Windows 2000 Resource Kit Support Tools: Alphabetical List of Tools

This page requires a browser capable of displaying frames.


Windows 2000 Resource Kit Toolbox: Glossary of Terms

This page requires a browser capable of displaying frames.


Introduction

The Microsoft® Windows® 2000 Resource Kit Support Tools can make working with the Windows 2000 platform even easier. This documentation presents an overview of these Support Tools. In order to use these tools, you must first install the Support Tools on your computer.

Installing the Windows 2000 Resource Kit Support Tools

For installation instructions, see:

Installing the Windows 2000 Resource Kit Support Tools

Using the Tools Management Console

After installation, you can view and run the installed tools and their documentation using the Tools Management Console, which organizes the Resource Kit tools and documentation.

For instructions on using the Tools Management Console, see:

Using the Tools Management Console

Finding the Tools you Need

The tools in the Resource Kit are listed in two different ways: by alphabetical order and by functional category.

For instructions on finding tools, see:

Finding the Tools you Need

Understanding Notation and Terminology Used in this Document

The following conventions for usage and notation are observed in this document:

Procedural Conventions

Notational Conventions

Keyboard Conventions

Terminology Conventions

The documentation in the Toolbox assumes that you are already familiar with Windows 2000. For more general information about Windows 2000, including keyboard equivalents to menu and mouse actions, see the Windows 2000 online documentation.

Links to Other Files and Locations

In this documentation, some topics include links preceded by an icon that allow you to open the tool's help or documentation file or to run the tool. For these links to work properly, the Resource Kit Support Tools must be installed on your computer. Links to tools that require further installation are preceded by explanatory notes.

Some of these links are to Internet sites and are preceded by a Internet icon. To use these links, you must have a World Wide Web browser (or in some cases an popup FTP client) installed on your computer and an Internet connection. Windows 2000 includes Microsoft® Internet Explorer, a Web browser which can connect to any World Wide Web or FTP link.

Links to popup glossary definitions consist of a popup icon followed by underlined green text. To copy or print a popup definition, select the popup text with the left mouse button, click the right mouse button, and on the menu that appears click Copy or Print.

About the Microsoft® Windows® 2000 Resource Kit

The full Microsoft® Windows® 2000 Resource Kit contains valuable technical and performance information about Windows 2000, as well as many more tools that enhance and extend the operating system. For information about the full Windows 2000 Resource Kits, along with updates of tools and books, tips, articles, and chats, visit the ResourceLink site on the World Wide Web at:
Internet http://mspress.microsoft.com/reslink

As a ResourceLink subscriber, you can download the most up-to-date versions of the Resource Kit tools, documentation, and online books from the download page:
Internet http://mspress.microsoft.com/reslink/nt40/toolbox/download/download.htm. The first download file, Readme.exe, also includes the most recent version of the Microsoft® Windows® 2000 Resource Kit Toolbox (Ntrktool.chm) for the full Resource Kit.

Other Internet sites related to the Resource Kit are listed in:
Resource Kit and related information on the Internet

Sending Feedback on the Microsoft® Windows® 2000 Resource Kit

You can send feedback, comments, or bug reports for these tools, or for any Resource Kit documentation, by e-mail to rkbeta@microsoft.com. If you have an Internet e-mail connection, you can click the following icon or text to send mail now:

Internet mailto:rkbeta@microsoft.com


New Tools

The following tools are new for the Microsoft® Windows® 2000 Resource Kit Support Tools:

Dnscmd.exe

Dsastat.exe

Dxdiag.exe

Ksetup.exe

Ktpass.exe

Ldp.exe

List.exe

Memsnap.exe: Memory Profiling Tool

Netafx.exe

Netdiag.exe: Network Connectivity Tester

Ntdsutil.exe

PPTP Ping: Point-to-Point Tunneling Protocol Ping Utilities

Repadmin.exe

RPC Ping: RPC Connectivity Verification Tool

SIDwalker

Snmputilg.exe: SNMP Troubleshooting Tool

Trustdom.exe

Wsremote.exe: Winsock Remote Console


Tools with Platform Limitations

The following tools in the Microsoft® Windows® 2000 Resource Kit Support Tools run only on x86-based computers:

* Nltest.exe

* Replmon.exe: Replication Monitor

* Shutdown.exe: Remote Shutdown


Resource Kit and Related Information on the Internet

Several Microsoft Internet sites provide further information and updates about the Windows 2000, Windows NT, and Windows 98 Resource Kits. If you have an Internet connection and a Web browser, you can click the following links to visit these sites.

World Wide Web Sites Related to Windows Resource Kits

ResourceLink (Windows 2000, Windows NT, and Windows 98 Resource Kits Web Site)
Internet http://mspress.microsoft.com/reslink

Microsoft Press Online Support Web Site
Internet http://mspress.microsoft.com/support/

Windows 2000 Resource Kit Tools Corrections and Comments
Internet http://support.microsoft.com/support/kb/articles/Q159/5/64.asp

World Wide Web Sites Related to the Windows 2000 and Windows NT Platforms

Windows 2000 Server Web Site
Internet http://www.microsoft.com/ntserver/

Windows 2000 Professional Web Site
Internet http://www.microsoft.com/ntworkstation/

Support Online Web site (for troubleshooting Windows 2000)
Internet http://support.microsoft.com/support/

Windows 2000 Hardware Compatibility List - Web Version
Internet http://www.microsoft.com/hwtest/hcl/

Other Microsoft World Wide Web Sites of Interest

Internet Explorer Web Site
Internet http://www.microsoft.com/ie/

Internet Information Server Web Site
Internet http://www.microsoft.com/iis/

Microsoft TechNet
Internet http://www.microsoft.com/TechNet/

NNTP Newsgroups (unofficial discussion area)
Internet http://support.microsoft.com/support/news/default.asp

Updates to Tools on the Internet

From the Microsoft popup FTP site, you can download updates to some Resource Kit tools and documentation, as well as the POSIX, Perl, and Regina REXX public domain source files.

Windows 2000 Resource Kit FTP Site
Internet ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/

Microsoft Home Page

URLs (Internet addresses) for specific topics may occasionally be moved during maintenance or changed. If you have any problem reaching a link, point your browser to:

Microsoft Home Page
Internet http://www.microsoft.com/


Disclaimer

Many of these tools were developed internally at Microsoft. Any use of any of these tools is at your own risk. These tools are provided "as is" without warranty of any kind. Microsoft disclaims any implied warranty of merchantability and/or fitness for a particular purpose.

These tools are written and tested in English only. Using these tools with a non-English version of Windows 2000 might produce unpredictable results.


Copyright Information

Information in this online document is subject to change without notice.

The names of companies, products, people, characters, and/or data mentioned herein are fictitious and are in no way intended to represent any real individual, company, product, or event, unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Microsoft Corporation.

© 1985-1999 Microsoft Corporation. All rights reserved.

Active Desktop, ActiveX, and Jscript are trademarks and Microsoft, MS, MS-DOS, Visual Basic, Win32, Windows, and Windows NT are registered trademarks of Microsoft Corporation.

Adaptec is a trademark of Adaptec Inc. Apple, AppleShare, LocalTalk, and Macintosh are registered trademarks and System 7 is a trademark of Apple Computer, Inc. Compaq is a registered trademark of Compaq Computer Corporation. DEC is a registered trademark of Digital Equipment Corporation. Everex is a trademark of Everex Systems, Inc. HP is a registered trademark of Hewlett-Packard Company. IBM and PS/2 are registered trademarks of International Business Machines Corporation. Intel is a registered trademark of Intel Corporation. Novell is a registered trademark of Novell, Inc. SMC is a registered trademark of Standard Microsystems Corporation. Toshiba is a registered trademark of Kabushiki Kaisha Toshiba. UngermanBass is a registered trademark of Ungermann-Bass, Inc.

The files for the Regina REXX scripting language are the only files covered by the GNU Library General Public License. All other files are copyrighted by Microsoft Corporation or the respective owners, and are subject to the terms of a separate license agreement.


Dxdiag.exe: DirectX Diagnostic Tool

Dxdiag.exe: DirectX Diagnostic Tool NEW

DxDiag Run DirectX Diagnostic Tool now.

HTML Help Open DirectX Diagnostic Tool Help now.

This tool presents information about the components and drivers of the Microsoft® DirectX® application programming interface installed on your system. It enables you to test sound and graphics output and disable some hardware acceleration features.

You can use DirectX Diagnostic Tool to gather information for a technician during a support call, or you can save the information gathered by the tool and paste it into an e-mail message.

Files Required

  • Dxdiag.chm
  • Dxdiag.exe


Gflags.exe

Gflags.exe: Global Flags Editor

GFlags is a GUI tool that enables a developer or system administrator to edit the NtGlobalFlag settings for Windows 2000.

You can use GFlags to modify the current flags in use by the Kernel or the flags used when a particular image file is launched. If you have administrative privileges, you can also use GFlags to modify the global Registry settings that will be used the next time Windows 2000 starts.

The GlobalFlag registry entry consists of 32 bits that are used as switches to enable or disable several different advanced internal system diagnostics and troubleshooting tests. Only certain flags can be changed for each target. Changes to the Kernel Registry flags do not take effect until the next time Windows 2000 starts. GFlags only looks at global flags specific to a particular image file when you launch this tool under a debugger or by clicking the GFlags Launch button.

GFlags can also set the flag required for the Kernel feature of Oh.exe, a Microsoft® Windows 2000® Resource Kit tool which shows the handles of open windows.

Note Running GFlags without arguments displays a dialog box that allows the user to modify the global flag settings.

Caution You should use GFlags only in consultation with Microsoft Technical Support. It is an optional component provided solely for troubleshooting purposes. Incorrect use of this tool might cause system boot failure, or might adversely impact performance. This tool makes modifications to your registry. Changing the registry can have unforeseen effects that can prevent you from starting your computer.

GFlags Topics

  • GFlags Syntax
  • GFlags Example: Using Gflags and Poolmon to Troubleshoot a Memory Leak
  • Global Tags Values Reference

Related Tools

File Required

  • Gflags.exe


GFlags Syntax

command prompt Open command prompt now.

One Step gflags [-r [flags [maxdepth]] [-k [flags]] [-i ImageFileName [flags]] [-l flags commandline...]

Where:

-r
operates on system registry settings.
-k
operates on kernel settings of running system.
-i
operates on settings for a specific image file.
If -i switch is specified without flags, then current settings are displayed, not modified.
If flags specified for the –i switch are FFFFFFFF, then the registry entry for that image is deleted.
-l
launches a command line with a specific setting.
flags
is one of the following:
  • A single hex number that specifies all 32-bits of the GlobalFlags value (e.g., 0x1234578).
  • One or more arguments beginning with a "+" or "-", where a + means to set the corresponding bit(s) in the GlobalFlags and a - means to clear the corresponding bit(s). The + or - character can be followed by a hex number or a three letter abbreviation for a GlobalFlag. Valid abbreviations are:

Valid Global Flag abbreviations

Abbreviation | Description
bmp | Stop on Hung GUI
d32 | Enable debugging of Win32 Subsystem
dhc | Disable Heap Coalesce on Free
dic | Debug Initial Command
dps | Disable paging of kernel stacks
dwl | Debug WINLOGON
ece | Enable Close Exception
edt | Enable Object Dereference Tracking
eel | Enable Exception Logging
eot | Enable Object Handle Type Tagging
hat | Enable Heap API Call Tracing
hfc | Enable heap free checking
hpa | Place heap allocations at ends of pages
hpc | Enable heap parameter checking
htc | Enable heap tail checking
htd | Enable Heap Tagging By DLL
htg | Enable heap tagging
hvc | Enable heap validation on call
idp | Ignore debug priviledge
ksl | Enable loading of kernel debugger symbols
kst | Create kernel mode stack trace DB
otl | Maintain a list of objects for each type
pfc | Enable pool free checking
ptc | Enable pool tail checking
ptg | Enable pool tagging
sls | Show Loader Snaps
soe | Stop On Exception
ust | Create user mode stack trace DB

Note
If no arguments are specified to GFlags then it displays a dialog box that allows the user to modify the global flag settings.


GFlags Example: Using GFlags and Poolmon to Troubleshoot a Memory Leak

Note: Poolmon is located in the Windows 2000 Support directory and is used to monitor the memory tags. With Poolmon you can monitor total Paged and Nonpaged pool bytes. Unless specific global flags are enabled using GFlags, Poolmon will not execute and instead will fail with the following error: "Query pooltags Failed c0000002"

Procedure To troubleshoot a memory leak with Gflags and Poolmon

  1. Place Gflags.exe and Poolmon.exe on the target system.

  2. Run Gflags.Exe without arguments.

  3. Select System Registry for the Destination

  4. Select Enable pool tagging from the list of options

  5. Click Apply.

  6. Click Okay.

  7. Shutdown and restart the computer.

  8. Run Poolmon.exe with the following command:
    poolmon.exe -wpooldata.txt -s300 -p -b

Where -w specifies the output file, -s specifies the log interval in seconds; - p sorts tag list by Paged, Non-Paged, or mixed; -b sorts tags by max byte usage. If you change these values do not put a space between w/s and the new value.

Example Output

Memory: 16224K Avail: 4564K PageFlts: 31 InRam Krnl: 684K P: 680K
 Commit: 24140K Limit: 24952K Peak: 24932K  Pool N: 744K P: 2180K

 Tag  Type    Allocs          Frees         Diff   Bytes      Per Alloc
-----------------------------------------------------------------------

 CM   Paged    1283 (   0)    1002 (   0)    281 1377312 (     0) 4901
Strg  Paged   10385 (  10)    6658 (   4)   3727  317952 (   512)   85
 Fat  Paged    6662 (   8)    4971 (   6)   1691  174560 (   128)  103
MmSt  Paged     614 (   0)     441 (   0)    173   83456 (     0)  482

The columns show usage for each tag name. By monitoring periodically which tag's bytes are increasing in allocation without being freed up you may be able to identify a possible leakage.


Global Tags Values Reference

The following are global tags for Windows 2000:

Flag Name | 32 Bit Hex Value
FLG_STOP_ON_EXCEPTION | 0x00000001
FLG_SHOW_LDR_SNAPS | 0x00000002
FLG_DEBUG_INITIAL_COMMAND | 0x00000004
FLG_STOP_ON_HUNG_GUI | 0x00000008
FLG_HEAP_ENABLE_TAIL_CHECK | 0x00000010
FLG_HEAP_ENABLE_FREE_CHECK | 0x00000020
FLG_HEAP_VALIDATE_PARAMETERS | 0x00000040
FLG_HEAP_VALIDATE_ALL | 0x00000080
FLG_POOL_ENABLE_TAIL_CHECK | 0x00000100
FLG_POOL_ENABLE_FREE_CHECK | 0x00000200
FLG_POOL_ENABLE_TAGGING | 0x00000400
FLG_HEAP_ENABLE_TAGGING | 0x00000800
FLG_USER_STACK_TRACE_DB | 0x00001000
FLG_KERNEL_STACK_TRACE_DB | 0x00002000
FLG_MAINTAIN_OBJECT_TYPELIST | 0x00004000
FLG_HEAP_ENABLE_TAG_BY_DLL | 0x00008000
FLG_IGNORE_DEBUG_PRIV | 0x00010000
FLG_ENABLE_CSRDEBUG | 0x00020000
FLG_ENABLE_KDEBUG_SYMBOL_LOAD | 0x00040000
FLG_DISABLE_PAGE_KERNEL_STACKS | 0x00080000
FLG_HEAP_ENABLE_CALL_TRACING | 0x00100000
FLG_HEAP_DISABLE_COALESCING | 0x00200000
FLG_ENABLE_CLOSE_EXCEPTIONS | 0x00400000
FLG_ENABLE_EXCEPTION_LOGGING | 0x00800000
FLG_ENABLE_HANDLE_TYPE_TAGGING | 0x01000000
FLG_HEAP_PAGE_ALLOCS | 0x02000000
FLG_DEBUG_INITIAL_COMMAND_EX | 0x04000000
FLG_VALID_BITS | 0x07FFFFFF

These values are stored in the registry in the the following location:

HKEY_LOCAL_MACHINE subtree in the following key:

\SYSTEM\CurrentControlSet\Control\Session Manager\

GlobalFlag REG_DWORD

The default value for GlobalFlag is 0, so Windows 2000 does not expend extra overhead in gathering pooltag information. If set to 0, all system registry global flag settings are disabled. For more information, see the definition of Ntexapi.h FLG_ in the Win32 Software Development Kit.

Gflags can also set the flag required for the Kernel feature of Oh.exe, a Microsoft® Windows 2000® Resource Kit tool that shows the handles of open windows.


Kill.exe: Task Killing Utility

Use this command-line tool to end one or more tasks or processes. Processes can be killed by process ID number(PID) any part of its process name a window name, usually the applications main window title To find the PID, use PuList or TList, two tools included in the Microsoft® Windows® 2000 Resource Kit.

With Kill, you can also specify how the process is to be stopped: you can have Kill send it a command telling it to halt itself, or have Kill force the process to end.

Task Killing Utility Topics

  • Kill Syntax
  • Kill Examples
  • Using Kill

Related Tools

File Required

  • Kill.exe


Using Kill

command prompt Open command prompt now.

To use Kill

  1. Find the process ID by using TList or another tool that displays process IDs.

  2. Execute Kill with the correct process id and options. See Kill Syntax for command-line usage.


Kill Syntax

command prompt Open command prompt now.

One Step kill [/f] {process_id | pattern}

Where:

/f

forces the process to terminate, rather than allowing it to halt itself.

process_id

specifies the ID number of the process to be ended.

pattern

can be either a complete process name, or an expression using wildcards that will be compared to the process names and window titles of all current processes. For example, typing kill *help* will end all processes with process names or window titles that contain "help".


Kill Examples

The first step is to get the process name or ID from Tlist as show below.

TList Sample Output

C:\NTRESKIT>tlist

   0 System Process
   2 System
  25 smss.exe
  33 csrss.exe
  39 WINLOGON.EXE
  45 SERVICES.EXE
  48 LSASS.EXE
  74 SPOOLSS.EXE
  88 RPCSS.EXE
139 INV32CLI.EXE
168 RCONSVC.EXE
 180 atsvc.exe
193 WUSER32.EXE
 203 inetinfo.exe
 204 wnvirq32.exe
 245 cidaemon.exe
 259 NDDEAGNT.EXE
  69 EXPLORER.EXE      Program Manager
 275 systray.exe

Example: killing the wnvirq32 process by using the process id

C:\NTRESKIT>kill 204
process #204 killed

Example: killing the atsvc process by using the process name

C:\NTRESKIT>kill atsvc
process #180 [atsvc.exe] killed


Memsnap.exe: Memory Profiling Tool

Memsnap.exe: Memory Profiling Tool NEW

This memory profiling tool takes a snapshot of the memory resources being consumed by all running processes and writes this information to a log file.

MemSnap logs system memory usage to a log file with the default name of Memsnap.log; however, any file name can be chosen by specifying it at the command line when starting the tool.

Memory Profiling Tool Topics

  • MemSnap Syntax
  • MemSnap Example Output

File Required

  • Memsnap.exe


MemSnap Syntax

command prompt Open command prompt now.

One Step memsnap [logfile]

Where:

logfile
is the name of the file where Memsnap writes its information (the default is Memsnap.log).


MemSnap Example Output

Process ID

Proc.Name

Wrkng.Set

PagedPool

NonPgdPl

Pagefile

Commit

Handles

Threads

0

(null)

16384

0

0

0

0

0

1

2

System

28672

0

0

36864

36864

154

26

21

smss.exe

204800

933

1224

167936

167936

31

6

26

csrss.exe

684032

36177

5096

1507328

1507328

302

10

35

winlogon.exe

0

24206

11392

1130496

1130496

52

4

41

services.exe

618496

15513

177716

1097728

1097728

214

13

44

lsass.exe

204800

13051

20624

1036288

1036288

108

12

71

spoolss.exe

32768

16090

709896

3166208

3166208

117

9


Ntmsgs.chm: Messages

Windows Help Open Messages now.

This HTML Help file lists most of the error and system-information messages generated by the Windows 2000 operating system, providing explanations of each message and suggestions on how to correct the problem. Some messages generated by applications or device drivers have been included as well.

An Access database (Ntevntlg.mdb: Event Log Database) of Event Log messages is also provided in the Resource Kit.

Important The Messages and the Event Log Database are not intended as exclusive references. If, for example, you encounter a network error message in the command prompt window, you can also find help for the network problem by typing net helmsg and the message identification number.

Ntmsgs.chm Topics

  • Installing Ntmsgs.chm
  • Using Ntmsgs.chm
  • Ntmsgs.chm Notes

Files Required

  • Ntmsgs.chm

For More Information

See Ntevntlg.mdb: Event Log Database


Using Ntmsgs.hlp

Using Ntmsgs.chm

Windows Help Open Ntmsgs.chm now.

How Messages in this Help File are Organized

The messages in this file have been organized to reflect the Windows 2000 Desktop. The messages appear in the Help file as follows:

  • Messages are normally followed by a description of the circumstances that might generate the message and, if appropriate or needed, by a suggested user action.

  • Variable names appear in italics.

  • Most status messages that require no user action are not documented.

How to search for messages

There are several ways to search for messages the Messages Help file. Starting from the Contents tab, double-clicking the Messages icon presents a heirarchial listing of topics grouped by application catagory or component as found on the Start menu. (Some additional topical groupings which are not application specific are also included.) This list includes:

  • In Alphabetical Order

  • Administrative Tools

  • Command Line Tools

  • Control Panel

  • Desktop

  • Dynamic Link Libraries

  • Event ID

  • Event Log

  • Help

  • Internet Information Server

  • Kernel

  • Logon

  • Setup

Click on a main component to see a list of the applications that are associated with that component. For example, if you want to find an error message for Dial-up Networking, double-click Accessories on the Contents page. Select Dial-Up Networking to view an alphabetical list of the messages for that application. After you open a message, you can then use the browse buttons to display other messages in that component.

Clicking the In Alphabetical Order button provides access to messages arranged alphabetically by the first letter of the first word of the message. Click on the letter that corresponds to the initial letter in the message. If you cannot find the message that appears on your screen in the alphabetical list, it might be because it begins with a replaceable parameter. Variable names, which are placeholders for the specific word or number that appears in the message, are used as substitutes for replaceable parameters. They appear in italics in the Help file. For example, if the Help file message reads, "number files were not found," the error message that appears on your screen will contain the actual number.

To view the messages that begin with a variable or a punctuation mark, click the In Alphabetical Order button, then the Symbol button . These messages are alphabetized by the variable name used to replace that parameter. The following is a list of all the variable names used in the Messages Help file as substitutes for replaceable parameters:

address | date | name | text
application | drive letter | number | time
code | file system | parameter | user name
command | filename | path |
computer name | group | systemroot |

  • Clicking the Event ID button displays ranges of event messages that are organized numerically. Click on the appropriate range to display the corresponding messages. The log in which a message appears is indicated at the end of each message string.

  • Clicking the Event Log button displays the three event logs—System, Security and Application. The messages in each log are listed alphabetically.


Ntmsgs.hlp Notes

Ntmsgs.chm Notes

The included Access database file (Ntevntlg.mdb) contains messages and related information from the Event Log, an administrative tool that is part of the Windows 2000 operating system. This database contains the messages from the System, Security, and Application logs along with their corresponding Event ID, Source, and Type.

You must have Microsoft Access installed on your computer to view this database. If you have Access 97 installed, you might get a notice the first time the file is accessed stating it is a read-only file. If file permissions need to be changed to allow writes, these can be made using Windows Explorer.

Product Support Suggestions

When reviewing the help file message information, sometimes the only suggested user action is to obtain help from Microsoft support or another technical support group. In that case, we suggest you verify that your hardware is on the Hardware Compatibility List for your specific product or application. If it is not certified, please replace it with a certified component and retest.

If the error still occurs, collect the following information and have it available before contacting technical support for help:

  • The type of hardware that you are using, including networking hardware, if applicable. Include bios revision number and any applied flash bios / firmware versions.

  • A list of all software (name and version) installed on the system, including service packs and upgrades.

  • The exact text and content of the message that appears on the screen. With messages that stop the box completely, also note the background and text colors (white letters on black screen, white letters on a blue screen, etc.)

  • A description of what happened, that is, a description of the problem.

  • A description of actions you took immediately before the error occured and what you were doing when the problem occurred. If the problem can be manually reproduced, that list of steps is critical.

  • Did the system ever work correctly? If so, what has changed since the system last worked properly? (hardware changes, configuration settings, applications installed, etc.)

  • Have your current/latest Emergency Repair Disk (ERD) as well as your initial ERD, if available. Also, have your last backup media handy in the event a recovery from system failure is unsuccesssful.

Microsoft offers a variety of support options to help you get the most from your Microsoft product. For information on some of these options, please refer to the World Wide Web. Windows NT and Windows 2000 support options can be found at:

http://support.microsoft.com/support

This site has links to the Windows NT Troubleshooting Guide and the Windows NT Knowledge Base, where you can search for articles, whitepapers and troubleshooting guides that address specific error messages or problems.


Reg.exe: Registry Editor

Reg.exe

This tool enables you to add, change, delete, search, backup, restore, and perform other operations on registry entries from the command prompt or a batch file. It can be used on both local and remote computers.

Reg incorporates the functionality of and replaces the following registry tools from previous Resource Kits: Regchg.exe, Regdel.exe, Regdir.exe, Regread.exe, Regsec.exe, Restkey.exe, Rregchg.exe, and Savekey.exe.

Caution Use extreme care when editing the registry of a local or remote computer. Do not use these tools unless you understand the changes you are making to the computer configurations. It is also highly recommended that you always back up the registry of any computer before making changes to it. You should typically change system settings by using the Control Panel options and other tools provided with Windows 2000.

Reg.exe Topics

Reg.exe supports the following commands:

  • REG QUERY

    Returns information about the current value entries or subkeys under a specified registry key or hive.

    REG QUERY Syntax REG QUERY Examples
  • REG ADD

    Adds a new registry value entry under the specified key.

    REG ADD Syntax REG ADD Examples
  • REG UPDATE

    Changes the current value of a registry entry; if there is no current entry no change will be made.

    REG UPDATE Syntax REG UPDATE Examples
  • REG DELETE

    Deletes a registry entry, key, or keys.

    REG DELETE Syntax REG DELETE Examples
  • REG COPY

    Copies a registry entry to a new location in the registry of the current or remote machine.

    REG COPY Syntax REG COPY Examples
  • REG SAVE and REG BACKUP

    Copies a specified registry entry, key, or hive, to a specified file. Useful for backing up portions of the registry prior to making changes. REG SAVE is identical to REG BACKUP.

    REG SAVE and BACKUP Syntax REG SAVE and BACKUP Examples
  • REG RESTORE

    Restores a specified registry entry, key, or hive from a file created by REG SAVE or REG BACKUP.

    REG RESTORE Syntax REG RESTORE Examples
  • REG LOAD

    Temporary loads a specified key or hive from a REG BACKUP or REG SAVE file into the root of the registry, e.g., for purposes of viewing, troubleshooting, or editing the registry entries of a machine that is not configured properly or is not connected to the network.

    REG LOAD Syntax REG LOAD Examples
  • REG UNLOAD

    Removes a specified key or hive that has previously been loaded using REG LOAD.

    REG UNLOAD Syntax REG UNLOAD Examples

For More Information

Command prompt Open command prompt now.

command prompt now.

For usage information, at the command prompt type:

reg /?

For usage information on a specific operation, at the command prompt type:

reg operation /?

File Required for Reg

  • Reg.exe


REG QUERY Syntax

Command prompt Open command prompt now.

REG QUERY RegistryPath [\\Machine] [/S]

Where:

RegistryPath

is in the format [ROOTKEY\]Key [\ValueName]

Where:

ROOTKEY

specifies the root key to start the search from (default = HKEY_LOCAL_MACHINE).

The Root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

Key

is the full name of a registry key under the selected ROOTKEY.

\ValueName

is the value to query under the selected key. (Optional. When omitted all keys and values under the Key are listed.)

Machine

is the name of a remote machine (default = current machine). Do not use drive letters to specify remote machines. Use double backslashes, followed by the name of the machine. (e.g., \\ZODIAC).

Note Only HKLM and HKU are available on remote machines.

/S, /s

Queries all subkeys under the specified key.


REG QUERY Example

REG QUERY Examples

The following are valid examples of REG QUERY commands:

REG QUERY HKLM\Software\Microsoft\ResKit\Setup\InstallDir

Displays the value of the InstallDir registry entry.

REG QUERY HKLM\Software\Microsoft\ResKit\Setup /S

Displays all keys and values under the Setup subkey.


REG ADD Syntax

Command prompt Open command prompt now.

REG ADD RegistryPath=Value [DataType] [\\Machine]

Where:

RegistryPath

is in the format [ROOTKEY\]Key \ValueName

Where:

ROOTKEY

specifies the root key from which to start the search (default = HKEY_LOCAL_MACHINE).

The Root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

Key

is the full name of a registry key under the selected ROOTKEY.

ValueName

is the name of the value to be changed under the selected key.

Value

is the new value to assign to the ValueName for the specified registry key.

DataType

specifies the numeric or string data type to be used (default = REG_SZ). The following Data Types are recognized by Reg.exe (note that the REG_BINARY data type cannot be used):

REG_SZ

Data which consists of a simple data string.

REG_DWORD

Numeric Data, represented by a number that is four bytes long.

REG_EXPAND_SZ

An expandable data string. The text contains a variable to be replaced when called by an application.

REG_MULTI_SZ

A multiple data string, with the values separated by NULL characters, such as semicolons.

\\Machine

is the name of a remote machine (default = current machine). Do not use drive letters to specify remote machines. Use double backslashes, followed by the name of the machine. (e.g., \\ZODIAC).

Note Only HKLM and HKU are available on remote machines.


REG ADD Example

REG ADD Examples

The following are valid examples of REG ADD commands:

REG ADD HKLM\Software\MyCo\MyApp\Version=1.00

Adds the registry entry version=1.00 of type REG_SZ.

REG ADD HKLM\Software\MyCo\MyApp\MRU=fax;mail;draft REG_MULTI_SZ \\ZODIAC

Adds the registry entry MRU='fax mail draft' on machine ZODIAC.


REG UPDATE Syntax

Command prompt Open command prompt now.

REG UPDATE RegistryPath =Value [\\Machine]

Where:

RegistryPath

is in the format [ROOTKEY\]Key \ValueName

Where:

ROOTKEY

specifies the root key to start the search from (default = HKEY_LOCAL_MACHINE).

The Root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

Key

is the full name of a registry key under the selected ROOTKEY.

\ValueName

is the name of the value to be changed under the selected key.

Value

is the new value to assign to the ValueName for the specified registry key.

DataType

specifies the numeric or string data type to be used (default = REG_SZ). The following Data Types are recognized by Reg.exe (note that the REG_BINARY data type cannot be used):

REG_SZ

Data which consists of a simple data string.

REG_DWORD

Numeric Data, represented by a number that is four bytes long.

REG_EXPAND_SZ

An expandable data string. The text contains a variable to be replaced when called by an application.

REG_MULTI_SZ

A multiple data string, with the values separated by NULL characters, such as semi-colons.

Machine

is the name of a remote machine (default = current machine). Do not use drive letters to specify remote machines. Use double backslashes, followed by the name of the machine. (e.g., \\ZODIAC).

Note Only HKLM and HKU are available on remote machines.


REG UPDATE Examples

The following are valid examples of REG UPDATE commands:

REG UPDATE Software\MyCo\MyApp\Timeout=10

Replaces the existing value for Timeout with 10. Defaults to HKLM.

REG UPDATE HKLM\Software\MyCo\MyApp\MRU=fax;mail;draft

Replaces the existing value for MRU with 'fax mail draft'. (MRU is assumed to be of data type REG_MULTI_SZ for this example.)


REG DELETE Syntax

Command prompt Open command prompt now.

REG DELETE RegistryPath [\\Machine]

Where:

RegistryPath
is in the format [ROOTKEY\]Key [\ValueName]
ROOTKEY
specifies the root key where the entry to be deleted is located (default = HKEY_LOCAL_MACHINE).

The Root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC
Key
is the full name of a registry key under the selected ROOTKEY.
ValueName
is the value to delete under the selected key. (Optional. When omitted all keys and values under the Key are deleted.)
Machine
is the name of a remote machine (default = current machine). Do not use drive letters to specify remote machines. Use double backslashes, followed by the name of the machine. (e.g., \\ZODIAC).

Note Only HKLM and HKCU are available on remote machines.


REG DELETE Example

REG DELETE Examples

The following are valid examples of REG DELETE commands:

REG DELETE HKLM\Software\MyCo\MyApp\Timeout

Deletes the Timeout registry entry.

REG DELETE HKLM\Software\MyCo \\ZODIAC

Deletes the ENTIRE hive MyCo on ZODIAC.


REG COPY Syntax

Command prompt Open command prompt now.

REG COPY Source [\\Machine] Destination [\\Machine]

Where:

Source and Destination

are in the Registry Path format [ROOTKEY\]Key [\ValueName]

Where:

ROOTKEY

specifies the root key where the entry to be copied is located (default = HKEY_LOCAL_MACHINE).

The Root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

Key

is the full name of a registry key under the selected ROOTKEY.

