Taking Ownership of a Resource

It is inevitable that someone will lose access to a resource. Of course this can only happen if you are using the NTFS file system. Assuming you have Administrator privileges, you can easily solve the dilemma by taking ownership of the resource and then sharing it (with full control) to the person who needs access so they can gain ownership of the resource. This action normally occurs when someone leaves an organization. Exercise 14-7 shows you how to gain ownership of a resource and then allow someone else to take ownership of it. In the exercise Steven is the person who quits the organization and Marissa is the new employee.

Exercise 14-7 Taking Ownership of a Resource

1. Log on your system as Administrator and create two new user accounts named Steven and Marissa.
2. Log off the system and log back on as Steven. Create a folder named StevenTest and set the permissions so only Steven has access to it. This folder will be the one that Marissa needs to access in order to retrieve valuable data.
3. Log off the system and log back on as Marissa. Try to access the StevenTest folder.
4. Log off the system and log back on as Administrator.
5. Open Windows NT Explorer and right-click the StevenTest folder.
6. Select Properties and choose the Security tab.
7. Select the Ownership button.
8. Select the Take Ownership button. The system prompts you with a dialog box stating that one or more of the items is a directory. Click the Yes button.
9. Select the Permissions button and give Marissa full control of the StevenTest folder.
10. Select the OK button.
11. Select the OK button.
12. Log off the system and log back on as Marissa.
13. Access the StevenTest folder and follow steps 5-8 to gain ownership of the folder.

Server Crashes

Server crashes are the worst thing that can happen to your Windows NT Server—especially if it is the Primary Domain Controller (PDC) in your network and you have no Backup Domain Controllers (BDC) to fall back on. This section describes how to use the System Recovery Utility and Task Manager to assist you when your system crashes.

System Recovery Utility

Windows NT features a Recovery utility that can perform selected tasks in the event of a STOP error. You configure the recovery options on the Startup/Shutdown tab of System Properties, which is shown in Figure 14-7.

Most of the Recovery options are self-explanatory; however one option is worth singling out. Automatically reboot allows your system to quickly return to normal operation after a system crash and eliminates the need to reboot manually.

The most important part of the Recovery utility to use for troubleshooting is the option Write debugging information to. When this option is checked and a STOP error occurs, the entire contents of memory are dumped to the pagefile. When your system restarts this information is copied automatically from the pagefile to the filename you specified in the Recovery option block.

Since the entire contents of your system’s memory are dumped to the pagefile, the pagefile must be as large as the amount of physical memory installed in your system. So, a system that has 64 megabytes of physical memory needs to have a pagefile that is at least 64 megabytes. One other caveat is that the pagefile must be located on the boot partition. Exercise 14-8 gives you a chance to configure your system for memory dumps.

Exercise 14-8 Configuring for memory dumps

1. Select Start | Settings | Control Panel.
2. Double-click the System applet and select the Startup/Shutdown tab.
3. Under Recovery, select the Write debugging information to box. You may either accept the default path and filename or pick one of your own.
4. If you want the next memory dump to overwrite any file that has the same name, select the Overwrite box. If you leave this block unchecked, Windows NT will not write a memory dump file if a file with the same name already exists.

Task Manager

At this point the Task Manager should be very familiar to you. Let's look at one more function that it can perform to help in troubleshooting your system. It has the capability to end a task that may be causing your system to hang. Under normal operating conditions you will see the word "Running" in the status column, as shown in Figure 14-8. If a task is no longer responding then the words "Not responding" are in the status column. Exercise 14-9 leads you through the process of shutting down a task.

Exercise 14-9 Shutting down a task with Task Manager

1. Use your right mouse button and click once on the Taskbar.
2. Select Task Manager from the menu.
3. Click on the Start button and select Programs | Accessories | Paint.
4. Click on the Start button and select Programs | Accessories | Clock.
5. Click on the Start button and select Programs | Accessories | Notepad.
6. Select the Applications tab on the Task Manager. You will see the three applications that you just started; to the right of each application is its Status.
7. Let's assume that the Clock application has run rampant and is using 100 % of the CPU; it needs to be shut down. Click on Clock to highlight it, then click the End Task button.
8. In a real situation when a task is not responding, you would receive a message sthat explains the task is not responding and asks if you would like to wait. Click End Task.
9. Close all remaining applications that are running.
10. Close the Task Manager.

