Windows 2000 Resource Kit Tools Help Start Page

How to find a tool

Visit the Web site for updates

View new tools for Windows 2000

Tools Help

Windows 2000 Resource Kit Tools Help documents nearly 300 software tools that harness the power of Windows 2000.

Discover and learn how to use tools to manage Active Directory, administer security features, work with the registry, automate recurring jobs, and perform many other important tasks.

© Copyright 1985-2000 Microsoft Corporation. All rights reserved.


Alphabetical List of Tools

This page requires a browser capable of displaying frames.


Introduction

The Microsoft® Windows® 2000 Resource Kit Tools Help presents an overview of the tools in the Microsoft® Windows® 2000 Resource Kit. Network administrators, developers, and power users will find an indispensable set of over 200 software tools for harnessing the power of the Windows 2000 network operating system to manage TCP/IP, networks, the registry, security, remote administration, configuration, batch files, and many other areas of the operating system.

These tools make working with the Windows 2000 platform even easier. Before using them, you must first install the Microsoft® Windows® 2000 Resource Kit on your computer.

Installing the Resource Kits

For installation instructions, see:

Installing the Windows 2000 Resource Kits

Finding the Tools You Need

The tools in the Resource Kit are listed in two different ways: by alphabetical order and by functional category.

For instructions on finding tools, see:

Finding the tools you need

Understanding Notation and Terminology Used in this Document

The following conventions for usage and notation are observed in this document:

Procedural conventions

Notational conventions

Terminology conventions

Tools Help assumes that you are already familiar with Windows 2000. For more general information about Windows 2000, including keyboard equivalents to menu and mouse actions, see the Windows 2000 online documentation.

Links to Other Files and Locations

In this documentation, some topics include links preceded by an icon that allow you to open the tool's help or documentation file or to run the tool. For these links to work properly, the Resource Kit tools must be installed on your computer. Links to tools that require further installation are preceded by explanatory notes.

Some of these links are to Internet sites and are preceded by a Internet icon. To use these links, you must have a World Wide Web browser (or in some cases an FTP client) installed on your computer and an Internet connection. Windows 2000 includes Microsoft Internet Explorer, which can connect to any World Wide Web or FTP link.

Links to popup glossary definitions are formatted in underlined dark green text. To copy or print a popup definition, select the popup text with the left mouse button, right-click the selected text, and on the menu that appears click Copy or Print. In the Print dialog box under Print Range, choose Selection.

More Information on the Windows 2000 Resource Kits

For updated information, tips, articles, and other information of interest to users of the Windows 2000 Resource Kits, visit:
Internet Windows 2000 Resource Kits Web Site

Other Internet sites related to the Windows 2000 Resource Kits are listed in:

Internet Resources

Sending Feedback on Resource Kits

Please send feedback, comments, or bug reports for these tools, or for any Resource Kit documentation, by electronic mail to rkinput@microsoft.com on the Internet. If you have an Internet e-mail connection, you can click the following icon or text to send mail now:

Internet rkinput@microsoft.com


Installing the Windows 2000 Resource Kits

Installing the Windows 2000 Resource Kit

  1. Insert the Windows 2000 Resource Kit companion CD into your CD-ROM drive.
  2. Follow the instructions that appear on your screen. For command-line and unattended installation information, see the Release Notes (readme.htm).
For a list of server-only tools, see Tools Included Only In Windows 2000 Server Resource Kit .

The Setup program installs the Resource Kit onto your hard disk. A typical installation requires approximately 65 MB of free disk space.

During setup you can select an installation directory. For the Server kit, the default installation directory is C:\Program Files\Resource Kit. For the Professional kit, the default installation directory is C:\Program Files\Resource Pro Kit.

For the Server kit, Setup creates a Windows 2000 Resource Kit folder on the Programs menu. For the Professional kit, Setup creates a Windows 2000 Professional Resource Kit folder on the Programs menu. In either case, this folder contains shortcuts to Resource Kit components, including Tools Help (this Help file), other online documentation, and Tools. The tools are organized in a customized folder with right-click menu items for the tools that launch the executable file and the help topic.

For More Information

For more details on Resource Kit installation, see the Release Notes (Readme.htm).


Finding the Tools You Need

The tools in the Windows 2000 Resource Kit are listed in two different ways: by alphabetical order and by functional category.

Finding Tools by Name

If you know the full name or executable file name of the tool you are looking for, you can look it up in the Alphabetical List. To open this list, click "Alphabetical List of Tools" on the Contents tab, or click the A-Z List button on the button bar. Hold the cursor over the name of a tool for a brief description.

You can also search for the name of the tool on the Index tab.

Finding Tools by Category

If you are looking for a particular type of tool, double-click one of the categories of tools on the Contents tab.


Procedural Conventions

  • Instructions for the mouse are written for the classic-style Windows desktop (the default configuration). If you have enabled Active Desktop, use a single mouse click when a double-click is called for.
  • Procedures describing how to perform a task are preceded by a triangular bullet one-step procedure for a single step or numbers for multiple steps.
Convention | Meaning
type | An instruction to "type" information means to press the key or keys and then press the ENTER key.
select | An instruction to "select" information means to highlight folders, file names, text boxes, menu bars, and options, or to select options in a dialog box.
choose | An instruction to "choose" something means to carry out a command from a menu or dialog box with mouse or keyboard actions.
+ | A PLUS SIGN (+) between two or more key names indicates that you must press the keys at the same time; for example, ALT+TAB.
, | A COMMA (,) between two or more key names indicates that you must press each key consecutively; for example, ALT, F, X.
Menu | Command (menus) | In referring to menu choices, Edit | Paste, for example, means to select the Edit menu and then choose the Paste command from it.
Note | Alerts you to supplementary information.
Caution | Alerts you to possible data loss, breaches of security, or other more serious problems.


Notational Conventions

Convention | Meaning
bold | Characters that you type exactly as shown, including commands and switches. Menu names and menu commands are also bold.
italic | Variables for which you supply a specific value. For example, Filename.ext represents any valid file name.
Initial Capitals
(Filename.ext) 		Names of files should begin with an initial capital letter, for example, Filename.ext. Paths and folders can be uppercase, lowercase, or mixed, according to how they actually appear in a standard installation of the application or the operating system.
ALL CAPITALS | Used for acronyms.
Monospace type
 Examples of code.
[ ] (square brackets) | In syntax descriptions, square brackets enclose optional items. If you include the item, type only the information between them, not the square brackets themselves.
{choice1 | choice2} (braces) | In syntax descriptions, braces enclose items which require a choice, such as {yes | no}. Type only one of the choices, not the braces or the dividing line.
Menu | Command (menus) | In referring to menu choices, Edit | Paste, for example, means to select the Edit menu and then choose the Paste command from it.


Terminology Conventions

Term | Meaning
MS-DOS | Microsoft® MS-DOS®
command prompt | The point on the MS-DOS screen where you enter commands, typically designated by "C:\>" (or other characters indicating the current drive and folder). To reach the command prompt in Microsoft® Windows® 2000, click Start, point to Programs, point to Accessories, then click Command Prompt. If you have an enhanced keyboard, press the Windows logo key then the R key. Type cmd and press the OK button.
command-line application -or- console-based application | An application designed to run under MS-DOS or in an MS-DOS window, and which cannot run in a Windows 2000 window.
Windows-based application -or- GUI application | An application that must run in a Windows 2000 window. All such applications follow similar conventions for the arrangement of menus, dialog box styles, and keyboard and mouse use.
%windir% | A Windows 2000 environment variable representing the folder in which the Windows 2000 operating system is installed.
CD_drive: | The drive letter for the CD-ROM drive, which might vary from computer to computer depending on what other hardware is installed.
tool -or- utility | Used synonymously to refer to application programs in Tools Help.


New Tools

The following tools are new for the Windows 2000 Resource Kit:

topic Addiag.exe: Application Deployment Diagnosis

topic Appsec.exe: Application Security

topic Atmarp.exe: Windows ATM ARP Server Information Tool

topic Atmlane.exe: Windows ATM LAN Emulation Client Information

topic Cachemov.exe: Offline Files Cache Mover

topic Cconnect.exe: Con-Current Connection Limiter

topic Ckymunge.dll: Cookie Munger

topic Cla.msc: Cybersafe Log Analyst

topic Clippool.exe

topic Clusrest.exe: Cluster Quorum Restore Utility

topic ClusterSentinel

topic Clustool.exe: Microsoft Cluster Tool

topic Confmgr.htm: IP Multicast Conference Management Tool

topic Copslpm.exe: Common Open Policy Service Local Policy Module

topic Cusrmgr.exe: Console User Manager

topic Delrp.exe: Delete File and Reparse Points

topic Dhcmp.exe: DH Compare

topic DHCP Objects (Dhcpobjs.exe)

topic Diskpar.exe: Disk Alignment Tool

topic Dmdiag.exe: Disk Manager Diagnostics

topic Drmapsrv.exe: Drive Share

topic Dsstore.exe: Directory Services Store

topic Dumpcfg.exe: Dump Configuration

topic Dumpfsmos.cmd: Dump FSMO Roles

topic Dupfinder.exe (Duplicate File Finder)

topic Dureg.exe: Registry Size Estimator

topic Efsinfo.exe: Encrypting File System Information

topic Elogdmp.exe: Event Log Query Tool

topic Enumprop.exe: Enumerate Properties

Expand.exe: File Expansion Utility

topic Exploration Air

topic Extract.exe: Extract Cabinet

topic Filespy.exe: File Spy

topic Gettype.exe

HTML Help Gp.chm: Windows 2000 Group Policy Reference

topic Gpolmig.exe: Group Policy Migration

topic Gpotool.exe: Group Policy Verification Tool

topic Gpresult.exe: Group Policy Results

topic Guid2obj.exe: GUID to Object

topic HTMLTextFilter.exe: HTML Text Filter

topic Httpcmd.exe: HTTP Command

topic Httpmon.exe: HTTP Monitoring Tool

topic Iasparse.exe: IAS Parse Tool

topic Ie5ntwa.exe: Internet Explorer Web Accessories

topic Ierk5.chm: Internet Explorer 5 Resource Kit

topic Ifilttst.exe: IFilter Test Suite

topic IIS Migration Support Documents

topic IIS Permissions Wizard Template Maker

topic Iishostsvc.exe: IIS Host Helper Service

topic Iisv5migrationutility_x86.exe: IIS Migration Wizard

topic Intfiltr.exe: Interrupt Filter

topic Internet Explorer Administration Kit

topic Internet Scanner

topic Inuse.exe: File-In-Use Replace Utility

topic Ipsecpol.exe

topic Javareg.exe: Java/COM Registration Utility

topic Kerbtray.exe (Kerberos Tray)

topic Klist.exe: Kerberos List

topic Lbridge.cmd: L-Bridge

topic Linkd.exe

topic List.exe

topic Lsreport.exe: Terminal Services Licensing Reporter

topic Lsview.exe: Terminal Services License Server Viewer

topic Mcast.exe

topic Mcopy.exe: Multiple Copy

topic Metaedit.exe: Metabase Editor

topic Moveuser.exe: Move Users

topic Mscep.dll: Certificate Enrollment Module for Routers

topic Msinfosetup.exe: Microsoft System Information Extensions

topic MSMQ Triggers

topic Mtc.exe: Multiple Tree Copy

topic Mtfcheck.exe: Microsoft Tape Format Verification Tool

topic Oidgen.exe: OID Generator

topic Perfcheck.dll: Performance Counter Check

topic Perfmon4.exe: Performance Monitor 4

topic Playback.exe

topic Prnadmin.dll: Printer Administration Objects

topic Ptree.exe: Process Tree

topic Qgrep.exe: Quick Grep

QSlice Quickres.exe: Quick Resolution Changer

topic Rassrvmon.exe: RAS Server Monitor

topic Rdpclip.exe: File Copy

topic Reducer.exe: Reduce Trace Data

topic Remapkey.exe: Remap Windows Keyboard Layout

topic Remote Administration Scripts

topic RPC Ping: RPC Connectivity Verification Tool

topic Rpcdump.exe: RPC Dump

topic Rsm_dbic.exe: Removeable Storage Integrity Checker

topic Rsm_dbutil.exe: Removeable Storage Database Utility

topic Rsmconfg.exe: Removable Storage Manual Configuration Wizard

topic Security Configuration IIS Templates

topic Sendfile.exe: SendFile Test Suite

topic Setspn.exe: Manipulate Service Principal Names for Accounts

topic Showperf.exe: Performance Data Block Dump Utility

topic Showpriv.exe: Show Privilege

Internet Support Online Web site

topic Svcacls.exe: Service ACL Editor

topic Sysprep.exe

topic Sysscansetup.exe: System Scanner

topic Takeown.exe

topic Tcmon.exe: Traffic Control Monitor

topic Terminal Server Capacity Planning Tools

topic Timestmp.sys: QoS Time Stamp

topic Tracedmp.exe: Trace Dump

topic Traceenable.exe

topic Tracelog.exe

topic Tru Access Manager Limited Edition

topic Tsreg.exe: Terminal Services Client Registry Editory

topic Tsver.exe: Terminal Services Version Limiter

topic Unattend.doc: Unattended Setup Parameters Guide

topic Uptime.exe

topic Vadump.exe: Virtual Address Dump

topic Vfi.exe: Visual File Information

topic W3Who.dll: Browser Client Context Viewer

topic Web Application Stress Tool

topic Where.exe: File Locator

topic Windows NT 4.0 OEM Support Tools

topic Winrpsdk15.doc: Windows Report Tool Deployment Software Development Kit

topic Wins.dll: WINS Replication Network Monitor Parser

topic Winsta.exe: WinStation Monitor

topic Wlbs_hb.dll and Wlbs_rc.dll: Windows Load Balancing Server Network Monitor Parsers

topic Wmloadsimulator.exe: Windows Media Load Simulator


Tools Included Only In Windows 2000 Server Resource Kit

The following tools are included in the Windows 2000 Server Resource Kit, but not the Windows 2000 Professional Resource Kit:

topic Appsec.exe: Application Security

topic Ckymunge.dll: Cookie Munger

topic Clusrest.exe: Cluster Quorum Restore Utility

topic Cluster Verification Utility

topic ClusterSentinel

topic Clustool.exe: Microsoft Cluster Tool

topic Copslpm.exe: Common Open Policy Service Local Policy Module

topic Drmapsrv.exe: Drive Share

topic Dsstore.exe: Directory Services Store

topic Exploration Air

topic Fcopy.exe: File Copy Utility for Message Queuing

topic HTMLTextFilter.exe: HTML Text Filter

topic Httpcmd.exe: HTTP Command

topic Httpmon.exe: HTTP Monitoring Tool

topic Iasparse.exe: IAS Parse Tool

topic Ifilttst.exe: IFilter Test Suite

topic IIS Migration Support Documents

topic IIS Permissions Wizard Template Maker

topic Iishostsvc.exe: IIS Host Helper Service

topic Intfiltr.exe: Interrupt Filter

topic Lsreport.exe: Terminal Services Licensing Reporter

topic Lsview.exe: Terminal Services License Server Viewer

topic Metaedit.exe: Metabase Editor

topic MSMQ Triggers

topic Netset.exe

topic Perfcheck.dll: Performance Counter Check

topic Playback.exe

topic Rassrvmon.exe: RAS Server Monitor

topic Rdpclip.exe: File Copy

topic Security Configuration IIS Templates

topic Sendfile.exe: SendFile Test Suite

topic Tcmon.exe: Traffic Control Monitor

topic Tru Access Manager Limited Edition

topic Terminal Server Capacity Planning Tools

topic Tsreg.exe: Terminal Services Client Registry Editor

topic Tsver.exe: Terminal Services Version Limiter

topic W3Who.dll: Browser Client Context Viewer

topic Web Application Stress Tool

topic Web Capacity Analysis Tool

topic Wins.dll: WINS Replication Network Monitor Parser

topic Winsta.exe: WinStation Monitor

topic Wlbs_hb.dll and Wlbs_rc.dll: Windows Load Balancing Server Network Monitor Parsers

topic Wmloadsimulator.exe: Windows Media Load Simulator


Tools Available in Windows 2000 Support Tools

Many of the following tools were included in previous Windows Resource Kits, but are now part of the Windows 2000 Support Tools, located on the Windows 2000 operating system CD-ROM in the \support directory. The Support Tools must be installed separately from the Windows 2000 operating system.

Each Support Tool is listed below by both its filename and its friendly name, if it has one, to facilitate finding the tool.

Tool | Description
Acldiag.exe: ACL Diagnostics | Outputs information on security attributes on Active Directory objects.
Active Directory Replication Monitor (Replmon.exe) | Displays replication topology, status and performance of Active Directory domain controllers.
Advanced Power Management Status (Apmstat.exe) | Determines a computer's ability to exploit power management features in Windows 2000.
ADSI Edit | Microsoft Management Console snap-in that acts as a low-level editor for Active Directory.
Apmstat.exe: Advanced Power Management Status | Determines a computer's ability to exploit power management features in Windows 2000.
Browstat.exe: Browser Status | General purpose network-browser diagnostic tool.
Clonepr.dll: ClonePrincipal | Creates clones of Windows NT 4.0 users and groups and migrates them to Windows 2000.
Depends.exe: Dependency Walker | Displays a hierarchical diagram of the dependent modules of an executable or DLL.
Dfsutil.exe: Distributed File System Utility | Helps administrators diagnose the Distributed File System from the command prompt.
DiskProbe (Dskprobe.exe) | Allows users with Administrator privileges to directly edit, save and copy data on the physical hard drive that is not accessible in any other way.
Distributed File System Utility (Dfsutil.exe) | Helps administrators diagnose the Distributed File System from the command prompt.
Dnscmd.exe: DNS Server Troubleshooting Tool | Enables user to administer and obtain statistics from local and remote DNS servers.
Dommig.doc: Planning Migration from Microsoft Windows NT to Microsoft Windows 2000 | Guides administrators through the planning process for migrating Windows NT domains to Windows 2000.
Dsacls.exe | Facilitates management of access-control lists for directory services.
Dsastat.exe: Active Directory Diagnostic Tool | Compares and detects differences between naming contexts on domain controllers.
Dskprobe.exe: DiskProbe | Allows users with Administrator privileges to directly edit, save and copy data on the physical hard drive that is not accessible in any other way.
Dumpchk.exe | Verifies that a memory dump file has been created correctly.
File and Directory Comparison (Windiff.exe) | Compares two text files or folders and displays differences.
Filever.exe | Displays version information on executable files.
Gflags.exe: Global Flags Editor | Allows user to edit NtGlobalFlag settings for the Windows 2000 operating system.
Kerberos Keytab Setup (Ktpass.exe) | Configures an account for a non-windows-based Kerberos service and generates a keytab.
Kerberos Setup (Ksetup.exe) | Configures a computer for using a non-windows-based Kerberos realm.
Kill.exe: Task Killing Utility | Allows user to terminate selected tasks or processes.
Ksetup.exe: Kerberos Setup | Configures a computer for using a non-windows-based Kerberos realm.
Ktpass.exe: Kerberos Keytab Setup | Configures an account for a non-windows-based Kerberos service and generates a keytab.
Ldp.exe: Active Directory Administration Tool | Allows users to perform LDAP operations against any LDAP compatible directory such as Active Directory.
Memsnap.exe: Memory Profiling Tool | Takes a snapshot of memory resources consumed by running processes.
Movetree.exe: Active Directory Object Manager | Moves an Organizational Unit from one domain tree to another.
Msicuu.exe: Windows Installer Cleanup Utility | Removes registry settings for applications installed with Windows Installer.
Msizap.exe: Windows Installer Zapper | Removes registry settings for applications installed with Windows Installer.
Netdiag.exe: Network Connectivity Tester | Tests the state and functionality of a network client.
Netdom.exe: Windows 2000 Domain Manager | Enables administrators to manage domains.
Network Connectivity Tester (Netdiag.exe) | Tests the state and functionality of a network client.
Nltest.exe | Administers and tests domains and user accounts.
Planning Migration from Microsoft Windows NT to Microsoft Windows 2000 (Dommig.doc) | Guides administrators through the planning process for migrating Windows NT domains to Windows 2000.
Pmon.exe: Process Resource Monitor | Shows per-process usage of CPU and memory.
Poolmon.exe | Monitors memory tags, including total paged and non-paged pool bytes.
PPTP Ping: Point-to-Point Tunneling Protocol Ping Utilities | Verifies that the required protocol and port for Point-to-Point Tunneling Protocol are being routed from a PPTP client to a PPTP server.
Process Resource Monitor (Pmon.exe) | Shows per-process usage of CPU and memory.
Pviewer.exe: Process Viewer | Displays information about a running process and allows you to stop it.
Reg.exe: Registry Management Utility | Manipulates registry entries on local or remote computers from the command prompt.
Remote.exe: Remote Command Line | Runs command-line programs on remote computers.
Repadmin.exe: Replication Diagnostics Tool | Assists administrators in diagnosing replication problems between Windows 2000 domain controllers.
Replmon.exe: Active Directory Replication Monitor | Displays replication topology, status and performance of Active Directory domain controllers.
Rsdiag.exe: Remote Storage Diagnostic Utility | Examines Remote Storage (HSM) databases and displays diagnostic information.
Rsdir.exe: Remote Storage File Information Utility | Examines Remote Storage reparse points and displays Remote Storage information for files.
Sdcheck.exe: Security Descriptor Check Utility | Displays the security descriptor for an object, including any inherited ACL's, as well as the security descriptor metadata.
Search.vbs | Performs a search against an LDAP (Lightweight Directory Access Protocol) server.
Security Administration Tools (SIDWalker) | Manages access-control policies.
Security Descriptor Check Utility (Sdcheck.exe) | Displays the security descriptor for an object, including any inherited ACL's, as well as the security descriptor metadata.
SIDWalker: Security Administration Tools | Manages access-control policies.
Snmputilg.exe: SNMP Troubleshooting Tool | Queries a Simple Network Management Protocol host or community for Management Information Base values from graphical user interface.
Task Killing Utility (Kill.exe) | Allows user to terminate selected tasks or processes.
Tlist.exe: Task List Viewer | Displays a list of IDs, names, and windows of processes running on the local computer.
W2000msgs.chm: Windows 2000 Error and Event Messages Help | Provides explanations of Windows 2000 error messages.
Windiff.exe: File and Directory Comparison | Compares two text files or folders and displays differences.
Windows 2000 Domain Manager (Netdom.exe) | Enables administrators to manage domains.
Windows 2000 Error and Event Messages Help (W2000msgs.chm) | Provides explanations of Windows 2000 error messages.
Windows Installer Cleanup Utility (Msicuu.exe) | Removes registry settings for applications installed with Windows Installer.
Windows Installer Zapper (Msizap.exe) | Removes registry settings for applications installed with Windows Installer.
Wsremote.exe: Winsock Remote Console | Starts a console application on the server and connects to it from the client using sockets or named pipes.


Legacy Tools

Several legacy tools that are no longer available in the Windows 2000 Resource Kits can still be obtained from the Resource Kit FTP site:

Internet ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/

These tools are not recommended or supported by Microsoft Corporation and are offered only on a "use at your own risk" basis.

Tool | Functionality
Aniedit.exe: Animated Cursor Creator | Creates and changes animated cursors by drawing and editing frames.
Breakftm.exe: Automated Mirror Break/Restore Utility | Breaks and reestablishes mirrored drives.
Creatals.exe | Sets permissions to create local aliases on domain servers.
EMWAC Server CGI Scripts | Outputs the result of a query to Microsoft® SQL Server™ to a Web server via CGI gateway scripting.
Imagedit.exe: Image Editor | Enables you to create and edit custom cursors and icons.
Topdesk.exe: Multiple Desktops | Creates multiple desktops and organizes applications on them.
Vdesk.exe | Switches between multiple desk tops and manages tasks by process ID.

Substitutes for Former Resource Kit Tools

The functionality of some other tools no longer in the Resource Kit and not on the FTP site is replaced by other tools included in the Windows 2000 Resource Kit or Windows 2000.

Former Resource Kit Tool | Replacement Tool | Functionality
Auditcat.hlp: Audit Categories Help | Ntevntlg.mdb: Windows 2000 Event Log Database (Resource Kit) | AuditCat displays information on seven categories of audit events in Event Viewer. This information is now included in Windows 2000 Event Log Database.
Scopy.exe: File Copy with Security | Xcopy.exe (operating system) | SCopy copies files and directories from NTFS partitions with their security intact, enabling you to back up security-sensitive data from your hard disk without using a tape drive. This can now be accomplished with XCopy.


Internet Resources

There are many Microsoft Internet sites that provide information and updates regarding Windows 2000, Windows NT, Windows 98, and the Windows 2000 Resource Kits.

If you have an Internet connection and a Web browser, you can click the following links to visit these sites.

Windows 2000 Resource Kits

Internet Windows 2000 Resource Kits Web Site

Windows Web Sites

Internet Windows 2000 Server

Internet Windows 2000 Server Deployment

Internet Windows Web Site

Internet Windows NT Server Web Site

Internet Windows NT 4.0 Workstation Web Site

Internet Microsoft Support Web Site

Internet Windows Hardware Compatibility List

Other Microsoft World Wide Web Sites of Interest

Internet Microsoft Knowledge Base Search

Internet Microsoft Internet Explorer Web Site

Internet Microsoft TechNet

Internet MSDN Online: Essential Resources for Developers

Internet Newsgroups

Updates to Tools on the Internet

As updated tools become available, they will be posted on the Internet Windows 2000 Resource Kits Web Site.

Microsoft Home Page

For any other information about Microsoft products, point your browser to:

Internet Microsoft Home Page


Disclaimer

Many of these tools were developed internally at Microsoft. These tools are provided "as is" without warranty of any kind. Use these tools at your own risk. Microsoft disclaims any implied warranty of merchantability and/or fitness for a particular purpose.

These tools are written and tested in English only. Using these tools with a non-English version of Windows 2000 might produce unpredictable results.


Copyright Information

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, people and events depicted herein are fictitious and no association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 1985-2000 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, Windows, Windows NT, Active Desktop, Active Directory, ActiveX, Win32, SQL Server, Visual Basic, Visual C++, and JScript are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries/regions.

Macintosh, Power Macintosh and QuickTime are registered trademarks and the Mac OS Logo and the QuickTime Logo are trademarks of Apple Computer, Inc. used under license.

The files for the Perl 5 scripting language and POSIX Utilities are the only files in this Help file covered by the GNU Library General Public License.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.


I want to deploy Windows 2000 on multiple computers

If you need to deploy Windows 2000 Professional or Server on large numbers of computers, the Windows 2000 Resource Kits contains useful tools for automating and customizing the setup process.

I want to automate multiple network installations

Setupmgr.exe: Setup Manager

Setup Manager simplifies installing and customizing multiple copies of Windows 2000 over a network. With it, you can customize installations by using different unattended answer files (Unattend.txt) and Uniqueness Database Files (UDFs).

Show me a brief overview of Setup Manager.

Sysdiff.exe: Automated Installation Tool

SysDiff enables you to pre-install applications as part of an automated setup.

Show me a brief overview of SysDiff.

For more information on SysDiff:

Sysprep.exe

SysPrep automates the cloning of a customized configuration of Windows 2000 to multiple computers.

Show me a brief overview of SysPrep.

Unattend.doc: Unattended Setup Parameters Guide

Unattend.doc describes how to install Windows 2000 in unattended setup mode, using an "answer file".

Show me a brief overview of Unattend.doc.

Deployment Tools

For other useful tools, see the Deployment Tools category in the table of contents of this help file.

I want background on the deployment process

For a guide to planning deployment and a conceptual overview of automating and customizing the installation process for Windows 2000:


I want to maintain disk information

If your computer crashes, or disk information becomes corrupted, you can more easily rebuild the disk or recover the data if you routinely back up data and maintain critical configuration information for your disks.

I want to view or print a report about the configuration of a hard disk on my computer

You can use DiskMap to print configuration reports from the command prompt.

Show me a brief overview of DiskMap.

I want to plan a Windows 2000 storage management strategy

For a guide to planning how to implement data storage in Windows 2000, see "Determining Windows 2000 Storage Management Strategies" in Windows 2000 Server Resource Kit Deployment Planning Guide.

I want to know what backups and configuration information I should be maintaining

For a conceptual overview of storage management and troubleshooting in Windows 2000, see "Disk Concepts and Troubleshooting" and "Data Storage and Management" under "Storage, File Systems, and Printing" in Windows 2000 Server Resource Kit Server Operations Guide.

Windows 2000 Operating System Resources

I want to save critical hard-disk information

Another useful disk management tool, Dskprobe.exe: DiskProbe, is included in the Windows 2000 Support Tools. DiskProbe is a sector editor that enables you to edit, save and copy data on the physical hard drive. With it, you can prepare for disk problems by saving critical disk structures before problems arise.

You can install the Support Tools from the \Support\Tools folder on the Windows 2000 operating system CD.

I want to create or update my Emergency Repair Disk

The Emergency Repair Disk (ERD) feature of Windows 2000 enables you to save information about your current system settings on a floppy disk and use this disk to repair your computer if system files are damaged or erased.

For information about the ERD and other system repair features of Windows 2000, see the "Repair overview" topic (indexed under "Emergency Repair Disk, overview") in the Windows 2000 online Help.


I want to set up and administer an Internet server

Microsoft® Windows® 2000 Server provides a powerful platform for any compatible Internet server software, and includes Microsoft® Internet Information Services (IIS). The Microsoft® Windows® 2000 Resource Kit provides background information and tools to help you set up and administer Internet servers and TCP/IP.

I want background on using Windows 2000 Server on the Internet

For a conceptual overview of working with Internet Information Server and Internet clients on Windows 2000 Server, see Windows 2000 Server Resource Kit Internetworking Guide and TCP/IP Core Networking Guide.

I want to set up a World Wide Web or intranet server or site

Internet Information Services (IIS) includes a World Wide Web server, a Gopher server, an FTP server, and an index server. With the World Wide Web server, you can create and administer Web sites on the World Wide Web or internal Webs (intranets). The index server component enables you to configure search pages for the Web site. IIS is installed with the Windows 2000 Server operating system.

The Windows 2000 Server Resource Kit Internet Information Services Guide provides background on and tools for working with IIS.

I want tools for using Windows 2000 Server on the Internet or for working with a TCP/IP intranet

The Resource Kit provides numerous tools that help you work with Internet Information Services, TCP/IP protocol, and Internet Explorer.

All of the tools in the Internet Information Services Tools category, the tools in the Internet Explorer Tools category, and numerous tools in the Network Management category can help you configure and manage your web server and TCP/IP intranet. To learn about these tools, in the Tools Help table of contents double-click "Internet Information Services Tools" "Internet Explorer Tools", or "Network Management Tools". Click any tool to see a brief overview of it.

Following are a few examples of IIS and Internet-related tools.

I want to migrate my Web server to IIS 5.0

The IIS Migration Wizard migrates third-party Web servers and settings to Windows 2000 Internet Information Services (IIS).

Show me the topic on IIS Migration Wizard.

I want to see IIS features demonstrated in a sample Web site.

Exploration Air is a Web site for a fictitious airline that demonstrates features of Internet Information Services 5.0 and the Microsoft Windows 2000 Server operating system.

Show me the topic on Exploration Air.

I want to test my Web server's performance, stability, and capacity.

The Internet Information Services Tools category contains many tools for testing and troubleshooting a Web server. These include the Web Application Stress Tool, a tool that simulates multiple browser hits on a Web site, and the Web Capacity Analysis Tool, a tool that tests client-server configurations.

Show me the topic on Web Application Stress Tool.

Show me the topic on Web Capacity Analysis Tool.

For more information about IIS, see the * Microsoft TechNet IIS Technology Center Web site.


I want to protect computing resources

If you need to protect hardware, software, or data from damage, theft, or unauthorized use or make it more accessible, the Windows 2000 Resource Kit offers tools and information to help you.

I want to plan security for a Windows 2000 network

If you are responsible for security planning, the Windows 2000 Resource Kit provides background information to help you evaluate your current security arrangements and plan to take advantage of new Windows 2000 security features. For example, the Kerberos v5 authentication protocol is integrated into Active Directory directory service and Encrypting File System (EFS) is part of the NTFS file system.

For detailed background information on Windows 2000 security planning, see "Planning Distributed Security" and "Planning Your Public Key Infrastructure" in Windows 2000 Server Resource Kit Deployment Planning Guide.

I want to learn about new security features of Windows 2000

For detailed background information on Windows 2000 authentication, access control, and encryption, see "Distributed Security" in Windows 2000 Server Resource Kit Distributed Systems Guide.

I want to implement and administer security on a Windows 2000 network

All of the tools in the Security Tools category and numerous tools in the Network Management and Diagnostic categories can help you configure and manage network and local security. To learn about these tools, in the Tools Help table of contents double-click "Security Tools" "Network Management Tools", or "Diagnostic Tools". Click any tool to see a brief overview of it.

Following are a few examples of security-related tools.

I want to monitor audit events on a computer

Auditpol.exe: AuditPol is a command-line tool that enables the user to modify the audit policy of the local computer or of any remote computer.

Show me a brief overview of AuditPol.

I want to use Encrypting File System

Efsinfo.exe: Encrypting File System Information is a command-line tool that displays information about files and folders encrypted with Encrypting File System (EFS) on NTFS partitions.

Show me a brief overview of EfsInfo.

I want to control backups to floppy disks

Floplock.exe: Lock Floppy Disk Drives locks a computer's floppy disks so that only members of the Administrators and PowerUsers groups can access them.

Show me a brief overview of FlopLock.

I want to configure Internet Protocol Security

Ipsecpol.exe: Internet Protocol Security Policies Tool is a command-line tool that configures Internet Protocol Security (IPSec) policies in the directory service, or in a local or remote registry.

Show me a brief overview of IpSecPol.

I want to see who has what permissions for files

Perms.exe: File Access Permissions per User displays users' access permissions for a specified file or set of files

Show me a brief overview of Perms.

Windows 2000 Operating System Resources

I want to back up security-sensitive data from NTFS partitions to floppy disks

Xcopy.exe, a command-line tool included with the Windows 2000 operating system, can copy files and directories from NTFS partitions with their security intact, enabling you to back up security-sensitive data from your hard disk without using a tape drive. Xcopy offers the functionality formerly found in Scopy.exe: File Copy with Security, a command-line tool that is no longer included in the Resource Kit.


I want to work with the Windows 2000 registry

The Windows 2000 registry is a central database in which the operating system stores configuration data in hierarchical form. Several tools in the Windows 2000 Resource Kit can help users, system administrators, and developers manage and manipulate the registry.

I want look up detailed information on registry entries

Regentry.chm: Technical Reference to the Windows 2000 Registry describes the keys, subkeys and value entries in the registry, including default values, syntax, valid ranges, and descriptions of registry data. While working in a registry editor, you can use this document to find details on specific entries and instructions on setting specific values.

To use the Technical Reference to the Windows 2000 Registry:

I want to perform other tasks with the registry

Several other tools in the Windows 2000 Resource Kit help you to work with the registry:

  • Delsrv.exe
  • Dureg.exe: Registry Size Estimator
  • Regback.exe: Registry Backup
  • Regdmp.exe
  • Regfind.exe
  • Regini.exe: Registry Change by Script
  • Regrest.exe: Registry Restoration
  • Scanreg.exe

Windows 2000 Operating System Resources

I want to work with the registry from the command-prompt

Another useful registry tool, Reg.exe: Registry Console Tool, is included in the Windows 2000 Support Tools. Reg.exe enables you to add, change, delete, search, save, and restore registry entries from the command prompt or a batch file.

Install the Support Tools from the \Support\Tools folder on the Windows 2000 operating system CD.

I want to edit the registry directly

The Windows 2000 operating system provides configuration and administrative programs that you can use to make most necessary changes in the registry, so most users should never need to edit it directly.

However, if you wish to view the registry or need to change a value that can only be set directly in the registry, you can use one of the two registry editors installed with Windows 2000:

  • Regedit.exe
  • Regedt32.exe

To start a registry editor, click Start, click Run, and then type the name of the editor in the Run box.

Caution-icon Caution

Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Microsoft Management Console or Control Panel whenever possible.

Tip-icon Tip

To avoid making inadvertent changes when viewing the registry, use Regedt32. From the Options menu, select Read Only Mode.

For information about the registry editors, see the online Help for Regedit.exe and Regedt32.exe.


I want to install or remove services

Installing a Service

The easiest way to add or remove a service, either on a local or remote computer, is to use the Srvinstw.exe: Service Installation Wizard, a Resource Kit tool.

To install a service manually on a local computer, follow these steps.

  1. Install the service's executable file as a service with Instsrv.exe: Service Installer, a Resource Kit tool. For example, to install Floplock.exe as the FloppyLock service, use the command-line syntax:
    instsrv FloppyLock "ResourceKitInstalledPath\floplock.exe"
  2. After installation, configure and start the service. Click Start, point to Programs, point to Administrative Tools, and click Computer Management. In the Computer Management snap-in console tree, click the Services and Applications node, then click the Services node.

    3. Note

    The Computer Management snap-in can be started from the command-line by typing compmgmt.msc.

  3. Select the service name you added in step 1.
  4. Right-click it and select Properties.
  5. In the General tab, set the Startup Type.
  6. In the Log On tab, select the account the service will use when running. Choose either the Local System account or enter another valid account and password. The type of logon required is determined by the application.

    7. Note

    If you need access to the screen and keyboard, you must choose Local System account and check the Allow Service to Interact with Desktop box. Note that a Local System account doesn't have network access. Otherwise, enter any valid account name and specify the correct logon password.

  7. Start the service. In the Services node, select the service name. Right-click on it and select Start.

Uninstalling a Service

The easiest way to add or remove a service, either on a local or remote computer, is to use the Srvinstw.exe: Service Installation Wizard, a Resource Kit tool.

To uninstall a service manually, follow these steps:

  1. Stop the service, if it is running. In the Services node, select the service name. Right-click it and select Stop.
  2. Uninstall the tool with Instsrv.exe: Service Installer, a Resource Kit tool. For example, to uninstall the FloppyLock service, use the command-line syntax:
    instsrv FloppyLock Remove


I want to use UNIX commands within Windows 2000

The following table shows a sampling of Windows 2000 and UNIX commands and tools which perform similar functions.

Note

This listing is intended to give you a starting place for locating similar functionality. Specific command functions and behavior may not match up exactly. Both UNIX and Windows 2000 command line tools can contain many switches. In addition, a command might behave differently depending on the flavor of UNIX on which it runs.

Italic: Indicates you will find this tool in the Services for UNIX product. This product includes a subset of the tools available from Mortice Kern System (MKS). Search for Services for UNIX at the Internet Windows 2000 Server Web site.
Bold: Indicated tool found in both Services for UNIX and either the Windows 2000 Resource Kit or the operating system.

UNIX | Windows | Windows location | Command Description
arp | arp | \winnt\system32\ntcmds.hlp | TCP/IP diagnostics: Displays and modifies the ARP cache (the IP address-to-hardware address translation table)
basename | basename | Services for Unix | Strip a directory and suffix from a file name.
cat | cat |  | Print one or more files to standard output.
cc | cc |  | Compile one or more C source files.
chgrp |  |  | Change the group ownership of a file.
chmod | chmod, perms (display perm. only), attrib | Services for Unix, operating system | Change the access mode of one or more files (rwx).
chown | chown | Services for Unix | Change the owner of a file.
compress/uncompress | compress/expand |  | Compact a file or files so that they are smaller.
cp cp -p | cp robocopy |  | Copy a file.
cron;crontab,at,batch | soon, at, Task Scheduler (GUI) | Operating system | Scheduler for kicking off processes, scripts or programs.
csh |  |  | Runs the C shell or runs a script of stored commands.
date | now |  | Displays the date. (Windows: the date command is used to change the date)
dd | ntbackup | Operating system | Backup
df | Click My Computer|Properties. |  | Reports total number of free disk blocks on all mounted file systems.
diff, sdiff,cmp, dircmp | windiff (GUI, Support Tools), fc, comp | Operating system | Compare the contents of files and/or directories.
du | diskuse, [GUI] open My Computer|Properties|General tab. | Disk usage. | diskuse,
echo | echo |  | Display text back to standard out.
edit | edit |  | Start a command line editor. Note Has a text GUI on Windows.
egrep | egrep | Services for Unix | Locate text within a file or files that match the specified regular expression. Doesn't support all regular expressions.
exportfs | net share |  |
fdisk | Disk Administrator |  |
fgrep | fgrep, find, Start|Search (GUI) | Services for Unix, operating system | Locate text within one or more files that match a literal, text string pattern. Does not support regular expressions.
file | exetype, filever (Support Tools), Windows Explorer: right-click application, then select quick view from menu. | Operating system, operating system (GUI) | Display the file type.
find | find, Start|Search | Services for Unix | Locate a file.
finger | finger | Operating system--\winnt\system32 | TCP/IP connectivity: Displays information about users. User information can be displayed for remote computers as well as for the local computer.
ftp | ftp | Operating system--\winnt\system32 | TCP/IP connectivity: Transfer a file between systems.
fsck | chkdsk | Operating system--\winnt\system32 |
grep | grep, findstr, find |  | Locate text within a file or files that match the specified regular expression.
groups | showgrps, findgrp, showmbrs |  | Display which groups a user belongs to.
head | head | Services for Unix | Display the first n lines of a file.
history | history | Services for Unix (sh) | Show the command history. (sh)
hostname | hostname | Operating system--\winnt\system32 | TCP/IP diagnostics: Displays the name of the local host.
ipconfig | ipconfig /all, getmac | Operating system--\winnt\system32 | TCP/IP diagnostics: Displays the TCP/IP configuration for each adapter specified and is used to release and renew DHCP IP address leases. Get the MAC address of a specific computer.
join |  |  | Joins the lines of two files.
kill | kill (Support Tools), rkill, wrkill (GUI), pviewer (GUI, Support Tools), Task Manager (GUI) | Operating system | Terminate a specified PID or job ID.
ksh | ksh | Services for Unix | Runs a Korn shell.
last | usrstat |  | ....
lint |  |  | A C program verifier.
list | list | Services for Unix | Create a list.
ln ln -s | ln Right-click object, select Create Shortcut. | Services for Unix | Creates a link to a file.
lp | lpr (for LPD-based printers), print file (text files), File|Print (GUI) |  | Print a file (System V).
lpq | lpq | operating system--\winnt\system32 | Lists the status of all the available printers on BSD UNIX.
lpr | lpr, print file (text files) | Operating system--\winnt\system32 | Prints a file (BSD).
lpstat |  |  | Lists status of all available printers System V systems.
ls | ls | Services for Unix | List the contents of a directory.
mkdir | mkdir | Services for Unix | Create a directory.
more | more | Services for Unix | Displays text one screen at a time.
mount | mountvol | Operating system |
mv | mv,move or rename | Services for Unix, operating system | Renames a file or moves it from one directory to another directory.
nbstat | nbstat | Operating system--\winnt\system32 | TCP/IP diagnostics: This is a diagnostic tool that displays protocol statistics and current TCP/IP connections using NBT (NetBIOS over TCP/IP).
netstat | netstat | Operating system--\winnt\system32 | TCP/IP diagnostics: Displays TCP/IP protocol statistics, current connections, and the local routing table.
nice | Task Manager (GUI), start |  | Change execution priority for command.
nslookup | nslookup |  | DNS: Query name servers. Resolve IP Addresses to Host Names. Resolve Host Name to IP Address(es). Returns Aliases as well as the Host's Fully Qualified Domain Name (FQDN).
perl | perl | Services for Unix | Run perl.
ping | ping | Operating system--\winnt\system32 | TCP/IP diagnostics: Determines whether a specific IP address is accessible. It works by sending a packet to the specified address and waiting for a reply.
ps | tlist (Support Tools), pstat, pmon (Support Tools), pulist |  | List processes.
pwd | cd (no arguments) |  | List the current directory.
quota | My Computer|Properties|Quota tab |  | Display the disk quota available to users.
rarp |  |  | TCP/IP diagnostics: How to get your own IP address, when all you know is your link address. Used to query a router table.
rcp | rcp | Operating system--\winnt\system32 | TCP/IP connectivity: Copies files between computer.
rexec | rexec | Operating system--\winnt\system32 | TCP/IP connectivity: The rexec and rexecd programs allow remote execution. Unlike rlogin, rsh, and rcp, rexecd does not use the trusted host mechanism.
rlogin | telnet | Services for Unix, operating system, Resource Kit | Connects the local host with a remote host
rm | rm, erase, del | Services for Unix, operating system | Delete a file.
rmdir | rmdir, rmdir | Services for Unix, operating system | Delete a directory.
route | route | Operating system--\winnt\system32 | TCP/IP diagnostics: Displays and modifies the local route table.
rsh | rshsvc |  | TCP/IP connectivity: Runs a command on another computer.
script | [scenario recorder in visual test is the only thing so far...] |  | Capture a record of a command session to a text file.
sed | sed | Services for Unix | Stream editor.
setenv | setx, set, My Computer|Properties|Advanced tab, select Environment Variables (GUI) |  | Set user environment variables.
sh | sh | Services for Unix | Runs the Bourne shell.
sort | sort, sort | Operating system--\winnt\system32 | Sort characters.
stop |  |  | Suspend the current background job or background job specified by job ID
su | su |  | Log on as a different user.
suspend |  |  | Suspend the current foreground job. (Often used with su.)
tail | tail | Services for Unix | Display the last n lines of a file.
tar |  |  | Consolidate files and directories into a single file.
tee | tee | Services for Unix | Duplicate stdin; send one copy to standard output and another copy to files.
telnet | telnet | Operating system--\winnt\system32 | TCP/IP connectivity: Provides a terminal emulation session.
top | pmon (Support Tools) |  | Display dynamic CPU statistics.
touch | touch |  | Update file access and modification times.
tracert | tracert | Operating system--\winnt\system32 | TCP/IP diagnostics: Traces the route followed to a destination showing how many hops the packet requires to reach the host and how long each hop takes.
uniq | uniq | Services for Unix | Prints the unique lines in a sorted file.
uptime | srvinfo -s, net statistics (in first few lines) |  | List how long system has been up.
vi | vi |  | Start the vi editor.
w |  |  | Print summaries of system usage. (Combination of uptime, who, and ps -a.)
wait |  |  | Wait for all background processes to complete, and report their termination status. Used in shell scripts.
wc | wc | Services for Unix | Count the number of words in a file.
who | srvinfo (services), srvcheck (valid shares), perfmtr |  | Display information about the current status of the system. (Current users, and so on.)
whoami | whoami |  | Print effective user name.


Appsec.exe: Application Security

Appsec.exe: Application Security NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

See the Windows 2000 Resource Kit Release Notes (Readme.htm) for important information on this tool.

The Application Security tool is a GUI-based application that allows an administrator in a multi-user environment to restrict the access of ordinary users to a predefined set of applications on the network. Enabling application security using this tool will cause the system to reject any attempts by ordinary users to execute a program that they are not authorized to use.

Microsoft® Windows® 2000 Group Policy contains a feature that restricts user access to applications by hiding the Start Menu and Desktop icons. AppSec increases security by restricting file execution, preventing the user from running an executable file even through the command line, or from within another application. The AppSec tool should be used in conjunction with the Group Policy restrictions, to both disable and hide restricted programs.

AppSec restricts the file based on the full path name. Only the named executable in the designated location can be run. This prevents users from running other versions of the same executable file from alternate locations.

The Application Security tool provides a simple GUI interface for adding and removing permitted applications to the list. It also offers a "Tracking" feature, which allows the administrator to track the executable files required for a permitted set of actions merely by performing those actions as a user would. This feature enables the administrator to discover applications which are being invoked from other applications (for example, Microsoft® Word invoked by Microsoft® Outlook® for editing of mail).

Scenario

AppSec is typically used to restrict access to users on a Terminal Services Application Server deployment. This allows important tools to be available on the computer, or accessible on the network, for administrators, while managing the actual applications a user can run.

One of the common usage scenarios of this tool for Windows 2000 is deploying a Terminal Server-enabled computer for use by Internet users. When Internet Connector licensing is enabled, all Terminal Server client logons are to the same user, TsInternetUser. The administrator will probably want to use this tool to custom configure this server so that the users coming over the Internet are not given the standard Windows 2000 interface, but are restricted to running a limited set of applications.

note-icon

Notes

  • The tool supports two security levels: Admin and non-admin. The Admin may always run any executable file even when AppSec security is enabled. All others will be restricted to only the allowed exe list.
  • The AppSec settings apply to the computer; there is no per user configuration.
  • When the Application Security tool is first enabled, users who are already logged to the Terminal Server before the AppSec.dll was loaded will not be affected, and will continue to be able to run applications not in the authorized list. In order to be restricted to the applications allowed by the tool, such users must first log off and log back on. This can be enforced by the administrator by stopping the session.
  • The tool only restricts applications invoked with the CreateProcess method. If a program is started using the NTCreateProcess method (which is rare), it can't be restricted using the Application Security Tool.
  • The Application Security tool can only be used to restrict 32-bit applications. By default when AppSec is enabled users are restricted from running any 16-bit applications. To allow users to run all 16-bit applications, the administrator can add ntvdm.exe to the authorized list of applications.
  • AppSec does no specific checking of the executable file; it restricts it only by name. If precautions are not taken, a malicious user could replace a valid executable file (for example: WinWord.exe) with a different file, renamed to WinWord. Windows 2000 Security must be used to prevent a user from replacing or renaming application files.
  • AppSec restricts only executable files, not DLLs.

Installing the Application Security Tool

The files required for the Application Security Tool are copied into the user-definable installation directory during Resource Kit setup. Before you use the tool, however, you must finish the installation with the following procedure.

To complete AppSec installation

  1. Install the Resource Kit.
  2. Open a command window, or click Start and then click Run.
  3. Type Instappsec.exe, and then press Enter.

Files Required

  • Appsec.exe
  • Appsec.hlp
  • Appsec.dll
  • Appsec.cnt
  • Instappsec.exe


Cachemov.exe: Offline Files Cache Mover

Cachemov.exe: Offline Files Cache Mover NEW

This GUI tool allows you to move your offline files cache to a different volume. By default it is created and remains on the root volume.

If space is becoming low on the root volume, you will want to move the cache to a different volume thus clearing space on the root volume and allowing Offline Files access to more disk space.

To run the program, decide onto which volume you wish to place your offline files cache. Make sure you have access to the volume and that there is free space on it. Then launch the program and select the volume from the list displayed. CacheMov will then proceed through the steps of moving the cache and setting up the necessary security on it.

Requirements and Cautions

  • You must be an Administrator to run this program.
  • You can only move the cache to a local fixed disk. You cannot place the cache on a network drive or a removable drive.
  • If you move the cache to a non-system drive and then do something to change the drive letters on the system, Offline Files may not work correctly.
  • It is a good idea to back up important files periodically. Although this tool has been tested thoroughly, further measures should be taken to protect your data from power failures and other contingencies.
  • It is best to keep the cache on an NTFS drive, so that non-administrators will not have access to the cache's internal files. However, Offline Files will function properly from a FAT or FAT32 volume as well.

Unattended Mode

To run CacheMov in unattended mode, use the following command line:

cachemov -unattend v:\

where v:\ is the volume to which you wish to move the cache.

All results are logged to the Application Event Log. The DLL is needed only for unattended setup, and must be in the same directory as the Cachemov.exe executable.

File Required

  • Cachemov.exe
  • Cchmvmsg.dll


Defptr.exe: Default Printer

Tool starts iconified in the system tray.

Using this tool, you can easily change your default printer, switching between available network or local printers.

Network printers tend to get busy at erratic intervals, which can require periodically switching the default to avoid "traffic jams." Default Printer allows you to toggle between available printers - local and network. The tool can be used for other purposes as well: for example, to switch printers while working in applications that support only the default printer.

Default Printer can be especially valuable for roaming users, allowing them to quickly select different default printers in different places for a docked notebook computer.

By default, Default Printer runs in status area mode. The icon is located in the status area, next to the clock on the right side of the Windows 2000 taskbar. To disable status area icon mode, run defptr -i.

File Required

  • Defptr.exe


Delprof.exe: User Profile Deletion Utility

DelProf tool deletes user profiles on computers running Microsoft® Windows® 2000.

On Windows 2000, user profiles can grow quite large (easily over a megabyte each), which takes up considerable disk space when several people are using one computer. With this tool, administrators can free up disk space on a computer when some users are no longer working on it.

User Profile Deletion Utility can run on a local or remote computer running any version of Windows 2000 or Microsoft® Windows NT® (but not Microsoft® Windows® 95 or Microsoft® Windows® 98, as the tool is Unicode-based).

Caution

This tool deletes everything in a user's profile, including settings, colors, and documents.

DelProf Topics

  • DelProf Syntax

File Required

  • Delprof.exe


DelProf Syntax

One Step delprof [/q] [/i] [/p] [/c:\\computername] [/d:days] [/?]

Where:

/q
runs DelProf in quiet mode, with no confirmation for each profile to be deleted.
/i
indicates that DelProf should ignore errors and continue deleting.
/p
prompts for confirmation before deleting each profile.
/c:\\computername
specifies a remote computer name on which to run DelProf.
/d:days
specifies the number of days of inactivity (days is an integer). profiles with longer inactivity will be deleted.
/?
displays command-line syntax


Delsrv.exe

This command-line tool unregisters a service with the Services Control Manager.

DelSrv Topics

  • DelSrv Syntax
  • DelSrv Examples

File Required

  • Delsrv.exe


DelSrv Syntax

One Step delsrv serviceName

Where:

serviceName
is the name of the service you want to unregister.


DelSrv Examples

List all services.

netsvc \\IMACOMPUTER /list
sc query type=service

Remove the filespy service.

delsrv filespy


Dureg.exe: Registry Size Estimator

Dureg.exe: Registry Size Estimator NEW

DuReg is a command-line tool that enables you to discover how much data is stored in the registry, or in any registry subtree, key or subkey. Additionally, the tool also enables you to search for all occurrences of a text string in the registry. This search can be limited to a specific subtree.

Note

DuReg counts data, not space. Because the space any data occupies varies with the storage method and amount of free space available, the size of data and size of space consumed are not equal. Also, because it measures data, DuReg does not account for fragmented free space in the registry.

The DuReg helps developers and administrators estimate how much space registry data is consuming. Developers can use this tool to discover how data they are contributing to the registry. Administrators can use this tool to investigate which applications are filling a registry when the registry approaches its maximum size.

The registry data size function is unique to each system. You can determine the maximum registry size and an estimate of the current registry size by using System in Control Panel. You can also find the current:maximum size ratio (expressed as a percentage) by using the System: % Registry Quota in Use counter in Perfmon\Sysmon. However, only DuReg returns the size of individual keys and subkeys.

DuReg Topics

  • DuReg Syntax
  • DuReg Example

File Required

  • Dureg.exe


DuReg Syntax

Registry Size Estimator Syntax

One Step dureg [{/cr | /cu | /u | /lm | /a}] [{/s | /d}] ["registry_path"] ["string to search"]

Where:

/a
finds the size of entire registry (all).
/cr "registry_path"
by default, returns the size of HKEY_CLASSES_ROOT. Include a registry path to find the size of any key within this subtree.
/cu "registry_path"
by default, returns the size of HKEY_CURRENT_USER. Include a registry path to find the size of any key within this subtree.
/lm "registry_path"
by default, returns the size of HKEY_LOCAL_MACHINE. Include a registry path to find the size of any key within this subtree. For example, dureg /lm "software\microsoft" finds the size of the HKLM\Software\Microsoft key
/u "registry_path"
by default, returns the size of HKEY_USERS. Include a registry path to find the size of any key within this subtree.
[/Subtree switch] "registry_path"
finds the size of any registry key.
/s "string"
searches for string in the registry, for example, dureg /s "video" finds all occurrences of "video" in the registry.

note-icon

Note

To stop a search, press CTRL+BREAK.

/s [/subtree switch] "string"
searches for string in the registry subtree, for example dureg /lm /s "video" finds all occurrences of "video" in HKLM.

note-icon

Note

To stop a search, press CTRL+BREAK.


DuReg Examples

  • To find the size of the registry.

    dureg /a

    Size of HKEY_CLASSES_ROOT   :    4139400
Size of HKEY_USERS          :     557562
Size of HKEY_LOCAL_MACHINE  :    8407113

    Total Registry data size:    13104075

  • To display all occurances of "Content Type" only in HKEY_CLASSES_ROOT.

    dureg /s /lm "Content Type"

HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/cdf\Extension : .cdf
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/fractals\Extension : .fif
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/hta\CLSID : {3050f4d8-98B5-11CF-BB82-00AA00BDCE0B}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/hta\Extension : .hta
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/mac-binhex40\Extension : .hqx
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/postscript\Extension : .ps
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/set-payment-initiation\Extension : .setpay
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/set-registration-initiation\Extension : .setreg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-cdf\Extension : .cdf
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-compress\Extension : .z
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-compressed\Extension : .tgz
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-gzip\Extension : .gz
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-internet-signup\Extension : .ins
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-iphone\Extension : .iii
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-latex\Extension : .latex
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-mix-transfer\Extension : .nix
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-mix-transfer\CLSID : {10000000-0000-0000-0000-000000000001}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-mplayer2\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-mplayer2\Extension : .asx
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-stuffit\Extension : .sit
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-tar\Extension : .tar
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-troff-man\Extension : .man
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-x509-ca-cert\Extension : .crt
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-zip-compressed\Extension : .zip
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/aiff\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/aiff\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/aiff\Extension : .aiff
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/basic\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/basic\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/basic\Extension : .au
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mid\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mid\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mid\Extension : .mid
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/midi\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/midi\Extension : .mid
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mpeg\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mpeg\Extension : .mp3
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/wav\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/wav\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/wav\Extension : .wav
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-aiff\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-aiff\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-aiff\Extension : .aiff
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-midi\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-midi\Extension : .mid
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-mpegurl\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-mpegurl\Extension : .m3u
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-pn-realaudio\Extension : .ra
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-wav\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-wav\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-wav\Extension : .wav
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/bmp\Extension : .bmp
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/bmp\Image Filter CLSID : {607fd4e8-0a03-11d1-ab1d-00c04fc9b304}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/bmp\Bits\0 : 2
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/gif\CLSID : {25336920-03F9-11cf-8FD0-00AA00686F13}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/gif\Extension : .gif
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/gif\Image Filter CLSID : {607fd4e8-0a03-11d1-ab1d-00c04fc9b304}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/gif\Bits\0 : 4
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/jpeg\CLSID : {25336920-03F9-11cf-8FD0-00AA00686F13}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/jpeg\Extension : .jpg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/jpeg\Image Filter CLSID : {607fd4e8-0a03-11d1-ab1d-00c04fc9b304}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/jpeg\Bits\0 : 2
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/pjpeg\CLSID : {25336920-03F9-11cf-8FD0-00AA00686F13}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/pjpeg\Extension : .jpg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/pjpeg\Image Filter CLSID : {607fd4e8-0a03-11d1-ab1d-00c04fc9b304}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/pjpeg\Bits\0 : 2
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/png\Image Filter CLSID : {A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/png\Bits\0 : 8
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/tiff\Extension : .tif
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/tiff\CLSID : {02B01C80-E03D-101A-B294-00DD010F2BF9}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/tiff\Image Filter CLSID : {EBD0F6B6-4AED-11D1-9CDB-00805F0C62F5}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/tiff\Bits\0 : 4
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/tiff\Bits\1 : 4
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/x-jg\CLSID : {25336920-03F9-11cf-8FD0-00AA00686F13}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/x-png\Image Filter CLSID : {A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/x-png\Bits\0 : 8
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/x-wmf\Image Filter CLSID : {607fd4e8-0a03-11d1-ab1d-00c04fc9b304}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/x-wmf\Bits\0 : 4
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/x-xbitmap\CLSID : {25336920-03F9-11cf-8FD0-00AA00686F13}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/x-xbitmap\Extension : .xbm
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/xbm\Extension : .xbm
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/xiff\Image Filter CLSID : {EBD0F6B6-4AED-11D1-9CDB-00805F0C62F5}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/xiff\Bits\0 : 12
HKEY_CLASSES_ROOT\MIME\Database\Content Type\image/xiff\Bits\1 : 12
HKEY_CLASSES_ROOT\MIME\Database\Content Type\message/rfc822\CLSID : {3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/css\Extension : .css
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/h323\Extension : .323
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/html\CLSID : {25336920-03F9-11cf-8FD0-00AA00686F13}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/html\Extension : .htm
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/html\Encoding : 8
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/iuls\Extension : .uls
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/plain\CLSID : {25336920-03F9-11cf-8FD0-00AA00686F13}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/plain\Extension : .txt
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/plain\Encoding : 7
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/scriptlet\CLSID : {21617250-A071-11D1-89B6-006008C3FBFC}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/scriptlet\Extension : .sct
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/webviewhtml\CLSID : {25336920-03F9-11CF-8FD0-00AA00686F13}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/webviewhtml\Extension : .htt
HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/x-scriptlet\CLSID : {AE24FDAE-03C6-11D1-8B76-0080C744F389}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/avi\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/avi\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/avi\Extension : .avi
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/mpeg\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/mpeg\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/mpeg\Extension : .mpeg
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/msvideo\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/msvideo\Extension : .avi
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/quicktime\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/quicktime\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/quicktime\Extension : .qt
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ivf\Extension : .IVF
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ivf\CLSID : {05589FA1-C356-11CE-BF01-00AA0055595A}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-la-asf\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-la-asf\Extension : .lsx
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-mpeg\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-mpeg\Extension : .mp2
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-mpeg2a\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-mpeg2a\Extension : .mp2
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-asf\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-asf\Extension : .asx
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-asf-plugin\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-asf-plugin\Extension : .asx
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-msvideo\CLSID : {22D6F312-B0F6-11D0-94AB-0080C74C7E95}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-msvideo\MPlayer2.BAK.CLSID : {05589fa1-c356-11ce-bf01-00aa0055595a}
HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-msvideo\Extension : .avi


Elogdmp.exe: Event Log Query Tool

Elogdmp.exe: Event Log Query Tool NEW

ElogDmp is a command-line tool that dumps information from a selected event log.

Using ElogDmp, you can display any of the following logs either locally or remotely: application, system and security. When used in conjunction with the FindStr.exe tool (in the %systemroot%\System32 directory), you can query for specific event log messages to display.

Any user on the network can use this tool to view the contents the application log on any remote computer on the network.

To view the contents of the system or security log on any remote computer you must be a Domain Administrator or be part of the local administrator's group on that computer.

ElogDmp Topics

  • ElogDmp Syntax

File Required

  • Elogdmp.exe


ElogDmp Syntax

One Step elogdmp [-?] computername eventlogtype

Where:

-?
displays command-line help.
computername
name of the computer to query.
eventlogtype
event log type to display: Application, Security or System


Instsrv.exe: Service Installer

Service Installer is a command-line tool that installs and uninstalls executable (.exe) services and assigns names to them.

To run Instsrv.exe, you must be part of the Administrators group.

By default, services added with this tool are not started. To start a service via the command-line, see the Service Controller Tool (SC).

A GUI application, Service Installation Wizard (Srvinstw.exe), is also available in the Windows 2000 Resource Kit. This wizard provides increased functionality and enables you to connect to and configure services on remote as well as local computers.

Service Installer Topics

  • Service Installer Syntax and Examples

File Required

  • Instsrv.exe


Service Installer Syntax and Examples

One Step instsrv ServiceName PathToExecuteable [-a AccountName] [-p AccountPassword] [ServiceName Remove]

Where:

ServiceName
is the name you want to assign to the service. This name will appear in listings such as those in the Services feature in Control Panel or in NetSvc/WinNetSvc.
PathToExecuteable
is the fully qualified path, including a drive letter, of the executable file for the service. The drive must be fixed and local.
ServiceName Remove
specifies the service you want to remove
-a AccountName
specifies the account the service will run under
-p AccountPassword
specifies the password for the account the service will run under

Examples

  • To install the service Srvany.exe as a service called MyService:
    instsrv MyService "PathToExecuteable\srvany.exe"
    note-icon

    Note

    By default, services are not "started" when they are installed. After using instsrv, some services also require that a registry entry be imported before they will run.

  • To install the service Srvany.exe as a service called MyService and have it run as a specific user:
    instsrv MyService "PathToExecuteable\srvany.exe -a MYDOMAIN\auser -p My1Password"
  • To uninstall the service MyService:
    instsrv MyService Remove
    note-icon

    Note

    Services must be stopped before removing them.


Intfiltr.exe: Interrupt Filter

Intfiltr.exe: Interrupt Filter NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

IntFiltr is a command-line tool used on multiprocessor systems to affinitize interrupts of disk or network adapters to one or more processors. Affinitizing interrupts to a processor can improve system performance by improving processor cache locality.

Using IntFiltr, you can direct a device's interrupts to a specific set of processors.

In a computer with multiple processors, Microsoft® Windows® 2000 sets (by default) the interrupt controller to direct a device's interrupts at any available processor. This means an interrupt will be serviced by the processor with the lowest priority, or IRQL.

By using Interrupt Filter, you can override the default behavior by selecting any set of processors as the target for the device's interrupts. Typically, this would involve choosing a single processor to be the target.

Interrupt filtering can affect the overall performance of the computer. No single algorithm produces the best performance under all possible workloads. This is why Windows 2000, by default, directs interrupts to any available processor. You, however, might be interested in experimenting with various configurations to find out which is optimal. This tool allows any configuration, even ones which are not optimal.

IntFiltr Topics

  • Installing IntFiltr
  • Using IntFiltr

Files Required

  • intfiltr.reg
  • intfiltr.exe


Installing IntFiltr

Before running IntFiltr, perform the following:
  • Copy intfiltr.sys to your <systemroot>\system32\drivers directory.
  • Run the following to update your registry:
    regedit intfiltr.reg


Using IntFiltr

Although all computer devices will appear in the Devices list, it only makes sense to install IntFiltr on top of devices that have interrupt resources. To see which devices have interrupt resources, you can go into Device Manager and select View -> Resources By Type.

  1. Run intfiltr.exe.
  2. Highlight a device in the Devices list box.
  3. Use the Add Filter and Remove Filter buttons to turn interrupt filtering on and off, respectively, for the selected device. When IntFiltr is installed on a device, the string "InterruptAffinityFilter" will appear in the Upper Filters list box.

Once configured, IntFilter runs in the background with no interaction until it is reconfigured.

  • To set the CPU-affinity for the selected device's interrupts, click the Set Mask button.
  • To remove a device's CPU-affinity mask from the registry, click the Delete Mask button.

Note

If no CPU-affinity mask exists for a device, installing IntFiltr on a device will have no useful effect.


Inuse.exe: File-In-Use Replace Utility

Inuse.exe: File-In-Use Replace Utility NEW

InUse is a command-line tool that performs on-the-fly replacement of files currently in use by the operating system. You must be a member of the Administrators group to use this tool.

InUse is primarily used to replace locked operating system files. After running the tool, the file specified is not replaced until the system is restarted. During restart, the system moves the file immediately after AUTOCHK is run, but before creating any paging files. This tool is useful for troubleshooting purposes, where you might need to replace an individual file on your computer instead of an entire set of files.

InUse Topics

  • InUse Syntax
  • InUse Examples

File Required

  • Inuse.exe


InUse Syntax

One Step inuse [-?] source destination [/y]

Where:

-?
Display command-line help.
source
Specifies the updated file name. Include the complete physical or UNC path name.
destination
Specifies the currently locked file you want to replace on the local drive. Include the complete physical path name.
/y
Suppresses the confirmation prompt to replace the file.


Javareg.exe: Java/COM Registration Utility

Javareg.exe: Java/COM Registration Utility NEW

This command-line tool registers Java classes as COM components in the registry. It performs functions similar to Regsvr32.exe, a tool included with the Microsoft® Windows 2000 operating system.

JavaReg Topics

  • JavaReg Syntax
  • JavaReg Examples

File Required

  • Javareg.exe

For More Information

VjReg, a similar tool that allows you to register multiple Java classes at once, is available at the Internet Microsoft SDK for Java section of the Microsoft Technologies for Java Web site.

News, technical information, related technologies, and SDKs for Java can be found by searching the Internet Microsoft Web site.


JavaReg Syntax

One Step javareg [{/register | /unregister} /class:JavaClass [/clsid:CLSID] [options]] [/?]

Where:

/register
registers the Java class specified by /class:JavaClass as a COM component in the registry with the optional class identifier specified in /clsid. If you use /register, you must specify at least /class as well, and you can also specify /clsid. Omitting /clsid forces JavaReg to create and register a CLSID.
JavaReg also recognizes /regserver for this command.
Example One
You can use /codebase, /control, and /typelib with /register to register a JavaBean object as a Microsoft® ActiveX® Control. If you use /control to register a JavaBean, you must also generate a type library using /typelib.
Example 4
/unregister
unregisters the Java class specified by /class:JavaClass. If you specify /unregister, you must also specify /class:JavaClass.
JavaReg also recognizes /unregserver for this command.
/class:JavaClass
specifies the class to be registered or unregistered with the class identifier provided in /clsid. If this option is specified, either /register or /unregister must also be specified. If no class identifier is provided, JavaReg generates a CLSID.
If you run JavaReg again with the same Java class name, the tool reuses the CLSID already assigned to the Java class. So to reconfigure the class, you can execute JavaReg with additional options later (for example, by specifying the /surrogate option).
/clsid:CLSID
specifies the class identifier CLSID to be registered with the class. Omitting this parameter forces JavaReg to create and register a CLSID.
Example Two
options
specifies one or more of the following options.
/codebase:[{Path | URL}]
specifies the base location, either a path to a directory name or a URL, that contains the Java class. This option can be used with /register as a part of registering a JavaBeans object as an ActiveX Control.
Example Four
/control
adds the necessary registry information for containers to treat the Java class as an ActiveX Control. This option can be used with /register as a part of registering a JavaBeans object as an ActiveX Control. If you use this option, you must also use /typelib.
Example Four
/nomktyplib
registers an existing typelib, specified in the file name argument of the /typelib option, without creating a new typelib.
/progid:ProgID
specifies a ProgID for the class being registered. By default, JavaReg does not assign a COM ProgID to your class. This option lets you designate what ProgID to use.
Example Three
/q
suppresses all message boxes (quiet mode). Regardless of whether this option is specified, JavaReg returns 0 (zero) on success and 1 (one) on failure.
/remote:RemoteServerName
activates the class on a remote server using Distributed Component Object Model (DCOM).
To activate and call a Java class on a different computer using DCOM, use /remote on the client computer. When using this option, the Java class cannot be activated on the client computer—only on the server. RemoteServerName can be any computer identifier supported by DCOM, typically, a NetBIOS name, a DNS name, or a decimal-dotted IP address.
Example Five
/surrogate
supports remote access to COM classes, writing the registry entries required to allow the Java class to be activated out-of-process (in a system-provided surrogate process). Use the /surrogate option when registering your Java class to run as a Distributed Component Object Model (DCOM) server. This is necessary if you want your Java class to be activated and called from a different computer.
If you do not specify the CLSID when using /surrogate, JavaReg generates one.
Example Five
/typelib:FileName
Generates a type library for a Java class at the location of the specified FileName. To register a typelib without generating a new one, use this option with /nomktyplib. This option can also be used with /register as a part of registering a JavaBeans object as an ActiveX Control.
Example Four
/?
displays command-line syntax in a dialog box.

Values Returned

JavaReg returns 0 (zero) on success and 1 (one) on failure.


JavaReg Examples

Example One

The following command line causes JavaReg to register the Java class Pager:

javareg /register /class:Pager

Because /clsid:CLSID is not specified, JavaReg generates a GUID to be used as the CLSID for the class (it uses the COM API CoCreateGUID).

If you run JavaReg again with the same Java class name, it reuses the CLSID already assigned to the Java class. So you can run the tool with additional options later to reconfigure the class (for example, by specifying the /surrogate option).

Example Two

The following command causes JavaReg to register the Java class Pager using the CLSID {2488D68A-D3BF-11D0-A145-080036006703}:

javareg /register /class:Pager /clsid:{2488D68A-D3BF-11D0-A145-080036006703}

Example Three

The following command causes JavaReg to register the Java class Pager and assign it the ProgID called Pager.Java.1 (by default, the tool does not assign a COM ProgID to your class).

javareg /register /class:Pager /progid:Pager.Java.1

Example Four

To register a JavaBean object as a Microsoft® ActiveX® Control, you can use /codebase, /control, and /typelib with /register. /codebase can be either a URL, as in this example, or a path to a directory name. If you use /control to register a JavaBean, you must also generate a type library using /typelib as shown in the following example:

javareg /register /class:Pager /codebase:http://www.reskit.com/java/trustlib /control /typelib:Pager.class

Example Five

To activate and call a Java class on a different computer using Distributed Component Object Model (DCOM), use /remote on the client computer. When using this option, the Java class cannot be activated on the client computer—only on the server. The following example explains the necessary steps for using this functionality.

  1. Write a Java class with some public members (for example, Pager.java).
    class Pager
{
   public boolean Page(String PhoneNumber, String PIN, String Msg)
   {
      System.out.println("Page request received. Sending.");
      System.out.println(" Phone: " + PhoneNumber);
      System.out.println(" PIN: " + PIN);
      System.out.println(" Message: " + Msg);
      return true;
   }
}
  2. Compile the Java source (into Pager.class, for example), and move the .class file to your trusted class library directory on the server (for example, C:\Winnt\Java\TrustLib\).
  3. On the server MyServer, run the following JavaReg command line (using the Pager example):
    javareg /register /class:Pager /progid:Pager.Java.1 /clsid:{2488D68A-D3BF-11D0-A145-080036006703} /surrogate
  4. On the client, run the following JavaReg command line (using the Pager example):
    javareg /register /class:Pager /progid:Pager.Java.1 /clsid:{2488D68A-D3BF-11D0-A145-080036006703} /remote:MyServer

Now you can use Microsoft® Visual Basic® to create an instance of Pager.Java.1. For example:

Dim x As Object
Set x = CreateObject("Pager.Java.1")
fSuccess = x.Page ("555-1212", "1234", "Call Home!")

The name of the remote server MyServer can be any computer identifier supported by DCOM, typically, a NetBIOS name, a DNS name, or a decimal-dotted IP address.

The Pager class will be activated and will run remotely on MyServer.


Netsvc.exe: Command-line Service Controller

You can use this tool to remotely start, stop, pause, continue, and query the status of services from the command line.

To use NetSvc, you need no special rights unless the owner of a computer has blocked out all users. To use the /stop or /start options, you must have an account on the target computer with privileges that allow starting or stopping services.

Command-Line Service Controller topics

  • NetSvc Syntax
  • NetSvc Notes

File Required

  • Netsvc.exe


NetSvc Syntax

One Step netsvc command servicename \\computername {/? | /help}

Where:

command
is one of the following. No servicename is required when you use the /list switch. All commands are case-insensitive.
/list
lists installed services. Omit servicename with this command.
/query
queries the status of a service.
/start
starts the specified service.
/stop
stops the specified service.
/pause
pauses the specified service.
/continue
restarts a paused service.
servicename
is the name of the service you want to control. You can enter either the service name, as defined in the registry, or the display name, as shown when you double-click the Services icon in Control Panel. If the service name has embedded spaces, place quotes around it. You can get a list of installed services by running netsvc /list computername
\\computername
is the name of the computer whose services you want to control. You must specify a computer.
/? or /help
displays this syntax at the command prompt. You can also display the syntax screen by typing netsvc without arguments.

Note

Arguments can be specified in any order.

Examples

netsvc /list \\joes486
netsvc /query \\anniep "Network DDE"
netsvc server \\joes486 /query
netsvc alerter \\joes486 /pause
netsvc "Clipbook Server" \\popcorn /stop


NetSvc Notes

Not all services (such as the Workstation service) can be stopped directly, although you can query them. If the user has a lot of active connections, you cannot force the service to shut down remotely, although you can pause or query it. Other services have other services that are dependent on them; trying to shut down such services will fail unless the dependent services are shut down first.

For example, the ClipBook Server requires the Network DDE Service; so you cannot shut down Network DDE without first shutting down ClipBook Server. This is true even with net stop.

Therefore, you must be familiar with the services you are shutting down.

If you try to stop an unstoppable service, netsvc simply reports that the service is running. For example:

netsvc /stop \\computer TargetService

Reply:

Service is running

This indicates that the service rejected the request to stop. It is impossible for netsvc to know why the service refuses to be stopped, since the reason varies from service to service.

Likewise, some services cannot be paused or continued, because pause or continue logic is not included in the service program. If you try to pause a nonpausable service, netsvc reports that the "Service is running" immediately afterwards.


Now.exe

Now displays the current date and time on STDOUT, followed by any command-line arguments you add.

Now is similar to the MS-DOS ECHO command, but with a timestamp. The tool is useful for logging times from .bat or .cmd files in order to track progress.

Now Topics

  • Now Syntax

File Required

  • Now.exe


Now Syntax

One Step now [message] [/?]

Where:

message

specifies the message you wish to display.

/?

displays usage instructions.

For example, typing:

now Download Completed.

elicits this reply:

Tue Aug 01 00:57:26 1995 Download Completed.


Pathman.exe

This command-line tool enables you to add or remove components of both the system and user paths. It can modify any number of paths in a single call and includes error checking that can handle path abnormalities such as repeated entries, adjacent semicolons, and missing entries.

Windows 2000 manages two different types of paths; the current user's path and the system path. Windows 2000 keeps a separate user path for every user on a system, but there is only one global system path. When a user logs on to a computer running Windows 2000, these two paths are combined to create the user's full path. For backward compatibility, Windows 2000 also loads path information from old Autoexec.bat files left in the root directory.

A user who is not an Administrator can modify their own user path. But in order to modify the system path, the user of PathMan must have Administrator privileges. PathMan does not manage information contained in old Autoexec.bat files.

Files Required

  • Pathman.exe
  • Pathman.doc


Ptree.exe: Process Tree

Ptree.exe: Process Tree NEW

Process Tree allows you to query the process inheritance tree and kill processes on local or remote computers.

By default, local Administrators, Power Users, and Users can query the tree, but only local Administrators and Power Users can kill processes.

The tool consists of a kernel-mode driver (Ptreedrv.sys), a Microsoft® Windows® 2000 service (Ptreesvc.exe and Ptreesvcps.dll), a COM+ server (Ptreesvr.dll), a console client (Ptree.exe), and a GUI client (Ptreeg.exe). Ptreeg.exe allows you to manage the process inheritance tree on multiple computers simultaneously.

Note

You can change the security settings of Process Tree by using Component Services in Administrative Tools at any time, because Process Tree uses COM+ role-based security.

Installation

Process Tree requires Windows 2000. Before using this tool, you must install it on your computer in a separate procedure after installing the Windows 2000 Resource Kit.

To Install Process Tree

  1. Run Ptree.msi from the \ptree sub-directory of the Windows 2000 Resource Kit installation directory.
    Ptree.msi installs Ptree.exe and Ptreeg.exe by default to the Windows 2000 Resource Kit installation directory.
    It also installs Ptreesvc.exe, Ptreesvcps.dll, and Ptreesvr.dll to the %windir%\system32 folder and Ptreedrv.sys to the %windir%\system32\drivers folder.
  2. Log off and re-logon to reset the Ptree service.

To Uninstall Process Tree

one step Use Add/Remove Programs in Control Panel to uninstall Process Tree.

Process Tree Syntax

one step ptree [-c computer_name] [{-k | -kt} process] [{-? | /?}]

Where:

ptree run without arguments
shows the process tree on the local computer.
-c computer_name
specifies the name of the remote computer on which to show the process tree.
-k
kills process.
-kt
kills process and its sub-process tree.
process
specifies the process name or process ID (PID) to be killed by -k or -kt.
{-? | /?}
shows the command-line usage.

Files Required

Ptree.msi is installed by the Resource Kit Setup program in the Resource Kit\ptree sub-folder. Running Ptree.msi installs the following files by default into the Resource Kit installation directory:

  • Ptree.exe
  • Ptreeg.exe

Ptree.msi also installs the following files into the %windir%\system32\ folder:

  • Ptreesvc.exe
  • Ptreesvcps.dll
  • Ptreesvr.dll
  • drivers\Ptreedrv.sys


Pulist.exe

This command-line tool displays processes running on local or remote computers. PuList works much like TList (a Support Tool on the Windows 2000 CD), but also lists the user name associated with each process on a local computer.

A local computer is specified by running the tool with no command-line arguments. In this case, PuList displays the process name and ID of each process running on the system, and also attempts to obtain the user name associated with each. This is useful if multiple processes are running on the system in different security contexts—PuList provides a mechanism for differentiating such processes.

note-icon

Note

The ability to obtain the user name from each process is dependent on whether the caller has sufficient access to the access token in each process. For best results, run PuList from an Administrator account or from the Local System account (running under a service running as Local System).

Remote computers are targeted by specifying one or more computer names on the command line. PuList displays the computer name followed by a list of running processes. If an error occurs when querying process information, the error string is displayed instead of the process information.

PuList can be used by network administrators to determine what processes are running on servers and workstations on a network. Furthermore, batch-file developers can redirect the output of the tool to a file and leverage this information in useful ways.

For example, if you know the name of the executable file you're looking for, for example Notepad.exe, the following command line will help narrow your results. Grep is a POSIX utility not installed by default by Windows 2000 Resource Kit Setup.

pulist | grep notepad

PuList Topics

  • PuList Syntax and Output

File Required

  • Pulist.exe


PuList Syntax and Output

PuList Syntax

One Step pulist [\\Server] [\\Server] ...

Where:

pulist
without arguments, displays the names and IDs all the processes running on the local computer, and attempts to display the user name associated with each process.
\\Server
specifies a remote computer or computers to query. PuList displays the computer name followed by the names and IDs of processes running on it.
More than one computer may be specified in the same command line. In this case, PuList displays the lists for each computer sequentially.

PuList Output

C:\>pulist

Process           PID  User
Idle              0
System            8
smss.exe          156  NT AUTHORITY\SYSTEM
csrss.exe         176  NT AUTHORITY\SYSTEM
winlogon.exe      172  NT AUTHORITY\SYSTEM
services.exe      228  NT AUTHORITY\SYSTEM
lsass.exe         240  NT AUTHORITY\SYSTEM
svchost.exe       428  NT AUTHORITY\SYSTEM
spoolsv.exe       452  NT AUTHORITY\SYSTEM
msdtc.exe         480  NT AUTHORITY\SYSTEM
tcpsvcs.exe       604  NT AUTHORITY\SYSTEM
svchost.exe       620  NT AUTHORITY\SYSTEM
llssrv.exe        644  NT AUTHORITY\SYSTEM
nspmon.exe        712  USER1-COMPUTER1\NetShowServices
nscm.exe          724  USER1-COMPUTER1\NetShowServices
regsvc.exe        772  NT AUTHORITY\SYSTEM
RsFsa.exe         812  NT AUTHORITY\SYSTEM
MSTask.exe        896  NT AUTHORITY\SYSTEM
snmp.exe          940  NT AUTHORITY\SYSTEM
suss.exe          996  NT AUTHORITY\SYSTEM
termsrv.exe       1024 NT AUTHORITY\SYSTEM
Dfssvc.exe        1096 NT AUTHORITY\SYSTEM
dns.exe           1112 NT AUTHORITY\SYSTEM
inetinfo.exe      1128 NT AUTHORITY\SYSTEM
mqsvc.exe         1168 NT AUTHORITY\SYSTEM
nspm.exe          1248 USER1-COMPUTER1\NetShowServices
nsum.exe          1384 USER1-COMPUTER1\NetShowServices
RsSub.exe         1512 NT AUTHORITY\SYSTEM
RsEng.exe         1624 NT AUTHORITY\SYSTEM
svchost.exe       1844 NT AUTHORITY\SYSTEM
Explorer.exe      212  USER1-COMPUTER1\Administrator
hh.exe            840  USER1-COMPUTER1\Administrator
msiexec.exe       1888 NT AUTHORITY\SYSTEM
WinMgmt.exe       1404 NT AUTHORITY\SYSTEM
hh.exe            2180 USER1-COMPUTER1\Administrator
mdm.exe           1332 USER1-COMPUTER1\Administrator
IEXPLORE.EXE      1852 USER1-COMPUTER1\Administrator
cmd.exe           2088 USER1-COMPUTER1\Administrator
mmc.exe           1180 USER1-COMPUTER1\Administrator
rpingc.exe        2192 USER1-COMPUTER1\Administrator
pulist.exe        1936 USER1-COMPUTER1\Administrator


Reducer.exe: Reduce Trace Data

Reducer.exe: Reduce Trace Data NEW

Reducer is an event tracing command-line tool that processes TraceLog trace log files to create per process, per thread workload profile.

Use Reducer for further analysis of the data obtained through tracing. TraceDump produces a summary of the trace logs. Reducer allows you to break down tracing to obtain more detailed information such as:

  • Transaction statistics
  • Image statistics
  • Disk information

Reducer Topics

  • Reducer Syntax
  • Reducer Examples

Files Required

  • Reducer.exe
  • Tracelib.dll
  • Mofdata.guid


Reducer Syntax

One Step reducer -out filename | [-h | -help | -?]

Where:

-out filename
is the output file name. Default is Workload.txt. Contains a complete breakdown of the various events during a particular tracing period. It contains the following information:
Transaction Statistics (for example: DsDirSearch)
  • Response time
  • Number of transactions per second (transaction rate)
  • Disk reads/writes per transaction
  • Network traffic (data sent/received) per transaction
  • CPU utilization (includes kernel and user space)
Image Statistics (for example: Lsass.exe)
  • Transactions involved with each process
  • Threads associated with each process
  • CPU utilization (both kernel and user) per process
  • Disk reads/writes per process Network traffic (data sent/received) per process
Disk Statistics
  • Total disk reads/writes
  • Disk reads/writes per process

Note

Other disk information can obtained from the transaction/image statistics described above.
-h, -help, -?
either of these displays command-line help.


Reducer Examples

Take the traces from both the kernel_log.etl and ds_log.etl files, and combine them to produce the final results in the my_workload.txt file. This assumes that kernel_log.etl and ds_log.etl files have been produced using the tracelog tool.

Reducer –out my_workload.txt c:\kernel_log.etl c:\ds_log.etl


Regback.exe: Registry Backup

Registry Backup (RegBack) is a tool for backing up the Microsoft® Windows® 2000 registry to files without use of a tape drive. RegBack allows you to back up registry hives while the system is running and has the hive files open.

Note

In Windows 2000, you can use Ntbackup.exe to back up the Active Directory™ directory service.

It will back up your registry so that, in case of problems with configuration, you can restore it and try again. In general, as with any critical data, it is a good idea to back up your registry often, especially before you install and test applications whose stability might be unknown.

To use RegBack, you must be logged on as a member of a group that has "Backup files and folders" privileges. RegBack uses the Win32 ReplaceKey function.

Note RegBack won't write over registry files it has previously written. See "RegBack Notes" for more information.

To restore a backup made with RegBack, use the Regrest.exe: Registry Restoration tool.

After any change in the configuration of the operating system, including adding new software, you should use the Repair Disk program, Rdisk.exe, to update files in the <systemroot>\Repair folder, and create a new Emergency Repair Disk.

By default, Rdisk does not back up all of the registry. Rdisk is intended as a last resort for making a system startable, but not necessarily as it was. If you want Rdisk to back up the entire registry, including the DEFAULT, SAM and SECURITY files, you must use the /s switch, running rdisk /s.

RegBack Topics

  • RegBack Syntax
  • Backing Up All Registry Files in the \Config Folder
  • Manually Backing Up a Hive to a Named File
  • Regular Registry Backup on Multiple Computers
  • RegBack Notes
  • RegBack Error Levels
  • RegBack Examples

File Required

  • Regback.exe


RegBack Syntax

One Step regback [destination_dir] [filename hivetype hivename]

For command-line help, type: regback | more or regback /?

After using RegBack, examine the output to make sure that the backup did what you wanted.

Note

Changes only take effect only after the system is restarted.

Where:

destination_dir
location of the backup files. May be on a share.
filename
name of the backup file to be created.
hivetype
either machine or users. Will fail if the hivetype isn't machine or users.
hivename
name of an immediate subtree of HKEY_LOCAL_MACHINE or HKEY_LOCAL_USERS. Will fail if hivename isn't a hive root.


Regback: Backing up all Registry files in the \Config Folder

Backing Up All Registry Files in the \Config Folder

regback DestinationFolder

For example: regback c:\monday.bku saves all hives in the Monday.bku folder. A warning appears if there are hives that must be backed up manually or if there are errors.


Manually Backing Up a Hive to a Named File

regback filename hivetype hivename

Where:

filename
is the name of the backup file to be created.
hivetype
is either machine or users. Will fail if the hivetype isn't machine or users.
hivename
is the name of an immediate subtree of HKEY_LOCAL_MACHINE or HKEY_LOCAL_USERS. Will fail if hivename isn't a hive root.

For example:

regback c:\backuphive\system machine system

regback c:\savedir\prof users s-1-0000-0000-1234


Regular Registry Backup on Multiple Computers

Using RegBack in a batch file and a Windows scheduling service, you can automate registry hive backups. You can schedule this batch file to run with the AT service or Task Scheduler.

Note

Make sure the account used to run the batch file has access privliges to the network and the network share. The default System account does not.

The following example batch file assumes that you are backing up to a network share that has already been set up, and that you have the approriate priviliges to get to this share. Because RegBack doesn't overwrite files, they must be deleted before the new ones are added.

echo on
rem ...  name:    doback.bat
rem .... Purpose: Network backup for Registry files
rem ...  Process: Connect to backup share, delete old backup files, copy over new backup files
rem ...  Before using this batch file, create a share containing the following directories: backup, config. Set permissions on this share so that the appropriate user can run this script.

net use \\myshare\backup

rem -->  delete old backups; regback will not copy over an existing file
echo y|del \\myshare\backup\*.*
echo y|del \\myshare\backup\config\*.*

regback \\myshare\backup

rem --> add any items that need to be manually backed up
copy %WINDIR%\Config \\myshare\backup\config

net use \\myshare\backup /delete

Note

RegBack cannot back up files onto a target folder that already contains files with the same names. So be sure to delete all files in the target folder before you attempt a backup.

Also, remember that RegBack does not back up hives that aren't in active use. You must use the Copy or XCopy command to back up unused hive files, such as unused user profiles.


RegBack Notes

  • RegBack and RegRest save and reload the entire registry hive, including access control lists. So it's possible to restore a hive and find that you have different ACLs than before.
  • RegBack does not automatically back up files that are not in the CONFIG folder, such as user profiles. However, you can back up these files manually. This avoids name conflicts.
  • RegBack does not copy the files in the CONFIG folder that are not currently kept open by the registry. Use Xcopy.exe or Scopy.exe to save inactive hives.
  • RegBack only backs up active hives. For hives that are not loaded, you can just copy the files.
  • RegBack will stop at the first bug, except for manual hives.
  • RegBack will not overwrite existing files; instead, it reports an error.
  • RegBack fails if the hive files don't all fit on the target, so often it's best to use RegBack to back up hives to a hard disk folder and then use Backup.exe, or use Xcopy.exe or Scopy.exe to save the backed-up hives on floppy disks.
  • If you have a tape drive, use the Windows Backup program instead. Start Backup by double-clicking its icon in the Administrative Tools program group.


RegBack Error Levels

The error on exit will be:

  • 0 if the procedure was successful
  • 1 if a hive that requires manual backup or restoration was encountered
  • 2 for all other errors


RegBack Examples

Backup Up All Active Hives

This example backs up to a local drive; you can just as easily back up to a tape drive or network share. A warning appears if there are hives that must be backed up manually or if there are errors.

c:\> regback c:\backup

saving SECURITY to c:\backup\SECURITY
saving SOFTWARE to c:\backup\software
saving SYSTEM to c:\backup\system
saving .DEFAULT to c:\backup\default
saving SAM to c:\backup\SAM

***Hive = \REGISTRY\USER\S-1-5-21-2127521184-1604012920-1887927527-67705
Stored in file \Device\Volume1\WINNT\Profiles\a-lolag\NTUSER.DAT
Must be backed up manually
regback (filename you choose>) users S-1-5-21-2127521184-1604012920-1887927527-67705

***Hive = \REGISTRY\USER\S-1-5-21-2127521184-1604012920-1887927527-67705_Classes
Stored in file \Device\Volume1\WINNT\Profiles\a-lolag\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
Must be backed up manually
regback (filename you choose) users S-1-5-21-2127521184-1604012920-1887927527-67705_Classes

Manually Backing Up Hives

User profiles are not automatically backed up. In this example, a user profile (identified in the previous example) is backed up. In addition, the newly-created backup file in the directory where it was created is shown.

c:\> regback c:\backup\user1.bku users S-1-5-21-2127521184-1604012920-1887927527-67705

saving S-1-5-21-2127521184-1604012920-1887927527-67705 to c:\backup\user1.bku

C:\>dir /b \backup

config
default
SAM
SECURITY
software
system
user1.bku

Network Backup: A Sample Batch Script

Using RegBack in a batch file and a Windows scheduling service, you can automate registry hive back ups. You can schedule this batch file to run with the AT service or Task Scheduler.

note-icon

Note

When scheduling this batch, specify an account which has access privileges to the network share. The default System account does not.

The following example batch file assumes you are backing up to a network share that has already been set up, and that you have appropriate privileges to get to this share.

RegBack cannot back up files onto a target folder that already contains files with the same names. Delete all files in the target folder before you attempt a backup. RegBack doesn't back up inactive hives, such as unused user profiles. To back up these hives, use the Copy or XCopy commands.

echo on
rem ...  Name:    doback.bat
rem ...  Purpose: Network backup for Registry files
rem ...  Process: Connect to backup share, delete old backup files, copy over new backup files
rem ...  Before using this batch file, create a share containing the following directories: backup, config. Set permissions on this share so that appropriate users can run this script.

net use \\myshare\backup

rem -->  delete old backups; regback will not copy over an existing file
echo y|del \\myshare\backup\*.*
echo y|del \\myshare\backup\config\*.*

regback \\myshare\backup
regback \\myshare\backup\usr1_ntusr.bku users S-1-5-21-2127521184-1604012920-1887927527-67705
regback \\myshare\backup\usr1_usercls.bku users S-1-5-21-2127521184-1604012920-1887927527-67705_Classes
rem --> add any items that need to be manually backed up
copy %WINDIR%\Config \\myshare\backup\config

net use \\myshare\backup /delete


Regdmp.exe

This command-line tool writes all or part of the Windows 2000 registry to the standard output (STDOUT). This output is displayed on the screen by default, but can also be redirected to a file. The output format is suitable for input to Regini.exe, another Windows 2000 Resource Kit tool.

RegDmp provides the following general information:

  • User name and domain membership.
  • Profile information (local versus roaming).
  • Security group membership.

The tool also provides the following Group Policy information:

  • The last time policy was applied for both the user and the computer.
  • The complete list of applied Group Policy objects and their details including a summary of the extensions that each Group Policy object contains.
  • Registry settings that were applied and their details.
  • Redirected folders that are and their details.

Restrictions

To access some parts of the registry, you must be a member of the Administrators group.

RegDmp Topics

  • RegDmp Syntax
  • RegDmp Output
  • Interesting Configuration Management Registry Keys

File Required

  • Regdmp.exe


RegDmp Syntax

One Step regdmp [{-m \\ComputerName | -h HiveFile HiveRoot | -w Win95Directory}] [-i n] [-o OutputWidth] [-s] [RegistryPath]

Where:

-m \\ComputerName
specifies a remote Windows 2000 computer (machine) whose registry is to be manipulated.
-h HiveFile HiveRoot
specifies a local hive to manipulate.
-w Win95Directory
specifies the paths to Windows 95 system.dat and user.dat files.
-i n
specifies the display indentation multiple. Default is 4.
-o OutputWidth
specifies how wide the output is to be. By default OutputWidth is set to the width of the console window, if standard output (STDOUT) has not been redirected to a file. In the latter case, an OutputWidth of 240 is used.
-s
specifies summary output, which includes value names, types and first line of data.
[RegistryPath]
specifies the point in the registry from which to start dumping. All entries below this point in the registry hierarchy are also dumped. If no path is specified, RegDmp dumps the entire registry, which can produce very lengthy output.
If the path contains spaces, it must be surrounded by quotations marks:
"Registry Path With Spaces"
When specifying a registry path, either on the command line or in an input file, the following prefix strings can be used:
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_USER
USER:
Each of these strings can stand alone as the key name or be followed a BACKSLASH and a subkey path.


RegDmp Output

The output of RegDmp is displayed on the screen by default, but can also be redirected to a file. The following is an example of a dump of HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt. Note that quotation marks must be used for registry paths that contain spaces.

Note

If RegDmp detects any REG_SZ or REG_EXPAND_SZ value that is missing the trailing null character, it prefixes the value string with the following text: (*** MISSING TRAILING NULL CHARACTER ***). This is a common programming error that RegFind, another Windows 2000 Resource Kit tool, can be used to clean up.

C:\>regdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt
    GPOs = {9B473310-AC06-11D2-B57A-0008C7457B4E};{605B38DC-A8D6-11D2-9BEB-00A024070A22};{EF06ECF2-A8C9-11D2-B575-0008C7457B4E};{88132A04-A9CA-11D2-B578-0008C7457B4E};{95B1FADC-A8D5-11D2-9BEB-00A024070A22};\
           {DF750C2B-FA94-11D2-9332-00C04FA3787A};
    {59f10040-e086-11d2-8e8d-00104b2b96cc} = REG_DWORD 0x00000003
    {00000409-78e1-11d2-b60f-006097c2720c} = REG_DWORD 0x00000005
    {965a5032-e791-11d2-ac7b-00104b2b96cc} = REG_DWORD 0x00000003
    {d81c8112-5273-11d2-b56c-00104b2b9604} = REG_DWORD 0x00000003
    LastArchLang = REG_DWORD 0x00000409
    {ca3cb8ac-dccb-485e-8e5e-9989f9ae66c6} = REG_DWORD 0x00000003
    {1bc555e0-e726-11d2-8391-0008c709d19e}
        Deployment Name = Winzip 7.0 (SR1)
        GPO Name = EU-AppDeploymentPolicy-GigelA
        GPO ID = {ef06ecf2-a8c9-11d2-b575-0008c7457b4e}
        Product ID = {59f10040-e086-11d2-8e8d-00104b2b96cc}
        AssignCount = REG_DWORD 0x00000001
        Revision = REG_DWORD 0x00000000
        Install UI = REG_DWORD 0x00000003
        AppState = REG_DWORD 0x00000012
        SupercededIDs = REG_MULTI_SZ "{bf45777f-a8e4-11d2-a468-00c04fa35a16}"
    {1d68b42f-e727-11d2-94ea-00805f65bc43}
        Deployment Name = Microsoft Office 2000 Premium (RTM)
        GPO Name = EU-AppDeploymentPolicyForADSelf-GigelA
        GPO ID = {88132a04-a9ca-11d2-b578-0008c7457b4e}
        Product ID = {00000409-78e1-11d2-b60f-006097c2720c}
        AssignCount = REG_DWORD 0x00000001
        Revision = REG_DWORD 0x00000000
        Install UI = REG_DWORD 0x00000005
        AppState = REG_DWORD 0x00000011
        SupercededIDs = REG_MULTI_SZ "{ce9c6170-d1b7-11d2-af2c-00805f65bc8d}"  \
                                     "{8552f11c-e1b4-11d2-a493-00c04fa35a16}"
    {4f08770d-2a88-11d3-bb52-0008c773d0ba}
        Deployment Name = Adobe Acrobat 4.0
        GPO Name = EU-AppDeploymentPolicy-GigelA
        GPO ID = {ef06ecf2-a8c9-11d2-b575-0008c7457b4e}
        Product ID = {ca3cb8ac-dccb-485e-8e5e-9989f9ae66c6}
        SupercededIDs = REG_MULTI_SZ "{038963ac-e725-11d2-8391-0008c709d19e}"
        AssignCount = REG_DWORD 0x00000001
        Revision = REG_DWORD 0x00000000
        Install UI = REG_DWORD 0x00000003
        AppState = REG_DWORD 0x00000012
    {7a827d1f-ec40-11d2-a49d-00a0c9c57d8c}
        Deployment Name = Microsoft Project  98
        GPO Name = EU-AppDeploymentPolicy-GigelA
        GPO ID = {ef06ecf2-a8c9-11d2-b575-0008c7457b4e}
        Product ID = {965a5032-e791-11d2-ac7b-00104b2b96cc}
        AssignCount = REG_DWORD 0x00000001
        Revision = REG_DWORD 0x00000000
        Install UI = REG_DWORD 0x00000003
        AppState = REG_DWORD 0x00000012
        SupercededIDs = REG_MULTI_SZ "{8f915892-a8f1-11d2-83ec-00805f65bc43}"
    {f56283d5-fce9-11d2-a4bd-00a0c9c57d8c}
        Deployment Name = Microsoft Raid 4.1a.07
        GPO Name = EU-AppDeploymentPolicy-GigelA
        GPO ID = {ef06ecf2-a8c9-11d2-b575-0008c7457b4e}
        Product ID = {d81c8112-5273-11d2-b56c-00104b2b9604}
        AssignCount = REG_DWORD 0x00000001
        Revision = REG_DWORD 0x00000004
        ScriptTime = REG_BINARY 0x00000008 0xd9055534 0x01be90f6
        Install UI = REG_DWORD 0x00000003
        AppState = REG_DWORD 0x00000011
        SupercededIDs = REG_MULTI_SZ "{53a5db3a-dbdc-11d2-919f-0008c7243c3e}"


Interesting Configuration Management Registry Keys

Note that if the registry path contains spaces, it must be surrounded by quotations marks when used as the RegistryPath in RegDmp. For example:
"Registry Path With Spaces"

Group Policy, User Data Settings, & Folder Redirection

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Offline Files

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\NetCache
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\NetCache

Software Installation and Maintenance & Application Management Client Side Extension

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt

Windows Installer

HKEY_CURRENT_USER\Software\Microsoft\Installer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer

User Settings Management & All Users Profile Information

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Current User Profile Information

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders


Regentry.chm: Technical Reference to the Windows 2000 Registry

The Technical Reference to the Windows 2000 Registry provides a database of details on Windows 2000 registry entries. You can use this Help file while working in a registry editor to find ranges of and instructions for setting specific registry values.

File Required

  • Regentry.chm


Regfind.exe

RegFind is a command-line tool that you can use to search the Windows 2000 registry for arbitrary data, key names, or value names. The tool allows you to replace any of these with new values. RegFind has a special flag for finding malformed REG_SZ strings in the registry.

To access some parts of the registry, you must be a member of the Administrators group.

RegFind Topics

  • RegFind Syntax
  • RegFind Output

File Required

  • Regfind.exe


RegFind Syntax

One Step regfind [{-m \\ComputerName | -h HiveFile HiveRoot | -w Win95Directory}] [-i n] [-o OutputWidth] [-p RegistryKeyPath] [{-z | -t DataType}] [{-b | -B}] [-y] [-n] [SearchString [-r ReplacementString]]

Where:

-m \\ComputerName
specifies a remote Windows 2000 computer (machine) whose registry is to be manipulated.
-h HiveFile HiveRoot
specifies a local hive to manipulate.
-w Win95Directory
specifies the paths to Windows 95 system.dat and user.dat files.
-i n
specifies the display indentation multiple. Default is 4.
-o OutputWidth
specifies how wide the output is to be. By default OutputWidth is set to the width of the console window, if standard output (STDOUT) has not been redirected to a file. In the latter case, an OutputWidth of 240 is used.
-p RegistryKeyPath
specifies where in the registry to start searching. All entries below this point in the registry hierarchy are also searched. If no path is specified, RegFind searches the entire registry, which can be time consuming.
If the path contains spaces, it must be surrounded by quotations marks:
"Registry Key Path With Spaces"
-z
specifies to search for REG_SZ and REG_EXPAND_SZ values that are missing a trailing null character and/or have a length that is not a multiple of the size of a Unicode character. If -r is also specified, any replacement string is ignored and RegFind adds the missing null character and/or adjusts the length up to an even multiple of the size of a Unicode character.
-t DataType
specifies which registry types to search. DataType can be REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ, REG_DWORD, REG_BINARY, or REG_NONE. Default is any of the _SZ types.
-b
only valid with _SZ searches. Specifies that RegFind should look for occurrences of the SearchString inside of REG_BINARY data. May not be specified with a ReplacementString that is not the same length as the SearchString.
-B
same as -b but also looks for ANSI version of string within REG_BINARY values.
-y
only valid with _SZ searches. Specifies that RegFind should ignore case when searching.
-n
specifies to include key and value names in the search; -n may not specified with -t.
SearchString
is the value to search for. If SearchString is not specified, RegFind searches based on type.
If SearchString contains spaces, it must be surrounded by quotations marks:
"Search String With Spaces"
-r ReplacementString
specifies an optional replacement string to replace any matches with.
SearchString and ReplacementString must be of the same type as specified by the -t switch. For any of the _SZ types, it is just a string. For REG_DWORD, it is a single number (for example: 0x1000 or 4096). For REG_BINARY, it is a number specifing #bytes, optionally followed by the actual bytes, with a separate number for each DWORD (for example, 0x06 0x12345678 0x1234). If just the byte count is specified, RegFind searches for all REG_BINARY values that have that length. May not search for length and specify -r.
When doing replacements, RegFind displays the value after the replacement has been. It is usually best to run RegFind once without the -r switch to see what will be changed before it is actually changed.
Whenever specifying a registry path, either on the command line or in an input file, the following prefix strings can be used:
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_USER
USER:
Each of these strings can stand alone as the key name or be followed a BACKSLASH (\) and a subkey path.


RegFind Syntax

RegFind Output

This example searches the HKEY_CURRENT_USER\Control Panel registry key for entries of type REG_DWORD.

C:\>regfind -p "HKEY_CURRENT_USER\Control Panel" -t REG_DWORD

Scanning HKEY_CURRENT_USER\Control Panel registry tree
Searching for any match based on type
Will match values of type: REG_DWORD

HKEY_CURRENT_USER\Control Panel
    Desktop
        ActiveWndTrkTimeout = REG_DWORD 0x00000000
        ForegroundFlashCount = REG_DWORD 0x00000003
        ForegroundLockTimeout = REG_DWORD 0x00030d40
        CaretWidth = REG_DWORD 0x00000001
        PaintDesktopVersion = REG_DWORD 0x00000001
    Microsoft Input Devices
        Mouse
            Exceptions
                584
                    Version = REG_DWORD 0x00050000
    Mouse
        ActiveWindowTracking = REG_DWORD 0x00000000


Regini.exe: Registry Change by Script

This tool uses character-based batch files to add keys to the Windows 2000 registry by specifying a registry script.

You can use a registry editor (RegEdit or RegEdt32) to perform similar tasks as an interactive process, but RegIni supports a wider range of data types than the registry editors do. RegIni also provides a quick way to add or modify drivers in the registry.

Caution

Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Control Panel or Microsoft Management Console (MMC) whenever possible.

Files Required

  • Regini.exe
  • Regini.doc
  • User-defined script file


Regrest.exe: Registry Restoration

Registry Restoration (RegRest) restores registry hive files from backups created by RegBack.

The registry is organized as a series of hive files, stored (with associated logs) in binary form on your computer's hard disk. You can manually back up and restore the registry manually, or in batch files, using the RegBack and RegRest tools.

You must be logged on as a member of a group that has "Backup Files and Folders" privileges to use RegRest.

RegRest performs a ReplaceKey operation, which swaps backup files for the default files that the Emergency Repair or Windows 2000 Setup programs installed, and saves the default files under other file names.
Restart the computer after running the RegRest program to see the restored registry.

RegRest Topics

  • RegRest Syntax
  • Restoring All Active Registry Hive Files in the \Config Folder
  • Manually Restoring a Hive
  • Notes on RegRest
  • RegRest Error Levels

File Required

  • Regrest.exe


RegRest Syntax

One Step regrest [newfile savefile] [hivetype hivename]

Where:

newfile
specifies the backup source file name. RegRest will rename this file and use it to replace the old hivename file.
savefile
specifies the file name for saving the old hivename that is being replaced. The old hive file will be renamed and moved to this location.
hivetype
must be either machine or users or it will fail.
hivename
name of an immediate subtree of HKEY_LOCAL_MACHINE or HKEY_LOCAL_USERS. Will fail if hivename isn't a hive root.

after using RegRest, examine the output to make sure that the restoration did what you wanted. Changes take effect only after the system is restarted.


Restoring All Active Hive Files

To restore all active hives in the \Config folder

One Step regrest newFolder saveFolder

Where:

newFolder
specifies the folder for the source of the backed up hive file that will replace a hive file in the \Config folder. For each active registry hive whose file is in \Config, RegRest attempts to replace the current file with a similarly-named file from the newFolder.
saveFolder
specifies the folder where the old hive files in \Config are moved.

For example: regrest c:\monday.bku c:\install.sav. A warning appears if there are hives that must be backed up manually or if there are errors. For each active registry hive, whose file resides in the \Config directory, attempt to replace its current file with a similarly-named file in the New Files directory, and move the old file to the Save Files directory. Warn of errors and hives that must be restored manually (Use the syntax format that follows for manual restore).

regrest c:\monday.bku  c:\install.sav
if ERRORLEVEL 1 echo Error!


Manually Restoring a Hive

One Step regrest newFilename saveFilename hivetype hivename

Where:

newFilename
Specifies the backup source file name. RegRest will rename this file and use it to replace the old hivename file.
saveFilename
Specifies the file name for saving the old hivename that is being replaced. The old hive file will be renamed and moved to this location.
hivetype
Either machine or users. Will fail if the hivetype isn't machine or users.
hivename
The name of an immediate subtree of HKEY_LOCAL_MACHINE or HKEY_LOCAL_USERS. Will fail if hivename isn't a hive root.

For example:

regrest c:\special.sav\system c:\oldsys.sav machine system


Notes on RegRest

  • RegBack and RegRest save and reload the entire hive, including access control lists (ACLs). Therefore, it is possible to restore a hive and find that you have different access control lists than before.
  • RegRest does not automatically restore hives that don't reside in the %WinDir%\Config folder (such as some user profiles), but RegRest will do so manually. This avoids name conflicts.
  • RegRest does not restore hives that aren't loaded. You can copy those files to restore them.
  • All files must be on the same volume. RegRest renames rather than copies files.
  • The old hive will be stored in a .sav file, so there must be space for this file.
  • RegRest will stop at the first bug, except for manually saved hives.
  • If you have a tape drive, use the Windows 2000 Backup program instead. To open Backup, click Start, point to Programs, then point to Acessories, then point to System Tools, and click Backup.


RegRest Error Levels

The error on exit will be:

  • 0 if the procedure was successful
  • 1 if a hive that requires manual backup or restoration was encountered
  • 2 for all other errors


Sc.exe: Service Controller Tool

This tool provides a way to communicate with Service Controller (Services.exe) from the command prompt to retrieve and set information about services.

Service Controller Tool is useful for testing and debugging your service programs. SC implements calls to all of the Windows 2000 service control functions. You can specify any function parameters through the command line. You can create batch files that call SC with various command lines to see how your service behaves with repeated starting and stopping.

SC can be used to display complete status information, including state, checkpoint number, and wait hint.

To view and manage services in Windows 2000

  1. Click Start, point to Programs, point to Administrative Tools, then click Computer Management.
  2. In Computer Management, double-click System Tools, then click Services.

    3. For information about how to use Services, right-click Services, and then click Help.

SC Topics

  • SC Syntax
  • How Administrators Can Use SC
  • How Developers Can Use SC

Files Required

  • Sc.exe
  • Scdev.doc


SC Syntax

One Step sc [\\ServerName] Command ServiceName [OptionName=OptionValue...]

Where:

\\ServerName
specifies the name of the server if you are running the commands on a remote computer. The name must start with two backslash characters (\\). If you are running the commands on the local computer, do not supply this parameter.
Command
specifies one of the following SC commands:
Command | Description
Config | Changes the configuration of a service (persistent).
Continue | Sends a CONTINUE control request to a service.
Control | Sends a control to a service.
Create | Creates a service (adds it to the registry).
Delete | Deletes a service (from the registry).
Description | Changes the description of a service.
EnumDepend | Enumerates service dependencies.
Failure | Changes the actions taken by a service upon failure.
GetDisplayName | Gets the display name for a service.
GetKeyName | Gets the name of the registry key for a service.
Interrogate | Sends an INTERROGATE control request to a service.
Pause | Sends a PAUSE control request to a service.
Qc Queries configuration for the service.
To find out the name of the binary for any service and whether it shares a process with other services, run sc qc ServiceName.
Qdescription | Queries the description of a service.
Qfailure | Queries the actions taken by a service upon failure.
Query | Queries the status for a service, or enumerates the status for types of services.
QueryEx | Queries the status and extended information for a service, or enumerates the status and extended information for types of services.
SdShow | Displays a service's security descriptor using SDDL.
SdSet | Sets a service's security descriptor using SDDL.
Start | Starts a service.
Stop | Sends a STOP request to a service.

The following commands don't require a service name. Their syntax is:
sc [ServerName] Command [OptionName=OptionValue...]

Command | Description
Boot | Values are {ok | bad} Indicates whether the last restart should be saved as the last-known-good restart configuration
Lock | Locks the Service Database
QueryLock | Queries the LockStatus for the SCManager Database
ServiceName
Specifies the name given to the service key in the registry. This is different from the display name that you see in the Service control panel application. You can get the ServiceName from the display name by running:

One Step sc GetKeyName DisplayName

OptionName
The name of an optional command parameter. You can supply zero or more optional pairs of parameter names and values. For a list of available names, run:

One Step sc Command

where Command is a valid command name as listed above.
OptionValue
Specifies the value for the parameter named by OptionName. For a list of available values, run:

One Step sc Command

where Command is a valid command name as listed above.

Help Information at the Command Prompt

To display help information for a command, use the following command prompt syntax:

One Step sc Command

where Command is a valid command name as listed above.

The exceptions are the Query and QuerytEx commands, which cause SC to list the status of all running services. For help on the Query and QueryEx commands, run the command sc, and at the prompt "Would you like to see help for the QUERY and QUERYEX commands?" type y.


How Administrators Can Use SC

Administrators can find out the name of the binary for any service, and whether it shares a process with other services, by running this command from the command prompt:

One Step sc qc ServiceName

SC can help match up services in the Services node in Microsoft Management Console (MMC) with processes in System Monitor. If the binary name is Services.exe, the service shares the Service Controller process.

Services.exe, Service Controller (also known as Service Control Manager), starts all the services. A number of Win32 services developed for Windows 2000 have been written to share the Service Controller's process, in order to conserve system resources. These services don't show up as separate processes in System Monitor.

Win32 services developed by third parties can also be configured to share processes with each other, so there might not be a process for every other service. SC can be used to get configuration information on these services. If a service doesn't share its process with other services, however, there will be a process for it in System Monitor when the service is running.


How Developers Can Use SC

SC can be useful for developers of services, because it provides more detailed and accurate information about services than the two end-user tools provided with Windows 2000. The Services Control Panel and the network command-line interface, Net.exe, can determine whether a service is running, stopped, or paused. Although these tools are fine for completely debugged applications when everything is running smoothly, the information they provide about a service being developed can be misleading.

SC implements calls to all of the Windows 2000 service control application programming interface (API) functions. You can set the parameters to these functions by specifying them at the command prompt.

With SC, you can query the service status and retrieve the values stored in the status structure fields. Net.exe and the Services Control Panel cannot provide you with the complete status of a service, but SC will tell you the exact state of the service, as well as show the last checkpoint number and wait hint. The checkpoint can then be used as a debugging tool, because it provides a clear indication of how far the initialization progressed before the program froze. The tool also lets you specify the name of a remote computer so that you can call the service API functions or view the service status structures on the remote computer.


Scanreg.exe

This Win32 command-line "registry GREP" enables you to search for any string in key names, entry names, and/or values in local or remote registry keys in Microsoft® Windows® 2000, Microsoft® Windows NT®, Microsoft® Windows® 95 and Microsoft® Windows® 98.

Files Required

  • Scanreg.exe
  • Scanreg.doc


Sclist.exe

This command-line tool can show currently running services, stopped services, or all services on a local or remote computer.

ScList is particularly useful in determining what services are running on a physically remote or blind (no monitor) system. To enable ScList to report on the status of services on a computer, however, the Server service must be running on it.