\ValueName

is the value to copy under the selected key. (Optional. When omitted all keys and values under the Key are copied.)

Machine

is the name of a remote machine (default = current machine). Do not use drive letters to specify remote machines. Use double backslashes, followed by the name of the machine. (e.g., \\ZODIAC).

Note Only HKLM and HKU are available on remote machines.


REG COPY Example

REG COPY Examples

The following are valid examples of REG COPY commands:

REG COPY HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp

Copies the key MyApp and all of its entries to SaveMyApp under MyCo.

REG COPY Software\MyCo \\SAFARI Software\MyCo \\ZODIAC

Copies the ENTIRE hive MyCo on SAFARI to MyCo on ZODIAC.


REG SAVE and REG BACKUP Syntax

Command prompt Open command prompt now.

REG SAVE RegistryPath FileName [\\Machine]

REG BACKUP RegistryPath FileName [\\Machine]

Where:

RegistryPath

is in the format [ROOTKEY\]Key

Where:

ROOTKEY

specifies the root key containing the key to be saved (default = HKEY_LOCAL_MACHINE).

The Root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

Key

is the full name of a registry key under the selected ROOTKEY.

FileName

is the name of the destination disk file, without an extension. (On local machines, this file is saved to the current directory. On remote machines, it is saved to the Windows directory).

Machine

is the name of a remote machine (default = current machine). Do not use drive letters to specify remote machines. Use double backslashes, followed by the name of the machine. (e.g., \\ZODIAC).

Note Only HKLM and HKU are available on remote machines.


REG SAVE and REG BACKUP Examples

The following are valid examples of REG SAVE and REG BACKUP commands (note that the two commands are identical):

REG SAVE HKLM\Software\MyCo\MyApp AppBkUp

Saves the hive MyApp to the file AppBkUp.

REG BACKUP HKLM\Software\MyCo MyCoBkUp \\ZODIAC

Saves the hive MyCo on ZODIAC to the file MyCoBkUp also on ZODIAC.

Note On local machines, REG SAVE or BACKUP save the file to the current directory. On remote machines, the file is saved to the Windows directory for machines running Windows 98 or the System32 directory for machines running Windows NT or Windows 2000.


REG RESTORE Syntax

Command prompt Open command prompt now.

REG RESTORE FileName KeyName [\\Machine]

Where:

FileName

is the name of the file to be restored, without an extension. This file must have been created with REG SAVE or REG BACKUP.

KeyName

is in the format [ROOTKEY\]Key

Where:

ROOTKEY

specifies the root key containing the key to be restored (default = HKEY_LOCAL_MACHINE).

The Root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

Key

is the full name of a registry key under the selected ROOTKEY.

Machine

is the name of a remote machine (default = current machine). Do not use drive letters to specify remote machines. Use double backslashes, followed by the name of the machine. (e.g., \\ZODIAC).

Note Only HKLM and HKU are available on remote machines.


REG RESTORE Examples

The following are valid examples of REG RESTORE commands:

REG RESTORE W98RKBkUp HKLM\Software\Microsoft\ResKit

Restores the hive file W98RKBkUp overwriting the subkey ResKit.

REG RESTORE W98RKBkUp HKLM\Sofware\Microsoft\ResKit \\ZODIAC

Restores the hive file W98RKBkUp overwriting the subkey ResKit on ZODIAC.


REG LOAD Syntax

Command prompt Open command prompt now.

REG LOAD FileName KeyName [\\Machine]

Where:

FileName

is the name of the hive file to be loaded, without an extension. This file must have been created with REG SAVE or REG BACKUP.

KeyName

specifies the temporary key to be created, in the format [ROOTKEY\]Key

Where:

ROOTKEY

specifies the root key to contain the temporary key (default = HKEY_LOCAL_MACHINE).

The Root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

Key

is the full name of a registry key under the selected ROOTKEY where the hive file is to be loaded, creating a new temporary key containing the contents of the hive file. This key will be non-persistent, and will be deleted on the next reboot, or with the REG UNLOAD command.

Machine

is the name of a remote machine (default = current machine) where the hive file is to loaded. Do not use drive letters to specify remote machines. Use double backslashes, followed by the name of the machine. (e.g., \\ZODIAC).

Note Only HKLM and HKU are available on remote machines.


REG LOAD Example

REG LOAD Examples

The following are valid examples of REG LOAD commands:

REG LOAD TempHive HKLM\TempHive

Loads the hive file TempHive to the Key TempHive under HKLM.

REG LOAD TempHive HKLM\TempHive \\ZODIAC

Loads the hive file TempHive to the key HKLM\TempHive on ZODIAC.


REG UNLOAD Syntax

Command prompt Open command prompt now.

REG UNLOAD KeyName [\\Machine]

Where:

KeyName

is the key name of the hive to be unloaded, in the format [ROOTKEY\]Key

Where:

ROOTKEY

specifies the root key containing the key to be unloaded (default = HKEY_LOCAL_MACHINE).

The Root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

Key

is the full name of the temporary registry key to be unloaded, under the selected ROOTKEY.

Machine

is the name of a remote machine (default = current machine) from which a temporary hive is to be unloaded. Do not use drive letters to specify remote machines. Use double backslashes, followed by the name of the machine. (e.g., \\ZODIAC).

Note Only HKLM and HKU are available on remote machines.

Note You cannot unload a hive that was loaded by the system. Also, you cannot unload a hive if an application has an open [image] handle to any subkey in the hive.


REG UNLOAD Examples

The following are valid examples of REG UNLOAD commands:

REG UNLOAD HKLM\TempHive

Unloads the hive TempHive from HKLM.

REG UNLOAD HKLM\TempHive \\ZODIAC

Unloads the hive TempHive from the machine ZODIAC.


Sc.exe: Service Controller Query Tool

Command prompt Open command prompt now.

One Step For syntax details, at the command prompt, type: sc /? or sc

WordPad Open "Using Sc.exe to Develop Windows 2000 Services" (Sc-dev.txt) now.

This tool provides a way to communicate with Service Controller (Services.exe) from the command prompt to retrieve information about services.

Service Controller Query Tool is useful for testing and debugging your service program. SC implements calls to all of the Windows 2000 service control functions. You can specify any function parameters through the command line. You can create batch files that call SC with various command lines to see how your service behaves with repeated starting and stopping.

SC also displays complete status information, including state, checkpoint number, and wait hint.

SC Topics

  • SC Syntax
  • How Administrators Can Use SC
  • How Developers Can Use SC

Files Required

  • Sc.exe
  • Sc-dev.txt


How Administrators Can Use SC

Administrators can find out the name of the binary for any service, and whether it shares a [image] process with other services, by running this command from the command prompt:

sc qc servicename

SC can help match up services in the Services Control Panel applet with processes in Performance Monitor; if the binary name is Services.exe, the service shares the Service Controller process.

Services.exe, Service Controller (also known as Service Control Manager), starts all the services. A number of Win32 services developed within the Windows 2000 group have been written to share the Service Controller's process, in order to conserve system resources. These services don't show up as separate processes in Performance Monitor.

Win32 services developed outside the Windows 2000 group can also be configured to share processes with each other, so there might not be a process for every other service. SC can be used to get configuration information on these services. If a service doesn't share its process with other services, however, there will definitely be a process for it in Performance Monitor when the service is running.


How Developers Can Use SC

SC can be useful for developers of services, because it provides more detailed and accurate information about services than the two end-user tools provided with Windows 2000. The Services Control Panel applet and the network command-line interface, Net.exe, can determine whether a service is running, stopped, or paused. Although these tools are fine for completely debugged applications when everything is running smoothly, the information they provide about a service being developed can be misleading.

SC implements calls to all of the Windows 2000 service control application programming interface (API) functions. You can set the parameters to these functions by specifying them at the command prompt.

With SC, you can query the service status and retrieve the values stored in the status structure fields. Net.exe and the Services Control Panel applet cannot provide you with the complete status of a service, but SC will tell you the exact state of the service, as well as show the last checkpoint number and wait hint. The checkpoint can then be used as a debugging tool, because it provides a clear indication of how far the initialization progressed before the program froze. The tool also lets you specify the name of a remote computer so that you can call the service API functions or view the service status structures on the remote computer.


Win32 Debugger Tools

Win32 Debugger Tools NEW

The Microsoft Windows 2000 Debugging Tools are a suite of debuggers and debugging-related tools. They are intended for use by users experienced in debugging such as application developers, driver developers, and administrators.

Caution Incorrect debugging can crash processes as well as the operating system.

Windbg is the main debugger produced by the Windows 2000 Debugger development team. NTSD and KD are provided for those familiar with these debuggers, and in scenerios where Windbg may not support a particular operation. Included debuggers are:
  • Windbg.exe - Windbg debugger
  • Windbgrm.exe - Windbg Remote
  • Dbgwiz.exe - Windbg Configuration Wizard
  • Alphakd.exe - Kernel Debugger for Alpha systems
  • I386kd.exe - Kernel Debugger for x86 systems
  • Cdb.exe - CDB Debugger (a variant of NTSD)
  • Ntsd.exe - NTSD Debugger

    Note On Windows 2000, Ntsd.exe ships with the operating system and is in %systemroot%\system32.

Kd (i386kd, mipskd, alphakd & ppckd) is the kernel debugger which is run on a separate debug machine to find problems in the kernel and drivers on a test machine. Ntsd is a "software debugger" which is used to debug user mode processes on a test machine. WinDbg is a windows-based debugger which can be used to debug either kernel or user mode. It is larger and somewhat slower than its text counterparts, but it has additional features, including source-level debugging. Ntsd (and windbg when debugging user mode processes) use symbols in the %windir%\symbols directory. The dll and exe symbols are needed for debugging most user mode problems. The following debugger-related tools are also included:
  • gflags.exe - Global Flags tool
  • dumpchk.exe - Dump Check tool
  • breakin.exe - BreakIn tool
  • remote.exe - Remote tool
  • kill.exe - Process Kill tool
  • list.exe - File List tool
  • drwtsn32.exe - Dr. Watson tool

    Note Dr. Watson ships with the operating system and is in %systemroot%\system32.

For More Information
  • Windbg help
  • Dr. Watson help

Files Required

  • Windbg.hlp


Setupmgr.exe: Setup Manager

Setup Manager Run Setup Manager now.

This wizard is a deployment tool that assists system administrators in automating the installation or upgrading of Windows 2000 on multiple computers, eliminating the need to monitor these operations. It can be used in corporate, OEM and VAR deployments.

Answer Files

Setup Manager helps administrators to create answer files, which are used by Windows 2000 Setup to perform unattended installations or upgrades of Windows 2000. Answer files answer the questions that Setup would normally ask the user while it is installing or upgrading Windows 2000. For example, Setup normally asks the user to supply a name for the computer. But if you supply the name for the computer in the answer file, Setup does not have to prompt the user.

When you use the Setup Manager Wizard to create an answer file, it prompts you for setup information on wizard pages, many of which look like the pages you see when running an attended Setup. Note that answer files do not automatically eliminate the need for user input when Setup runs. The parameters in answer files must be set to require little or no user interaction.

User-Interaction Level

Windows 2000 Setup runs in one of five unattended modes that controls how much it interacts with the user. In a fully unattended installation, Setup does not prompt the user for any information and you must supply all required information in the answer file. In this case, Setup Manager requires that you specify data for all required settings. When using any of the other unattended modes, Setup Manager allows you to not specify some data. If you do not wish to specify a particular setting in the answer file, leave that field blank, or choose "Do not specify this setting" in certain cases.

If you are upgrading an existing Windows 2000 installation, Setup uses the parameters of the existing installation and ignores parameters specified in the answer file.

Setup Manager is a Win32 application and runs only on Windows 2000.

Starting Setup Manager

You can run Setup Manager from the Tools Management Console, from the command prompt, or by clicking the "Run Setup Manager now" link at the top of this page.

To run Setup Manager from the command prompt, type:

setupmgr

Command prompt Open command prompt now.

Setup Manager Topics

  • AutoLogon
  • Distribution Folder
  • Running Your Own Commands: GuiRunOnce and Cmdlines.txt
  • Batch Scripts: .Bat and .Udf Files
  • Remote Install
  • SysPrep
  • Troubleshooting Setup Manager

Related Tools

Files Required

  • Setupmgr.exe
  • Setupmgr.dll
  • Setupmgr.inf

For More Information

For detailed information about deploying Windows 2000, visit the Deployment pages of the Microsoft Windows 2000 Server Web site at Internet http://www.microsoft.com/ntserver/windowsnt5/deployment/.


Setup Manager - AutoLogon

AutoLogon

After the unattended setup is complete you can cause the freshly installed system to automatically log in as the Administrator. This is only permitted if there is an empty password for the Administrator account. The Setup Manager Wizard will not allow AutoLogon to be enabled unless an empty password is set.

Enabling AutoLogon prevents network printers from being installed for a domain user's account. Instead, the system processes the GuiRunOnce key while logged on as Administrator. If you install network printers, AutoLogon should not be enabled.


Setup Manager - Distribution Folder

Distribution Folder

A distribution folder enables you to supply your own files that Windows Setup automatically copies to the target computers. Setup Manager can guide you through the process of creating a distribution folder.

Such files could include help files that you want to reside on every computer in your organization Tor device drivers not shipped with Windows 2000. They could also be your own applications that you want to deploy to the target computers.

When you create a distribution folder using the Setup Manager Wizard, you need at least enough free disk space to hold the Windows 2000 CD plus the amount of disk space needed to store the files you are deploying yourself.

Use the Additional Dirs page to supply your own files to be deployed. First expand and collapse the tree-view to select the destination for the files. Once you select where to copy the files to, click AddFiles, and Setup Manager will allow you to browse for a file or folder to copy.

If you examine your distribution folder after using the Additional Dirs page, you will notice that all of the files and folders you copied were stored in a sub-directory named $oem$. Also, notice that the files you want placed in the "System Drive" tree were placed in $oem$\$1. Each of the special keys that are displayed on the Additional Dirs page maps to a special sub-directory of the $oem$ directory.

When an unattended Setup runs using a distribution folder, the entire tree rooted at $oem$ is copied to the temporary Windows Setup directory $WIN_NT$.~LS. At some point during Setup, trees in special sub-directories, such as $1, are copied to the corresponding location on the target computer. At the end of Setup, the $oem$ tree is deleted.


Setup Manager - Running Your Own Commands: GuiRunOnce and Cmdlines.txt

Running Your Own Commands: GuiRunOnce and Cmdlines.txt

Setup Manager contains two similar pages that allow you to run your own commands. The difference between these pages should be noted.

Run Once

The Run Once page is implemented by using the GuiRunOnce key of the answer file. This key is processed when setup is completed and the first login occurs.

Command Lines

The Command Lines page is implemented using the distribution folder. Setup Manager writes the list of commands you enter to a special file, Cmdlines.txt, saved in the $oem$ sub-directory of your distribution folder.

Unlike the Run Once commands, the commands in Cmdlines.txt are processed at the end of Setup, just before it re-boots to prompt for the first login.

Note that while Setup runs, nobody is logged in. Therefore, commands run on the Command Lines page do not have access to protected network resources.


Setup Manager - Batch Scripts: .Bat and .Udf Files

Batch Scripts: .Bat and .Udf Files

Setup Manager creates a sample batch script to illustrate how to use the answer file you created. In certain cases, the sample batch script must be modified before it will work properly.

In all cases, the answer file must be passed to Windows Setup using the /unattended: option of either the winnt32 (for Win32 systems) or the winnt commands (for DOS). See the sample batch script for an example.

If you are deploying using a distribution folder, the sample batch script must be changed to refer to the correct distribution folder.

If you copied the answer file to a different location, the batch script must be modified to refer to the new location.

If you specified multiple computer names, Setup Manager creates a batch script that expects the computer name to be passed on the command line. In this case, the .udf file must also be present.

When using the .udf file for multiple computer name assignment, it must be passed to winnt32 or winnt using the /udf option. See the sample batch script for an example.


Setup Manager - Remote Install

Remote Install

When you create an answer file to be used with a Remote Install Server (RIS), Setup Manager creates a .sif file instead of the usual .txt file.

A sample batch script is not created in this case. You must use the Administration tools shipped with RIS to enable your new .sif file.


Setup Manager - SysPrep

SysPrep

Information on this topic is not yet available.


Setup Manager - Troubleshooting Setup Manager

Troubleshooting Setup Manager

Q: My Fully Automated Setup stops because the directory \Winnt already exists. How can I prevent this?

A: Choose, "Yes, edit additional settings". When you get to the Target Path page, enable "Automatically generate a unique name."

Q: How do I install on a particular drive letter?

A: Use the /tempdrive: option on winnt32 or winnt.

Q: I specify "Use Windows Default" for display settings and my fully unattended install prompts for video settings. What should I do?

A: In Windows 2000 Beta 3, you must specify at least a video resolution for a fully unattended install.


SIDwalker

SIDwalker: Security Administration Tools NEW

This set of programs helps system administrators manage access-control policies on Windows 2000 and Windows NT systems. Access control is implemented by access-control lists (ACLs). Every file in the NTFS file system and every registry key has a unique ACL. Access rights to file resources are granted to users and groups and what access rights they are granted. Each user and group is identified in the ACL by a security identity (SID).

Modifying Access Control

The SIDwalker tools are designed to support a three-phase approach to modifying access control. Each phase of changing access control can take a day or longer to complete and verify and requires some amount of system resources and administrator time. The phases are:

  • Planning
    The administrator needs to determine what users have been granted access to resources (file shares, print shares, NTFS files, registry keys, and local group membership) on a particular computer.

  • Mapping Accounts
    Based on who has access to what resources on the system, the administrator can chose to delete old, unused security identities, or replace them with corresponding new identities, such as new security groups.

  • Converting ACLs
    Using the information from the planning and mapping phases, the third phase is the conversion of security identities found anywhere on a system to corresponding new identities.

Why Use SIDwalker?

Administrators will find the SIDwalker tools most useful for the following operations:

  • Monitoring security policy on specific Windows 2000 and Windows NT systems

  • General maintenance and clean-up of access control for Windows 2000 and Windows NT file systems

  • Support for moving Windows 2000 and Windows NT servers from one domain to another domain and updating the access control using accounts defined in the destination domain

SIDwalker Components

SIDwalker consists of three separate programs. Two of these, Showaccs and Sidwalk, are command-line tools for examining and changing access-control list entries. The third, Security Migration Editor, is a Microsoft Management Console (MMC) snap-in for editing mapping between old and new security identifiers (SIDs). The SIDwalker tools are designed to run independently of each other.

SIDWalker Topics

  • Showaccs
  • Security Migration Editor
  • Sidwalk
  • Using the SIDwalker Tools
  • Access-control Policy Migration Scenario
  • Migrating Domains from Windows NT 4.0 to Windows 2000

Related Topics

Files Required

  • Showaccs.exe
  • Sidwalk.exe
  • Msvcrt50.dll

Showaccs.exe and Sidwalk.exe are stand-alone application programs that can run on either Windows 2000 or Windows NT 4.0. On Windows NT 4.0 systems, they require Msvcrt50.dll, which is available from the \System32 directory of any Windows 2000 installation.

  • Sidwkr.dll
  • Sidwalk.msc

Sidwkr.dll is the snap-in file for Security Migration Editor. Security Migration Editor requires the MMC, which is available for Windows 2000 or Windows NT 4.0. Sidwalk.msc is also provided as a saved MMC console shortcut.


SIDWalker: Showaccs

Showaccs

Showaccs is a command-line program that enables users to examine the access-control lists (ACLs) on the registry, file system, and file and print shares, and to look at membership in local groups. Showaccs command options support looking at specific areas of Windows 2000, such as specific file-system directories, or examining the entire system.

The output file of Showaccs is a comma-separated text file, called the access-profile file, showing all the object-specific access rights on the system. The access-profile file can be reviewed and analyzed using a text editor or imported into a spreadsheet or database management program.

Showaccs also creates a mapping file that lists the security principals (users and groups) that show up somewhere in ACLs. The mapping file can be input to the Security Migration Editor Microsoft Management Console (MMC) snap-in for account mapping.

Showaccs Syntax

Command prompt Open command prompt now.

one step showaccs access_profile_file [/f [path]] [/r] [/s] [/p] [/g] [/m [map_file_path]] [/nobuiltins] [/?]

Where:

access_profile_file
is the path of the .csv file to be generated.
/f path
shows access rights for all NTFS files or, optionally, for those on the directory tree of the specified path.
/r
shows access rights for the registry.
/s
shows access rights for file shares.
/p
shows access rights for printer shares.
/g
shows access rights for local groups.
/m map_file_path
generates a map file, optionally in the directory specified by map_file_path.
/nobuiltins
omits access rights for built-in groups.
/?
(or showaccs with no switch) displays a usage screen.


SIDWalker: Security Migration Editor

Security Migration Editor

The Security Migration Editor is an Microsoft Management Console (MMC) snap-in that provides a graphical user interface for mapping old security identifiers (SIDs) listed in a mapping file created by Showaccs to new security identifiers. The “migration” referred to is from old SIDs to corresponding new SIDs, which are mapped by selecting from the list of user and group accounts in target domains or computers. The snap-in also gives options to ignore or delete these SIDs as they show up in access-control lists (ACLs). The Security Migration Editor updates the mapping file, which is then used as input to Sidwalk.

Installing Security Migration Editor

Command prompt Open command prompt now.

Before running the Security Migration Editor snap-in, it must be initialized from the command prompt with the command:

regsvr32 sidwkr.dll

This initializes the class libraries used by the snap-in.

Using Security Migration Editor

To use the snap-in, add it to the MMC, which can be run from the Start menu. Security Migration Editor can also be started from the command prompt with the command:

mmc sidwalk.msc

Further instructions on using snap-ins can be found in Help for the MMC.


SIDWalker: Sidwalk

Sidwalk

Sidwalk is a command-line program that takes a mapping file as input and scans all the access control lists in the registry, file system, file and print shares, and local group membership. Sidwalk uses the mapping information in the mapping file to either delete or replace every occurrence of an old security identifier (SID) with the corresponding new SID. The same mapping file can be used for Sidwalk conversion on multiple computers.

Sidwalk Syntax

Command prompt Open command prompt now.

one step sidwalk profile_file [profile_file …] [/t] [/f] [/r] [/s] [/p] [/g] [/l file] [/?]

Where:

profile_file
is the path and filename of one or more .csv mapping files to be used for input.
/t
conducts a test/dry run.
/f
scans all NTFS files.
/r
scans the registry.
/s
scans file shares.
/p
scans printer shares.
/g
scans local groups.
/l file
generates a Converter log file with file as the filename and path.
/?
(or sidwalk with no switch) displays a usage screen.


SIDWalker: Using the SIDwalker Tools

Using the SIDwalker Tools

Showaccs and Sidwalk can be run as scheduled batch jobs. They must be run locally on the computer where the access permissions are to be changed. Both programs use Windows 2000 security APIs to examine every access-control list (ACL) on every object on the system. They are very CPU and I/O intensive programs: plan to run them when system use is otherwise very light and expect significant resource use.

Showaccs can examine the registry in approximately 5 minutes. Walking through the entire registry or file system, however, might require many hours, depending on file-system size and scope of analysis. Examining every ACL on every file and converting security identifiers (SIDs) on a large file system of roughly 50 gigabytes (GB) can take two or more hours with 100 percent CPU utilization.

Security Migration Editor does not have to run on the same computer on which Showaccs or Sidwalk run. An administrator can schedule Showaccs to run remotely on one server in the network, transfer the resulting files to a local workstation for analysis and update using Security Migration Editor, then copy the mapping file back to one or more target systems and run Sidwalk on them.


SIDWalker: Access-control Policy Migration Scenario

Access-control Policy Migration Scenario

The following example is a scenario requiring migration of access-control policies:

All of the files for a project on a file server have an access control list that grants the group ProjectTeam read/write access to the project files.

ProjectTeam is a security group that has a unique security identity in the Windows 2000 account directory. If the project changes and ProjectTeam merges into a larger project team, the administrator might want to change the access permissions on the project files. The read/write access-control rights granted to the original ProjectTeam can be replaced by access rights granted to a NewProjectTeam group. NewProjectTeam can be defined in a different NT domain and project file server. The computer on which the project file server runs can move from the current domain to a new domain for the larger project. In changing situations like this, SIDwalker can facilitate managing and updating security access policies on the servers involved.


Sysprep.exe

Sysprep.exe NEW

Sysprep is a tool designed for corporate system administrators, OEMs, and other personnel who need to deploy Windows 2000 on multiple machines. After performing the initial setup steps on a single system, you can run SysPrep to prepare the sample machine for cloning. SysPrep assigns a unique SID to each target computer the first time the computer is rebooted. Sysprep also creates a Mini-Setup wizard which runs the first time the target user reboots the machine. This shortened GUI-mode setup takes five to six minutes instead of 45 to 60 minutes and prompts the end user only for required and user-specific information, such as the End User License Agreement, Product ID, and user name and company.

Sysprep is a valuable utility even if you don’t use disk duplication. You can run SysPrep with the -nosidgen switch to create a shortened "Mini-Setup" on a single machine. In this case, SysPrep allows for auditing that may have been done, automates the Mini-Setup portion of the process so that users can still enter user-specific information such as regional settings and TAPI information, and bypasses setting up unique SIDs since the SIDs will already be unique when Setup is actually run on the computer.

Note The combination of Sysprep.exe and Setupcl.exe replaces the Rollback.exe utility used in automating deployment of Windows NT 4.0.

SysPrep Topics

  • Using SysPrep
  • Using SysPrep for Duplicated Setups
  • Using SysPrep to Audit Installations
  • SysPrep Syntax

Related Tools

Files Required

  • Sysprep.exe
  • Setupcl.exe


SysPrep: Automating Multiple Installations with Disk Duplication

Using SysPrep

When deploying Windows 2000, you can completely install the operating system and preconfigure the shell and applications to the degree required. You can then use Sysprep to enable user-specific customization when the computer is delivered or setup for the user. In this case, the first time the end user starts the computer, Mini-Setup runs to prompt the user for a minimal amount of information. The Sysprep folder is automatically deleted from the hard drive after Mini-Setup completes.

The Sysprep utility can be used in three different contexts:

  • Disk duplication. Using Sysprep with disk duplication allows you to copy fully installed systems when the hardware is similar. It modifies the local machine Security ID (SID) so that it is unique to each machine.
  • Auditing. When you use Sysprep after auditing the computer, Sysprep will be ready for the end user to run Windows.
  • Automating Mini-Setup. Sysprep creates a shortened GUI-mode setup that takes five to six minutes instead of 45 to 60 minutes and prompts the end user only for required and user-specific information, such as the End User License Agreement, Product ID, and user name and company. To use SysPrep in this mode, pre-install Windows 2000 on the local machine and then follow the procedure below.

To manually restore the computer to an end-user ready state with Sysprep

  1. On the Start menu, click Run, and then type:

    cmd

  2. At the command prompt, change to the root of the system drive (%systemdrive%) and then type:

    md sysprep

  3. From the <platform>\Support\Reskit\Deploy.cab file of the Windows 2000 compact disc, copy Sysprep.exe and Setupcl.exe to the Sysprep folder you have created.
  4. Remove the operating system CD.
  5. At the command prompt, change to the Sysprep folder, and then type:

    sysprep

    with the parameters you choose. See SysPrep.exe Syntax for a list of command-line parameters.
  6. The computer will automatically shut down if it is ACPI-compatible. If it is not ACPI-compatible, a message appears telling you to shut down the computer when the process has completed.

To automate the process of restoring the computer to an end-user ready state with Sysprep when using distribution folders and answer files

  1. To the \$OEM$\$1 folder of your distribution folders create a subfolder called \Sysprep.
  2. Add Sysprep.exe and Setupcl.exe to the \$OEM$\$1\Sysprep folder from the <platform>\Support\Reskit\Deploy.cab file of the Windows 2000 compact disc. A Sysdiff.inf answer file can also be created and placed in this folder if desired.
  3. In your answer file, add the following line to the bottom of the [GuiRunOnce] section:
    %systemdrive%\sysprep\sysprep.exe -quiet <additional parameters as required>

    See SysPrep.exe Syntax for a list of command-line parameters.
  4. After Windows 2000 Setup completes, the computer will automatically shut down if it is ACPI-compatible. If it is not ACPI-compatible, a message appears telling you to shut down the computer when the process has completed.

Notes

  • In the current beta version of Windows 2000, Sysprep runs only if the computer is a member of a workgroup, not a domain.
  • Because Sysprep is a cloning utility and doesn’t reset the Event Viewer logs, the logs on the target computers show the events that occurred on the master computer.
  • After you run Sysprep on a computer, the timeout is reset to the default. The default is two seconds when a single operating system is installed, 30 seconds when multiple operating systems are installed.


SysPrep: Automating Multiple Installations with Disk Duplication

Using SysPrep for Duplicated Setups

Using Sysprep with disk duplication allows you to copy fully installed systems when the hardware is nearly identical. (The HAL, ACPI support, and hard disk controllers must be identical. The number of processors installed and platform must also be identical; however, the particular model of processors need not be the same. The amount of RAM can differ between computers. Other Plug-and-Play devices such as modems, network cards, sound cards, and video cards do not have to be identical either. Note: If the master and target machines have different BIOS versions, you should test the process first to ensure success.

When using Sysprep for Disk Duplication, Sysprep modifies the local machine Security ID (SID) so that it is unique to each machine.

To prepare a master computer for cloning

  1. Install Windows 2000 on a master computer. As a best practice, Microsoft recommends that Windows 2000 be installed from a distribution folder using an answer file to help ensure consistency in configuring the master computer so that iterative builds can be created and tested more readily. (See Unattend.doc for information on automating Windows 2000 setup using an answer file.)
  2. Log onto the computer as administrator.
  3. (Optional) Install and customize applications (Microsoft Office, Internet Explorer favorites, etc.)
  4. (Optional) Run audit tests.
  5. (Optional) If the computer is not a member of a workgroup, make it a member of a workgroup at this point.

    Note In the current beta version of Windows 2000, Sysprep runs only if the computer is a member of a workgroup, not a domain. However, a Sysprep.inf file can be used to automate joining a domain if desired.

  6. (Optional) If desired, create a SysPrep.Inf file manually or with the aid of SetupMgr.EXE. This file is used to further customize each computer for the user and helps to set the amount of information for which the user will be prompted during Mini-Setup.
  7. Run Sysprep.exe. Make sure that both the SysPrep.exe and Setupcl.exe files exist together in the %systemdrive%\Sysprep folder on the local hard disk. When used, the Sysprep.inf also needs to be in the same folder.

    Important If Setupcl.exe is not in the same directory as SysPrep.exe, setup will fail.

  8. If the computer is ACPI compliant, the computer will shut down by itself. If not, a dialog will appear to stating that it is safe to shut down the computer.
  9. Take out the system drive and follow your procedures for duplicating the system on other machines. You must have special equipment or software for duplicating hard disks.

After a duplicated hard disk is inserted into a computer, when the user turns the computer on, the following happens:

  1. Plug-and-Play detection occurs - this takes approximately 3 minutes.
  2. The Mini-Setup wizard runs to prompt users to:
    • Accept the EULA
    • Enter their name and organization
    • Join a domain or a workgroup
    • Specify regional settings information
    • Specify TAPI information
    • Specify desired networking protocols and services to install.

    Note If a Sysprep.inf file was used when running Sysprep.exe, only the dialogues omitted in the .Inf file will be presented to the user. If display settings are omitted, the default settings will be used instead.

  3. The local Sysprep folder containing Sysprep.exe and Sysprep.inf on the %systemdrive% is deleted.
  4. The computer reboots and a logon prompt is then displayed.


SysPrep: Auditing Installations with SysPrep

Using SysPrep for Auditing Installations

You use the auditing process to verify that a computer is functional before it ships to the user. During the auditing process you can, for example, check that the operating system loads and applications launch properly, run a Disk Defragmenter program, run Chkdsk to check for corrupt hard disk files, verify that the licensing agreements are not being violated, and verify that all installed devices in Device Manager are properly recognized. You can also use auditing to verify that Welcome, Web Help, and OEM Help work properly, and that the Oeminfo.ini file is on the computer.

Windows 2000 preinstallation is set up so that you can use your own auditing tools to examine each computer that has Windows 2000 preinstalled. You can examine the computer as it will exist at the user site and then use the Sysprep tool to return the computer to a ready-to-ship state. Then, when the user receives the computer and turns it on for the first time, the computer runs Mini-Setup.

To audit a target computer that has Windows 2000 preinstalled

  1. Install Windows 2000 using the steps described in Chapter 8, "Deployment Methods" in the OEM Preinstallation Kit User's Guide. When Setup has completed and the target computer has restarted, the computer is running a fully installed version of Windows 2000.
  2. Create the \Sysprep folder, and then copy Sysprep.exe and Setupcl.exe to it. See Using Sysprep for more information.

    If you plan to run Sysprep from a floppy disk or the network, you can skip this step.

  3. Audit the system using a third-party auditing tool.

    Note You can reboot as many times as necessary while auditing the computer to your satisfaction, but the audit must meet the restrictions described in the following Important note.

    Important When you are auditing, do not overwrite any system files or otherwise disturb the preinstalled computer. Sysprep does not detect or restore system files that your auditing tools have changed.