STOP Error—the "Blue Screen of Death"

The words "blue screen of death" are about the worst thing you can tell someone about their Windows NT Server. The blue screens are actually text mode STOP messages that identify hardware and software problems that have occurred while running Windows NT Server. The reason for producing the blue screen is to visibly alert users to the fact that an error message has been generated. The blue screen is intended to provide information to help in troubleshooting the problem, rather than allowing the system to fail in an "invisible" manner. As shown in Figure 14-9, the "blue screen of death" consists of a STOP message, the text translation, the addresses of the violating call, and the drivers loaded at the time of the STOP screen. If you have configured your system to write debugging information, it will also generate that file.

Even though the "blue screen of death" can look intimidating, in most cases you need to use only a small amount of the displayed data to help determine the cause of the error. The further interpretation of STOP errors is beyond the scope of this book.

From the Classroom

Troubleshooting to Fix Actual Problems (What a Novel Idea!)

We have many opportunities to see students and clients troubleshoot real live problems. It can really be an interesting experience. We have probably learned most about what to do—and what not to do—as we watched our clients try to troubleshoot problems. We are always amazed at how thoroughly students can "hose" (that’s technical talk for "render inoperable") their classroom computers! And even when the instructors have no idea what is wrong or how to fix it, they must restore the machine, so that the students can continue the class exercises. In these cases, we tell the students not to worry—in the Saturday makeup class (the one that starts at 6:00 a.m.) we'll show them how to not do what they just did.

Not surprisingly, the most critical part of troubleshooting is to identify the problem. Many people waste countless hours troubleshooting issues that are not the real problem or not even related to the problem. This is the number one "gotcha." To identify the problem, you first have to collect information—even before you begin to act. For example, let's say data is continually corrupted on your hard drive. What is the problem? In an actual case, we watched a client troubleshoot the drives and the controller, even to the extent of replacing both several times, without ever fixing the "problem." The real problem was that memory was being used for write cache. The original drive and controller were good.

A closely related tactic is troubleshooting the symptom rather than the problem. This is the number two "gotcha." In one vivid example (and our personal favorite), a user called to say they were unable to connect to a remote server. To address this problem, the technician repeatedly connected their own computer to the remote server. Now most of you just said, "Well, what's wrong with that?" But the technician was troubleshooting the symptom (the user could not connect to the server), not the problem. They found out it was possible to connect. So what? How did that help the user? And did that help find the problem? You're probably saying, "At least they eliminated the 'server is down' issue." But was that an issue? If the server were down, you would have much more evidence than this single user's complaint. In this case, we finally checked the System log on the user’s computer and found that the protocol did not initialize, because the adapter drive failed to bind, because the NIC had failed. The failure of the network card was the "problem." The user's inability to connect to the server was only a symptom.

One huge "gotcha" is breaking the rule to "change only one thing at a time." When troubleshooting any problem, change only one simple variable. Study the effects of that change. If there is no change, reset that variable to its original state, change another variable, and re-test. This step-by-step approach lets you isolate what went wrong so you'll be able to correct it. But just as important as correcting the problem is learning from the experience. When technical people are surveyed and ask to identify the most important factor in successful troubleshooting, more than half say that prior experience with the problem is the most helpful piece of information they need. You get prior experience by successfully fixing the problem. That means you learned what was wrong and what you did to fix it. If you changed multiple variables and the problem went away, you did not learn what the problem was—or even what you did to fix it! The next time the problem occurs, you won’t know any more than you did before.

Good Luck! Just remember—troubleshooting can be fun!

Using Microsoft Resources

Having access to a variety of troubleshooting resources will make your life much easier when dealing with Windows NT Server. This section describes some resources that are available to you.

Microsoft Web and FTP sites

Microsoft maintains World Wide Web (WWW) servers and FTP (File Transfer Protocol) servers that can provide you with updated drivers, current product information and more. The WWW address is www.microsoft.com and the FTP address is ftp.microsoft.com. The FTP site allows anonymous logons, so feel free to explore the site.

Microsoft Service Packs

Microsoft periodically issues a Service Pack to fix bugs that have been detected in the Windows NT operating system. At the time of this writing the latest service pack issued was Service Pack 3.