ScList Topics

  • ScList Syntax
  • ScList Examples

File Required

  • Sclist.exe


ScList Syntax

One Step sclist [-?] [-r] [-s] [MachineName]

Where:

-?
Display command-line help.
-r
Display only running services.
-s
Display only stopped services.
MachineName
Computer to list services on. Local computer assumed by default.


ScList Examples

  • Display all running services on the local computer.
    sclist -r
    --------------------------------------------
- Service list for Local Machine (running)
--------------------------------------------
running          Alerter                          Alerter
running          AppMgmt                          Application Management
running          Browser                          Computer Browser
running          ClipSrv                          ClipBook
running          Dfs                              Distributed File System
running          Dhcp                             DHCP Client
running          dmserver                         Logical Disk Manager
running          Dnscache                         DNS Client
running          Eventlog                         Event Log
running          EventSystem                      COM+ Event System
running          IISADMIN                         IIS Admin Service
running          lanmanserver                     Server
running          lanmanworkstation                Workstation
running          LicenseService                   License Logging Service
running          LmHosts                          TCP/IP NetBIOS Helper Service
running          Messenger                        Messenger
running          MSDTC                            Distributed Transaction Coordinator
running          MSIServer                        Windows Installer
running          NetDDE                           Network DDE
running          NetDDEdsdm                       Network DDE DSDM
running          Netlogon                         Net Logon
running          Netman                           Network Connections
running          NtmsSvc                          Removable Storage
running          PlugPlay                         Plug and Play
running          PolicyAgent                      IPSEC Policy Agent
running          ProtectedStorage                 Protected Storage
running          RemoteRegistry                   Remote Registry Service
running          RpcSs                            Remote Procedure Call (RPC)
running          SamSs                            Security Accounts Manager
running          Schedule                         Task Scheduler
running          seclogon                         RunAs Service
running          SENS                             System Event Notification
running          SMTPSVC                          Simple Mail Transport Protocol (SMTP)
running          Spooler                          Print Spooler
running          TermService                      Terminal Services
running          TrkWks                           Distributed Link Tracking Client
running          W32Time                          Windows Time
running          W3SVC                            World Wide Web Publishing Service
running          Wmi                              Windows Management Instrumentation Driver Extensions
  • List all stoppped services on the local computer.
    sclist -s
    --------------------------------------------
- Service list for Local Machine (stopped)
--------------------------------------------
stopped          cisvc                            Indexing Service
stopped          dmadmin                          Logical Disk Manager Administrative Service
stopped          Fax                              Fax Service
stopped          IsmServ                          Intersite Messaging
stopped          kdc                              Kerberos Key Distribution Center
stopped          mnmsrvc                          NetMeeting Remote Desktop Sharing
stopped          NtFrs                            File Replication
stopped          NtLmSsp                          NT LM Security Support Provider
stopped          RasAuto                          Remote Access Auto Connection Manager
stopped          RasMan                           Remote Access Connection Manager
stopped          RemoteAccess                     Routing and Remote Access
stopped          RpcLocator                       Remote Procedure Call (RPC) Locator
stopped          RSVP                             QoS RSVP
stopped          SCardDrv                         Smart Card Helper
stopped          SCardSvr                         Smart Card
stopped          SharedAccess                     Internet Connection Sharing
stopped          SysmonLog                        Performance Logs and Alerts
stopped          TapiSrv                          Telephony
stopped          TlntSvr                          Telnet
stopped          TrkSvr                           Distributed Link Tracking Server
stopped          UPS                              Uninterruptible Power Supply
stopped          UtilMan                          Utility Manager
stopped          WinMgmt                          Windows Management Instrumentation
stopped          RKillSrv                         RKillSrv


Setx.exe

This command-line tool offers a batch method for setting environmental variables in the user or computer environment from a variety of sources, without any programming or scripting. Besides taking both the variable and value from the command line, it can also take values from registry keys and offsets into text files.

Without SetX, there is no command-line or programmatic way to directly set system environment values for Microsoft® Windows® 2000. These are configureable only through Control Panel or through a registry editor (Regedit or Regedt32). The SET command, which is internal to the command interpreter (Cmd.exe), sets only user environment variables for the environment of the current console window.

SetX allows you to set values for variables in either the user or computer environment from one of three sources: Command Line Mode, Registry Mode, and File Mode.

SetX resembles the UNIX utility SETENV. For more information about UNIX cognates in Windows 2000 and Windows 2000 Resource Kits, see "I want to use UNIX commands within Windows 2000".

For syntax details, at the command prompt, type:
One Step setx /? or setx (without parameters)
to display command-line options for all three modes.

For additional information and examples for all three modes, type
One Step setx -i

SetX Topics

  • Command-Line Mode Syntax
  • Registry Mode Syntax
  • File Mode Syntax
  • Known Limitations

File Required

  • Setx.exe


Setx.exe Command-Line Mode syntax

Command-Line Mode Syntax

One Step setx variable value [-m]

Where:

variable

is the name of the environmental variable to set.

value

is the value to which the environmental variable will be set.

-m

sets value in the computer environment. The default is the User environment.


Setx.exe Registry Mode Syntax

Registry Mode Syntax

One Step setx variable -k hive\key\...\value [-m]

Where:

variable

is the name of the environmental variable to set.

-k

specifies that the variable will be set based upon information from a registry key.

hive\key\...\value

is the registry path to the value to use for the environmental variable, for example, HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation\StandardName

-m

sets value in the Machine environment. The default is the User environment.


SetX File Mode Syntax

File Mode Syntax

One Step setx variable -f filename {-a x,y | -r x,y "string"} [-d d] [-x] [-m]

Where:

-f filename

specifies the name of the file to use.

-a x,y

specifies absolute coordinates and offset as search parameters.

-r x,y "string"

specifies relative coordinates and offset from string as search parameters.

-d d

specifies additional delimiters (d) such as "," or "\".

The four built-in delimiters are: space, tab, carriage return and linefeed. Additional delimiters can be any ASCII character. The maximum number of delimiters, including the four built-in ones, is 15.

-x

displays file coordinates. Switches -a, -r, and -d are ignored.

-m

sets value in the Machine environment. The default is the User environment.


Known Limitations

  • SetX writes variables to the master environment in the registry. Variables set with SetX are only available in future command windows, not in the current command window. This is a limitation of Windows 2000.
  • When accessing REG_MULTI_SZ values in the registry, only the first item is extracted and used.
  • Only the HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE hives are supported.
  • Values added to the User or Machine environments cannot be removed with SetX (as a corresponding one can be removed from the local environment by using SET with a variable name and no value.)
  • Registry values of type REG_DWORD are extracted and used in hexadecimal mode.
  • File Mode supports parsing of CR-LF text files only.


Showpriv.exe: Show Privilege

Showpriv.exe: Show Privilege NEW

ShowPriv is a command-line tool that displays the users and groups granted a particular privilege. This tool must be run locally on the target computer or on a domain controller to display users and groups with domain privileges.

ShowPriv Topics

  • ShowPriv Syntax
  • ShowPriv Examples

File Required

  • Showpriv.exe


ShowPriv Syntax

One Step showpriv privilege

Where:

privilege
is a specific privilege. All local users who have this privilege are listed.
See the Windows 2000 Server Resource Kit Distributed Systems Guide for more information.
note-icon

Note

For more information on error codes returned by ShowPriv, type

net helpmsg errorNumber

Privilege | Windows Privilege | Description
SeTcbPrivilege | Act as part of the operating system | Allows a process to authenticate like a user and thus gain access to the same resources as a user. Only low-level authentication services should require this privilege.
SeMachineAccountPrivilege | Add computers to a domain | Allows the user to add a computer to a specific domain. For the privilege to be effective, it must be assigned to the user as part of local security policy for domain controllers in the domain.
SeBackupPrivilege Back up files and directories Allows the user to circumvent file and directory permissions to back up the system. The privilege is checked only when an application attempts access through the NTFS backup application programming interface (API). Otherwise, normal file and directory permissions apply.

By default, this privilege is assigned to Administrators and Backup Operators. See also Restore files and directories in this table.
SeChangeNotifyPrivilege Bypass traverse checking Allows the user to pass through folders to which the user otherwise has no access while navigating an object path in any Windows file system or in the registry. This privilege does not allow the user to list the contents of a folder; it allows the user only to traverse its directories.

By default, this privilege is assigned to Administrators, Backup Operators, Power Users, Users, and Everyone.
SeSystemTimePrivilege Change the system time Allows the user to set the time for the internal clock of the computer.

By default, this privilege is assigned to Administrators and Power Users.
SeCreatePagefilePrivilege Create a page filepagefile Allows the user to create and change the size of a page file.

By default, this privilege is assigned to Administrators.
SeCreateTokenPrivilege | Create a token object | Allows a process to create an access token by calling NtCreateToken() or other token-creating APIs.
SeCreatePermanentPrivilege | Create permanent shared objects | Allows a process to create a directory object in the Windows 2000 object manager.
SeDebugPrivilege Debug programs Allows the user to attach a debugger to any process.

By default, this privilege is assigned to Administrators.
SeEnableDelegationPrivilege | Enable computer and user accounts to be trusted for delegation | Allows the user to change the Trusted for Delegation setting on a User or Computer object in Active Directory. The user or computer that is granted this privilege must also have write access to the account control flags on the object.
SeRemoteShutdownPrivilege Force shutdown from a remote system Allows a user to shut down a computer from a remote location on the network. See also Shut down the system in this table.

By default, this privilege is assigned to Administrators.
SeAuditPrivilege | Generate security audits | Allows a process to create, generate, and add entries in the security log. The security log is used to trace unauthorized system access. See also Manage auditing and security log in this table.
SeIncreaseQuotaPrivilege Increase quotas Allows a process that has Write Property access to another process to increase the processor quota that is assigned to the other process. This privilege is useful for system tuning, but it can be abused, as in a denial of service attack.

By default, this privilege is assigned to Administrators.
SeIncreaseBasePriorityPrivilege Increase scheduling priority Allows a process that has Write Property access to another process to increase the execution priority of the other process. A user with this privilege can change the scheduling priority of a process in the Task Manager dialog box.

By default, this privilege is assigned to Administrators.
SeLoadDriverPrivilege Load and unload device drivers Allows a user to install and uninstall Plug and Play device drivers. Device drivers that are not Plug and Play are not affected by this privilege and can be installed only by Administrators. Because device drivers run as trusted (highly privileged) programs, this privilege can be misused to install hostile programs and give them destructive access to resources.

By default, this privilege is assigned to Administrators.
SeLockMemoryPrivilege | Lock pages in memory | Allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege can significantly degrade system performance. This privilege is obsolete and is therefore never selected.
SeSecurityPrivilege Manage auditing and security log Allows a user to specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys. Object access auditing is not actually performed unless you have enabled it in Audit Policy (under Security Settings, Local Policies). A user who has this privilege can also view and clear the security log from Event Viewer.

By default, this privilege is assigned to Administrators.

SeSystemEnvironmentPrivilege Modify firmware environment values Allows modification of system environment variables either by a process through an API or by a user through System Properties.

By default, this privilege is assigned to Administrators.

SeProfileSingleProcessPrivilege Profile a single process Allows a user to run Microsoft® Windows NT® and Microsoft® Windows® 2000 performance-monitoring tools to monitor the performance of nonsystem processes.

By default, this privilege is assigned to Administrators and Power Users.
SeSystemProfilePrivilege Profile system performance Allows a user to run Windows NT and Windows 2000 performance-monitoring tools to monitor the performance of system processes.

By default, this privilege is assigned to Administrators.
SeUndockPrivilege Remove computer from docking station Allows the user of a portable computer to undock the computer by clicking Eject PC on the Start menu.

By default, this privilege is assigned to Administrators, Power Users, and Users.
SeAssignPrimaryTokenPrivilege | Replace a process-level token | Allows a parent process to replace the access token associated with a child process.
SeRestorePrivilege Restore files and directories Allows a user to circumvent file and directory permissions when restoring backed-up files and directories and to set any valid security principal as the owner of an object. See also Back up files and directories in this table.

By default, this privilege is assigned to Administrators and Backup Operators.
SeShutdownPrivilege Shut down the system Allows a user to shut down the local computer. See also Force shutdown from a remote system in this table. In Windows 2000 Professional:

By default, this privilege is assigned to Administrators, Backup Operators, Power Users, and Users. In Windows 2000 Server:

By default, this privilege is not assigned to Users, only to Administrators, Backup Operators, and Power Users.
SeSynchAgentPrivilege Synchronize directory service data Allows a process to provide directory synchronization services. This privilege is relevant only on domain controllers.

By default, this privilege is assigned to Administrators and LocalSystem accounts on domain controllers.
SeTakeOwnershipPrivilege Take ownership of files or other objects Allows a user to take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads.

By default, this privilege is assigned to Administrators.


ShowPriv Examples

  • Show all users with backup rights on this computer.
    showpriv SeBackupPrivilege
2 account(s) with the SeBackupPrivilege user right:
BUILTIN\Backup Operators
BUILTIN\Administrators
All accounts enumerated
  • Show all users who can remotely shut down this computer.
    showpriv SeRemoteShutdownPrivilege
1 account(s) with the SeRemoteShutdownPrivilege user right:
BUILTIN\Administrators
All accounts enumerated


Sleep.exe: Batch File Wait

Sleep causes the computer to wait for a specified amount of time. Sleep is useful in batch files and may be more convenient to use than the AT command (part of the Windows 2000 operating system) in certain cases.

Sleep Topics

  • Sleep Syntax
  • Sleep Batch File Example

File Required

  • Sleep.exe


Sleep Syntax

sleep time

Where:
time
is the number of seconds to pause.

For example:

  • Add a line in a batch file to pause the batch for an hour before running the next command in a batch file.
    sleep 3600
  • Wait 10 seconds before running next command:
    sleep 10


Sleep Batch File Example

This example could be used in a logon script:

@echo off

echo * Message of the Day - 7/22/97 *
echo.
echo Don't forget the company picnic!
echo Buses leave at 4pm.

sleep 60


Soon.exe: Near-Future Command Scheduler

One Step For brief usage details, type soon at the command prompt. To view Soon's default settings, run soon /d.

Soon schedules commands and programs to run in the near future on either the local or a remote computer, by generating and running an appropriate AT command (part of the Microsoft® Windows® 2000 operating system).

The Soon command closely resembles the AT command because Soon simply generates and executes a suitable AT command. The Schedule service must be running to use the Soon command.

Soon schedules jobs to run at a time relative to the current time (a number of seconds from "now"). Rescheduling a job with Soon therefore requires no editing of the Soon command. Soon can also be used to schedule jobs to run cyclically at intervals of less than one day. You encapsulate the job to be scheduled in a command file, along with a suitable Soon command, then schedule the command file rather than the actual job it encapsulates.

Soon Topics

  • To Use Soon
    • Scheduling Syntax
    • Configuration Syntax
  • Using Soon to Schedule Jobs Repetitively
  • Using Soon to Troubleshoot a Batch Job
  • Example: Running a command every five minutes

Files Required

  • Soon.exe
  • At.exe (standard Windows 2000 tool) must be on your path.
  • Schedule service (standard Windows 2000 service) must be running on the target computer.


To Use Soon

There are two forms of the Soon command: a scheduling command and a configuration command.

Scheduling

Configuration


Scheduling Syntax

Command prompt Open command prompt now.

The Soon scheduling command takes the following form:

One Step soon [\\computername] [delay] [/interactive] "command"

Where:

\\computername

specifies a remote computer on which the command is to be scheduled. If this argument is omitted, the command is scheduled on the local computer.

delay

specifies when the command is to run, expressed as a number of seconds from now. If this argument is omitted, Soon will use one of its default delay settings, as follows:

  • If the job is to be run on the local computer, Soon uses its LocalDelay.
  • If the job is to be run on a remote compute, Soon uses its RemoteDelay.

/interactive

allows the job to interact with the desktop of the logged-on user when the job runs. If this argument is omitted, Soon uses its current InteractiveAlways (/i—see Configuration) setting, as follows:

  • If InteractiveAlways is on, the job will interact with the desktop.
  • If InteractiveAlways is off, the job will not interact with the desktop.

command

specifies the command to be scheduled (enclosed in double quotation marks).


Configuration Syntax

Command prompt Open command prompt now.

The Soon configuration command takes the following form:

One Step soon /d [/l:n] [/r:n] [/i:{on | off}]

Where:

/d

instructs Soon to modify or display its default settings.

  • If /d is omitted, Soon assumes that this is a Scheduling command
  • If /d is specified on its own, Soon displays its current default settings.
  • If /d is specified with other arguments, Soon modifies its default settings accordingly.

/l:n

sets the value of LocalDelay (default delay for Local jobs), initially five seconds. Specify a positive decimal integer for this value.

/r:n

sets the value of RemoteDelay (default delay for Remote jobs), initially 15 seconds. Specify a positive decimal integer for this value.

/i:[on|off]

sets the value of InteractiveAlways—initially off.


Using Soon to Schedule Jobs Repetitively

Soon is very useful when creating and debugging scheduled jobs. This task often requires that the same job be scheduled repetitively as a one-off job, with debugging and corrections to the job between iterations.

Using the AT command to schedule jobs repetitively in this manner can be time-consuming, because AT accepts only absolute times to determine when the job should be run. Rescheduling a job with AT requires, at the very least, that you edit the time in the AT command. Rescheduling such a job with Soon can save a lot of debugging time.


Using Soon to Troubleshoot a Batch Job

One way to troubleshoot a batch job that is scheduled to run using the AT command is to type the following at the command prompt:

soon /interactive "cmd.exe"

This command opens the command prompt within the next five seconds and allows you to manually run the batch job.

If a command prompt does not open, then open Control Panel Services and check to see if the Schedule service is started. Click the Startup button and make certain that the System account is selected; only the system account can interact with the desktop. Network connections made under the System account use a null session for credentials, so it may be necessary to supply a user name and password for commands such as NET USE.

Before running your batch job, type the command set in order to understand the environment that the command scheduler is running under; all environmental variables including the user name will be listed.

The above command syntax allows you to troubleshoot situations where a batch job runs successfully when it is executed from the command line, but does not work when you execute it using the AT command.

In addition to troubleshooting the batch job, do the following:

  1. Include the echo and pause commands in your batch file so that you can narrow down the cause of the problem.
  2. When you use the AT command, make sure you are using the correct schedule service account. In Control Panel Services, verify the "Log On As" account for the Schedule service. This account determines whether the task scheduled to run has access to the network or the local computer.
  3. Determine if the task requires interaction with the desktop. If so, use LocalSystem for the Schedule service. However, this means that network connectivity is not available unless you type the following at the command line:
    net use \\servername\sharename /U:domain\user name password


Soon Example: Running a Command Every Five Minutes

If, for example, you wish to run Someprog.exe every five minutes, create a command file as follows:

Every5.cmd:
    SOON 300 Every5.cmd
    Someprog.exe

Then schedule Every5.cmd by using AT or Soon (for example, run Soon Every5.cmd). When Every5.cmd runs, it immediately reschedules itself to run five minutes (300 seconds) in the future, and then proceeds to perform the intended task by running Someprog.exe. Alternatively, if you wish to run Someprog.exe repetitively, but wish to have five minutes of idle time between runs of Someprog.exe, create a command file as follows:

Idle5.cmd:
    Someprog.exe
    Soon 300 Idle5.cmd

Then schedule Idle5.cmd by using AT or Soon (for example, run Soon Idle5.cmd). When Idle5.cmd runs, it performs the intended task by running Someprog.exe, and then reschedules itself to run again five minutes (300 seconds) in the future.


Srvany.exe: Applications as Services Utility

With Srvany, you can configure any Windows application so that it runs as a service. When applications are run as services:

  • they are not closed during logoff, so users do not need to restart them each time they log on.
  • server applications can handle requests even when nobody is logged on to the server.
  • an application can run with a logon account different from that of the current user.

Note

Even when started as services, some applications quit when the user logs off. This happens if the applications do not ignore the WM_ENDSESSION message (or CTRL_LOGOFF_EVENT).

Srvany works best with 32-bit applications written for Windows 2000 or Windows NT. You can use this tool to start 16-bit Windows applications as services, but some 16-bit applications are not able to keep running after a user logs off from the computer.

Note

All Srvany services should be disabled when installing or upgrading Windows 2000, Windows NT Server, Windows NT Workstation, or applications.

Srvany Topics

  • Installing Srvany
  • Running an Application as a Service
  • Starting and Stopping a Service
  • Srvany Notes

File Required

  • Srvany.exe


Installing Srvany

  1. Install Srvany as a Windows service. Use the command prompt command-line syntax:

    instsrv MyService c:\path\srvany.exe

    Where:

    MyService
    is the name you want to assign to the service.
    c:\path\
    is the full path to srvany.exe.

    2. Note

    In addition to Instsrv, you can also use the Service Installation Wizard (Srvinstw) to install a service.

Windows NT steps Windows 2000 steps
  2. In Control Panel GUI Control Panel, double-click the Services icon to open the Services dialog.
  3. Select the service you added in step #1.
  4. Click the Startup button to open the Service dialog.
  5. Under Startup Type, choose either Manual or Automatic.
  2. In the Computer Management MMC Snap-in Computer Management console tree, click the Services and Applications node, then click the Services node.
  3. Select the service you added in step #1.
  4. Right-mouse click and select Properties.
  5. In the General tab, set the Startup Type as either Manual or Automatic.
  6. In the Log On tab, set the account the service will use when running. Choose either the System account or enter another valid account. The type of log on needed is determined by the application.
    note-icon

    Note

    If you need access to the screen and keyboard, you must choose System Account and check the "Allow Service to Interact with Desktop" box. Note that System Account is local and doesn't have network access. Otherwise, enter any valid account name and specify the correct logon password.

Installing Multiple Instances

You can install Srvany several times using different registry parameters and running different target applications. Use a distinct service name for each instance you install, for example, MyService1, MyService2, and so on.


Running an Application as a Service

To specify an application to run as a service, you must use a registry editor to add information to the Windows registry. You also have the option of setting any required startup parameters to run the application, as well as setting the working directory used by the application.

Caution

Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Control Panel or Microsoft Management Console (MMC) whenever possible.

Starting a Registry Editor

  1. Click the Start button, and then click Run.
  2. In the Open box, type regedt32, and click OK.

    note-icon

    Note

    None of the strings mentioned in the following examples are case-sensitive.

Starting an Application as a Service

  • Add a new Parameters subkey in the following registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    MyService\
    In the new Parameters subkey, create an:
  • Application entry with a data type of REG_SZ,
  • specify the full path of the executable file for the application (including the extension). For example:
    Application: REG_SZ: D:\Tools\Vi.exe

Setting Start Parameters

Use one of the following to set specific start parameters.

  • Start a registry editor.
  • In the new Parameters subkey in the registry, create an AppParameters entry with a data type of REG_SZ, and specify the parameters for the application. For example:

    • AppParameters: REG_SZ: C:\Tmp\EXAMPLE
    - Or -
  • In Services in Control Panel, click your service, and then, in the Startup Parameters box, type the full command line required to start the application. For example:

D:\\Binp\\B.exe C:\\Tmp\\EXAMPLE

Note You must type two backslashes (\\) to specify a single backslash (\).

For more information, see "Programming Considerations,".

Setting Environment Variables

  1. After installing your application as a service, run Regedt32.
  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyService\Parameters.
  3. Add a key called "AppEnvironment" of type REG_MULTI_SZ.
  4. Within there, adjust any of the parameters you want making sure to press ENTER after every line. When you start the service, you'll notice the specified environment variables have been added to your list.

Setting the Working Directory

Use one of the following to set a working directory.

  • In the Parameters subkey in the registry, create an AppDirectory entry with a data type of REG_SZ, and specify the working directory to use for the application. For example:
    AppDirectory: REG_SZ: C:\Tmp

    • - Or -
  • In Services, click the service, and then, in the Startup Parameters box, type the full command line required to start the application, and include the /D switch, as in the following example:
    /D C:\\Tmp D:\\Tools\\Vi.exe C:\\Tmp\\EXAMPLE

    note-icon

    Note

    Use Services only when the service is configured to be started manually, not when it is started by the system. If the target application is usually the same each time you run the service, specifying it in Services is less convenient than entering these parameters in the registry, because you must type the parameters each time the service is started. However, if the target application is usually different each time the service is started, using the Services method might be more convenient.


Starting and Stopping a Service

Services are configured to start automatically or manually. If a service is configured for automatic startup, it is started by the system when the computer is started. For services configured for manual startup, you can start them in the following ways.

Starting a Service Manually

Start a service manually by using one of the following methods:

  • In Services in Control Panel, click the service, and then click Start.

    • -Or-
  • Use the Sc.exe tool. At the command prompt, type:
    sc start MyService

    • -Or-
  • Use the net start command. At the command prompt, type:
    net start MyService

Stopping a Service

Stop a service by using one of the following methods:
  • In Services in Control Panel, click the service, and then click Stop.

    • -Or-
  • Use the Sc.exe tool. At the command prompt, type:
    sc stop MyService

    • -Or-
  • Use the net stop command. At the command prompt, type:
    net stop MyService

Caution When the service is stopped, it stops the application by calling the Win32 TerminateProcess() API, which does not allow the application to prompt the user to save changes. For this reason, the application should be closed before the service is stopped.

Stopping a Service Indefinately

  1. For Windows 2000: In Start|Programs|Adminstrative Tools|Computer Management|Services, click the service then right-click the mouse and select Properties.
    For Windows NT: In Start|Settings|Control Panel|Services, click the service, then click Startup to display the Startup dialog box.
  2. Set the Startup Type to Disabled.

Removing a Srvany service

If you want to remove a Srvany service permanently, use the following procedure.
  1. If the Srvany service is running, stop it.
  2. Run the following command:
    instsrv MyService remove

note-icon

Note

This procedure removes only one instance of Srvany. It is possible that Srvany.exe is still being used to run other applications as services.


Srvany Notes

Running from the Working Directory

If Srvany fails to start an application, try specifying the directory containing the application as the working directory. As Srvany can run under an account that is different from the user who is currently logged on, environment variables might be set differently, and, as a result, the system might be unable to find a required DLL. Running the application from its root directory might solve the problem.

Interactivity versus Network Access

Due to a restriction enforced by Windows on services, the application can either be interactive (for example, it might read keyboard input) or have network access, but not both at the same time. If you know which servers your interactive service application needs to connect to, it is possible to configure these servers (or selected shares on them) to allow your service (running under the LocalSystem account) to gain access to them.
  • To allow LocalSystem services on any computer in the domain to connect to a specific share on a server, use a registry editor to add the name of that share in the following registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    LanmanServer\Parameters\NullSessionShares
  • If LocalSystem services also need to gain access to named pipes on that server, add the named pipes in the following registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    LanmanServer\Parameters\NullSessionPipes
  • To allow access to all shares and pipes on the server by LocalSystem services, add the following RestrictNullSessAccess entry, with a data type of DWORD and a value of 0:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    LanmanServer\Parameters\RestrictNullSessAccess

    note-icon

    Note

    Adding this entry to the registry allows everyone in the domain to gain access to the server.

Programming Considerations

With Win32 graphical applications, all top-level windows receive the WM_QUERYENDSESSION and WM_ENDSESSION messages when the user logs off. Some Win32 applications quit when they receive these messages. In order for a Win32 application to keep running when a user logs off, the default Windows procedure should be called when these messages are received.

Win32 character-based applications receive a CTRL_LOGOFF_EVENT event from the console when the user logs off. If your character-based application registers a console event handler (using SetConsoleCtrlHandler), it must ignore CTRL_LOGOFF_EVENT in order to keep running.

Presentation Manager Applications

When you use Srvany with Presentation Manager applications, special configuration instructions apply. Consult the Readme.wri file shipped on Disk#1 of the Windows NT Add-On Subsystem for Presentation Manager, version 3.51. Presentation Manager is a Microsoft add-on product that allows you to run 16-bit Presentation Manager 1.x applications in addition to the OS/2 character-mode applications supported by the Windows OS/2 subsystem.


Srvinstw.exe: Service Installation Wizard

Service Installation Wizard provides an easy method of installing or deleting services and device drivers. It can connect to and configure services on local and remote computers.

To run Service Installation Wizard, you must have administrative privileges. The user must have Administrator privileges on the target computer to successfully configure services. All file and directory paths should be relative to the target computer when configuring services on remote computers.

Caution

Use extreme care when deleting services and device drivers. Removal of certain services can cause your system and applications to become unstable or unusable.

You can also use the command-line application Service Installer (Instsrv.exe) to install services on the local computer.

File Required

  • Srvinstw.exe


Svcacls.exe: Service ACL Editor

Svcacls.exe: Service ACL Editor NEW

This command-line tool sets access control lists (ACLs) on service objects, enabling administrators to delegate control of services.

To initially use Service ACL Editor, you must have Administrator privileges, although someone with Administrator privileges can use the tool to grant someone without Administrator privileges permission to use the tool. Delete, Read Control, and Write discretionary access control are required to modify discretionary access control lists (DACLs) for services. The DACL (usually referred to simply as ACL) determines the permissions on an object. To change a DACL, a permission called WRITE_DAC is required.

Service ACL Editor runs only on x86-based computers running Windows 2000 or Windows NT version 4.0.

Caution

Do not remove permissions on any service for Administrators or System. If you do, you might have to reinstall Windows 2000 to regain control over the service.

Service ACL Editor Topics

  • Service ACL Editor Syntax
  • Service ACL Editor Examples

File Required

  • Svcacls.exe


Service ACL Editor Syntax

One Step svcacls [\\TargetComputer\]Service [Options]

Where

TargetComputer
is the UNC name of the computer on which permissions are to be determined. It must be followed with a backslash before the name of the service.
Service
is the name of the service for which permissions are to be determined.
Options
include:
G[rant]:Trustee:Permissions (adds permissions)
S[et]:Trustee:Permissions (replaces permissions)
R[evoke]:Trustee (removes whatever explicit permissions have been given)
D[eny]:Trustee (does not allow any access to the object regardless of any other permissions)
You can use more than one option on one line, for example:
svcacls browser r:username g:username:riu

caution

Caution

Use Deny with extreme care, as it is possible to lock even administrators out of a service with an option such as D:everyone.

Trustee
is the user to whom the permissions apply. If a trustee name contains spaces, you must use double quotes around it.
Permissions
include specific permissions and generic permissions.

Specific permissions:

Q: Query Service Configuration             	(SERVICE_QUERY_CONFIG)
S: Query Service Status                    	(SERVICE_QUERY_STATUS)
E: Enumerate Dependent Services            	(SERVICE_ENUMERATE_DEPENDENTS)
C: Change Service Configuration            	(SERVICE_CHANGE_CONFIG)
T: Start Service                           	(SERVICE_START)
O: Stop Service                            	(SERVICE_STOP)
P: Pause/Continue Service                  	(SERVICE_PAUSE_CONTINUE)
I: Interrogate Service with ControlService()(SERVICE_INTERROGATE)
U: Allow User-Defined Control Commands     	(SERVICE_USER_DEFINED_CONTROL)

Generic permissions:

F: Full Control               (SERVICE_ALL_ACCESS = QSECTOPIU)
R: Generic Read               (GENERIC_READ       = QSE)
W: Generic Write              (GENERIC_WRITE      = C)
X: Generic Execute            (GENERIC_EXECUTE    = TOPIU)


Service ACL Editor Examples

svcacls | displays usage screen.
svcacls browser | lists permissions on the browser service on the local computer.
svcacls \\computername\browser | list permissions on the browser service on a computer called "computername."
svcacls browser g:username:rx | grants the Read and Execute permissions for user's user name on the browser service, adding to the user's current permissions.
svcacls browser s:username:rx | sets permissions for user's user name to Read and Execute on the browser service, replacing the user's current permissions.
svcacls browser r:username | revokes the user's user name permissions on the browser service on the local computer.
svcacls browser d:username | explicitly denies access to user's user name on the browser service.


Svcmon.exe: Service Monitoring Tool

This tool monitors services on local and remote computers for changes in state (starting or stopping). To detect these changes, Service Monitoring Tool implements a polling scheme. When a monitored service stops or starts, Service Monitoring Tool notifies you by sending e-mail or via Microsoft® Exchange Server.

Service Monitoring Tool Topics

  • Installing and Configuring Service Monitoring Tool
  • Service Monitoring Tool Troubleshooting

Files Required

  • Smconfig.exe - Service Monitoring Tool Configuration Wizard.
  • Svcmon.exe - Service Monitoring Tool. After installing the Microsoft® Windows® 2000 Server Resource Kit, you must manually copy this file to your computer's %SystemRoot%\System32 folder.


Installing and configuring Service Monitoring Tool

To install and configure the Service Monitoring Tool

  1. Manually copy Svcmon.exe from the folder where the Windows 2000 Server Resource Kit installation has installed it to the computer's %SystemRoot%\System32 folder.
  2. At the command prompt, type smconfig to run the Service Monitoring Tool Configuration Wizard.

Wizard Page 1

The first page of the Service Monitoring Tool Configuration Wizard provides a brief overview of the tool. Click Next to proceed with installation or configuration.

Wizard Page 2

The second page helps you to set up Exchange information. Typically the default Domain, User Name and Profile given are adequate. You must enter a password: if you are on a Windows 2000 network, use your Domain\UserName password. To complete the Exchange information, add the e-mail names of any other people who should be notified when the selected services change state.

Wizard Page 3

On the third and final page, you select the services to be monitored. The computer name defaults to the local computer. To monitor services on another computer, enter the computer name and press the TAB key. From the services list, select a service to monitor. Next, modify the polling interval if necessary. The polling interval specifies in seconds how frequently the service should be polled for a state change.

After selecting a computer, service and polling interval, click the Add Service button to add the service to the list of services to be monitored. Continue adding services until all of the services that you wish to monitor have been added to the list. Service Monitoring Tool supports a maximum of 99 services.

After adding all of the services to be monitored to the list, click the Finish button to complete the installation or re-configuration of Service Monitoring Tool.

Note

To remove a stopped service, use Srvinstw.exe: Service Installation Wizard, a tool included in the Windows 2000 Server Resource Kit.


Service Monitoring Tool Troubleshooting

Logging

To facilitate troubleshooting, Service Monitoring Tool provides program tracing or logging. You can enable logging by modifying the entries in the following registry path:

HKEY_LOCAL_MACHINE\Software\Microsoft\ResKit\Service Monitoring Tool\Logging

Registry Entries

Enabled

Set to T for True. The default value is F for False.

LogFile

Leave the default, Svcmon.lg. The resulting log file will be Svcmon.lgN where N corresponds to the day of the week. For example, 1 would be Monday, 2 would be Tuesday, and so on.

LogLevel

Set to 7. The default value is 1, which provides no logging information; 7 provides the highest degree of logging possible.

After you enable logging, you must stop and restart the Service Monitoring Tool service to activate logging. Use the Services option in Control Panel to stop and start the service. The log file is written to the %SystemRoot%\System32 directory on the current computer.

Error Message

Service Monitoring Tool might cause the following error message:

"Could not start service Service Monitor. Because (Logon Failed)"

If you see this message, try this solution:

Run the Service Monitoring Tool Configuration Wizard (Smconfig.exe) again, making sure to correctly re-type your password. If the problem persists, go to the Services option in Control Panel, select the Service Monitoring Tool service and then click the Start up button. Verify your user name and re-enter your password. Then start the service again from the Services option in Control Panel.


Timethis.exe: Time This

Time This times how long it takes the system to run a given command.

You provide as a parameter the name of the command you want to run and time. Time This runs the specified command, then reports the start and finish time for the command, and how long it took to run, in HH:MM:SS.TTT format.

Time This is useful for determining the start, end, and elapsed run times of any command. It is easy to use interactively, and can also be used to time commands in .bat or .cmd files: simply prefix the command(s) you wish to time with the timethis command.

Time This Topics

  • Time This Syntax
  • Time This Example: Timing a DIR Command

File Required

  • Timethis.exe


Time This Syntax

One Step timethis commandname

Where:

commandname
specifies the name of the command you want executed and timed.

You can also specify the arguments for the command. For example:

timethis net use x: \\server\share /user:billybob

runs net use x: \\server\share /user:billybob and report how long it took.

Quotation marks around the command are required when the command involves redirection via <, >, >>, or |, for example. Quotation marks ensure that the redirection is applied to the command being timed, rather than the timethis command itself. For example:

timethis "dir > dirlist.txt"


Time This Example: Timing a DIR Command

This command:

c:\>timethis dir c:\users\default\temp

produces this output (lines in bold type are TimeThis output):

TimeThis : Command Line : DIR C:\USERS\DEFAULT\TEMP

TimeThis :  Start Time : Thu Aug 03 11:23:22 1995

   Volume in drive C has no label.

   Volume Serial Number is 8C25-C783

   Folder of C:\USERS\DEFAULT\TEMP

03/08/95  11:04         <DIR>          .

03/08/95  11:04         <DIR>          ..

20/03/95  12:31                 54,717 BIGLMH

20/03/95  14:57                 55,801 HOSTS

20/03/95  14:57                 55,801 LMHOSTS

17/03/95  05:10                 24,274 LMHOSTS.000

               6 File(s)        190,593 bytes

                               39,556,096 bytes free

TimeThis :  Command Line :  DIR C:\USERS\DEFAULT\TEMP

TimeThis :    Start Time :  Thu Aug 03 11:23:22 1995

TimeThis :      End Time :  Thu Aug 03 11:23:23 1995

TimeThis :  Elapsed Time :  00:00:00.972

C:\>


Timezone.exe: Daylight Saving Time Update Utility

This command-line tool updates the daylight saving information for the current time zone in the registry. In some countries and regions, the start and end of daylight saving time are changed every year, and there is no fixed start or end date.

This tool runs on Windows 2000, Windows NT, and Windows 95/98.

TimeZone Syntax

one step timezone [/g] [/s StartDate EndDate] [/?]

Where:

/g
gets the current time zone.
/s StartDate EndDate
sets a new time zone, with StartDate the date that daylight saving time begins and EndDate the date that daylight saving time ends.

StartDate and EndDate use the format:
Hour:DayOfWeek:Day:Month

Hour specifies the hour of the day using a 24-hour clock. Valid values are 00 to 23.

DayOfWeek specifies the day of the week; Sunday = 0, Monday = 1, and so on. Valid values are 0 to 6.

Day specifies the occurrence of DayOfWeek during the month; 1 = first occurrence of day, 2 = second occurrence of day, and so on. Valid values are 1 to 5. For example, if DayOfWeek is Sunday, then 1 = first Sunday, 4 = fourth Sunday, 5 = last Sunday.

Month specifies the month; January = 1, February = 2, and so on. Valid values are 01 to 12.

/?
shows the command-line usage.

TimeZone Example

timezone /s 02:0:5:04 02:2:1:10

Daylight saving information for the current time zone is changed to the following:

Daylight saving time begins at 2:00 on the last Sunday in April (02:0:5:04).

Daylight saving time ends at 2:00 on the fourth Tuesday in October (02:2:4:10).

File Required

  • Timezone.exe


Tlocmgr.exe: Telephony Location Manager

This shell extension configures telephony locations and properties for portable computer users who use telephone applications, such as Dial-Up Networking, from several locations. It is useful for anyone who changes Telephony API (TAPI) locations—for example, taking a laptop from the office to home, where the computer no longer has to dial a prefix (such as 9). For a laptop user with a hot-docking setup, this tool automatically changes the TAPI location.

When you start Telephony Location Manager, it appears as an icon in the status area (near the clock).

A menu from this icon enables you to quickly:

  • change your current TAPI location (click the icon with the left mouse button).
  • bring up dialing properties (click with the right mouse button).
  • run Phone Dialer (click with the right mouse button).

File Required

  • Tlocmgr.exe


Tracedmp.exe: Trace Dump

Tracedmp.exe: Trace Dump NEW

TraceDmp is an event tracing command-line tool that produces a summary of event trace log items. TraceDmp processes either a trace log file generated by TraceLog or polls real time trace buffer data, and converts that information to a .csv file.

TraceDmp behaves like a WMI consumer. It takes the output from a TraceLog file, generally a .etl file, and converts it into a user-friendly format. This output provides you with a view event trace results.

TraceDmp gives you several ways to view event tracing data:

  • Summary.txt file: A summary of the events traced.
  • CSV (comma-separated format) file: Events traced are saved in chronologically sorted order. This gives you a more detailed view for each event.
  • Real time tracing: Tracedmp can also be used for real time event tracing. In this case, TraceDmp will read directly from the buffer instead of from a TraceLog file.
    The format and process is similar to that described for log files in "How TraceDmp Works" below.

How TraceDmp Works

TraceDmp interprets the log file created by TraceLog. This log file is written in a specific format, with a header and some variable data. While the header is fixed, the variable data has to be interpreted separately for each event. For example, process start/end tracing and disk I/O tracing have their own variable structure. This variable portion is determined by TraceDmp through a lookup in the mofdata.guid file.

Currently, mofdata.guid only contains information for directory service and System tracing. To process data from other providers, you must either include the format for that provider in mofdata.guid, or get another pre-configured mofdata.guid file. The format is based on the WMI format, which uses the MOF structure. Details can be obtained by running WBEMTest.

TraceDmp Topics

  • TraceDmp Syntax
  • TraceDmp Examples

Files Required

  • Tracedmp.exe
  • Mofdata.guid: contains the MOF format for the variable portion of the event log

For More Information

See the Internet Microsoft Platform SDK for more information about Event tracing.


TraceDmp Syntax

One Step tracedmp [options] | [-h | -?]

Where:

-o [filename]
Output CSV and summary files. Default output files dumpfile.csv and summary.txt. are placed in the same directory as TraceDmp.

Dumpfile.csv

This file contains a count of all the events that occurred while tracing was being performed. The GUIDs for each event is also displayed. It is important to understand the difference between Event type (start/end) and Event type (DCstart/DCend (DC stands for Data Collection)). The former are those events that started and ended after tracing had begun. They had their lifetime within the tracing period.

There are processes or threads that began before tracing had been turned on, and will continue even after tracing is completed. For such events, the tool recognizes their start as the time tracing was turned on, and their end as the time tracing was turned off. This is the definition of DCstart and DCend.

This file can be opened in Microsoft® Excel. It contains a list of the events as they occurred in chronological order. The various fields are:

Event name | Name of the event being traced
TID | Thread ID
Clock-time | The timestamp of the event occurrence.
Kernel (ms) | Time taken by that event in the kernel space.
User (ms) | Time taken by the event in the user space.
User data | The variable portion of the header. Based on the MOF structure provided in the MOFdata.guid file. This could be more than one column of data. To interpret, look in the Mofdata.guid file or run WEBMTest.
IID | Instance ID
PIID | Parent Instance ID to which the IID relates.

note-icon

Note

IID and PIID are the last two columns (on the right) of the output file and should not be mistaken for User Data, as this field could span multiple columns.

-guid
MOF definition file. Default GUID file is mofdata.guid. If tracing is done for a provider other than the directory service or the operating system, you must specify the GUID file for that provider.
-rt
generates a real-time trace file. Real-time mode tracing, set from TraceLog, must be active.
-summary
produces summary.txt only.
-debug
debugs display
-begin
-end
[-h | -?]
displays command-line help.


TraceDmp Examples

  • Generate output files called summary.txt and dumpfile.csv.
    Tracedmp c:\logfile.etl
  • Generate output files called myoutput.csv and myoutput.txt.
    Tracedmp -o myoutput c:\logfile.etl
  • Generate real time output files for the directory service. Assumes TraceLog has been explicitly started to run in real time mode, as data is being read from a buffer.
    Tracedmp -rt ds


Traceenable.exe: Trace Enable

Traceenable.exe: Trace Enable NEW

Trace Enable is a GUI-based tool that enables tracing and displays current tracing options.

Trace Enable allows you to:

  • enable/disable RAS/RADIUS tracing through a GUI rather than REGEDT32.

What Trace Enable Does

Trace Enable scans the values under the HKLM\SOFTWARE\Microsoft\Tracing key, and enables you to modify the following subkeys for each component:

  • EnableConsoleTracing
  • EnableFileTracing
  • MaxFileSize

Using Trace Enable

As each tracing item is selected in the combo box, the values are displayed. Make your changes then click the Set button. This will write your changes to the registry.

In order to get console tracing, you must turn it on for the component, and turn it on with the master check box at the top of the TraceEnable window.

For example, to generate a log file for PPP:

  1. Select PPP from the drop down list.
  2. Click the Enable File Tracing button.
  3. Click the Set button.
  4. Tracing is now enabled for this component. In most cases the log file is created in %windir%\tracing.

Trace Enable

The following describes items in the Trace Enable interface.

Global
Enable Console Tracing | Console tracing lets you view the log realtime, on the console. Press CTRL and TAB to swap between multiple open logs.
Enable Pool Tagging | Turns on system pool tagging. Select this option only if you explicitly want to enable pool tagging. This option does not affect log tracing. note-icon Note Pool tagging can also be enabled by using gflags.exe.
Per Component
Component drop-down list | Component which can be traced on this computer.
Enable Console Tracing | Display log trace information in a console window.
Enable File Tracing | Save trace information to a log file. note-icon Note Most trace log files are stored in %windir%\tracing, however you can check the value in the HKLM\SOFTWARE\Microsoft\Tracing FileDirectory subkey.
Max File Size | Maximum log file size.
Close | Exit Trace Enable.
Set | Set selected options in the registry.
Disable All | Disable tracing for all components.
Enable All | Enable tracing for all components. Automatically selects Global console tracing for all components and pool tagging. note-icon Note Deselect pool tagging unless you will need to view pool tag information using another tool.

Limitations

If you run Trace Enable on a cleanly installed computer, and haven't done any remote access server activity, most of the remote access server tracing keys will not exist in the registry. To get around this, on a clean computer, run RasPhone once before running TraceEnable.

File Required

  • Traceenable.exe


Tracelog.exe: Trace Log

Tracelog.exe: Trace Log NEW

TraceLog is event tracing command-line tool that starts, stops, or enables trace logging. The results of event logging can be viewed with either the TraceDmp or Reducer tools.

TraceLog acts like a Windows Management Instrumentation (WMI) controller link in that it helps control the various parameters associated with the logging of event traces.

Using TraceLog you can:

  • Start, stop, update, and query a trace session.
  • Set up a buffer to which the event traces will be logged by the provider.
  • Create a log file to which the buffer would be flushed. Can also set up a real-time mode in which case the buffer would be delivered directly to the consumer that wants it
  • Provide more specific control over system level tracing.
  • Control the level of tracing required.

TraceLog first creates a circular buffer and enables tracing. The WMI provider, such as the operating system or an application such as the directory service, starts tracing events. These traces are written to the buffer. When a buffer is filled, the data is written to a log file. If real-time mode is set, then the consumer, such as TraceDmp or another application, can take data directly from the buffer.

TraceLog display
Logger Name | Name of the logging instance. For the kernel it is NT Kernel Logger, else it defaults to what you have provided (see example 2)
Logger Id | ID of the logger
Logger Thread Id | Thread ID of the logger
Buffer Size | The size of the buffer allocated
Maximum Buffers | The maximum buffers in pool
Minimum Buffers | The number of buffers to pre-allocate
Number of Buffers | The number of buffers being currently used
Free Buffers | The number of buffers in the free list
Buffers Written | The number of buffers that have already been written to

TraceLog Topics

  • TraceLog Syntax
  • TraceLog Examples
  • Overview of Event Tracing

Files Required

  • Tracelog.exe
  • Control.guid: contains the GUIDs of the providers for which tracing is possible


TraceLog Syntax

One Step tracelog [Management options] [Buffer options] [Log file options] [System level tracing options] [Provider-specific options] | [-h | -help | -?]

Where:

Management options: Starting, stopping, updating and querying a trace session

-guid file
starts tracing for providers in file specified. The file with a list of GUIDs for event tracing. Each GUID corresponds to a traceable event. One cannot just provide a GUID, even if it is just one GUID; it has to be included in a file. To begin system tracing, no GUID file is necessary (see example 1). To enable directory service events, the control.guid file has been provided with the tool (see example 2).
-start [logger_name]
starts a trace session. You need to give a logger name for the events to trace. If it is a system trace, you don't need to specify a logger name, since the default logger name would be taken as "NT kernel logger" (see examples 1 and 2).
note-icon

Note

System and application traces could be started simultaneously, but you must specify a different logger name for the application trace (see example 3).

-stop [logger_name]
stops a trace session. You have to specify the instance name of the events for which you would like tracing to discontinue. For stopping system tracing, you need not specify any logger name (see example 4).
-update [options] [logger_name]
Update the current trace session. This would be useful when you would like to change the file name of the log file (maybe directing it to a different disk) or change some buffer parameters, or change to real time mode, or some other changes. The following options can be updated for the kernel logger (system trace):
Option | Action
-rt | Mode switch. To switch to and from real time mode.
-f logfile_name | New logfile name to switch logfile.
-ft n | Change the flush timer.
-max n | Change the maximum number of buffers.
"-nodisk" "-noprocess" "-nothread" "-nonet" "-fio" "-pf" "-hf" "-img" "-cm" | Flags. These flags apply only to the NT kernel logger.
All updates should be provided in a single update statement. For example, to switch to real-time processing and increase the maximum number of buffers:
Tracelog –update –rt –max 40
-x
stops all active trace sessions. Stops all system and otherwise traces. Completes halt to event tracing.
-l
queries to list all the ongoing traces.
-q
queries to list the system trace only.

Buffer options

-b n
sets buffer size to n kilobytes. gives the buffer size. You would generally like to give the size to be multiple of the page size (for x86-based computers the page size is 4 kilobytes). A small size increases the flush frequency. The kernel, depending on the memory capacity, chooses the default.
-min n
sets minimum buffers. This is the number of buffers to pre-allocate. If logging is frequent, set a higher number. Default is 2.
-max n
sets maximum buffers in pool. This limits the amount of memory consumed for each tracing session. Default is 25.
-ft n_seconds
Set flush timer to n seconds. After a buffer gets filled up, it gets flushed to the log file or to the consumer-for real time tracing. This option allows you to specify the time after which to force a flush. Especially useful for real time tracing.
-age n_minutes
modifies aging decay time. If a buffer has been allocated but isn't being used, or the last n minutes have passed, it is freed. This is generally useful for light tracing, so that memory is freed. This has nothing to do with maximum buffers that have been allocated. That value remains the same. Default is 15 minutes.

Log file options

-rt [b]
enables tracing in real time mode.
-f name
logs to name file. Specifies the log file to which the buffer will be flushed. The consumer will use this file for its analysis. The default name and location is c:\logfile.etl. Use a different file name for each instance of tracing required (-o filename option).
-seq n_mbytes
sequential logfile of up to n indicates that the logging should be sequential and the file size is n megabytes. By default, logging is sequential.
-cir n_mbytes
Circular logfile of n megabytes. indicates that logging should be circular. After the file size is reached, logging starts from the beginning of the file again. The header information is not lost however.

System level tracing options

Provide more specific control over system level (kernel) tracing. In order to understand these controls, it is important to understand something about system level tracing. The following events can be traced at the system level:

  1. Process start/end
  2. Disk I/O
  3. Network TCP/IP, UDP/IP
  4. Thread start/end
  5. Image Load
  6. Registry calls
  7. File I/O
  8. Page Fault

Of these, the first 4 are enabled by default. The last 4 are not enabled, as this would generate a significant amount of extra load (resource utilization), which is best to avoid.

-nf n
sequentially to new file every n Mb.
-fio
enables file I/O tracing.
-pf
enables page faults tracing.
-hf
enables hard faults tracing. Hard page faults are those that involve a physical read, such as: read from the disk.
-img
enables image load tracing.
-um
enables Process Private tracing. In this case, the buffer is established in the private process space instead of the kernel space.
note-icon

Note

By default, the buffer is started in the kernel space.

Provider specific options: Provider level options

In order to use the following options, the provider should have this functionality enabled. One would therefore have to check with the provider (like the operating system or the directory service), before using these options.

-level n
provider-specific: a provider could have number of levels of tracing. A higher number would indicate a deeper level of tracing.
-flags n
provider-specific: perform more specific tracing. The flag passed depends on functionality available in the provider used.
[-h | -help | -?]
displays command-line help.

The default with no options is: tracelog -q.


TraceLog Examples

  1. Starts system event tracing. The default log file is c:\logfile.etl.
    tracelog –start
    Logger Started...
Operation Status:       0L
The operation completed successfully.

Logger Name:            NT Kernel Logger
Logger Id:              ffff
Logger Thread Id:       1360
Buffer Size:            8 Kb
Maximum Buffers:        25
Minimum Buffers:        2
Number of Buffers:      2
Free Buffers:           1
Buffers Written:        3
Events Lost:            0
Log Buffers Lost:       0
Real Time Buffers Lost: 0
Log File Mode:          Sequential
Enabled tracing:        Process Thread Disk TcpIp
Log Filename:           C:\LogFile.Etl
  2. Here, directory service (logger name) tracing is started with the log file being mylogfile.etl
    tracelog –guid control.guid –start ds –f c:\mylogfile
  3. Start directory service tracing.
    tracelog –start ds
    Logger Started...
Operation Status:       0L
The operation completed successfully.

Logger Name:            ds
Logger Id:              2
Logger Thread Id:       1360
Buffer Size:            8 Kb
Maximum Buffers:        25
Minimum Buffers:        2
Number of Buffers:      2
Free Buffers:           1
Buffers Written:        1
Events Lost:            0
Log Buffers Lost:       0
Real Time Buffers Lost: 0
Log File Mode:          Sequential
Log Filename:           C:\LogFile.Etl
    tracelog –start ds –guid control.guid –f c:\dslogfile.etl
    (starts directory service tracing)
  4. Stop tracing.
    tracelog –stop
    Operation Status:       0L
The operation completed successfully.

Logger Name:            NT Kernel Logger
Logger Id:              ffff
Logger Thread Id:       1360
Buffer Size:            8 Kb
Maximum Buffers:        25
Minimum Buffers:        2
Number of Buffers:      2
Free Buffers:           2
Buffers Written:        7
Events Lost:            0
Log Buffers Lost:       0
Real Time Buffers Lost: 0
Log File Mode:          Sequential
Log Filename:           C:\LogFile.Etl
    tracelog –stop ds
  5. Start tracing to a specific log file.
    tracelog –start –f kernel_log.etl
    Setting log file to: C:\Program Files\Resource Kit\kernel_log.etl
Logger Started...
Operation Status:       0L
The operation completed successfully.

Logger Name:            NT Kernel Logger
Logger Id:              ffff
Logger Thread Id:       1360
Buffer Size:            8 Kb
Maximum Buffers:        25
Minimum Buffers:        2
Number of Buffers:      2
Free Buffers:           1
Buffers Written:        3
Events Lost:            0
Log Buffers Lost:       0
Real Time Buffers Lost: 0
Log File Mode:          Sequential
Enabled tracing:        Process Thread Disk TcpIp
Log Filename:           C:\Program Files\Resource Kit\kernel_log.etl
    tracelog –start ds –guid control.guid –f ds_log.etl
  6. If current logger is a real-time logger, this will switch current logger to non real-time, sequential logger.
    tracelog –update


Overview of Event Tracing

An event represents any activity of interest, especially with respect to performance. It is typically an activity related to the usage of a resource such as the processor or disk, for example. Examples of operating system events are disk I/O and page fault events. Examples of application events are the start and end of a certain transaction (in the case of the directory service it could be the start and end of a search operation).

A trace is a continuous snapshot of the system performance. Along with each snapshot, information related to that event is also recorded simultaneously. Therefore Event tracing is an ordered set of events, generally recorded to a buffer.

Event tracing works on the WMI model. There exists a provider, a controller and a consumer, which act independently of each other.

Note

For WMI model details, see the Internet Microsoft Platform SDK.

A provider could be the Operating System or the Directory service, which registers its events (those that can be traced). Each event is associated with a specific GUID (which is unique). A list of all the events and their GUIDs can be obtained by running WBEMTest from the Run window (for details refer to SDK documentation on 'using WBEMTest'). After registering, the provider carries on with its usual activity.

When tracing has to be started, the controller takes over. It creates a buffer, where the event traces are to be recorded. Tracing is then enabled for those events that the controller would like to monitor (this is usually done by supplying the GUID of that event). The controller can be made more complex by giving it the ability to control various parameters with respect to the buffer, the log file, the type of tracing, and so on.

The consumer takes the traces that are logged, and converts them to a human readable form for further analysis. Once again, the consumer could as well have been something more sophisticated such as an application, which could trigger some kind of an event based on some value in the event trace log.

Event tracing has a number of uses. It supplements counters, in that it allows one to derive various metrics not possible using simple raw counters. A specific example is the response time metric. Event tracing allows more detailed analysis of system events and therefore can be useful for capacity planning. Event tracing can also be used (potentially by developers) for initial problem identification and the detection of system bottlenecks.

Note

Because event tracing is more resource-intensive than regular performance counters, it should not be used on a full-time basis.


Tzedit.exe: Time Zone Editor

You can use Time Zone Editor to create and edit time zone entries for the Date/Time option in Control Panel. Time Zone Editor allows you to customize such information as time zone name, abbreviation, daylight savings time dates, and difference from Greenwich Mean Time.

To edit or create time zone entries, you must be a member of the Administrators group.

To Use Time Zone Editor

In Time Zone Editor, click the Edit button to edit a time zone, or click the New button to create a new time zone entry.

For online Help while running Time Zone Editor, click the Help button or press the F1 key.

Files Required

  • Tzedit.exe
  • Tzedit.hlp


Uptime.exe: Uptime

Uptime.exe NEW

This command-line tool analyzes a single server by processing the event log to determine reliability, availability, and current uptime. The target system can either be the local system or a remote system.

In its simple form, the tool displays the current system uptime, that is, the length of time since the last restart. An advanced option allows you to access more detailed information such as shutdowns, restarts, operating system failures, and Service Pack installation. Many factors affect these calculations, and the results displayed by this tool should be considered estimates.

No special privileges are required for basic operation. But it is best to run the tool under an administrative account, since much more information is available to calculate system uptime and availability. For instance, the time zone of the system, which is important to many of the calculations, can only be reliably obtained by an administrator. Additionally, when calculating the Current System Uptime, Uptime attempts to use the System Performance Counter for Uptime. However, if the user is not an administrator, this counter may be unavailable. In this case, an estimate is made based on the last recorded boot noted in the event log.

Requirements

Availability calculations require:

  • Windows 2000 or Windows NT version 4.0 Service Pack 4 or higher
  • that the system heartbeat be active

The system heartbeat is a date/time stamp that is written to the system registry at a fixed interval. This heartbeat is available in Windows 2000 and Windows NT 4.0 Service Pack 4 or later. It is enabled by default on Windows 2000 Server. Since the heartbeat causes the registry to be written to the disk at regular intervals, it can interfere with systems running various forms of power management. It is not recommended that you enable the heartbeat of a laptop system.

To enable the heartbeat, run:

uptime /heartbeat [\\computer]

If the heartbeat is disabled, or if you are not running Service Pack 4 or later, Uptime may report that the event logs do not contain sufficient information to calculate system availability. This is because the tool detects an abnormal shutdown (for instance a Stop error (also known as "blue screen") or power failure) but cannot determine how long the system was down during this abnormal outage.

Application Failures

Application Failure event detection is dependent upon Dr. Watson (a Windows 2000 diagnostic utility) being enabled.

Stop Errors (Blue screens)

Stop error detection is dependent upon the system being configured to write an event to the event log if the system stops unexpectedly.

To enable Stop error event logging for Windows NT 4.0:

  1. Open Control Panel and double-click System.
  2. Select the Startup/Shutdown tab.
  3. Check the Write an event to the system log check box.

To enable Stop error event logging for Windows 2000:

  1. Open Control Panel and double-click System.
  2. Select the Advanced tab.
  3. Click Startup and Recovery.
  4. Check the Write an event to the system log check box.

Potential sources of error

All calculations are based on the entries in the event log. If the system time is altered significantly, this has a dramatic affect on the calculations made. Additionally, if the event logs have been cleared, or have become so full that additional events cannot be written, the tool's ability to accurately estimate system availability is affected.

The heartbeat is generally written every five minutes, so the amount of downtime calculated for abnormal outages is limited in accuracy to this window.

Systems that are members of a cluster are currently unsupported by Uptime. If the tool detects that the target system might be a member of a cluster, it displays a message stating that the results might be in error.

Uptime Topics

  • Uptime Syntax
  • Uptime Examples

File Required

  • Uptime.exe


Uptime Syntax

One Step uptime [server] [/s] [/a] [{ /d:mm/dd/yyyy | /p:n }] [/heartbeat] [{ /? | /help }]

Where:

uptime
run with no options, returns the uptime (length of time since the last restart) of the local computer.
Example
server
specifies the name or IP address of a remote server to process.
/s
displays key system events and statistics.
Example
/a
displays application failure events along with all of the system information displayed by /s.
/d:mm/dd/yyyy
calculates only for events after mm/dd/yyyy.
/p:n
calculates only for events in the previous n days.
Example
/heartbeat
toggles on or off the system's heartbeat.
Example
/?
displays basic usage.
/help
displays additional usage information.


Uptime Examples

Example One

Uptime with no options returns the system's uptime:

c:\uptime
\\DONFUNK-DEV2 has been up for: 13 day(s), 17 hour(s), 3 minute(s), 35 second(s)

Example Two

Uptime with the /s option returns system start and stop events as well as availability calculations.

c:\uptime /s
Uptime Report for: \\DONFUNK-DEV2

Current OS: Microsoft Windows 2000 Uniprocessor Free.
Time Zone: Pacific Daylight Time

System Events as of 9/15/1999 10:54:10 AM:

Date:      Time:        Event:               Comment:
---------- -----------  -------------------  -----------------------------------
 7/26/1999  1:01:48 AM  Boot
 7/26/1999  6:46:35 PM  Shutdown             Prior uptime:0d 17h:44m:47s
 7/26/1999  6:49:21 PM  Boot                 Prior downtime:0d 0h:2m:46s
 7/27/1999 11:49:23 AM  Shutdown             Prior uptime:0d 17h:0m:2s
 7/27/1999 11:52:14 AM  Boot                 Prior downtime:0d 0h:2m:51s
  8/5/1999 12:06:46 PM  Shutdown             Prior uptime:9d 0h:14m:32s
  8/5/1999 12:17:16 PM  Boot                 Prior downtime:0d 0h:10m:30s
  8/5/1999 12:37:10 PM  Shutdown             Prior uptime:0d 0h:19m:54s
  8/5/1999 12:39:32 PM  Boot                 Prior downtime:0d 0h:2m:22s
  8/6/1999  5:14:20 PM  Shutdown             Prior uptime:1d 4h:34m:48s
  8/6/1999  5:25:12 PM  Boot                 Prior downtime:0d 0h:10m:52s
  8/6/1999  5:43:10 PM  Shutdown             Prior uptime:0d 0h:17m:58s
  8/6/1999  5:45:31 PM  Boot                 Prior downtime:0d 0h:2m:21s
 8/23/1999 11:17:44 AM  Shutdown             Prior uptime:16d 17h:32m:13s
 8/23/1999 11:21:07 AM  Boot                 Prior downtime:0d 0h:3m:23s
  9/1/1999  5:10:32 PM  Shutdown             Prior uptime:9d 5h:49m:25s
  9/1/1999  5:13:18 PM  Boot                 Prior downtime:0d 0h:2m:46s
  9/1/1999  5:33:19 PM  Abnormal Shutdown    Prior uptime:0d 0h:20m:1s
  9/1/1999  5:39:14 PM  Boot                 Prior downtime:0d 0h:5m:55s

Current System Uptime: 13 day(s), 17 hour(s), 2 minute(s), 21 second(s)

--------------------------------------------------------------------------------

Since 7/26/1999:

           System Availability: 99.9409%
                  Total Uptime: 51d 9h:8m:36s
                Total Downtime: 0d 0h:43m:46s
                 Total Reboots: 10
     Mean Time Between Reboots: 5.14 days
             Total Bluescreens: 0

Example Three

To view a system's information for the previous n days, the /p:n switch may be used. For example to view the system information for the last 10 days use:

c:\uptime /s /p:10

Uptime Report for: \\DONFUNK-DEV2

Current OS: Microsoft Windows 2000 Uniprocessor Free.
Time Zone: Pacific Daylight Time

System Events as of 9/15/1999 11:01:22 AM:

Date:      Time:        Event:               Comment:
---------- -----------  -------------------  -----------------------------------

Current System Uptime: 13 day(s), 17 hour(s), 9 minute(s), 32 second(s)

--------------------------------------------------------------------------------

Since 9/5/1999: (Last 10 Days)

           System Availability: 100.0000%
                  Total Uptime: 10d 11h:1m:22s
                Total Downtime: 0d 0h:0m:0s
                 Total Reboots: 0
             Total Bluescreens: 0

Example Four

Uptime also allows the user to turn on and off the system's "heartbeat."

c:\uptime /heartbeat

The system heartbeat is a timestamp written to the registry
at a fixed interval. This timestamp is used by UPTIME
to calculate how long a system was down when it fails
to go through a normal shutdown. Using this heartbeat may
interfere with power management since it writes to the
disk at regular intervals. Therefore the system heartbeat
should not normally be used on a laptop.

NOTE: Any change to the heartbeat settings will not take
effect until the next reboot.

The system heartbeat is currently enabled.


W2000msgs.chm: Windows 2000 Error and Event Messages Help

This HTML Help file lists most of the error and system-information messages generated by Windows 2000, providing explanations of each message and suggestions on how to correct the problem. Some messages generated by applications or device drivers have been included as well.

Important

Windows 2000 Error and Event Messages Help is not intended as an exclusive reference. If, for example, you encounter a network error message, you can find information about it by typing net helpmsg and the message identification number at the command prompt.

Messages Help Topics

  • Installing Messages Help
  • Using Messages Help
  • Messages Help Notes

File Required

  • W2000msgs.chm

For More Information

An Access database of event messages, W2000events.mdb: Windows 2000 Events, is provided in the Windows 2000 Resource Kit.


Installing Messages Help

System Requirements

This file uses the HTML Help user interface that is installed with Windows 2000.

Installation

Messages Help is installed on your system when you install the Windows 2000 Resource Kit.

Uninstalling Messages Help

To uninstall Messages Help, simply delete W2000msgs.chm from your local system.


Using Messages Help

HTML Help Open Windows 2000 Error and Event Messages Help.

How Messages in this Help File are Organized

The messages in this file have been organized to reflect the Windows 2000 desktop. The messages appear in the Help file as follows:

  • Messages are normally followed by a description of the circumstances that might generate the message and, if appropriate or needed, by a suggested user action.

  • Variable names appear in italics.

  • Most status messages that require no user action are not documented.

How to Search for Messages

There are several ways to search for messages in the Messages Help file. On the Contents tab is a hierarchical listing of topics grouped by application catagory or component as found on the Start menu. (Some additional topical groupings which are not application-specific are also included.) This list includes (in alphabetical order):

  • Accessories

  • Administrative Tools

  • Command Line Tools

  • Control Panel

  • Desktop

  • Dynamic Link Libraries

  • Enterprise

  • Event ID

  • Event Log

  • Help

  • Internet Information Services

  • Kernel

  • Logon

  • Setup

Double-click a main component to see a list of the applications that are associated with that component. For example, if you want to find an error message for Notepad, double-click Accessories on the Contents tab. Select Notepad to view an alphabetical list of the messages for that application.

Clicking the In Alphabetical Order button provides access to messages arranged alphabetically by the first letter of the first word of the message. Click the letter that corresponds to the initial letter in the message. If you cannot find the message that appears on your screen in the alphabetical list, it might be because it begins with a replaceable parameter. Variable names, which are placeholders for the specific word or number that appears in the message, are used as substitutes for replaceable parameters. They appear in italics in the Help file. For example, if the Help file message reads, "number files were not found", the error message that appears on your screen will contain the actual number.

To view the messages that begin with a variable or a punctuation mark, click the In Alphabetical Order button, then the Symbol button. These messages are alphabetized by the variable name used to replace that parameter.

  • Clicking the Event ID button displays ranges of event messages that are organized numerically. Click the appropriate range to display the corresponding messages. The log in which a message appears is indicated at the end of each message string.

  • Clicking the Event Log button displays the three event logs: Application, Security, and System. The messages in each log are listed alphabetically.


Messages Help Notes

When reviewing the help file message information, sometimes the only suggested user action is to obtain help from Microsoft product support or another technical support group. In that case, we suggest you verify that your hardware is on the Internet Microsoft Hardware Compatibility List for your specific product or application. If it is not certified, please replace it with a certified component and retest.

Product Support Suggestions

If the error still occurs, collect the following information and have it available when you contact your product support provider for help:

  • The type of hardware that you are using, including networking hardware, if applicable. Include BIOS revision number and any applied flash BIOS/firmware versions.

  • A list of all software (name and version) installed on the system, including service packs and upgrades.

  • The exact text and content of the message that appears on the screen. With messages that stop the computer completely, also note the background and text colors (white letters on a black screen or white letters on a blue screen, for example).

  • A description of actions you took immediately before the error occurred and what you were doing when the error occurred. If the error can be manually reproduced, that list of steps is critical.

  • A description of what happened after the error.

  • Did the system ever work correctly? If so, what has changed since the system last worked properly? (Hardware changes, configuration settings, applications installed, and other changes.)

  • Have your current and/or latest Emergency Repair Disk (ERD) as well as your initial ERD, if available. Also, have your last backup media handy in the event a recovery from system failure is unsuccessful.


Ntdetect.com (Installd.cmd): Startup Hardware Detector

Installd.cmd installs the debug (or checked) version of Ntdetect.com, Startup Hardware Detector, which is part of Microsoft® Windows® 2000.

On x86-based computers, NTDetect detects installed hardware components at startup time and displays the hardware information structures passed to the kernel. If the standard version of Ntdetect.com fails to detect all the hardware you think it should find, you can use the debug version, which provides more diagnostic information, to help isolate the problem. A mouse or a disk controller is the component that typically causes problems.

NTDetect displays information about the computer's system components, bus and adapter components, disk geometry, read-only memory (ROM) blocks, keyboard and communications (COM) port and parallel port components, mouse component, and floppy disk drive component. When detection is complete, you are prompted to press any key to display hardware information in the registry.

Installing NTDetect is a separate task you perform after you install the Microsoft® Windows® 2000 Resource Kit.

Caution

Under no circumstances should you delete Ntdetect.com, which is a required program for a computer running Windows 2000. The debug version installed by Installd.cmd is a special version that displays diagnostic information. If you have removed the standard version of Ntdetect.com and your system does not start correctly, use the Emergency Repair Disk to restore the original version. You can also use Installd.cmd to remove the special version of NTDetect.

NTDetect Topics

  • To Install NTDetect
  • To Remove the Special Version of NTDetect
  • Example of NTDetect Information for the System Component

Files Required

  • Installd.cmd
  • Ntdetect.com


To Install NTDetect

1) At the command prompt, switch to the folder where the Resource Kit tools are installed, and type installd

InstallD:

  • Renames the standard Ntdetect.com in the root directory of your system partition.
  • Copies the debug version of Ntdetect.com from %ResKit% to the root directory.

2) To see the results, shut down and restart the computer.

NTDetect displays information about the computer’s system components, bus and adapter components, disk geometry, read-only memory (ROM) blocks, keyboard and communications (COM) port and parallel port components, mouse component, and floppy disk drive component. When detection is complete, you are prompted to press any key to display hardware information.

3) To view more information, keep pressing any key. The information displayed is similar to what is stored in HKEY_LOCAL_MACHINE\HARDWARE\Controller x in the registry.

Example of NTDetect information for the system component

4) After all information for detected hardware is displayed, you can press SPACEBAR to use the LastKnownGood control set instead of the current control set to start the system.

This allows a system experiencing problems to revert to the last configuration that started successfully.


To Remove the Special Version of NTDetect

one step At the command prompt, type installd /not


Example of NTDetect information for the System Component

Current Node: 00050000

Type: MaximumType

Child: 00050045

Parent = 00000000

Sibling: 00000000

ConfigurationData = 00000000

IdentifierLength = 0000011

Identifier= AT/AT COMPATIBLE

ConfigdataLength = 00000044

Version = 0000, Revision = 0000

Count = 0002

Type = Device Data

Size = 0000000C

0080 0000 00DB 000 0000 0000 002 0000 000B 0000 0001 0000


Support Web Site

The Internet Microsoft Support Web site helps users find troubleshooting information, download drivers and other files, and contact Microsoft Product Support Services directly. The Microsoft Knowledge Base is also available through this site.


Windows NT 4.0 OEM Support Tools

Windows NT 4.0 OEM Support Tools NEW

The Microsoft® Windows NT® version 4.0 OEM Support Tools are troubleshooting and development tools for those working with Windows NT Server and Workstation, versions 3.51 and 4.0, including all Service Pack revisions. The tools extend the functionality of existing debugging tools, such as Windows Debugger, provide new features upon which new debugging methodologies can be based, and provide development support.

The Windows NT Support Tools feature four components:
  • Kernel Debugger Extensions New debugger extensions to facilitate examination and analysis of a wider range of kernel data structures than is conveniently possible today, especially when dealing with crash dumps.
  • Pool Enhancements Tools for memory pool caller-tracking/tail-checking, pool logging, pool free block pattern fill, and increasing available pool statistics.
  • Kernel Memory Space Analyzer A heuristics-based kernel memory crash dump analysis tool to aid in diagnosing memory corruption problems. This tool discovers and analyzes anomalies in the kernel memory space.
  • User Mode Process Dump A tool that allows users to create dump files from any Win32 process, such as csrss.exe or explorer.exe, that can be examined using Windows Debugger. The tool allows for manual creation of dump files via the command line or hot-key, or automatic creation when exceptions occur in monitored processes.

OEM Support Tools Topics

  • Installing the OEM Support Tools

Files Required

The files required for Windows NT 4.0 OEM Support Tools are located on your Microsoft® Windows® 2000 Resource Kit companion CD.

To use this tool, you must install it. See Installing the OEM Support Tools for more information.

For More Information

See Userdocs.doc, which is contained in the Support.zip file in the <cdroot>\apps\oemsuptools, for more information. Also refer to the relnote.txt file in the same directory for known issues and restrictions.


Installing the OEM Support Tools

The Windows NT 4.0 OEM Support Tools are not installed during Windows 2000 Resource Kit installation. To install them, use the following procedure:

To install the OEM Support Tools

  1. Insert the Microsoft Windows 2000 Resource Kit companion CD in your CD-ROM drive.
  2. When the setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\oemsuptools directory, copy support.zip and the other files you need for your platform to a directory (t202alp.zip and t202alps.zip for Alpha-based computers; t202x86 and t202x86s.zip for x86-based computers).
  4. Extract the files from the .zip files.
  5. To install each set of tools, refer to the userdocs.doc file extracted from support.zip. Also refer to the relnote.txt file contained in <cdroot>\apps\oemsuptools directory for known issues and restrictions.

The five .zip files contain the following:

  • support.zip - User Document and Sample Source Code
  • t202alp.zip - Binaries for Alpha-based computers
  • t202alps.zip - Symbols for Alpha-based computers
  • t202x86.zip - Binaries for x86-based computers
  • t202x86s.zip - Symbols for x86-based computers


Gpolmig.exe: Group Policy Migration

Gpolmig.exe: Group Policy Migration NEW

This command-line tool helps to migrate Microsoft® Windows NT version 4.0 System Policies to Microsoft® Windows® 2000.

GPolMig migrates settings from Windows NT 4.0 policy files to the Windows 2000 Group Policy object structure. The location of the registry settings that implements software policy has changed in Windows 2000 and therefore the migration might not have an effect on some applications and components.

GPolMig Topics

  • GPolMig Syntax
  • GPolMig Example

File Required

  • Gpolmig.exe


GPolMig Syntax

One Step gpolmig policyfilepath [/list] [/listgpo] [/migrate objecttype name GPO]

Where:

policyfilepath
is the path to the Windows NT 4.0 policy (.pol) files.
/list
lists the policies in a Windows NT 4.0 policy file by objecttype.
/listgpo
lists the Group Policy objects open and available for import.
/migrate
specifies three additional parameters to perform in migration of policy.
objecttype
is one of the following from the Windows NT 4.0 policy file:
computer, user, or group.
name
is the name of the object in the Windows NT 4.0 policy file to use as a source.
GPO
is the name of the Group Policy object to which to migrate the settings (determined by the Group Policy objects you have open for editing).


GPolMig Examples

To list the policies in a Windows NT policy file:

gpolmig c:\temp\ntconfig.pol /list

To list the current Group Policy objects open for import on this computer:

gpolmig c:\temp\ntconfig.pol /listgpo

To migrate computer policy to a Group Policy object:

gpolmig c:\temp\ntconfig.pol /migrate computer mymachine {00000000-0000-0000-0000-000000000000}Machine

To migrate user policy to a Group Policy object:

gpolmig c:\temp\ntconfig.pol /migrate user user1 {00000000-0000-0000-0000-000000000000}User

note-icon

Note

View the properties of the Group Policy object to determine the GUID placeholder.


Hardware Compatibility List Web Site

The Internet Microsoft® Windows® Hardware Compatibility List Web site describes the computers and peripherals that have been tested and found compatible with Windows operating systems.


Lbridge.cmd: L-Bridge

Lbridge.cmd: L-Bridge NEW

This batch script assists in managing directory service replication in mixed-mode environments and in migrating from the LMRepl file replication service used by Microsoft® Windows NT® version 4.0 to System Volume (sysvol) and File Replication Service (FRS), which are used by Microsoft® Windows® 2000.

On Windows NT 4.0 domains, LMRepl is generally used to replicate logon scripts to all domain controllers. Windows 2000, however, does not support LMRepl. Windows 2000 Active Directory uses FRS to automatically and transparently replicate the sysvol, which includes logon scripts, to all domain controllers.

L-bridge provides a bridge between the replication architectures of Windows NT 4.0 and Windows 2000. This script moves files from the Windows 2000 sysvol to the Export directory used by LMRepl on Windows NT 4.0 servers. The benefit of this approach is that it keeps the two replication mechanisms physically separated from one another, so that no legacy services are introduced onto the Windows 2000 domain controller.

Lbridge.cmd is a sample batch file that you can adapt to your own needs. It can use either XCopy, a Windows 2000 tool, or RoboCopy as the file-copying application. For more details on using Lbridge.cmd, open the batch file with a text editor like Notepad and read the comments in the script.

File Required

  • Lbridge.cmd


Netset.exe

Netset.exe NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This tool can be used to configure a variety of network parameters from the command prompt. It can list, install, configure and uninstall networking components. This makes NetSet useful for automating post-setup network configuration in unattended mode when deploying Windows 2000 on multiple computers.

NetSet can also facilitate unattended resetting of network parameters on individual computers when recovering from user errors or hardware failures.

To list installed components, use the /display option.

For other operations, you must provide an answer file, which is a text file that describes the actions you want to perform. For more information on the syntax of the answer file, see Unattend.doc: Unattended Setup Parameters Guide, also included in the Windows 2000 Resource Kit.

NetSet Syntax

One Step netset { drive:\path\filename | /display } [/?]

Where:

drive:\path\filename
specifies the full path to the answer file.
/display
displays a list of installed networking components.
/?
displays this syntax at the command prompt.

Files Required

  • Netset.exe


Setupmgr.exe: Setup Manager

The Setup Manager deployment tool is a wizard that assists system administrators in installing Windows 2000 on multiple computers. Setup Manager can:

  • Create answer files that can be used to automate the installation of Windows 2000 on multiple computers.
  • Extract the configuration information from a preconfigured system into an answer file, which can then be used to replicate that configuration on other computers.
  • Create a distribution share point for network installations. In addition to the Windows 2000 installation files, this network installation share can contain additional applications, drivers, additional commands to run at the end of setup, and other custom components, as specified by the system administrator.

Answer Files

Setup Manager helps administrators to create answer files, which are used by Windows 2000 Setup to perform unattended installations or upgrades of Windows 2000. Answer files answer the questions that Setup would normally ask the user while it is installing or upgrading Windows 2000. For example, Setup normally asks the user to supply a name for the computer. But if the administrator supplies the name for the computer in the answer file, Setup does not have to prompt the user.

When you use the Setup Manager Wizard to create an answer file, it prompts you for setup information on wizard pages, many of which look like the pages you see when running an attended Setup. Note that answer files do not automatically eliminate the need for user input when Setup runs. The parameters in answer files must be set to require little or no user interaction.

User-Interaction Level

Windows 2000 Setup runs in one of five unattended modes that controls how much it interacts with the user. In a fully unattended installation, Setup does not prompt the user for any information and you must supply all required information in the answer file. In this case, Setup Manager requires that you specify data for all required settings. When using any of the other unattended modes, Setup Manager allows you to not specify some data. If you do not wish to specify a particular setting in the answer file, leave that field blank, or, when prompted, choose "Do not specify this setting".

Note

If you are upgrading an existing Windows 2000 installation, Setup uses the parameters of the existing installation and ignores parameters specified in the answer file.

Setup Manager is a Win32 application that runs only on Windows 2000.

Starting Setup Manager

After installing the Windows 2000 Resource Kit, you can run Setup Manager from the Windows 2000 Resource Kit Start Menu Deployment Tools group, from the command prompt, or by clicking the "Run Setup Manager now" link at the top of this page.

To run Setup Manager from the command prompt, type:

setupmgr

Setup Manager Topics

  • AutoLogon
  • Distribution Folder
  • Running Your Own Commands: GuiRunOnce and Cmdlines.txt
  • Batch Scripts: .Bat and .Udf Files
  • Remote Install
  • SysPrep Install
  • Troubleshooting Setup Manager

Files Required

  • Setupmgr.exe
  • Setupmgx.dll

For More Information

For detailed information about deploying Windows 2000, visit the Internet Windows 2000 Server Deployment Web site.


AutoLogon

After the unattended setup is complete you can make the newly-installed system to automatically log in as the Administrator.

Enabling AutoLogon prevents network printers from being installed for a domain user's account. Instead, the system processes the GuiRunOnce key while logged on as Administrator. If you install network printers, AutoLogon should not be enabled.


Distribution Folder

A distribution folder enables you to supply your own files that Windows Setup automatically copies to the target computers. Setup Manager can guide you through the process of creating a distribution folder.

Such files could include help files that you want to install on every computer in your organization or device drivers not shipped with Windows 2000. They could also be your own applications that you want to deploy to the target computers.

When you create a distribution folder using the Setup Manager Wizard, you need at least enough free disk space to hold the Windows 2000 operating system CD plus the amount of disk space needed to store the files you are deploying yourself.

Use the Additional Dirs page to supply your own files to be deployed. First expand and collapse the tree-view to select the destination for the files. Once you select where to copy the files to, click AddFiles, and Setup Manager will allow you to browse for a file or folder to copy.

If you examine your distribution folder after using the Additional Dirs page, you will notice that all of the files and folders you copied were stored in a subdirectory named $oem$. Also, notice that the files you want placed in the System Drive tree were placed in $oem$\$1. Each of the special keys that are displayed on the Additional Dirs page maps to a special sub-directory of the $oem$ directory.

When an unattended Setup runs using a distribution folder, the entire tree rooted at $oem$ is copied to the temporary Windows Setup directory $WIN_NT$.~LS. At some point during Setup, trees in special subdirectories, such as $1, are copied to the corresponding location on the target computer. At the end of Setup, the $oem$ tree is deleted.


Running Your Own Commands: GuiRunOnce and Cmdlines.txt

Setup Manager contains two similar pages that allow you to run your own commands. The difference between these pages should be noted.

Run Once

The Run Once page is implemented by using the GuiRunOnce key of the answer file. This key is processed when setup is completed and the first logon occurs.

Command Lines

The Command Lines page is implemented using the distribution folder. Setup Manager writes the list of commands you enter to a special file, Cmdlines.txt, saved in the $oem$ subdirectory of your distribution folder.

Unlike the Run Once commands, the commands in Cmdlines.txt are processed at the end of Setup, just before it restarts to prompt for the first logon.

Note that while Setup runs, nobody is logged in. Therefore, commands run on the Command Lines page do not have access to protected network resources.

Note

Windows Installer application installations cannot be initiated from a Cmdlines.txt file.


Batch Scripts: .bat and .udf Files

Setup Manager creates a sample batch script to illustrate how to use the answer file you created. In certain cases, the sample batch script must be modified before it will work properly.

In all cases, the answer file must be passed to Windows Setup using the /unattend: option of either the winnt32 (for Win32 systems) or the winnt commands (for MS-DOS). See the sample batch script for an example.

If you are deploying using a distribution folder, the sample batch script must be changed to refer to the correct distribution folder.

If you copied the answer file to a different location, the batch script must be modified to refer to the new location.

If you specified multiple computer names, Setup Manager creates a batch script that expects the computer name to be passed on the command line. In this case, the .udf file must also be present.

When using the .udf file for multiple computer name assignment, it must be passed to winnt32 or winnt using the /udf option. See the sample batch script for an example.


Remote Install

When you create an answer file to be used with a Remote Install Server (RIS), Setup Manager creates a .sif file instead of the usual .txt file.

A sample batch script is not created in this case. You must use the Administration tools shipped with RIS to enable your new .sif file.


SysPrep Install

When you create an answer file for a Sysprep Install, an .inf file is generated. To use this answer file it must be placed on your system drive in the Sysprep folder (for example C:\Sysprep) or on a floppy disk that is inserted when the Windows 2000 start menu appears. The files Sysprep.exe and Setupcl.exe must also be in the Sysprep folder. Running Sysprep.exe or the .bat file generated by Setup Manager will prepare the hard drive for duplication. For ease of use, you can choose to have Setup Manager create the Sysprep folder for you with all the necessary files. You should only choose to do this if you are running Setup Manager on the computer to be duplicated.

Note

The Sysprep folder is deleted after the hard drive is powered-up and Windows Setup completes.

See Sysprep.exe for more detailed information on using the Sysprep tool.


Troubleshooting Setup Manager

Q: My Fully Automated Setup stops because the directory \Winnt already exists. How can I prevent this?

A: Choose, "Yes, edit additional settings". When you get to the Target Path page, enable "Automatically generate a unique name."

Q: How do I install on a particular drive letter?

A: Use the /tempdrive: option on winnt32 or the /t: option with winnt to point to the desired destination partition.


Sysdiff.exe

Sysdiff.exe: Automated Installation Tool

Using this tool, you can pre-install applications as part of an automated setup, including applications that do not support scripted installation.

Using SysDiff is a three-step process:

  1. Create a "snapshot" of Microsoft® Windows® 2000 Professional after it has been installed on a reference computer. This is the SNAP mode (/snap option).
  2. Install the applications you want on the reference computer and create a difference file with information on the these applications. SysDiff enables you to view this difference file in a readable format. This is the DIFF mode (/diff option).
  3. Apply the difference file to new installations on other computers, as part of an unattended setup or at any time after initial installation is complete. This is the INF mode (/inf option).

If many applications must be installed, the difference file can become unmanageably large, as it contains the files and settings for all these applications. In this case, SysDiff enables you to create from the difference file an information (.inf) file containing only registry and initialization (.ini) file directives. You can then use this information file to install the applications.

To create this separate .inf file, run SysDiff using the /inf switch.

Sysdiff.inf is a model information file used to customize SysDiff while the tool is running. Do not use Sysdiff.inf as a model for the kind of .inf file used to apply only registry changes and .ini file changes.

SysDiff Topics

  • SysDiff Troubleshooting Tips

Files Required

  • Sysdiff.exe
  • Sysdiff.hlp


SysDiff Troubleshooting Tips

The following are a selection of general tips on troubleshooting SysDiff.

  • How to Troubleshoot SysDiff Error Messages
  • Behavior You Can Expect if the Problem Is a Bad .inf File
  • What to Do if You Suspect a Corrupted Diff File

How to Troubleshoot SysDiff Error Messages

SysDiff uses the Windows error numbering system to report problems. To determine the meaning of a SysDiff error message, that is, to translate the error number into a message, switch to the MS-DOS prompt and type the following

   NET HELPMSG <number>

where <number> is the number of the SysDiff error message.

For example, SysDiff stops responding and the following error message appears:

   ERROR MESSAGE: SYSTEM ERROR 5

When you type

   NET HELPMSG 5

at the MS-DOS prompt, the meaning of "System Error 5" appears:

   Access is denied.

When you use this same method to decode the error message "SYSTEM ERROR 32," the following information appears:

   The process cannot access the file because it is being used by another process.

In this way, you can decode the meaning of the error numbers.

How to Troubleshoot "Installation Failed" Applying .inf.

There are many causes for this error message. It is not the purpose of this article to try to catalog all of them. This article shows you how to determine exactly where the apply command is failing and explains some general reasons for such failures.

The .inf file is created by the sysdiff /inf /m command and is placed in the $OEM$ directory. This file contains changes that are to be made to the registry. It also tells you the version of SysDiff that was used to create it, the system root directory and the total diff count.

The .inf file is executed sequentially, from the bottom up. To determine where it has failed, it is necessary to open the file in a text editor (such as Notepad) beside the registry editor. Each line of the file, following the [AddReg] section heading, represents a single change to the registry. These are abbreviated; HKCR stands for HKEY_CLASSES_ROOT, HKLM stands for HKEY_LOCAL_MACHINE, and so on.

Instead of starting at the bottom and working your way up, it might be better to start at the middle and work your way out. Look at the line in the .inf file and check the registry to see if that line was written. If it was, move to the halfway mark between there and the end of the file until you find a line that was not written. From there, locate the last line that was written; this will show you the last thing SysDiff successfully wrote to the registry.

When SysDiff encounters an entry that it cannot write, it stops writing from that point forward and reports an error message that tells you that the installation failed. SysDiff will then prompt you to continue. SysDiff will continue, but all entries from that point forward are not written. Changes that are made to .ini files are included in the [updateinis] section near the end of the .inf file. If you suspect the problem is in updating .ini files, comment out this section and see if SysDiff will continue.

Debugging .inf files can be a time-consuming process. It is not, however, necessary to do a full SysDiff /apply command to test it each time you comment something out. Because all the Cmdlines.txt is doing is reading the .inf file and writing each entry, you can configure it to do only that:

Copy Cmdlines.txt and the .inf file from the $oem$ directory to the local Windows 2000 installation.

Copy Cmdlines.txt to a *.bat file (like Go.bat).

Open the *.bat file in a text editor (such as Notepad), delete the [Commands] heading and remove the quotation marks and save the changes.

Carry out the go.bat.

The above procedure is much faster than doing a full SysDiff /apply to debug an error in the .inf file.

Note

Make certain that the \%WinDir%\System32 is in the environment path.

Important

Make certain that you do this to a computer that has already failed in the installation. The main reason for verifying that this is done to a failed installation as opposed to a clean install is that if the application directories and .ini files do not exist, SysDiff will always return an error when it tries to write to files that are not there.

Behavior You Can Expect if the Problem Is a Bad .inf File

  • When you double-click an application, it starts, and then an hourglass appears and then goes away.
  • When you double-click files in Windows Explorer, you get a message stating that there is no application associated with this file (even though you know that a .xls file belongs to Excel, for example).
  • Programs do not appear in the Start menu but do appear on the hard disk drive. (This can also be due to forgetting the /m parameter on the SysDiff /inf command line).

Things that cause an .inf file to fail include:

  • An attempt to write to a key that the current user no longer has access to or that SysDiff cannot, by its nature, write to. An example of this is a failure to write to changes in the Boot.ini. SysDiff cannot write to a read only file.
  • An attempt to write to a key that no longer exists.
  • Corrupted diff file (see below).

What to Do if You Suspect a Corrupted Diff File

One of the problems with creating the snapshot, diff, and .inf file over the network is network problems or bottlenecks. The diff file contains an image of all of the files that have been added since the image file was created. Creating this large a file over a network connection can leave you wide open for data corruption.

A corrupted diff file may be the cause when you do everything right, and you verify the integrity of the .inf file (using the Go.bat procedure outlined above) but the apply still fails. Diff files are huge. If there are any network bottlenecks at all, it is easy for these files to become corrupted. To resolve this, try the following:

  1. Create the snapshot, diff, and .inf files locally.
  2. Manually copy the $oem$ file to the I386 share, then run the unattended installation.


Sysprep.exe

SysPrep is a tool designed for corporate system administrators, original equipment manufacturers (OEMs), and other personnel who need to deploy Microsoft® Windows® 2000 on multiple computers. After performing the initial setup steps on a single system, you can run SysPrep to prepare the sample computer for cloning. SysPrep assigns a unique security identifier (SID) to each target computer the first time the computer is restarted. SysPrep also creates a Mini-Setup wizard that runs the first time the target user reboots the computer. This shortened GUI-mode setup takes five to six minutes instead of 45 to 60 minutes and prompts the user only for required and user-specific information, such as the End User License Agreement, Product ID, and user name and company.

SysPrep is a valuable tool even if you don’t use disk duplication. You can run SysPrep with the -nosidgen switch to create a shortened Mini-Setup on a single computer. In this case, SysPrep allows for auditing that might have been done, automates the Mini-Setup portion of the process so that users can still enter user-specific information such as regional options and Telephony API (TAPI) information, and bypasses setting up unique SIDs since the SIDs will already be unique when Setup is actually run on the computer.

Note

The combination of Sysprep.exe and Setupcl.exe replaces the Rollback.exe tool used in automating deployment of Microsoft® Windows NT® version 4.0.

SysPrep Topics

  • Using SysPrep
  • Using SysPrep for Disk Duplication
  • Using SysPrep to Audit Installations
  • Automating Mini-Setup
  • SysPrep Syntax

Files Required

  • Sysprep.exe
  • Setupcl.exe


Using SysPrep

When deploying Windows 2000, you can completely install the operating system and preconfigure the shell and applications to the degree required. You can then use SysPrep to enable user-specific customization when the computer is delivered or setup for the user. In this case, the first time the end user starts the computer, Mini-Setup runs to prompt the user for a minimal amount of information. The SysPrep folder is deleted from the hard drive after Mini-Setup completes.

The SysPrep tool can be used in three different contexts:

  • Disk duplication. Using SysPrep with disk duplication allows you to copy fully installed systems when the hardware is similar. It modifies the local computer security identifier (SID) so that it is unique to each computer.
  • Auditing. When you use SysPrep after auditing the computer (using the -nosidgen parameter), SysPrep will be ready for the end user to run Windows.
  • Automating Mini-Setup. SysPrep creates a shortened GUI-mode setup that takes five to six minutes instead of 45 to 60 minutes and prompts the end user only for required and user-specific information, such as the End User License Agreement, Product ID, and user name and company. To use SysPrep in this mode, pre-install Windows 2000 on the local computer and then run SysPrep with the -nosidgen parameter, as in the procedure below.

To manually restore the computer to an end-user ready state with SysPrep

  1. On the Start menu, click Run, and then type:

    cmd

  2. At the command prompt, change to the root of the system drive (%SystemDrive%) and then type: md sysprep
  3. From the directory where you installed the Resource Kit, copy Sysprep.exe and Setupcl.exe to the SysPrep folder you have created.
  4. At the command prompt, change to the SysPrep folder, and then type: sysprep -nosidgen
    with the parameters you choose. See SysPrep.exe Syntax for a list of command-line parameters.
  5. The computer will shut down if it is ACPI-compatible. If it is not ACPI-compatible, a message will appear telling you to shut down the computer when the process has completed.

To automate the process of restoring the computer to an end-user ready state with SysPrep when using distribution folders and answer files

  1. To the \$OEM$\$1 folder of your distribution folders create a subfolder called \Sysprep.
  2. Add Sysprep.exe and Setupcl.exe to the \$OEM$\$1\Sysprep folder from the directory where you installed the Resource Kit. A Sysprep.inf answer file can also be created and placed in this folder if desired.
  3. In your answer file, add the following line to the bottom of the [GuiRunOnce] section:
    %SystemDrive%\sysprep\sysprep.exe -quiet additional parameters as required

    See SysPrep.exe Syntax for a list of command-line parameters.

  4. After Windows 2000 Setup completes, the computer will shut down if it is ACPI-compatible. If it is not ACPI-compatible, a message will appear that instructs you to shut down the computer when the process has completed.

Notes

In the current version of Windows 2000:

  • You can run SysPrep from any location, including a floppy disk.
  • SysPrep runs only if the computer is a member of a workgroup, not a domain. However, you can use SysPrep to add the computer to a domain when the Mini-Setup wizard runs.
  • You can run additional commands at the end of Mini-Setup by providing a Cmdlines.txt in your SysPrep folder. For more information about this option, see "Using Cmdlines.txt," in the Microsoft® Windows® 2000 Server Resource Kit Deployment Planning Guide.
  • You cannot run SysPrep on a computer that has been configured as a Cluster service server or a Certificate Services server. However, you can use SysPrep to duplicate a standalone server that will later be configured as a domain controller, a cluster services server, or a certificate services server.


SysPrep: Automating Multiple Installations with Disk Duplication

Using SysPrep for Disk Duplication

To use SysPrep as part of the disk duplication process, the following requirements must be met:

  • The master and destination computers must have compatible HALs. For example, HAL APIC and HAL MPs (multiprocessor systems) are compatible, whereas HAL PIC (Programmable Interrupt Controller) is not compatible with either HAL APIC or HAL MPs.
  • The mass storage controllers (IDE or SCSI) must be identical between the master and destination computers.
  • Plug and Play devices such as modems, sound cards, network cards, and video cards do not have to be the same, but drivers for those devices should be available.
  • Third-party software or disk-duplicating hardware devices are required. These products create binary images of a computer's hard disk, and they either duplicate the image to another hard disk or store the image in a file on a separate disk.
  • The size of the destination computer’s hard disk must be at least the same size as the master computer’s hard disk. If the destination computer has a larger hard disk, the difference is not included in the primary partition. However, you can use the ExtendOemPartition key in the Sysprep.inf file to extend the primary partition if it was formatted as NTFS.

Note

If the master and target computers have different BIOS versions, you should test the process first to ensure success.

When using SysPrep for Disk Duplication, SysPrep modifies the local computer security identifier (SID) so that it is unique to each machine.

To prepare a master computer for cloning

  1. Install Windows 2000 on a master computer. As a best practice, it is recommended that Windows 2000 be installed from a distribution folder using an answer file to help ensure consistency in configuring the master computer so that iterative builds can be created and tested more readily. (See Unattend.doc for information on automating Windows 2000 setup using an answer file.)
  2. Log onto the computer as administrator.
  3. (Optional) Install and customize applications (for example: Microsoft Office, Internet Explorer favorites).
  4. (Optional) Run audit tests.
  5. (Optional) If desired, create a SysPrep.Inf file manually or with the aid of SetupMgr.exe. This file is used to further customize each computer for the user and helps to set the amount of information for which the user will be prompted during Mini-Setup.
  6. Run Sysprep.exe. Make sure that both the Sysprep.exe and Setupcl.exe files exist together in the %SystemDrive%\Sysprep folder on the local hard disk. When used, the Sysprep.inf also needs to be in the same folder or on a floppy disk that is inserted when the Windows 2000 startup menu appears.

    Important If Setupcl.exe is not in the same directory as SysPrep.exe, SysPrep will not work.

  7. If the computer is ACPI-compliant, the computer will shut down by itself. If not, a dialog will appear stating that it is safe to shut down the computer.
  8. Take out the system drive and follow your procedures for duplicating the system on other computers. You must have special equipment or software for duplicating hard disks.

After a duplicated hard disk is inserted into a computer, when the user turns the computer on, the following happens:

  1. Plug and Play detection occurs; this takes approximately three minutes.
  2. The Mini-Setup wizard runs to prompt users to:
    • Accept the EULA
    • Enter their name and organization
    • Join a domain or a workgroup
    • Specify regional options information
    • Specify TAPI information
    • Specify desired networking protocols and services to install.

    Note

    If a Sysprep.inf file was used when running Sysprep.exe, only the dialogues omitted in the .inf file are presented to the user. If display settings are omitted, the default settings will be used instead.

  3. The local SysPrep folder containing Sysprep.exe and Sysprep.inf on the %SystemDrive% is deleted.
  4. The computer restarts and a logon prompt is displayed.


SysPrep: Auditing Installations with SysPrep

Using SysPrep for Auditing Installations

You use the auditing process to verify that a computer is functional before it is delivered to the user. During the auditing process you can, for example, check that the operating system loads and applications launch properly, run a Disk Defragmenter program, run Chkdsk to check for corrupt hard disk files, verify that the licensing agreements are not being violated, and verify that all installed devices in Device Manager are properly recognized.

Windows 2000 deployment is set up so that you can use your own auditing tools to examine each computer that has Windows 2000 preinstalled. You can examine the computer as it will exist at the user site and then use the Sysprep tool to return the computer to an end-user ready state. Then, when the user receives the computer and turns it on for the first time, the computer runs Mini-Setup.

To audit a destination computer that has Windows 2000 installed

  1. Install Windows 2000 using the steps described in Using Sysprep. When Setup has completed and the destination computer has restarted, the computer is running a fully installed version of Windows 2000.
  2. Create the \Sysprep folder, and then copy Sysprep.exe and Setupcl.exe to it. See Using Sysprep for more information.

    If you plan to run Sysprep from a floppy disk, you can skip this step.

  3. Audit the system using a third-party auditing tool.
    note-icon

    Note

    You can restart as many times as necessary while auditing the computer to your satisfaction.

    important-icon

    Important

    When you are auditing, do not overwrite any system files or otherwise disturb the preconfigured computer since Sysprep does not detect or restore system files that your auditing tools have changed.

  4. When auditing is complete, remove any files or folders placed on the hard disk during the auditing process. At the command prompt, move to the folder containing Sysprep.exe, and then type the following command with the options you want:

    sysprep -nosidgen

    5. followed by any other options you want. See Sysprep.exe Syntax for more information on Sysprep command-line parameters.

  5. When Sysprep finishes, immediately shut down Windows 2000. The computer is now ready to deliver to the user.


SysPrep: Automating Mini-Setup

Automating Mini-Setup

To automate Mini-Setup

  • Create a Sysprep folder on the %systemdrive% of the master computer,

    • –Or–

  • Create the Sysprep.inf, save the .inf file to a floppy disk, and insert the disk at the beginning of Mini-Setup.

Note

The Sysprep folder is deleted after Mini-Setup completes.

You can also automate Mini-Setup by combining the two methods listed above. For example, if you are auditing a computer, run a Sysprep.inf file from a floppy disk with all the necessary responses to speed up the audit. After auditing, set up the original Sysprep.inf to run from the %systemdrive%\Sysprep\ folder so that the customer can respond to the necessary questions during the Mini-Setup wizard.

Note

If you use InstallFilesPath or OemPnpDriversPath in your Sysprep.inf file, make sure the paths designated for these parameters are consistent for all Sysprep.inf files.


SysPrep Syntax

One Step Sysprep [Sysprep.Inf] [-quiet] [-nosidgen] [-reboot] [-pnp]

Where:

Sysprep.inf
Is a file created with Setup Manager to customize the Mini-Setup routine that will run the first time the target user restarts the computer.
-quiet
suppresses confirmation dialogs displayed to the user.
-nosidgen
informs Setupcl.exe not to generate new SIDs on the restart.
-reboot
forces the computer to restart instead of shutting down (useful during auditing only).
-pnp
The Mini-Setup wizard will detect new or different Plug and Play devices on the destination computer and disable those that were used on the master computer but not found on the destination computer; however, you might want to use the -pnp switch to enable legacy device detection or to re-enumerate the devices on the destination computer. Using this switch adds a few extra minutes to the end-user's experience in order to do a complete hardware redetection.


Unattend.doc: Unattended Setup Parameters Guide

This Word document describes how to install Windows 2000 in unattended setup mode, using an "answer file" (a text file that supplies the information that would otherwise require interactive input from the user during setup.) Unattended setup mode allows you to create multiple similarly-configured installations of Microsoft® Windows® 2000.

The Microsoft Windows 2000 Unattended Setup Parameters Guide (Unattend.doc) provides the complete list of unattended setup parameters to use in Windows 2000 unattended answer files. Included in this documentation are the necessary section headings, parameter values, definitions of the parameter functions, and examples. This file also contains sample answer files.

Files Required

  • Unattend.doc


Wmloadsimulator.exe: Windows Media Load Simulator

Wmloadsimulator.exe: Windows Media Load Simulator NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Windows Media Load Simulator is a testing tool used to simulate large numbers of users streaming audio or video data from a Windows Media Server.

Windows Media Load Simulator must be installed on a client computer and used to test the capacity of the Windows Media Unicast Service on a Windows Media server. The load simulator simulates a high client demand by initiating a large number of client requests for streams in order to potentially overwhelm the system and network resources of your site. Each instance of Windows Media Load Simulator can request streams for up to 200 simulated clients.

To create an even larger demand on the Windows Media server, you can run multiple instances of Windows Media Load Simulator on a single client computer or on multiple client computers against the same Windows Media server. For example, if you want to determine if your Windows Media server can handle 1,000 client requests for unicast content, you can run five instances of Windows Media Load Simulator, each configured to simulate 200 clients, on one client computer. Or you can run a single instance of Windows Media Load Simulator, each configured to simulate 200 clients, on five client computers.

Windows Media Load Simulator also allows you to create user names and passwords for the simulated clients. The Windows Media server must process this information and authenticate each user, which consumes even more server resources. Windows Media Load Simulator supports authentication using Basic User Authentication and Windows NTLM on the Windows Media server.

Installing Windows Media Load Simulator

The Windows Media Load Simulator is not installed during Windows 2000 Resource Kit installation. To install it, use the following procedure:

To install Windows Media Load Simulator

  1. Insert the Microsoft Windows 2000 Resource Kit companion CD into your CD-ROM drive.
  2. When the setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\wmloadsimulator directory, double-click WmLoadSimulator.exe.
  4. Follow the directions that appear on your screen.

Files Required

  • Wmloadsimulator.exe
  • Wmload.chm

The files required for Windows Media Load Simulator are located in the <cdroot>\apps\wmloadsimulator\ directory of your Windows® 2000 Resource Kit companion CD.

For More Information

See the Windows Media Load Simulator online help (WmLoad.chm) in the <cdroot>\apps\wmloadsimulator\ directory of the Windows® 2000 Resource Kit companion CD.


Chklnks.exe: Link Check Wizard

Link Check Wizard scans all of the link (shortcut) files on your system, and checks to see if the shortcut points to an existing application or document. If the associated application or document is not found, the Wizard lists that file as a dead link, giving you the option to remove it.

  • To find out more information about a particular link, right-click its entry in the list of dead links.
  • To remove a link, check the box next to it.
  • To remove all of the listed links, click Select All.

When you have selected all of the links you want to remove, click Finish.

Link Check Wizard requires Microsoft® Internet Explorer version 4.0 or later.

File Required

  • Chklnks.exe


Cmdhere.inf: Command Prompt Here

This shell extension adds a CMD Prompt Here command to the context menu that is available when you right-click in the Folders (left) pane of Windows Explorer. Selecting this option from the context menu creates a new command-prompt session with the same path as that of the object that is right-clicked.

Installing CmdHere

To install CmdHere:

  1. In Windows Explorer, navigate to the directory where the Resource Kit is installed.
  2. Right-click Cmdhere.inf.
  3. On the resulting pop-up menu, click Install.

Files Required

  • Cmdhere.inf


Seagate Software Crystal Reports for the Windows 2000 Resource Kit

Seagate Software Crystal Reports 6.0

Seagate Crystal Reports Event Log Viewer is a full-featured report writer that provides an easy way to extract, view, save, and publish information from the Windows 2000 system, application, and security event logs in a variety of formats. Crystal Reports 6.0 adds a wide range of new features that build on the capabilities of previous versions. Integrating new Web reporting technology and advanced developer features with proven functionality ensures that Seagate Crystal Reports 6.0 can address all of your reporting needs.

Crystal Reports offers direct access to the event logs of multiple computers. It can open and manipulate existing log files (in read-only mode) and Access database files. Enhancements in this version allow more flexibility in filtering and analyzing data contained in the security event log.

Crystal Reports allows you to format and group information, then export it to a printer, word processor, or spreadsheet. It includes 12 usable reports that quickly provide information from one or multiple computers in a single report.

The main components of Crystal Reports are:

  • Crw.exe, the report designer-viewer
  • Crpe.dll, the print engine that generates reports.

Installing Crystal Reports

Crystal Reports is not installed during Windows 2000 Resource Kit installation. To install it, use the following procedure:

To install Crystal Reports

  1. Insert the Microsoft Windows 2000 Resource Kit companion CD in your CD-ROM drive.
  2. When the setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\crystal\disk1 directory, double-click setup.exe.
  4. Follow the directions that appear on your screen.

Files Required

The files required for Crystal Reports are located on your Microsoft® Windows® 2000 Resource Kit companion CD.

For More Information

Seagate Software Crystal Reports is a third-party application included in the Microsoft® Windows® 2000 Resource Kit. For more information, visit the Crystal Reports page on the Seagate Software Web site at:

Internet link http://www.seagatesoftware.com/crystalreports/


Netcons.exe: Net Connections

This GUI tool monitors and displays current net connections, taking the place of the Windows command-line command net use.

NetCons can be viewed as a dialog box or minimized in the status area, next to the clock. When the tool is minimized, you can right-click the NetCons icon to view the list of net connections.

File Required

  • Netcons.exe


Quickres.exe: Quick Resolution Changer

Tool starts iconified in the system tray.

This tool enables you to change your display's visible screen area (resolution), bit depth, and vertical refresh rate (Microsoft® Windows® 2000/Microsoft® Windows NT® only) from the taskbar, without restarting the operating system.

QuickRes resides as an icon in the status area, the notification area at the right end of the taskbar. Single-click the icon with the left mouse button to dynamically select new display settings for your desktop. Double-click the icon to bring up the Display Properties dialog box.

The mode-settings menu is sortable. QuickRes can remember which modes are compatible with your monitor, and which ones are not (based on the user's input).

QuickRes is multiple-monitor aware when running on operating systems that support multiple displays (Microsoft® Windows 98 and Windows 2000).

note-icon

Note

If you select a mode that is incompatible with your video card, simply wait 15 seconds or press the ESC key or the N key. Each of these returns you to the previous resolution and tags the mode as incompatible for future reference.

QuickRes is one of the Power Toys.

File Required

  • Quickres.exe


Quiktray.exe: Quick Tray

This tool allows you to create your own menu of favorite programs, documents, URLs, or other resources, and presents that menu as a series of small icons in the status area of your Microsoft® Windows® 2000 desktop. This provides a simple, organized, and convenient way to start or switch between commonly used applications.

Note

Quick Tray stores the information about your custom system tray menu in the Quiktray.dat file, located in the same directory as Quiktray.exe. This file is created the first time you run Quick Tray, and can be edited with a text editor. You can also use the Quick Tray data file to create standard Quick Tray menus for multiple computers. See Quick Tray Tips for more information.

Quick Tray Topics

  • Using Quick Tray
  • Quick Tray Tips

File Required

  • Quiktray.exe


Using Quick Tray

You can add an application or program (a file ending in the .exe extension), a text or document file (for example, .txt or .doc), or a shortcut to a URL to the Quick Tray menu. Items are added to the Quick Tray menu by means of the Quick Tray dialog box.

one step To open the Quick Tray dialog box, start Quick Tray, and then click the Quick Tray icon in the status area.

one step To add an application, program, or document file to the Quick Tray menu, click the file in Windows Explorer and drag it into the Application window in the Quick Tray dialog box.

one step To add a link to a URL to the Quick Tray menu, first create a shortcut to the URL on your desktop, and then drag the shortcut into the Application window of the Quick Tray dialog box.

one step To remove an item from the Quick Tray menu, select its icon in the Quick Tray dialog box, and then click Remove.

one step To close the Quick Tray dialog box without exiting the program, click Close. This closes the Quick Tray dialog box, leaving the Quick Tray icon in the status area.

one step To exit Quick Tray and remove the Quick Tray icon from the status area, click the Quick Tray icon, and then click Exit in the Quick Tray dialog box.

Note

If you choose to add a file other than an .exe file to the Quick Tray menu, Windows 2000 should have a registered association for that file type. For instance, a .txt file could be associated with Notepad or another text editor. For more information about creating file associations, see the topic on Associate.exe in this Help file.


Quick Tray Tips

  • Put a shortcut to Quiktray.exe in the Startup folder of your computer, so that it starts each time you boot.
  • Create a standard Quick Tray menu configuration for members of a work group. This could contain shortcuts to network shares, commonly-used Web sites, or standard applications used by the group.

To install standard Quick Tray configurations on multiple computers

  1. Configure a Quick Tray menu on a single computer, using the Quick Tray dialog box or a text editor to create or modify the Quiktray.dat file.
  2. Copy this file to a disk or network share, and then copy it into the directory containing Quiktray.exe on the target computer.

The first time a user starts QuickTray on the target computer, Quick Tray loads the Quiktray.dat data file and creates a menu in the target computer's system tray with the specified links.

Note Make sure that the applications and documents in the Quick Tray menu are present on the target computer, and that the paths to the files are correct. If the Quick Tray menu includes links to network resources, edit the Quicktray.dat file to make sure that the UNC path name is used, and that the target user has permissions to access the file or program on the remote share. If Quick Tray cannot find a file on the target computer, it will create the file, with no data, and will display a nonfunctional icon in the status area.


Remapkey.exe: Remap Windows Keyboard Layout

Remapkey.exe: Remap Windows Keyboard Layout NEW

This tool changes keyboard layout by remapping the scancode of keys. You must have Administrator privileges to use this tool.

  • Key remap setting are effective for the current user and for all the users of the system.
  • The new key layout is effective for Logon dialog or the command prompt.
  • You can setup automatic logon so that even if you lose the CTRL, ALT, or DEL keys, you'll be able to logon to the system.

Remapping is done on a "key" basis. RemapKey can swap the CTRL key and CAPS LOCK keys, but it cannot swap only the symbol at shift state: instead, the whole key functionality is swapped.

For example, if you swapped "A" with "B", "A", CTRL+A, SHIFT+A and ALT+A will be swapped with "B", CTRL+B, SHIFT+B and ALT+B accordingly.

Since remapping is done at the operating system level, key swap changes are transparent to applications.

RemapKey Topics

  • RemapKey Syntax
  • Using RemapKey

File Required

  • Remapkey.exe


RemapKey Syntax

One Step remapkey -c

Where:

-c
clears all remappings.

Note

Most RemapKey functions are changed through the GUI.


Using RemapKey

The RemapKey window contains two keyboards. The upper keyboard, the Base keyboard, shows the existing key mappings. The lower keyboard, the Remapped keyboard is where you define new key mappings.

Changing key mappings is simple.

  1. In the Base keyboard, left-click the key you want to change.
  2. Drag and drop it on the new key on the Remapped keyboard.
  3. Exit RemapKey.
  4. Restart your computer to enable the new mappings.

    5. Note

    RemapKey will perform an integrity check before setting up. If it finds risky key settings, it will display a warning.

For example, if you want to swap CTRL key and CAPS LOCK:
  1. Start RemapKey.

    2. Note Administrator privilege is required to set up the key remappings.

  2. Left-click the CTRL on the Base keyboard, and drag it to CAPS LOCK on the Remap keyboard.
    CAPS LOCK on the Remap keyboard will be changed to CTRL
  3. Left-click CAPS LOCK on the Base keyboard and drag it to CTRL key on the Remap keyboard.
    The CTRL key on Remap keyboard will be changed to CAPS LOCK
  4. Exit RemapKey.
    Before closing the window, RemapKey will ask you if you want to restart. If you're ready to restart, click the OK button.
  5. After the restart, the CTRL key and the CAPS LOCK key will be swapped.
    Please note the key remapping is effective for Logon Dialog.
    You can confirm the remapping status with RemapKey after logging on.

How to Stop Key Remapping

Use one of the following to stop key remapping.
  • To stop remapping of a key: left click the remapped key on Remap keyboard.
  • To stop all remappings: click Edit menu and choose Delete All. Reboot your system.
  • Run RemapKey from the command line with the -c option. This will remove all the remappings without the GUI. Reboot your system.
To restore your current key settings after editing, but before you quit RemapKey:
On the Edit menu, select Unedit.

RemapKey Cautions

Scancode remapping might cause these problems.
  1. You might not be able to type all of keys.
  2. If you lose one of important CTRL, ALT, or DELETE keys, you might not be able to log on to your system.

