Edit Environment Variables without Admin Rights

As a System Admin in an organization one always comes across a situation when users want Admin Rights because they cannot modify System Environment Variables(generally required by developers to change JAVA_HOME and CLASSPATH). However there is no need to give users Admin Rights for such small task.

Instead, they can create User Variables that override System Variables when they log on. The only exception to this rule is the PATH variable whose contents is composed of the system and user variables, separated by a semicolon.

------------------- End of Document -----------------------

Tags: Windows XP

Published Date: 20081002

Extract troubleshooting info from Windows XP BSOD error messages

Microsoft Windows XP systems are notorious for crashing for any number of reasons and in a number of ways. Some of these crashes are mild and can easily be overcome simply by closing a non-responding application or by rebooting the system. However, others are more serious and can bring the entire system to its knees. Microsoft calls these types of crashes “Stop errors” because the operating system stops responding. When a Stop error occurs, the GUI is replaced by a DOS-like blue screen with a cryptic error message followed by a code number. This screen is affectionately referred to as the Blue Screen Of Death, or BSOD for short.

Common BSODs in Windows XP

Now that you have a good idea of how to dissect a BSOD and pull out the relevant pieces of information from all the gibberish on the screen, let’s look at some of the more common BSODs in Windows XP. I’ll only cover just a few of the BSOD conditions, but there are lots of possible Stop errors. For each BSOD I discuss, I’ll provide a link to an article on the Microsoft Knowledge Base that covers that particular Stop error. (Since more than one article might address a Stop error, you may want to search the Knowledge Base if you discover that you need more information.)

STOP:0×0000000A
IRQL_NOT_LESS_OR_EQUAL

This Stop error, which can be caused by either software or hardware, indicates that a kernel-mode process or driver attempted to access a memory location it did not have permission to access or a memory location that exists at a kernel interrupt request level (IRQL) that was too high. A kernel-mode process can access other only processes that have an IRQL that’s equal to or lower than its own.

Troubleshooting a Stop 0×0000000A error in Windows XP

STOP: 0×0000001E
KMODE_EXCEPTION_NOT_HANDLED

This Stop error indicates that indicates that the Windows XP kernel detected an illegal or unknown processor instruction. The problems that cause this Stop error can be either software or hardware related and result from invalid memory and access violations, which are intercepted by Windows’ default error handler if error-handling routines are not present in the code itself.

Possible Resolutions to STOP 0×0A, 0×01E, and 0×50 Errors

STOP: 0×00000050
PAGE_FAULT_IN_NONPAGED_AREA

This Stop error indicates that requested data was not in memory. The system generates an exception error when using a reference to an invalid system memory address. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause this Stop error.

Possible Resolutions to STOP 0×0A, 0×01E, and 0×50 Errors

STOP: 0×0000007B
INACCESSIBLE_BOOT_DEVICE

This Stop error indicates that Windows XP has lost access to the system partition or boot volume during the startup process. Installing incorrect device drivers when installing or upgrading storage adapter hardware typically causes this Stop error. This error could also indicate a possible virus infection.

Troubleshooting Stop 0×0000007B or “0×4,0,0,0″ Error

STOP: 0×0000007F
UNEXPECTED_KERNEL_MODE_TRAP

This Stop error indicates a hardware problem resulting from mismatched memory, defective memory, a malfunctioning CPU, or a fan failure that’s causing overheating.

General causes of “STOP 0×0000007F” errors

STOP: 0×0000009F
DRIVER_POWER_STATE_FAILURE

This Stop error indicates that a driver is in an inconsistent or invalid power state. This Stop error typically occurs during events that involve power state transitions, such as shutting down, or moving in or out of standby or hibernate mode.

Troubleshooting a Stop 0×9F Error in Windows XP

STOP: 0×000000D1
DRIVER_IRQL_NOT_LESS_OR_EQUAL

This Stop error indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high. The most typical cause is a bad device driver (one that uses improper addresses). It can also be caused by faulty or mismatched RAM or a damaged pagefile.

Error Message with RAM Problems or Damaged Virtual Memory Manager

STOP: 0×000000EA
THREAD_STUCK_IN_DEVICE_DRIVER\

This Stop error indicates that a device driver problem is causing the system to pause indefinitely. Typically, this problem is caused by a display driver waiting for the video hardware to enter an idle state. This might indicate a hardware problem with the video adapter or a faulty video driver.