Obtaining a Service Pack

The latest Service Pack can be ordered by phone from Microsoft or obtained from their FTP site. The FTP address for Intel-based machines is ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/ussp3/i386.

Service Pack Pre-Installation

There are several measures you should take to prepare your system for installing a Service Pack.

Installing a Service Pack

Another thing you need to do before installing a Service Pack is to read the README.TXT file that comes in the archive to see what bugs have been fixed and if there are any peculiarities that may affect the installation on your system. Installing a Service Pack is not a complex task. There are only a couple of decisions that need to be made; if in doubt, it is wise to err on the side of caution because a Service Pack can render your machine inoperable. Exercise 14-10 shows you how to install Service Pack 3.

Exercise 14-10: Installing a Service Pack

1. Obtain Service Pack 3 (nt4sp3_i.exe) via FTP from ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/ussp3/i386. Save the executable file to a folder.
2. Select Start | Programs | Windows NT Explorer and open the folder where you stored the Service Pack archive.
3. Double-click the nt4sp3_i.exe file. The executable starts extracting files to a temporary location and automatically starts update.exe. After the files have been extracted, you see a Welcome screen that explains the procedure. It is wise to follow the instructions about updating your ERD and backing up all system and data files.
4. Click the Next button to display the Software License Agreement. Read it and click the Yes button.
5. Service Pack Setup prompts you to pick the type of installation desired. Make sure the "Install the Service Pack" radio button is selected and click the Next button.
6. The next screen asks you if you want to create an Uninstall directory. As always, it is wise to err on the side of caution. Make sure the "Yes, I want to create an Uninstall directory" radio button is selected and click the Next button. If you do not create an Uninstall directory you will not be able to use the Uninstall feature of the Service Pack.
7. The next screen tells you that the program is ready to install the Service Pack. Click the Finish button to complete the process. The Service Pack will change only those files that were originally set up on your system.

Reapplying a Service Pack

Do not delete the Service Pack archive from your system because any time you change hardware or software on the system you must reapply the Service Pack. When you reapply it you also need to tell the program to create a new Uninstall directory.

Removing a Service Pack

You may find that the Service Pack does not function correctly on your system. If this happens you will need to remove it from your system. Keep in mind that you can only uninstall the Service Pack if you originally installed the Service Pack with the Uninstall directory option selected. Exercise 14-11 shows you how to remove a Service Pack from your system.

Exercise 14-11 Removing a Service Pack

1. Select Start | Programs | Windows NT Explorer and open the folder where you stored the Service Pack archive.
2. Double click the nt4sp3_i.exe file. The executable starts extracting files to a temporary location and automatically starts update.exe. After the files have been extracted, you see a Welcome screen that explains the procedure.
3. Click the Next button to display the Software License Agreement, then click the Yes button.
4. Service Pack Setup prompts you to pick the type of installation desired. Select the "Uninstall a previously installed Service Pack" radio button and click the Finish button.
5. When your system restarts, the Update.exe program replaces the files that were updated by the Service Pack with the files from the previous installation.

The Knowledge Base

The Knowledge Base contains support information developed by Microsoft Product Support Specialists for problems that they have solved. We cannot stress enough the value that the Knowledge Base can provide. It is often the first place we will look when faced with an unusual problem. If we are having this problem there's a good chance that someone else has already encountered it. The Knowledge Base is available in many different places. It can be accessed on Microsoft’s WWW site, the TechNet CD’s, and Resource Kit CD’s.

TechNet CD-ROM

The TechNet CD’s are an invaluable tool for supporting any Microsoft product. We have already mentioned the TechNet CD’s in earlier discussions of troubleshooting. There are more than 1.5 million pages of technical documentation available on the TechNet CD’s—along with drivers, updates, and Service Packs. TechNet is available by yearly subscription and delivers new CD’s to you every month as they are updated.

Resource Kits

The Resource Kits contain detailed information that is an in-depth, technical supplement to the documentation included with the product. Resource kits also come with a CD that is full of very useful utilities. Resource Kits can be obtained from your local dealer; they are also included on the TechNet CD’s.

