheme categorization scheme, and then use the Property pane to define its properties. See Using Categorization Scheme (tModel) Properties for definitions of each property.

You can now add categories and subcategories to the new categorization scheme, or add additional categorization schemes to the current document.

Saving a Categorization Scheme Document

To save a categorization scheme document:

  • On the UDDICatSchemeEditor File menu, click Save. If this is a new document, you are prompted to specify a name and location.

Your changes are saved to the document.

Opening an Existing Categorization Scheme Document

To open an existing categorization scheme document:

  1. Open UDDICatSchemeEditor.
  2. On the File menu, click Open.
  3. Select the XML document that contains the UDDI Services categorization schemes you want to open, and then click Open.

Load progress is displayed in the status bar. After loading is complete, the categorization schemes defined in the document are displayed in the Categorization Scheme pane.

Creating a New Categorization Scheme in an Existing Document

To create a new categorization scheme in an existing document:

  1. Open UDDICatSchemeEditor.
  2. On the File menu, click Open.
  3. Select the XML document to which you want to add a categorization scheme, and then click Open. Load progress is displayed in the status bar. After loading is complete, the categorization schemes defined in the document are displayed in the Categorization Scheme pane.
  4. After loading is complete, click the File menu and click Add New Scheme. A new categorization scheme appears named New Categorization Scheme.
  5. Select the New Categorization Scheme categorization scheme, and use the Property pane to define its properties. See Using Categorization Scheme (tModel) Properties for definitions of each property.

You can now add categories and subcategories to the new categorization scheme, or add additional categorization schemes to the current document.

Adding a Category to a Categorization Scheme

You can add a category to a categorization scheme by using either the Edit menu or the shortcut menu.

To add a category to a categorization scheme by using the Edit menu:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, select the categorization scheme to which you want to add a category.
  2. On the Edit menu, click Add Category. A new category appears named New Category Name.
  3. Select the New Category Name category, and then use the Property pane to define its properties. See Using Category (categoryValue) Properties for definitions of category properties.
  4. Repeat steps 1 through 3 to add additional categories.

To add a category to a categorization scheme by using the shortcut menu:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, right-click the categorization scheme to which you want to add a category.
  2. Click Add Category on the shortcut menu. A new category appears named New Category Name.
  3. Select the New Category Name category, and then use the Property pane to define its properties. See Using Category (categoryValue) Properties for definitions of category properties.
  4. Repeat steps 1 through 3 to add additional categories.

Editing a Category

To edit a category:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, select the category that you want to edit.
  2. Use the Property pane to define its properties. See Using Category (categoryValue) Properties for definitions of category properties.

Adding a Subcategory to a Category

You can add a subcategory to a category by using either the Edit menu or the shortcut menu.

To add a subcategory to a category by using the Edit menu:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, select the category to which you want to add a subcategory.
  2. Select the New Category Name subcategory, and then use the Property pane to define its properties. See Using Category (categoryValue) Properties for definitions of category properties.
  3. Repeat steps 1 and 2 to add additional subcategories.

To add a subcategory to a category by using the shortcut menu:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, right-click the category to which you want to add a subcategory.
  2. Click Add Category on the shortcut menu. A new category appears named New Category Name.
  3. Select the New Category Name subcategory, and then use the Property pane to define its properties. See Using Category (categoryValue) Properties for definitions of category properties.
  4. Repeat steps 1 through 3 to add additional subcategories.

Editing a Subcategory

To edit a subcategory:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, select the subcategory that you want to edit.
  2. Use the Property pane to define its properties. See Using Category (categoryValue) Properties for definitions of category properties.

Moving a Category or Subcategory

You can move categories and subcategories by using the drag-and-drop method.

To move a category or subcategory by using the drag-and-drop method:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, select the category or subcategory that you want to move.
  2. While holding down the mouse button, drag the category or subcategory to its new location.
  3. When you are ready to drop the category in its new location, release the mouse button.

Copying a Category or Subcategory

You can copy categories and subcategories by using either the Edit menu or the shortcut menu.

To copy a category or subcategory by using the Edit menu:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, select the category or subcategory that you want to move.
  2. On the Edit menu, click Copy.
  3. Select the category where you want to paste the category or subcategory.
  4. On the Edit menu, click Paste.

To copy a category or subcategory by using the shortcut menu:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, right-click the category or subcategory that you want to move.
  2. Click Copy on the shortcut menu.
  3. Right-click the category where you want to paste the category or subcategory.
  4. Click Paste on the shortcut menu.

Repeat these steps to copy additional categories or subcategories. To copy entire branches of categories, move the parent category.

Deleting a Category or Subcategory

You can delete categories or subcategories by using either the Edit menu or the shortcut menu.

To delete a category or subcategory by using the Edit menu:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, select the category or subcategory that you want to delete.
  2. On the Edit menu, click Delete.

To delete a category or subcategory by using the shortcut menu:

  1. In the UDDICatSchemeEditor Categorization Scheme pane, right-click the category or subcategory that you want to delete.
  2. Click Delete on the shortcut menu.

Repeat these steps to delete additional categories or subcategories. To delete entire branches of categories, delete the parent category.

Understanding UDDI Categorization Schemes

A UDDI Services categorization scheme is an XML document that contains two primary elements: a tModel that represents the categorization scheme, and one or more associated categoryValues that represent the categories and subcategories of the scheme. When you create a new categorization scheme by using UDDICatSchemeEditor, a new tModel is automatically created and assigned a unique tModelKey. When you add or copy a category by using UDDICatSchemeEditor, a new categoryValue is automatically created and assigned a unique keyValue. When adding, moving or copying a subcategory, the parentKeyValue is automatically assigned the keyValue of the parent category.

Note

  • If you are replacing an existing categorization scheme in a UDDI Services site, change the value of the new categorization scheme's referenceExistingTmodel property to true, and change the value of the tModelKey property to match the tModelKey of the tModel of the existing categorization scheme.

Important

  • When you import a categorization scheme by using an existing tModel, the original categorization scheme associated with that tModel is overwritten.
  • If you open a categorization scheme document that contains a category with a parentKeyValue that does not match any of the keyValues in that scheme, UDDICatSchemeEditor will be unable to determine its parent category. If this occurs, you are presented with a parentKeyValue Mismatch dialog box that allows you to either make the category a top-level category, or permanently remove it and all of its subcategories from the scheme.

Using Categorization Scheme (tModel) Properties

Property | Description
isBrowsable | Indicates whether the categorization scheme is available for browsing from the Browse by Category tab in Search. This setting can be modified from the UDDIServices Coordinator section of the Web UI. True if browsable. False if hidden.
isChecked | Indicates whether UDDI Services checks and validates the keyValue attribute of each category. This setting can be modified from the UDDI Services Coordinator section of the Web UI. True if this is a checked categorization scheme. False if this is not a checked categorization scheme.
tModelDescription | Gives a description of the categorization scheme. String, 255 characters maximum.
tModelDetail | Specifies the categorization and identification schemes associated with the tModel of the categorization scheme. [Multi-value]
tModelKey | Specifies the universally unique identifier (UUID) of the tModel to which the categorization scheme belongs. UUID: followed by a string consisting of 8 hexadecimal digits followed by a hyphen, then three groups of 4 hexadecimal digits each followed by a hyphen, then 12 hexadecimal digits.
tModelName | Gives the name of the categorization scheme as it appears to end users. String, 255 characters maximum.
referenceExistingTmodel | Indicates whether the categorization scheme defines its own unique tModel, or if it is associated with an existing tModel. True if the categorization scheme is associated with an existing tModel—the tModelKey must be the UUID of the tModel to which the categorization scheme is to be associated. False if the categorization scheme defines its own tModel—the tModelKey for the categorization scheme must be unique.

Using Category (categoryValue) Properties

Property | Description
isValid | Indicates whether the category can be used to categorize entities. To ensure that publishers use the most granular level of categorization available, mark any category with subcategories as false. True if the category can be used to categorize entities. False if the category cannot be used to categorize entities.
keyName | The name of the category as it appears to end users. String, 255 characters maximum.
keyValue | Specifies the unique alphanumeric value assigned to the category. When creating new categories, UDDICatSchemeEditor automatically generates this value for you. String, 255 characters maximum.
parentKeyValue | Specifies the KeyValue of the parent category. (Blank for top-level categories.) UDDICatSchemeEditor automatically assigns this value for you. Changing this value changes the parent category to which the category belongs. String, 255 characters maximum.

For more information about the UDDI data model and UDDI services categorization schemes, see the Enterprise UDDI Services Web page (http://go.microsoft.com/fwlink/?LinkID=12423).


UDDICatSchemeEditor UI

Overview | Remarks | UI | Related Tools Run Tool

The UDDICatSchemeEditor user interface (UI) consists of two panes and a description area. The pane on the left, called the Categorization Scheme pane, displays a tree view of the categorization schemes contained within the current document. The pane on the right, called the Property pane, displays the properties assigned to any item selected in the Categorization Scheme pane. The area below the Property pane, called the Description area, displays contextual information about any property selected in the Property pane.

The UDDICatSchemeEditor user interface

UDDICatSchemeEditor Menus

File Menu

The File menu contains the following commands.

Command | Description
New | Closes the current document and creates a new, empty one. You are prompted to save any unsaved changes.
Add New Scheme | Adds a new top-level categorization scheme to the current document.
Open | Opens an existing document.
Close | Closes the current document. You are prompted to save any unsaved changes.
Save | Saves the current document.
Save as | Saves the current document with a new name.
Recent Files | Lists recently opened documents.
Exit | Closes UDDICatSchemeEditor. You are prompted to save any unsaved changes.

Edit Menu

The Edit menu contains the following commands.

Command | Description
Undo | Undoes the previous action.
Redo | Does the last undone action again.
Cut | Removes the selected item and copies it to the Clipboard. To put the item in a location, use the Paste command.
Copy | Copies the selected item to the Clipboard. To put the item in a location, use the Paste command.
Paste | Inserts the contents of the Clipboard into the current selection.
Add New Category | Adds a new category to the current selection.
Delete | Deletes the selected item.
Rename | Renames the selected item.
Find | Finds the specified text in the current document.
Find Next | Finds the next occurrence of the specified text in the current document.
Replace | Replaces specific text in the current document.

Tools Menu

The Tools menu contains the following commands.

Command | Description
Preview XML | Displays the XML version of the current document in your Web browser.
Font | Changes the font used in the Categorization Scheme pane.

Help Menu

The Help menu contains the following commands.

Option | Description
Help Topics | Opens UDDICatSchemeEditor Help.
About Categorization Scheme Editor | Displays information about this version of UDDICatSchemeEditor.

parentKeyValue Mismatch Dialog

The parentKeyValue Mismatch window appears when you open a categorization scheme document that contains a category with a parentKeyValue that does not match any of the keyValues in that scheme. If this occurs, you are presented with a parentKeyValue Mismatch dialog box. This allows you to either make the category a top-level category, or permanently remove it and all of its subcategories from the scheme.