Error message: STOP 0×000000EA THREAD_STUCK_IN_DEVICE_DRIVER

STOP: 0×00000024
NTFS_FILE_SYSTEM

This Stop error indicates that a problem occurred within Ntfs.sys, the driver file that allows the system to read and write to drives formatted with the NTFS file system. (A similar Stop message, 0×00000023, exists for the file allocation table [FAT16 or FAT32)] file systems.)

Troubleshooting Stop 0×24 or NTFS_FILE_SYSTEM Error Messages

STOP: 0xC0000218
UNKNOWN_HARD_ERROR

This Stop error indicates that a necessary registry hive file could not be loaded. The file may be corrupt or missing. The registry file may have been corrupted due to hard disk corruption or some other hardware problem. A driver may have corrupted the registry data while loading into memory or the memory where the registry is loading may have a parity error.

How to Troubleshoot a Stop 0xC0000218 Error Message

STOP: 0xC0000221
STATUS_IMAGE_CHECKSUM_MISMATCH

This Stop message indicates driver, system file, or disk corruption problems (such as a damaged paging file). Faulty memory hardware can also cause this Stop message to appear.

“STOP: C0000221 unknown hard error” or “STOP: C0000221 STATUS_IMAGE_CHECKSUM_MISMATCH” error message occurs

Note: This post has been kept on this blog for personal reference and has been taken from TechRepublic website.

-------------- End of Document -----------------

Tags: Windows XP, Windows Server 2003

Published Date: 20080724

Disable Autologon in Windows XP

If you've configured Windows XP to automatically login earlier, and want to cancel the auto-logon, try any of these methods:

Method 1:

By default, MSGina.dll checks the state of the SHIFT key when AutoAdminLogon is 1. If the SHIFT key is held down during the boot process, MSGina.dll will ignore the AutoAdminLogon key value and prompt the user for identification and authentication information interactively. You can use this method to temporarily disable automatic logon at startup

Method 2:

Click Start, and then click Run. In the Open box, type control userpasswords2, and then click OK. In the dialog box that appears, enable Users must enter a user name and password to use this computer check box, and then click OK.

Method 3:

Click Start, Run and type "rundll32 netplwiz.dll,ClearAutoLogon"

Method 4:

Use this method only if you've configured the automatic logon using the registry manually. Because, automatic logon procedure using Control Userpasswords2 or using Tweak UI does not involve Winlogon \ DefaultPassword key at all. They are stored in protected area rather.

• Open Registry Editor (Regedit.exe) and navigate to:

HKEY_LOCAL_MACHINE \ Software \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon

• Delete the DefaultPassword entry.

• Double-click AutoAdminLogon, type 0 in the Value Data box, and then click OK.

-----------------------End of Document ----------------------------

Tags: Windows XP

Published Date: 20080608

How to add new Website in IIS5.1 on Windows XP

If IIS is running in Windows XP, it does not give you an option to add a new Website in the Internet Services Manager mmc console. However you can add a new website using a vbscript that comes with IIS. However do remember that only ONE website can run at a time in IIS running on Windows XP. To add a new website  follow the below instructions.

1. Open Internet Services manager and stop the Default Web Site
2. Open a command prompt windows and navigate to the folder 'c:\Inetpub\AdminScripts'
3. Type “adsutil.vbs enum w3svc /p" to get a list of websites created. Basically only the Default Website is listed (W3SVC/1)
4. Type “adsutil.vbs create W3SVC/2” (the last number can be anything; it is the index of the new website)
5. Type “adsutil.vbs copy W3SVC/1 W3SVC/2” to copy the whole directory structure and settings to the new website
6. Go to the Internet Service manager and and rename this new website, give it a new root folder and set it up however you like
7. To delete an existing website type “adsutil.vbs delete W3SVC/2” (Remember DELETING A WEBSITE IS IRREVERSIBLE so please be extremely careful)

--------------------End of Document ----------------

Tags: IIS, Windows XP

Published Date: 20080606

Cleanup $NTServicePackUninstall$ and SoftwareDistribution Folder

Service pack and Windows update installations leave a lot of unnecessary files in the %SystemRoot% folder. They occupy a lot of space and you can safely delete these files. Do this only when you are sure that you will not need to uninstall any of the updates or Service Pack.

To remove the Service Pack uninstall files

1. Go to C:\WINDOWS and delete "$NTServicePackUinistall$"
2. Go to Add/Remove Programs.
3. Click "Service Pack 1"(2)(3), there will be an error since you just deleted the file.
4. Click YES to delete the shortcut.
5. Use similar procedure to delete uninstall files for the updates.
   