Help

Windows NT Help is just a few mouse clicks away. Help is available in three different contexts. You can use the Contents tab in Help to find topics grouped by subject, use the Index tab to find specific topics listed alphabetically, or use the Find tab to search for information by typing in a subject, title, specific word or phrase. Figure 14-10 displays the Help Index tab. Exercise 14-12 gives you an opportunity to use Help to find a specific phrase.

Exercise 14-12: Opening Help files

1. Select Start | Help. The Help Topics window is displayed.
2. Select the Index tab and type netwo in dialog box 1.
3. The words "network adapter" are highlighted in dialog box 2.
4. Double-click "network adapter" to see the Topics Found dialog box.
5. Double-click "To install a network adapter" to receive help on that topic.
6. Close Help after you read the information displayed.

When you install Windows NT Server it is essential to verify that your hardware is on the Hardware Compatibility List. Installation errors can occur either during the text-based mode or the graphical mode of Setup. Windows NT Server comes with two utilities that can help identify hardware prior to installation—NTHQ and SCSITOOL.

Troubleshooting configuration errors can be a frustrating process. Problems can include a variety of boot failures in which you may need to use the Last Known Good configuration or the Emergency Repair Disk. Other tools available to help with troubleshooting Windows NT Server are the Event Viewer and Windows NT Diagnostics (WinMSD).

Disk problems can cause difficulties even after you are logged on to your system. Two of the most common errors are encountering unknown volumes and extended partition problems.

If you have a fault-tolerant configuration, you may have to recover from a RAID problem. These problems affect both RAID 1 and RAID 5 sets. Regenerating a stripe set with parity will reconstruct the data from the remaining members to a new drive. The method you use to fix a mirror set depends on whether it is the member or system partition that no longer functions correctly.

Printing problems can be difficult to troubleshoot because of the many variables involved.Two particularly complicating factors are the number of diverse clients supported by NT server and the number and variety of print devices supported. One of the most common printing problems is running out of hard disk space for the spooler.

Remote Access Service troubleshooting for Dial-Up Networking clients can be improved by enabling two log files via your Registry—PPP.LOG and DEVICE.LOG.

Network problems can be very tough to troubleshoot because there are many components where something can go wrong. Some of the more common malfunctions include protocol mismatches between systems and the use of incorrect frame types on an IPX/SPX network.Permission problems often become a problem when you create a share on the network that uses NTFS. You have to be cognizant of not only the share permissions but also the NTFS permissions. In some situations you may need to take ownership of a resource to clear up an existing security and permission problem.

System recovery can actually help in troubleshooting by providing a dump of your physical memory that can be further analyzed when appropriate. If you have an application that stops responding, you can use the Task Manager to shut it down. The STOP error, better known as the "blue screen of death", identifies hardware and software problems that have occurred. The "blue screen of death" can be very intimidating and is something that no one who deals with Windows NT looks forward to seeing. It reflects that a serious problem has occurred, but it does provide a good deal of information to help you find out what caused the STOP error.

There are many resources available to help you keep Windows NT Server running successfully. One of the most valuable is the Microsoft Service Pack, which is issued periodically after a significant number of bugs have been fixed. Service Packs can be obtained from the Microsoft FTP site. Installing a Service Pack is not an especially complex task, but you should make a backup of your system and examine the readme.txt file before you begin the installation. Other resources available include Microsoft’s World Wide Web and FRP sites, the Microsoft Knowledge Base, the TechNet CD subscription, and the on-line Help files included with Windows NT.

Review Questions: Just read, or Click HERE to launch interactive Self Test

The following questions will help you measure your understanding of the material presented in this chapter. Read all the choices carefully, as there may be more than one correct answer. Choose all correct answers for each question.

1. Which of the following is a valid ARC path?

1. multi(0)diskrdisk(0)partition(0)\winnt="Windows NT Version 4.0"
2. multi(0)disk(0)rdisk(0)partition\winnt="Windows NT Version 4.0"
3. scsi(0)diskrdisk(0)partitionwinnt="Windows NT Version 4.0"
4. scsi(0)diskrdisk(0)partition\winnt"Windows NT Version 4.0

2. What files are required to be on a Windows NT boot disk for a non-SCSI, Intel-based machine?

1. NTLDR
2. BOOT.INI
3. NTBOOTDD.SYS
4. OSLOADER.EXE
5. NTDETECT.COM

3. You are sent out on a trouble call and told that the system hangs since the user added a new video driver. What would you do?