The parentKeyValue Mismatch window


UddiConfig Examples

Example 1: Capture Settings from Local Components Using the Credentials of the Current User

To capture configuration settings from components operating on the local computer using the current user's credentials, and save them to the file C:\Config.xml, type the following at the command line:

uddiconfig /o C:\config.xml

Press ENTER. This saves the configuration settings to C:\config.xml.

Example 2: Capture Settings from Remote Components Using Administrator Credentials

To capture configuration settings from components operating on a remote computer named UDDISVCS using Administrator credentials, and save them to a file C:\config.xml, type the following at the command line:

uddiconfig /s UDDISVCS /u Administrator /p lsA93j%g /o c:\config.xml

Press ENTER. This saves the configuration settings on UDDISVCS to C:\config.xml.

Example 3: Apply Settings to Local Components Using Credentials of the Current User

To apply configuration settings from file C:\Config.xml to components operating on the local computer using the current user's credentials, type the following at the command line:

uddiconfig /f c:\config.xml

Press ENTER. The configuration settings contained in C:\config.xml are applied to the local components.


UddiConfig Remarks

Understanding Web Server Configuration Settings

Uddiconfig.exe recognizes the following Web server configuration settings:

Web Server Configuration Settings
Configuration Setting | Description
logging\eventLog | Specifies the level of information published to the event log by the UDDI Services Web server component. type: logEnumeration Values: None, Error, Warning, FailAudit, PassAudit, Info, Verbose
logging\logFile | Specifies the level of information published to the log file by the UDDI Services Web server component. type: logEnumeration Values: None, Error, Warning, FailAudit, PassAudit, Info, Verbose
databaseConnection\readComputer | The name of the computer that hosts UDDI Services Database components used for read operations by the UDDI Services Web server. type: string Value: 255 characters maximum.
databaseConnection\writeComputer | The name of the computer that hosts UDDI Services Database components used for write operations by the UDDI Services Web server. type: string Value: 255 characters maximum.

Understanding Site Configuration Settings

Uddiconfig.exe recognizes the following site configuration settings:

Site Configuration Settings
Configuration Setting | Description
roles\administratorsGroup | The name of the group that defines the users with Administrator privileges on the site. type: string Value: <groupname>, BUILTIN\<groupname>, or <domain>\<groupname>
roles\coordinatorsGroup | The name of the group that defines the users with Coordinator privileges on the site. type: string Value: <groupname>, BUILTIN\<groupname>, or <domain>\<groupname>
roles\publishersGroup | The name of the group that defines the users with Publisher privileges on the site. type: string Value: <groupname>, BUILTIN\<groupname>, or <domain>\<groupname>
roles\usersGroup | The name of the group that defines the users with User privileges on the site. type: string Value: <groupname>, BUILTIN\<groupname>, or <domain>\<groupname>
security\accessControl | The type of authentication required to access the site. type: authenticationEnumeration Value: WindowsIntegratedUddiServices, UddiServices, WindowsIntegrated, WindowsIntegratedAuthenticatedReads
security\requireSSL | Determines if SSL-encryption is required to interact with the site. type: boolean Value: true or false
security\cryptography\tokenExpirationMinutes | Specifies the amount of time, in minutes, that the SOAP authentication token expires for UDDI Publisher authenticated publications. type: integer Value: 1 to 1000
security\cryptography\automaticKeyReset | Determines if the cryptography key used to generate SOAP authentication tokens is automatically regenerated after a set interval. type: boolean Value: true or false
security\cryptography\automaticKeyResetDays | Specifies the amount of time, in days, that the cryptography key used to generate SOAP authentication tokens is reset. type: string. Value: 1 to 1000
advanced\Operator | The value used to populate the Operator attribute in SOAP API responses that include an operator attribute. type: string Value:
advanced\Find.MaxRowsDefault | The maximum number of rows returned on SOAP API find requests. type: integer Value: 1 to 1000
advanced\DefaultDiscoveryURL | The prefix used for the default discoveryURL attached to providers published in this site. type: string Value: http://<servername>

Examining a Uddiconfig.xml Sample

The following is a sample configuration file for Uddiconfig.exe:

<uddiServicesConfiguration xmlns="urn:uddi-microsoft-com:uddi_services_configuration">
  <webServer>
    <logging>
      <eventLog>None</eventLog>
      <logFile>Error</logFile>
    </logging>
    <databaseConnection>
      <readComputer>UDDIDATABASE</readComputer>
      <writeComputer>UDDIDATABASE</writeComputer>
    </databaseConnection>
  </webServer>
  <site>
    <roles>
      <administratorsGroup>BUILTIN\Administrators</administratorsGroup>
      <coordinatorsGroup>BUILTIN\Administrators</coordinatorsGroup>
      <publishersGroup>BUILTIN\Administrators</publishersGroup>
      <usersGroup>BUILTIN\Users</usersGroup>
    </roles>
    <security>
      <accessControl>WindowsIntegrated</accessControl>
      <requireSSL>true</requireSSL>
      <cryptography>
        <tokenExpirationMinutes>60</tokenExpirationMinutes>
        <automaticKeyReset>true</automaticKeyReset>
        <automaticKeyResetDays>7</automaticKeyResetDays>
      </cryptography>
    </security>
    <advanced>
      <propertyName propertyValue="1000">Find.MaxRowsDefault</propertyName>
    </advanced>
  </site>
</uddiServicesConfiguration>

This sample configuration file contains the following configuration settings:

Configuration Setting | Value
logging\eventLog | None
logging\logFile | Error
databaseConnection\readComputer | UDDIDATABASE
databaseConnection\writeComputer | UDDIDATABASE
roles\administratorsGroup | BUILTIN\Administrators
roles\coordinatorsGroup | BUILTIN\Administrators
roles\publishersGroup | BUILTIN\Administrators
roles\usersGroup | BUILTIN\Users
security\accessControl | WindowsIntegrated
security\requireSSL | True
security\cryptography\tokenExpirationMinutes | 60
security\cryptography\automaticKeyReset | True
security\cryptography\automaticKeyResetDays | 7
advanced\Find.MaxRowsDefault | 1000

Using the UddiConfig Schema (XSD) to Produce Uddiconfig.exe-compatible Configuration Files

Use the following .xsd file to produce Uddiconfig.exe-compatible configuration files.

<xs:schema
  xmlns="urn:uddi-microsoft-com:uddi_services_configuration"
  xmlns:xs="http://www.w3.org/2001/XMLSchema"
  targetNamespace="urn:uddi-microsoft-com:uddi_services_configuration"
  elementFormDefault="qualified" attributeFormDefault="unqualified">
  <xs:element name="uddiServicesConfiguration">
    <xs:complexType>
      <xs:sequence>
        <xs:element name="webServer" minOccurs="0" maxOccurs="1">
          <xs:complexType>
            <xs:sequence>
              <xs:element name="logging" minOccurs="0" maxOccurs="1">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element name="logFile" type="logEnumeration" minOccurs="0"
                       maxOccurs="1"/>
                    <xs:element name="eventLog" type="logEnumeration" minOccurs="0"
                       maxOccurs="1"/>
                  </xs:sequence>
                </xs:complexType>
              </xs:element>
              <xs:element name="databaseConnection" minOccurs="0" maxOccurs="1">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element name="readComputer" minOccurs="0" maxOccurs="1"/>
                    <xs:element name="writeComputer" minOccurs="0" maxOccurs="1"/>
                  </xs:sequence>
                </xs:complexType>
              </xs:element>
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element name="site" minOccurs="0" maxOccurs="1">
          <xs:complexType>
            <xs:sequence>
              <xs:element name="roles" minOccurs="0" maxOccurs="1">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element name="administratorsGroup" type="xs:string" minOccurs="0"
                       maxOccurs="1"/>
                    <xs:element name="coordinatorsGroup" type="xs:string" minOccurs="0"
                       maxOccurs="1"/>
                    <xs:element name="publishersGroup" type="xs:string" minOccurs="0"
                       maxOccurs="1"/>
                    <xs:element name="usersGroup" type="xs:string" minOccurs="0"
                       maxOccurs="1"/>
                  </xs:sequence>
                </xs:complexType>
              </xs:element>
              <xs:element name="security" minOccurs="0" maxOccurs="1">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element name="accessControl" type="authenticationEnumeration"
                       minOccurs="0" maxOccurs="1"/>
                    <xs:element name="requireSSL" type="xs:boolean" minOccurs="0"
                       maxOccurs="1"/>
                    <xs:element name="cryptography" minOccurs="0"
                       maxOccurs="1">
                      <xs:complexType>
                        <xs:sequence>
                          <xs:element name="tokenExpirationMinutes" minOccurs="0"
                             maxOccurs="1">
                            <xs:simpleType>
                              <xs:restriction base="xs:integer">
                                <xs:minInclusive value="1"/>
                                <xs:maxInclusive value="1000"/>
                              </xs:restriction>
                            </xs:simpleType>
                          </xs:element>
                          <xs:element name="automaticKeyReset" type="xs:boolean"
                             minOccurs="0" maxOccurs="1"/>
                          <xs:element name="automaticKeyResetDays" minOccurs="0"
                             maxOccurs="1">
                            <xs:simpleType>
                              <xs:restriction base="xs:integer">
                                <xs:minInclusive value="1"/>
                                <xs:maxInclusive value="365"/>
                              </xs:restriction>
                            </xs:simpleType>
                          </xs:element>
                        </xs:sequence>
                      </xs:complexType>
                    </xs:element>
                  </xs:sequence>
                </xs:complexType>
              </xs:element>
              <xs:element name="advanced" minOccurs="0">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element name="propertyName" maxOccurs="unbounded">
                      <xs:complexType>
                        <xs:simpleContent>
                          <xs:extension base="xs:string">
                            <xs:attribute name="propertyValue" type="xs:string" use="required"/>
                          </xs:extension>
                        </xs:simpleContent>
                      </xs:complexType>
                    </xs:element>
                  </xs:sequence>
                </xs:complexType>
              </xs:element>
            </xs:sequence>
          </xs:complexType>
        </xs:element>
      </xs:sequence>
    </xs:complexType>
  </xs:element>
    <xs:simpleType name="logEnumeration">
      <xs:restriction base="xs:string">
        <xs:enumeration value="None"/>
        <xs:enumeration value="Error"/>
        <xs:enumeration value="Warning"/>
        <xs:enumeration value="FailAudit"/>
        <xs:enumeration value="PassAudit"/>
        <xs:enumeration value="Info"/>
        <xs:enumeration value="Verbose"/>
      </xs:restriction>
    </xs:simpleType>
    <xs:simpleType name="authenticationEnumeration">
      <xs:restriction base="xs:string">
        <xs:enumeration value="WindowsIntegratedUddiServices"/>
        <xs:enumeration value="UddiServices"/>
        <xs:enumeration value="WindowsIntegrated"/>
        <xs:enumeration value="WindowsIntegratedAuthenticatedReads"/>
      </xs:restriction>
    </xs:simpleType>
  </xs:schema>


UddiConfig Syntax

UddiConfig uses the following syntax:

One Step uddiconfig [/s ComputerName] [/u UserName /p Password] {/o [Drive:][Path]FileName | /f[Drive:][Path]FileName | /? | /h | /help}

Parameters

/s ComputerName
Specifies the NETBIOS name of the remote computer that hosts the UDDI Services components from which you want to capture configuration settings or to which you want to apply configuration settings.
/u UserName
Specifies the user name to use on ComputerName. UserName should be in the form user@domain or domain\user.
/p Password
Specifies the Password for UserName.
/o [Drive:][Path]FileName
Captures configuration settings from the components operating on the target computer and saves them to the file specified by FileName.
/f[Drive:][Path]FileName
Applies configuration settings from the file specified by FileName to the components operating on the target computer.
/? | /h | /help
Displays command-line usage.