  4. When auditing is complete, remove any files or folders placed on the hard disk during the auditing process. At the command prompt, move to the folder containing Sysprep.exe, and then type the following command with the options you want:

    sysprep /nosidgen

    followed by any other options you want. See Sysprep.exe Syntax for more information on Sysprep command-line parameters.

  5. When Sysprep finishes, immediately shut down Windows 2000. The computer is now ready to ship to the user.

You can also use other mechanisms to audit computers that have Windows 2000 preinstalled. For example, you might audit by starting MS-DOS from an MS-DOS disk and running your own tests from there. As long as these tests remove any information they write to the hard disk, they have no impact on the Windows 2000 preinstallation.


SysPrep Syntax

SysPrep.exe Syntax

Command prompt Open command prompt now.

One Step Sysprep [Sysprep.Inf] [-quiet] [-nosidgen] [-reboot]

Where:

Sysprep.inf
Is a file created with Setup Manager to customize the Mini-Setup routine that will run the first time the target user reboots the computer.
-quiet
suppresses confirmation dialogs displayed to the user.
-nosidgen
informs Setupcl.exe not to generate new SIDs on the reboot.
-reboot
forces the computer to reboot instead of shutting down (useful during auditing only).


Unattend.doc: Unattended Setup Parameters Guide

API Monitor Open Unattend.doc now.

This Word document describes how to install Windows 2000 in unattended setup mode, using an "answer file" (a text file that automatically supplies the information that would otherwise require interactive input from the user during setup.) Unattended setup mode allows administrators to create multiple similarly-configured installations of Windows 2000.

The Microsoft Windows 2000 Unattended Setup Parameters Guide (Unattend.doc) provides the complete list of unattended setup parameters to use in Windows 2000 unattended answer files. Included in this documentation are the necessary section headings, parameter values, definitions of the parameter functions, and examples. This file also contains sample answer files.

Related Tools

Files Required

  • Unattend.doc
  • Unattend.txt


Apimon.exe: API Monitor

API Monitor Run API Monitor now.

Windows Help Open API Monitor Help now.

This command-line tool monitors a running application for all Application Programming Interface (API) calls a process is making. APIMon counts and times the API calls. It also, optionally, monitors page faults caused by the monitored application and reports them by API call.

APIMon is useful as a performance monitor to help tune your application. You can determine the hot spots in an application by examining the APIs with the largest times and/or counts. You can look at which APIs are used, taking special note of calls that cause ring transitions to kernel mode or client/server transitions. Large numbers of these calls can be the cause of a slow application.

APIMon can generate two types of reports.

  • A report listing the number of calls made to each API and total time spent in each API
  • A trace file listing the individual calls to all APIs with the calling parameters as they occurred in time

APIMon Topics

  • Installing APIMon
  • Using APIMon
  • APIMon Syntax
  • APIMon Options

Files Required

  • Apimon.exe
  • Apimon.hlp
  • Apidll.dll


Using APIMon

API Monitor Run API Monitor now.

You can run APIMon from the command line, from the Tools Management Console, or by double-clicking Apimon.exe in Windows Explorer. After APIMon starts you must open a program for monitoring. When running APIMon from a command line, you can optionally specify the program name as an argument.

To monitor an application in APIMon

  1. Start APIMon.
  2. Open the application you want to monitor.
  3. Start the application by pushing the "Go" traffic light button, or click Tools and then click Start Monitor.

When the application starts, two windows appear. The first counts APIs and displays the time, and the second lists the current DLLs.


APIMon Syntax

command prompt Open command prompt now.

One Step apimon [options] [appname]

Where:

options
Are any of the options which may be specified on the APIMon properties page. See APIMon Options for more information
appname
is the name of the application to be monitored.


APIMon Options

command prompt Open command prompt now.

API Monitor Open API Monitor now.

The following options may be specified on the APIMon properties page, or when running APIMon from the command line:

Enable Tracing

Turns on API tracing. This causes APIMon to create a trace file containing one line of text for each API call made by the monitored application. The trace contains the following information:

1. Return Address

2. First four arguments

3. API Name

Enable Counters

Turns on API counting and timing.

Pre-Load Symbols

Enabling this option causes APIMon to load the debug symbols for all DLLS while the monitored program is executing. This option is turned on automatically when Monitor Page Faults is turned on.

Disable Heap Checking

When a process is being debugged, NTDLL's heap manager turns on a set of heap-checking flags. This ensures that if the process corrupts its heap, the debugger will catch the error. The heap checking flags also slow down the process and change the characteristics of the heap.

The Disable Heap Checking option disables this behavior and allows the process to run as if it were not being debugged.

Go Immediately

This option causes APIMon to start the monitor for the application as soon as the program is opened by selecting File, and then Open from the menu or when a program name is specified on the APIMon command line.

Don’t Use Fast Counters

On the Intel Pentium and the Alpha AXP processors, APIMon can use special instructions to do the API timings. The other processors must use the WIN32 API GetPerformanceCounter(). This option disables the use of these instructions if APIMon is running on one of the supported platforms.

Monitor Known DLLs Only

By default, APIMon monitors API calls to all DLLs that the monitored process loads, either statically or dynamically. This option provides for the monitoring of a specific list of DLLs to be monitored. To create the DLL list, see "Known DLLs Options," below.

Monitor Page Faults

Enabling this option causes APIMon to create a new window that displays page fault information. The window displays one entry for each API from all enabled DLLs that has caused a page fault.

Default Counter Sorting

This option specifies the default sort order for the API counter window. The sort order can be changed while the monitor is running.

File Names Options

Log File Name

Specify a full path and file name for the APIMon log file. You may specify a file on your local machine or a UNC name to a network path and name. This file is created when the menu command Write Data To Log File is selected from the File menu. The file is overwritten each time the log file is created.

Trace File Name

Specify a full path and file name for the Trace file. You may specify a file on your local machine or a UNC name to a network path and name. This file is created when the Enable Tracing option is turned on. The file is overwritten each time the trace file is created.

Symbol Path

This string is a path or multiple paths separated by semicolons. Each path points to a tree containing debug symbols. The debug symbols can be either .dbg files, .exe files, or .pdb files. This string is necessary if the Pre-Load Symbols option is turned on.

Known DLLs Options

This property page is used to specify a list of Known DLLs that are initially monitored by APIMon, which can be useful if you don’t want APIMon to clutter the display and log file with irrelevant statistics.

To add a new entry to the list, click an empty entry. In the edit box, enter the DLL name and press enter. The DLL name MUST not contain a full path, just the DLL name with a .dll extension.

To delete an entry, click the desired entry, delete all of the text, and press enter. The entry is then removed from the list.

In order for this DLL list to take effect, the Monitor Known DLLs Only option must be turned on.


Depends.exe: Dependency Walker

Dependency Walker Run Dependency Walker now.

Windows Help Open Dependency Walker Help now.

Dependency Walker is a graphical Win32 development tool that scans any Win32 module (.exe, .dll, .ocx, .cpl, .scr, and .sys, among others) and builds a hierarchical tree diagram of all dependent modules. For each module found, this tool lists all the functions that are exported by that module, and which of those functions are actually being called by other modules. Another view displays the minimum set of required files, along with detailed information about each file including a full path to the file, base address, version numbers, machine type, debug information, and more.

Dependency Walker can help troubleshoot system errors related to module load problems. During the module scan, Dependency Walker detects dozens of common application problems such as missing modules, invalid modules, import/export mismatches, circular dependency errors, and mismatched machine types of modules.

Dependency Walker is useful for developers, testers, system administrators, creators of setup scripts, and anyone else who needs to examine what dependencies are required to make a specific module load successfully.

You can use Dependency Walker to:

  • Find out the minimum set of files required to load a particular application.

  • Determine what functions are exported by a particular module (use Dependency Walker instead of LINK /DUMP or DUMPBIN).

  • Determine what functions a particular module actually uses in other modules.

  • Remove a module as a dependency of your application.

  • List the full path, version, base address, or machine type of all modules for a given application.

  • Troubleshoot a module load error.

Dependency Walker Topic

  • Using Dependency Walker

Files Required

  • Depends.exe
  • Depends.hlp
  • Depends.cnt


Using Dependency Walker

Dependency Walker Run Dependency Walker now.

When you first run Dependency Walker (Depends.exe), it automatically registers itself with your system as a handler for all Win32 binaries. This causes a "View Dependencies" item to be added to the system's context menu, which is displayed when you right-click a Win32 module file in Windows Explorer.

To open a file in Dependency Walker, use one of three methods:

  • Right-click any Win32 module in Windows Explorer and choose View Dependencies from the Context menu.

  • Select File,and then click Open from the main menu in Dependency Walker.

  • Drag and drop a file on top of the Dependency Walker main window.

For More Information

Windows Help Open Dependency Walker Help now.


Tlist.exe: Task List Viewer

The Task List Viewer is a command-line tool that displays a list of tasks, or [image] processes, currently running on the local computer. For each process, it shows the process ID number, process name, and, if the process has a window, the title of that window.

Once you have used TList to find the processes running on your computer, you can end one or more of those processes by using Kill.exe: Task Killing Utility.

Task List Viewer Topics

  • TList Syntax
  • Examples of TList Output

Related Topics

File Required

  • Tlist.exe


TList Syntax

Command prompt Open command prompt now.

One Step tlist [/t | pid | pattern]

Where:

/t
specifies that the output is to be displayed based on which [image] processes are children/parents of which other processes.
pid
is a process ID. Instructs TList to list module information for this task.
pattern
is a pattern to use (e.g., A*).The pattern can be a complete task name or a regular expression pattern to use as a match. TList matches the supplied pattern against the task names and the window titles.

Once you have used TList to find the processes running on your computer, you can end one or more of those processes by using Kill.exe: Task Killing Utility.


Examples of TList Output

  • Example 1: Output without the /t option
  • Example 2: Output with the /t option
  • Example 3: Output with pid options

Example 1

The following is an example of output from running tlist without the /t option. For each [image] process, the process ID, process name, and window title (if any) are shown.

0 System Process

15 System

29 Smss.exe

22 Csrss.exe

17 Winlogon.exe

42 Services.exe

40 Lsass.exe

57 Spoolss.exe

85 Tcpsvcs.exe

111 Locator.exe

102 Rpcss.exe

37 Nddeagnt.exe NetDDE Agent

78 progman.exe Task List

92 Cmd.exe Command Prompt - tlist

49 Ntvdm.exe Microsoft Word - Document2

115 Scm.exe

138 invwin32.exe

158 Tlist.exe

Example 2

The following is an example of output from running tlist with the /t option.

System Process (0)

System (2)

smss.exe (25)

csrss.exe (33)

Winlogon.exe (39)

Services.exe (45)

Spoolss.exe (74)

Rpcss.exe (88)

Msdtc.exe (98)

Inojobsv.exe (121)

Cisvc.exe (127)

Cidaemon.exe (247)

Inv32cli.exe (139)

Pstores.exe (150)

Rconsvc.exe (155)

Atsvc.exe (165)

wnvtmr32.exe (169)

Wuser32.exe (174)

Dns.exe (184)

Inetinfo.exe (193)

Wnvirq32.exe (201)

NETDDE.EXE (248)

Clipsrv.exe (258)

lsass.exe (48)

Nddeagnt.exe (256)

Explorer.exe (357) Program Manager

Newsalrt.exe (251)

Clipbrd.exe (276) ClipBook Viewer

Winhlp32.exe (323)

Systray.exe (257)

Loadwc.exe (49)

Mgaqdesk.exe (216)

Mgahook.exe (271)

Conf.exe (275)

Realmon.exe (281)

Netwatch.exe (265) Net Watch

Cmd.exe (308) Command Prompt - tlist /t

Tlist.exe (260)

Ddhelp.exe (307)

Climonnt.exe (334)

Example 3

The following is an example of output from running tlist with the pid option using the crss process with the process ID of 22.

tlist 22

Csrss.exe

WD: D:\BO40\system32\

mdLine: D:\BO40\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows

SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 Server

winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

irtualSize: 38924 KB PeakVirtualSize: 43152 KB

orkingSetSize: 1220 KB PeakWorkingSetSize: 2544 KB

umberOfThreads: 10

34 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting

35 Win32StartAddr:0x00000000 LastErr:0x00000057 State:Waiting

36 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting

37 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting

40 Win32StartAddr:0x00000000 LastErr:0x00000057 State:Waiting

84 Win32StartAddr:0x00000000 LastErr:0x00000057 State:Waiting

220 Win32StartAddr:0x00000000 LastErr:0x00000057 State:Waiting

222 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting

269 Win32StartAddr:0x00000000 LastErr:0x00000006 State:Waiting

299 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting

4.0.1371.1 shp 0x5ffe0000 Csrss.exe

4.0.1381.4 shp 0x77f60000 Ntdll.dll

4.0.1371.1 shp 0x5ff90000 Csrsrv.dll

4.0.1381.4 shp 0x5ffa0000 Basesrv.dll

4.0.1381.4 shp 0x5ffb0000 Winsrv.dll

4.0.1381.4 shp 0x77e70000 User32.dll

4.0.1381.4 shp 0x77f00000 Kernel32.dll

4.0.1381.4 shp 0x77ed0000 Gdi32.dll

4.0.1381.4 shp 0x77dc0000 Advapi32.dll

4.0.1381.4 shp 0x77e10000 Rpcrt4.dll

4.0.1371.1 shp 0x77fd0000 Winmm.dll

1.0.7.0 shp 0x10000000 Wnvwav32.dll

4.0.1381.4 shp 0x0ffb0000 Wow32.dll

4.0.1381.4 shp 0x77c40000 Shell32.dll

4.72.2106.4 shp 0x70ff0000 Comctl32.dll

4.0.1381.4 shp 0x0f000000 Ntvdm.exe

4.0.1381.4 shp 0x77d80000 Comdlg32.dll

4.0.1371.1 shp 0x77a90000 Version.dll

4.0.1371.1 shp 0x779c0000 Lz32.dll

4.0.1381.4 shp 0x5f810000 Rpcltc1.dll

4.0.0.1381 shp 0x74100000 Msacm32.drv

4.0.0.1371 shp 0x75d50000 Msacm32.dll


Dumpel.exe: Dump Event Log

Dump Event Log is a command-line tool that dumps an event log for a local or remote system into a tab-separated text file. This tool can also be used to filter for or filter out certain event types.

Dump Event Log Topics

  • Dump Event Log Syntax
  • Dump Event Log Examples

Related Tools

Files Required

  • Dumpel.exe


Dump Event Log Syntax

command prompt Open command prompt now.

One Step dumpel -f file [-s \\server] [-l log [-m source]] [-e n1 n2 n3...] [-r] [-t] [-d x]

Where:

-f file
specifies the filename for the output file. there is no default for -f, so you must specify the file.
-s server
specifies the server for which you want to dump the event log. leading backslashes on the server name are optional.
-l log
specifies which log (system, application, security) to dump. if an invalid logname is specified, the application log will be dumped.
-m source
specifies in which source (such as rdr, serial, ...) to dump records. only one source can be supplied. if this switch is not used, all events are dumped. if a source is used that is not registered in the registry, the application log will be searched for records of this type.
-e n1 n2 n3 ...
filters for event id nn (up to 10 can be specified). if the -r switch is not used, only records of these types are dumped; if -r is used, all records except records of these types are dumped. if this switch is not used, all events from the specified sourcename are selected. you cannot use this switch without the -m switch.
-r
specifies whether to filter for specific sources or records, or to filter them out.
-t
specifies that individual strings are separated by tabs. if -t is not used, strings are separated by spaces.
-d x
dumps events for the past x days.


Dump Event Log Examples

To dump the system event log on server \\EVENTSVR to a file named Event.out, use:

dumpel -f event.out -s eventsvr -l system

To dump the local system event log to a file named Event.out, but only get Rdr events 2013, use:

dumpel -f event.out -l system -m rdr -e 2013

To dump the local application log to a file named Event.out, and get all events except ones from the Garbase source, use:

dumpel -f event.out -l application -m garbase -r


Logevent.exe: Event Logging Utility

command prompt Open command prompt now.

One Step For syntax details, at the command prompt, type: logevent

This tool enables you to make entries to the Event Log on either a local or remote computer from the command prompt or a batch file.

The program is particularly useful for storing historical information from the execution of batch programs run from Login Scripts or the AT command. Its ability to store entries into the event log of other computers allows these data to be collected centrally, if required.

In order to allow the Event Log Viewer to properly display the entry, the application should be installed onto the computer being used to view the event log. Installation is automatically performed when the LogEvent program is used for the first time.

Event Logging Utility Topic

  • Event Logging Utility Examples

Related Tools

File Required

  • Logevent.exe


Event Logging Utility Examples

command prompt Open command prompt now.

logevent "Batch program failed"

Puts an Information entry into the event log with the text "Batch program failed".

logevent -m \\Master -s W -c 999 "Fatal Error !"

Puts a Warning entry into the event log with the text "Fatal Error".


Ntevntlg.mdb: Event Log Database

Open Event Log Database now.

This Access database file lists messages and related information from the Windows Event Log, an administrative tool that is part of Windows 2000. This database contains the messages from the System, Security, and Application logs along with their corresponding Event ID, Source, and Type.

You must have Microsoft Access installed on your computer to view this database.

A Windows Help file (Ntmsgs.hlp: Messages) listing most of the error and system-information messages generated by Windows 2000 is also provided in the Microsoft® Windows® 2000 Resource Kit.

Important The Messages and Event Log Database are not intended as exclusive references. If, for example, you encounter a network error message in the command prompt window, you can also find help for the network problem by typing net helpmsg and the message identification number.

File Required for the Event Log Database

  • Ntevntlg.mdb

For More Information

Ntmsgs.chm: Messages


Browstat.exe: Browser Status

BrowStat is a general purpose, character-based browser diagnostic tool. Use BrowStat to find out whether a browser is running and to find active Microsoft Windows for Workgroups (WFW) browsers in Windows 2000 and Windows NT domains. This tool also provides information about the state of the browser in a workgroup, including the name of the master browser.

You can find out which transports are on a computer by using the net config rdr command and examining the result. In this discussion, "transport" refers to the Windows 2000 or Windows NT device name (case-insensitive) for the specified transport, in one of the following formats:

\device\transport (For example: \device\Nbf_elnk1601)

\transport

transport

BrowStat Topics

  • BrowStat Syntax
  • Flags in BrowStat Listings
  • BrowStat STATS Example
  • BrowStat STATUS Example

File Required

  • Browstat.exe


BrowStat Syntax

Command prompt Open command prompt now.

One Step browstat options

Where:

options
is the whole word or abbreviation from the following list:

ELECT (EL) — Forces a master browser election on the domain that uses the transport specified.

Usage:

browstat elect transport domain

GETBLIST (GB) — Retrieves a list of the backup browsers on the domain with the specified transport.

Usage:

browstat getblist transport [[domain] refresh]

GETMASTER (GM) — Uses NetBIOS to retrieve the name of the browser master for a transport for a workgroup.

Usage:

browstat getmaster transport domain

GETPDC (GP) — Uses NetBIOS to retrieve the name of the primary domain controller for a transport for a workgroup.

Usage:

browstat getpdc transport domain

LISTWFW (WFW) — Finds Windows for Workgroups computers that are currently running the browser.

If you have a mixed workgroup-and-domain network, you can disable the browser in Windows for Workgroups.

Usage:

browstat listwfw domain

STATS (STS) — Dumps various useful browser statistics.

The \\server switch allows it to be pointed to a specific server.

Usage:

browstat stats [\\server] [clear]

See STATS Example

STATUS (STA) — Dumps browser status for the specified workgroup on all local transports.

It also includes the build number of the browser master and how many servers are in the workgroup.

Usage:

browstat status [-v] workgroup

See STATUS Example

TICKLE (TIC) — Stops the browser master for the specified workgroup on the specified transport.

It can be used to reset a computer that has been determined to be "bad."

Usage:

browstat tickle transport domain

VIEW (VW) — Retrieves the list of servers or domains for a specified server for a specified transport or workgroup.

Usage:

browstat view transport

browstat view transport domain | server [/DOMAIN]

browstat view transport server /DOMAIN domain


Flags in BrowStat Listings

AFP = AFP Server

BBR = Backup Browser

BDC = Backup Domain Controller

DFS = Distributed File System

DL = Dial-in Server

DMB = Domain Master Browser

MBR = Master Browser

MDC = Member Domain Controller

MFPN = Microsoft File and Print for Netware

NT = Windows NT

NV = Novell

OSF = OSF Server

 PBR = Potential Browser

PDC = Primary Domain Controller

PQ = Print Server

S = Server

SQL = SQL Server

SS = Windows NT Member Server

TS = Time Source

VMS = Vax VMS Server

W = Workstation

W95 = Windows 95

WFW = Windows for Workgroups

XN = Xenix


BrowStat STATS Example

C>BROWSTAT STATS
Browser statistics since 20:40:54.705 on 6/9/1993    Time statistics were last cleared
NumberOfServerEnumerations:    237
NumberOfDomainEnumerations:    235
NumberOfOtherEnumerations:    6
NumberOfMailslotWrites:    1974
NumberOfServerAnnouncements:    0
NumberOfDomainAnnouncements:    0
NumberOfElectionPackets:    27425
NumberOfGetBrowserServerListRequests:    0
NumberOfMissedGetBrowserServerListRequests:    0
NumberOfDroppedServerAnnouncements:    0
NumberOfDroppedMailslotDatagrams:    0
NumberOfFailedMailslotReceives:    0
NumberOfMasterAnnouncements:    0
NumberOfIllegalDatagrams:    0

Meaning:

NumberOfServerEnumerations: = Number of browse requests for servers

NumberOfDomainEnumerations: = Number of browse requests for domains

NumberOfOtherEnumerations: = Number of "other" browse requests

NumberOfMailslotWrites: = Number of mailslot writes received

NumberOfServerAnnouncements: = Number of server announcements received

NumberOfDomainAnnouncements: = Number of domain (workgroup) announcements received

NumberOfElectionPackets: = Number of browser election packets received

NumberOfGetBrowserServerListRequests: = Number of GetBrowserServerList requests received

NumberOfMissedGetBrowserServerListRequests: = Number of GetBrowserServerList requests missed

NumberOfDroppedServerAnnouncements: = Number of server announcements dropped

NumberOfDroppedMailslotDatagrams: = Number of mailslot writes dropped due to memory

NumberOfFailedMailslotReceives: = Number of mailslot writes dropped due to transport

NumberOfMasterAnnouncements: = Number of WAN master browser announcements

NumberOfIllegalDatagrams: = Number of illegal datagrams received


BrowStat STATUS Example

C>BROWSTAT STATUS NTLAN
Status for domain ntlan on transport \Device\Nbf_Lance01
    Master browser name is: MSTRBROWSER1
        Master browser is running build 1.511.1
    3 backup servers retrieved from master MSTRBROWSER1
        \\MYPC
        \\MSTRBROWSER1
        \\BACKUPSVR1
    There are 20 servers in domain ntlan on transport \Device\Nbf_Lance01
    There are 1074 domains in domain ntlan on transport \Device\Nbf_Lance01
Status for domain ntlan on transport \Device\Streams\NWNBLINK
    Master browser name is: MSTRBROWSER1
        Master browser is running build 1.511.1
    3 backup servers retrieved from master MSTRBROWSER1
        \\BACKUPSVR1
        \\MSTRBROWSER1
        \\MYPC DEBUG
    There are 8 servers in domain ntlan on transport \Device\Streams\NWNBLINK
    There are 36 domains in domain ntlan on transport \Device\Streams\NWNBLINK
Status for domain ntlan on transport \Device\Streams\NBT
    Master browser name is: MSTRBROWSER1
        Master browser is running build 1.511.1
    3 backup servers retrieved from master MSTRBROWSER1
        \\MSTRBROWSER1
        \\BACKUPSVR1
        \\MYPC
    There are 11 servers in domain ntlan on transport \Device\Streams\NBT
    There are 101 domains in domain ntlan on transport \Device\Streams\NBT


Netdiag.exe: Network Connectivity Tester

Netdiag.exe: Network Connectivity Tester NEW

This command-line diagnostic tool helps isolate networking and connectivity problems by performing a series of tests to determine the state of your network client and whether it is functional. These tests and the key network status information they expose give network administrators and support personnel a more direct means of identifying and isolating network problems. Moreover, because this tool does not require that parameters or switches be specified, support personnel and network administrators can focus on analyzing the output, rather than training users on tool usage.

Sample Scenario

An example of this tool's usefulness is a scenario where the user has a problem connecting to a network resource. Receiving only a "Network path not found" error message and no further assistance, the user has no idea where to start troubleshooting the problem.

Assuming that the reason for the failure in this case is that the [image] WINS server is down, the solution can be found easily with Network Connectivity Tester. When executed in this scenario, the tool shows that the NIC Protocol, Bindings, [image] IP address, Default [image] Gateway, and [image] DNS tests succeed. The [image] WINS ping test fails and reports that the WINS server could not be contacted. With this information the user knows that either the WINS server address is incorrect or that the WINS server is not responding for some unknown reason. Since the WINS address is also displayed as output, it can easily be verified for correctness. With the problem isolated, the Network Admininstrator can perform additional troubleshooting to determine why the WINS server is down.

Network Connectivity Tester Features

  • Command-line executable - allows for easy scripting.
  • Ships as a WBEM Source Provider DLL so MSINFO can be used as a [image] GUI entrypoint.
  • Gathers static network information and tests network driver, protocol driver, send/receive capability, and well-known target accessibility.
  • Receives input and returns output that can be leveraged by other applications and services.
  • Runs on Windows 32-bit operating systems.
  • Can be used by network administrators in conjunction with the Scheduler Service to generate reports at regularly scheduled intervals.

Network Connectivity Tester topics

  • Netdiag Syntax
  • Netdiag Sample Output
  • Netdiag Notes: Details About the Tests Executed

Files Required for Network Connectivity Tester

  • Netdiag.exe


Netdiag Syntax

Command prompt Open command prompt now.

netdiag [/q] [/v] [/debug] [/d:DomainName] [/fix] [/DcAccountEnum] [/skip:testname]

Where:

/q
specifies quiet output (errors only).
/v
specifies verbose output.
/debug
specifies even more verbose output.
/d:DomainName
finds a domain controller (DC) in the specified domain.
/fix
fixes trivial problems.
/DcAccountEnum
enumerates DC machine accounts.
/skip:TestName
skips the named test. Valid tests are:
  • DNS - DNS Test

  • Bowser - Redir and Bowser Test

  • DsGetDc - DC Discovery Test

  • DcList - Dc List Test

  • Trust - Trust Relationship Test

  • Kerberos - Kerberos Test

  • LDAP - LDAP Test


Netdiag Sample Output

Computer Name: JADE-NTS5
Dns Host Name: JADE-NTS5.dns.microsoft.com

Ethernet adapter Local Area Connection:

        Host Name . . . . . . . . . : JADE-NTS5.dns.microsoft.com
        DNS Servers . . . . . . . . : 157.55.254.211
                                      157.55.254.212
        IP Address. . . . . . . . . : 157.54.128.52
        Subnet Mask . . . . . . . . : 255.255.254.0
        Default Gateway . . . . . . : 157.54.128.1

PPP adapter NdisWanIpOut{8709E8DA-CFA9-11D1-9731-F5C07D6AAA08}:

        Host Name . . . . . . . . . : JADE-NTS5
        DNS Servers . . . . . . . . :
        IP Address. . . . . . . . . : 0.0.0.0
        Subnet Mask . . . . . . . . : 0.0.0.0
        Default Gateway . . . . . . :

Autonet address test:

    PASS - you have at least one non-autoconfigured IP address

IP loopback ping test:

    PASS - pinging IP loopback address was successful
           your IP stack is most probably OK

Default Gateway test:
   Adapter name: {8709E8C7-CFA9-11D1-9731-F5C07D6AAA08}
       Pinging gateway 157.54.128.1 - reachable
Adapter name: NdisWanIpOut{8709E8DA-CFA9-11D1-9731-F5C07D6AAA08}
       There are no gateways defined for this adapter.

    PASS - you have at least one reachable gateway.

NBT name test:
   no NetBT scope defined

   \Device\NetBT_Tcpip_{8709E8C7-CFA9-11D1-9731-F5C07D6AAA08}
        JADE-NTS5      <20>  UNIQUE      REGISTERED
        JADE-NTS5      <00>  UNIQUE      REGISTERED
        MAUNALOA       <00>  GROUP       REGISTERED
        INet~Services  <1C>  GROUP       REGISTERED
        IS~JADE-NTS5   <00>  UNIQUE      REGISTERED
        MAUNALOA       <1E>  GROUP       REGISTERED
        JADE-NTS5      <03>  UNIQUE      REGISTERED
        MAUNALOA       <1D>  UNIQUE      REGISTERED
        ??__MSBROWSE__?<01>  GROUP       REGISTERED
   \Device\NetBT_Tcpip_NdisWanIpOut{8709E8D8-CFA9-11D1-9731-F5C07D6AAA08}
   \Device\NetBT_Tcpip_NdisWanIpOut{8709E8D9-CFA9-11D1-9731-F5C07D6AAA08}
   \Device\NetBT_Tcpip_NdisWanIpOut{8709E8DA-CFA9-11D1-9731-F5C07D6AAA08}
   \Device\NetBT_Tcpip_NdisWanIpIn

    PASS - your NetBT configuration looks OK
           there is at least one interface where the <00>, <03>, <20>
           names are defined and they are not in conflict.

Karoly test:
    List of NetBt transports currently configured.
        \Device\NetBT_Tcpip_{8709E8C7-CFA9-11D1-9731-F5C07D6AAA08}
    1 NetBt transport currently configured.

Domain Membership test:
    NT Build:            1785
    Machine is a:        Standalone Server
    Netbios Workgroup name: MAUNALOA
    Dns domain name is not specified.
    Dns forest name is not specified.
    Logon User:          Administrator
    Logon Domain:        JADE-NTS5
    Logon Server:        \\JADE-NTS5

Dns test:
    DNS server at 157.55.254.211 is up.
    DNS server at 157.55.254.212 is up.

Redir and Browser test:
    List of NetBt transports currently bound to the Redir
        \Device\NetBT_Tcpip_{8709E8C7-CFA9-11D1-9731-F5C07D6AAA08}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        \Device\NetBT_Tcpip_{8709E8C7-CFA9-11D1-9731-F5C07D6AAA08}
    The browser is bound to 1 NetBt transport.

DC Discovery test:

Dc List test:

Trust Relationship test:

Kerberos test:

LDAP test:

The command completed successfully


Netdiag Notes: Details About the Tests Executed

NIC

A. Enumerate NIC configuration details for all installed NICs, including NIC description, physical address, and resources in use.

B. Verify [image] LAN and [image] WAN adapter driver status - initialized or error.

C. Sense if NIC is attached to the network (NDIS Autosense).

WAN

A. COM port in use and settings: data bits, stop bits, parity, baud rate, error checking, compression, LCP extensions, Unimodem support.

B. Sense if WAN link is up.

Bindings

A. Enumerate all network bindings, including binding failures.

Winsock

A. Enumerate Winsock layered service providers, including minimum and maximum version supported, vendor description, maximum number of sockets, and maximum UDP datagram size.

B. Ping Web Proxy Server, if present.

TCPIP Protocol and Related Services

General TCP/IP

A. Configuration information: IP address, subnet mask, default gateway, autoconfiguration enabled, [image] DHCP enabled, LMHOSTS enabled, host name, [image] DNS servers, DNS domain, [image] WINS servers, node type, [image] NetBIOS scope ID, IP forwarding (routing) enabled, WINS proxy enabled, NetBIOS resolution? (enabled, disabled, via DHCP), DNS for Windows name resolution, DHCP class ID, IP security.

B. Enumerate Configured Default Gateways. Ping current default [image] gateway address if present. If current default gateway not reachable, ping each gateway in the gateway list until success is achieved or the end of the list is reached.

DHCP

A. DHCP lease obtained, lease expires.

B. If Autonet address is in use, broadcast to determine if DHCP server is available, including time information so we know how long it took to get a response.

NETBT

A. Enumerate local and remote name cache (i.e., nbtstat -c and nbtstat -n).

DNS Server

A. Ping DNS Server.

B. If server not available: log target address, status code and description.

C. Try next server, per search order, until the end of the list is reached.

D. Query DNS server on Port 53 for SOA record.

WINS Server

A. Ping WINS Server.

B. Test whether registration of a unique or group name specific to this diagnostic is successful.

C. Test whether name query of the above name is successful.

D. If server not available log target address, status code and description.

E. Try next server, per search order.

IPX Protocol

A. Get [image] frame type, network ID, packetburst enabled, source routing enabled, RouterMTU.

Routing

A. Enumerate static routes and report if they are persistent.

Note This test will return "N/A" on Windows 95/98 platforms because it does not apply.

Netware

A. Tree or bindery login, default context if tree login, server attached to on bootup (get nearest server reply information).

Distributed Systems

A. RPC Tests - Perform an RPC bind and ack.

B. Find DC (domain controller) in Your Domain: DC name, IP Address, Domain Name, Domain GUID, Tree Name, DC Site Name, Our Site Name, Flags

C. Find PDC (Primary Domain Controller) in Your Domain: DC name, IP Address, Domain GUID, Domain Name, Tree Name, DC Site Name, Our Site Name, Flags

D. Find Windows 2000 DC in Your Domain: DC name, IP Address, Domain GUID, Domain Name, Tree Name, DC Site Name, Our Site Name, Flags

E. List of DCs in Domain

F. Trust Relationship Test - Enumerate NTLM and Kerberos Trusts.

G. Kerberos Test: Cached Tickets including Server name, End Time, and Renew Time. Note: This test will return N/A on Windows 95/98 and Windows NT 4.0 platforms because it does not apply.

