Troubleshooting Software Module 14

Summary Boot Problems System-Tools Error Messages and Codes Startup Modes Recovery and Backup Tools Troubleshooting Tools

3 End User The troubleshooting process usually begins with the end user, because they have the most valuable information. After talking to the end user to find out what they were doing and what application they were using when they began experiencing the problems, it is a good idea to start by reproducing the error symptoms.

4 System Boot Problems The boot up procedure that starts the computer system reveals a lot about the health of the system. Observing the steps of a boot up process can reveal a great deal about what is causing problems in the system. One tool that every system administrator should have is a bootable disk. Often systems have issues that cannot be resolved, or the operating system has become so corrupt that despite all efforts the system will not start or boot up. A bootable disk allows administrators or service technicians to boot from a diskette instead of the hard drive.

5 System Boot Problems The COMMAND.COM program is known as the command interpreter. It is the most important system file, since the computer cannot boot without it. COMMAND.COM contains the operating system's most commonly used commands. When DOS runs an application, COMMAND.COM finds the program and then loads it and gives it control of the system.

6 System Boot Problems Bootable Configuration Files –CONFIG.SYS –AUTOEXEC.BAT

7 CONFIG.SYS Contains setup or configuration instructions Configures DOS programs for use with devices and applications Set up Memory Managers

8 AUTOEXEC.BAT Looks for after CONFIG.SYS List of DOS commands that will automatically execute when DOS is loaded Not necessary for system to boot

9 DOS Error Messages Bad or Missing COMMAND.COM In the DOS environment, the "Bad or Missing COMMAND.COM" error message is common. There are a few things that might cause this error message to appear. The COMMAND.COM file cannot be found on the hard drive. The COMMAND.COM file is not located in the hard drive root directory (this usually occurs when a new hard drive or operating system is installed). The end user accidentally erases the COMMAND.COM file from the root directory of the hard drive.

10 DOS Error Messages Extended Memory Access (HIMEM.SYS) DOS 4.0 versions and above have a memory management program called HIMEM.SYS that manages the extended memory above the 1024 KB level. When this utility is loaded into memory it shifts most of the operating system functions into the High Memory Area of extended memory. In Windows 98, the HIMEM.SYS statement must be present and correct for the operating system to run. Also, check and make sure that the HIMEM.SYS file is the correct version and that it is in the correct location.

11 DOS Error Messages Expanded Memory Access (EMM386.EXE) The EMM386.EXE program provides the system with access to the Upper Memory Area (UMA) of RAM. This program operates together with the HIMEM.SYS utility and provides the system with the capability to conserve conventional memory by moving device drivers and memory- resident programs into the UMA. Some common troubleshooting issues with this program occur when conflicts exist in the allocation of the upper memory blocks. This might happen if there is a missing or incorrect HIMEM.SYS file or there are conflicting third party drivers.

12 Troubleshooting Startup Problems MSCONFIG.EXE –Type in command line –Used to load system tools –Used to load drivers and software options –Used to view CONFIG.SYS & AUTOEXEC.BAT

13 Windows Memory Usage Problems Windows core files affected if a Windows memory error exists are: –KRNLXXX.EXE –GDI.EXE –USER.EXE These files might be damaged after restarting the Windows.

14 General Protection Fault A General Protection Fault (GPF) occurs when one of the operating system applications attempts to access an unallocated memory location. General Protection Faults are usually the result of programs that use illegal instructions to access areas of memory that have been protected.

15 Error Codes Error codes that are generated at system startup usually indicate hardware problems, configuration problems, or boot up problems that are associated with the operating system. If the "no operating system found" error message appears during startup, the most likely culprits are either a failed hard drive or a damaged or corrupted master boot record (MBR). To troubleshoot the problem, first check to make sure that the hard drive is properly installed and that all the cables are properly installed as well. If the problem persists, start from a boot disk containing FDISK.EXE, then use the FDISK.EXE/mbr command to fix the master boot record on the hard drive.