UddiDataExport Remarks

Overview | Remarks | UI | Related Tools Run Tool

Using the UddiDataExport XML Document

The XML document created with this tool can be used for a variety of purposes. For example, you can use it as a backup of specific entities, or you can use it to migrate data from one site to another by importing the XML document into the new site. For more information about importing data into a UDDI Services site, see the UDDI Services Web UI help or the UDDI Services MMC Snap-in help.

Important

  • If you plan to import data into a different UDDI site, select Include dependencies and Remove default discovery URL. This ensures that the data you export contains all necessary information and excludes any references to the old site. Failing to do this may prevent you from successfully importing the data due to references to entities that do not exist in the new site.
  • Exported data does not include entity ownership information or publisher assertion relationships.
  • When you import data into a site, any duplicate information is overwritten by the new data.

Note

  • You must have local administrator credentials on the site to which you want to import data.

Exporting tModels with Names That Begin with a Specified String, Excluding Dependencies

You can export tModels with names that begin with a specified string.

For example, to export the tModels that being with "Account," follow these steps:

  1. Open the UDDI Data Export Wizard, and then click Next.
  2. Specify the source site, authentication type, and destination file, and then click Next.
  3. Select tModels.
  4. Clear the Include dependencies check box.
  5. In the Name field, type: Account, and then click Next.
  6. Select the tModels you want to export, and then click Export.
  7. Click Finish. The providers you selected are now exported to the specified file.

Migrating Providers from a UDDI Site to a New UDDI Services Site

To migrate a provider from a UDDI site to a new UDDI services site:

  1. Open the UDDI Data Export Wizard, and then click Next.
  2. Specify the source site, authentication type, and destination file, and then click Next.
  3. Select Providers.
  4. In the Name field, type all or part of the name of the entities you want to migrate to the new site.
  5. Select Include dependencies and Remove default discovery URL, and then click Next.
  6. Select the entities you want to migrate, and then click Export.
  7. Click Finish.
  8. Using your Web browser, navigate to the UDDI Services Web site to which you want to migrate the data.
    For example: http://<servername>/uddi.
  9. Click Coordinate.
  10. Click Data Import.
  11. Click Browse and select the XML file that contains the entities you want to migrate to this site, and then click Open.
  12. Click Import. The entities contained in the XML file are now migrated to the new UDDI Services site, published by the current logged-on user.

    13. Important

    • When you import data into a site, any duplicate information is overwritten by the new data.

    Note

    • To import data into a site you must be a UDDI Services administrator.


UddiDataExport UI

Overview | Remarks | UI | Related Tools Run Tool

The UDDI Data Export wizard consists of the following steps:

Step 1: Welcome/Introduction

A brief introduction to the wizard.

Step 2: Source Site and Destination File

Set source site and destination file information.

  • Inquiry URL: This is the URL of the UDDI site from which you want to export. The site you specify must support UDDI inquiry messages.

    For example, to export from the Microsoft UDDI Business Registry (UBR) Web site, type the following in the Inquiry URL textbox: http://uddi.microsoft.com/inquire.

  • Authentication type: Select the kind of authentication for the wizard to use to interact with the site.

    Windows Integrated authentication: Select this if you want the wizard to use Windows Integrated authentication to interact with the site.

    Anonymous authentication: Select this if you want the wizard to use Anonymous authentication to interact with the site.

  • File Name: Specify the path and name of the file where the data will be stored. For example, to store the data in C:\Uddidata.xml, type the following in the File Name textbox: c:\uddidata.xml.

    Append to File: Select this if you want to append data to an existing file. Clear it if you do not want to append data to an existing file. If this option is not selected, existing data in the file is overwritten.

  • Click Next when you are ready to proceed to the next step of the wizard.

Step 3: Filter Criteria

Select the type of entity you want to export and type all or part of the name by which you want to filter. This criteria is used to filter the list of providers or tModels you can select from in Step 4.

  • Providers: Select this if you want to export providers.
  • tModels: Select this if you want to export tModels.
  • Name: One or more characters in the name of the entities you want to export. Use % as a wild card. This search is not case-sensitive. This field is optional.

    For example, to search for names that begin with "account," type: account. To search for names that contain "account," type: %account%.

  • Include dependencies: Select this check box to include the tModels that are referenced by the entities that match the filter criteria. Clear it if you do not want to include dependent tModels. For example, if an entity references a categorization tModel, select this check box to include that categorization tModel in the results. This field is optional.
  • Remove default discovery URL: Select this check box to remove the default discovery URL associated with the providers you export. Clear if you do not want to remove the default discovery URL from exported entities. This field is optional.

Important

  • If you plan to import this data into a different UDDI site, select Include dependencies and Remove default discovery URL. This ensures that the data you export is complete and does not contain references to information or entities that might not exist in the new site.
  • When you import data into a site, any duplicate information is overwritten by the new data.

Click Next when you are ready to proceed to the next step of the wizard.

Step 4: Select Data to Export

Select the check box next to the entities you want to export from the list. Clear the check box next to the entities you do not want to export. The list contains only those entities on the UDDI site that match the filter criteria. Click Export when you are ready to export the selected entities.

  • To select all entities, click Select All
  • To deselect all entities, click Deselect All

Note

  • If the results do not include all of the entities that you want to export, you may need to refine your filter criteria or perform multiple exports.

Step 5: Export Complete

A summary of the exported entities is displayed. Click Finish to close the wizard.


VaDump Examples

Example 1: Dump the Address Space

To dump the address space, type the following at the command line:

vadump [-sv] -p decimal_process_id

Note

  • Substitute an actual process ID for the decimal_process_id.

Press ENTER. Output similar to the following is displayed:

    EXECUTEREAD:          471040

Total BROWSEUI.dll Commitment  1044480
    READONLY:             479232
    READWRITE:              4096
    WRITECOPY:              4096
    EXECUTEREAD:          557056

Total SHDOCVW.dll Commitment  1372160
    READONLY:             606208
    READWRITE:              8192
    EXECUTEREAD:          757760

Total UxTheme.dll Commitment   204800
    READONLY:              28672
    READWRITE:              4096
    EXECUTEREAD:          172032

Total comctl32.dll Commitment   942080
    READONLY:             372736
    READWRITE:              4096
    EXECUTEREAD:          565248

Total appHelp.dll Commitment   135168
    READONLY:              16384
    READWRITE:              4096
    EXECUTEREAD:          114688

Total CLBCatQ.DLL Commitment   503808
    READONLY:              32768
    READWRITE:              8192
    WRITECOPY:             16384
    EXECUTEREAD:          446464

Total COMRes.dll Commitment   811008
    READONLY:             802816
    READWRITE:              4096
    EXECUTEREAD:            4096

Total VERSION.dll Commitment    32768
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           16384

Total cscui.dll Commitment   323584
    READONLY:             188416
    READWRITE:              4096
    WRITECOPY:              4096
    EXECUTEREAD:          126976

Total CSCDLL.dll Commitment   110592
    READONLY:              36864
    READWRITE:              4096
    WRITECOPY:              4096
    EXECUTEREAD:           65536

Total themeui.dll Commitment   446464
    READONLY:             163840
    READWRITE:             12288
    WRITECOPY:             61440
    EXECUTEREAD:          208896

Total Secur32.dll Commitment    69632
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           53248

Total MSIMG32.dll Commitment    20480
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:            4096

Total netapi32.dll Commitment   331776
    READONLY:              20480
    READWRITE:             12288
    EXECUTEREAD:          299008

Total urlmon.dll Commitment   516096
    READONLY:              86016
    READWRITE:              8192
    WRITECOPY:             45056
    EXECUTEREAD:          376832

Total USERENV.dll Commitment   753664
    READONLY:              77824
    READWRITE:              8192
    EXECUTEREAD:          667648

Total actxprxy.dll Commitment   106496
    READONLY:              20480
    READWRITE:             12288
    EXECUTEREAD:           73728

Total LINKINFO.dll Commitment    32768
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           16384

Total ntshrui.dll Commitment   147456
    READONLY:             102400
    READWRITE:              4096
    EXECUTEREAD:           40960

Total SAMLIB.dll Commitment    57344
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           40960

Total SETUPAPI.dll Commitment  1032192
    READONLY:             520192
    READWRITE:              4096
    WRITECOPY:              4096
    EXECUTEREAD:          503808

Total NETSHELL.dll Commitment  1748992
    READONLY:            1241088
    READWRITE:             16384
    WRITECOPY:             12288
    EXECUTEREAD:          479232

Total credui.dll Commitment   184320
    READONLY:             110592
    READWRITE:              8192
    WRITECOPY:              8192
    EXECUTEREAD:           57344

Total WS2_32.dll Commitment    81920
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           65536

Total WS2HELP.dll Commitment    32768
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           16384

Total iphlpapi.dll Commitment    94208
    READONLY:              20480
    READWRITE:              4096
    EXECUTEREAD:           69632

Total CLUSAPI.dll Commitment    69632
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           53248

Total tsappcmp.dll Commitment    69632
    READONLY:              12288
    READWRITE:              8192
    EXECUTEREAD:           49152

Total msi.dll Commitment  2150400
    READONLY:             696320
    READWRITE:             28672
    WRITECOPY:             20480
    EXECUTEREAD:         1404928

Total WINSTA.dll Commitment    61440
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           45056

Total webcheck.dll Commitment   270336
    READONLY:             106496
    READWRITE:              4096
    EXECUTEREAD:          159744

Total WSOCK32.dll Commitment    36864
    READONLY:              20480
    READWRITE:              4096
    EXECUTEREAD:           12288

Total stobject.dll Commitment   131072
    READONLY:              98304
    READWRITE:              4096
    EXECUTEREAD:           28672

Total BatMeter.dll Commitment    40960
    READONLY:              20480
    READWRITE:              4096
    EXECUTEREAD:           16384

Total POWRPROF.dll Commitment    28672
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           12288

Total WTSAPI32.dll Commitment    32768
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           16384

Total SXS.DLL Commitment   741376
    READONLY:              86016
    READWRITE:              4096
    WRITECOPY:              4096
    EXECUTEREAD:          647168

Total printui.dll Commitment   548864
    READONLY:             290816
    READWRITE:              4096
    WRITECOPY:              8192
    EXECUTEREAD:          245760