To make sure the ability to log on is always available, you can set your computer to auto-logon with RemapKey. On the Option menu, select Setup Auto Logon.


Runext.exe: Run Extension

Runext.exe: Run Extension NEW

This shell extension adds a Run command to the context menu for files that are right-clicked in Windows Explorer. Selecting Run from the menu opens the Run dialog box with the file's path name set in the Open field. The cursor is set immediately after the file name to allow the quick entry of parameters for that application.

Installing Run Extension

This tool is not installed by the Microsoft® Windows® 2000 Resource Kit automated setup program. To install it, use the following procedure.

To install Run Extension

  1. Insert the Microsoft® Windows® 2000 Resource Kit companion CD in your CD-ROM drive.
  2. Click Explore the CD.
  3. In the <cdroot>\Apps\Runext directory, right-click Runext.inf.
  4. In the context menu that appears, click Install.

Files Required

  • Runext.exe (installed)
  • Runext.inf
  • Runext.x86

The files required for Run Extension are located in the <cdroot>\Apps\Runext directory of your Microsoft® Windows® 2000 Resource Kit companion CD.


Sipanel.exe: Soft Input Panel

This tool allows you to use Windows 2000 on computers that have a pen as the only or primary input device. Soft Input Panel does simple handwriting recognition and allows you to enter characters in any input field of any Windows-based application by writing the characters into Soft Input Panel and then sending the characters to the application. You can also choose to enter characters by using one of Soft Input Panel's keyboard views.

Soft Input Panel has three views:

  • Handwriting recognizer, with two, three, or four character input areas
  • Small software keyboard
  • Large software keyboard

When you start Soft Input Panel, a pen icon appears in the taskbar. Click the icon to toggle Soft Input Panel on and off. To run Soft Input Panel every time you log on, create a shortcut to Sipanel.exe, and place it in your computer's Startup folder. For information about creating shortcuts, see the Windows 2000 Help documentation.

Note

  • Before configuring the computer to use a pen as the only input device, you must configure Windows 2000 to allow automatic logon. Without the Auto Logon feature you will not be able to activate logon, as this normally requires you to press CTRL+ALT+DEL to open the logon dialog box. In addition, you will not be able to enter characters to the logon box since Soft Input Panel is not yet running at that time. For more information, please refer to the Auto Logon Setter documentation.
  • This application supports only U.S. character sets.

Files Required

  • Sipanel.exe
  • Activate.dll
  • Fwalpha.dll
  • Fwalpha2.dll
  • Hwxpad.dll
  • Hwxeng.dll
  • Sipanel.cnt
  • Sipanel.hlp
  • Usa.lex - This file is copied to the %SystemRoot% folder.


Smart Sketch LE

Smart Sketch LE NEW

Intergraph SmartSketch LE 3.0 is a technical drawing and diagramming product. It is the baseline for a line of add-ins and solutions for the technical drawing, CAD, and professional/business diagramming marketplace. SmartSketch LE is a limited edition of the full SmartSketch product, a tool that captures design ideas and turns them into precise, finished drawings.

Installing SmartSketch LE

SmartSketch LE is not installed during Windows 2000 Resource Kit installation. To install it, use the following procedure:

To install SmartSketch LE

  1. Insert the Windows 2000 Resource Kit companion CD in your CD-ROM drive.
  2. When the setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\smartsketch_le directory, double-click setup.exe.
  4. Follow the directions that appear on your screen.

Files Required

Smart Sketch LE is a separate application not installed by the Windows 2000 Resource Kit installation program. The files required are located in the <cdroot>\apps\smartsketch_le\ directory of your Windows® 2000 Resource Kit companion CD.

For More Information

Intergraph SmartSketch LE is a third-party application included in the Windows® 2000 Resource Kit. For more information, see the Internet link SmartSketch LE Web page on the Intergraph Web site.


Winexit.scr: Windows Exit Screen Saver

WinExit is a screen saver that logs the current user off after the specified time has elapsed. In other respects it is similar to other screen savers and can be configured and tested on the Screen Saver tab of the Display Properties dialog box in Control Panel.

WinExit displays a dialog box containing the countdown timer and a user-defined message. When the countdown timer reaches zero, the logoff process is initiated.

Note

In order for non-administrators to be able to use WinExit, you must add Set Value and Create Subkey permissions for the group Everyone on the registry key:
HKEY_Local_Machine\Software\Microsoft\WindowsNT\CurrentVersion

WinExit Topics

  • To Activate WinExit

Files Required

  • Winexit.scr
  • Winexit.hlp


To Activate WinExit

  1. In Control Panel, double-click the Display icon.
  2. On the Screen Saver tab, select Windows Exit from the Screen Saver list.
  3. In the Wait box, select the number of minutes of inactivity before the screen saver appears.
  4. To configure the screen saver, click the Settings button.

    5. In the Force Logoff box, select the Force Application Termination check box to have the system close all running applications regardless of their current state.

    • By default, this check box is not selected and the system queries applications to see if work needs to be saved before shutting them down. Use this setting with caution since applications with unsaved data will not have a chance to save their work.
    • In the Time To Log Off box, enter the time WinExit will display its logoff dialog box before proceeding with the logoff process. Enter a value between 0 and 999 seconds.
    • In the Logoff Message box, enter a message to display in the logoff dialog box. The message is limited to 255 characters and will be truncated if extra characters are entered.
  5. To start the screen saver temporarily so you can see what it looks like, click the Preview button. To return to Windows, move your mouse or press any key.

    6. Note

    You can test Windows Exit screen saver with the Preview button on the Screen Saver tab without WinExit attempting to log you off.

  6. When activated, WinExit beeps, indicating that the logoff process is about to begin, and displays the logoff dialog box. If no action is taken and the countdown timer reaches zero, the system will initiate the logoff procedure. You can stop the process before the countdown timer reaches zero by either moving the mouse pointer over the dialog box or pressing any key on the keyboard.


Addiag.exe: Application Deployment Diagnosis

Addiag.exe: Application Deployment Diagnosis NEW

AdDiag is a command-line tool which provides information on current state of software either installed or available for installation on a computer managed by IntelliMirror Software Installation and Maintenance.

The tool provides the following information about software on a computer:
  • The current user, including their logon credentials and SID, and the platform (processor, locale) that could affect the managed software.
  • Whether or not Terminal Server is running on the computer.
  • Installed or advertised information about software derived from the registry.
  • Advertised information about available software stored in Active Directory™ directory service.
  • Windows Installer information.

AdDiag Topics

  • AdDiag Syntax
  • AdDiag Examples
  • Understanding AdDiag Report Output

File Required

  • Addiag.exe


AdDiag Syntax

One Step addiag [/verbose][/user] [/trace:string][/test:string_list][/debug:ulong] [/?]

Where:

/verbose
runs diagnostics in verbose mode. Default is FALSE.
/user
runs diagnostics for user (TRUE) or computer (FALSE). Default is TRUE.
/trace:string
takes a string specifying what system tracing should be turned on or off. The value should be one of the following, and must be between 1 and 260 characters in length:
  • AppMgmtOn
  • AppMgmtOff
  • CStoreOn
  • CStoreOff
  • MSIOn
  • MSIOff
  • UserEnvOn
  • UserEnvOff
/test:string_list
Takes an unsigned long specifying the diagnostics to be run. Defaults to 0x1f, which runs the first five tests. Acceptable values are a combination of:
0x1 | Dump general information
0x2 | Dump Terminal Server information
0x4 | Dump Local Managed Applications List
0x8 | Dump Server Deployed Applications List
0x10 | Dump Local Windows Installer Applications List
0x20 | Dump Local Group Policy object List
0x40 | Dump Local Script Application List
0x80 | Dump Local Active Directory policy history
0x100 | Dump Local Windows Installer Features List
0x200 | Dump Windows Installer shortcuts in the profile
0x400 | Perform Active Directory Integrity check.
/debug
Takes an unsigned long specifying the debug level (Internal Use only). Acceptable values are a combination of:
  • 0x1 Messages
  • 0x2 Errors
  • 0x4 Warnings
Default is 2.
/?
displays command-line help.


AdDiag Examples

addiag
Microsoft (R) Software Installation Diagnostics. Version 0.80
Copyright (C) Microsoft Corp 1998-1999. All rights reserved.

Collecting info...

========================= General Info =========================

User -- NameSamCompatible: REDMOND\User1
User -- NameFullyQualifiedDN: CN=User1,CN=Users,DC=redmond,DC=corp,DC=microsoft,DC=com
User -- Logon Server: \\RED-DC-12
User -- SID: S-1-5-21-2127521184-1604012920-1887927527-67705
User -- Profile Type: LOCAL
User -- Locale: 1033
Processor Architecture: x86
System Locale: 1033

========================= TS Info =========================

Running Remote Admin TS

========================= Managed Apps (Local List) =========================

No Managed applications were found.

========================= Managed Applications (Server) =========================

User dump for redmond.corp.microsoft.com
Dumping GPO list (2 items)...
    GPO GUID: {12A7A27A-31AE-4DDC-AAC1-5744AB20EC41}
    Name: EU-Office-MachinesDeployment-DuongN
    GPO GUID: {C52B5368-2A6F-11D3-BB3C-00805FC792AD}
    Name: EU-PublicApplicationPublishing -ITGINTEL
    No Apps were found.

========================= Windows Installer Apps =========================

Found 3 MSI application(s)
WebFldrs
Windows 2000 Support Tools
Microsoft(r) Windows(r) 2000 Resource Kit

========================= Local AD History =========================

Found 1 Applied GPO(s) in the history
EU-PublicApplicationPublishing -ITGINTEL
    GPO GUID: {C52B5368-2A6F-11D3-BB3C-00805FC792AD}
    Version: 0x1b601b6


Understanding AdDiag Report Output

AdDiag can generate a report containing the following sections of information.

  1. ========================= General Info =========================
     General info provides user configuration details.
  2. ========================= TS Info =========================
     TS info provides information about whether or not Microsoft Terminal Server is running:
  3. ======================= Managed Apps (Local List) =======================
     Managed Apps (Local List) lists all applications with information stored in the registry. The applications are listed by GUID. The GUID is set from the Software Installation snap-in, so in a case where the friendly name does not appear correct, the GUID is the information of most use in troubleshooting.
    Assign count is the count of full advertisements executed for the application. This should only make a difference in Roaming User Profile (RUP) cases, because this is the only case when additional full advertisements are made for the same user.
    4. UI Levels
0x0 | UI level is unchanged
0x1 | Default UI
0x2 | Completely silent installation
0x3 | Progress bars and error handling
0x4 | Authored UI (wizard dialogs suppressed)
0x5 | Authored UI (wizards, progress bars, and error handling)
0x40 | Display only progress bars
0x80 | Display success or failure dialog on completion
    Application States
0x1 | Assigned
0x2 | Published
0x4 | Remove unmanaged version before assignment
0x8 | Leave application unmanaged when Group Policy no longer applies
0x10 | Remove application when Group Policy no longer applies
0x20 | Leave application unmanaged
0x40 | Remove application
0x18 | Assigned and Leave application unmanaged when Group Policy no longer applies
  4. ======================= Deployed Apps (Server) =========================
     Deployed Apps (Server) is a full list of applications from the Group Policy objects applied to the given user (or computer). In the case of upgrade relationships the base application is still listed, even if there is an upgrade for it. This feature has not been implemented yet
  5. ========================= MSI Apps =========================
     MSI Apps lists all applications for which there is Windows Installer information. Managed applications came from Software Installation and Maintenance, unmanaged applications came from alternative distribution, such as Microsoft Systems Management Server.


Apimon.exe: API Monitor

This tool monitors a running application for all Application Programming Interface (API) calls a process is making. APIMon counts and times the API calls. It also, optionally, monitors page faults caused by the monitored application and reports them by API call.

APIMon is useful as a performance monitor to help tune your application. You can determine the hot spots in an application by examining the APIs with the largest times and/or counts. You can look at which APIs are used, taking special note of calls that cause ring transitions to kernel mode or client/server transitions. Large numbers of these calls can be the cause of a slow application.

APIMon can generate two types of reports.

  • A report listing the number of calls made to each API and total time spent in each API
  • A trace file listing the individual calls to all APIs with the calling parameters as they occurred in time

APIMon Topics

  • Installing APIMon
  • Using APIMon
  • APIMon Syntax
  • APIMon Options

Files Required

  • Apimon.exe
  • Apimon.hlp
  • Apidll.dll


Installing APIMon

API Monitor runs on Windows 2000 and Windows NT version 4.0 Server or Workstation

This tool is not installed by the Windows 2000 Resource Kit Setup. To install it, use the following procedure:

To install APIMon

  1. Open the \Apimon folder.
  2. Copy Apimon.exe, Apidll.dll and Apimon.hlp files to %SystemRoot% (for example, c:\winnt) or another directory on the path.


Using APIMon

You can run APIMon from the command line, from the Tools Management Console, or by double-clicking Apimon.exe in Windows Explorer. After APIMon starts you must open a program for monitoring. When running APIMon from a command line, you can optionally specify the program name as an argument.

To monitor an application in APIMon

  1. Start APIMon.
  2. Open the application you want to monitor.
  3. Start the application by pushing the "Go" traffic light button, or click Tools and then click Start Monitor.

When the application starts, two windows appear. The first counts APIs and displays the time, and the second lists the current DLLs.


APIMon Syntax

One Step apimon [-b] [-g] [-t value] [appname] [-?]

Where:

-b
breaks into the debugger when APIMon starts.
-g
goes immediately.
-t value
sets refresh rate to value.
appname
is the name of the application to be monitored.
-?
displays a syntax dialog box.

See APIMon Options for more information on options available on the APIMon Properties page.


APIMon Options

The following options may be specified in the APIMon Options dialog box:

Miscellaneous Options tab

Enable Tracing

Turns on API tracing. This causes APIMon to create a trace file containing one line of text for each API call made by the monitored application. The trace contains the following information:

1. Return Address

2. First four arguments

3. API Name

Enable Aliasing

Turns on aliasing.

Enable Counters

Turns on API counting and timing.

Pre-Load Symbols

Enabling this option causes APIMon to load the debug symbols for all DLLs while the monitored program is executing. This option is turned on when Monitor Page Faults is turned on.

Disable Heap Checking

When a process is being debugged, NTDLL's heap manager turns on a set of heap-checking flags. This ensures that if the process corrupts its heap, the debugger will catch the error. The heap checking flags also slow down the process and change the characteristics of the heap.

The Disable Heap Checking option disables this behavior and allows the process to run as if it were not being debugged.

Go Immediately

This option causes APIMon to start the monitor for the application as soon as the program is opened by selecting File, and then Open from the menu or when a program name is specified on the APIMon command line.

Don’t Use Fast Counters

On Intel Pentium processors, APIMon can use special instructions to do the API timings. Other processors must use the Win32 API GetPerformanceCounter(). This option disables the use of these instructions if APIMon is running on one of the supported platforms.

Monitor Known DLLs Only

By default, APIMon monitors API calls to all DLLs that the monitored process loads, either statically or dynamically. This option provides for the monitoring of a specific list of DLLs to be monitored. To create the DLL list, see "Known DLLs Options," later in this document.

Monitor Page Faults

Enabling this option causes APIMon to create a new window that displays page fault information. The window displays one entry for each API from all enabled DLLs that has caused a page fault.

Default Counter Sorting

This option specifies the default sort order for the API counter window. The sort order can be changed while the monitor is running.

File Names Tab

Log File Name

Specify a full path and file name for the APIMon log file. You may specify a file on your local computer or a UNC name to a network path and name. This file is created when the menu command Write Data To Log File is selected from the File menu. The file is overwritten each time the log file is created.

Trace File Name

Specify a full path and file name for the Trace file. You may specify a file on your local computer or a UNC name to a network path and name. This file is created when the Enable Tracing option is turned on. The file is overwritten each time the trace file is created.

Symbol Path

This string is a path or multiple paths separated by semicolons. Each path points to a tree containing debug symbols. The debug symbols can be either .dbg files, .exe files, or .pdb files. This string is necessary if the Pre-Load Symbols option is turned on.

Known DLLs Tab

This property page is used to specify a list of Known DLLs that are initially monitored by APIMon, which can be useful if you don't want APIMon to clutter the display and log file with irrelevant statistics.

To add a new entry to the list, click an empty entry. In the edit box, enter the DLL name and press enter. The DLL name must not contain a full path, just the DLL name with a .dll extension.

To delete an entry, click the desired entry, delete all of the text, and press enter. The entry is then removed from the list.

In order for this DLL list to take effect, the Monitor Known DLLs Only option must be turned on.


Atanlyzr.exe: AppleTalk Network Device Analyzer

Atanlyzr.exe is a GUI tool that performs an AppleTalk lookup for registered AppleTalk devices on an AppleTalk network. You can perform a lookup of all AppleTalk devices, specific Net, Name, Type, or partial Name, and Types in the selected zone(s).

You can use this tool to find information on an AppleTalk network, such as what systems are routing, what system has a printer captured, or a list of printers or computers running Windows 2000. Each device returns values for its Net, Node, Socket, Name, Type, and Zone. The combinations of Net/Node/Socket or Name/Type/Zone are unique values.

Atanlyzr.exe lets you print the lookup results or save them in a tab-delimited text file (*.nlz is the default) that can be viewed with a word processor, spreadsheet, or text editor.

The computer that runs Atanlyzr.exe must have the AppleTalk stack installed. The stack is part of Services for Macintosh® and AppleTalk Protocol.

Files Required

  • Atanlyzr.exe
  • the AppleTalk stack and related components


Auditpol.exe: Audit Policy

AuditPol is a command-line tool that enables the user to modify the audit policy of the local computer or of any remote computer. To run AuditPol, the user must have administrator privileges on the target computer.

AuditPol Topics

  • AuditPol Syntax
  • AuditPol Examples

Files Required

  • Auditpol.exe


AuditPol Syntax

One Step auditpol [\\computer] [/enable | /disable] [/help | /?] [/category:type] [/category:type] ...

Where:

\\computer
is the name of a remote computer. If no computer name is specified, the operation takes place on the local computer.
/enable
enables audit (default).
/disable
disables audit.
/category:type
specifies what kind of events to audit
category can be:
  • system: system events
  • logon: logon/logoff events
  • object: object access
  • privilege: use of privileges
  • policy: security policy changes
  • sam: Security Accounts Manager (SAM) changes
type can be:
  • success: audit success events.
  • failure: audit failure events.
  • all: audit success and failure events.
  • none: do not audit these events.


AuditPol Examples

Display the audit policy

C:> Auditpol.exe \\computer

Running ...

(X) Audit Enabled

AuditCategorySystem = Success and Failure

AuditCategoryLogon = Failure

AuditCategoryObjectAccess = Failure

AuditCategoryPrivilegeUse = No

AuditCategoryDetailedTracking = No

AuditCategoryPolicyChange = No

AuditCategoryAccountManagement = Success and Failure

Enable audit for process category

C:> Auditpol.exe \\computer /process:all

Running ...

Audit information changed successfully on \\computer ...

New audit policy on \\computer ...

(X) Audit Enabled

AuditCategorySystem = Success and Failure

AuditCategoryLogon = Failure

AuditCategoryObjectAccess = Failure

AuditCategoryPrivilegeUse = No

AuditCategoryDetailedTracking = Success and Failure

AuditCategoryPolicyChange = No

AuditCategoryAccountManagement = Success and Failure

Enable/disable audit

C:> Auditpol.exe \\computer /disable

Running ...

Audit information changed successfully on \\computer...

New audit policy on \\computer...

(0) Audit Disabled

AuditCategorySystem = Success and Failure

AuditCategoryLogon = Failure

AuditCategoryObjectAccess = Failure

AuditCategoryPrivilegeUse = No

AuditCategoryDetailedTracking = Success and Failure

AuditCategoryPolicyChange = No

AuditCategoryAccountManagement = Success and Failure

C:> Auditpol.exe \\computer /enable

Running ...

Audit information changed successfully on \\computer ...

New audit policy on \\computer...

(X) Audit Enabled

AuditCategorySystem = Success and Failure

AuditCategoryLogon = Failure

AuditCategoryObjectAccess = Failure

AuditCategoryPrivilegeUse = No

AuditCategoryDetailedTracking = Success and Failure

AuditCategoryPolicyChange = No

AuditCategoryAccountManagement = Success and Failure


Browmon.exe: Browser Monitor

Browser Monitor is a tool with a GUI that monitors the status of browsers on selected domains. Browsers are shown on a per-domain and per-transport basis.

The Windows Browser service maintains a list of all available domains and servers. Microsoft® Windows® 2000 Server and Microsoft® Windows® 2000 Professional continue to support the browser service, originally introduced with Microsoft® Windows® for Workgroups version 3.1, to provide for interoperability with domains and computers that are not Active Directory™–enabled.

On a network of computers running only Windows 2000, clients can find network servers and file sharing resources through the shared folder object in Active Directory directory service. However, as a practical matter, most organizations will use the browser service for the foreseeable future to service legacy computers that are not Active Directory–capable. The browser service and NetBIOS are enabled by default when Windows 2000 is installed.

Note

To open online Help while working in Browser Monitor, press F1.

Files Required

  • Browmon.exe
  • Browmon.hlp


CyberSafe Log Analyst

CyberSafe Log Analyst NEW

CyberSafe Log Analyst is a Microsoft® Windows® 2000 Security Event Log analysis tool. Designed as a snap-in to the Microsoft Management Console (MMC) used with Windows 2000, the CyberSafe Log Analyst assists you in organizing and interpreting security event logs from Windows 2000, providing more effective, system-wide user activity analysis.

Installing the CyberSafe Log Analyst

CyberSafe Log Analyst is not installed during Windows 2000 Resource Kit installation. To install it, use the following procedure:

To install the CyberSafe Log Analyst

  1. Insert the Microsoft Windows 2000 Resource Kit companion CD in your CD-ROM drive.
  2. When the setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\loganalyst directory, double-click setup.exe.
  4. Follow the directions that appear on your screen.

Note

The installation program adds CyberSafe Log Analyst as a snap-in to the Microsoft Management Console. To launch both CLA and MMC, click Start, point to Settings, and then click Control Panel. In Control Panel, click Administrative Tools, and then click CyberSafe Log Analyst.

Files Required

The files required for CyberSafe Log Analyst are located in the <cdroot>\apps\loganalyst directory of your Microsoft® Windows® 2000 Resource Kit CD-ROM.

For More Information

See the CyberSafe Log Analyst online Help, which is available from the MMC Help menu after you install and run the tool.


Cluster Verification Utility

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This tool verifies that a two-node cluster is set up properly. The minimum requirements for a server cluster are:

  • two servers connected by a network
  • a method for each server to access the other's disk data, and
  • special cluster software like the Cluster service, which is part of the Microsoft® Windows® 2000 operating system.

Cluster Verification Utility includes two tests: Configuration Verification and Shared SCSI Drive Diagnostic Verification.

  • Configuration Verification allows you to verify that the two cluster nodes are able to communicate with each other, and that both of them are able to access the same shared SCSI drive or drives.
  • Shared SCSI Drive Diagnostic Verification tests a shared SCSI Bus for functionality that is required by by the Cluster service systems.

    note-icon

    Caution

    This test will destroy data on all disks on the shared bus.

Important

This tool writes to drive A: on each node of the cluster being tested. Therefore, it is necessary to ensure that these drives contain a writable floppy disk before running the tool.

Files Required

The files for this tool are installed by the Windows 2000 Resource Kit setup program into the Resource Kit\cvu folder on your hard disk. Cluster Verification Utility must be installed separately from the Resource Kit, using its own setup program.

  • Clustsim.exe – The executable file for Shared SCSI Drive Diagnostic Verification.
  • Cvu.txt - The documentation file for Clustsim.
  • Ntlog.dll - a DLL that works with Cluster Verification Utility.
  • Setup.exe – An installation program which copies all the CVU files to a \CVU directory on the local hard drive.
  • Wpcvp.cnt – The table of contents for the CVU Help file.
  • Wpcvp.exe – The main CVU executable file, containing the Configuration Verification codes.
  • Wpcvp.hlp – The CVU Help file.

For More Information

For more information on clustering, search the Internet Microsoft Web site.


ClusterSentinel

ClusterSentinel NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This application-layer monitoring system integrates with Network Load Balancing clustering technology, previously known as Windows Load Balancing Server (WLBS). ClusterSentinel monitors the health of servers and uses the testing results to determine when servers are available. When a server fails the tests, ClusterSentinel removes it from cluster activity, while continuing to monitor it. When the server passes the tests, ClusterSentinel adds the server back to the cluster. This release of ClusterSentinel supports Chat, SMTP, HTTP, SQL and a generic port-connect monitor.

ClusterSentinel improves the availability of services by measuring them at the application layer. Currently, many tools are available in the marketplace to monitor the health of services to varying degrees. ClusterSentinel combines this functionality to provide operations personnel with a single access point for application and cluster-level information needed to troubleshoot a problem.

Improving availability requires the means to take corrective actions when testing indicates an error condition. ClusterSentinel achieves this by integrating with Network Load Balancing for control of cluster membership. Network Load Balancing provides seamless fault tolerance in the case of server or network failures. Although application failures can be masked through manual intervention by issuing a command to remove the failing server from cluster participation, this process takes seconds to complete. When manual intervention is not forthcoming, the network is left exposed to faults occurring at the port and application level. This is where ClusterSentinel comes in.

ClusterSentinel and Network Load Balancing work together to enable cluster-level monitoring and control. Through monitoring, the tool can track changes in cluster membership and the cluster-level state of the members. Then ClusterSentinel can use application-level monitoring results to decide when to add and remove servers from active cluster participation. By committing this information to a persistent store, the tool provides the information needed to track a server's availability over time.

Operating System Requirements

ClusterSentinel can be deployed on Microsoft® Windows® 2000 or Microsoft® Windows NT® version 4.0 with Service Pack 5 or later.

Documentation

Detailed information on how to configure, administer and troubleshoot ClusterSentinel can be found in ClusterSentinelUsersGuide.doc, in the \apps\ClusterSentinel\Docs folder of the Microsoft® Windows® 2000 Resource Kit companion CD.

Files Required

The files required for ClusterSentinel are located in the \apps\ClusterSentinel folder of the Microsoft® Windows® 2000 Resource Kit companion CD.

ClusterSentinel is not installed by the Resource Kit setup program. You must install it separately. For information on how to install this tool, see ClusterSentinelUsersGuide.doc in the \Docs sub-directory of the \apps\ClusterSentinel folder.


Designed for Windows Logo Program Web Site

The Designed for Windows Logo Program Web site is accessed by searching the Internet MSDN Online Web site. The Designed for Windows Logo site describes the requirements that must be satisfied by software and hardware in order to receive the Designed for Windows logo. The site also includes complete application information.

Developers of software applications can find information on developing applications that are compatible with both Microsoft® Windows® 2000 and Microsoft® Windows® 98, and download the most recent version of the Logo Handbook for Software and Software Logo Requirements for Windows 2000.

End users can use this site to determine exactly what Windows 2000 and Windows 98 compatibility means and what features to expect in an application that carries the Logo.

The guidelines provide information on how to provide:

  • Application migration functionality for future Windows operating system upgrades.
  • Automated application installation and update features.
  • Policy support, including lockdown.
  • Effective use of the Windows registry and other key operating system files.
  • Enhanced accessibility requirements for people with disabilities.
  • Requirements for Java applications and other software distributed over the network.


Dh.exe: Display Heap

DH is a command-line tool to display information about heap usage for user-mode processes or pool usage in kernel-mode memory. It also enables you to lock heaps, tags, stacks, and objects. DH accepts command-line switches to identify which process to display information for and what information to display, and writes formatted output to a text file.

One of DH's most useful functions is to display a list of potential memory hogs and memory allocation calls which have allocated the most memory. However, to identify call sites symbolically the system needs the ability to capture a stack back trace at runtime. This is only supported on checked x86 builds.

Note

Symbols are removed from the standard Windows releases (also known as a retail or 'free' builds) to reduce file size, decrease file load time and increase system performance.

After you've configured your computer, the -g option of DH displays a sorted list of call sites that have allocated the most memory. Each call site is identified by a symbolic stack back trace of up to 16 levels which uniquely identifies the code path that resulted in the memory allocations.

On regular builds of Windows, the -p 0 option displays a list of all Windows kernel objects in the system, along with all handles to those objects for each process. If the -p 0 option is specified, all references to "heap" in the usage text should be replaced by "pool", as DH is really displaying system pool usage information. The same restrictions apply as on checked x86 builds, but you must enable the 'Create Kernel mode stack trace DB' option with Gflags.exe and reboot before the -g option will display useful pool information.

DH Topics

  • Before Running DH
  • DH Syntax
  • DH Usage Scenario

Files Required

  • Dh.exe


Before Running DH

Before using Dh.exe, the following procedures should be performed on your computer:

  1. Back up your registry settings.
  2. Start Registry Editor (Regedt32.exe)

    note-icon

    Caution

    Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Control Panel or Microsoft Management Console (MMC) whenever possible.

  3. From the HKEY_LOCAL_MACHINE subtree, go to the following key:
    SYSTEM\CurrentControlSet\Control\Session Manager
  4. Change the value of the GlobalFlag entry to 23000. For example:
    GlobalFlag:REG_DWORD:0X00023000

    note-icon

    Note

    By default, this value is ZERO or 0x00000000.

  5. Ensure the following flags are enabled. Gflags.exe (a tool included with the Windows 2000 Support Tools) lets you easily change these flags.
  • Enable debugging of the Win32 subsystem
  • Create user mode stack DB
  • Create kernel mode stack DB
  • Enable loading of kernel debugger symbols

    Note The enabled value of all flags is 00023000

  • Click OK and quit the Registry Editor.
  • If you have a checked build of Windows, install the checked symbol table files into the %WINDIR% directory.

    note-icon

    Note

    Symbol table files must match the version of the image from which they were made. Your Windows 2000 CD contains these files in the \support\debug <platform>\symbols directory. If you install a service pack, you must also install the updated symbol table files.

  • Shutdown and restart the computer.
  • After restarting, open a command prompt and type the following command to set the location of the symbol files:
    SET _NT_SYMBOL_PATH=C:\%WINDIR%

After this is completed, you can run DH.

Using DH

Use the -p 0 option to display a list of all Windows kernel objects in the system along with all handles to those objects for each process.

Note

Global flag settings still apply when using DH.


DH Syntax

One Step dh {-p n | -p -1 | -p 0 [-k] [-o]} [-l] [-m] [-s] [-g] [-h] [-t] [-b] [-i] [-f fileName] [--] [-?]

Where:

-p n
displays information about process with client ID of n in dh_n.dmp. default flags for -p n are -s -g.
-p -1
displays information about Win32 subsystem process in dh_win32.dmp.
-p 0
displays information about kernel memory and objects in dh_sys.dmp. default flags for -p 0 are -m -s -g -t -k -o.
  • -k
  • displays information about processes and threads (valid only with -p 0).
  • -o
  • displays information about object handles (valid only with -p 0).
  • -l
  • displays information about locks.
  • -m
  • displays information about module table.
  • -s
  • displays summary information about heaps.
  • -g
  • displays information about memory hogs. This option displays a sorted list of call sites that have allocated the most memory. Each call site is identified by a symbolic stack >back trace of up 16 levels that should uniquely identify the code path that resulted in the memory allocations.
  • -h
  • displays information about heap entries for each heap.
  • -t
  • displays information about heap tags for each heap.
  • -b
  • displays information about stack back trace database.
  • -i
  • ignores information about stack back trace database.
-f filename
specifies the name of the file to write the dump to.
--
specifies the dump output should be written to STDOUT.
-?
displays this usage information.


DH Usage Scenario

When setting up development practices for a new project, many developers like to use a common memory allocation routine, exposed as a macro, which can easily be switched to use a memory leak-tracking version. When the process ends, this memory leak-tracking version dumps any remaining allocated memory chunks, usually stored in a linked list, along with the file name and line-number information on where each allocation was made.

Older projects may not have planned for such memory leak-tracking features. In this case, you can use Dh.exe to dump all memory allocations at a beginning point in the test program to a file (Dh_1.dmp, for example), run the stress application for some time, have the stress program pause in a state that should be identical to the first pause, then take another reading with Dh.exe (Dh_2.dmp).

With the two output files, Dh_1.dmp and Dh_2.dmp, you can then use Dhcmp.exe to compare them for any changes in memory usage. Dhcmp.exe will list any memory allocation differences in order of size and tells you a block number for each leak. For each block number, look in the file Dh_2.dmp and go to each allocation history to see a stack back-trace which tells you what chunks of memory are not being freed correctly.


Dhcmp.exe: DH Compare

Dhcmp.exe: DH Compare NEW

This command-line tool provides information on heap usage to help find leaks.

It can either list the bytes allocated per callsite in decreasing order, or compare two dumps of heap usage from Dh.exe, another Windows® 2000 Resource Kit tool, matching the backtraces from each file.

DH Compare Topics

  • DhCmp Syntax

File Required

  • Dhcmp.exe


DhCmp Syntax

DhCmp has two modes:

Mode 1

One Step dhcmp [-d] [-v] [-?] dh_dump1.txt dh_dump2.txt

This mode is useful for finding leaks. It compares two dumps from Dh.exe, another Resource Kit tool.

Dh_dump1.txt and dh_dump2.txt are obtained before and after some test scenario. DhCmp matches the backtraces from each file and calculates the increase in bytes allocated for each backtrace. These are then displayed in descending order of size of leak. The first line of each backtrace output shows the size of the leak in bytes, followed by the (last-first) difference in parentheses. Leaks of size 0 are not shown.

Mode 2

One Step dhcmp [-d] [-v] [-?] dh_dump.txt

For each allocation backtrace, the number of bytes allocated is attributed to each callsite (each line of the backtrace). The number of bytes allocated per callsite are summed and the callsites are then displayed in descending order of bytes allocated. This is useful for finding a leak that is reached via many different codepaths.

ntdll!RtlAllocateHeap@12 appears first when analyzing DH dumps of Csrss.exe, as all allocation will have gone through that routine. Similarly, ProcessApiRequest is very prominent too, since that appears in most allocation backtraces. Hence the useful thing to do with Mode 2 outputs is to use DhCmp to compare two of them:

dhcmp dh_dump1.txt > tmp1.txt
dhcmp dh_dump2.txt > tmp2.txt
dhcmp tmp1.txt tmp2.txt

The output of the last command line shows the differences.

For Both Modes

-d
displays output in decimal. The default is hexadecimal.
-v
displays verbose output, including the actual backtraces as well as the summary information. Verbose output is useful only in Mode 1.
-?
specifies the alert frequency in seconds.


Dommon.exe: Domain Monitor

Domain Monitor monitors the status of servers in a domain and the secure channel status to the domain controller and to domain controllers in trusted domains. Domain Monitor displays the domain controller name and a list of trusted domains, plus various status errors.

Note

To get online Help while working in Domain Monitor, press F1.

File Required

  • Dommon.exe
  • Dommon.hlp


Dumpel.exe: Dump Event Log

Dump Event Log is a command-line tool that dumps an event log for a local or remote system into a tab-separated text file. This tool can also be used to filter for or filter out certain event types.

Dump Event Log Topics

  • Dump Event Log Syntax
  • Dump Event Log Examples

Files Required

  • Dumpel.exe


Dump Event Log Syntax

One Step dumpel -f file [-s \\server] [-l log [-m source]] [-e n1 n2 n3...] [-r] [-t] [-d x]

Where:

-f file
specifies the file name for the output file. there is no default for -f, so you must specify the file.
-s server
specifies the server for which you want to dump the event log. leading backslashes on the server name are optional.
-l log
specifies which log (system, application, security) to dump. if an invalid logname is specified, the application log will be dumped.
-m source
specifies in which source (such as rdr, serial, ...) to dump records. only one source can be supplied. if this switch is not used, all events are dumped. if a source is used that is not registered in the registry, the application log will be searched for records of this type.
-e n1 n2 n3 ...
filters for event id nn (up to ten can be specified). if the -r switch is not used, only records of these types are dumped; if -r is used, all records except records of these types are dumped. if this switch is not used, all events from the specified sourcename are selected. you cannot use this switch without the -m switch.
-r
specifies whether to filter for specific sources or records, or to filter them out.
-t
specifies that individual strings are separated by tabs. if -t is not used, strings are separated by spaces.
-d x
dumps events for the past x days.


Dump Event Log Examples

To dump the system event log on server \\EVENTSVR to a file named Event.out, use:

dumpel -f event.out -s eventsvr -l system

To dump the local system event log to a file named Event.out, but only get Rdr events 2013, use:

dumpel -f event.out -l system -m rdr -e 2013

To dump the local application log to a file named Event.out, and get all events except ones from the Garbase source, use:

dumpel -f event.out -l application -m garbase -r


Enumprop.exe: Enumerate Properties

Enumprop.exe: Enumerate Properties NEW

This command-line tool dumps all properties set on any directory service object. Using EnumProp, you can display the security descriptor or list only a given set of attributes for an object.

EnumProp also recognizes globally unique identifiers (GUIDs) (objectGUID and schemaGUID) and security identifiers (SIDs). It then displays those properties accordingly.

EnumProp Topics

  • EnumProp Syntax
  • EnumProp Example

File Required

  • Enumprop.exe


EnumProp Syntax

One Step enumprop [options] LDAP-PATH

Where:

options
include:
/sec
displays only the security descriptor.
/attr:attr1,attr2...
displays only these attributes.
LDAP-PATH
specifies the LDAP (Lightweight Directory Access Protocol) path to the object.


EnumProp Examples

Example One

c:\>enumprop "LDAP://cn=administrator,cn=users,dc=user5,dc=com"

LDAP://cn=administrator,cn=users,dc=user5,dc=com: 29 set properties.

 1: accountExpires: 9223372036854775807
 2: badPasswordTime: 0
 3: badPwdCount: 0
 4: codePage: 0
 5: cn: Administrator
 6: countryCode: 0
 7: description: Built-in account for administering the computer/domain
 8: instanceType: 4
 9: isCriticalSystemObject:  Type 6
10: memberOf:
        CN=Domain Admins,CN=Users,DC=user5,DC=com
        CN=Enterprise Admins,CN=Users,DC=user5,DC=com
        CN=Schema Admins,CN=Users,DC=user5,DC=com
        CN=Administrators,CN=Builtin,DC=user5,DC=com
11: lastLogoff: 0
12: lastLogon: 125589045061875000
13: logonCount: 2
14: nTSecurityDescriptor:
15: distinguishedName: CN=Administrator,CN=Users,DC=user5,DC=com
16: objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=user5,DC=com
17: objectClass:
        top
        person
        organizationalPerson
        user
18: objectGUID: {6501886D-9A84-11D2-BC7C-00C04F82FE9D}
19: objectSid: S-1-5-21-842925246-1454471165-682003330-500
20: primaryGroupID: 513
21: pwdLastSet: 125589047530625000
22: name: Administrator
23: sAMAccountName: Administrator
24: sAMAccountType: 805306368
25: userAccountControl: 66048
26: uSNChanged: 2264
27: uSNCreated: 2113
28: whenChanged: 23/12/1998 17:39:13
29: whenCreated: 23/12/1998 17:27:47

Example Two

c:>enumprop /attr:objectguid,distinguishedname,objectsid "LDAP://cn=administrator,cn=users,dc=user5,dc=com"

LDAP://cn=administrator,cn=users,dc=user5,dc=com

 1: distinguishedName: CN=Administrator,CN=Users,DC=user5,DC=com
 2: objectGUID: {6501886D-9A84-11D2-BC7C-00C04F82FE9D}
 3: objectSid: S-1-5-21-842925246-1454471165-682003330-500

Example Three

c:>enumprop /sec "LDAP://cn=administrator,cn=users,dc=user5,dc=com"

LDAP://cn=administrator,cn=users,dc=user5,dc=com

Revision: 1
Control: 35844
Owner: BUILTIN\Administrators
Group: BUILTIN\Administrators
No System ACL
Discretionary ACL:
   AclRevision: 4
   AceCount: 7
   Ace #: 1
      Trustee: Everyone
      AccessMask: 0x130
         ADS_RIGHT_DS_READ_PROP
         ADS_RIGHT_DS_WRITE_PROP
      AceType: 0x5
         ADS_ACETYPE_ACCESS_ALLOWED_OBJECT  - ?
      AceFlags: 0x0
      Flags: 0x1
         ACE_OBJECT_TYPE_PRESENT - The ObjectType member contains a GUID
      ObjectType: {AB721A53-1E2F-11D0-9819-00AA0040529B}
         Control: Change Password
      InheritedObjectType: NULL
   Ace #: 2
      Trustee: NT AUTHORITY\Authenticated Users
      AccessMask: 0x10
         ADS_RIGHT_DS_READ_PROP
      AceType: 0x0
         ADS_ACETYPE_ACCESS_ALLOWED - Allows Trustee access
      AceFlags: 0x0
      Flags: 0x0
      ObjectType: NULL
      InheritedObjectType: NULL
   Ace #: 3
      Trustee: NT AUTHORITY\Authenticated Users
      AccessMask: 0x20028
         ADS_RIGHT_READ_CONTROL
         ADS_RIGHT_DS_SELF
         ADS_RIGHT_DS_WRITE_PROP
      AceType: 0x5
         ADS_ACETYPE_ACCESS_ALLOWED_OBJECT  - ?
      AceFlags: 0x0
      Flags: 0x1
         ACE_OBJECT_TYPE_PRESENT - The ObjectType member contains a GUID
      ObjectType: {BC0AC240-79A9-11D0-9020-00C04FC2D4CF}
         Control: Modify Group Membership
      InheritedObjectType: NULL
   Ace #: 4
      Trustee: BUILTIN\Administrators
      AccessMask: 0xf01ff
         ADS_RIGHT_DELETE
         ADS_RIGHT_READ_CONTROL
         ADS_RIGHT_WRITE_DAC
         ADS_RIGHT_WRITE_OWNER
         ADS_RIGHT_DS_CREATE_CHILD
         ADS_RIGHT_DS_DELETE_CHILD
         ADS_RIGHT_ACTRL_DS_LIST
         ADS_RIGHT_DS_SELF
         ADS_RIGHT_DS_READ_PROP
         ADS_RIGHT_DS_WRITE_PROP
         ADS_RIGHT_DS_DELETE_TREE
         ADS_RIGHT_DS_LIST_OBJECT
      AceType: 0x0
         ADS_ACETYPE_ACCESS_ALLOWED - Allows Trustee access
      AceFlags: 0x0
      Flags: 0x0
      ObjectType: NULL
      InheritedObjectType: NULL
   Ace #: 5
      Trustee: NT AUTHORITY\SELF
      AccessMask: 0x130
         ADS_RIGHT_DS_READ_PROP
         ADS_RIGHT_DS_WRITE_PROP
      AceType: 0x5
         ADS_ACETYPE_ACCESS_ALLOWED_OBJECT  - ?
      AceFlags: 0x0
      Flags: 0x1
         ACE_OBJECT_TYPE_PRESENT - The ObjectType member contains a GUID
      ObjectType: {AB721A53-1E2F-11D0-9819-00AA0040529B}
         Control: Change Password
      InheritedObjectType: NULL
   Ace #: 6
      Trustee: NT AUTHORITY\SELF
      AccessMask: 0x10
         ADS_RIGHT_DS_READ_PROP
      AceType: 0x0
         ADS_ACETYPE_ACCESS_ALLOWED - Allows Trustee access
      AceFlags: 0x0
      Flags: 0x0
      ObjectType: NULL
      InheritedObjectType: NULL
   Ace #: 7
      Trustee: USER5\Enterprise Admins
      AccessMask: 0xf01fd
         ADS_RIGHT_DELETE
         ADS_RIGHT_READ_CONTROL
         ADS_RIGHT_WRITE_DAC
         ADS_RIGHT_WRITE_OWNER
         ADS_RIGHT_DS_CREATE_CHILD
         ADS_RIGHT_ACTRL_DS_LIST
         ADS_RIGHT_DS_SELF
         ADS_RIGHT_DS_READ_PROP
         ADS_RIGHT_DS_WRITE_PROP
         ADS_RIGHT_DS_DELETE_TREE
         ADS_RIGHT_DS_LIST_OBJECT
      AceType: 0x0
         ADS_ACETYPE_ACCESS_ALLOWED - Allows Trustee access
      AceFlags: 0x13
         ADS_ACEFLAG_INHERIT_ACE - Child container objects inherit ace, inherited unless NO_PROPAGATE_INHERIT_ACE is set
         ADS_ACEFLAG_VALID_INHERIT_FLAGS -
         ADS_ACEFLAG_INHERITED_ACE - This ACE was inherited
      Flags: 0x0
      ObjectType: NULL
      InheritedObjectType: NULL


Exetype.exe: Finding the Executable Type

ExeType is a command-line application that identifies the operating system environment and processor required to run a particular executable file.

You can use ExeType to help determine:

  • Why an application will not run (perhaps because a subsystem is failing).
  • Whether to force Microsoft® MS-DOS® mode if it is a bound OS/2 application.

Executable files are bound to just one Microsoft® Windows® 2000 environment subsystem. At run time, the operating system code that creates the executable's process checks the image header for the subsystem type, which is specified with the /SUBSYSTEM switch of the link command, and notifies the proper subsystem that a new process is running.

Along with ExeType, you can also view information about the executable image type and header with:

  • the link /DUMP command, which is part of the Windows 2000 operating system.
  • the Quick View command accessible from Windows Explorer in Windows 2000 and Windows 98.
    In Explorer, right-click an .exe file, then click Quick View on the context menu that pops up.
    Quick View provides more detailed information about the image header.

ExeType Topics

  • ExeType Syntax
  • Example of ExeType Output
  • Exetype.ini File

Files Required

  • Exetype.exe
  • Exetype.ini


ExeType Syntax

One Step exetype filename

Where

filename
is the name of the executable file you want information about.
ExeType does not support wildcard characters for file names.

Note

The Exetype.ini file must be in a folder included on your computer's path (if unsure, type path at the command prompt). By default, the Windows 2000 Resource Kit installs ExeType to its root folder, which is on the path.


Example of ExeType Output

C:\>exetype myfile.exe

File "myfile.exe" is of the following type:
    Windows NT
    32 bit machine
    Executable File
    Built for the Intel 80386 processor
    Runs under the Windows GUI subsystem

Notes

  • The 80386 processor does not support Windows NT or Windows 2000. This reference should be to later members of the x86 family of processors.
  • There is actually only one Win32 subsystem, not separate ones for GUI and character-based applications.


Exetype.ini File

The Exetype.ini file must be in a folder included on your computer's path (if unsure, type path at the command prompt). By default, Windows 2000 Resource Kit Setup installs ExeType to its root folder, which is on the path.

The format of Exetype.ini is as follows:

[entry1]

This denotes the start of a new entry (80 characters maximum).

TYPE String

A description of the file type (80 characters maximum).

ADDRESS HexadecimalValue or **

Microsoft .exe files have the address of the header at a certain location. This value is kept at offset 3c from the beginning of the file. If your entry does not keep the address of the header in an offset, use ** and the offset parameter will be ignored.

OFFSET HexadecimalValue

This hexadecimal value denotes the offset from the beginning of the header.

MASK HexadecimalValue

This bitmask lets you screen which bits of the bytes you want to look at.

VALUE [HexadecimalValue | !HexadecimalValue]

This is the actual value you are comparing to the value of the bits at OFFSET strained through MASK.

The EXCLAMATION POINT (!) denotes a logical NOT; in other words, this file fits the criteria only if the value in the file does not match this value.

ADDRESS HexadecimalValue or **

OFFSET HexadecimalValue

MASK HexadecimalValue

VALUE HexadecimalValue

[entry2]

TYPE String

HEADER HexadecimalValue or **

OFFSET HexadecimalValue

MASK HexadecimalValue

VALUE HexadecimalValue

Each Entry has one TYPE field and from one to five groups of ADDRESS, OFFSET, MASK, and VALUE fields.

Note

All hexadecimal values must have an even number of characters (in bytes). If an odd number of nibbles is needed, pad with zeros.


Getmac.exe: GetMAC

GetMAC provides a quick method for obtaining the MAC (Ethernet) layer address and binding order for a computer running Windows 2000, locally or across a network. This can be useful when you want to enter the address into a sniffer, or if you need to know what protocols are currently in use on a computer.

GetMAC Topics

  • GetMAC Syntax
  • GetMAC Example

File Required

  • Getmac.exe


GetMAC Syntax

One Step getmac [\\computername] [computername.domain.com]

Where:

\\computername
is the NetBIOS name of a computer accessible across a network (including via RAS).
computername.domain.com
is the DNS name of a computer accessible across a network (including via RAS).


GetMAC Example

C:\>getmac \\host

returns the following information:

Information for machine \\host

Transport Address Transport Name

----------------- --------------

00-00-1B-16-78-76 \Device\NetBT_NE32007

00-00-1B-16-78-76 \Device\NwlnkNb

00-00-00-00-00-00 \Device\NetBT_NdisWan5

52-41-53-48-00-01 \Device\Nbf_NdisWan4

52-41-53-48-00-04 \Device\Nbf_NdisWan8

00-00-1B-16-78-76 \Device\Nbf_NE32007

In this example:

00-00-1b-16-78-76 is the address of an NE3200 Ethernet card.

00-00-00-00-00-00, 52-41-53-48-00-01, and 52-41-53-48-00-04 are RAS addresses.

When attempting a connection to a remote computer over the network, the workstation service will use the following order:

NetBT (TCP/IP) over the NE3200

NwlinkNb (IPX) over the NE3200

NetBT over one of the RAS links

Nbf (NetBIOS) over two other remote access server links

Nbf over the NE3200

To change the order in which Windows 2000 attempts connections for the workstation service

  1. In Control Panel, double-click Network.
  2. Click Bindings.
  3. In "Show Bindings For," select "Workstation."
  4. Adjust the binding order with the arrows on the right.


Guid2obj.exe: GUID to Object

Guid2obj.exe: GUID to Object NEW

This command-line tool maps a GUID to a distinguished name. In Microsoft® Windows® 2000, each security principal (user, group, or computer) is identified by a unique security identifier (SID) in the form of a GUID. In Active Directory directory service, each object has a distinguished name. This tool enables you to associate the two.

By default, GUID2Obj queries the Global Catalog, but you can tell it to use a domain controller on your site or even a given server.

GUID2Obj Topics

  • GUID2Obj Syntax
  • GUID2Obj Examples

File Required

  • Guid2obj.exe


GUID2Obj Syntax

One Step guid2obj [{]Guid[}] [/server:ServerName] [/site[:SiteName]] [/?]

Where:

[{]Guid[}]
specifies a GUID, optionally with surrounding braces. This parameter is required.
/server:ServerName
binds to the server ServerName. If this switch is not used, GUID2Obj binds to the nearest Global Catalog by default.
/site[:SiteName]
binds to a domain controller on the site SiteName. If no site name is specified, finds a domain controller on the current site and binds to it.
/?
displays a syntax screen at the command prompt.


GUID2Obj Examples

The following are all valid command lines for GUID2Obj.

guid2obj {6501886d-9a84-11d2-bc7c-00c04f82fe9d}

guid2obj 6501886d-9a84-11d2-bc7c-00c04f82fe9d

guid2obj /server:microsoftdc2 {6501886d-9a84-11d2-bc7c-00c04f82fe9d}

guid2obj /site:Default-First-Site-Name {6501886d-9a84-11d2-bc7c-00c04f82fe9d}

This command-line produces the following output

c:\>guid2obj {6501886d-9a84-11d2-bc7c-00c04f82fe9d}

CN=Administrator,CN=Users,DC=microsoft,DC=com


Heapmon.exe

This command-line tool enables you to view system heap information.

HeapMon Topic

  • HeapMon Syntax

File Required

  • Heapmon.exe


HeapMon Syntax

One Step heapmon [-?] [-1] [-p id] [-t | -a | -f | -d | [-u | -b]] [-( | -)] [-e] [-l]

Where:

-?
displays this message.
-1
specifies to monitor the Win32 subsystem
-p id
specifies the process id to monitor. Default is to monitor the Win32 subsystem.
-t
sorts output by tag name.
-a
sorts output by #allocations.
-f
sorts output by #frees.
-d
sort output by #allocations - #frees.
-u
sorts output by bytes used.
-b
sorts output by bytes used; same as -u.
-(
Changes #allocations and #frees above to be #bytes allocated and freed.
-)
Changes #allocations and #frees above to be #bytes allocated and freed; same as -(.
-e
enables display of total lines.
-l
enables highlighting of changed lines.

Changing Output While HeapMon is Running

While HeapMon is running, you can type any of the following switch characters to change the output:

t
sorts output by tag name
a
sorts output by #allocations
f
sorts output by #frees
d
sorts output by #allocations then #frees
u or b
specifies the sort output by bytes used
( or )
toggles interpretation of #allocations and #frees above to be #bytes allocated and freed.
e
toggles display of total lines.
l
toggles highlighting of changed lines
? or h
displays help text
q
quits the program.


Iasparse.exe: Read RAS/IAS Logfiles

Iasparse.exe: IAS Parse Tool NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This command-line tool parses Internet Authentication Service (IAS) and remote access server logs and converts them into a readable format. The log file generated both these services is very cryptic to be understood by an ordinary user.

IAS can create a log file based on the authentication and accounting requests received from the network access servers when using Remote Access Dial-In User Service (RADIUS) authentication. Remote access server can also log such information when using Microsoft® Windows® 2000 authentication.

Setting up and using such logs helps simplify administration of the service. The logs can be useful for tracking accounting information, such as logon and logoff records for billing purposes. IasParse presents the information in them in a user-friendly way.

IasParse is useful:

  • when a user cannot authenticate and you need to find out what’s going wrong.
  • in calculating billing information.
  • for other diagnostic purposes, such as finding out the RADIUS attributes received and sent.

IAS Logs

IAS records the authentication and accounting information that it receives in a log file, which can be in either of two formats:

  • IAS Format
    In the Microsoft® Windows® NT version 4.0 version of IAS, the log was formatted using a method by which attributes were logged as attribute-value pairs. This formatting is supported in IAS in Windows 2000, and the logs that use this format are referred to as IAS-formatted log files.
  • ODBC-Compatible Format
    The ODBC-compatible format for log files is available starting in Windows 2000. Unlike IAS-formatted log files, ODBC-compatible log files present the data in a standard sequence and using a structure that is identical, regardless of the network access server (NAS) sending the data. This consistent sequence and structure helps simplify accounting and authentication record-keeping. Data can be easily exported to an ODBC database, which supports filtering and analysis by a variety of third-party programs.

The user interface of IAS allows the user to choose the format of the log file. This format can also be changed dynamically, which can produce intermixed records of both formats in the log file. Thus there is a need for a tool that can understand the format of the records logged into the log file dynamically, parse it, and produce an output that helps the user to understand the information logged into the file.

IAS uses the information in the file %windir%\system32\ias\dnary.mdb to find out the ODBC log sequence and also whether to log a particular attribute while logging in IAS format. The tool also reads the information from the same file before parsing the log file. Hence hard coding these values inside the tool was eliminated.

IAS can also send the output to a pipe instead of a file. IasParse uses this feature to read the input from the pipe and send the output directly to the screen. In effect, this causes the tool to dynamically display the parsed output. This feature can be enabled by choosing the -p option. For this functionality to work, the user must configure the IAS to output to a pipe. This can be done by setting the log file directory from the IAS snap-in to \\.\pipe.

IasParse Topics

  • IasParse Syntax
  • IasParse Examples

Files Required

  • Iasparse.exe

The following two files must also be present on the system.

  • %windir%\system32\ias\dnary.mdb
  • %windir%\system32\iassvcs.dll


IasParse Syntax

One Step iasparse [-f:filename] [-p] [-v] [-?]

Where:

-f:filename
parses the file filename. By default, IasParse parses the file %windir%\system32\logfiles\iaslog.log
-p
sends output directly to display. Sets the log file directory in the IAS snap-in to \\.\pipe.
-v
displays the description associated with attributes in the log file.
For example, for this attribute:
Client-Vendor : VENDOR
it shows this description:
Manufacturer of RADIUS proxy or NAS. (IAS only)
-?
displays a syntax screen at the command prompt.


IasParse Examples

IAS Format

iasparse –f:iaslog.log

The line logged into the file: 172.31.230.187,rajeshp,02/09/2000,23:18:00,IAS,RA
JESHP2,6,2,7,1,5,11,61,5,64,1,65,1,31,172.31.225.108,66,172.31.225.108,4108,172.
31.230.187,4116,9,4128,rajeshp3,4147,311,4148,MSRASV5.00,4129,RAJESHP2\rajeshp,4136,1,4142,0

 NAS_IP_Address      :	 172.31.230.187
 User_Name           : 		rajeshp
 Record_Date         : 		02/09/2000
 Record_Time         : 		23:18:00
 Service_Name        : 		IAS
 Computer_Name       : 	RAJESHP2
 Service-Type        : 		Framed
 Framed-Protocol     : 		PPP
 NAS-Port            : 		11
 NAS-Port-Type       : 		Virtual
 Tunnel-Type         : 		PPTP
 Tunnel-Medium-Type  : 	IP
 Calling-Station-Id  : 		172.31.225.108
 Tunnel-Client-Endpt : 	172.31.225.108
 Client-IP-Address   : 		172.31.230.187
 Client-Vendor       :		 VENDOR
 Client-Friendly-Name: 	rajeshp3
 MS-RAS-Vendor       :	 Microsoft
 MS-RAS-Version      : 	MSRASV5.00
 SAM-Account-Name    : 	RAJESHP2\rajeshp
 Packet-Type         : 		Access-Request
 Reason-Code         :		 The operation completed successfully.

The line logged into the file: 172.31.230.187,rajeshp,02/09/2000,23:18:00,IAS,RA
JESHP2,4130,RAJESHP2\rajeshp,4129,RAJESHP2\rajeshp,4128,rajeshp3,4116,9,4108,172.31.230.187,4136,3,4142,16

 NAS_IP_Address      : 	172.31.230.187
 User_Name           : 		rajeshp
 Record_Date         : 		02/09/2000
 Record_Time         : 		23:18:00
 Service_Name        : 		IAS
 Computer_Name       : 	RAJESHP2
 Fully-Qualifed-User-Name: RAJESHP2\rajeshp
 SAM-Account-Name    : RAJESHP2\rajeshp
 Client-Friendly-Name: rajeshp3
 Client-Vendor       : VENDOR
Client-IP-Address   : 172.31.230.187
 Packet-Type         : Access-Reject
 Reason-Code         : Authentication failure: unknown user name or bad password

ODBC-Compatible Format

iasparse

The line logged into the file: "RAJESHP3","IAS",05/17/1999,15:31:11,4,"rajeshp"
,,"172.31.225.108",,"20.20.20.3",,"172.31.230.187",11,9,"172.31.230.187","rajes
p3",4294967295,5,,1,2,,,0,"311 1 172.31.230.187 05/17/1999 17:13:09 3",,1200,,,
,0,318,370,"14",1,0,13,13,,"37","0x00000001",,1,1,"172.31.225.108",,,,,,,,"MSRASV5.00",311,,,,

 Computer_Name       : 	"RAJESHP3"
 Service_Name        : 		"IAS"
 Record_Date         : 		05/17/1999
 Record_Time         : 		15:31:11
 Packet-Type         : 		Accounting-Request
 User-Name           :		 "rajeshp"
 Fully-Qualifed-User-Name:
 Called-Station-Id   :
 Calling-Station-Id  : 		"172.31.225.108"
 Callback-Number     :
 Framed-IP-Address   : 	"20.20.20.3"
 NAS-Identifier      :
 NAS-IP-Address      :		 "172.31.230.187"
 NAS-Port            : 		11
 Client-Vendor       : 		VENDOR
 Client-IP-Address   :		 "172.31.230.187"
 Client-Friendly-Name: 	"rajeshp3"
 Port-Limit          : 		4294967295
 NAS-Port-Type       :		 Virtual
 Connect-Info        :
 Framed-Protocol     : 		PPP
 Service-Type        : 		Framed
 Authentication-Type : 	Unknown
 NP-Policy-Name      :
 Reason-Code         : 		The operation completed successfully.
 Class               : 		"311 1 172.31.230.187 05/17/1999 17:13:09 3"
 Session-Timeout     :
 Idle-Timeout        : 		1200
 Termination-Action  :
 EAP-Friendly-Name   :
 Acct-Status-Type    : Start
 Acct-Delay-Time     : 0
 Acct-Input-Octets   : 318
 Acct-Output-Octets  : 370
 Acct-Session-Id     : "14"
 Acct-Authentic      : Radius
 Acct-Session-Time   : 0
Acct-Input-Packets  : 13
Acct-Output-Packets : 13
Acct-Terminate-Cause: Unknown
Acct-Multi-Ssn-Id   : "37"
Acct-Link-Count     : "0x00000001"
Acct-Interim-Interval:
Tunnel-Type         : PPTP
Tunnel-Medium-Type  : IP
Tunnel-Client-Endpt : "172.31.225.108"
Tunnel-Server-Endpt :
Acct-Tunnel-Conn    :
Tunnel-Pvt-Group-ID :
Tunnel-Assignment-ID:
Tunnel-Preference   :
MS-Acct-Auth-Type   :
MS-Acct-EAP-Type    :
MS-RAS-Version      : "MSRASV5.00"
MS-RAS-Vendor       : Microsoft
MS-CHAP-Error       :
MS-CHAP-Domain      :
MS-MPPE-Encryption-Types:
MS-MPPE-Encryption-Policy:


Installation Monitor

This command-line tool tracks changes made by Setup programs in any secondary processes they invoke, including changes to registry entries, files and .ini file entries. Installation Monitor creates a .iml file that documents all those changes, along with enough information to undo all the changes.

You can use Installation Monitor to track what problematic Setup programs are doing. The information it generates can also be used to replicate system settings for specific applications.

Installation Monitor Topics

  • Installation Monitor Examples

Files Required

  • Instaler.exe
  • Showinst.exe
  • Undoinst.exe


Installation Monitor Examples

Instaler.exe

instaler myfile a:\setup.exe

Runs Setup.exe from a floppy drive and documents all changes made by it and any child processes it invokes in a file called Myfile.iml.

C:\temp\instaler reskit -9 -r -dAEC f:\setup

Monitors the Resource Kit Setup. It creates Teskit.log (text file) & Reskit.iml (binary file, required for Undoinst.exe) in the current directory and logs all registry and file system activity. -dAEC calls Instaler.exe to log all errors, debug events, and create API calls.

C:\temp\instaler reskit f:\setup

Monitors Resource Kit Setup. It creates Reskit.log (text file) & Reskit.iml (binary file, required for Undoinst.exe) in the current directory and logs all registry and file system activity.

Showinst.exe

showinst myfile

Displays the contents of Myfile.iml.

C:\temp\showinst reskit

Shows a less comprehensive log of the installation containing only the file and registry modifications.

C:\temp\showinst reskit -c

Displays the contents of text files.

Undoinst.exe

undoinst myfile

Undoes the changes described by Myfile.iml.

undoinst reskit

Removes files and registry information.

undoinst reskit -r

Removes files and registry information and replaces the contents of the input .iml file with a redo script.

undoinst reskit -v

Removes files and registry information with verbose output.


Kernprof.exe: Kernel Profiler

This command-line tool provides counters for and profiles of various functions of the Microsoft® Windows® 2000 kernel.

With Kernel Profiler, you can monitor details and frequency for each function the kernel calls, how often a process switches from User mode to Kernel mode, and, on a multi-processor computer, display information for each processor.

Kernel Profiler runs only on Windows 2000.

Kernel Profiler Topics

  • KernProf Syntax
  • KernProf Examples
  • KernProf Sample Output

File Required

  • Kernprof.exe


KernProf Syntax

One Step kernprof [-a] [-c] [-d] [-f filename] [-i interval] [-n] [-p] [-r] [-s source] [-t lowthreshold] [-v] [-w waittime] [-x] [sampletime]

Where:

-a
displays function address and length and bucket size of the actual functions being called by the kernel.
-c
displays individual counters per call.
-d
computes hit density for each function. This tells you how many times each function is being called, which can be helpful in determining what the majority of the kernel calls are.
-f filename
specifies an output file. The default is output to STDOUT.
-i interval
specifies a sampling interval in 100ns. The default is 10000.
-n
prints hit percentages.
-p
displays per-processor profile objects. This gives you a display for each processor as opposed to combining data for all processors into the same counters.
-r
waits for an Enter keystroke before starting collection.
-s source
specifies a source to use instead of the clock as profile source. kernprof -s ? lists alternative profile sources.
-t lowthreshold
specifies a minimum number of counts to report. The default is 100.
Setting a count for the minimum number of hits for a particular sample can help to limit the amount of data you collect. For example, if you set lowthreshold to 200, you will get all counters that are above 200, while any counters below 200 will not be reported in the output data.
-v
displays verbose symbol information.
-w waittime
sets a wait time of waittime before starting sampling (collection). This is helpful if time is needed to start an application or process before taking a sample.
-x
displays context switch counters. Context switch counters track how many times a process switches from User mode to Kernel mode.
sampletime
specifies, in seconds, how long to collect profile information. The default is to sample until CTRL+C is pressed.


KernProf Examples

The following example takes a sample for 500 seconds and pipes the information to the path specified after ">" (in this case, C:\Pathto\Outputfile\Test.exe).

kernprof -a -d -c -x -p -v 500 >c:\pathto\outputfile\test.txt

The following example takes a sample of any counter over 200 and pipes the information to the path specified after the ">" (in this case, the directory from which KernProf was run to Test1.txt).

kernprof -a -d -c -x -p -v 500 200 >test1.txt

The following example takes a sample after waiting for 60 seconds and pipes the information to the path specified after ">" (in this case, C:\Users\Default\Test3.txt).

kernprof -a -d -c -w 60 -x -p -v 500 >c:\users\default\test3.txt


KernProf Sample Output

Symbols loaded: 80400000  ntoskrnl.exe
^               ^         ^- module name
|               +- Base address
+- symbols loaded line (-v)
delaying for 240 seconds... report on values with 100 hits
             ^                                     ^- hit threshold (-t, defaults to 100)
             +- wait time (passed on command line, default is wait for ctrl-C)
end of delay

Processor 0: 240322 Total hits
Processor 1: 238755 Total hits
             ^- number of perf hits registered on each processor (-p)
479077 Total hits
^- total number of perf hits

PROCESSOR 0
^- indicates the following is perf data collected from processor 0 (-p)
   201101 83.68         ntoskrnl.exe --Total Hits--
   ^      ^             ^- module name
   |      +- percentage of hits (module hits / total hits) (-n)
   +- number of hits in this module
      115  0.05    54         ntoskrnl.exe ExAcquireResourceExclusiveLite 0x080411ADC 210 4
      ^    ^       ^          ^            ^                              ^           ^   ^- size of bucket (-a)
      |    |       |          |            |                              |           +- code size of function (-a)
      |    |       |          |            |                              +- address of function (-a)
      |    |       |          |            +- Function name (or address if no symbols loaded)
      |    |       |          +- module location
      |    |       +- hit density (hits * 100 / function length) (-d)
      |    +- percentage of hits (-n)
      +- number of hits
0x00000004:    23    45     1     0    20     7    13     0     0     0     0     0     6
^              ^-----^------^-----^----^------^----^------^-----^-----^-----^-----^-----^- hits per bucket (-c)
+- offset into function (-c)

Context Switch Information
    Find any processor             0
    Find last processor            0
    Idle any processor             0
    Idle current processor         0
    Idle last processor            0
    Preempt any processor          0
    Preempt current processor      0
    Preempt last processor         0
    Switch to idle                 0

    Total context switches    139773
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^- context switch information (-x)

Sample Output Notes

  • If -p is specified, module profile information is printed for each processor, otherwise only one report is printed.
  • "size of bucket" (-a) indicates how many bytes each bucket represents. Each bucket contains 2 "bucket size" bytes. For instance if the bucket size is 4, each bucket represents 24, or 16 bytes.
  • Specific context switch information may be available only in checked builds.
  • If symbols aren't available for a component, "Function name" is replaced by the function address.
  • When outputting data, the profiler skips leading 0 counts, the first number represented is not necessarily the first bucket of the function.
  • Bucket output occasionally exceeds function size. It is believed that this is due to empty space (data or code) after the function.
  • if a module recieves less than "hit threshold" (specified by -t lowthreshold) hits, then its data is not displayed.


Logevent.exe: Event Logging Utility

This tool enables you to make entries to the Event Log on either a local or remote computer from the command prompt or a batch file.

The program is particularly useful for storing historical information from the execution of batch programs run from Login Scripts or the AT command. Its ability to store entries into the event log of other computers allows these data to be collected centrally, if required.

In order to allow the Event Log Viewer to properly display the entry, the application should be installed onto the computer being used to view the event log. Installation is automatically performed when the LogEvent program is used for the first time.

LogEvent Topics

  • LogEvent Syntax
  • LogEvent Examples

File Required

  • Logevent.exe


LogEvent Syntax

One Step logevent [-m \\\ComputerName] [-s Severity] [-c CategoryNumber] [-r Source] [-e EventID] [-t TimeOut] "Event Text"

Where:

-s Severity
Severity is one of the following:
  • (S)uccess
  • (I)nformation
  • (W)arning
  • (E)rror
  • (F)ailure
The default is "Information".
-m \\ComputerName
Name of the computer on which the event should be logged.
-c CategoryNumber
Category number. The default is 0.
-r Source
Source is a string-which can be quoted-for the event's source. default is "User Event".
-e EventID
EventID is an integer for the event's Event ID (0-65535). Default is 1.
-t TimeOut
TimeOut is the number of seconds the system waits before exit. default is 60000.
"Event Text"
Names that include space characters must be enclosed in double quotes.

Example:

logevent -m \\server -s E -c 3 -r "User Event" -e 42 "My message."

The following table shows how LogEvent switches map to Event Viewer.

Event Viewer Application Log Event Properties
Type | -s Severity
Date |
Source | -r Source
Time |
Category | -c CategoryNumber
Event ID | -e EventID
User |
Computer | -m \\ComputerName
Description | "Event Text"


LogEvent Examples

  • Put an Information entry into the local event log.

    logevent "Batch program failed"

  • Put a Warning entry into the event log on the computer called "Master", with a catagory code of 999.

    logevent -m \\Master -s W -c 999 "Fatal Error !"


Lsreport.exe: Terminal Services Licensing Reporter

Lsreport.exe: Terminal Services Licensing Reporter NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This command-line tool displays information about licenses granted by Terminal Services license servers. It connects to Terminal Services license servers to obtain information about the license key packs installed on the servers.

By default, LsReport writes all data to a file named Lsreport.txt in the working directory. The output is tab-delimited and contains the following columns:

  • Server
  • License ID
  • Keypack ID
  • Client
  • User
  • Start
  • End
  • Issue Type
  • License Type

To run LsReport, you must have sufficient permission to access license information on the Terminal Services license servers being queried.

License Reporting Tool Topics

  • LsReport Syntax
  • LsReport Examples

File Required

  • Lsreport.exe


LsReport Syntax

One Step lsreport [/f [path]filename] [/d start [end]] [/t] [serverlist] [/?]

Where:

/f [path]filename
allows an alternate file name (and optional path) to be specified for the log file. If an output file by the same name exists, it is overwritten. By default, LsReport writes all data to a file named Lsreport.txt in the working directory.
Example
/d start [end]
writes only licenses considered to be in force between the start and end dates to the output file. If the end date is not specified, it defaults to the current date. An in-force license is a license that is valid at any point over the time span. Active licenses are valid at all points after issue; temporary licenses are valid for 90 days after issue.
/t
restricts the report to temporary licenses only. By default, LsReport reports on all licenses, temporary or otherwise.
Example
serverlist
lists Terminal Services license servers to be queried, separated by spaces. If no list is specified, a list is obtained from the domain controller and all discoverable domain and enterprise Terminal Services license servers are queried.
/?
displays a summary of these options and example invocations of LsReport at the command prompt.


LsReport Examples

lsreport /f c:\lsout2.txt

writes information on all licenses to Lsout2.txt in the root directory of drive C.

lsreport /t NTLS-1 NTLS-2

queries Terminal Services license servers named NTLS-1 and NTLS-2, and reports only on temporary licenses on these two servers.


Lsview.exe: Terminal Services License Server Viewer

Lsview.exe: Terminal Services License Server Viewer NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This GUI-based tool displays the name and type of the available Terminal Services license servers in the user's current domain. It is useful for for monitoring and logging the status of license servers.

The LsView window includes a Time field listing the day and time when each server was last available. The list refreshes every five minutes. At each update, the tool writes all statistics to a log file.

When minimized, LsView appears as a traffic light icon in the status area. This traffic light turns red when a server is down. Hovering over the icon pops up a tool tip showing the names of available license servers.

LsView runs only on Windows 2000.

File Required

  • Lsview.exe


Mibcc.exe: SNMP MIB Compiler

This tool compiles SNMP MIB files.

The SNMP service for Microsoft® Windows® 2000 supports multiple MIBs using an extension-agent API interface. An extension-agent DLL for the Simple Mail Transport Protocol (SMTP) is included with Windows 2000, and other extension-agent DLLs can be added. Previous versions of the Resource Kit have shipped MIBs to support the Internet MIB II (a subset of the LAN Manager MIB II objects), Host Resources MIB objects, and many more.

SNMP MIB Compiler Topics

  • MIBCC Syntax

Files Required

  • Mibcc.exe


MIBCC Syntax

One Step mibcc [-e x] [-l] [-n] [-o filename] [-t] [-w] [files...] [-?]

Where:

-e x
stops after x errors. (Default = 10)
-l
does not print logo.
-n
prints each node as it is added.
-o filename
outputs file name (by default, no file is generated).
-t
prints the MIB tree when finished.
-w x
sets warning level of x, where 0=silent (default value), 1=errors only, 2=warnings only, 3=errors and warnings.
files
specifies the source file names.
-?
displays help.


Msinfosetup.exe: Microsoft System Information Extensions

Msinfosetup.exe: Microsoft System Information Extensions NEW

The Microsoft System Information utility uses a set of controls to collect and display information on computers running Microsoft® Windows® 95, Microsoft® Windows® 98, and Microsoft® Windows NT® version 4.0. On Microsoft® Windows® 2000, these controls are no longer used and are not installed with the operating system. The Microsoft System Information Extensions provide the necessary files to allow Windows 2000 users to open and view System Information (.nfo) files or Windows Report Tool .cab files that were created on these other versions of Windows.

Note

The Microsoft System Information Extensions are not installed during Windows 2000 Resource Kit installation.

System Information Extensions Topics

  • Installing the System Information Extensions
  • Using the System Information Extensions

Files Required

  • The files required for the Microsoft System Information Extensions are contained in the <cdroot>/apps/msinfoext directory of the Microsoft® Windows® 2000 Resource Kit companion CD.


MsInfoSetup Examples

Installing MsInfoSetup

Note

The Microsoft System Information Extensions are not installed when you install the Windows® 2000 Resource Kit. To install them, use the following procedure:

To install the System Information Extensions

  1. Insert the Windows® 2000 Resource Kit companion CD in your CD-ROM drive.
  2. When the setup screen appears, click Explore the CD.
  3. In the <cdroot>/apps/msinfoext directory, double-click msinfosetup.exe.
  4. Follow the directions that appear on your screen.


Using MsInfoSetup

To use the System Information Extensions

  1. Install the extensions on the Windows 2000 computer where you want to view the files.
  2. Click Start, point to Run, and then type msinfo32.exe to start the Microsoft System Information MMC Snap-in.
  3. On the Action menu, select All Tasks, and then click Open System Information File.
  4. Select the .nfo or .cab file that was created on Windows 95, Windows 98, or Windows NT version 4.0.
  5. Click Open.

Notes

  • When a non-Windows 2000 .nfo or .cab file is opened, the Find, Save, and Basic/Advanced operations do not work.
  • If you click a terminal node and then a non-terminal node in the MMC contents pane, the view pane continues to display data from the terminal node. To correct this, on the Action menu, click Refresh.


Oh.exe: Open Handles

This command-line tool shows the handles of all open windows. You can also constrain OH to only show information relating to a specific process, object type, or object name. This feature is useful for finding which process has a file open when a sharing violation occurs.

To function properly, OH must enable a kernel option which maintains a linked list of all objects by object type. If not set, OH enables this option and notifies you that you must reboot before OH will function. After rebooting, OH can display information.

Note

This linked list uses 8 bytes of overhead per object. If desired, this option can later be disabled with Gflags.exe (a Windows 2000 Support Tool included on the Windows 2000 CD). To disable this option in Gflags.exe, clear the check box for Maintain a list of objects for each type in the Global Flags window, then restart the computer.

OH Topics

  • OH Syntax

File Required

  • Oh.exe


OH Syntax

One Step oh [-p n] [-t typeName] [-o fileName] [-a] [name] [-?]

Where:

-p n
only displays open handles for process with ClientId of n
-t typeName
only displays open object names of the specified type. Examples include: Key, File, Directory, Desktop, Semaphore, Mutant, Section, Event, Thread.
note-icon

Note

Use the -a option to also display unnamed objects of the specified type.

-o fileName
specifies the name of the file to write output.
-a
includes objects with no name.
name
displays only handles that contain the specified name.
-?
displays command-line help.


Oleview.exe: OLE/COM Object Viewer

This administration and testing tool enables you to browse in a structured way, configure, activate, and test all of the Microsoft Component Object Model (COM) classes installed on your computer.

Using this tool, you can also configure local or system-wide COM settings, including security settings, and enable or disable Distributed COM. You can activate COM classes locally or remotely, which is helpful for testing Distributed COM setups. OleView fully supports the Component Categories specification, which is a core COM technology.

OleView lets you Test any COM class by simply double-clicking its name. The list of interfaces that class supports will be displayed. Double-clicking an interface entry allows you to invoke a viewer that will exercise that interface.

With OleView, you can view type library contents to figure out what methods, properties, and events a Microsoft® ActiveX® control supports. Then you can copy a properly formatted OBJECT tag to the Clipboard for inserting into an HTML document. OleView is oriented toward developers and power users; however, the user interface offers both Expert and Novice modes, which you can toggle between.

OleView displays the registry entries for each class in an easy-to-read format. The registry view (right pane) shows all the relevant registry information, including named values of keys like ApartmentModel.

In the OleView window, currently active items are shown in bold and multiple objects can be activated simultaneously. You can drag and drop a file name onto the window and the tool creates a file moniker and binds to it.

Right-click an object in OleView to see its context menu.

The right pane contains tabs for administering COM class information. You can set Distributed COM options and security as well as change keys like LocalServer32.

From within OleView, you can activate remote servers one of two ways:

  • With CoGetClassObject:
  1. Right-click an object in the left pane.
  2. Choose the Create Instance On... menu item and enter a computer name.

    3. For example, to activate an object on \\computer1, enter computer1 and press OK.

  3. With a file moniker bind and ActivateAtStorage:
    • On the File menu, choose Bind To File.
    • Specify the UNC name of the file you want to bind to, for example, \\computer1\docs\any.doc.

You can also specify any moniker display name on the command line.

OleView requires Microsoft® Windows® 2000, Microsoft® Windows NT® version 4.0, Microsoft® Windows® 98, or Microsoft® Windows® 95. You must also have installed either Microsoft® Internet Explorer 3.0 or higher or the Microsoft® ActiveX® Software Development Kit (SDK).

Versions of this tool (then called OLE2View) included with Microsoft® Windows NT version 3.5 and Microsoft® Windows NT version 3.51 are included with the Microsoft® Win32® Software Development Kit (SDK) and Microsoft® Visual C++®.

To correctly set up OleView components, you must run Ccdist.exe, a self-extracting and self-installing file that contains Comcat.dll. Comcat.dll implements the Component Categories manager, which applications use to read and write Component Category information to and from the registry. OleView uses Comcat.dll to list the components installed on a system by category.

OLE/COM Object Viewer Topic

  • OLE/COM Object Viewer Interface Viewers

Files Required

  • Oleview.exe
  • Oleview.htm
  • Comcat.dll (installed by Ccdist.exe)
  • Ccdist.exe (self-extracting file containing Comcat.dll)
  • Ccdist35.exe
  • Iviewers.dll


OLE/COM Object Viewer Interface Viewers

In OleView, interface viewers are Component Object Model (COM) objects. Viewers for IDataObject (Uniform Data Transfer), IDispatch, IPersistXXX, ITypeLib and ITypeInfo are provided. There is a default interface viewer for IUnknown, so that no matter what interface you click you'll get at least the default (taking advantage of the default class capabilities of Component Categories).

The ITypeLib viewer is a type library decompiler, so that output window of the viewer shows the .odl source for the given type library (or the part you have selected).

OLE/COM Object Viewer supports plug-in interface viewers. If you have designed a COM interface, or would like to be able to use some existing interface, you can develop your own interface viewers (see the IDL file for the IInterfaceViewer interface below). Simply create an in-process COM server which implements the IInterfaceViewer interface and have it register the following information:

HKCR\Interface\{the IID you want to view}\OleViewerIViewerCLSID = {your clsid}

You should also use the Component Category Manager to register your viewer's CLSID as implementing the OLEViewer Interface Viewer CATID: {64454F82-F827-11CE-9059-080036F12502}.

IDL for IInterfaceViewer

// iview.idl
//
// Interface definitions for Ole2View Interface Viewers
//
import "unknwn.idl";

// DEFINE_GUID(IID_IInterfaceViewer,0xfc37e5ba,0x4a8e,0x11ce, 0x87,0x0b,0x08,0x00,0x36,0x8d,0x23,0x02);
//
// IInterfaceViewer::View can return the following SCODEs
//
// S_OK
// E_INVALIDARG
// E_UNEXPECTED
// E_OUTOFMEMORY
//
[
    uuid(fc37e5ba-4a8e-11ce-870b-0800368d2302),
    object
]
interface IInterfaceViewer : IUnknown
{
    HRESULT View([in]HWND hwndParent, [in]REFIID riid, [in]IUnknown* punk);
}


Os2api.txt: OS/2 API Information

OS/2 API Information contains information for developers describing which APIs for the OS/2 operating system are supported by Microsoft® Windows® 2000 and which are not supported.

File Required

  • Os2api.txt


Qtcp.exe

Qtcp.exe NEW

This command-line tool measures end-to-end network service quality. Qtcp sends a sequence of test packets through a network, then reports on the queuing delay experienced by each packet. Packets that do not arrive at the destination are recorded as dropped packets. This tool can be used on either a production network or a controlled test network.

Qtcp Features

This tool:

  • can report very precise delay variations, on the order of microseconds.
  • invokes network Quality of Service (QoS) by default and is useful for evaluating QoS mechanisms.
  • can simulate traffic flows shaped to a range of token bucket parameters for a range of user-selectable packet sizes.
  • can be used on an isolated, controlled network or a production network.
  • generates detailed result logs, and can collate multiple log files to produce a statistical summary across variables.

A Qtcp session is invoked on both a sending and a receiving host computer. After invocation, the tool sets up a TCP control channel between sender and receiver to properly negotiate the test. At the same time, it uses the GQoS API (part of Winsock2) to invoke QoS from local Traffic Control and from the network.

When the test is finished, the receiving host parses the log of received packets and generates three log files:

  • Filename.sta reports summary statistics on the total number of packets received and specifies the sequence number of each dropped packet.
  • Filename.raw contains a detailed log showing normalized send time and receive time for each packet, the latency (difference between sent and received time), packet size and sequence number.
  • Filename.log normalizes the results of Filename.raw to account for clock drift between the two hosts

Details on how to use Qtcp are contained in "Using Qtcp to Measure Network Service Quality" (Qtcp.doc).

Kernel-Mode Time-Stamping Module

Qtcp works with an optional kernel-mode time-stamping module that can be run only on Microsoft® Windows® 2000. Timestmp.sys is a separate tool also included in the Windows 2000 Resource Kit, and requires separate installation with its own installer, Tsinstl.exe. As packets are transmitted and received, TimeStmp stamps them with the local time to a precision of 100 ns. If the kernel-mode time-stamping module is not installed, Qtcp uses a user-mode time stamp that is less accurate.

Files Required

  • Qtcp.exe
  • Timestmp.sys - optional
  • Tsinstl.exe - installs Timestmp.sys

The files for Qtcp are installed by the Resource Kit setup program into the \qostools sub-directory of the Resource Kit installation directory.


RPC Ping: RPC Connectivity Verification Tool

RPC Ping: RPC Connectivity Verification Tool NEW

This tool confirms Remote Procedure Call (RPC) connectivity between RPC servers and clients on a network. RPC Ping checks to see if RPC services are responding to RPC requests from client computers.

RPC Ping Topics

  • Rpings (Server) Syntax
  • Rpingc and Rpingc16 (Client) Syntax

Files Required

Server Component

  • Rpings.exe (for Microsoft® Windows® 2000 and Microsoft® Windows NT®)

Client Component

  • Rpingc.exe (for Windows 2000, Windows NT, and Microsoft® Windows® 95, and Microsoft® Windows® 98)
  • Rpingc16.exe (for Microsoft® Windows® 3.1x clients)


RPC Ping: Rpings.exe (Server) Syntax

RPings is the server-side RPC Ping tool. It contains two Remote Procedure Call (RPC) functions: Echo and Stats. These functions are called by the client side RPC ping tools (Rpingc32 or Rpingc16 ). Run RPings without any options to use all available protocol sequences.

One Step rpings [-p ProtocolSequence]

Where:

ProtocolSequence
is the friendly name for one of the supported transport mechanisms of RPC, as follows:
Friendly Name | Description
namedpipes | NCA connection over Named Pipes (ncacn_np)
tcpip | NCA connection over TCP/IP (ncacn_ip_tcp)
netbios | NCA connection over NetBIOS on NetBEUI (ncacn_nb_nb)
ipx/spx | NCA connection over SPX (ncacn_spx)
vines | NCA connection over Banyan Vines (ncacn_vns_spp)

note-icon

Note

Enter @q to exit Rping.


RPC Ping: Rpingc and Rpingc16 (Client) Syntax

Rpingc is the 32-bit version of the client side of the RPC Ping tool. Rpingc16 is the 16-bit versions of the client side. They connect and bind to the specified destination Remote Procedure Call (RPC) server and display the status, available protocol sequences with end points, and quality of the RPC connection. Both Rpingc and Rpingc16 are set up to run in the Windows environment.

Rpingc and Rpingc16 Options

Exchange Server: The name of the Exchange Server to ping

Protocol Sequence: The following options are available:

Any (default)

Named Pipes

IPX/SPX

TCP/IP

NetBIOS

Vines

End Point: The following End Points on the Exchange Server are available:

RPing (default, all)

Store (the Exchange Store)

Admin (the Exchange Administrator)

Number of Pings: Continuous

Stop at ___

Mode: Ping Only (character echoed by Rpings)

End Point Search (enumerates all endpoints available)

Run with Security (verifies that authenticated RPCs work)


Rpcdump.exe: RPC Dump

Rpcdump.exe: RPC Dump NEW

This command-line tool queries Remote Procedure Call (RPC) endpoints for status and other information on RPC.

RPC Dump interrogates the endpoint mapper database to obtain a list of every registered endpoint. If the /i switch is specified, the tool pings each endpoint to determine if the service that registered the endpoint is listening. After gathering some other statistics, RPC Dump sorts them and outputs the data.

This tool can help to isolate network troubles involving RPC.

RPC Dump Topics

  • RPC Dump Syntax
  • RPC Dump Examples

File Required

  • Rpcdump.exe


RPC Dump Syntax

One Step rpcdump [/s] [/v] [/i] [/p protocol] [-?]

Where:

/s
specifies the name of server to interrogate. Defaults to local if not specified.
/v
runs in verbose mode.
/i
pings all registered endpoints to determine if the service that registered the endpoint is listening.

note-icon

Note

This can take a while over slow network links. RPC Dump is multi-threaded to help with performance in this area. A status bar displays the progress.

/p protocol
is the name for one of the supported transport mechanisms of RPC. The default is ncacn_ip_tcp. Valid protocols include the following:
ncacn_np | Connection-oriented named pipes
ncacn_mq | Datagram connectionless over the Message Queuing server
ncadg_ipx | Datagram connectionless IPX
ncacn_spx | Connection-oriented SPX
ncacn_http | Connection-oriented TCP/IP using Microsoft Internet Information Services as HTTP proxy.
ncacn_nb_nb | Connection-oriented NetBEUI
ncacn_nb_tcp | Connection-oriented NetBIOS over TCP
ncacn_nb_ipx | Connection-oriented NetBIOS over IPX
ncacn_ip_tcp | Connection-oriented TCP/IP
ncacn_at_dsp | AppleTalk DSP
ncadg_ip_udp | Datagram connectionless UDP/IP
ncacn_vns_spp | Connection-oriented Vines SPP transport
ncacn_dnet_nsp | Connection-oriented DECnet transport
ncacn_nb_xns | Connection-oriented XNS
-?
displays a command-line syntax screen.


RPC Dump Example

In this example, a client is unable to start mail because it cannot connect to the server. You can run RPC Dump on the Microsoft® Exchange server to verify that the proper services (such as directory and store) are registered and responding to RPC calls.

In the sample output, the Exchange server has registered its endpoints and is listening for RPC calls.

rpcdump /s reskit /i

ncacn_ip_tcp(Connection-oriented TCP/IP)
  172.30.5.86[1526] [f5cc59b4-4264-101a-8c59-08002b2f8426] MS Exchange Directory DRS Interface :YES
  172.30.5.86[1526] [f5cc5a7c-4264-101a-8c59-08002b2f8426] MS Exchange Directory XDS Interface :YES
  172.30.5.86[1526] [f5cc5a18-4264-101a-8c59-08002b2f8426] MS Exchange Directory NSP Interface :YES
  172.30.5.86[1544] [a4f1db00-ca47-1067-b31f-00dd010662da] Exchange Server STORE EMSMDB Interface :YES
  172.30.5.86[1544] [a4f1db00-ca47-1067-b31e-00dd010662da] Exchange Server STORE ADMIN Interface :YES
  172.30.5.86[1544] [89742ace-a9ed-11cf-9c0c-08002be7ae86] Exchange Server STORE ADMIN Interface :YES
  172.30.5.86[1544] [99e64010-b032-11d0-97a4-00c04fd6551d] Exchange Server STORE ADMIN Interface :YES

Notice that some endpoints might not have a friendly name or annotation. It is up to the service that registers the endpoint to fill in this field.

In verbose mode, additional information is displayed such as version and ComTimeOutValue.

rpcdump /s reskit /i /v

ProtSeq:ncacn_np
Endpoint:\pipe\0000011C.001
NetOpt:
Annotation:Exchange Server STORE ADMIN Interface
IsListening:YES
StringBinding:ncacn_np:\\\\RESKIT[\\pipe\\0000011C.001]
UUID:a4f1db00-ca47-1067-b31e-00dd010662da
ComTimeOutValue:RPC_C_BINDING_DEFAULT_TIMEOUT
VersMajor 1  VersMinor 0


Snmpmon.exe: SNMP Monitor

SNMP Monitor is a tool that can monitor any SNMP MIB variables across any number of SNMP nodes. It can then optionally log query results to any ODBC data source (such as SQL Server), automatically creating any necessary tables. Logging can be enabled for all queries or limited to particular thresholds, and thresholds can be either edge or level triggered.

Rudimentary conditionals are also possible. SNMP Monitor can execute arbitrary command lines based on whether or not the node responded to the query, whether or not the node supported the requested variable, and whether the value was greater than, less than, or equal to a specified constant.

SNMP Monitor is a stand-alone executable that accepts a configuration file as input.

SNMP Monitor Caveats

  • In the current implementation, the timeouts used for SNMP queries are not configurable. The defaults are 750 millisecond timeout and two retries.
  • SNMP Monitor assumes a community string of "public" for all SNMP queries. This is not currently configurable.
  • If polling intervals are too small, SNMP Monitor can get behind. Everything will still get polled and evaluated correctly, but accurate timing cannot be assumed.

SNMP Monitor Topics

  • SNMP Monitor Syntax
  • SNMP Monitor Configuration File Format:
    | Scope Declaration | Conditional Statements | String Substitution | Example
  • SNMP Monitor Sample Configuration File: M5.mon
  • SNMP Monitor Sample Configuration File: Pbxfix.mon
  • SNMP Monitor Database Table Schema

Files Required for SNMP Monitor:

  • Snmpmon.exe
  • Odbc32.dll must be available if database logging is to be used.


SNMP Monitor Syntax

Command prompt Open command prompt now.

One Step snmpmon configuration_file

Where:

configuration_file

is the fully qualified path to an SNMP Monitor configuration file.

For example:

snmpmon c:\snmp\monitor.ini


SNMP Monitor Configuration File Format

A configuration file is an ASCII text file that consists of one or more "monitored node definitions" separated by at least one blank line or C++ style comment line. Comments are not allowed within a monitored node definition. A monitored node definition consists of the "scope declaration" followed by any number of "conditional statements".

  • Scope Declaration
  • Conditional Statements
  • String Substitution
  • Example


SNMP Monitor Configuration File: Scope Declaration

Scope Declaration

A scope declaration has the following format:

<Node ID> <Object identifier> <Poll interval> <Default log setting> [<ODBC data source> <ODBC table name> <ODBC user ID> [<ODBC password>]]

Where:

<Node ID>

must be one of the following:

  • A computer name without backslashes (for example, "MY_SERVER")
  • A dotted IP address (for example, "128.11.100.4")
  • A colon followed by the path to a text file containing a list of computer names or IP addresses. There must be one entry per line, and blank lines are ignored (for example, ":c:\snmpmon\data\machines.ip").

<Object identifier>

is the dotted object identifier within the MIB namespace (for example, "1.3.6.1.2.1.1.3").

<Poll interval>

is the number of seconds between each poll of this monitored node.

<Default log setting>

is one of the following values:

0 Don't log any data unless specified by one of the conditionals.
1 Log all query results, ignoring the log settings in the conditionals.

<ODBC data source>

is the name of the ODBC data source to which to direct logged data.

<ODBC table name>

is the name of the table within the data source to which to direct logged data. If this table does not exist, it will be created.

<ODBC user ID>

is the user ID used to connect to the ODBC data source.

<ODBC password>

is the password used to connect to the ODBC data source. If this parameter is omitted, no password is used.


SNMP Monitor Configuration File: Conditional Statements

Conditional Statements

The scope declaration is followed immediately by any number of conditional statements. Each conditional has the following format:

<Condition> <Log trigger> [<Command-line trigger> <Command-line timeout> <Command line>]

Where:

<Condition>

is one of the following:

  • NO_RESPONSEmet when the node does not respond to the query.
  • RESPONDEDmet when the node responds to a query regardless of the value.
  • SUPPORTEDmet when the node responds with a valid value from the query.
  • NOT_SUPPORTEDmet when the node responds, but does not support the value in question.
  • <xmet when the result is less than the integer x.
  • >xmet when the result is greater than the integer x.
  • =xmet when the result is equal to the integer x.

Note that spaces are not allowed between the operator and the integer in the three previous conditionals.

<Log trigger>

is one of the following values:

0 Don't log anything when this conditional is met.

1 Log the result only when this conditional was not met during the last poll ("edge triggered").

2 Log the result each time this conditional is met ("level triggered").

<Command-line trigger>

is one of the following values:

0 Execute this command line every time this conditional is met.

1 Execute this command line only if this conditional was not met during the last poll ("edge triggered").

<Command-line timeout>

specifies, in milliseconds, how long to wait for the command line to finish executing. For any timeout greater than 0, if the command has not completed when the timeout expires the command will be terminated.

<Command line>

is the command line to execute when this conditional is met.

Conditionals are processed in the order in which they occur in the node definition. Only the first met conditional is actually processed.


SNMP Monitor Configuration File: String Substitution

String Substitution

SNMP Monitor also provides for string substitution within command lines. This feature allows an administrator to put place holders in command lines within the configuration file that will be replaced with the appropriate values when they are run.

Such substitution strings are specified in a command line by a single percent character ("%") followed by the letter corresponding to the desired value. A percent character can be included in a command by preceding it with another percent character, for example, "%%").

The following substitutions are available:

i IP address of the current node

o object identifier being queried

d Name of the ODBC data source where this data is being logged

t Name of the table within the ODBC data source where this data is being logged

r Result of the SNMP query. This is not the value of the query, but rather a success/failure indication.

v Value of the queried variable. If the query failed, this resolves to zero.


SNMP Monitor Configuration File: Example

Example

Given that we are currently monitoring the 1.3.6.1.2.1.1.3 object ("system uptime") for the device with the IP address 128.11.109.3 and the device has been running for 30 seconds (3,000 hundredths of a second), the following command line:

coolstuf %i %o %v

would resolve to:

coolstuf 128.11.109.3 1.3.6.1.2.1.1.3 3000


SNMP Monitor Sample Configuration File: M5.mon

// In all cases, we turn the icon red if the computer doesn't answer,

// green if it does, and purple if it has been restarted within the

// last ten minutes

// Headend and operations computers

:ops.b15 1.3.6.1.2.1.1.3 120 0 SNMPMonTest SNMP_HE_Data sa

NO_RESPONSE 1 1 20 ovstat %i 0

<30000 1 1 20 ovstat %i 2

RESPONDED 0 1 20 ovstat %i 3

// USRobotics hardware

:usrobot.b15 1.3.6.1.2.1.1.3 120 0 SNMPMonTest SNMP_Modem_Data sa

NO_RESPONSE 1 1 20 ovstat %i 0

<30000 1 1 20 ovstat %i 2

RESPONDED 0 1 20 ovstat %i 3

// MMS controllers

:tiger.b15 1.3.6.1.2.1.1.3 120 0 SNMPMonTest SNMP_Tiger_Data sa

NO_RESPONSE 1 1 20 ovstat %i 0

<30000 1 1 20 ovstat %i 2

RESPONDED 0 1 20 ovstat %i 3

// Production STBs

:stbe.b15 1.3.6.1.2.1.1.3 120 0 SNMPMonTest SNMP_STB_Data sa

NO_RESPONSE 1 1 20 ovstat %i 0

<30000 1 1 20 ovstat %i 2

RESPONDED 0 1 20 ovstat %i 3

// Test STBs

:stbetest.b15 1.3.6.1.2.1.1.3 120 0 SNMPMonTest SNMP_STB_Data sa

NO_RESPONSE 1 1 20 ovstat %i 0

<30000 1 1 20 ovstat %i 2

RESPONDED 0 1 20 ovstat %i 3

// The cubs don't seem to have SNMP installed so for now we won't

// poll them

//:cub.b15 1.3.6.1.2.1.1.3 1120 0 SNMPMonTest SNMP_CUB_Data sa

//NO_RESPONSE 1 1 20 ovstat %i 0

//<30000 1 1 20 ovstat %i 2

//RESPONDED 0 1 20 ovstat %i 3

_


SNMP Monitor Sample Configuration File: Pbxfix.mon

// Production STBs

:stbe.b15 1.3.6.1.2.1.1.3 20 0 SNMPMonTest ModemCtlData sa

NO_RESPONSE 1 1 20 modemctl %i BUSY

>30000 1 1 20 modemctl %i RESTORE

// Test STBs

:stbetest.b15 1.3.6.1.2.1.1.3 20 0 SNMPMonTest ModemCtlData sa

NO_RESPONSE 1 1 20 modemctl %i BUSY

>30000 1 1 20 modemctl %i RESTORE

_


SNMP Monitor Database Table Schema

The data tables that are created by SNMP Monitor and to which query results are logged contain the following fields/columns:

Column nameDatatype

-----------------------------------------------

IDint

IPAddressvarchar(20)

ObjectIdentifiervarchar(255)

Resultint

Valueint

Timedatetime


Snmputil.exe: SNMP Browser

SNMP Browser is a tool that lets you get SNMP information from an SNMP host on your network.

SNMP Browser Topics

  • SNMP Browser Syntax
  • SNMP Browser Example

Files Required

  • Mib.bin (can be created with Mibcc.exe: SNMP MIB Compiler)
  • Snmputil.exe

Note

The following three required files are installed with Windows 2000:

    • Mgmtapi.dll
    • Snmpapi.dll
    • Wsnmp32.dll

The SNMP service must be installed on the computers that SNMP Browser queries.


SnmpUtil Syntax

One Step snmputil {{get | getnext | walk} agent community oid [oid] | trap}

Where:

get
gets the current value of the specified oid(s).
getnext
gets the current value of the item in the MIB that follows the item whose oid is specified.
walk
steps through the MIB and retrieves the values of all items in the branch of the MIB specified by oid.
agent
specifies the computer to query. This can be either an IP address or a host name if the computer is specified in the HOSTS file.
community
specifies a community name, which is used to group computers together into management groups. You can see a list of community names in the SNMP Service Configuration dialog box by choosing the Network icon in Control Panel or looking up the value of ValidCommunities in the SNMP\Parameters subkey in the registry. By default, a community called "public" is created when you install SNMP on Windows NT.
oid
the ASN.1 name of the variable being queried, of the form .N.N.N.N (that is, a string of numbers separated by periods or, alternately, a string of names separated by periods). oid is an abbreviation for "object identifier."
trap
tells SNMP Browser to listen for and trap PDUs.

Note

The SNMP service does not need to be running on the computer that is executing SNMP Browser, but the proper files must be copied to that computer. In particular, Mgmtapi.dll, Snmpapi.dll, Wsnmp32.dll, and Mib.bin must be present, and TCP/IP must be installed on the computer.


SNMP Browser Example

The following command line:

snmputil get jb486 public .iso.org.dod.internet.mgmt.mib-2.system.sysDescr.0

returns a text description of the type of computer hardware and software being used on the computer named jb486.

Notice that the oid strings can get quite long. There is one built-in shortcut. For items in the .iso.org.dod.internet.mgmt.mib-2 branch of the Internet MIB, the request can be shortened to:

snmputil get jb486 public system.sysDescr.0

In this case, the oid does not start with a period (".").

note-icon

Note

The SNMP service does not need to be running on the computer that is executing SNMP Browser, but the proper files must be copied to that computer. In particular, Mgmtapi.dll, Snmpapi.dll, Wsnmp32.dll, and Mib.bin must be present, and TCP/IP must be installed on the computer.


Srvinfo.exe

This command-line tool displays information about a remote server, including available disk space, partition types, and status of services.

SrvInfo Topics

  • SrvInfo Syntax
  • SrvInfo Example

File Required

  • Srvinfo.exe


SrvInfo Syntax

One Step srvinfo [-d] [-ns] [-s] [-v] [\\computer_name] [-?]

Where:

-d
shows service drivers and services.
-ns
does not show any service information.
-s
shows shares.
-v
gets version information for Exchange Server, Internet Information Services, and SQL Server.
\\computer_name
specifies the name of a remote server. If omitted, information on the local computer is displayed.
-?
displays a syntax screen at the command prompt.


SrvInfo Example

c:\srvinfo

Server Name: NTRKALPHA
Security: Users
NT Type: WinNT Server
Version: 4.0, Build = 1344
Domain: NTWKSTA
PDC: \\PHOENIX
IP Address: 172.17.88.28
CPU[0]: DEC-321064
Drive: [Filesys] [Size] [Used] [Free]
  C$     NTFS     1004    907     97
  D$      FAT        6      1      5
Services:
   [Running]    Alerter
   [Running]    Computer Browser
   [Stopped]    ClipBook Server
   [Running]    DHCP Client
   [Running]    EventLog
   [Running]    Server
   [Running]    Workstation

   [Running]    License Logging Service
   [Running]    TCP/IP NetBIOS Helper
   [Running]    Messenger
   [Stopped]    Network DDE
   [Stopped]    Network DDE DSDM
   [Running]    Net Logon
   [Running]    NT LM Security Support Provider
   [Running]    Plug and Play
   [Stopped]    Directory Replicator
   [Stopped]    Remote Procedure Call (RPC) Locator
   [Running]    Remote Procedure Call (RPC) Service
   [Stopped]    Schedule
   [Running]    Spooler
   [Stopped]    Telephony Service

   [Stopped]    UPS
Network Card [0]: Intel EtherExpress PRO Ethernet Adapter
Protocol[0]: [NET0] WINS Client(TCP/IP) 4.0
System Up Time: 186 Hr 36 Min  9 Sec


Terminal Server Capacity Planning Tools

Terminal Server Capacity Planning Tools NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This suite of tools assists organizations with Microsoft® Windows® 2000 Terminal Services capacity planning. They allow organizations to easily place and manage simulated loads on a server. This in turn can allow an organization to determine whether its environment is able to handle the load that the organization expects to place on it.

The tools includes a server-client load simulator for Windows 2000 Terminal Services, RoboServer (Robosrv.exe) and RoboClient (Robocli.exe), and two related test tools, SmClient (Smclient.exe) and QueryIdle (Qidle.exe). Used together, these tools make capacity planning easier and more automated.

Terminal Server Capacity Planning Tools Overview (Tscpt.doc) and Terminal Server Simulated Client (Smclient.doc) provide detailed descriptions of these tools and how to use them.

Files Required

  • Robocli.exe
  • Robosrv.exe
  • Qidle.exe
  • Smclient.doc
  • Smclient.exe
  • Tscpt.doc


Timestmp.sys: QoS Time Stamp

Timestmp.sys: QoS Time Stamp NEW

This tool provides optional kernel-mode time-stamping support for Qtcp.exe, another Windows 2000 Resource Kit tool that measures end-to-end network service quality. Qtcp invokes network Quality of Service (QoS) by default and is useful for evaluating QoS mechanisms. TimeStmp works as a pluggable module in the Packet Scheduler framework.

As Qtpc transmits and receives test packets, TimeStmp stamps them with the local time to a precision of 100 ns, enhancing the accuracy of Qtcp test results. If this module is not installed, Qtcp uses a user-mode time stamp that is less accurate.

On the sending side, TimeStmp picks up packets that are destined to port 5003 and time-stamps the current system tickcount and a sequence number in a pre-determined field in the packet. On the receiver, it time-stamps the system tickcount into a different field.

Installing and Uninstalling TimeStmp

Tsinstl.exe installs and configures Timestmp.sys on a host computer. This program can configure TimeStmp to operate on specific adapters in the host computer and to use Auto or Manual Start.

Once TimeStmp is configured on an Interface (network adapter), however, the Packet Scheduler will not bind to TCP/IP (Tcpip.sys), and thus will not have an IP address, until Timestmp.sys is started.

After running Tsinstl.exe, you must copy Timestmp.sys to your current drivers directory (%windir%\system32\drivers). You must then reboot to make the driver operational.

Although you can leave TimeStmp installed with negligible overhead, you can also use the remove option of Tsinstl.exe to uninstall the module. A restart is required after for this to take effect. Uninstalling returns the computer to its previous registry settings by deleting the PSCHED\Profiles and TIMESTMP keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.

Files Required

  • Qtcp.exe - test application that uses Timestmp.sys
  • Timestmp.sys
  • Tsinstl.exe - installation program for Timestmp.sys

The files for TimeStmp are installed by the Resource Kit setup program into the \qostools sub-directory of the Resource Kit installation directory.


W2000events.mdb: Windows 2000 Events

This Access database file lists messages and related information from the Windows Event Log, an administrative tool that is part of Microsoft® Windows® 2000. This database contains the messages from the System, Security, and Application logs along with their corresponding Event ID, Source, and Type.

You must have Microsoft® Access installed on your computer to view this database. You might get a notice the first time the file is opened stating it is a read-only file. If file attributes need to be changed to allow writes, this can be done using Windows Explorer.

Important

The Windows 2000 Events database is not intended as an exclusive reference. If, for example, you encounter a network error message in the command prompt window, you can also find help for the network problem by typing net helpmsg and the message identification number.

File Required

  • W2000events.mdb

For More Information

W2000msgs.chm: Windows 2000 Error and Event Messages Help, an HTML Help file listing most of the error and system-information messages generated by Windows 2000, is also provided in the Windows 2000 Resource Kit.


Windows Report Tool Deployment Software Development Kit (WinRep SDK)

Windows Report Tool Deployment Software Development Kit (WinRep SDK) NEW

The Windows Report Tool (Winrep.exe) is an Internet-based problem reporting tool that is installed with Microsoft® Windows® 2000. Windows Report Tool collects information about a client computer that can be used by technical support personnel to diagnose and troubleshoot problems.

The Windows Report Tool Deployment Software Development Kit (WinRep SDK) is a collection of files consisting of documentation, sample Web pages, and tools necessary for extending the WinRep solution into a corporate or OEM environment. WinRep SDK allows customers to have a fast and efficient way of submitting requests for product support.

For more information, see Winrepsdk15.doc, which is located in the <cdroot>\Apps\Winrep directory of the Windows 2000 Resource Kit companion CD.

Files Required

  • Winrpsdk15.doc
  • Edpost1.dll
  • Setuped.dll
  • Fileonly.htm
  • Launch.htm
  • Sqlfile.htm

The Windows Report Tool Deployment Software Development Kit is not installed during the standard Windows 2000 Resource Kit installation. The files are located in the <cdroot>\Apps\Winrep directory of the Windows 2000 Resource Kit companion CD.


Associate.exe

This command-line tool enables you to register or unregister a file name extension with the registry. "File extension, executable program" associations enable the Windows 2000 shell to launch the correct executable program when a file with the associated file name extension is opened from the command prompt, from Windows Explorer, or from File Manager.

For example, if you use many files with the extension ".abc" and have an application Abcrun.exe that operates on them, you could associate the file name extension and application by running:

associate .abc abcrun.exe

Then, whenever a file with the .abc file name extension is started from the command prompt, File Manager, or Windows Explorer, Abcrun.exe will run.

Associate Topics

  • Associate Syntax
  • Associate Examples

File Required

  • Associate.exe


Associate Syntax

One Step associate .ext filename [/q] [/d] [/f] [/?]

Where:

.ext
indicates the extension to be associated.
filename
indicates the executable program to associate .ext with.
/q
(quiet) suppresses all interactive prompts.
/d
deletes the association if it exists.
/f
forces an overwrite or delete of the existing entry without questions.
/?
displays a usage screen.

Return Value

A return value of zero indicates success. Any other value indicates failure.


Associate Examples

associate .lst notepad.exe

adds the association of .lst with Notepad.exe.

associate .lst notepad.exe /d

removes the association of .lst with Notepad.exe.

associate .lst

returns the name of the associated executable for .lst, if it exists


Clip.exe: Clip To Clipboard

This command-line tool copies text from the STDIN stream to the Clipboard. You can then paste the data directly into any application that can receive text from the Clipboard.

To use Clip

Run any program that prints text to STDOUT and pipe the results through Clip. Clip reads from STDIN and copies the text to the Clipboard. Then, using the Paste command, copy the text to any application that can receive text from the Clipboard.

For syntax details, at the command prompt, type:
clip /? or clip -?

Example One

dir | clip

copies a folder listing onto the Clipboard. Next, run WordPad (or a similar text editor) and choose Edit, then Paste from the menu bar to paste the folder listing into WordPad.

Example Two

clip < readme.txt

places a copy of the contents of Readme.txt onto the Clipboard.

Example Three

awk -f gencode.awk input.txt | clip

places the output of the program Gencode.awk onto the Clipboard.

File Required

  • Clip.exe


Cliptray.exe: Clipboard Organizer

This tool allows you to store and organize blocks of text and copy them into text-based files using the Clipboard. It is useful for developers, authors, support personnel, Webmasters, or anyone who needs to use the same text many times.

When you start ClipTray, the ClipTray icon appears in the status area (system tray). Right-clicking this icon brings up the ClipTray menu, containing the titles of your current entries and options for adding more. Clicking on the ClipTray entry you wish to use will place it into the Clipboard, where it is ready for pasting into any program.

ClipTray also has the ability to use more than one ClipTray text file, allowing you to access your entries by project or to distribute entries to other members of your team.

Files Required

  • Cliptray.cnt
  • Cliptray.exe
  • Cliptray.hlp
  • Comdlg32.ocx
  • Msgblast.ocx
  • Vb40032.dll


Compress.exe: File Compress

Compress.exe: File Compression Utility

This command-line tool can compress one or more files. These compressed files can be expanded with Expand.exe: File Expansion Utility

Compress Syntax

One Step compress [-r] [-d] [-zx] [-z] [-zq[n]] Source Destination [-?]

-Or-

One Step compress -r [-d] [-zx] [-z] [-zq[n]] Source [Destination] [-?]

Where:

-r
renames expanded files.
-d
updates compressed files only if out of date.
-zx
uses LZX compression.
-z
uses MS-ZIP compression.
-zq[n]
uses quantum compression. Optional level n must be in the range 1 to 7. The default is 4.
Source
specifies the source file. The * and ? wildcard characters can be used.
Destination
specifies the destination file or path. The destination can be a folder. If source specifies multiple files and -r is not specified, then destination must be a folder.
-?
shows command-line help.

File Required

  • Compress.exe


Creatfil.exe: Create File

This command-line tool creates an artificial file of any size. This is useful for testing the behavior of tools, applications, and setup programs under conditions of low available memory on a hard disk.

Create File must be run from the command prompt; it cannot be run from the Run command on the Start menu.

Create File Syntax

One Step creatfil [path]filename [filesize]

Where:

path
is the path to an existing directory on the hard disk where the file is to be created (default is the root of the current drive).
filename
is the name of the file to create.
filesize
is the size of the file to create, in units of one kilobyte (1024 bytes). This argument is optional. The default is one kilobyte.

Create File Example

c:\>creatfil workfile.dat 100

creates a 100 KB (102,400 byte) file of zeros called Workfile.dat.

Files Required

  • Creatfil.exe


Delrp.exe: Delete File and Reparse Points

Delrp.exe: Delete File and Reparse Points NEW

This command-line tool deletes a file or directory and any associated NTFS reparse points.

In Microsoft® Windows® 2000, NTFS supports a new file system entity called a "reparse point." Reparse points are used as building blocks by Microsoft and third-parties to enhance NTFS file system behavior. They are used in Hierarchical Storage Management (HSM), and Volume Mount Points.

For HSM, reparse points are used to implement remote storage and other future storage add-ons. For Volume Mount Points, they eliminate drive letter restrictions by using mount points.

Note

Using reparse points, applications can trap open operations against file system objects and run their own code before returning file data.

Delrp Topics

  • Delrp Syntax

File Required

  • Delrp.exe


Delrp Syntax

One Step delrp filename [/?]

Where:

filename
is the file or directory to be deleted
?/
displays command help


Diruse.exe: Directory Disk Usage

Directory Disk Usage shows disk space used per folder. You can use this tool to check how disk space is being used in users' home folders. If you run Directory Disk Usage while logged on as a member of the Administrators group, you can check the use of disk space in folders on an NTFS partition, even if you don't have access rights to those folders.

You can also specify a maximum folder size, and Directory Disk Usage will mark any folders that exceed it and, if you choose, alert you to the problem.

DirUse is similar to DU used by UNIX.

DirUse Topic

  • DirUse Syntax

File Required

  • Diruse.exe


DirUse Syntax

One Step diruse {/s | /v} {/m | /k | /b} [/c] [/,] [/q:# [/l] [/a] [/d] [/o]] [/*] dirs

Where:

/s

includes subfolders of the specified folders in the output.

/v

outputs progress reports while scanning subfolders. Ignored if /s is specified.

/m

displays disk usage in megabytes.

/k

displays disk usage in kilobytes.

/b

displays disk usage in bytes (default).

/c

uses compressed file size instead of apparent file size.

/,

displays the thousands separator (comma or period) in file sizes.

/q:#

marks folders that exceed the specified size (#) with an EXCLAMATION POINT (!). If /m (megabytes) or /k (kilobytes) is not specified, then the size is assumed to be in bytes.

If /q is specified, then the return code is ONE if any folders are found that exceed the specified sizes. Otherwise the return code is ZERO.

/l

outputs overflows to logfile DIRUSE.LOG in the current folder.

/a

specifies that an alert is generated if sizes specified by /q:# are exceeded. The Alerter service must be running, and the alert appears only when you are using DirUse.

/d

displays only folders that exceed specified sizes.

/o

specifies that subfolders are not checked to see if they exceed the specified size.

/*

uses the top-level folders residing in the specified dirs.

dirs

specifies a list of paths to check. dirs is required.

diruse with no parameters or with any unrecognized parameter displays command-line help.

Parameters can be typed in any order. You can use the DASH (-) character rather than the FORWARDSLASH (/)character. For example:

diruse -s -m -q:1.5 -l -* c:\users


Diskmap.exe

This command-line tool produces a detailed report on the configuration of the hard disk that you specify. It provides information from the registry about disk characteristics and geometry, and reads and displays data about all of the partitions and logical drives defined on the disk.

