Troubleshooting Software

1
Module 14

• Troubleshooting Software

2
End User

• The troubleshooting process usually begins with
  the end user, because they have the most valuable
  information.
• After talking to the end user to find out what
  they were doing and what application they were
  using when they began experiencing the problems,
  it is a good idea to start by reproducing the
  error symptoms.

3
System Boot Problems

• The boot up procedure that starts the computer
  system reveals a lot about the health of the
  system. Observing the steps of a boot up process
  can reveal a great deal about what is causing
  problems in the system.
• One tool that every system administrator should
  have is a bootable disk.
• Often systems have issues that cannot be
  resolved, or the operating system has become so
  corrupt that despite all efforts the system will
  not start or boot up.
• A bootable disk allows administrators or service
  technicians to boot from a diskette instead of
  the hard drive.

4
System Boot Problems

• The COMMAND.COM program is known as the command
  interpreter. It is the most important system
  file, since the computer cannot boot without it.
  COMMAND.COM contains the operating system's most
  commonly used commands.
• When DOS runs an application, COMMAND.COM finds
  the program and then loads it and gives it
  control of the system.

5
System Boot Problems

• Bootable Configuration Files
• CONFIG.SYS
• AUTOEXEC.BAT

6
CONFIG.SYS

• Contains setup or configuration instructions
• Configures DOS programs for use with devices and
  applications
• Set up Memory Managers

7
AUTOEXEC.BAT

• Looks for after CONFIG.SYS
• List of DOS commands that will automatically
  execute when DOS is loaded
• Not necessary for system to boot

8
DOS Error Messages

• Bad or Missing COMMAND.COMIn the DOS
  environment, the "Bad or Missing COMMAND.COM"
  error message is common.
• There are a few things that might cause this
  error message to appear.
• The COMMAND.COM file cannot be found on the hard
  drive. The COMMAND.COM file is not located in the
  hard drive root directory (this usually occurs
  when a new hard drive or operating system is
  installed).
• The end user accidentally erases the COMMAND.COM
  file from the root directory of the hard drive.

9
DOS Error Messages

• Extended Memory Access (HIMEM.SYS)DOS 4.0
  versions and above have a memory management
  program called HIMEM.SYS that manages the
  extended memory above the 1024 KB level.
• When this utility is loaded into memory it shifts
  most of the operating system functions into the
  High Memory Area of extended memory.
• In Windows 98, the HIMEM.SYS statement must be
  present and correct for the operating system to
  run.
• Also, check and make sure that the HIMEM.SYS file
  is the correct version and that it is in the
  correct location.

10
DOS Error Messages

• Expanded Memory Access (EMM386.EXE)The
  EMM386.EXE program provides the system with
  access to the Upper Memory Area (UMA) of RAM.
• This program operates together with the HIMEM.SYS
  utility and provides the system with the
  capability to conserve conventional memory by
  moving device drivers and memory-resident
  programs into the UMA.
• Some common troubleshooting issues with this
  program occur when conflicts exist in the
  allocation of the upper memory blocks.
• This might happen if there is a missing or
  incorrect HIMEM.SYS file or there are conflicting
  third party drivers.

11
Troubleshooting Startup Problems

• MSCONFIG.EXE
• Type in command line
• Used to load system tools
• Used to load drivers and software options
• Used to view CONFIG.SYS AUTOEXEC.BAT

12
Windows Memory Usage Problems

• Windows core files affected if a Windows memory
  error exists are
• KRNLXXX.EXE
• GDI.EXE
• USER.EXE
• These files might be damaged after restarting the
  Windows.

13
General Protection Fault

• A General Protection Fault (GPF) occurs when one
  of the operating system applications attempts to
  access an unallocated memory location.
• General Protection Faults are usually the result
  of programs that use illegal instructions to
  access areas of memory that have been protected.

14
Error Codes

• Error codes that are generated at system startup
  usually indicate hardware problems, configuration
  problems, or boot up problems that are associated
  with the operating system.
• If the "no operating system found" error message
  appears during startup, the most likely culprits
  are either a failed hard drive or a damaged or
  corrupted master boot record (MBR).
• To troubleshoot the problem, first check to make
  sure that the hard drive is properly installed
  and that all the cables are properly installed as
  well. If the problem persists, start from a boot
  disk containing FDISK.EXE, then use the
  FDISK.EXE/mbr command to fix the master boot
  record on the hard drive.