Total WINSPOOL.DRV Commitment   147456
    READONLY:              16384
    READWRITE:              4096
    WRITECOPY:              4096
    EXECUTEREAD:          122880

Total ACTIVEDS.dll Commitment   196608
    READONLY:              16384
    READWRITE:              4096
    WRITECOPY:             28672
    EXECUTEREAD:          147456

Total adsldpc.dll Commitment   151552
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:          135168

Total WLDAP32.dll Commitment   180224
    READONLY:              16384
    READWRITE:             12288
    WRITECOPY:             20480
    EXECUTEREAD:          131072

Total ATL.DLL Commitment    98304
    READONLY:              40960
    READWRITE:              4096
    WRITECOPY:              4096
    EXECUTEREAD:           49152

Total CFGMGR32.dll Commitment    32768
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           16384

Total MPR.dll Commitment    69632
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           53248

Total WINMM.dll Commitment   180224
    READONLY:              49152
    READWRITE:              4096
    WRITECOPY:              4096
    EXECUTEREAD:          122880

Total drprov.dll Commitment    28672
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           12288

Total ntlanman.dll Commitment    53248
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           36864

Total NETUI0.dll Commitment    90112
    READONLY:              24576
    READWRITE:              4096
    EXECUTEREAD:           61440

Total NETUI1.dll Commitment   192512
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:          176128

Total davclnt.dll Commitment    36864
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           20480

Total Mapped Commitment  2105344
    READONLY:            1982464
    READWRITE:              8192
    EXECUTEREAD:          110592
    EXECUTEREADWRITE:       4096

Total   Priv Commitment  4091904
    READONLY:               4096
    READWRITE:           3088384
    EXECUTEREADWRITE:     999424

Dynamic Reserved Memory 10911744

PageFaults:                11243
PeakWorkingSetSize      11038720
WorkingSetSize          11026432
PeakPagedPoolUsage         50676
PagedPoolUsage             47076
PeakNonPagedPoolUsage       7912
NonPagedPoolUsage           6872
PagefileUsage            5033984
PeakPagefileUsage        5476352

C:\Documents and Settings\Administrator>

Example 2: Dump the Current Working Set to a Log File

To dump the current working set to a log file, type the following at the command line:

vadump -o [-msv] [-l logfile] -p decimal_process_id

Note

  • Substitute the name of a file for logfile.
  • A summary of the results for this example is located at the end of the output.

Press ENTER. Output similar to the following is displayed:

0x00020000 (0) PRIVATE Base 0x00020000
0x0012E000 (0) Stack for ThreadID 000005E8
0x0012F000 (0) Stack for ThreadID 000005E8
0x00140000 (0) PRIVATE Base 0x00140000
0x00141000 (0) Process Heap
0x00142000 (0) Process Heap
0x00143000 (0) Process Heap
0x00144000 (0) Process Heap
0x00145000 (0) Process Heap
0x00146000 (0) Process Heap
0x00147000 (0) Process Heap
0x00148000 (0) Process Heap
0x00149000 (0) Process Heap
0x0014A000 (0) Process Heap
0x0014B000 (0) Process Heap
0x0014C000 (0) Process Heap
0x0014D000 (0) Process Heap
0x0014E000 (0) Process Heap
0x0014F000 (0) Process Heap
0x00150000 (0) Process Heap
0x00151000 (0) Process Heap
0x00152000 (0) Process Heap
0x00153000 (0) Process Heap
0x00154000 (0) Process Heap
0x00155000 (0) Process Heap
0x00156000 (0) Process Heap
0x00157000 (0) Process Heap
0x0015C000 (0) Process Heap
0x0015D000 (0) Process Heap
0x0015E000 (0) Process Heap
0x0015F000 (0) Process Heap
0x00160000 (0) Process Heap
0x00241000 (0) Private Heap 0
0x00242000 (0) Private Heap 0
0x00250000 (2) UNKNOWN_MAPPED Base 0x00250000
0x00254000 (2) UNKNOWN Heap 1
0x0028C000 (7) DATAFILE_MAPPED Base 0x00280000 locale.nls
0x00320000 (0) PRIVATE Base 0x00320000
0x00321000 (0) Private Heap 2
0x00322000 (0) Private Heap 2
0x00323000 (0) Private Heap 2
0x00324000 (0) Private Heap 2
0x00325000 (0) Private Heap 2
0x00326000 (0) Private Heap 2
0x00840000 (0) PRIVATE Base 0x00840000
0x00850000 (0) PRIVATE Base 0x00850000
0x00851000 (0) PRIVATE Base 0x00850000
0x4AD00000 (5) cmd.exe
0x4AD01000 (5) cmd.exe
0x4AD02000 (6) cmd.exe
0x4AD03000 (6) cmd.exe
0x4AD06000 (4) cmd.exe
0x4AD07000 (5) cmd.exe
0x4AD08000 (4) cmd.exe
0x4AD0A000 (6) cmd.exe
0x4AD0B000 (5) cmd.exe
0x4AD0C000 (5) cmd.exe
0x4AD0D000 (5) cmd.exe
0x4AD0E000 (4) cmd.exe
0x4AD0F000 (5) cmd.exe
0x4AD10000 (4) cmd.exe
0x4AD13000 (5) cmd.exe
0x4AD14000 (4) cmd.exe
0x4AD15000 (4) cmd.exe
0x4AD16000 (3) cmd.exe
0x4AD17000 (3) cmd.exe
0x4AD18000 (4) cmd.exe
0x4AD19000 (5) cmd.exe
0x4AD1A000 (5) cmd.exe
0x4AD1D000 (0) cmd.exe
0x4AD1E000 (0) cmd.exe
0x4AD1F000 (0) cmd.exe
0x4AD20000 (0) cmd.exe
0x4AD21000 (0) cmd.exe
0x4AD22000 (0) cmd.exe
0x4AD23000 (0) cmd.exe
0x4AD27000 (0) cmd.exe
0x4AD2B000 (0) cmd.exe
0x4AD2F000 (0) cmd.exe
0x4AD31000 (0) cmd.exe
0x4AD35000 (0) cmd.exe
0x4AD39000 (0) cmd.exe
0x77BF1000 (7) msvcrt.dll
0x77BF2000 (7) msvcrt.dll
0x77BF4000 (7) msvcrt.dll
0x77BFD000 (7) msvcrt.dll
0x77BFE000 (7) msvcrt.dll
0x77C0B000 (7) msvcrt.dll
0x77C0C000 (7) msvcrt.dll
0x77C0D000 (6) msvcrt.dll
0x77C0E000 (2) msvcrt.dll
0x77C0F000 (5) msvcrt.dll
0x77C13000 (7) msvcrt.dll
0x77C14000 (7) msvcrt.dll
0x77C15000 (7) msvcrt.dll
0x77C16000 (7) msvcrt.dll
0x77C18000 (7) msvcrt.dll
0x77C19000 (7) msvcrt.dll
0x77C1A000 (4) msvcrt.dll
0x77C1C000 (5) msvcrt.dll
0x77C1D000 (7) msvcrt.dll
0x77C1E000 (7) msvcrt.dll
0x77C20000 (7) msvcrt.dll
0x77C21000 (7) msvcrt.dll
0x77C23000 (7) msvcrt.dll
0x77C24000 (7) msvcrt.dll
0x77C3B000 (0) msvcrt.dll
0x77C3D000 (0) msvcrt.dll
0x77C3E000 (0) msvcrt.dll
0x77CA9000 (7) RPCRT4.dll
0x77D31000 (7) USER32.dll
0x77D45000 (7) USER32.dll
0x77D54000 (5) USER32.dll
0x77D7B000 (7) USER32.dll
0x77DC1000 (7) ADVAPI32.dll
0x77DC2000 (7) ADVAPI32.dll
0x77DC6000 (7) ADVAPI32.dll
0x77DC7000 (6) ADVAPI32.dll
0x77DCD000 (7) ADVAPI32.dll
0x77DDB000 (7) ADVAPI32.dll
0x77DE5000 (7) ADVAPI32.dll
0x77DE6000 (7) ADVAPI32.dll
0x77DE7000 (7) ADVAPI32.dll
0x77DE8000 (7) ADVAPI32.dll
0x77DEA000 (7) ADVAPI32.dll
0x77DEC000 (7) ADVAPI32.dll
0x77DED000 (7) ADVAPI32.dll
0x77DFB000 (7) ADVAPI32.dll
0x77DFF000 (7) ADVAPI32.dll
0x77E08000 (7) ADVAPI32.dll
0x77E09000 (7) ADVAPI32.dll
0x77E1F000 (0) ADVAPI32.dll
0x77E20000 (0) ADVAPI32.dll
0x77E26000 (0) ADVAPI32.dll
0x77E27000 (0) ADVAPI32.dll
0x77E28000 (0) ADVAPI32.dll
0x77E51000 (7) kernel32.dll
0x77E52000 (7) kernel32.dll
0x77E53000 (7) kernel32.dll
0x77E54000 (7) kernel32.dll
0x77E69000 (7) kernel32.dll
0x77E6A000 (7) kernel32.dll
0x77E6C000 (7) kernel32.dll
0x77E6D000 (7) kernel32.dll
0x77E71000 (7) kernel32.dll
0x77E72000 (7) kernel32.dll
0x77E78000 (7) kernel32.dll
0x77E79000 (7) kernel32.dll
0x77E7A000 (7) kernel32.dll
0x77E7B000 (7) kernel32.dll
0x77E7C000 (7) kernel32.dll
0x77E7D000 (7) kernel32.dll
0x77E82000 (7) kernel32.dll
0x77E85000 (7) kernel32.dll
0x77E86000 (7) kernel32.dll
0x77E87000 (7) kernel32.dll
0x77E88000 (7) kernel32.dll
0x77E89000 (7) kernel32.dll
0x77E8A000 (7) kernel32.dll
0x77E8B000 (7) kernel32.dll
0x77E8C000 (7) kernel32.dll
0x77E8D000 (7) kernel32.dll
0x77E8E000 (7) kernel32.dll
0x77E90000 (7) kernel32.dll
0x77E91000 (7) kernel32.dll
0x77E95000 (7) kernel32.dll
0x77E96000 (7) kernel32.dll
0x77E9B000 (7) kernel32.dll
0x77E9C000 (7) kernel32.dll
0x77E9D000 (7) kernel32.dll
0x77E9E000 (7) kernel32.dll
0x77EA2000 (6) kernel32.dll
0x77EA3000 (7) kernel32.dll
0x77EA4000 (7) kernel32.dll
0x77EA6000 (7) kernel32.dll
0x77EA7000 (7) kernel32.dll
0x77EAA000 (7) kernel32.dll
0x77EAB000 (7) kernel32.dll
0x77EAC000 (7) kernel32.dll
0x77EB0000 (7) kernel32.dll
0x77EB2000 (7) kernel32.dll
0x77EB4000 (7) kernel32.dll
0x77EB5000 (7) kernel32.dll
0x77EB9000 (7) kernel32.dll
0x77EBD000 (7) kernel32.dll
0x77EC8000 (0) kernel32.dll
0x77ECA000 (0) kernel32.dll
0x77F41000 (7) ntdll.dll
0x77F42000 (7) ntdll.dll
0x77F43000 (7) ntdll.dll
0x77F44000 (7) ntdll.dll
0x77F45000 (7) ntdll.dll
0x77F47000 (7) ntdll.dll
0x77F48000 (7) ntdll.dll
0x77F49000 (7) ntdll.dll
0x77F4A000 (7) ntdll.dll
0x77F4B000 (7) ntdll.dll
0x77F4C000 (7) ntdll.dll
0x77F4D000 (7) ntdll.dll
0x77F4E000 (7) ntdll.dll
0x77F51000 (7) ntdll.dll
0x77F52000 (7) ntdll.dll
0x77F58000 (7) ntdll.dll
0x77F59000 (7) ntdll.dll
0x77F60000 (7) ntdll.dll
0x77F61000 (7) ntdll.dll
0x77F66000 (7) ntdll.dll
0x77F67000 (7) ntdll.dll
0x77F6D000 (7) ntdll.dll
0x77F6E000 (7) ntdll.dll
0x77F72000 (7) ntdll.dll
0x77F73000 (7) ntdll.dll
0x77F75000 (7) ntdll.dll
0x77F76000 (7) ntdll.dll
0x77F79000 (7) ntdll.dll
0x77F7A000 (7) ntdll.dll
0x77F7D000 (7) ntdll.dll
0x77F7E000 (7) ntdll.dll
0x77F7F000 (7) ntdll.dll
0x77F80000 (7) ntdll.dll
0x77F81000 (7) ntdll.dll
0x77F82000 (7) ntdll.dll
0x77F83000 (7) ntdll.dll
0x77F84000 (7) ntdll.dll
0x77F86000 (7) ntdll.dll
0x77F94000 (7) ntdll.dll
0x77F97000 (7) ntdll.dll
0x77F98000 (7) ntdll.dll
0x77F99000 (7) ntdll.dll
0x77FA9000 (7) ntdll.dll
0x77FBA000 (0) ntdll.dll
0x77FBB000 (0) ntdll.dll
0x77FBC000 (0) ntdll.dll
0x77FBD000 (0) ntdll.dll
0x77FBE000 (0) ntdll.dll
0x7F6F0000 (7) UNKNOWN_MAPPED Base 0x7F6F0000
0x7F6F2000 (7) UNKNOWN_MAPPED Base 0x7F6F0000
0x7FFC1000 (7) UNKNOWN_MAPPED Base 0x7FFB0000
0x7FFD2000 (7) UNKNOWN_MAPPED Base 0x7FFB0000
0x7FFD3000 (7) UNKNOWN_MAPPED Base 0x7FFB0000
0x7FFDE000 (0) TEB Base 0x7FFDE000
0x7FFDE000 (0) PRIVATE Base 0x7FFDE000
0x7FFDF000 (0) PRIVATE Base 0x7FFDF000
0x7FFE0000 (7) PRIVATE Base 0x7FFE0000
0xC0000000 -> (0x00000000 : 0x003FFFFF)   44 Resident Pages
              (0x00140000 : 0x00240000) -> Process Heap segment 0
              (0x00240000 : 0x00250000) -> Private Heap 0 segment 0
              (0x00250000 : 0x00260000) -> UNKNOWN Heap 1 segment 0
              (0x00320000 : 0x00330000) -> Private Heap 2 segment 0
              (0x00030000 : 0x00130000) -> Stack for thread 0