H. LDAP Test Un-Authenticated LDAP call - Current Time, Server name, subschemaSubentry, Settings. Note: This test will return N/A on Windows 95 and Windows NT 4.0 platforms because it does not apply.

I. NTLM Authenticated LDAP call

J. Authenticated LDAP call

K. IPSEC Test - Is IPSEC enabled?, Enumerate IPSEC policy settings. Note: This test will return N/A on Windows 95/98 and Windows NT 4.0 platforms because it does not apply.


PPTP Ping: Point to Point Tunneling Protocol Ping Tools

PPTP Ping: Point-to-Point Tunneling Protocol Ping Tools NEW

Pptpclnt.exe and Pptpsrv.exe are tools that work in unison to verify that the required protocol and port for Point-to-Point Tunneling Protocol (PPTP) is being routed from a PPTP client to a PPTP server or vice-versa.

In order for a PPTP client to access a remote PPTP server, all routers in between the two hosts MUST allow traffic to pass through TCP port 1723 (PPTP) and must support protocol type 47. Protocol type 47 is the GRE (Generic Routing Encapsulation) protocol.

Note This tool is not meant to test the functionality of a PPTP server or a PPTP client. It is meant to assure that the path between the two hosts is passing through TCP port 1723 and using the GRE protocol (type 47).

PPTP Ping Topics

  • Using PPTP Ping
  • Troubleshooting PPTP Ping

Files Required

  • Pptpclnt.exe
  • Pptpsrv.exe


Using PPTP Ping

The following sections cover testing your PPTP connection and sample output.

Testing PPTP Connectivity

For this example, assume there is a PPTP server on site "A" and a PPTP client on site "B."

To test PPTP connectivity between Site "A" and Site "B":

  1. Run Pptpsrv.exe on a Windows 2000 computer on site "A." This does not have to be the PPTP server.

  2. Run Pptpclnt.exe [ servername or IPaddress ] on a Windows 2000 computer in site "B."

  3. When prompted by Pptpclnt.exe, type in some text to send to Pptpsrv.exe and then click Enter.

  4. You should see the text received at the host running Pptpsrv.exe.

  5. You should then see five GRE packets sent from Pptpclnt.exe and received at Pptpsrv.exe.

  6. Repeat steps 1-5, this time running Pptpsrv.exe on a host on site "B" and Pptpclnt.exe on a host on site "A." These can, of course, be the same hosts you just used.

Example Output: Server Side

pptpsrv

Now you must run pptpclnt.exe on remote machine

Waiting for inbound connection on TCP port 1723...
Inbound connection from client has completed successfully!

Data received from client:
---> abcdefghijklmnopqrstuvwxyz

Sending the message 'Reply from server' to the client

=====================================================
Connectivity test to TCP Port 1723 was susccessful!!!
Closing down socket...
=====================================================

Created socket for GRE protocol test

Listening on PROTOCOL 47 for incoming GRE packets...

Total GRE packets received = 1
Total GRE packets received = 2
Total GRE packets received = 3
Total GRE packets received = 4
Total GRE packets received = 5

======================================
GRE protocol test was successful!
======================================
Closing socket

Example output: client side

pptpclnt jade

Initializing WinSock...
Obtaining host information...
Successfully resolved server's host information

======================================
Enter data to send to server (up to 255 chrs.), then hit enter:
-->abcdefghijklmnopqrstuvwxyz

Successfully connected to server using TCP port 1723 (PPTP)
Sending data to server jade.dns.microsoft.com

Waiting for a reply to the data which was just sent...
Received a reply.  Reply contains the following text:
---> Hello, there! This is a reply from the server.

=================================
Connectivity test to TCP Port 1723 was susccessful!!!
Closing down socket...
=================================

Creating a socket to test GRE protocol traffic...

Total GRE packets sent = 1
Total GRE packets sent = 2
Total GRE packets sent = 3
Total GRE packets sent = 4
Total GRE packets sent = 5

=====================================
Check server to see if the GRE packets were received successfully
=====================================
Closing down socket


Troubleshooting PPTP Ping

Cannot Connect to PPTP Server

The error message you receive will help determine what part of the PPTP connection you should troubleshoot. When PPTP filtering is enabled you might receive one of the following error messages:

Error 678: There is no answer
Error 650: The Remote Access Server is not responding

If you receive one of these error messages, disable PPTP filtering and then attempt to ping the PPTP server. To disable PPTP filtering, type the following command on the PPTP server:

NET STOP RASPPTPF

You should now be able to ping the PPTP server over the Internet. If you still receive one of these error messages, the problem might not be a PPTP problem. Until you get replies from the server, you will need to troubleshoot this issue as a normal connectivity problem.

If pinging the PPTP server across the Internet successfully returns with replies, the ISP or internal corporate network might not allow Generic Routing Encapsulation (GRE) packets or PPTP packets to go across the firewall or router.

GRE packets are commonly used internally as messages between routers. For example, an ISP might use GRE to distribute routing messages between its sites. For security or other reasons, this ability can be turned off to the outside Internet. You can resolve this problem by ensuring that Protocol 47 is open at the router or firewall. This protocol is required for PPTP to work correctly.In addition to GRE Protocol 47, Port 1723 must be enabled at all routers or firewalls between the PPTP client and server.

An example of a GRE-blocked PPTP call in a trace is shown below. In this case, the ISP uses GRE internally, but does not allow the protocol to be sent to any outside interfaces.

1- 5.364   00 E8 TCP       ....S., len:

2- 5.614   E8 00 TCP       .A..S., len:

3- 5.614   00 E8 TCP       .A ., len: 0, seq: 168021101-168021101,
   ack:    460753,

4- 5.630   00 E8 TCP       .AP..., len: 156, seq: 168021101-168021256,
   ack:    460753,

5- 6.130   E8 00 TCP       .AP..., len:  156, seq:    460753-460908,
   ack:   168021257, win:

6- 6.145   00 E8 TCP       .AP..., len:  168, seq: 168021257-168021424,
   ack:    460909,

7- 6.520   E8 00 TCP       .AP..., len:   32, seq:    460909-460940,
   ack:    168021425, win:

8- 6.536   00 E8 TCP       .AP..., len:   24, seq: 168021425-168021448,
   ack:    460941,

9- 6.536   20 20 LCP       Config Req Packet, Ident = 0x00, Length = 17

10- 6.536  00 E8 LCP       Config Req Packet, Ident = 0x00, Length = 17

11- 6.833  E8 00 ICMP      Destination Unreachable: 198.140.211.122
   See frame 10

12- 6.942  E8 00 TCP       .A...., len:    0, seq:    460941-460941,
   ack:   168021449, win:

In frame 11, a reference states that the destination cannot be reached in frame 10. Looking closely at frame 10, you can see that this packet is actually a GRE packet:

+ FRAME: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
+ IP: ID = 0xECB3; Proto = 0x2F; Len: 53
+ GRE: ..KS............ Length: 21, Call ID: 0  <<<--Shows that this is a
                                                     GRE packet.
+ PPP: Link Control Protocol Frame (0xC021)
+ LCP: Config Req Packet, Ident = 0x00, Length = 17

The IP address in the IP portion of this frame shows the IP address of the device that will not allow GRE packets past its interface.

Note Some ISPs or corporate firewalls will not allow incoming or outgoing GRE packets. In this case, you will see the same "Destination Host Unreachable" packets in the trace, but there will not be any packets that drill down to GRE.

Timeouts Using PPTP

If you receive error 718, "the server has not responded," you might want to increase the number of attempts PPTP makes to transmit data.

You can make this change by editing the following Registry entry.

Caution Using Registry Editor incorrectly can cause serious, system-wide problems that might require you to reinstall Windows 2000 to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk.

To increase PPTP data retransmissions

  1. Run Registry Editor (Regedt32.exe).

  2. Go to the following key in the registry:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Paramters

  3. On the Edit menu, click Add Value and use the following entry (if the entry already exists, double-click it to edit the value):

    Value Name: PPTPTcpMaxDataRetransmissions

    Data Type: REG_DWORD

    Value range: 0 - 0xFFFFFFFF

    Default value: 9h

By default, this value is 9h. You might want to increase this value to 18h. It is not recommended to increase this value beyond 27h.

If you are using the NetBEUI protocol to connect to a PPTP server, you might need to install Windows NT 4.0 Service Pack 3 or Windows 2000. For additional information, please see the following article in the Microsoft Knowledge Base:

ARTICLE-ID: Q163129

TITLE : RAS Client Fails to Connect to Service Pack 2 Using NetBEUI

Dialing the IP Address and Logging on to PPTP Server

After each computer can connect to its ISP and ping the PPTP server, test logging on to the PPTP server.

Set up a Dial-Up Networking phone book entry to dial the IP address of the PPTP server. When you set up the phone book entry, enter the server's IP address in place of a phone number. Dial using RASPPTPM.

If Dial-Up Networking dials but does not connect to the PPTP server, try restarting the Remote Access Server service. To do so, follow these steps

To restart the Remote Access Server Service

  1. In Control Panel, double-click Services.

  2. Locate the Remote Access Server service. Stop the service and then start the service.

Confirming Dial-In Permissions

PPTP requires that the connecting user account have dial-in permissions. Use the Remote Access Admin tool to verify that the user account has the appropriate dial-in permissions.

If a domain is present, the user might need domain permissions to connect to certain resources on the network.

Troubleshooting Protocol Issues

PPTP can use the NetBEUI, IPX/SPX-compatible, and TCP/IP protocols. The NetBEUI protocol requires the least amount of configuration. Connecting to the PPTP server requires that the client and server have a network protocol in common. Once connected, the PPTP server can act as NetBIOS gateway to the rest of the local area network.

When you are using the TCP/IP protocol, each client needs a unique IP address. IP addresses can be statically assigned to clients, supplied from a pool of IP addresses, or from a DHCP server.

The PPTP Ping tool can be used in troubleshooting connectivity issues with TCP/IP. For additional information, please see the following article in the Microsoft Knowledge Base:

ARTICLE-ID: Q102908

TITLE : How to Troubleshoot TCP/IP Connectivity with Windows NT

Troubleshooting Browsing Issues

Avoid browsing Network Neighborhood over a slow connection. Try connecting to the network resource directly. To do so, follow these steps:

To connect to a network resource directly

  1. Click Start, and then click Run.

  2. Type the following line, and then click OK:

    \\<server>\<share>

If you can connect using this method, the PPTP session is working properly and the issue is related to browsing.

For additional information about PPTP, see the following article(s) in the Microsoft Knowledge Base:

ARTICLE-ID: Q162230

TITLE : Fragmentation and Performance Issues with PPTP Connections

ARTICLE-ID: Q154674

TITLE : PPTP Registry Entries

ARTICLE-ID: Q164052

TITLE : PPTP and Interoperability with Other Local Machine Services

ARTICLE-ID: Q164601

TITLE : How to Enable PPTP Port for Network Monitor

ARTICLE-ID: Q158387

TITLE : RAS Server Cannot Use DHCP to Assign Addresses w/ PPTP

Filtering


RPC Ping: RPC Connectivity Verification Tool

RPC Ping: RPC Connectivity Verification Tool NEW

This tool can confirm RPC connectivity between Microsoft Exchange Server and any of the supported Microsoft Exchange Client workstations on the network. RPC Ping checks if Microsoft Exchange Server services are responding to RPC requests from client workstations via the network.

RPC Ping Topics

  • Rpings (Server) Syntax
  • Rpingc32, Rpingc16, Rpingdos (Client) Syntax

Files Required

Server Component

  • Rpings.exe (for the Microsoft Exchange Windows NT Server)

Client Component

  • Rpingc32.exe (for Windows 2000, Windows NT, and Windows 95/98)
  • Rpingc16.exe (for Windows 3.1x clients)
  • Rpingdos.exe (for MS-DOS clients)


RPC Ping: Rpings.exe (Server) Syntax

RPings is the server-side RPC Ping tool. It contains two RPC functions: Echo and Stats. These functions are called by the client side RPC ping tools (Rpingc32, Rpingc16, or Rpingdos). Run RPings without any options to use all available protocol sequences.

Command prompt Open command prompt now.

One Step rpings [-p ProtocolSequence]

Where:

ProtocolSequence
is the friendly name for one of the supported transport mechanisms of RPC, as follows:
Friendly Name | Description
namedpipes | NCA connection over Named Pipes (ncacn_np)
tcpip | NCA connection over TCP/IP (ncacn_ip_tcp)
netbios | NCA connection over NetBIOS on Netbeui (ncacn_nb_nb)
ipx/spx | NCA connection over SPX (ncacn_spx)
vines | NCA connection over Banyan Vines (ncacn_vns_spp)

Note Enter '@q' to exit RPing.


RPC Ping: Rpingc32, Rpingc16, Rpingdos (Client) Syntax

Command prompt Open command prompt now.

Rpingc32 is the 32-bit version of the client side of the RPC Ping tool. Rpingc16 and Rpingdos are the 16-bit versions of the client side. They will connect and bind to the specified destination RPC server and display the status, available protocol sequences with end points, and quality of the RPC connection. Both Rpingc and Rpingc16 are set up to run in the Windows environment. Rpingdos runs in the MS-DOS environment.

Rpingc32 & Rpingc16 Options

Exchange Server:The name of the Exchange Server to ping

Protocol Sequence:The following options are available:

Any (default)

Named Pipes

IPX/SPX

TCP/IP

Netbios

Vines

End Point:The following End Points on the Exchange Server are available:

Rping (default, all)

Store (the Exchange Store)

Admin (the Exchange Administrator)

Number of Pings:Continuous

Stop at ___

Mode:Ping Only (character echoed by RPINGS)

End Point Search (enumerates all endpoints available)

Run with Security:verifies that authenticated RPCs work

Rpingdos Syntax

rpingdos [-p ProtocolSequence] -n NetworkAddress [-e EndPoint] [-c xxx] [-s]

Where:

-p ProtocolSequence
sets the protocol sequence, using these friendly names for protocols:

namedpipes

tcpip

ipx/spx

netbios

vines

The default is namedpipes

-n NetworkAddress
is required.
-e EndPoint
is the endpoint to find., Defaults to Rping.
-c xxx
is the number of pings., Defaults to 1.
-s
runs an endpoint search.

Protocol sequences can be set using these friendly names:

-p namedpipes

-p tcpip

-p ipx/spx

-p netbios

-p vines


Snmputilg.exe: SNMP Troubleshooting Tool

Snmputilg.exe: SNMP Troubleshooting Tool NEW

Click to run tool Open SnmpUtilG now.

SnmpUtilG is a graphical tool that complements the older command prompt SNMP browser tool (Snmputil.exe). System administrators can use either tool to obtain information from SNMP-manageable systems on the network.

You can use SnmpUtilG to perform the basic SNMP operations such as GET, GET-NEXT, and SET from a graphical interface. SnmpUtilG also supports saving SNMP data to the clipboard, as well as saving data to comma delimted text files.

Caution Even though many OID values are "read only" by default, you should use the SNMP SET command with caution. Incorrect use of this tool might cause network name resolution or network connectivity problems adversely impacting performance.

SnmpUtilG Topics

  • Installing SnmpUtilG
  • Using SnmpUtilG

Files Required

  • Snmputilg.exe


Installing SnmpUtilG

To Install SnmpUtilG

  1. Install the Windows 2000 Resource Kit Support Tools, or copy the following files from the compact disk to your hard drive:

    Snmputil2.exe

    Mib.bin (optional)

  2. Verify that the files are in your path. If they are not in the path, copy the files to the %systemroot%\System32 directory.

To Run SnmpUtilG
  • Click Start, point to Run, and then type SNMPUTIL2 on the Run line.


Using SnmpUtilG

Open SnmpUtilG now.

The tool starts with the loopback address 127.0.0.1, the OID .1.3.6.1.2.1, and the “public” community selected. These values can be changed to select another system by IP address, select another OID farther down the tree, or select another community as necessary.

If another system IP address is selected, that system must be running the SNMP service. The target system must also be configured to allow access from the network address from which the utility is run. By default Windows 2000 allows access from all other IP addresses.

If another community is selected, the community must exist and READ priviledges must be granted to that community under the security tab of the SNMP Service Properties in the Control Panel Network Applet. The ability to configure community permissions exists only in systems running Windows NT version 4.0 Service Pack 4 and Windows 2000. The ability to restrict access by IP address exists in all versions of Windows NT and Windows 2000.

The “SNMP Function to Execute” dropdown box is used to select the desired operation, followed by selecting the “Execute Command” button. Functions include:

  • GET the value of the current OID

  • GET the NEXT value after the current OID (this is the default)

  • GET the NEXT 20 values after the current OID

  • GET all values from OID down (WALK the tree)

  • WALK the tree from WINS values down

  • WALK the tree from DHCP values down

  • WALK the tree from LANMAN values down

  • WALK the tree from MIB-II down (Internet MIB)

The results are listed on the screen.

The results can be cleared, saved, or updated from the Context menu, which is selected by right-clicking the mouse. From the Context menu you may:

  • Copy one or more records to the clipboard.

  • Clear contents of the list view now.

  • Clear list view after executing each command.

  • Requery the currently selected record.

  • Dump all records to a comma delimited text file

  • Edit (SET) the value of this OID.

Caution Even though many OID values are “read only” by default, you should use the SNMP SET command with caution. Incorrect use of this tool might cause network name resolution or network connectivity problems adversely impacting performance.


Active Directory Schema Manager (SCHMMGMT.MSC)

Active Directory Schema Manager (Schmmgmt.msc) NEW

HTML Help Open Schema Manager Help now.

The Schema Manager is a Microsoft Management Console (MMC) snap-in that allows you to view, modify, and extend the Active Directory schema. The schema is the list of definitions or metadata that determines the objects, and the types of information about the objects, that can be stored in the Active Directory.

Files Required

  • Schmmgmt.msc

For More Information

For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see Internet "Active Directory Overview".


ADSI Edit

ADSI Edit NEW

ADSI Edit is a Microsoft Management Console (MMC) snap-in that acts as a low-level editor for the Active Directory. Via Active Directory Services Interfaces (ADSI), it provides a means to add, delete, and move objects within the Directory Services. The attributes of each object can be viewed, changed, and deleted.

Files Required

  • Adsiedit.dll
  • Adsiedit.msc

Related Tools

For More Information

For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see Internet "Active Directory Overview".


Dsacls.exe

Dsacls.exe NEW

This tool facilitates management of access-control lists for directory services.

Files Required

  • Dsacls.exe

For More Information

For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see Internet "Active Directory Overview".


Dsastat.exe

Dsastat.exe NEW

This diagnostic tool compares and detects differences between naming contexts on domain controllers.

DsaStat can be used to compare two directory trees across replicas within the same domain or, in the case of a Global Catalog, across different domains. The tool retrieves capacity statistics such as megabytes per server, objects per server, and megabytes per objectClass, and performs comparisons of attributes of replicated objects.

The user specifies the targeted domain controllers and additional operational parameters from the command line or from an initialization file. DsaStat determines if Domain Controllers in a domain have a consistent and accurate image of their own domain. In the case of Global Catalogs, DsaStat checks to see if the GC has a consistent image with DC’s in other domains. As a complement to the replication-monitoring tools, Repadmin.exe and Replmon.exe: Active Directory Replication Monitor, DsaStat can be used to ensure that domain controllers are up to date with one another.

DsaStat Topics

  • DsaStat Syntax
  • DsaStat Examples

Files Required

  • Dsastat.exe

For More Information

For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see Internet "Active Directory Overview".


DsaStat Syntax

DsaStat command-line options can be used to minimize or focus your search or comparisons.

command prompt Open command prompt now.

One Step dsastat [/?] [-loglevel:option] [-output:option] [-f:filename] [-s:servername[portnumber][;servername[portnumber];...]] [-t:option] [-sort:option] [-p:entrynumber] [-b:searchpath] [-filter:ldapfilter] [-gcattrs:option[;option;...]]

Where:

/?
displays help for DsaStat, along with the default options and parameter values.
-loglevel:option
specifies the extent of logging that is performed during execution. Valid option values are: INFO, TRACE and DEBUG. The default option is INFO.
-output:option
specifies where the results of DsaStat are displayed. Valid option values are: SCREEN, FILE or BOTH. If FILE is selected the output is saved to a file named Dsastat.log.nnnnn. The default option is SCREEN.
-f:filename
specifies the filename of an initialization file to use for parameters if user does not specify the parameters on the command line.
-s:servername[portnumber][;servername[portnumber];...]
specifies the name(s) of server(s) on which the comparison will be performed. Separate each server name with a semi-colon. The server name may be suffixed with the TCP/IP port number. If the port number is ":3268", the comparison will be performed against the global catalog of that server. The dafault port number is the default LDAP port (389).
-t:option
specifies whether to whether to perform a statistics comparison or a full-content comparison. Valid option values are TRUE (perform a statistical comparison) or FALSE (perform a full-content comparison). The default is TRUE, perform a statistical comparison. The statistical comparison merely counts the objects. It does not compare the attributes of the objects that have been retrieved from the replica domain controllers and it ignores the –gcattrs option. On the other hand, full-content comparison retrieves every object with attribute values and performs a comparison of the attributes of the same object from different domain controllers.
-sort:option
determines whether the search operations are performed with sorting based on object GUID. Valid option values are TRUE (perform sorted queries) or FALSE (do not perform sorted queries). The default value is FALSE. Performing a sorted query by setting this option to TRUE has a performance impact; however, it complements the full-content comparison because it ensures that objects are returned in nearly the same order from different servers and improves the performance of full-content comparison.
-p:entrynumber
sets page size for ldap_search operation. The valid range for entrynumber is from 1 to 999. The default value is 64. The number indicates the number of entries to be returned per page. If the directory objects are large (such as user objects with many of their attributes populated with values), it is advisable to use a smaller page size.
-b:searchpath
sets the Distinguished Name of the base search path. This allows DsaStat to perform the comparison against any subtree of the directory.
-filter:ldapfilter
sets LDAP filter used in the LDAP search operation. The filter must conform to LDAP search syntax as specified in RFC 2254. The default filter is "(objectclass=*)".
-gcattrs:option[;option;...]
specifies attributes to be returned from search. This option is only used if the comparison option –t is set to FALSE. Valid option values are any LDAP attribute, objectclass when no attributes are requested, auto if only those attributes that are replicated to the Global Catalog are requested, and all when you want all attributes contained in an object are to be retrieved. If specific multiple LDAP attributes are requested, separate each LDAP value with a semi-colon.


DsaStat Examples

Consider a network with the following domains and servers:

  • Acme, with two domain controllers:
    AcmeS1 (which is also a Global Catalog)
    AcmeS2
    The distinguished name of the domain is DC=Acme,DC=com.
  • FooBar.Acme, a child domain of Acme, with one domain controller:
    FooBarS1 (which is also a Global Catalog)
    The distinguished name of the domain is DC=FooBar,DC=Acme,DC=com.

Example 1

To compare the number of objects in the directory for the domain Acme, run the following:

dsastat –s:AcmeS1;AcmeS2 –b:DC=Acme,DC=com –gcattrs:objectclass –p:999

This search merely keeps a count of the different types of objects in each of the replicas and then compares the count for each objectclass.

Example 2

To perform a full comparison of each object in the domain Acme, run the following:

dsastat –s:AcmeS1;AcmeS2 –b:DC=Acme,DC=com –gcattrs:all –sort:true –t:false –p:16

This search does a full-content search and comparison of all the objects in the domain Acme. The default filter is "(objectclass=*)" and so all objects will be retrieved by this search. The objects are also sorted based on objectGUID to improve the perfomance of the comparison operation.

Example 3

To perform a comparison of all users in the Sales organizational unit in the Acme domain, run the following:

dsastat –s:AcmeS1;AcmeS2 –b:OU=Sales,DC=Acme,DC=com –gcattrs:all –sort:true –t:false –p:16 –filter:"(&(objectclass=user)(!objectClass=computer))"

This example illustrates the specification of the base search path at a subtree of the domain, in this case the organizational unit names Sales. In addition, the filter specifies that the comparison is only concerned with user objects and not computer objects. Note that since computer objects are derived from user objects in the class hierarchy, a search filter specifying objectclass=user will return both user and computer objects.

Example 4

To perform a comparison between a domain controller in the FooBar domain and a Global Catalog server in the domain Acme, run the following (note that the Global Catalog server AcmeS1 in the domain Acme holds a partial replica of all objects from the domain FooBar):

dsastat –s:AcmeS1:3268;FooBarS1 -b:DC=FooBar,DC=Acme,DC=com -gcattrs:objectclass –p:999

This search compares the Global Catalog on AcmeS1 and checks to see if it has a consistent partial image of the domain FooBar. This search does not perform a full-content comparison, but simply checks that the object count is the same between the GC and the Domain Controller FooBarS1 in the domain FooBar.

Example 5

To perform a full-content comparison between a domain controller in the FooBar domain and a Global Catalog server in the domain Acme, run the following:

dsastat –s:AcmeS1:3268;FooBarS1 –b:DC=FooBar,DC=Acme,DC=com –gcattrs:auto –sort:true –t:false –p:16

This example performs a full-content comparison between all the objects that have been replicated to the Global Catalog. Specifying the auto option for -gcattrs ensures that only the attributes replicated to the Global Catalog are retrieved.


Ldp.exe

Ldp.exe: Active Directory Administration Tool NEW

shortcut Run Ldp now.

Word for Windows Open Ldp.doc now.

Ldp is a graphical tool that allows users to perform Lightweight Directory Access Protocol (LDAP) operations, such as connect, bind, search, modify, add, and delete, against any LDAP-compatible directory, such as the Active Directory. LDAP is an Internet-standard wire protocol used by the Active Directory.

In troubleshooting, Ldp can be used by administrators to view objects stored in the Active Directory along with their metadata, such as security descriptors and replication metadata.

Files Required

  • Ldp.doc
  • Ldp.exe

For More Information

For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see Internet "Active Directory Overview".


Movetree.exe

Movetree.exe: Active Directory Object Manager NEW

Movetree.exe is a command line tool that allows administrators to move Active Directory objects such as organizational units, users or computers between domains in a single forest. These types of operations would be performed to support domain reconsolidation or organizational restructuring operations.

While Movetree will move the Active Directory objects between domains, there are some Active Directory objects that cannot be moved between domains and there may also be associated data that exists externally to the Active Directory that also will not be moved.

Objects that cannot be moved will remain in an "orphan" container in the "LostAnd Found" container in the source domain. The Lost And Found container can be viewed in the Active Directory Users & Computers snap-in when the Advanced View menu option is selected.

Local and Domain Global groups will not be moved during a movetree operation. Group memberships however will remain intact so that security is not compromised. Computer objects will not be moved during a movetree operation. Use the Netdom tool to move computer accounts between domains and to join computers to domains.

Associated data that is not moved during a movetree operation includes policies, profiles, logon scripts and user’s personal data. Use additional scripts or management tools, such as the Remote Administration Scripts, in conjunction with movetree to perform these additional steps.

Movetree Topics

  • Movetree Syntax
  • Movetree Examples

Files Required

  • Movetree.exe

For More Information

For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see Internet "Active Directory Overview".


Movetree.exe Syntax

command prompt Open command prompt now.

One Step movetree command argument [/u:{domain\user}] [/p:{password|*}]

Where:

command
Is one of the commands in the list below.
domain\user and password
If this is not specified, MoveTree will use the credentials of the currently logged on user.

Note If MoveTree is used in a batch file it will return ErrorLevel 0 for success and Error level 1 for a failure.

Movetree commands and arguments

/? Or /help
Displays online help information for movetree.
/test
Allows the administrator to perform a test run of the movetree operation without moving the objects.
/start
Initiates the movetree operation.
/test /start
combines both the test and start options into a single command.
/continue
Continues the execution of a previously paused command.


movetree.exe /continue

movetree /continue

The continue command continues the execution of a previously paused command. This allows the movetree operation to continue even if a network fault or a domain controller error interrupted the initial operation.

Syntax:

One Step movetree ServerName /continue /s:Src DC /d:Dst DC /ddn:Dst DN

Where:

Src DC
Source Domain Controller. Refers to the name of a domain controller in the domain from which the objects are being moved. Eg. Server1.Marketing.Acme.Com
Dst DC
Destination Domain Controller refers to the name of a domain controller in the domain to which the objects are being moved. Eg. Server2.Sales.Acme.Com
Dst DN
Is the distinguished name of the destination to which the objects are being moved. Eg. OU=Promotions,DC=Sales,DC=Acme,DC=Com

/continue Command Example

To resume a previous movetree operation between Server 1 in the Marketing domain and Server2 in the Sales domain in which the objects were being moved into the "Sales Promotion" organizational unit, execute the following command.

MOVETREE /continue
 /s:Server1.Marketing.Acme.Com
 /d:Server2.Sales.Acme.Com /ddn:OU=Sales
  Promotions,DC=Sales,DC=Acme,DC=Com


movetree.exe /start

movetree /start

The start command initiates the movetree operation. It continues the operation until the operation completes or it pauses the operation if there is a network fault or if the destination domain controller becomes unavailable. If the operation is paused, it may be continued using the /continue command.

Syntax:

One Step movetree ServerName /start /s:Src DC /d:Dst DC /sdn:SrcDN /ddn:Dst DN

Where:

Src DC
Source Domain Controller. Refers to the name of a domain controller in the domain from which the objects are being moved. Eg. Server1.Marketing.Acme.Com
Dst DC
Destination Domain Controller refers to the name of a domain controller in the domain to which the objects are being moved. Eg. Server2.Sales.Acme.Com
Src DN
Is the distinguished name of the object being moved. Eg. OU=Promotions,DC=Marketing,DC=Acme,DC=Com
Dst DN
Is the distinguished name of the destination to which the objects are being moved. Eg. OU=Promotions,DC=Sales,DC=Acme,DC=Com

Movetree /start command example

To move the "Promotions" organizational unit from the "Marketing" domain to the "Sales" domain and rename the "Promotions" organizational unit to "Sales Promotions" execute the follwing command:

MOVETREE /start /s:Server1.Marketing.Acme.Com
 /d:Server2.Sales.Acme.Com
 /sdn:OU=Promotions,DC=Marketing,DC=Acme,DC=Com
 /ddn: OU=Sales Promotions,DC=Sales,
  DC=Acme,DC=Com


movetree.exe /test

movetree /test

The /test command allows the administrator to perform a test run of the movetree operation without moving the objects. This will enable the administrator to determine if there is sufficent disk space on the target domain controller, if there are any conflicts with object names or if there are any objects that could not be moved (such as Domain Local or Global groups). The administrator may then take remedial action before performing the move operation.

Syntax:

One Step movetree ServerName /test /s:Src DC /d:Dst DC /sdn:SrcDN /ddn:Dst DN

Where:

Src DC
Source Domain Controller. Refers to the name of a domain controller in the domain from which the objects are being moved. Eg. Server1.Marketing.Acme.Com
Dst DC
Destination Domain Controller refers to the name of a domain controller in the domain to which the objects are being moved. Eg. Server2.Sales.Acme.Com
Src DN
Is the distinguished name of the object being moved. Eg. OU=Promotions,DC=Marketing,DC=Acme,DC=Com
Dst DN
Is the distinguished name of the destination to which the objects are being moved. Eg. OU=Promotions,DC=Sales,DC=Acme,DC=Com

/test Command Error Conditions

The test command will return an error if any of the following conditions are met:

  1. The user does not have the necessary permissions to create objects in the destination container.
  2. The destination domain controller does not have sufficient disk space to continue the operation.
  3. There is a relative distinguished name conflict on the destination.
  4. There is a samAccountName conflict for any object that would be moved.
  5. If there are any objects that cannot be moved because they are built-in accounts or they are either a Domain Local or a Global group.
  6. If there are any computer objects. Use the Netdom tool to move computer accounts and join the computers to the domain.

/test Command Example

To perform a test operation moving the "Promotions" organizational unit from the "Marketing" domain to the "Sales" domain and renaming the "Promotions" organizational unit to "Sales Promotions", execute the following command:

MOVETREE /test
/s:Server1.Marketing.Acme.Com
/d:Server2.Sales.Acme.Com /sdn:OU=Promotions,
DC=Marketing,DC=Acme,DC=Com /ddn:OU=Sales
Promotions,DC=Sales,DC=Acme,DC=Com


movetree.exe /test /start

movetree /test /start

This command combines both the test and start options into a single command. This allows the administrator to perform a test operation and, if that is successful, automatically start the move operation.

Syntax:

One Step movetree ServerName /test /start /s:Src DC /d:Dst DC /sdn:SrcDN /ddn:Dst DN

Where:

Src DC
Source Domain Controller. Refers to the name of a domain controller in the domain from which the objects are being moved. Eg. Server1.Marketing.Acme.Com
Dst DC
Destination Domain Controller refers to the name of a domain controller in the domain to which the objects are being moved. Eg. Server2.Sales.Acme.Com
Src DN
Is the distinguished name of the object being moved. Eg. OU=Promotions,DC=Marketing,DC=Acme,DC=Com
Dst DN
Is the distinguished name of the destination to which the objects are being moved. Eg. OU=Promotions,DC=Sales,DC=Acme,DC=Com


Movetree.exe Examples

Moving an organizational unit from one domain to another

In the Marketing domain there is an organizational unit called "Promotions" and a server called "Server1". In the Sales organizational unit is a server called "Server2". The desired operation is to move the "Promotions" organizational Unit from Marketing to Sales and rename the new OU "Sales Promotions".