16 Error Codes The "illegal operation" designation covers a wide range of errors. The most common causes of an illegal operation include problems between that program and a software driver in the operating system, or memory-management problems between the program and an open program in the background. Problems and conflicts with different Dynamic-Link Library files (DLL files), which are added to the system when software programs are installed, can also cause illegal operation errors.

17 SFC Utility System File Checker Utility Command-line utility Scans the OS files to ensure correct MS version Will replace OS file with correct version

18 Shutdown Problems Application processes can be shut down manually using Ctrl-Alt-Del

19 Windows 9x Startup Modes Access the Windows 9x Startup Modes by pressing the F8 key when the "starting Windows 9x" screen is displayed. The menu offers several startup options including Normal, Logged, Safe Mode, Step-by-Step confirmation, and DOS modes. These startup modes will help in troubleshooting startup issues.

20 Windows 9x Startup Modes In Normal mode, the system boots up as it normally would with all the proper drivers and registry files. The Logged mode boots up just like the Normal mode but it creates an error log that contains the performed steps and their outcomes. Safe Mode is a troubleshooting tool for Windows. Starting Windows 95 in Safe mode bypasses the current real-mode configuration and loads a minimal protected-mode configuration, disabling Windows 95 device drivers and using the standard VGA display adapter. If the problem does not occur in Safe mode, it may be a conflict with hardware settings, real-mode configuration issues, incompatibilities with legacy Windows programs or drivers, or registry damage.

21 Windows 9x Log Files SETUPLOG.TXT – created when setup fails before hardware detection. BOOTLOG.TXT – created as the system is booting up. DETCRASH.LOG – created when setup fails during hardware detection. DETLOG.TXT – created every time the detection process runs.

22 System Tools Event Viewer – monitor events. Dr. Watson – isolate and correct GPF. SCANREG.EXE – scans registry for corruption. DEFRAG.EXE – rewrites files on hard drive back to beginning of drive to simplify retrieval of data, improves drive performance.

23 System Tools CHKDSK.EXE – used to recover lost allocation units, optimizes storage space on hard drive. SCANDSKW.EXE – repair tool, checks integrity of hard drive and other media, then repairs it. MSCONFIG.EXE – used to load device drivers and software options, allows viewing of CONFIG.SYS and AUTOEXEC.BAT. EDIT.COM – view and edit config files like AUTOEXEC.BAT, CONFIG.SYS

24 Windows System Editors SYSEDIT.EXE Typing sysedit in the Run dialog box of the Start menu will open the system editor tool. The sysedit utility is used to modify text files such as the.INI files in the system, as well as the CONFIG.SYS and AUTOEXEC.BAT files. POLEDIT.EXE Use the System Policy Editor (POLEDIT.EXE) to set up different security restrictions for different users. Use it to set one policy for a whole group, configure desktops for roving users so that any computer they use will have the same look, or to protect a computer if it is unplugged from the network.

25 Registry Editors The contents of the registry can be edited and viewed through the Registry Editors. Access the registry editors by typing REGEDIT.EXE or REGEDT32.EXE at the Run command window on the Start menu. REGEDIT.EXE was initially designed to work with Windows 9x, but it will work in Windows It is recommended to use REGEDT32.EXE with Windows 2000 and REGEDIT.EXE with Windows 9x.

26 Windows 2000 Recovery Console The Windows 2000 Recovery Console is a command-line interface used to perform a variety of troubleshooting and recovery tasks. The recovery console can be started by starting the system with the Windows 2000 setup disks or the CD, and selecting the option when prompted. The FIXMBR command can be used with the Recovery Console to fix hard drive problems. The FIXMBR command repairs a master boot record (MBR). The FIXBOOT command writes a new boot sector onto the system partition.