0xC0002000 -> (0x00800000 : 0x00BFFFFF)    3 Resident Pages
0xC012B000 -> (0x4AC00000 : 0x4AFFFFFF)   35 Resident Pages
              (0x4AD00000 : 0x4AD5D000) -> cmd.exe

0xC01DE000 -> (0x77800000 : 0x77BFFFFF)    5 Resident Pages
              (0x77BF0000 : 0x77C44000) -> msvcrt.dll

0xC01DF000 -> (0x77C00000 : 0x77FFFFFF)  148 Resident Pages
              (0x77F40000 : 0x77FF3000) -> ntdll.dll
              (0x77E50000 : 0x77F3C000) -> kernel32.dll
              (0x77BF0000 : 0x77C44000) -> msvcrt.dll
              (0x77DC0000 : 0x77E4D000) -> ADVAPI32.dll
              (0x77CA0000 : 0x77D26000) -> RPCRT4.dll
              (0x77D30000 : 0x77DB7000) -> USER32.dll
              (0x77C50000 : 0x77C8F000) -> GDI32.dll

0xC01FD000 -> (0x7F400000 : 0x7F7FFFFF)    2 Resident Pages
0xC01FF000 -> (0x7FC00000 : 0x7FFFFFFF)    6 Resident Pages

Category                        Total        Private Shareable    Shared
                           Pages    KBytes    KBytes    KBytes    KBytes
      Page Table Pages         7        28        28         0         0
      Other System             4        16        16         0         0
      Code/StaticData        188       752       112         0       640
      Heap                    37       148       148         0         0
      Stack                    2         8         8         0         0
      Teb                      1         4         4         0         0
      Mapped Data              7        28         0         0        28
      Other Data               9        36        32         4         0

      Total Modules          188       752       112         0       640
      Total Dynamic Data      56       224       192         4        28
      Total System            11        44        44         0         0
Grand Total Working Set      255      1020       348         4       668

Module Working Set Contributions in pages
    Total   Private Shareable    Shared Module
       35        13         0        22 cmd.exe
       48         5         0        43 ntdll.dll
       51         2         0        49 kernel32.dll
       27         3         0        24 msvcrt.dll
       22         5         0        17 ADVAPI32.dll
        1         0         0         1 RPCRT4.dll
        4         0         0         4 USER32.dll

Heap Working Set Contributions
  28 pages from Process Heap (class 0x00000000)
    0x00140000 - 0x00240000 28 pages
   2 pages from Private Heap 0 (class 0x00001000)
    0x00240000 - 0x00250000 2 pages
   1 pages from UNKNOWN Heap 1 (class 0x00008000)
    0x00250000 - 0x00260000 1 pages
   6 pages from Private Heap 2 (class 0x00001000)
    0x00320000 - 0x00330000 6 pages

Stack Working Set Contributions
   2 pages from stack for thread 000005E8

Example 3: Dump New Additions to the Working Set

To dump new working set additions for the specified process identifier (PID) to a specified log file, type the following at the command line:

vadump -w [-crv] [-l logfile] -p decimal_process_id

Notes

  • Substitute an actual process ID for the decimal_process_id.
  • To stop dumping new additions to the working set, press Ctrl+C.

Press ENTER. Output similar to the following is displayed:

Address: 00000000 Size: 00010000
    State Free

Address: 00010000 Size: 00001000 RegionSize: 10000
    State Committed
    Protect Read/Write
    Type Private

Address: 00020000 Size: 00001000
    State Committed
    Protect Read/Write
    Type Private

Address: 00021000 Size: 0000F000
    State Free

Address: 00030000 Size: 00001000 RegionSize: 100000
    State Reserved
    Type Private

Address: 00130000 Size: 00004000
    State Committed
    Protect Read Only
    Type Mapped

Address: 00134000 Size: 0000C000
    State Free

Address: 00140000 Size: 0000A000 RegionSize: 100000
    State Committed
    Protect Execute Read/Write
    Type Private

Address: 00240000 Size: 00006000 RegionSize: 10000
    State Committed
    Protect Execute Read/Write
    Type Private

Address: 00250000 Size: 00006000 RegionSize: 10000
    State Committed
    Protect Execute Read/Write
    Type Mapped

Address: 00260000 Size: 00016000
    State Committed
    Protect Read Only
    Type Mapped

Address: 00276000 Size: 0000A000
    State Free

Address: 00280000 Size: 00034000
    State Committed
    Protect Read Only
    Type Mapped

Address: 002B4000 Size: 0000C000
    State Free

Address: 002C0000 Size: 00041000
    State Committed
    Protect Read Only
    Type Mapped

Address: 00301000 Size: 0000F000
    State Free

Address: 00310000 Size: 00006000
    State Committed
    Protect Read Only
    Type Mapped

Address: 00316000 Size: 0000A000
    State Free

Address: 00320000 Size: 00007000 RegionSize: 10000
    State Committed
    Protect Execute Read/Write
    Type Private

Address: 00330000 Size: 00003000
    State Committed
    Protect Read Only
    Type Mapped

Address: 00333000 Size: 0000D000
    State Free

Address: 00340000 Size: 0000B000 RegionSize: c8000
    State Committed
    Protect Execute Read
    Type Mapped

Address: 00408000 Size: 00008000
    State Free

Address: 00410000 Size: 00103000
    State Committed
    Protect Read Only
    Type Mapped

Address: 00513000 Size: 0000D000
    State Free

Address: 00520000 Size: 0013E000 RegionSize: 300000
    State Committed
    Protect Execute Read
    Type Mapped

Address: 00820000 Size: 00001000
    State Committed
    Protect Read/Write
    Type Private

Address: 00821000 Size: 0000F000
    State Free

Address: 00830000 Size: 00001000
    State Committed
    Protect Read/Write
    Type Private

Address: 00831000 Size: 0000F000
    State Free

Address: 00840000 Size: 00001000
    State Committed
    Protect Read/Write
    Type Private

Address: 00841000 Size: 0000F000
    State Free

Address: 00850000 Size: 00002000
    State Committed
    Protect Read/Write
    Type Private

Address: 00852000 Size: 4A4AE000
    State Free

Address: 4AD00000 Size: 00001000 RegionSize: 5d000
    State Committed
    Protect Read Only
    Type Image

Address: 4AD5D000 Size: 17273000
    State Free

Address: 61FD0000 Size: 00001000 RegionSize: 10000
    State Committed
    Protect Read Only
    Type Image

Address: 61FE0000 Size: 15C10000
    State Free

Address: 77BF0000 Size: 00001000 RegionSize: 54000
    State Committed
    Protect Read Only
    Type Image

Address: 77C44000 Size: 0000C000
    State Free

Address: 77C50000 Size: 00001000 RegionSize: 3f000
    State Committed
    Protect Read Only
    Type Image

Address: 77C8F000 Size: 00011000
    State Free

Address: 77CA0000 Size: 00001000 RegionSize: 86000
    State Committed
    Protect Read Only
    Type Image

Address: 77D26000 Size: 0000A000
    State Free

Address: 77D30000 Size: 00001000 RegionSize: 87000
    State Committed
    Protect Read Only
    Type Image

Address: 77DB7000 Size: 00009000
    State Free

Address: 77DC0000 Size: 00001000 RegionSize: 8d000
    State Committed
    Protect Read Only
    Type Image

Address: 77E4D000 Size: 00003000
    State Free

Address: 77E50000 Size: 00001000 RegionSize: ec000
    State Committed
    Protect Read Only
    Type Image

Address: 77F3C000 Size: 00004000
    State Free

Address: 77F40000 Size: 00001000 RegionSize: b3000
    State Committed
    Protect Read Only
    Type Image