The following command performs a test run, and then if no errors are encountered performs the move operation:

MOVETREE /TEST /START
 /s:Server1.Marketing.Acme.Com
 /d:Server2.Sales.Acme.Com
 /sdn:OU=Promotions,DC=Marketing,DC=Acme,DC=Com
 /ddn:OU=Sales Promotions
 ,C=Sales,DC=Acme,DC=Com

Alternatively this operation could be performed using a batch file:

MOVETREE /TEST /s:Server1.Marketing.Acme.Com
 /d:Server2.Sales.Acme.Com
 /sdn:OU=Promotions,DC=Marketing,DC=Acme,DC=Com
 /ddn:OU=Sales Promotions,DC=Sales,DC=Acme,DC=Com
IF ERRORLEVEL 0 GOTO START
GOTO EXIT
:START
MOVETREE /START /s:Server1.Marketing.Acme.Com
 /d:Server2.Sales.Acme.Com
 /sdn:OU=Promotions,DC=Marketing,DC=Acme,DC=Com
 /ddn:OU=Sales Promotions ,DC=Sales,DC=Acme,DC=Com
:EXIT


Ntdsutil.exe

Ntdsutil.exe: Directory Services Management Tool NEW

Word for Windows Open Ntdsutil.doc now.

This command-line tool provides Windows directory service management facilities for Windows 2000.

NtdsUtil performs database maintenance of the Active Directory store, management and control of the Floating Single Master Operations (FSMO), and cleaning up of metadata left behind by abandoned domain controllers, those which are removed from the network without being uninstalled.

Files Required

  • Ntdsutil.doc
  • Ntdsutil.exe

For More Information

For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see Internet "Active Directory Overview".


Remote Administration Scripts

Remote Administration Scripts NEW

HTML Help Open Rscripts.chm now.

The Remote Administration Scripts are a collection of Visual Basic scripting tools designed to perform specific administrative tasks using Microsoft Active Directory Services Interfaces (ADSI) and Windows Management Instrumentation (WMI) for Windows 2000. Rscripts.chm is an HTML Help file that documents the Remote Administration Scripts.

Related Tools

Files Required

  • Rscripts.chm

The Remote Administration Scripts files are located in the \Dstool\Vbsscripts folder of the Windows 2000 Resource Kit.

For More Information

For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see:
Internet "Active Directory Overview".

For more information about WMI and WBEM, visit the following Web site:
Internet http://www.microsoft.com/management/wbem/

For more information about VBScript and Windows Scripting Host, go to:
Internet http://msdn.microsoft.com/scripting/


Repadmin.exe

Repadmin.exe: Replication Diagnostics Tool NEW

This command-line tool assists administrators in diagnosing replication problems between Windows 2000 domain controllers.

During normal operation, the Knowledge Consistency Checker (KCC) automatically manages the replication topolgy for each naming context held on domain controllers.

RepAdmin allows the administrator to view the replication topology (sometimes referred to as RepsFrom and RepsTo) as seen from the perspective of each domain controller. In addition RepAdmin can be used to manually create the replication topology (although in normal practice this should not be necessary), to force replication events between domain controllers and to view both the replication metadata and up-to-dateness vectors.

Note During the normal course of operations, there is no requirement for manual creation of the replication topology. Incorrect use of this tool may adversely impact the replication topology. The major use of this tool is to monitor replication so that problems such as offline servers, unavailable LAN/WAN connections can be identified.

RepAdmin Topic

  • RepAdmin Syntax

Related Tools

File Required

  • Repadmin.exe

For More Information

For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see Internet "Active Directory Overview".


RepAdmin Syntax

command prompt Open command prompt now.

One Step repadmin command arguments [/u:domain\user] [/pw:password|*}]

Where:

command
represents one of the commands listed below.
arguments
are the arguments applying to cmd.
/u:domain\user
specifies an optional user and domain as the administrator. If the username and password are not specified, RepAdmin uses the credentials of the currently logged-on user.
/pw:password | *
is the password of the user specified by the /u: switch. If the username and password are not specified, RepAdmin uses the credentials of the currently logged-on user.

Commands and Arguments

In the following command listings, these terms are used:

Naming_Context
refers to the naming contexts that are held on a domain controller, namely: the three read/write naming contexts domain, schema and configuration and the optional read-only naming context, the Global Catalog (GC). A naming context is specified with its distinguished name, for example, dc=antipodes,dc=com.
DSA
Directory System Agent. Refers to the name of a domain controller, for example, Server1.
DSA UUID
DSA Universally Unique ID. Refers to the 128 bit number used to identify objects stored in the directory, for example, fa1a9e6e-2e14-11d2-aa9b-bbfc0a30094c.
DN
X.500 distinguished name, for example, cn=Server1,cn=First Site,cn=configuration,cn=antipodes,cn=com.

/add Naming_Context Destination_DSA Source_DSA [/asyncrep] [/syncdisable] [/dsadn:Source_DSA_DN] [/transportdn:Transport_DN] [/mail] [/async]

creates a RepsFrom attribute on the destination domain controller for the specified naming context and initiates a replication request. During a normal replication cycle, the destination domain controller requests updates from the source domain controller.
/asyncrep
queues the replication event, but does no wait for the replication to complete before returning control to the user.
/syncdisable
adds the RepsFrom attribute but does not participate in the replication cycle. To perform replication between the destination and source domain controllers, repadmin /sync /force must be used.
/trasnportdn
specifies the distinguished name of the Inter Site Message transport, used only for mail based replication.
/mail
specifies that the replication is mail based, therefore requires the /transportdn option.
/async
queues the add operation without interupting the current replication cycle and returns control to the user.

/delete Naming_Context Destination_DSA [Source_DSA] [/localonly][/nosource] [/async]

removes a RepsFrom attribute on the destination domain controller for the specified naming context.
/localonly
does not delete the corresponding RepsTo attribute on the source DSA.
/nosource
when removing a read only naming context such as the Global Catalog, the associated data stored in the directory is removed in blocks of 500 objects. This allows the /delete command to be re-executed without havingto specify the Source DSA to remove the remaining objects.
/async
queues the delete operation without interupting the current replication cycle and returns control to the user.

/sync Naming_Context Destination_DSA Source_DSA_UUID [/force] [/async] [/full]

starts a replication event for the specified naming context between the source and destination domain controllers. The source DSA UUID can be determined when viewing the replication partners with the repadmin /showreps command.
/force
overides the normal replication schedule.
/async
starts the replication event, but RepAdmin will not wait for the replication event to complete.
/full
forces a full replication of all objects from the destination DSA.

/addrepsto Naming_Context DSA Reps_To_DSA Reps_To_DSA_UUID

creates a RepsTo attribute on the domain controller for the specified naming context. Ordinarily there is no requirement to perform this command as the KCC will automatically create the RepsTo attributes on destination DSA’s from other DSA’s RepsFrom entries.

/updrepsto Naming_Context DSA Reps_To_DSA Reps_To_DSA_UUID

updates the RepsTo attribute on the domain controller for the specified naming context. More specifically it updates the network address used by the source DSA to contact the destination DSA.

/delrepsto Naming_Context DSA Reps_To_DSA Reps_To_DSA_UUID

deletes the RepsTo attribute on the domain controller for the specified naming context.

/showreps DSA [/verbose] [/nocache]

displays the replication partners (RepsFrom and RepsTo) for each naming context that is held on the specified domain controller. By enumerating each RepsFrom and each RepsTo for each domain controller, the administrator would be able to visualise the replication topology for each naming context. The output also indicates whether the domain controller is also a Global Catalog (GC) server.

/showvector Naming_Context [DSA] [/nocache]

displays the up-to-dateness information for a specified naming context. This vector indicates how up to date a replica is with its replication partners.

/showmeta Object_DN [DSA] [/nocache]

displays the replication metadata for any object stored in the Active Directory such as attribute ID, version number, originating and local Update Sequence Number (USN), and originating DSA’s GUID and date/time stamp. By comparing the replication metadata for the same object on different domain controllers, an administrator can determine whether replication has taken place.

/showtime [Windows_NT_Directory_Service_Time_Value]

with no arguments displays the current system time in both the Directory Service format and string format. The string format displays both the local and UTC time zones.
Alternatively, Showtime accepts a Directory Service time value and converts it to a string format in both local and UTC time zone.

/showmsg Win32_error_number

takes as an argument the Win32 error number and displays the Win32 error text.

/options [DSA] [{+ | -}IS_GC] [{+ | -}DISABLE_INBOUND_REPL] [{+ | -}DISABLE_OUTBOUND_REPL] [{+ | -}DISABLE_NTDSCONN_XLATE]

allows the administrator to control whether the domain controller hosts a copy of the Global Catalog, whether to enable or disable replication.


Replmon.exe: Active Directory Replication Monitor

Platform: Replmon.exe runs only on x86-based computers.

shortcut Run Active Directory Replication Monitor now.

For information on calling functions in the IADsTools ActiveX DLL from a script:

WordPad Open Iadstools.doc now.

This utility graphically displays the replication topology of connections between servers on the same site. ReplMon enables administrators to view low-level status and performance of replication between Active Directory domain controllers and optionally, the status of Group Policy Objects.

The tool works as a client of a COM object. Administrators can use it to customize their own VBScripts to extract replication data out of the Directory Services and act on it. It also includes functions which are wrapped APIs to make it easy to script replication with just a few lines of VBScript code.

Active Directory Replication Monitor Features

ReplMon:

  • Automatically detects all naming contexts on the selected server, including Global Catalog servers.
  • Displays with whom the machine is replicating both directly and transitively.
  • For direct replication partners, displays each USN value, number of failed attempts, reason, and flags used for each partner.
  • Offers a Server Wizard so that administrators can select from a list without knowing the server name.
  • Automatically detects what domain a client is in and displays the appropriate option.
  • Allows administrators to display how remote domain controllers are configured (for example, whether they're the primary domain controller).
  • In Automatic Update Mode, polls the server at an administrator-defined interval to get current statistics and replication state.
  • Allows administrators to synchronize between just two domain controllers.
  • Allows administrators to trigger the Knowledge Consistency Checker into re-calculating the replication topology.
  • Logs all of the tool's activities.
  • Keeps a log file of the history of the server's replication state that is viewable in the tool's "Details" mode.
  • Monitors the count of failed replication attempts. If the failure meets or exceeds an administrator-defined value, it can write to the event log and send mail.
  • Allows administrators to show which objects have not yet replicated from a particular machine.
  • Displays information and instructions on using each feature when you move your mouse over it.

    • Requirements

    ReplMon must be installed on a computer running Windows 2000 Professional or Server. The computer can be a domain controller, member server, or standalone machine.

    Active Directory Replication Monitor Topics

    • Using Active Directory Replication Monitor
    • Troubleshooting With Active Directory Replication Monitor

    Related Tools

    Files Required

    • Replmon.exe – main executable for Active Directory Replication Monitor (Visual Basic 5.0)
    • Iadstools.dll – component DLL that hosts the functions used by Active Directory Replication Monitor (COM Object)
    • Iadstools.doc - documentation for IADsTools

    For More Information

    For background on Active Directory, visit the Microsoft Windows 2000 Server Web site and see Internet "Active Directory Overview".


Installing Active Directory Replication Monitor

ReplMon must be installed on a computer running Windows 2000 Professional or Server. The computer can be a domain controller, member server, or standalone computer.

Installation of Active Directory Replication Monitor also installs a popup DLL named Iadstools.dll in the \system32 directory. This DLL, a popup COM object, contains the functions used by Active Directory Replication Monitor to perform the various tasks in the tool. The Active Directory Replication Monitor application is itself a client to Iadstools.dll, which can be scripted by using Windows Scripting Host. For more information on scripting the data through this DLL, refer to the IADsTools Documentation.

WordPad Open Iadstools.doc now.

Active Directory Replication Monitor is not installed by the Windows 2000 Resource Kit by default. To install it, use the following procedure:

To install Active Directory Replication Monitor

  1. From the \Replmon subdirectory on the Windows 2000 Resource Kit CD, run Setup.exe.
  2. Select a directory where the application should be installed. The default directory is %Program Files%\Active Directory Replication Monitor.
  3. Select the option to continue with installation. No further configuration is necessary. An icon for Active Directory Replication Monitor is created under Programs on the Start Menu.


Using Active Directory Replication Monitor

To run ReplMon

one step From the Start menu, choose Programs, and then choose Active Directory Replication Monitor
–Or–
one step From the Start menu, choose Run, and then Browse to search for the folder or subdirectory where you installed Replmon.exe: Active Directory Replication Monitor.

ReplMon How-to Topics

  • Features of the Active Directory Replication Monitor Window
  • Adding a Server to the List of Monitored Servers
  • Triggering a Manual Refresh of the Statistics for a Monitored Server
  • Synchronizing Naming Contexts
  • Recalculating Replication Topology
  • Determining Who Owns a FSMO (Flexible Single Master Operation)
  • Graphically Displaying Replication Partners
  • Viewing the Topology of Replication Partners for a Given Naming Context
  • Graphically Displaying the Domain Controller Responsible for Inter-Site Topology
  • Displaying Attribute Meta-Data for Objects in the Directory
  • Viewing Retired Domain Controllers as Replica Partners


Troubleshooting With Active Directory Replication Monitor

Logging Active Directory Replication Monitor Events

If any errors are encountered while running Active Directory Replication Monitor, the administrator can enable diagnostic debug logging of internal application events. In this mode, as the application progresses through its monitoring of servers, events are written to the application log. This can be helpful in determining the causes of problems.

To enable debug logging

  1. From the View menu, select Options...…
  2. On the General tab, select Enable Debug Logging and click OK.

The change takes place immediately. On the next refresh of statistics, events will be written to the event log.

Note This option may fill the Application Log rapidly. Set log properties appropriately to accommodate possible event logging.

ReplMon Troubleshooting Topics

  • Displaying Group Policy Objects
  • Displaying Performance Statistics
  • Displaying Attribute Replication Status


Ktpass.exe: Kerberos Keytab Setup

Ktpass.exe: Kerberos Keytab Setup NEW

KtPass is a configuration tool for MIT Kerberos interoperability that allows an Administrator to configure a non-Windows 2000 Kerberos service as a security principal in the Windows 2000 Active Directory. Ktpass configures the server principal name for the host or service in the Active Directory and generates an MIT-style Kerberos "keytab" file containing the service’s shared secret key. The tool allows UNIX-based services that support Kerberos authentication to use the interoperability features provided by the Windows 2000 Kerberos KDC service.

Note: Use the Windows Directory Management tool to create computer and user accounts for the host and user security principals logging into the Windows Kerberos domain.

Uses of KSetup

Administrators can use Ktpass to generate the keytable output file useed to replace or merge with the MIT Kerberos /etc/krb5.keytab file. MIT Kerberos-based services (non-interactive) use the keytab to log on and utilize Kerberos services.

Note Keytab files should be securely transferred to and from the foreign host because they contain keys, which are similar to passwords.

See the MIT Kerberos 5 (krb5 1.0) Interoperability walkthrough for more information. You will find this document on your Windows 2000 Beta product CD-ROM or on the Windows 2000 Beta Web site (http://ntbeta.microsoft.com/documentation/WalkThrough.asp)

Ktpass Topic

  • Ktpass Syntax

Related Topics

Files Required

  • Ktpass.exe


Ktpass Syntax

command prompt Open command prompt now.

One Step ktpass /out filename /princ username [/mapuser] [/in filename] [/crpyto type] [/ptype type] [/keyno keynum] [/?]

Where:

/out
Specify the name of the Krb5 keytable file to be generated.

Note This is the keytable you transfer to the UNIX computer and replace or merge with your existing keytable file, /etc/krb5.keytab.

/princ
Principal name in the form user@REALM. Example: "sample" or "host/unix.foo.bar.com"
/pass
Passworrd to use for this principal (set in /princ) name.
/mapuser
Map the name of a Kerberos principal (set in /princ) onto a local account. By default, this is not done.
/in
Keytab to read or digest.
/crypto {DES-CBC-CRC | DES-CBC-MD5}
Encryption type to use.

DES-CBC-CRC : default

DES-CBC-MD5 : more MIT-ish

Note Other encryption types will be added before final release.

/ptype {KRB5_NT_PRINCIPAL | KRB5_NT_SRV_INST | KRB5_NT_SRV_HST}
Specify the principal type.

KRB5_NT_PRINCIPAL : general ptype (recommended) Just the name of the principal or for users

KRB5_NT_SRV_INST : user service instance

KRB5_NT_SRV_HST : host service instance

/kyno
Key Version Number (def:1)
/?
Displays the usage screen.

Ktpass Example

The following example shows how to use Ktpass to generate a UNIX host keytab file, map the principal to the account, and set the host principal password.

C:> Ktpass -princ host/hostname@NT-DNS-REALM-NAME -mapuser hostname$ -pass password -out unixmachine.keytab

where

hostname is the host DNS name, (for example, "foobar.microsoft.com").

NT-DNS-REALM-NAME is the uppercase name of the Windows domain; for example, "NTDOM.MICROSOFT.COM."

hostname$ is the host DNS name with a dollar sign ($) appended; this is the account for the computer.

password is a complex password for the account.


Dhcpcmd.exe: DHCP Administrator's Tool

This command-line tool provides an auxiliary method of administering Dynamic Host Configuration Protocol (DHCP) servers.

DHCP Administrator's Tool Topic

  • DHCP Administrator's Tool Syntax

Files Required

  • Dhcpcmd.exe


DHCP Administrator's Tool Syntax

Command prompt Open command prompt now.

One Step dhcpcmd ServerIpAddress command [command options]

Where:

ServerIpAddress
specifies the IP address of the DHCP server on which you are running the command.
command
is one of the commands in the following list:
General commands
AddReservedIp

GetVersion

MibCounts

ServerConfig

Subnet commands
CreateSubnet

DeleteSubnet

SetSubnetState

Range commands
AddIpRange

AddExcludeRange

RemoveExcludeRange

Active-Lease commands
EnumClients
Superscope commands
SetSuperScope

DeleteSuperScope

GetSuperScopeTable

RemoveSubScope

Command options
are parameters you might have to specify, depending on the value of command. The following options can be used:

CreateOption

DeleteOption

SetGlobalOptionValue

RemoveGlobalOptionValue

SetSubnetOptionValue

RemoveSubnetOptionValue

SetReservedOptionValue

RemoveReservedOptionValue


Dhcploc.exe: DHCP Server Locator Utility

DHCP Server Locator Utility displays the DHCP servers active on the subnet. If it detects any unauthorized DHCP servers, it beeps and sends out alert messages. It also displays packets that it detects from DHCP servers; you can specify whether to display packets from all DHCP servers or only from unauthorized servers.

You can use this command line-based tool to determine which DHCP servers are available to a DHCP client and to detect unauthorized DHCP servers on a subnet.

Important
DHCP Server Locator Utility should not be run from a DHCP server. The tool listens for DHCP servers by taking DHCP packets off the IP stack. However, it has no means to reintroduce DHCP packets to the stack. Therefore, running this tool on a DHCP server will preempt DHCP requests and the DHCP server will appear not to respond.

DHCP Server Locator Utility Topics

  • DHCP Server Locator Utility Syntax
  • DHCP Server Locator Utility Output

Files Required

  • Dhcploc.exe


DHCP Server Locator Utility Syntax

command prompt Open command prompt now.

One Step dhcploc [-p] [-a:"alertname_list"] [-i:alertinterval] computer_ip_address [valid_dhcp_server_list]

Where:

-p:

specifies not to display detected packets from any of the authorized DHCP servers specified in valid_dhcp_server_list.

-a:"alertname_list"

specifies to send alert messages to the names in alertname_list if any unauthorized DHCP servers are found.

-i:alertinterval

specifies the alert frequency in seconds.

computer_ip_address

specifies the IP address of the computer from which you are running DHCPLOC. If the computer has multiple adapters, you must specify the IP address of the adapter that is connected to the subnet you want to test.

valid_dhcp_server_list

specifies the IP addresses of any number of authorized DHCP servers. The utility will not send alerts when it detects packets from the servers in this list. However it will display those packets unless you specify the -p option.


DHCP Server Locator Utility Output

The output of DHCP Server Locator Utility is formatted as follows:

time (IP) ipaddress OfferedPacketType (S) ServerIPAddress [***]

where "***" indicates a packet from an unauthorized server.

Sample output:

17:34:58 (IP)0.0.0.0 NACK (S)11.11.31.84 ***

17:36:38 (IP)11.101.190.130 OFFER (S)11.101.12.226 ***

17:36:38 (IP)11.101.196.231 ACK (S)11.101.13.53

17:36:53 (IP)11.101.196.231 ACK (S)11.101.13.53

17:37:05 (IP)11.101.196.234 OFFER (S)11.101.13.53

17:37:05 (IP)11.101.193.232 OFFER (S)11.101.12.198

17:37:06 (IP)11.101.190.132 OFFER (S)11.101.12.226 ***


Dnscmd.exe

Dnscmd.exe: DNS Server Troubleshooting Tool NEW

Dnscmd.exe is a command line tool designed to assist administrators in DNS management.

DNScmd allows the administrator to view the properties of DNS servers, zones and resource records. In addition DNScmd can be used to manually modify these properties, to create and delete zones and resource records, and to force replication events between DNS server physical memory and DNS databases/datafiles.

Note DNScmd enhances the functionality of and replaces Dnsstat.exe, a tool included in previous Resource Kits.

DNScmd Topics

  • DNScmd Syntax
  • DNScmd Example

File Required

  • Dnscmd.exe


DNScmd Syntax

command prompt Open command prompt now.

One Step dnscmd ServerName Command [Command Parameters]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Command

Is one of the commands listed below.
Command Parameters
Are the optional parameters associated with some of the commands listed below.

DNSCMD Commands

/Info
Provides DNS Server properties.
/ResetRegistry
Resets a property of a server or zone.
/Restart
Restarts the specified DNS server.
/ClearCache
Clears the cache of the specified DNS server.
/UpdateServerFile
Writes datafile for the specified zone.
/ResetListenAddresses
Resets/selects server IP address(es) to serve DNS requests.
/ResetForwarders
Resets/selects forwarders IP address(es).
/EnumZones
Enumerates zones on the specified DNS server.
/ZoneAdd
Creates a new zone on the specified DNS server.
/ZoneDel
Deletes specified zone from the specified DNS server.
/ZonePause
Pauses the specified zone on the specified DNS server.
/ZoneResume
Resumes the specified zone on the specified DNS server.
/ZoneReload
Reloads the specified zone from its database (file or DS) on the specified DNS server.
/ZoneWriteBack
Writes back the specified zone to the file on the specified DNS server.
/ZoneRefresh
Forces refresh of the specified secondary zone on the specified DNS server from its master.
/ZoneUpdateFromDs
Updates the specified DS integrated zone by data from DS on the specified DNS server.
/ZoneResetType
Changes a type (Primary/Secondary/DSintegrated) of the specified zone on the specified DNS server.
/ZoneResetNotify
Sets/resets a notify list for the specified zone on the specified server.
/RecordAdd
Creates a record in the specified zone or RootHints on the specified DNS server.
/RecordDel
Deletes a record from the specified zone or RootHints on the specified DNS server.
/NodeDel
Deletes all records at a name from the specified zone, RootHints or Cache at the specified DNS server.


Dnscmd.exe /ClearCache

Dnscmd /ClearCache

The /ClearCache command clears the DNS server cache.

Syntax:

One Step dnscmd ServerName /ClearCache

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes


Dnscmd.exe /EnumRecords

Dnscmd /EnumRecords

The /EnumRecords command enumerates records at the specified node on the specified DNS server. If none of the optional fields is specified the command returns all records at the specified node. If a value of at least one of the optional fields is specified then it enumerates only records corresponding to the value(s) specified in the optional field(s).

Syntax:

One Step dnscmd ServerName /EnumRecords NodeName [DataOption] [/Type RRType] [/Root|/Child] [/Additional] [/StartPoint ChildName]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
NodeName
is a Fully Qualified Domain Name (FQDN) of a node.
DataOption

may have the following values:
    /Authority
    /RootHints
    /Cache
    /Glue

RRType
may be any resource record (RR) type such as A, NS, SOA, etc.
/Root|Child
Causes the command to enumerate only RRs of the root (/Root) or only RRs NOT of the root (/Child).
/Additional
Causes the output to include additional data when enumerating.
ChildName
Is the domain name below which to start enumeration.


Dnscmd.exe /EnumZones

Dnscmd /EnumZones

The /EnumZones command enumerates zones on the specified DNS server. If no filters values are specified it enumerates all zones on that server. If a value of at least one filter is specified then it enumerates only zones corresponding to the value(s) specified in the filters fields.

Syntax:

One Step dnscmd ServerName /EnumZones [Filter1] [Filter2]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
[Filter1]
May have the following values:
    /Primary
    /Secondary
    /Cache
    /Auto-Created

[Filter2]
May have the following values:
    /Forward
    /Reverse


Dnscmd.exe /Info

Dnscmd /Info

The info command provides the DNS server properties if no zone is specified. If a zone name follows the /Info keyword, then the command provides the zone properties.

Usage:

One Step dnscmd ServerName /Info [ZoneName[Options] ]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Options

May have two values: AllowUpdate and DsIntegrated. If one of these options follows the zone name then the command provides a current value of the appropriate key only.


Dnscmd.exe /NodeDel

Dnscmd /NodeDel

The /NodeDel command deletes all records at a name from the specified zone, RootHints or Cache at the specified DNS server.

Syntax:

One Step dnscmd ServerName /NodeDel Zone NodeName [/Tree] [/f]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Zone

May be ZoneName or /RootHints or /Cache.
NodeName

is a Fully Qualified Domain Name (FQDN) of a node (with a '.' at the end) OR node name relative to the ZoneName.
/Tree
If this optional field is specified then the command deletes entire subdomain. If this field is not specified then the subdomain is not deleted.
/f
If this optional field is specified the command executes without asking for confirmation.


Dnscmd.exe /RecordAdd

Dnscmd /RecordAdd

The /RecordAdd command creates a record in the specified zone or RootHints on the specified DNS server.

Syntax:

One Step dnscmd ServerName /RecordAdd Zone OwnerName [Ttl] RRType RRData

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Zone
may be a ZoneName or /RootHints.
Ttl
An optional parameter that specifies Time-to-Live (TTL) for the created record. If the field is not specified then the TTl is specified in the SOA record for the zone.
RRtype and RRData
The RRData parameter may receive different sets of data values depending on the RRType of the record, as shown in the table below.
Set of allowed record types RRType | Set of allowed record data RRData
A | IPAddress
SOA | PrimSvr, Admin, Serial#, Refresh, Retry, Expire, MinTTL
NS,CNAME,MB,MD,PTR,MF,MG,MR | HostName | DomainName
MX,RT,AFSDB | Preference, ServerName
MINFO,RP | MailboxName, ErrMailboxName
TXT,X25,HINFO, ISDN | String [String]
SRV | Priority, Weight, Port, HostName
WKS | Protocol*, IPAddress, Service [Service]...]
AAAA | ipv6Address
WINS | MapFlag, LookupTimeout, CacheTimeout, IPAddress, [IPAddress]
WINSR | MapFlag LookupTimeout CacheTimeout RstDomainName
* The Protocol variable may have two values: UDP or TCP


Dnscmd.exe /RecordDel

Dnscmd /RecordDel

The /RecordDel command deletes a record from the specified zone, RootHints or Cache on the specified DNS server.

Syntax:

One Step dnscmd ServerName /RecordDel Zone OwnerName [Ttl] RRType RRData

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Zone
may be ZoneName or /RootHints or Cache.
RRtype and RRData
The RRData parameter may receive different sets of data values depending on the RRType of the record, as shown in the table below.
Set of allowed record types RRType | Set of allowed record data RRData
A | IPAddress
NS,CNAME,MB,MD,PTR,MF,MG,MR | HostName | DomainName
MX,RT,AFSDB | Preference, ServerName
MINFO,RP | MailboxName, ErrMailboxName
TXT,X25,HINFO, ISDN | String [String]
SRV | Priority, Weight, Port, HostName
WKS | Protocol, IPAddress, Service [Service]...]
AAAA | ipv6Address
ATMA | ATM Address
WINS | MapFlag, LookupTimeout, CacheTimeout, IPAddress, [IPAddress]
WINSR | MapFlag LookupTimeout CacheTimeout RstDomainName
/F
Forces execution of command without asking for confirmation.


Dnscmd.exe /ResetForwarders

Dnscmd /ResetForwarders

The /ResetForwarders command resets/selects forwarders IP address(es).

Syntax:

One Step dnscmd ServerName /ResetForwarders [IPAddress] ...] [ /[No]Slave ] [/TimeOut Time]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
IPAdress

Is an IP address where the DNS server forwards DNS queries that are unsolvable within its own databases. There can be a list of space-separated IPAddresses. If no IPAddress is specified then DNS server does not have forwarders.
[ /[No]Slave ]
Optionally allows you to specify whether the DNS server is a Slave. If this parameter is not specified then the server is not a Slave.
Time
Specifies the forwarding timeout. If no value is specified then the forwarding timeout is 5 seconds.


Dnscmd.exe /ResetListenAddresses

Dnscmd /ResetListenAddresses

The /ResetListenAddresses command resets/selects server IP address(es) to serve DNS requests.

Syntax:

One Step dnscmd ServerName /ResetListenAddresses [ListenAddress]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ListenAddress

Is an IP address belonging to the DNS server. More than one ListenAddress can be listed, separated by spaces. If no ListenAddress is specified, DNS server listens to all server IP addresses.


Dnscmd.exe /ResetRegistry

Dnscmd /ResetRegistry

The /ResetRegistry command resets a binary value of one of the properties of the server or zone to the value specified under Value. If a zone name is not specified then the command resets a server property.

Syntax:

One Step dnscmd ServerName /ResetRegistry [Zone] Property Value

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Property
May be a zone property, if the Zone parameter is specified, otherwise must be a server property.
The list of zone properties which may be specified includes:
    /SecureSecondaries
    /AllowUpdate
    /Unicode

The list of server properties which may be specified includes:
    /EnableRegistryBoot
    /RpcProtocol
    /NoRecursion
    /RecursionRetry
    RecursionTimeout
    /ForwardingTimeout
    /IsSlave
    /DisableAutoReverseZones
    /CleanupInterval
    /AutoCacheUpdate
    /AllowUpdate
    /DisjointNets
    /RoundRobin
    /AddressAnswerLimit
    /BindSecondaries
    /WriteAuthoritySoa
    /WriteAuthorityNs
    /StrictFileParsing
    /LooseWildcarding
Value

Must be 0 or 1.


Dnscmd.exe /Restart

Dnscmd /Restart

The /Restart command restarts the specified DNS server.

Syntax:

One Step dnscmd ServerName /Restart

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes


Dnscmd.exe /UpdateServerFile

Dnscmd /UpdateServerFile

The /UpdateServerFile command writes a data file for the specified zone. If zone name is not specified then the command writes to data files all dirty (out of date) zone and/or root-hint data file(s).

Syntax:

One Step dnscmd ServerName /UpdateServerFile [ZoneName]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes


Dnscmd.exe /ZoneAdd

Dnscmd /ZoneAdd

The /ZoneAdd command creates a new zone on the specified DNS server.

Syntax:

One Step dnscmd ServerName /ZoneAdd [ZoneName>] Property [Options]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Property
may have one of the following three values:
    /Primary [/file filename]

    /Secondary MasterIPaddress[MasterIPaddress] ...] [/file filename]

    /DsPrimary.

Where:

/Primary
Stands for the standard (non-DS integrated) primary zone.
[/file ]
Allows specification of the zone’s file name.
/Secondary
If a secondary zone is specified, at least one MasterIPaddress must be provided, or a space-separated list if there are more than one Masters for the created secondary zone.
/DsPrimary
Indicates that the new zone is primary DS integrated.
Options
Can have the following three values:
/a AdminName
is the email name of the zone administrator.
/OverWrite_Mem
overwrites DNS by data in DS.
/OverWrite_Ds
overwrites DS by data in DNS.


Dnscmd.exe /ZoneDel

Dnscmd /ZoneDel

The /ZoneDel command deletes the specified zone from the specified DNS server, and from the DS if the zone is DS-integrated and the /DsDel flag is specified. If the /DsDel flag is not specified then the zone is deleted from the DNS server, but not from the DS. If the /f flag is set, the command executes without asking for confirmation.

Syntax:

One Step dnscmd ServerName /ZoneDel ZoneName [/DsDel] [/f]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
Is name of the zone to be deleted.
/DSdel
specifies that the zone should be deleted from the DS as well.
/F
Forces the command to execute without asking for confirmation.


Dnscmd.exe /ZonePause

Dnscmd /ZonePause

The /ZonePause command pauses the specified zone on the specified DNS server.