A good way to use this tool is to run it for each disk in your computer, print out the configuration report for each disk, and save the hard copy with the other configuration information that you maintain for your computer. In case of some kinds of disk problems, this information can then be used to reconstruct the hard disk structure.

DiskMap Limitations: No Dynamic Disk Support

DiskMap does not support all the disk-based features found in Windows 2000.

Windows 2000 offers two types of disk configurations: basic disk and dynamic disk. The basic disk configuration uses the same disk structures found on all versions of Windows NT, using primary partitions and logical volumes within extended partitions as containers of data. All disks are initially configured as basic disks. DiskMap fully supports basic disks.

Dynamic disk is new to Windows 2000. It uses a disk management database located at the end of the disk to manage the structure of disk volumes. Each physical disk has to be upgraded to use dynamic disk.

DiskMap cannot read the disk-management database. It gathers its disk data from reading the partition table and any extended partition tables that may exist. Users who upgrade their disks to dynamic disk might not be able to use DiskMap to get an accurate portrayal of the structures on those disks.

Any partition structures that existed before disks are upgraded to dynamic disk are retained in the partition table. DiskMap is able to read and display this data. However, once dynamic disk is installed, users can add as many new volumes as space allows without the limits imposed by the partition table, and volumes can be easily extended and spanned beyond their initial configuration. None of these types of additions or changes are recorded in the partition table on dynamic disks, which inhibits DiskMap's ability to recognize new volumes, locate boot sectors, and identify the start and end sectors of individual volumes. For more information about basic and dynamic disks, refer to the Windows 2000 Professional Resource Kit or Server Operations Guide of the Windows 2000 Server Resource Kit.

DiskMap Topic

  • DiskMap Syntax

File Required

  • Diskmap.exe


DiskMap Syntax

One Step diskmap /d drive# [/h]

Where:

/d drive#
specifies the number of the physical disk to map.
/h
specifies that the report should be generated with hexadecimal output. The default is decimal output.
Some fields are always decimal or always hexadecimal regardless of whether or not /h is specified:
Always hexadecimal | Always decimal
Signature | The megabyte (MB) portion of the DiskSize field
System | Partition Number

Notes

  • The Partition Number field is a cumulative listing of all volumes on the disk, including all partitions (primary and extended) as well as all logical volumes contained within any existing extended partitions. While a disk may contain no more than four partitions, there can be as many logical volumes as there are letters in the alphabet, minus the reserved drive letters A through C.
  • DiskMap will not run from an MS-DOS prompt.


Diskuse.exe

DiskUse is a command-line tool that scans directories on a hard disk and reports on space used by each user.

This tool can scan a single directory, a directory tree, or an entire drive and can extract information on one user or all users. Reports can be displayed on-screen or output to a file, in table or text format. DiskUse can also list all the files owned by a user or users, filtered in a variety of ways.

Diskuse.exe Topics

  • Diskuse Syntax

File Required

  • Diskuse.exe


Dmdiag.exe: Disk Manager Diagnostics

Dmdiag.exe: Disk Manager Diagnostics NEW

Disk Manager Diagnostics is a command-line tool that outputs system state and configuration information describing disk storage.

DmDiag displays the following information for a computer:
  • Computer name and operating system version
  • Physical disk to disk type
  • Mount points
  • LDM file versions
  • Drive letter usage, GetLogicalDrives(), GetDriveType()
  • \Device
  • Symbolic links
  • ldmsize
  • Kernel list
  • Disk partition information

DmDiag Topics

  • DmDiag Syntax
  • DmDiag Examples

File Required

  • Dmdiag.exe


DmDiag Syntax

One Step dmdiag

There are no switches for this tool.


DmDiag Examples

  • Save disk configuration information to a file named DiskConf.out:
    dmdiag > DiskConf.out
  • Display disk configuration information:
    dmdiag
    ---------- Computer name and OS version ----------

  Computer name: IMACOMPUTER
       NT build: 2154

---------- Drive letter to device name, QueryDosDevice() ----------

              D: \Device\HarddiskVolume2
              E: \Device\HarddiskVolume3
              F: \Device\CdRom0
              G: \Device\HarddiskVolume4
              A: \Device\Floppy0
              C: \Device\HarddiskVolume1

---------- Physical Disk to disk type ----------

  PhysicalDrive0 \Device\Harddisk0\DR0 (Signature 3137382d) Basic Disk

---------- Mount Points ----------

    \\?\Volume{927d670b-69d2-11d2-805b-000000000000}\
        C:\

    \\?\Volume{927d670c-69d2-11d2-805b-000000000000}\
        D:\

    \\?\Volume{927d670d-69d2-11d2-805b-000000000000}\
        E:\

    \\?\Volume{8bb65abe-566f-11d3-80f0-806d6172696f}\
        G:\

    \\?\Volume{54c0c117-dd07-11d2-9795-806d6172696f}\
        F:\

    \\?\Volume{54c0c116-dd07-11d2-9795-806d6172696f}\
        A:\

---------- LDM File Versions ----------

              2152.1.290.1 shp - G:\WINNT\System32\dmadmin.exe
              2152.1.290.1 shp - G:\WINNT\System32\dmconfig.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmdlgs.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmdskmgr.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmdskres.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmintf.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmremote.exe
              2152.1.290.1 shp - G:\WINNT\System32\dmserver.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmutil.dll
              2152.1.290.1 shp - G:\WINNT\System32\dmview.ocx
              2152.1.290.1 shp - G:\WINNT\System32\drivers\dmboot.sys
              2152.1.290.1 shp - G:\WINNT\System32\drivers\dmio.sys
              2152.1.290.1 shp - G:\WINNT\System32\drivers\dmload.sys

---------- Drive letter usage, GetLogicalDrives(), GetDriveType() ----------

              A: Removable disk
              C: Fixed disk
              D: Fixed disk
              E: Fixed disk
              F: CD-ROM
              G: Fixed disk

---------- dosdev ----------

A: = \Device\Floppy0 [Removable]
C: = \Device\HarddiskVolume1 [Fixed]
D: = \Device\HarddiskVolume2 [Fixed]
E: = \Device\HarddiskVolume3 [Fixed]
F: = \Device\CdRom0 [CDRom]
G: = \Device\HarddiskVolume4 [Fixed]

---------- \Device\Harddisk0 ----------

\Device\Harddisk0\DP(1)0x7e00-0x7ff50c00+1 (Device)
\Device\Harddisk0\DP(2)0x7ff60800-0x7ff50c00+2 (Device)
\Device\Harddisk0\DP(3)0xffeb9200-0x7ff50c00+3 (Device)
\Device\Harddisk0\DP(4)0x17fe11c00-0x75a96200+4 (Device)
\Device\Harddisk0\DR0            (Device)
\Device\Harddisk0\Partition0     (SymbolicLink) -> \Device\Harddisk0\DR0
\Device\Harddisk0\Partition1     (SymbolicLink) -> \Device\HarddiskVolume1
\Device\Harddisk0\Partition2     (SymbolicLink) -> \Device\HarddiskVolume2
\Device\Harddisk0\Partition3     (SymbolicLink) -> \Device\HarddiskVolume3
\Device\Harddisk0\Partition4     (SymbolicLink) -> \Device\HarddiskVolume4

---------- \Device ----------

\Device\00000001                 (Device)
\Device\00000002                 (Device)
\Device\00000003                 (Device)
\Device\00011f                   (Device)
\Device\00021f                   (Device)
\Device\00031f                   (Device)
\Device\00041f                   (Device)
\Device\000520                   (Device)
\Device\000620                   (Device)
\Device\000720                   (Device)
\Device\000821                   (Device)
\Device\000922                   (Device)
\Device\001022                   (Device)
\Device\001122                   (Device)
\Device\001223                   (Device)
\Device\001323                   (Device)
\Device\001423                   (Device)
\Device\001523                   (Device)
\Device\001624                   (Device)
\Device\001724                   (Device)
\Device\001825                   (Device)
\Device\001925                   (Device)
\Device\002025                   (Device)
\Device\002125                   (Device)
\Device\002227                   (Device)
\Device\002327                   (Device)
\Device\002427                   (Device)
\Device\002527                   (Device)
\Device\002628                   (Device)
\Device\002728                   (Device)
\Device\002828                   (Device)
\Device\002928                   (Device)
\Device\003029                   (Device)
\Device\003129                   (Device)
\Device\003229                   (Device)
\Device\003329                   (Device)
\Device\003429                   (Device)
\Device\003529                   (Device)
\Device\003629                   (Device)
\Device\00372a                   (Device)
\Device\00382a                   (Device)
\Device\00392a                   (Device)
\Device\00402a                   (Device)
\Device\004132                   (Device)
\Device\004233                   (Device)
\Device\004333                   (Device)
\Device\004433                   (Device)
\Device\004533                   (Device)
\Device\004633                   (Device)
\Device\004733                   (Device)
\Device\004833                   (Device)
\Device\004933                   (Device)
\Device\005034                   (Device)
\Device\005134                   (Device)
\Device\005234                   (Device)
\Device\005334                   (Device)
\Device\005434                   (Device)
\Device\005534                   (Device)
\Device\Afd                      (Device)
\Device\Beep                     (Device)
\Device\CdRom0                   (Device)
\Device\ChangeEventCdRom0        (Event)
\Device\DmControl                (Directory)
\Device\DmLoader                 (Device)
\Device\Floppy0                  (Device)
\Device\FloppyPDO0               (Device)
\Device\FsWrap                   (Device)
\Device\FtControl                (Device)
\Device\Gpc                      (Device)
\Device\Hal Pci 0                (Device)
\Device\Harddisk0                (Directory)
\Device\HarddiskDmVolumes        (Directory)
\Device\HarddiskVolume1          (Device)
\Device\HarddiskVolume2          (Device)
\Device\HarddiskVolume3          (Device)
\Device\HarddiskVolume4          (Device)
\Device\HCD0                     (Device)
\Device\Ide                      (Directory)
\Device\INO_Fltr                 (Device)
\Device\Ip                       (Device)
\Device\IPMULTICAST              (Device)
\Device\IPSEC                    (Device)
\Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF (Device)
\Device\ISAPNP_CSC6835_DEV0001_FFFFFFFF (Device)
\Device\ISAPNP_CSC6835_DEV0002_FFFFFFFF (Device)
\Device\KeyboardClass0           (Device)
\Device\KsecDD                   (Device)
\Device\KSENUM#00000001          (Device)
\Device\KSENUM#00000002          (Device)
\Device\KSENUM#0000004d          (Device)
\Device\LanmanDatagramReceiver   (Device)
\Device\LanmanRedirector         (Device)
\Device\LanmanServer             (Device)
\Device\Mailslot                 (Device)
\Device\MountPointManager        (Device)
\Device\Mup                      (Device)
\Device\NamedPipe                (Device)
\Device\Ndis                     (Device)
\Device\NdisTapi                 (Device)
\Device\NdisWan                  (Device)
\Device\NdisWanIp                (Device)
\Device\NDProxy                  (Device)
\Device\Netbios                  (Device)
\Device\NetbiosSmb               (Device)
\Device\NetBT_Tcpip_{8DF1FF1F-FBC8-4ABB-B154-26D835858B69} (Device)
\Device\NetBt_Wins_Export        (Device)
\Device\NTPNP_PCI0000            (Device)
\Device\NTPNP_PCI0001            (Device)
\Device\NTPNP_PCI0002            (Device)
\Device\NTPNP_PCI0003            (Device)
\Device\NTPNP_PCI0004            (Device)
\Device\NTPNP_PCI0005            (Device)
\Device\NTPNP_PCI0006            (Device)
\Device\NTPNP_PCI0007            (Device)
\Device\NTPNP_PCI0008            (Device)
\Device\NTPNP_PCI0009            (Device)
\Device\Null                     (Device)
\Device\Parallel0                (Device)
\Device\ParallelPort0            (Device)
\Device\ParallelVdm0             (Device)
\Device\ParTechInc0              (Device)
\Device\ParTechInc1              (Device)
\Device\ParTechInc2              (Device)
\Device\PhysicalMemory           (Section)
\Device\PointerClass0            (Device)
\Device\Processor                (Device)
\Device\RasAcd                   (Device)
\Device\RawCdRom                 (Device)
\Device\RawDisk                  (Device)
\Device\RawIp                    (Device)
\Device\RawTape                  (Device)
\Device\ReadDataPort_0           (Device)
\Device\Scsi                     (Directory)
\Device\ScsiPort0                (SymbolicLink) -> \Device\Scsi\aic78xx1
\Device\ScsiPort1                (SymbolicLink) -> \Device\Scsi\aic78u21
\Device\Serial0                  (Device)
\Device\Serial1                  (Device)
\Device\Spud                     (Device)
\Device\sysaudio                 (Device)
\Device\Tcp                      (Device)
\Device\Udp                      (Device)
\Device\USBPDO-0                 (Device)
\Device\Video0                   (Device)
\Device\Video1                   (Device)
\Device\Video2                   (Device)
\Device\VideoPdo0                (Device)
\Device\VolumesSafeForWriteAccess (Event)
\Device\WANARP                   (Device)
\Device\WinDfs                   (Directory)
\Device\WMIDataDevice            (Device)
\Device\WMIServiceDevice         (Device)
\Device\{5AAF27E9-C446-42DF-B037-8EA58A8DE51E} (Device)
\Device\{8DF1FF1F-FBC8-4ABB-B154-26D835858B69} (Device)
\Device\{D5537CCD-EB42-4633-A85F-EFF0B9DA57EC} (Device)
\Device\{E55B60D6-4FB8-44F5-806F-EE3E593D0B63} (Device)

---------- \?? ----------

\??\$VDMLPT1                     (SymbolicLink) -> \Device\ParallelVdm0
\??\A:                           (SymbolicLink) -> \Device\Floppy0
\??\AUX                          (SymbolicLink) -> \DosDevices\COM1
\??\C:                           (SymbolicLink) -> \Device\HarddiskVolume1
\??\CdRom0                       (SymbolicLink) -> \Device\CdRom0
\??\COM1                         (SymbolicLink) -> \Device\Serial0
\??\COM2                         (SymbolicLink) -> \Device\Serial1
\??\D:                           (SymbolicLink) -> \Device\HarddiskVolume2
\??\DISPLAY1                     (SymbolicLink) -> \Device\Video0
\??\DISPLAY2                     (SymbolicLink) -> \Device\Video1
\??\DISPLAY3                     (SymbolicLink) -> \Device\Video2
\??\DmConfig                     (SymbolicLink) -> \Device\DmControl\DmConfig
\??\DmInfo                       (SymbolicLink) -> \Device\DmControl\DmInfo
\??\DmIoDaemon                   (SymbolicLink) -> \Device\DmControl\DmIoDaemon
\??\DmLoader                     (SymbolicLink) -> \Device\DmLoader
\??\DmTrace                      (SymbolicLink) -> \Device\DmControl\DmTrace
\??\E:                           (SymbolicLink) -> \Device\HarddiskVolume3
\??\F:                           (SymbolicLink) -> \Device\CdRom0
\??\FDC#GENERIC_FLOPPY_DRIVE#1&3a2146f1&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\FloppyPDO0
\??\fsWrap                       (SymbolicLink) -> \Device\FsWrap
\??\FtControl                    (SymbolicLink) -> \Device\FtControl
\??\G:                           (SymbolicLink) -> \Device\HarddiskVolume4
\??\Global                       (SymbolicLink) -> \??
\??\GLOBALROOT                   (SymbolicLink) ->
\??\HCD0                         (SymbolicLink) -> \Device\HCD0
\??\INO-FILTER                   (SymbolicLink) -> \Device\INO_Fltr
\??\INOFL-FILTER                 (SymbolicLink) -> \FileSystem\INO_FLPYFs
\??\Ip                           (SymbolicLink) -> \Device\Ip
\??\IPMULTICAST                  (SymbolicLink) -> \Device\IPMULTICAST
\??\IPSECDev                     (SymbolicLink) -> \Device\IPSEC
\??\ISAPNP#CSC6835_DEV0000#FFFFFFFF#{65e8773d-8f56-11d0-a3b9-00a0c9223196} (SymbolicLink) -> \Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF
\??\ISAPNP#CSC6835_DEV0000#FFFFFFFF#{65e8773e-8f56-11d0-a3b9-00a0c9223196} (SymbolicLink) -> \Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF
\??\ISAPNP#CSC6835_DEV0000#FFFFFFFF#{6994ad04-93ef-11d0-a3cc-00a0c9223196} (SymbolicLink) -> \Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF
\??\ISAPNP#CSC6835_DEV0000#FFFFFFFF#{dda54a40-1e4c-11d1-a050-405705c10000} (SymbolicLink) -> \Device\ISAPNP_CSC6835_DEV0000_FFFFFFFF
\??\LPT1                         (SymbolicLink) -> \Device\Parallel0
\??\MAILSLOT                     (SymbolicLink) -> \Device\MailSlot
\??\MountPointManager            (SymbolicLink) -> \Device\MountPointManager
\??\NDIS                         (SymbolicLink) -> \Device\Ndis
\??\NDISTAPI                     (SymbolicLink) -> \Device\NdisTapi
\??\NdisWan                      (SymbolicLink) -> \Device\NdisWan
\??\NDISWANIP                    (SymbolicLink) -> \Device\NdisWanIp
\??\NDPROXY                      (SymbolicLink) -> \Device\NDProxy
\??\NUL                          (SymbolicLink) -> \Device\Null
\??\PCI#VEN_10B7&DEV_9055&SUBSYS_00801028&REV_00#2&ebb567f&0&88#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\NTPNP_PCI0005
\??\PCI#VEN_9004&DEV_8078&SUBSYS_78809004&REV_01#3&c4cf9f2&0&7098#{2accfe60-c130-11d2-b082-00a0c91efb8b} (SymbolicLink) -> \Device\NTPNP_PCI0009
\??\PCI#VEN_9005&DEV_001F&SUBSYS_00801028&REV_00#3&c4cf9f2&0&5098#{2accfe60-c130-11d2-b082-00a0c91efb8b} (SymbolicLink) -> \Device\NTPNP_PCI0008
\??\PhysicalDrive0               (SymbolicLink) -> \Device\Harddisk0\DR0
\??\PIPE                         (SymbolicLink) -> \Device\NamedPipe
\??\PRN                          (SymbolicLink) -> \DosDevices\LPT1
\??\PTILINK1                     (SymbolicLink) -> \Device\ParTechInc0
\??\PTILINK2                     (SymbolicLink) -> \Device\ParTechInc1
\??\PTILINK3                     (SymbolicLink) -> \Device\ParTechInc2
\??\Root#*PNP030b#1_0_22_0_32_0#{884b96c3-56ef-11d1-bc8c-00a0c91405dd} (SymbolicLink) -> \Device\004533
\??\Root#*PNP0401#PnPBIOS_3#{97f76ef0-f883-11d0-af1f-0000f800845c} (SymbolicLink) -> \Device\004633
\??\Root#*PNP0501#PnPBIOS_1#{4d36e978-e325-11ce-bfc1-08002be10318} (SymbolicLink) -> \Device\004733
\??\Root#*PNP0501#PnPBIOS_1#{86e0d1e0-8089-11d0-9ce4-08003e301f73} (SymbolicLink) -> \Device\004733
\??\Root#*PNP0501#PnPBIOS_2#{4d36e978-e325-11ce-bfc1-08002be10318} (SymbolicLink) -> \Device\004833
\??\Root#*PNP0501#PnPBIOS_2#{86e0d1e0-8089-11d0-9ce4-08003e301f73} (SymbolicLink) -> \Device\004833
\??\Root#*PNP0F03#1_0_21_0_31_0#{378de44c-56ef-11d1-bc8c-00a0c91405dd} (SymbolicLink) -> \Device\005534
\??\Root#dmio#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\00011f
\??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\00021f
\??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\003329
\??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\003429
\??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\003529
\??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\003629
\??\Root#SYSTEM#0000#{085aff00-62ce-11cf-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{65e8773e-8f56-11d0-a3b9-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000} (SymbolicLink) -> \Device\00392a
\??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196} (SymbolicLink) -> \Device\00392a
\??\SCSI#CdRom&Ven_NEC&Prod_CD-ROM_DRIVE:464&Rev_1.05#4&12aa9cc4&0&050#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\Scsi\aic78xx1Port0Path0Target5Lun0
\??\SCSI#CdRom&Ven_NEC&Prod_CD-ROM_DRIVE:464&Rev_1.05#4&12aa9cc4&0&050#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\Scsi\aic78xx1Port0Path0Target5Lun0
\??\SCSI#Disk&Ven_QUANTUM&Prod_VIKING_II_9.1WLS&Rev_3506#4&212b3f19&0&000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\Scsi\aic78u21Port1Path0Target0Lun0
\??\Scsi0:                       (SymbolicLink) -> \Device\Scsi\aic78xx1
\??\Scsi1:                       (SymbolicLink) -> \Device\Scsi\aic78u21
\??\Shadow                       (SymbolicLink) -> \Device\LanmanRedirector
\??\STORAGE#Volume#1&30a96598&0&Signature3137382DOffset17FE11C00Length75A96200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\HarddiskVolume4
\??\STORAGE#Volume#1&30a96598&0&Signature3137382DOffset7E00Length7FF50C00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\HarddiskVolume1
\??\STORAGE#Volume#1&30a96598&0&Signature3137382DOffset7FF60800Length7FF50C00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\HarddiskVolume2
\??\STORAGE#Volume#1&30a96598&0&Signature3137382DOffsetFFEB9200Length7FF50C00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} (SymbolicLink) -> \Device\HarddiskVolume3
\??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c5066e-72c1-11d2-9755-0000f8004788} (SymbolicLink) -> \Device\KSENUM#00000002
\??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50671-72c1-11d2-9755-0000f8004788} (SymbolicLink) -> \Device\KSENUM#00000002
\??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50674-72c1-11d2-9755-0000f8004788} (SymbolicLink) -> \Device\KSENUM#00000002
\??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{fbf6f530-07b9-11d2-a71e-0000f8004788} (SymbolicLink) -> \Device\KSENUM#00000002
\??\sysaudio                     (SymbolicLink) -> \Device\sysaudio
\??\UNC                          (SymbolicLink) -> \Device\Mup
\??\USB#ROOT_HUB#3&32c8bd93&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} (SymbolicLink) -> \Device\USBPDO-0
\??\Volume{54c0c116-dd07-11d2-9795-806d6172696f} (SymbolicLink) -> \Device\Floppy0
\??\Volume{54c0c117-dd07-11d2-9795-806d6172696f} (SymbolicLink) -> \Device\CdRom0
\??\Volume{8bb65abe-566f-11d3-80f0-806d6172696f} (SymbolicLink) -> \Device\HarddiskVolume4
\??\Volume{927d670b-69d2-11d2-805b-000000000000} (SymbolicLink) -> \Device\HarddiskVolume1
\??\Volume{927d670c-69d2-11d2-805b-000000000000} (SymbolicLink) -> \Device\HarddiskVolume2
\??\Volume{927d670d-69d2-11d2-805b-000000000000} (SymbolicLink) -> \Device\HarddiskVolume3
\??\WanArp                       (SymbolicLink) -> \Device\WANARP
\??\WMIDataDevice                (SymbolicLink) -> \Device\WMIDataDevice
\??\WMIServiceDevice             (SymbolicLink) -> \Device\WMIServiceDevice
\??\{5AAF27E9-C446-42DF-B037-8EA58A8DE51E} (SymbolicLink) -> \Device\{5AAF27E9-C446-42DF-B037-8EA58A8DE51E}
\??\{8DF1FF1F-FBC8-4ABB-B154-26D835858B69} (SymbolicLink) -> \Device\{8DF1FF1F-FBC8-4ABB-B154-26D835858B69}
\??\{D5537CCD-EB42-4633-A85F-EFF0B9DA57EC} (SymbolicLink) -> \Device\{D5537CCD-EB42-4633-A85F-EFF0B9DA57EC}
\??\{E55B60D6-4FB8-44F5-806F-EE3E593D0B63} (SymbolicLink) -> \Device\{E55B60D6-4FB8-44F5-806F-EE3E593D0B63}

---------- ldmsize 0 ----------

           1,110 Cylinders
             255 Tracks/Cylinder
              63 Sectors/Track
             512 Bytes/Sector
              12 MediaType
      17,832,150 Sectors (total)
   9,130,060,800 Bytes (total)
       8,916,075 KB
           8,707 MB
             8.5 GB

               0 StartingOffset
   9,132,374,016 PartitionLength
               0 HiddenSectors
               0 PartitionNumber
               0 PartitionType
               0 BootIndicator
               0 RecognizedPartition
               0 RewritePartition

              16 PartitionCount
        3137382d Signature

        Starting        Partition     Hidden       Total  Partition    Partition       Boot Recognized    Rewrite
  Offset (bytes)   Length (bytes)    Sectors     Sectors     Number   Type (HEX)  Indicator  Partition  Partition

          32,256    2,146,765,824         63   4,192,902          0         0x07          1          1          0
   2,146,798,080    6,267,663,360  4,192,965  12,241,530          1         0x05          0          0          0
               0                0          0           0          2         0x00          0          0          0
               0                0          0           0          3         0x00          0          0          0
   2,146,830,336    2,146,765,824         63   4,192,902          4         0x07          0          1          0
   4,293,596,160    2,146,798,080  4,192,965   4,192,965          5         0x05          0          0          0
               0                0          0           0          6         0x00          0          0          0
               0                0          0           0          7         0x00          0          0          0
   4,293,628,416    2,146,765,824         63   4,192,902          8         0x07          0          1          0
   6,440,394,240    1,974,067,200  8,385,930   3,855,600          9         0x05          0          0          0
               0                0          0           0         10         0x00          0          0          0
               0                0          0           0         11         0x00          0          0          0
   6,440,426,496    1,974,034,944         63   3,855,537         12         0x07          0          1          0
               0                0          0           0         13         0x00          0          0          0
               0                0          0           0         14         0x00          0          0          0
               0                0          0           0         15         0x00          0          0          0

   9,130,060,800 Bytes (17832150 sectors) Geometric size
   9,132,374,016 Bytes (17836668 sectors) True size (measured)
   9,132,374,016 Bytes (17836668 sectors) Reported size (Partition0)
               0 Bytes (       0 sectors) missing/wasted

---------- kernel list ----------

Basic-info: version=21 maxspecio=512 maxio=512 maxkio=2048
Ktrans-state: dg=0.0 pendtid=0.0 state=UNKNOWN
#
# Kmem-regions:
#
id 0: (size=100)
id 1: (size=0)
#
# Disks: (cnt: 1)
#
Disk Harddisk0: dm= dgiid=0.0 darid=0.1026 dmrid=0.0
  kflag=()
  sflag=()
  vflag=(autoconfig|offline)
  publen=9223372036854775807 privlen=9223372036854775807 maxiosize=64
  type=ntdisk info=
#
# Devices: (cnt: 0)
#
#
# Groups: (cnt: 1)
#
Group NULLDG: iid=0.0 id=
  diskset=00000000-0000-0000-0000-000000000000
  configtid=0.0 logsize=0
  kflag=()
  vflag=(created|notempdb|noautoreimport|secondary)
# Group-Objects: (cnt: 0)
# End-group: NULLDG

---------- query -ht ----------

---------- query -l ----------

---------- disk header Harddisk0 ----------

dmdiag: ERROR: scan operation failed:
    Format error in disk private region

---------- disk config Harddisk0 ----------

dmdiag: ERROR: scan operation failed:
    Format error in disk private region

---------- disk klog Harddisk0 ----------

dmdiag: ERROR: scan operation failed:
    Format error in disk private region

---------- disk partitions Harddisk0 ----------

Device:     Harddisk0
Size:       17836668 blocks 8709.31 Megabytes
Parameters: Signature=825702445 mediatype=12
Geometry:   geometry=1110/255/63 sectorsize=512 endingblocks=4518
 Partition1: Type=7 Extent=63,4192902 Hidden=63 Flags=boot,recognized
 Extended:   Type=5 Extent=4192965,12241530 Hidden=4192965 Flags=
 Partition2: Type=7 Extent=4193028,4192902 Hidden=63 Flags=recognized
 Extended:   Type=5 Extent=8385930,4192965 Hidden=4192965 Flags=
 Partition3: Type=7 Extent=8385993,4192902 Hidden=63 Flags=recognized
 Extended:   Type=5 Extent=12578895,3855600 Hidden=8385930 Flags=
 Partition4: Type=7 Extent=12578958,3855537 Hidden=63 Flags=recognized


Dumpcfg.exe: Dump Config

Dumpcfg.exe: Dump Config NEW

This command-line tool simplifies the manual system recovery process associated with storage configuration. You must a member of the Administrator group to run this tool.

Use Dump Config to:
  • display system, disk and volume information
  • change your disk signature

Windows disk devices are partitioned. These partitions can be used directly as logical devices, subdivided further into smaller logical devices, or combined into larger, multi-disk logical devices called volume sets. Normally, access to a logical device requires that a drive letter be assigned and the device be formatted with a file system, although there are techniques for accessing Windows devices as "raw" devices using either drive letters or a physical drive designation.

Windows keeps track of which disk is which based on a unique 4-byte disk signature that is recorded in the Master Boot Record (MBR) of each disk at offset 0x1B8. DumpConfig can be used to modify this value. This signature is generated by the Disk Administrator when it initializes if the disk does not already have a non-zero value in this field. This technique does not rely on knowledge of physical properties that might change such as SCSI ID or which adapter a disk is connected to. Therefore, disk hardware connections may be changed without upsetting existing software fault tolerance.

The advantage of using the signature to identify a disk is that even when the physical disk configuration is changed, Windows can still correctly identify volume sets and assign drive letters to their original devices. When a disk that already has a valid signature appears on a Windows system, Disk Administrator will not write a new signature, but will record the signature in the DISK key.

Duplicate signatures are not allowed. This can create problems when making copies a disk at the track level, which occurs with some breakable mirror and disaster protection software, if the disk copy (which also has a copy of the signature) is visible from the same system as the original disk. When Disk Administrator detects a duplicate signature, it will ask permission to write a new signature to the offending disk. If permission is denied, it will make the disk unavailable. You can use DumpConfig to change the disk signature, making the disk readable again.

note-icon

Note

The disk can still be accessed by programs using physical drive address semantics.

Dump Config Topics

  • Dump Config Syntax
  • Dump Config Examples

File Required

  • Dumpcfg.exe


Dump Config Syntax

One Step dumpcfg [-s new_signature_in_hex_format disk_device_number] [-?]

Where:

(without arguments)
displays system, disk and volume information. See example.
s new_signature_in_HEX_format disk_device_number
changes the disk signature.
Example: Change signature for disk #1 to 17AB26CD:
dumpcfg -s17AB26CD 1
-?
displays command help.


Dump Config Examples

Change signature for disk #1 to 17AB26CD:

C:\>dumpcfg -S17AB26CD 1

List system information:

C:\>dumpcfg

[System Information]

Computer Name: IMACOMPUTER
Cluster name (DNS): IMACOMPUTER.microsoft.com
Cluster name (NetBIOS): IMACOMPUTER
System Root (install directory): E:\WINNT
OS: Windows 2000 Professional
Service Pack:
Product:

[DISKS]

Disk Number: 0
Signature: 3137382D

[Volumes]

Volume #1:
Volume name: \\?\Volume{89eb60a6-3df5-11d3-b7d0-806d6172696f}\
Drive letter: C:
Volume Label:
File System: NTFS
Boot\Boot.ini\System Volume: BOOT  BOOT.INI  SYSTEM
Volume Type: Simple Volume \ Logical Drive
Number of members: 1
Member #1: Partition - Disk: 0,   StartingOffset: 32256 bytes,   Length: 2047 MB

Volume #2:
Volume name: \\?\Volume{89eb60a7-3df5-11d3-b7d0-806d6172696f}\
Drive letter: D:
Volume Label:
File System: NTFS
Boot\Boot.ini\System Volume: BOOT  SYSTEM
Volume Type: Simple Volume \ Logical Drive
Number of members: 1
Member #1: Partition - Disk: 0,   StartingOffset: 2146830336 bytes,   Length: 2047 MB

Volume #3:
Volume name: \\?\Volume{89eb60a8-3df5-11d3-b7d0-806d6172696f}\
Drive letter: E:
Volume Label:
File System: NTFS
Boot\Boot.ini\System Volume: BOOT  SYSTEM
Volume Type: Simple Volume \ Logical Drive
Number of members: 1
Member #1: Partition - Disk: 0,   StartingOffset: 4293628416 bytes,   Length: 2047 MB

Volume #4:
Volume name: \\?\Volume{fe645520-571e-11d3-9e84-806d6172696f}\
Drive letter: G:
Volume Label:
File System: NTFS
Boot\Boot.ini\System Volume: BOOT  SYSTEM
Volume Type: Simple Volume \ Logical Drive
Number of members: 1
Member #1: Partition - Disk: 0,   StartingOffset: 6440426496 bytes,   Length: 1882 MB
dir


Dupfinder.exe: Duplicate File Finder

Dupfinder.exe: Duplicate File Finder NEW

Duplicate File Finder is a GUI-based tool which locates duplicate files for deletion or renaming.

Dupfinder also lists size, modification date, version, CRC-32 and language information for files.

File Required

  • Dupfinder.exe


Expand.exe: File Expansion Utility

Expand.exe: File Expansion Utility NEW

This command-line tool enables you to expand files that have been compressed by Compress.exe: File Compression Utility. Expand can also extract compressed files from a cabinet (.cab) file. Microsoft® Windows® 2000 includes Driver.cab, which contains thousands of files, and users can use this tool to expand one or a few from this cabinet for system recovery.

Expand Syntax

One Step expand [-r] Source Destination [-?]

-Or-

One Step expand -r Source [f:Files] [Destination] [-?]

-Or-

One Step expand -d Source.cab [-f:Files] [-?]

-Or-

One Step expand Source.cab -f:Files Destination [-?]

Where:

-r
renames compressed files.
-d
displays list of files in source.
Source
specifies the source file. The * and ? wildcard characters can be used.
f:Files
lists names of files to expand from a .cab. Use f:* to expand all files from a .cab.
Destination
specifies the destination file or path. The destination can be a folder. If source contains multiple files and -r is not specified, then destination must be a folder.
-?
shows command-line help.

Files Required

  • Expand.exe


Extract.exe: Extract Cabinet

Extract.exe: Extract Cabinet NEW

This command-line tool extracts individual files from compressed cabinet (.cab) files. Using cabinet files is a highly efficient method of compression and distribution that has been used by Microsoft for many years. It is now available to anyone who needs to compress and distribute multiple files.

The cabinet file format is a non-proprietary format based on Lempel-Ziv compression. At the heart of this format is the MakeCAB compression tool, a loss-less data compression tool included with Windows 2000 that provides efficient compression for setup programs and Internet applications alike. With MakeCAB, you can store multiple files in a single cabinet file and carry compression across files.

Note

Windows 2000, and Windows 98 with Microsoft Internet Explorer version 4 and later enable you to view and extract files from .cab files with Windows Explorer. Extract, though, is still useful for working with .cab files from the command line.

Extract Topics

  • Extract Syntax
  • Extract Examples

Files Required

  • Extract.exe


Extract Syntax

One Step extract cabinet [filename ...] [/a] [{/d | /e}] [/l dir] [/y]

- or -

One Step extract source {[newname] | destination /c} [/y]

Where:

cabinet
is the name of a cabinet file (containing two or more files).
filename
is the name of the file to extract from the cabinet. Wildcard characters and multiple file names (separated by blanks) may be used.
source
is the name of a compressed file (a cabinet with only one file).
newname
is a new file name to give the file extracted from source. If not supplied, the original name is used.
destination
is the path to which to copy source. If not supplied, the original name is used. Used only with the /c switch.
/a
processes all cabinets. Follows cabinet chain starting in first cabinet mentioned.
/c
copies the source file to the path destination (can be used for copying from DMF disks).
/d
displays the directory of the cabinet file (use with the cabinet file name to avoid extracting the files).
/e
extracts all files from cabinet (use instead of *.* to extract all files).
/l dir
extracts files to the location dir (default is current directory).
/y
does not prompt before overwriting an existing file.


Extract Examples

Displaying the Contents of a .cab File

C:\Cconnect\Client>extract cconnect.cab /d

Microsoft (R) Cabinet Extraction Tool - Version 5.00.2090.1
Copyright (C) Microsoft Corp. 1981-1999.

 Cabinet cconnect.cab

08-17-1999  6:04:48p A---       118,784 CConnect.exe
06-27-1999  8:00:00p A---     1,384,448 msvbvm60.dll
06-27-1999  8:00:00p A---       606,480 oleaut32.dll
06-27-1999  8:00:00p A---       164,112 olepro32.dll
06-27-1999  8:00:00p A---       147,728 asycfilt.dll
06-27-1999  8:00:00p A---        16,896 stdole2.tlb
05-31-1998 12:00:00a A---        22,288 COMCAT.DLL
06-27-1999  8:00:00p A---        73,776 wshom.ocx
06-27-1999  8:00:00p A---        61,491 wbemdisp.tlb
03-26-1999 12:00:00a A---       118,784 MSSTDFMT.DLL
03-26-1999 12:00:00a A---       249,856 SETUP1.EXE
03-26-1999 12:00:00a A---       101,888 VB6STKIT.DLL
03-26-1999 12:00:00a A---        73,216 ST6UNST.EXE
                13 Files      3,139,747 bytes

Moving a .cab File to Another Folder

C:\Cconnect\Client>extract cconnect.cab c:\cconnect /c

Microsoft (R) Cabinet Extraction Tool - Version 5.00.2090.1
Copyright (C) Microsoft Corp. 1981-1999.
Extracting cconnect.cab -> c:\cconnect\cconnect.cab

Extracting the Contents of a .cab to Another Folder

C:\Cconnect\Client>extract cconnect.cab /e /l c:\cconnect\temp

Microsoft (R) Cabinet Extraction Tool - Version 5.00.2090.1
Copyright (C) Microsoft Corp. 1981-1999.

 Cabinet cconnect.cab

Extracting c:\cconnect\temp\CConnect.exe
Extracting c:\cconnect\temp\msvbvm60.dll
Extracting c:\cconnect\temp\oleaut32.dll
Extracting c:\cconnect\temp\olepro32.dll
Extracting c:\cconnect\temp\asycfilt.dll
Extracting c:\cconnect\temp\stdole2.tlb
Extracting c:\cconnect\temp\COMCAT.DLL
Extracting c:\cconnect\temp\wshom.ocx
Extracting c:\cconnect\temp\wbemdisp.tlb
Extracting c:\cconnect\temp\MSSTDFMT.DLL
Extracting c:\cconnect\temp\SETUP1.EXE
Extracting c:\cconnect\temp\VB6STKIT.DLL
Extracting c:\cconnect\temp\ST6UNST.EXE

Extracting Two Files from a .cab to Another Folder

C:\Cconnect\Client>extract cconnect.cab cconnect.exe setup1.exe /l c:\cconnect\temp

Microsoft (R) Cabinet Extraction Tool - Version 5.00.2090.1
Copyright (C) Microsoft Corp. 1981-1999.

 Cabinet cconnect.cab

Extracting c:\cconnect\temp\CConnect.exe
Extracting c:\cconnect\temp\SETUP1.EXE


Fcopy.exe: File Copy Utility for Microsoft Message Queuing

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Before this link will open Fcopy.doc, you must first have installed FCopy by running Fcsetup.exe.

FCopy is a multi-server file copy tool that compresses files and folders to facilitate copying across LANs and WANs. Because it uses Message Queuing, this tool continues to copy files even if there are network problems. It includes update options which copy files only if they have been changed.

FCopy divides files into 32 kilobyte segments, compresses each segment and sends it as a Message Queuing message (in express mode). It does not need to restart when a network breakdown occurs since Message Queuing guarantees that the messages will be delivered.

FCopy's file compression uses a fast algorithm. It works well on any computer, but is most useful for slow lines; on regular Ethernet, it doesn’t affect copy speed very much unless the computer has a fast CPU. FCopy has been tested on files of more than five gigabytes, but can theoretically copy much larger files.

FCopy works with Message Queuing for Windows 2000, which is part of Microsoft® Windows® 2000, and MSMQ 1.0 for Microsoft® Windows NT® version 4.0, which is found on the Windows NT version 4.0 Option Pack CD-ROM.

Requirements

Before running FCopy, perform the following installation steps.

  1. Install Message Queuing for Windows 2000 on your computer.
  2. Install FCopy by running:
    fcsetup.exe

File Required

  • Fcsetup.exe

For More Information

For more information about Message Queuing, search the
Internet Microsoft Web site.


Filespy.exe: File Spy

Filespy.exe: File Spy NEW

This tool allows you to monitor both local and network drives to see what types of I/O Request Packets (IRP) and Fast I/O operations are executing in the system. It is a general-purpose diagnosis tool for anyone who wants to understand the file activity in a system.

FileSpy aids Installable File System (IFS) filter driver writers in understanding the I/O that is occurring in the system. FileSpy was developed as a useful example of how to write an IFS filter driver. This driver sits in the I/O stack and records the relevant information for the I/O operations that are happening, such as the starting time, the completion time, and return status.

Using FileSpy

  • Install the FileSpy service by running fspyinst.exe.

To remove the FileSpy service, run fspyunist.exe and restart your computer.

FileSpy Topics

  • FileSpy Syntax
  • FileSpy Examples
  • FileSpy Logs

Files Required

  • Filespy.exe
  • Filespy.sys
  • Fspyinst.exe
  • Fspyunin.exe


FileSpy Syntax

One Step filespy

Where:

/a drive
Attaches monitor to drive, where <drive> is a valid drive letter in the system (for example, C:).
/d drive
Detaches monitor from drive, where drive is a valid drive letter in the system (for example, C:) that the monitor has previously attached to.
note-icon

Note

The monitor may not truly detach from the device when it receives the /d command because a filter driver can only detach from a device when it can guarantee that it is on the top of the I/O stack. This will only going to occur when the filter driver receives the detach command from the I/O Manager. When the user application tells the kernel driver to detach from a device, the kernel monitor stops logging the data for that device. Also note that shutting down the user application does not cause the kernel monitor to detach from all the drives. The kernel driver will stop logging the I/O operations that it is seeing, but if the user restarts the user application, the kernel monitor will continue logging to the devices that it was attached to when the user application last stopped. The kernel driver will only reset these attachments to system devices when the system is restarted.

/h
lists statistics on hash table used to store file names.
/l
lists all the drives that the kernel driver is monitoring.
/s
toggles on and off showing the logging output to the screen. When the application is started, the default behavior is to show logging output to the screen.
/f [filename]
toggles on and off writing the logging output to a file. If issuing the /f command will toggle on writing output to a file, the required <filename> specifies the output file name. If the /f command will toggle off the writing output to a file, the <filename> is ignored and not required. By default, the logging output is not stored to a file.
go|g
exits the user from command mode and will allow the user application to show logging output on the screen again if the program is set to do so.
Exit
shuts down the user application.


FileSpy Logs

Logging information output either to the screen and/or to a file (as specified by the user commands) is the same. Different information is logged for for I/O operations along the Irp path versus I/O operations along the Fast I/O path.

The only difference between screen and file output is that fields are tab-delimited when writing to file to make the data easier to analyze. The data written to the screen has been compacted to make it easier to read. You still want your Command Window to be extra wide.

If the memory limit is hit when logging I/O operations, a message saying that the system is out of memory will appear in the log. You can see how many I/O operations were not logged by looking at the sequence numbers of the log records once the memory pressure has been relieved.

Output Format for Irp Operations

These fields appear from left to right, across the screen.

I | Designates that this is an I/O operation along the Irp path.
Sequence Number | The sequence number for this operation.
Originating Time | The time this I/O operation began.
Completion Time | The time this I/O operation ended.
Processes Id and Thread Id | The process and thread id for the thread that originated this I/O operation.These values are shown in the format processId.threadId.
IRP Major Code | The IRP major code for this operation.
IRP Minor Code | The IRP minor code for this operation, if there is one.
Interpretation of flags set Four columns with either a letter or a DASH (-) to designate different flags being set.
  1. N – NoCache flag was set
  2. P – Paging IO flag was set
  3. S – Synchronous API flag was set
  4. Y – Synchronous Paging IO flag was set
FileObject | The pointer value representing the File Object for this operation.
Return Status | The numeric value for the return status for this operation (look in ntstatus.h to see the description for the return value).
Name | If available, the name of the file.

Output Format for Fast I/O Operations

These fields appear from left to right, across the screen.

F | Designates that this is an I/O operation along the IRP path.
Sequence Number | The sequence number for this operation.
Originating Time | The time this I/O operation began.
Completion Time | The time this I/O operation ended.
Processes Id and Thread Id | The process and thread id for the thread that originated this I/O operation. These values are shown in the format processId.threadId.
Fast I/O Type Code | The type of Fast I/O operation.
Wait | If available, "T" if this Fast I/O operation was called with the Wait parameter set to TRUE, and "F" if the wait parameter was set to FALSE.
Length | If available, the number of bytes in the operation.
File Offset | If available, the offset into the file for this operation.
FileObject | If available, the pointer value representing the File Object for this operation.
Return Status | The numeric value for the return status for this operation (look in ntstatus.h to see the description for the return value).
Name | If available, the name of the file.


FileSpy Examples

G:\Program Files\Resource Kit>filespy
Hit [Enter] to begin command mode...
FileSpy:  Opening device...
DEVICE NAME                   | STATUS
------------------------------------------
No devices attached
FileSpy:  Creating logging thread...
Log: Starting up
>?
Valid switches: [/a <drive>] [/d <drive>] [/h] [/l] [/s] [/f [<file nam
        [/a <drive>] attaches monitor to <drive>
        [/d <drive>] detaches monitor from <drive>
        [/h] print file name hash statistics
        [/l] lists all the drives the monitor is currently attached to
        [/s] turns on and off showing logging output on the screen
        [/f [<file name>]] turns on and off logging to the specified fi
If you are in command mode,
        [go|g] will exit command mode
        [exit] will terminate this program
>g


Freedisk.exe

This command-line tool checks for free disk space. When it is used in a batch file, it returns a "0" if there is enough space and a "1" if there isn't. When used from the command line, FreeDisk returns "OK" when the disk space is available, and "Too Small" when it isn't.

FreeDisk Syntax

One Step freedisk x: minimum_bytes

Where:

x:
is the letter of the disk drive to check
minimum_bytes
is the decimal number of minimum free bytes to check for on the disk drive. If at least this number of bytes is available, FreeDisk returns a 0; if not, it returns a 1.

FreeDisk Example

C:>Freedisk c: 500000000

OK

Indicates that there is at least 500 megabytes (MB) of free space available on drive C.

File Required

  • Freedisk.exe


Ftedit.exe: Fault Tolerance Registry Information Editor

This GUI tool allows you to create, edit, and delete fault tolerance sets for disk drives and partitions of local and remote computers.

Information on disks and fault tolerance is stored as disk keys in the registry. To read it, you only need guest access (by default), but to change it, you must have the permissions necessary to write to the SYSTEM key of the registry.

Files Required

  • Ftedit.cnt
  • Ftedit.exe
  • Ftedit.hlp


Linkd.exe

Linkd.exe NEW

This command-line tool links an NTFS directory to a target object. LinkD grafts the target name directly into the name space at the specified source directory, so that the source directory subsequently acts as a name-space junction. A junction acts as a surrogate, standing in for the target object in the directory tree.

The source directory must reside on a drive formatted with NTFS 5.0. The destination or target of the link can be any valid Microsoft® Windows® 2000 directory name, device name, or object name. When the target name does not resolve to a directory or a device, open calls fail.

LinkD runs only on the local computer.

LinkD Topics

  • LinkD Syntax
  • LinkD Examples

File Required

  • Linkd.exe


LinkD Syntax

One Step linkd source [/d] [destination] [/?]

Where:

source
displays the Windows 2000 name targeted by source.
source [destination]
links source to destination (target), which can be any valid Windows 2000 directory name, device name, or object name.
source [/d]
deletes source, regardless of whether a link to a destination exists for that source.
/?
prints this help message. Type linkd /? | more to see all the help text.

LinkD's syntax is case-insensitive. If a source or destination name contains a space, the name must be surrounded by quotation marks. All characters in both the source and destination names must be in the ASCII character set; usage of Unicode characters is not supported.


LinkD Examples

C:\linkd folder1 folder2
C:\linkd folder1

C:\folder2

C:\linkd folder1 folder2
C:\dir folder1

Volume in drive C is Windows 2000
Volume Serial Number is XXXX-1111

Directory of C:\folder1

09-09-1999 10:35a     <DIR>     .
09-09-1999 10:35a     <DIR>     ..
09-09-1999 11:05a        1,000  file1.txt
09-09-1999 12:10p          500  file2.txt
         2 file(s)       1,500 bytes
         2 dir(s)   53,018,624 bytes free


List.exe: Text Display and Search Tool

List.exe: Text Display and Search Tool NEW

This simple text display and search tool lists the contents of a file. Unlike other text display tools, List is a good tool for looking at large text or log files because it does not read the whole file into memory when you open it.

List is useful for displaying text or log files remotely and for use on servers where administrators are concerned with degradation of system performance.

List Topics

  • List Syntax
  • List Keyboard Command Reference

Files Required

  • List.exe


List Syntax

One Step list [-s:string] [-g:line#] filename[, filename, ...]

Where:

-s:string
is the string to search for after opening the file.

-g:line#
is the line to jump to after opening the file.

filename[, filename, ...]
is the name of the file(s) to open and display.

For help on List commands and switches, press F1.


List Keyboard Command Reference

Keyboard Command | Description
Up, Down, Left, Right | Move one line or character in this direction
PgUp | Up one page
PgDn | Down one page
Home | Top of listing
End | End of listing
W | Toggle word wrap
CTRL + L | Refresh display
Q, ESC | Quit
/ | Search for string
\ | Search for string, any case
F4 | Toggle multifile search
n, F3 | Next occurrence of string - "n" must be lowercase
N | Previous occurences of string - "N" must be uppercase
C | Clear highlighted line
J | Jump to highlighted line
M | Mark highlighted
CTRL + Up | Pull copy buffer up
CTRL + Down | Pull copy buffer down
CTRL + Home | Slide copy buffer up
CTRL + End | Slide copy buffer down
G | Go to line number
CTRL + PgUp | Previous file
CTRL + PgDn | Next file
F | New file
H | Switch to Hexadecimal edit and display mode (ESC to exit)

The Hexadecimal mode of List supports additional features such as the ability to edit, load (import), and save (export) files. The chart below describes these features.

Keyboard Command | Description
F1 | Toggle
F2 | Go to
F3 | Search
F4 | Export
F5 | Import
F10 | Undo


Mcopy.exe

This command-line tool can be used in place of the MS-DOS Copy command in a batch file to copy specified files from one directory to another. It differs from the Copy command in that it creates a log file during the operation, which can be useful for troubleshooting or administrative purposes. Also unlike the Copy command, MCopy cannot be used with wildcards. For logged copy operations involving entire directories or directory trees, see Mtc.exe.

MCopy Topic

  • MCopy Syntax
  • MCopy Example

File Required

  • Mcopy.exe


MCopy Syntax

One Step mcopy [LogPath]LogFile [SrcPath]SrcFile [DstPath]DstFile

Where

LogPath
specifies the path to the directory containing the log file for the copy operation. If LogPath is not specified, MCopy searches for the file in the current directory.
LogFile
specifies the file name of the log file to which to append a log of actions and errors for the copy operation. If the file does not exist, MCopy creates it.
SrcPath
specifies the path to the directory containing the source file that you want to copy. SrcPath can consist of a drive letter and colon, a UNC network path, a directory name, or a combination. If SrcPath is not specified, MCopy searches for the file in the current directory.
SrcFile
specifies the file name of a source file that you want to copy. The full file name must be specified; wildcards cannot be used.
DstPath
specifies the path and file name of the target file. DstPath can consist of a drive letter and colon, a network share name, a directory name, or a combination. Note that the directory must already exist. If DstPath is not specified, MCopy creates the file in the current directory.
DstFile
specifies the name of the file to which the SrcFile will be copied. Note that the full file name must be specified. Wildcards cannot be used.

Note Image Note

MCopy error messages can be decoded using the Net helpmsg command, as follows:

Net helpmsg errorcode

Where errorcode is the number of the error.


Mcopy.exe Examples

MCopy Examples

Mcopy command-line example

mcopy mycopy.txt c:/windows/system.ini c:/startlog

MCopy batch file example

The following is an example of the use of Mcopy.exe and Mtc.exe with variables and error-checking in a batch file:

REM
REM	Set global variables
REM

set log=Mylog.log
set errlog=error.log
set sourcetree=\\neptune\binaries
set buildtree=e:\myproject

REM
REM	Create destination directories
REM

MD %buildtree%
MD %buildtree%\bin

Mcopy %log% %sourcetree%\readme.doc  %buildtree%\bin\readme.doc
MTC %log% %sourcetree%\abc\tools 		 %buildtree%\abc\tools\
MTC %log% %sourcetree%\def  		 	 %binaries%\def\

:ERRORCHK
findstr /I matching %LOG% > %ERRLOG%
findstr ERROR %LOG% >> %ERRLOG%

qgrep -y ERROR %ERRLOG% > nul
if errorlevel 1 goto NEXT

start "LOG HAS AN ERROR(S)!!!" list %ERRLOG%
goto SKIP

:NEXT
qgrep -y matching %ERRLOG% > nul
if errorlevel 1 goto NO_ERROR

start "LOG HAS AN ERROR(S)!!!" list %ERRLOG%
goto SKIP

:NO_ERROR
start "LOG HAS NO ERROR in it." list %ERRLOG%
Goto SKIP

:SKIP
GOTO END

:END


Mtc.exe

This command-line tool can be used in place of the MS-DOS Xcopy command in a batch file to copy a whole tree of files from one directory to another. It differs from the Xcopy command in that it creates a log file during the operation, which can be useful for troubleshooting or administrative purposes. It is also similar to Mcopy.exe, which copies individual files.

Mtc Topic

  • Mtc Syntax
  • Mtc Example

File Required

  • Mtc.exe


Mtc Syntax

One Step mtc [LogPath]LogFile [SrcPath]SrcTree [DstPath]DstTree

Where

LogPath
specifies the path to the directory containing the log file for the copy operation. If LogPath is not specified, Mtc searches for the file in the current directory.
LogFile
specifies the file name of the log file to which to append a log of actions and errors for the copy operation. If the file does not exist, Mtc creates it.
SrcPath
specifies the path to the source tree that you want to copy. SrcPath can consist of a drive letter and colon or a UNC network path. If SrcPath is not specified, Mtc searches for the source tree in the current directory.
SrcTree
specifies the name of the root directory of the source tree that you want to copy. If SrcPath is not specified, Mtc searches for SrcTree in the current directory.
DstPath
specifies the path and file name of the destination tree. DstPath can consist of a drive letter and colon or a UNC network path. If DstPath is not specified, Mtc creates the destination tree in the current directory.
DstTree
specifies the directory name for the destination tree to which you want to copy. If the directory does not exist, Mtc will create it. If DstPath is not specified, Mtc creates the destination tree in the current directory.

Note Image Note

Mtc error messages can be decoded using the Net helpmsg command, as follows:

Net helpmsg errorcode

Where errorcode is the number of the error.


Mtc.exe Examples

Mtc Example

Mtc Batch File Example

The following is an example of the use of Mcopy.exe and Mtc.exe with variables and error-checking in a batch file:

REM
REM	Set global variables
REM

set log=Mylog.log
set errlog=error.log
set sourcetree=\\neptune\binaries
set buildtree=e:\myproject

REM
REM	Create destination directories
REM

MD %buildtree%
MD %buildtree%\bin

Mcopy %log% %sourcetree%\readme.doc  %buildtree%\bin\readme.doc
MTC %log% %sourcetree%\abc\tools 		 %buildtree%\abc\tools\
MTC %log% %sourcetree%\def  		 	 %binaries%\def\

:ERRORCHK
findstr /I matching %LOG% > %ERRLOG%
findstr ERROR %LOG% >> %ERRLOG%

qgrep -y ERROR %ERRLOG% > nul
if errorlevel 1 goto NEXT

start "LOG HAS AN ERROR(S)!!!" list %ERRLOG%
goto SKIP

:NEXT
qgrep -y matching %ERRLOG% > nul
if errorlevel 1 goto NO_ERROR

start "LOG HAS AN ERROR(S)!!!" list %ERRLOG%
goto SKIP

:NO_ERROR
start "LOG HAS NO ERROR in it." list %ERRLOG%
Goto SKIP

:SKIP
GOTO END

:END


Mtfcheck.exe: Microsoft Tape Format Verification Tool

Mtfcheck.exe: Microsoft Tape Format Verification Tool NEW

This command-line tool enables you to verify that the format of a tape is compliant with the Microsoft Tape Format (MTF) specification. With it, you can verify any data written by NtBackUp, HSM, or any application that uses MTF. By verifying the data, you can make sure that the data is accessible to any MTF compliant application. MtfCheck can restore any file on any MTF-compliant tape without using Hierarchical Storage Management (HSM), NtBackUp (a Windows 2000 tool), or the application that wrote the tape. It can also erase a tape by zeroing all its data.

If data on an MTF tape are partially corrupted, MtfCheck can provide useful information on the corruption. Even if HSM or NtBackUp cannot access an MTF tape because of partial corruption, MtfCheck can still access it and restore the valid part of the data or uncorrupted files in a set.

Before MtfCheck, the standard way of verifying tape data was to run NtBackUp on the tape. But NtBackUp does not report inconsistencies on the tape; rather, it only indicates whether or not it can access the tape data. Moreover, it is not always feasible to restore the whole tape to verify data.

Normal tape erase procedures simply put a tape header followed by an END_OF_DATA mark, possibly keeping some partially valid data intact beyond the END_OF_DATA mark. For security reason, this might be unacceptable in certain cases. With MtfCheck, a user can over-write the tape with zeros and add a label to it.

In an automated test environment, testers can run an MTF application to write MTF data on a medium, run MtfCheck to create a report file in a specified directory, and use the summary in the report file along with the data from other test tools to ensure that the application wrote valid data.

System administrators can use this tool to verify routine backup data and to make sure they can rely on backup devices and procedures.

MtfCheck operates only on MTF data.

MtfCheck Topics

  • MtfCheck Syntax
  • MtfCheck Examples

File Required

  • Mtfcheck.exe


MtfCheck Syntax

One Step mtfcheck [-t TapeName] [-r ReportFileName] [-f N -s N] [-e[l] [-l"Label"]] [-?]

Where:

-t TapeName
specifies the name of the tape to operate on.
The name of the media should be "tape0", "tape1", and so forth. MtfCheck will convert that to \\.\tape0, or \\.\tape1. If no tape name is given, MtfCheck will use \\.\tape0 as the default media name.
-r ReportFileName
specifies the name of the report file into which MtfCheck dumps its output.
The default output file is Report.txt in the current directory. You can specify any file name in any directory to collect MtfCheck's output. If an invalid report file name is given, MtfCheck dumps output to the screen.
-f N
specifies the file number N to restore from the specified set on a tape. The file number can be obtained from the report file.
If the file or set number is not known, file restoration is a two-phase operation. In the first phase, the user runs mtfcheck -r ReportFileName to get a report file, in which MtfCheck enumerates all the sets and files on the given medium. Then in the second phase, the user specifies the set number and file number to restore any particular file in the specified set.
-s N
specifies a set number N on the medium from which a file should be restored.
The set number is available from the report file. This option is used with the -f N option.
-e[l]
erases a given tape without zeroing all data (the faster method). This does not overwrite all the data on the tape, but merely puts a header followed by a tapemark followed by an END_OF_DATA mark.
With l (long erase), erases the tape by zeroing all data. This overwrites all data on the medium and puts a header followed by a tapemark followed by an END_OF_DATA mark. This option may be useful for security reasons.
-l"Label"
specifies a media label to put in the header while erasing the tape. This option may be used with the -l"Label" option.
-?
displays this syntax screen at the command prompt.


MtfCheck Examples

mtfcheck -ttape0

This command verifies all the data on the device \\.\tape0 and writes a summary on those data in a file called Report.txt in the current directory.

mtfcheck -ttape0 –rc:\temp\myreport.txt

This command verifies all the data on the device \\.\tape0 and writes a summary on those data in a file called Myreport.txt in c:\Temp directory. In an automated test environment, the user can run a MTF application to write MTF data on a media, run MtfCheck to create a report file in a specified directory, and use the summary in the report file along with the data from other test tools to ensure that the application wrote valid data.

mtfcheck  -ttape0 -f10 -s3

This command restores tenth file from the third set on the tape \\.\tape0. If the file number or the set number is not known, user can run a normal verify (mtfcheck /ttape0) step and get those numbers from the report file.

mtfcheck -ttape0 -el  -l"My Label"

This command erases a tape, overwriting all its valid bytes with zero, and writes a header with the label "My Label". If -e is used instead of -el, then it writes only a header followed by an END_OF_DATA, as in a soft erase.


Qgrep.exe: Qgrep

Qgrep.exe: Qgrep NEW

This tool is used to search a file or set of files for a particular string or pattern. It is much like the POSIX tool grep.exe.

search through multiple files search through subdirectories

Qgrep Topics

  • Qgrep Syntax
  • Qgrep Examples

File Required

  • Qgrep.exe


Qgrep Syntax

One Step qgrep [-?] [B] [E] [L] [O] [X] [l] [n] [z] [v] [x] [y] [-e string] [-f file] [-i file] [strings] [files]

Where:

-?, /?
displays command-line syntax.
-B
matches pattern at beginning of line.
-E
matches pattern at end of line.
-L
treats search strings literally.
-O
prints seek offset before each matching line.
-X
treats search strings as regular expressions.
-l
prints only the file name if the file contains a match.
-n
prints line numbers before each matching line.
-z
prints matching lines in MSC error message format.
-v
prints only lines that do not contain a match.
-x
prints lines that match exactly.
-y
treats upper- and lower-case as equivalent.
-e string
treats the next argument as a literal search string.
-f file
reads search strings from file.
-i file
reads file list from file.
strings
the search string(s). White space separates search strings unless the argument is prefixed with -e. For example,
qgrep "all out" x.y
means find either "all" or "out" in x.y, while
qgrep -e "all out" x.y
means find "all out".
files
The file(s) to search, which can include wildcard characters (* and ?).


Qgrep Examples

Find either arg1 or arg2 in FileName:

qgrep "arg1 arg2" FileName

Find arg1 arg2 in FileName:

qgrep -e "arg1 arg2" FileName


Robocopy.exe: Robust File Copy Utility

RoboCopy is a 32-bit Windows command-line application that simplifies the task of maintaining an identical copy of a folder tree in multiple locations, either on the same computer or in separate network locations. RoboCopy can provide time-efficient maintenance of mirror images of large folder trees on network servers separated by slow or unreliable wide area networks (WANs) links.

RoboCopy is robust: it retries after network errors. By copying only changed files, it saves a lot of time. RoboCopy is flexible: you can copy a single folder or walk a directory tree specifying multiple file names and wildcard characters for source files.

By default, RoboCopy ignores source file attributes when selecting files to copy. It copies any file matching specified conditions, regardless of the file's attribute settings.

To run RoboCopy, both the source and destination folders should reside on an NTFS partition wherever possible. You can use RoboCopy to copy to other file systems such as HPFS or FAT, but if you do so you might lose long file names, and file modification times might suffer from rounding errors at the destination.

RoboCopy outputs a log of files and folders to its command-prompt window, listing the folders processed, files copied and why, network errors, and incompatibilities between the source and destination folder-tree structures. This output can also be redirected to a disk file. Just before RoboCopy closes, it outputs a summary of its activities during its session to its command-prompt window, or to a disk file if redirected.

Although RoboCopy does not run as a service, you can use the Schedule service to run RoboCopy as a scheduled job. The scheduled job can run a command file that invokes RoboCopy and uses Soon.exe to reschedule the same command file in the future. This procedure has the same effect as a replication service, although in this case RoboCopy is restricted to using a single drive or share as both source and destination.

Note

Robocopy does not run on Microsoft® Windows® 95, or Microsoft® Windows NT® version 3.5x. RoboCopy is a Unicode application, and Windows 95 does not provide full Unicode support. Also, RoboCopy uses the CopyFileEx() Win32 API, which is supported on Microsoft® Windows® 2000 and Microsoft® Windows NT® version 4.0, but not on Windows NT 3.5x.

Files Required

  • Robocopy.exe
  • Robocopy.doc


Rsm_dbic.exe: Removable Storage Integrity Checker

Rsm_dbic.exe: Removable Storage Integrity Checker NEW

Rsm_Dbic is a command-line tool that checks the integrity of the Removable Storage database for media, removable media drives, and libraries for inconsistencies.

Note

Removable Storage keeps a database of all changers and standalone drives it supports as well as keeping track of work items and operator requests. The database also contains all supported media, organized by both pool and media type.

Rsm_Dbic Topics

  • Rsm_Dbic Syntax
  • Rsm_Dbic Examples

File Required

  • Rsm_dbic.exe

For More Information

  • For information about Removable Storage, see the Windows 2000 Resource Kit Online Books


Rsm_Dbic Syntax

One Step rsm_dbic [/?] [/v] [/p]

Where:

/?
displays command-line help.
/v
displays information about Removable Storage objects as it checks for integrity.
/p
pauses the Removable Storage service, performs an integrity check, then continues the service after the integrity check is complete. This prevents Removable Storage from modifying the database, and potentially causing an erroneous inconsistency to be reported while the database is being checked.
note-icon

Note

If this fails to pause or continue the Removable Storage feature, a warning message will appear. You will then need to manually either pause or restart the Removable Storage feature from the MMC Service snap-in.


Rsm_Dbic Examples

  • Pause the database and check for inconsistencies.

    rsm_dbic /p

    The Removable Storage service was paused successfully.

The Removable Storage service was continued successfully.

 No Inconsistencies Found
  • Display object information as database check is performed.

    rsm_dbic /v

    CheckChanger: Found 0 Changer(s)
CheckComputer: Found 1 Computer(s)
CheckComputer: Checking IMACOMPUTERNAME
CheckComputer: Checking MediaPoolRoot IMACOMPUTERNAME
CheckDrive: Found 1 Drive(S)
CheckDrive: Checking Drive Drive 0  NEC CD-ROM DRIVE:464 SCSI CdRom Device
CheckDrive: DriveType is NEC CD-ROM DRIVE:464 SCSI CdRom Device (Standard CD-ROM drives) for Drive Drive 0 NEC CD-ROM DRIVE:464 SCSI CdRom Device
CheckDrive: Checking Library NEC CD-ROM DRIVE:464 SCSI CdRom Device  Type = 3 for Drive Drive 0
CheckDrive: Drive for Computer IMACOMPUTERNAME
CheckDrive: DriveState is 0 for Drive Drive 0
CheckIEDoor: Found 0 IEDoor(s)
CheckIEPort: Found 1 IEPort(s)
CheckIEPort: Checking IEPort #0
CheckIEPort: IEPort #0 belongs to Library NEC CD-ROM DRIVE:464 SCSI CdRom Device
CheckLibrary: Found 2 Libraries
CheckLibrary: Checking Library Off-line Media
CheckLibrary: Detailed information about Library Off-line Media
            # of Drives = 0
            # of Slots =0
            # of IEDoors = 0
            # of IEPorts =  0
            # of Changers = 0
            # of Media in Library = 0
            # of MediaTypes = 0
            # of LibRequests = 0
CheckLibrary: Checking Library NEC CD-ROM DRIVE:464 SCSI CdRom Device
CheckLibrary: Detailed information about Library NEC CD-ROM DRIVE:464 SCSI CdRom Device
            # of Drives = 1
            # of Slots =0
            # of IEDoors = 0
            # of IEPorts =  1
            # of Changers = 0
            # of Media in Library = 0
            # of MediaTypes = 1
            # of LibRequests = 0
CheckLibWorkItem: Found 0 WorkItem(s)
CheckLogicalMedia: Found 0 Logical Media(s)
CheckMediaPool: Found 4 MediaPool(s)
CheckMediaPool: Checking MediaPool #0 Unrecognized
CheckMediaPool: Parent MediaPool is IMACOMPUTERNAME for MediaPool Unrecognized
CheckMediaPool: Found 0 PoolMembers for Unrecognized
CheckMediaPool: Found 0 LogicalPoolMembers for MediaPool Unrecognized
CheckMediaPool: Checking MediaPool #1 Import
CheckMediaPool: Parent MediaPool is IMACOMPUTERNAME for MediaPool Import
CheckMediaPool: Parent MediaPool for MediaPool Import is 'Import' MediaPool
CheckMediaPool: Found 0 PoolMembers for Import
CheckMediaPool: Found 0 LogicalPoolMembers for MediaPool Import
CheckMediaPool: Checking MediaPool #2 Free
CheckMediaPool: Parent MediaPool is IMACOMPUTERNAME for MediaPool Free
CheckMediaPool: Parent MediaPool for MediaPool Free is 'FREE' MediaPool
CheckMediaPool: Found 0 PoolMembers for Free
CheckMediaPool: Found 0 LogicalPoolMembers for MediaPool Free
CheckMediaPool: Checking MediaPool #3 IMACOMPUTERNAME
CheckMediaPool: Found 0 PoolMembers for IMACOMPUTERNAME
CheckMediaPool: Found 0 LogicalPoolMembers for MediaPool IMACOMPUTERNAME
CheckOpRequest: Found 0 OpRequest(s)
CheckPartition: Found 0 Partition(s)
CheckPhysicalMedia: Found 0 PhysicalMedia(s)
CheckStorageSlot: Found 0 StorageSlot(S)
 No Inconsistencies Found


Rsm_dbutil.exe: Removable Storage Database Utility

Rsm_dbutil.exe: Removable Storage Database Utility NEW

Removable Storage Database Utility is a graphical user interface (GUI) tool that allows you to manage a Removable Storage database. Using the Removable Storage Database Utility you can:

  • check database integrity
  • create an Removable Storage database "backup"
  • change the location of the Removable Storage database
  • lookup objects in the Removable Storage database using their GUIDs

Note

Removable Storage keeps a database of all changers and standalone drives it supports as well as keeping track of work items and operator requests. The database also contains all supported media, organized by both pool and media type.

Check Integrity tab

Examines a Removable Storage database for referential integrity constraints. Steps through the database and inspects each database object attribute for valid values and referential integrity. Run this option when Removable Storage behaves unpredictably or the information shown in Removable Storage snap-in is incorrect.

Check Integrity tab
Option | Description
Verbose Output | Generate a detailed report on the database.
Pause Removable Storage | Pause the Removable Storage service then continue the service after the integrity check is complete. This prevents Removable Storage from modifying the database, and potentially causing an erroneous inconsistency to be reported while the database is being checked. If it fails to pause or continue the Removable Storage feature, a warning message will appear. You will then need to manually either pause or restart the Removable Storage service from the MMC Service snap-in.
View Result with Microsoft Internet Explorer | View the generated report in Internet Explorer immediately after the integrity check is complete.
Output | Specify the location where integrity check report is created. By default, this report is saved as C:\RSMResult.txt

Backup/Restore tab

Creates a consistent set of database files. These files are suitable for backup by your favorite backup program. While the Microsoft® Windows® 2000 Backup utility can create a Removable Storage database backup, other backup tools might not have this capability.

Backup/Restore tab
Option | Description
Backup | Create a backup file called Ntmsdata.bak in the Ntmsdata\Export\ subdirectory of the current database location.
Restore | Restore database from Ntmsdata.bak in the Ntmsdata\Export\ subdirectory of the current database location.

Configure tab

Change the default location of a Removable Storage database. When you enter a different location and click Change, the current database and backup files are moved to the new location and necessary registry changes are made so Removable Storage can still locate the database.
For example, you would use this option to place a Removable Storage database on a different volume, such as a RAID disk.

Configure tab
Option | Description
Current location | Displays the current database location. Enter the new location here and click the Change button. Moving the database requires that the Removable Storage service is stopped. If the tool can't stop the service, the database will not be moved, and a warning message will appear. You will then need to manually stop the Removable Storage service from the MMC Service snap-in.

Find Guid tab

Lists GUIDs used by Removable Storage. Use the "find GUID" feature to help figure out what error messages returned by Removable Storage-aware applications really mean. Double-clicking any GUID provides more details about the object. You can also search the database for a specific GUID.

Find Guid tab
Option | Description
Search button | Search for a specific GUID within the Removable Storage database.
Refresh button | Refresh button re-reads the Removable Storage database and generates a new list of Guids.
Type | GUID type.
GUID | GUID value. This is the unique identifier for an object.

Double-clicking on a specific GUID returns the following information for that item. Information returned includes:

Option | Description
Name | The name of the object.
Description |
Type | Options include: computer, drive, drivetype, ieport, library, mediapool, mediatype
Id | The GUID for this object.
Time Created |
Time Modified |

File Required

  • Rsm_dbutil.exe

For More Information

  • On Removable Storage, see the Windows 2000 Resource Kit Online Books


Rsmconfg.exe: Removable Storage Manual Configuration Wizard

Rsmconfg.exe: Removable Storage Manual Configuration Wizard NEW

RsmConfg is a wizard that aids in manually configuring robotic library changers that the Removable Storage auto-configuration feature of Microsoft® Windows® 2000 can't. RsmConfg will map any unmapped changer drive bays to a drive name.

Removable Storage will correctly associate drives with changers as long as the configuration of the drive or changer follows specific rules. When an installation doesn't conform to these rules, an administrator must perform a "manual" configuration. This tool steps you through this process and performs many of the necessary steps for you.

Manual Configuration Wizard is a tool that helps administrators configure robotic libraries that the auto-configuration utility of the Removable Storage feature of Windows 2000 fails to configure.

Removable Storage will correctly associate drives with changers as long as the configuration of the drives and changer follow the following rules:

  • the robotic library hardware unit supports drive element address reporting with the ReadElementStatus SCSI command.
  • all drives inside the robotic library are on the same SCSI bus as the library itself.

When Removable Storage fails to configure one or more changer in the system, for each library unit, it displays a pop-up window which displays the message: "Unable to auto-configure (library unit name)". Then the administrators can use this wizard to configure all such changers. The wizard guides the you through the process. It does most of the operations by itself, but the administrator might have to intervene to eject or insert media.

RsmConfg Topics

  • Using RsmConfg
  • Troubleshooting RsmConfg

Files Required

  • Rsmconfg.exe


Takeown.exe: TakeOwn

Takeown.exe NEW

TakeOwn is a command-line tool that cleans up multiple boot drives without formatting the drive. Using this tool, you can delete an installation of Microsoft® Windows® 2000 from a local computer.

If you install Windows 2000 onto a computer with another installation of Windows 2000 already on it, and then attempt to delete it, you'll find that you can't delete the entire directory. One of the hidden directories, named \Installer, contains some .msi and .ico files that are locked, and unless you use TakeOwn, there's nothing you can do to delete any of them short of formatting the drive.

This is because Windows 2000 applies security attributes to the file such that the only one that can access those files are the System account of the previous installation. Even an administrator of this computer cannot reset these permissions.

After deleting the lock with TakeOwn, you might have to use the GUI, Cacls, or Xcacls tools to give you full permissions to the files or directories before you can delete the files or directories in question.

File Required

  • Takeown.exe


Textview.exe: TextViewer

TextViewer provides a graphical interface for quickly viewing text files on local or shared drives.

While this tool provides basic editing and searching capabilities, it is primarily intended for viewing similar files within multiple subfolders. For example, you could use TextViewer to skim through all the *.txt files within a Resource Kit or all the source files (*.c; *.cpp; *.cxx) within a Software Developers Kit.

In an expandable tree control, TextViewer displays files on a local or shared drive according to a file mask, which allows you to see all files or only certain file types. To select files for viewing, you double-click them.

File Required

  • Textview.exe


Vfi.exe: Visual File Information

Vfi.exe: Visual File Information NEW

Visual File Information retrieves and generates file information. You can use this information for testing purposes to detect what files have changed in different versions of applications or what the differences are between two seemingly identical computers. This information is also valuable to track different versions of resources that normally don't store version information. Results can be copied to the Clipboard or saved to a tab-delimited file or Microsoft® Excel file.

The following information (if present) is displayed for each file:

  • File Path
  • File Name
  • Extension
  • Size
  • Date
  • Time
  • Attributes
  • File Version
  • Product Version Language
  • Code Page
  • Operating System
  • Type
  • File Flags
  • CRC-32
  • ISO 9660

File Required

  • Vfi.exe


Where.exe: Where

Where.exe: Where NEW

This command-line tool can be used to locate files on the hard disk or the network. Where.exe can run recursive searches, can display file information such as date, size, or executable type, and on local computers can accept environmental variables in place of paths.

Where Topics

  • Where Syntax
  • Where Examples

File Required

  • Where.exe


Where Syntax

One Step where [/r dir] [/q] [/t] [/e] [/Q] pattern ...

or

One Step where [/q] [/t] [/e] [/Q] $envvar: pattern ...

Where:

/r dir
indicates a recursive search, starting with directory dir.
/q
quiet, use exit code.
/t
tells Where.exe to display the size and time of the file.
/e
tells Where.exe to display the executable type of any executable files found.
/Q
places double quotes around the output.
pattern
specifies the name of a directory, file or set of files to be found. Wildcard characters (? or *) may be used in place of characters.
$envvar
is the name of a valid environmental variable on the local computer (for example, $windir).


Where Examples

Examples

where "program files"
Find all directories named "program files" in the current directory and path of the current computer.
where $windir:*.ini
Find all instances of files with the .ini extension along the path represented by the environmental variable windir.
where /r \\zodiac\c$ /e notepad.*
Find all files named "notepad" in drive "C$" of the remote computer \\zodiac and its subdirectories, and report the executable type for executable files.
where /r c:\ test
Find all directories named "test" in drive c: of the current computer and its subdirectories.


Ierk5.chm: Internet Explorer 5 Resource Kit

Ierk5.chm: Internet Explorer 5 Resource Kit NEW

The Internet Explorer 5 Resource Kit (IERK) details the ways that you can best customize and use Internet Explorer 5 for your needs. It covers the planning process from deciding which components and features to include to distributing Internet Explorer throughout your organization or to your customers. It describes how you can make the most of browser functionality and showcase your content. It also provides detailed coverage of installation options and outlines ways to best handle support and maintenance.

Although this technical and planning resource focuses specifically on the latest version of Internet Explorer, its coverage includes much more. It describes customization and deployment features available across platforms (Windows 16-bit and 32-bit versions as well as UNIX) and discusses ways that you can design solutions that combine various tools and integrate with different Microsoft products

File Required

  • Ierk5.chm


Microsoft Internet Explorer Administration Kit

Microsoft Internet Explorer Administration Kit NEW

The Microsoft Internet Explorer Administration Kit (IEAK) enables administrators to create, distribute, and update customized installations of Internet Explorer 5 using tools included in the kit, such as the Internet Explorer Customization wizard, the Microsoft Connection Manager Administration Kit (CMAK). The IEAK Profile Manager, also included in the kit, allows you to create an answer file specifying custom settings for Internet Explorer during automated installations of Windows 2000. See Unattended Setup with IEAK Profile Manager for more information.

Using IEAK, you can:

  • Tailor the browser and other Internet components to fit your organization's or customers' needs. For example, you can customize the Links bar and Favorites list to promote your organization or provide helpful information.
  • Configure settings before you install, so you don't need to set options on each computer.
  • Customize Setup so that it requires less intervention and installs your custom programs.
  • If you're a corporate administrator, control which settings your employees can change, so you ensure that security, connection, and other important settings adhere to corporate standards.

IEAK Topics

  • Installing the IEAK
  • Unattended Setup with IEAK Profile Manager

Files Required

The files for IEAK are located on the Windows 2000 Resource Kit CD in the <Cdroot>\Apps\IEAK folder.


Installing the Internet Explorer Administration Kit

The Internet Explorer Administration Kit is not installed by the Windows 2000 Resource Kit setup program. To install it, use the following procedure:

To install the Internet Explorer Administration Kit

  1. Insert the Windows 2000 Resource Kit companion CD into your CD-ROM drive.
  2. When the Setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\IEAK directory, double-click Ieak5.exe.
  4. Follow the directions that appear on your screen.

To start the Internet Explorer Administration Kit

  1. Click Start.
  2. Point to Programs.
    3. Point to Microsoft IEAK, and then click the name of the component you want to run.


Unattended Setup with IEAK Profile Manager

To install Windows 2000 automatically, you can run Setup with an answer file. An answer file contains settings that customize Setup without user or administrator intervention. This type of Setup is often referred to as "unattended Setup."

In the branding section of the answer file, you can specify an IEAK Profile, which contains custom settings for Internet Explorer. To produce a customized profile for unattended Setup, you can use the Profile Manager that comes with the IEAK.

To create a customized profile, carry out the following procedure. After you have created the customized profile, you should specify the customized profile name in the Branding section of the answer file for unattended Setup. For more details about unattended Setup, see the "Automating Client Installation and Upgrade" chapter in the of the Microsoft® Windows® 2000 Resource Kit Deployment Planning Guide. Also see the Unattend.doc and Setup Manager topics in this Tools Help documentation.

To create an IEAK Profile by using the Profile Manager

  1. Install the IEAK from the Windows 2000 Resource Kit companion CD
  2. On the Start menu, point to Programs.
  3. Point to Microsoft IEAK, and then click IEAK Profile Manager.
  4. Click New to create a new .ins file, or click Open to modify an existing file.
  5. On the Platform menu, click Windows 2000.
  6. Click the items under Wizard Settings that you want to modify, and then change the settings that you want.
  7. On the File menu, click Save to save your settings to an IEAK Profile.

Note

The System Policies and Restrictions settings for Windows 2000 are not available through the Profile Manager. To manage restrictions and policies for Windows 2000, use Group Policy.


Internet Explorer Web Accessories

Internet Explorer Web Accessories NEW

Internet Explorer Web Accessories are a selection of useful Web Accessories for Microsoft® Internet Explorer 5. Most of these are activated by right-clicking on an appropriate item in the browser and choosing the associated command.

Open Frame in New Window | Remove sidebars from a Web page by right-clicking anywhere in the frame you want, and selecting Open in New Frame.
Quick Search | This Web Accessory lets you reach the search engines of your choice quickly. For example, if you type av ActiveX in the Address bar, Internet Explorer starts a search using AltaVista Search on the keyword "ActiveX." To activate Quick Search, click Quick Search on the Links bar, and then click Save.
Zoom In/Zoom Out | This Web Accessory lets you zoom in and out of any image on a Web page. Right-click on the image and select Zoom In or Zoom Out.
Image Toggler | Now you can quickly and easily turn off images for extra speed, and turn them back on again. Look for Toggle Images in the Links bar and click it.
Text Highlighter | This Web Accessory lets you highlight text in a document just like you would in Microsoft® Word. Select your text, then right-click and choose Highlight. This tool is very useful for reading long documents.
Web Search | With this Web Accessory you can select keywords on a Web page, right-click, and choose Web Search. Your selected words go directly to a default search engine.
Links List | To see all the links on a Web page, right-click anywhere and select Links Lists, and you'll get a new window with every link on the page in a convenient list format. Then just click any link to use it.
Image List | Use this to find out what the size of graphics are and how long they could take to download at various connection speeds. This tool also displays a window containing all the images on a Web page in a separate window and displays the file size and the size in pixels.

Installation Instructions

The Internet Explorer Web Accessories are not installed during Windows 2000 Resource Kit installation. To install them, use the following procedure:

To install the Internet Explorer Web Accessories

  1. Insert the Microsoft Windows 2000 Resource Kit companion CD in your CD-ROM drive.
  2. When the setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\Webaccessories directory, double-click Ie5ntwa.exe.
  4. Follow the directions that appear on your screen.

File Required

  • Ie5nwa.exe

For More Information

  • Internet Microsoft Windows Technologies Internet Explorer Web site
    contains a wealth of information about Internet Explorer, including access to the Internet Explorer Knowledge Base, technical support information, and answers to frequently asked questions.
  • Search the Internet Microsoft Web site for information about Microsoft Internet Services Network (ISN). The ISN Web site contains all the latest news and information about Microsoft Internet technologies.
  • Search the Internet Microsoft Web site for the Microsoft Intranet Web site, which contains many intranet applications, tools, and resources to help IT professionals build and manage corporate intranets.
  • Internet MSDN Online Web site
    features product and technology information for developers using Microsoft tools and applications. Find out how to bring state-of-the-art Web technology to Internet and intranet sites and learn how to author for different versions and platforms.


Cookie Munger Filter

Cookie Munger: ISAPI filter for ASP session state for browsers without cookies

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

The Cookie Munger filter is a tool that enables Active Server Pages (ASP) to work with browsers that do not support cookies or that refuse to accept them. ASP uses the ASPSESSIONID cookie to maintain its session state. ASP expects the browser to send this cookie to the server with every request that it makes. The ASPSESSIONID cookie is unique to a session. Without it, ASP does not know which session the user owns and it cannot keep the Session object up to date as the user moves from page to page.

Cookie Munger Topics

Installing Cookie Munger

Using Cookie Munger

File Required

  • ckymunge.dll


Installing the Cookie Munger Filter

Installing Cookie Munger

Cookie Munger (Ckymunge.dll) is installed by the Resource Kit setup program. To configure and use Cookie Munger, use the following procedure:

To configure and use Cookie Munger

  1. Copy Ckymunge.dll from the Resource Kit installation directory to a suitable location, such as <systemdrive>\InetPub\Scripts or <systemdrive>\Winnt\System32\InetSrv.
  2. Launch the Internet Information Services snap-in.
  3. In the snap-in, select a Web Site on the IIS Server that you want Cookie Munger to filter. Right-click Selected Web site, and then click Properties from the context menu.
  4. Select the ISAPI Filter tab and then click Add.

    5. Note

    If you have other filters installed, the order in which they are executed might become important. Cookie Munger is a medium-priority filter.

  5. Type "Cookie Munger" in the Filter Name field and type in the full path to the location where you copied Ckymunge.dll (for example, type: <systemdrive>\InetPub\Scripts\ckmunge.dll)
  6. Next you must Disable Chunk encoding. By default, ASP transmits files to certain browsers (in particular, Internet Explorer 4.0 and later) using Transfer Chunk Encoding. This is more efficient than sending the data as straight ASCII text. However, the CkyMunge filter does not understand chunked encoding, so you must disable the encoding. To do so, open up a command window (Cmd.exe) and change your current directory to <systemdrive>\InetPub\AdminScripts
  7. Type adsutil.vbs set w3svc/AspEnableChunkedEncoding False on the command line and press Enter.
  8. Once you have finished all the steps above you must stop and restart the Web server to load the new filter into memory.


Using the Cookie Munger Filter

Using Cookie Munger

Cookie Munger works as follows:
  1. The filter receives a request for a particular URL. If the headers of the request contain a "Cookie: ASPSESSIONIDxxxxxxxx=xxx" header, then that ASPSESSIONID is recorded. If the URL contains an encoded ASPSESSIONID (see step 2), the ASPSESSIONID is removed from the URL and a Cookie header is generated instead. The ASPSESSIONID, if present, is recorded for this transaction.
  2. Cookie Munger filters all outgoing data. When ASP sends out a page in response to the above request, Cookie Munger removes Set-Cookie headers with ASPSESSIONIDs, if present (to eliminate cookie warnings in browsers that do not support them), and "munges" any local, relative URLs embedded in the page (for example, http:microsoft/web.asp may become something similar to http:microsoft/web.asp-ASP=PVZQGHUMEAYAHMFV).
  3. If the user clicks on one of those modified URLs, the request comes back to the server (and filter) and step 1 starts over again.
Notes

Filtering outgoing raw data is an expensive process. Every byte of data sent out by IIS must be streamed through the filter. The filter goes to some pains to be smart about not unnecessarily processing data it's not interested in (such as GIFs), but there are unavoidable performance costs associated with IIS needing to copy all data from kernel memory to user memory.

It is impossible to give an accurate prediction of how much performance will degrade on your server if the Cookie Munger filter is installed. On a lightly loaded server, the difference should not matter. On a heavily loaded server, the performance might become unacceptable.

It is recommended that you measure the performance of your server both with and without the filter installed and see if the convenience of supporting users who won't accept cookies or users with old browsers outweighs the cost of poorer performance. User education might be a better solution in the long run.

If you elect not to install this filter, you can minimize the number of cookies sent by Active Server Pages in one of two ways:

  1. Put something into the Session object. For example: <% Session("something") = whatever %>
  2. Put a global.asa into the virtual root for your application, with an empty Session_OnStart subroutine.

In IIS 5.0, you can turn off session state (and hence cookies) entirely:

  1. On an individual page, place
      <% @ EnableSessionState=FALSE %%>
    at the top of the page.
  2. For an entire ASP application: Start the Internet Service Manager, select the Web site that you want to disable session state for, and open its Properties sheet. On the Directory tab, select Configuration. On the App Options tab, clear Enable Session State.

The filter has three modes: Off, On, and Smart. In Off mode the filter does no work (a better way of turning it off is to remove it from the list of filters). In On mode, all URLs will be munged as normal and no cookies will be sent out. In Smart mode, the filter will munge text and let cookies go out to the browser. If the cookie comes back, it will stop munging URLs and use the cookies. If the cookie doesn't come back, it will begin eating outgoing cookies and continue to munge URLs. This will result in slightly better performance. The mode is controlled by a registry setting:

          HKEY_LOCAL_MACHINE\SYSTEM\
              Software\
                  Microsoft\
                      CkyMunge\
                          MungeMode (DWORD)

A value of 0 is Off, 1 is On, and 2 is Smart.

URLs will look unconventional (for example: http:/microsoft/web.asp-ASP=PVZQGHUMEAYAHMFV). Users can still bookmark them, however. If the ASPSESSIONID is stale, the server will assign them a new session ID and start a new session. If Cookie Munger has been disabled in the meantime, then the URL will be unreachable.

Only local URLs are modified. Absolute URLs are not modified (for example, http://www.microsoft.com/test/test.asp), nor are local-absolute URLs (for example, http:/test/test.asp). It is good HTML style to use relative URLs wherever possible, to ensure location independence, so that moving a set of pages to a different server or directory will not require modification of the text.

The filter does not work well with pure HTML pages (pages with an .htm or .html file name extension), as the Set-Cookie header does not get sent out by IIS. Thus, the filter has no way of knowing how to modify any embedded URLs. Rename your .htm and .html pages to have a .asp extension, even if they contain no server-side scripting.

If you have some client-side scripting that dynamically constructs URLs in the user's browser (windows.navigate), these URLs will not be modified to contain the ASPSESSIONID.

This filter is transparent to Active Server Pages. It neither knows nor cares that the filter is present.


Exploration Air 5.0 Sample Web Site

Exploration Air 5.0 Sample Web Site NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Exploration Air 5.0 is a Web application showcase for Microsoft® Internet Information Services 5.0 and Microsoft® Windows® 2000 Server. Exploration Air 5.0 is a sample e-commerce Web site for a fictional airline. It demonstrates how you can use Internet Information Services 5.0 and Windows 2000 Server to build rich and dynamic Web applications using a wide variety of Microsoft Internet tools and technologies.

For More Information

For more information on configuring, using, and troubleshooting Exploration Air, see the Exploration Air 5.0 Release Notes. After installing the tool on your hard disk, click Start, point to Programs, point to Exploration Air 5.0 Sample Site, and then click Exploration Air 5.0 Release Notes.

Exploration Air Topics

  • Installing Exploration Air


Installing Exploration Air 5.0

To take advantage of all of the features of Exploration Air 5.0, the following Windows 2000 components must be installed:

  • Indexing Services
  • Certificate Services
For information on installing these services, see the Windows 2000 product documentation.

To install the Exploration Air 5.0 sample site

note-icon

Note

Note that you must log on as a member of the Administrator group to install Exploration Air.

  1. Start Windows 2000.
  2. Insert the Windows 2000 Resource Kit companion CD into your CD-ROM drive.
  3. When the setup screen appears, click Explore the CD.
  4. In the \apps\explorationair directory, double-click the ExAir5-Desktop-x86.msi file.
  5. Follow the instructions that appear on your screen.

note-icon

Note

By default, the Exploration Air files are installed in the C:\Program Files\Microsoft\ExxAir5 directory of your hard disk.

To configure and start Exploration Air 5.0

  1. Once the Exploration Air 5.0 sample site is installed, the COM+ components must be configured. To do this, click Start, point to Programs, point to Exploration Air 5.0 Sample Site, and then click Install ExAir5 COM+ Component. Next, click Install Benefit5 COM+ Component, and lastly, click Install ProdInfo5 COM+ Component.
  2. After installation, you can start using Exploration Air with the Exploration Air 5.0 Sample Site submenu of the Start menu. Click Start, point to Programs, point to Exploration Air 5.0 Sample Site, and then click Exploration Air 5.0.

note-icon

Notes

  • To provide an upgrade path for enhanced performance, scalability, and reliability, the Exploration Air 5.0 sample site can be "upsized" by the user to support the use of Microsoft® SQL Server™ 6.5 or 7.0 as a server-based database provider instead of Microsoft® Access 97, which is provided as the default database. For more information on implementing this feature, see the Exploration Air 5.0 Sample Site Release Notes, which can be accessed through the Exploration Air 5.0 Sample Site submenu of the Start menu after installation.
  • In order to provide the most secure e-commerce environment possible, Secure Sockets Layer (SSL) and X.509 Client Certificate authentication are available as user configurable options to "secure" the Frequent Flyer Club application that ships as part of the Exploration Air 5.0 sample site. However, in order to use these features, several configuration changes to your IIS configuration are necessary in order to enable encryption and/or certificate authentication. For more information, see the Exploration Air 5.0 Sample Site Release Notes, which can be accessed through the Exploration Air 5.0 Sample Site submenu of the Start menu after installation.


HTML Text Filter (Htmlfltr.exe)

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

HTML Text Filter is a command-line tool that removes comments and extra white space from HTML files, decreasing browser load time and improving performance. If a directory is specified, HTML Text Filter compresses uncompressed ASP, HTM, and HTML files, recursing to all subdirectories if /S is specified. If a file (or file pattern with wildcard characters) is specified, it compresses all matching files.

Note

HTML Text Filter never compresses files that contain the <!--NoCompress--> tag.

HTML Text Filter Syntax

One Step htmlfltr [/q] [/s] {dir | file}

Where:

/q
Causes HTML Text Filter to run in quiet mode (does not display status on completion).
/s
Compresses files in all sub-directories under the specified directory.
dir
Specifies a directory name and path.
file
Specifies a file name or pattern (for example, default.*).

HTML Text Filter Example

htmlfltr /s c:\web\Mysite

Compresses all .asp, .html, and .htm files in the Mysite directory and all subdirectories.

File Required

  • Htmlfltr.exe


Httpcmd.exe: HTTP Command

Httpcmd.exe: Command-line HTTP client NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

HTTPCmd is a command-line HTTP client. It lets you send requests to a server from a command prompt, and observe the returns. The server's reply is sent to STDOUT, and is displayed in the command window.

Input Files

HTTPCmd sends its requests to the server by means of an input file, which you create. Some typical input files (.req files) are copied to your local computer during the Windows 2000 Resource Kit installation, and can be modified to suit your needs. These files are located in the directory where you installed the Resource Kit. For example, the content of the Getinfo.req file is the line:

  GET /scripts/getinfo.exe/scripts/test.hfo?zxz=aca&aca=zxz HTTP/1.0

If there is no test.hfo file in the specified directory on the server, or if the specified directory doesn't exist, this returns error message 404.

HTTPCmd Topics

  • HTTPCmd Syntax

File Required

  • Httpcmd.exe


HTTPCmd Syntax

One Step httpcmd server input.file [-k] [-u:username:password] [-a:AuthenticationScheme] [-e] [-t] [-h]

Where:

server
is the server to be tested.
input.file
contains a full HTTP request.
-k
sets the Send Pragma to: Keep-connection, input.file contains multiple requests separated by $END on a blank line.
-u:username:password
uses the specified user name and password for authentication purposes.
-a:AuthenticationScheme
can be "Basic", "NTLM", or "MS-KERBEROS". Only one authentication scheme is supported at a time.
-e
echo sends requests to STDOUT. Shows what is being requested.
-t
do HEX-HTTP for filter testing.
-h
don't echo HTTP headers.

The server's reply is sent to STDOUT, and is displayed in the command window.


Httpmon.exe: HTTP Monitoring Tool

Httpmon.exe: HTTP Monitoring Tool NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

HTTP Monitoring Tool is a multithreaded Windows 2000 service-monitoring tool that gathers large amounts of data about a Web site. HTTP Monitoring Tool is controlled by a configuration file (HTTPMon.ini), which you must edit to suit your testing needs. It is designed to test a large number of computers through the configuration of the .ini file and generate either a standard comma-separated file (CSV), or entries in the Windows 2000 event log.

HTTP Monitoring Tool provides immediate monitoring of Web servers, without requiring specialized Web page development. You can also customize it to perform complex tests. HTTP Monitoring Tool was designed to use the existing pages on a Web server to capture the user's experience. In addition, you can use the Clusters and Friendly Names settings in HTTPMON.ini. With these, HTTP Monitoring Tool uses names that are meaningful to support personnel, which makes troubleshooting easier.

With some additional coding and implementation, it is possible to use the .csv file generated by the HTTP Monitoring Tool to import data into Microsoft® SQL Server™ databases, read from a custom application, perform Internet monitoring, or inform Operations and Technical Support personnel about server status. Code samples are provided in the Httpmon\Samples directory.

Documentation

After installing HTTPMon, see the HTTPMon tool documentation (Httpmon.doc) and readme file. The default installation location for these files is: C:\Program Files\Httpmon\Docs.

HTTPMon Topics

  • Installing HTTPMon

Files Required

  • The files required by HTTPMon are located in the Apps\Httmon directory of the Windows 2000 Resource Kit companion CD. See Installing HTTPMon for information on installing and running the application.


Installing HTTP Monitoring Tool

HTTP Monitoring Tool is not installed by the Windows 2000 Resource Kit setup program. To install it, use the following procedure:

To install HTTP Monitoring Tool

  1. Insert the Windows 2000 Resource Kit companion CD into your CD-ROM drive.
  2. When the Setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\httpmon directory, double-click setup.exe.
  4. Follow the directions that appear on your screen.

Once you have installed HTTP Monitoring Tool, see the Readme file (Readme.txt) and User's Guide (HTTPMon_whitepaper.doc) for information on configuring and using the tool. These files are both located in the directory where you installed the tool (C:\Program Files\Httpmon in the default installation).


IFilter Test Suite

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

IFilter Test Suite validates IFilter implementations by calling IFilter methods and checking the returned values for compliance with the IFilter specification. Some of the things the test looks for are that:

  • Chunk IDs are unique and increasing.
  • The IFilter behaves consistently after re-initialization.
  • IFilter method calls with incorrect parameters return expected error codes.

The test consists of a single application, Ifilttst.exe, and an initialization file, Ifilttst.ini. The Ifilttst.exe file is a command-line application.

System Requirements

To run the IFilter Test Suite on your computer, you must have the following installed and running:

  • Microsoft® Windows® 2000 Server or Advanced Server
  • Microsoft Internet Information Services 5.0
  • Microsoft Indexing Service

IFilter Test Suite Topics

  • Ifilttst.exe Syntax
  • Ifilttst.exe Example
  • IFilter Test Suite .ini File

Files Required

  • Ifilttst.exe
  • Ifilttst.ini
  • Ifilttst.doc


Ifilttst.exe Syntax

One Step ifilttst /i InputFilename[...] [/ini IniFilename ] [/l [Logname]] [/d] [/-l] [/-d] [/legit] [/stress] [/v verbosity] [/t th reads] [/r [depth]] [/c loops]

Where:

/?
displays a message showing the syntax and describes each parameter.
/ini IniFilename
specifies the initialization file to be used. If none is specified, the default is Ifilttst.ini.
/i InputFilename
names the input file or directory to be filtered. The file name can contain the wildcard characters * and ?. You can list multiple files, separated by spaces.
/l [LogName]
directs log messages to the specified file instead of to the screen. These messages describe the individual tests performed and the pass/fail result of the test. By default, the log file name is the same as the input file name with a .log extension. If you specify a log file name, then all log messages will be directed to a single log file, even if you specify multiple input files.
/d
directs dump messages to a file and describes the contents of the chunks. The chunk structure is dumped when the verbosity level is 3. The dump file name is the same as the input file name, but with a .dmp extension.
/-l
disables logging. This flag overrides /l.
/-d
disables dumping. This flag overrides /d.
/legit
forces the test to run only the Validation Test. The Consistency Test and Invalid Input Tests are skipped.
/stress
runs the test in stress mode. This is the same as specifying /-l /-d /v 0 /c 0 /legit
/v integer
sets the verbosity level. 0: Logs only messages concerning specific IFilter failures and dumps the chunk contents. 1: Logs warning messages. 2: Logs messages concerning tests that passed. 3: Logs informational messages and dumps the structure of the chunks. The default is 3.
/t integer
determines the number of threads to launch. The default is 1.
/r [integer]
sets the depth for recursively filtering subdirectories. If no integer is specified, or if the integer is 0, full recursion is assumed. The default is 1.
/c integer
sets the number of times to loop. If the integer is 0, the test loops infinitely. By default, the test loops only once.

Note

You must include a space between the command line switch and the value.


IFilter Test Suite Examples

IFilter Test Suite Example

You can invoke the IFilter Test Suite from the command line, as in the following example:

ifilttst /i test.htm /l /d /v 1

This example tells the program to filter the file Test.htm, redirect the log messages to Test.htm.log, redirect the dump messages to Test.htm.dmp, and set the verbosity to 1.

For the example to work, the following files must be in the current working directory:

  • Ifilttst.exe
  • Ifilttst.ini
  • Test.htm

For a description of the Ifilttst.ini file, see The Ifilttst.ini File.


The Ifilttst.ini File

Ifilttst.ini File Overview

An IFilter object is initialized by calling IFilter::Init(). Init() takes the following parameters:

  • grfFlags
  • cAttributes
  • aAttributes
  • pdwFlags

The user of the IFilter Test Suite can specify the values for these parameters in a file called Ifilttst.ini. (A sample Ifilttst.ini file is provided later in this document.)

The file is broken up into sections, with the section name enclosed in square brackets. In the example, the sections are named Test1, Test2, and so on. All section names must be unique. The test will read the values from the first section and initialize the filter with them. Then it will run all of its tests using this filter configuration. The test will then release the filter and reinitialize it, using parameters from the next section. It repeats the process until there are no more configurations left to test.

Each section contains a complete description of the parameters for IFilter::Init(). The parameters are described in separate fields, called entries.

ENTRY | VALUE OF ENTRY
Flags | The names of the IFILTER_INIT flags that are to be concatenated together (using a "bitwise or") to form the grfFlags parameter. They must be in all caps and must appear on the same line.
cAttributes | A decimal integer representing the value of the cAttributes parameter.
aAttributes | The first token must be a globally unique identifier (GUID). The GUID must be formatted exactly as shown in section [Test3] in the example below. The second token may be either a propid (consisting of a number in hexadecimal notation) or a lpwstr (a pointer to a wide character string). The wide string character lpwstr can be specified by enclosing the string in double quotes (see section [Test6]).

If the Flags and cAttributes entries are not specified, they default to zero. If you set cAttributes equal to 2, you will usually want to specify 2 aAttributes; however, you do not have to. In section [Test5], cAttributes is 1, but no aAttributes have been specified. The test will then call IFilter::Init() with cAttributes equal to 1, and aAttributes equal to NULL. This is a useful test case, since it is likely to cause an access violation in IFilter::Init().

There is no entry for the pdwFlags parameter since this parameter is used solely to return a value to the caller; it does not need to have any special value prior to the call to Init().

If Ifilttst.exe cannot find a file named Ifilttst.ini in the present working directory, it uses a default configuration to initialize the filter object. Below is the default configuration:

[default]
grfFlags = IFILTER_INIT_APPLY_INDEX_ATTRIBUTES
cAttributes = 0

Sample Ifilttst.ini file

; Only extract text from the object
[Test1]
Flags =
cAttributes = 0
; Get all attributes (text and pseudo-properties)
[Test2]
Flags = IFILTER_INIT_APPLY_INDEX_ATTRIBUTES
cAttributes = 0
; This also extracts just text from the object (the GUID is PSGUID_STORAGE,
; and the propid is PID_STG_CONTENTS)
[Test3]
Flags = IFILTER_INIT_CANON_PARAGRAPHS IFILTER_INIT_HARD_LINE_BREAKS
cAttributes = 1
aAttributes1 = b725f130-47ef-101a-a5f1-02608c9eebac 13
; Only extract requested attribute from the html object
; (the GUID corresponds to the html filter)
[Test4]
Flags = IFILTER_INIT_CANON_HYPHENS IFILTER_INIT_CANON_SPACES
cAttributes = 1
aAttributes1 = 70eb7a10-55d9-11cf-b75b-00aa0051fe20 3
; What happens if cAttributes is non-zero, but aAttributes is empty?
[Test5]
Flags = IFILTER_INIT_CANON_SPACES IFILTER_INIT_APPLY_INDEX_ATTRIBUTES IFILTER_INIT_APPLY_OTHER_ATTRIBUTES
cAttributes = 1
; Here is an attribute with a lpwstr instead of a propid
; (the lpwstr is enclosed in quotes)
; The GUID corresponds to the meta tag clsid for the HTML filter.
[Test6]
Flags =
cAttributes = 1
aAttributes1 = D1B5D3F0-C0B3-11CF-9A92-00A0C908DBF1 "GENERATOR"


IIS Host Helper Service

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

The Host Helper Service is a service that registers host header strings as NetBIOS names. This allows users on an intranet that are using WINS to access the Web server by the host header name without registering the Web server's name with a DNS server.

Note

The IIS Host Helper Service will only register host names that are 15 characters or less and do not contain a PERIOD (.). This is to avoid confusion with DNS names that contain a PERIOD (.). The 15-character limitation is due to the nature of NetBIOS names. NetBIOS names cannot exceed 16 characters, and the IIS Host Helper Service needs to use the 16th character.

IIS Host Helper Service Topics

  • Using IIS Host Helper Service

File Required

  • Iishostsvc.exe


Using IIS Host Helper Service

Installing IIS Host Helper Service

To Install IIS Host Helper Service

  1. Copy Iishostsvc.exe from the Windows 2000 Resource Kit CD to the %SystemRoot%\System32\inetsrv directory of your hard disk.
    note-icon

    Note

    If you selected Internet Information Services Tools during Resource Kit installation, this step has already been done.

  2. Open a command window and change the current directory to the %SystemRoot%\System32\inetsrv directory.
  3. Type iishostsvc install, and then press ENTER.

Starting the Host Helper Service

To start IIS Host Helper Service

  1. Follow the procedure for installing the service, as described previously in this document.
  2. Open a command window and change the current directory to the %SystemRoot%\System32\inetsrv directory.
  3. Type net start iishostsvc, and then press ENTER.

Stopping IIS Host Helper Service

To stop the IIS Host Helper Service

  1. Open a command window and change the current directory to the %SystemRoot%\System32\inetsrv directory.
  2. Type net stop iishostsvc, and then press ENTER.

Uninstalling IIS Host Helper Service

To uninstall IIS Host Helper Service

  1. Open a command window and change the current directory to the %SystemRoot%\System32\inetsrv directory.
  2. Type iishostsvc uninstall, and then press ENTER.


IIS Migration Support Files

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

The following support files from Chapter 2 of the IIS Migration Guide are available on the Windows 2000 Resource Kit companion CD.

  • Design.doc This is a template you can use for creating a design for Web services.
  • FuncSpec.doc This is a template you can use for creating a functional specification for Web services.
  • OrgEnvir.doc This is a form you can use for surveying the organization environment when planning a Web services migration project.
  • ProjPlan.doc This is a template you can use for creating a master project plan for a Web services migration project (.doc file version of ProjSche.mpp, below).
  • ProjSche.mpp This is an example of a master project schedule for a Web services migration project. It will give you some ideas regarding the items to include in your own schedule.

    note-icon

    Note

    This file requires Microsoft® Project.

  • RiskAsmt.doc This is a form you can use for assessing risks for a Web services migration project.
  • Standard.doc This is a form you can use for surveying Web administration standards and procedures so you can update them as appropriate when migrating Web services.
  • TechEnvi.doc This is a form you can use for surveying the technical environment when planning a Web services migration project.
  • TestPlan.doc This is a sample test plan that you can use for a reference when planning a Web services migration project.
  • ToolsChk.doc This is a checklist you can use for creating a list of tools to obtain or update for a Web services migration project.
  • VisScope.doc This is a template you can use for creating a vision and scope document for a Web services migration project.


IIS Migration Wizard

IIS Migration Wizard NEW

The IIS Migration Wizard migrates Web server configuration settings, Multipurpose Internet Mail Extensions (MIME) type information, and content to Windows 2000 Server and Internet Information Services (IIS) 5.0 from another Web server. It also provides the option to migrate users and groups.

During a migration, the wizard performs the following basic tasks:

  • Creates a virtual Web site in the IIS 5.0 snap-in, with a configuration that is matched as closely as possible to the original Web site.
  • Copies content, including application files, into an appropriate directory structure that it creates in Windows Explorer.
  • Maps the virtual Web site to the content.
  • Configures ASP applications, ISAPI extensions, and DLLs. Sets execute permissions on the CGI directory. You might have to take additional steps in order for your applications to run on IIS 5.0.

Each of these tasks is explained in more detail later in this topic.

Important

The wizard overwrites any files that have duplicate names according to Windows conventions. File names are considered to be duplicate if they are differentiated only by letter cases. In addition, the wizard retains the UNIX-style names of migrated files and directories, and not all UNIX-style names are accepted by Windows. Before you migrate them, it is important to make sure that your UNIX files and directories conform to Windows conventions, as described in Migrating UNIX Files and Applications.

For More Information

The Microsoft® Windows® 2000 Resource Kit Internet Information Services Resource Guide includes two chapters about Web server migration. "Managing the Migration Process" provides general information about planning and implementation. "Migrating a Web Server to IIS 5.0" discusses specific migration issues, including changes that must be made to UNIX files and applications.

For a list of migrated Web server configuration settings, see IIS Migration Wizard Migrated Settings.

IIS Migration Wizard Topics

  • Installing the IIS Migration Wizard
  • Using the IIS Migration Wizard
  • Troubleshooting the IIS Migration Wizard
  • IIS Migration Wizard Migrated Settings

Files Required

The files required for IIS Migration Wizard are located on your Microsoft® Windows® 2000 Resource Kit CD-ROM.

To use this tool, you must install it. See Installing the IIS Migration Wizard for more information.


Installing the IIS Migration Wizard

The IIS Migration Wizard consists of two components, the "source" and the "target." You install the source component on the computer from which you are migrating. You install the target component on the computer to which you are migrating. Two different source components are included with the wizard: one for use with Windows NT version 4.0 Server or Windows 2000 Server and one for use with a UNIX-based computer. For more information about supported target and source platforms, see IIS Migration Wizard Support Platforms and System Requirements.

Note

Before you begin, make sure you have Administrator rights on both the source and the target computers. For more information, see Important Security Information.

This topic provides the following instructions:

  • Installing the Windows source component
  • Installing the UNIX source component
  • Installing the target component

Installing the Windows source component

Use the following procedure to install the source component onto a computer running Windows NT 4.0 or Windows 2000 Server. This should be the server from which you are migrating.

To install the Windows source component

  1. Log on to the source computer as Administrator.
  2. For migrations from Netscape Enterprise Server, make sure that Perl 5.x is installed on the source computer. The Windows version of Perl 5.x is available on the Resource Kit companion CD.
  3. Insert the Resource Kit companion CD into the CD-ROM drive and find the <cdroot>\apps\migrationwizard\ directory.
  4. Double-click IISv5MigrationUtility_x86.exe.
  5. Follow the instructions on the screen to install the component. When prompted, select the Install components for migration source option.
  6. For additional instructions, click Help at the bottom of the dialog box.

Installing the UNIX source component

Use the following procedure to install the source component on a UNIX computer running Apache HTTP Server.

To install the UNIX source component

  1. Log on to the source computer as root.
  2. Make sure that Perl 5.x is installed on the source computer.
  3. Use FTP to transfer IISv5MigrationUtility-ApacheSource.tar to a temp directory on the source computer. This file is located on the Resource Kit companion CD in <cdroot>\apps\migrationwizard\.
  4. On the command line, either locally or from TELNET, type:

    tar -x < IISv5MigrationUtility-ApacheSource.TAR

    5. Note

    Remember that UNIX is case-sensitive.

  5. In the temp directory into which you extracted the tar file, type:

    perl install.pl
     (either locally, or from TELNET).

Once the Apache source component is installed, you can begin a migration from the target computer, as described in Running the IIS Migration Wizard.

Installing the Target Component

To install the target component, you can use one of the following two procedures:

  • Install it from the source computer over a Web connection. This is the preferred method.
  • Install it from the Resource Kit companion CD.

Note

The IIS Migration Wizard is designed to run on a target computer with a default configuration for Windows 2000 Server and IIS 5.0. You might encounter unexpected problems when running the wizard on a target computer with a custom configuration. For more information, see Troubleshooting the IIS Migration Wizard.

To install the target component from the source computer

  1. Make sure the source component is installed on the source computer and that the source Web server is running. If the source Web server is IIS 5.0, the Default Web Site must be running. If you have renamed or deleted the Default Web Site, then the Web site that appears first under the Administration Web Site in the IIS 5.0 snap-in must be running.
  2. Log on to the target computer as Administrator.
  3. Connect to http://[source]/iismu/welcome.htm, where [source] is either the computer name or the IP address of the source computer. This starts the IIS Migration Wizard.
  4. On the Welcome page, click Next.
  5. On the next page, click the link for the x86-based target platform.
  6. In the Internet Explorer dialog box, select an option to either open or save the file. If you select the option to open the file from its current location, the target component will be installed directly across the network. If you select the option to save the file to disk, the installation file will be saved in a location you specify. In order to install the target component, you must then double-click the installation file that you saved.
  7. When installation of the target component is complete, return focus to the wizard.
  8. Click Next to begin a migration or Cancel to close the wizard. To run a migration at a later time, select IIS Migration Wizard from Programs on the Start menu of the target computer. Before starting a migration, it is recommended that you read the information in Using the IIS Migration Wizard.

To install the target component from the Resource Kit companion CD

  1. Log on to the target computer as Administrator.
  2. Insert the Resource Kit companion CD into the CD-ROM drive and find <cdroot>\apps\migrationwizard\.
  3. Double-click IISv5MigrationUtility_TargetOnly_x86.exe.
  4. Follow the instructions on the screen. When prompted, select the target installation option.
  5. To begin a migration, select IIS Migration Wizard from Programs on the Start menu of the target computer. Before starting a migration, it is recommended that you read the information in Using the IIS Migration Wizard.


Using the IIS Migration Wizard

This topic provides the following information:

  • IIS Migration Wizard - Platforms and Requirements for Running
  • Important Security Information
  • Running the IIS Migration Wizard
  • Starting a Migrated Web Site
  • Running the Wizard Again
  • Migrating Netscape and Apache Users
  • Completing the Migration of Content
  • Saving Archive Files
  • Restoring Migrated Settings and Content

IIS Migration Wizard--Platforms and Requirements for Running

Supported Source Platforms

Note

In this documentation, "source" refers to the computer from which you are migrating, and "target" refers to the computer to which you are migrating.

The IIS Migration Wizard can migrate Web sites from the following source platforms to Windows 2000 Server and IIS 5.0:

  • UNIX with Apache HTTP Server 1.3
  • Windows NT Server 4.0 with Netscape Enterprise Server 3.5.1
  • Windows NT Server 4.0 with IIS 4.0
  • Windows 2000 Server with IIS 5.0 (you can use this feature to replicate an IIS Web server to another computer)

Note

Microsoft Peer Web Services is not supported as a migration target or source.