Address: 77FF3000 Size: 076FD000
    State Free

Address: 7F6F0000 Size: 00007000 RegionSize: 100000
    State Committed
    Protect Execute Read
    Type Mapped

Address: 7F7F0000 Size: 007C0000
    State Free

Address: 7FFB0000 Size: 00024000
    State Committed
    Protect Read Only
    Type Mapped

Address: 7FFD4000 Size: 0000A000
    State Free

Address: 7FFDE000 Size: 00001000
    State Committed
    Protect Execute Read/Write
    Type Private

Address: 7FFDF000 Size: 00001000
    State Committed
    Protect Execute Read/Write
    Type Private

Address: 7FFE0000 Size: 00001000 RegionSize: 10000
    State Committed
    Protect Read Only
    Type Private

Total  Image Commitment  4427776
    READONLY:            1253376
    READWRITE:            151552
    WRITECOPY:             94208
    EXECUTEREAD:         2928640

Total cmd.exe Commitment   380928
    READONLY:             147456
    READWRITE:             69632
    WRITECOPY:             49152
    EXECUTEREAD:          114688

Total ntdll.dll Commitment   733184
    READONLY:             212992
    READWRITE:             20480
    WRITECOPY:              4096
    EXECUTEREAD:          495616

Total kernel32.dll Commitment   966656
    READONLY:             466944
    READWRITE:              8192
    WRITECOPY:              4096
    EXECUTEREAD:          487424

Total msvcrt.dll Commitment   344064
    READONLY:              20480
    READWRITE:             16384
    WRITECOPY:             12288
    EXECUTEREAD:          294912

Total ADVAPI32.dll Commitment   577536
    READONLY:             151552
    READWRITE:             20480
    WRITECOPY:             20480
    EXECUTEREAD:          385024

Total RPCRT4.dll Commitment   548864
    READONLY:              28672
    READWRITE:              4096
    EXECUTEREAD:          516096

Total USER32.dll Commitment   552960
    READONLY:             196608
    READWRITE:              4096
    WRITECOPY:              4096
    EXECUTEREAD:          348160

Total GDI32.dll Commitment   258048
    READONLY:              16384
    READWRITE:              4096
    EXECUTEREAD:          237568

Total MPR.dll Commitment    65536
    READONLY:              12288
    READWRITE:              4096
    EXECUTEREAD:           49152

Total Mapped Commitment  3239936
    READONLY:            1830912
    EXECUTEREAD:         1384448
    EXECUTEREADWRITE:      24576

Total   Priv Commitment  1277952
    READONLY:               4096
    READWRITE:           1073152
    EXECUTEREADWRITE:     200704

Dynamic Reserved Memory 4784128

PageFaults:                 4483
PeakWorkingSetSize       2179072
WorkingSetSize            258048
PeakPagedPoolUsage         16036
PagedPoolUsage             15780
PeakNonPagedPoolUsage       2072
NonPagedPoolUsage           1416
PagefileUsage            1556480
PeakPagefileUsage        1626112


VaDump Remarks

Using VaDump to Look Inside Your Working Set

VaDump can be used to look inside the working set of a process running an application to determine the nature of each page. For example, before using the Working Set Tuner to reduce the size of the code space, use VaDump to determine what percentage of the working set is dedicated to the code space. If that percentage is small, look for a more significant component of the working set to optimize.


VaDump Syntax

VaDump uses the following syntax:

One Step vadump [-c] [-m] [-o] [-r] [-s] [-t] [-w] [-v] [-l LogFile] -p DecimalProcessID [-help]

Parameters

-c
Displays faults that occur on code pages.

Note

  • The -w parameter must always be used with the -c parameter. The -c parameter modifies the output you get with the -w parameter. Without it, the faults on code pages are not shown.
-m
Shows all code symbols on a page.
-o
Displays a working-set snapshot with summary.

Note

  • The -w parameter cannot be used in conjunction with the -o parameter.
-r
Prints information about individual faults.
-s
Provides summary information only.
-t
Includes page-table information in summary.
-w
Tracks new working-set additions.
-v
Gives verbose output.
-l LogFile
Specifies the name of the log file.
-p DecimalProcessID
Specifies a process ID in decimal form.

Note

  • The -p parameter must always be used when using VaDump.
-help
Displays command-line help.


VFI Examples

Overview | Remarks | UI | Examples | Related Tools Run Tool

Example 1: Remove a Group or user name from the Permissions list

The following procedure uses Visual File Information (VFI) to remove a group or user name from the permissions list.

  1. Start VFI and click File on the tool bar.
  2. On the File menu, click either Add a file or Add a folder. The file or contents of the folder display in the text box.
  3. A dialog box asks if you want to save this information to a tab-delimited text file. Click Yes.
  4. Highlight a file displayed in the text box, click File on the tool bar, and choose Properties from the File menu. The Properties text box displays.
  5. Click the Security tab on the Properties text box.
  6. Highlight the desired group or user name from the Group or user name text box and click the Remove button to remove that group or user name.

Example 2: Modify the permissions of an administrator

The following procedure uses Visual File Information (VFI) to modify the permissions of an administrator.

  1. Start VFI and click File on the tool bar.
  2. On the File menu, click either Add a file or Add a folder. The file or contents of the folder display in the text box.
  3. A dialog box asks if you want to save this information to a tab-delimited text file. Click Yes.
  4. Highlight a file displayed in the text box, click File on the tool bar, and choose Properties from the File menu. The Properties text box displays.
  5. Click the Security tab on the Properties text box.
  6. Highlight the desired group or user name from the Group or user name text box and use the Allow or Deny check boxes to modify the permissions.


VFI Remarks

Overview | Remarks | UI | Examples | Related Tools Run Tool

Securing a Computer and Its Resources

In order to secure a computer and its resources, you must take the rights that users have into consideration . You can secure a computer or multiple computers by granting users or groups specific user rights. You can secure an object, such as a file or folder, through assigning permissions to allow users or groups to perform specific actions on that object.


VFI UI

Overview | Remarks | UI | Examples | Related Tools Run Tool

The following menus and options are located on the Visual File Information (VFI) dialog box:

File Menu

The File menu offers the user the following options:

  • Add a file. Click this option to open a dialog box that allows you to choose a file to add to the grid in the dialog box.
  • Add a folder. Click this option to open a dialog box that allows you to choose a folder whose contents you want to add to the grid in the dialog box.
  • Save. Click this option to display a Save As dialog box, which contains the following options:
    • Save in text box. Allows you to choose the location to which you want to save a file.
    • File name text box. Allows you to choose the name of a file.
    • Save as type text box. Allows you to choose the file type when saving the file.
    • Save button. Allows you to save a file using the location, name, and file type information entered in the text boxes on the Save As dialog box.
    • Cancel button. Allows you to close the Save As dialog box without saving any changes.
  • Quick View. Click this option to view the contents of the file.
  • Properties. Click this option to display a dialog box containing the properties of a file. The properties displayed will vary depending on the file system in use.

Edit Menu

The Edit menu offers the user the following options:

  • Copy Info. Allows you to copy file information of the highlighted file to the clipboard.
  • Select All. Allows you to select all files in the file grid.
  • Remove. Allows you to remove the selected file from a file list.
  • Touch. Allows you to touch the file date and time.

View Menu

The View menu offers the user the following options:

  • Language Name. Allows you to view the language by name or ID.
  • Decimal FileSize. Allows you to view the file size in hexadecimal or decimal.
  • Toolbar. Allows you to display or hide the tool bar.
  • ToolTips Allows you to display or hide the tool tips.
  • Status Bar. Allows you to display or hide the status bar.
  • SmartFit Columns. Allows you to resize all columns to their best width.
  • Options. Click this entry to open a dialog box containing general and column options available to the user.

Help Menu

The Help menu offers the user the following options:

  • Visual File Information Help. Click this entry to open a dialog box that gives general information about the VFI tool.
  • Field Information. Click this entry entry to display a list of fields. Then, click the fields to display added information about each field. The fields include:
    • Attributes — Click Attributes to display the list of possible file attributes. This list includes:
      • Archive
      • Hidden
      • Read Only
      • System
      • Encrypted
      • Compressed
      • Temporary
      • Offline
    • Version — Contains information about the operating system field.
    • Language — Contains information about the language field.
    • Code Page — Contains information about the code page field.
    • File OS — Contains information about the operating system field.
    • File Type — Contains information about the file field.
    • File Flags — Contains information about the flag field.
    • 32-bit CRC key — Contains information about the CRC field.
    • ISO 9660
      • — Contains information about the ISO 9660 Level 1 file systems.
  • About Visual File Information
    • Click this field to display the version and build number of the VFI tool.


VolPerf Remarks

Overview | Remarks | Syntax | Related Tools Open Command Prompt

Comparing VolPerf to Vssadmin

You can use the Vssadmin command to list shadow copies and shadow storage; however, it is very difficult to manage a large number of servers by using Vssadmin.

Administrators are interested in monitoring the number of shadow copies on their servers in addition to the space that is being consumed on the shadow storage. VolPerf allows them to use System Monitor to monitor shadow copy performance counters. This makes the management of a large number of servers easier than if they use Vssadmin.

Understanding VolPerf

VolPerf is a collection of shadow copy performance counters that allows you to monitor the usage of shadow copies on one or multiple servers. After installing VolPerf on your system, you can run System Monitor and see that a new object type, Shadow Copies, is displayed in the list of objects. When you select Shadow Copies, each fixed volume is added as an instance that can be selected. The following table lists counters that are available.

Counter | Description
Shadow Copies | Shadow copies performance counters.
Nb of Shadow Copies | Number of shadow copies of a volume.
Used Space (Mb) | Space used in the shadow storage volume for all the shadow copies of the input volume.
Allocated Space (Mb) | Space allocated in the shadow storage volume for all the shadow copies of the input volume.
Maximum Space (Mb) | Maximum space allocated in the shadow storage volume for all the shadow copies of the input volume.
Nb of Diff Area Files | Total number of different area files on a volume. This is the same as the total number of shadow copies on the system whose shadow storage is configured on the input volume.
Size of Diff Area Files (Mb) | Size of all different area files on the input volume.
% Disk Used by Diff Area File | Size of all different area files on the input volume divided by the volume.


VolPerf Syntax

Overview | Remarks | Syntax | Related Tools Open Command Prompt

VolPerf uses the following syntax:

One Step volperf [/install] [/uninstall] [/?]

Parameters

/install
Installs shadow copy performance counters.
/uninstall
Uninstalls shadow copy performance counters.
/?
Displays command-line usage.

Note

  • When run without parameters, VolPerf displays command-line usage.