15
Error Codes

• The "illegal operation" designation covers a wide
  range of errors.
• The most common causes of an illegal operation
  include problems between that program and a
  software driver in the operating system, or
  memory-management problems between the program
  and an open program in the background.
• Problems and conflicts with different
  Dynamic-Link Library files (DLL files), which are
  added to the system when software programs are
  installed, can also cause illegal operation
  errors.

16
SFC Utility

• System File Checker Utility
• Command-line utility
• Scans the OS files to ensure correct MS version
• Will replace OS file with correct version

17
Shutdown Problems

• Application processes can be shut down manually
  using Ctrl-Alt-Del

18
Windows 9x Startup Modes

• Access the Windows 9x Startup Modes by pressing
  the F8 key when the "starting Windows 9x" screen
  is displayed.
• The menu offers several startup options including
  Normal, Logged, Safe Mode, Step-by-Step
  confirmation, and DOS modes.
• These startup modes will help in troubleshooting
  startup issues.

19
Windows 9x Startup Modes

• In Normal mode, the system boots up as it
  normally would with all the proper drivers and
  registry files.
• The Logged mode boots up just like the Normal
  mode but it creates an error log that contains
  the performed steps and their outcomes.
• Safe Mode is a troubleshooting tool for Windows.
  Starting Windows 95 in Safe mode bypasses the
  current real-mode configuration and loads a
  minimal protected-mode configuration, disabling
  Windows 95 device drivers and using the standard
  VGA display adapter. If the problem does not
  occur in Safe mode, it may be a conflict with
  hardware settings, real-mode configuration
  issues, incompatibilities with legacy Windows
  programs or drivers, or registry damage.

20
Windows 9x Log Files

• SETUPLOG.TXT created when setup fails before
  hardware detection.
• BOOTLOG.TXT created as the system is booting
  up.
• DETCRASH.LOG created when setup fails during
  hardware detection.
• DETLOG.TXT created every time the detection
  process runs.

21
System Tools

• Event Viewer monitor events.
• Dr. Watson isolate and correct GPF.
• SCANREG.EXE scans registry for corruption.
• DEFRAG.EXE rewrites files on hard drive back to
  beginning of drive to simplify retrieval of data,
  improves drive performance.

22
System Tools

• CHKDSK.EXE used to recover lost allocation
  units, optimizes storage space on hard drive.
• SCANDSKW.EXE repair tool, checks integrity of
  hard drive and other media, then repairs it.
• MSCONFIG.EXE used to load device drivers and
  software options, allows viewing of CONFIG.SYS
  and AUTOEXEC.BAT.
• EDIT.COM view and edit config files like
  AUTOEXEC.BAT, CONFIG.SYS

23
Windows System Editors

• SYSEDIT.EXETyping sysedit in the Run dialog box
  of the Start menu will open the system editor
  tool. The sysedit utility is used to modify text
  files such as the .INI files in the system, as
  well as the CONFIG.SYS and AUTOEXEC.BAT files.
• POLEDIT.EXEUse the System Policy Editor
  (POLEDIT.EXE) to set up different security
  restrictions for different users. Use it to set
  one policy for a whole group, configure desktops
  for roving users so that any computer they use
  will have the same look, or to protect a computer
  if it is unplugged from the network.

24
Registry Editors

• The contents of the registry can be edited and
  viewed through the Registry Editors. Access the
  registry editors by typing REGEDIT.EXE or
  REGEDT32.EXE at the Run command window on the
  Start menu.
• REGEDIT.EXE was initially designed to work with
  Windows 9x, but it will work in Windows 2000. It
  is recommended to use REGEDT32.EXE with Windows
  2000 and REGEDIT.EXE with Windows 9x.

25
Windows 2000 Recovery Console

• The Windows 2000 Recovery Console is a
  command-line interface used to perform a variety
  of troubleshooting and recovery tasks.
• The recovery console can be started by starting
  the system with the Windows 2000 setup disks or
  the CD, and selecting the option when prompted.
• The FIXMBR command can be used with the Recovery
  Console to fix hard drive problems. The FIXMBR
  command repairs a master boot record (MBR).
• The FIXBOOT command writes a new boot sector onto
  the system partition.

26
Windows Registry Backup Recovery Tools

• Windows 95 creates a backup copy of the Registry
  each time the operating system is started.
• Windows 98 does not copy the Registry to .DA0
  files when the operating system starts. Instead,
  it provides a program called Registry Checker.
  Once each day, Registry Checker, SCANREGW, backs
  up the Registry to a .CAB file.