1. Use the Emergency Repair Disk to replace the Registry
2. Boot the system with a Windows NT boot disk
3. Reboot the system and choose the Last Known Good configuration
4. Reload Windows NT Server on the system

4. Your system has 128 megabytes of physical memory and you have set the System Recovery to write debugging information to %systemroot%\memory.dmp. What else needs to be done to ensure that the debugging information will be saved?

1. Your pagefile has to be at least 128 megabyte
2. Your pagefile has to be smaller than 128 megabyte
3. Your pagefile has to be located on a partition other than where Windows NT Server is installed
4. Your pagefile has to be equal to the size of your boot partition

5. Paul has been fired and his replacement Ann needs to access the 4th quarter report that is located in a folder that belonged to Paul. How will Ann be able to access this folder?

1. Have Ann log onto the system and take ownership of the folder
2. Have Paul come back to work so he can give Ann access to the folder
3. Have an Administrator log on the system and assign ownership of the directory to Ann
4. Have an Administrator log on and take ownership of the folder, then give Ann full control of the folder

6. To update you Emergency Repair Disk you would type _________from a Command Prompt.

1. fdisk
2. rdisk
3. ERD
4. update
5. repair

7. (True/False) A Service Pack can be easily removed from your system even if you do not have the uninstall folder.
8. What causes the "blue screen of death"?

1. a STOP message
2. a HALT message
3. a SEVERE message
4. a CRITICAL message

9. The Partition(n) portion of an ARC name starts counting with _____

1. 0
2. 1
3. 2
4. 3

10. A system you have been sent out to troubleshoot will not boot. You attempt to use the Last Known Good configuration and it does not correct the problem. What would you do next?

1. Format the drive and reload Windows NT Server
2. Use the Emergency Repair Disk for that system
3. Use your Windows NT boot disk to replace a missing script file
4. Use the Emergency Repair Disk for the neighboring system

11. (True/False) The SAM and Security files are automatically updated when you use the Repair Disk Utility.
12. (True/False) The fault-tolerant boot disk must be used if the member drive of a mirror set is orphaned.
13. The fault-tolerant driver detects an orphaned drive on your RAID 5 set. What is the result?

1. The system will be shut down automatically
2. Data will be corrupted
3. The system will continue functioning with no system degradation
4. The system will continue functioning with some system degradation

14. What would cause a system on a network that uses the IPX/SPX protocol to not communicate with any other systems on the network?

1. The IPX/SPX protocol has not been installed
2. TCP/IP is not functioning correctly
3. The frame type is incorrect
4. The default gateway is incorrect

15. A user attempts to print but the print job never completes and the hard drive thrashes a lot. What could be causing this to happen?

1. The print spooler is stalled
2. The print spooler has run out of hard drive space
3. The print spooler priority is set to high
4. The printer has not been installed

Answers to Chapter 14 Self Test

1. B. The only choice that fulfills ARC naming requirements is B.
2. A, B, E. The other two files are used for SCSI systems and RISC-based machines.
3. C. Reboot the system using the Last Known Good Configuration with the original video driver.
4. A. The pagefile has to be at least the same size as physical memory so that it can dump everything from memory to the pagefile for debugging.
5. D. An Administrator will have to take ownership of the folder, but by giving Ann full control she will be able to access the folder and take ownership for herself.
6. B. You would type rdisk from a Command Prompt to update your ERD.
7. False. If you did not create an Uninstall folder, you will not be able to easily remove the Service Pack.
8. A. A STOP message will cause the "blue screen of death".
9. B. The partition(n) starts with a count of one.
10. B. You should use the ERD for that system to try and fix it.
11. False. You must use the /s switch with rdisk if you want to backup the SAM and Security files.
12. False. The fault-tolerant boot disk only needs to be used if the failure involves the system partition. Your system will boot on its own when the member partition has failed.
13. D. The system will continue to function, however it will have some system degradation as the data from the orphaned drive will have to be regenerated in physical memory as it is needed.
14. A, C. If the system cannot communicate with other systems on an IPX/SPX network then make sure the protocol has been installed and that it is using the correct frame type.
15. B. The spooler has run out of disk space. You need to create more room or move the spooler to another partition that has more room.