Requirements for Running the Wizard

The following conditions must be met in order for the IIS Migration Wizard to run correctly:

  • The target computer must have Web access to the source computer.
  • The person running the wizard must have local computer administrator rights on both the source and the target computers.
  • The target computer must be running Windows 2000 Server and IIS 5.0. It should also have a default configuration.
  • The source platform must be supported, as described previously in this topic.
  • A source computer running Apache HTTP Server or Netscape Enterprise Server must have Perl 5.x installed.
  • During a migration, the IIS 5.0 Default Web Site must be running on the target computer.
  • For migrations from IIS, the IIS Default Web site must be running on the source computer. If the Default Web Site has been deleted or renamed, then the first Web site that appears under the Administration Web Site in the IIS snap-in must be running.
  • For migrations from Apache HTTP Server and Netscape Enterprise Server, the Web server must be running on the source computer.
  • Total content involved in a single migration cannot exceed 4 gigabytes (GB). If content exceeds this limit, you can perform separate migrations for virtual Web sites. If you have only one Web site, you can decrease the content in a single migration by creating virtual Web sites that each refer to a portion of the content. You can then conduct separate migrations for the virtual Web sites.
  • As described later in Migrating UNIX Files and Applications, before starting a migration from Apache HTTP Server, you must make sure that file names and directory names adhere to Windows conventions. Otherwise, some files and directories could be overwritten.

Important Security Information

  • It is strongly recommended that you uninstall IIS Migration Wizard source and target components after completing the migration process. Leaving these components installed could pose a security risk. On a Windows-based computer, you uninstall the components by using the Add/Remove Programs utility in Control Panel. On a UNIX-based computer, you uninstall the components by deleting the [webroot]/iismu directory and the [cgibin]/iismu directory.
  • For Apache HTTP Server and Netscape Enterprise Server migrations, you must specify a password when installing the source component. You then enter this password during the migration process when connecting to the source computer from the target computer.
  • You must have local computer administrator rights on both the source and target computers in order to use the migration wizard. Being a domain administrator satisfies this condition.

Running the IIS Migration Wizard

Once you have installed the IIS Migration Wizard source component, you are ready to run the wizard and conduct a migration. For more information, see Installing the IIS Migration Wizard.

To run the IIS Migration Wizard

  1. Make sure you have satisfied the conditions for using the wizard as described in Requirements for Running the Wizard. If you have not done so, the wizard will not run correctly.
  2. If you have installed the target component, log on to the target computer as Administrator, and then select IIS Migration Wizard from Programs on the Start menu. This starts the wizard.

    3. Or:

    If you have not installed the target component, log on to the target computer as Administrator, and then connect to http://[source]/iismu/welcome.htm, where [source] is either the computer name or the IP address of the source computer. This starts the wizard. When prompted, choose the option to install the target component. When the installation is complete, continue with the wizard.

  3. When prompted, select the server content, settings, and MIME information to migrate for each virtual server. When migrating from Netscape Enterprise Server or Apache HTTP Server, you can also choose the option to migrate users, as described later in Migrating Netscape and Apache Users. The IIS Administration Web Site is not migrated by default, but you can select an option to migrate it.
  4. To get help while using the wizard, click Help at the bottom of the dialog box.
  5. When satisfied with your selections, click Next. The wizard then starts the migration, which can take from several minutes to over an hour. When the migration is complete, the wizard displays a list of warnings, as well as additional steps required to complete the migration.
  6. To save the activity log or the migration archive file, which contains migrated content and settings, click the appropriate link at the bottom of the wizard screen. For more information, see Saving Archive Files.
  7. To close the wizard, click Finish.

Important It is strongly recommended that you uninstall both the source and target components after completing the migration process. Leaving these components installed could pose a security risk. For more information, see Important Security Information.

For More Information

For more information about migrated configuration settings, see IIS Migration Wizard Migrated Settings. For more information about how content is migrated, including applications, see Completing the Migration of Content.

Starting a Migrated Web Site

After you have taken all the steps to complete the migration, you can start the new Web site in the IIS snap-in. To do this, select the new Web site, and then click the Start button on the toolbar. Be aware that the Default Web Site serves IIS 5.0 documentation and samples, and that it runs on port 80 by default. If you try to run your new Web site on the same port, you will create a conflict. If you change the port number of the Default Web Site, you will no longer be able to access your documentation. Therefore, if you are running a single Web site, it is best to run it under the Default Web Site. For information about running more than one Web site at a time on IIS 5.0, see the "Adding Sites" topic in the IIS 5.0 online product documentation.

Running the Wizard Again

You can run the IIS Migration Wizard again on the same target computer and use either the same source Web sites or different source Web sites. The following are the results for each scenario:

  • Using the same source Web site, and giving it the same name during a migration, results in a duplicate virtual Web site in the IIS 5.0 snap-in. The new Web site is given the same name as the original Web site, with an appended serial number. All Web site content contained in Inetpub\[Web Site], where [Web Site] is the name of the original Web site, is overwritten by content from the source Web site, and both sites refer to the new content.
  • Using the same source Web site, and giving it a new name during a migration, results in a new virtual Web site, with the new name, in the IIS 5.0 snap-in. Source Web site content is written to Inetpub\[New Web Site], where [New Web Site] is the name you gave the new Web site.
  • Using a different source Web site creates a new virtual Web site in the IIS 5.0 snap-in and a new directory of source content in Inetpub\[New Web Site], where [New Web Site] is the name you gave the new Web site.

To run the wizard again

  1. If necessary, install the source component on the source computer, as described in Installing the IIS Migration Wizard.
  2. Follow the procedure given in Running the IIS Migration Wizard.

Migrating Netscape and Apache Users

During a migration from Netscape Enterprise Server or Apache HTTP Server, you can select the option to migrate a user database. If you choose this option, the wizard creates a user file and stores it in a location you specify. Once the migration is finished, you can use Addusers.exe, a Windows 2000 Resource Kit tool, to import the users to Windows 2000 Server. For instructions on using Addusers.exe, click Help on the final wizard screen.

Completing the Migration of Content

The IIS Migration Wizard copies all source Web site content to the target computer. It also performs much of the necessary configuration in order for IIS 5.0 to serve the content. However, for certain types of content you might need to take additional steps to complete the migration. This topic describes the directory structure the wizard creates for content and the additional steps you might need to complete the migration.

The IIS Migration Wizard places content in the following directory structure that it creates in Windows Explorer on the target computer: Inetpub\[source]\[drive]\[directory structure], where [source] is the computer name or IP address of the source computer, [drive] is the drive on which the content was stored on the source computer, and [directory structure] is the directory structure as it exists on the source computer.

The wizard configures IIS 5.0 properties for migrated content, with the following results:

  • Web pages are configured to be served correctly. You might need to change UNIX-style file names might to reflect Windows conventions. For more information, see Migrating UNIX Files and Applications.
  • CGI applications are placed in a directory with execute permissions enabled. You might need to take additional steps in order for your CGI applications to run on IIS 5.0, particularly UNIX CGI applications. For more information, see "Migrating a Web Server to IIS 5.0" in the Microsoft® Windows® 2000 Resource Kit Internet Information Services Resource Guide.
  • ASP applications with relative paths are configured to run correctly. You might need to correct absolute paths in .asp files to reflect the new directory hierarchy.
  • ISAPI extensions are configured to run correctly.
  • NSAPI extensions are migrated, but are not converted to a format that runs on IIS 5.0.
  • DLLs that are stored in Web content directories on the source computer are configured to run correctly. DLLs stored outside Web content directories are not migrated.
  • COM objects that are stored in Web content directories on the source computer are copied to the appropriate directory. However, to complete the migration of COM objects, you must manually run Regsvr32.exe. COM objects stored outside Web content directories are not migrated.
  • ODBC sources are not migrated.
  • Security certificates are not migrated.

For more information

For more information about additional steps you might need to take to migrate Web site content, especially from the UNIX environment, see Migrating UNIX Files and Applications, next.

Migrating UNIX Files and Applications

Because of operating system differences between UNIX and Windows 2000 Server, you might need to make a few changes to content files and directories that you migrate from Apache HTTP Server.

Before migrating from Apache HTTP Server, it is important to make sure that your file and directory names adhere to Windows conventions. The IIS Migration Wizard overwrites any files that have duplicate names according to Windows conventions, when they exist in the same directory on the source computer. If the wizard encounters a file with the same name as another file in a directory, even if the letters have different cases, it overwrites the file that it encountered first with the "duplicate" file. The wizard overwrites directories in the same manner, at the directory level.

Besides correcting duplicate file names, you might need to remove "illegal characters" from file names. The wizard retains the UNIX-style names of migrated files and directories, and IIS 5.0 will serve these files correctly. However, you might encounter some problems when working with your files and directories in the Windows file system if their names contain any the following characters:

/ \ : * ? " < > |

In addition, you might need to change file names and path names within application files so that they reflect Windows conventions. For more information on migrating applications, see "Migrating a Web Server to IIS 5.0" in the Internet Information Services Resource Guide.

Saving Archive Files

The IIS Migration Wizard provides the option to save two archive files: a .cab file containing migrated content and settings, and a .log file containing a list of events that occurred during the migration. From the .cab file, you can restore the settings and content of a particular migration, as described in the next topic. By reviewing the events recorded in the .log file, you can troubleshoot any problems with the migration.

At the end of a migration, the wizard provides the option to save the two archive files to a location that you specify. If you do not choose the option to save these files, and then later discover that you need them, you can find them in the %SystemRoot%\System32\inetsrv\iismu directory on the target computer. By default the files are named [source].cab and [source].log, where [source] is either the computer name or the IP address of the source computer. For example, if the source computer has the computer name "SomeName," the wizard would name the files SomeName.cab, and SomeName.log. However, be aware that the next time you run a migration, these files will be overwritten, so it is highly recommended that you save them to a different location when the wizard provides this option.

Restoring Migrated Settings and Content

For each migration, the IIS Migration Wizard provides the option to save a .cab file that archives migrated settings and content, as described previously. If you make changes to a migrated Web site that you later want to "undo," or if your data becomes corrupted, you can restore the original settings and content. You do this by running the wizard again and referencing the .cab archive file rather than a source Web server. You can also use this method to replicate migrated settings and content to another computer running Windows 2000 Server and IIS 5.0.

The wizard restores or replicates migrated settings and content as follows:

  • If, in the IIS 5.0 snap-in, the wizard encounters a Web site with the same name as the Web site for which the archive .cab file was created, it restores the Web site settings to the state recorded in the .cab file. The wizard also overwrites any content contained in Inetpub\[Web Site Name]\ folder with corresponding content from the archive .cab file. [Web Site Name] is a folder with the same name as the migrated Web site. If the wizard does not find a folder with this name, it creates a folder with this name and copies the content into it.
  • If, in the IIS 5.0 snap-in, the wizard does not encounter a Web site with a name that corresponds to the name of the archived Web site, it creates and new Web site with this name. It also copies all of the archived content to Inetpub\[Web Site Name]\, where [Web Site Name] is a folder the wizard creates with the same name as the migrated Web site.

To restore or replicate migrated settings and content

  1. Log on to the target computer (the one onto which you want to replicate or restore settings and content) as Administrator.
  2. If necessary, install the target component, as described in Installing the IIS Migration Wizard.
  3. Select IIS Migration Wizard from Programs on the Start menu. This starts the wizard.
  4. On the Welcome page, click Next.
  5. In Step 2: connect to the source server, select the option to use the archive file.
  6. In the box, type the path and file name of the archive .cab file, and then click Next.
  7. Click Next on each subsequent screen until the migration begins. Once started, the process takes from a few minutes to over an hour, depending on the amount of content being restored or replicated. When it is complete, the wizard displays a list of warnings, as well as additional steps required.


Troubleshooting the IIS Migration Wizard

Contents

  • Page Cannot Be Displayed Error
  • Response.isClientConnected VBScript Error
  • Stalling on Netscape Source Servers

Page Cannot Be Displayed Error
When Starting the Wizard from a Web Page

When you are trying to start the wizard from a Web page by connecting to http://[source]/iismu/welcome.htm, you might receive an error message that the page cannot be displayed. If you do, it means that the source Web server is not running.

To correct the problem, stop the wizard, start the source Web server, and then start the wizard again. If the source Web server is IIS, you need to start the Default Web Site or, if you have renamed or deleted it, the Web site that appears first under the Administration Web Site in the IIS snap-in of the MMC.

Page Cannot be Displayed Error after Step 2

After starting the wizard and completing the second step (Step 2: connect to the source server), you might receive an error message that the page cannot be displayed. If you do, it means that either the target component is not installed, or the target Web server is not running. To correct the problem, use the following steps:

  • If the target component has not been installed, go back to Step 1 of the wizard, install the target component, and then continue with the wizard.
  • If the target component has been installed, the error indicates that the target Web server is not running. In this case, stop the wizard. In the IIS snap-in, start the Default Web Site, and then start the wizard again.

If after taking these steps, you continue to receive an error message that the page cannot be displayed, the likely cause is that you do not have a default installation of Windows 2000 and IIS 5.0 on the target computer. The IIS Migration Wizard does not support target platforms without a default installation. You can try to correct the problem by making sure that the IIS Default Web Site responds to requests made to localhost. The wizard uses the address "localhost" when moving from Step 2 to Step 3. Use the following steps to address this problem.

  1. In the IIS snap-in on the target computer, make sure that the IP address of the Default Web Site is set to ALL UNASSIGNED.
  2. On the target computer, make sure that the IIS Default Web Site is running on port 80.
  3. On the target computer, make sure that the IIS Default Web Site is the ONLY Web site running on port 80.

Response.isClientConnected VBScript Error

If you get the following error message when running the wizard:

Microsoft VBScript runtime error '800a01b6'
Object doesn't support this property or method: 'Response.isClientConnected'

It could mean that you have an extra, outdated ASP DLL on your Windows NT source computer. To see if this is the case, on the source computer, open the \WINNT\system32\inetsrv folder. If you find a folder named ASP within it, take the following steps:

  1. Make sure that there is a file named asp.dll within the inetsrv folder, in addition to the ASP folder. If so, proceed with the remaining steps.
  2. In the Services program in Control Panel, stop the IIS Admin Service. This also stops the FTP, HTTP, and SMTP services.
  3. Back up the ASP folder and its contents to another location on your hard drive. In the unlikely case that the newer asp.dll didn't work properly, you could then restore the ASP folder to its original location.
  4. In the inetsrv folder, delete the ASP folder.
  5. In the Services program in Control Panel, restart the IIS Admin Service.
  6. Verify that script mappings are correct at each level on which you have defined an application. To do this, in the IIS snap-in, open the property sheets for each application root folder and click the Home Directory tab. Under Application Settings, click Configuration, and verify that the script mappings reference \inetsrv\asp.dll.
  7. In the Services program in Control Panel, restart the FTP, HTTP, and SMTP services.

Stalling on Netscape Source Servers

Sometimes the IIS Migration Wizard stalls while creating the migration archive on Netscape source servers. This occurs when the connection timeout value on the Netscape source server is too short. To correct this problem, use the Netscape Server Administrator to increase the value for HTTP Persistent Connection Timeout under Server Preferences/Performance Tuning.


IIS Migration Wizard Migrated Settings

This topic describes how the IIS Migration Wizard migrates configuration settings, called "properties" in IIS, from the source Web server to IIS 5.0.

Contents

  • Properties Migrated from IIS 4.0 and IIS 5.0
  • Configuration Settings Migrated from Apache HTTP Server
  • Configuration Settings Migrated from Netscape Enterprise Server

Properties Migrated from IIS 4.0 and IIS 5.0

When migrating from IIS 4.0, the IIS Migration Wizard migrates all of the metabase properties from the source Web site. For properties that are new with IIS 5.0, the wizard uses the IIS 5.0 defaults. When migrating from IIS 5.0, the IIS Migration Wizard migrates all of the metabase properties from the source Web site. The wizard does not migrate any registry settings. For more information about the migrated metabase properties, see migrate.txt, which is loaded into %winnt%\system32\inetsrv\iismu when the tool is installed:

Configuration Settings Migrated from Apache HTTP Server

This topic lists the core Apache HTTP Server 1.3 directives and indicates whether, and how, the IIS Migration Wizard migrates them to IIS metabase properties. This topic also explains how to configure each property in the IIS 5.0 snap-in. There is not a one-to-one correspondence between Apache and the IIS 5.0 configuration options: not all IIS 5.0 settings exist on Apache and, conversely, not all Apache settings exist on IIS 5.0. This topic does not cover IIS 5.0 properties that have no counterpart in Apache. For in-depth information on IIS 5.0 configuration parameters and metabase properties, see the "Administrator's Reference" topic in the IIS 5.0 online product documentation.

Note: As with Apache HTTP Server, IIS 5.0 supports hierarchical settings. IIS 5.0 can be configured at the server, virtual directory, and file level. The IIS Migration Wizard retains the scope of Apache settings when they are migrated to IIS 5.0.

Apache httpd.conf Directives and Corresponding IIS 5.0 Properties

Apache Directive | Wizard Migrates (Y/N) | IIS Metabase Property | IIS 5.0 Snap-in Configuration
AccessConfig | No | Not applicable | The wizard uses these parameters for mapping to the access configuration information. However, in IIS 5.0 there is no separate access configuration file.
BindAddress | Yes | ServerBindings | For multihoming, IIS 5.0 allows you to specify Virtual Hosts, or virtual servers. To configure a virtual server, right-click a Web site, choose Properties, and then select the Web Site tab. Click the Advanced button on the Web Site tab, and add the correct IP address and TCP port.
CacheNegotiatedDocs | No | Not applicable | You can specify an expiration date for content in a browser or proxy cache. To configure this setting, right-click a Web site, choose Properties, and then select the HTTP Headers tab. Select the Enable Content Expiration check box and enter expiration dates.
ErrorLog | No | Not applicable | All errors for the Inetinfo process are logged to the Windows 2000 Server Event Log and do not need to be specified in the Web server configuration. The wizard uses IIS 5.0 default log settings.
ExpiresActive | Yes | HttpExpires | In IIS 5.0 content expiration is disabled by default. To disable content expiration, right-click a Web site, choose Properties, select the HTTP Headers tab, and then clear the Enable Content Expiration check box.
ExpiresDefault | Yes | HttpExpires | In IIS 5.0 content expiration is off by default. To enable content expiration, right-click a Web site, choose Properties, and then select the HTTP Headers tab. Select the Enable Content Expiration check box, and then set the parameters.
Header | Yes | HttpCustomHeaders | To create a custom header, right-click a Web site, choose Properties, and then select the HTTP Headers tab. In the Custom HTTP Headers box, click Add, and then type a name and a value for the HEADer.
HostnameLookups | Yes | EnableReverseDNS | IIS 5.0 log files capture the IP addresses of Web site visitors. To look up the host name of a given IP address, enable the metabase property EnableReverseDns. To set IP address restrictions, right-click a Web site, click Properties, click the Directory Security tab, and then click the Edit button in the IP Address and Domain Name Restrictions box.
IdentityCheck | Yes | LogExtFileUserName | To log the identity of each Web site visitor, right-click a Web site, click Properties, and then click the Web Site tab. Select the Enable Logging check box, and then click Properties. Click the Extended Properties tab, and then select the User Name check box.
<IfDefine> | Yes | Not applicable | The wizard uses this information when parsing the Apache files.
Include | Yes | Not applicable | This directive is not needed in IIS 5.0.
KeepAlive | Yes | AllowKeepAlive, MaxConnections | In IIS 5.0, HTTP Keep-Alives are enabled by default. To disable Keep-Alives, right-click a Web site, choose Properties. On the Web Site property sheet, clear the HTTP Keep-Alives Enabled check box. You set the maximum number of connections and the connection time-out in this location as well.
KeepAliveTimeout | Yes | Connection Timeout | To set the Keep-Alive time-out, right-click a Web site, choose Properties. In the Connections box on the Web Site property sheet, select the Limited To radio button, and then type the seconds until a timeout in the Connection Timeout text box.
Listen | Yes | ServerBindings | IIS 5.0 allows you to specify a port for named-based virtual hosts. To configure this setting, right-click a Web site, choose Properties. On the Web Site property sheet, click the Advanced button, and then enter the TCP port number.
ListenBacklog | Yes | ServerListenBacklog | This is a service-level property, and it cannot be configured from the MMC.
MaxClients | Yes | MaxConnections | To configure this property, right-click a Web site, choose Properties, and then select the Web Site tab. Select the Unlimited or the Limited To radio button. For limited connections, in the Connection Timeout text box, specify the number of seconds before a connection should time out.
MaxKeepAliveRequests | No | Not applicable | There is no equivalent in IIS 5.0.
MaxRequestsPerChild | No | Not applicable | IIS 5.0 uses a limited number of processes, and there is no need to set the maximum number of requests per child process as there is with Apache.
Min/MaxSpareServers | No | Not applicable | IIS 5.0 uses a limited number of processes, and there is no need to account for their number.
NameVirtualHost | Yes | ServerBindings | An Apache virtual host corresponds to an IIS 5.0 Web Site. In IIS 5.0, you can create virtual hosts either by using multiple IP addresses or by using a single IP address and HTTP 1.1 Host Header Names. To create a virtual host with a unique IP address, right-click a Web site, choose Properties, and then select the Web Site tab. Click the Advanced button and specify the IP address. To specify a host HEADer name for a named-based virtual host, right-click a Web site, and then choose Properties. On the Web Site property sheet, click the Advanced button and enter the Host Header Name for to the IP address you want to use.
PidFile | No | Not applicable | IIS 5.0 does not offer the option to log its process ID to a file.
Port | Yes | ServerBindings | To set the port to which your Web server should listen, right-click a Web site, choose Properties, and then select the Web Site tab. Enter a port number in the TCP Port box.
Proxy Cache Parameters | No | Not applicable | IIS 5.0 cannot function as a proxy server on its own. Microsoft® Proxy Server is recommended as a proxy server for use with Windows 2000 Server.
ProxyRequests | No | Not applicable | See the previous note for Proxy Cache Parameters.
RlimitCPU | Yes | CpuLimit* | IIS 5.0 has a number of properties that specify CPU throttling parameters. To specify performance parameters in the IIS 5.0 snap-in, right-click a Web site, choose Properties, click the Performance tab, and then choose the settings you want.
ScoreBoardFile | No | Not applicable | IIS 5.0 does not have a Scoreboard file.
ServerAdmin | No | Not applicable | IIS 5.0 does not have a configuration setting for displaying the administrator's name and contact information. You can add this information to your pages by using ASP.
ServerAlias | Yes | ServerBindings | IIS 5.0 allows you to specify a host header name for a named-based virtual host. To configure this setting, right-click a Web site, and then choose Properties. On the Web Site property sheet, click the Advanced button and enter the Host Header Name for to the IP address you want to use.
ServerName | No | Not applicable | The host name for your Web server is stored in your Domain Name System (DNS) server and is not required in IIS 5.0 configuration properties. However, you must specify an IP address and HTTP port in order for IIS 5.0 to serve content.
ServerPath | Yes | Path | This directive is migrated to the Path property of the IIS Virtual Directory object. This property defines the path from a virtual directory to its corresponding physical directory. You configure this property in the IIS 5.0 snap-in when you create a new virtual directory, by specifying from which directory the content is to be served.
ServerRoot | Yes | Not applicable | The wizard uses this information for parsing Apache files, but IIS 5.0 does not have the same concept of server root and does not have a corresponding property.
ServerType | No | Not applicable | IIS 5.0 always runs in standalone mode. Once IIS 5.0 is started its process remains in memory and listens to the specified HTTP port. You can't configure IIS 5.0 to dynamically load as with an inetd server on Apache.
StartServers | No | Not applicable | See the previous note for Min/MaxSpareServers.
Timeout | Yes | ConnectionTimeout | You can specify the maximum amount of idle time to elapse before your server drops a connection. To configure this setting, right-click a Web site, choose Properties, and then select the Web Site tab. Enter the maximum timeout value in the Connection Timeout box.
TransferLog | No | Not applicable | IIS 5.0 does not use a transfer log.
User/Group | No | Not applicable | When IIS 5.0 is installed, it creates by default the IWAM user account under which the server runs. You must be logged in as an administrator or operator in order to start and stop the IIS 5.0 service, but the process does not retain your permissions.
<VirtualHost> | Yes | Not applicable | For each Apache virtual host, the wizard creates a new IIS virtual Web site. It migrates the directives contained between the <Virtual Host> tags, including server bindings, and applies them to the Web site. You might need to correct the IP address of the new Web site following migration.

Apache srm.conf Directives and Corresponding IIS 5.0 Properties

Apache Directive | Wizard Migrates (Y/N) | IIS Metabase Property | IIS Snap-in Configuration
AccessFileName | Yes | Not applicable | The wizard uses these parameters for mapping access configuration information. However, in IIS 5.0 there is no separate access configuration file. IIS 5.0 security is integrated with Windows 2000 security. To limit access to a site or directory by user, you must configure a new user account in the Windows 2000 Server User Manager. You also can classify individuals or groups as "Web site operators" with limited authority to administer a Web site. They do not have to be Windows 2000 Administrators. To define Web site operators, in the IIS 5.0 snap-in, right-click a Web site, click Properties, and then click the Operators tab.
AddDescription | No | Not applicable | There is no corresponding property in IIS 5.0.
AddEncoding | Yes | MimeMap | To map a file extension to a Multipurpose Internet Mail Extensions (MIME) type, right-click a Web site, choose Properties, and then select the HTTP Headers tab. In the Mime Map box, click File Types, and then click New Type. Or, to edit an existing MIME type, select a file type in the list, and then click Edit. Type the file extension and associated MIME type in the appropriate boxes.
AddIcon | No | Not applicable | IIS 5.0 uses the standard Windows 2000 icons when displaying a directory. You cannot specify a substitute icon.
AddLanguage | No | Not applicable | There is no corresponding property in IIS 5.0.
AddType | Yes | MimeMap | To add MIME types, right-click a Web site, choose Properties, and then select the HTTP Headers tab. In the Mime Map box, click File Types, click New Type. Type the file extension and the associated MIME type in the appropriate boxes.
Alias | Yes | Not applicable | The wizard creates a Virtual Directory object for each Apache alias and applies the appropriate parameters by configuring corresponding metabase properties. To create a virtual directory, right-click the FTP or Web site, click New, and select Virtual Directory. Use the New Virtual Directory Wizard to complete this task.
AliasMatch | Yes | Not applicable | There is no direct equivalent in IIS 5.0 because there is no concept of regular expressions. The wizard creates a corresponding Virtual Directory object. See the previous note for Alias.
DefaultIcon | No | Not applicable | Windows 2000 Server offers a standard default icon for file types that do not have a preset icon in the file system.
DefaultType | Yes | MimeMap | IIS 5.0 contains a comprehensive list of MIME types. You can add new MIME types to the list should you need to serve a new MIME type. To view default MIME types, right-click a Web site, choose Properties, and then select the HTTP Headers tab. Click the File Types button in the MIME Map section of the tab.
DirectoryIndex | Yes | EnableDirBrowsing | You can configure IIS 5.0 to allow directory browsing. To configure this setting, right-click a Web site, choose Properties, select the Home Directory tab, and then select the Directory Browsing check box. IIS 5.0 does not allow you to specify a prewritten HTML document as a directory index.
DocumentRoot | Yes | Path | The wizard migrates this directive to the Path property of the IIS Root object. This property defines the path from a Web site home directory to its corresponding physical directory. To configure this property, right-click a Web site, choose Properties and select the Home Directory tab. Then specify the location of the home directory (document root).
ErrorDocument | Yes | HttpErrors | To enable custom error messages, right-click a Web site, choose Properties, and then select the Custom Errors tab. In cases where the custom error page is a standard HTML page, you need to only copy the file to the IIS 5.0 system to complete the migration. In the case of CGI custom errors, you need to test the CGI scripts after moving them to IIS 5.0.
FancyIndexing | No | Not applicable | IIS 5.0 offers default indexing only.
HeaderName | No | Not applicable | There is no corresponding property in IIS 5.0.
IndexIgnore | No | Not applicable | There is no corresponding property in IIS 5.0.
LanguagePriority | No | Not applicable | There is no corresponding property in IIS 5.0.
MetaDir | No | Not applicable | You do not need to specify a Meta Directory to serve HTTP Header information. To specify custom HTTP headers, right-click a Web site, choose Properties, select the HTTP Headers tab, and then click Add. Specify a header name and value in the appropriate boxes.
MetaSuffux | No | Not applicable | See the previous note in MetaDir.
ReadmeName | No | Not applicable | IIS 5.0 does not specify a default name for Readme files.
Redirect | Yes | HttpRedirect | To redirect a request to another resource, right-click a Web site, choose Properties, select the Home Directory tab, and then select A redirection to a URL. Type the URL in the Redirect to text box.
RedirectTemp | Yes | HttpRedirect | In IIS 5.0, redirections are temporary by default.
RedirectPermanent | Yes | HttpRedirect | To make a redirection permanent, follow the steps given for Redirect earlier in this document. In addition select the A permanent redirection for this resource check box after typing the URL.
ResourceConfig | Yes | Not applicable | The wizard uses this information, but it does not directly translate to an IIS 5.0 property.
ScriptAlias | Yes | Not applicable | The wizard creates a Virtual Directory object using the Apache path information sets the IIS AccessExecute property to true. Any virtual directory can execute scripts when the "Allow Scripts" permission is enabled in the IIS 5.0 snap-in. To configure this property, right-click a Web site, choose Properties, select the Home Directory tab, and then select the Scripts only or the Scripts and Executables option in the Execute Permissions box.
TypesConfig | Yes | MimeMap | The wizard adds specified mime types to the IIS 5.0 MIME map. To view or configure MIME types, right-click a Web site, choose Properties, and then select the HTTP Headers tab. Click the File Types button in the MIME Map section of the tab.
UserDir | No | Not applicable | IIS 5.0 does not offer a default directory for ISP user httpd directories. You must create a virtual directory for each user in the IIS 5.0 snap-in, and then point it to the user directory in Windows Explorer.

Apache access.conf Directives and Corresponding IIS 5.0 Properties

Apache Directive | Wizard Migrates (Y/N) | IIS 5.0 Metabase Property | IIS 5.0 Snap-in Configuration
AllowOverride | Yes | Not applicable | The wizard uses this information to parse the access configuration files. However, IIS 5.0 utilizes Windows 2000 security to restrict access to a site so htaccess files are not necessary to control access. Note that in IIS 5.0 you can classify individuals or groups as "Web site operators" with limited authority to administer a Web site. They do not have to be Windows 2000 Administrators. To define Web site operators, in the IIS 5.0 snap-in, right-click a Web site, click Properties, and then click the Operators tab.
AuthDBGroupFile | No | Not applicable | The IIS Migration Wizard does not directly migrate this information, but uses it to create the Users file for use with Addusers.exe. Following migration, you must reconfigure all security on IIS 5.0.
AuthDBUserFile | No | Not applicable | See previous note for AuthDBGroupFile.
AuthDBMGroupFile | No | Not applicable | See previous note for AuthDBGroupFile.
AuthDBMUserFile | No | Not applicable | See previous note for AuthDBGroupFile.
AuthName | No | Realm | See previous note for AuthDBGroupFile.
AuthType | No | AuthBasic | In Apache, AuthType is usually set to Basic. The corresponding IIS 5.0 metabase property is AuthBasic. To configure authentication, right-click the virtual directory for which you want to set authentication, click Properties, and then click Directory Security. In the Enable anonymous access and edit the authentication methods for this resource box, click Edit, and then choose an authentication method.
<Directory> | Yes | Not applicable | The wizard migrates defined directives enclosed in this tag to the corresponding IIS 5.0 virtual directory.
<DirectoryMatch> | Yes | Not applicable | The wizard migrates defined directives enclosed in this tag to the corresponding IIS 5.0 virtual directory.
<Files> | Yes | Not applicable | The wizard migrates defined directives enclosed in this tag to the corresponding IIS 5.0 virtual directory.
<FilesMatch> | Yes | Not applicable | The wizard migrates defined directives enclosed in this tag to the corresponding IIS 5.0 virtual directory.
<Limit> | No | Not applicable | There is no equivalent in IIS 5.0.
<LimitExcept> | No | Not applicable | There is no equivalent in IIS 5.0.
<Location> | Yes | Not applicable | The wizard migrates defined directives enclosed in this tag to the corresponding IIS 5.0 virtual directory.
<LocationMatch> | Yes | Not applicable | The wizard migrates defined directives enclosed in this tag to the corresponding IIS 5.0 virtual directory.
Options, ExecCGI | Yes | AccessExecute | You can set most of the IIS 5.0 equivalents of the Options parameter by enabling execution or scripts permissions for any virtual directory. To do this, in the IIS 5.0 snap-in, right-click the directory for which you want to set permissions, and then click Properties. Click the Home Directory tab, and then set permissions in the Execute Permissions box.
Options Indexes | Yes | EnableDirBrowsing | To enable users to view directory contents, in the IIS 5.0 snap-in, right-click the directory for which you want to enable browsing, and then click Properties. Click the Home Directory tab, and then select the Directory browsing check box.
Server status reports | No | Not applicable | IIS 5.0 does not provide server status reports.

Migrating Custom Modules

In Apache, custom modules extend the capabilities of the Web server. With IIS 5.0, there are a number of options for extending server capabilities. There is no direct way to migrate a custom module, so it must be recreated on IIS 5.0 using one of the following approaches:

  • ASP with COM components or ISAPI DLLs can be written to duplicate most of the desired functionality, such as database or file system access. There are a number of built-in ASP objects to speed this task, such as FileSystemObject, which provides the methods, properties, and collections you use to access the file system.
  • ISAPI filters allow you to implement custom authentication and logging, as well as URL rewriting, or "munging.". For more information on using ISAPI filters to extend IIS 5.0 security, see "Security" in the Internet Information Services 5.0 Resource Guide.

For more information about using these technologies, see the IIS 5.0 section of the SDK documentation on Internet MSDN Online.

Configuration Settings Migrated from Netscape Enterprise Server

The tables in this section list Netscape Enterprise Server 3.5 (NES) settings and indicate whether or not the IIS Migration Wizard migrates the setting and where the setting is found in IIS 5.0. Each heading within this section corresponds to a tab within the NES Server Manager.

Note: IIS 5.0 configuration settings, or properties, can be set on the server, site, directory, or even file level. Most NES settings apply to the site level only.

NES Server Preferences and Corresponding IIS 5.0 Properties

NES Configuration Setting | Migrated by Wizard? Y/N | IIS Metabase Property | IIS Snap-in Configuration
Bind To Address | Yes | ServerBindings | Right-click a Web site, click Properties, and then click the Web Site tab. The setting appears in the IP Address box.
Convert 2.0 ACL file | No | Not applicable | There are no settings to migrate.
Dynamic Configuration Files | No | Not applicable | In IIS 5.0 you can classify individuals or groups as "Web site operators" with limited authority to administer a Web site. They do not have to be Windows 2000 Administrators. To define Web site operators, in the IIS 5.0 snap-in, right-click a Web site, click Properties, and then click the Operators tab.
Enable DNS | No | Not applicable | In IIS 5.0 you can restrict access by domain name. This feature can have a significant negative effect on server performance, however.
Encryption | No | Not applicable | You can install a server certificate and enable encryption by using the Security Task wizards.
Error Responses | Yes | HttpErrors | When migrating a custom error page that is a standard HTML page, you need only copy the file to the IIS 5.0 system to complete the migration. In the case of CGI custom errors, you need to test the CGI scripts after moving them to IIS 5.0. To enable custom error messages in the IIS 5.0 snap-in, right-click a Web site, choose Properties, and then select the Custom Errors tab.
HTTP Persistent Connection Timeout | Yes | ConnectionTimeout | Right-click a Web site, click Properties, and then click the Web Site tab. The setting appears in the Connection Timeout box.
Maximum Simultaneous Requests | Yes | MaxConnections | Right-click a Web site, click Properties, and then click the Web Site tab. The setting appears in the Limited To box.
MIME Types | Yes | MimeMap | Right-click a Web site, click Properties, click the HTTP Headers tab, and then select the File Types button.
MTA Host and NNTP Host | No | Not applicable | Windows 2000 Server includes SMTP and NNTP services. For more information, see Windows 2000 Server Help.
On/Off | No | Not applicable | Select a Web site you want to stop or start, and then click the Stop or Start toolbar button.
Restore Configuration | No | Not applicable | IIS 5.0 supports configuration backup. To back up the IIS 5.0 metabase, in the IIS 5.0 snap-in, right-click the computer name, choose Backup/Restore Settings, click Backup, type a name for the backup file, and then click OK.
Restrict Access | No | Not applicable | IP address restrictions are not migrated because they are defined differently on IIS 5.0. To set IP address restrictions, right-click a Web site, click Properties, click the Directory Security tab, and then click the Edit button in the IP Address and Domain Name Restrictions box.
Server Name | Yes | ServerBindings | The setting is migrated to a Host Header name. For information on this feature, see the "Naming Web Sites" topic in the IIS 5.0 online product documentation.
Server Port | Yes | ServerBindings | Right-click a Web site, click Properties, and then click the Web Site tab. The setting appears in the TCP Port box.

NES Application Settings and Corresponding IIS Properties

IIS 5.0 supports CGI, ISAPI, and ASP-based applications. CGI applications can be ported directly to run on IIS 5.0, or they can be converted to ISAPI or ASP.

NES Configuration Setting | Migrated by Wizard? Y/N | IIS Metabase Property | IIS Snap-in Configuration
CGI Directory | Yes | Not applicable | The wizard creates a CGI virtual directory and enables CGI Execute permission.
CGI File Type | No | Not applicable | There is no corresponding property in IIS 5.0.
Java | No | Not applicable | The Java virtual machine is already enabled on IIS 5.0, so there is no need to migrate this setting.
Query Handler | No | Not applicable | There is no corresponding property in IIS 5.0.
Server Side JavaScript | No | Not applicable | IIS 5.0 includes server-side support for JScript and VBScript. There is no need to migrate a switch setting for these languages.
ShellCGI Directory | Yes | Not applicable | The wizard creates a ShellCGI virtual directory and enables CGI Execute permission.
URL Prefix | Yes | Not applicable | The wizard creates a corresponding virtual directory.
WAI Management | No | Not applicable | This setting has to do with the Internet Inter-ORB Protocol (IIOP); IIS 5.0 uses the COM and DCOM object models.
WinCGI Directory | No | Not applicable | WIN CGI is not supported in IIS 5.0.

NES Server Logging and Corresponding IIS 5.0 Properties

NES Configuration Setting | Migrated by Wizard? Y/N | IIS 5.0 Metabase Property | IIS 5.0 Snap-in Configuration
Archive Log | No | Not applicable | There are no settings to migrate. When you set your logging preferences on IIS 5.0, you can use Windows 2000 Backup or other third-party backup tools to archive the log files and remove them from the server as appropriate.
Generate Report | No | Not applicable | There are no settings to migrate. You can customize and extend IIS 5.0 logging in the IIS 5.0 snap-in. You can set viewing options and filters in the Windows 2000 Server Event Viewer.
Log Preferences | Yes | Not applicable | Basic log file settings are migrated, but due to differences in logging methods, you should review the settings created in IIS 5.0 to make sure they are optimal for your new environment.
Log Client Accesses | Yes | LogType | See previous note for Log Preferences.
Record Domain Names/IP Addresses | Yes | LogExtFileClientlp, LogExtFileComputerName | See previous note for Log Preferences.
Format | No | Not applicable | There is no corresponding property in IIS 5.0.
Monitor Current Activity | No | Not applicable | There are no settings to migrate. To monitor server activity on IIS 5.0, use the Windows 2000 Server System Monitor to evaluate performance and resource consumption.
Simple Management Network Protocol (SNMP) Sub-Agent Configuration | No | Not applicable | There is no corresponding property in IIS 5.0.
Rotate Log | Yes | LogFilePeriod | See previous note for Log Preferences.
View Access Log | No | Not applicable | There are no settings to migrate. You can view access logs from the Windows 2000 Server Event Viewer.
View Error Log | No | Not applicable | There are no settings to migrate. You can view error logs in the Windows 2000 Server Event Viewer.

Configuration Styles

The settings under this heading are not migrated to IIS 5.0. IIS 5.0 includes support for property inheritance, which achieves much the same result as configuration styles. In the IIS 5.0 snap-in, you can right-click the server and set global properties for the WWW Service. Every new Web site created on the server inherits these properties. Similarly, when you set properties for a Web site, directories created for the site inherit site properties.

NES Content Management and Corresponding IIS 5.0 Properties

NES Configuration Setting | Migrated by Wizard? Y/N | IIS 5.0 Metabase Property | IIS 5.0 Snap-in Configuration
Document Footer (Footer Text) | Yes | DocFooter | You can specify a document footer for the entire IIS 5.0 server, for a single Web site, or for a directory. To configure this setting, right-click the server, a Web site, or a directory; click Properties; and then click the Documents tab.
Additional Document Directories (URL Prefix, Map to Directory) | Yes | Not applicable | The wizard creates a corresponding virtual directory. You can use the New Virtual Directory Wizard to create a virtual directory. To start the wizard, select the Web site for which you want to define a virtual directory), click the Action button, point to New, and then select Virtual Directory.
Cache Control Directives | No | Not applicable | By default, in IIS 5.0 HTML pages are cached by proxy servers. The default value for ASP pages is "private," meaning they cannot be cached, and you can use the Response object to control whether a proxy server caches the page.
Default MIME Type | No | Not applicable | IIS 5.0 contains a comprehensive list of MIME types. You can add new MIME types to the list should you need to serve a new MIME type. To view or edit MIME types, right-click a Web site, choose Properties, and then select the HTTP Headers tab. Click the File Types button in the MIME Map section of the tab.
Directory Indexing | Yes | EnableDirBrowsing | If you have selected "Simple" or "Fancy" directory indexing, the IIS Migration Wizard sets the Directory Browsing Allowed setting. To configure this setting, right-click a Web site, click Properties, and then click the Home Directory tab.
Hardware Virtual Servers (IP Address, Document Root) | Yes | ServerBindings | This is migrated as a component of ServerBindings. To configure a virtual server, right-click a Web site, choose Properties, and then select the Web Site tab. Click the Advanced button, and add the IP address and TCP port.
Home Page/Index File | Yes | DefaultDoc | If a home page is listed, it is migrated to IIS 5.0 as the default document name, ahead of any documents with index file names (according to the Index Filenames setting also found in this table). If no home page is listed, any specified index file names are set as the default documents.
Index Filenames | Yes | DefaultDoc | See the previous description of the "Home Page/Index File" setting.
International Characters | No | Not applicable | With ASP pages, you specify the character set by using the Response.Charset property.
Parse Accept Language Header | No | Not applicable | Microsoft® Indexing Services can interpret this header in order to determine the language in which a query is being written.
Parse HTML | No | Not applicable | By default IIS 5.0 processes files with .stm, .shtm, or .shtml file name extensions. For information on enabling and using server-side includes, see "About Server-Side Includes" in the IIS 5.0 online product documentation.
Primary Document Directory | Yes | Not applicable | The wizard creates a corresponding virtual directory. You can use the New Virtual Directory Wizard to create a virtual directory. To start the wizard, select the Web site for which you want to define a virtual directory, click the Action button, point to New, and then select Virtual Directory.
Software Virtual Servers (URL Host, Home Page) | Yes | ServerBindings | In IIS 5.0, you can assign any number of sites to a single IP address and distinguish them by using host headers, but no special term is employed to describe them. To configure a virtual server by using host headers, right-click a Web site, and then choose Properties. On the Web Site property sheet, click the Advanced button and enter the host header name for to the IP address you want to use.
URL Prefix, Forward Requests To | Yes | HttpRedirect | This is called "redirection" in IIS 5.0. To redirect a request to another resource, right-click a Web site, choose Properties, select the Home Directory tab, and then select A redirection to a URL. Type the URL in the Redirect to box.

Web Publishing

The wizard does not migrate Web publishing settings. Web publishing can be supported with client-side development and management tools such as Microsoft® FrontPage® (a member of the Microsoft® Office family) and Microsoft® Visual InterDev™.

Agents and Search

The wizard does not migrate Agents and Search settings. Index Services, included with Windows 2000 Server, provides index and search capabilities. For more information, see Windows 2000 Server Help.

Auto Catalog

The wizard does not migrate Auto Catalog settings. As with Agents and Search settings, IIS 5.0 uses Index Services to build a searchable catalog of information about the content of the Web site.


IIS Permissions Wizard Template Maker

IIS Permissions Wizard Template Maker NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

IIS Permissions Wizard Template Maker assists in the creation of new permissions templates for use with Microsoft® Internet Information Services (IIS), version 5.0 and greater. Permissions Templates are a collection of Access Control permissions, Authentication Methods, and IP Address Restrictions properties that can be applied to an internet site. Stored in the metabase with other IIS settings, templates make it easy to change the security configuration of a site without editing individual properties.

The Permissions Wizard takes a scenario-driven approach in setting up Web and FTP permissions, NTFS access permissions, and authentication schemes. Rather than setting each area with a separate user interface, you select the scenario that most closely resembles your site's needs and the wizard sets all of the access permissions and authentication schemes for you.

One of the great advantages of this is that the wizard will ensure that Web (or FTP) and NTFS permissions are properly coordinated and that the correct authentication scheme is used. All of the settings can later be changed in the IIS snap-in.

Installing the IIS Permissions Wizard

The IIS Permissions Wizard is not installed during Windows 2000 Resource Kit installation. To install it, use the following procedure:

To install the IIS Permissions Wizard

  1. Insert the Microsoft Windows 2000 Resource Kit CD in your CD-Rom drive.
  2. When the setup screen appears, click Browse this CD.
  3. In the <cdroot>\apps\iispermwizard\x86 directory, double-click setup.exe.
  4. Follow the directions that appear on your screen.

Files Required

The files required for IIS Permissions Wizard Template Maker are located on your Microsoft® Windows® 2000 Resource Kit CD-ROM.

For More Information

See TempMake.txt in the <cdroot>\apps\iispermwizard\docs directory of the Microsoft® Windows® 2000 Resource Kit CD-ROM.


Internet Scanner

Internet Scanner from Internet Security Systems

Internet Scanner is a Microsoft® Windows® 2000 and UNIX network security scanner. It investigates and analyzes your network environment for selected security vulnerabilities, simulating the techniques of skilled vulnerability analysts and network security engineers. Depending on the reporting options you select, Internet Scanner gives you information about each detected vulnerability, including its location, detailed description, and suggested corrective actions.

Internet Scanner can be used on all TCP/IP-based networks (networks connected to the Internet) as well as on stand-alone networks and computers. You should run Internet Scanner periodically to test the security of network devices and the integrity of the network. This is to detect newly introduced weaknesses and changes in the network.

Internet Scanner Topics

  • Installing Internet Scanner

Files Required

  • Iisnt.exe
  • Iis_NT.hlp

For more information

For more information, see the Internet Scanner online Help file. After installing the tool on your hard disk, click Start, point to Programs, point to Internet Scanner, and then click Scanner Help.


Installing Internet Scanner

Internet Scanner is not installed by the Windows 2000 Resource Kit setup program. To install it, use the following procedure:

To install Internet Scanner

  1. Insert the Windows 2000 Resource Kit CD into your CD-ROM drive.
  2. When the Setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\InternetScanner directory, double-click Setup.exe.
  4. Follow the directions that appear on your screen.

Once you have installed Internet Scanner, click Start, point to Programs, point to Internet Scanner, and then click Internet Scanner to run the tool.


Metabase Editor: Metaedit.exe

Metaedit.exe: Metabase Editor NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Metabase Editor is a tool that allows you to browse and modify attributes in the IIS metabase. It is similar in functionality to Regedit.exe. This tool also allows you to backup, restore, import, and export the metabase; and add, modify, rename, and delete metabase keys.

Metabase Editor includes the following features:

  1. Metabase Browser/Editor
  2. Metabase Consistency Checker

Caution

While using Metabase Editor it is possible to make changes that could damage your IIS configuration. Be sure to edit all entries carefully.

About Metabase Consistency Checker

Metabase Consistency Checker performs the following tasks:

  • Checks for incorrect data
  • Validates package Class IDs (CLSIDs) against the registry
  • Ascertains whether the schema exists
  • Checks for case-sensitivity issues
  • Checks for unknown properties
  • Checks for missing mandatory properties
  • Evaluates branch size (and gives warnings if branch is very large, for example, big blob)
  • Checks some hard-coded cases (such as an application that must have a Component Services package)
  • Checks for /root/ in all w3svc/1/xxxx paths

Metabase Consistency Checker will not repair data, as this is a task for Metabase Browser/Editor. Also, if Metabase Consistency Checker finds more than 100 errors, it returns a "Too many errors" message for the 101st error.

For More Information

For more information on editing, viewing, and troubleshooting your IIS configuration with Metabase Editor, see the Metabase Editor online Help file (Metaedit.chm), located in the directory where you install the tool (by default, in C:\Program Files\Metaedit).

Metabase Editor Topics

  • Installing Metabase Editor

Files Required

  • Metaedit.cab
  • Setup.exe
  • Setup.lst

Note

The files required by MetaEdit are located in the <cdroot>\Apps\Metaedit directory of the Windows 2000 Resource Kit companion CD. See Installing MetaEdit for information on installing and running the application.


MetaEdit_Installing

Metabase Editor: Metaedit.exe

Installing Metabase Editor

To install Metabase Editor

  1. Start Windows 2000. Note that you must log on as a member of the Administrator group to install Metabase Editor.
  2. Insert the Windows 2000 Resource Kit CD into your CD-ROM drive.
  3. When the Autorun screen appears, click Explore the CD.
  4. Browse to <cdroot>\apps\metadit.
  5. Click setup.exe to initiate the Metabase Editor setup.
  6. Follow the instructions that appear on your screen.

Starting the tool

Once the tool is installed, click Start, point to Programs, and then click MetaEdit 2.0 to run the tool.

The MetaEdit files are installed to a user-defined installation directory during setup. If no directory is defined, the files are installed in the following directory:

Program Files\MetEdit


Perfcheck.dll: Performance Counter Check

Perfcheck.dll: Performance Counter Check NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This tool allows the user to easily verify performance counters from within Microsoft® Windows Script Host or from within an ASP page.

For simplicity, the tool just handles one performance counter at a time. If you want to monitor multiple counters simultaneously, you must instantiate the object for each counter you want to monitor. Performance Counter Check is simple to use: just set the object "counter" member equal to the desired counter path and retrieve the object "value" member.

Notice that the counter path is \\Object(Instance)Counter.
You can find these in Performance Monitor when you access the Add dialog box.

PerfCheck Topics

  • Performance Counter Check Setup
  • Performance Counter Check Samples

File Required

  • Perfcheck.dll


Performance Counter Check Setup

The Performance Counter Check file (Perfcheck.dll) is installed by the Windows 2000 Resource Kit automated setup program. To use the tool you must register and start the PerfCheck.dll, using the following procedure:

To register Performance Counter Check

  • On a command line, change directories to the directory where you installed the Resource Kit, and then type:

    regsvr32 perfcheck.dll


PerfCheck Samples

Performance Counter Check Samples

JScript sample for Windows Script Host:

var bar = WScript.CreateObject("IISSample.PerfCheck.1");
var value;

value = bar.counter("\\Process(inetinfo)\\ID Process");
WScript.Echo(value);
WScript.DisconnectObject(bar);

JScript sample for an Active Server Pages (ASP) page:

<script language=JScript runat=server>
var bar = Server.CreateObject("IISSample.PerfCheck.1");
var value;

value = bar.counter("\\Process(inetinfo)\\Thread Count");
Response.Write(value);
Response.Write("<br>done<br>");
</script>

VBScript sample for an ASP page:

<script language=VBScript runat=server>
set bar = Server.CreateObject("IISSample.PerfCheck.1")

value = bar.counter("\Process(inetinfo)\ID Process")
Response.Write value
Response.Write "<br<done<br>"

value = bar.counter("\Process(inetinfo)\Thread Count")
Response.Write value
Response.Write "<br>done<br>"
</script>

Note

It is important to consider security issues when accessing IIS-specific counters. When using this object from an ASP page, the page must use integrated Windows authentication so that the object is not running as IUSR_... or IWAM_... This authentication method limits those with access to the metabase to the counter information. The solution to this is to disable anonymous access to the resource by clearing the Allow Anonymous Access check box in the Directory Security tab for the resource's directory. This is not an issue for Windows counters, but rather for IIS-specific counters such as ASP counters, FTP counters, and Web Service counters.


Playback.exe

Playback.exe: Playback NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

The Playback tool records requests coming into your Microsoft® Internet Information Services (IIS) site and allows them to be played back against the same or another IIS server that mirrors the original server's content. The tool consists of two key parts:

  • Recorder.dll - an ISAPI Filter that records the traffic to your web site and creates a log file.
  • Playback.exe - a command-line tool that is used to play back the traffic recorded by Recorder.dll.

Playback is not a stress tool. It is a simulation tool that is designed to reproduce request traffic as closely as possible. Playback can work in conjunction with stress tools such as the Web Application Stress Tool, assisting in scenarios such as the following:

  • Real world simulation - capture traffic in a production environment and play it back in a test environment.
  • Deployment testing - capture some traffic from an IIS 3.0 or 4.0 site and play it against an IIS 5.0 computer that has the original computer's content mirrored. This will help to ensure that IIS 5.0 can cleanly run your application under a real world load.
  • User scenarios - record user scenarios and play them back as regression testing.
  • Capacity Planning - record traffic in a production site and tune servers using real-world load in a testing environment.

Playback Topics

  • Installing Playback
  • Using Playback
  • Playback Syntax
  • Playback Example
  • Playback Technical Notes
  • Troubleshooting Playback

Files Required

  • Playback.exe
  • Lkhash.dll
  • Recorder.dll

Note

Playback.exe and Recorder.dll are installed in the user-defined installation directory during Windows 2000 Resource Kit setup. Lkhash.dll is installed in the <windir>\system32 directory.


Installing Playback

To install and run Playback, you must be running Windows 2000 Server, and the following components must also be installed:

  • Internet Information Services

For information on installing these services, see the Windows 2000 product documentation.

Installation Instructions

The Playback tool consists of two components, Recorder.dll (an ISAPI Filter) and Playback.exe, a command-line executable file. These files are installed to the user-definable installation directory during Windows 2000 Resource Kit setup. In order to start and run the tool, however, a series of post-installation steps must be followed.

To register and start the Recorder ISAPI Filter.

  1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager.
  2. In the left column of the IIS snap-in, right-click the computer name and select Properties.
  3. In the Master Properties drop-down box, make sure WWW Service is selected.
  4. Click Edit for the WWW Service master properties.
  5. Select the ISAPI Filters tab and click Add.
  6. Type in a filter name (for example, Recorder) and the path to the directory where the associated file is installed (usually the Resource Kit installation directory).
    For Recorder, select Recorder.dll. For Playback, select Playback.exe.
  7. Click OK to close each dialog box.
  8. In the IIS snap-in, right-click the computer name, and in the menu, click Restart IIS.
  9. Click OK.

Once the Recorder ISAPI filter has been started, all traffic coming through the filter will be logged.


Using Playback

Recording

After installing the tool and re-starting IIS, the Recorder (recorder.dll) creates the following directory, unless the registry value has been changed:

system32\LogFiles\Replay

The Recorder records all the request traffic coming into IIS. The filter creates custom log file(s) in a directory specified in the registry. For information about configuring the registry entry for Playback, see Configurable Options.

The recorder filter logs the request at two different times, depending on the mode you select. In the validation mode the request information is recorded before IIS logs the data (during a SF_NOTIFY_LOG event). The server status code is known at this time, so during playback the client can validate this value to give some indication everything is going as expected (this isn't always accurate because of the vast number of potential responses given the server state).

In the test mode the request data is recorded during SF_NOTIFY_READ_RAW_DATA. This necessitates two files being created, since data comes in asynchronously. During playback the client will indicate that no requests can be validated. This is expected. This feature is an attempt to log any requests before IIS has had a chance to begin working on it. It will make reproducing certain types of problems easier. This mode will not be used in most cases since validation gives more useful information.

The recorder filter creates the following file(s):

ReplayYYYYMMDD.log
In the validation mode only this file is created, and all the information for each request is written to it.
ReplayYYYYMMDD.data
This file is created in test mode, and holds any extra body information related to a request

Note

You must keep these two files together for playback; otherwise the client will be unable to create the request and will exit.

After you have recorded some traffic you must stop IIS. If you want to restart IIS so it continues to service requests, copy the above the log file(s) to another directory or drive for playback before restarting.

Note

The recorder captures everything that comes in on every request, so the logs generated can be very large (depending on the type of traffic and what your log configuration is, they can run about 15 times larger than the standard IIS log). Initially, try small captures and playing them back to see how things work. Expand your capture times as appropriate.

Configurable Options

Registry entries reside in the following location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Replay\.

The following is a description of registry entries for the IIS Playback tool:

  • CookieExpiration - when the Playback cookie expires.
  • CookieName - the Playback cookie name.
  • CookiePath - the Playback cookie path (using a frontslash (/) effectively makes it work on all paths)
  • ReplayCompress - future feature
  • ReplayLogOrder - Log order (1 = validation [default] or 0 = test mode).
  • ReplayLogFileName - the name of the log file
  • ReplayLogFilePath - The path to the location where you want the log files to be created (the default is: system32\LogFiles\Replay).

Caution

Be careful about using net locations as this can have a negative effect on performance.

SessionTimeout - time out of a Playback user.

Note

The SessionTimeout variable is in minutes and designates when the recorder should drop a user from its internal table. The default is 20 minutes, the same as for ASP sessions. If you do not keep track of user sessions, change this value to 0 so memory resources can be cleaned up more often. If you do keep track of user sessions, set this value to the same timeout value you use for accurate tracking.

To play back a Replay Log

After recording you can take the generated log file and play the requests back against any specified server that has the content of the original server mirrored. See Playback Syntax for the command-line usage.

Notes

  • The Playback tool does not play back security scenarios (NTLM/SSL,...), although the recorder will record security cookies.
  • If you are playing a log back against a server that has the Playback tool installed on it, you might want to remove the filter before playback.
  • The Playback tool attempts to preserve cookie information; however, some client scenarios are missed.
  • You cannot playback a log while it is being generated.


Playback Syntax

One Step playback /log:ReplayLog [/machine:MachineName] [/timeout:timeout_in_seconds] [/loops: ##] [/errorlog:file_name]

Where:

/Log:ReplayLog
Required. Specifies the name of the logfile to be played back (must be created by Record.dll).
MachineName
Optional. Specifies the name of the computer to play log against. If not specified, playback will attempt to play the log file against the recorded server IP address.
/loops:
Optional. Specifies the number of times to loop through a log during playback.
/timeout:
Optional. Specifies the time, in seconds, before a socket connection will timeout.
/errorlog:
Optional. Specifies a file name for playback to log errors, indicating why something failed.


Playback Examples

Playback Example

playback /log:C:\WINNT\system32\LogFiles\Replay\Replay19990726.log
/machine:\\ServerX /loops:100 /errorlog:ReplayErr.log


Playback Examples

Playback Technical Notes and Version Information

  • This version of the recorder filter has been tested on IIS versions 3.0, 4.0, and 5.0.
  • This version of Playback will not play back the logs generated with the first version of the tool (provided with Beta releases of the Windows 2000 Resource Kit).
  • The current Playback client is single-threaded and is not time-sensitive.
  • The current version of the tool attempts to simulate users via cookie preservation; however, it is unable to utilize the socket and timing information.


Troubleshooting Playback

Playback Logging Problems

If the Replay directory or the log file(s) are not created, it is generally attributable to two problems:

  • Lkhash.dll is not found. Make sure it is in your System32 directory.
  • The Internet Services Manager entry for the filter (recorder.dll) is not correct.

To correct the second problem, for IIS version 4.0 or later, repeat the steps for configuring the recorder.dll in Installing Playback.

For IIS version 3.0, verify the path for the filter in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Filter DLLs.

Playback Problems

This section lists several common problems and their solutions.

Site stops working with the Playback tool installed

  1. Remove the filter entry in the Internet Services Manager or registry.
  2. See if you can reproduce the problem without the filter installed.

Connection Errors

Playback.exe uses sockets to connect and make requests against the specified server. If you get errors connecting, it could be one of the following issues:

  • Misspelled computer name on command line.
  • IP address can't be looked up.
    Refer to Help on sockets and/or TCP/IP for other issues.

Playback reports that all the requests fail verification.

Verify that the content of the server you did the recording on is mirrored on the computer you are playing logs against.

If it is mirrored correctly try taking another snapshot, but reduce the recording time.

Playback reports that some of the requests fail verification.

The current client has problems with '100 CONTINUE' response, as during a PUT operation and won't always play the request back correctly. These will be counted as errors. Also, because the Playback client sends all the data from the original request without checking status, it is possible that IIS will return '100 CONTINUE' on large requests with the expected response embedded. The current client does not parse the '100 CONTINUE' message and will therefore count the response as a failure.

Future releases of the client will handle these issues for better and more accurate reporting.


Security Configuration and Analysis Tool IIS Templates

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Setting security policy on a Web server by hand is both tedious and error-prone. In Microsoft® Windows® 2000, security policies can be easily standardized and implemented by means of security templates. A security template is a physical file representation of a security configuration. The Windows 2000 Resource Kit includes two IIS-specific security templates:

  • Secure Internet Web Server template
  • Secure Intranet Web Server template

These templates are designed for use with the Security Configuration and Analysis snap-in, a Windows 2000 tool that provides a single point of administration for Windows 2000 system security. The Security Configuration and Analysis tool allows an administrator to:

  • Define one or more security policies based on the role of the computer.
  • Configure a server to match a security policy.
  • Audit a server against an existing policy and report differences.

Note

For more information about the Security Configuration and Analysis tool, the Security Configuration Tool Set, and other issues regarding Windows 2000 security, see Windows 2000 Server online Help.

IIS Security Configuration Templates Topics

  • Using the IIS Security Configuration Templates

Files Required

  • SecureInternetWebServer.inf
  • SecureIntranetWebServer.inf
  • Sectemplates.msc


Using the Security Configuration and Analysis Tool IIS Templates

During Windows 2000 Resource Kit installation, the Security Configuration IIS Templates are placed by default in the <windir>\security\templates directory of your hard disk. The Resource Kit Setup also installs a Security Templates Snap-in (Sectemplates.msc), a Microsoft Management Console (MMC) snap-in that allows you to view and edit all the security templates currently installed on your system. SecTemplates.msc is placed in the root of the directory where you selected to install the Resource Kit. To start the snap-in and to load and use the templates, use the following procedure:

To load the IIS Templates in the Security Template viewer

  1. Install the Resource Kit, making sure you select the "IIS Tools" component.
  2. Click Start, and then click Run. In the Open: line, type Sectemplates.msc, and then click OK.
  3. When the Security Templates snap-in opens, the SecureInternetWebServer and SecureIntranetWebServer templates appear in the list in the contents pane (on the left) of the Microsoft Management Console.
  4. To view and change individual policies in the template, double-click the policy in the right pane of the Microsoft Management Console.

Note

For more information about viewing and editing templates in the Microsoft Management Console, see MMC online Help.

Once the policy is updated to meet your requirements you can import the template into the Security Configuration and Analysis tool and audit against it or apply the template. It is preferable to audit first to see how misconfigured your servers are.

To load the IIS Templates in the Security Configuration and Analysis tool

  1. Install the Resource Kit, making sure you select the "IIS Tools" component.
  2. Click Start, and then click Run. In the Open: line, type MMC, and then click OK.
  3. In the Microsoft Management Console, click Console, and then click Add/Remove Snap-in.
  4. In the Add/Remove Snap-in dialog box, click Add.
  5. In the list of Available Stand-alone Snap-ins, scroll to the "Security Configuration and Analysis" snap-in, and then double-click it.
  6. Close the Available Stand-alone Snap-ins dialog box. In the Add/Remove Snap-in dialog box, click OK.

    In the right-hand pane of the Microsoft Management Console, The Security Configuration and Analysis snap-in appears as a folder ("Scope item") off the Console Root.

  7. Select the Security Configuration and Analysis scope item. Follow the directions that appear in the contents pane (on the right) for creating a new database.
  8. In the Import Template dialog box, select the IIS template you want to import.
  9. To audit your computer against the policies in the template, right-click the Security Configuration and Analysis scope item, and then click Analyze Computer Now....

Note

For more information about viewing and editing templates in the Microsoft Management Console, see MMC online Help.


W3who.dll: Browser Client Context Tool

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

W3Who is an Internet Server Application Programming Interface (ISAPI) application dynamic-link library (DLL) that works within a Web page to display information about the calling context of the client browser and the configuration of the host server. The following information is displayed:

  • Access token (the security context associated with the current request), including:
  • List of security identifiers granted in this access token.
  • List of privileges.
  • List of environment variables transmitted by IIS to the ISAPI application. These variables include browser characteristics, client connection (remote IP address, remote user, keep-alive), client request (method, URL, software), and server characteristics (version, server name, server IP address, server port).

W3Who is useful in a testing environment for checking security and environment contexts.

W3Who Topics

  • Installing and Configuring W3Who
  • Using W3Who

File Required

  • W3who.dll


Installing W3Who

Installing and Configuring W3Who

The Windows 2000 Resource Kit setup program places W3Who.dll in the root of the Resource Kit installation directory. To install and configure the W3Who application, follow these steps:

To install and configure W3Who

  1. Copy W3Who.dll from the root of the Resource Kit installation directory to a virtual directory on your IIS Web server.
  2. Open the IIS Microsoft Management Console (MMC) snap-in.
  3. Right-click the virtual directory where you copied W3Who.dll, and then click Properties.
  4. In the Properties dialog box, click the Virtual Directory tab.
  5. In Execute Permissions, click Scripts and Executables.
  6. Click OK.


Using W3Who

To run the W3Who application, reference W3Who in a Web page. For example, include the following HTML text on a page that resides in the same virtual directory as W3Who.dll:

<p><a href="W3Who.dll">Who Are You</a>

Or, create a button that posts an HTML form:

<form action="W3Who.dll" method="GET">
<div align="center"><center><p><input type="submit" value="Who Are You">
</form>

Important

The example usage instructions outlined above are strictly for installing and testing the tool and do not cover security concerns. To properly use this tool while maintaining a secure Web site, see the information on security concerns in the Microsoft® Internet Information Services 5.0 documentation.


Web Application Stress Tool

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

The Web Application Stress Tool simulates Web activity so that you can evaluate the performance of your Web application, server, or network. With this tool, you can perform tests that simulate a wide variety of workload scenarios, in order to help you determine the optimal configuration for your server.

To realistically simulate Web activity, the Web Application Stress Tool allows you to set various test parameters. Some of these test parameters include the following:

  • The number of users
  • The size, type, and rate of client requests
  • The specific pages to request
  • The frequency of client requests

Once you have set the test parameters, you can run the test. After the test concludes, the Web Application Stress Tool will provide a detailed report about the test. Some of the details provided in this report include the following:

  • Total number of hits
  • Hits per page
  • Number of socket errors
  • Number of requests per second
  • Any performance counters you specified prior to running the test
  • Time To First Byte (TTFB) and Time To Last Byte (TTLB) for each item on a page

Based on the information provided in this report, you can set up a new test that increases or decreases the stress on the server. You should establish a desired peak level that supports your business needs, then adjust the test such that it reaches this level.

Once you have identified a test that sufficiently produces the desired peak level, you can assess the hardware requirements to support such a level and upgrade those resources accordingly.

Web Application Stress Tool Topics

  • Installing the Web Application Stress Tool
  • Understanding Web Testing Concepts
  • Using the Web Application Stress Tool
  • Troubleshooting the Web Application Stress Tool
  • Web Application Stress Tool Examples
  • Specifying Clients
  • Specifying Users
  • Using Page Groups
  • Capturing Performance Counters
  • Viewing Script Details
  • Adjusting Test Settings
  • Viewing Test Results

Files Required

  • The files required by Web Application Stress Tool are located in the <cdroot>\Apps\Webstress directory of the Windows 2000 Resource Kit companion CD. See Installing Web Application Stress Tool for information on installing and running the application.


Installing the Web Application Stress Tool

The Web Application Stress Tool is not installed by the Windows 2000 Resource Kit setup program. To install it, use the following procedure:

To install the Web Application Stress Tool

  1. Insert the Windows 2000 Resource Kit companion CD into your CD drive.
  2. When the Setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\webstress directory, double-click Setup.exe.
  4. Follow the directions that appear on your screen.
  5. Repeat the above procedure for each computer that you would like to use as a stress client.

To start the Web Application Stress Tool

  1. Click Start.
  2. Point to Programs.
  3. Point to Microsoft Web Application Stress Tool, and then click Microsoft Web Application Stress Tool.

Important

To use the Web Application Stress Tool, you must be running Microsoft® Windows® 2000 or Microsoft® Windows NT® version 4.0 SP4.


Understanding Web Testing Concepts

The first task in Web testing is to use a tool to apply stress to the Web site and to measure the maximum requests per second that the Web server can handle. This is a quantitative measurement. The second task is to determine which resource prevents the requests per second from going higher, such as CPU, memory, or server dependencies. This second task takes more interpretation than the first.

In many situations, the Web server processor is the bottleneck. Increase the stress until the requests per second start to decrease, and then slightly reduce the stress. This level is the maximum performance that the Web site can achieve. You can increase the stress by increasing the Stress level setting (number of threads) or by increasing the number of Web Application Stress Tool client computer.

On the Web server, use System Monitor to watch the Computername; System; % Total Processor Time and Computername; Web Service; Connection Attempts/sec as well as Computername; Active Server Pages; and Requests Queued counters. If the processors are running at 80 to 85 percent of capacity, then they are most likely the bottleneck. If the number of Requests Queued fluctuates considerably during the stress test and the processor utilization remains relatively low, this indicates that the script is calling a server COM component that is receiving more calls than it can handle. In this case, the server COM component is the bottleneck.

You should determine an expected peak load that meets your business needs and then create a test that uses enough threads to reach that capacity. This will help you determine the maximum request rate for the Web application and confirm that it is in line with the expected peak load.

The amount of personalization in a Web application also plays a significant role in how it performs. The Web Application Stress Tool contains several features that make testing a personalized Web site easy. For example, you can create users, which allows the Web Application Stress Tool to save a cookie with each of them. You can also use the Querystring editor to help create and store several sets of name-value pairs that are passed with each request.


Using the Microsoft Web Application Stress Tool

Using the Web Application Stress Tool

To use the Web Application Stress Tool, you must create tests that accurately simulate your expected workload on the server, continuously adjusting test parameters and running tests until you reach this workload. Once you have devised an adequate test, you can determine which hardware resources to upgrade in order to support a given workload.

Exploring the Sample Script

Each time you start the Web Application Stress Tool, a script is created called Sample Script, which you can use to explore the features that the Web Application Stress Tool provides. The actual files used in the Sample Script are stored in the folder where you installed the Web Application Stress Tool.

Once you have examined the different items in the Sample Script, you can run the test. After it concludes, you can view the test report by clicking Reports from the View menu.


Troubleshooting the Microsoft Web Application Stress Tool

Troubleshooting the Web Application Stress Tool

The following list comprises the issues that most frequently arise for the Web Application Stress Tool. For specific questions and feedback, send mail to webtool@microsoft.com.

Unable to start the Web application stress tool

If you have problems starting the Web Application Stress Tool, confirm that the Web Application Stress Tool service is running. From Control Panel, double-click Services, locate the Web Application Stress Tool service and click Start Service.

Unable to add or connect to client computers

If you have problems adding client computers verify that:

  • The client computer is running the correct version of the Web Application Stress Tool. The Web Application Stress Tool will not connect to a computer that is running a different version of the Windows NT Service component.
  • The client computer is running Windows 2000 or Windows NT Server or Workstation. The Web Application Stress Tool will not run on Windows 95/98.
  • Each client computer has the Web Application Stress Tool installed and the service is running.
    Each client computer needs the Web Application Stress Tool service installed and running.
  • You can ping the other computer by using the TCP/IP Ping utility. All of the client computers in a Web Application Stress Tool test must be able to make socket connections to each other. Check the Overview section in the Web Application Stress Tool report window to confirm that there are no socket errors.
  • You are using enough threads to take advantage of each client. The Web Application Stress Tool distributes the threads among the client computers. If you are only using two threads, but have three client computers, one client will not be used.
  • You are an administrator on each client computer. Distributed Component Object Model (DCOM) will not connect to a remote computer if the privileges are not sufficient.

Not all users are assigned a cookie

During a stress run, the Web Application Stress Tool saves cookies with each user in sequential order. If you have several hundred users, but only run the test for a few minutes, this might not be enough time to assign a cookie to each user. To resolve this issue, run the test for a longer period of time.

All of the page data in the report displays zeros

If a stress report shows all zeros for the Time To First and Last Bytes, check the Result Codes section of the Web Application Stress Tool report. It is possible that the Web Application Stress Tool was unable to hit the page for the reason shown in the Result Codes section.

Authentication is not working

The Web Application Stress Tool requires that you add a working user and password for the authenticated site you are testing. You can add several users, but they all must be valid user accounts for the authentication type.

Whenever I select random in the query string editor, the name-value pair disappears

When the Random check box is selected in the query string editor, the Web Application Stress Tool removes the name-value pair from the query string in the Uniform Resource Identifier (URI) box. This is by design; however, these name-value pairs are still passed with every request and are selected randomly from your list of values.

Unsure how to make the Web Application Stress Tool work with a proxy server

To enable the Web Application Stress Tool over a proxy, add the account privileges to the Web Application Stress Tool service. From Control Panel, open the Services utility, and double-click the Web Application Stress Tool service. In the Log On As section, add your network user account and password. Then stop and restart the Web Application Stress Tool service. This needs to be done on every client you intend to use over the proxy.


Web Application Stress Tool Examples

The Web Application Stress Tool contains powerful features that make creating scripts and testing Web sites easier. Here are some examples of things you can do:

  • Record the clicks in your browser. The Web Application Stress Tool captures your browser activity and stores this information in a script. This makes it easy to create realistic user activity.
  • Create a new script. To do so, select the files located on your Web server by using the Content Tree editor. This allows you to quickly create a script that can hit every page on your Web site, without requiring you to manually type each URL in the Script editor.
  • Create a script from an Internet Information Services (IIS) log file; IIS records site usage within this file. If your site is already deployed on the Internet, or on an Intranet, IIS is collecting useful data for you. The format and contents of these log files vary based on how you have configured IIS. The Web Application Stress Tool can read the most common formats and will allow you to create a script directly from this data, thus producing realistic scripts. This method of script creation is useful for troubleshooting problems on a live site.
  • Design a script that contains random or sequential name-value pairs that are passed to an online form. The Web Application Stress Tool contains the Querystring editor; this parses both Active Server Pages (ASP) and HTML forms to let you specify the name-value pairs.

    In a script, if the same name-value pairs were passed with every request for this page, the test would not be very realistic. Consequently, the Web Application Stress Tool provides an interface that automatically selects a different "FirstName", "LastName", and "Amount" value for every request. This ensures a realistic way to test the performance and stability of the forms on your Web site.

  • Create some users and then request pages that create cookies. When a Web page passes a cookie value, the Web Application Stress Tool assigns that cookie to a user. You can modify the cookie value for each user. These same users are then used to stress test the Web site, passing the cookie with each request. This generates a realistic stress scenario, especially on Web sites that contain heavy user interaction and personalization.
  • Determine the bottleneck and maximum requests per second by increasing the number of threads in a stress test. This type of testing provides valuable feedback on how your Web site will perform in the real world.
  • Adjust the bandwidth throttling to obtain performance statistics on your site at varying bandwidths. For example, you can run a test that simulates a 56 kilobits per second (Kbps) modem and look at the report data to see how long a user will need to wait before a page renders on the client.
  • Export the report values to Microsoft® Excel and create charts filled with critical data that demonstrate the performance and stability of your Web application.


Specifying Clients

Select Scripts from the View menu to expose the Script view. Select the Clients node under the Sample Script and double-click the Default client group, indicated by the following icon: wpe9.jpg (1203 bytes). This opens the Clients view where you can add and delete client computers from the current group or add new groups of client computers. Notice that "localhost" is the only client and that it has a check box next to it. This means that the current computer is acting as a Web Application Stress Tool client. Leave the Client view as is and select Scripts from the View menu to return to the Script view.


Specifying Users

Select the Users node and double-click the Default user population, indicated by the following icon: wpe8.jpg (1269 bytes). This opens the Users view where you can add and delete users from the default population and create new populations. Each Web Application Stress Tool user stores cookie information and authentication data. Notice that there are 20 users in the default population.

Web Application Stress Tool users are not the same as Stress level (threads), a setting located in the Concurrent Connections section of the Settings node. The two concepts should be kept separate.


Using Page Groups

The last two script items in the Sample Script contain the text "adGrp" under the Group column. This is a page group, which is shown as "Default" unless you change it. You can use page groups to change the order in which the script items are invoked. You can also use page groups to change the number of times that each script item is invoked while a script is running.

You can see a list of all the page groups by selecting the Page Groups node in the script tree view. You can also change the distribution percentages from this view. Notice that Keep-Alives are enabled for entire page groups at a time.

You can add, change, or delete page groups by selecting an item in the Group column from within the script items window. Page groups provide the following benefits:

  • A logical grouping of paths in a Web Application Stress Tool script. For example, a Web page might contain several elements that the browser requests individually, such as graphics. If you record a script, you will see that all of the elements of a particular page are requested sequentially. Since these elements are requested by the browser, including them in a script is a good idea, as opposed to simply requesting the page where the graphics reside. Use a page group to collect all of these components into one transaction. They make your script more readable because groups of files are associated with each other by a page group name. Once you add a page group to one script item, that name becomes available in the page group drop-down and can quickly be selected and assigned to multiple pages in a script.
  • More accurate reporting statistics because all of the pages in a group are summarized in the Web Application Stress Tool report, in a section called Group Data. You can quickly see the distribution, number of hits, and result codes associated with a particular page group.
  • More accurate stress script because elements of a group are requested sequentially, regardless of their location in the script items window, much like the way a browser would request them. Additionally, you can assign a configurable percentage to a specific page group. For example, if you know the home page will be requested 80 times more than the other pages on your site, you can assign all of the elements of the home page into a page group; then you can assign a value of 80 to the page group in the Distribution column of the Page Groups section (in the script properties). You can then evenly distribute the remaining pages.


Capturing Performance Counters

Select the Perf Counters node from the script tree and click on the Add Counter button. It might take a moment or so to load the Add Counters dialog box when this button is clicked for the first time. Add the following counters:

  • Web Service\ Get Requests/sec
  • Web Service\ Post Requests/sec
  • System\ % Total processor time
  • Active Server Pages\ Requests/sec

Change the Collection Interval to every 5 seconds. Capturing the correct performance counters is critical to obtaining the correct data for analysis when the test completes. There are several important performance counters to choose from, based on the type of application you are testing.

The following counters provide a high-level snapshot of a Web application's stability and should provide a good overview of the health of the application. Initially, you should start by capturing a small set of counters. Once you determine the problem area, you can get more details by capturing more counters related to that issue.

Note

The overhead incurred from System Monitor is five percent or less on single processor computers and insignificant on multiple processor computers.

Overall Counters

Object | Counter | Purpose
Processor | % Total Processor Time | Shows the amount of time spent processing threads by all CPUs. A number consistently above 90% on one or more processors indicates that the test is too intense for the hardware. Make sure you add the 0 through x instances of this counter for multiprocessor computers.
PhysicalDisk | % Disk Time | Requires diskperf-y at the command prompt. Shows the percentage of elapsed time that the disk is busy with read/write activity. A number consistently above 80% might indicate a memory leak. Make sure you add the 0 through x instances of this counter for multidisk computers.
PhysicalDisk | Disk Queue Length | Shows the number of outstanding requests on the disk. Sustained queue lengths on one disk that are greater than 3 indicate a disk or memory problem. It might also indicate that a SQL Server is not set up correctly.
Memory | Page Faults/sec | Shows the number of times a virtual page was not found in memory. If this number is consistently above 0, it indicates that too much memory has been allocated to an application, and not enough to Windows 2000.
Memory | Available Bytes | Shows the total bytes of real memory that is available to the computer, less the bytes being used by running applications. Add this number to Memory\ Committed Bytes to get the total amount of memory on the computer.
Memory | Pool Nonpaged Bytes | Shows pages that are used by the operating system that do not leave memory. This will increase with each process, but watch for gradual growth in this counter over a test run. This would indicate an application's repeated inadvertent opening of a file or some other object. Performance will suffer if this gets within 4 megabytes (MB) of Memory\ Available Bytes.
Memory | Pages/sec | Shows how many pages are being moved to and from the disk to satisfy virtual memory requirements. If the server does not have enough memory to handle its workload, this number will be consistently high.
Memory | Committed Bytes | Shows the size of virtual memory that has been committed to the running applications. Add this number to Memory\ Available Bytes to compute the total amount of memory on the computer. Committed bytes should increase as the test is ramping up, but it should remain fairly constant after that.
Server | Bytes Total/sec | Shows network activity. This gives you an idea of how close the server's adapters are to being fully utilized. This is particularly useful for watching multihomed servers.
System | Total Interrupts/sec | Shows the frequency with which this computer is handling hardware interrupts. This gives you a good idea of how busy the whole system is.
Object | Threads | Threads are the basic executable entity that can execute instructions in a processor. If this number continues to rise over time, open the Process\ Thread Count counter and see which instance is creating all of the threads.
Process | Private Bytes - _Total | Shows the current number of bytes all instances have allocated that cannot be shared with other processes. Make sure you select the _Total instance from the list. Select whatever other instances you suspect might be consuming too much memory.

Web Server Only

Object | Counter | Purpose
Web Service | Current Anonymous Users | Shows the current number of connections to the service during an unauthenticated stress test. This counter should be just slightly less than the number of Web Application Stress Tool threads times the number of Web Application Stress Tool sockets per thread.
Web Service | Current NonAnonymous Users | The number of authenticated users currently connected to the HTTP Server. Use this number to determine how many authenticated connections the Web server picks up. If this drops to 0 during an authenticated stress run, check for the correct permission tokens on the content and confirm that the Web Application Stress Tool users have a valid user name and password for each.
Web Service | Bytes Total/sec | Shows the sum of bytes sent and received by the Web server. If this number is low, it means that IIS is transferring data at a low rate.
Web Service | Not Found Errors | Shows the number of requests that could not be satisfied by service because the requested document could not be found; typically reported as HTTP 404 error code to client. If this number is greater than 0, the stress is at least partially incorrect.
Active Server Pages | Request Errors/Sec | The number of errors per second, including connection errors, compile errors, and runtime errors. If this number is ever greater than 0, something is wrong with the test scripts, server configuration, or scripts in ASP pages.
Active Server Pages | Requests/sec | The number of ASP page requests executed per second. Use this number to provide an indication of how heavy the stress on the Web server is. Anything over 85 connections/sec is heavy stress.
Active Server Pages | Requests Rejected | The total number of requests not executed because the queue was full or there were insufficient resources to meet the number of hits that the Web server is getting. If this number is consistently above 0, the stress test is too heavy.
Active Server Pages | Memory Allocated | The total amount of memory currently allocated by Active Server Pages. Compare this number to Memory\ Available Bytes and Memory\ Committed Bytes to determine what percentage ASP is using. A ratio of greater than 50% during the test would indicate a memory leak in a server-side object.
Active Server Pages | Requests Queued | This should remain close to 0. If it ever reaches 460, you will know that clients are receiving the "Server Too Busy" error. If this queue continues to grow as more stress is applied, the ASP page should be redesigned because it is too complicated for the given stress level.
Process | Private Bytes - inetinfo | Private Bytes - inetinfo is the current number of bytes the HTTP/ASP service has allocated that cannot be shared with other processes. If this number is consistently large, and growing, there is probably a leak in a server-side object. Compare with Process\ Private Bytes - _Total.

SQL Server Only

Object | Counter | Purpose
SQLServer | Cache Hit Ratio | Shows the hit rate that data is found in the cache. If data is not in the cache, the server will have to be read from the disk. This shows memory allocation and therefore indicates whether the server has sufficient memory for the task. A number consistently less than 85% indicates a memory problem.
SQLServer | User Connections | Shows the number of active SQL Server users. Each connection uses 37 kilobytes (KB) of memory. Compare this number to the Active Server Pages\ Requests/sec counter to get an idea of the degree to which the scripts are really working the SQL Server. A large difference might indicate that the test script is not a valid stress of SQL Server.
SQLServer | Net - Network Reads/sec | Shows the number of data packets read from the network. An extremely high value for an extended time indicates that either the network card has a problem or, more likely, the application is not using enough stored procedures and is written improperly.
SQLServer | I/O - Lazy Writes/sec | The number of flushed pages per second by the lazy writer. A number consistently above 0 indicates that the lazy writer is constantly working to flush buffers to disk. This means that the application either has a memory leak or the SQL Server requires more memory for normal operation.
SQLServer - Locks | Total Blocking Locks | Shows a lock that forces another process to wait until the current process is complete. An occasional block is normal. If this number is consistently greater than 0, it indicates transaction problems. Some of the basic causes are inefficient query design, poor table design, or slow throughput due to inadequate hardware.


Viewing Script Details

The left window of the Web Application Stress Tool is known as the Script view, which displays all of the scripts stored in the current Web Application Stress Tool database. If this is a new database, the only items you see in the Script view are Defaults and Sample Script.

There are seven script items in the Sample Script, each of which utilizes a special feature of the Web Application Stress Tool. For example, notice that one of the script items is a POST. Using your mouse, highlight the row header to the left of the POST script item, and then double-click. This opens the Script Item Details view. From this view, you can edit the querystring name-value pairs, change POST data, modify the header, and enable Secure Sockets Layer (SSL).

Take a look at the Querystring tab view. Notice that the names User and Password are being passed in the querystring. Also notice that %Username% and %Password% are the values being passed. These are not literal values; they are special variables that tell the Web Application Stress Tool to pass the next available user and next available password from the list. The Web Application Stress Tool automatically cycles through the user names and passwords, passing the next set with each POST.

Close the Script Item Details view by clicking the OK button.


Adjusting Test Settings

Select the Settings node and change the Test Run Time to 1 minute, down from 15. Leave the other settings as they are for the time being, but look over the other options in this view to get an idea of what can be configured for a script. You can also set the default settings for all new scripts by selecting the Defaults node and changing those options. Keep in mind that the settings in the Defaults node will not affect existing scripts, such as the Sample Script.


Viewing Test Results

Select Reports from the View menu to open the Reports view. Expand the Sample Script report to display all of the report nodes. There should be one node listed by the date and time in which your latest test was started. Expand and select the top level of this report node to view a summary of this test.

You can select a specific node of the report tree to view more in-depth information. For example, select the Result Codes node to display a sum of the HTTP result codes for every request in the test. Expanding the Perf Counters node displays the counters that have been collected during the test.

Expand the Page Data node and select the first script item. The right pane displays detailed information regarding this script item. Reports provide the response time for specific pages by determining when the script has finished downloading on the client. This is a good source of performance data.

The Time To First Byte (TTFB) calculates the time from the request for the page until the Web Application Stress Tool receives the first byte of data, in milliseconds. The Time To Last Byte (TTLB) calculates the total time from the request until the last byte of data has been received on the client, in milliseconds. This number includes the TTFB time and any additional time needed to receive the last byte of data. All of the requests are sorted, then the data is divided into percentiles.

While in Report view, you can select Export to CSV from the File menu. Exporting the report values to a format that Microsoft® Excel can read allows you to create charts that show where most of the requests fall.


Web Capacity Analysis Tool

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

The Web Capacity Analysis Tool (WCAT) runs simulated workloads on client-server configurations. Using WCAT, you can test how your Microsoft® Internet Information Services (IIS) and network configuration respond to a variety of different client requests for content, data, or Hypertext Markup Language (HTML) pages. The results of these tests can be used to determine the optimal server and network configuration for your computer running Microsoft® Windows 2000 Server with IIS version 5.0. WCAT evaluates how Internet servers running Windows 2000 Server and Internet Information Services respond to various client workload simulations.

You can test different server and network configurations by using the prepared WCAT content and workload simulations. When you change your hardware and software configuration and repeat the prepared tests, you can identify how the new configuration affects server response to the simulated client workload. You can use WCAT to test servers with single or multiple processors and to test servers that are connected to multiple networks.

Note

The Web Capacity Analysis Tool is not installed by the Resource Kit Setup program. To install the tool, use the following procedure:

To install WCAT

  1. Insert the Windows 2000 Resource Kit CD into your CD-ROM drive.
  2. When the Setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\wcat directory, double-click setupex.exe.
  4. Follow the directions that appear on your screen.

For More Information

After following the procedure to install WCAT, click Start, point to Programs, point to Microsoft WCAT, and then click WCAT User's Guide.


Addusers.exe: Add Users

This 32-bit administrative tool for Windows 2000 uses a comma-delimited file to create, write, and delete user accounts. The easiest way to maintain such files is in a spreadsheet, such as Microsoft Excel, that can work with comma-delimited files.

The format for the comma-delimited file requires headings for users [User], global groups [Global], and local groups [Local]. Before you use the /c option to create user accounts, it is recommended that you first execute AddUsers with the /d switch, the dump accounts option, which writes the headings, user accounts, local groups, and global groups to a file. Viewing this file gives a clearer picture of the structure and headings of the comma-delimited file.

You must be a member of the Administrators group on the target computer to add accounts and a member of the Users group to write accounts.

AddUsers is 100 percent Unicode. The switch /p:, followed by l, c, e, d, or any combination of the four enables you to specify the four account-creation options available in User Manager: UserMustChangePasswordAtNextLogon, UserCannotChangePassword, PasswordNeverExpires, and AccountDisabled.

AddUsers Topics

  • AddUsers Syntax
  • AddUsers File Structure
  • Example: AddUsers File

File Required

  • Addusers.exe


AddUsers Syntax

One Step addusers [ \\computername ] { /c [/p:{l | c | e | d}] | /d | /e } filename [/s:x] [/?]

Where:

\\computername
is the computer on which you want to create user accounts or from which you want to write user accounts. If you do not specify a computer name, AddUsers will use the local computer by default.
/c
creates user accounts, local groups, and global groups as specified by filename.
/p:
followed by l, c, e, or d, or any combination of the four, sets the following account-creation options (must be used in conjuction with /c):
  • l
    users do not have to change passwords at next logon.
  • c
    users cannot change passwords.
  • e
    passwords never expire (implies l option).
  • d
    accounts are disabled.
if you do not specify this option, all accounts will be created with the Usermgr.exe defaults.
/d
dumps (writes) user accounts, local groups, and global groups to filename.
Note that choosing to dump current user accounts does not save the account's passwords or any security information for the accounts. to back up security information for accounts, a tape backup should be used.
Also, note that since password information is not saved in a user account dump, using the same file to create accounts will cause all passwords of newly created accounts to be empty. All newly created users will be required to change their password at logon by default.
/e
deletes user accounts as specified by filename.

note-icon

Caution

Be careful when erasing user accounts, as it is not possible to recreate the user account with the same SID. This option, however, cannot erase built-in default accounts.
Also, be aware that when a local or global group is included in the text file, the /e switch does not just remove the user from the group, but also eliminates the entire group.

filename
is the comma-delimited input/output file that addusers will use for data.
/s:x
changes the character used for separating fields in the file. the x should be replaced with the new character to be used for separating fields. For example, /s:~ would make the "~" (tilde) the field-separation character.
if this option is not specified, the default separator, a comma (","), is used.
/?
displays a usage screen with this syntax


AddUsers File Structure

AddUsers requires that each section in the comma-delimited input/output file have a heading to denote what type of information follows. These headings are [User], [Global], and [Local]. Use the dump users (/d) option to create a file that will demonstrate the use of these headings.

Syntax is section-specific for each entry (line) in the different sections, as follows:

[User]

UserName,FullName,Password,Comment,HomeDriveAndPath,Profile,Script,

[Global]

GlobalGroupName,Comment,UserName, ...

[Local]

LocalGroupName,Comment,UserName, ...

The entries (lines) in the [Local] and [Global] group sections can have 0 or more UserName entries after the comment field. Each user name will be added to that group. Lines must end with a comma (or the appropriate separator character).

Notes

  • To change the separator character from the default comma, use the /s:x command-line switch.
  • Global Groups will appear to be added to computers running Windows 2000 Professional. However, since Windows 2000 Professional does not support Global Groups, they are not actually added.


Example: AddUsers File

Please note that the blank lines between the sections are not required. If blank lines are used, they must be completely empty (no spaces or tabs, only the return character).

[User]
Administrator,,,Built-in account for administering the computer/domain,,,,
Guest,,,Built-in account for guest access to the computer/domain,,,,
IUSR_INTEROP80,Internet Guest Account,,Built-in account for anonymous access to Internet Information Services,,,,
IWAM_INTEROP80,Internet Guest Account,,Built-in account for anonymous access to Internet Information Services out of process applications,,,,
MTS_INTEROP80,MTS_INTEROP80,,Component Services system package administrator account,,,,
TsInternetUser,TsInternetUser,,This user account is used by Terminal Services.,,,,
[Global]
None,Ordinary users,Administrator,Guest,MTS_INTEROP80,TsInternetUser,IWAM_INTEROP80,IUSR_INTEROP80,
[Local]
Administrators,Members can fully administer the computer/domain,USER1\Administrator,USER1\MTS_INTEROP80,SYS-WINNT\Domain Admins,DOMAIN1\user1,
Backup Operators,Members can bypass file security to back up files,
Guests,Users granted guest access to the computer/domain,USER1\Guest,USER1\TsInternetUser,USER1\IWAM_INTEROP80,USER1\IUSR_INTEROP80,
Power Users,Members can share directories and printers,
Replicator,Supports file replication in a domain,
Users,Ordinary users,SYS-WINNT\Domain Users,
USER1 Admins,USER1 Admins - Members can create and manage Webs,BUILTIN\Administrators,
USER1 Authors,USER1 Authors - Members can create and modify folders and files in Webs,
USER1 Browsers,USER1 Browsers - Members can read documents in Webs,
MTS Administrators,Microsoft Component Services Administrators,USER1\MTS_INTEROP80,
MTS Impersonators,Microsoft Component Services trusted process identities.,
WMI Users,Members get read only access to WMI,


Atmarp.exe: Windows ATM ARP Server Information Tool

Atmarp.exe: Windows ATM ARP Server Information Tool NEW

AtmArp is a command-line tool that assists network administrators and support personnel in troubleshooting the status of the Asynchronous Transfer Mode (ATM) Address Resolution Protocol (ARP)/multicast address resolution service (MARS) that ships with Windows 2000. ATM refers to a group of related, standards-based technologies that provide high-speed communication over various media.

Atmarp.exe provides information about Atmarps.sys, the Windows 2000 IP/ATM combined ARP/MARS/multicast server (MCS) server. This service provides the server side connectivity support for an IP/ATM network.

AtmArp Topics

  • AtmArp Syntax
  • AtmArp Example

File Required

  • Atmarp.exe

For More Information

For more detailed information on Asynchronous Transfer Mode, see the
Internet ATM Forum Web page for the specification on LAN Emulation over ATM 1.0.


AtmArp Syntax

One Step atmarp [/s] [/c] [/reset] [/?]

Where:

/reset
displays statistics for the ARP and MARS server.
/c
displays the ARP and MARS caches.
/reset
resets the ARP and MARS statistics.
/?
displays help.


AtmArp Examples

Displaying ARP Server Statistics

atmarp

Windows ATM ARP Server Information

Adapter: {EB535D2A-8044-11D2-AFE3-A9CC1F4296B4}

Arp Server Statistics

Elapsed Time: 1250  seconds
Recvd. Pkts.: 24    total           (0 discarded)
Entries: 2     current         (2 max)
Responses: 4     acks            (0 naks)
Client VCs: 1     current         (2 max)
Incoming Calls: 7     total

Mars Server Statistics
Recvd. Pkts.: 20    total           (1 discarded)
MCData Pkts.: 21    total           (0 discarded, 21 reflected)
Members: 2     current         (2 max)
Promis.: 1     current         (1 max)
Add Party: 2     total           (0 failed)
Registration: 2     requests        (0 failed)
Joins: 11    total           (4 failed, 5 dup's)
Leaves: 1     total           (0 failed)
Requests: 6     total
Responses: 5     acks            (0 naks)
VC Mesh: 2     joins           (1 acks)
Groups: 2     current         (2 max)
Group Size: 1     max

View all field descriptions.

Elapsed time:
Seconds elapsed since the ARP/MARS/MCS service was started, or the last time AtmArp/reset was executed.

Recvd. Pkts.:
total number of control packets received by the server on this adapter. This total includes both ARP and MARS control packets.
discarded: the number of packets that are discarded before they were classified as ARP or MARS control packets. These packets were discarded either because they were badly formed, or because the server has run out or resources. A high number of discarded packets indicates a communications or resource related problem.

Entries:
current: Number of ARP entries currently in the internal ARP table.
max: Maximum number of entries in the ARP table since the start of statistics collection.

Responses:
acks: Total number of ARP ACK response sent.
naks: Total number of ARP NACK responses sent since the start of statistics collection.

Client VCs:
current: Current number of incoming client VCs.
max: Maximum number of incoming client VCs at any one point of time since the start of statistics collection.

Incoming Calls:
total: Sum total of incoming client VC calls since the start of statistics collection.

Recvd. Pkts.:
total: Total number of MARS control packets received.
discarded: Total number of MARS control packets that were discarded, either because they were invalid or because the server has run out of resources. A high number of discarded packets indicates a communications, or resource-related problem.

MCData Pkts.:
total: Total number of multicast data packets received from clientsdiscarded: Number of multicast data packets that were discarded, either because they were invalid or because the server has run out of resources. A high number of discarded packets indicates a communications or resource-related problem.
reflected: Total number of multicast data packets that were reflected on the cluster control VC.

Members:
current: Current number of multicast clients.
max: Maximum number of multicast clients at any one time since the start of statistics collection.

Promis.:
current: Current number of clients that have requested promiscuous join, which is a request to receive all multicast data.
max: Maximum number of multicast clients that have requested promiscuous joins, at any one time since the start of statistics collection.

Add Party:
total: Total number of times an attempt was made to add a party to the cluster control VC
failed: Number of times that add party attempt failed. A high number of failures indicates a communications, or resource-related problem.

Registration:
requests: Total number of multicast client registrations requests received.
failed: Number of registration requests that failed.

Joins:
total: Total number of request by clients to join a multicast group (includes promiscuous join requests).
failed: Number of join requests that were denied.
dup's: Number of join requests which were (1) a duplicate of, or (2) a subset of an earlier join request by the same client, or (3) for an address range that is MCS-served.

Leaves:
total: Total number of requests to leave a multicast group (includes promiscuous leave requests).
failed: Number of leave requests that were denied.

Requests:
total: Total number of MARS requests, which are requests asking for the ATM addresses associated with a particular IP multicast group address.

Responses:
acks: Total number of MARS requests which were successfully answered, for example, there was at least one ATM address associated with the IP multicast group address.
naks: Total number of MARS requests which were NACK'd, because no ATM addresses were associated with the IP multicast group address.

VC Mesh:
joins: Total number of successful joins involving VC-Mesh IP multicast group addresses.
acks: Total number of MARS requests for one of these VC-Mesh-served IP multicast group addresses. If this number is 0, it typically means that no client has attempted to send to a VC-Mesh served address.

Groups:
current: Current number of VC-Mesh IP multicast group addresses.
max: Maximum number of VC-Mesh IP multicast group addresses at any one time since the start of statistics collection.

Group Size:
max: Maximum number of clients that had requested to receive the same VC-Mesh IP multicast address group at any one time.

Displaying ARP and MARS caches

atmarp /c

Windows ATM ARP Server Information

Adapter: {EB535D2A-8044-11D2-AFE3-A9CC1F4296B4}

Arp Cache
192.168.74.20 -> 47.0000.00.00003c.0000.a000.0000.0000c1100879.01
192.168.74.23 -> 47.0000.00.00003c.0000.a000.0000.0020480811da.01

Mars Cache
promiscuous -> 47.0000.00.00003c.0000.a000.0000.0020480811da.01
236.1.2.3 -> 47.0000.00.00003c.0000.a000.0000.0000c1100879.01:q


Atmlane.exe: Windows ATM LAN Emulation Client Information

Atmlane.exe: Windows ATM LAN Emulation Client Information NEW

AtmLanE is a command-line tool designed to assist administrators in troubleshooting the status of the Asynchronous Transfer Mode (ATM) LAN Emulation (LANE) client that ships with Windows 2000. ATM refers to a group of related, standards-based technologies that provide high-speed communication over various media.

When an ATM adapter is installed on a Windows 2000 computer, the LANE client is installed by default. If this system is connected to a switch that has LANE services configured (ask your system administrator or refer to the ATM switch documentation), the client will allow network connectivity to other clients within its emulated LAN.

AtmLanE Topics

  • AtmLanE Syntax

File Required

  • Atmlane.exe

For more information

For more detailed information on Asynchronous Transfer Mode, see the
Internet ATM Forum Web page for the specification on LAN Emulation over ATM 1.0.


AtmLanE Syntax

One Step atmlane

There are no switches for this tool.

Windows ATM LAN Emulation Client Information

Adapter: \DEVICE\{BB6C0952-8F73-11D2-9AB5-E7689533344A}

ELAN: \Device\{6A9A2593-8F75-11D2-9AB5-00603D080160}

    ELAN Number:        0
    ELAN State:         OPERATIONAL
C1  ATM Address:        47.0000.00.00003c.0000.a000.0000.00603d080160.00
C2  LAN Type:           Ethernet/802.3
C3  MaxFrameSize:       1516
C4  Proxy:              Off
C5  ELAN Name:          Collage740ElanEth
C6  MAC Address:        00.60.3d.08.01.60
C7  ControlTimeout:     300 sec
C8  RouteDescriptors:   None
    LECS Address:       47.0079.00.000000.0000.0000.0000.00a03e000001.00
C9  LES Address:        39.840f.80.01bc61.df00.0720.4500.00006f072045.03
    BUS Address:        39.840f.80.01bc61.df00.0720.4500.00006f072045.04
C10 MaxUnkFrameCount:   5
C11 MaxUnkFrameTime:    1 sec
C12 VccTimeout:         1200 sec
C13 MaxRetryCount:      1
C14 LEC ID:             16
C15 MulticastMacAddrs:  Broadcast,All_Multicast
C16 LE_ARP Cache:       See below
C17 AgingTime:          300 sec
C18 ForwardDelayTime:   15 sec
C19 TopologyChange:     Off
C20 ArpResponseTime:    16 sec
C21 FlushTimeout:       4 sec
C22 PathSwitchingDelay: 6 sec
C23 LocalSegmentId:     4080
C24 McastSendVcType:    Best Effort
C25 McastSendVcRate:    0 cps
C26 McastSendPeakRate:  0 cps
C27 RemoteMacAddrs:     None
C28 ConnComplTimer:     4 sec

C16 LE_ARP Cache

ff.ff.ff.ff.ff.ff -> 39.840f.80.01bc61.df00.0720.4500.00006f072045.04

Connection Cache

PEER 47.0091.81.000000.0061.3e5b.fe01.0020480811f3.00 DataDirect
BUS  39.840f.80.01bc61.df00.0720.4500.00006f072045.04 McastSend + McastFwd
LES  39.840f.80.01bc61.df00.0720.4500.00006f072045.03 CtrlDirect + CtrlDistr


Cconnect.exe: Con-Current Connection Limiter

Cconnect.exe: Con-Current Connection Limiter NEW

This tool provides a method of tracking concurrent connections of users and monitoring what computers users are logged on to a network. It consists of two components, a client and an administrator.

Con-Current Connection Limiter:

  • is completely hidden from the end user's view.
  • keeps track of all computers that users are logged onto.
  • tracks last known user of the computer.
  • monitors what logon server users are logging into.
  • allows concurrent connection limitations to be set on a per-user or per-group basis.
  • stores all information in a Microsoft® SQL Server™ database assigned by the Administrator.

Requirements

These tools require:

  • Microsoft® Windows® 2000

    • - Or -

  • Microsoft® Windows NT® version 4.0 with:
    • Service Pack 4 or higher
    • Windows Script Host
    • Windows Management Instrumentation (WMI)
    • MDAC version 2 or higher

      • Information on all of these can be found at the Internet Microsoft Web site.

  • SQL Server 6.5 or higher

Before running the VBS files, CConnect Client must be run successfully at least once to properly set up the database. Otherwise the VBS scripts will fail.

Files Required

Con-Current Connection Limiter is not installed by the Windows 2000 Resource Kit setup program. The files required for this tool are located on the Apps\Cconnect\ folder of the Resource Kit companion CD.

Before using CConnect Client or CConnect Administrator, you must first install them using the installation programs (Setup.exe) located in the Apps\Cconnect\Client and Apps\Cconnect\Admin folders.


Mscep.dll: Certificate Services Add-on for Cisco Routers

Mscep.dll: Certificate Services Add-on for Cisco Enrollment Protocol NEW

Mscep.dll is a Certificate Services add-on ISAPI dynamic-link library (DLL) that enables enrollment for Cisco Systems, Inc. routers for IPSec authentication certificates from a Microsoft® Windows® 2000 Certificate Authority (CA) using the Simple Certificate Enrollment Protocol (SCEP).

Note

Mscep.dll is not installed during Resource Kit installation and can only be installed on an enterprise or stand-alone root certification authority (CA). To install it on an enterprise CA, you must be a member of the Enterprise Administrators group or the root Domain Administrators group and the CA should be in a separate certification hierarchy from all other CAs in your organization. To install onto a stand-alone CA, you need to be a member of the computer administrators group. For more information, see Installing Mscep.dll.

MsCep Topics

  • Installing Mscep.dll
  • Enrolling for Certificates from a Cisco Router

File Required

  • Cepsetup.exe


Installing Microsoft Windows 2000 Certificate Services Add-on for Cisco Enrollment Protocol

The Certificate Services Add-on for Cisco Enrollment Protocol (CEP) runs on Windows 2000 Server.

This tool is not installed by the Windows 2000 Resource Kit Setup. To install it, use the following procedure:

Before You Start

  • You must install the Certificate Services Add-on for CEP on a root certification authority (CA). Both enterprise root CAs and stand-alone root CAs are supported. You can install the Certificate Services Add-on for CEP on a subordinate CA. However, as of October 1999, existing versions of Cisco routers are not able to request certificates from the subordinate CA.

  • The CA should be in a separate certification hierarchy from all other CAs in your organization.

  • You need to have proper administrative privileges to install the Certificate Services Add-on for CEP. By default, you need to be a member of the Enterprise Administrators group or the root Domain Administrators group to install this add-on on an enterprise CA, or you need to be a member of the computer administrators group to install this add-on on a standalone CA.

  • The Certificate Services Add-on for CEP cannot be installed on a Windows 2000 CA that has any non-alphanumeric characters (for example: &,*, :, ;, ', ") in its name.

To install Certificate Services Add-on for CEP on a Windows 2000 Root CA

  1. Log on with the appropriate administrative privileges to the server on which the root CA is installed.
  2. Click Start, click Run, then type drive:cepsetup.exe where drive is the CD-ROM drive where the Windows 2000 Resource Kit companion CD is located or the disk drive where you have downloaded cepsetup.exe. (On the Resource Kit companion CD, this file is located in the <cdroot>\Apps\Cep directory.)
  3. In the CEP Setup wizard:
    • Select whether or not you want to require a challenge phrase for router certificate enrollment.
    • Enter information about who is enrolling for the Registration Authority (RA) certificate, which will later allow certificates to be requested from the CA on behalf of the router.
    • (Optional) Select Advanced Enrollment Options if you want to specify the cryptographic service provider (CSP) and key lengths for the RA signature and encryption keys.
    • The URL - http://URLHostName/certsrv/mscep/mscep.dll - is displayed when the CEP Setup wizard finishes and confirms a successful installation. URLHostName is the name of the server which hosts the CA's enrollment Web pages (also referred to as Certificate Services Web pages).


Enrolling for Certificates from a Cisco Router

To enroll for certificates from a Cisco router

Remove all current certificates stored on the router and configure the router for new certificate enrollment

  1. At the routername> prompt, type EN

  2. Type in your password. You are now in "Enable Mode" on the router.

  3. At the routername# prompt, type config t.

  4. At the routername(config)# prompt, type no crypt ca identity ExistingCAIdentityName.

  5. Type y to destroy all certificates.

  6. At the routername(config)# prompt, type crypt ca identity NewCAIdentityName.

  7. At the routername(ca-identity)# prompt, type enrollment mode ra.

    8. Note

    Do not use the query sub-command at routername(ca-identity)# prompt to configure the router.

  8. At the routername(ca-identity)# prompt, type enrollment url http://URLHostName/certsrv/mscep/mscep.dll where URLHostName is the name of the server which hosts the CA's enrollment Web pages (also referred to as Certificate Services Web pages).

  9. If you do not want the router to check the CA's certificate revocation list (CRL), at the routername(ca-identity)# prompt, type crl optional.

  10. At the routername(ca-identity)# prompt, type exit.

  11. At the routername(config)# prompt, type exit.

  12. At the routername# prompt, type write memory.

  13. To confirm that your changes have taken place, at the routername# prompt, type write terminal. The router will display its configuration information. No certificates will appear in the displayed information and you will see the enrollment URL you entered.

Request the CA's Certificate

  1. At the routername# prompt, type config t.

  2. At the routername(config)# prompt, type crypt ca authenticate NewCAIdentityName.

  3. Attributes of CA certificate will be displayed, including the fingerprint of the CA certificate. The "fingerprint" is a series of alphanumeric characters unique to that CA certificate.

    You can confirm that the fingerprint of the CA certificate being presented to the router matches the fingerprint of the authentic CA certificate by connecting to the URL: http://URLHostName/certsrv/mscep/mscep.dll in Internet Explorer. Verify that the fingerprint displayed at this URL matches the fingerprint of the certificate being presented to the router.

    Type Y to accept the CA certificate.

  4. To confirm that you received the CA certificate, at the routername(config)# prompt, type exit.

  5. At the routername# prompt, type show crypt ca certificate. The CA certificate will be displayed on the screen.

Generate a Public and Private Key Pair

  1. At the routername# prompt, type config t.

  2. At the routername(config)# prompt, type crypt key gen rsa.

  3. When you are asked if you want to replace your current keys, type Y.

  4. Enter the number of bits in the modulus (key size). The default is 512.

Enroll for Certificates.

  1. At the routername(config)# prompt, type crypt ca enroll NewCAIdentityName.

  2. You are asked to input a password.

    Using Microsoft® Internet Explorer, retrieve a valid challenge password by connecting to the URL: http://URLHostName/certsrv/mscep/mscep.dll.

    Some notes about this password:

    • Every time you connect to this URL, a different challenge password is displayed. Each challenge password is valid for 60 minutes and can only be used once.

    • The password displayed is both the challenge password for certificate enrollment and the password for certificate revocation. Remember this password so that in case you need to revoke the certificate, you can provide it to the CA administrator.

    • If you connect to the URL above and do not see a challenge password displayed, then the CEP Add-on was not setup to require a challenge password. In this case, you can make up a password of your own choosing. This password will be used for certificate revocation only.

    • If you are requesting a certificate from an enterprise CA, you must have the right to enroll for certificates based on the IPSecIntermediateOffline certificate template in order to access the URL above. By default, a member of the Enterprise Administrators group or the root Domain Administrators group will have the right to enroll for certificates based on the IPSecIntermediateOffline certificate template.

      See the procedure entitled Set security permissions and delegate control of certificate templates in Windows 2000 Server Help for the procedure to change enrollment permissions for certificate templates.

    • By default anyone can view the Web page at the URL above if it is on a stand-alone CA.

  3. Type Y to include the router serial number in the subject name.

  4. Type Y to include the IP address in the subject name.

  5. Type Y to request the certificate from the CA. The certificate request fingerprint will be displayed and the certificate will be received from the CA.

  6. Type exit to leave config mode.

  7. At the routername# prompt, type show crypt ca certificate to verify that you have certificate(s) for the router. The certificate(s) issued to the router, as well as the CA certificate, will be displayed on the screen.

Notes

  • You should use Internet Explorer on a Windows 2000-based computer when performing procedural steps that require you to connect to the URL: http://URLHostName/certsrv/mscep/mscep.dll.

  • If Internet Explorer is configured to use a proxy server, make sure that the Bypass proxy server for local addresses check box is selected in the Tools, Internet Options, Connections, LAN Settings dialog box in Internet Explorer.

  • The router cannot process certificates whose issuer or subject has non-alphanumeric characters (for example: *, :, ;, ', ")

  • Some helpful procedures in Windows 2000 Server online documentation:

    • To issue or deny a pending certificate request on a stand-alone CA, see Review pending certificate requests in Windows 2000 Server Help.

    • To revoke a certificate and publish a CRL, see Revoke an issued certificate and Manually publish the certificate revocation list in Windows Server help.

    • If you are issuing certificates to routers from a CA, you may want to view all issued certificates with the unstructured Name, unstructured Address, and serialNumber columns. To add these columns to the MMC view, see Customize the display of columns in Certification Authority in Windows Server help for general instructions to add columns to the Certification Authority snap-in display.


Clippool.exe: ClipBook Viewer

Clippool.exe: Clip Pool NEW

ClipPool allows you to transparently share a single logical clipboard among many computers. With ClipPool installed, you can easily copy and paste data between many computers. For example, a debugger trace on one computer can be copied into an e-mail message on another computer. The tool is run from its icon in the status area .

Using ClipPool

After installing ClipPool, you'll see a tiny "clipboard" icon in the status area near the clock. This icon indicates the current state of ClipPool.

  • A clipboard indicates everything is working.
  • A clipboard covered with a big red X indicates you've lost your connection to the server. This can be due to a physical network problem, for example, a cable is unplugged, or a problem with the server configuration. ClipPool will try to reconnect to the server once every five seconds. Once you resolve the problem, it should recover.

If you right-click the clipboard icon, you'll see a short menu. This has options for closing ClipPool, and for opening the Windows clipboard viewer (Clipbrd.exe). Double-clicking the clipboard icon also opens the clipboard viewer.

Menu item | Description
Clipboard viewer... | In Windows 2000, Clipboard Viewer has been renamed Clipbook Viewer. ClipBook Viewer shows you the information you have copied to the Clipboard.
Info... | Tells you if this computer is a ClipPool server or client, and which port is being used.
About... | Version information about ClipPool.
Close | Exit ClipPool.

To transfer clipboard data between computers, use the normal cut, copy, and paste operations from your application software. The clipboard contents will be available among all computers.

Limitations

ClipPool currently only supports standard Windows clipboard formats. This includes text, bitmaps, metafiles, and .wav files. ClipPool does not support complex items such formatted text and embedded objects.

ClipPool Topics

  • ClipPool Setup
  • ClipPool Syntax
  • ClipPool Examples

File Required

  • Clippool.exe


ClipPool Setup

ClipPool runs on the following: Microsoft® Windows® 2000, Microsoft® Windows NT® version 4.0, and Microsoft® Windows® 98. It requires a network card running TCP/IP.
  1. Copy Clippool.exe to a directory of your choice on every computer which will participate in the clipboard pool. If not already present, you will also need Msvcp50.dll.
  2. Run Clippool.exe on each computer in the pool. One computer must be configured as a server, and the other computers must be configured as clients. For a basic setup, use the following:
    • On the server computer, serverName:
      clippool /server
    • On all other computers, the clients:
      clippool /client serverName

For permanent setups, create shortcuts for these commands in the "Startup" folder on each computer.

See ClipPool Syntax for more information on options to create more complex configurations.


ClipPool Syntax

One Step clippool [-?] [/port portNumber | /pickaport] [/info] [/nolocal] [/title "title"] {{/client servername} | /server}

Where:

-?
displays command-line help. Appears in a dialog.
/port portNumber
selects a specific port. Use TCP port n to communicate with the server. If this is specified, it must be specified on the server and all clients. This parameter is useful for allowing multiple clipboard pools to use the same computer as their server. To do this, run a separate instance of ClipPool on the server for each pool, specifying a different port for each instance. The default port is 6042.
/pickaport
selects an available port. Similar to the /port.
/info
displays an information dialog containing the port number currently selected at startup.
/nolocal
prevents ClipPool from interacting with the local clipboard. This is useful on a ClipPool server, especially one running multiple instances of ClipPool. Only one instance of ClipPool can use the clipboard at a time.
/title "title"
sets a custom title for this instance of ClipPool. This is displayed in the tooltip for the taskbar icon. This can be useful for distinguishing between multiple instances of ClipPool on a server.
/client servername
Adds this computer to the clipboard pool, and points it at the ClipPool server, servername. Must be run locally on the client.
/server
Sets this computer as the ClipPool server.