Syntax:

One Step dnscmd ServerName /ZonePause ZoneName

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes


Dnscmd.exe /ZoneRefresh

Dnscmd /ZoneRefresh

The /ZoneRefresh command forces refresh of the specified secondary zone on the specified DNS server from its master.

Syntax:

One Step dnscmd ServerName /ZoneRefresh ZoneName

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes


Dnscmd.exe /ZoneReload

Dnscmd /ZoneReload

The /ZoneReload command reloads the specified zone from its database (file or DS) on the specified DNS server.

Syntax:

One Step dnscmd ServerName /ZoneReload ZoneName

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes


Dnscmd.exe /ZoneResetNotify

Dnscmd /ZoneResetNotify

The /ZoneResetNotify command sets/resets a notify list for the specified zone on the specified server.

Syntax:

One Step dnscmd ServerName /ZoneResetNotify ZoneName [ /[No]Secure ] [NotifyIPAddress] ...]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
[ /[No]Secure ]

Specifies the zone as secure (/Secure), which allows access by secondaries in notify list ONLY, or non-secure (/NoSecure). If the field is not specified the zone is non-secure.
NotifyIPAddress
Is the IP address of the secondaries to be notified. This can be a list of space-separated IP addresses.


Dnscmd.exe /ZoneResetType

Dnscmd /ZoneResetType

The /ZoneResetType command changes a type (Primary/Secondary/DSintegrated) of the specified zone on the specified DNS server.

Syntax:

One Step dnscmd ServerName /ZoneResetType ZoneName Property [Options]

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Property
may have one of the following three values:
    /Primary [/file filename]

    /Secondary MasterIPaddress[MasterIPaddress] ...] [/file filename]

    /DsPrimary.

Where:

/Primary
Stands for the standard (non-DS integrated) primary zone.
[/file ]
Allows specification of the zone’s file name.
/Secondary
If a secondary zone is specified, at least one MasterIPaddress must be provided, or a space-separated list if there are more than one Masters for the created secondary zone.
/DsPrimary
Indicates that the new zone is primary DS integrated.
Options
May have the following three values:
/a AdminName
is the email name of the zone administrator.
/OverWrite_Mem
overwrites DNS by data in DS.
/OverWrite_Ds
overwrites DS by data in DNS.


Dnscmd.exe /ZoneResume

Dnscmd /ZoneResume

The /ZoneResume command resumes the specified zone on the specified DNS server.

Syntax:

One Step dnscmd ServerName /ZoneResume ZoneName

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes


Dnscmd.exe /ZoneUpdateFromDs

Dnscmd /ZoneUpdateFromDs

The /ZoneUpdateFromDs command updates the specified DS integrated zone by data from DS on the specified DNS server.

Syntax:

One Step dnscmd ServerName /ZoneUpdateFromDs ZoneName

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes


Dnscmd.exe /ZoneWriteBack

Dnscmd /ZoneWriteBack

The /ZoneWriteBack command writes back the specified zone to the file on the specified DNS server.

Syntax:

One Step dnscmd ServerName /ZoneWriteBack ZoneName

Where:

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local machine using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes


DNScmd Examples

One Step getserverinfo

To gather information about the status of the DNS server use the getserverinfo command:
dnscmd 157.54.130.19 getserverinfo

Output

DNS Server 157.54.130.19 Information:
Server info:
        ptr              = 00141F38
        version          = 00000000
        boot registry    = 1
        ServerAddresses:
                Addr Count = 3
                Addr[0] => 157.54.130.19
                Addr[1] => 1.1.1.201
                Addr[2] => 1.1.1.65
        ListenAddresses:
                Addr Count = 1
                Addr[0] => 1.1.1.201
        Forwarders:
        NULL IP Array
        forward timeout  = 0
        slave            = 0
Command successfully completed.

One Step resetlistenaddresses

dnscmd 157.54.130.19 resetlistenaddresses 2 1.1.1.65 1.1.1.1

Output

ListenAddresses reset successful.
Command successfully completed.

One Step resetforwarders

dnscmd 157.54.130.19 resetforwarders 2 1.1.1.1 2.2.2.2 fslave 1

Output

Forwarders reset successful.

One Step getstatistics

dnscmd 157.54.130.19 getstatistics

Output

DNS Server 157.54.130.19 statistics:

DNS Statistics
--------------
        Server start time    4/22/98 4:08:19 PM
        Stats last cleared   4/22/98 4:08:19 PM
        Seconds since clear 363

Queries and Responses:
----------------------
Total:
        Queries Received = 2
        Responses Sent   = 2
UDP:
        Queries Recvd    = 2
        Responses Sent   = 2
        Queries Sent     = 6
        Responses Recvd  = 3
TCP:
        Client Connects  = 0
        Queries Recvd    = 0
        Responses Sent   = 0
        Queries Sent     = 0
        Responses Recvd  = 0

Recursion:
----------
        Packets    = 1
        Lookups    = 2
        Questions  = 1
        Passes     = 3
        Forwards   = 2
        Sends      = 2
        Responses  = 0
        Timeouts   = 2
        Failures   = 0
        Incomplete = 0
TCP Recursion:
        Try      = 0
        Query    = 0
        Response = 0
Root Query:
        Query    = 1
        Response = 0

WINS Referrals:
---------------
Forward:
        Lookups   = 0
        Responses = 0
Reverse:
        Lookups   = 0
        Responses = 0

Secondary Zone Transfer:
------------------------
SOA Queries     = 1
SOA Responses   = 1
Notifies Recvd  = 0
AXFR Requests   = 0
AXFR Rejected   = 0
AXFR Failed     = 0
AXFR Successful = 0

Master Zone Transfer:
---------------------
Notifies Sent           = 3
AXFR Requests Recvd     = 0
AXFR Invalid Requests   = 0
AXFR Denied (Security)  = 0
AXFR Refused            = 0
AXFR Failed             = 0
AXFR Successful         = 0

Database:
---------
Nodes
  InUse    = 48
  Memory   = 3721
Records
  InUse    = 44
  Memory   = 5446
Database Total
  Memory   = 9167

RR Caching:
        Total      = 0
        Current    = 0
        Timeouts   = 0

Domain Nodes:
        Alloc      = 66
        Free       = 0
        NetAllocs  = 66
        Memory     = 3721

        Used       = 48
        Returned   = 0
        InUse      = 48

        Std Alloc  = 64
        Std Used   = 46
        Std Return = 0
        InFreeList = 18

Records:
        Alloc      = 263
        Free       = 0
        NetAllocs  = 263
        Memory     = 5446

        Used       = 45
        Returned   = 1
        InUse      = 44

        Std Alloc  = 254
        Std Used   = 36
        Std Return = 1
        InFreeList = 219

Packet Memory Usage:
--------------------
UDP Messages:
        Alloc      = 5
        Free       = 0
        NetAllocs  = 5
        Memory     = 6255
        Used       = 11
        Returned   = 9
        InUse      = 2
        InFreeList = 3

TCP Messages:
        Alloc      = 0
        Realloc    = 0
        Free       = 0
        NetAllocs  = 0
        Memory     = 0

Recursion Messages:
        Used       = 1
        Returned   = 1

Nbstat Memory Usage:
--------------------
Nbstat Buffers:
        Alloc      = 0
        Free       = 0
        NetAllocs  = 0
        Memory     = 0
        Used       = 0
        Returned   = 0
        InUse      = 0
        InFreeList = 0

Command successfully completed.

One Step clearstatistics

dnscmd 157.54.130.19 clearstatistics

Output

DNS Server 157.54.130.19 statistics cleared:
Command successfully completed.

One Step enumzoneinfo

dnscmd 157.54.130.19 enumzoneinfo

Output

Zone Info List:
Zone Count = 1

[0]Zone info:
        ptr          = 0014CD08
        hZone        = 0014BDE0
        zone name    = .
        zone type    = 0
        using dbase  = 0
        data file    = cache.dns
        using WINS   = 0
        using Nbstat = 0
        Zones Masters
        NULL IP Array
        Zone Secondaries
        NULL IP Array
        secure secs  = 0
Command successfully completed.

One Step createzone

dnscmd 157.54.130.19 createzone test.org 2 1.1.1.1 test.org.dns

Output

DNS Server 157.54.130.19 created zone test.org:

zone handle = 0015B040

Command successfully completed.

One Step deletezone

dnscmd 157.54.130.19 deletezone 0015B040

Output

DNS Server 157.54.130.19 deleted zone at 0015B040:

Status = 0 0x00000000

Command successfully completed.

One Step pausezone

dnscmd 157.54.130.19 pausezone 0014C280

Output

DNS Server 157.54.130.19 paused zone at 0014C280:

Status = 0 0x00000000

Command successfully completed.

One Step resetzonemaster

nscmd 157.54.130.19 resetzonemaster 0014BF48 2.2.2.2 3.3.3.3

Output

DNS Server 157.54.130.19 reset zone masters.

zone handle = 0014BF48

Command successfully completed.

One Step enumnoderecords

dnscmd 157.54.130.19 enumnoderecords bigdog.bigdog.com.

Output

Returned records: Record buffer of length 92 at 00141B98:

RPC Node:

ptr = 00141B98

wLength = 20

wRecordCount = 3

dwChildCount = 0

dwFlags = 80000000

Node Name = (7) bigdog

A Record info:

ptr = 00141BAC

hRecord = 0014C64C

wLength = 24

wDataLength = 4

wType = A (1)

wClass = 1

dwFlags = 0

dwTtlSeconds = 3600

A 1.1.1.2

A Record info:

ptr = 00141BC4

hRecord = 0014C660

wLength = 24

wDataLength = 4

wType = A (1)

wClass = 1

dwFlags = 0

dwTtlSeconds = 3600

A 1.1.1.1

A Record info:

ptr = 00141BDC

hRecord = 0014C8A4

wLength = 24

wDataLength = 4

wType = A (1)

wClass = 1

dwFlags = 0

dwTtlSeconds = 3600

A 4.4.4.4

Command successfully completed.

One Step enumchildnodesandrecords

dnscmd 157.54.130.19 enumchildnodesandrecords bigdog.com

Output

Returned records: Record buffer of length 204 at 00141B98:

RPC Node:

ptr = 00141B98

wLength = 20

wRecordCount = 3

dwChildCount = 0

dwFlags = 80000000

Node Name = (7) bigdog

A Record info:

ptr = 00141BAC

hRecord = 0014C64C

wLength = 24

wDataLength = 4

wType = A (1)

wClass = 1

dwFlags = 0

dwTtlSeconds = 3600

A 1.1.1.2

A Record info:

ptr = 00141BC4

hRecord = 0014C660

wLength = 24

wDataLength = 4

wType = A (1)

wClass = 1

dwFlags = 0

dwTtlSeconds = 3600

A 1.1.1.1

A Record info:

ptr = 00141BDC

hRecord = 0014C8A4

wLength = 24

wDataLength = 4

wType = A (1)

wClass = 1

dwFlags = 0

dwTtlSeconds = 3600

A 4.4.4.4

RPC Node:

ptr = 00141BF4

wLength = 20

wRecordCount = 1

dwChildCount = 1

dwFlags = 81000000

Node Name = (5) test

NS Record info:

ptr = 00141C08

hRecord = 0014C674

wLength = 40

wDataLength = 20

wType = NS (2)

wClass = 1

dwFlags = 40000000

dwTtlSeconds = 3600

NS (19) bigdog.bigdog.com.

RPC Node:

ptr = 00141C30

wLength = 20

wRecordCount = 1

dwChildCount = 0

dwFlags = 80000000

Node Name = (4) www

CNAME Record info:

ptr = 00141C44

hRecord = 0014C688

wLength = 29

wDataLength = 9

wType = CNAME (5)

wClass = 1

dwFlags = 0

dwTtlSeconds = 3600

CNAME (8) bigdog.

Command successfully completed.


Netafx.exe

Netafx.exe: Network Configuration Tool NEW

command prompt Open command prompt now.

For help, at the command prompt, type netafx /?

This tool can be used to configure a variety of network parameters from the command prompt. This makes NetAfx useful for automating post-setup network configuration in unattended mode when deploying Windows 2000 on multiple computers.

NetAfx can also facilitate unattended resetting of network parameters on individual computers when recovering from user errors or hardware failures.

Related Tools

Files Required

  • Netafx.exe


Netdom.exe: Windows 2000 Domain Manager

This tool enables administrators to manage Windows 2000 domains and trust relationships from the command line.

Use NetDom to:

  • Join a Windows 2000 computer to an NT 4.O or Windows 2000 domain, and:
      - Provide an option to specify the OU for the computer account. - Generate a random machine password for initial join.
  • Manage computer accounts for domain member workstations and member servers:
      - Add, Remove, Query. - Provide an option to specify the OU for the computer account. - Provide an option to move an existing computer account for a member workstation from one domain to another and maintain the security descriptor on the computer account.
  • Establish (one or two-way) trust relationships between domains, including trust for the following domain types:
      - Downlevel NT 4.0 domains. - Windows 2000 parent/child domains in a domain tree. - The Windows 2000 portion of a trust link to an MIT Kerberos realm.
  • Verify and\or reset the secure channel for the following configurations:
      - Member Workstations and Servers - BDCs in an NT 4.0 Domain - Specific Windows 2000 replicas
  • Manage trust relationships between domains
      - View all trust relationships - Enumerate direct trust relationships - Enumerate all (direct and indirect) trust relationships

Netdom Topics

  • NetDom Syntax
  • NetDom Examples

Related Tools

File Required

  • Netdom.exe


Nltest.exe

Platform: NlTest runs only on x86-based computers.

This command-line tool helps perform network administrative tasks such as:

  • getting a list of primary domain controllers (PDCs)
  • forcing a shutdown
  • querying and checking on the status of trust
  • testing trust relationships and the state of domain controller (DC) replication in a Windows domain
  • forcing a user-account database into sync on Windows NT 4.0 or 3.x DCs (Windows 2000 DCs use a completely different mechanism for maintaining user accounts)

When the word "trust" is used in the context of Windows, it describes a relationship between two Windows domains. Each domain involved has either the role of being the trusting domain, or the trusted domain. For any given trust relationship, there is a single discreet communication channel between each domain controller in the trusting domain, and a domain controller in the trusted domain.

For example if domain "A" trusts domain "B", then "B" is the trusted domain, and "A" is the trusting domain. In a another example suppose domain "I" trusts domain "J", and domain "J" trusts domain "I". In this example there are two distinct trust relationships between their domain controllers. Often this is called the "Complete Trust" mode, or a 2-way trust. Yet for Secure Channel diagnosis, it is best to think of these as two separate secure channels, between each domain controller in the trusting domain, and a domain controller in the trusted domain.

Trust relationships are not transitive. For example, suppose domain "X" trusts domain "Y" which in turn trusts domain "Z". This does not imply domain "X" trusts domain "Z". The reason for this is the administrator in each domain must grant explicit permission on either side of the trust relationship for it to take place.

Another form of trust relationship is sometimes referred to as an "implicit" trust. In a single domain model or in an environment where there are no "explicit" trust relationships between any two domains, the "implicit" trust relationship is active and functionally needed. This implicit trust exists between all Windows computers that are members of a domain and a domain controller in their domain. Explicit trust relationships are established through User Manager For Domains. Implicit trust relationships are established by becoming a member of a domain.

NlTest can be used to test the trust relationship between a Windows machine that is a member of a domain and a domain controller where its machine account resides. NlTest can also verify the trust between the BDCs in a domain and their PDC. In domains where an explicit trust has been defined, NlTest can test the trust relationship between all domain controllers in the trusting domain and a domain controller in the trusted domain.

These sessions of communication are called Secure Channels and are used to authenticate Windows machine accounts. They also are used to authenticate User Accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called Pass-Through Authentication, and it allows a Windows machine that has joined a domain to have access to the User Account Database in its domain and in any trusted domains.

For Windows 2000, NlTest no longer uses the Browser Service to enumerate domain controllers. Rather, the /dclist otpion calls the DsGetDomainControllerInfo API to get the list from the Directory Services.

All of these trust relationships, and domain synchronization can be monitored, tested, and verified by NlTest.

NlTest Topics

  • NlTest Syntax
  • NlTest Examples for Windows NT 4.0
  • NlTest Examples for Windows 2000

File Required

  • Nltest.exe
o


Shutdown.exe: Remote Shutdown

Platform: Remote Shutdown runs only on x86-based computers.

Remote Shutdown is a command-line tool that allows you to remotely shut down or reboot a computer running Windows 2000.

Note To schedule Remote Shutdown for a specific time, use the AT command (see Windows 2000 Help for a full description) or Winat.exe: Command Scheduler, a tool in the Microsoft® Windows® 2000 Resource Kit.

Remote Shutdown Topic

  • Remote Shutdown Syntax

Related Tools

File Required

  • Shutdown.exe


Remote Shutdown Syntax

Command prompt Open command prompt now.

shutdown [\\computername] [/l] [/a] [/r] [/t:xx] ["msg"] [/y] [/c] [/?]

Where:

\\computername
specifies a remote computer to shut down. Note that if no name is given but the tool is started with any of the other options, the local computername will be used.
/l
specifies a local shutdown.
/a
quits a system shutdown. This is only possible during the timeout period. If this switch is used, all others are ignored.
/r
specifies that the computer should reboot after shutdown.
/t:xx
sets the timer for system shutdown in xx seconds. The default is 20 seconds.
"msg"
specifies an additional message of a maximum of 127 characters, surrounded by quotation marks.
/y
answers all following questions with yes.
/c
forces running applications to close.

Caution If you use the /c parameter, Windows 2000 ignores the application's option to save data that might have changed. You will see no File Save dialog box, because Windows 2000 will force the application to close. This will result in a loss of all data not previously saved.

/? (or shutdown without parameters)
shows all command-line options.

Note To schedule Remote Shutdown for a specific time, use the AT command (see Windows 2000 Help for a full description) or Winat.exe: Command Scheduler, a tool in the Microsoft® Windows 2000® Resource Kit.


Trustdom.exe: Trust Domain Setup

Trustdom.exe: Trust Domain Setup NEW

This command-line tool can help manage trust relationships. Using TrustDom, administrators can view, create, and delete trust relationships between Windows 2000 and Windows NT domains.

How Administrators Can Use this Tool

Use TrustDom to manage the following:

  • Two-way trust relationships between Windows 2000 domains.

  • Explicit one-way trust relationships with Windows NT version 4.0 domains.

  • A trust relationship between a Windows 2000 domain and an MIT-based Kerberos realm on a UNIX system.

See the Windows NT® 5.0 Operating System MIT Kerberos 5 (krb5 1.0) Interoperability Beta 2 Walkthrough for more information. You will find this document on your Microsoft Windows 2000 Beta product CD-ROM or on the Microsoft Windows 2000 Beta Web site (http://ntbeta.microsoft.com/documentation/WalkThrough.asp)

TrustDom Topics

  • TrustDom Syntax

File Required

  • Trustdom.exe


Winscl.exe

Winscl.exe: WINS Administration Tool

WinsCl is a command prompt administrative tool for managing Windows Internet Name Service (WINS).

WinsCl can monitor WINS activities and examine WINS databases. It can also send commands to WINS to initiate an activity such as replication, scavenging, registering/querying a record, or doing backup/restore operations. And it includes a command that does consistency checking on the WINS database.

Unlike WINS Manager, however, WinsCl cannot configure a WINS.

Note

  • Using WinsCl is potentially a high-overhead operation and a network-bandwidth hog, as it results in full replication of the entire database. It is best done when network activity is low.
  • If you attempt to delete a non-existent or incorrect name (for example, with lowercase letters that should be uppercase), WinsCl returns a status of SUCCESS even though the database was not modified since the parameter was incorrect. This could be misleading, as it might appear that the database has been correctly updated when in fact it was not.

For help in troubleshooting possible causes of database inconsistencies, use WinsChk, a Microsoft® Windows® 2000 Resource Kit tool, in conjunction with WinsCl.

WinsCl Topics

  • WinsCl Options
  • WinsCl Notes

Related Tools

Files Required

  • Winscl.exe


Pmon.exe: Process Resource Monitor

PMon is a command-line tool that monitors [image] process resource usage, tracking CPU and memory usage.

Pmon.exe can be used to measure Paged and Nonpaged pool usage and can be helpful in identifying kernel mode memory leaks.

PMon also provides a keyboard interface. Use the up and down arrow keys to scroll up and down the list of currently running processes. Use ESC or q to exit PMon. Use any other key to have PMon refresh its display immediately.

To Run Process Resource Monitor

Command prompt Open command prompt now.

At the command prompt, type:

pmon

To Quit Process Resource Monitor

Press CTRL+C orclick Close on the window menu of the command-prompt window.

Process Resource Monitor Topics

  • Process Resource Monitor Output Format
  • PMON Notes

File Required for Process Resource Monitor

  • Pmon.exe


PMon Notes

The Pmon.exe output screen updates every few seconds. An easy way to monitor Pmon.exe over time is to copy the screen to a notepad file. Do this once an hour or so while you are running your test. This will make it easier to compare values.

Monitor the Commit numbers on the second row. Constantly increasing numbers over several hours will indicate a probable leak. Total Paged and Nonpaged bytes are the last two items on the second row. Also monitor the Commit Charge column. The process with the leak should have an increasing Commit Charge.

Output

Memory: 130484K Avail: 73872K PageFlts: 25 InRam Kernel: 5524K P:11448K

Commit: 87144K/ 53116K Limit: 250300K Peak: 113904K Pool N: 4352K P:15844K

CPU | Cpu Time | Mem Usage | Mem Diff | Page Faults | Flts Diff | Commit Charge | Usage | NonP | Pri Page | Hnd Cnt | Thd Cnt | Image Name
 |  | 19800 | 0 | 23075420 |  |  |  |  |  |  |  | File Cache
97 | 279:00:57 | 16 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 2 | Idle Process
0 | 0:02:42 | 200 | 0 | 3445 | 0 | 36 | 0 | 0 | 8 | 520 | 38 | System
0 | 0:00:00 | 200 | 0 | 2257 | 0 | 164 | 1 | 0 | 11 | 30 | 6 | smss.exe
1 | 0:00:05 | 1092 | 0 | 9287 | 0 | 1964 | 5 | 36 | 13 | 383 | 10 | csrss.exe
0 | 0:00:02 | 1080 | 0 | 7397 | 0 | 2376 | 12 | 21 | 13 | 65 | 3 | WINLOGON.EXE
0 | 0:00:24 | 3396 | 0 | 48089 | 2 | 1412 | 267 | 16 | 9 | 296 | 20 | SERVICES.EXE
0 | 0:00:02 | 1812 | 0 | 6590 | 0 | 1056 | 28 | 10 | 9 | 111 | 13 | LSASS.EXE
0 | 0:00:00 | 268 | 0 | 2457 | 0 | 2076 | 692 | 14 | 8 | 105 | 9 | SPOOLSS.EXE


Process Resource Monitor Output Format

CPU CpuTime Mem
Usage 		Mem
Diff 		Page
Faults 		Flts
Diff 		Commit
Charge 		Usage
NonP 		Usage
Page 		Pri Hnd
Cnt 		Thd
Cnt 		Image
Name
CPU: CPU %

Identifies the percentage of total CPU usage associated with a particular [image] process.

CpuTime

Expressed as a percentage of the elapsed time that a processor is busy executing a non-Idle thread. It can be viewed as the fraction of the time spent doing useful work. Each processor is assigned an Idle thread in the Idle [image] process that consumes those unproductive processor cycles not used by any other threads.

MemUsage: Memory Usage

Identifies the total memory used.

Page Faults

Page faults/second is a count of the page faults in the processor. A page fault occurs when a [image] process refers to a virtual memory page that is not in its working set in main memory. A page fault will not cause the page to be fetched from disk if that page is on the standby list, and hence already in main memory, or if it is in use by another process with which the page is shared.

Commit Charge

Displays the size of virtual memory (in bytes) that has been Committed (as opposed to simply reserved). Committed memory must have backing (that is, disk) storage available, or must be assured never to need disk storage (because main memory is large enough to hold it).

Usage NonP: Non-paged usage

The size of the Nonpaged Pool, which is a system memory area where space is acquired by operating system components as they accomplish their appointed tasks. Nonpaged Pool pages cannot be paged out to the paging file, but instead remain in main memory as long as they are allocated.

Usage Page: Page Usage

The amount of the Page File instance in use.

Thd Cnt: Thread Count

Identifies the number of threads for the particular [image] process.

Image Name

Identifies the executable filename or [image] process associated with a particular item.


Pviewer.exe: Process Viewer

Run Process Viewer now.

Process Viewer is a Windows-based tool that displays information about a running [image] process and allows you to stop (kill) processes and change process priority.

Note Process Viewer is similar to Pview.exe, but also allows you to look at processes on remote machines.

Process Viewer Topics

  • Details of the Process Viewer Screen

Related Topics

File Required for Process Viewer

  • Pviewer.exe


Process Viewer Details

The Process Viewer dialog box contains the following elements:

Memory Detail
Click this button to see details about memory use for the selected process.
Kill Process
Click this button to stop the selected process.

Caution Do not attempt to kill processes required for running Windows 2000 or Windows NT. Make sure you understand which program owns a process before attempting to kill it.

Computer
Shows the name of the computer whose processes are currently displayed. Click the Connect button and complete the dialog box to view processes for a remote computer.
Process
The name of the process followed by the process ID number (in hexadecimal format) in parentheses.
Processor Time
Processor Time is expressed as a percentage of the elapsed time that a processor is busy executing a non-Idle thread. It can be viewed as the fraction of the time spent doing useful work. Each processor is assigned an Idle thread in the Idle process that consumes those unproductive processor cycles not used by any other threads.
Privileged Time
Privileged Time is the percentage of processor time spent in Privileged Mode in non-Idle threads. The Windows service layer, the Executive routines, and the Windows Kernel execute in Privileged Mode. Device drivers for most devices other than graphics adapters and printers also execute in Privileged Mode. Unlike some early operating systems, Windows 2000 and Windows NT use process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows 2000 or Windows NT on behalf of your application may appear in other subsystem processes in addition to the Privileged Time in your process.
User Time
User Time is the percentage of processor time spent in User Mode in non-Idle threads. All application code and subsystem code execute in User Mode. The graphics engine, graphics device drivers, printer device drivers, and the window manager also execute in User Mode. Code executing in User Mode cannot damage the integrity of the Windows Executive, Kernel, and device drivers. Unlike some early operating systems, Windows 2000 and Windows NT use process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows 2000 or Windows NT on behalf of your application might appear in other subsystem processes in addition to the Privileged Time in your process.
Process Memory Used
The current number of bytes in the Working Set of this process. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed, they will then be soft-faulted back into the Working Set before they leave main memory.
Process Priority
The current base priority of this process. Threads within a process can raise and lower their own base priority relative to the process's base priority.
Threads
Thread State is the current state of the thread. It is 0 for Initialized, 1 for Ready, 2 for Running, 3 for Standby, 4 for Terminated, 5 for Wait, 6 for Transition, 7 for Unknown. A Running thread is using a processor; a Standby thread is about to use one. A Ready thread wants to use a processor but is waiting for a processor because none are free. A thread in Transition is waiting for a resource in order to execute, such as waiting for its execution stack to be paged in from disk. A Waiting thread has no use for the processor because it is waiting for a peripheral operation to complete or a resource to become free.
Thread Priority
The current base priority of this thread. The system might raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it towards the base priority if the thread becomes compute bound.
Thread Information
Context Switches/sec is the rate of switches from one thread to another. Thread switches can occur either inside of a single process or across processes. A thread switch can be caused either by one thread asking another for information, or by a thread being preempted by another, higher-priority thread becoming ready to run.

Dynamic Priority is the current dynamic priority of this thread. The system can raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it towards the base priority if the thread becomes compute bound.


Remote.exe: Remote Command Line

The Remote tool allows you to run command-line programs on remote computers.

For example, when you are developing software, you can compile code with the processor and resources of a remote computer while you perform other tasks on your computer. You can also use Remote to distribute the processing requirements for a particular task across several computers.

To use Remote, first start the Server end (by running remote /s) on the computer where you want to run the selected program. Next, connect to the Server end from another computer (by running remote /c).

Remote does no security authorization, and will permit anyone with a remote client (remote /c) to connect to your remote server (remote /s). This leaves the account under which the remote server was run open to anyone who connects. By contrast, Rcmd.exe: Remote Command Service, a tool from the Microsoft® Windows® 2000 Resource Kit, authenticates all users with standard Windows 2000 user authentication procedures.

Note Remote cannot be used to control graphical Windows-based applications.

Remote Topics

  • To Start the Server End of Remote
  • To Start the Client End of Remote
  • To Exit Remote on the Server Computer
  • To Exit Remote on the Client Computer
  • Remote Server Example
  • Remote Client Example
  • Remote Limitations

File Required for Remote

  • Remote.exe


To Start the Server End of Remote

Command prompt Open command prompt now.

At the command prompt on the Server computer, type:

remote /s "cmd" uniqueID [/u [domainname\]username] [/f param] [/b param]

Where:

"cmd"
Specifies the text-mode executable name for the program that you want to control from another computer, enclosed in quotes with any optional parameters required.
uniqueID
For the /s switch, specifies a string to uniquely identify this session of Remote Server from other possible sessions on this computer.
/u [domainname\]username
Specifies a group or user that can connect. For example, remote /s cmd Rana /u administrators allows only members of the Administrators group to connect, and remote /s cmd Rana /u anniep allows only a user logged on as "anniep" to connect. If this is not specified, anyone can connect to the session.
/f param
Specifies a foreground color for the remote command prompt such as yellow or black.
/b param
Specifies a background color for the remote command prompt such as lblue or white, where "lblue" means light blue.


To Start the Client End of Remote

Command prompt Open command prompt now.

At the command prompt on the Client computer, type:

remote /c computername uniqueID [/f param] [/b param] [/l param]

Where:

computername
Specifies the name of the computer on which the remote Server is running.
uniqueID
For the /c switch, specifies the uniqueID of the remote Server running on computername
/f param
Specifies a foreground color for the remote command prompt such as yellow or black.
/b param
Specifies a background color for the remote command prompt such as lblue or white, where "lblue" means light blue.
/l param
Specifies the number of lines to get for the Client.


To Exit Remote on the Server Computer

  • At the command prompt, type @k.


To Exit Remote on the Client Computer

  • At the command prompt, type @q.

This stops Remote on the Client end, but leaves Remote running at the Server.


Remote Server Example

remote /s "i386kd -v" brillig /u administrators

This starts the [image] Kernel Debugger with the -v switch, with only members of the administrators group allowed to connect.

To interact with this "cmd" from another computer, start the Client end with this command, where "apears" is the Remote Server name:

remote /c apears brillig


Remote Client Example

remote /c rajx86 brillig

This statement connects to a server session on the server named rajx86 with the ID "brillig" if there is a remote /s "cmd" brillig started on the computer rajx86.


Remote Limitations

Only non–MS-DOS programs using [image] STDIN/ [image] STDOUT/ [image] STDERR for input/output will function redirected across the network. Programs that use the Win32 Console API will not work correctly. MS-DOS programs will not work. Generally, any programs that use on-screen character mode windows or cursor manipulation (such as screen-mode editors) will not work.


Wsremote.exe: Winsock Remote Console

Wsremote.exe: Winsock Remote Console NEW

Command prompt Open command prompt now.

WSRemote provides the ability to start a console application on the server and connect to it from the client using sockets or named pipes. This is an enhancement over Remote.exe: Remote Command Line, which allows only named-pipes connections.

Features of WSRemote:

  • Enables you to choose the name of the named pipe or the TCP/IP port on which you would like to start the WSRemote server.
  • Protects your WSRemote server by requiring a username and password before accepting a connection from a sockets client.
  • Temporarily prevents any sockets connections to the WSRemote server by locking the server from the server's console.
  • Enables you to remotely bind a WSRemote server’s port to a proxy server running Microsoft Proxy Server 2.0

Caution Running a WSRemote server on the Internet creates a TCP/IP socket server that might be accessible to any Internet user. It is recommended that you choose a random TCP/IP port and use a username and password for any WSRemote session that runs on the Internet. If clients other than WSRemote clients try to connect to a WSRemote session, you will see the following on your console screen.

CONNECT on socket: 216
FROM ip: 10.20.20.20
Auth:Bad Username or Password

If you see this on a WSRemote console that was left unattended, it is strongly recommended that you determine the origin of this request.

Wsremote.exe Topics

  • WSRemote System Requirements
  • Starting the WSRemote Server
  • Connecting the Client to the WSRemote Server (TCP/IP)
  • Connecting the Client to the WSRemote Server (Named Pipes)
  • Stopping the WSRemote Server (TCP/IP)
  • Unlocking the Server Console
  • Disconnecting the WSRemote Client (Server Running)
  • WSRemote Server Syntax
  • WSRemote Server Syntax

Files Required

  • Wsremote.exe

For More Information

More information on the Server Proxy feature of Microsoft Proxy Server 2.0 can be found in the Proxy Server 2.0 Release Notes found with the Microsoft Proxy Server 2.0 Documentation, or from the Support Online Knowledge base at:

Internet http://support.microsoft.com/support/kb/articles/q174/9/22.asp


WSRemote System Requirements

System Requirements for WSRemote

To use WSRemote, you must have the following components installed:

  • Windows 2000 Server or Windows 2000 Professional

  • The TCP/IP protocol


Starting the WSRemote Server

Command prompt Open command prompt now.