The updates will be in this format "$NTUninstall********"
Do NOT delete "$hf_mig$"

To remove the Automatic updates' files in SoftwareDistribution Folder

Automatic updates are downloaded in %systemroot%\SoftwareDistribution\Download folder and occupy a lot of space. You can safely delete these files.

1. Open a command prompt window
2. type net stop wuauserv and press enter
3. Open Windows Explorer and delete all contents in the folder c:\windows\SoftwareDistribution\Download
4. Go back to Command prompt window and type net start wuauserv and press enter

Be sure to restart Windows before before another attempt at getting the updates !!

--------------------End of Document ----------------

Tags: Windows Server 2003, Windows Server 2008, Windows XP

Published Date: 20080519

How to clean up downloaded files for Automatic updates / Windows Update

Automatic updates are downloaded in %systemroot%\SoftwareDistribution\Download folder and occupy a lot of space. You can safely delete these files.

Type the following commands in command prompt window

net stop wuauserv

Open Windows Explorer and delete all contents in the folder c:\windows\SoftwareDistribution\Download

Go back to Command prompt window and type net start wuauserv

Be sure to restart Windows before another attempt at getting the updates !!

-------------- End of Document -----------------

Tags: Windows 2000, Windows 2003, Windows XP

Published Date: 20080517

How to remove Outlook Express 5.1, 5.5, or 6.0 from a Windows 2000-based computer

To manually remove Outlook Express 5.1, Outlook Express 5.5, or Outlook Express 6.0 from a Windows 2000-based computer, follow these steps:

Note Make sure that you are logged on to the computer as an administrator.

1. Make sure that system files and file name extensions are visible.

a. Double-click the My Computer icon.

b. On the Tools menu, click Folder Options, and then click the View tab.

c. In the Hide Files and Folders section, click Show hidden files and folders, and then click to clear the Hide file extensions for known file types check box.

d. Click to clear the Hide Protected Operating System Files (Recommended) check box, and then click Yes in the warning message dialog box.

e. Click OK to close the Folder Options dialog box.

2. Delete the Outlook Express registry keys.

To remove Outlook Express, you must delete the registry keys for Outlook Express. To do this, follow these steps:

a. Click Start, click Run, type regedit, and then click OK.

b. Locate the following registry keys, right-click the registry key, and then click Delete:

•HKEY_LOCAL_MACHINE\Software\Microsoft\Outlook Express

•HKEY_CURRENT_USER\Software\Microsoft\Outlook Express

•HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}

c. Close Registry Editor.

3. Rename the Outlook Express files.

To complete the removal procedure, rename the Outlook Express files. Each of these files is located in the default file folder and in the C:\Winnt\System32\Dllcache folder. For example, the Msoe.dll file is located in the following folders:

• C:\Program Files\Outlook Express

• C:\Winnt\System32\Dllcache

You must rename the file in both folders to successfully remove Outlook Express. To rename the Outlook Express files, follow these steps:

a. Remove any CDs that are in your CD drive.

b. Start Windows in safe mode.

c. Click Start, point to Search, and then click For Files and Folders.

d. In the Search for files or folders named box, type Msoe.dll, and then click Search Now.

e. Right-click the first Msoe.dll file, and then click Rename.

f. Type Msoe.old, and then press ENTER.

g. To rename the second instance of the Msoe.dll file, repeat steps e and f.

h. When you are prompted about Windows file protection, click Cancel.

i. When you are prompted about whether to keep unrecognized file versions, click Yes.

j. To rename the following files, repeat steps d through i:

• Msoeacct.dll

• Msoert2.dll

• Msoeres.dll

• Msimn.exe

• Oeimport.dll

• Oemiglib.dll

• Oemig50.exe

• Setup50.exe

k. Restart your computer in Normal Mode.

-------------- End of Document -----------------

Tags: Windows 2000, Windows XP

Published Date: 20080516

How to manually rebuild Performance Counter Library values

When you use the System Monitor tool, some counters may be missing or do not contain counter data. The base set of performance counter libraries may become corrupted and may need to be rebuilt along with any extensible counters. This behavior may occur if certain extensible counters corrupt the registry, or if some Windows Management Instrumentation (WMI)-based programs modify the registry.