ClipPool Examples

  • Setup this computer as the ClipPool server.
    clippool /server
  • Setup this computer as a ClipPool client connecting to the ClipPool server, IMACOMPUTER.
    clippool /client IMACOMPUTER
  • Setup this computer as the ClipPool server, pick an available port, then display the dialog containing the port selected at startup.
    clippool /server /pickaport /info


Clusrest.exe: Cluster Quorum Restore Utility

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This tool is used in a Microsoft® Windows® 2000 cluster after a node has been restored using NtBackup, a component of the Windows 2000 operating system. NtBackup leaves the quorum data in a directory on the node's disk, but does not restore it to the quorum disk at that time. Restoring the quorum disk requires that the cluster be stopped and restarted, which may not be necessary or desirable. If a quorum disk requires a restore, the cluster is most likely down and the operation will not negatively impact operation.

The process of restoring a single node of a cluster is straightforward. You must first restore the system state and cluster state to the node; then you must restart. This causes the node to rejoin the cluster and restores it to operation.

To restore the quorum disk, following the node restore, run Clusrest.exe. This moves the quorum data from the node to the quorum. The node can then be restarted and the cluster should be established. Other nodes may then join the cluster as they are brought up.

Note

Restoring a quorum rolls the cluster back in time to the backup date. There are impacts to performing this operation that include loss of data. This operation should only be undertaken when it becomes absolutely necessary.

ClusRest Topics

  • Using ClusRest
  • Troubleshooting ClusRest

Files Required

  • Clusrest.exe


Using ClusRest

To run ClusRest

  1. Use NtBackup, a component of the Windows 2000 operating system, to perform a cluster restore on a node of the cluster.
    This deposits the quorum data on the node's disk drive. The quorum data must be placed on the disk by NtBackup prior to running ClusRest.
  2. At the command prompt, run clusrest.
    This causes the quorum disk to be restored to the state of the backup.
  3. Reboot the computer.

The cluster should be restored and running.


Troubleshooting ClusRest

Only two error conditions are reported by ClusRest:

  • If the quorum data to be restored to the quorum disk is not found, the tool reports FILE NOT FOUND.
    This data can be placed on the node only by running a restore of the cluster with the application NtBackup, a component of the Windows 2000 operating system. The restore must be performed prior to running this utility and a cluster restore must be performed. The data is placed on the node's disk in the %windir%\cluster\cluster_backup folder.
  • If the system is not part of a cluster or the quorum disk is not available, not formatted or broken, the tool reports ERROR_SERVICE_DOES_NOT_EXIST


Clustool.exe: Microsoft Cluster Tool

Clustool.exe: Microsoft Cluster Tool NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This tool assists you with a few common tasks related to the Cluster service (part of Microsoft® Windows® 2000), including backing up and restoring a cluster configuration and moving resources to a cluster.

A server cluster is a group of independent computer systems working together as a single system to ensure that mission-critical programs and resources remain available to clients. Clustered computers must be running Windows 2000 Advanced Server.

Clustering technology enables you to enhance data availability, server manageability, and performance. Regardless of how many servers are connected in a cluster, a workstation treats the cluster as if it were a single server. Cluster configurations are used to address availability, manageability, and scalability.

Microsoft Cluster Tool consists of the following wizards:

  • Configuration Backup Wizard -- Creates a backup of the configuration for a selected cluster.
  • Configuration Restore Wizard -- Restores the configuration of a cluster from a selected configuration backup file.
  • Resource Migration Wizard -- Migrates resources (file shares and shared printers) from a stand-alone Microsoft® Windows® 2000 or Microsoft® Windows NT® server to a cluster.

Installing the Microsoft Cluster Tool

The Microsoft Cluster Tool is not installed during Windows 2000 Resource Kit installation. To install it, use the following procedure:

To install the Microsoft Cluster Tool

  1. Insert the Microsoft Windows 2000 Resource Kit companion CD in your CD-ROM drive.
  2. When the setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\clustool directory, double-click setup.exe.
  4. Follow the directions that appear on your screen.

Files Required

The files required for Microsoft Cluster Tool are located in the CD_drive:\apps\ClusTool\ directory of your Microsoft® Windows® 2000 Resource Kit companion CD.

For More Information

See the Microsoft Cluster Tool online Help (Clustool.hlp) in the CD_drive:\apps\ClusTool\ directory of the Microsoft® Windows® 2000 Resource Kit companion CD.


Confmgr.htm: IP Multicast Conference Management Tool

Confmgr.htm: IP Multicast Conference Management Tool NEW

This scripted HTML page enables you to configure standard and advanced options for multicast audio and video conferencing.

With ConfMgr, you can:

  • Obtain a list of IP Multicast conferences published on a given ILS server.
  • Create new IP Multicast conferences.
  • Delete IP Multicast conferences
  • Directly edit properties of existing conferences using the SDP Blob editor

Microsoft® Windows® 2000 includes support for multicast audio and video conferencing, and the Phone Dialer application that ships with Windows 2000 as a communications accessory with the operating system can serve as a multicast conferencing client. With Phone Dialer, users can create, delete, and join multicast conferences.

While the functionality exposed by Phone Dialer is sufficient for most small- to medium-sized conferences held on LANs, advanced users and network administrators may wish for more configuration options when establishing conferences. This multicast conference management tool exposes the following additional conference options:

  • Selection of alternate audio and video codecs
  • Specification of audio-only or video-only conferences
  • Specification of receive-only conferences

Note that this tool was originally designed for internal test use only. Modifying configuration properties not discussed in this document could result in conferences that do not function properly with Microsoft applications.

IP Multicast Conference Management Topics

  • ConfMgr Conference Management Functions
  • Modifying Audio and Video Codec Selections with ConfMgr
  • Limiting Audio and Video with ConfMgr

File Required

  • Confmgr.htm


ConfMgr Conference Management Functions

Before you can begin managing multicast conferences, you must select an Internet Locator Service (ILS) server with which to connect. You can either select a server whose location has been published to the domain's Active Directory (by clicking the Published ILS Server radio button and selecting a server from the drop-down menu) or specify a server manually (by clicking the ILS Server radio button and entering a server name). If you want to access the ILS server using a different user account than the one you're using on your local computer, enter the domain, user name, and password in the appropriate boxes. Click the Connect it! button to connect to the ILS server.

Once you are connected to the ILS server, a list of the conferences published on the server will appear in the Published conferences window. Below the window are four buttons:

Button | Function
Refresh | Retrieves a revised list of conferences from the ILS server.
SDP Blob | Enables you to view and edit a conference's SDP conference description.
Delete | Removes a conference from the ILS server.
Add New | Add a conference to the ILS server.

The functions of the Refresh and Delete buttons are self-explanatory and are not explained further. The Add New and SDP Blob buttons are useful to power users, and are discussed in other topics.


Modifying Audio and Video Codec Selections with ConfMgr

Clicking the Add New button allows you to create a conference, much as you would using Phone Dialer. Note that while the tool allows you to create, modify, and delete conferences, you cannot join conferences using the tool itself. If you use only the basic conference property fields, then a conference is created with the same default settings as a conference created by Phone Dialer. However, clicking the Adv. Options button allows access to more detailed conference properties. Of these properties, the audio and video codec selections are the most interesting to power users.

The default audio codec for multicast conferences is the 64 kbps ITU G.711 PCM codec. Conferences on bandwidth-constrained networks (for example, conferences with participants connected via analog modems) may benefit from selecting a lower bandwidth codec. Besides the G.711 codec, the 13 kbps GSM 06.10 codec is also supported for multicast conferencing. Using the GSM codec will result in significantly lower audio bandwidth consumption, but with a corresponding reduction in sound quality and increased latency.

Note that the actual network traffic observed will be somewhat higher than the codec data rates due to packetization overhead. Also note that although other codecs are listed as options in the configuration menu, only G.711 and GSM are supported for multicast conferencing at this time. Two variants of the G.711 codec can be chosen; they are functionally identical, but G.711u is used by default.

The default video codec for multicast conferences is the ITU H.263 codec. The conference management tool also allows the creation of conferences specifying use of the ITU H.261 codec, however H.263 has both lower bandwidth consumption and superior quality than H.261. For this reason, use of the H.261 codec is not recommended unless required for compatibility with non-Microsoft clients.

Note

  • You can disable audio and/or video (thus making an audio-only or video-only conference) by unchecking the appropriate Audio or Video checkboxes.
  • You can make audio and/or video receive-only by checking the appropriate Receive Only check boxes.


Limiting Audio and Video with ConfMgr

You can directly edit SDP conference descriptions by clicking the SDP Blob button.

Note that in all cases where the SDP conference description is modified, the changes will only take effect on participants that join after the changes are made. In addition, any clients that have previously accessed the conference description on the ILS server must refresh their view of the ILS server before the changes will take effect.

For more information on the format of SDP conference descriptions, see the proposed Internet standard RFC 2327 (Session Description Protocol).

Caution

Do not modify SDP conference invitations unless you understand them thoroughly.


Copslpm.exe: Common Open Policy Service Local Policy Module

Copslpm.exe: Common Open Policy Service Local Policy Module NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

The COPS (Common Open Policy Service) LPM (Local Policy Module) enables a COPS-based Policy Server to provide admission control decisions to a Windows 2000 ACS (Admission Control Service) for RSVP (Resource Reservation Protocol) requests. The ACS acts as the logical gatekeeper for RSVP message propagation across the network. With the COPS LPM installed on the ACS, the RSVP requests are passed to the COPS Policy Server for admission control decisions. The COPS LPM communicates with the COPS Policy Server using the COPS protocol.

Minimum Requirements

COPS LPM requires Windows 2000 Server, ACS, and a COPS-06 enabled Policy Server. The installation prompts the user for the primary and backup policy server system information.

Event Logging

Every time the ACS service is started or stopped it loads or unloads Icopslpm.dll. When this dynamic-link library (DLL) gets loaded or unloaded, an error condition occurs, or a successful operation occurs, a message gets logged into Windows 2000 system log. These messages can be seen with Event Viewer (found in Administrative Tools). Messages logged by ACS have the source RSVP and ones logged by the COPS LPM have the source iCOPSLPM. Informational messages get logged for all successful operations, such as connecting to the server, initializing (loading) or deinitializing (unloading) the DLL. Error messages get logged for all error conditions, such as failure to read the registry or failure to connect to a policy server. There are also a few messages that get logged under certain conditions, such as messages about communication failures with the policy server.

COPS LPM Topics

  • Installing COPS LPM
  • Uninstalling COPS LPM

Files Required

The files for COPS LPM are located on the Windows 2000 Resource Kit CD in the <Cdroot>\Apps\copslpm folder.


Installing COPS LPM

Common Open Policy Service Local Policy Module requires an additional installation procedure beyond that of the Resource Kit.

  1. Log in as an Administrator.
  2. Make sure that the QoS Admission Control RSVP service is installed and can be started and stopped successfully from the Component Services snap-in.
    To open it:
    • Click the Start button, point to Programs, point to Administrative Tools, then click Component Services.
    • In the console root, click Services (Local) and scroll down in the right pane to find the QoS RSVP service.
  3. Run the self-extracting executable, Copslpm.exe, found in the <Windows 2000 Resource Kit Cdroot>:\Apps\Copslpm directory.
  4. Verify that iCOPSLPM has initialized properly as described in the Event Logging section of the main topic.

The installation program, Copslpm.exe, installs and configures COPS LPM as follows:

Components

Copslpm.exe copies the following DLLs to the \System32 directory:

  • Icopslpm.dll
  • Icopsmsg.dll

Registry Settings

Copslpm.exe configures the following registry settings during installation:

Registry settings for ACS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RSVP
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RSVP\PCM Config
    "ActiveLPMs" value must contain "Icopslpm.dll".
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RSVP\Parameters
    "RunAsAcsService" value should be set to 1.
Registry settings for enabling Windows 2000 Event Log for Icopslpm.dll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\iCOPSLPM
  • "EventMessageFile" should contain %SystemRoot%\System32\Icopslpm.dll.
  • "TypesSupported" should be set to 0x7.
Registry settings required by Icopslpm.dll
HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\COPS LPM\ServerConfig
  • "BackupServer" should have backup server's DNS name or IP address.
  • "PrimaryServer" should have primary server's DNS name or IP address.
  • "RetryInterval" is the retry interval (in milliseconds) that LPM should wait before attempting to connect to a server (primary, secondary, or redirected) when a prior attempt has failed. The install program does not create this entry. In absence of this entry, the DLL assumes a default value of 60000.


Uninstalling COPS LPM

From the Control Panel, use Add/Remove Programs to unintstall COPS LPM.


Cusrmgr.exe: Console User Manager

Cusrmgr.exe: Console User Manager NEW

This command-line tool enables editing of many of the properties available through the Local Users and Groups, a Microsoft® Windows® 2000 system tool that is part of the Computer Management MMC snap-in. With CusrMgr, you can rename or delete users, set passwords, and set or reset other user properties.

For Microsoft® Windows NT® version 4.0, CusrMgr offers command-line access to User Manager's "User" and "User Profile" properties.

CusrMgr Topics

  • CusrMgr Syntax
  • CusrMgr Examples

File Required

  • Cusrmgr.exe


CusrMgr Syntax

One Step cusrmgr -u UserName [-m \\ComputerName] [{-r UserName | -d NewUserName}] [{-p | -P Password}] [-rlg OldGroupName NewGroupName] [-rgg OldGroupName NewGroupName] [-alg LocalGroupName] [-agg GlobalGroupName] [-dlg LocalGroupName] [-dgg GlobalGroupName] [-c Comment] [-f FullName] [-U UserProfile] [-n LogonScript] [-h HomeDir] [-H HomeDirDrive] [{+s | -s} Property]

Where:

-u UserName
specifies the user account on which to perform the operation. This switch is case-sensitive: it takes a lower-case u.
-m \\ComputerName
specifies the name of the computer (machine) on which to perform the operation. The default is the local computer.

User Functions

-r UserName
renames user specified with -u to NewUserName.
-d UserName
deletes user UserName.

Resetting Password Functions

-p
sets a random password. This switch is case-sensitive: it takes a lower-case p.
-P Password
sets password to Password. This switch is case-sensitive: it takes a capital P.

Group Functions

-rlg OldGroupName NewGroupName
renames local group OldGroupName to NewGroupName.
-rgg OldGroupName NewGroupName
renames global group OldGroupName to NewGroupName.
-alg LocalGroupName
adds user specified by -u UserName to local group LocalGroupName.
-agg GlobalGroupName
adds user specified by -u UserName to global group GlobalGroupName.
-dlg LocalGroupName
deletes user specified by -u UserName from local group LocalGroupName.
-dgg GlobalGroupName
deletes user specified by -u UserName from global group GlobalGroupName.

SetProperties Functions

-c Comment
sets Comment property to Comment.
-f FullName
sets FullName property to FullName.
-U UserProfile
sets UserProfile property to UserProfile. This switch is case-sensitive: it takes a capital U.
-n LogonScript
sets LogonScript property to LogonScript.
-h HomeDir
sets HomeDir property to HomeDir. This switch is case-sensitive: it takes a lower-case h.
-H HomeDirDrive
sets HomeDirDrive property to HomeDirDrive. This switch is case-sensitive: it takes a capital H.
+s Property
sets property Property, where Property can be any of the following properties:
  • MustChangePassword
  • CanNotChangePassword
  • PasswordNeverExpires
  • AccountDisabled
  • AccountLockout
  • RASUser
-s Property
resets any of the properties that can be set with +s.

Return Value

CusrMgr returns 0 on success.


CusrMgr Examples

Setting a new password for a user on the local computer

cusrmgr -u UserName -P NewUserPassword

Setting "User must change Password at next login" property for a user on the local computer

cusrmgr -u UserName +s MustChangePassword

Setting a new password for a user at the domain level

\\PdcName is the primary domain controller of the domain to which the UserName belongs.

cursmgr -u UserName -P NewUserPassword -m \\PdcName

Setting "User must change Password at next login" property for a user at the domain level

cursmgr -u UserName +s MustChangePassword -m \\PdcName


Dhcploc.exe: DHCP Server Locator Utility

DHCP Server Locator Utility displays the DHCP servers active on the subnet. If it detects any unauthorized DHCP servers, it beeps and sends out alert messages. It also displays packets that it detects from DHCP servers; you can specify whether to display packets from all DHCP servers or only from unauthorized servers.

You can use this command line-based tool to determine which DHCP servers are available to a DHCP client and to detect unauthorized DHCP servers on a subnet.

Important
DHCP Server Locator Utility should not be run from a DHCP server. The tool listens for DHCP servers by taking DHCP packets off the IP stack. However, it has no means to reintroduce DHCP packets to the stack. Therefore, running this tool on a DHCP server will preempt DHCP requests and the DHCP server will appear not to respond.

DHCP Server Locator Utility Topics

  • DHCP Server Locator Utility Syntax
  • DHCP Server Locator Utility Output

Files Required

  • Dhcploc.exe


DHCP Server Locator Utility Syntax

One Step dhcploc [-p] [-a:"alertname_list"] [-i:alertinterval] computer_ip_address [valid_dhcp_server_list]

Where:

-p:
specifies not to display detected packets from any of the authorized DHCP servers specified in valid_dhcp_server_list.
-a:"alertname_list"
specifies to send alert messages to the names in alertname_list if any unauthorized DHCP servers are found.
-i:alertinterval
specifies the alert frequency in seconds.
computer_ip_address
specifies the IP address of the computer from which you are running DHCP Server Locator Utility. If the computer has multiple adapters, you must specify the IP address of the adapter that is connected to the subnet you want to test.
valid_dhcp_server_list
specifies the IP addresses of any number of authorized DHCP servers. The tool will not send alerts when it detects packets from the servers in this list. However it will display those packets unless you specify the -p option.


DHCP Server Locator Utility Output

The output of DHCP Server Locator Utility is formatted as follows:

time (IP) ipaddress OfferedPacketType (S) ServerIPAddress [***]

where "***" indicates a packet from an unauthorized server.

Sample output:

17:34:58 (IP)0.0.0.0 NACK (S)11.11.31.84 ***

17:36:38 (IP)11.101.190.130 OFFER (S)11.101.12.226 ***

17:36:38 (IP)11.101.196.231 ACK (S)11.101.13.53

17:36:53 (IP)11.101.196.231 ACK (S)11.101.13.53

17:37:05 (IP)11.101.196.234 OFFER (S)11.101.13.53

17:37:05 (IP)11.101.193.232 OFFER (S)11.101.12.198

17:37:06 (IP)11.101.190.132 OFFER (S)11.101.12.226 ***


Dhcpobjs.exe: DHCP Objects

Dhcpobjs.exe: DHCP Objects NEW

DHCP Objects is an automation object-model library for the Microsoft® DHCP server. It allows administrators and developers to write applications and scripts to administer a DHCP server remotely. It provides enhanced capabilities over Dhcpcmd.exe (a tool included in the Microsoft® Windows® 2000 Support Tools), such as the ability to remove a DHCP lease.

DHCP Objects is implemented as an in-process server (DLL) exposing ActiveX® Objects (previously known as OLE Automation objects) as dual COM interfaces. All objects are accessible from advanced automation controllers such as Microsoft® Visual C++®, Microsoft® Visual Basic®, and Microsoft® Visual J++™, as well as from scripting languages like VBScript and JavaScript (provided that the scripting host application provides a way to create ActiveX objects). The DHCP objects may be accessed remotely via DCOM or Remote Automation, so 16-bit, 32-bit and Web-based applications can use it to administer any DHCP server on a given network.

DHCP Objects is not installed by the Windows 2000 Resource Kit setup program. Before using this tool, you must install it by running Dhcpobjs.exe, a self-extracting executable file. Installed with the tool is Dhcpobjs.chm, an HTML Help file that contains detailed information on how to use the tool.

Files Required

  • Dhcpobjs.exe


Drmapsrv.exe: Drive Share

Drmapsrv.exe: Drive Share NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

DrMapSrv is a Terminal Services command-line tool that configures NET SHARE & NET USE client drive for Terminal Server access.

Drive Share is a tool for use with Terminal Services. When the Terminal Services client is a computer, Drive Share maps all client local drives into the Terminal Server session. This means that the user will be able to directly interact with drives on both the local and remote computer from within the Terminal Server Client program.

Drive Share does not provide any new capability to Terminal Services, but automates a common activity. It uses the same Net Share and Net Use facilities a user could perform manually. It does this automatically upon client connection, for every local drive on the user's computer. This implies that the same securities, and the same limitations, apply whether this sharing is performed manually or using this tool.

Drive Share Components

Drive Map consists of two components.
  1. On the client side, the drmapclt.dll file provides the drive enumeration and sharing. It is placed in the Terminal Server Client directory and referenced through the registry.
  2. On the server side, drmapsrv.exe provides the drive connection. It resides in the System32 directory and is referenced through the directory.

DrMapSrv Topics

  • Installing Drive Share
  • DrMapSrv Examples

Files Required

  • drmapclt.dll: Client-side mapping dynamic-link library
  • drmapclt.reg: Client-side registry setup file
  • drmapsrv.exe: Server-side mapping control
  • drmapsrv.reg: Server-side registry setup file


Installing Drive Share

Drive Share must be installed on each Terminal Server, and on each computer that is to be a Terminal Server client.

Installation on Terminal Services Server(s)

If you also want to run File Copy (Rdpclip.exe), it must be installed first. Otherwise, rdpclip.exe must be reinstalled after installing Drive Share.
  1. Copy the file drmapsrv.exe to the System32 folder in your Winnt directory.
  2. Run the following to setup the Registry keys:
    drmapsrv.reg

Installation on Terminal Services Client(s)

  1. Copy the file drmapclt.dll to the Terminal Server Client installation folder. By default, this is C:\Program Files\Terminal Server Client. This will be the same folder which contains the file mstsc.exe.
  2. Run the following to setup the Registry keys:
    drmapclt.reg


Drive Share Examples

Say you have a typical computer with a hard drive (C:), a CD-ROM drive (D:), and a floppy disk drive (A:). The system is known as "LocalSys" on the network.

After installing the Terminal Server client and the Drive Map tool, you connect to a Terminal Server, which is also running the Drive Map tool.

After opening My Computer in the Terminal Server Session you would see A:, C: and D: refer to the floppy drive, hard drive volume, and CD-ROM drive on the Terminal Server. X:, Y:, and Z: are the mapped drives. These mappings allow the user to interact directly with the CD-ROM drive, the hard drive and the floppy drive on his local computer.


Dumpfsmos.cmd: Dump FSMO Roles

Dumpfsmos.cmd: Dump FSMO Roles NEW

This command-line tool dumps the Flexible Single Master Operation (FSMO) roles for a domain. Using DumpFsmos, you can find the names of the domain controllers that are performing forest-wide operations master roles, including schema master and domain naming master, and domain-wide operations master roles, including RID master, primary domain controller emulator, and infrastucture master.

Rights required to run Dump FSMO Roles are:

  • Builtin\Administrator, to run the tool locally
  • Domain\Administrator or Enterprise\Administrator, to run the tool remotely

The syntax for DumpFsmos is:

One Step dumpfsmos DomainController

Where:

DomainController
is the name of a domain controller in any domain in the forest.

File Required

  • Dumpfsmos.cmd


Findgrp.exe: Find Group

This tool finds all direct and indirect group memberships for a specified user in a domain. Find Group can help determine a particular user's access to Windows 2000 domain controllers in a domain by listing the groups in which the user is a member.

Note

Find Group was created especially for use in a trusted domain model. Administrative access to either your domain or user's domain is not required.

Find Group Topics

  • Find Group Syntax
  • Find Group Example

File Required

  • Findgrp.exe


Find Group Syntax

One Step findgrp [your_domain] [USER_DOMAIN\username]

Where:

your_domain
is the domain from which the group information is retrieved. type localmachine to list groups on your local Windows 2000 Professional computer.
user_domain
is the domain that contains the user account.
username
is the name of the user.

Note

Your domain and user's domain can be the same. If they are not the same, your domain must trust the user's domain.


Find Group Example

In the following example, User1 has a user account in the APPLE domain. The PEACH domain trusts the APPLE domain.

C:\reskit> findgrp peach apple\User1

The user is in the following APPLE Global Groups:

Domain Users

Department 10

Global Project

The user is in the following PEACH Local Groups:

Project

Test

Plans


Floplock.exe: Lock Floppy Disk Drives

FloppyLock is a service that allows you to control access to the floppy drives of a computer. This service can be used to help prevent unauthorized software installation or the introduction of viruses via floppy disks.

When the service is started on Windows 2000 Professional, only members of the Administrators and Power Users groups can access the floppy drives. When the service is started on Windows 2000 Server, only members of the Administrators group can access floppy drives.

FlopLock works by assigning a Discretionary Access Control List (DACL) to a floppy drive. When FlopLock has the floppy drives on a machine locked, only users in the Adminstrators group can use the floppy drive(s). If the FloppyLock service is configured to start automatically, the lock stays in place even after the computer is restarted.

Installing the FloppyLock service is a separate task you must perform after you install the Resource Kit tools.

Using FloppyLock is easy. Once the FloppyLock service is installed, starting it locks the floppy drives on that computer. To unlock the drives, stop the FloppyLock service.

Note

Full source code for floplock.exe is available on the Microsoft® Win32® Software Development Kit (SDK) compact disk, in the \q_a\sd_flppy directory

FloppyLock Topics

  • Installing the FloppyLock Service

File Required

  • Floplock.exe


Installing the FloppyLock Service

FloppyLock Main Topic

Installing and Uninstalling the FloppyLock Service

Installing FloppyLock

The FlopLock service must be installed on all computers which will have their floppy drives locked. After installation, it must be configured on each installed computer to start automatically to prevent unauthorized users from using the floppy drive.
  • The easiest way to add or remove a service, either on a local or remote computer, is to use the Service Installation Wizard.
  • To install manually on a local computer, follow these steps.
    1. Install FloppyLock as a service. Use the command-line syntax:

      One Step instsrv FloppyLock "ResourceKitInstalledPath\floplock.exe"

    2. After installation, configure and start the service. In the Computer Management snap-in console tree, click the Services and Applications node, then click the Services node.
    3. Select the service name you added in step #1.
    4. Right-mouse click and select Properties.
    5. In the General tab, set the Startup Type as Automatic. This automatically restarts the service after reboots and logoffs.
    6. In the Log On tab, set the account the service will use when running. Enter a valid Administrator-restricted account and password.
    7. In the event of failures, you may want to specify what happpens in the Recovery tab.
    8. Start the service. Select the FloppyLock service name. Right-mouse click and select Start.
  • The following is an example batch file to install and start a service.

REM ===============================================
REM ====     Example script for starting a floplock service via command-line     ====
REM ===============================================

REM -------->  Install the service
instsrv MyExampleService "ResourceKitInstalledPath\floplock.exe" -a AdminServiceAccount -p 1AdminPassword

REM  -------> Start the newly added service
sc Start MyExampleService

Uninstalling FloppyLock

  • The easiest way to add or remove a service, either on a local or remote computer, is to use the Service Installation Wizard.
  • To uninstall manually, follow these steps.
    1. Stop the FloppyLock service, if it is running.
    2. Use the command-line syntax:

      One Step instsrv FloppyLock Remove


Getsid.exe

GetSID compares the user security IDs (SIDs) of two accounts.

You can use it to compare account SIDs between a primary domain controller and backup domain controller when you suspect user database corruption.

GetSID Topics

  • GetSID Syntax

File Required

  • Getsid.exe


GetSID Syntax

One Step getsid \\server1 account \\server2 account

Where:

\\server1 and \\server2
are the names of the servers on which the accounts are found, and account is the account SID).


Global.exe

This command-line tool displays members of global groups on remote servers or domains.

For Microsoft® Windows® 2000 Server, a global group is one that can be granted permissions and rights and can become a member of local groups in its own domain, the member servers and workstations thereof, and trusting domains. However, a global group can contain user accounts only from its own domain. Global groups provide a way to create sets of users from inside the domain, available for use both in and out of the domain.

Global groups cannot be created or maintained on computers running Microsoft® Windows® 2000 Professional. For Windows 2000 Professional computers that participate in a domain, however, domain global groups can be granted rights and permissions at those workstations and can become members of local groups on those workstations.

To manage users and groups on your computer in Windows 2000, use Local Users and Groups, under the System Tools node of the Computer Management MMC snap-in, one of the Administrative Tools.

Syntax

One Step global groupname {domainname | \\server} [/?]

Where:

groupname
is the name of the global group of which to display members.
If groupname is multi-word (containing spaces), it must be enclosed in double quotation marks, for example, "server operators".
domainname
is the name of a network domain.
\\server
is the name of a network server.
/?
displays a syntax screen at the command prompt.

Run without parameters, global also displays this syntax screen.

note-icon

Note

To list members of local groups, use Local.exe, another Resource Kit tool.

Examples

global "server operators" nt_domain

displays the members of the group server operators in the nt_domain domain.

global "Domain Users" EastCoast

displays the members of the group Domain Users in the EastCoast domain.

global PrintUsers \\blackcat

displays the members of the group PrintUsers on the server blackcat.

For a group with many users, you can use Global to redirect the member list into a text file, for example:

global Group1 \\Server1 > globallist.txt

Then text files containing membership of different groups can be compared for discrepancies with a program like Windiff, which is included in the Windows 2000 Support Tools.

File Required

  • Global.exe


Gp.chm: Windows 2000 Group Policy Reference

This HTML Help document provides detailed descriptions of the Group Policies in Windows 2000. These descriptions detail the effects of enabling, disabling, and not configuring each policy, and offer explanations of how related policies interact. Policies covered include Windows Settings and Administrative Templates for Computer Configuration and Administrative Templates for User Configuration.

The text of Gp.chm is nearly identical to the text of the Explain tabs for each policy in Group Policy, a MMC snap-in. This file is provided so users can search the text.

File Required

  • Gp.chm


Gpotool.exe: Group Policy Verification Tool

Gpotool.exe: Group Policy Verification Tool NEW

This command-line tool allows you to check the health of the Group Policy objects on domain controllers.

GpoTool can:

  • check Group Policy object consistency. The tool reads mandatory and optional directory services properties (version, friendly name, extension globally unique identifiers (GUIDs) and SYSVOL data (Gpt.ini), compares directory services and SYSVOL version numbers, and performs other consistency checks. Functionality version must be 2 and user/computer version must be greater than 0 if the extensions property contains any GUID.
  • check Group Policy object replication. It reads the Group Policy object instances from each domain controller and compares them (selected GPC properties and full recursive compare for GPT).
  • display information about a particular Group Policy object, including properties that can't be accessed through the Group Policy snap-in such as functionality version and extension GUIDs.
  • browse Group Policy objects. A command-line option can search policies based on friendly name or GUID. A partial match is also supported for both name and GUID.
  • preferred domain controllers. By default, all available domain controllers in the domain will be used; this can be overwritten with the supplied list of domain controllers from the command line.
  • provide cross-domain support. A command-line option is available for checking policies in different domains.
  • run in verbose mode. If all policies are fine, the tool displays a validation message; in case of errors, information about corrupted policies is printed. A command-line option can turn on verbose information about each policy being processed.

GpoTool Topics

  • GpoTool Syntax
  • GpoTool Examples

File Required

  • Gpotool.exe


GpoTool Syntax

One Step gpotool [/gpo:GPO[,GPO…]] [/domain:DNSname] [/dc:DC[,DC…]] [/checkacl] [/verbose] [/new:GPO[,GPO...]] [/del:GPO[,GPO...]] [/?] [/help]

Where:

/gpo:GPO[,GPO…]
processes preferred policies GPO[,GPO…]. Partial GUID and friendly name matches are accepted for GPO. If GPO is not specified, processes all policies in the domain.
Example
/domain:DNSname
specifies the DNS name for the domain hosting the policies. If not present, the user's domain is used.
/dc:DC[,DC…]
finds the preferred list of domain controllers DC[,DC…]. If not specified, finds all controllers in the domain.
/checkacl
verifies the SYSVOL ACL. For faster processing, this step is skipped by default.
/verbose
displays detailed information.
Example
/new:GPO[,GPO...]
create new policies with the specified friendly names GPO[,GPO...].
/del:GPO[,GPO...]
deletes policies with the specified friendly names GPO[,GPO...].
/? or /help
displays this syntax screen on the command line.


GpoTool Examples

Example 1: Verbose Output

The following example analyzes the output of the Group Policy Verification Tool run with the /verbose switch.

c:\>gpotool.exe /verbose

The first part of the output provides a complete list of the domain controllers in your domain that are currently online and available to serve requests.

Domain: domain1.microsoft.com
Validating DCs...
NTDSDC4: down
NTDSDC5.domain1.microsoft.com: OK
NTDSDC.domain1.microsoft.com: OK
NTDSDCB.domain1.microsoft.com: OK
NTDSDC0: down
Available DCs:
NTDSDC5.domain1.microsoft.com
NTDSDC.domain1.microsoft.com
NTDSDCB.domain1.microsoft.com

The next portion of the output provides the number of unique Group Policy objects (different GUIDs) that can be found across all available domain controllers.

Searching for policies...
Found 23 policies

Following this output, the tool outputs the health of each unique GPO. A healthy Group Policy object passes all tests run by this tool, generating the following output:

============================================================
Policy {372B5AB3-A991-11D2-9BEB-00A024070A22}
Policy OK
Details:
------------------------------------------------------------

Output details:

  • The Group Policy object is specified by its GUID.
  • "Policy OK" indicates that the Group Policy object passed all tests.

A Group Policy object that does not pass all tests:

============================================================
Policy {29021088-BF90-11D2-8614-00C04FF621C4}
gpotool: e 	ERROR: Err: CreateTime different between Applications

Error: NTDSDC5.domain1.microsoft.com - NTDSDC.domain1.microsoft.com sysvol mismatch
Details:
------------------------------------------------------------

Output details:

  • The Group Policy object is specified by its GUID.
  • gpotool: e, does not provide any additional information.
  • ERROR: provides information on the test failed by the Group Policy object.
  • Error: provides details of the domain controllers that are effected.

Following this, detailed information on the GPO is displayed individually for each domain controller that contains a copy of the Group Policy object. Therefore, if you have five domain controllers, and each has a copy of the Group Policy object, then the data below will be detailed five times in the output to cover each of the five copies. The status information looks something like this:

------------------------------------------------------------
DC: NTDEV-01.domain1.microsoft.com
Friendly name: EU-SlowLinkPolicy
Created: 2/8/99 7:55:04 PM
Changed: 6/24/99 7:58:08 PM
DS version:     7(user) 2(machine)
Sysvol version: 7(user) 2(machine)
Flags: 0
User extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}]
Machine extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957D-509E-11D1-A7CC-0000F87571E3}]
Functionality version: 2
------------------------------------------------------------

Output details:

  • DC: specifies the domain controller where this copy of the Group Policy object resides.
  • Friendly name: specified the friendly name of the Group Policy object. This is what you see in the Active Directory Users and Computers snap-in.
  • Created: specifies when the Group Policy object was created.
  • Changed: specifies the last time the GPO was changed.
  • DS version: specifies Group Policy object version (directory services portion of the Group Policy object).
  • Sysvol version: specifies Group Policy object version (SYSVOL portion of the Group Policy object).
  • Flags: indicates if the Group Policy object has been fully or partially disabled by the administrator.
  • User extensions: specifies Group Policy user-based extensions by GUID that have been included and configured in the Group Policy object.
  • Machine extensions: specifies Group Policy computer-based extensions that have been included and configured in the Group Policy object.
  • Functionality version: specifies the version of the Group Policy object. The version number must be equal to 2 or higher to work correctly on Windows 2000. Upgrading Group Policy objects is not supported.

Example 2: A Corrupt Policy

This is a sample output for a corrupt policy missing the template directory and version number property. The policy is found based on a partial match of friendly name.

c:\>gpotool.exe /gpo:Corrupt

Error: Property versionNumber not found on BOGDANT4
Error: Cannot access sysvol template on BOGDANT4, error 2
============================================================
Policy {9A89E00A-CB92-11D2-9348-00A0C9220C09}
------------------------------------------------------------
DC: BOGDANT4
Friendly name: Test Corruption Policy
Created: 2/24/99 2:42:47 AM
Changed: 2/24/99 3:01:27 AM
DS version: not found
Sysvol version: not found
Flags: 0
User extensions: not found
Machine extensions: not found
Functionality version: 2
------------------------------------------------------------

Errors found.


Gpresult.exe: Group Policy Results

Gpresult.exe: Group Policy Results NEW

This command-line tool displays information about the result Group Policy has had on the current computer and logged-on user.

GPResult provides the following general information:

  • Operating System
    • Type (Professional, Server, Domain Controller)
    • Build number and Service Pack details
    • Whether Terminal Services is installed and, if so, the mode it is using
  • User Information
    • User name and location in Active Directory (if applicable)
    • Domain name and type (Windows 2000 or Windows NT)
    • Site name
    • Whether the user has a local or roaming profile and location of the profile
    • Security group membership
    • Security privileges
  • Computer Information
    • Computer name and location in Active Directory (if applicable)
    • Domain name and type (Windows 2000 or Windows NT)
    • Site name

GPResult also provides the following information about Group Policy:

  • The last time policy was applied and the domain controller that applied policy, for the user and computer
  • The complete list of applied Group Policy objects and their details, including a summary of the extensions that each Group Policy object contains
  • Registry settings that were applied and their details
  • Folders that are re-directed and their details
  • Software management information detailing assigned and published applications
  • Disk quota information
  • IP Security settings
  • Scripts

GPResult Topics

  • GPResult Syntax
  • Interpreting GPResult Output

File Required

  • Gpresult.exe


GPResult Syntax

One Step gpresult [/v] [/s] [/c] [/u] [/?]

Where:

/v
runs GPResult in verbose mode.
  • Adds list of user's security privileges.
  • Adds Group Policy object details (GUID, friendly name, version, source).
  • Adds details for the following Group Policy extensions:
    • Administrative Templates (Registry-Based Policies)
    • Application Management
    • Disk Quotas
    • Folder Re-direction
    • IP Security
    • Scripts
/s
runs GPResult in super-verbose mode. This includes the same information as verbose in addition to:
  • binary values of binary registry settings when applicable
  • a detailed list of which applications will be displayed in Add/Remove Programs
  • both version numbers of a Group Policy object (the version number of the GPC and the version number of the GPT)
/c
displays information on computer settings only.
/u
displays information on user settings only.
/?
displays a command-line syntax screen.


Interpreting GPResult Output

This example analyzes the output of Group Policy Results when run in verbose mode using the following command line:

gpresult /v

Operating System Information

When GPResult is run with any mode, the following operating system information is always displayed at the top of the output:

Microsoft (R) Windows (R) 2000 Operating System Group Policy Result tool
Copyright (C) Microsoft Corp. 1981-1999

Created on Wednesday, September 29, 1999 at 2:47:26 PM

Operating System Information:

Operating System Type:          Professional
Operating System Version:       5.0.2128
Terminal Server Mode:           Not supported

This output provides you with:

  • Operating system type (Professional, Server, Domain Controller)
  • Operating system version (build number and any installed Service Packs)
  • Terminal Server mode, which indicates if Terminal Server is installed and if so, the mode in which it is installed

User Output

Following the operating system output comes general information for the current user.

The output begins by detailing the user's configuration. This includes domain membership, domain type, and the current site as indicated below:

User Group Policy results for:

CN=Alan Steiner,OU=Users,OU=Test,DC=ntdev,DC=microsoft,DC=com

Domain Name:          NTDEV
Domain Type:          Windows 2000
Site Name:            Red-Bldg99

Following this the output details profile information about the user. The output details the roaming profile (if applicable) and location of the current profile that is in use.

Roaming profile:      \\ntprofiles\roamprof\AlanS
Local profile:        C:\Documents and Settings\AlanS

Next the output details all the security groups that the user belongs to:

The user is a member of the following security groups:

    GROUP1\Domain Users
    \Everyone
    BUILTIN\Administrators
    BUILTIN\Users
    BUILTIN\Power Users
    GROUP1\RedirectedDesktop
    GROUP1\Department 15333
    GROUP1\mydocs1
    \LOCAL
    NT AUTHORITY\INTERACTIVE
    NT AUTHORITY\Authenticated Users

Following the details of security group membership, the output continues by detailing all of the user's security privilege information:

The user has the following security privileges:

    Bypass traverse checking
    Manage auditing and security log
    Back up files and directories
    Restore files and directories
    Change the system time
    Shut down the system
    Force shutdown from a remote system
    Take ownership of files or other objects

For the complete list of security privileges that may be displayed by GPResult, please refer to Security Privileges below.

After detailing security privileges, a time stamp of when the last time Group Policy was applied to current user and the domain controller from which the policy was applied to the current user are listed.

###############################################################

Last time Group Policy was applied: Monday, September 06, 1999 at 9:25:40 AM
Group Policy was applied from: NTDS.ntdev.microsoft.com

===============================================================

Administrative Templates (Registry-Based Policy)

Next, if any registry-based policies have been applied to the user, the following is displayed:

The user received "Registry" settings from these Group Policy objects (GPOs):

    Local Group Policy
        Revision Number:	40
        Unique Name:		Local Group Policy
        Domain Name:

    EU-DesktopLockDown-Admin
        Revision Number:	12 (Active Directory) 12 (Sysvol)
        Unique Name:		{EF06ECF2-A8C9-11D2-B575-0008C7457B4E}
        Domain Name:		group.microsoft.com
        Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

    EU-DesktopSetup-Admin
        Revision Number:	7 (Active Directory) 7 (Sysvol)
        Unique Name:		{29021088-BF90-11D2-8614-00C04FF621C4}
        Domain Name:		group.microsoft.com
        Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

Output details:

  • The output is a list of Group Policy objects that contain registry-based policy settings (including Local Group Policy)
  • Each Group Policy object is displayed with the following details:
    • Friendly Name
    • Revision Number
    • Unique Name (GUID or Local Group Policy)
    • Domain Name
    • Linking information

Next the details of the actual registry-based settings that were applied are displayed:

The following settings were applied from: Local Group Policy

        KeyName:	Software\Microsoft\Windows\CurrentVersion\Policies\System
        ValueName:	VerboseStatus
        ValueType:	REG_DWORD
        Value:		0x00000001

         KeyName:	Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
         ValueName:	NoSMHelp
         ValueType:	REG_DWORD
         Value:		0x00000001

The following settings were applied from: Default Domain Policy

        KeyName:	Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
        ValueName:	NoManageMyComputerVerb
        ValueType:	REG_DWORD
        Value:		0x00000001

         KeyName:	Software\Microsoft\Windows\CurrentVersion\Policies\System
         ValueName:	VerboseStatus
         ValueType:	REG_DWORD
         Value:		0x00000001

Output details:

  • The output lists all registry settings that were applied to the user and the Group Policy object (by its friendly name) that supplied the registry settings.
  • Each registry settings is displayed with the following details:
    • Keyname (location in the registry)
    • ValueName
    • ValueType (for example, DWORD or STRING)
    • Value (The value is displayed here only if it is non-binary. To see a binary value, run GPResult in super-verbose mode with the /s switch.

note-icon

Note

If any of the registry settings is written to a location outside the locations the Group Policy handles, this registry setting is not a true policy setting. Group Policy uses only the following locations:

  • \Software\Policies
  • \Software\Microsoft\Windows\CurrentVersion\Policies

If any registry settings outside of these locations are applied, the following warning is also displayed.

+++++++  Warning!  The next registry setting is not a true policy setting
+++++++            and will be left in the registry when the GPO
+++++++            that created it is no longer applied.

Folder Redirection

If any Folder Redirection policy settings have been applied to the user, output similar to the following is displayed:

===============================================================
The user received "Folder Redirection" settings from these GPOs:

    EU-RedirectedDesktop-User1
        Revision Number:	14 (Active Directory) 14 (Sysvol)
        Unique Name:		{C19B776C-A8E8-11D2-9BEB-00A024070A22}
        Domain Name:		ntdev.microsoft.com
        Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

    EU-FolderRedirection-User1
        Revision Number:	12 (Active Directory) 12 (Sysvol)
        Unique Name:		{FBEE2508-BCAA-11D2-B3EE-00C04FA3787A}
        Domain Name:		ntdev.microsoft.com
        Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

    Desktop is redirected to \\ntpolicy1\desktop\%username%
    My Pictures is redirected to \\ntpolicy1\mydocs1\%username%\My Pictures
    My Documents is redirected to \\ntpolicy1\mydocs1\%username%

Output details:

  • The output is a list of Group Policy objects that contain Folder Redirection policy settings (including Local Group Policy).
  • Each Group Policy object is displayed with the following details:
    • Friendly name
    • Revision number
    • Unique name (GUID or Local Group Policy)
    • Domain name
    • Linking information
  • A list of the folders that have been re-directed, and their re-directed location, is also displayed.

Scripts

If any Scripts policy settings have been applied to the user, output similar to the following is displayed:

===============================================================
 The user received "Scripts" settings from these GPOs:

     EU-Marketing
         Revision Number:	12 (Active Directory) 12 (Sysvol)
         Unique Name:		{EF068882-A229-11D2-B575-0008C7457B4E}
         Domain Name:		ntdev.microsoft.com
         Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

 EU-Canada
         Revision Number:	44 (Active Directory) 44 (Sysvol)
         Unique Name:		{HJ924782-A444-11D2-B444-00039573954F}
         Domain Name:		ntdev.microsoft.com
         Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

     Logon scripts specified in:  EU-Marketing
         \\marketing1\logon$\adlogon.bat

     Logoff scripts specified in:  EU-Marketing
         \\marketing1\logon$\adlogoff.bat

     Logon scripts specified in:  EU-Canada
         \\toronto3\logon$\pplogon.bat

     Logoff scripts specified in: EU-Canada
         \\toronto3\logon$\adlogoff.bat

Output details:

  • The output is a list of Group Policy objects that contain Scripts policy settings (including Local Group Policy).
  • Each Group Policy object is displayed with the following details:
    • Friendly name
    • Revision number
    • Unique name (GUID or Local Group Policy)
    • Domain name
    • Linking information
  • A list of scripts that were run is displayed with the following details:
    • Type of script (logon, logoff, startup, shutdown)
    • Script name
    • Location from where the script was run

Application Management

If any Application Management policy settings have been applied to the user, output similar to the following is displayed:

===============================================================
 The user received "Application Management" settings from these GPOs:

     EU-CorpStandard
         Revision Number:	156 (Active Directory) 156 (Sysvol)
         Unique Name:		{9B4293472AC06-44D2-B22A-0008C7457E8J}
         Domain Name:		ntdev.microsoft.com
         Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

     EU-RedmondSite
         Revision Number:	1536 (Active Directory) 1536 (Sysvol)
         Unique Name:		{9B4999999AC06-12O2-B66A-0008C7457B4E}
         Domain Name:		ntdev.microsoft.com
         Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

     The user has been assigned the following applications:

         Microsoft Office 2000 Premium (RTM)
         GPO Name:	EU-CorpStandard
         Removal Option:	Application is uninstalled when policy is removed

         Microsoft FrontPage 20000
         GPO Name:	EU-RedmondSite
         Removal Option:	Application is uninstalled when policy is removed

     The user has installed the following published applications:

         WinZip 7.0
         GPO Name:	EU-CorpStandard
         Removal Option:	Application is uninstalled when policy is removed

Output details:

  • The output is a list of Group Policy objects that contain Application Management policy settings (including Local Group Policy).
  • Each Group Policy object is displayed with the following details:
    • Friendly name
    • Revision number
    • Unique name (GUID or Local Group Policy)
    • Domain name
    • Linking information
  • A list of assigned and published applications is displayed with the following details:
    • Assigned or published
    • Name of application
    • Name of Group Policy object where the application was configured
    • Removal Option information for the application

If GPResult had instead been run in Super verbose mode (/s), it would also have provided information on which applications would be available in Add/Remove Programs. The output would look similar to the following:

The user has the following applications available in Add/Remove Programs:

         Microsoft Money 99
         GPO Name:	EU-RedmondSite
         Installed:	No

         Connection Manager Self Host -- Smart Card Corpnet Access
         GPO Name:	EU-RedmondSite
         Installed:	No

         Microsoft Excel 97 SR2 (Legacy Deployment)
         GPO Name:	EU-RedmondSite
         Installed:	No

Output details:

  • The output is a list of applications that will appear in Add/Remove Programs. The details provided are:
    • Name of application
    • Name of Group Policy object where the application was configured
    • Installed or not installed

Other Group Policy Extensions

For other Group Policy extensions that ship with Windows 2000 that have been applied to the user, the following is displayed for each of these extensions:

===============================================================
The user received "Name of the Extension" settings from these GPOs:

    EU-SecurityB31
        Revision Number:	14 (Active Directory) 14 (Sysvol)
        Unique Name:		{C19ASDAS-ADD8-11D2-9BEB-002342342342}
        Domain Name:		ntdev.microsoft.com
        Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

    EU-SecurityHR
        Revision Number:	12 (Active Directory) 12 (Sysvol)
        Unique Name:		{FBEASDAS-BDDA-11D2-B3EE-002342342342}
        Domain Name:		ntdev.microsoft.com
        Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

Computer Output

This section repeats the same processes as above for User Output, but this time displays information for the computer that the user has logged on to.

The output begins with general information for the computer, including the computer name and location, domain name, domain type and site name as indicated below.

###############################################################

  Computer Group Policy results for:

  CN=DEVPC01,CN=Computers,DC=ntdev,DC=microsoft,DC=com

  Domain Name:          NTDEV
  Domain Type:          Windows 2000
  Site Name:            Red-Bldg99

After detailing the general information, the output shows a time stamp of when the last time Group Policy was applied to this computer and the domain controller from which Computer Group Policy was applied.

###############################################################

Last time Group Policy was applied: Monday, September 07, 1999 at 7:51:59 AM
Group Policy was applied from: NTDS.ntdev.microsoft.com

===============================================================

The Registry Based Policy, Folder Re-direction, and other Group Policy extensions that have been applied to this computer are detailed at this point. This information is output in the same format as detailed earlier in this document for the User Output.

In addition, the Computer section displays the following when applicable:

IP Security

If any IP Security policy settings have been applied to the computer, output similar to the following is displayed:

===============================================================
 The computer received "IP Security" settings from these GPOs:

     EU-IPSecDefaultClientPol-RandyRam
         Revision Number:	5 (Active Directory) 5 (Sysvol)
         Unique Name:	{6EB61A60-A991-11D2-9BEB-00A024070A22}
         Domain Name:	ntdev.microsoft.com
         Linked to:		Domain (DC=ntdev,DC=microsoft,DC=com)

     Policy Name:	NTDEV Default Client Policy
     Description:	All NTDEV machines get this
     Policy Path:	LDAP://CN=ipsecPolicy{163E9FDB-A9AE-11D2-AFD6-006097936A9F},
CN=IP Security,CN=System,DC=ntdev,DC=microsoft,DC=com

Output details:

  • The name of the Group Policy object that applied IP Security settings. For this Group Policy object, the following details are displayed:
    • Friendly name
    • Revision number
    • Unique name (GUID or Local Group Policy)
    • Domain name
    • Linking information
  • IP Security settings details:
    • Policy name
    • Description
    • Policy path

Disk Quotas

If any Microsoft Disk Quota policy settings have been applied to the computer, output similar to the following is displayed:

===============================================================
 The computer received "Microsoft Disk Quota" settings from these GPOs:

     Local Group Policy
         Revision Number:	25
         Unique Name:		Local Group Policy
         Domain Name:
         Source:		Local computer

     Disk Quotas enabled:			Yes
     Disk Quotas enforced:			Yes
     Quota limit:				80 MB
     Warning level:				120 MB
     Log event when quota limit exceeded:		No
     Log event when quota warning level exceeded:	No
     Apply policy to removable media:		No

Output details:

  • The name of the Group Policy object that applied Microsoft Disk Quotas. For this Group Policy object, the following details are displayed:
    • Friendly name
    • Revision number
    • Unique name (GUID or Local Group Policy)
    • Domain name
    • Source
  • Disk Quota details:
    • Disk Quotas enabled: yes/no
    • Disk Quotas enforced: yes/no
    • Quota limit
    • Warning level
    • Log event when quota limit reached: yes/no
    • Log event when quota warning level exceeded: yes/no
    • Apply policy to remove media: yes/no

Security Privileges

Complete list of security privileges that can be tracked by GPResult in verbose mode:

"Create a token object"
"Replace a process level token"
"Lock pages in memory"
"Increase quotas"
"Add workstations to domain"
"Act as part of the operating system"
"Manage auditing and security log"
"Take ownership of files or other objects"
"Load and unload device drivers"
"Profile system performance"
"Change the system time"
"Profile single process"
"Increase scheduling priority"
"Create a pagefile"
"Create permanent shared objects"
"Back up files and directories"
"Restore files and directories"
"Shut down the system"
"Debug programs"
"Generate security audits"
"Modify firmware environment values"
"Bypass traverse checking"
"Force shutdown from a remote system"
"Remove computer from docking station"
"Synchronize directory service data"
"Enable computer and user accounts to be trusted for delegation"


Grpcpy.exe: Group Copy

This GUI-based tool enables users to copy the user names in an existing group to another group in the same or another domain or on a computer running Microsoft® Windows® 2000.

Users of this program must have at least account operator privileges in the domains within which they want to work.

Files Required

  • Grpcpy.exe
  • Grpcpy.doc


Ifmember.exe

IfMember is a command-line tool that checks whether the current user is a member of a specified group. It is typically used in Windows logon scripts and other batch files.

IfMember uses its own process token to discover group membership, rather than querying the relevant domain controller each time it runs. While this has a significant performance benefit, it does mean that IfMember will only be aware of groups on the local computer, on the computer's domain, and on trusted domains.

IfMember Topics

  • IfMember Syntax
  • IfMember Example

File Required

  • Ifmember.exe


IfMember Syntax

One Step ifmember [/verbose] [/list] [groupname1] [groupname2] ...

Where:

/verbose
prints all group matches
/list
lists all groups the user is in
groupname
specifies one or more group names (separated by a spaces)


IfMember Example

These lines of code illustrate the use of IfMember with IF ERRORLEVEL in a batch file:

ifmember Administrators

if not errorlevel 1 exit

REM the rest of this batch file will only be run if the user is a member of the Administrators group.


Ipsecpol.exe: Internet Protocol Security Policies Tool

Ipsecpol.exe: Internet Protocol Security Policies Tool NEW

This command-line tool configures Internet Protocol Security (IPSec) policies in the directory service, or in a local or remote registry. It does everything that the IPSec Microsoft Management Console (MMC) snap-in does, and is even modeled after the snap-in.

IPSecPol has two mutually exclusive modes: static and dynamic. The default mode is dynamic.

Dynamic mode plumbs policy into the Policy Agent, which is active only for the lifetime of the Policy Agent service. This means it will not be active after a reboot or stopping of the service. The benefit of dynamic mode is that the policy can co-exist with directory service-based policies, which override any local policy not plumbed by IPSecPol.

Static mode creates or modifies stored policy. This policy can be used again and will last the lifetime of the store. This is the mode that the IPSec MMC snap-in uses. Static mode is indicated by the -w flag. The flags listed for static mode in the syntax listing are valid only for static mode. The usage for static mode is an extension of dynamic mode, so please read through the dynamic mode section.

This tool runs only on Microsoft® Windows® 2000.

Why Use IPSecPol?

  • If you have a large and/or complex IPSec policy that you want to configure, IPSecPol can help you by providing a scriptable way to create that policy. Just put your IPSecPol commands into a batch file.

    • Note

    This also provides a backup in case you lose the directory service or registry that the policy is stored in. Just re-run the batch file.

  • IPSecPol facilitates just-in-time policy with its batch ability. If someone wants a secured channel with your server, simply send them the tool binaries and the command line or batch file to run.
  • If your computer is using directory service policy and you want to add rules that will allow you to speak IPSec to computers not covered in the directory service policy, use IPSecPol dynamic mode.
  • If you prefer command-line tools to GUI applications, use IPSecPol.

For a more thorough explanation of IPSec policy terminology, see the online Help for the IPSec MMC snap-in.

Requirements

You must have specific privileges for both dynamic and static mode. For static mode, you must have read/write access to the storage that you write. For dynamic mode, you must have Administrator privileges on the computer to which you are plumbing the dynamic policy.

IPSecPol Topics

  • IPSecPol Syntax
  • IPSecPol Example

Files Required

  • Ipsecpol.exe
  • Ipsecutil.dll
  • Text2pol.dll


IPSecPol Syntax

One Step ipsecpol [\\computername] [-?] [flags]

Where:

\\computername
sets policies on that computer. If used, this flag must be the first argument. If not used, the local computer is assumed.

note-icon

Note

You must have administrative privileges on the computer specified.

-?
displays an extended usage screen. Run without arguments, IpSecPol displays a basic usage screen.

Other flags are listed under either Dynamic Mode or Static Mode.

Flags for dynamic or static mode (listed under Dynamic Mode below):

One Step -f FilterList [-n NegotiationPolicyList] [-t TunnelAddress] [-a AuthMethodList] [-u] [-soft] [{-dialup | -lan}] [-1s SecurityMethodList] [-1k Phase1RekeyAfter] [-1p]

Flag for dynamic mode only:

One Step [-confirm]

Flags for static mode only:

One Step [-w TYPE:DOMAIN] [-p PolicyName:PollInterval] [-r RuleName] [-x] [-y] [-o]

All flags except -f have defaults. You must usually provide -f to specify to which filters to apply the policy, except with the –u, –x, or –y flags, which delete policies or rules.

Dynamic Mode

Dynamic mode plumbs policy into the Policy Agent, which is active only for the lifetime of the Policy Agent service. This means it will not be active after a restart or stopping of the service. The benefit of dynamic mode is that the policy can co-exist with directory service-based policies, which override any local policy not plumbed by IPSecPol.

Each execution of the tool sets an IPSec rule, an IKE policy, or both. When setting the IPSec policy, think of it as setting an IP Security Rule in the UI. So, if you need to set up a tunnel policy, you will need to execute the tool twice, once for the outbound filters and outgoing tunnel endpoint, and once for the inbound filters and incoming tunnel endpoint.

In dynamic mode, if you use a DNS name that resolves to multiple addresses only the first address in the list is used. This is not a problem in static mode.

Read the filter spec help carefully, it is the most difficult and easiest to confuse. In particular, pay attention to how a protocol is specified.

note-icon

Note

References to SHA in IPSecPol refer to the SHA1 algorithm.

Flags for Dynamic or Static Mode

The following flags deal with IPSec policy. If omitted, a default value is used where specified.

-f FilterList
applies a FilterList, which is one or more space separated filterspecs. There is no default. -f is required except with the –u, –x, or –y flags.

      A filterspec is of the format:
      A.B.C.D/mask:port=A.B.C.D/mask:port:protocol

      The Source address is always on the left of the = and the Destination address is always on the right.

      MIRRORING: If you replace the = with a + two filters will be created, one in each direction.

      mask and port are optional. If omitted, Any port and
      mask 255.255.255.255 will be used for the filter.

      You can replace A.B.C.D/mask with the following for
      special meaning:
      0 means My address(es)
      * means Any address
      a DNS name (Note that multiple resolutions are ignored)

      protocol is optional, if omitted, Any protocol is assumed.  If you indicate a protocol, a port must precede it or :: must preceded it. Note that if protocol is specified, it must be the last item in the filter spec.

      Examples:
      Machine1+Machine2::6 will filter TCP traffic between Machine1 and Machine2
      172.31.0.0/255.255.0.0:80=157.0.0.0/255.0.0.0:80:TCP will filter all TCP traffic from the first subnet, port 80 to the second subnet, port 80

      PASSTHRU and DROP filters: By surrounding a filter specification with (),
      the filter will be a passthru filter.  If you surround it with [], the
      filter will be a blocking, or drop, filter.
      Example: (0+128.2.1.1) will create 2 filters (it's mirrored) that will
      be exempted from policy.

      You can use the following protocol symbols: ICMP UDP RAW TCP

      Star notation:
      If you're subnet masks are along octet boundaries, then you
      can use the star notation to wildcard subnets.
      Examples:
      128.*.*.* is same as 128.0.0.0/255.0.0.0
      128.*.* is the same as above
      128.* is the same as above
      144.92.*.* is same as 144.92.0.0/255.255.0.0
-n NegotiationPolicyList
specifies a NegotiationPolicyList, which is one or more space separated IPSec policies in the one of the following forms. The default is ESP[3DES,SHA] ESP[3DES,MD5] ESP[DES,SHA] ESP[DES,MD5].

      ESP[ConfAlg,AuthAlg]RekeyPFS
      AH[HashAlg]
      AH[HashAlg]+ESP[ConfAlg,AuthAlg]

      where ConfAlg can be NONE, DES, or 3DES
      and AuthAlg can be NONE, MD5, or SHA
      and HashAlg is MD5 or SHA

      NOTE: ESP[NONE,NONE] is not a supported config
      NOTE: SHA refers the SHA1 hash algorithm

      Rekey is number of KBytes or number of seconds to rekey
      put K or S after the number to indicate KBytes or seconds, respectively
      Example: 3600S will rekey after 1 hour
      To use both, separate with a slash.
      Example: 3600S/5000K will rekey every hour and 5 MB.

      REKEY PARAMETERS ARE OPTIONAL

      PFS this is OPTIONAL, if it is present it will enable phase 2 perfect
      forward secrecy.  You may use just P for short.
-t TunnelAddress
specifies a tunnel address in one of the following forms. When omitted, TunnelAddress defaults to transport mode.

      A.B.C.D
      DNS name
-a AuthMethodList
specifies a list of space separated auth methods in the following form. The default is KERBEROS.

      A list of space separated auth methods of the form:
      PRESHARE:"preshared key string"
      KERBEROS
      CERT:"CA Info"

      The strings provided to preshared key and CA info ARE case sensitive.
      You can abbreviate the method with the first letter, ie. P, K, or C.
-u
deletes all rules added in dynamic mode.
-soft
allows soft associations. The default is to not allow soft associations.
{-dialup | -lan}
-lan sets policy only for LAN adapters. -dialup sets policy only for dialup adapters. Both are optional: if neither is specified, the default is all adapters.

The following three flags deal with IKE phase 1 policy. An easy way to remember this is that all IKE phase 1 parameters are passed with a 1 in the flag. If no IKE flags are specified, the current IKE policy is used. If there is no current IKE policy, the defaults specified below are used.

-1s SecurityMethodList
specifies a SecurityMethodList, which is one or more space separated SecurityMethods in the following form. The default is 3DES-SHA-2 3DES-MD5-2 DES-SHA-1 DES-MD5-1

      ConfAlg-HashAlg-GroupNum
      where ConfAlg can be DES or 3DES
      and HashAlg is MD5 or SHA
      and GroupNum is:
      1 (Low)
      2 (Med)

      Example: DES-SHA-1
-1k Phase1RekeyAfter
specifies the number of Quick Modes or number of seconds to rekey for phase 1. Put Q or S after the number to indicate Quick Modes or seconds,respectively. The default is no QM limit, 480 minute lifetime. This tag is optional.

      Example: 10Q will rekey after 10 quick modes
      To use both, separate with a slash.
      Example: 10Q/3600S will rekey every hour and 10 quick modes
-1p
enable PFS for phase 1. The default is not enabled.

Flag for Dynamic Mode Only

-confirm
requests confirmation before setting policy. This switch is optional, and can be abbreviated to -c.

Static Mode

In static mode, IPSecPol creates or modifies stored policy. This policy can be used again and will last the lifetime of the store. This is the mode that the IPSec MMC snap-in uses. Static mode is indicated by the -w flag. The following flags are valid only for static mode. The usage for static mode is an extension of dynamic mode, so please read through the dynamic mode section.

Static mode uses most of the dynamic mode syntax, but adds a few flags that enable it work at a policy level as well. Remember, dynamic mode just lets you add anonymous rules to the policy agent. Static mode allows you to create named policies and named rules. It also has some functionality to modify existing policies and rules, provided they were originally created with IpSecPol.

Static mode is designed to provide most of the functionality of the IPSec user interface in a command-line tool, so there are references here to the snap-in.

Static mode requires one change to the dynamic-mode usage. In static mode, pass through and block filters are indicated in the NegotiationPolicyList that is specified by -n. There are three items you can pass in the NegotiationPolicyList that have special meaning:

  • BLOCK ignores the rest of the policies in NegotiationPolicyList and makes all of the filters blocking or drop filters. This is the same as checking the Block radio button in the snap-in.
  • PASS ignores the rest of the policies in NegotiationPolicyList and makes all of the filters pass through filters. This is the same as checking the Permit radio button in the snap-in.
  • INPASS plumbs any inbound filters as pass through. This is the same as checking the Allow unsecured communication, but always respond using IPSEC check box in the snap-in.

For static mode, authorized users can modify the ACLs of the storage to give you access. For the local or remote computer case, IP Security policy objects are stored in:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PolicyAgent\Policy\Local

For the Directory Service case, they are stored in:

CN=IP Security,CN=System,DC=YourDCName,DC=ParentDCName,DC=TopLevelDC

in other words, the IP Security container under the System container.

Flags for Static Mode Only

All static-mode flags are required unless otherwise indicated.

-w TYPE:DOMAIN
writes the policy to storage indicated by TYPE:DOMAIN. This switch is optional.

   TYPE can be either REG for registry or DS for Directory Storage
        if \\machinename was specified and TYPE is REG, will be written
        to the remote machine's registry
   DOMAIN for the DS case only. Indicates the domain name of the
          DS to write to. If omitted, use the domain the local machine is in.
-p PolicyName:PollInterval
names the policy with the string PolicyName. If a policy with this name is already in storage, this rule is added to the policy. Otherwise a new policy is created. If PollInterval is specified, the polling interval for the policy is set.
-r RuleName
names the rule with the string RuleName. If a rule with that name already exists, that rule is modified to reflect the information supplied to IpSecPol. For example, if only -f is specified and the rule exists, only the filters of that rule are replaced.
-x
sets the policy active in the LOCAL registry case. This switch is optional.
-y
sets the policy inactive in the LOCAL registry case. This switch is optional.
-o
delete the policy specified by -p. This switch is optional.
This switch deletes all aspects of the specified policy: do not use it if you have other policies pointing to the objects in that policy.


IPSecPol Examples

Tunnel Policy

This example establishes an AH tunnel between the two specified IP addresses. Note that the phase 1 security method is set with PFS. It also uses -confirm, abbreviated to -c.

ipsecpol -f 128.2.1.1=128.2.1.13 -t 128.2.1.13 -n ah[sha] -apreshare:tooltime -1s des40-md5-3 -1p -c ipsecpol -f 128.2.1.13=128.2.1.1 -t 128.2.1.1 -n ah[sha] -apreshare:tooltime -1s des40-md5-3 -1p -c

Tunnel Policy Tips

  • Each time you run IPSecPol you are plumbing a "rule" into IPSec. So for tunnel policies, you must run the tool twice, once for the inbound and once for the outbound.
  • Specify the tunnel endpoint with -t.
  • Don't use mirroring (the plus symbol) in your tunnel files.

Dynamic Mode For All Traffic From This Host To Any Other Host

This example sets a mirrored filter of me to any using AH md5. It uses Kerberos for the Oakley authority on the local computer.

ipsecpol -f 0+* -n ah[md5]

Setting Dynamic Policy on a Remote Computer

This example establishes a mirrored filter between the two computers named randyram and randyram0, using an AND proposal and a preshared key. It sets policy on \\randyram0.

ipsecpol \\randyram0 -f randyram+randyram0 -n esp[des,sha]+ah[md5] -apreshare:tooltime -c

Using Static Mode to Set up a Domain Policy

This example sets up a policy in the Directory Service for the domain that the computer running this command is in. It sets up a Directory Service-based policy for clients to two secured servers. Both ESP and AH are sent as security offers and the computers negotiate which one they will use. Note the use of abbreviation in the authentication methods (KERBEROS could have been abbreviated as a K) and that this rule is only for LAN interfaces.

ipsecpol -w DS -p "Default Domain Policy":30 -r "Secured Servers" -f 0+SecuredServer1 0+SecuredServer2 -n ESP[MD5,DES] AH[MD5] -a KERBEROS P:ace -lan

Using Static Mode to Set Up a Local Policy

This example sets up a local policy that would negotiate properly with the policy from the previous example (Using static mode to set up a domain policy), so it would be run on SecuredServer1 or SecuredServer2. Note the use of -x to make the policy active.

ipsecpol -w REG -r "Me to Anyone" -p "Secure My Traffic" -f 0+* -n AH[MD5] -a P:ace -x

Updating a rule in static mode is not augmenting the existing rule. Rather, it replaces the rule's current settings with the settings you specify on the command line. For example if you take the policy from Example 5 and want to modify just the negotiation policy, you would execute:

ipsecpol -w REG -r "Me to Anyone" -p "Secure My Traffic" -n ESP[DES,SHA] AH[SHA]PFS

This would replace the original negotiation policy with the one specified above. It would not touch any of the other settings in the existing rule.


Kerbtray.exe: Kerberos Tray

Kerbtray.exe: Kerberos Tray NEW

Tool starts iconified in the system tray.

Kerberos Tray is a GUI tool that displays ticket information for a computer running the Kerberos protocol.

The KerbTray icon is located in the status area of your desktop and can be used to view and purge the ticket cache. Positioning your mouse cursor over the KerbTray icon will display the time left on your initial ticket-granting ticket (TGT) before it expires. The icon will also change in the last hour of life before the Local Security Authority (LSA) renews the ticket.

Note

Your initial ticket-granting ticket (TGT) is the ticket you received when you first logged onto the Windows 2000 domain with your account.

Using KerbTray

Double-clicking will bring up a list of tickets you have obtained since logon. Right-clicking the icon will bring up a menu. Selecting List Tickets will display the same dialog as a double click.

  • List Tickets lists all tickets you have obtained since logon.
  • Purge Tickets will destroy all tickets that you have cached. Use this option with caution. It may stop you from being able to authenticate to resources. If this happens, logoff then logon again. New tickets are acquired the next time Kerberos services are used.

The KerbTray dialog comprises the following sections:

  1. The top section lists the name of your Kerberos client principal associated with your Windows 2000 account.
  2. The scrolling list contains domains and tickets for services that you have used since logon. Select an item here, and its properties are displayed in the remaining sections of the dialog.
  3. The middle section lists the service principal. This name is the target principal name for the selected ticket from the domain list.
  4. The bottom section is a set of property pages (Names, Times, Flags, and Encryption types) which describe attributes of the ticket selected in the scrolling list. Only non-expired tickets show attributes.
Names tab
Option | Description
Client name | Requestor of the ticket. In most cases this is your client principal name.
Service name | Canonical name of the account principal for the service. This is the same as the samAccountName property in the directory for that account. A ticket-granting-ticket (TGT) is a ticket for the key distribution center (KDC) service. The "initial" TGT is the TGT that you got when you logged on for the domain with your account. The service name for a TGT is "krbtgt".
Target name | Service name the ticket was requested for. This is the name of a servicePrincipalName property on an account in the directory.
Times tab
Option | Description
Start time | Time the ticket is valid from.
End time | Time the ticket is valid until. Once a ticket is past this time, it can no longer be used to authenticate to a service.
Renew until | If the ticket is a renewable ticket, then this is the maximum lifetime of the ticket. In order to continue using a ticket it must be renewed. Tickets must be renewed before both the End time and Renew until times expire.
Execution types tab
Option | Description
Ticket Encryption Type | Encryption type used to encrypt the Kerberos ticket.
Key Encryption Type | Encryption type the enclosed session key will be used with.

The following Kerberos ticket flags may be set:

Flags tab
Option | Description
Forwardable | This flag allows for authentication forwarding without requiring the user to enter a password again.
Forwarded | This flag is set by the ticket-granting service (TGS) when a client presents a ticket with the FORWARDABLE flag set and requests it be set by specifying the FORWARDED key distribution center (KDC) option and supplying a set of addresses for the new ticket. It is also set in all tickets issued based on tickets with the FORWARDED flag set.
Proxiable | This flag allows a client to pass a proxy to a server to perform a remote request on its behalf. When set, this flag tells the ticket-granting service (TGS) that it can issue a new ticket, but not a ticket-granting ticket (TGT), with a different network address based on this ticket.
Proxy | This flag is set in a ticket by the ticket-granting service (TGS) when it issues a proxy ticket. Application servers may check this flag and require additional authentication from the agent presenting the proxy in order to provide an audit trail.
May Postdate | This flag must be set in a ticket-granting ticket (TGT) in order to issue a postdated ticket based on the presented ticket.
Postdated | This flag indicates a ticket has been postdated. Postdated tickets provide a way to obtain these tickets from the key distribution center (KDC) at job submission time, but leave them "dormant" until they are activated and validated by a further request of the KDC. When the KDC issues a POSTDATED ticket, it will also be marked as INVALID, so that the application client must present the ticket to the KDC to be validated before use.
Invalid | This flag indicates the ticket is invalid (not valid). A postdated ticket will usually be issued in this form. Invalid tickets must be validated by the key distribution center (KDC) before use. Tickets are presented to the KDC in a ticket-granting server (TGS) request with the VALIDATE option specified. The KDC will only validate tickets after their starttime has passed.
Initial | This flag indicates the ticket was issued using the AS protocol and not issued based on a ticket-granting ticket (TGT).
Renewable | This flag allows the ticket holder to maintain a valid ticket for long periods of time. Renewable tickets have two "expiration times": the first is when the current instance of the ticket expires, and the second is the latest permissible value for an individual expiration time.
HW Authenticated | This flag provides additional information about the initial authentication, regardless of whether the current ticket was issued directly, in which case INITIAL will also be set, or issued on the basis of a ticket-granting ticket (TGT), in which case the INITIAL flag is clear.
Preauthenticated | This flag provides additional information about the initial authentication, regardless of whether the current ticket was issued directly, in which case INITIAL will also be set, or issued on the basis of a ticket-granting ticket (TGT), in which case the INITIAL flag is clear.
OK a delegate | This flag indicates that the server (not the client) specified in the ticket has been determined by policy of the realm to be a suitable recipient of delegation. Windows 2000 will only forward the user's credentials to services that are "ok as delegate".

File Required

  • Kerbtray.exe

For More Information

See "Distributed Security" in the Windows 2000 Server Resource Kit Distributed Systems Guide.

See Internet RFC-1510, The Kerberos Network Authentication Service (v5)


Klist.exe: Kerberos List

Klist.exe: Kerberos List NEW

Kerberos List is a command-line tool that enables you to view and delete Kerberos tickets granted to the current logon session. To use this tool, and see any tickets, your Windows 2000 computer must be joined to a Windows 2000 domain.

Kerberos List from a client shows:

  • Ticket-granting ticket (TGT) to a Windows Kerberos key distribution center (KDC)
  • Ticket-granting ticket (TGT) to Ksserver on UNIX

Warning Deleting Kerberos tickets can disable the full functionality of Windows 2000 for the current logon session.

Kerberos List Topics

  • Kerberos List Syntax
  • Kerberos List Examples

File Required

  • Klist.exe

For More Information

  • Internet RFC-1510, The Kerberos Network Authentication Service (v5)
  • Windows 2000 Resource Kit Online Books


Kerberos List Syntax

One Step klist [-?] [tickets | tgt | purge]

Where:

-?
Display command-line help.
tickets
Lists the currently-cached tickets of services that you have authenticated to since logon. Displays the following attributes of all cached tickets:
Option | Description
Server | Server and domain for the ticket.
KerbTicket Encryption Type | Encryption type used to encrypt the Kerberos ticket.
End Time | Time the ticket becomes no longer valid. Once a ticket is past this time, it can no longer be used to authenticate to a service.
Renew Time | If the ticket is a renewable ticket (see TicketFlags below), then this is the maximum lifetime of the ticket. In order to continue using this ticket it must be renewed before the End Time. It can be renewed as long at it is before the End Time and is before the RenewUntil time.
tgt
Lists the initial Kerberos ticket-granting-ticket (TGT). Displays the following attributes of the currently-cached ticket:
Option | Description
ServiceName | A TGT (ticket-granting-ticket) is a ticket for the KDC service. The service name for a TGT is "krbtgt".
TargetName | Service name the ticket was requested for. This is the name of a servicePrincipalName property on an account in the directory.
FullServiceName | Canonical name of the account principal for the service.
DomainName | The domain name of the service.
TargetDomainName | For a cross realm ticket, this is the realm in which the ticket is good instead of the issuing realm.
AltTargetDomainName | The name supplied to InitializeSecurityContext that generated this ticket, usually an SPN.
TicketFlags | Kerberos ticket flags set on the current ticket in hexadecimal. The KerbTray tool displays these flags visually in the Flags tab.
KeyExpirationTime | The key expiration time from the KDC reply.
Start time | Time the ticket becomes valid.
End Time | Time the ticket becomes no longer valid. Once a ticket is past this time, it can no longer be used to authenticate to a service.
RenewUntil | If the ticket is a renewable ticket (see TicketFlags), then this is the maximum lifetime of the ticket. In order to continue using a ticket it must be renewed. Tickets must be renewed before both the End Time and RenewUntil times expire.
TimeSkew | The reported time difference between the client computer and the server computer for a ticket.
purge
Allows you to delete a specific ticket. Purge tickets will destroy all tickets that you have cached, so use this with caution. It might stop you from being able to authenticate to resources. If this happens you will have to logoff and logon again.


Kerberos List Examples

  • List details about the current ticket. This is useful to determine if you have a valid ticket to the krbtgt/DOMAIN.NAME@REALM.NAME principal.

klist tgt

Cached TGT:

ServiceName: krbtgt
TargetName: krbtgt
FullServiceName: imauser
DomainName: MYDOMAIN.CORP.MICROSOFT.COM
TargetDomainName: MYDOMAIN.CORP.MICROSOFT.COM
AltTargetDomainName: MYDOMAIN.CORP.MICROSOFT.COM
TicketFlags: 0x40e00000
KeyExpirationTime: 0/256/1 1:00:29928
StartTime: 10/6/1999 7:43:02
EndTime: 11/5/1999 7:43:02
RenewUntil: 12/5/1999 7:43:02
TimeSkew: 12/5/1999 7:43:02
  • List all currently cached tickets.

klist tickets

Cached Tickets: (23)

   Server: krbtgt/MYDOMAIN.CORP.MICROSOFT.COM@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/5/1999 7:43:02
      Renew Time: 12/5/1999 7:43:02

   Server: krbtgt/MYDOMAIN.CORP.MICROSOFT.COM@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 15:31:40
      Renew Time: 12/3/1999 15:31:38

   Server: DOMCON-01$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 5:09:08
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-04$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 5:09:08
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-11$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 3:37:07
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-07$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 3:37:07
      Renew Time: 12/4/1999 8:28:53

   Server: RED-ADC-02$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/4/1999 0:35:06
      Renew Time: 12/4/1999 8:28:53

   Server: CPITGDCR01$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 23:05:05
      Renew Time: 12/4/1999 8:28:53

   Server: LDAP/DOMCON-03.mydomain.corp.microsoft.com/mydomain.corp.microsoft.com@
MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 21:20:04
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-03$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 21:20:04
      Renew Time: 12/4/1999 8:28:53

   Server: LDAP/DOMCON-06.mydomain.corp.microsoft.com/mydomain.corp.microsoft.com@
MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 19:37:04
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-06$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 19:37:03
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-02$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 14:19:02
      Renew Time: 12/4/1999 8:28:53

   Server: RED-ADC-01$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 12:42:53
      Renew Time: 12/4/1999 8:28:53

   Server: LDAP/DOMCON-12.mydomain.corp.microsoft.com/mydomain.corp.microsoft.com@
MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 12:42:53
      Renew Time: 12/4/1999 8:28:53

   Server: DOMCON-12$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/3/1999 12:42:53
      Renew Time: 12/4/1999 8:28:53

   Server: LDAP/CPITGDCR01.mydomain.corp.microsoft.com/mydomain.corp.microsoft.com
@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 22:49:46
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/DOMCON-02.mydomain.corp.microsoft.com/mydomain.corp.microsoft.com@
MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 21:06:46
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/DOMCON-07.mydomain.corp.microsoft.com/mydomain.corp.microsoft.com@
MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 19:24:45
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/RED-ADC-02.mydomain.corp.microsoft.com/mydomain.corp.microsoft.com
@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 17:27:44
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/DOMCON-11.mydomain.corp.microsoft.com/mydomain.corp.microsoft.com@
MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 15:41:10
      Renew Time: 12/3/1999 15:31:38

   Server: LDAP/DOMCON-04.mydomain.corp.microsoft.com/mydomain.corp.microsoft.com@
MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 15:31:41
      Renew Time: 12/3/1999 15:31:38

   Server: IMAUSERSCOMPUTER$@MYDOMAIN.CORP.MICROSOFT.COM
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/2/1999 15:31:39
      Renew Time: 12/3/1999 15:31:38


Local.exe

This command-line tool displays members of local groups on remote servers or domains.

For computers running Microsoft® Windows® 2000 Professional, a local group is one that can be granted permissions and rights from the local computer and, if the computer participates in a domain, user accounts and membership in global groups both from its own domain and from trusted domains.

To manage users and groups on your computer in Windows 2000, use Local Users and Groups, under the System Tools node of the Computer Management MMC snap-in, one of the Administrative Tools.

Syntax

One Step local groupname [{domainname | \\server}] [/?]

Where:

groupname
is the name of the local group of which to display members.
If groupname is multi-word (containing spaces), it must be enclosed in double quotation marks, for example, "server operators".
domainname
is the name of a network domain.
\\server
is the name of a network server.
/?
displays a syntax screen at the command prompt.

Run without parameters, local also displays this syntax screen.

note-icon

Note

To list members of global groups, use Global.exe, another Windows 2000 Resource Kit tool.

Examples

local "server operators" nt_domain

displays the members of the group server operators in the nt_domain domain.

local "Power Users" EastCoast

displays the members of the group Power Users in the EastCoast domain.

local Administrators \\blackcat

displays the members of the group Administrators on the server blackcat.

For a group with many users, you can use Local to redirect the member list into a text file, for example:

local Group1 \\Server1 > globallist.txt

Then text files containing membership of different groups can be compared for discrepancies with a program like Windiff, which is included of the Windows 2000 Support Tools.

File Required

  • Local.exe


Logoff.exe

This tool is used to log a user off from the command prompt.

Use LogOff in unattended installation routines to automate ending the current user session. In combination with the autologon registry settings, LogOff enables your script to log on, perform some task such as installation, and log off without user intervention.

Note

Running LogOff without switches will cause the tool to ask for user confirmation and prompt to save unsaved data.

LogOff Topics

  • LogOff Syntax

File Required

  • Logoff.exe


Logoff.exe Syntax

LogOff Main Topic

LogOff Syntax

Note

Running LogOff without switches will cause the tool to ask for user confirmation and prompt to save unsaved data.

One Step logoff [/F] [/N]

Where:

/F,/f
Forces running processes to close, but will ask for user confirmation. The user will not be asked to save unsaved data.
/N,/n
User will be logged-off without confirmation. However, the user will be prompted to save unsaved data.


Mcast.exe

Mcast.exe NEW

This command-line tool can be used to send multicast packets or to listen for packets being sent to a multicast group address.

Mcast is useful for testing whether or not there is multicast connectivity between two computers on your network. This can be done by using Mcast to send packets from one of the computers on your network to the group address you wish to test. On the computer for which you want to test connectivity, you can use Mcast to listen for packets received on the group address. Using this method, you can determine whether or not there is multicast connectivity between the two computers.

Multicasting is a method of point-to-multipoint delivery of information over a network. In contrast to sending multiple packets to multiple unicast addresses, this method sends all information in a single packet and requires no overhead for keeping lists of recipients. And unlike broadcast packets, multicast traffic does not disturb those nodes that are not listening for it. Multicast-capable routers can forward the multicast packet to all networks where there is at least one node listening.

Mcast Topics

  • Mcast Syntax
  • Mcast Examples

Files Required

  • Mcast.exe


Mcast Syntax

One Step mcast [/send] /srcs:sourceaddress /grps:groupaddress [/intvl:[packetinterval]] [/numpkts:[numberpackets]] [/ttl:[timetolive]] [/pktsize:[packetsize]] [/intf:[interfaceaddress]]

One Step mcast /recv /grps:groupaddress [/dump:[packettype]] [/runtime:[duration]] [/intf:[interfaceaddress]]

Where:

/send
sends packets.
/srcs:sourceaddress
specifies the source addresses for the packets; this is a mandatory argument if /recv is not specified.
/grps:groupaddress
specifies the multicast group address to which packets should be sent or from which packets should be received; this is a mandatory argument.
/intvl:[packetinterval]
specifies the interval between sent packets, in milliseconds; the default setting is 10.
/numpkts:[numberpackets]
specifies the number of packets to be sent from each source address provided to each group address provided; the default setting is 100.
/ttl:[timetolive]
specifies the time-to-live value of sent packets; the default setting is 5.
/pktsize:[packetsize]
specifies the size of sent packets in bytes; the default setting is 256.
/intf:[interfaceaddress]
specifies the local interface to bind; the default setting is the default local interface.
/recv
listens for packets.
/dump:[packettype]
dumps the contents of received packets of packettype, where valid settings are:
  • 1 - bad packets
  • 2 - good packets
  • 3 - all packets
The default setting is no dump.
/runtime:[duration]
specifies the duration for which Mcast should run in minutes; the default setting is infinite.


Mcast Examples

This example sends 10 multicast packets with the source address 172.31.253.55 to the group address 230.1.1.1 with an inter-packet spacing of one second (1,000 milliseconds).

mcast /send /srcs:172.31.253.55 /grps:230.1.1.1 /intvl:1000 /numpkts:10
Send Packet - 10

This example listens for multicast packets on the group address 230.1.1.1 for 1 minute.

mcast /recv /grps:230.1.1.1 /runtime:1
Started.... Waiting to receive packets...
Received [1]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Received [2]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Received [3]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Received [4]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Received [5]: [GOOD] SRC- 172.31.253.55 GRP- 230.1.1.1    TTL- 5 Len- 256
Test ran for the specified time - 1 Minutes


Moveuser.exe: Move Users

Moveuser.exe: Move Users NEW

This command-line tool changes the security of a profile from one user to another. This enables you to change the account domain and/or the user name.

Note

MoveUser runs only on Windows 2000, not on Windows NT 4.0 or earlier.

MoveUser Topics

  • MoveUser Syntax

File Required

  • Moveuser.exe


MoveUser Syntax

One Step moveuser [DOMAIN/]user1 [DOMAIN/]user2 [/c:computer] [/k] [/y] [/?]

Where:

user1
specifies a user who has a local profile. Specify domain users in DOMAIN/user format; specify only user for local accounts.
user2
specifies the user who will own the user1 profile. This account must already exist. Specify domain users in DOMAIN/user format; specify only user for local accounts.
/c:computer
specifies the computer on which to make the changes.
/k
specifies that if user1 is a local user, then the user account should be kept.
/y
allows overwriting an existing profile.
/?
displays this syntax at the command prompt.


MSMQ Triggers

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

MSMQ Triggers is Message Queuing application that allows you to associate incoming messages in a queue with functionality in a COM component or standalone .exe. As such, business rules can be invoked in response to such messages without any additional programming.

MSMQ Triggers works with Message Queuing for Microsoft® Windows® 2000 and MSMQ 1.0 for Microsoft® Windows NT® version 4.0.

MSMQ Triggers Concepts

Triggers are associated with specific queues on a computer and are invoked every time a Message Queuing message arrives at such queues. A trigger is comprised of one or more rules. These rules are defined by actions that will be invoked when all conditions associated with a rule are true.

A trigger is an automatic action taken in response to a message event. In the context of MSMQ Triggers, an event is defined as one or more conditions being satisfied with respect to a message arriving at a queue. The collection of all triggers on a particular computer is called the trigger set.

A condition is a test that is applied when a message arrives at a monitored queue. The condition can test for a property of a message only. A condition is always paired with an action.

An action is an executable behavior that is taken when a condition is true. An action can be expressed as an executable and argument list; or, a COM component, method, and argument list. Arguments are also called parameters.

A rule is an action-condition pair. A rule describes an action that will be taken when a specific condition is true. The collection of all rules (for all triggers) on a particular computer is called the rule set. A default rule handler, IMSMQRuleHandler, is used to test the condition and implement the action for a rule. This is the only supported rule handler.

An action is an executable behavior that is taken when a condition is true. An action can be expressed as an executable and argument list; or, a COM component, method, and argument list. Arguments are also called parameters.

A rule is an action-condition pair. A rule describes an action that will be taken when a specific condition is true. The collection of all rules (for all triggers) on a particular computer is called the rule set. A default rule handler, IMSMQRuleHandler, is used to test the condition and implement the action for a rule. This is the only supported rule handler.

The MSMQ Triggers Service reads messages from a monitored queue, that is, the service looks at such messages. Messages are not removed from queues by this service. It should be noted that another Message Queuing application may open the queue and remove messages before the MSMQ Triggers Service can looks at the queue.

Note

On Windows NT 4.0, a trigger cannot be associated with a private queue located on a remote computer.

Why Use MSMQ Triggers?

To provide message-handling functionality currently, applications developers must create a receiving application that invokes specific behavior on a per-message basis.

By using MSMQ Triggers, specific behavior can be invoked at a queue level. Application developers no longer need to write any infrastructure code to provide such message-handling functionality.

MSMQ Triggers Components

MSMQ Triggers consists of three separate programs. The first, Trigserv.exe, is the executable for running the MSMQ Triggers service. The second, Trigsnap.dll, is a snap-in DLL used in Microsoft Management Console (MMC) to manage triggers and define rules. The third, MSMQ Trigger Monitor (Trigmon.exe), is a troubleshooting application used to capture and display detailed trace and diagnostic information generated by the MSMQ Triggers Service.

MSMQ Triggers Topics

  • Installing MSMQ Triggers
  • Using MSMQ Trigger Manager
  • MSMQ Triggers Example
  • Troubleshooting MSMQ Triggers

Files Required

  • Msmqtriggers.exe - self-extracting setup program that installs MSMQ Triggers
  • Trigserv.exe - main executable file for the MSMQ Triggers Service
  • Trigobjs.dll - DLL that contains COM objects used by the MSMQ Triggers Service
  • Trigsnap.dll - snap-in DLL for MMC used to manage triggers and rules
  • Trigmon.exe - Microsoft® Visual Basic® executable for MSMQ Trigger Monitor

For More Information

For more information about Message Queuing, search the
Internet Microsoft Web site.


Installing MSMQ Triggers

MSMQ Triggers runs on Windows 2000 with Message Queuing installed and Windows NT 4.0 with Service Pack 4 and on MSMQ 1.0 installed (x86-based computers only).

MSMQ Triggers cannot be installed on Windows 95, on Windows 98, on dependent client computers, or on server cluster nodes.

MSMQ Triggers is not installed by Windows 2000 Resource Kit Setup. To install it, use the following procedure:

To install MSMQ Triggers

  1. On the Resource Kit CD, open the x86\Apps\Msmqtriggers folder, and then double-click MSMQTriggers.exe to start the setup program. Follow the instructions that appear on the screen.
  2. If needed, configure the MSMQ Triggers Service to run under a domain administrative account for the local computer. The default LocalSystem account can also be used to run this service.
  3. Grant the service account the Peek Message permission for all queues that will be associated with triggers for the local computer.
  4. Verify the computer has network connectivity.

The self-extracting setup program will install all DLL files into the \Winnt\System32 folder and all other files into the \Program Files\Microsoft\MSMQ Triggers folder of the local computer.

The MSMQ Triggers service can run under the LocalSystem account or under a domain administrative account. By default, this service runs under the LocalSystem account. The account used must be able to access queues to which triggers are associated with; specifically, the account must be granted the Log On As A Service right, and you must be granted the Peek Message permission for all applicable queues. For more information, see the Windows 2000 online documentation for Message Queuing.

MSMQ Triggers installs with a set of default configuration values that are stored in the registry. These values can be changed later using the MMC snap-in. For more information, see Changing Default Configuration Values.


Using MSMQ Triggers

Triggers and their rules are displayed in, and can be managed from, the Computer Management snap-in in the Microsoft Management Console (MMC) for Windows 2000 and Windows NT 4.0. For Windows 2000, you must first expand Services and Applications and then expand Message Queuing in the console tree (usually the left pane).

Under the Triggers folder, the Trigger definitions folder and the Rule definitions folder can then be expanded to view individual trigger and rule definitions respectively. Alternatively, a queue folder can also be expanded to view related triggers and rules. Simply right-click a trigger or rule to access properties and definitions.

Note

The version of MMC required for using MSMQ Triggers with the Computer Management snap-in is version 1.1. This version is not provided with Windows NT 4.0. For information on upgrading the version of MMC you are using, see:
Internet Microsoft Management Console Home Page.

For more information on MMC and using snap-ins, see Windows Help for MMC.

Managing Triggers

All triggers created on the local computer are displayed in the Computer Management snap-in. The left pane displays the trigger set and the rule set, while the right pane displays additional properties associated with each trigger.

Triggers can be serialized. Serialized triggers will process messages in the order in which they arrive; however, the throughput is lower than for non-serialized triggers as messages are processed one at a time. Non-serialized triggers allow for higher throughput but may not process messages in the order in which they arrive, such as when multiple messages are processed simultaneously. Multiple triggers associated with a queue must be either all serialized or all non-serialized, otherwise their behavior cannot be defined. It is recommended that you use only a single trigger with the serialized option since the order of trigger firing is random according to their GUIDs.

The following describes the various tasks associated with managing triggers on a computer.

To create a trigger

  1. In the console tree, expand Triggers, right-click Trigger definitions, point to New, and then click New trigger.
  2. In Trigger name, enter a name for the trigger.
  3. In Queue path name, enter the name of the queue to attach the trigger to. This must be the path name, not the format name for the queue. For example, Mycomputer\Myqueue is a valid format.
  4. Select if the trigger is to be enabled or disabled.
  5. Select if the trigger is to be serialized or not.
  6. Create rules for this trigger as needed. For more information, see To create a rule.

Note

Before creating a trigger, verify that the account the MSMQ Trigger Service runs under has been granted the Peek Message permission for all existing queues that will be associated with triggers.

To edit a trigger definition

  1. In the console tree, expand Triggers, double-click Trigger definitions, right-click the applicable trigger, and then click Properties.
  2. Change the trigger properties as needed.

To delete a trigger

  • In the console tree, double-click Triggers, expand Trigger definitions, right-click the applicable trigger, and then click Delete.

Managing Rules for Triggers

All rules created on the local computer are displayed in the Computer Management snap-in. You can assign multiple rules to a trigger; in this case, the rules are executed in the order they are displayed in the rules list. You can change the priority of rules in this list. Rules displayed are disabled by default, you must select the applicable check box next to the rule to enable it for use with the trigger.

To summarize, a rule is comprised of one or more conditions, with an action executed when the condition(s) are true. The condition is applied to a message when it arrives at the monitored queue, and yields either a true or false result. Multiple conditions must all be true for an action to be executed. If no condition is specified, this will always return a true value. This is useful when you want a trigger to fire unconditionally every time a message arrives at the monitored queue. The following table lists the supported conditions.

Condition | Description
Message Label Contains/Does Not Contain | Tests if the label of the arrived message contains (or does not contain) the string you specified. This string is case-sensitive.
Message Priority Equals/Not Equal/Greater Than/Less Than | Tests if the priority of the arrived message satisfies the mathematical expression you specified.
Message AppSpecific Equals/Not Equal/Greater Than/Less Than | Tests if some application-specific numeric value satisfies the mathematical expression you specified.
Message Body Contains/Does Not Contain | This applies only to messages in which the body type is VT_BSTR, otherwise the condition will always be false.
Message Source Machine ID Equals/Not Equals | Tests if the source computer GUID is equal to (or does not equal) the value you specified.

Actions taken when a condition is true are either expressed in the form of an executable file and arguments (parameters), or in the form of a COM component, method, and arguments. You can specify one or more arguments to be passed per action. The supported arguments are listed on the Action tab for the rule definitions property page.

When the action specified is in the form of a COM component, you can specify a return value that determines whether the MSMQ Trigger Service will continue processing rules or not. In this case, the return value should be of the enum type MSMQTriggerObjects::RulesProcessingStatus, and can have the values RULES_PROCESSING_CONTINUE or RULES_PROCESSING_STOP.

The following describes the various tasks associated with managing trigger rules.

To create a rule for a trigger

  1. In the console tree, expand Triggers, right-click Rule definitions, point to New, and then click New rule.
  2. On the General tab, enter a name and a description for the rule.
  3. On the Conditions tab, select a condition from the list, enter the condition value or string in the space adjacent, and then click the plus (+) button. (You can also use the minus (-) button to remove a condition). Repeat this step as needed.
  4. On the Action tab, do one of the following:
    • To start an executable when the condition is met, click Start standalone executable and in Standalone EXE path, enter the folder path and name to the executable file. If desired, select the Show window check box.
    • To start a COM component when the condition is met, click Invoke COM component , in COM component prog-id, enter the program ID or CLSID for the component, and in Method name, enter the method used.
  5. In Parameters, select an argument from the list, and then click the plus (+) button. (You can also use the minus (-) button to remove an argument). Repeat this step as needed.
  6. If applicable, click the up-arrow or down-arrow buttons to move each parameter higher or lower in priority. This changes the order in which the parameters are passed.
  7. When finished, click Apply and then click OK.
  8. In the console tree, right-click the trigger you want to associate the rule with and then click Add/remove rules.
  9. On the Rules list tab, select the check box next to the new rule to enable it.

To edit a rule definition

  1. In the console tree, expand Triggers, double-click Rule definitions, right-click the applicable rule, and then click Properties.
  2. Change properties and values as needed.

To change the priority of a rule for a trigger

  1. In the console tree, expand Triggers, expand Trigger definitions, and then expand the applicable trigger.
  2. Right-click the applicable rule underneath the trigger, point to All Tasks, and then click Move Up or click Move Down as needed to give the rule a higher or lower priority respectively.

To delete a rule

  • In the console tree, expand Triggers, expand Rule definitions, right-click the applicable rule, and then click Delete.

Changing Default Configuration Values

MSMQ Triggers installs with a set of default configuration values. You can change these values after installation using the Computer Management snap-in by right-clicking Triggers, clicking Properties, and then changing the values as needed.

All configuration information, as well as trigger definition information, is stored in the local registry under HKEY_LOCAL_MACHINE\Software\Microsoft\MSMQ\Triggers.

Notes

  • The Default message body value is the size of the buffer that the MSMQ Triggers Service will allocate for an incoming message. This value should be set to a size that will accommodate 90% of all messages that are expected to arrive in monitored queues. If this value is set too small, it will force the service to reallocate these buffers for every message. If set too large, too much memory will be allocated.
  • If you want to use MSMQ Triggers Monitor, you must first select the Write to log queue check box. For more information, see Using MSMQ Triggers Monitor.


MSMQ Triggers Examples

MSMQ Triggers Example

Suppose you create a new trigger named "PrivateTrigger" that is associated with the private queue "Mycomputer\Myqueue", and is comprised of two rules: "MyRule1" and "MyRule2".

Each of these rules defines a condition (such as Message Label Contains "marketing") and an action to be taken when the condition is true (such as open "Pbrush.exe" with parameter "Message Label"). In addition, a rule handler object is attached to the rule, by default this is the supplied IMSMQRuleHandler.

When a message arrives at Mycomputer\Myqueue, the MSMQ Triggers Service is notified. Next, for the "PrivateTrigger" trigger defined for that queue, the rules "MyRule1" and "MyRule2" associated with that trigger are applied. Lastly, Microsoft Paint is opened if all the conditions for those triggers are met (are true).


Troubleshooting MSMQ Triggers

This section discusses the most common problems encountered when using MSMQ Triggers and describes how to use MSMQ Trigger Monitor, a troubleshooting tool used for capturing and displaying trace and diagnostic information generated by the MSMQ Triggers Service.

Common Problems

This topic describes the most common problems and their causes when using MSMQ Triggers.

The MSMQ Triggers Service fails to start.

Probable causes include the following:

  • The MSMQ Triggers service has been configured to run under a domain user account without proper administrative permissions. Note that the default LocalSystem account has sufficient permissions to run the MSMQ Triggers service.
  • The computer has been started with a "no network" profile, thus the RPC calls used by Message Queuing are failing. Verify that the computer has network connectivity.
  • The MSMQ Triggers service has crashed. In-process Component Object Model (COM) components that are invoked can sometimes crash and as a result can also crash the MSMQ Triggers Service. This service should not be restarted until the condition that causes the COM component to crash has been rectified.
  • The MSMQ Triggers Service is unresponsive. This can happen if the invoked action (and associated EXE or COM component) is blocked. This service can commence once the blocked component is able to continue.

A trigger is defined but it does not appear to be firing.

Probable causes include the following:

  • The trigger is currently disabled. Confirm that the trigger has been enabled.
  • The account the MSMQ Trigger Service runs under has not been granted the Peek Message permission for a queue. In this case, you will have to stop and restart this service after changing the permissions for the queue(s).
  • The MSMQ Trigger Service is not running. Verify that this service has been started.
  • The MSMQ Triggers Service has been paused. Verify that this service is not in a paused state.
  • For the first rule created and assigned to the first trigger for a queue, the rule is activated on messages that are already contained in the queue, instead of on messages that arrive in the queue subsequently.
  • The trigger condition is not being met (is false).

The warning "The message "CreateTriggerMonitor() failed to create a new monitor thread as there are already the maximum allowable number of threads in the pool (x)" appears in the Windows event log".

This message is normal when the MSMQ Triggers Service runs under heavy load. It indicates that the maximum number of threads has been reached. You can ignore this warning, or you can increase the maximum number of allowable threads.

Using MSMQ Triggers Monitor

MSMQ Trigger Monitor (Trigmon.exe) is a troubleshooting tool that can be used to capture and view detailed trace and diagnostic information produced by the MSMQ Triggers Service. This tool displays messages as they are issued from the service. Using MSMQ Trigger Monitor, it is possible to trace which threads have fired which triggers for which message.

You can run MSMQ Trigger Monitor by double-clicking Trigmon.exe in Windows Explorer (under \Program Files\Microsoft\MSMQ Triggers).

MSMQ Trigger Monitor provides the following features to assist in trigger testing and development.

  • Displayed trace messages can be exported to a text file. This feature is accessed from the File menu.
  • Selected columns can be displayed or hidden from view. This feature is accessed from the Columns menu.
  • Filtering can be applied to displayed rows. This is done to isolate the history of a particular thread or object for the MSMQ Triggers Service. This feature is accessed from the View menu.
  • Trace messages can be deleted after viewing them, or can be saved for later analysis. This feature is toggled using the Consume Messages check box. Clear this check box if you wish to save trace messages for later analysis. You must first click Open Log Queue to access this check box.
  • MSMQ Trigger Monitor operation can be paused by selecting the Pause Monitor check box.
  • MSMQ Trigger Monitor can produce an audible beep when the MSMQ Trigger Service issues an error or warning message. This feature is disabled by default, and is accessed from the View menu.

Before you can use MSMQ Trigger Monitor, you must first do the following:

  1. Open the Computer Management snap-in.
  2. Right-click Triggers and then click Properties.
  3. On the Triggers configuration tab, select the write to log queue check box.

For more information about using the Computer Management snap-in, see Using MSMQ Triggers.


Netclip.exe: Clipboard Viewer

Netclip.exe: Clipboard Viewer NEW

This GUI tool lets you view the contents of the clipboard of another computer on the network, and to cut and paste any data, in any format, to and from the other computer by dragging and dropping. The same user must be logged into both computers when using NetClip.

To share the clipboard between the two computers, NetClip uses the Microsoft Component Object Model (COM). It fully supports Rich Text Format (RTF) as well as any custom data format supported by your applications.

Using NetClip

To use this tool, simply run Netclip.exe. When it starts you see your local clipboard.

To connect to another computer, click the Connect button on the Toolbar and enter the remote computer name. You can use a NetBIOS name (for example, "mycomputer"), a DNS name (for example, "mycomputer.microsoft.com"), or an IP address (for example, "127.16.0.1").

To terminate the connection with the remote computer, click the Disconnect button.

You can also pass a computer name on the command line, allowing you to put a shortcut on your desktop for each of your computers.

NetClip Requirements

NetClip requires Microsoft® Windows® 2000 or Microsoft® Windows NT® version 4.0 to view and modify the clipboard on another computer. It can also run on Microsoft® Windows® 98 or Microsoft® Windows® 95, but as a local clipboard viewer only.

Note

  • To allow clients to access a server's clipboard via NetClip, you must grant the user launch and access permissions on the server computer. You can do this with either Oleview.exe: OLE/COM Object Viewer or Dcomcnfg.exe, a Windows 2000 program located in the %windir%\System32 directory.
  • If you receive an "Access denied" error when attempting to connect to a remote server's clipboard, make sure that "Enable distributed COM on this computer" is checked on the Default Properties tab of Dcomcnfg.exe.

File Required

  • Netclip.exe
  • Nclipps.dll


Nlmon.exe: NLMonitor

This command-line tool can be used to list and test many aspects of trust relationships.

NLMonitor uses the Computer Browser service to enumerate domain controllers. Therefore if browsing is not working correctly, NLMonitor may produce inconsistent results. Also, the computer where NLMonitor is run, and also those providing the browsing services, must share the same protocols that are used by the domain controllers to carry out their domain activity.

NLMonitor can:
  • show trusted domain controllers

note-icon

Note

The Computer Browser service is used by Windows-based computers operating on each subnet. Computers designated as browsers maintain the browse lists, which contain all shared resources used on the network. Browsing is required by some network applications provided in earlier versions of Windows such as My Network Places, the NET VIEW command, and Windows Explorer.

Using NLMonitor

Once you have started NLMonitor, it might take awhile before a server announces over the network.

The following commands are active:

Command | Description
D/d | Display the last known status of servers.
H/h | Display help.
Q/q | Quit NLMonitor.
R/r | Refresh list content.

NLMonitor Topics

  • NLMonitor Syntax
  • NLMonitor Examples

File Required

  • Nlmon.exe


NLMonitor Syntax

One Step nlmon [/DOMAINLIST:DomainList] [/MONTRUST:Yes|No] [/UPDATE:Mins] [/DEBUG:HexValue]

Where:

/DOMAINLIST:DomainList
Type a comma separated domain list to monitor. The default is Primary/Account Domain.
/MONTRUST:Yes|No
Specify if trusted domains are monitored. Default is No.
/UPDATE:Mins
Specify the refresh time.
/DEBUG:HexValue
Debug out level.


NLMonitor Examples

It may take a few minutes before NLMonitor displays output.
  • Monitor the MYDOMAIN and GLOBAL_SALES domains.

    nlmon /DOMAINLIST:GLOBAL_SALES,MYDOMAIN

    TIME : [10/19 11:58:59]
TIME : [10/19 11:58:59]
****************************************************************************
TIME : [10/19 12:01:44]
DomainName: MYDOMAIN
ServerName      DCState    DCType     DCStatus   ReplStatus PDCLinkStatus
\\OORTC1        DCOnline   NTBDC      0          InSync     0

    Trusted DC List:
    TDomainName     TDCName         TSCStatus
    USREGION        \\nadc-01.northamerica.msn.com 0
    GLOBAL_SALES    \\mktdc-01.sales.msn.com 0
    PRODUCTION      \\adc-01  0

............................................................................
****************************************************************************
    The following table provides more information for reading NlMon output:
    Output item | Description
    Time | Time monitoring occured.
    DomainName | Domain being monitored. In the example, this is MYDOMAIN
    ServerName | Name of the server. In the example, this is OORTC1
    DCState | \\DCOnline
    DCType | NTBDC
    DCStatus Use
    net helpmsg msgNumber
    for details of the specific error message.
    ReplStatus | InSync
    PDCLinkStatus Use
    net helpmsg msgNumber
    for details of the specific error message.
    Trusted DC List:
    TDomainName | Trusted domain name.
    TDCName | Trusted domaincontroller name.
    TSCStatus Use
    net helpmsg msgNumber
    for details of the specific error message.
    Error Code | Description
    0 | The operation completed successfully.
    1311 | There are currently no logon servers available to service the logon request.
    1355 | The specified domain either does not exist or could not be contacted.


Ntrights.exe

With this command-line tool, you can grant or revoke any Windows 2000 right for a user or group of users on a local or remote computer. You can also place an entry in the computer's event log noting the change.

The tool is useful in unattended or automated installations of Microsoft® Windows® 2000 during which you may want to change the Windows 2000 default rights. You can also use it in situations where you need to change a right in an existing installation, but you can't access and logon to all computers.

Note

  • To be able to set a right for a user or group, you must have Administrator privileges.

NTRights Topics

  • NTRights Syntax
  • NTRights Examples
  • Windows 2000 Rights

File Required

  • Ntrights.exe


NTRights Syntax

One Step ntrights {-r Right | +r Right} -u UserOrGroup [-m \\Computer] [-e Entry] [-?]

Where:

-r Right
revokes Right from specified user or group. For a full list, see Windows 2000 Rights.
+r Right
grants Right to specified user or group. For a full list, see Windows 2000 Rights.
-u UserOrGroup
specifies the user or group for whom rights are to be granted or revoked.
-m \\Computer
specifies the computer (machine) on which to perform the operation. The default is the local computer.
-e Entry
adds a text string Entry to the computer's event log.
-?
displays a syntax screen at the command prompt.

Notes

  • To be able to set a right for a user or group, you must have Administrator privileges.
  • Names of Windows 2000 rights are case-sensitive. You must type the string of the right exactly as it appears: for example, SeSystemtimePrivilege and not sesystemtimeprivilege.


NTRights Examples

To grant the right to change the system time to the local users group, run the following command:

ntrights +r SeSystemtimePrivilege -u Users

To revoke the right of the group "Everyone" to access this computer from the network:

ntrights -r SeNetworkLogonRight -u Everyone

NTRights can also operate on remote computers across a network by specifying a target computer. For example, to grant the right to logon as a service on computer NTUSER007 for the user MyService001, you would run the following command:

ntrights +r SeServiceLogonRight -u MyService001 -m \\NTUSER007


Windows 2000 Rights

These are the Windows 2000 rights (and their meanings) that can be granted or revoked with NTRights.

Names of Windows 2000 rights are case-sensitive. You must type the string of the right exactly as it appears: for example, SeSystemtimePrivilege and not sesystemtimeprivilege.

Windows 2000 Right | Meaning
SeAssignPrimaryTokenPrivilege | Replace a process level token.
SeAuditPrivilege | Generate security audits.
SeBackupPrivilege | Back up files and directories.
SeChangeNotifyPrivilege | Bypass traverse checking.
SeCreatePagefilePrivilege | Create a pagefile.
SeCreatePermanentPrivilege | Create permanent shared objects.
SeCreateTokenPrivilege | Create a token object.
SeIncreaseBasePriorityPrivilege | Increase scheduling priority.
SeIncreaseQuotaPrivilege | Increase quotas.
SeLoadDriverPrivilege | Load and unload device drivers.
SeLockMemoryPrivilege | Lock pages in memory.
SeMachineAccountPrivilege | Add workstations to domain.
SeProfileSingleProcessPrivilege | Profile single process.
SeRemoteShutdownPrivilege | Force shutdown from a remote system.
SeRestorePrivilege | Restore files and directories.
SeSecurityPrivilege | Manage auditing and security log.
SeShutdownPrivilege | Shut down the system.
SeSystemEnvironmentPrivilege | Modify firmware environment values.
SeSystemProfilePrivilege | Profile system performance.
SeSystemtimePrivilege | Change the system time.
SeTakeOwnershipPrivilege | Take ownership of files or other objects.
SeTcbPrivilege | Act as part of the operating system.
SeUnsolicitedInputPrivilege |


Oidgen.exe: OID Generator

Oidgen.exe: OID Generator NEW

OID Generator generates a pair of unique base object identifier values for use in extending the Active Directory schema. One object identifier is for use in defining new Attibutes, the other for defining new Classes.

To Use OID Generator

  1. Type oidgen on the command-line. OID Generator requires no parameters.
  2. Cut and paste the new object identifier values from the command window to your document or source code.

note-icon

Note

Before you run OID Generator, setting the following cmd.exe window properties will make it much easier to copy the generated object identifiers into a document or source code. In the Layout tab, set the Window Size width to at least 100. In the Options tab, click the QuickEdit Mode check box to enable copy and paste.

Use the generated object identifier pair as the root of your object identifier space and assign new object identifiers in that space by adding a element to the end of each object identifier and incrementing it for each new class or attribute desired. For example, if the generated Class Root is:

1.2.840.113556.1.5.7000.111.2014652.180672.30.178511.21396.1226462.1996501
your first new class should be:
1.2.840.113556.1.5.7000.111.2014652.180672.30.178511.21396.1226462.1996501.1

File Required

  • Oidgen.exe


Permcopy.exe

This command-line tool copies share (Full Control, Read, Change) and file (Full Control, Modify, Read & Execute, Read, Write, Traverse Directory) level permissions (ACLs) from one share to another.

Important

Copying permissions to an administrative share located on an x86-based computer will cause Services.exe to stop.

PermCopy Topics

  • PermCopy Syntax
  • PermCopy Examples

File Required

  • Permcopy.exe


PermCopy Syntax

One Step permcopy \\SourceServer ShareName \\DestinationServer ShareName

Where:

\\SourceServer ShareName
is the source to use for share permissions.
\\DestinationServer ShareName
is the destination share where permissions are applied.


PermCopy Examples

  • Copy the ResKit share permissions to the SupKit share.
    permcopy \\IMACOMPUTER ResKit \\IMACOMPUTER SupKit
    The command completed successfully.


Perms.exe: File Access Permissions per User

Perms displays a user's access permissions for a specified file or set of files.

To use Perms, you need "Backup files and folders" privileges on the computer where the files are stored, and you must be logged on as a member of the Administrators group for the domain or computer where the user account is defined. Otherwise, "Access denied" errors might occur.

Perms queries the permissions associated with a specific ACE, displaying only those permissions granted by that particular ACE.

Note that if a user is a member of local or global groups with varying sets of permissions, PERMS output does not reflect cases in which this user has been given or denied rights through the ACEs for these local or global groups. The following scenarios illustrate this point:

  • In this case, Perms would show that username has FULL ACCESS, while in fact he or she has NO ACCESS.
  • In this case, Perms would show that username has READ ONLY permission, even though he or she actually has FULL ACCESS.

Perms Topics

  • Perms Syntax
  • Perms Examples
  • Access Masks in Perms Output

File Required

  • Perms.exe


Perms Syntax

One Step perms [domain\|computer\]username path [/i] [/s] [/?]

Where:

[domain\|computer\]username
Name of user whose permissions are to be checked, in the format domain\username or computer\username or local username.
path
Name of a file or folder in any legal format, including UNC (\\). You can use the * or ? wildcards.
/i
Assumes the specified user is logged on interactively to computer where the file/directory resides. With this switch, PERMS assumes the user is a member of the INTERACTIVE group. Without this switch, PERMS assumes the user is a member of the NETWORK group. Indicates that Perms is to assume that account is interactively logged on to the computer where path resides. Without this parameter, Perms assumes the user is logged on over the network and is a member of the Network security group.
/s
Checks permissions on files in subdirectories.
/?
displays help for the Perms command.


Perms Examples

  • Display permissions for files in user "imauser" on computer "IMACOMPUTER" in subdirectories of the C: drive, and send that output to a text file.
    perms IMACOMPUTER\imauserg c: /s >driveCperms.txt


Access Masks in Perms Output

Access mask descriptions in Perms output:
Access | Description
R | Read. Allows or denies viewing the attributes of a file or folder, such as read-only and hidden. Attributes are defined by NTFS.
W | Write. Allows or denies changing the attributes of a file or folder, such as read-only or hidden. Attributes are defined by NTFS.
X | Execute. Allows or denies running program files (applies to files only).
D | Delete. Allows or denies deleting the file or folder. If you don't have Delete permission on a file or folder, you can still delete it if you have been granted the Delete Subfolders and Files permission on the parent folder.
P | Change Permissions. Allows or denies changing permissions for the file or folder, such as Full Control, Read, and Write.
O | Take Ownership. Allows or denies taking ownership of the file or folder. The owner of a file or folder can always change permissions on it, regardless of any existing permissions that protect the file or folder.
A | General All
- | No Access
* | The specified user is the owner of the file or directory.
# | A group the user is a member of owns the file or directory.
? | The user's access permisssions cannot be determined.