To start a WSRemote server that runs a command prompt and listens on port 8080 with no username or password

  1. Open a command prompt.
  2. Change directory to the directory which contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /s cmd 8080

To start a WSRemote server that runs a command prompt and listens on port 8080 with username and password security

  1. Open a command prompt.
  2. Change directory to the directory which contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /s cmd 8080 /u username /p password

To start a WSRemote server that runs a command prompt and listens on port 8080 with username, password and will not accept any initial incoming connections

  1. Open a command prompt.
  2. Change directory to the directory which contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /s cmd 8080 /u username /p password /i

Now no WSRemote clients can connect without someone on the server unlocking the WSRemote session from the server console. See Unlocking the Server console.


Connecting the Client to the WSRemote Server (TCP/IP)

Connecting the Client to the WSRemote Server using TCP/IP Sockets

Command prompt Open command prompt now.

To connect a WSRemote client to a WSRemote server over TCP/IP using port 8080 with no username and password

  1. Open a command prompt.
  2. Change directory to the directory which contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /c dns_name_or_ip_address_of_server 8080

To connect a WSRemote client to a WSRemote server over TCP/IP using port 8080 with username and password security

  1. Open a command prompt.
  2. Change directory to the directory which contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /c dns_name_or_ip_address 8080 /u username /p password


Connecting the Client to the WSRemote Server (Named Pipes)

Connecting the Client to the WSRemote Server using Named Pipes

Command prompt Open command prompt now.

To connect a WSRemote client to a WSRemote server over named pipes using pipe 8080

  1. Open a command prompt.
  2. Change directory to the directory which contains the file Wsremote.exe.
  3. Enter the following command: (Note the "/n" for named pipes)

    wsremote /s cmd 8080 /n


Stopping the WSRemote Server

Command prompt Open command prompt now.

To stop the WSRemote server from the server’s console

One Step Type @k in the WSRemote server console.


Unlocking the Server Console

Command prompt Open command prompt now.

To allow/disallow WSRemote to accept incoming IP sockets connection to the WSRemote server

One Step Type @l in the WSRemote server console.

If IP sessions are previously blocked, WSRemote displays the following message:

**LOCK: IP Sessions Now Allowed

If IP sessions are previously un-blocked WSRemote displays the following:

**LOCK: No IP Sessions Allowed


Disconnecting the WSRemote Client (Server Running)

Disconnecting the WSRemote Client from the WSRemote Server (Leaving the Server Running)

Command prompt Open command prompt now.

To disconnect from the WSRemote server while leaving the server running

One Step Type @q in the WSRemote client console.


WSRemote Server Syntax

command prompt Open command prompt now.

One Step wsremote /s Program UniqueId _or_PortNumber [/f Color] [/b Color] [/i] [/u Username] [/p Password]

Where:

/s
starts this WSRemote session as a server.
Program
is the console based program you want to run.
UniqueId_or_PortNumber
is the TCP port number where you will start the remote server.
/f Color
is the foreground console color (for example, yellow or black).
/b Color
is the background console color (for example, blue or white).
/i
turns on IP Blocking. No clients can connect via IP sockets until the console is unlocked.
/u Username
specifies the username needed to connect to the WSRemote server from a WSRemote client (over IP Sockets).
/p Password
specifies the password needed to connect to the WSRemote server from a WSRemote client (over IP Sockets).


WSRemote Client Syntax

command prompt Open command prompt now.

One Step wsremote /c ServerName UniqueId [/l #_Lines_to_get][/f Color] [/b Color] [/i] [/u Username] [/P Password]

Where:

/c
starts this WSRemote session as a server.
ServerName
is the IP address, DNS name, or NetBIOS name of the server you are connecting to.
UniqueId
is the port number that was specified when starting the WSRemote server.
/l #_Lines_to_Get
retrieves only the specified number of lines from the WSRemote.
/f color
is the foreground console color (for example, yellow or black).
/b color
is the background console color (for example, blue or white).
/n
connects to a WSRemote or Remote.exe server using Named Pipes instead of IP Sockets.
/u Username
specifies the username needed to connect to the WSRemote server from a WSRemote client (over IP Sockets).
/p Password
specifies the password needed to connect to the WSRemote server from a WSRemote client (over IP Sockets).


Ksetup.exe: Kerberos Setup

Ksetup.exe: Kerberos Setup NEW

KSetup is a command-line tool for configuring Windows 2000 Professional to use an MIT-based Kerberos realm instead of a Windows 2000 domain. KSetup initializes registry keys that the Kerberos Security Provider uses to locate an MIT Kerberos KDC if the Windows 2000 computer is not a member of a Windows domain. After configuration, the Windows 2000 user can log on to accounts in the Kerberos realm.

This functionality takes advantage of the Kerberos V5 interoperability features of Windows 2000. See the MIT Kerberos 5 (krb5 1.0) Interoperability walkthrough for more information. You will find this document on your Windows 2000 Beta product CD-ROM or on the Windows 2000 Beta Web site (http://ntbeta.microsoft.com/documentation/WalkThrough.asp)

Uses of KSetup

Administrators can use KSetup to:

  • Configure KDCs for a Kerberos realm.
  • Make a Windows 2000 Professional computer a member of a UNIX Kerberos realm.
  • Map local Windows 2000 Professional user accounts to principals in the Kerberos realm.

Note Windows 2000 Professional computers configured to use the Kerberos KDC are not members of a Windows NT domain.

KSetup Topic

  • KSetup Syntax

Related Topics

Files Required

  • Ksetup.exe


KSetup Syntax

command prompt Open command prompt now.

One Step ksetup /SetDomain DnsDomainName /MapUser KerbName LocalName /AddKdc Realmname Kdcname /SetMachPassword Password [/Server servername] [/?] [/Help ][/ptype type] [/keyno keynum] [/?]

Where:

/SetDomain DnsDomainName
sets the name of an MIT Kerberos realm.

/MapUser KerbName LocalName
maps the name of a principal onto a local account.

/AddKdc Realmname Kdcname
adds an additional KDC address for a realm.

/SetMachPassword Password
sets the machine password.

/Server servername
specifies the name of a Windows 2000 computer to target the changes.

/? or /Help
displays the usage screen.


Dskprobe.exe: DiskProbe

DiskProbe Run DiskProbe now.

Windows Help Open DiskProbe Help now.

DiskProbe is a sector editor for Windows 2000. It allows a user with local Administrator rights to directly edit, save and copy data on the physical hard drive that is not accessible in any other way.

You can use DiskProbe to replace the Master Boot Record, repair damaged partition table information and to repair or replace damaged Partition Boot Sectors or other file system data. The tool can also save Master Boot Records and Partition Boot Sectors as files. They can then be replaced if the sectors become damaged at a later time. These on-disk data structures are not accessible through the file system, and so are not saved by any backup programs currently available.

Restrictions

  • Only users with local Administrator rights can use DiskProbe to access the physical disk. Other users can run DiskProbe, but in the Open Physical Drive dialog box, no physical drives will be listed.

  • DiskProbe runs under Windows 95, but no physical drives are available. Windows 95 still uses BIOS Interrupt 13 calls for disk access, and does not support the Kernel mode calls necessary to access large physical drives. But under Windows 95 you can still open, edit, and save files as raw hex data.

Command Prompt Usage

command prompt Open command prompt now.

Although it is a GUI tool, DiskProbe can also be run from the command prompt. Only the path and filename are supported as arguments, for example:

dskprobe c:\mydir\sector00.dsk

This example runs DiskProbe and opens Sector00.dsk in the C:\MYDIR folder.

After the program has been run, double-clicking a file with the .dsk extension will start DiskProbe and load the file.

Caution
Because any sector editor allows direct access to a physical drive, it is possible to damage or permanently overwrite critical on-disk data structures. Backup all critical data before using any low-level tool such as DiskProbe. Misuse of low-level tools such as DiskProbe may make all data on a drive or volume permanently inaccessible.

Related Tools

Files Required

  • Dskprobe.exe
  • Dskprobe.hlp
  • Mfc40.dll
  • Msvcrt40.dll

    • Note These DLLs may be used by other Resource Kit tools.

    DiskProbe uses no configuration files. The only change it makes to the registry is to register the shell type and default file extension (.dsk).


List.exe

List.exe: Text Display and Search Tool NEW

This simple text display and search tool lists the contents of a file. Unlike other text display tools, List is a good tool for looking at large text or log files because it does not read the whole file into memory when you open it.

List is useful for displaying text or log files remotely and for use on servers where administrators are concerned with degradation of system performance.

List Topics

  • List Syntax
  • List Keyboard Command Reference

Files Required

  • List.exe


List Syntax

command prompt Open command prompt now.

One Step list [-s:string] [-g:line#] filename[, filename, ...]

Where:

-s:string
is the string to search for after opening the file.

-g:line#
is the line to jump to after opening the file.

filename[, filename, ...]
is the name of the file(s) to open and display.

For help on List commands and switches, press F1.


List Keyboard Command Reference

Keyboard Command | Description
Up, Down, Left, Right | Move one line or character in this direction
PgUp | Up one page
PgDn | Down one page
Home | Top of listing
End | End of listing
W | Toggle word wrap
Ctrl + L | Refresh display
Q, ESC | Quit
/ | Search for string
\ | Search for string, any case
F4 | Toggle multifile search
n, F3 | Next occurance of string - "n" must be lower-case
N | Previous occurance of string - "N" must be upper-case
C | Clear highlight line
J line | Jump to highlighted
M | Mark highlighted
Ctrl + Up | Pull copy buffer up
Ctrl + Down | Pull copy buffer down
Ctrl + Home | Slide copy buffer up
Ctrl + End | Slide copy buffer down
G | Goto line number
Ctrl + PgUp | Previous file
Ctrl + PgDn | Next file
F | New file
H | Switch to Hex edit and display mode (ESC to exit)

The Hex mode of List supports additional features such as the ability to edit, load (import), and save (export) files. The chart below describes these features.

Keyboard Command | Description
F1 | Toggle
F2 | Goto
F3 | Search
F4 | Export
F5 | Import
F10 | Undo


Windiff.exe: File and Directory Comparison

executable file Run WinDiff now.

Windows Help Open WinDiff Help now.

WinDiff shows the differences between specified ASCII text files or folders of ASCII text files. This is particularly useful for program source code.

The display either shows a summary of the comparison status of a list of files (outline mode) or a detailed line-by-line comparison of one of the files (expanded mode).

You can run WinDiff like any other Windows-based application, using menu commands to choose files to compare and perform other actions. Or you can run WinDiff from the command prompt with switches.

WinDiff Topics

  • WinDiff Syntax
  • Comparing Files with WinDiff
  • Running WinDiff with Menu Choices
  • File Menu
  • Edit Menu
  • Expand Menu
  • View Menu
  • Options Menu
  • Outline Mode Display
  • Expanded Mode Display

Files Required

  • Windiff.exe
  • Windiff.hlp
  • Gutils.dll


Running WinDiff with Menu Choices

Run WinDiff now.

To compare two files with WinDiff

  • On the File menu, click Compare Files.

  • In the Select First File dialog box, specify a filename for the first file in the comparison. Then select the other file to compare in the Select Second File dialog box.

To compare folders with WinDiff

  • On the File menu, click Compare Directories.

  • In the Select Directories dialog box, specify two folder names and, if you want, check the Include Subdirectories check box.


WinDiff Outline Mode Display

Outline Mode Display

In outline mode, the display shows one file per line with the files listed in alphabetical order—except files contained in sub-folders appear after all files in higher folders. The paths shown are all relative to the root path given when the comparison is invoked.

For example:

windiff c:\temp d:\progs\new

returns the following type of results:

.\myfile.txt         identical
.\hisfile.txt        files differ
.\newest\myfile.txt  only in C:\TEMP
.\newest\x.x         only in D:\PROGS\NEW
.\oldest\file        identical

the full paths for this example are:

.\myfile.txt         c:\temp\myfile.txt and d:\progs\new\myfile.txt
.\hisfile.txt        c:\temp\hisfile.txt and d:\progs\new\hisfile.txt
.\newest\myfile.txt  c:\temp\newest\myfile.txt
.\newest\x.x         d:\progs\new\newest\x.x
.\oldest\file        c:\temp\oldest\file and d:\progs\new\oldest\file

Status Indicators

The status of a file can be one of the following:

  • Identical
    The files are identical, including white space.
  • Files Differ or Different Sizes
    The two files differ, but possibly only in white space.
  • Only In path
  • The file exists only in one folder or the other, specified by path.
  • Files Differ? (Left Unreadable)
    The file in the left path existed, but could not be read. There are many possible reasons. Some of the common ones are Network Error and Access Denied.
  • Files Differ? (Right Unreadable)
    The file in the right path existed, but could not be read. The file in the left path was successfully read.

  • Unreadable files are treated differently (highlighted in red, etc.).

Viewing Files Based on Status

Using the Options menu, you can display or suppress files based on their status category. The categories are:
  • Identical
  • Differ (including unreadable)
  • Left only
  • Right only

Note A common source of confusion is a blank display caused when only files in categories turned off from the Options menu are found. For example, all the files are identical but files in the "Identical" category are not being displayed.


Rsdiag.exe: Remote Storage Diagnostic Utility

Rsdiag.exe: Remote Storage Diagnostic Utility NEW

This command-line tool examines Remote Storage (HSM) databases and displays diagnostic information about jobs, managed NTFS 5 volumes, removable media, and other Remote Storage information useful for system analysis. RSDiag can output each of the Remote Storage databases and property files in text format.

RSDiag works with RSDir, the other Remote Storage tool, to help diagnose problems in the Remote Storage databases and, if necessary, recover lost data.

RSDiag Syntax

Command prompt Open command prompt now.

One Step rsdiag [job [jobname]] [cancel jobname] [volume [volumename] [/manageables]] [version] [reloadtrace] [media] [decode errorcode] [dump {-e|-f|-a|-n|-s} dumpfile]

Where:

job [jobname]
displays job information for the specified job.
If no job is specified, the job option displays information on all jobs.
cancel jobname
cancels the specified job.
volume [volumename] [/manageables]
without arguments, displays volume information.
With volumename, it displays extended information for the specified volume.
With /manageables, it shows volumes which are eligible for management.
version
displays version information for the files.
reloadtrace
reloads the trace file information.
media
displays information on the physical storage media.
decode errorcode
shows error information for this particular errorcode.
For hex error codes, prepend 0x.
dump {-e|-f|-a|-n|-s} dumpfile
sends the diagnostic information to a text file;
dumpfile must include the full path and name of the file to dump to.
The switches specify which kind of source file to output in text format:
-e Engine database file
-f File System Agent database file
-a File System Agent property file
-n Engine property file
-s Sub System property file

Related Topics

File Required

  • Rsdiag.exe
  • Rstools.dll


Rsdir.exe: Remote Storage File Information Utility

Rsdir.exe: Remote Storage File Information Utility NEW

This command-line tool examines Remote Storage reparse points, displaying Remote Storage information for files in the current directory and its subdirectories.

RSDir works with RSDiag, the other Remote Storage tool, to help diagnose problems in the Remote Storage databases and, if necessary, recover lost data.

RSDir Syntax

Command prompt Open command prompt now.

One Step rsdir [/full] [/s]

Where:

/full
displays extended file information
/s
displays file information for the current directory and subdirectories

Related Topics

Files Required

  • Rsdir.exe
  • Rstools.dll


Installing APIMon

API Monitor runs on Windows 2000 and Windows NT 4.0 Server or Workstation (X86 or Alpha processor)

This tool is not installed by the Windows 2000 Resource Kit Setup. To install it, use the following procedure:

To install APIMon

  1. Open the \APIMon folder for the processor platform you are using (\Alpha or \X86).
  2. Copy Apimon.exe, Apidll.dll and Apimon.hlp files to %SystemRoot% (for example, c:\winnt) or another directory on the path.


Windows 2000 Resource Kit Support Tools: Alphabetical list of Tools

- A -

Active Directory Replication Monitor (Replmon.exe) NEW

Active Directory Schema Manager (Schmmgmt.msc) NEW

HTML Help ADSI Administration Scripts (Remote Administration Scripts) NEW

ADSI Edit NEW

Apimon.exe: API Monitor

- B -

Browstat.exe: Browser Status

- C -

No entries

- D -

Debugger Tools (Win32) NEW

Depends.exe: Dependency Walker

Dhcpcmd.exe: DHCP Administrator's Tool

Dhcploc.exe: DHCP Server Locator Utility

DiskProbe (Dskprobe.exe)

Dnscmd.exe: DNS Server Troubleshooting Tool

Dsacls.exe NEW

Dsastat.exe: Active Directory Diagnostic Tool NEW

Dskprobe.exe: DiskProbe

Dumpel.exe: Dump Event Log

Dxdiag.exe: DirectX Diagnostic Tool NEW

- E -

Event Logging Utility (Logevent.exe)

- F -

File and Directory Comparison (Windiff.exe)

- G -

Gflags.exe: Global Flags Editor

- H -

No entries

- I -

No entries

- J -

- K -

Kerberos Keytab Setup (Ktpass.exe) NEW

Kerberos Setup (Ksetup.exe) NEW

Kill.exe: Task Killing Utility

Ksetup.exe: Kerberos Setup NEW

Ktpass.exe: Kerberos Keytab Setup NEW

- L -

Ldp.exe: Active Directory Administration Tool NEW

List.exe: Text Display and Search Tool NEW

Logevent.exe: Event Logging Utility

- M -

Memsnap.exe: Memory Profiling Tool NEW

Movetree.exe: Active Directory Object Manager NEW

- N -

Netafx.exe: Network Configuration Tool NEW

Netdiag.exe: Network Connectivity Tester NEW

Netdom.exe: Windows 2000 Domain Manager

Nltest.exe

Ntdsutil.exe: Directory Services Management Tool NEW

Ntevntlg.mdb: Event Log Database

Ntmsgs.chm: Messages

- O -

No entries

- P -

Pmon.exe: Process Resource Monitor

PPTP Ping: Point-to-Point Tunneling Protocol Ping Utilities NEW

Process Resource Monitor (Pmon.exe)

Process Viewer (Pviewer.exe)

Pviewer.exe: Process Viewer

- Q -

No entries

- R -

Reg.exe: Registry Editor

Remote Administration Scripts NEW

Remote Command Line (Remote.exe)

Remote.exe: Remote Command Line

Remote Shutdown (Shutdown.exe)

Repadmin.exe: Replication Diagnostics Tool NEW

Replmon.exe: Active Directory Replication Monitor NEW

RPC Ping: RPC Connectivity Verification Tool NEW

Rsdiag.exe: Remote Storage Diagnostic Utility NEW

Rsdir.exe: Remote Storage File Information Utility NEW

- S -

Sc.exe: Service Controller Query Tool

Setupmgr.exe: Setup Manager

Shutdown.exe: Remote Shutdown

SIDWalker: Security Administration Tools NEW

Snmputilg.exe: SNMP Troubleshooting Tool NEW

SysPrep.exe: Setup Preparation Utility NEW

- T -

Task Killing Utility (Kill.exe)

Task List Viewer (Tlist.exe)

Tlist.exe: Task List Viewer

Trustdom.exe: Trust Domain Setup NEW

- U -

Unattend.doc: Unattended Setup Parameters Guide NEW

- V -

No entries

- W -

Windiff.exe: File and Directory Comparison

Event Log Database (Ntevntlg.mdb)

Messages (Ntmsgs.chm)

Win32 Debugger Tools NEW

Winscl.exe: WINS Administration Tool

Wsremote.exe: Winsock Remote Console NEW

- X -

No entries

- Y -

No entries

- Z -

No entries


Windows 2000 Resource Kit: Alphabetical List of Tools

Windows 2000 Resource Kit Support Tools
Alphabetical List of Tools

A B C D E F G H I J K L M
N O P Q R S T U V W X Y Z
Some tools are listed twice: once by their filename, once by their full name (in italics).


Dhcpcmd AddExcludeRange

Adds a range of exclusion addresses to the scope.

Syntax:

One Step dhcpcmd ServerIpAddress addexcluderange scope_address start_excl end_excl

Example:

dhcpcmd 127.0.0.1 addexcluderange 10.0.0.0 10.0.0.1 10.0.0.10

Excludes IP addresses between 10.0.0.1 and 10.0.0.10.


Dhcpcmd AddIpRange

Adds another IP range to an already existing scope.

Syntax:

One Step dhcpcmd ServerIpAddress addiprange ScopeAddress StartIpRange EndIpRange

Example:

dhcpcmd 127.0.0.1 addiprange 11.101.0.0 11.101.4.1 11.101.4.254


Dhcpcmd AddReservedIp

Adds a reserved IP to an already existing scope.

Usage:

One Step dhcpcmd ServerIpAddress addreservedip ScopeAddress ReserveIp HardwareString

Example:

dhcpcmd 127.0.0.1 addreservedip 11.101.0.0 11.101.13.53 08002B30369B


Dhcpcmd CreateOption

Creates a new option definition.

Syntax:

One Step dhcpcmd ServerIpAddress createoption option_id option_name default_value_type default_value

Example:

dhcpcmd 127.0.0.1 createoption 253 own_id own_class DWORD 0


Dhcpcmd CreateSubnet

Creates a new subnet. This command should be immediately followed by the AddIpRange command, without which the system can be inconsistent and the server may not behave as expected.

Syntax:

One Step dhcpcmd server_IP_address createsubnet scope_address scope_mask scope_name

Example:

dhcpcmd 127.0.0.1 createsubnet 10.0.0.0 255.0.0.0 !0NetSubnet

Creates the subnet 10.0.0.0.


Dhcpcmd DeleteOption

Deletes an existing option.

Syntax:

One Step dhcpcmd ServerIpAddress deleteoption option_id

Example:

dhcpcmd 127.0.0.1 deleteoption 253


Dhcpcmd DeleteSubnet

Deletes an existing subnet.

One Step dhcpcmd ServerIpAddress deletesubnet scope_address force_flag

Where:

force_flag
is either dhcpfullforce or dhcpnoforce. If dhcpfullforce is specified, then all clients with active leases in that scope are deleted before the scope is deleted. If there are clients with active leases in a scope, dhcpfullforce must be specified or deletesubnet fails.

Example:

dhcpcmd 127.0.0.1 deletesubnet 10.0.0.0 dhcpfullforce

Deletes the subnet 10.0.0.0 and any leases that are present for this subnet.


Dhcpcmd DeleteSuperScope

Deletes a superscope and optionally converts all subordinate elements to a different superscope. If the target superscope does not already exist, Dhcpcmd creates it.

Syntax:

One Step dhcpcmd ServerIpAddress deletesuperscope [different_superscope_name]

Example:

dhcpcmd 127.0.0.1 deletesuperscope NewSuperScope


Dhcpcmd EnumClients

Lists the lease information in a different format.

One Step dhcpcmd ServerIpAddress enumclients ScopeAddress [-v | -h]

Where:

-v
displays detailed lease information.
-h
displays lease information, including hardware information.

Example:

dhcpcmd 127.0.0.1 enumclients 11.101.0.0 -h


Dhcpcmd GetSuperScopeTable

Retrieves the full superscope information.

Syntax:

One Step dhcpcmd ServerIpAddress getsuperscopetable

Example:

dhcpcmd 127.0.0.1 getsuperscopetable


Dhcpcmd GetVersion

Displays and sets server parameters.

One Step dhcpcmd ServerIpAddress serverconfig [ConfigParameter] [Value]

Where:

ConfigParameter
can be any of the DHCP server parameters.
Value
is the value to which you want to set that parameter.

Typing dhcpcmd ServerIpAddress serverconfig with no further options displays the DHCP server parameters.

Example:

dhcpcmd 127.0.0.1 serverconfig
dhcpcmd 127.0.0.1 serverconfig backupinterval 15

The first example displays DHCP Server parameters, and the second example sets the backupinterval parameter to 15.


Dhcpcmd MibCounts

Displays the current DHCP server statistic information.

Usage:

One Step dhcpcmd ServerIpAddress mibcounts

Example:

dhcpcmd 127.0.0.1 mibcounts


Dhcpcmd RemoveExcludeRange

Removes an existing exclusion range.

Syntax:

One Step dhcpcmd ServerIpAddress removeexcluderange scope_address start_excl end_excl

Example:

dhcpcmd 127.0.0.1 removeexcluderange 10.0.0.0 10.0.0.1 10.0.0.10

Removes an existing exclusion from IP addresses 10.0.01 to 10.0.0.10


Dhcpcmd RemoveGlobalOptionValue

Removes the global option value. (Note that this is not the same as removing the option itself.)

Syntax:

One Step dhcpcmd ServerIpAddress removeglobaloptionvalue option_id


Dhcpcmd RemoveReservedOptionValue

Removes an option defined for a reservation.

Syntax:

One Step dhcpcmd ServerIpAddress removereservedoptionvalue reserved_subnet reserved_IP_address option_id


Dhcpcmd RemoveSubnetOptionValue

Removes a subnet option.

Syntax:

One Step dhcpcmd ServerIpAddress removesubnetoptionvalue subnet_address option_id


Dhcpcmd RemoveSubScope

Removes a particular scope from its current superscope.

Syntax:

One Step dhcpcmd ServerIpAddress removesubscope subscope_address

Example:

dhcpcmd 127.0.0.1 removesubscope 10.0.0.0


Dhcpcmd ServerConfig

Displays and sets server parameters.

One Step dhcpcmd ServerIpAddress serverconfig [ConfigParameter] [Value]

Where:

ConfigParameter
can be any of the DHCP server parameters.
Value
is the value to which you want to set that parameter.

Typing dhcpcmd ServerIpAddress serverconfig with no further options displays the DHCP server parameters.

Example:

dhcpcmd 127.0.0.1 serverconfig
dhcpcmd 127.0.0.1 serverconfig backupinterval 15

The first example displays DHCP Server parameters, and the second example sets the backupinterval parameter to 15.


Dhcpcmd SetGlobalOptionValue

Sets a global option value.

Syntax:

One Step dhcpcmd ServerIpAddress setglobaloptionvalue option_id option_type option_value


Dhcpcmd SetReservedOptionValue

Sets the option value for a reservation.

Usage:

One Step dhcpcmd ServerIpAddress setreservedoptionvalue reserved_subnet reserved_IP_address option_id option_type option_value


Dhcpcmd SetSubnetOptionValue

Adds an option value to a scope option.

Syntax:

One Step dhcpcmd ServerIpAddress setsubnetoptionvalue subnet_address option_id option_type option_value


Dhcpcmd SetSubnetState

Enables and disables a subnet.

One Step dhcpcmd ServerIpAddress setsubnetstate scope_address state

Where:

state
is 0 if the scope is to be enabled and non-0 if the scope is to be disabled.

Example:

dhcpcmd 127.0.0.1 setsubnetstate 10.0.0.0 0

Enables the subnet 10.0.0.0


Dhcpcmd SetSuperScope

Sets the superscope that a scope belongs to, creating the superscope if it does not already exist.

Syntax:

One Step dhcpcmd ServerIpAddress setsuperscope superscope_name scope_address {1/0}

If the value of the last parameter is 1 the superscope is changed even if the scope belonged to some other scope. If the value is 0, then an error is returned if the scope belongs to another superscope.

Example:

dhcpcmd 127.0.0.1 setsuperscope NewSuperScope 10.0.0.0 1


Windows 2000 Resource Kit Support Tools: Glossary of Terms

- A -

ACE

ACL

ActiveXTM

API

associate

- B -

batch program

browser

- C -

CDE

CGI

checked build

code page

COM

Common Gateway Interface

Component Object Model

CRC

Cyclical Redundancy Check

- D -

daemon

DHCP

DLL

DNS

domain

domain controller

Domain Name System

Dynamic Host Configuration Protocol

dynamic link library

- E -

environment variable

- F -

FAT

fault tolerance

File Transfer Protocol

frame

FTP

- G -

gateway

GUI

- H -

HAL

handle

Hardware Abstraction Layer

heap

heap manager

High-Performance File System

hive

HOSTS

HPFS

HTML

HTTP

Hypertext Markup Language

Hypertext Transfer Protocol

- I -

Internet Server Application Program Interface

IP address

IPX/SPX

ISAPI

- J -

No entries

- K -

kernel

kernel mode

key

Korn shell

ksh

- L -

LAN

local area network

- M -

MAC

Management Information Base

Master Boot Record

MBR

Media Access Control

MIB

mirror set

- N -

NetBEUI

NetBIOS

NTFS

- O -

Object Linking and Embedding

ODBC

OLE

Open Database Connectivity

- P -

packet

page fault

partition

partition table

path

PCMCIA

Performance Monitor

permissions

POP

POSIX

Post Office Protocol

process

protocol

- Q -

No entries

- R -

RAS

Reduced Instruction Set Computing

Regedit.exe

registry

Registry Editor

Remote Access Service

Remote Procedure Call

Remote Procedure Call service

Request for Comments

RFC

ring transition

RISC

router

RPC

RPC service

- S -

SAM

script

SCSI

Security Accounts Manager

security identifier

Server Message Block

sh

shell

SID

Simple Mail Transport Protocol

Simple Network Management Protocol

Small Computer System Interface

SMB

SMTP

SNMP

socket

SQL

STDERR

STDIN

STDOUT

stripe set

stripe set with parity

Structured Query Language

subnet mask

symbol files

system tray

- T -

TAPI

TCP/IP

TDI

Telephony API

telnet

thread

touch

Transmission Control Protocol/Internet Protocol

Transport Driver Interface

transport protocol

- U -

UNC

Unicode

Uniform Resource Locator

Universal Naming Convention

Universal Serial Bus

UNIX

URL

USB

user profile

UUEncoding/Decoding

- V -

volume set

- W -

WAN

wc

wide area network

Windows® Internet Name Service

Windows NT File System

WINS

word count

- X -

No entries

- Y -

No entries

- Z -

No entries


Windows 2000 Resource Kit Toolbox: Glossary of Terms

Glossary of Terms

A B C D E F G H I J K L M
N O P Q R S T U V W X Y Z
To copy or print a popup definition, select the popup text with the left mouse button, click the right mouse button, and on the menu that appears click Copy or Print.


Finding the Tools You Need

The tools in the Resource Kit are listed in two different ways: by alphabetical order and by functional category.

Finding Tools by Name

If you know the full name or executable file name of the tool you are looking for, you can look it up in the Alphabetical List. To open this list, click "Alphabetical List of Tools" on the Contents tab, or click the A-Z List button on the button bar. You can also search for the name of the tool on the Index tab.

Finding Tools by Category

If you are looking for a particular type of tool, double-click one of the categories of tools on the Contents tab.


Installing the

 Introduction | > Next >

Installing the Microsoft® Windows® 2000 Resource Kit Support Tools.

The Microsoft® Windows® 2000 Resource Kit Support Tools are a separate installation from the Windows 2000 operating system.

To install the Windows 2000 Resource Kit Support Tools

  1. Start Windows 2000, and then insert the Windows 2000 compact disc into your CD-ROM drive.
  2. When the autorun screen appears, click Explore this CD.
  3. In the \Support\Reskit directory, click Setup.
  4. Follow the instructions that appear on your screen.

The Setup program installs all the Resource Kit files onto your hard disk and requires a maximum of 15 megabytes (MB) of free space.

Setup creates a Resource Kit folder on the Start menu with shortcuts to this Help file and the Tools Management Console.

For More Information

For more details on Resource Kit installation:
Word for Windows Open the Release Notes (Readme.doc) now.


Keyboard Conventions

Convention Meaning
  • + (a plus sign between two or more key names)
 Indicates that you must press the keys at the same time; for example, ALT + TAB.
  • , (a comma between two or more key names)
 Indicates that you must press each key consecutively; for example, ALT, F, X.


Notational Conventions

Convention | Meaning
bold | Characters that you type exactly as shown, including commands and switches. Menus and commands on them are also bold.
italic | Variables for which you supply a specific value. For example, Filename.ext could refer to any valid file name for the case in question.
Initial Capitals
(Filename.ext) 		Names of files should begin with an initial capital letter, for example, Filename.ext. Paths and folders can be uppercase, lowercase, or mixed, according to how they actually appear in a standard installation of the application or the operating system.
ALL CAPITALS | Names of acronyms.
Courier type
 Examples of code.
[ ] (square brackets) | In syntax descriptions, square brackets enclose optional items. If you include the item, type only the information between them, not the square brackets themselves.
{choice1 | choice2} (braces) | In syntax descriptions, braces enclose items which require a choice, such as {yes | no}. Type only one of the choices, not the braces or the dividing line.
Menu | Command (menus) | In referring to menu choices, Edit | Paste, for example, means to select the Edit menu and then choose the Paste command from it.


Procedural Conventions

  • Instructions for the mouse are written for the classic-style Windows desktop (the default configuration). If you have enabled the Active Desktop, use a single mouse click when a double click is called for.

  • Procedures describing how to do a task are preceded by a triangular bullet one-step procedure for a single step or numbers for multiple steps.

  • An instruction to "type" information means to press the key or keys and then press the ENTER key.

  • An instruction to "select" information means to highlight folders, filenames, text boxes, menu bars, and options, or to select options in a dialog box.

  • An instruction to "choose" something means to carry out a command from a menu or dialog box with mouse or keyboard actions.

  • "Note" alerts you to supplementary information.