VolRest Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: Search for a File on a Server

The task in this example is to search for all versions of the Mydoc.txt file. Type the following at the command line:

volrest \\myserver\TW\user1\mydoc.txt

Press ENTER. Output similar to the following is displayed:

 Searching previous versions on \\myserver\TW\user1\mydoc.txt

11/11/2002  03:21 PM                 7 \\myserver\TW\@GMT-2002.11.12-20.00.20\user1\mydoc.txt
11/11/2002  12:49 PM                 4 \\myserver\TW\@GMT-2002.11.11-23.14.36\user1\mydoc.txt
11/11/2002  12:48 PM                 4 \\myserver\TW\@GMT-2002.11.11-20.48.57\user1\mydoc.txt

               3 File(s)  15 bytes
               0 Dir(s)

To list the files that are actually present in the directory, type the following at the command line:

dir \\myserver\TW\@GMT-2002.11.12-20.00.20\user1\mydoc.txt

Press ENTER. Output similar to the following is displayed:

 Volume in drive \\myserver\TW is New Volume
 Volume Serial Number is A860-CF81

 Directory of \\myserver\TW\@GMT-2002.11.12-20.00.20\user1

11/11/2002  03:21 PM                 7 mydoc.txt
               1 File(s)              7 bytes
               0 Dir(s)  15,052,722,176 bytes free

Example 2: Restore Files from Shadow Copy

The task in this example is to restore all versions of Mydoc.txt from the shadow copy. Type the following at the command line:

volrest \\myserver\TW\user1\mydoc.txt /r:c:\oldfiles

Press ENTER. Output similar to the following is displayed:

 Restoring previous versions from \\myserver\TW\user1\mydoc.txt to c:\oldfiles

11/11/2002  03:21 PM                 7 C:\OLDFILES\mydoc.txt
11/11/2002  12:49 PM                 4 C:\OLDFILES\mydoc(1).txt
11/11/2002  12:48 PM                 4 C:\OLDFILES\mydoc(2).txt

               3 File(s)  15 bytes

Example 3: Restore Files from the Shadow Copy and Rename Files with a Readable Format of the Shadow Copy Time Stamp

The task in this example is to restore all versions of Mydoc.txt from the shadow copy and name them with a readable format of the shadow copy time stamp. Type the following at the command line:

volrest \\myserver\TW\user1\mydoc.txt /r:c:\oldfiles /sct

Press ENTER. Output similar to the following is displayed:

volrest \\myserver\TW\user1\mydoc.txt  /r:c:\oldfiles /sct

 Restoring previous versions from \\myserver\TW\user1\mydoc.txt to c:\oldfiles

11/11/2002  03:21 PM                 7 C:\OLDFILES\mydoc (Tuesday, November 12, 2002, 12.00.20).txt
11/11/2002  12:49 PM                 4 C:\OLDFILES\mydoc (Monday, November 11, 2002, 15.14.36).txt
11/11/2002  12:48 PM                 4 C:\OLDFILES\mydoc (Monday, November 11, 2002, 12.48.57).txt

               3 File(s)  15 bytes


VolRest Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

VolRest uses the following syntax:

One Step volrest [/ad] [/as] [/ah] [/s] [/b] [/r:DirectoryName [/e] [/sct] [FileName] [/?]

Parameters

/ad
Includes directories.
/as
Includes system files.
/ah
Includes hidden files.
/b
Uses bare format with no heading or summary information.
/s
Includes files in the specified directory and all its subdirectories.
/r:DirectoryName
Restores all previous versions in the specified directory. When /r is omitted, VolRest displays valid Win32 file names that include the @GMT string interpreted by Server Service as a shadow copy time stamp.

Notes

  • By default, files are restored with the same file name. If two or more previous versions are restored, the second file has a (1) appended to its name, the third file a (2), and so on.
  • When the /r parameter is used, VolRest displays the name of the files as they are restored.
/e
Restores empty directories.
/sct
Adds the shadow copy time stamp to restored file names (for example: "mydoc (Wednesday, January 01, 2003, 14.00.00).doc").
FileName
Specifies the name of a remote file or directory on a server on which Shadow Copies for Shared Folders has been enabled. VolRest returns an error if the target file is a local file. It also returns the message "No previous version" if Shadow Copies for Shared Folders has not been enabled on the server that hosts the target file. The file name can also be the root of a share, such as X:\ or \\server\share. In this case, it lists the shadow copies present on that share.
/?
Displays command-line usage.

Note

  • When run without parameters, VolRest displays command-line usage.


VrfyDsk Examples

Example: Check Drive C for Corruption

The task in this example is to check drive C for corruption. Type the following at the command line:

VRFYDSK C: /V

Press ENTER.

Output similar to the following is displayed:

Microsoft Windows
(C) Copyright 1985-2002 Microsoft Corp.

Attempting to create shadow copy of \\?\Volume{81c43992-d067-11d6-b4eb-806d61726
96f}\.

Shadow copy creation succeeded on \\?\Volume{81c43992-d067-11d6-b4eb-806d6172696
f}\. The device is \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

Assigning drive letter Z: to device \Device\HarddiskVolumeShadowCopy1 (shadow co
py of volume \\?\Volume{81c43992-d067-11d6-b4eb-806d6172696f}\ )

Invoking Chkdsk on drive Z: (shadow copy of volume \\?\Volume{81c43992-d067-11d6
-b4eb-806d6172696f}\ ) ...

The type of the file system is NTFS.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
Detected minor inconsistencies on the drive.  This is not a corruption.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Cleaning up 60 unused index entries from index $SII of file 9.
Cleaning up 60 unused index entries from index $SDH of file 9.
Cleaning up 60 unused security descriptors.
Security descriptor verification completed.

   2096450 KB total disk space.
   1264114 KB in 9174 files.
      2640 KB in 1010 indexes.
         0 KB in bad sectors.
     28808 KB in use by the system.
     12544 KB occupied by the log file.
    800888 KB available on disk.

      2048 bytes in each allocation unit.
   1048225 total allocation units on disk.
    400444 allocation units available on disk.

Cleaning up shadow copy of volume \\?\Volume{81c43992-d067-11d6-b4eb-806d6172696
f}\.

Unassigning drive letter Z: from device \Device\HarddiskVolumeShadowCopy1.

VrfyDsk creates a shadow copy of drive C by using Volume Shadow Copy service, and then assigns a drive letter to the shadow copy of drive C. VrfyDsk then checks the consistency of the file system on the shadow copy, displays any messages, and exits. Last, VrfyDsk unasssigns the drive letter from the shadow copy and deletes the shadow copy.


VrfyDsk Remarks

Comparing Chkdsk to VrfyDsk

Chkdsk is a tool that provides functionality similar to VrfyDsk; however, running Chkdsk on an active system, boot volume, or a data volume that is in use by another program or process might incorrectly report errors when none are present. VrfyDsk overcomes this limitation of Chkdsk.

If you run Chkdsk on a volume that is in use, it might report nonexistent errors due to the transient nature of the volume. To ensure that Chkdsk gets a consistent view of the volume, the volume might have to be taken offline. This can be a problem if you are maintaining a service level agreement that specifies that you maintain high availability and ensure that volumes are not corrupt.

To solve this problem, use VrfyDsk, which creates a shadow copy of the volume and checks consistency on this shadow copy. VrfyDsk allows you to monitor the health of your volumes without taking them offline and making them unavailable. Because Vrfydsk does not create a complete copy of the data, but only creates a shadow copy, it does not take much longer to run than Chkdsk.


VrfyDsk Syntax

VrfyDsk uses the following syntax:

One Step VRFYDSK [volume[Path]] [/V] [/I] [/C] [/?]

Parameters

Note

  • The VrfyDsk parameters are a subset of the Chkdsk parameters. All parameters for VrfyDsk are passed directly to Chkdsk as parameters for the corresponding switch.
volume[Path]
Specifies the fixed amount of storage on a disk or tape that you want to check for corruption. You can use any of the following as inputs for the target volume:
  • Volume name
  • Drive letter
  • Mount point
If you do not specify volume information, VrfyDsk uses the current volume as the target volume.
/V
Runs VrfyDsk in verbose mode, which displays any clean-up messages.
/I
For NTFS drives only, runs VrfyDsk in a mode that performs a check of index entries that is less vigorous than the default check. Use this option to reduce the amount of time needed to run the tool.
/C
For NTFS drives only, runs VrfyDsk in a mode that skips cycle-checking within folder structures. Use this option to reduce the amount of time needed to run the tool.
/?
Displays command-line usage.


WinExit Remarks

Overview | Remarks | UI | Related Tools

Installing WinExit

To install WinExit:

  1. Right-click Winexit.scr.
  2. Select Install from the shortcut menu.

Using WinExit

When activated, WinExit beeps, indicating that the logoff process is about to begin, and it displays the logoff dialog box. If no action is taken and the countdown timer reaches zero, the system initiates the logoff procedure. You can stop the process before the countdown timer reaches zero by either moving the mouse pointer over the dialog box or by pressing any key on the keyboard.

To activate WinExit:

  1. In Control Panel, double-click the Display icon.
  2. On the Screen Saver tab, select Logoff Screen Saver from the Screen Saver list.
  3. In the Wait box, select the number of minutes of inactivity before the screen saver appears.
  4. To configure the screen saver to force a logoff, click the Settings button.
  5. In the Force Logoff box, select the Force Application Termination check box. This action forces the system to close all running applications regardless of their current state.
    • By default, this check box is not selected. If you check it, the system queries all open appllications to warn users that data must be saved. After a predefined period of time, the applications shut down automatically, whether or not the data has been saved. Use this setting cautiously, because unsaved data cannot be retrieved after a shutdown.
    • In the Time To Log Off box, enter the time WinExit will display in its logoff dialog box before proceeding with the logoff process. Enter a value between 0 and 999 seconds.
    • In the Logoff Message box, enter a message to display in the logoff dialog box. The message is limited to 255 characters; it will be truncated if extra characters are entered.
  6. To start the screen saver temporarily so you can see what it looks like, click the Preview button. To return to Windows, move your mouse or press any key.


WinExit UI

Overview | Remarks | UI | Related Tools

WinExit displays a dialog box containing the following options:

Option | Description
Force logoff | Select the Force Application Termination check box to close all running applications regardless of their current state.
Time to logoff | Select the Force Application Termination check box to close all running applications regardless of their current state.
Logoff Message | Enter a message to display in the Auto Logoff dialog box. The message is limited to 255 characters. It is truncated if extra characters are entered.

Caution

  • Selecting the Force Application Termination check box may cause data loss.


WinHTTPCertCfg Examples

Overview | Syntax | Examples | Related Tools Open Command Prompt

Example 1: List Accounts with Access to a Certificate's Private Key

The task in this example is to list the user accounts that have access to the private key of a specified certificate. To do this, use the /l parameter, which requires the /c and /s parameters. The certificate store, named Root, is located in the LOCAL_MACHINE hive of the registry. The name of the certificate is Test. Type the following at the command line:

winhttpcertcfg /l /c local_machine\root /s test

Press ENTER. Output similar to the following is displayed:

Microsoft (R) WinHTTP Certificate Configuration Tool
Copyright (C) Microsoft Corporation 2001.