Prnadmin.dll: Printer Administration Objects

Prnadmin.dll: Printer Administration Objects NEW

PrinterAdmin is a COM-based tool for managing printers, drivers and ports on local and remote computers. It provides large-scale non-interactive control of printers.

Using PrinterAdmin, you can:

  • add and delete a printer.
  • add and delete a driver.
  • add and delete a TCP port.
  • add and delete a form.
  • view a list of printers, ports, drivers, forms on a certain computer.
  • control and configure printers.
  • print a test page.
  • clone a print server.

PrinterAdmin consists of several scriptable COM objects residing in Prnadmin.dll, which functions as a wrapper around Printui.dll. Several Microsoft® Visual Basic® Script (VBScript) and JavaScript sample files are included with the tool.

Installing PrinterAdmin

To install PrinterAdmin, run the following command:

regsvr32 [path]prnadmin.dll

Files Required

  • Clean.vbs - sample VBScript file
  • Clone.vbs - sample VBScript file
  • Conall.vbs - sample VBScript file
  • Defprn.vbs - sample VBScript file
  • Drvmgr.vbs - sample JavaScript file
  • Forms.vbs - sample VBScript file
  • Persist.vbs - sample VBScript file
  • Portconv.vbs - sample VBScript file
  • Portmgr.vbs - sample VBScript file
  • Prnadmin.dll
  • Prnadmin.doc
  • Prncfg.vbs - sample VBScript file
  • Prnctrl.vbs - sample VBScript file
  • Prndata.vbs - sample VBScript file
  • Prndemo.js - sample JavaScript file
  • Prnmgr.vbs - sample VBScript file


Raslist.exe

This command-line tool displays Remote Access Service (RAS) server announces from a network.

RasList listens for RAS server announces on all active network cards (LANAs) in the computer from which it is run. Its output shows which card recieved the announce.

RasList is a monitoring tool. It may take a few seconds for the data to begin to appear; data will continue to appear until the tool is closed.

Note

RasList uses 1 listening thread per LANA.

RasList Topics

  • RasList Syntax
  • RasList Example

File Required

  • Raslist.exe


RasList Syntax

One Step raslist

RasList takes no parameters. It displays Remote Access Service (RAS) server announces.

To stop RasList, press the ESC key.


RasList Example

c:\>raslist

RASLIST - list of RAS servers on the net
Ready to receive RAS announces on SERVER1
press ESC to exit
Initializing...
RAS announce received from host USER1            on SERVER1
RAS announce received from host USER2 	 		 on SERVER1
RAS announce received from host USER3     		 on SERVER1
RAS announce received from host USER1            on SERVER1
RAS announce received from host USER2   		 on SERVER1
RAS announce received from host USER3   	     on SERVER1
RAS announce received from host USER1            on SERVER1
RAS announce received from host USER2    	   	 on SERVER1
RAS announce received from host USER3   	     on SERVER1
RAS announce received from host USER1            on SERVER1
RAS announce received from host USER2   		 on SERVER1
RAS announce received from host USER3   	     on SERVER1
RAS announce received from host USER1            on SERVER1
RAS announce received from host USER2   	     on SERVER1
RAS announce received from host USER3   	     on SERVER1
RAS announce received from host USER4    	     on SERVER1
RAS announce received from host USER1            on SERVER1
RAS announce received from host USER2    		 on SERVER1
RAS announce received from host USER3      	     on SERVER1


Rassrvmon.exe: RAS Server Monitor

Rassrvmon.exe: RAS Server Monitor NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Using this tool, you can monitor the remote access server activities on your server in greater detail than the standard Windows tools allow.

RasSvrmon provides the following monitoring information:

  • Server information: time of first call to server, time of most recent call to server, total calls, total bytes passed through sever, peak connection count, total connect time, currently connected users, and their connection information
  • Per Port information: time of first call to port, time of most recent call to port, total connections to this port since server started, total bytes passed on this port, total errors on this port, current port status
  • Summary information: Statistics are kept for each unique user/computer combination since the start of the monitoring-total connect time, total bytes transmitted, connection count, average connect time, total error count
  • Individual Connection information: Per connection stats for each connection--user name/computer name, IP address, connection establishment time, duration, bytes transmitted, error count, line speed

RasSvrmon also allows alerting for the following conditions:

Dead Server | Rasmon uses the MprAdminPortEnum API to get statistics from the server. If this API fails, it means the remote access server was unreachable, or in a non-responsive state. You can set RasSrvmon to alert you if this happens X number of times without a success. By default X is 120, which is 10 minutes.
No Incoming Calls | If the remote access server has not taken a call in a while, it could indicate a non-functioning server, or a problem with the lines, or any of a number of other conditions. Or, it could be that you just don't have anyone calling in.

Note

To allow for more flexibility, the alerting is setup to run a program of your choosing. This gives you the flexibility to send mail, or a page, or a network popup, or any other action you can automate with an executable file name or a batch script.

Limitations

  • If the server takes more than 30,000 calls or so the data files get big. They need to be archived and RasSvrmon restarted.
  • Only focuses on one remote access server at a time. To monitor multiple computers, run multiple instances of RasSvrmon.

RasSvrmon Topics

  • RasSvrmon Syntax
  • RasSvrmon Reports
  • RasSvrmon Files

Files Required

  • Rassrvmon.exe
  • Reportgen.exe


RasSvrmon Syntax

One Step RasSvrmon –s:servername [–t:time_offset] [–p:SVCHOST_pid]

Where:

–s:servername
Will start RasSvrmon focused on a remote computer named servername. You can also use the IP address of the remote computer.
–s:servername –t:time_offset
Will start focused on servername, but will reflect the amount of time the remote access server has been running before the monitoring tool was started. This will show up in the servername.webstatus file.
–p:SVCHOST_pid
If you are running RasSvrmon on the remote access server itself, you need to use the –p switch instead of –s. Give the process ID of the svchost process that remote access server is running under.
note-icon

Note

This is not an ideal way to run RasSvrmon. One of RasSvrmon uses is to alert you if the remote access server quits. If the monitor is running on the computer that quits, obviously you will not be alerted.


Generating Reports for RasSvrmon

Generating RasSvrmon Reports

Using the Reportgen tool, you can generate several reports from the data files created by RasSvrmon.
REPORTGEN –d:3/1/99   (Show summary of connections since March 1, 1999)
Username                         Connect Count        Bytes         Connect Time
================================================================================
userone                                1           7,897,391            02:17:01
usertwo-auto                           5             625,304            00:11:30
userfour                               2           3,442,873            00:44:26
userthree                              1           1,044,271            00:05:51
usernine                               2             650,063            00:12:32
user_one	                           1               4,236            00:01:48
------------------------
Total                                 12          13,664,138            03:33:08
REPORTGEN –d:3/1/99 –t:16:00  (Show summary of connections since 4:00pm on March 1, 1999)
Username                         Connect Count        Bytes         Connect Time
================================================================================
usertwo-auto                            4             493,378            00:08:54
userfour                                1             211,982            00:11:18
usernine                                2             650,063            00:12:32
------------------------
Total                                   7           1,355,423            00:32:44
REPORTGEN –f (Frequency distribution to see when the peak usage is, and how long it lasts)
Time                           New    Total
===========================================
Fri Mar 05 04:01:00 1999        4       8
Fri Mar 05 08:01:00 1999        28      31
Fri Mar 05 12:01:00 1999        15      24
Fri Mar 05 16:01:00 1999        27      35
Fri Mar 05 20:01:00 1999        13      21
Sat Mar 06 00:01:00 1999        7       18
Sat Mar 06 04:01:00 1999        2       9
Sat Mar 06 08:01:00 1999        11      16
Sat Mar 06 12:01:00 1999        20      27
Sat Mar 06 16:01:00 1999        29      37
Sat Mar 06 20:01:00 1999        23      34
Sun Mar 07 00:01:00 1999        3       18
Sun Mar 07 04:01:00 1999        3       12
Sun Mar 07 08:01:00 1999        21      29
Sun Mar 07 12:01:00 1999        30      47
Sun Mar 07 16:01:00 1999        45      59
Sun Mar 07 20:01:00 1999        40      54
Mon Mar 08 00:01:00 1999        17      32
Mon Mar 08 04:01:00 1999        30      41
Mon Mar 08 08:01:00 1999        30      45
Mon Mar 08 12:01:00 1999        46      56
Mon Mar 08 16:01:00 1999        54      62
Mon Mar 08 20:01:00 1999        39      54
REPORTGEN –c (First and last recorded connection for each user.  Finds stale accounts)
Name                     First                          Most Recent
================================================================================
usertwo                  Mon Nov 30 08:57:11 1998       Mon Mar 08 19:15:44 1999
someone1				 Thu Dec 17 18:32:58 1998       Sun Mar 07 16:52:31 1999
someone2                 Mon Dec 21 21:04:48 1998       Mon Mar 08 21:11:38 1999
someone3                 Mon Dec 28 23:04:49 1998       Mon Dec 28 23:04:49 1998
someone4                 Tue Dec 01 14:51:12 1998       Mon Mar 08 21:46:19 1999
someone8                 Thu Dec 03 09:16:17 1998       Fri Feb 05 10:12:56 1999
REPORTGEN –p:PPP|ARAP (Show only PPP or only ARAP connections to the server)


Files Generated by RasSvrmon

RasSvrmon generates four files for each remote access server monitored.
  • Servername.webstatus
  • Servername.userdetails
  • Servername.userlist
  • Servername.webstatus

    A file is generated for each remote access server monitored, and is updated every 30 seconds.

    note-icon

    Note

    These files can be collected and posted every minute or so to a Web server. Anyone wanting to know current server load, can just view the Web page.

Server:                 192.168.170.24
Monitored Uptime:       29d 18:52:06
Peak Connections:       10
Current Connections:
        user22:         13:06:47
        user22:         13:06:48
        user17:         01:30:23
        user17:         01:30:23
Total Calls:            129
Total Bytes:            3,333,164,636
Total Connect Time:     11d 01:57:14
Last Status Update:     Wed Mar 10 09:10:04 1999
  • Servername.userdetails

    Each line in the file represents a link connection. The fields are tab separated so they can easily be imported into Microsoft® Excel, or a database, or whatever you prefer to use. The fields in each line are as follows:

  1. User name
  2. Computer name
  3. Bytes transmitted
  4. Date connection was established
  5. Connection duration
  6. Port name
  7. remote access server connection flags
    • #define RAS_FLAGS_PPP_CONNECTION 0x00000001
    • #define RAS_FLAGS_MESSENGER_PRESENT 0x00000002
    • #define RAS_FLAGS_RAS_CONNECTION 0x00000004
    • #define RAS_FLAGS_ARAP_CONNECTION 0x00000008
  8. IP address
  9. Connect speed
user17  USER121 1,610,877,608   Fri Mar 05 09:54:38 1999        2d 19:52:47     EICON S2M ISDN adapter (ISA)    3       192.168.170.105  64000
user17  USER121 1,611,662,435   Fri Mar 05 09:54:39 1999        2d 19:52:46     EICON S2M ISDN adapter (ISA)    3       192.168.170.105  64000
user17  USER121 7,193   Mon Mar 08 05:47:39 1999        00:18:48        EICON S2M ISDN adapter (ISA)    3       192.168.170.111  64000
user17  USER121 7,614   Mon Mar 08 05:47:38 1999        00:18:49        EICON S2M ISDN adapter (ISA)    3       192.168.170.111  64000
user1   ISDNPIP 2,052   Mon Mar 08 12:53:07 1999        00:00:16        EICON S2M ISDN adapter (ISA)    3       192.168.170.109  64000
user1   ISDNPIP 1,516   Mon Mar 08 12:53:08 1999        00:00:15        EICON S2M ISDN adapter (ISA)    3       192.168.170.109  64000
user1   ISDNPIP 708,610 Mon Mar 08 13:11:58 1999        00:09:32        EICON S2M ISDN adapter (ISA)    1       192.168.170.110  64000
user1   ISDNPIP 1,974,212       Mon Mar 08 13:11:59 1999        00:09:34        EICON S2M ISDN adapter (ISA)    1       192.168.170.110  64000
  • Servername.userlist This file is used by REPORTGEN to generate the data dumps.


Rasusers.exe: Remote Access Users

RasUsers lets you list for a domain or a server all user accounts that have been granted permission to dial in to the network via Routing and Remote Access, a feature of Microsoft® Windows® 2000 that implements remote access functionality.

RasUsers Topics

  • RasUsers Syntax
  • RasUsers Examples

Files Required

  • Rasusers.exe
  • Rassapi.dll


RasUsers Syntax

One Step rasusers { DomainName | ServerName } [/?]

Where:

DomainName
is the name of a domain on which to list Routing and Remote Access accounts.
ServerName
is the name of a server on which to list Routing and Remote Access accounts.
/?
displays a brief usage message.

Files Required

  • Rasusers.exe
  • Rassapi.dll


RasUsers Examples

  • View all authorized Routing and Remote Access users in a specific domain.

    rasusers MYDOMAIN

    user1
user2
user3
testpod
  • View all authorized Routing and Remote Access users on a Routing and Remote Access server.
    note-icon

    Note

    To find the names of Routing and Remote Access server computers, use raslist.exe, a Resource Kit tool. It will detect Routing and Remote Access servers as they announce themselves over a network.

    rasusers \\MYCOMPUTER

    ce
user4


Rdpclip.exe: File Copy

Rdpclip.exe: File Copy NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

File Copy is an extension to Terminal Server that allows you copy and paste between server and client.

RdpClip allows you to copy and paste files between a terminal session and client console session. Using RdpClip, you can:
  • copy and paste multiple files and directories
  • copy and paste on Windows 32-bit or 16-bit clients

File Copy is a tool that extends the Terminal Services cut, copy, and paste capabilities. In Windows 2000, you can use Terminal Services to cut and paste text and graphics between the client and server sessions. Using File Copy, you are also able to use cut, copy, and paste to transfer files and folders between the client and server sessions.

File Copy has both client and server components. These components make use of the Terminal Services Virtual Channel architecture to provide client and server integration.

There is no specific User Interface for File Copy as it works through the normal clipboard facilities. Once File Copy is installed on the client and server, you can select a file or folder, and use the system or application clipboard controls to copy or cut it (for example: CTRL+C or selecting Edit then Cut). You can then move to the other system (client if you were on the Terminal Server or vice versa), and again use the clipboard controls to paste the selection. The File Copy facility uses the virtual channel to stream the selection to the destination.

File Copy Topics

  • Installing RdpClip

File Required

  • RDPClip.exe - The Terminal Service RDP protocol clipboard extension facility. This replaces the RdpClip that is included with Windows 2000.
  • fxfr.dll – Extends Terminal Services clipboard redirection through the virtual channel to support large streams.
  • rdpdr.dll – This file replaces the normal Terminal Services rdpdr.dll file, which provides clipboard and file redirection. This version makes use of fxfr.dll
  • fxfr.ini - Server-side registry setup file
  • fxfrinst.bat - Install file


Installing RdpClip

File Copy must be installed on each Terminal Server, and on each computer that is to be a Terminal Server client.

Server Setup

  • Run fxfrinst.bat.

    • -or-
  • Perform the following manual steps:
    1. Create a folder named "rdpclip" in the System32 folder in your winnt directory
    2. Copy the file RDPClip.exe into this new rdpclip folder.
    3. Set up the following registry key. This may be done manually, or by running the fxfr_srv.reg tool. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd] "StartupPrograms"="rdpclip\rdpclip.exe"
    4. Copy the file fxfr.dll to your %systemroot$\System32 directory.

Client Setup

There are separate files for Win16 and Win32 clients. Be sure you are using the correct version. The 16-bit files can be found within the 16 bit client subdirectory of the rdpclip directory.

  1. Copy the file fxfr.dll to the Terminal Server Client installation folder. By default, this is C:\Program Files\Terminal Server Client. This is the same folder that contains the file mstsc.exe.
  2. Copy the file rdpdr.dll to the Terminal Server Client installation folder. This replaces the rdpdr.dll installed with the Terminal Services client.


Remote Administration Scripts

Remote Administration Scripts NEW

The Remote Administration Scripts are a collection of Microsoft® Visual Basic® scripting tools designed to perform specific administrative tasks using Microsoft Active Directory™ Service Interfaces (ADSI) and Windows Management Instrumentation (WMI) for Windows 2000. Rscripts.chm is an HTML Help file that documents the Remote Administration Scripts.

Files Required

  • Rscripts.chm

The Remote Administration Script .vbs files are located in the Ras.cab of the Windows 2000 Resource Kit. They are installed into the user-definable installation directory during standard Resource Kit installation.

For More Information

For more information about Active Directory, see the Internet Microsoft Windows 2000 Server Active Directory Web site.

For more information about WMI, search the Internet MSDN Online Web site.

For more information about VBScript and Windows Script Host, see the Internet Microsoft Windows Script TechnologiesWeb site.


Remote Command Service (Rcmd.exe & Rcmdsvc.exe)

The Remote Command Service provides a secure, robust way to remotely administer and run command-line programs.

Remote Command Service consists of client and server components. The client is a command-line program, Rcmd.exe. The server end, Rcmdsvc.exe, is installed and run as a service. That is, it can be stopped and started locally or remotely via the Control Panel Network application, or locally with the NET START and NET STOP commands. As a service, if configured to start automatically, it will run whenever the system is running, independently of whether a user is locally logged on.

A command session, or "virtual console," is created when a client connects to the server. It is not visible on the desktop, and does not in any way interfere with it. Up to ten clients may be simultaneously connected to the remote command server on a computer, all operating securely and independently of each other.

Remote Command Service Topics

  • Remote Command Installation
  • Remote Command Operation
  • Interactive Session
  • Interactive Multi-Session
  • Single-Command Session
  • Remote Command Security
  • Remote Command Limitations

Files Required

  • Rcmd.exe
  • Rcmdsvc.exe


Remote Command Installation

The Resource Kit setup program installs the Remote Command Service files into your Resource Kit folder. No further installation is necessary for the Remote Command client.

To install the Remote Command server

  1. At the command prompt, go to the Resource Kit directory.
  2. Run rcmdsvc -install to install the Remote Command Service. You must have administrative privileges on this computer to do this.
  3. To start the service, run net start rcmdsvc.

You do not have to restart the system for the installation to take effect. There are no configuration options.

Before using Remote Command Server, however, you must start the service.

To start the service

one step At the command prompt, run net start rcmdsvc.

To uninstall the service

  1. At the command prompt, go to the Resource Kit directory.
  2. Run net stop rcmdsvc to stop the service.
  3. Run rcmdsvc -uninstall to remove the service.


Remote Command Operation

To start the client side, type rcmd at the command prompt.

For syntax details, at the command prompt, type:
One Step rcmd /?

There are three modes of operation:

  1. Interactive Session
  2. Interactive Multi-Session
  3. Single-Command Session


Interactive Session

    To run an interactive session

  1. At the command prompt, type rcmd \\server_name.

    2. This establishes a command session with the computer specified in server_name.

  2. Enter multiple commands, if necessary.
  3. Press CTRL+BREAK to quit the session and exit Remote Command Service.

    4. If a program is running on the target at the time the session is closed, the program will be closed, except for spawned, detached processes (see Remote Command Limitations).

  4. Type exit to quit the remote command shell and break the session.


Interactive Multi-Session

    To run an interactive multi-session

  1. At the command prompt, type rcmd.
  2. Type the server name without the \\.

    3. When a server name is entered, if the session is successfully established, multiple commands can be entered, as in Interactive Session mode. However, pressing CTRL+BREAK or CTRL+C will break only the session and not exit the program. Instead, the program will prompt for another server with which to establish a new session.

  3. Type CTRL+BREAK again to quit the session and exit Remote Command Service.


Single Command

Single-Command Session

To run a single-command session, at the command prompt, type
One Step rcmd \\server_name command

The specified command on the specified server executes. Upon completion of the command, Remote Command Service quits. This is particularly useful for executing a series of commands to multiple servers from a batch command script.


Remote Command Security

Security is provided in two ways:

  • The logged-on user must have interactive logon privileges on the target computer in order to connect to it.
  • Any programs executed on the target computer are executed impersonating the logged-on user. Any access validation (such as opening files) is performed as if the user were logged on to the local computer.

Note

All Windows 2000 Professional users have interactive logon privileges by default. Anyone who can locally log on to your system can transparently access it over the network, unless you configure it otherwise. For Windows 2000 Server, however, only system administrators have this privilege.


Remote Command Limitations

  • Only non-MS-DOS programs using STDIN/STDOUT/STDERR for input/output will function redirected across the network. Programs that use the Win32 Console API will not work correctly. MS-DOS programs will not work. Generally, any programs that use on-screen character mode windows or cursor manipulation (such as screen-mode editors) will not work.
  • It is not possible to connect with the user's credentials, from the remote shell, to file resources remote to the target computer. The only way to connect is to specify a user name and password with the NET USE command (see NET USE help). Due to the way the NET USE command works, it is not possible to be prompted for the password; it must be entered on the command line, and, in any case, is then sent in clear text across the network.
  • Executing START on the remote computer will result in starting detached processes. These processes are not "connected" (that is, no input or output is possible), and will not be stopped when you exit the remote command shell. This wastes resources on the remote computer.
  • The standard users environment is not set up in the remote command shell. Any environment must be set up explicitly during the command session.


Remote Console

Remote Console is a client/server application that you can use to run a remote command-line session. In this command-line session, you can launch any other application remotely. A Remote Console session resembles a telnet session under UNIX.

The Remote Console Server service launches a Cmd.exe process for each client connection (Cmd is the command-line interpreter). Remote Console then takes full control of the console in which Cmd is running and notifies the clien of any video memory change to that console. As Remote Console does not redirect standard output, but directly takes control of video memory, you can use this tool to remotely run any command-line program that uses video memory, such as Edit.

When you run Remote Console, the client sends all keyboard events to the Remote Console server, so that these events are simulated in the Cmd console on the server side.

Few tools besides Remote Console run applications remotely. For example, Remote.exe (a Support Tool included with Windows 2000) is not a service but simply redirects standard input and output, so console programs that take control of the video memory and the keyboard do not work with Remote. Along with Remote Command Service and Rshsvc.exe: TCP/IP Remote Shell Service, Remote Console Server offers users a new way to run consoles remotely and to take control of a Cmd session.

The Remote Console client is compatible with any version of Microsoft® Windows® 2000 or Microsoft® Windows NT®, and runs only on these platforms.

Caution

Permitting all users to connect to Remote Console Server can compromise server security, as Remote Console clients are given a Cmd session. Any user who is given access to a Cmd session can run any application as if they were actually logged on to the server.

Remote Console Topics

  • Remote Console Installation
  • Remote Console Client Syntax
  • Monitoring Remote Console Clients
  • Security Notes
  • Client/Server Console Display Notes
  • Rconmode

Files Required

  • Oemsetup.inf
  • Rclient.exe
  • Rcongrp.exe
  • Rconmode.exe
  • Rconmsg.dll
  • Rconstat.exe
  • Rconsvc.exe
  • Rcruncmd.exe
  • Rsetup.exe


Remote Console Installation

Server Setup

Remote Console includes a command-line setup program, Rsetup.exe. This program can be used by a domain administrator to remotely install Remote Console on a large number of computers.

To run Rsetup, you must be a member of the Administrators group on the target computer.

One Step rsetup [\\computername]

installs Remote Console on computername or the local computer, if no target is specified.

Rsetup:

  • copies all files to \%SystemRoot%\System32.
  • installs or updates the service Rconsvc (Remote Console Server).

If Remote Console is already installed on the target computer then it is automatically updated

The Remote Console Server service is started automatically at startup.

Client Setup

No special installation beyond the Resource Kit setup is required to run the client. If you have not installed the Resource Kit, copy Rclient.exe to a directory in your path on the client.

The Remote Console client is compatible with any version of Windows NT or Windows 2000, and runs only on these platforms.

To run the Remote Console client, see:

Remote Console Client Syntax


Remote Console Client Syntax

At the command prompt on the client computer, type:

One Step rclient [\\]servercomputername [/e[ncrypt]] [/logon[:[domainname\]username] [password]] [/s[lowlink]] [/r[unbatch] batchfilename]

Where:

/e[ncrypt]
Encrypts all data sent, so the contents of the console are only accessible to the Remote Console client. Doing this gives the user a way to keep the console contents secret. The /encrypt option is available only if both the client and the server are running Windows 2000, Windows NT Server version 4.0, or Windows NT Workstation 4.0.

Caution

The /encrypt option does not work on the French version of Remote Console.

/logon
Enables the server to give the Cmd.exe process, which runs on behalf of the client, a logon ID. With this logon ID, the Cmd process uses the client's credentials (domainname, username and password) to make network connections.

Use this option if you are planning to use network connections after connecting to the server.

If a user name is not specified along with /logon, the current user is used. If the password has not been passed in the command line, the user is prompted to enter a password after Remote Console starts. After the user enters the password, the credentials are encrypted and sent to the server. Remote Console follows this process because Windows NT security does not support SecurityDelegation mode, which allows propagating an access token from one server to another.

Note that the /logon option of the client now encrypts the password with a Data Encryption Standard (DES) algorithm.

Caution
Password encryption is available only if both client and server are running Windows 2000, Windows NT Server 4.0, or Windows NT Workstation 4.0.

/s[lowlink]
Makes a low-speed connection.

Use this option if the client and the server are linked with a low-speed connection (not a LAN), for example, a RAS connection or a connection over a router.

This option enables both the client and the server to tune their parameters so that the stream of data that goes across the wire relies upon the link speed. If the /slowlink option is not used, the amount of data that goes across the wire is computed regardless of the link speed.

/r[unbatch] batchfilename
Executes a batch file and exits. For example:

rclient \\server /runbatch mycommand.bat

rclient \\server /runbatch "mycommand.bat argument1 argument2 ... argumentn"

Note

The Remote Console client is compatible with any version of Windows NT or Windows 2000, and runs only on these platforms.


Monitoring Remote Console Clients

You can monitor Remote Console connections in two ways:

  1. You can view the system event logs, where all Remote Console clients connections are logged. A Success Audit event is logged on the server when a client connects to Remote Console Server, and another Success Audit event is logged when the same user is disconnected. Each user is given a unique ID so that the administrator can find, for example, the disconnection event matching a given connection event.
  2. If you have Administrator access, you can also run Rconstat.exe on the server, or remotely when connected to the server with the Remote Console client. Rconstat does not take any parameters and lists all the current connections. Rconstat output looks like the following:

Current number of clients = 1

Total number of clients since service has started = 1

Id Client User Name Start Time In Out

-------------------------------------------------------------------------------

1 DOMAIN\User Wed Aug 21 18:48:10 1996 2KO 59KO

Use of Rconstat is limited to Administrators; all other users receive an "access denied" error message if they attempt to use it. Notice that the Rconstat client user name is always "NT AUTHORITY\SYSTEM" on the Windows NT 3.51 platform, because the displayed name matches the security context of the Cmd process.

Caution

Stopping the Remote Console Server Service closes all current connections. Moreover, when a client is disconnected using Remote Console, all the processes that it has started during the remote Cmd session and that are still running are stopped.


Security Notes

Remote Console Security Notes

Caution

Permitting all users to connect to Remote Console Server can compromise server security, as Remote Console clients are given a Cmd session. Any user who is given access to a Cmd session can run any application as if they were physically logged on to the server.

On both the Windows NT 3.51 and Windows NT 4.0 platforms, Remote Console clients are limited to members of the Administrators group.

On Windows NT 4.0 or higher, however, while this limitation is the default, you may allow users not in the Administrators group to connect to Remote Console Server. Remote Console Server setup creates a local group on your computer called RConsole Users, which includes a list of users and global groups; to modify the members of this group, use User Manager. All members of the RConsole Users local group are permitted to connect to Remote Console Server Members of the Administrators group can always run Remote Console clients, whether or not they are members of RConsole Users.

Moreover, Remote Console Server setup adds the privilege "Log on as a batch file" to the RConsole Users group. This privilege is required when the clients use the /logon option.

Remote Console Server setup also adds the following registry entry:

Value = OtherAllowedUsers

This entry is a multi-string value that by default includes only one string: RConsole Users

For those in the OtherAllowedUsers list, a Cmd.exe process is started with the security context of the client. Therefore, such a Cmd process runs with the same security access token as if the client were physically logged on to the server.

Winlogon usually checks that a user who attempts to physically log on to a server has the special user right "Log on locally" (for more information on this right, refer to User Manager documentation). Remote Console Server does not check this privilege before granting access to the client. Therefore, if you configure the server to accept clients that are not members of the Administrators group, you should be aware that they have access to anything on the server, as if they were logged on to the server and running Cmd.

For better security in this case, check all file permissions so that these clients can only edit or modify files with access granted.

Note

The /logon option of the client now encrypts the password with a Data Encryption Standard (DES) algorithm.


Client/Server Console Display Notes

Not only does Remote Console Server send its video memory to the client, but also the client is an exact copy of the console on which Cmd.exe is running. This feature means that the server also sends the client any change in its console size. For example, the client can run:

mode x,y

or

rconmode bufferx,buffery,windowx,windowy

to see the changes. For more information, see Rconmode.


Rconmode

A new Remote Console tool, Rconmode, enables you to change the screen buffer size and the window size of the current console. The syntax is:

One Step rconmode bufferx,buffery,windowx,windowy

Where:

bufferx
is the screen buffer width in characters.
buffery
is the screen buffer height in characters.
windowx
is the window width in characters.
windowy
is the window height in characters.

For example, the following command changes the screen buffer size to 80 x 500 and the window size to 80 x 50:

rconmode 80,500,80,50


Remote Process Kill

This service (Rkillsrv.exe) with both GUI (Wrkill.exe) and command-line (Rkill.exe) clients allows a user to enumerate and kill processes on a remote computer. To kill a process remotely with this tool, you must be member of the Administrators group.

Remote Process Kill combines some of the functionality of Tlist.exe and Kill.exe (in the Support Tools directory on the Windows 2000 CD).

The service can be installed with Instsrv.exe or Srvinstw.exe. See "Installing and Unistalling a Service" for more details.

Remote Process Kill also includes the following features:

  • An installation option to allow the client to automatically install and start the service on a remote system
  • An uninstall option

You must first install the service before running the tools.

RKill Topics

  • Installing the RKillSrv Service
  • RKill Syntax
  • RKill Examples

Files Required

  • Rkill.exe (command-line version)
  • Rkillsrv.exe (service)
  • Wrkill.exe (GUI version)


Installing the RKillSrv Service

Installing a Service

  • The easiest way to add or remove a service, either on a local or remote computer, is to use the Service Installation Wizard, a Windows 2000 Resource Kit tool.
  • To install a service manually on a local computer, follow these steps.
    1. Install the service's executable file as a service with Service Installer, a Resource Kit tool. For example, to install Rkill.exe as the Remote Kill service, use the command-line syntax:

      One Step instsrv Remote Kill "ResourceKitInstallationPath\rkill.exe"

    2. After installation, configure and start the service. Click Start, point to Programs, point to Administrative Tools, and click Computer Management. In the Computer Management snap-in console tree, click the Services and Applications node, then click the Services node.
      note-icon

      Note

      The Computer Management snap-in can be started from the command-line by typing compmgmt.msc.

    3. Select the service name you added in step 1.
    4. Right-mouse click and select Properties.
    5. In the General tab, set the Startup Type.
    6. In the Log On tab, select the account the service will use when running. Choose either the Local System account or enter another valid account and password. The type of log on required is determined by the application.

      7. Note

      If you need access to the screen and keyboard, you must choose Local System account and check the "Allow Service to Interact with Desktop" box. Note that a Local System account doesn't have network access. Otherwise, enter any valid account name and specify the correct logon password.

    7. Start the service. In the Services node, select the service name. Right-click and select Start.

Uninstalling a Service

  • The easiest way to add or remove a service, either on a local or remote computer, is to use the Service Installation Wizard, a Resource Kit tool.
  • To uninstall a service manually, follow these steps.
    1. Stop the service, if it is running. In the Services node, select the service name. Right-click and select Stop.
    2. Unistall the tool with Service Installer, a Resource Kit tool. For example, to uninstall the FloppyLock service, use the command-line syntax:

      One Step instsrv Rkill Remove


RKill Syntax

One Step rkill [view \\servername] [kill \\servername pid] [nkill \\servername process.exe] [token \\servername] [install \\servername] [deinstall \\servername]

Where:

view \\servername
to get the process list on servername
kill \\servername pid
to kill process pid on servername
nkill \\servername process.exe
to kill a process by name on servername
token \\servername
to get your remote security token on servername
install \\servername
to install the RemoteKill service on servername
deinstall \\servername
to deinstall the RemoteKill service on servername


RKill Examples

Examples are not available at this time.


Rshsvc.exe: TCP/IP Remote Shell Service

TCP/IP Remote Shell Service, the server side of the TCP/IP tool Rsh.exe, provides a command-line shell or single command execution service for remote users.

RshSvc works like the UNIX Remote Shell Service. Any computer with an RSH client, which exists for nearly all major operating systems, can access this service.

Caution

The security model of RshSvc is similar to that of its UNIX equivalent. Because of this, users running RSH on remote computers, beyond those specified in the RHOSTS file, might be able to gain access to a computer running RshSvc.

TCP/IP Remote Shell Service Topics

  • To install Remote Shell Service
  • To start and stop Remote Shell Service
  • Remote Shell Service Security
  • Remote Shell Service Limitations

Files Required

  • Rshsetup.exe
  • Rshsvc.bat
  • Rshsvc.dll
  • Rshsvc.exe


To install Remote Shell Service

  1. Copy Rshsetup.exe, Rshsvc.exe, Rshsvc.dll to the %SystemRoot%\System32 folder.
  2. At the command prompt, type the following command:
    rshsetup %systemroot%\system32\rshsvc.exe %systemroot%\system32\rshsvc.dll


To start and stop Remote Shell Service

To start the service, at the command prompt, type:

net start rshsvc

To stop the service, at the command prompt, type:

net stop rshsvc


Remote Shell Service Security

Caution

The security model of RshSvc is similar to that of its UNIX equivalent. Because of this, users running RSH on remote computers, beyond those specified in the RHOSTS file, might be able to gain access to a computer running RshSvc.

The RHOSTS file must be in the %SystemRoot%\System32\Drivers\Etc\ directory. This file should contain one or more of the following type of entry (each entry should be on one line):

M1 U1 [U2 U3 ....]

[M2 U1 U2 U3 ....]

where

Mn
are the names of the computers from which the RSH client can be run.
Un
are names of the users who are permitted to access the Remote Shell Service.

RshSvc returns an "Access denied" message under the following conditions:

  1. The RSH client computer name is not specified in the RHOSTS file.
  2. The name of the logged-on user on the RSH client computer is not present in the RHOSTS files.
  3. RshSvc (using GetHostByName) failed to resolve the IP address of a computer specified in the RHOSTS files and a user is trying to access this service from that computer.
  4. In Windows 2000, the "Register this connection's address in DNS" option is checked; or in Windows NT 4.0, the "Use DNS for Windows Resolution" option is checked.


Remote Shell Service Limitations

Although this service can be used to start batch files of the following types:

  • dir
  • ls
  • tlist

it may not work well if you try to start command windows in batch files, as in the following examples:

start cmd

start cmd vi

Neither the RSH client nor the RSH service are meant to be used for running interactive commands such as editing utilities. If you try to start interactive editors, such as vi, using this service, the RSH client will time out after a specified period.

When the client tries to start a command, the RSH server waits for a specified timeout period, which is hard coded to 10 minutes, while the command executes before timing out. This limitation means that the client cannot run a command that takes more than 10 minutes to complete.


Setspn.exe: Manipulate Service Principal Names for Accounts

This command-line tool allows you to manage the Service Principal Names (SPN) directory property for an Active Directory™ directory service account. SPNs are used to locate a target principal name for running a service. SetSpn allows you to view the current SPNs, reset the "host" SPNs, and add or delete supplemental SPNs.

It is not usually necessary to modify SPNs. They are set up by a computer when it joins a domain and when services are installed on the computer. In some cases, however, this information can become stale. For instance, if the computer name is changed, the SPNs for installed services would need to be changed to match the new computer name.

The topic on Troubleshooting SetSpn lists a basic set of built-in SPNs that are always recognized for computer accounts.

SetSpn Topics

  • SetSpn Syntax
  • SetSpn Examples
  • Troubleshooting SetSpn

Files Required

  • Setspn.exe

For More Information

For more information about SPNs, see the Microsoft Platform SDK and the Windows 2000 Resource Kit books.

For more information about Active Directory, visit the
Internet Active Directory Web page on the Microsoft® Windows® 2000 Server Web site.


SetSpn Syntax

One Step setspn Computer [-l] [-r] [-a SPN] [-d SPN] [-?]

Where:

-l
lists the currently registered Service Principal Names (SPN) for computer. This switch is the default: setspn run without this switch also lists the registered SPNs.
-r
resets the default SPN registrations for the host names for Computer.
-a SPN
adds the specified SPN for the Computer.
-d SPN
deletes the specified SPN for the Computer.
-?
displays a syntax screen at the command prompt.


SetSpn Examples

List currently registered SPNs

setspn -l daserver1
Registered ServicePrincipalNames for CN=DASERVER1,CN=Computers,DC=reskit,DC=microsoft,DC=com:
HOST/daserver1
HOST/daserver1.reskit.microsoft.com

Reset default registered SPNs

setspn -r daserver1
Registering ServicePrincipalNames for CN=DASERVER1,CN=Computers,DC=reskit,DC=microsoft,DC=com
HOST/daserver1.reskit.microsoft.com
HOST/daserver1
Updated object

Add new SPN

setspn -a http/daserver1.reskit.microsoft.com daserver1
Registering ServicePrincipalNames for CN=DASERVER1,CN=Computers,DC=reskit,DC=microsoft,DC=com
        http/daserver1.reskit.microsoft.com
Updated object

Remove SPN

setspn -d http/daserver1.reskit.microsoft.com daserver1
Unregistering ServicePrincipalNames for CN=DASERVER1,CN=Computers,DC=reskit,DC=microsoft,DC=com
http/daserver1.reskit.microsoft.com
Updated object


Troubleshooting SetSpn

Service Principal Names (SPN) can be constructed only by using the account base name as the second part. The directory service enforces this, by generating a constraint violation error. You may not have the rights to access or modify this property on some account objects. You can determine what your access rights are by viewing the security attributes on the account object using the Directory Management (Active Directory Users and Computers) Microsoft Management Console (MMC) snap-in, a Windows 2000 administrative tool.

Reporting Bugs

When reporting bugs or making requests (such as feature requests), include the following information:

  • A detailed description of the problem or request.
  • Setspn.exe version number.
  • The account name and current contents of the servicePrincipalName property
  • The security descriptor of the servicePrincipalName property

Built-in SPNs

The built-in SPNs that are always recognized for computer accounts are:

alerter
appmgmt
browser
cifs
cisvc
clipsrv
dcom
dhcp
dmserver
dns
dnscache
eventlog
eventsystem
fax
http
ias
iisadmin
messenger
msiserver
mcsvc
netdde
netddedsm
netlogon
netman
nmagent
oakley
plugplay
policyagent
protectedstorage
rasman
remoteaccess
replicator
rpc
rpclocator
rpcss
rsvp
samss
scardsvr
scesrv
schedule
scm
seclogon
snmp
spooler
tapisrv
time
trksvr
trkwks
ups
w3svc
wins
www


Showacls.exe

This command-line tool enumerates access rights for files, folders, and trees. It allows masking to enumerate only specific ACLs.

ShowACLs works on NTFS partitions only.

The most useful feature of ShowACLs is the ability to show permissions for a particular user. The method that ShowACLs uses to perform this is by enumerating the local and global groups that the particular user belongs to and matching the users security identifier (SID) and the SIDs of the groups the users belongs to, to the SIDs in each ACE entry.

NTFS uses Access Control Lists (ACLs) to set permissions for users and groups on objects. ACLs are made up of Access Control Entries (ACEs). Each ACE entry has information that controls the permissions for a specific user or group. There are currently four ACE type defined; Access Allowed, Access Denied, System Alarm and System Audit. Each ACE entry has a common ACE header and unique data structure. The SID associated with each ACE entry is contained in the data following the ACE header.

One of the problems with a command-line tool like ShowACLs is the amount of information that is contained in the ACL. The first version of ShowACLs attempted to display all the data in the access mask, which was very confusing. The latest version has adopted the "standard" permissions, Full, Change and Read-Only where appropriate. If a mask does not match these predefined values, the a raw dump of the mask is performed.

ShowAcls Topics

  • ShowAcls Syntax
  • ShowAcls Examples

Files Required

  • Showacls.exe
  • Showacls.doc


ShowAcls Syntax

One Step showacls [/s] [/u:domain\user] [filespec]

Where:

/s
includes sub-directories
/u:domain\user
specifies domain\user
ACE header values
0x1 | Object Inherit ACE
0x2 | Container Inherit ACE
0x4 | No Propagate Inherit ACE
0x8 | Inherit Only ACE
Access mask values
Delete. Allows or denies deleting the file or folder. If you don't have Delete permission on a file or folder, you can still delete it if you have been granted the Delete Subfolders and Files permission on the parent folder. | D
File Append. Append Data allows or denies making changes to the end of the file but not changing, deleting, or overwriting existing data (applies to files only). | a
File Execute. Execute File allows or denies running program files (applies to files only). | fx
File Read. File Read allows or denies viewing the attributes of a file or folder, such as read-only and hidden. Attributes are defined by NTFS. | r
File Write. Write Data allows or denies making changes to the file and overwriting existing content (applies to files only). | w
Generic All | A
Generic Execute. Execute File allows or denies running program files (applies to files only). | X
Generic Read. Allows or denies viewing the attributes of a file or folder, such as read-only and hidden. Attributes are defined by NTFS. | R
Generic Write. Allows or denies changing the attributes of a file or folder, such as read-only or hidden. Attributes are defined by NTFS. | W
List Directory. List Folder allows or denies viewing file names and subfolder names within the folder (applies to folders only). | l
Read Data. Read Data allows or denies viewing data in files (applies to files only). | d
Read EA. Allows or denies viewing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary. | rE
Synchronize. Allows or denies different threads to wait on the handle for the file or folder and synchronize with another thread that may signal it. This permission applies only to multithreaded, multiprocess programs. | S
Write EA. Allows or denies changing the extended attributes of a file or folder. Extended attributes are defined by programs and may vary. | rW


ShowAcls Examples

  • showacls
    G:\Program Files\Resource Kit\
                BUILTIN\Users             Special Access [RX]
                BUILTIN\Power Users       Special Access [RWXD]
                BUILTIN\Administrators    Special Access [A]
                NT AUTHORITY\SYSTEM       Special Access [A]
                CREATOR OWNER             Special Access [A]
                NT AUTHORITY\TERMINAL SERVER USER Special Access [RWXD]


Showgrps.exe

This command-line tool shows the groups to which a user belongs, even within a given network domain.

ShowGrps Topics

  • ShowGrps Syntax
  • ShowGrps Examples

File Required

  • Showgrps.exe


ShowGrps Syntax

One Step showgrps [/A] domain\user

Where:

domain\user
user name.
/A
checks all known trusted domains


ShowGrps Examples

showgrps

User: [MYDOMAIN\user1], is a member of:

  MYDOMAIN\Domain Users
  \Everyone
  ANOTHERDOMAIN\Users

showgrps -a

User: [MYDOMAIN\user1], is a member of:

  \Everyone


Showmbrs.exe

This command-line tool shows the user names of members of a given group, even within a given network domain.

Note

You can use showgrps to list groups for a particular user.

ShowMbrs Topics

  • ShowMbrs Syntax
  • ShowMbrs Examples

File Required

  • Showmbrs.exe


ShowMbrs Syntax

One Step showmbrs grouptype

Where:

grouptype
specifies where users should be listed from:
  • showmbrs domain\group
  • showmbrs \\domain\group
  • showmbrs group


ShowMbrs Examples

  • Show all local administrators.
    showmbrs ADMINISTRATORS
    Members of local group [\ADMINISTRATORS]:

   IMACOMPUTER\Administrator
   IMADOMAIN\Domain Admins
   IMADOMAIN\IMACOMPUTER


Shutdown.exe: Remote Shutdown

Remote Shutdown is a tool which allows you to remotely shut down or reboot a computer running Windows 2000 or Windows NT 4. ShutDown provides system shutdown and restart options from both the command-line and a GUI.

Note

To schedule Remote Shutdown for a specific time, use the AT command or Task Scheduler (see Windows 2000 Help for a full description).

Remote Shutdown Topic

  • Remote Shutdown Syntax

File Required

  • Shutdown.exe


Remote Shutdown Syntax

one step shutdown [\\computername] [/l] [/a] [/r] [/t:xx] ["msg"] [/y] [/c] [/?]

Where:

\\computername
Remote computer to shut down. If no name is given but the tool is started with any of the other options, the local computer name will be used.
/L
Specifies a local shutdown.
/A
Quits a system shutdown. This can only be done during the timeout period. If this switch is used, all others are ignored.
/R
Restart the computer specifed after shutdown.
/T:xx
Sets the timer for system shutdown in xx seconds. The default is 20 seconds.
"msg"
Specifies an additional message with a maximum of 127 characters, surrounded by quotation marks.
/y
Answers questions with "yes".
/C
Forces running applications to close.

note-icon

Caution

If you use the /c parameter, Windows 2000 ignores the application's option to save data that might have changed. You will see no File Save dialog box, because Windows 2000 will force the application to close. This will result in a loss of all data not previously saved.

/? (or shutdown without parameters)
Display help.

Examples

  • Shutdown and reboot a remote computer.
    shutdown \\IMAREMOTECOMPUTER /R
  • Shutdown a local computer, closing all applications in 5 seconds.
    shutdown /L /C /T:5


Srvcheck.exe

This command-line tool lists the shares on an computer running Microsoft® Windows® 2000 and enumerates the users on the ACLs for each share.

SrvCheck Syntax

One Step srvcheck [\\ComputerName] [/?]

Where:

\\ComputerName
is the computer on which to run SrvCheck. If not specified, the default is the local computer.
/?
displays a syntax screen at the command prompt.

File Required

  • Srvcheck.exe


Srvmgr.exe: Server Manager

Use this GUI-based tool to manage Microsoft® Windows NT® version 4.0 or Microsoft® Windows NT® version 3.51 domains and computers. To manage Windows 2000 domains and computers, use Active Directory™ directory service and the other Windows 2000 administrative tools instead.

With Server Manager you can:

  • Select a Windows NT 4.0 domain, workgroup, or computer to administer.
  • Manage a Windows NT 4.0 computer. For a selected computer you can view a list of connected users, view shared and open resources, manage directory replication, manage the list of administrative alert recipients, manage services and shared directories, and send messages to connected users.
  • Manage a Windows NT 4.0 domain. When administering a domain you can promote a backup domain controller to become the primary domain controller, synchronize servers with the primary domain controller, and add computers to and remove computers from the domain.

Most of the capabilities provided by Server Manager are also offered by the Services and Server tools in Control Panel in Windows NT 4.0. However, Server Manager can manage both local and remote computers, while these Windows NT 4.0 Control Panel tools manage only the local computer.

You can also use Administrative Tools in Control Panel in Windows 2000 to administer both local and remote computers. To administer Windows 2000 domains and computers, always use the Windows 2000 administrative tools.

Who Can Use Server Manager?

To administer a domain and its servers using Server Manager, you must be logged on to a user account that is a member of the Administrators, Domain Admins, or Server Operators group for that domain. Members of the Account Operators group can also use Server Manager, but only for the purpose of adding computers to the domain.

To use Server Manager to administer a workstation computer or server running Windows NT that is not a domain controller, you must be logged on to a user account that is a member of the Administrators or Power Users group for that computer.

A few Server Manager functions are allowed for only Administrators or Domain Admins. When Server Operators, Account Operators, or Power Users attempt to perform these functions, a message appears indicating that access is denied.

Files Required

  • Srvmgr.cnt
  • Srvmgr.exe
  • Srvmgr.hlp


Su.exe

SU lets you start a process running as an arbitrary user. It is named after the SU (Switch Users) utility of the UNIX family of operating systems.

Providing that the specified domain, user name, and password are correct, the new process runs in the security context of that user.

The new process starts with an environment block representing the per-user environment variables that Windows 2000 maintains. When the new process starts, the registry hive representing the target user, accessed through the HKEY_CURRENT_USER key, is available to the process. Both of these behaviors can be disabled.

The logon type equates to the logon right required by the target user (who was granted the privileges). Furthermore, the logon type dictates how the access token representing the target user is populated. The security identifier (SID) with type SE_GROUP_LOGON_ID in the access token for the new process represents the type of logon: Batch, Interactive, or Service. Logon rights can be granted through the Local Security Policy snap-in, an Administrative Tool included with Windows 2000 (or User Manager, a Resource Kit Tool, for Windows NT version 4.0).

Note

Local Security Policy tells you if local settings are being overridden by settings applied through Group Policy at the site, domain, or organizational unit level. If this is the case, then you will not be able to change them at the local level.

Privileges and SU Service

In this release of SU, the caller no longer needs the following privileges:

  • SeTcbPrivilege "Act as part of the operating system"
  • SeIncreaseQuotaPrivilege "Increase Quotas"
  • SeAssignPrimaryTokenPrivilege "Replace a process level token"
  • SeRestorePrivilege "Restore files and directories" (required only for preparation of user registry hive)

In order to obtain these privileges before running SU, the user must install a new service-based component used by SU. The service component is encapsulated in the executable Suss.exe, and this is installed by entering the following command at the command prompt:

suss.exe -install

You must be an administrator in order to install the service in this manner. The name of the service installed, as listed in the in the Services snap-in, is SU Service.

Once SU Service is installed, users may use SU without having the four privileges mentioned above. If you are upgrading over an previous installation of SU, you should revoke the above mentioned privileges from any users or groups to whom they were previously granted. You can do this with the Local Security Policy snap-in (or User Manager for Windows NT 4.0).

SU Service can be configured to run in the Local System account or any account that has been assigned the privileges that were previously necessary in the stand-alone version. By default, the service allows anybody to use SU, but that can be regulated by changing the ACL on a particular registry key (the ACL itself will map to whom the service allows to use SU).

Note

If you receive the error "LogonUser error! (rc=1722)" when using SU, you may not have properly installed SU Service from Suss.exe or the service may be stopped. Verify that SU Service is included in the list in the Services snap-in. If its status is not shown as Started on the list, start the service by right-clicking it and then clicking Start. If the service does not appear in the list, please follow the above instructions to install the service.

RunAs

Most of the functionality of SU is included in RunAs, a command-line tool included with the Windows 2000 operating system. For information on this tool, see Windows 2000 Help. However, SU still includes two features not available in RunAs:

  1. SU can target other desktops.
  2. SSP logons using the -n switch are not supported by Runas.

SU Limitations

  • Environment variables contained in Autoexec.bat are not populated to the environment of the new process.
  • Environment variables HOMEDRIVE and HOMEPATH are not populated to the environment of the new process.
  • Mandatory profiles are not supported. Furthermore, if a profile does not exist for the target user, a default profile is not prepared and registry operations against HKEY_CURRENT_USER are not be persistent.
  • Network drives are not connected for the target process. Windows 2000 makes drive letter mappings global, which could cause collisions when multiple users are logged on; for this reason, network drives are not reconnected.

SU Topics

  • SU Syntax
  • SU Environment Variables
  • SU Examples
  • Avoiding Password Prompting With SU
  • Running SU Under Task Scheduler

Files Required

  • Su.exe
  • Suss.exe


SU Syntax

Su.exe

Default Assumptions

If no command line is specified, the command line specified by the %comspec% environment variable is executed.

  • If no domain is specified, default account search logic is used.
  • If no windowstation and desktop is specified, the new process runs on the same windowstation and desktop that was used to launch SU.
  • The new process has an environment block similar to that generated for a standard interactive logon. This feature is disabled by using the -e option.
  • The new process has the user registry hive loaded, if available. This behavior is disabled by using -l option.
  • The logon type is Interactive, which requires that the target user have SeInteractiveLogonRight. The logon type can be changed to batch or service by using the -b or -s switches, respectively.

Syntax Listing

One Step su user ["cmdline"] [domain] [[winstation\]desktop] [options] [{-b | -i | -n | -s}]

user
specifies the user name for the new process. Must be the first non-switch argument. This is the only required argument.
"cmdline"
specifies the command line to execute as user. Must be the second non-switch argument. This argument is optional. If it contains spaces, it must be surrounded by quotation marks.
If "cmdline" is not specified, the default command processor specified in the environment variable %comspec% is executed.
domain
specifies the domain name for the target user. Must be the third non-switch argument. This argument is optional.
If it is not specified, default domain lookup will occur. In this case the domain lookup is executed in the following order, until the domain for the target user is found:
Well-known, built-in, local accounts, primary domain, trusted domains.
Specifying "." as the domain limits the search for the user account to the local computer.
[winstation\]desktop
specifies the target windowstation and desktop for the new process. Must be the fourth non-switch argument. This argument is optional.
Winsta0\Default is the user default interactive windowstation and desktop. This argument can be specified with only the desktop name. Not specifying a windowstation name causes the process to run on the current windowstation in the supplied desktop. When specifying a windowstation, the windowstation and desktop pair must be ordered as follows: windowstationname\desktopname. Not specifying any desktop for the new process causes the process to run on the same windowstation and desktop from which SU was launched, launching a child on the current winstation\desktop.
options
are one or more option switches, also called flags, that can be specified in any order anywhere on the command line. All switches are optional.
-cb
does not create a new console.
If the new process is a console process, it inherits the console of the caller.
This option should not be combined with -w when starting console applications. Furthermore, the password should not be supplied when redirecting passwords when starting console applications.
This switch should not be used with redirected passwords.
-dn
does not switch to a new desktop, if one was specified.
If the new process is set to run on a desktop which differs from the current desktop, the default behavior is to switch to the new desktop, making the new desktop active and bringing it to the foreground. This option overrides the default and prevents switching to the new desktop.
Note that SU does not return until the new process exits, unless the -w switch is specified.
-e
disables environment preparation. The parent environment is inherited.
This option prevents preparation of the user environment for the new process, instead causing the environment to be inherited from SU.
-g
Forces GUI option prompting with supplied command-line arguments.
-l
disables loading of the user registry hive. Default is used instead.
This option prevents loading of the user registry hive for the target user. If the hive happens to be loaded for the target user, the new process behaves the same way with HKEY_CURRENT_USER that it would if -l were not specified. If -l is specified without -e, a user-default environment is created for the new process, as opposed to creating a user-specific environment for the new process.
-v
displays verbose output to STDOUT (standard output).
This option displays details related to the creation of the new process.
-w
Do not wait on child. The registry hive remains loaded.
When this option is specified, SU does not wait for the new process to exit before returning to the caller. This means that SU cannot unload the user registry hive for the target user if a hive was loaded on behalf of that user. This flag should not be combined with the -cb flag when starting a console-based application; if it is, console output is intermixed.
{-b | -i | -n | -s}
One of the following logon types may also be specified as an option. The default type is interactive.
-b
batch
The target user must possess the SeBatchLogonRight logon type. This logon type is not used by Microsoft, but is available for use in custom applications.
-i
interactive
The target user must possess the SeInteractiveLogonRight logon type (the default logon type for SU).
This is the same logon type that occurs when a user physically logs onto a computer running Windows 2000.
-n
network
The target user must possess the SeNetworkLogonRight logon type.
-s
service
The target user must possess the SeServiceLogonRight logon type.


SU Environment Variables

The following environment variables particular to SU may be used with the tool. These environment variables are used only when the SU graphical user interface (GUI) is not invoked.

To view or change environment variables:

  1. Click Start, point to Settings, then click Control Panel.
  2. In Control Panel, double-click System, click the Advanced tab, then click the Environment Variables... button.

These environment variables can also be set in a batch file to be used with the Windows 2000 Task Scheduler service.

SU_USERNAME
supplies a default user name to SU.
SU_PASSWORD
supplies a password to SU. Avoids password prompting.
SU_DOMAIN
overrides default domain name referenced by SU.
SU_COMMANDLINE
overrides default command line run by SU.
SU_DESKTOP
overrides default windowstation and desktop targeted by SU.


SU Examples

su administrator

Starts the default command line in the security context of the first account found with name Administrator.

su administrator eventvwr.exe .

Starts Eventvwr.exe as the Administrator, searching only the local account database for the user Administrator.

su username -v -b

Starts the default command line in the first account found with name username, displaying verbose output related to the creation of the new process. The logon type will be Batch, which requires that user username have the SeBatchLogonRight.

su username "" bristol -cb

Starts the default command line in the account username in domain bristol, but does not create a console window for the new process. Instead, the process uses the current console window.

su username "windbg.exe qslice.exe" bristol -e -l

Starts the command line "windbg.exe qslice.exe". The new process runs in the account username in the domain bristol. The user environment is not prepared for the new process; rather, the environment is inherited from the SU process. This command line does not load the user registry hive for the user username.

su username cmd.exe "" winsta0\default -w

Starts Cmd.exe in the first account found with the name username. The new process runs on the windowstation named winsta0 and desktop named default, which is the user-default interactive windowstation and desktop. This command line does not wait on the new process to exit before returning from SU. Such a command line might be useful if executed from a non-interactive service running in the Local System account.

su username cmd.exe bristol winsta0\mydesktop

Starts Cmd.exe on a windowstation and desktop named winsta0\mydesktop, and switches to that desktop.


Avoiding Password Prompting With SU

You can redirect a password to avoid prompting, providing that STDIN (standard input) is redirected accordingly. If SU is running under a command processor, the following approaches are suitable for redirecting a password:

su username < c:\password\username.txt

The password for user username is obtained from c:\password\username.txt. The password must be followed by a carriage return in the file username.txt. On NTFS file systems, you can apply security to username.txt such that only the callers of SU have access to the password file or directory.

echo mypassword | su username

Password mypassword for user username is piped to SU. This approach is useful for batch files. Note that on NTFS file systems, the batch file executing this command should have security applied such that only the callers of SU have access to the batch file. Note also that some command processors might not handle this case properly.

In addition, you can avoid password prompting by setting the environment variable SU_PASSWORD in the process or batch file that launches SU. This environment variable is used only when the SU graphical user interface (GUI) is not invoked.


Running SU Under Task Scheduler

SU can be run under the Windows 2000 Task Scheduler service to allow scheduling of jobs in various user contexts.

Note that when Task Scheduler runs in the Local System account, it has all required privileges to execute SU. If the service is running in a user account, this account must be granted all of the required privileges mentioned above in the Privileges and SU Service section of the main SU topic.

If the Task Scheduler service does not run in the Local System account, SU cannot start a process on the winsta0\default windowstation and desktop. Therefore, it is not possible to start a process that is visible on the user default desktop in this way. If you need to run scheduled SU jobs that are visible on the user-default desktop, run the Task Scheduler service in the Local System account.

Examples: Task Scheduler Command Lines

at 10:30 "cmd.exe /c su.exe username qslice.exe england winsta0\default < c:\username.txt"

This command line starts Qslice.exe at 10:30 a.m. in the user account england\username, on the user default desktop winsta0\default, obtaining the user password from the file c:\username.txt.

In this case, Cmd.exe /c is used to start Su.exe, which enables Cmd.exe to redirect input to Su.exe from c:\username.txt. Note that the /c switch for Cmd.exe causes Cmd.exe to exit when Su.exe returns, thus ending the process.

at 1:30 "cmd.exe /c su.exe guest cmd.exe . winsta0\winlogon < c:\guest.txt"

This command line starts Cmd.exe at 1:30 a.m. in the local user account guest, on the desktop winsta0\winlogon, obtaining the user password from the file c:\guest.txt. The winlogon desktop is the desktop used during an interactive logon. Although this command line illustrates how to start a process on this desktop, doing so is not recommended.

Example: Environment Variables In Batch Files

The SU environmental variables options can be used in conjunction with batch files executed under Task Scheduler.

For example, the following batch file executes Msmail32.exe in the user account named username in the domain england with the password password:

set SU_COMMANDLINE=msmail32.exe
set SU_DOMAIN=england
set SU_PASSWORD=password
su.exe username


Subinacl.exe

With this command-line tool, administrators can obtain security information on files, registry keys, and services, and transfer this information from user to user, from local or global group to group, and from domain to domain.

For example, if a user has moved from one domain (DOMA) to another (DOMB), the administrator can replace DOMA\User with DOMB\User in the security information for the user's files. This gives the user access to the same files from the new domain. See Domain Migration With SubInAcl.

SubInAcl enables administrators to:

  • Display security information associated with files, registry keys, or services, including owner, group, permissions access control list (ACL), discretionary access control list (DACL), and system access control list (SACL).
  • Change the owner of an object.
  • Replace the security information for one identifier (account, group, well-known security identifier (SID)) with that of another identifier.
    The /replace and /changedomain options change security information in the Owner, System ACL, and Discretionary ACL fields, but the Primary Group information is never replaced.
    For example, /replace=DOM_MARKETING\ChairMan=NEWDOM\NewChairMan replaces all access control entries (ACEs) and owners containing DOM_MARKETING\ChairMan with the NewChairMan SID retrieved from NEWDOM domain.
  • Migrate security information on objects.
    This is useful if you have reorganized a network's domains and need to migrate the security information on files from one domain to another.
    For example, /changedomain=OldDomainName=NewDomainName replaces all ACEs with a SID from OldDomainName with the equivalent SID found in NewDomainName

This tool is designed for use by administrators. Some actions may fail or generate error messages if the user doesn't have the following privileges:

  • SeBackupPrivilege (Back up files and directories.)
  • SeChangeNotifyPrivilege (Bypass traverse checking.)
  • SeRestorePrivilege (Restore files and directories.)
  • SeSecurityPrivilege (Manage auditing and security log.)
  • SeTakeOwnershipPrivilege (Take ownership of files or other objects.)
  • SeTcbPrivilege (Act as part of the operating system.)

SubInAcl Topics

  • SubInAcl Syntax
    • SubInAcl Syntax: view_mode
    • SubInAcl Syntax: object_type
    • SubInAcl Syntax: action[=parameter]
  • SIDs in SubInAcl
  • SubInAcl Editing Features
  • Domain Migration With SubInAcl

File Required

  • Subinacl.exe


SubInAcl Syntax

The syntax of SubInAcl is analogous to that of the UNIX tool find. For each object, SubInAcl:

  1. Retrieves the security descriptor of the object_name object. For more information, see SIDs in SubInAcl.
  2. Applies the action(s), which are executed in the order in which they appear on the command line.

If:

  • The security descriptor has been modified

    • and

  • The /testmode switch has not been specified

the changes are applied to the object.

You can specify as many actions as you wish. You must specify at least three characters for each action. The syntax is not case-sensitive.

Example:
subinacl /file c:\temp\*.txt /replace=Jim=Kim/display

For each .txt file, this command line:

  • Replaces Jim with Kim.
  • Displays the whole security descriptor.
  • Applies the changes, if any.

Syntax Listing

One Step subinacl [view_mode] [/test_mode] object_type object_name [action[=parameter]] [action[=parameter]] ... [/playfile file_name] [/help [/full] [keyword]]

view_mode
Values:

/noverbose
/verbose (same as /verbose=2)
/verbose=1
/verbose=2
/test_mode
When this mode is specified, the changes are not actually made to the object security descriptor. This option can be useful for testing the validity of a command.
Example:
subinacl /subdirec \\server\share\*.* /changedomain=DOMA=DOMB /ifchangecontinue /noverbose /display /testmode
For each file specified, this command displays what the modified security descriptor would be. But the changes are not actually applied to the files.
object_type
Values:

/file
/subdirectories
/onlyfile
/share
/clustershare
/keyreg
/subkeyreg
/service
/printer
/kernelobject
object_name
is any valid name of an object of type object_type.
action[=parameter]
/display (default)
/setowner=owner
/replace=[DomainName\]OldAccount=[DomainName\]NewAccount
/changedomain=OldDomainName=NewDomainName
/migratetodomain=SourceDomain=DestDomain
/findsid=[DomainName\]Account[=stop]
/suppresssid=[DomainName\]Account
/confirm
/perm
/audit
/ifchangecontinue
/cleandeletedsidsfrom=DomainName
/accesscheck=[DomainName\]UserName
/setprimarygroup=[DomainName\]Group
/grant=[DomainName\]UserName[=Access]
/deny=[DomainName\]UserName[=Access]
/revoke=[DomainName\]UserName
/playfile file_name
/help [/full] [keyword]

/full
displays a full syntax listing.
For a brief syntax listing, run subinacl without any arguments.

keyword
displays help on a particular area of SubInAcl. Values can be:
features
usage
syntax
sids
view_mode
test_mode
object_type
domain_migration
substitution_features
editing_features
-Or-
any action or /object_type.


SubInAcl Syntax: view_mode

Values:

/noverbose
/verbose (same as /verbose=2)
/verbose=1
/verbose=2

SubInAcl can be used in quiet mode (/noverbose) or in two verbose modes, /verbose=1 or /verbose=2. The default for SubInAcl (when run without a view_mode value) is /verbose=2.

You can specify these switches either:

for the entire command line, for example:
subinacl /noverbose /file *.dat /display

or after a specific action, for example:
subinacl /file *.dat /display /noverbose /display

The /verbose=1 mode may be used with /display to display permission ACEs using /grant or /deny notations.


SubInAcl Syntax: object_type

Values:

SubInAcl can work with various kinds of objects. Most objects support enumeration with the "*" (wildcard) character. Actions are valid for all objects.

Files

/file
manipulates files.

Examples of object_name for /file:

*.obj
c:\temp\*.obj
\\servername\share\*.exe

Note that SubInAcl is not supported on Dfs volumes.

/subdirectories

manipulates files in specified directory and all subdirectories.

Examples of object_name for /subdirectories:
c:\temp\*.obj - works with all .obj files in the \temp directory.
c:\temp\test - works with all test files under the \temp directory.
c:\temp\test\*.* - works with all files under \temp\test.

/onlyfile

opens a file without using the FindFilexxx mechanism.

Can be used to access named pipes or mailslot, for example:
\\.\pipe\pipename

Shares

/share

accesses a network file share.

Example of object_name for /share:
\\server\share

/clustershare

access a cluster file share resource.

Examples of object_name for /clustershare:

\\clustername\FileShare_Resource_Name
\\clustername\s*

Registry keys

/keyreg

manipulates registry keys.

Examples of object_name for /keyreg:

HKEY_CURRENT_USER\Software
HKEY_CURRENT_USER\Software\*Version
\\Srv\HKEY_LOCAL_MACHINE\KeyPath

/subkeyreg

manipulates registry keys and subkeys.

Examples of object_name for /subkeyreg:

HKEY_CURRENT_USER\Software
HKEY_CURRENT_USER\Software\*Version
\\Srv\HKEY_LOCAL_MACHINE\KeyPath

Services

/service

manipulates services.

Examples of object_name for /service:

\\ServerName\Messenger
Messenger

Printer

/printer

manipulates printers, using any valid printer name as object_name.

Kernel named objects

/kernelobject

accesses a named kernel object.
Can be used to view mutexes, sections, and event objects

Internet Information Services

/metabase

gives access to the AdminACL metabase property of the Internet Information Services metabase.

Note that this property can be used only with the following metabase paths:
\LM\MSFTPSVC
\LM\MSFTPSVC/n
\LM\W3SVC

This object does not support enumeration.

Example:

subinacl /metabase \\ServerName\LM\W3SVC /grant=administrator=F


SubInAcl Syntax: action[=parameter]

Values:

/display (default)
Displays the security descriptor.
The /noverbose display can be used to reapply the security descriptor (see /playfile).
/owner=owner or /setowner=owner
Changes the owner of the object.
owner is a valid security identifier (SID), which can be expressed in several forms.
Example:
/owner=DomainName\Administrators
Retrieves the Administrators' SID on the server where the object is located (see Win32 SDK LookupAccountName function).
/replace=[DomainName\]OldAccount=[DomainName\]NewAccount
Replaces all access control entries (ACEs) (Audit and Permissions) in the object.
Example:
/replace=DOM_MARKETING\ChairMan=NEWDOM\NewChairMan
replaces all ACEs containing DOM_MARKETING\ChairMan with NewChairMan SID retrieved from NEWDOM domain.
/changedomain=OldDomainName=NewDomainName
Replaces all ACEs with a SID from OldDomainName with the equivalent SID found in NewSamServer.
Example:
/changedomain=DOM_MARKETING=NEWDOMAIN
Replaces all ACEs containing DOM_MARKETING\ChairMan SID with the ChairMan's SID retrieved on NEWDOMAIN computer The NEWDOMAIN must have a trusted relationship with the server containing the object.
/migratetodomain=SourceDomain=DestDomain
Same behavior as /changedomain, except that new ACEs are added to a new domain and ACEs for the old domain are preserved. Example:
/migratetodomain=DOM1=DOM2
Each ACE with DOM1\User is duplicated with DOM2\User (If DOM2\User exists). If during the migration there was a serious oversight you can instruct the user to log back onto DOM1.

note-icon

Note

Owner and Primary Group are migrated to DOM2.

/findsid=[DomainName\]Account[=stop]
Displays the object name containing a reference to DomainName\Account in the security descriptor.
/suppresssid=[DomainName\]Account
Suppresses all ACEs containing the DomainName\Account SID. If the object's owner is DomainName\Account, the owner is set to Everyone's SID.
/confirm
/perm
Suppresses all existing permissions aces (PACEs).
/audit
Suppresses all existing auditing ACEs (AACEs).
/ifchangecontinue
Continues to process the next actions only if some changes have been made in the previous actions.
/cleandeletedsidsfrom=DomainName
Deletes all ACEs containing deleted (not valid) SIDs from DomainName.
/accesscheck=[DomainName\]UserName
Displays the access granted to the Domain\UserName. The password is requested. This option requires the SeTcbName privilege (Act as Part of the Operating System), and cannot be used with remote objects.
Note: The access is checked with the NETWORK security identified granted to the Domain\UserName.
/setprimarygroup=[DomainName\]Group
Changes the primary group.
/grant=[DomainName\]UserName[=Access]
Adds a Permission ACE for UserName. If Access is not specified, Full Control access is granted.
/deny=[DomainName\]UserName[=Access]
Adds a denied Permission ACE for the specified UserName (or group). If Access is not specified, all accesses will be denied.
/revoke=[DomainName\]UserName
Suppresses all Permission ACEs for the specified User (or group).

Permission ACEs

Used with /grant and /deny:

     File:
       F : Full Control
       C : Change
       R : Read
       P : Change Permissions
       O : Take Ownership
       X : eXecute
       E : Read eXecute
       W : Write
       D : Delete

     ClusterShare:
       F : Full Control
       R : Read
       C : Change

     Printer:
       F : Full Control
       M : Manage Documents
       P : Print

     KeyReg:
       F : Full Control
       R : Read
       A : ReAd Control
       Q : Query Value
       S : Set Value
       C : Create SubKey
       E : Enumerate Subkeys
       Y : NotifY
       L : Create Link
       D : Delete
       W : Write DAC
       O : Write Owner

     Service:
       F : Full Control
       R : Generic Read
       W : Generic Write
       X : Generic eXecute
       L : Read controL
       Q : Query Service Configuration
       S : Query Service Status
       E : Enumerate Dependent Services
       C : Service Change Configuration
       T : Start Service
       O : Stop Service
       P : Pause/Continue Service
       I : Interrogate Service
       U : Service User-Defined Control Commands

     Share:
       F : Full Control
       R : Read
       C : Change

     Metabase:
       F : Full Control
       R : Read - MD_ACR_READ
       W : Write - MD_ACR_WRITE
       I : Restricted Write - MD_ACR_RESTRICTED_WRITE
       U : Unsecure Props Read - MD_ACR_UNSECURE_PROPS_READ
       E : Enum Keys - MD_ACR_ENUM_KEYS
       D : Write DAC - MD_ACR_WRITE_DAC


SIDs in SubInAcl

The security descriptor references a user group with a security identifier (SID). A SID can be expressed in one of the following forms:

  • DomainName\Account (for example, DOM\Administrators)
  • StandaloneServer\Group
  • Account (see LookupAccount API)
  • s-1-x-x-x-x
    x is expressed in decimal (for example, S-1-5-21-56248481-1302087933-1644394174-1001).
    In this case, no check is done to verify the existence of a given SID.

SubInAcl maintains a local cache of SIDs to minimize SID-to-"Human Name" translation costs for the network.


SubInAcl Editing Features

SubInAcl allows you to modify each part of a a security descriptor:

  • owner
    See /owner=SID or /setowner=SID
  • primary group
    see /setprimarygroup=GroupSID
  • system ACL (SubInAcl name = Audit ACL) with access control entries or ACEs (SubInAcl name = AAce = Audit ACE)
    see /audit /aace=xxx
  • discretionary ACL (SubInAcl name = Perm ACL ) with Access Control Entries (SubInAcl name= PAce = Perm ACE)
    see /perm /pace=xxx, /revoke=SID, /grant=SID=Access, and /deny=SID


Domain Migration With SubInAcl

The main purpose of SubInAcl is to help administrators to migrate users when the domain architecture has changed.

Example One

The user User1 has moved and is now member of the DOMB organization. You can reflect this change with:

subinacl /subdirec \\server\share\*.* /replace=OldDomain\User1=DOMB\User1

Note

A trust relationship must be enabled between the domains of \\server, OldDomain, and DOMB.

Example Two

You have worked with a unique domain. You want to migrate a backup domain controller (BDC) named MIGRCONTROL with all the files and the users to a new domain.

  1. Reinstall the BDC as primary domain controller (PDC) to the NEWDOMAIN (without erasing the files).
  2. Create the users on NEWDOMAIN.
  3. Create a "trusted relationship" with OLDDOMAIN.
  4. Run subinacl /noverbose /subdirectories x:\*.* /changedomain=OLDDOMAIN=NEWDOMAIN
  5. Verify the changes with SubInAcl /noverbose /subdirectories x:\*.*

Example Three

You have worked with a standalone server named SERVER in a workgroup environment. You want to move this server (including users) to a domain DOM.

  1. Move SERVER to the domain DOM.
  2. Create the users in the DOM domain.
  3. Run subinacl /noverbose /subdirectories \\server\share /changedomain=SERVER=DOM

For more details, see the /changedomain, /migratetodomain, and /replace actions.


Tru Access Manager Limited Edition

Tru Access Manager Limited Edition NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Tru Access Manager Lite is a comprehensive network accounting application developed by Telco Research that lets you track and report use of your network by users and/or workgroups. Combined with Microsoft Internet Authentication Service (IAS), TAM Lite reports when users connect to your network, how long they stay connected, and how much bandwidth they use while connected. Combined with Microsoft® Proxy Server, TAM Lite tracks what services are being used, when they are being used, and what Internet locations are being visited.

TAM Lite combines data collection, session management, performance management, exception reporting to:

  • Identify and report abnormal use.
  • Identify and report problems related to quality of service.
  • Report peak and off-peak traffic periods and port utilization.
  • Categorize and report types of network access (for example: analog, digital, VPN.)
  • Identify and report Internet, e-mail, and other types of network services.
  • Compute and access the cost of network services.

Files Required

The files required for Tru Access Manager Limited Edition are located on the Microsoft® Windows® 2000 Resource Kit companion CD.

To use this tool, you must install it. Find the installation file (tamlitev3019.exe) in the \apps\truaccess\ directory of the Microsoft® Windows® 2000 Resource Kit CD.


Tcmon.exe: Traffic Control Monitor

Tcmon.exe: Traffic Control Monitor NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Traffic Control Monitor consists of two components: Tcmon.exe, the monitor shell and Tccom.exe, the traffic control COM server.

TcMon

Tcmon.exe is a GUI tool that uses TcCom to drive the Traffic Control API locally or remotely. With it, you can be add or remove flows and filters.

TcMon shows information about traffic-control interfaces on a local or remote computer, which can be selected from the menu by clicking Computer, and then clicking Select computer.... Traffic control-enabled interfaces are listed in a drop-down menu that allows you to select one.

Three tabs display the following information:

Tab | Content
Flows | Describes flows, service type, token rate, filters, and size in bytes.
Parameters | Retrieves values of various parameters of each object.
Statistics | Enumerates traffic-control statistics.

This application is written in Microsoft® Visual Basic®.

TcCom

Tccom.exe is the service used by TcMon to communicate with the traffic control server. It can also be called by applications or scripts in VBScript or other scripting languages. Network administrators can use it to remotely configure traffic control on a host.

Before you can use TcMon on a target computer, you must register and start TcCom on that computer using the following syntax:

tccom -RegServer

To start TcCom as a service once it has been installed, run:

tccom -Service

To un-register TcCom, run the following on the target computer:

tccom -UnregServer

Files Required

  • Comctl32.ocx
  • Msvbm60.dll
  • Tccom.exe
  • Tcmon.exe


Tpc.exe: Third-Party Quality of Service Control Agent

Tpc.exe: Third-Party Quality of Service Control Agent NEW

This tool, which provides both command-line and GUI interfaces, enables you to work with Resource Reservation Protocol (RSVP), a Quality of Service (QoS) feature. You can use Tpc to test RSVP and to set up RSVP sessions on behalf of applications that are not QoS-aware. See the Internet Engineering Task Force's RSVP Request For Comment for details on RSVP parameters.

On Windows 2000, setting up an RSVP session also sets up other QoS mechanisms including 802.1p priority, diff-serv priority, and packet shaping.

Tpc runs on Windows 2000 and Windows 98, and uses RAPI Version 402.

Third-Party Quality of Service Control Agent Topics

  • Tpc Syntax
  • Tpc Example

File Required

  • Tpc.exe


Tpc Syntax

You can run Third-Party Quality of Service Control Agent from the command prompt, from the Run dialog box (on the Start menu click Run), or from Windows Explorer. When run, it displays a banner and a prompt:

tpc <--

Commands

At this prompt, you can use the following command set. All commands must be typed in upper-case characters. Some of the commands take arguments as shown.

HELP
displays this list of commands.
QUIT
exits Tpc.
ADD -d direction -p protocol -u local_address -v local_port -x remote_address -y remote_address -f filename
creates a session.
SHOWALL
shows all sessions.
SHOW -i index
shows one session.
CHANGESESSION -i index -session_parameter value
changes the context of a session.
CHANGEQOS -i index -qos_parameter value
changes the QoS Spec of a session.
INVOKE -i index
invokes QoS (RSVP + TC) for a standby session.
UPDATE -i index
re-invokes QoS (RSVP + TC) for an active session.
STATUS -i index
looks up the status of an active session.
TERMINATE -i index
terminates QoS support for an active session.
DELETE -i index
removes a standby session.
DELETEALL
removes all standby sessions.

Arguments

The arguments for the commands above are as follows:

index
session index
direction
{send | recv}
protocol
{udp | tcp}
local_address
local IP address {A.B.C.D | default}
local_port
local port number
remote_address
remote IP address
remote_port
remote port number
filename
file containing QoS specifications (see example file) indicating:
-servicetype {controlled_load | guaranteed}
-tokenrate (value in bytes/second)
-tokenbucketsize (value in bytes)
-peakbandwidth (value in bytes/second)
-minimumpolicedsize (value in bytes)
-maxsdusize (value in bytes)
-filterstyle {fixed | wildcard | default}
-resvconfirm {0 | 1 | default}
-ttl {integer | default}
-shapediscardmode {borrow | shape | discard | dontcare}
-internalpriority {interger value in the range of 0-7 | dontcare}
session_parameter
any one of the session parameters
qos_parameter
any one of the QoS parameters


Tpc Example

To setup a one way QoS support for a UDP flow from sender (172.31.1.1/6001) to receiver (172.31.2.2/7001):

On Sending Computer:

ADD -d send -p udp -u default -v 6001 -x 172.31.2.2 -y 7001 -f sendqos.file
SHOWALL
SHOW -i 0
INVOKE -i 0
CHANGEQOS -i 0 -shapediscardmode discard
UPDATE -i 0
TERMINATE -i 0
DELETE -i 0

On Receiving Computer:

ADD -d recv -p udp -u default -v 7001 -x 172.31.1.1 -y 6001 -f recvqos.file
SHOWALL
SHOW -i 0
INVOKE -i 0
CHANGEQOS -i 0 -tokenbucketsize 500
UPDATE -i 0
TERMINATE -i 0
DELETE -i 0

Example QoS File

-servicetype          controlled_load
-tokenrate            2000
-tokenbucketsize      100
-peakbandwidth        3000
-minimumpolicedsize   64
-maxsdusize           1024
-filterstyle          default
-resvconfirm          1
-ttl                  default
-shapediscardmode     shape
-internalpriority     5


Tsreg.exe: Terminal Services Client Registry Editor

Tsreg.exe: Terminal Services Client Registry Editor NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Windows Terminal Services Client Registry Editor is a GUI-based tool that allows you to modify a selection of Terminal Server Client options. It allows you to easily change registry settings relating to items such as bitmap caching and glyph caching.

You must have Terminal Services Client software installed to use this tool.

Using this tool, you can:

  • set and modify various Terminal Services Client settings, such as the bitmap cache size
  • more easily identify what effect various settings have on Windows Terminal Services Client (WSTC) performance

TsReg Topics

  • Bitmap Cache Tab
  • Glyph Cache Tab
  • Miscellaneous Tab
  • Client Profiles Tab

Files Required

  • Tsreg.exe
  • Tsreg.hlp


Terminal Services Client Registry Editor interface

Bitmap Cache tab

The bitmap cache stores bitmaps client side so they do not have to be resent over the wire.

Bitmap caching places commonly used bitmaps, like the one used to display the Start button, in a file on the client computer. This improves performance by minimizing the amount of display information that must be passed over a connection.

Bitmap caching is enabled on a per-session basis from the client software and requires 10 megabytes (MB) of free hard-drive space on the client computer.

Persistent bitmap caching allows the client to store bitmaps sent from the server on a persistent media like a disk or flash RAM. On connection, the client informs the server of the bitmaps it has so the server doesn't have to send them over again. The bitmap cache uses a simple virtual memory scheme to increase the size of the cache, without taking up more physical memory. This allows the client to advertise more bitmap cache entries than it has in RAM, and use the disk or file system as the swap space. This helps to reduce the number of cache evictions and improves the bandwidth utilization. Virtual memory bitmap caching is especially useful for bitmaps larger than 4 kilobytes (KB).

The RDP protocol supports a maximum of five bitmap caches. The cell sizes for cache 0 to 4 are 256 bytes (16X16 bitmaps), 1024 bytes (32X32 bitmaps), up to 64 KB (256X256 bitmaps). The number of cell entries depends on the client's configuration. Persistent bitmaps are stored under the directory where the client is installed. Within that directory, a "cache/" directory is created, and within that are numbered directories, one for each cache.

These values are set in the following registry key: HKEY_CURRENT_USER \Software\Microsoft\Terminal Server Client\.
Bitmap cache
Total Cache Size | Size in KB of RAM-based bitmap cache.
Distribution Proportion
1st item | Percentage of bitmap cache used for small cache entries.
2nd item | Percentage of bitmap cache used for medium cache entries.
3rd item | Percentage of bitmap cache used for large cache entries.
Persistent Caches
Cache 1 | If "Cache bitmaps to disk" setting is enabled, setting this entry to 1 will cache small cache entries.
Cache 2 | If "Cache bitmaps to disk" setting is enabled, setting this entry to 1 will cache medium cache entries.
Cache 3 | If "Cache bitmaps to disk" setting is enabled, setting this entry to 1 will cache large cache entries.
Cache 4 | unused
Cache 5 | unused
Number of bitmap caches | Controls the number of active bitmap caches. Activates the number (1-5) of persistent caches you can configure.
Restore button | Restore default settings on this tab.

Glyph Cache tab

The glyph cache stores glyphs client side so they do not have to be resent over the wire. The glyph cache contains the outline, vector, or raster font information.

A glyph is any character, such as a letter or number, along with the font information required to calculate how that character will be displayed. The first time a glyph is requested, its appearance is calculated, then stored in a glyph cache. Anytime after that the glyph is needed, it is transferred out of the cache to the screen or page buffer. For example, if you are typing in a document with particular font, chances are that 99.9 percent of the time the font is used on the screen as it is being transferred from the cache.

These values are set in the following registry key: HKEY_CURRENT_USER \Software\Microsoft\Terminal Server Client\.

Glyph cache
Glyph cell settings
Cell 1 Size | Size of cells in glyph cache 1.
Cell 2 Size | Size of cells in glyph cache 2.
Cell 3 Size | Size of cells in glyph cache 3.
Cell 4 Size | Size of cells in glyph cache 4.
Cell 5 Size | Size of cells in glyph cache 5.
Cell 6 Size | Size of cells in glyph cache 6.
Cell 7 Size | Size of cells in glyph cache 7.
Cell 8 Size | Size of cells in glyph cache 8.
Cell 9 Size | Size of cells in glyph cache 9.
Cell 10 Size | Size of cells in glyph cache 10.
Glyph support level | 0 – none, 1 – partial, 2 – full glyph support. None turns glyph cache off. Partial and Full turn on glyph caching. They are treated the same.
Text Fragment Cell Size | Size of cells in the fragment cache.
Restore button | Restore default settings on this tab.

Miscellaneous tab

These values are set in the following registry keys: HKEY_CURRENT_USER \Software\Microsoft\Terminal Server Client\ HKEY_CURRENT_USER\Control Panel\Desktop\
Miscellaneous
Shadow Bitmap Enabled | Controls use of backup bitmap. A shadow bitmap is a copy of the screen memory maintained on the client to allow faster response to delta operations, like minimizing a window.
Dedicated Terminal | 0 - not a dedicated terminal, 1 - dedicated terminal. Dedicated terminal tells us that the Terminal Server client will always have a particular application window, and it won't get overlaid. For example, as would happen when it is used to serve up a particular application, rather then a desktop. Knowing this allows us to optimize other, such as turning off the shadow bitmap.
Order Draw Threshold | Number of orders to draw into the shadow bitmap before transferring.
ForegroundLockTimeout |
Restore button | Restore default settings on this tab.

Client Profiles tab

Use this tab to save and load custom setting profiles. These are useful for quickly assessing the impact of different configuration setting combinations on your Terminal Services client.

Profiles are saved in the registry under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\.

Client Profiles
Saved profiles | Select a profile containing settings for all other tabs. note-icon Note Use the Restore button on any tab where you want to reset options to default values.
Load button | Load an existing profile.
Delete button | Delete a profile.
Save As button | Save existing settings in a new profile.


Terminal Services Client Registry Editor: Bitmap Cache tab

The bitmap cache stores bitmaps client side so they do not have to be resent over the wire.

Bitmap caching places commonly used bitmaps, like the one used to display the Start button, in a file on the client computer. This improves performance by minimizing the amount of display information that must be passed over a connection.

Bitmap caching is enabled on a per-session basis from the client software and requires 10 megabytes (MB) of free hard-drive space on the client computer.

Persistent bitmap caching allows the client to store bitmaps sent from the server on a persistent media like a disk or flash RAM. On connection, the client informs the server of the bitmaps it has so the server doesn't have to send them over again. The bitmap cache uses a simple virtual memory scheme to increase the size of the cache, without taking up more physical memory. This allows the client to advertise more bitmap cache entries than it has in RAM, and use the disk or file system as the swap space. This helps to reduce the number of cache evictions and improves the bandwidth utilization. Virtual memory bitmap caching is especially useful for bitmaps larger than 4 kilobytes (KB).

The RDP protocol supports a maximum of five bitmap caches. The cell sizes for cache 0 to 4 are 256 bytes (16X16 bitmaps), 1024 bytes (32X32 bitmaps), up to 64 KB (256X256 bitmaps). The number of cell entries depends on the client's configuration. Persistent bitmaps are stored under the directory where the client is installed. Within that directory, a "cache/" directory is created, and within that are numbered directories, one for each cache.

These values are set in the following registry key: HKEY_CURRENT_USER \Software\Microsoft\Terminal Server Client\.
Bitmap cache
Total Cache Size | Size in KB of RAM-based bitmap cache.
Distribution Proportion
1st item | Percentage of bitmap cache used for small cache entries.
2nd item | Percentage of bitmap cache used for medium cache entries.
3rd item | Percentage of bitmap cache used for large cache entries.
Persistent Caches
Cache 1 | If "Cache bitmaps to disk" setting is enabled, setting this entry to 1 will cache small cache entries.
Cache 2 | If "Cache bitmaps to disk" setting is enabled, setting this entry to 1 will cache medium cache entries.
Cache 3 | If "Cache bitmaps to disk" setting is enabled, setting this entry to 1 will cache large cache entries.
Cache 4 | unused
Cache 5 | unused
Number of bitmap caches | Controls the number of active bitmap caches. Activates the number (1-5) of persistent caches you can configure.
Restore button | Restore default settings on this tab.


Terminal Services Client Registry Editor: Glyph Cache tab

The glyph cache stores glyphs client side so they do not have to be resent over the wire. The glyph cache contains outline, vector, or raster font information for displaying characters on the client.

A glyph is any character, such as a letter or number, along with the font information required to calculate how that character will be displayed. The first time a glyph is requested, its appearance is calculated, then stored in a glyph cache. Anytime after that the glyph is needed, it is transferred out of the cache to the screen or page buffer. For example, if you are typing in a document with particular font, chances are that 99.9 percent of the time the font is used on the screen as it is being transferred from the cache.

These values are set in the following registry key: HKEY_CURRENT_USER \Software\Microsoft\Terminal Server Client\.

Glyph cache
Glyph cell settings
Cell 1 Size | Size of cells in glyph cache 1.
Cell 2 Size | Size of cells in glyph cache 2.
Cell 3 Size | Size of cells in glyph cache 3.
Cell 4 Size | Size of cells in glyph cache 4.
Cell 5 Size | Size of cells in glyph cache 5.
Cell 6 Size | Size of cells in glyph cache 6.
Cell 7 Size | Size of cells in glyph cache 7.
Cell 8 Size | Size of cells in glyph cache 8.
Cell 9 Size | Size of cells in glyph cache 9.
Cell 10 Size | Size of cells in glyph cache 10.
Glyph support level | 0 – none, 1 – partial, 2 – full glyph support. None turns glyph cache off. Partial and Full turn on glyph caching. They are treated the same.
Text Fragment Cell Size | Size of cells in the fragment cache.
Restore button | Restore default settings on this tab.


Terminal Services Client Registry Editor: Miscellaneous tab

These values are set in the following registry keys: HKEY_CURRENT_USER \Software\Microsoft\Terminal Server Client\ HKEY_CURRENT_USER\Control Panel\Desktop\
Miscellaneous
Shadow Bitmap Enabled | Controls use of backup bitmap. A shadow bitmap is a copy of the screen memory maintained on the client to allow faster response to delta operations, like minimizing a window.
Dedicated Terminal | 0 - not a dedicated terminal, 1 - dedicated terminal. Dedicated terminal tells you that the Terminal Services client will always have a particular application window, and it won't get overlaid. For example, this would when it is used to serve up a particular application, rather then a desktop. Knowing this allows you to optimize other options, such as turning off the shadow bitmap.
Order Draw Threshold | Number of orders to draw into the shadow bitmap before transferring.
ForegroundLockTimeout | Sets the duration for which the foreground focus can not be wrested from the current holder after an action.
Restore button | Restore default settings on this tab.


Terminal Services Client Registry Editor: Client Profiles tab

Use this tab to save and load custom setting profiles. These are useful for quickly assessing the impact of different configuration setting combinations on your Terminal Servcies client.

Profiles are saved in the registry under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\.

Client Profiles
Saved profiles | Select a profile containing settings for all other tabs. note-icon Note Use the Restore button on any tab where you want to reset options to default values.
Load button | Load an existing profile.
Delete button | Delete a profile.
Save As button | Save existing settings in a new profile.


Tsver.exe: Terminal Services Version Limiter

Tsver.exe: Terminal Services Version Limiter NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

Version Limiter is a GUI-based tool that allows you to set whether the Terminal Services Client supports version checking. This allows you to limit access

Terminal Services Version Monitor will only run Microsoft® Windows® 2000 with Terminal Services enabled.

Terminal Services Version Monitor (TsVer) is an administrative tool for enforcing policies with respect to WinStation client build numbers. This tool consists of two components, a wizard for editing policies, enabling, and disabling version checking, as well as a dynamic link library for enforcing policies. TsVer provides a way for you to exercise control over which WinStation clients can connect to your servers.

Version Limiter features include:
  • explicit control over which client builds are permitted on your server
  • easily enabled or disabled
  • option for sending customized messages to rejected clients
  • all failed logon attempts recorded to Windows event log with IP address and computer name.
TsVer.dll must be copied to the System32 directory.

Files Required

  • Tsver.exe
  • Tsver.dll


Usrmgr.exe: User Manager for Domains

Use this GUI-based tool to manage security for Microsoft® Windows® 2000 Professional and Microsoft® Windows NT® version 4.0 domains, member servers, and computers. It enables you to manage a Windows NT 4.0 domain from a Windows 2000 computer.

Note

For Windows 2000 domains, member servers, and Windows 2000 Professional computers, use Active Directory directory service and the other Windows 2000 administrative tools instead.

With User Manager for Domains you can:

  • Select the domain or computer to be administered.
  • Create and manage user accounts.
  • Create and manage groups.
  • Manage the security policies.

Files Required

  • Usrmgr.exe
  • Usrmgr.hlp
  • Usrmgr.cnt


Usrstat.exe

This command-line tool displays the user name, full name, and last logon date and time for each user in a given domain.

File Required

  • Usrstat.exe


Usrtogrp.exe: Add Users to a Group

This command-line tool adds users to a local or global group according to information contained in a user-specified input text file.

The UsrToGrp tool creates the specified group if it does not already exist. Then, for each user name specified in the file, it searches the specified computer or domain for the user account. If you are adding users to a local group, the tool also searches trusted domains for the user account. If you are adding users to a global group, the tool only searches the specified domain, not any trusted domains. Once the account is found, UsrToGrp adds the account to the group. Note that if the user name exists in multiple domains, only the first instance of that user name that UsrToGrp finds is added to the group.

UsrToGrp does not create user accounts. Each user specified in the text file you create must have an existing account. For global groups, users must have an account in the specified domain. For local groups, users must have an account on the local computer, the specified domain, or in a trusted domain. Only accounts that exist on your local computer will be used if your Windows 2000 Professional computer is a member of a Workgroup rather than a Domain.

This tool is most beneficial when used in a trusted domain structure. It is useful for granting large numbers of users (1,000 maximum per iteration) membership in a group, especially if you don't know in which trusted domain the user accounts are contained. The tool works on all Windows 2000 computers.

Note

You must be a member of the Administrators or Account Operators group in the specified computer or domain.

UsrToGrp Topics

  • To add users to a group
  • UsrToGrp Examples

Files Required

  • Usrtogrp.exe


To add users to a group

  1. Create a text file with the following format: domain: domainname localgroup(or globalgroup): groupname user1 user2 user3 (etc...)
  2. At the command prompt, type:

    One Step usrtogrp filename

    Where:

    filename
    is the text file you created in Step 1. If the file is not in the current folder, type the full path to the file, for example: c:\reskit>usrtogrp c:\public\tools\file.txt


Usrtogrp.exe: Example

Usrtogrp.exe: Examples

  1. A text file for adding users to a group on the local computer:

    domain: localmachine

    globalgroup: sms users

    user1

    user2

    user3

    note-icon

    Note

    If you are manipulating a local group, UsrToGrp will also search trusted domains, so user accounts should be specified as "UserName", not "DomainName\UserName".

  2. A text file for adding users to a group on the maindomain domain:

    domain: maindomain

    localgroup: second level administrators

    user1

    user2

    user3

    user4


Whoami.exe

This command-line tool returns the domain or computer name and the user name of the user who is currently logged onto the computer on which the tool is run.

WhoAmI displays the complete contents of the access token (for example, of the current user's security context) on standard output (STDOUT). It displays the user name and security identifier (SID), the groups and their SIDs, the privileges and their status (for example, enabled or disabled) and the logon ID.

WhoAmI Topics

  • WhoAmI Syntax
  • WhoAmI Examples

File Required

  • Whoami.exe


WhoAmI Syntax

one step whoami [/option] [/option] ...

Where:

/option is one of the following:

/all
displays all information in the current access token.
/noverbose
displays minimal information. Must be used with the /USER, /GROUPS, /PRIV, or /LOGONID option.
/user
displays current user.
/groups
/priv
displays groups.
displays privileges.
/logonid
displays logon ID.
/sid
displays security identifiers (SIDs). Must be used with the /USER, /GROUPS, /PRIV, or /LOGONID option.
/help
displays help.


WhoAmI Output Examples

For information on WhoAmI syntax, at the command prompt type:

one step whoami /help

[c:\]WHOAMI

DCHRISROB\chrisrob

[c:\]WHOAMI /ALL

[User] = "DCHRISROB\chrisrob" S-1-5-21-1099181476-344607857-928725530-1002

[Group 1] = "DCHRISROB\Domain Admins" S-1-5-21-1099181476-344607857-928725530-512

[Group 2] = "Everyone" S-1-1-0

[Group 3] = "DCHRISROB\RK Source" S-1-5-21-1099181476-344607857-928725530-1010

[Group 4] = "BUILTIN\Administrators" S-1-5-32-544

[Group 5] = "BUILTIN\Users" S-1-5-32-545

[Group 6] = "BUILTIN\Guests" S-1-5-32-546

[Group 7] = "DCHRISROB\Domain Users" S-1-5-21-1099181476-344607857-928725530-513

[Group 8] = "DCHRISROB\Domain Guests" S-1-5-21-1099181476-344607857-928725530-514

[Group 9] = "LOCAL" S-1-2-0

[Group 10] = "NT AUTHORITY\INTERACTIVE" S-1-5-4

[Group 11] = "NT AUTHORITY\Authenticated Users" S-1-5-11

[Login ID] = S-1-5-5-0-6552

(O) SeTcbPrivilege = Act as part of the operating system

(X) SeChangeNotifyPrivilege = Bypass traverse checking

(O) SeSecurityPrivilege = Manage auditing and security log

(O) SeBackupPrivilege = Back up files and directories

(O) SeRestorePrivilege = Restore files and directories

(O) SeSystemtimePrivilege = Change the system time

(O) SeShutdownPrivilege = Shut down the system

(O) SeRemoteShutdownPrivilege = Force shutdown from a remote system

(O) SeTakeOwnershipPrivilege = Take ownership of files or other objects

(O) SeDebugPrivilege = Debug programs

(O) SeSystemEnvironmentPrivilege = Modify firmware environment values

(O) SeSystemProfilePrivilege = Profile system performance

(O) SeProfileSingleProcessPrivilege = Profile single process

(O) SeIncreaseBasePriorityPrivilege = Increase scheduling priority

(O) SeLoadDriverPrivilege = Load and unload device drivers

(O) SeCreatePagefilePrivilege = Create a pagefile

(O) SeIncreaseQuotaPrivilege = Increase quotas

[c:\]WHOAMI /USER /SID

[User] = "DCHRISROB\chrisrob" S-1-5-21-1099181476-344607857-928725530-1002

[c:\]WHOAMI /GROUPS

[Group 1] = "DCHRISROB\Domain Admins"

[Group 2] = "Everyone"

[Group 3] = "DCHRISROB\RK Source"

[Group 4] = "BUILTIN\Administrators"

[Group 5] = "BUILTIN\Users"

[Group 6] = "BUILTIN\Guests"

[Group 7] = "DCHRISROB\Domain Users"

[Group 8] = "DCHRISROB\Domain Guests"

[Group 9] = "LOCAL"

[Group 10] = "NT AUTHORITY\INTERACTIVE"

[Group 11] = "NT AUTHORITY\Authenticated Users"

[c:\]WHOAMI /GROUPS /NOVERBOSE

DCHRISROB\Domain Admins

Everyone

DCHRISROB\RK Source

BUILTIN\Administrators

BUILTIN\Users

BUILTIN\Guests

DCHRISROB\Domain Users

DCHRISROB\Domain Guests

LOCAL

NT AUTHORITY\INTERACTIVE

NT AUTHORITY\Authenticated Users

[c:\]WHOAMI /USER /GROUPS /SID

[User] = "DCHRISROB\chrisrob" S-1-5-21-1099181476-344607857-928725530-1002

[Group 1] = "DCHRISROB\Domain Admins" S-1-5-21-1099181476-344607857-928725530-512

[Group 2] = "Everyone" S-1-1-0

[Group 3] = "DCHRISROB\RK Source" S-1-5-21-1099181476-344607857-928725530-1010

[Group 4] = "BUILTIN\Administrators" S-1-5-32-544

[Group 5] = "BUILTIN\Users" S-1-5-32-545

[Group 6] = "BUILTIN\Guests" S-1-5-32-546

[Group 7] = "DCHRISROB\Domain Users" S-1-5-21-1099181476-344607857-928725530-513

[Group 8] = "DCHRISROB\Domain Guests" S-1-5-21-1099181476-344607857-928725530-514

[Group 9] = "LOCAL" S-1-2-0

[Group 10] = "NT AUTHORITY\INTERACTIVE" S-1-5-4

[Group 11] = "NT AUTHORITY\Authenticated Users" S-1-5-11

[c:\]WHOAMI /PRIV /NOVERBOSE

SeTcbPrivilege

SeChangeNotifyPrivilege

SeSecurityPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeSystemtimePrivilege

SeShutdownPrivilege

SeRemoteShutdownPrivilege

SeTakeOwnershipPrivilege

SeDebugPrivilege

SeSystemEnvironmentPrivilege

SeSystemProfilePrivilege

SeProfileSingleProcessPrivilege

SeIncreaseBasePriorityPrivilege

SeLoadDriverPrivilege

SeCreatePagefilePrivilege

SeIncreaseQuotaPrivilege

[c:\]WHOAMI /USER /GROUPS /PRIV

[User] = "DCHRISROB\chrisrob"

[Group 1] = "DCHRISROB\Domain Admins"

[Group 2] = "Everyone"

[Group 3] = "DCHRISROB\RK Source"

[Group 4] = "BUILTIN\Administrators"

[Group 5] = "BUILTIN\Users"

[Group 6] = "BUILTIN\Guests"

[Group 7] = "DCHRISROB\Domain Users"

[Group 8] = "DCHRISROB\Domain Guests"

[Group 9] = "LOCAL"

[Group 10] = "NT AUTHORITY\INTERACTIVE"

[Group 11] = "NT AUTHORITY\Authenticated Users"

(O) SeTcbPrivilege = Act as part of the operating system

(X) SeChangeNotifyPrivilege = Bypass traverse checking

(O) SeSecurityPrivilege = Manage auditing and security log

(O) SeBackupPrivilege = Back up files and directories

(O) SeRestorePrivilege = Restore files and directories

(O) SeSystemtimePrivilege = Change the system time

(O) SeShutdownPrivilege = Shut down the system

(O) SeRemoteShutdownPrivilege = Force shutdown from a remote system

(O) SeTakeOwnershipPrivilege = Take ownership of files or other objects

(O) SeDebugPrivilege = Debug programs

(O) SeSystemEnvironmentPrivilege = Modify firmware environment values

(O) SeSystemProfilePrivilege = Profile system performance

(O) SeProfileSingleProcessPrivilege = Profile single process

(O) SeIncreaseBasePriorityPrivilege = Increase scheduling priority

(O) SeLoadDriverPrivilege = Load and unload device drivers

(O) SeCreatePagefilePrivilege = Create a pagefile

(O) SeIncreaseQuotaPrivilege = Increase quotas


Wins.dll: WINS Replication Network Monitor Parser

Wins.dll: WINS Replication Network Monitor Parser NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This extension DLL parses Windows Internet Name Service (WINS) data from within Network Monitor, a feature of Microsoft® Windows® 2000.

This tool is useful as a way to view and troubleshoot network issues related to WINS replication.

Wins.dll runs on any version of Windows 2000 or Microsoft® Windows NT® that supports Network Monitor version 1 or 2.

WINS Replication Network Monitor Parser Topic

  • Installing Wins.dll

File Required

  • Wins.dll


Installing Wins.dll

To install WINS Replication Network Monitor Parser, you must modify the local Parser.ini and Tcpip.ini to support the Wins.dll. Follow these steps:

  1. Open Tcpip.ini in the \Parsers subdirectory.
  2. Add "42 = WINS" to the [TCP_HandoffSet] section of the file, as in the following example:
    [TCP_HandoffSet]
20   = FTP
21   = FTP
23   = TELNET
25   = SMTP
42   = WINS
53   = DNS
  3. Save and close Tcpip.ini.
  4. Open Parser.ini in the \Netmon subdirectory.
  5. Add "WINS.DLL = 0: WINS" to the [PARSERS] section of the file, as in the following example:
    [PARSERS]
FRAME.DLL   = 0: FRAME
MAC.DLL     = 0: ETHERNET, TOKENRING, FDDI, TMAC, SMT
LLC.DLL     = 0: LLC, RPL, SNAP, BPDU
NETBIOS.DLL = 0: NETBIOS
SMB.DLL     = 0: SMB
.....
WINS.DLL    = 0: WINS
  6. Add the following section to the end of Parser.ini.
    [WINS]
Comment     = "WINS Server Replication"
FollowSet   =
HelpFile    =
  7. Save and close Parser.ini.


Winschk.exe

This command-line tool checks name and version-number inconsistencies that may appear in Windows Internet Name Service (WINS) databases, monitors replication activity, and verifies the replication topology in an enterprise network. It is particularly useful for WINS administrators.

With WinsChk, you can remotely check and resolve WINS database replication issues. You can isolate some of the most common problems that lead to database inconsistencies with an easy-to-use tool that can be run in a central location.

This tool includes options that flag possible causes of database inconsistencies, such as:

  • asymmetric replication topologies
  • a high level of communication failures

WinsChk can detect these and warn the administrator

The tool also helps monitor the actual replication activity by allowing the user to:

  • check for version number inconsistencies
  • check for the state of one or more names at various WINS databases in the network.

The tool can be used in interactive or non-interactive mode. In the latter, a log of all the tool activity is kept in the local directory (Winstst.log). The option to monitor WINS activity can be run in the background, which dumps all logs into Monitor.log.

WinsChk Topic

  • WinsChk Options

File Required

  • Winschk.exe


WinsChk Options

WinsChk has no switches. When run at the command prompt, it displays the following options:

0 - Enables or disables interactive mode
1 - Tests for names on WINS servers
2 - Checks for version number consistencies
3 - Monitors WINS servers and detects communication failures
4 - Verifies replication configuration
99 - Exits WinsChk

These options are described in more detail below.

Options

0 - Enabling or disabling interactive mode

Allows the user to enable or disable interactive mode. In interactive mode, status messages are displayed in the command-prompt window and recorded in Winstst.log. The first time you run WinsChk, interactive mode is enabled by default.

1 - Testing names on WINS servers

This option allows you to check quickly for consistency between WINS servers. This functionality is driven by two flat files, Names.txt and Servers.txt, which you can edit by using a text editor.

Servers.txt contains the IP address of a source WINS server from which a list of all the replicating WINS servers is built up to query.

Names.txt can contain multiple NetBIOS names (one per line) which need to be checked. The format of names in this file is:

name*16th_byte

for example, Variable*20

Note

The names included in Names.txt must be specified in uppercase characters.

WinsChk queries each WINS server with the list of NetBIOS names. It checks for consistency of IP addresses and reports any mismatched IP addresses or occurrences of "name not found". It also reports non-responsive WINS servers.

2 - Checking for version number inconsistencies

Using an RPC (remote procedure call) function, WinsChk gets the owner address to version number mapping tables from different WINS servers and checks the consistency of their databases by ensuring that a WINS server always has the highest version number among the network of WINS servers for records it owns.

In the following matrix, each record is a mapping table retrieved from a particular WINS server (the order of WINS servers being the same along both dimensions of the matrix), each diagonal element should have the highest version number among all the numbers in its column.

ABCList of owners

A1008079Mapping table retrieved from A

B9575*65Mapping table retrieved from B

C7845110Mapping table retrieved from C

In this example, the intersection B with B indicates a problem that needs to be addressed.

3 - Monitoring WINS servers and detecting communication failures between WINS servers

This option monitors WINS servers periodically to ensure that both the primary and backup WINS servers are not down at the same time. WinsChk records WINS server activity in Monitor.log, and alerts the administrator to any situation that needs to be addressed.

This option also periodically retrieves statistics from the WINS server, for example once every hour, to ensure that replication is not failing consistently. Communication problems might be due to a disconnected or inoperable WINS server.

You can run WinsChk with this option as a one-time or a continuous version. The continuous version runs every three hours by default. To avoid excessive network activity, you should not run this option too frequently.

4 - Verifying replication configuration

Checks the registry of a WINS server to ensure that each replication partner is configured as both pull and push and that a pull interval is defined. In this way, WINS database changes are replicated for the entire network. If WinsChk detects an asymmetric partner relationship, it flags it for the administrator.

99 - Quits the tool


Winscl.exe: WINS Administration Tool

This command-line administrative tool helps to manage Windows Internet Name Service (WINS).

WinsCl can monitor WINS activities and examine WINS databases. It can also send commands to WINS to initiate an activity such as replication, scavenging; registering and/or querying a record; or backup and/or restore operations. It includes a command that does consistency checking on the WINS database.

Unlike WINS Manager, however, WinsCl cannot configure a WINS.

Notes

  • Using WinsCl is potentially a high-overhead operation and a network-bandwidth hog, as it results in full replication of the entire database. It is best done when network activity is low.
  • If you attempt to delete a non-existent or incorrect name (for example, with lowercase letters that should be uppercase), WinsCl returns a status of SUCCESS even though the database was not modified since the parameter was incorrect. This could be misleading, as it might appear that the database has been correctly updated when in fact it was not.

For help in troubleshooting possible causes of database inconsistencies, use WinsChk, a Windows 2000 Resource Kit tool, in conjunction with WinsCl.

WinsCl Topics

  • WinsCl Options
  • WinsCl Notes

File Required

  • Winscl.exe


WinsCl Options

You can use the following options with WinsCl:

Option | Full name | Explanation
RN | Register Name | Allows you to register unique/multihomed/normal group/Internet group names.
QN | Query Name | Allows you to query any name in the Windows Internet Name Service (WINS) database.
DN | Delete Name | Deletes a name. This action permanently erases the name from the WINS database.
GV | Get Version Counter Value | Gets the current value of the version counter used to stamp records with version numbers.
GM Get Mappings Gets the configuration intervals being used by WINS. These intervals are in seconds. It also retrieves the priority class and the number of query threads in WINS. The owner ID to address to version number mappings used by the replicator to determine how up-to-date the WINS database is relative to other WINS servers is also retrieved. This command works only with WINS used with Microsoft® Windows NT® version 3.51.

note-icon

Note

Owner ID is a number corresponding to a WINS address. This number is stored with a record in the WINS database, and identifies the owner of the record.
GMO | Get Mappings (Windows NT 3.5 WINS) | Is the same as Get Mappings except that this version applies only to WINS used with Windows NT 3.5.
GST | Get Statistics | Allows you to get the various time-stamps and statistics maintained by WINS. This option applies only to WINS used with Windows NT 3.51.
GSTO | Get Statistics (Windows NT 3.5 WINS) | Is the same as Get Statistics except that this option applies only to WINS used with Windows NT 3.5.
PUSHT Push Trigger Allows you to instruct the connected WINS server to send a push trigger to another WINS server. The local WINS server sends a push trigger to the remote WINS server only if one of the following conditions is true:
  • The remote WINS server is listed under the Wins\Parameters\Push subkey in the registry.
  • The RplOnlyWCnfPnrs entry in the Wins\Parameters subkey in the registry is not present or has a value of 0.
Likewise, the remote WINS accepts this trigger only if the local WINS satisfies one of the following conditions:
  • It is listed under the Wins\Parameters\Pull subkey in its registry.
  • The RplOnlyWCnfPnrs entry in the Wins\Parameters subkey in its registry is not present or has a value of 0.
Once the trigger is sent and accepted, the remote WINS server, depending on whether or not its database is out of sync with the database of the connected WINS server, might or might not pull records from the local WINS server.
PULLT Pull Trigger Allows you to instruct the connected WINS server to send a pull trigger to another WINS server. The local WINS server sends a pull trigger to the remote WINS server only if its database is out of sync with the database of the remote WINS server, and if (and only if) one of the following conditions is true:
  • The remote WINS server is listed in the registry under the Wins\Parameters\Pull subkey.
  • The RplOnlyWCnfPnrs registry entry in the Wins\Parameters subkey is either not present or has a value of 0.
Likewise, the remote WINS server accepts this trigger only if one of the following conditions is true:
  • The local WINS server is listed under the Wins\Parameters\Push subkey in its registry.
  • The RplOnlyWCnfPnrs entry in the Wins\Parameters subkey in its registry is either not present or has a value of 0.
SI | Statically Initialize WINS | Allows you to statically initialize WINS from a file which has records in the format used in an LMHOSTS file.
CC Consistency Checking Allows you to initiate consistency checking on WINS. Consistency checking results in a WINS server communicating with other WINS servers to check the consistency of its database.
Warning This operation results in high overhead on the WINS server and can also use up the entire network bandwidth (if a full replication is done). If you have a large database, you should run this command at a time when network traffic is minimal.
SC | Scavenge Records | Is used to instruct WINS to scavenge records. This means that records that are old enough are released, and appropriate records are made extinct. Extinct records that need to be deleted are deleted, and replica records that need to be verified are verified.
DRR | Delete All or a Range of Records | Is used to delete records by specifying a range of version numbers. You can also delete all records in a WINS database. Only the records owned by the selected WINS server are deleted. Other information about the WINS service, such as the highest version number pulled, is not deleted.
PRR Pull All or a Range of Records Is used to pull a range of records from remote WINS. The range is a range of version numbers. If the range being pulled overlaps records of the remote WINS that already exist in the WINS database, the pre-existing records are deleted before the new ones are pulled. This command is used to pull records that were never replicated and have no chance of being replicated unless their version number becomes greater than the highest value the local WINS has allocated for remote WINS. Replication only takes place after the appropriate registry value has been checked.
See also Pull Trigger
GRBN Get Records by Name Retrieves one or more records starting with a string. The names of records are alphabetically sorted in the WINS database.
Note Names with 0x1B in the 16th byte are an exception. They are stored with the 1st and 16th byte transposed.
You can choose to search the database from the beginning or from the end. If, for example, you want to retrieve 100 names starting with the letter Z, you can specify that WINS should search from the end of the database. This will cause less overhead on WINS.
GRBV | Get Records by Version Number | Retrieves records from the local WINS database in the specified range of version numbers.
BK | Back Up WINS Database | Performs a backup of the WINS database to a directory on the same WINS computer.
RSO Restore WINS Database prior to Microsoft® Windows NT version 4.0 Restores the WINS database from the directory to which it was backed up.
Note The WINS database is created by WINS prior to Windows NT 4.0. Also, make sure that WINS is not running when you run this command.
RS Restore WINS Database Restores the WINS database from the directory to which it was backed up.
Note The WINS database is created by WINS in Windows NT 4.0 or Windows 2000. Also, make sure that WINS is not running when you run this command.
RC | Reset WINS Counters | Resets the WINS counters displayed via Get Statistics (or Get Statistics (Windows NT 3.5 WINS) for Windows NT 3.5 WINS) to 0.
CR Count Records in Database Counts the number of records for an owner in the WINS database. The owner is identified by the address. You can count either all or a specific range of records.
Note This can be a high overhead operation.
SDB Search Database Searches the database for a record with a particular name or address.
Note This can be a high overhead operation.
GD | Get Domain Names | Allows you to get the list of domain names registered in the WINS database. These are the 1B names (0x1B in the 16th byte) registered by the PDCs (primary domain controllers) of the domains.
DW | Delete WINS | Deletes all the information relevant to a WINS server (identified by its address) from the database of the connected WINS server, including all records belonging to the WINS server and administrative information. When the connected WINS is specified for deletion, all of its records are deleted. Other information, such as highest version number of records in the database, is not removed.
CW | Connect to WINS | Allows you to connect to a remote WINS server.
MENU | Show Menu | Displays the list of commands available.
NOMENU | No Menu | Hides the list of commands. This may be desirable if you don't want to clutter the output when a script is driving WinsCl.
EX | Exit Tool | Allows you to exit WinsCl.