To rebuild the base performance counter libraries manually:

1. Copy Perfc009.dat and Perfh009.dat to %Systemroot%\System32 folder.

2. Start Registry Editor, and then locate the following key in the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib

3. In the registry, change the LastCounter value to 1846 (decimal), and change the LastHelp value to 1847 (decimal).

4. Locate the following registry key to search for services that have a Performance subkey:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

5. Remove the following values from the Performance subkey (if they exist):

• FirstCounter

• FirstHelp

• LastCounter

• LastHelp

You can also use the Exctrlst.exe tool to locate the performance counter dynamic-link library files (DLLs) that are installed, and then access the registry to remove the DWORD values. You now have a workable performance registry that contains only system base counters.

After you have completed this procedure, you must re-add the extensible counters from the list of services. Before you do so, however, you must identify the .ini file that is used to load the counters:

5. Run the batch file counters.bat

-------------- End of Document -----------------

Tags: Windows XP, Windows 2003

Published Date: 20080515

If Windows Update does not work

If Windows update does not work properly and you are receiving error repeatedly when you are trying to update windows from microsoft website use these commands to configure windows update from scratch.

net stop bits
net stop /s wuauserv
regsvr32 /u wuaueng.dll /s
del /f /s /q %windir%\SoftwareDistribution\*.*
del /f /s /q %windir%\windowsupdate.log

regsvr32 wuapi.dll
regsvr32 wuaueng1.dll
regsvr32 wuaueng.dll
regsvr32 wucltui.dll
regsvr32 wups2.dll
regsvr32 wups.dll
regsvr32 wuweb.dll

net start bits
net start wuauserv
wuauclt.exe /resetauthorization /detectnow

-------------- End of Document -----------------

Tags: Windows XP, Windows 2003

Published Date: 20080514

Important and basic Windbg commands

!analyze –v :analyzes the dump file and provides a best possible diagnosis of the same

!sympath :shows path to your symbol files

lm :lists all loaded modules in memory

lmf :list loaded modules with full path

lmt :list loaded modules with last modified timestamp

!lmi <module name> :Shows header information about the module, including the date and time, which can often tell you whether you're running an older version of a program and need to upgrade

vertarget :Shows information about the system on which you are debugging

!peb :Shows the PEB (process environment block) including DLL information

.trap :Dump a trap frame

.chain :Lists all loaded debugger extensions

-------------- End of Document -----------------

Tags: Windows XP, Windows Server 2000, Windows Server 2003

Published Date: 20071109

Finding NIC information remotely using WMIC commands

WMIC is a very useful and very under utilized interface for server / OS management provided in Windows. One very common example that generally requires logging in to the server is to check / set Network card properties. At a command prompt type WMIC and then /? to find the available interfaces that can be queried or set.

To check NIC Configuration tyep the following sequence of commands at the command prompt. For example:

WMIC
/NODE:<hostname>
NICCONFIG Get DNSHostName

NICCONFIG Get DNSDomainSuffixSearchOrder

-------------- End of Document -----------------

Tags: Windows XP, Windows Server 2000, Windows Server 2003

Published Date: 20071112

How to create a user-defined service in Windows

Execute the following command at the command promt. You need to have Windows Resource Kit installed on the box. ‘C:\Program Files\Resource Kit\Instsrv.exe <my Service> C:\Program Files\Resource Kit\Srvany.exe’

1. Open Registry editor and go to the following key. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<my service>
2. From the Edit menu, click Add Key. Type the following and click OK:
   Key Name: Parameters
   Class : <leave blank>
3. Select the Parameters key and from the Edit menu, click Add Value. Type the following and click OK

Value Name: Application
Data Type : REG_SZ
String : <path>\<application.ext>
where <path>\<application.ext> is the drive and full path to the application executable including the extension (i.e., C:\WinNT\Notepad.exe)

-------------- End of Document -----------------

Tags: Windows XP, Windows Server 2000, Windows Server 2003

Published Date: 20071025

How to convert SID to username and username to SID

PsGetSid makes reading a computer's SID easy, and works across the network so that you can query SIDs remotely. PsGetSid also lets you see the SIDs of user accounts and translate a SID into the name that represents it.

Usage: psgetsid [\\computer[,computer[,...] | @file] [-u username [-p password]]] [account|SID]

If you want to see a computer's SID just pass the computer's name as a command-line argument. If you want to see a user's SID, name the account (e.g. "administrator") on the command-line and an optional computer name.

Specify a user name if the account you are running from doesn't have administrative privileges on the computer you want to query. If you don't specify a password as an option PsGetSid will prompt you for one so that you can type it in without having it echoed to the display.