27
Data Backup Procedures

• Backup and restore operations can take various
  forms.
• Some common examples, include normal,
  incremental, differential, and daily backup.
• Normal backup is also known as full backup. With
  normal backup, all files on the disk are stored
  to tape, and the archive bit for all files is set
  to off or cleared.
• A full backup that is done each day requires only
  one tape to restore the data, but it is
  impractical to run a full backup each day because
  of the amount of dedicated time it requires.

28
Data Backup Procedures

• Incremental backup procedure backs up all the
  files that have been created or modified since
  the last full or incremental backup. It is
  important to remember two things about an
  incremental backup first, that it works only in
  conjunction with a full (normal) backup, and
  second, that any new file created or modified has
  its archive bit turned back on so that it will be
  saved to tape during the next incremental backup.
  
• Copies all the files that are new or changed
  since the last normal or incremental backup. The
  archive bit is cleared, so the files are not
  backed up again.

29
Data Backup Procedures

• Differential backup procedure backs up all the
  files that have been created or modified since
  the last full backup. This sounds the same as an
  incremental backup, but the difference is that
  even though the file is saved to tape, the
  archive bit is not reset. This means that each
  time a differential backup is done, all the files
  modified or created since the last full backup
  will be stored again (continually backed up).
• Daily Backup procedure backs up only the files
  that are modified on the day of the backup. This
  backup also does not reset the archive bit to
  off.

30
Incremental vs. Differential Backups

• An incremental backup where the archive bits are
  cleared nightly means that each nightly backup
  will continue to be relatively small, taking very
  little time. However, it also means that if a
  restore of the entire disk is needed, then the
  client will have to restore both the last full
  backup, then each incremental backup after that,
  in order to get all files to their last modified
  state.
• With a differential backup, the archive bits are
  only cleared during the full backup, and not on
  each nightly incremental backup. This means that
  nightly backups get gradually larger each night,
  but it means that if a full disk restore is
  needed, only two restores will be needed the
  full backup, and the last differential backup.

31
Backups Restated (Extra)

• Normal (Full) backup - copies all the files that
  have been selected to the backup media and marks
  the files as having been archived (the archive
  bit is cleared).
• Incremental - copies all the files that are new
  or changed since the last normal or incremental
  backup. The archive bit is cleared, so the files
  are not backed up again.
• Differential - copies all the files that are new
  or changed since the last normal or incremental
  backup. The archive bit is not cleared, so the
  files are continually backed up until the next
  normal or incremental backup.
• Daily - copies all the files that have changed on
  the day of the backup. The archive bit is not
  cleared, so any of the other forms of backup will
  also copy the files.

32
Network Troubleshooting Software Utilities

• PING.EXE - This utility is short for Packet
  Internet Groper. It is used to determine whether
  a specific IP address is accessible. It works by
  sending a packet to the specified address and
  waiting for a reply.
• To test the NIC to see if it is functioning
  properly. PING the card with its local loopback
  address which is 127.0.0.1.

33
Network Troubleshooting Software Utilities

• TRACERT.EXE - is a utility that traces a packet
  from the computer to an Internet host. It shows
  how many hops the packet requires to reach the
  host and how long each hop takes.
• TRACERT.EXE utilities work by sending packets
  with low Time-to-Live (TTL) fields. The TTL value
  specifies how many hops the packet is allowed
  before it is returned. When a packet cannot reach
  its destination because the TTL value is too low,
  the last host returns the packet and identifies
  itself.

34
Network Troubleshooting Software Utilities

• WINIPCFG.EXE view IP config on Windows 95, 98,
  ME
• IPCONFIG.EXE view IP config on Windows NT,
  2000, XP

35
Troubleshooting Information Resources

• Troubleshooting Files that come with the
  operating system, there are other resources
  available.
• The Windows 9x/NT/2000 Resource Kits are very
  useful. There is a solution for almost every
  troubleshooting issue in these resource kits.
  They provide CDs and textbooks with thousands of
  pages of in-depth technical information that
  provide reference material when researching a
  problem.
• Another place to check for help and
  troubleshooting aids is on the Internet.
• The Microsoft website has a huge database of
  troubleshooting pages called the Microsoft
  TechNet. http//www.microsoft.co
  m/technet