27 Windows Registry Backup & Recovery Tools Windows 95 creates a backup copy of the Registry each time the operating system is started. Windows 98 does not copy the Registry to.DA0 files when the operating system starts. Instead, it provides a program called Registry Checker. Once each day, Registry Checker, SCANREGW, backs up the Registry to a.CAB file.

28 Data Backup Procedures Backup and restore operations can take various forms. Some common examples, include normal, incremental, differential, and daily backup. –Normal backup is also known as full backup. With normal backup, all files on the disk are stored to tape, and the archive bit for all files is set to off or cleared. –A full backup that is done each day requires only one tape to restore the data, but it is impractical to run a full backup each day because of the amount of dedicated time it requires.

29 Data Backup Procedures Incremental backup procedure backs up all the files that have been created or modified since the last full or incremental backup. It is important to remember two things about an incremental backup: first, that it works only in conjunction with a full (normal) backup, and second, that any new file created or modified has its archive bit turned back on so that it will be saved to tape during the next incremental backup. Copies all the files that are new or changed since the last normal or incremental backup. The archive bit is cleared, so the files are not backed up again.

30 Data Backup Procedures Differential backup procedure backs up all the files that have been created or modified since the last full backup. This sounds the same as an incremental backup, but the difference is that even though the file is saved to tape, the archive bit is not reset. This means that each time a differential backup is done, all the files modified or created since the last full backup will be stored again (continually backed up). Daily Backup procedure backs up only the files that are modified on the day of the backup. This backup also does not reset the archive bit to off.

31 Incremental vs. Differential Backups An incremental backup where the archive bits are cleared nightly means that each nightly backup will continue to be relatively small, taking very little time. However, it also means that if a restore of the entire disk is needed, then the client will have to restore both the last full backup, then each incremental backup after that, in order to get all files to their last modified state. With a differential backup, the archive bits are only cleared during the full backup, and not on each nightly incremental backup. This means that nightly backups get gradually larger each night, but it means that if a full disk restore is needed, only two restores will be needed – the full backup, and the last differential backup.

32 Backups Restated (Extra)‏ Normal (Full) backup - copies all the files that have been selected to the backup media and marks the files as having been archived (the archive bit is cleared). Incremental - copies all the files that are new or changed since the last normal or incremental backup. The archive bit is cleared, so the files are not backed up again. Differential - copies all the files that are new or changed since the last normal or incremental backup. The archive bit is not cleared, so the files are continually backed up until the next normal or incremental backup. Daily - copies all the files that have changed on the day of the backup. The archive bit is not cleared, so any of the other forms of backup will also copy the files.

33 Network Troubleshooting Software Utilities PING.EXE - This utility is short for Packet Internet Groper. It is used to determine whether a specific IP address is accessible. It works by sending a packet to the specified address and waiting for a reply. To test the NIC to see if it is functioning properly. PING the card with its local loopback address which is

34 Network Troubleshooting Software Utilities TRACERT.EXE - is a utility that traces a packet from the computer to an Internet host. It shows how many hops the packet requires to reach the host and how long each hop takes. TRACERT.EXE utilities work by sending packets with low Time-to-Live (TTL) fields. The TTL value specifies how many hops the packet is allowed before it is returned. When a packet cannot reach its destination because the TTL value is too low, the last host returns the packet and identifies itself.

35 Network Troubleshooting Software Utilities WINIPCFG.EXE – view IP config on Windows 95, 98, ME IPCONFIG.EXE – view IP config on Windows NT, 2000, XP

36 Troubleshooting & Information Resources Troubleshooting Files that come with the operating system, there are other resources available. The Windows 9x/NT/2000 Resource Kits are very useful. There is a solution for almost every troubleshooting issue in these resource kits. They provide CDs and textbooks with thousands of pages of in-depth technical information that provide reference material when researching a problem. Another place to check for help and troubleshooting aids is on the Internet. The Microsoft website has a huge database of troubleshooting pages called the Microsoft TechNet.