-------------- End of Document -----------------

Tags: Active Directory, Windows XP, Windows Server 2000, Windows Server 2003

Published Date: 20070905

How to get detailed hardware information of HP / Compaq server

HP / compaq servers generally have the survey / hpdiags utility installed in %system drive%\hp\hpdiags folder. This utility generates a detailed system information file and can be very useful for many diagnostic and inventory purposes.

1. Run the hpdiags.exe utility and it would generate a survey%Date%%Time%.xml file. (This survey file can be quite cryptic and I generally use the following commands to make it a readable html file.)

2. Copy the surveyxxxx.xml file and survey.xsl file to your computer.

3. Download msxsl.exe from microsoft.com

4. Run the command msxsl.exe <input_file.xml> survey.xsl -o <outpul_file.html>at the command prompt. Give fully qualified path names wherever necessary.

-------------- End of Document -----------------

Tags: Windows XP, Windows Server 2000, Windows Server 2003

Published Date: 20070905

Do I have local admin rights?

Find out how in three mouse clicks (or two keys plus a mouse click)....

1. Click 1: Right-Click My Computer

2. Click 2: Select Properties

3. Click 3: Select the "Computer Name" tab

If the "Change" box is available, you're a local administrator. If it's greyed out, you're not. It's that simple.

So as to combine one tip into two, if you didn't know, you could change Clicks 1 and 2 above with 2 keyboard hits: Windows Key + Break.

-------------- End of Document -----------------

Tags: Windows XP, Windows Server 2000, Windows Server 2003

Published Date: 20070905

How to give Read-only access to Event logs to particular users

Sometimes it is necessary to permit certain groups of people access to event logs on domain controllers or other servers in the domain. The most common request is read-only access to various event logs to enable delegated administrators monitor the logs. A good example is giving DNSAdmins read-only access to the DNS event logs.

The process is very cryptic and involves modification of some registry keys. It is documented in the below mentioned KB articles:

http://support.microsoft.com/?id=323076
How to set event log security locally or by using Group Policy in Windows Server 2003
http://support.microsoft.com/kb/842209/en-us
You receive an "Access is denied" error message when you try to access an event log on a Windows Server 2003-based computer or on a Windows 2000-based computer

The default ACLs for each event log is below, which you need to start with as your base then add whatever additional ACLs you want:

Application Log:

O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)

Directory Services:

O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)

DNS Service:

O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)

File Replication Service:

O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)

Security Event Log:

O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)

System Event Log:

O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x1;;;S-1-5-3)(A;;0x2;;;NS)

To add more groups or users to the ACL list, you first need to determine the SID of the user or group. It should start with an "S" and be quite long, such as S-1-5-21-702074188-2833732907-241959117-48998. You can use LDP or other methods to find the SID.

The SDDL syntax for adding read-only access to any of the logs above is:

(A;;0x1;;;<Insert SID here>), for example: (A;;0x1;;;S-1-5-21-702074188-2833732907-241959117-48998)

For the security event log the final ACL would look like:

O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x1;;;S-1-5-21-702074188-2833732907-241959117-48998)

Just cut and paste this into the GPMC for the right event log, and viola! Instant read-only access is granted to a specific user or group

-------------- End of Document -----------------

Tags: Windows XP, Windows Server 2000, Windows Server 2003

Published Date: 20070829

Run command to lock windows

Ever wondered how can you lock your computer using a script?

Just try typing the below line verbatim on the run window and hit enter. Presto! Your computer is locked.

rundll32.exe user32.dll, LockWorkStation

-------------- End of Document -----------------

Tags: Windows XP, Windows Server 2000, Windows Server 2003

Published Date: 20080828

Determine System configuration information of Windows box remotely

I always wanted to gather information such as CPU / RAM / OS Version / Installed OS patches / System Uptime / Installation date and other such details that are required for inventory purpose for Wintel boxes.

Systeminfo is a command line tool enables an administrator to query for basic system configuration information. Below is the parameter list of the command:

1. /S system: Specifies the remote system to connect to.

2. /U [domain\]user: Specifies the user context under which the command should execute.

3. /P [password]: Specifies the password for the given user context. Prompts for input if omitted.

4. /FO format: Specifies the format in which the output is to be displayed. Valid values: "TABLE", "LIST", "CSV".

5. /NH: Specifies that the "Column Header" should not be displayed in the output. Valid only for "TABLE" and "CSV" formats.

6. /?: Displays this help/usage.

This would help a lot in filling your h/w inventory sheets.

--------------- End of Document -----------------------

Tags: Windows XP, Windows Server 2000, Windows Server 2003

Published Date: 20070822