WinsCl Notes

When using WinsCl, keep the following points in mind:

  • Addresses of Windows Internet Name Service (WINS) should be given in dotted decimal notation.
  • A version number is 64 bits long. When you are prompted for the version number, enter it in decimal with the high word first followed by the low word. The two words should be separated by a space. For example, 0 9567.
  • Many commands such as PULLT, PUSHT, SI, and PRR, are run in the background. A return status of SUCCESS indicates that the command has been queued to WINS for execution. It does not mean that WINS has successfully run the command.
  • WinsCl is case sensitive. So, for example, BOB is different from bob or Bob (when used as input to RN, QN, or domain name.)
  • The scope, if given, should be in domain name form, as explained in RFC 883. For example, microsoft.com.
  • Whenever a pull (or a push) replication is done, the local WINS server will send a request for it to the remote WINS server only if the remote WINS server is either listed in the registry under the Wins\Parameters\Pull (or Push) subkey or if the value of the RplOnlyWCnfPnrs entry in the Wins\Parameters subkey is either nonexistent or set to 0. Likewise, the remote WINS server will accept the request only if the WINS server making the request is either listed under the Wins\Parameters\Push (or Pull) subkey or if the value of the RplOnlyWCnfPnrs entry in the Wins\Parameters subkey is either nonexistent or is set to 0. The two WINS servers look up the values of these above subkeys and entries in their local registries.


Winsta.exe: WinStation Monitor

Winsta.exe: WinStation Monitor NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This GUI tool monitors the status of all users logged on to a Microsoft® Windows® 2000 Terminal Server.

WinStation Monitor conserves resources while providing up-to-the-minute statistics, including user name, domain, IP address, session ID and connection status of currently logged-on users. This is particularly useful for Remote Administration tasks, as it gives the operator an immediate indication of other administrators who may be active on the system.

WinStation Monitor Features

  • Automatic refresh as well as a manual refresh option (click View, and then Refresh).
  • Tray icon in the status area displays the total number of sessions in a tool tip.
  • Option for showing all sessions or only active sessions (click View, and then Show All).
  • Data can be sorted in ascending or descending order by column.

WinStation Monitor runs only on Windows 2000 with Terminal Services enabled.

File Required

  • Winsta.exe


Wlbs_hb.dll and Wlbs_rc.dll: Windows Load Balancing Server Network Monitor Parsers

Wlbs_hb.dll and Wlbs_rc.dll: Windows Load Balancing Server Network Monitor Parsers NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

These extension DLLs parse Windows Load Balancing Server (WLBS) data from within Network Monitor, a feature of Microsoft® Windows® 2000.

This tool is useful as a way to view and troubleshoot network issues related to the WLBS Service. With it, Network Monitor users can view WLBS Heartbeats and Remote Control data when such network activity is captured.

The WLBS Network Monitor Parsers run on any version of Windows 2000 or Microsoft® Windows NT® that supports Network Monitor version 1 or 2.

WLBS Network Monitor Parsers Topic

  • Installing the WLBS Network Monitor Parsers

Files Required

  • Wlbs_hb.dll
  • Wlbs_rc.dll


Installing the WLBS Network Monitor Parsers

  1. Copy the Wlbs_hb.dll and Wlbs_rc.dll files to your Netmon\Parsers directory.
  2. Open the Mac.ini file in the Netmon\Parsers directory.
  3. In the [ETYPES] section, add the line "0xBF01 = WLBS_HB" and "0x886F = WLBS_HB", so that the section looks similar to this:
        [ETYPES]
    0x600   =   XNS
    0x800   =   IP
    0x806   =   ARP_RARP,1
    0x0bad  =   VINES_IP
    0x1984  =   TRAIL
    0x8035  =   ARP_RARP,2
    0x809B  =   LAP
    0x80D5  =   SNA
    0x80F3  =   AARP
    0x8137  =   IPX
    0x8138  =   IPX
    0x86DD  =   IP6
    0xBF01  =   WLBS_HB
    0x886F  =   WLBS_HB
  4. Open the Tcpip.ini file in the Netmon\Parsers directory.
  5. In the [UDP_HandoffSet] section, add the line "1717 = WLBS_RC" and "2504 = WLBS_RC", so that the section looks similar to this:
        [UDP_HandoffSet]
    53   = DNS
       67   = DHCP
       68   = DHCP
       111  = RPC
       161  = SNMP
       162  = SNMP
       137  = NBT, 1000
       138  = NBT, 1002
       139  = NBT, 1001
       520  = RIP
       1717 = WLBS_RC
       2049 = RPC
       2504 = WLBS_RC
  6. Open the Parser.ini file in the Netmon directory.
  7. In the [PARSERS] section, add the lines "WLBS_RC.DLL = 0: WLBS_RC" and "WLBS_RC.DLL = 0: WLBS_RC", so that the section looks similar to this:
        [PARSERS]
<Other Parsers>
        LDAP.DLL    = 0: LDAP
        TDS.DLL     = 0: TDS
        ATMARP.DLL  = 0: ATMARP
        RSVP.DLL    = 0: RSVP
        UNI31.DLL   = 0: UNI31
        RTPPARSR.DLL= 0: RTP, RTCP
        TCPIP6.DLL  = 0: IP6, ICMP6
        CLSC.DLL    = 0: CLSC
        L2TP.dll	= 0: L2TP
        WLBS_HB.DLL = 0: WLBS_HB
        WLBS_RC.DLL = 0: WLBS_RC
  8. At the bottom of the Parser.ini file, add the following information exactly as listed below:
        [WLBS_HB]
    Comment     = "WLBS Heartbeat"
    FollowSet   =
    HelpFile    =

    [WLBS_RC]
    Comment     = "WLBS Remote Control Protocol"
    FollowSet   =
    HelpFile    =
  9. Save the .ini files.


Xcacls.exe

This tool allows you to set all file-system security options accessible in Windows Explorer from the command line. XcAcls does this by displaying and modifying the access control lists (ACLs) of files.

XcAcls is especially useful in unattended installations of Microsoft® Windows® 2000 Professional or Server. With this tool, you can set the initial access rights for folders in which the operating system resides. When you distribute software to servers or workstations, XcAcls also offers one-step protection against deletion of directories or files by users.

XcAcls Topics

  • XcAcls Syntax
  • XcAcls Examples

Files Required

  • Xcacls.exe


XcAcls Syntax

One Step xcacls filename [/T] [/E] [/C] [/G user:perm;spec] [/R user] [/P user:perm;spec [...]] [/D user [...]] [/Y]

Where:

filename
indicates the name of the file or directory to which the access control list (ACL) or access control entry (ACE) should be applied. All standard wildcard characters can be used.
/T
recursively walks through the current directory and all its subdirectories, applying the chosen access rights to the matching files and/or directories.
/E
edits the ACL instead of replacing it. If you specify the following command line:

XCACLS test.dat /G Administrator:F

only the Administrator has access to TEST.DAT. All ACEs applied earlier are lost.
/C
causes XcAcls to continue if an "access denied" error occurs. If /C is not specified, XcAcls stops on this error.
/G user:perm;spec
grants access to user to the matching file or directory. The perm variable applies the specified access right to files and represents the special file-access-right mask for directories. The Perm variable accepts the following values:
R
Read
C
Change (write)
F
Full Control
P
Change Permissions (special access)
O
Take Ownership (special access)
X
EXecute (special access)
E
REad (Special access)
W
Write (Special access)
D
D Delete (Special access)

The spec variable applies only to directories, and accepts the same values as perm, with the addition of the following special value:

T
NoT Specified. Sets an ACE for the directory itself without specifying an ACE that is applied to new files created in that directory. At least one access right has to follow. Entries between ; and T will be ignored.

Notes

  • The access options for files (for directories, special file access and special directory access) are identical. For detailed explanations of these options, see the Windows 2000 operating system documentation.
  • All other options, which can also be set in Windows Explorer, are subsets of all possible combinations of the basic access rights. Therefore, there are no special options for directory access rights like LIST or READ.

/R user
revokes all access rights for the specified user.
/P user:perm;spec
replaces access rights for user. The rules for specifying perm and spec are the same as for the /G option. See XcAcls Examples.
/D user
denies access to the file or directory for user.
/Y
disables confirmation when replacing user access rights. By default, CACLS asks for confirmation. Because of this feature, when CACLS is used in a batch routine, the routine hangs until the right answer is entered. The /Y option was introduced to avoid this confirmation, so XcAcls can be used in batch mode.


XcAcls Examples

XCACLS *.* /G administrator:RW /Y

This command replaces the ACL of all files and directories found in the current directory, without scanning any subdirectories and without confirmation.

XCACLS *.* /G TestUser:RWED;RW /E

This command edits the ACL of a file or a directory, but its effect on a directory is different. The ACE added to the directory is also an inherit ACE for new files created in this directory.

In this example, the command gives TestUser read, write, run, and delete rights on all new files created in this directory, but only read and write permissions on the directory itself.

XCACLS *.* /G TestUser:R;TRW /E

This command grants read and write permissions on a directory without creating an inherit entry for new files. Therefore, in this example, new files created in this directory get no ACE for TestUser. For existing files, an ACE with read permissions is created.


Clearmem.exe: Clear Memory

Clearmem.exe: Clear Memory NEW

ClearMem is a command-line tool that forces pages out of RAM.

ClearMem attempts to allocate and commit more memory then is physically available, as well as flushing the file cache. In Windows, working sets are allowed to grow until memory pressure forces them to decline. Flushing the file cache is important because some pages in the process working set are part of the file cache (for example, code loaded from a file).

Running ClearMem twice will usually force most applications out of memory. ClearMem has to run multiple times to present a real-life memory load because the system does not immediately trim all possible pages in a process working set, but does so gradually over time. When ClearMem runs, the system pauses because of the flood of high priority activity.

note-icon

Note

Use Vadump to see the contents of the working set.

To run ClearMem, the computer's paging file must be at least as large as its RAM. If you are running Windows Server configured for "Maximize Throughput for Network Applications," you might have to run ClearMem more than twice to reduce application working sets to the minimum. Use System Monitor to check on progress.

Working Sets

The working set is a set of memory pages. It is all the physical pages "owned" by a process. Each memory page can be:
  • Shared – memory that is shared with some other process or processes. If these other processes are usually running (for example, services.exe or explorer.exe) then the effect of these pages can be ignored as removing them from the working set would not free any pages because they will still be in use.
  • Shareable – memory that could potentially be shared with another process but is not. This memory is not shared because there is no demand for its content anywhere else.
  • Private – memory which cannot be shared.

ClearMem Topics

  • ClearMem Syntax

File Required

  • Clearmem.exe


ClearMem Syntax

One Step Clearmem.exe [-q] [-d] [-m num] [-p num] [-w] [-t num] [-?]

Where:

-?
displays command-line help.
-q
quiet mode - nothing printed.
-d
debug break on entry into and exit from application.
-m num
number of megabytes to allocate. The default is to use all physical memory.
-p num
number of pages to read. The default is 63 but you can specify few pages.
-w
write to the virtual memory section.
-b
read and write the virtual memory section.
-t num
times to touch a page.

Note

ClearMem runs with the following defaults: clearmem -p63 -t1


Counters.chm: Windows 2000 Performance Counter Reference

See the Windows 2000 Resource Kit Release Notes (Readme.htm) for more information.

The Windows 2000 Performance Counter Reference describes all performance objects and counters provided for use with tools in the Performance snap-in of Windows 2000. Use this reference to learn how monitoring counter values can assist you in diagnosing problems or detecting bottlenecks in your system.

File Required

  • Counters.chm


Cpustres.exe: CPU Stress Utility

CPU Stress Utility is a GUI-based tool that consumes processor cycles by continuously running an endless loop. With this tool, you can activate up to four threads, setting individual thread priority and activity levels.

File Required

  • Cpustres.exe


Ctrlist.exe: Counter List

Ctrlist.exe: Counter List NEW

CtrList is a command-line tool that lists all objects and counters installed in the system for the given language ID.

CtrList Topics

  • CtrList Syntax

File Required

  • Ctrlist.exe


CtrList Syntax

One Step ctrlist [-c | -m | -d] [LangID] [\\machine]

Where:

-c
prints data in a CSV format.
-m
prints data as a Windows Management Instrumentation MOF.
-d
prints data as a Windows Management Instrumentation MOF with performance data instances defined.
note-icon

Note

Only one of the above command switches may be used at a time.

LangID
Language identifier.
  • 009 for English (default)
  • 007 for German
  • 00A for Spanish
  • 00C for French
\\machine
may be specified to list counters on a remote system
Example

Get all French system objects and counters and put them in the file french.lst "ctrlist 00C > french.lst"


Diskpar.exe: Disk Alignment Tool

Diskpar.exe: Disk Alignment Tool NEW

DiskPar is a command-line tool that finds and modifies the starting sector on a disk to improve disk performance. It is only used with multi-disk systems.

Windows has an internal structure called the Master Boot Record (MBR) that limits the maximum default hidden sectors to 63. For this reason, the default starting sector for disks that report more than 63 sectors/track is the 64th sector. For disks with 64 or more sectors/track this can cause misalignment when data is transferred to and from the disks. For example, with a disk that has 64 sectors/track, what appear to be track aligned transfers begin at the last sector of one track and span to the next track. The following issues further complicate this problem:

  • The track information reported by disks doesn't always reflect reality
  • Many disks have different numbers of sectors on different tracks (for example: outer vs. inner bands)
  • Basic Block Microsoft® MS-DOS® interoperability issues with Microsoft® Windows® 95 and Microsoft® Windows® 98 restrict changes to partition alignment

To get maximum disk performance on Windows for disks which have alignment optimizations and large track sizes, you can use DiskPar to obtain and set partition information. By doing so, you can significantly improve disk activity performance for some specialized controllers.

DiskPar Topics

  • DiskPar Syntax
  • DiskPar Example

File Required

  • Diskpar.exe


DiskPar Syntax

One Step diskpar [-?] [ -i | -s ] DriveNumber

Where:

-?
displays command-line help.
-i DriveNumber
queries drive layout and partition information.
-s DriveNumber
set new partition information. Use only on a raw drive. See example.
warning-icon

Caution

Setting the disk partition will erase all data on this drive.


DiskPar Examples

DiskPar Example

  • You have a disk controller that can only do lazy writes if the writes are within 4 kilobyte (KB) boundries.
  • One of the disks you are using reports it supports more than 63 sectors per track.
    note-icon

    Note

    You can discover this information by using diskpar -i or any other tool, such as DmDiag which displays starting sector information.

  • You also have an application which continuously causes 64 KB writes to disk. In this case, each write will not be within the 4 KB boundry and disk performance would be poor.

Using DiskPar, you can modify the hidden starting offset to significantly improve write performance.

  1. Start Disk Management on disk 0.
  2. Delete all partitions on disk 1 making it a raw drive.
    note-icon

    Note

    Backup any data you don't want to lose before removing partitions.

  3. From disk 0, run DiskPar to set the starting offset and create the first partition on disk 1:
    diskpar -s 1
  4. Enter the new starting offset (in sectors), and the partition length (in MB). This writes the new starting sector information to the Master Boot Record (MBR) for that disk, and creates the first partition.
  5. Using Disk Manager, create and format all other desired paritions on disk 1.


Drivers.exe: List Loaded Drivers

List Loaded Drivers displays character-based information about the installed device drivers. There are no command-line arguments.

List Loaded Drivers Syntax

One Step drivers | more

Format of List Loaded Drivers Data

ModuleName Code Data Bss Paged Init LinkDate

ModuleName
The driver's file name.
Code
The executable code in the image.
Data
The non-.bss data in the image.
Bss
The .bss section from the image. This is data that is initialized to 0.
Paged
The size of the data that is paged.
Init
The size of the file on disk.
LinkDate
The date that the driver was linked.

File Required

  • Drivers.exe


Empty.exe: Empty Working Set

Empty.exe: Empty Working Set NEW

Empty is a command-line tool that frees the working set of a specified task or process.

A working set is a subset of virtual pages resident in physical memory. Empty frees the working set of a process, making those page frames available for use by other processes.

Empty Topics

  • Empty Syntax

File Required

  • Empty.exe


Empty Syntax

Where:

One Step empty {PID | progname }

Where:

PID
is a currently-running process ID. Use Tlist.exe to list process IDs. This tool is a Microsoft® Windows® 2000 Support Tool included on the \support directory of the Windows 2000 operating system CD-ROM.
progname
is the name of a currently-running program


Exctrlst.exe: Extensible Performance Counter List

This tool provides information on the performance counter DLLs that have been installed on a computer running Microsoft® Windows® 2000, listing the services and applications that provide performance information via the Windows 2000 registry. When monitored using the Performance console provided in Windows 2000, the data provided by these performance counters can be useful for optimizing and troubleshooting.

Files Required

  • Exctrlst.cnt
  • Exctrlst.exe
  • Exctrlst.hlp


Leakyapp.exe: LeakyApp

This GUI tool appropriates system memory to test how other applications or the system as a whole runs in low-memory situations.

LeakyApp allocates all available memory to its own process and retains the memory until it is stopped or reset. When the tool stops, the memory it has allocated is released.

LeakyApp shows how the system responds to a process that is allocating a disproportionate share of memory. This demonstration can help administrators identify other applications that use a disproportionate share of memory.

The My Leaky App dialog box displays a status bar representing current space used and space remaining in the paging files on the hard disks of the local computer. If the computer has more than one paging file, the status bar represents the total space in all paging files.

You can observe the effects of memory allocation by watching the LeakyApp paging-file status bar, or by using Task Manager or System Monitor, which are included with Windows 2000.

Note

LeakyApp makes your system run poorly because it restricts memory for all other processes. Run LeakyApp only for purposes of testing or experimentation.

LeakyApp Topics

  • Using LeakyApp

File Required

  • Leakyapp.exe


Using LeakyApp

The LeakyApp status bar

When you run LeakyApp, the My Leaky App dialog box displays a status bar representing current space used and space remaining in the paging files on the hard disks of the local computer. If the computer has more than one paging file, the status bar represents the total space in all paging files.

To activate LeakyApp's memory allocation

One Step In the My Leaky App dialog box, click Start Leaking.

You can observe the effects of memory allocation by watching the LeakyApp paging-file status bar, or by using Task Manager or System Monitor, which are included with Windows 2000. To observe LeakyApp's performance in System Monitor, chart or log the following counters:

  • Process: Private Bytes: leakyapp
  • Process: Working Set: (for all processes except Idle and _Total)
  • Memory: Available Bytes
  • Memory: Cache Bytes

To halt further memory allocation

One Step In the My Leaky App dialog box, click Stop Leaking.

LeakyApp retains the memory it has allocated but does not allocate more memory.

To release the memory LeakyApp has allocated

One Step In the My Leaky App dialog box, click Reset.

To quit Leaky App

One Step In the My Leaky App dialog box, click Exit.

As it closes, LeakyApp releases all memory it has allocated while running.


Ntimer.exe: Program Timer

Ntimer.exe: Program Timer NEW

Ntimer is a command-line tool that measures how long a program runs.

It shows Elapsed Time (ETime), time in User Mode (UTime) and time in Privileged Mode (KTime). These are expressed in hours:minutes:seconds.milliseconds. Time is actually accurate only to the resolution of the timer, which is 10 milliseconds on the x86 architecture.

Ntimer Topics

  • Ntimer Syntax
  • Ntimer Examples

File Required

  • Ntimer.exe


Ntimer Syntax

One Step ntimer [-1 -f -s] imageName [parameters]...

Where:

-1
displays output on one line.
-f
displays the process page faults, total system interrupts, context switches and system calls.
-s
indicates the name of the image is a server process. Press CTRL+C to get the times.
imageName
parameters


Ntimer Examples

  • If you want to measure an application to get some understanding of how it is operating, the following will start the application you want to time, then when the application ends, it prints basic run statistics of elapsed, user, and kernel time in the application process.

    ntimer application


Perfmon4.exe: Performance Monitor 4

Perfmon4.exe: Performance Monitor 4 NEW

Performance Monitor 4 is a graphical tool for measuring the performance of your own computer or other computers on a network. On each computer, you can view the behavior of objects, such as processors, memory, cache, threads, and processes. Each of these objects has an associated set of counters that provide information about device usage, queue lengths, delays, and information used to measure throughput and internal congestion.

It provides charting, alerting, and reporting capabilities that reflect both current activity and ongoing logging. You can open, browse, and chart log files later as if they reflected current activity.

Note

An earlier version of Performance Monitor 4 was included with Microsoft® Windows NT® version 4.0 as an administrative tool. On Microsoft® Windows® 2000, Performance Monitor has been replaced by System Monitor.

Files Required

  • Perfmon4.exe
  • Perfmon4.hlp
  • Perfmon4.cnt


Perfmtr.exe: Performance Meter

This command-line tool displays text-based information on the performance of a computer running Windows 2000.

Performance Meter can show:

  • CPU usage
  • file cache usage
  • header
  • I/O usage
  • POOL usage
  • Cache Manager reads and writes
  • server statistics
  • virtual memory usage
  • x86-based processor Virtual DOS Machine (VDM) usage

To use PerfMtr

At the command prompt, type:
perfmtr

PerfMtr begins by displaying CPU usage. Use the following keystrokes to change the type of performance information displayed:

Key | Displays
c | CPU usage
v | Virtual memory usage
f | File Cache usage
r | Cache Manager read and write operations
p | Pool usage
i | I/O usage
x | x86-based processor VDM stats
s | Server stats

The information is periodically updated, and will scroll off the screen.
Type h to repeat the header for the current information type.
Type q to quit.

File Required

  • Perfmtr.exe


Pfmon.exe: Page Fault Monitor

This tool enables you to monitor the page faults that occur as you run an application. Page Fault Monitor produces a running list of hard and soft page faults generated by each function call by the application.

The best indicator of a memory bottleneck is a sustained high rate of hard page faults; over five per second.

You can use this tool to trace the source and number of page faults in a process. Page Fault Monitor can display the data, write it to a log file, or both.

You must run Page Fault Monitor from the command prompt.

Page Fault Monitor Topic

  • Page Fault Monitor Syntax

Files Required

  • Pfmon.exe
  • Psapi.dll


Page Fault Monitor Syntax

One Step pfmon [-n] [-l] [-c] [-h] [-p pid] [-d] [-k] [-K] application-command-line [-?]

Where:

-n
does not display running faults, just logs to Pfmon.log.
-l
logs faults to Pfmon.log.
-c
shows only code faults.
-h
shows only hard faults.
-p pid
attaches to existing process ID (pid).
-d
outputs the following tab-delimited information:
  • page fault number
  • page fault type - hard or soft
  • program counter's module
  • symbol for program counter
  • decimal value of program counter
  • decimal value of program counter of the virtual address (VA) accessed
  • symbol for virtual address (VA)
  • value of virtual address (VA)

-k
shows kernel-mode page faults and user-mode page faults.
-K
shows kernel-mode page faults instead of user-mode page faults.
application-command-line
the command line of the application to monitor. Do not specify AppCommandLine if you are using -p pid.
When you terminate the application specified by AppCommandLine, Page Fault Monitor prints a summary of the faults that occurred while executing the application. For example, execute the following command:
pfmon wperf

The summary printed when you terminate WPERF will look something like this:

wperf.dbg Caused     44 faults had     5 Soft   24 Hard faulted VA's
ntdll.dbg Caused     99 faults had    63 Soft    4 Hard faulted VA's
kernel32.dbg Caused  46 faults had    29 Soft    4 Hard faulted VA's
gdi32.dbg Caused     17 faults had     9 Soft    3 Hard faulted VA's
user32.dbg Caused    29 faults had    21 Soft    6 Hard faulted VA's
advapi32.dbg Caused   7 faults had     2 Soft    8 Hard faulted VA's
rpcrt4.dbg Caused     4 faults had     1 Soft    3 Hard faulted VA's

Total Faults 246 (KM 135 UM 246 Soft 164, Hard 82, Code 123, Data 123)

-?
displays a usage screen.


Pstat.exe: Process and Thread Status

PStat is a character-based tool that lists all running processes and threads and displays their status. This tool is similar to Qslice.exe, but uses a command-line rather than a GUI interface.

The current version of PStat takes a system snapshot and shows old PStat-style and Pmon.exe (a Support Tool on the Windows 2000 CD) data, along with Drivers.exe output, in a single output stream. This output can be useful for troubleshooting.

Pstat has no command-line switches. To use it, simply run pstat from the command prompt.

File Required

  • Pstat.exe


Qslice.exe: CPU Usage by Processes

Quick Slice shows the percentage of total CPU usage for each process in the system. This tool is similar to Pstat.exe, but it presents the information in a graphical format.

Using Quick Slice

The QuickSlice window displays the following for all monitored processes:
Item | Description
PID (Process ID) | The process ID number in hexadecimal format.
Image Name | Identifies the executable file name or process associated with a particular item.
% Process CPU Usage Identifies the percentage of total CPU usage associated with a particular process.
  • Red bar = Kernel time
  • Blue bar = user time
  • For the main window, the length of the bar represents (CPU usage for a single process) / (CPU usage for all processes currently running in the system) * 100.
  • For the image-specific window, the length of the bar represents (CPU usage for an individual thread) / (CPU usage for all the threads in this process) * 100.

Double-clicking an image name in the Quick Slice window displays details about the threads of that process. This window shows the paged pool, nonpaged pool and thread ID (TID) for the image.

Specifying the Sampling Interval for Quick Slice

You can specify the sampling interval for Quick Slice at the command prompt. The default is 500 milliseconds.

At the command prompt, type

One Step start qslice -t nnn

Where:

-t nnn

Specifies the display interval in milliseconds. (The default is 500 milliseconds.)

File Required

  • Qslice.exe


SendFile Test Suite

SendFile Test Suite NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

The SendFile Test Suite consists of a collection of applications that demonstrate the relative performance of four Web hosting methods on a Web server. The four hosting methods are:

  • Internet Server Application Program Interface (ISAPI)
  • Active Server Pages (ASP)
  • Common Gateway Interface (CGI)
  • static content (simple HTML)

This comparison allows a Web administrator to test each hosting method (using a Web stress testing tool) in order to find the one that is best suited for the hardware, configuration, and content of the target Web site.

SendFile Topics

  • Installing the SendFile Test Suite
  • Testing the SendFile Applications

Files Required

  • file8K.txt
  • sendfile.asp
  • sendfile.exe
  • sendfile.dll


SendFile Syntax

Installing the SendFile applications on the Web server

To set up your Web server to run the SendFile applications, you will need to perform the following tasks.

To install the SendFile Test Suite applications on the Web Server

  1. Use the IIS Virtual Directory Creation Wizard to create two virtual directories, SendFile_InProcess and SendFile_OutOfProcess, on your IIS server. The two virtual directories can point to the same physical directory (for example, C:\SendFile). Both virtual directories must be given the Read, Run Scripts, and Execute access permissions.
  2. After the virtual directories have been created, open the Properties dialog for each directory and change the Application Protection setting. SendFile_InProcess must run as "Low (IIS Process)". SendFile_OutOfProcess must run as either "Medium (Pooled)" or "High (Isolated)".
  3. From the <cdroot>\Apps\Sendfile directory of the Windows 2000 Resource Kit companion CD, copy file8K.txt, sendfile.asp, sendfile.exe, and sendfile.dll to the physical directory C:\SendFile. The data file, file8k.txt, can be installed anywhere on the server, but for convenience, copy it in the same directory as the applications.
  4. Use your favorite browser to check that you can run the SendFile programs. Type in each of the following URLs
    Static
    http://server/SendFile_InProcess/file8K.txt
    http://server/SendFile_OutOfProcess/file8K.txt
    ASP
    http://server/SendFile_InProcess/sendfile.asp?/SendFile_InProcess/file8K.txt
    http://server/SendFile_OutOfProcess/sendfile.asp?/SendFile_OutOfProcess/file8K.txt
    ISAPI
    http://server/SendFile_InProcess/sendfile.dll?/SendFile_InProcess/file8K.txt
    http://server/SendFile_OutOfProcess/sendfile.dll?/SendFile_OutOfProcess/file8K.txt
    CGI
    http://server/SendFile_InProcess/sendfile.exe/SendFile_InProcess/file8K.txt
    http://server/SendFile_OutOfProcess/sendfile.exe/SendFile_OutOfProcess/file8K.txt

    Note

    There is no ? in the CGI's URLs. For an explanation of this, see the source of sendfile.exe.


SendFile Syntax

Testing the SendFile Applications

You can test the SendFile applications with Web server performance and stress tools such as the Microsoft Web Stress Tool or WCAT, both of which are included in the Windows 2000 Resource Kit. You can also use third-party tools.

You'll need a 100 megabits per second (Mbps) network, or better, to measure all but the slowest applications. A traditional 10 Mbps Ethernet can deliver approximately 1 megabyte (MB) per second. With the 8 kilobyte (KB) data file, file8k.txt, that's only 120 files per second. If you use a very small data file instead (less than 100 bytes) you might be able to obtain valid results on a 10 Mbps network, since there is a certain amount of per-file overhead and the cumulative overhead might be enough to prevent the network being swamped. Using a very small file size will highlight the differences in the ASP/ISAPI/CGI/static frameworks, perhaps unfairly. Conversely, using a huge file size would minimize the differences between the frameworks, and instead measure the capacity of the underlying network. Using an 8 KB file, which is a "typical" file size, avoids these extremes.

You'll also need several client computers to run Homer or WCAT, since a single client computer will not be able to generate enough load to push your server to its maximum throughput.

The test network should be disconnected from the rest of your network. The high volume of network traffic generated by the tests will interfere greatly with other users, and traffic from the other users will muddy the results. Ideally, the clients and the server should be connected by a network switch, not a hub. A hub will experience congestion.

If you have a fast server, a single 100 Mbps network segment may not be enough. A fast server will be able to swamp the 100 Mbps network. You can add additional network segments, if this is the case. The server must have a network card for each segment that it is connected to. The Homer/WCAT test controller must also be directly connected to each segment. The client computers should be connected to one segment only.

When you have the network, the clients, the controller, and the server all set up correctly, you can proceed to test the Sendfile applications. Use Homer or WCAT to create a test for each of the URLs listed above. Refer to the tools' documentation for details on setting up and running tests.

Multiprocessor Systems

If you have a multiprocessor server, you may want to see how it performs when some of the processors are disabled. You can do this by using Notepad to edit c:\boot.ini, which will look something like this:

[boot loader]
    timeout=30
    default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Server" /fastdetect
    ; perhaps other, similar lines to boot different operating systems

Copy the line under [operating systems] that corresponds to the default entry under [boot loader] and append /numproc=N, where N is the number of processors you want to use. Be sure to add an explanatory note to the menu string. For example:

    [boot loader]
    timeout=30
    default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Server" /fastdetect
    multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Server (2P)" /fastdetect /numproc=2
    ; perhaps other, similar lines to boot different operating systems

Caution

Take a backup of your boot.ini before making any modifications. Windows 2000 will not start without a valid boot.ini.

Note that uniprocessor systems use a different kernel than multiprocessor systems. Using /numproc=1 on a multiprocessor system will give you lower results than using the uniprocessor kernel. For information about installing a uniprocessor kernel on a multiprocessor system, search the Internet Microsoft Knowledge Base.


Setedit.exe: PerfMon Chart Setting Editor

Setedit.exe: PerfMon Chart Setting Editor NEW

PerfMon Chart Setting Editor is a GUI-based tool that edits System Monitor chart settings files.

SetEdit looks just like System Monitor, but when you edit a legend line it permits you to type in instance names.

SetEdit is particularly useful for locating instances within System Monitor log files. Since you cannot select instances until they are active at the start of the time window, system-crashing instances can be hard to find. You can use SetEdit to enter the case-sensitive name of the instance into a settings file.

When System Monitor opens the settings file, it can then locate the instance automatically. Click File, and then Save Chart Settings As... to save your changes to settings files.

SetEdit Syntax

SetEdit can also run from the command prompt.

One Step setedit [setfile.pmc]

Where:

setfile.pmc
is the case-sensitive filename of a settings file.

File Required

  • Setedit.exe


Showperf.exe: Performance Data Block Dump Utility

Showperf.exe: Performance Data Block Dump Utility NEW

Performance Data Block Dump Utility is a tool with a graphical user interface (GUI) that dumps the contents of the Performance Data block so you can view and debug the raw data structure.

Note

For formatted output, see Performance Monitor 4.

ShowPerf can be used to display counters which do not show up in System Monitor. It can also be used to verify that all performance DLL's are returning the correct data.

Item | Description
Computer | Enter the name of the computer to view. The default is your local computer.
Show "Costly" Objects | Display costly objects. These objects report technical data about kernel objects, but require a comparatively high amount of overhead. "Costly" counters are usually either memory or processor intensive, and are not displayed in System Monitor. After selecting this check box, click the Refresh button to display this set of objects. See the Performance Counters Reference included in this Resource Kit for a description of individual counters for a specific object.
Object | Selecting the object type controls which instance options and performance counters are displayed.
Instance | An instance is used to distinguish between multiple performance objects of the same type on a computer. Many objects have a _Total instance which represents the sum of values for all instances of the object for the selected counter.
Counter Index | Index number used to look up the name string of the counter stored in the registry.
Counter Name | Name of the counter. See the Peformance Counters Reference included in this Resource Kit for a description of individual counters for a specific object.
Counter Type | The counter type determines how the counter data is calculated, averaged, and displayed.
Counter Data | Actual raw value of the counter returned by the registry.

Using ShowPerf to troubleshoot a bad performance counter

  • Run ExCtrlLst.
  • For each service listed in the list box, except those starting with "Perf" (such as PerfProc, PerfNet, PerfCtrs), clear the Performance Counters Enabled check box at the bottom of the dialog box.
  • Run ShowPerf.
  • You should see a list of objects and counters in the ShowPerf display.
  • Start enabling services in ExCtrlLst, one at a time.
  • Click the refresh button on ShowPerf after each one. After each refresh of ShowPerf, verify that the list of objects and counters is still valid.
  • Do this until you get an error.
  • If so, disable the last service to see if the error goes away. If it does, then leave that service's performance counters disabled until the DLL for that service is fixed.

File Required

  • Showperf.exe


Top.exe: Time-Ordered Processes

Top.exe: Time-Ordered Processes NEW

Time-Ordered Processes (TOP) is a performance monitor that lists processes according to their CPU usage. It lists information for each process that received a time slice during an interval.

Top is useful in discovering which processes are using the most processor time. It displays a continuously updated table of all processes running on the system in descending order of their percentage of processor time.

Using Top

To exit Top after it is running, press the Q key on your keyboard.

File Required

  • Top.exe


Totlproc.exe: Total Processors

Totlproc.exe: Total Processors NEW

TotlProc is a performance counter that measures the memory usage of all installed processors. TotlProc measures processor time on applications launched by the system interrupt.

Installing TotlProc

To install TotlProc, run the following from a command prompt:

Important

Do not use the Run window on the Start menu to install TotlProc.

regedit tp.reg
lodctr perftp.ini
copy perftp.dll %systemroot%\System32\perftp.dll

To verify that the counter was installed correctly, start ExCtrLst. TotalProcessor should appear in the list of extensible counters.

Selecting TotlProc

To select TotlProc:

  1. Start System Monitor.
  2. In the Edit menu, select Add to Chart. In the Add to Chart dialog, select: Total Processor: % Total Processor Time
  3. Select Total Processor in the Object box, click the % Total Processor Time counter, then click the Add button.

Running TotlProc

You can run TotlProc.exe from a command prompt, from the Run window on the Start menu, or create a shortcut to it, then double-click the shortcut.

The processor time value will appear in the TotlProc window in decimal form and in System Monitor in chart, report, alert, or log view. You can minimize TotlProc.exe, but if you stop it, the Total Processor counter in System Monitor will display a value of 0%.

Note

TotlProc is not compatible with other processor time counters. While TotlProc is running, System Monitor and Task Manager processor time counters will always read 100%.

TotlProc Topics

  • TotlProc Syntax

Files Required

  • Perftp.dll
  • Perftp.h
  • Perftp.ini
  • Totlproc.exe
  • Tp.reg


TotlProc Syntax

Syntax is not available. Use the command-line help available from the tool itself.


Typeperf.exe: Performance Data in the Command Window

This command-line tool displays real-time data from System Monitor counters in a command window. You specify the counters and the update interval in a command-line string; TypePerf returns the values of the requested counters at the specified intervals and displays them in the command prompt window until you stop it by pressing any key.

TypePerf's performance data come from internal hardware and software counters, just as the data from System Monitor. TypePerf can display the data for any System Monitor counter that is installed on the computer being monitored. The data is written in comma-separated, variable length strings, so you can redirect it to a .txt or .csv file and use a text editor or spreadsheet program to view and format it.

Initially, you might need to use System Monitor to determine the correct names of query elements, but once a valid query is assembled, you can use it repeatedly or add it to logon scripts and other programs.

TypePerf Topics

  • TypePerf Queries
  • TypePerf Examples
  • TypePerf Output

Files Required

  • Pdh.dll
    • On Windows NT version 4.0 and earlier versions, Pdh.dll must be located in the same folder as Typeperf.exe. On Windows 2000, the newer version of Pdh.dll that ships with the operating system works with TypePerf.
  • Typeperf.exe


TypePerf Queries

You must run TypePerf queries in a command prompt window from the directory where the tool is installed.

TypePerf queries consist of the word typeperf, an update interval, and the path to one or more System Monitor counters on the computer. The update interval tells TypePerf how often to retrieve and display the counter data. The counter paths uniquely identify a System Monitor counter. When you use System Monitor, you specify the counter path by selecting a performance object and counter name and, if applicable, the parent object and instance, from the Add to Chart dialog box. When you use TypePerf, you must enter the same data in a string.

Type your query using the following format:

One Step typeperf update-interval "counter-path-1" ["counter-path-2"]

Where each counter path consists of the following elements:

One Step "[\\computer]\performance-object[([parent-object/]instance)]\counter"

The format of a complete query for one counter appears as follows:

One Step typeperf update-interval "[\\computer]\performance-object[([parent-object/]instance)]\counter"

The performance object and counter name are required for all counters. Other elements, such as the name of a parent object and instance, are required only when the counter displays data about a specific instance of an object, such as a counter that monitors one particular thread in a process.

The quotation marks and the backslash preceding the performance object are required even when optional elements are not present. The names of computers, objects, instances and counters must be entered exactly as they appear in System Monitor, including any special characters or spaces in the name.

Tips

  • To find the elements that comprise the path to any System Monitor counter, such as the name of the performance object or instance, use System Monitor. Start System Monitor and click the + button. The Add to Chart window displays the counters installed on the computer and their attributes. For information about a counter, click Explain.
  • To redirect the TypePerf output to a text or .csv file, append the DOS redirection character ">" and file name to your query. (See Example 6.) If the file you specify doesn't exist, TypePerf creates it for you. If the file already exists, TypePerf deletes the previous contents of the file and writes the new data to it.
  • To display more than one counter, enclose each counter path in quotation marks and separate each counter path from the others with a space. A query can include data from more than one computer, but it can have only one update interval that applies to all counters in the query. (See Example 5.)
  • If you forget the query format, at the command prompt, type typeperf.

Query Elements

The following table describes the query elements in more detail:

update-interval | The elapsed time in seconds between updates of performance data. This value also determines how often TypePerf writes data to the command prompt window. An update interval is required in all TypePerf queries. Each query has one update interval which applies to all counters in the query.
computer | The name of the computer being monitored. This field is required only if you are monitoring a remote computer.
performance-object | The component being monitored, such as Processor, Process, or Physical Disk. In the System Monitor Add to Chart dialog box, performance objects appear in the Object box. This field is required in all TypePerf queries.
parent-object | The higher-level performance object of which the object being monitored is a logical part. For example, if the performance object is a thread, the parent object is the process in which the thread runs. This field is required only when the performance object is a child of another object. In the System Monitor Add to Chart dialog box, parent objects appear in the Instance box on the left side of the ==> arrow.
instance | Specifies more precisely the object being monitored. The instance is required for all objects that can appear more than once on the same computer, such as processors or disks. (You must specify an instance for all objects that can have instances, even if your computer only has one item of the object type.) To display data for all instances of an object, enter _Total in the Instance field. In the System Monitor Add to Chart dialog box, instances appear in the Instance box. When the performance object has a parent object, the instance appears on the right side of the ==> arrow in the Instance box.
counter | Specifies the System Monitor counter you want to display. The counter determines what information is collected about the object. This field is required in all TypePerf queries. In the System Monitor Add to Chart dialog box, the counters for each object appear in the Counter box.


TypePerf Examples

The following examples show how to format TypePerf queries based on information from the Add to Chart dialog box in System Monitor.

Example 1. Single counter: Available memory on the local computer

The simplest query has the form:

One Step typeperf update-interval "\performance-object\counter"

The following query directs TypePerf to display the Memory: Available Bytes counter on the local computer every 30 seconds.

typeperf 30 "\Memory\Available bytes"

This query is based on the Available Bytes counter shown in the System Monitor Add to Chart dialog box.

Example 2. Instances: Processor time on the local computer

If the counter you are monitoring belongs to an instance of the performance object, specify the instance in parentheses, as shown in the following query format:

One Step typeperf update-interval "\performance-object(instance)\counter"

The following query directs TypePerf to display the Processor: % Processor Time counter on the local computer every three seconds. Please note that even though this computer has only one processor, you must include the instance number (0) in the query because the Processor performance object can have instances.

typeperf 3 "\Processor(0)\% processor time"

This query is based upon the % Processor Time counter shown in the System Monitor Add to Chart dialog box.

Example 3. Parent objects: Disk time on a logical disk

If the instance is an instance of a parent object, specify the parent object before the instance, preceded by a forward slash, as shown in the following query format:

One Step typeperf update-interval "\performance-object(parent-object/instance)\counter"

The following query directs TypePerf to display the LogicalDisk: % Disk Time counter for the E: logical drive. The E: drive is on the computer's second physical disk, designated disk 1. Because the logical disk is a child of the physical disk, you must specify the parent object, the child object, and the instance in the counter path.

typeperf 10 "\LogicalDisk(1/E:)\% Disk Time"

This query is based upon the % Disk Time counter shown in the System Monitor Add to Chart dialog box.

Example 4. Another computer: Thread count on a remote computer

To monitor a counter on another computer, specify the computer name before the instance, preceded by two backslashes, as shown in the following query format:

One Step typeperf update-interval "\\computer\performance-object(instance)\counter"

The following query directs TypePerf to display the Process: Thread Count counter for the Windows Explorer process on another computer every 10 seconds.

typeperf 10 "\\Compu12\Process(Explorer)\Thread Count"

This query is based upon the Thread Count counter shown in the System Monitor Add to Chart dialog box.

Example 5. Multiple counters: Disk time and read aheads on the local computer

This compound query has the following format:

One Step typeperf update-interval "\object(instance)\counter" "\object\counter"

The following compound query directs TypePerf to display the PhysicalDisk: % Disk Time and Cache: Read Ahead counters every five seconds.

typeperf 5 "\PhysicalDisk(1)\% Disk Time" "\Cache\Read Aheads/sec"

Note

Each counter path is enclosed in quotation marks and the two counter paths are separated from each other by a space.

This compound query is based on the % Disk Time and Read Ahead/sec counters shown in the System Monitor Add to Chart dialog box.

Example 6. Creating a spreadsheet file

You can direct TypePerf to write the response to your query to a text file (.txt) or to a comma-separated, variable-length format file (.csv). You can then view the TypePerf response in a text editor or spreadsheet program.

Note

Don't forget to press a key to stop TypePerf. This data can accumulate quickly.

To direct TypePerf output to a file, append the DOS redirection character ">" and the file name to your TypePerf query. If the file you specify doesn't exist, TypePerf creates it for you. If the file already exists, TypePerf deletes the previous contents of the file and writes the new data to it.

This query has the following format:

One Step typeperf update-interval "counter-path" > filename

The following query directs TypePerf to write its response to a simple query to the Typeperf.csv file:

typeperf 1 "\Processor(0)\% Processor Time" > typeperf.csv

After TypePerf stops, you can view the resulting file in a text editor or spreadsheet program.


TypePerf Output

In response to a valid query, TypePerf writes data to the command prompt window in a table comprised of rows of comma-separated, variable-length strings in the following format:

"Date and time of update", "Counter (1) data",  "Counter (2) data",  ...

Each row of the table represents a data sample taken as close as possible to the requested interval. The following example shows the first few rows of TypePerf's response to a query:

Query

typeperf 1 "\Processor(0)\% Processor Time" "\Memory\Page faults/sec"

Response

"Sample Time","\Processor(0)\% processor time","\Memory\Page faults/sec"
"02/26/1998 10:05:33.970","0.50922227797290942","5.0174216320911258"
"02/26/1998 10:05:34.971","2.9961254244058266","3.9942622621550328"
"02/26/1998 10:05:35.972","1.0059311033449814","0"
"02/26/1998 10:05:36.974","1.0059311033449814","0"
"02/26/1998 10:05:37.975","0.99604553624924597","0"

You can view the data in the command prompt window or redirect it to a .txt or .csv file for later viewing and processing in a text editor or spreadsheet program.


Vadump.exe: Virtual Address Dump

Vadump.exe: Virtual Address Dump NEW

VaDump is a command-line tool that shows the state and size of each segment of virtual address space.

This tool can be used to make sure virtual address space is not over-allocated.

Note

You can use Tlist or Pviewer to find the process ID.

VaDump creates a listing that contains information about the memory usage of a specified process.

The list produced by VaDump includes the following:

  • Each address, along with its size, state, protection, and type.
  • Total committed memory for the image.
  • Total committed memory for the .exe file.
  • Total committed memory for each .dll file, including system .dll files.
  • Total mapped committed memory.
  • Total private committed memory.
  • Total reserved memory.
  • Information about the working set.
  • Information about paged and nonpaged pool usage.

VaDump Topics

  • VaDump Syntax
  • VaDump Examples
  • Using VaDump to Look Inside Your Working Set

File Required

  • Vadump.exe


VaDump Syntax

One Step Vadump.exe [options] -p decimal_process_id

Where:

-help
displays command-line help.
-c
includes code faults faulting computer summary.
-m
shows all code symbols on page.
-o
workingset snapshot with summary.
-r
print information on individual faults.
-s
summary information only.
-t
include pagetable info in summary.
-w
track new working set additions.
-v
verbose output.
-l logfile
name of logfile.
-p decimal_process_id


VaDump Examples

  • Dump the address space:

    vadump [-sv] -p decimal_process_id

  • Dump the current workingset:

    vadump -o [-mpsv] [-l logfile] -p decimal_process_id

  • Dump new additions to the workingset (Stop with ^C):

    vadump -w [-crv] [-l logfile] -p decimal_process_id


Using VaDump to Look Inside Your Working Set

You may want to get a better understanding of the pieces inside the working set of your application. For example, you might save a lot of code space with the Working Set Tuner only to discover that the code space is only a small portion of your overall working set. In fact, this might even be something you want to do before you go to all the trouble to tune your code.

You probably want to make these measurements on a test computer. Choose a computer large enough to hold your entire working set tuning test scenario in memory. You might need to discover this size through the trial and error process described in this section.

To do this, you can use Virtual Address Dump (VaDump). VaDump looks inside the working set of a process and determines the nature of each page.

Note

Link your application using the -debug and -debugtype:coff options, so you get full use from VaDump.

  1. Create a test scenario for tuning the working set your application.
  2. Start your application.
  3. Start Tlist. VaDump expects the process identifier (PID) of the application to be in decimal. Tlist lists PIDs in decimal form.
  4. Start System Monitor and leave it running. Open a command window so you can run VaDump.
  5. Type the following in the command window, but don't press ENTER yet.
    vadump -o -m -p pid > app.vad

    6. The -o option tells VaDump to monitor the working set in the original style, the -m option tells VaDump to use the mapped symbols, and the -p option indicates the process identifier (pid), in decimal, of the process to measure. In the example command line, the output is directed to the file App.vad. Again, do not press ENTER yet.

  6. Flush everything from memory and the disk cache. Running the Clearmem tool a few times generally completes the flush. However, to make sure everything flushes, you may want to watch your working set with System Monitor.
  7. Switch to your application and run the test scenario you devised for tuning the working set.
  8. Switch to the VaDump window and press the ENTER key to run the VaDump command created earlier.

    9. The output from VaDump shows the nature of each page in the working set of your process:

    0x00010000 PRIVATE Base 0x00010000
0x00020000 PRIVATE Base 0x00020000
0x0012d000 PRIVATE Base 0x00030000
0x0012e000 PRIVATE Base 0x00030000
0x0012f000 PRIVATE Base 0x00030000
0x00130000 PRIVATE Base 0x00130000
0x00140000 PRIVATE Base 0x00140000
0x00141000 Process Heap
0x00142000 Process Heap
0x00143000 Process Heap
0x00240000 PAGEFILE_MAPPED Base 0x00240000
0x00250000 DATAFILE_MAPPED Base 0x00250000 unicode.nls
0x00251000 DATAFILE_MAPPED Base 0x00250000 unicode.nls
0x00253000 DATAFILE_MAPPED Base 0x00250000 unicode.nls
0x00260000 DATAFILE_MAPPED Base 0x00260000 locale.nls
0x00263000 DATAFILE_MAPPED Base 0x00260000 locale.nls
0x00270000 DATAFILE_MAPPED Base 0x00270000 sortkey.nls
0x002c0000 DATAFILE_MAPPED Base 0x002c0000 sorttbls.nls
0x002d0000 PRIVATE Base 0x002d0000
0x002e0000 PAGEFILE_MAPPED Base 0x002e0000
0x002f0000 PRIVATE Base 0x002f0000
0x01000000 menappl.exe
        (1000) _except_list
0x01001000 menappl.exe
        ( 165) LogDisplayDlgProc@16
        (  24) GetSystemPerfData@16
        ( 1a0) UpdateSystemData@8
        (  1c) MemorySize@4
        (  29) GetObjectDefByTitleIndex@8
        (  14) LogCollecting@4
        ( 113) DrawAlerts@8
        (  d2) DrawLog@8
        (  4c) SmallFileSizeString@8

    The page virtual addresses appear on the left. For each section of address space, the base is shown on the right. PRIVATE pages are dynamic data pages that are private to the process. Process Heap pages are dynamically allocated from the process heap. It can be difficult to determine who is using this space, and you might need to look at pointers within your application using the debugger.

    The system pages are those allocated for the page tables and for the working set packing list itself. This might be larger than your application actually needs, because VaDump needs to scan them. So use System Monitor as described to determine the difference. For this example, when we looked at the working set of System Monitor while charting, running VaDump added five pages to the working set.

    If COFF symbols are included and the module was linked with the -debug flag, other pages that belong to specific modules are indicated by listing which public symbols occur within the page. This helps you to understand why a particular page has been brought into memory. If the module was compiled without the correct flags, you will see only the module name.

    Any pages listed as belonging to the module "Error" are pages that did not resolve to a particular module.

    You will also find some DATA pages at the upper end of the application's address space. These are for such system-related items as the Process Environment Block, the Thread Environment Blocks, the Per-Thread Data Area, and so on.

    Pages in the range starting at 0xC0000000 are page table pages. They are listed showing the range of pages they map, how many of those are in memory (these are called resident pages), and the range of resident pages and their modules.

    Finally, there is a summary of pages and who owns them. These pages summarize the pages already listed, so avoid counting them again.

  9. Take a look at System Monitor again and get the new size for your application's working set. This is likely to be larger than before, because VaDump itself must bring some pages into the working set to scan all the page tables and working set entries for your application.
  10. Run the scenario in your application again. System Monitor should get no page faults in your application during this run. If it does, you may not have enough memory on the system to hold your application's working set.


Wperf.exe: Perf Monitor

Wperf.exe: Perf Monitor NEW

Perf Monitor is a GUI-based tool that monitors performance and presents data in a different way than System Monitor.

Using Perf Monitor

  1. Click a corner of the window when it appears, and enlarge the window.
  2. Double-click on the window to display the Select menu. Select the counters whose information you want to display. The following can be monitored by CPU in either line or bar graph form:
    • Page Faults/Sec.
    • Context Switch/Sec.
    • 1st Level TB Fills/Sec. (RISC-specific. See below.)
    • 2nd Level TB Fills/Sec. (RISC-specific. See below.)
    • System Calls/Sec.
    • Interrupts/Sec.
    • Paged Pool
    • Non Paged Pool
    • Process Count
    • Thread Count
    • Align Fixup Count
    • Exception Dispatch Count
    • Float Emulation Count
    • Inst Emulation Count

Counters 1st Level TB Fills/Sec and 2nd Level TB Fills/Sec are not available through System Monitor, because they are supported only by some RISC-based computers. The TB is the page translation buffer in the processor, which is used to translate virtual addresses to physical addresses. On some RISC-based computers, resolving TB misses is a software operation, so a large number of these reduces system performance.

File Required

  • Wperf.exe


Activeperl.exe: ActiveState ActivePerl

Activeperl.exe: Active Perl NEW

Perl is a flexible scripting language widely used for system administration on both UNIX and Windows platforms, as well as programming on the World Wide Web. ActivePerl is a Windows implementation of Perl which also enables you to work with the registry and event logs, and can act as an OLE automation controller.

ActivePerl also includes:

  • Perl: Binary of core Perl distribution.
  • Perl for ISAPI: Plug-in for running Perl CGI's and scripts faster on ISAPI compliant Web servers such as IIS.
  • PerlScript: Microsoft® ActiveX® scripting engine, like JavaScript or VBScript. Can be used within any ActiveX Script Host such as Microsoft® Exchange Server, Microsoft® Internet Explorer, and the Windows Script Host.
  • Perl Package Manager (PPM): Perl extension installer and manager. Makes it easy for Win32 developers to manage the many modules and extensions available for Perl.

Files Required

The files required for ActivePerl are located on your Microsoft® Windows® 2000 Resource Kit companion CD.

To use this tool, you must install it. The installation file (on the Windows 2000 Resource Kit companion CD) is: /apps/perl/ActivePerl.exe.

  • Activeperl521.exe: Perl executable file
  • Activeperlsource521.zip: Perl source
  • ActivePerl Release Notes.htm: ActiveState Perl Release Notes
  • AP521_diff.txt

Note

This software is ActiveState ActivePerl build #521.

For More Information

ActiveState ActivePerl for the Windows 2000 Resource Kit is a third-party application included in the Windows 2000 Resource Kit. For more information about ActivePerl, visit the ActiveState Web site at:

Internet link http://www.ActiveState.com/ActivePerl/


Autoexnt.exe: AutoExNT Service

The AutoExNT Service allows you to start a custom batch file, Autoexnt.bat, when you start a computer - without having to log onto the computer on which it will run.

AutoExNT includes an /interactive option (analogous to the /interactive option of the AT command) that allows you to see the processes started. To use AutoExNT, you must be running Microsoft® Windows® 2000, Microsoft® Windows NT® version 4.0, or Microsoft® Windows NT® 3.5 or later.

As no user-environment variables have yet been declared when AutoExNT runs at system startup, you must use full path names. If you need a service to be running, such as the Server or Schedule service, include a net start service command at the beginning of your Autoexnt.bat file before you start running a dependent process.

AutoExNT Service Topics

  • Installing and Configuring the AutoExNT Service

Files Required

  • Autoexnt.exe: The AutoExNT Service executable file.
  • Servmess.dll: AutoExNT Service message file.
  • Instexnt.exe: Setup program used to install the service.


Installing the AutoExNT Service

To install AutoExNT Service
  1. Copy the Autoexnt.exe and Servmess.dll files into the <systemroot>/System32 directory.
  2. Using a text editor, create a batch file containing the commands you want to include, and name it Autoexnt.bat.
  3. Copy Autoexnt.bat into the <systemroot>Systemroot/System32 directory. At the command prompt, type:
    instexnt install
    To view the installation processes running on the desktop, use the /interactive option. At the command prompt, type:
    instexnt install /interactive

    note-icon

    Note

    If you use the /interactive option, any users who are logged on locally are able to stop the processes from running.

  4. When installation has completed successfully, you should see the following:
     CreateService AutoExNT SUCCESS
    with InterActive Flag either OFF or ON, as appropriate.

Testing AutoExNT Service

To test AutoExNT Service, log on as Administrator and type the following command at the command prompt:
net start autoexnt
If the tool starts correctly, Autoexnt.bat runs in a command-prompt window.

Configuring AutoExNT Service to Run at Startup

To configure AutoExNT Service to run when you start your computer
  1. In the Services list, right-click AutoExNT and select Properties.
  2. On the General tab in the Startup Type box, select Automatic.
  3. Choose Apply, then OK.

note-icon

Note

When you need to access an area outside your local system (for example using the net use command), click Logon As: This Account, specify an account that has adequate permissions on the domain, and provide a password as required.


Choice.exe: User Input for Batch Files

Choice prompts the user to make a choice in a batch program by displaying a prompt and pausing for the user to choose from among a set of keys. You can use this command only in batch programs.

Choice Topics

  • Choice Syntax
  • Choice Examples: Using Choice a Batch Files
  • Choice Examples: Leaving out a Prompt
  • Choice Examples: Using the /t Switch
  • Choice ERRORLEVEL Note

Files Required

  • Choice.exe


Choice Syntax

One Step choice [/c[:]choices] [/n] [/s] [/t[:]c,nn] [text]

Where:

/c[:]choices
specifies allowable keys in the prompt. When displayed, the keys will be separated by commas, will appear in brackets ([]), and will be followed by a question mark. If you don't specify the /c switch, Choice uses YN as the default (which displays as [Y, N]). The colon (:) is optional.
/n
causes Choice not to display the prompt. The text before the prompt is still displayed, however. If you specify the /n switch, the specified keys are still valid.
/s
causes Choice to be case-sensitive. If the /s switch is not specified, Choice will accept either uppercase or lowercase for any of the keys that the user specifies.
/t[:]c,nn
causes Choice to pause for a specified number of seconds before defaulting to a specified key. The values for the /t switch are as follows:
  • c = the character to default to after nn seconds. The character must be in the set of choices specified in the /c switch.
  • nn = the number of seconds to pause. Acceptable values are from 0 to 99. If 0 is specified, there will be no pause before defaulting.
text
specifies text you want to be displayed before the prompt. Quotation marks are necessary only if you include a switch character (/) as part of the text before the prompt. If you don't specify text, Choice displays only a prompt.


Choice Examples: Using Choice in Batch Files

When you use the following syntax in a batch file:

  choice /c:ync

causes the following to display when Choice is started:

  [Y,N,C]?

Adding text to the syntax:

  choice /c:ync Yes, No, or Continue

causes the following to display when Choice is started:

  Yes, No, or Continue [Y,N,C]?


Choice Examples: Leaving out a Prompt

Using the /n switch to leave out the prompt in a batch program:

  choice /n Yes, No, or Continue?

means the user sees only the text you specified when Choice is started:

  Yes, No, or Continue?


Choice Examples: Using the /t Switch

Using the following syntax in a batch program:

choice /c:ync /t:n,5

means the user sees the following when Choice is started:

[Y,N,C]?

If the user doesn't press a key within five seconds, Choice selects N and returns an ERRORLEVEL value of 2. Otherwise, Choice returns the value corresponding to the user's choice.


Choice ERRORLEVEL note

ERRORLEVEL is set to the offset of the key that the user presses in choices.

The first key you assign returns a value of 1, the second a value of 2, the third a value of 3, and so on. If the user presses a key that is not among the keys you assigned, Choice sounds a warning beep (that is, it sends a BEL, or 07h, character to the console).

If Choice detects an error condition, it returns an ERRORLEVEL value of 255.

If the user presses CTRL+BREAK or CTRL+C, Choice returns an ERRORLEVEL value of 0.

When you use ERRORLEVEL parameters in a batch program, list them in decreasing order.


Forfiles.exe

This command-line tool can be used in a batch file to select files in a folder or tree for batch processing.

ForFiles enables you to run a command on or pass arguments to multiple files. For example, you could run the TYPE command on all files in a tree with the *.txt extension. Or you could execute every batch file (*.bat) on the C:\ drive with the file name "Myinput.txt" as the first argument.

With ForFiles, you can:

  • select files using absolute or relative dates.
  • build an archive tree of files using variables such as @fsize (file size) and @fdate (file date).
  • differentiate files from directories using the @isdir variable.
  • use special characters in the command line by passing the hexadecimal code (0x HH).

ForFiles works by implementing the "recurse subdirectories" flag on tools designed to process only a single file.

ForFiles Topics

  • ForFiles Syntax
  • ForFiles Examples

File Required

  • ForFiles.exe


ForFiles Syntax

One Step forfiles [-p path] [-m searchmask] [-c command] [-d{+|-}{ddmmyyyy|dd}] [-s] [-v] [-?]

Where:

-p path
indicates a path on which to start searching. The default folder is the current one from which forfiles is run (.).
-m searchmask
searches files according to searchmask. The default searchmask is *.*
-c command
indicates a command to execute on each file. Command strings with spaces must be enclosed in double quotation marks. The default command is "cmd /c echo @file".

The following variables can be used in a command string: @file, @file_without_ext, @ext, @path, @relpath, @isdir, @fsize, @fdate, @ftime.

To include special characters in the command line, use the hexadecimal code 0x HH.
-d{+|-}{ddmmyyyy|dd}
selects files with a date greater than or equal to (>=), or less than or equal to (<=), ddmmyyyy (UTC), or files with a date greater than or equal to (>=), or less than or equal to (<=), the current date minus dd days.
-s
instructs forfiles to recurse into subdirectories.
-v
runs forfiles in verbose mode.
-?
displays this usage screen. Usage can also be displayed by running forfiles without arguments.


ForFiles Syntax

ForFiles Examples

The defaults for ForFiles arguments are:
Directory: . (current directory)
Search Mask: *.*
Command: "cmd /c echo @file"

Examples

To list all the batch files on drive c:

forfiles -pc:\ -s -m*.bat -c"cmd /c echo @file is a batch file"

To list all the directories on drive c:

forfiles -pc:\ -s -m*.* -c"cmd /c if @isdir==true echo @file is a directory"

To list all the files older than 100 days on drive c:

forfiles -pc:\ -s -m*.* -d-100 -c"cmd /c echo @file : date >= 100 days"

To list all the files older than January 1, 1993 on drive c:

forfiles -pc:\ -s -m*.* -d-01011993 -c"cmd /c echo @file is quite old!"

To list all the extensions of all files on drive c:

forfiles -pc:\ -s -m*.* -c"cmd /c echo extension of @file is 0x22@ext0x22"


Gettype.exe: Get Type Version Information

Gettype.exe: Get Type Version Information NEW

This command-line tool allows you to detect what type of operating system—Microsoft® Windows® 2000 or Microsoft® Windows NT®; workstation, server or domain controller—is installed on a computer.

GetType is useful for administrators who need to detect Windows software installations in a mixed environment before performing some action in a batch file. Sometimes it is necessary to run software or scripts only on clients or servers running a particular variety of Windows 2000 or Windows NT.

GetType queries the registry for the computer's installation type, and sets the error level (%ErrorLevel%) accordingly. For error levels, see GetType Syntax.

GetType Topics

  • GetType Syntax
  • GetType Example

File Required

  • Gettype.exe


GetType Syntax

One Step gettype [\\RemoteComputer] [/s]

Where:

\\RemoteComputer
specifies an optional remote computer on which to run GetType.
/s
specifies silent mode.

GetType queries the registry for the workstation's install type, and sets the error level (%ErrorLevel%) as follows:

Error level | Meaning
1 | Windows NT Workstation
2 | Windows 2000 Professional installation
3 | Windows NT Server Non-Domain Controller
4 | Windows 2000 Server Non-Domain Controller
5 | Windows NT Server Domain Controller
6 | Windows 2000 Server Domain Controller
7 | Windows NT [Enterprise/Terminal] Server Domain Controller
8 | Windows NT [Enterprise/Terminal] Server Non-Domain Controller


GetType Examples

Using GetType within a batch file, you can create scripts that run only if a specific platform is detected. See the sample batch file below. Platforms GetType recognizes include:

  • Windows NT Workstation
  • Windows 2000 Professional installation
  • Windows NT Server Non-Domain Controller
  • Windows 2000 Server Non-Domain Controller
  • Windows NT Server Domain Controller
  • Windows 2000 Server Domain Controller
  • Windows NT [Enterprise/Terminal] Server Domain Controller
  • Windows NT [Enterprise/Terminal] Server Non-Domain Controller

To use GetType within a script

  1. Create a batch file similar to the following:
    @echo off
REM Batch file to detect operating system
REM ----------------------------------
if Windows_NT == %OS% goto WINNT
echo You are NOT running Windows NT (Windows 95/98 perhaps?)
goto END

:WINNT
gettype.exe

if errorlevel=9 goto FILENOTFOUND

echo You are running Windows NT.
echo More Specifically:
echo.

if ERRORLEVEL=8 goto EIGHT
if ERRORLEVEL=7 goto SEVEN
if ERRORLEVEL=6 goto SIX
if ERRORLEVEL=5 goto FIVE
if ERRORLEVEL=4 goto FOUR
if ERRORLEVEL=3 goto THREE
if ERRORLEVEL=2 goto TWO
if ERRORLEVEL=1 goto ONE

:FILENOTFOUND
echo.
echo Gettype not found.
echo.
goto END

:EIGHT
echo Windows NT [Enterprise/Terminal] Server Non-Domain Controller
goto END

:SEVEN
echo Windows NT [Enterprise/Terminal] Server Domain Controller
goto END

:SIX
echo Windows 2000 Server Domain Controller.
goto END

:FIVE
echo Windows NT Server Domain Controller.
goto END

:FOUR
echo Windows 2000 Server Non-Domain Controller.
goto END

:THREE
echo Windows NT Server Non-Domain Controller.
goto END

:TWO
echo Windows 2000 Professional installation.
goto END

:ONE
echo Windows NT Workstation.
goto END

:END
pause
  2. Copy Gettype.exe and the batch file to the target workstations and run.


Kix32.exe: KiXtart 95

KiXtart 95 is a logon script processor and enhanced batch language for computers running Windows 32-bit operating systems in a Windows Networking environment.

With KiXtart 95's free-format scripting language, you can conditionally display information, set environment variables, start programs, connect to network drives, read or edit the registry, and change the current drive and directory.

Version 3.60 offers some important new capabilities:

  • Numerous new and enhanced commands, functions and macros.
  • Support for single-dimension arrays of variables
  • Support for specifying numbers in hexadecimal notation.
  • A new macro that tells you the number of active Remote Access Connections
  • The ability to declare variables local to a specific script or subroutine
  • Support for mathematical And and Or operators
  • "Smart" information information retrieval that retrieves only local user information, speeding up the startup of KiXtart
  • internationalization of Kix32 and Kxrpc, making all macros available in the correct codepage

Kix32.doc and Kix32rel.txt contain more details about the latest changes in KiXtart 95.

Files Required

The files for KiXtart 95 are installed by the Windows 2000 Resource Kit Setup program in the %NTResKit%\Kix95 folder.


Logtime.exe

This command-line tool logs the start or finish of command-line programs from a batch file. This is useful for timing and tracking batch jobs such as mail-address imports.

LogTime creates a log file called Logtime.log, with a date-and-time stamp next to the specified parameter (text_string in LogTime syntax). When called from within a batch file, the date-and-time stamp records when LogTime (with the given parameter) was run by the batch file. If, for example, LogTime is run before and after a command-line program in a batch file, Logtime.log will record the start and stop time of that program.

With each use of LogTime, new information is appended to Logtime.log; the file is not overwritten.

LogTime Topic

  • LogTime Syntax

Files Required

  • Logtime.exe


POSIX Utilities

The POSIX Utilities, a suite of UNIX-like command-line tools, have been recompiled to operate on Microsoft® Windows® 2000.

The Windows 2000 Resource Kit also includes Win32 clones of seven of the POSIX Utilities.

Caution

Different versions of FIND, MKDIR, and RMDIR (POSIX utilities) are included with Windows 2000. You should rename the POSIX versions of these so there is no confusion.

POSIX Topics

  • Installing the POSIX Utilites
  • POSIX Utility Descriptions
  • POSIX Utility Notes
  • Win32 POSIX Clones

Files Required

    • These tools are located in the <cdroot>\Apps\Posix directory of the Windows 2000 Resource Kit companion CD. See Installing POSIX Utilities for installation information.

Copyright Notice

The files for the POSIX Utilities are the only files in the Windows 2000 Resource Kits covered by the GNU Library General Public License. All other files are copyrighted by Microsoft Corporation or the respective owners, and are subject to the terms of a separate license agreement.


Installing POSIX Utilites

The POSIX Utilites are not installed by the Windows 2000 Resource Kit setup program. To install them, use the following procedure:

To install POSIX Utilities

  1. Insert the Windows 2000 Resource Kit companion CD into your CD drive.
  2. When the Setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\posix directory, copy and paste the tools you want to use to your hard drive.


POSIX Utility Descriptions

Utility | MS-DOS Equivalent | Description
cat | TYPE | "conCATenator": Command line POSIX utility to display the contents of a file.
cc | none | "C Compiler" - CL front-end: Command line POSIX utility for compiling a C program. CC Command Information
chmod | ATTRIB | "CHange MODe": Command line POSIX utility to change what access different groups of users have to a file.
chown | none | "CHange OWNer": Command line POSIX utility to change ownership of a file.
cp | COPY | "CoPy": Command line POSIX utility to duplicate a file or directory.
find | none | file finder: Command line POSIX utility that searches a folder tree for files matching given criteria.
grep | none | "Global Regular Expression Print" - FIND sub: Command line POSIX utility to search for patterns using regular expressions within files.
ln | none | "LiNker": Command line POSIX utility that provides a way to access a file using different names.
ls | DIR | "LiSt": Command line POSIX utility to list the contents of a directory.
mkdir | MD | "MaKe DIRectory": Command line POSIX utility to create a new directory.
mv | REN | "MoVe": Command line POSIX utility to move a file or directory to a new location. (Does not leave an original.)
rm | DEL | "ReMove": Command line POSIX utility to delete a file.
rmdir | RD | "ReMove DIRectory": Command line POSIX utility to delete a directory.
sh | COMMAND | "SHell": Command line POSIX utility that includes a large subset of Korn shell functionality. note-icon Note Does not support variable arrays. sh Command Information
touch | none | Change dates: Command line POSIX utility that changes the modification date of files.
vi | EDIT | vi ("VIsual") clone: Command line POSIX utility for editing text files. VI Command Information
wc | none | "Word Count": Command line POSIX utility that returns the number of bytes, words, and lines in files.


POSIX Utility Notes

When you run the POSIX utilities, any parameters consisting of file names should be in the POSIX format; for example, if you want to display the file D:\Temp\Message.txt, in the COMMAND program, you might enter:

type d:\temp\message.txt

whereas in the sh program, you would enter:

cat //D/temp/message.txt

Drive letters (which must be capitalized) are preceded by two forward slashes, and folders are preceded by one forward slash. Case sensitivity is also important for POSIX file names; if you want to search all the C files in a FAT folder for the string "main", you need to enter the following:

grep main *.C

If "*.c" is entered instead, nothing would match in the FAT folder, due to the automatic uppercasing of file names on FAT file systems.


Win32 POSIX Clones

The following are Win32 work-alikes of seven of the POSIX Utilities are included in the Windows 2000 Resource Kit. These clones don't use the POSIX subsystem at all, but duplicate the functionality of the corresponding POSIX tools.

cat.exe

cp.exe

ls.exe

mv.exe

touch.exe

wc.exe

vi.exe


Timeout.exe

Timeout is a command-line tool that causes the command processor to pause execution for the number of seconds specified by the time (#) parameter, after which it continues without requiring a user keystroke. A user keystroke, however, will cause execution to resume immediately even if the timeout period has not expired.

The functioning of Timeout is similar to that of the MS-DOS pause command merged with Sleep.exe. Timeout is typically used in batch files.

Timeout Topics

  • Timeout Syntax

File Required

  • Timeout.exe


Timeout Syntax

One Step timeout #

Where:

#
Specifies the decimal number of seconds (between -1 and 100000) to wait before continuing.

The value -1 causes the computer to wait indefinitely for a keystroke. This value makes Timeout function the same as the pause command.

Running timeout without any parameter displays a brief description of usage.


Waitfor.exe

This command-line tool waits until a signal is given across the network. Multiple computers can wait for the same signal.

The tool could be useful when testing builds of a piece of software, for example, as the build computer could send out a signal to several computers running WaitFor once the build has completed successfully. On receipt of the signal, the batch file including WaitFor could instruct the computers to immediately start running tests on the build.

The names of the signals that WaitFor uses are file-like, independent and not sensitive to case. Multiple instances of WaitFor can run on a single computer, but each must be waiting for a different signal. A signal can be triggered by using the -s option.

WaitFor runs on Microsoft® Windows® 2000, any version of Microsoft® Windows NT® and on Microsoft® Windows® 95. On Windows 2000 and Windows NT, the computer receiving the signal must be in the same domain as the sending computer. On Windows 95, signal names longer than the 8.3 file name format will be truncated, so use of signal names that comply with the 8.3 standard is advised.

WaitFor command-line switches enable you to specify the number of seconds to wait and the name of the signal for which to waits or which to sends.

Syntax

One Step waitfor [-t timeout] [-s] signalname [-?]

Where:

-t timeout
specifies the number of seconds to wait. Default is forever.
-s
sends signalname instead of waiting for it.
signalname
specifies the signal for which WaitFor waits or which it sends. Signalname is not case-sensitive.
-?
displays a usage message (as does any error in parsing the command line).

Note

Only one instance of WaitFor can wait for a given signal on a given computer.

Examples

waitfor -t 10 espresso\build007
waits 10 seconds or until the "espresso\build007" signal is triggered.

waitfor espresso\build007
waits forever (the default) or until the "espresso\build007" signal is triggered.

waitfor -s espresso\build007
triggers the "espresso\build007" signal.

File Required

  • Waitfor.exe


Dsstore.exe: DS Store

Dsstore.exe: Directory Services Store NEW

Server-only: This tool is included in the Windows 2000 Server Resource Kit only.

This tool assists in managing Enterprise Public Key Integration. It includes functionality necessary for several deployment scenarios.

DsStore enables you to:

  • list information about a given computer's certificates.
  • list information about computer's objects on the domain.
  • list information about Certificate Authorities in the Enterprise.
  • add, remove, and display certificates from the directory services Enterprise Root Store.
  • add and remove certificate revocation lists (CRLs) from directory services.
  • validate certificates from directory services public key infrastructure (PKI) locations.
  • pulse "autoenrollment" events to speed up various PKI processes
  • add non-Microsoft® Windows® 2000 Certificate Authorities or offline Certificate Authorities to the enterprise PKI.
  • manage enterprise roots in directory services.
  • verify Machine Autoenrollment and Domain Controller certificates from Kerberos Key Distribution Center (KDC).
  • check on status and validity of domain controller certificates.
  • check on validity of smart card certificates.

DsStore Topics

  • DsStore Syntax

File Required

  • Dsstore.exe


DsStore Syntax

One Step dsstore DN_of_domain [-del] [-display] [-addcrl crl_filename CA_name computer_name] [-addroot crl_filename CA_name] [-?]

Where:

DN_of_domain
is the distinguished name of the target domain. You must specify this as the first parameter. For example, dsstore DC=dev,DC=microsoft,DC=com.
-del
presents a list of roots, from which you can choose one for deletion.
-display
displays enterprise roots.
-addcrl crl_filename CA_name computer_name
adds a certificate revocation list (.crl) file, a Certificate Authority name, and a computer name.
-addroot crl_filename CA_name
adds a certificate revocation list (.crl) file and a Certificate Authority name.
-?
displays a syntax screen at the command prompt.


Efsinfo.exe: Encrypting File System Information

Efsinfo.exe: Encrypting File System Information NEW

This command-line tool displays information about files and folders encrypted with Encrypting File System (EFS) on NTFS partitions.

EFS is a feature of Windows 2000 that enables users to encrypt and decrypt files. This helps users keep files safe from intruders who might gain unauthorized physical access to their sensitive data (for example, by stealing a laptop or external disk drive).

In EFS, users work with encrypted files and folders just as they do with any other files or folders: encryption is transparent. If the EFS user is the same person who encrypted the file or folder, the system decrypts the file or folder when the user accesses it later. Unauthorized users or intruders, however, are prevented from accessing any encrypted files or folders.

You can also encrypt or decrypt a file or folder with the command-line tool cipher, which is included with the Windows 2000 operating system.

EfsInfo Topics

  • EfsInfo Syntax
  • EfsInfo Example

File Required

  • Efsinfo.exe


EfsInfo Syntax

One Step efsinfo [/u] [/r] [/c] [/i] [/y] [/s:Dir] [Pathname [...]] [/?]

Where:

/u
displays encryption information about the files and folders in the current folder. This is the default option: running efsinfo without switches produces the same output.
/r
displays recovery agent information.
/c
displays certificate thumbnail information.
/i
continues performing the specified operation even after errors have occurred. By default, EfsInfo stops when an error is encountered.
/y
displays the current Encrypting File System (EFS) certificate thumbnail on the local computer. The files specified might not be on this computer. If no items are returned, there are no encrypted files on the system.
/s:Dir
performs the specified operation on directories in the given directory and all subdirectories.
Pathname [...]
specifies the path of one or more files or directories for which to display encryption information.
/?
displays command-line help


EfsInfo Example

This example displays the current EFS certificate.

efsinfo /y

Your current EFS certificate thumbnail information on the computer named A-LOLAG2 is:

  BAAF 99CB 2B76 C49C E49C 6B17 C404 1030 E6BD BF3D

Note

This command returns no information if no encrypted files or folders have been created on this computer.


System Scanner

System Scanner NEW

System Scanner for Windows is a security assessment solution for Microsoft® Windows® 2000, Microsoft® Windows NT version 4.0, Microsoft® Windows® 95, and Microsoft® Windows® 98. It performs nearly 300 vulnerability checks including:

  • Extensive system baseline capabilities, including file, registry, and user
  • Browser-specific vulnerabilities
  • Comprehensive IIS/PWS checks
  • Presence of well known TCP/IP-based services
  • NetBIOS checks
  • Java vulnerabilities
  • Microsoft Office vulnerabilities
  • Windows 95 Policy Editor misconfigurations
  • Susceptibility to denial of service attacks
  • Configuration of virus scanners
  • Registry security checks
  • User policy configuration checks
  • Remote access checks and modem checks

System Scanner allows you to define your own policies, as well as schedule scans to run at specified times. Easy-to-use HTML reports provide detailed descriptions of vulnerabilities detected on your machine and information necessary to correct them.

Installing System Scanner

System Scanner is not installed during Windows 2000 Resource Kit installation. To install it, use the following procedure:

To install System Scanner

  1. Insert the Microsoft Windows 2000 Resource Kit companion CD in your CD-ROM drive.
  2. When the setup screen appears, click Explore the CD.
  3. In the <cdroot>\apps\systemscanner directory, double-click sysscansetup.exe.
  4. Follow the directions that appear on your screen.

Files Required

System Scanner is a separate application not installed by the Windows 2000 Resource Kit installation program. The files required are located in the <cdroot>\apps\systemscanner\ directory of your Microsoft® Windows® 2000 Resource Kit companion CD.

For More Information

See the System Scanner Help file. After installing System Scanner, click Start, point to Programs, point to ISS, and then click System Scanner Help.


Glossary of Terms

This page requires a browser capable of displaying frames.


Windows 2000 Resource Kit Tools Help: Alphabetical list of Tools

- A -

topic ActivePerl.exe NEW

topic Add Users to a Group (Usrtogrp.exe)

topic Addiag.exe: Application Deployment Diagnosis NEW

topic Addusers.exe: Add Users

HTML Help ADSI Administration Scripts (Remote Administration Scripts) NEW

topic Apimon.exe: API Monitor

ATAnlyzr AppleTalk network device ANaLYZeR (Atanlyzr.exe)

topic Application Deployment Diagnosis (Addiag.exe) NEW

AppSec Application Security (Appsec.exe) NEW

topic Applications as Services Utility (Srvany.exe)

AppSec Appsec.exe: Application Security NEW

topic Associate.exe

ATAnlyzr Atanlyzr.exe: AppleTalk network device ANaLYZeR

topic Atmarp.exe: Windows ATM ARP Server Information Tool NEW

topic Atmlane.exe: Windows ATM LAN Emulation Client Information NEW

topic Auditpol.exe

topic Autoexnt.exe: AutoExNT Service

topic Automated Installation Tool (Sysdiff.exe)

- B -

topic Batch File Wait (Sleep.exe)

BrowMon Browmon.exe: Browser Monitor

topic Browser Client Context Viewer (W3Who.dll) NEW

- C -

CacheMov Cachemov.exe: Offline Files Cache Mover NEW

topic Cconnect.exe: Con-Current Connection Limiter NEW

topic Certificate Enrollment Module for Routers (Mscep.dll) NEW

ChkLnks Chklnks.exe: Link Check Wizard

topic Choice.exe: User Input for Batch Files

topic Ckymunge.dll: Cookie Munger NEW

topic Cla.msc: Cybersafe Log Analyst NEW

topic Clear Memory (Clearmem.exe) NEW

topic Clearmem.exe: Clear Memory NEW

topic Clipboard Viewer (Netclip.exe)

topic Clip.exe: Clip To Clipboard

ClipTray Clipboard Organizer (Cliptray.exe)

ClipPool Clippool.exe NEW

ClipTray Cliptray.exe: Clipboard Organizer

topic Clusrest.exe: Cluster Quorum Restore Utility NEW

topic Cluster Quorum Restore Utility (Clusrest.exe) NEW

topic Cluster Verification Utility

topic ClusterSentinel NEW

topic Clustool.exe: Microsoft Cluster Tool NEW

CmdHere Cmdhere.inf: Command Prompt Here

topic Command-Line Service Controller (Netsvc.exe)

CmdHere Command Prompt Here (Cmdhere.inf)

topic Common Open Policy Service Local Policy Module (Copslpm.exe) NEW

topic Compress.exe: File Compress

topic Con2prt.exe: Connect to Printer

topic Con-Current Connection Limiter (Cconnect.exe) NEW

ConfMgr Confmgr.htm: IP Multicast Conference Management Tool NEW

topic Connect to Printer (Con2prt.exe)

topic Console User Manager (Cusrmgr.exe) NEW

topic Cookie Munger (Ckymunge.dll) NEW

topic Copslpm.exe: Common Open Policy Service Local Policy Module NEW

topic Counter List (Ctrlist.exe)

HTML Help Counters.chm: Windows 2000 Performance Counters

CpuStres CPU Stress Utility (Cpustres.exe)

QSlice CPU Usage by Processes (Qslice.exe)

CpuStres Cpustres.exe: CPU Stress Utility

topic Crystal Reports for Windows 2000 Resource Kit by Seagate Software

topic Create File (Creatfil.exe)

topic Creatfil.exe: Create File

topic Ctrlist.exe: Counter List

topic Cusrmgr.exe: Console User Manager NEW

topic CVU (Cluster Verification Utility)

topic Cybersafe Log Analyst (Cla.msc) NEW

- D -

topic Daylight Saving Time Update Utility (Timezone.exe)

DefPtr Defptr.exe: Default Printer

topic Delete File and Reparse Points (Delrp.exe) NEW

DelProf Delprof.exe: User Profile Deletion Utility

topic Delrp.exe: Delete File and Reparse Points NEW

topic Delsrv.exe

Internet Designed for Windows Logo Program Web site

topic Dh.exe

topic Dhcmp.exe: DH Compare NEW

DhcpObjs DHCP Objects (Dhcpobjs.exe) NEW

topic DHCP Server Locator Utility (Dhcploc.exe)

topic Dhcploc.exe: DHCP Server Locator Utility

DHCP Objects Dhcpobjs.exe: DHCP Objects NEW

topic Directory Disk Usage (Diruse.exe)

topic Directory Services Store (Dsstore.exe) NEW

topic Diruse.exe: Directory Disk Usage

topic Disk Alignment Tool (Diskpar.exe) NEW

topic Disk Manager Diagnostics (Dmdiag.exe) NEW

topic Diskmap.exe

topic Diskpar.exe: Disk Alignment Tool NEW

topic Diskuse.exe

topic Dmdiag.exe: Disk Manager Diagnostics NEW

DomMon Dommon.exe: Domain Monitor

topic Drive Share (Drmapsrv.exe) NEW

topic Drivers.exe: List Loaded Drivers

topic Drmapsrv.exe: Drive Share NEW

topic Dsstore.exe: Directory Services Store NEW

topic Dump Configuration (Dumpcfg.exe) NEW

topic Dump Event Log (Dumpel.exe)

topic Dump FSMO Roles (Dumpfsmos.cmd) NEW

topic Dumpcfg.exe: Dump Configuration NEW

topic Dumpel.exe: Dump Event Log

topic Dumpfsmos.cmd: Dump FSMO Roles NEW

topic Dupfinder.exe: Duplicate File Finder NEW

topic Duplicate File Finder (Dupfinder.exe) NEW

topic Dureg.exe: Registry Size Estimator NEW

- E -

topic Efsinfo.exe: Encrypting File System Information NEW

topic Elogdmp.exe: Event Log Query Tool NEW

topic Empty Working Set (Empty.exe) NEW

topic Empty.exe: Empty Working Set NEW

topic Encrypting File System Information (Efsinfo.exe) NEW

topic Enumerate Properties (Enumprop.exe) NEW

topic Enumerating Remote Access Users (Rasusers.exe)

topic Enumprop.exe: Enumerate Properties NEW

topic Event Log Query Tool (Elogdmp.exe) NEW

topic Event Logging Utility (Logevent.exe)

ExCtrLst Exctrlst.exe: Extensible Performance Counter List

topic Exetype.exe: Finding the Executable Type

Expand Expand.exe: File Expansion Utility NEW

topic Exploration Air NEW

topic Extract.exe: Extract Cabinet NEW

- F -

topic Fcopy.exe: File Copy Utility for Microsoft Message Queuing

topic File Access Permissions per User (Perms.exe)

topic File Compress (Compress.exe)

topic File Copy (Rdpclip.exe) NEW

topic File Copy Utility for Microsoft Message Queuing (Fcopy.exe)

topic File Locator (Where.exe) NEW

topic File Spy (Filespy.exe) NEW

topic File-In-Use Replace Utility (Inuse.exe) NEW

topic Filespy.exe: File Spy NEW

topic Findgrp.exe: Find Group

topic Finding the Executable Type (Exetype.exe)

topic Floplock.exe: Lock Floppy Disk Drives

topic Forfiles.exe

topic Freedisk.exe

FTEdit Ftedit.exe: FT Registry Information Editor

- G -

topic Get Type Version Information (Gettype.exe) NEW

topic Getmac.exe

topic Getsid.exe

topic Gettype.exe: Get Type Version Information NEW

topic Global.exe

HTML Help Gp.chm: Windows 2000 Group Policy Reference NEW

topic Gpolmig.exe: Group Policy Migration NEW

topic Gpotool.exe: Group Policy Verification Tool NEW

topic Gpresult.exe: Group Policy Results NEW

Group Copy Group Copy (Grpcpy.exe)

topic Group Policy Migration (Gpolmig.exe) NEW

topic Group Policy Verification Tool (Gpotool.exe) NEW

topic Group Policy Results (Gpresult.exe) NEW

Group Copy Grpcpy.exe: Group Copy

topic GUID to Object (Guid2obj.exe) NEW

topic Guid2obj.exe: GUID to Object NEW

- H -

Internet Hardware Compatibility List Web site

topic Heapmon.exe

topic Htmlfltr.exe: HTML Text Filter NEW

topic HTML Text Filter (Htmlfltr.exe) NEW

topic HTTP Command (Httpcmd.exe) NEW

topic HTTP Monitoring Tool (Httpmon.exe) NEW

topic Httpcmd.exe: HTTP Command NEW

topic Httpmon.exe: HTTP Monitoring Tool NEW

- I -

topic IAS Parse Tool (Iasparse.exe) NEW

topic Iasparse.exe: IAS Parse Tool NEW

topic Ierk5.chm: Internet Explorer 5 Resource Kit NEW

topic IFilter Test Suite (Ifilttst.exe) NEW

topic Ifilttst.exe: IFilter Test Suite NEW

topic Ifmember.exe

topic IIS Host Helper Service (Iishostsvc.exe) NEW

topic IIS Migration Support Documents NEW

topic IIS Migration Wizard (Iisv5migrationutility_x86.exe) NEW

topic IIS Permissions Wizard Template Maker NEW

topic Iishostsvc.exe: IIS Host Helper Service NEW

topic Iisv5migrationutility_x86.exe: IIS Migration Wizard NEW

topic Installation Monitor

topic Installd.com (Ntdetect.com): Startup Hardware Detector

topic Instsrv.exe: Service Installer

topic Intfiltr.exe: Interrupt Filter NEW

topic Internet Explorer 5 Resource Kit (Ierk5.chm) NEW

topic Internet Explorer Administration Kit NEW

topic Internet Explorer Web Accessories NEW

topic Internet Protocol Security Policies Tool (Ipsecpol.exe) NEW

topic Internet Scanner

topic Interrupt Filter (IntFiltr.exe) NEW

topic Inuse.exe: File-In-Use Replace Utility NEW

topic IP Multicast Conference Management Tool (Confmgr.htm) NEW

topic Ipsecpol.exe: Internet Protocol Security Policies Tool NEW

- J -

topic Java/COM Registration Utility (Javareg.exe) NEW

topic Javareg.exe: Java/COM Registration Utility NEW

- K -

topic Kerberos List (Klist.exe) NEW

topic Kerberos Tray (Kerbtray.exe) NEW

topic Kerbtray.exe (Kerberos Tray) NEW

topic Kernprof.exe: Kernel Profiler

topic Kix32.exe: KiXtart 95

topic Klist.exe: Kerberos List NEW

- L -

topic L-Bridge (Lbridge.cmd) NEW

topic Lbridge.cmd: L-Bridge NEW

LeakyApp Leakyapp.exe

ChkLnks Link Check Wizard (Chklnks.exe)

topic Linkd.exe NEW

topic List.exe NEW

topic List Loaded Drivers (Drivers.exe)

topic Local.exe

topic Lock Floppy Disk Drives (Floplock.exe)

topic Logevent.exe: Event Logging Utility

topic Logoff.exe

topic Logtime.exe

topic Lsreport.exe: Terminal Services Licensing Reporter NEW

topic Lsview.exe: Terminal Services License Server Viewer NEW

- M -

topic Manipulate Service Principal Names for Accounts (Setspn.exe) NEW

topic Mcast.exe NEW

topic Mcopy.exe: Multiple Copy NEW

topic Metaedit.exe: Metabase Editor NEW

topic Mibcc.exe: SNMP MIB Compiler

topic Microsoft Cluster Tool (Clustool.exe) NEW

topic Microsoft System Information Extensions (Msinfosetup.exe)

topic Microsoft Tape Format Verification Tool (Mtfcheck.exe) NEW

topic Move Users (Moveuser.exe) NEW

topic Moveuser.exe: Move Users NEW

topic Mscep.dll: Certificate Enrollment Module for Routers NEW

topic Msinfosetup.exe: Microsoft System Information Extensions

topic MSMQ Triggers NEW

topic Mtc.exe: Multiple Tree Copy NEW

topic Multiple Copy (Mcopy.exe) NEW

topic Multiple Tree Copy (Mtc.exe) NEW

topic Mtfcheck.exe: Microsoft Tape Format Verification Tool NEW

- N -

topic Near-Future Command Scheduler (Soon.exe)

NetCons Net Connections (Netcons.exe)

topic Netclip.exe: Clipboard Viewer

NetCons Netcons.exe: Net Connections

topic Netset.exe NEW

topic Netsvc.exe: Command-Line Service Controller

topic Nlmon.exe: NL Monitor

topic Now.exe

topic Ntdetect.com (Installd.com): Startup Hardware Detector

topic Ntimer.exe: Program Timer NEW

topic Ntrights.exe

- O -

topic OEM Support Tools for Windows NT 4.0

CacheMov Offline Files Cache Mover (Cachemov.exe) NEW

topic Oh.exe

topic Oidgen.exe: OID Generator NEW

OleView Oleview.exe: OLE/COM Object Viewer

WordPad Os2api.txt: OS/2 API Information

- P -

topic Page Fault Monitor (Pfmon.exe)

topic Pathman.exe

topic Perf Monitor (Wperf.exe)

topic Perfcheck.dll: Performance Counter Check NEW

topic PerfMon Chart Setting Editor (Setedit.exe)

topic Perfmon4.exe: Performance Monitor 4 NEW

topic Perfmtr.exe: Performance Meter

topic Performance Counter Check (Perfcheck.dll) NEW

topic Performance Data Block Dump Utility (Showperf.exe) NEW

topic Performance Data in the Command Window (Typeperf.exe)

topic Performance Meter (Perfmtr.exe)

topic Performance Monitor 4 (Perfmon4.exe) NEW

topic Permcopy.exe

topic Perms.exe: File Access Permissions per User

topic Pfmon.exe: Page Fault Monitor

topic Playback.exe NEW

topic POSIX Utilities

topic Prnadmin.dll: Printer Administration Objects NEW

topic Program Timer (Ntimer.exe) NEW

topic Process and Thread Status (Pstat.exe)

topic Process Tree (Ptree.exe) NEW

topic Pstat.exe: Process and Thread Status

topic Ptree.exe: Process Tree NEW

topic Pulist.exe

- Q -

topic Qgrep.exe: Quick Grep

topic QoS Time Stamp (Timestmp.sys) NEW

QSlice Qslice.exe: CPU Usage by Processes

topic Qtcp.exe NEW

QSlice Quickres.exe: Quick Resolution Changer

topic Quiktray.exe: Quick Tray

- R -

topic RAS Server Monitor (Rassrvmon.exe) NEW

topic Raslist.exe

topic Rassrvmon.exe: RAS Server Monitor NEW

topic Rasusers.exe: Enumerating Remote Access Users

RCmd Rcmd.exe & Rcmdsvc.exe: Remote Command Service

topic RConsole (Remote Console)

topic Rdpclip.exe: File Copy NEW

topic Reduce Trace Data (Reducer.exe) NEW

topic Reducer.exe: Reduce Trace Data NEW

topic Regback.exe: Registry Backup

topic Regdmp.exe

HTML Help Regentry.chm: Technical Reference to the Windows 2000 Registry

topic Regfind.exe

topic Regini.exe: Registry Change by Script

topic Registry Backup (Regback.exe)

topic Registry Change by Script (Regini.exe)

topic Registry Restoration (Regrest.exe)

topic Registry Size Estimator (Dureg.exe) NEW

topic Regrest.exe: Registry Restoration

topic Remapkey.exe: Remap Windows Keyboard Layout NEW

topic Remote Administration Scripts NEW

RCmd Remote Command Service (Rcmd.exe & Rcmdsvc.exe)

topic Remote Console

RKill Remote Process Kill

topic Remote Shutdown (Shutdown.exe)

topic Removeable Storage Database Utility (Rsm_dbutil.exe) NEW

topic Removeable Storage Integrity Checker (Rsm_dbic.exe) NEW

topic Removable Storage Manual Configuration Wizard (Rsmconfg.exe) NEW

topic Robocopy.exe: Robust File Copy Utility

topic RPC Dump (Rpcdump.exe) NEW

topic RPC Ping: RPC Connectivity Verification Tool NEW

topic Rpcdump.exe: RPC Dump NEW

topic Rshsvc.exe: TCP/IP Remote Shell Service

topic Rsm_dbic.exe: Removeable Storage Integrity Checker NEW

topic Rsm_dbutil.exe: Removeable Storage Database Utility NEW

topic Rsmconfg.exe: Removable Storage Manual Configuration Wizard NEW

topic Run Extension (Runext.exe)

topic Runext.exe: Run Extension

- S -

topic Sc.exe: Service Controller Tool

topic Scanreg.exe

topic Sclist.exe

topic Seagate Software Crystal Reports for Windows 2000 Resource Kit

topic Security Configuration IIS Templates NEW

topic SendFile Test Suite (Sendfile.exe) NEW

topic Sendfile.exe: SendFile Test Suite NEW

topic Server Manager (Srvmgr.exe)

topic Service ACL Editor (Svcacls.exe) NEW

topic Service Controller Tool (Sc.exe)

SrvInstW Service Installation Wizard (Srvinstw.exe)

topic Service Installer (Instsrv.exe)

SvcMon Service Monitoring Tool (Svcmon.exe)

topic Setedit.exe: PerfMon Chart Setting Editor

topic Setspn.exe: Manipulate Service Principal Names for Accounts NEW

SetupMgr Setupmgr.exe: Setup Manager

topic Setx.exe

topic Show Privilege (Showpriv.exe) NEW

topic Showacls.exe

topic Showgrps.exe

topic Showmbrs.exe

topic Showperf.exe: Performance Data Block Dump Utility NEW

topic Showpriv.exe: Show Privilege NEW

topic Shutdown.exe: Remote Shutdown

SiPanel Sipanel.exe: Soft Input Panel

topic Sleep.exe: Batch File Wait

topic Smart Sketch LE NEW

topic SNMP MIB Compiler (Mibcc.exe)

SnmpMon Snmpmon.exe: SNMP Monitor

topic Snmputil.exe: SNMP Browser

topic Soon.exe: Near-Future Command Scheduler

topic Srvany.exe: Applications as Services Utility

topic Srvcheck.exe

topic Srvinfo.exe

SrvInstW Srvinstw.exe: Service Installation Wizard

topic Srvmgr.exe: Server Manager

topic Startup Hardware Detector: Ntdetect.com (Installd.cmd)

SU Su.exe

topic Subinacl.exe

Internet Support Online Web site NEW

topic Svcacls.exe: Service ACL Editor NEW

SvcMon Svcmon.exe: Service Monitoring Tool

topic Sysdiff.exe: Automated Installation Tool

topic Sysprep.exe NEW

topic System Scanner NEW

- T -

topic Takeown.exe NEW

topic Tcmon.exe: Traffic Control Monitor NEW

topic TCP/IP Remote Shell Service (Rshsvc.exe)

HTML Help Technical Reference to the Windows 2000 Registry (Regentry.chm)

topic Telephony Location Manager (Tlocmgr.exe)

topic Terminal Server Capacity Planning Tools NEW

topic Terminal Services Client Registry Editory (Tsreg.exe) NEW

topic Terminal Services License Server Viewer (Lsview.exe) NEW

topic Terminal Services Licensing Reporter (Lsreport.exe) NEW

topic Terminal Services Version Limiter (Tsver.exe) NEW

TextView Textview.exe: TextViewer

TzEdit Time Zone Editor (Tzedit.exe)

topic Time-Ordered Processes (Top.exe)

topic Timeout.exe

topic Timestmp.sys: QoS Time Stamp NEW

topic Timethis.exe

topic Timezone.exe: Daylight Saving Time Update Utility

topic Tlocmgr.exe: Telephony Location Manager

topic Top.exe: Time-Ordered Processes

topic Total Processors (Totlproc.exe)

topic Totlproc.exe: Total Processors

topic Tpc.exe: Third-Party Quality of Service Control Agent

topic Trace Dump (Tracedmp.exe) NEW

topic Tracedmp.exe: Trace Dump NEW

topic Traceenable.exe NEW

topic Tracelog.exe NEW

topic Traffic Control Monitor (Tcmon.exe) NEW

topic Tru Access Manager Limited Edition NEW

topic Tsreg.exe: Terminal Services Client Registry Editor NEW

topic Tsver.exe: Terminal Services Version Limiter NEW

topic Typeperf.exe: Performance Data in the Command Window

TzEdit Tzedit.exe: Time Zone Editor

- U -

topic Unattend.doc: Unattended Setup Parameters Guide NEW

topic Uptime.exe NEW

topic User Input for Batch Files (Choice.exe)

topic User Manager for Domains (Usrmgr.exe)

DelProf User Profile Deletion Utility (Delprof.exe)

topic Usrmgr.exe: User Manager for Domains

topic Usrstat.exe

topic Usrtogrp.exe: Add Users to a Group

- V -

topic Vadump.exe: Virtual Address Dump NEW

topic Vfi.exe: Visual File Information NEW

topic Virtual Address Dump (Vadump.exe) NEW

- W -

Access W2000events.mdb: Windows 2000 Events

HTML Help W2000msgs.chm: Windows 2000 Error and Event Messages Help

topic W3Who.dll: Browser Client Context Viewer NEW

topic Waitfor.exe

topic Web Application Stress Tool NEW

topic Web Capacity Analysis Tool

topic Where.exe: File Locator NEW

topic Whoami.exe

HTML Help Windows 2000 Error and Event Messages Help (W2000msgs.chm)

Access Windows 2000 Events (W2000events.mdb)

HTML Help Windows 2000 Group Policy Reference (Gp.chm)

HTML Help Windows 2000 Performance Counters (Counters.chm)

topic Windows ATM ARP Server Information Tool (Atmarp.exe)

topic Windows ATM LAN Emulation Client Information (Atmlane.exe)

WinExit Windows Exit Screen Saver (Winexit.scr)

topic Windows Load Balancing Server Network Monitor Parsers (Wlbs_hb.dll and Wlbs_rc.dll) NEW

topic Windows Media Load Simulator (Wmloadsimulator.exe) NEW

topic Windows NT 4.0 OEM Support Tools NEW

topic Windows Report Tool Deployment Software Development Kit (Winrpsdk15.doc) NEW

WinExit Winexit.scr: Windows Exit Screen Saver

topic Winrpsdk15.doc: Windows Report Tool Deployment Software Development Kit NEW

topic WINS Administration Tool (Winscl.exe)

topic WINS Replication Network Monitor Parser (Wins.dll) NEW

topic Wins.dll: WINS Replication Network Monitor Parser NEW

topic Winschk.exe

topic Winscl.exe: WINS Administration Tool

topic Winsta.exe: WinStation Monitor NEW

topic WinStation Monitor (Winsta.exe) NEW

topic Wlbs_hb.dll and Wlbs_rc.dll: Windows Load Balancing Server Network Monitor Parsers NEW

topic Wmloadsimulator.exe: Windows Media Load Simulator NEW

topic Wperf.exe: Perf Monitor

- X -

topic Xcacls.exe

- Y -

No entries

- Z -

No entries


Alphabetical List of Tools

A B C D E F G H I J K L M
N O P Q R S T U V W X Y Z
Some tools are listed twice: once by their file name, once by their full name (in italics). Hold the cursor over the name of a tool for a brief description.


Con2prt.exe

Con2prt.exe: Connect to Printer

Con2Prt.exe provides scriptable functionality to the Add Printer wizard, so that you can simply write a script to add printers on client computers. Con2Prt lets the user disconnect all existing connections to Windows 2000 printers and connect to newly specified Windows 2000 printers.

Con2prt Topics

  • Con2prt Syntax
  • Con2prt Examples

File Required

  • Con2prt.exe


Con2prt Syntax

One Step con2prt [ /? | /h | /f | [/c \\printserver\share | /cd \\printserver\share]+]

Where:

/? | /h
displays usage.
/f
deletes all existing printer connections.
/c
connects to printer at \\printserver\share.
/cd
connects to printer at \\printserver\share and sets it as the default printer.

Notes

  • The /? and /h parameters can only be the first parameter. If these switches are specified, further interpretation of the command line is stopped. The /f parameter can also only be the first parameter, but it does not stop further interpretation of the command line. Any number of /c and /cd parameters can be specified; however, only the first /cd sets the specified printer as the default.
  • Use the command Net View \\printserver to determine available print shares.


Diskuse Syntax

Diskuse.exe Topics

Diskuse.exe Syntax

One Step diskuse [path] [switches]

Where:

path
can be a full path, relative path, or UNC. If no path is specified, the current directory is assumed. Examples of acceptable paths:

C:\USERS   USERS\BILL   \\SERVER\SHARE\USERS
switches
are any of the following. If no switches are specified, subdirectories are not scanned and the results are displayed in the default format.
/f:file

Store the output in a file instead of displaying it on the screen. The file name can be a full name, relative name, or UNC. If Table Mode (described below) is specified, the file is comma-delimited. If you specify Table Mode and end the file with a '.csv' extension (Comma Separated Values), it can be directly loaded into a Microsoft® Excel spreadsheet.

Examples:

/F:OUTPUT.TXT   /F:C:\SCAN.DAT   /F:\\SERVER\SHARE\DATA.CSV
/e:file
Store all error and warning messages in a file instead of displaying them on the screen. The file name can be a full name, relative name, or UNC.

Examples:

/E:ERROR.LOG   /E:C:\DISKUSE.ERR   /E:\\SERVER\SHARE\LOG.ERR
/u:user
Only scan for and report information about a specific user. The user name should be in the format DOMAIN\USERNAME. If no domain is specified, it uses the first instance of the user it can find.

Examples:

/U:DOMAIN\USERNAME   /U:USERNAME
/s
Scan all subdirectories of the path specified.
/t
Output is in a table format. If the output is going to a file, the table is comma-delimited. If the output is going to the screen, the table is space-delimited.
/w
Unicode Output (Wide Characters). By default, all output is in ANSI characters. Use this switch if you have Unicode file names on your server and wish to have them reported in Unicode format. Unicode is still read, even if this switch is not present. This switch only effects the output.

note-icon

Note

Most command windows cannot display Unicode characters, so the output may not be displayed correctly. If you send the output to a file, make sure that the program you are using to read the file supports Unicode as well (for example, Notepad)

/q
Quiet Mode. No information is displayed on the screen. If this is used without the /F switch, the program is basically useless. If this is used without the /E switch, you will not get a report of any errors or warnings.
/? | h
Command-line help.


Glossary of Terms

- A -

ACE

ACL

ACS

Active Directory

ActiveX™

Admission Control Service

API

associate

- B -

backup domain controller

basic input/output system

batch program

BDC

BIOS

browser

- C -

CDE

CGI

checked build

cluster

code page

COM

Common Gateway Interface

Component Object Model

CRC

Cyclical Redundancy Check

- D -

daemon

Dfs

DHCP

directory

directory service

distinguished name

Distributed File System

DLL

DNS

domain

domain controller

Domain Name System

Dynamic Host Configuration Protocol

dynamic-link library

- E -

Encrypting File System

environment variable

EFS

- F -

FAT

FAT32

fault tolerance

File Transfer Protocol

filter

Flexible Single Master Operation

flow

forest

frame

FTP

FSMO

- G -

gateway

globally unique identifier

Group Policy

Group Policy object

GUI

GUID

- H -

HAL

handle

Hardware Abstraction Layer

heap

heap manager

hierarchical storage management

High-Performance File System

hive

HOSTS

HPFS

HSM

HTML

HTTP

Hypertext Markup Language

Hypertext Transfer Protocol

- I -

infrastucture master

Internet Protocol

Internet Server Application Program Interface

IP

IP address

IPX/SPX

ISAPI

- J -

Jet

- K -

KCC

KDC

Kerberos

kernel

kernel mode

key

key distribution center

Knowledge Consistency Checker

Korn shell

ksh

- L -

LAN

LDAP

Lightweight Directory Access Protocol

local area network

Local Security Authority

LSA

- M -

MAC

Management Information Base

Master Boot Record

MBR

Media Access Control

MIB

Microsoft Management Console

mirror set

mixed mode

MMC

- N -

namespace

native mode

NetBEUI

NetBIOS

NTFS

NTLM

- O -

Object Linking and Embedding

ODBC

OLE

Open Database Connectivity

organizational unit

OU

- P -

packet

page fault

partition

partition table

path

PCMCIA

PDC

Performance Monitor

permissions

POP

POSIX

Post Office Protocol

primary domain controller

process

protocol

- Q -

QoS

Quality of Service

quorum disk

quorum disk

quorum log

quorum resource

- R -

RAS

Reduced Instruction Set Computing

Regedit.exe

registry

Registry Editor

relative identifier

Remote Access Service

Remote Procedure Call

Remote Procedure Call service

Removable Storage

replication

Request for Comments

Resource Reservation Protocol

RFC

RID

ring transition

RISC

router

RPC

RPC service

RSVP

- S -

SAM

schema

script

SCSI

Security Accounts Manager

security descriptor

security identifier

server cluster

Server Message Block

service

sh

shell

SID

Simple Mail Transport Protocol

Simple Network Management Protocol

site

Small Computer System Interface

SMB

SMTP

snap-in

SNMP

socket

SQL

status area

STDERR

STDIN

STDOUT

stripe set

stripe set with parity

Structured Query Language

subnet mask

symbol files

System Volume

sysvol

- T -

TAPI

TCP/IP

TDI

Telephony API

telnet

thread

touch

Traffic Control

Transmission Control Protocol/Internet Protocol

Transport Driver Interface

transport protocol

tree

trust relationship

- U -

UDP

UNC

Unicode

Uniform Resource Locator

Universal Naming Convention

Universal Serial Bus

UNIX

update sequence number

URL

USB

User Datagram Protocol

user profile

USN

UUEncoding/Decoding

- V -

volume set

- W -

WAN

wc

wide area network

Windows® Internet Name Service

WINS

word count

- X -

X.500

- Y -

No entries

- Z -

No entries


Glossary of Terms

A B C D E F G H I J K L M
N O P Q R S T U V W X Y Z
To copy or print a glossary definition from a popup window, select the text in the popup window using the left mouse button, right-click the selected text, and on the menu that appears click Copy or Print. In the Print dialog box under Print Range, choose Selection.


InUse Examples

  • Replace a local existing file with an updated remote version.

    inuse \\IMACOMPUTERNAME\winnt\test.dll e:\winnt\test.dll

    InUse - version 1.4
---------------------------------------------------------------------------
Copyright (c) 1994-1999 Microsoft Corporation. All rights reserved
Windows 2000 detected - WFP is enforced

INUSE is about to replace the following file

        Existing:    e:\winnt\test.dll
        1.4

        Replacement: \\IMACOMPUTERNAME\winnt\test.dll
        1.4

Do you want to continue?(y/n) y

        \\IMACOMPUTERNAME\winnt\test.dll is replacing --> e:\winnt\test.dll

Changes will not take affect until you reboot.
  • Replace multiple files via a batch script.
       batch.cmd
   @echo off
   inuse test.dll c:\winnt\system32\test.dll /y
   inuse test2.dll c:\winnt\system32\test2.dll /y
   inuse test3.dll c:\winnt\system32\test3.dll /y
   shutdown /l /r /y


LogTime Syntax

One Step logtime [text_string] [/?]

Where:

text_string

specifies the message you want to display.

/?

displays usage instructions.

Sample batch file: Go.bat

logtime "begin import program"

import.exe

logtime "end import program"

Logtime.log output for Go.bat

05/27/96 13:14:19 begin import program

05/27/96 13:15:07 end import program


CC Command Information

Before using cc, you need to:

  • Go to your system's Mstools folder and copy Link32.exe to Link.exe.
  • Customize your environment. Some of the variables that you will need to set are:

    • MAKEPATH=location of default make rules

    PATH=location of cc executables

    POSIX_INC=location(s) of default include files

    POSIX_LIB=location of default libraries

    SHELL=full path of Korn shell

    Notes These variables need to contain POSIX-style paths, not NTFS-style paths; yet the only paths that need to be added by using the System icon in Control Panel are POSIX_INC and POSIX_LIB. The best place to enter the other variables is in your profile file (the file pointed to by the ENV environment variable). Also:

    • The MAKEPATH variable needs to contain the folder where the default make rules files (that is, the contents of the Mk-rules.zip archive) are installed.
    • The PATH variable needs to include the folder where the cc executables reside, in order to be able to run them from anywhere.
    • The POSIX_INC variable needs to have the location(s) of the default include files. If more than one folder is required in POSIX_INC, then separate the folders with colons. Order is significant; folders listed first will be searched first.
    • The POSIX_LIB variable needs to be set to the location of the default libraries. The SHELL variable needs to point to the full path of the Korn shell executable (including any .exe extention).


SH Command Information

Before using the shell, you may need to customize your environment. Some of the environment variables that you may want to set are:

ENV=location of .profile equivalent

PATH=location of sh executable

TZ=appropriate timezone

  • The ENV variable contains the full path of a file that contains shell commands that you want to run initially, for example, creating aliases, customizing prompts, and so on.
  • The PATH variable needs to include the folder where the sh resides, in order to be able to run it from anywhere.
  • The TZ variable should be set according to your location on the planet; for example, for residents of Oregon it should be set to "PST8PDT", translated as "normally Pacific Standard Time, eight hours behind Coordinated Universal Time, during the summer Pacific Daylight Time".

A sample .profile file may look something like this:

alias a=alias

alias md=mkdir

alias rd=rmdir

alias ua=unalias

set -o vi

PS1='[!] '

These commands set four aliases, make available vi-style command-line editing, and set the prompt to display the current command number inside of brackets. For a more complete view of what the shell can do, see a good book on the subject, such as Bolsky & Korn's The KornShell Command and Programming Language, published by Prentice Hall (ISBN 0-13-516972-0).

There is an extension to the typeset built-in command, a "-p" parameter, representing POSIX customization of an environment variable.

For example, if there were a variable named GLOP that contained "C:\users\default\telnet.trm", applying typeset -p GLOP to it would result in GLOP having the value "//C/users/default/telnet.trm".

The converse command, typeset +p GLOP, would "de-POSIX-ize" the variable, leaving the original value in GLOP.

Note that Windows 2000 environment variables that reference other Windows 2000 environment variables, for example, SET LOGNAME=%UserName%, will not be expanded inside of the shell; such variables will have the unexpanded value—for example, LOGNAME would contain "%UserName%", not "Administrator".


VI Command Information

Before using vi, you need to customize your environment. Some of the environment variables that you need to set are:

PATH=location of the vi executable

TERM=ansi

TERMCAP=location of termcap equivalent

_POSIX_TERM=on

  • The PATH variable needs to include the folder where the vi executable file resides, to be able to run it from anywhere.
  • The TERM variable needs to have a value that matches an entry in the TERMCAP file; by default, this entry is named "ansi".
  • The TERMCAP variable contains the full path of the termcap file. You should customize the entry in the termcap file according to your typical command prompt window size; if you usually use a window that's not 80 columns by 25 lines, change the co entry to match the number of columns, and change the li entry to match the number of lines. For example, if you normally use a 100 column by 60 line window, the co entry would be "co#100" and the li entry would be "li#60".
  • The _POSIX_TERM variable must be set to "on" to use the terminal emulation portion of the POSIX server.


Troubleshooting RsmConfg

  • Once changers are manually configured, they are no longer auto-configurable. Therefore, any device configuration change will not be detected by Removable Storage.
    note-icon

    Note

    Using RsmConfg is the same as a manual configuration.

  • To access the changer and mount media, the Removable Storage service must be stopped. If you do not the permission to stop the service you will see an error message.
  • All stand-alone drives should be empty when RsmConfig starts. As Removable Storage might confuse some changer drives with stand-alone drives, unload media from any changer drives. As a guide, the wizard will display the drive name(s) containing media.
  • If the unconfigured changer does not contain any media, you must inject media in that changer. Otherwise, mapping won't occur.
  • If it is not possible to communicate with the changer or any of the drives, the manual configuration wizard won't work and you will see the appropriate error message.
  • The registry entry HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ NtmsSvc\Config has one subkey for each changer.

    If the changer is accessible, but auto-configuration failed to map properly, the DriveNumbers data for that changer subkey will have a correct value and there will be a ??? entry for each unmapped drive bay.

    This indicates the manual configuration wizard will work. If these entries are not created when Removable Storage starts up, then the manual wizard also will not work.


Using RsmConfg

Removable Storage Manual Configuration Wizard aids in manually configuring robotic library units which the auto-configuration feature of Removable Storage fails to configure.

  1. The wizard scans for all stand-alone drives in the system. Some of these may belong to a changer.
    note-icon

    Note

    If media is present in any stand-alone drives, you must eject it. The wizard cannot continue until all stand-alone drives are empty.

  2. The wizard displays a list of all changers which Removable Storage failed to configure. Select the one you want to configure.
  3. The wizard mounts a media to each of the unmapped drive bays of the selected changer. At this point you have two options:
    • Select the slot number that has media.
    • Let the wizard scan the changer to find a slot with media.
  4. If there is no media in any slot, insert media for the wizard to continue.
  5. The wizard scans the standalone drive list and discovers which drive is loaded. That drive is mapped to the unmapped drive bay of the changer. The result of the mapping is displayed. This step is repeated for all unmapped drive bays.
  6. Once a changer is successfully configured, you can select another unconfigured changer. As each changer is configured, the appropriate registry entries are updated and the changer is made accessible.