Matching certificate:
CN=test
DC=contoso
DC=com

Additional accounts and groups with access to the private key include:
    BUILTIN\Administrators
    NT AUTHORITY\SYSTEM

Example 2: Grant Access to a Private Key from a User Account

The task in this example is to grant access to a certificate's private key to a user account. To do this, use the /g parameter, which requires the /c, /s, and /a parameters. The certificate store, named Root, is located in the LOCAL_MACHINE hive of the registry. The name of the certificate is Test and the user account that access is being granted to is named Testuser. Type the following at the command line:

winhttpcertcfg /g /c local_machine\root /s test /a testuser

Press ENTER. Output similar to the following is displayed:

Microsoft (R) WinHTTP Certificate Configuration Tool
Copyright (C) Microsoft Corporation 2001.

Matching certificate:
CN=test
DC=contoso
DC=com

Granting private key access for account:
    CONTOSO\testuser


WinHTTPCertCfg Syntax

Overview | Syntax | Examples | Related Tools Open Command Prompt

WinHTTPCertCfg uses the following syntax:

One Step winhttpcertcfg [{/i PFXFile|/g|/r|/l}] /c {LOCAL_MACHINE|CURRENT_USER} CertStore [/a Account] [/s {SubjectStr] [/p PFXPassword]

Parameters

/i PFXFile
Imports a certificate and its private key from a PFX file. When this parameter is used, the /a and /c parameters are also required.
/g
Allows the specified user account access to a certificate's private key. When this parameter is used, the /a, /c, and /s parameters are also required.
/r
Denies the specified user account access to a certificate's private key. When this parameter is used, the /a, /c, and /s parameters are also required.
/l
Lists user accounts that have access to the private key of the specified certificate. When this parameter is used, the /c and /s parameters are also required.
/c {LOCAL_MACHINE|CURRENT_USER} CertStore
Specifies the location and the name of the certificate store. Choose from the LOCAL_MACHINE or the CURRENT_USER hive of the registry. Select LOCAL_MACHINE for all users of the local computer to use the certificate. Select CURRENT_USER for only a particular user on the local computer to use the certificate. CertStore specifies the name of the certificate store that contains the certificate you need to find.
/a Account
Specifies a user account. This can be a local or a domain user account.
/s {SubjectStr
Specifies a string of characters, which WinHTTPCertCfg uses to find a certificate. WinHTTPCertCfg searches the Subject field of certificates that are present on the local computer. This string is not case-sensitive.
/p {PFXPassword
Specifies a password to use when importing a certificate and its private key. This parameter is only available when you use the /i parameter.


WinHTTPTraceCfg Examples

Example 1: View Current WinHTTP Trace Facility Settings

The task in this example is to display the current settings of the WinHTTP packet tracing service. To do this, run WinHTTPTraceCfg with no parameters. Type the following at the command line:

winhttptracecfg

Press ENTER. Output similar to the following is displayed:

Microsoft (R) WinHTTP Tracing Facility Configuration Tool
Copyright (C) Microsoft Corporation 2001.

Updated trace settings

Current WinHTTP trace settings under

    HKEY_LOCAL_MACHINE\
     SOFTWARE\Microsoft\Windows\CurrrentVersion\Internet Setings\WinHttp\Tracing:

     TracingEnabled: -key not set- (default value: 0)
      ToFileDebugger -key not set- (default value: 0)
     ShowBytes -key not set- (default value: 1)
     ShowApiTrace -key not set- (default value: 0)
     MaxFileSize -key not set- (default value: 65535)
     FileNamePrefix -key not set- (default value: "")

This output shows that WinHTTPTraceCfg has not yet been used to set the WinHTTP packet trace facility settings.

Example 2: Set the WinHTTP Trace Settings

The task in this example is to use WinHTTPTraceCfg to set values in the WinHTTP trace settings. Use the /e, /s, and /t parameters to enable tracing, specify that the output be in hexadecimal format, and include top-level API function calls in the output. Type the following at the command line:

winhttptracecfg /e 1 /s 1 /t 1

Press ENTER. Output similar to the following is displayed:

Microsoft (R) WinHTTP Tracing Facility Configuration Tool
Copyright (C) Microsoft Corporation 2001.

Updated trace settings

Current WinHTTP trace settings under

    HKEY_LOCAL_MACHINE\
     SOFTWARE\Microsoft\Windows\CurrrentVersion\Internet Setings\WinHttp\Tracing:

     TracingEnabled: 1
      ToFileDebugger -key not set- (default value: 0)
     ShowBytes: 1
     ShowApiTrace: 1
     MaxFileSize -key not set- (default value: 65535)
     FileNamePrefix -key not set- (default value: "")


WinHTTPTraceCfg Remarks

Minimizing the Impact of Log File Size on Performance

When capturing log files with WinHTTP packet tracing service, make sure you have adequate hard disk space for the log files. Log files can grow rapidly. If you cannot monitor the size of the file, or you have a limited amount of disk space, use WinHTTPTraceCfg to limit the size of the log file.

Interpreting WinHTTPTraceCfg Output

The lines in the output of WinHTTPTraceCfg have a one-to-one correspondence with the syntax parameters of the tool. The following table shows the title of the output lines and the parameter that affects the value of that line.
Output Line | Parameter
TracingEnabled | /e
ToFileDebugger | /d
ShowBytes | /s
ShowApiTrace | /t
MaxFileSize | /m
FileNamePrefix | /l


WinHTTPTraceCfg Syntax

WinHTTPTraceCfg uses the following general syntax:

One Step winhttptracecfg [/e {0|1}] [/l Prefix] [/d {0|1}] [/s {0|1|2}] [/t {0|1}] [/m MaxFileSize]

Parameters

/e
Specifies whether the trace facility is enabled or disabled. Enter 0 to disable tracing. Enter 1 to enable tracing. If omitted, the default setting is 0.
/l Prefix
Specifies a prefix that WinHTTPTraceCfg prepends to the default log file name. If omitted, the log file is written to the current directory. Once the /l parameter is run, the specified prefix is continuously used until the /l parameter is run again with a star (*) as the Prefix setting.
/d
Specifies whether the output should be written to a log file or directed to a debugger. Enter a 0 to write the information to a log file. Enter a 1 to direct the output to a debugger. If omitted, the output is written to a log file.
/s
Specifies whether to display the output in American National Standards Institute (ANSI) or hexadecimal format. Enter a 0 to display the output in ANSI format. Enter a 1 to display the output in hexadecimal format. If omitted, the default setting is 0.
/t
Specifies whether top-level function calls are included in the output. Enter a 0 to exclude top-level function calls from the display information. Enter a 1 to include top-level function calls in the display information. If omitted, the default setting is 0.
/m MaxFileSize
Specifies the maximum size, in bytes, of the log file. Values below 65,535 bytes are not accepted. Once the log file reaches the maximum alloted size, the file is overwritten by current log file information. If omitted, the default log file size is 65,535 bytes.


Wins.dll Remarks

Overview | Remarks | Related Tools

Installing Wins.dll

Note

  • The Netmon directory is usually located in the %windir%\system32 path.

To install WINS Replication Network Monitor Parser, you must modify the local Parser.ini and Tcpip.ini to support the Wins.dll.

  1. Open Tcpip.ini in the Netmon\Parsers subdirectory.
  2. Add "42 = WINS" to the [TCP_HandoffSet] section of the file, as in the following example:
    [TCP_HandoffSet]
20   = FTP
21   = FTP
23   = TELNET
25   = SMTP
42   = WINS
53   = DNS
  3. Save and close Tcpip.ini.
  4. Open Parser.ini in the Netmon subdirectory.
  5. Add "WINS.DLL = 0: WINS" to the [PARSERS] section of the file, as in the following example:
    [PARSERS]
FRAME.DLL   = 0: FRAME
MAC.DLL     = 0: ETHERNET, TOKENRING, FDDI, TMAC, SMT
LLC.DLL     = 0: LLC, RPL, SNAP, BPDU
NETBIOS.DLL = 0: NETBIOS
SMB.DLL     = 0: SMB
...
WINS.DLL    = 0: WINS
  6. Add the following section to the end of Parser.ini.
    [WINS]
Comment     = "WINS Server Replication"
FollowSet   =
HelpFile    =
  7. Save and close Parser.ini.


WLBS_hb and WLBS_rc Remarks

Overview | Remarks | Related Tools

Installing WLBS_hb and WLBS_rc

Note

  • The Netmon directory is usually located in the %windir%\system32 path.

To install WLBS_hb and WLBS_rc, you must modify the local Mac.ini, Parser.ini, and Tcpip.ini files.

  1. Copy the Wlbs_hb.dll and Wlbs_rc.dll files to your Netmon\Parsers directory.
  2. Open the Mac.ini file in the Netmon\Parsers directory.
  3. In the [ETYPES] section, add the lines 0xBF01 = WLBS_HB and 0x886F = WLBS_HB, as in the following example:
        [ETYPES]
    0x600   =   XNS
    0x800   =   IP
    0x806   =   ARP_RARP,1
    0x0bad  =   VINES_IP
    0x1984  =   TRAIL
    0x8035  =   ARP_RARP,2
    0x809B  =   LAP
    0x80D5  =   SNA
    0x80F3  =   AARP
    0x8137  =   IPX
    0x8138  =   IPX
    0x86DD  =   IP6
    0xBF01  =   WLBS_HB
    0x886F  =   WLBS_HB
  4. Save and close the Mac.ini file.
  5. Open the Tcpip.ini file in the Netmon\Parsers directory.
  6. In the [UDP_HandoffSet] section, add the lines 1717 = WLBS_RC and 2504 = WLBS_RC, as in the following example:
        [UDP_HandoffSet]
    53   = DNS
       67   = DHCP
       68   = DHCP
       111  = RPC
       161  = SNMP
       162  = SNMP
       137  = NBT, 1000
       138  = NBT, 1002
       139  = NBT, 1001
       520  = RIP
       1717 = WLBS_RC
       2049 = RPC
       2504 = WLBS_RC
  7. Save and close the Tcpip.ini file.
  8. Open the Parser.ini file in the Netmon directory.
  9. In the [PARSERS] section, add the lines WLBS_RC.DLL = 0: WLBS_RC and WLBS_RC.DLL = 0: WLBS_RC, as in the following example:
        [PARSERS]
<Other Parsers>
        LDAP.DLL    = 0: LDAP
        TDS.DLL     = 0: TDS
        ATMARP.DLL  = 0: ATMARP
        RSVP.DLL    = 0: RSVP
        UNI31.DLL   = 0: UNI31
        RTPPARSR.DLL= 0: RTP, RTCP
        TCPIP6.DLL  = 0: IP6, ICMP6
        CLSC.DLL    = 0: CLSC
        L2TP.dll	= 0: L2TP
        WLBS_HB.DLL = 0: WLBS_HB
        WLBS_RC.DLL = 0: WLBS_RC
  10. Add the following section to the end of the Parser.ini file:
        [WLBS_HB]
    Comment     = "WLBS Heartbeat"
    FollowSet   =
    HelpFile    =

    [WLBS_RC]
    Comment     = "WLBS Remote Control Protocol"
    FollowSet   =
    HelpFile    =
  11. Save and close the Parser.ini file.