  • "Caution" alerts you to possible data loss, breaches of security, or other more serious problems.


Terminology Conventions

  • "MS-DOS" refers to Microsoft MS-DOS.

  • "Command prompt" refers to the point on the MS-DOS screen where you enter commands, typically designated by "C:\>" (or other characters indicating the current drive and folder). To reach the command prompt in Windows 2000, click Start, point to Programs, and then click MS-DOS Prompt.

  • "Command-line application" or "console-based application" refers to an application designed to run under MS-DOS or in an MS-DOS window, and which cannot run in a Windows 2000 window.

  • "Windows-based application" or " popup GUI application" refers to an application which must run in a Windows 2000 window. All such applications follow similar conventions for the arrangement of menus, dialog box styles, and keyboard and mouse use.

  • "%SystemRoot%" refers to the folder in which Windows 2000 is installed.

  • "%ResKit%" refers to the folder in which the Windows 2000 Resource Kit is installed.

  • "CD_drive:" refers to the drive letter for the CD-ROM drive, which may vary from computer to computer depending on what other hardware is installed.

  • "Tool" and "utility" are used synonymously to refer to application programs in the Windows 2000 Resource Kit Toolbox.


Using the Tools Management Console

The Tools Management Console, a part of Windows 2000, enables you to view, run, and organize the installed tools and their documentation.

Starting the Tools Management Console

* Click Start, point to Programs, point to Windows 2000 Resource Kit, and then click Tools Management Console.

Finding Tools with the Tools Management Console

The left pane of the Tools Management Console is like the left pane of Windows Explorer. Click the plus (+) sign next to an item to expand it; click its minus (-) sign to collapse it again. The contents of the folders in the left pane appear in the right (contents) pane.

In the Tools Management Console, as in online Help, you can search for a tool by name or category. To search for a tool by name, expand the Tools A-Z folder in the left-hand pane. To search for a tool by category, expand the Tool Categories folder.

To run a tool, click its name in the contents pane. To launch the online Help topic for the tool, right-click the tool name. On the context menu that appears, click Help.

For online Help on using the Tools Management Console itself, click Help in the menu bar, and then click Help on MMC.


NetDom Examples

Sample Workstation or Member Server Operations

Adding a workstation or member server to a domain

Add the workstation mywksta to the NT 4.0 domain mycompany:

NETDOM ADD /d:mycompany mywksta
/ud:redmond\admin /pd:password

Add the workstation mywksta to the Windows 2000 domain devgroup.mycompany.com in the OU Dsys/workstations:

NETDOM ADD /d:devgroup.mycompany.com
mywksta /OU:Dsys/workstations

NOTE If /OU is not specified the account is created in the Computers container.

Joining a workstation or member server to a domain

Join mywksta to the devgroup.mycompany.com domain in the Dsys/workstations OU.

NETDOM JOIN /d:devgroup.mycompany.com
mywksta /OU:Dsys/workstations

In addition to adding the computer account to the domain, the workstation is modified to contain the appropriate shared secret to complete the Join.

Removing a workstation or member server from a domain

To remove mywksta from the mydomain domain and have the workstation be part of a workgroup:

NETDOM REMOVE /d:mydomain mywksta
/ud:mydomain\admin /pd:password
Moving a workstation or member server from one domain to another

To move mywksta from its current domain into the mydomain domain:

NETDOM MOVE /d:mydomain mywksta
 /ud:mydomain\admin /pd:password

If the destination is an Windows 2000 domain, the SID History for the workstation is updated, retaining the security permissions that the computer account had previously.

Resetting the secure channel for a workstation, member server, or NT 4.0 BDC

To reset the secure channel secret maintained between mywksta and devgroup.mycompany.com (regardless of OU):

NETDOM RESET /d:devgroup.mycompany.com
 mywksta

To reset the secure channel between an the NT 4.0 PDC for Northamerica and the backup domain controller NABDC:

NETDOM RESET /d:Northamerica NABDC
Forcing a secure channel session between a member and a specific domain controller

Members may often establish secure channel sessions with non-local domain controllers. To force a secure channel session between a member and a specific domain controller, add the /Server option to the RESET command:

NETDOM RESET /d:devgroup.mycompany.com
mywksta /Server:mylocalbdc
Verifying a workstation or member server secure channel

To verify the secure channel secret maintained between mywksta and devgroup.mycompany.com:

NETDOM VERIFY /d:devgroup.mycompany.com
mywksta

Sample Domain TRUST Operations

Establishing a trust relationship

When used with the TRUST command, the /d:domain parameter always refers to the TRUSTED domain.

To have the NT 4.0 Resource Domain USA-Chicago trust the NT 4.0 Account domain Northamerica:

NETDOM TRUST /d:Northamerica USA-Chicago
/ADD /Ud:Northamerica\admin /Pd:*
/Uo:USA-Chicago\admin /Po:*

>Password for Northamerica\admin: xxxx
>Password for USA-Chicago\admin: yyyy

The user must have credentials for both domains. /Pd: can be used to specify the password for Northamerica\admin while /Po: can be used to specify the password for USA-Chicago\admin. If passwords are not provided on the command line, the user will be prompted for both.

The /TWOWAY option can be appended to specify a bidirectional trust:

NETDOM TRUST /d:marketing.mycompany.com
engineering.mycompany.com /ADD /TWOWAY
/Uo:admin@engineering.mycompany.com
/Ud:admin@marketing.mycompany.com
Establishing a trust relationship with a Kerberos realm

To establish a one-way trust such that Northamerica trusts the MIT realm:

NETDOM TRUST /r:ATHENA Northamerica /ADD

The /r option replaces the /d option as the TRUSTED domain and indicates that this is a MIT kerberos realm.

To allow the MIT realm to trust the Northamerica domain:

NETDOM TRUST /d:Northamerica /r:ATHENA /ADD
Breaking a trust relationship:

To undo the trust that USA-Chicago has for Northamerica,

NETDOM TRUST /d:Northamerica USA-Chicago /REMOVE

To break a two-way trust relationship

NETDOM TRUST /d:marketing.mycompany.com
 Engineering.mycompany.com /REMOVE /TWOWAY
  /Uo:admin@engineering.mycompany.com
  /Ud:admin@marketing.mycompany.com
Verifying a specific trust relationship

To verify the one-way trust that USA-Chicago has for Northamerica:

NETDOM TRUST /d:Northamerica USA-Chicago /VERIFY

To verify a two-way trust between the Northamerica and Europe domains:

NETDOM TRUST /d:Northamerica EUROPE /VERIFY /TWOWAY

The verify command checks that the appropriate shared secrets are synchronized between the two items involved in the trust.

Resetting a specific trust relationship

To reset the secure channel for the one-way trust between Northamerica and USA-Chicago:

NETDOM TRUST /d:Northamerica USA-Chicago
 /Ud:Northamerica\admin /RESET

The reset command synchronizes the appropriate shared secrets if they are not already synchronized.

Verifying Kerberos Functionality

To verify kerberos authentication between a workstation and a service located in domain devgroup.mycompany.com:

NETDOM TRUST /d:devgroup.mycompany.com
[workstation] /VERIFY /KERBEROS

If the workstation parameter is omitted, the current workstation is used.

The NETDOM TRUST command with the /Verify /Kerberos options attempts to get a session ticket for the Kerberos Admin service in the target domain. If successful, it can be concluded that all kerberos operations (e.g. KDC referrals) are operating correctly between the workstation and the target domain.

The /FLUSH option can be used to purge the ticket cache prior to performing the verification.

Note This operation is not remoteable and must be run on the workstation being tested.

Sample Domain QUERY operations

Viewing domain membership

List all the workstations in the domain Northamerica:

NETDOM QUERY /d:Northamerica WORKSTATION

List all of the Servers in Northamerica:

NETDOM QUERY /d:Northamerica SERVER

List all the domain controllers in the domain Northamerica:

NETDOM QUERY /d:Northamerica DC

List all of the OUs in devgroup.mycompany.com:

NETDOM QUERY /d:devgroup.mycompany.com OU

List the PDC for Northamerica:

NETDOM QUERY /d:Northamerica PDC

List the current PDC Emulator for devgroup.mycompany.com:

NETDOM QUERY /d:devgroup.mycompany.com FSMO
Secure Channel batch repair

The QUERY command can be used in conjunction with the /Verify and /Reset options to perform these operations en masse. The output of the QUERY command can be piped to the NETDOM VERIFY or NETDOM RESET command.

List all servers and verify secure channel secret:

NETDOM QUERY /d:Northamerica SERVER /VERIFY

List all workstations and reset any unsynchronized secure channel secrets:

NETDOM QUERY /d:Northamerica WORKSTATION /RESET
Viewing domain trusts

To view all the direct trust relationships for the domain Northamerica:

NETDOM QUERY /d:Northamerica
/Ud:Northamerica\admin DOMAIN /Direct

To view all the direct and indirect trust relationships for the domain Northamerica:

NETDOM QUERY /d:Northamerica
 /Ud:Northamerica\admin DOMAIN
Trust batch repair

To view all trust relationships and check their status:

NETDOM QUERY /d:devgroup.mycompany.com
DOMAIN /VERIFY

To view all trust relationships and fix those that are broken:

NETDOM QUERY /d:devgroup.mycompany.com
DOMAIN /RESET

Sample Domain TIME operations

Viewing Domain Controller Time Status

To verify the current time for all Domain Controllers in devgroup.mycompany.com:

NETDOM TIME /d:devgroup.mycompany.com

To verify the time for a specific server:

NETDOM TIME /d:devgroup.mycompany.com
dc1.devgroup.mycompany.com
Synchronizing Time

The /Synch switch may be used to automatically resynchronize a specified domain controller or all domain controllers which are out of synch:

NETDOM TIME /d:devgroup.mycompany.com /SYNCH

Specifying a domain controller:

NETDOM TIME /d:devgroup.mycompany.com
dc1.devgroup.mycompany.com /SYNCH
Renaming the Domain Name for an NT 4.0 BDC

Changing the name of an NT 4.0 domain is a complex process and requires:

  • Renaming the Domain Name on the NT 4.0 PDC.
  • Modifying all NT 4.0 BDCs.
  • Rejoining all Members (workstations and servers).
  • Deleting and Reestablishing all Trusts.

The following NETDOM syntax is provided to support the modifications necessary to rejoin a BDC to the renamed domain. (step 2 above):

NETDOM RENAME /d:newdomainname BDCServer


NetDom Syntax

command prompt Open command prompt now.

One Step Netdom command [/d:domain] object [/options]

Where:

command
Is one of the following:

Workstation and Member Server commands
ADD
adds machine accounts to domains.
JOIN
joins a workstation or member server to a domain.
/MOVE
moves a workstation or member server to a new domain.
REMOVE
removes a workstation or member server from a domain.
RENAME
assists in NT 4.0 domain rename efforts, applies to NT 4.0 Backup Domain Controllers.
RESET
resets secure channel passwords upon which memberships are based.
VERIFY
verifies the secure channel passwords between a member and its domain.

Domain commands
QUERY
retrieves membership and trust information from a domain.
TIME
synchronizes time within a domain.
TRUST
establishes, verifies or resets a trust relationship.
/d:domain
Can be an NT 4.0 NetBios name, or a Windows 2000 DNS name. Regardless of the command, a domain must always be provided. If the option is not specified, then the domain that the current machine belongs to is assumed.
For Workstation and Member Server commands, /d:domain refers to the domain which the workstation or member server currently belongs to, or should belong to, after the operation is completed. For Domain commands, /d:domain always refers to the trusted domain.
object

is the Active Directory object upon which the command is to work, and may be one of the following:

  • Workstation
  • Server
  • Domain Controller
  • Domain

Only certain objects are supported for each command:

Commands | Valid object(s) | Example
ADD | Name of Workstation or Standalone Server | Netdom ADD /d:ntdev.ms.com mywksta
JOIN | Name of Workstation or Standalone Server | Netdom JOIN /d:ntdev.ms.com mywksta
MOVE | Name of Workstation or Standalone Server | Netdom MOVE /d:newdomain mywksta
REMOVE | Name of Workstation or Standalone Server | Netdom REMOVE /d:ntdev.ms.com mywksta
RESET | Name of Workstation or Standalone Server | Netdom RESET /d:ntdev.ms.com redmond
VERIFY | Name of Workstation or Standalone Server | Netdom VERIFY /d:resourcedom yourwksta
RENAME | Name of Backup Domain Controller | Netdom RENAME /d:newdomain BDC51
QUERY | Workstation, Server,DC, PDC,Domain, FSMO,OU | Netdom QUERY /d:ntdev.ms.com DC
TIME | Name of a Domain | Netdom TIME /d:masterdom resourcedom
TRUST | Name of a Domain | Netdom TRUST /d:masterdom resourcedom
/options

Are the following:

Options available for ALL commands

/Ud:[DOMAIN\]USER
User account used to make the connection with the domain specified by the /d argument. If this option is not specified, the current user account is used.
/Pd:[password | *]
Password of the user account specified with /Ud. If *, then password is prompted for.
/Uo:[Domain\]User
User account used to make the connection with the object on which the action is to be performed. If this option is not specified, the current user account is used.
/Po:[password | *]
Password of the user account specified with /Uo. If *, then password is prompted for.
/S:server
Specifies a domain controller against which an operation should be performed. This option is useful for commands which otherwise may be performed using any domain controller in /d:domain.
/Verbose
By default, only the result of the operation is reported. For example:
success: mywksta joined to redmond domain

If the verbose operation is specified, then the output lists the success or failure of each "atomic" transaction necessary to perform the operation. For example:

success: adding machine account for mywksta to mycompany domain
success: configuring lsa on mywksta
success: mywksta joined to mycompany domain

Additionally, NETDOM returns an errorlevel based on the success (0) or failure (1) of the operation.

/Help
Displays online help describing the syntax of this program.

Options available for the ADD, JOIN, and MOVE commands

/OU:ou-path
Name of a destination Organizational Unit (OU) in /d:domain. The OU path starts immediately below the root of the domain name context, (that is, the domain node).
/Reboot:[time in seconds]
Specifies that the machine being joined or moved should be shutdown and automatically rebooted after the operation has completed. If the number of seconds before reboot is not specified, the default value of 20 seconds is used.

The following message and a countdown timer will be displayed on the workstation's screen prior to the reboot:

The system is shutting down. Please save
all work in progress and logoff. Any unsaved changes
will be lost. This shutdown was initiated because the
domain which this machine belongs to was changed by
nnn.

Where nnn is the name of the adminstrator entered with the /Uo parameter.

Options available for the domain commands QUERY, TIME and TRUST

/Verify

When used in conjunction with the QUERY command, the /Verify option specifies that the secure channel secrets for all enumerated memberships or trusts should be verified in addition to being displayed. Unless the user is an enterprise admin, it may not be possible to verify all secure channel secrets.

When used in conjunction with the TIME command, the /Verify option displays the synchronization status of all Domain Controllers within the domain.

When used in conjunction with the TRUST command, the /Verify option checks the secure channel secrets upon which a specific trust is based.

/Reset

When used in conjunction with the QUERY command, the /Reset option specifies that the secure channel secrets for all enumerated memberships or trusts (which are currently broken) be resynchronized. The /Reset switch implies the /Verify switch. Unless the user is an enterprise admin, it may not be possible to reset all enumerated trusts or memberships.

When used in conjunction with the TIME command, the /Reset option synchronizes the clocks of those domain controllers which are not within the allowable skew range for the domain.

When used in conjunction with the TRUST command, the /Reset option verifies the secure channel secrets upon which the specific trust is based and resynchronizes them if necessary.

Options available for the QUERY command

/Direct
Indicates that the query for trust relationships should only return direct trust relationships rather than direct and indirect ralationships. Available only when domain is specified as the object in a QUERY command.

Options available for the TIME command.

/SYNCH
Automatically resynchronizes a specified domain controller or all domain controllers which are out of synch.

Options available for the TRUST command.

/Add
Specifies that a trust should be created.
/Remove
Specifies that a trust should be broken.
/TwoWay
Specifies that a bidirectional trust relationship should be established rather than a one-way trust relationship.
/Kerberos
In conjunction with the /Verify option, /Kerberos specifies that the Kerberos protocol should be exercised between a workstation and a target domain.
/Flush
In conjunction with /Verify and /Kerberos, indicates that the workstation's ticket cache should be purged prior to verifying the functionality of the Kerberos protocol.


NlTest Examples for Windows NT 4.0

Example 1

Suppose the RANDYMCD Domain trusts the ESS Domain, and a Windows 2000 Professional computer called RANDYMC3 is a member of the RANDYMCD Domain. NlTest can be used to show this trust relationship.

C:\>nltest /trusted_domains
Trusted domain list:
    ESS
The command completed successfully

Example 2

To determine the Domain Controllers in the RANDYMCD domain:

C:\>nltest /dclist:randymcd
List of DCs in Domain randymcd
    \\RANDYMC2 (PDC)
    \\RANDYMC1
The command completed successfully

Example 3

To determine the Domain Controllers in the ESS domain:

C:\>nltest /dclist:ess
List of DCs in Domain ess
    \\NET1 (PDC)
The command completed successfully

Example 4

Below are the secure channels between each Domain Controller in RANDYMCD and a DC in the ESS Domain.

C:\>nltest /server:randymc1 /sc_query:ess
Flags: 0
Connection Status = 0 0x0 NERR_Success
Trusted DC Name \\NET1
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully

C:\>nltest /server:randymc2 /sc_query:ess
Flags: 0
Connection Status = 0 0x0 NERR_Success
Trusted DC Name \\NET1
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully

Example 5

The Windows NT Workstation or Windows 2000 Professional computer that is a member of the RANDYMCD Domain, has an implicit trust with a domain controller.

C:\>nltest /server:randymc3 /sc_query:randymcd
Flags: 0
Connection Status = 0 0x0 NERR_Success
Trusted DC Name \\RANDYMC2
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully

Example 6

To determine if a Domain Controller can authenticate a user account:

C:\>nltest /whowill:ESS bob
[20:58:55] Mail message 0 sent successfully (\MAILSLOT\NET\GETDC939)
[20:58:55] Response 0: S:\\NET1 D:ESS A:bob (Act found)
The command completed successfully
C:\>nltest /whowill:randymcd randymc
[21:26:13] Response 0: S:\\RANDYMC2 D:RANDYMCD A:randymc (Act found)
[21:26:15] Mail message 0 sent successfully (\MAILSLOT\NET\GETDC295)
The command completed successfully

Example 7

NLTEST can be used to find a trusted domain that has a given user account.

C:\>nltest /finduser:sweppler
Domain Name: ESS
Trusted DC Name \\NET1
The command completed successfully

Example 8

To verify the status of BDC synchronization:

C:\>nltest /bdc_query:randymcd
Server : \\RANDYMC1
        SyncState :  IN_SYNC
        ConnectionState : Status = 0 0x0 NERR_Success
The command completed successfully


NlTest Examples for Windows 2000

Example 1

To determine the trust relationships for the current domain.

D:\nt\release\i386\dump>nltest /trusted_domains
Trusted domain list:
    0: AAAAA (NT 4) (Direct)
    1: BBBBB bbbbb.zzzzz.microsoft.com (NT 5) (Forest: 30) (Direct)
    2: CCCCCCC-XXX (NT 4) (Direct)
    3: DDDDDDDDDDDD (NT 4) (Direct)
    4: EEEEEEEEEEEEEE (NT 4) (Direct)
    5: FFFFFFF (NT 4) (Direct)
    6: GGGGGGGGGGGG (NT 4) (Direct)
    7: HHHHHHHHHH (NT 4) (Direct)
    8: IIIIIIIIIIIII (NT 4) (Direct)
    9: JJJJJJ (NT 4) (Direct)
    10: kkkkkkkkk (NT 4) (Direct)
    11: LLLLLL (NT 4) (Direct)
    12: mmmmmmmmmmmm (NT 4) (Direct)
    13: NNN (NT 4) (Direct)
    14: OOOOOOO (NT 4) (Direct)
    15: PPPPPPP (NT 4) (Direct)
    16: QQQQ-YYYY (NT 4) (Direct)
    17: RRRRRR (NT 4) (Direct)
    18: SSSSSSSS (NT 4) (Direct)
    19: TTTTTTTTTTT (NT 4) (Direct)
    20: UUUUUUU (NT 4) (Direct)
    21: VVVVVVVVVVVV (NT 4) (Direct)
    22: WWWWWW (NT 4) (Direct)
    23: AAAAAAAAAAAA (NT 4) (Direct)
    24: BBBBBB (NT 4) (Direct)
    25: CCCCCCC ccccccc.zzzzz.microsoft.com (NT 5) (Forest: 30) (Direct)
    26: DDD-EEEEEE ddd-ddddddd.zzzzz.microsoft.com (NT 5) (Forest: 30) (Direct)

    27: EEEEEEEEEEEEEE (NT 4) (Direct)
    28: FFFFFFFFFF (NT 4) (Direct)
    29: GGGGGGG-GGG ggggggg-ggg.Microsoft.com (NT 5) (Direct)
    30: HHHHH hhhhh.microsoft.com (NT 5) (Forest Tree Root) (Primary Domain)
    31: IIIIIIII iiiiiiii.xxxxxxx.zzzzz.microsoft.com (NT 5) (Forest: 25)
The command completed successfully

Example 2

To determine the domain controllers in the current domain:

D:\nt\release\i386\dump>nltest /dclist:
Get list of DCs in domain '' from '\\AAAAA-BB-01.zzzzz.microsoft.com'.
        AAAAAA4.zzzzz.microsoft.com       [DS] Site: Red-Bldg26
        BBBBBB3.zzzzz.microsoft.com
    CCCCC-CC-07.zzzzz.microsoft.com       [DS] Site: CCC-Zzz-BldgA
    CCCCC-CC-08.zzzzz.microsoft.com [PDC] [DS] Site: Zzz-BldgB
        DDDDDD9.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
      EEEEEEE01.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
        FFFFFF5.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
        GGGGGG0.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
       HHHHHHHC.zzzzz.microsoft.com       [DS] Site: qqqqq
        IIIIII1.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
        JJJJJJ2.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
The command completed successfully


NlTest Syntax

command prompt Open command prompt now.

One Step nltest [option] ...

Where option can be any of the following (options are not case-sensitive):

/SERVER:ServerName
Remotes the NlTest command to the specified server. If this switch is not specified, the command is executed from the local machine.
/QUERY
Queries the local or ServerName server for a healthy secure channel to a Domain Controller, and the status of Directory Services replication with the primary domain controller (PDC). This can be very helpful in determining the general status of the Netlogon service.
/REPL
Forces partial synchronization of the local or ServerName backup domain controller (BDC).
/SYNC
Forces a full, immediate synchronization of the local or ServerName BDC.
/PDC_REPL
Forces a UAS change message from the local or ServerName PDC to all BDCs.
/SC_QUERY:DomainName
Queries and verifies the secure channel in the specified domain for a local or remote Windows 2000 computer, Workstation, Server, or BDC. This can be executed for a PDC if an explicit trust relationship exists between two domains and the Trusted domain is specified.
/SC_RESET:DomainName
Resets the secure channel between the local or remote Windows 2000 computer, Workstation, Server, or BDC. This can be executed for a PDC if an explicit trust relationship exists between two domains and the Trusted domain is specified.
/DCLIST:DomainName
Lists all domain controllers, PDC and BDCs for a given domain.
/DCNAME:DomainName
Lists the primary Domain controller for a given domain.
/DSGETDC:DomainName
Call DsGetDcName /PDC /DS /DSP /GC /KDC /TIMESERV /GTIMESERV /NETBIOS /DNS /IP /FORCE /WRITABLE /AVOIDSELF /SITE:SiteName /ACCOUNT:AccountName /RET_DNS /RET_NETBIOS
Each of these flags maps to a particular flag bit passed to DsGetDcName. For more information, see the DsGetDcName documentation in the Platform SDK.
/DSGETSITE
Calls DsGetSiteName
/WHOWILL:Domain
Queries the domain and indicates which Domain Controller has the account in their local user account database. This is very useful in determining if a given domain controller contains the user account. If the username specified is that of the currently logged on user, the user's current password is not sent to the Domain Controller. This is helpful in determining if duplicate accounts exist across several domains.
/FINDUSER:User
Queries explicit trusted domains for the user specified. This is very useful when determining what Trusted Domain controller or what Trusted domain out of several Trusted domains will authenticate a user's credentials when a Domain name is not specified in the SMB packet. Many down-level clients such as Windows for Workgroups version 3.1 and the real-mode redirector in Windows 95 do not specify a domain name.
/TRANSPORT_NOTIFY
Notifies netlogon of new transport.
/BP
Forces a break point in Netlogon on ServerName.
/DBFLAG:HexFlags
Sets new debug flag. For most purposes, use 0x2000FFFF as the value for HexFlags. For specific values of debug flags, see the entry for HKLM\System\CurrentControlSet\Services\Netlogon\Parameters\DBFlag in Regentry.chm: Technical Reference to the Windows 2000 Registry.
/USER:UserName
Displays many of the attributes for the specified user account that are maintained in the user account database.
Note: This switch does not work for Windows 2000 domain controllers (DCs). It does work for Windows NT 4.0 and 3.x DCs, and for Windows 2000 and Windows NT 4.0 and 3.x workstations and servers.
/TIME:HexLSL HexMSL
Converts NT GMT time to ASCII.
HexLSL is a hex value for "least significant longword." HexMSL is a hex value for "most significant longword."
/LOGON_QUERY
Queries the cumulative number of logon attempts at the console, or over the network.
/TRUSTED_DOMAINS
Queries for a list of domains explicitly trusted by the workstation.
/BDC_QUERY:DomainName
Queries for a list of backup domain controllers in the specified domain and displays their state of synchronization and replication status.
/SIM_SYNC:DomainName MachineName
Simulates full sync replication.
/LIST_DELTAS:FileName
Displays the contents of the change log file FileName, which list changes to the user account database. Netlogon.chg is the default name.
/SHUTDOWN:Reason [Seconds]
Shuts down local computer or ServerName for Reason, a string, after Seconds, an integer.
For a complete description, see the Platform SDK documentation for InitiateSystemShutdown.
/SHUTDOWN_ABORT
Aborts a system shutdown.
/?
Displays this syntax.


Installing Ntmsgs.hlp

Installing Ntmsgs.chm

System Requirements

This help file uses the Windows 2000 Help user interface that is installed with Windows 2000. However, you will need to have Microsoft Access installed on your system to view the database.

Installation

The Message files are installed on your system when you install Windows 2000.

Uninstalling Ntmsgs.hlp

To uninstall the Message help file or the Event Log Message database file, simply delete the files listed above from your local system.


Oh.exe - Full Windows 2000 Resource Kit Only

Oh.exe is not included in the Support Tools. It is available only in the full Microsoft® Windows 2000® Resource Kit.


(Untitled)

Commit Charge

Displays the size of virtual memory (in bytes) that has been Committed (as opposed to simply reserved). Committed memory must have backing (that is, disk) storage available, or must be assured never to need disk storage (because main memory is large enough to hold it).


(Untitled)

CpuTime (CPU Time)

Expressed as a percentage of the elapsed time that a processor is busy executing a non-Idle thread. It can be viewed as the fraction of the time spent doing useful work. Each processor is assigned an Idle thread in the Idle [image] process that consumes those unproductive processor cycles not used by any other threads.


(Untitled)

Image Name

Identifies the executable filename or [image] process associated with a particular item.


(Untitled)

Mem Usage (Memory Usage)

Identifies the total memory used.


(Untitled)

Usage NonP (NonPaged Usage)

The size of the Nonpaged Pool, which is a system memory area where space is acquired by operating system components as they accomplish their appointed tasks. Nonpaged Pool pages cannot be paged out to the paging file, but instead remain in main memory as long as they are allocated.


(Untitled)

Usage Page (Paged Usage)

The amount of the Page File instance in use.


(Untitled)

Page Faults

Page faults/second is a count of the page faults in the processor. A page fault occurs when a [image] process refers to a virtual memory page that is not in its working set in main memory. A page fault will not cause the page to be fetched from disk if that page is on the standby list, and hence already in main memory, or if it is in use by another process with which the page is shared.


(Untitled)

CPU (%CPU)

Identifies the percentage of total CPU usage associated with a particular [image] process.


(Untitled)

Thd Cnt (Thread Count)

Identifies the number of threads for the particular [image] process.


Pulist.exe - Full Windows 2000 Resource Kit Only

Pulist.exe is not included in the Support Tools. It is available only in the Microsoft® Windows 2000® Resource Kit.


(Untitled)

REG QUERY Syntax
REG QUERY Examples
REG ADD Syntax
REG ADD Examples
REG UPDATE Syntax
REG UPDATE Examples
REG DELETE Syntax
REG DELETE Examples
REG COPY Syntax
REG COPY Examples
REG SAVE and BACKUP Syntax
REG SAVE and BACKUP Examples
REG RESTORE Syntax
REG RESTORE Examples
REG LOAD Syntax
REG LOAD Examples
REG UNLOAD Syntax
REG UNLOAD Examples


Displaying Attribute Replication Status

After replication occurs, Active Directory Replication Monitor can display which attributes were replicated. This feature is useful in troubleshooting possible replication failures for given objects per Naming Context.

To view attribute replication status

  1. Click the View menu.
  2. Click Details.


Displaying Group Policy Objects

Active Directory Replication Monitor can list Group Policy Objects (GPOs) on a domain controller with their associated version number. This data can assist administrators with troubleshooting. This feature allows an administrator to compare the current version of a GPO with that of the version contained in the SysVol. The Group Policy Objects can be viewed by the administrator on demand or through the built-in logging feature.

To view the current state of GPOs

one step From the Action menu item, select Server, then Show Group Policy Object Status.

Administrators can then determine the status of an individual GPO by comparing its version number with that of the version contained in SysVol, as well as by viewing its Sync Status.

To enable GPO logging

  1. From the View menu, select Options...
  2. On the Status Logging tab, check Monitored Servers: Group Policy Objects.


Displaying Performance Statistics

Performance statistics play an essential part in determining possible inconsistencies in a domain. Active Directory Replication Monitor provides administrators with the ability to view this data either on demand or through the built-in logging feature. The counters available to Replication Monitor are specific to the Active Directory and are also available in System Performance Monitor.

To view the current Performance Statistics

one step From the Action menu item, select Server, then Show Current Performance Data.

To enable logging of performance statistics

  1. From the View menu, select Options...
  2. On the Status Logging tab, check Monitored Servers: Performance Statistics.


Adding a Server to the List of Monitored Servers

  1. From the Edit menu, select Add Site/Server.

    2. This presents a dialog box that allows the administrator to either browse for the server to monitor or, if already known, to add the server explicitly. If the administrator chooses to browse for the server, Active Directory Replication Monitor will attempt to determine the domain of which the computer the administrator is currently logged on to is a member.

    The domain name is used to find a domain controller from which a list of sites and domain controllers can be enumerated. If this can be automatically determined, it will be filled in automatically. If the administrator needs to supply alternate credentials to access the Active Directory in a given domain, the Use Alternate Credentials checkbox should be selected and the credentials supplied by pressing the Change… button.

    Note When you are prompted to supply alternate credentials, the password does not carry over to the second page of the wizard, so you must re-enter it. These credentials are only used to enumerate Sites and Domain Controllers names in the Active Directory – they are not cached for use when monitoring specific servers. This was done to avoid caching the password in the user interface.

  2. Select one of the two following options:
    • If the administrator knows the name of the server, select Add the server explicitly by name.
    • If the administrator needs to browse for the server, select Search the directory for the server to add.
  3. Select Next.
    • If the administrator chose to add the server explicitly, the first two sections of the next page of the wizard will be grayed out and the third enabled so that the administrator can enter the name of the server. This can be in the form of Fully Qualified Domain Name, IP address, or NetBIOS name. If the administrator is not an administrator in the domain of the selected server, the Use Alternate Credentials checkbox should be selected and the credentials supplied by pressing the Change… button. These credentials are cached for only the selected server for use when updating statistics for that machine.
    • If the administrator chose to browse for the server, the first section of the next page of the wizard displays the list of sites and each domain controller (regardless of domain) within that site. If a site was selected when the Add Site/Server wizard was invoked, the second option lists just the domain controllers in the Site selected. Otherwise, this section is disabled. The third section is enabled, just as in the explicit case, if the administrator chooses to enter the name explicitly. If either of the first two options are used, a server must be selected. If the administrator is not an administrator in the domain of the selected server, the Use Alternate Credentials checkbox should be selected and the credentials supplied by pressing the Change… button. These credentials are cached for only the selected server for use when updating statistics for that machine.
  4. Select Finish.

When the server is located, several events occur:

  • If the domain controller is a Global Catalog server, this is recorded and the icon for the server will have an icon that reflects a globe.
  • The naming contexts for the server are enumerated, and the server is queried for the replication partners that propogate data for each of the contexts. If the server is a Global Catalog server, there may be more than three naming contexts displayed.
  • Log files are started automatically for each of the replication partners so that statistics can be tracked at a per-replication partner/per naming-context level.
  • If the admin has chosen to enable monitoring of performance statistics and status of Group Policy Objects, the server will be queried for the status of both of these and a log will be started to record this data.


Determining Who Owns a FSMO (Flexible Single Master Operation)

Active Directory Replication Monitor can display a monitored server's knowledge of which domain controllers hold FSMO (Flexible Single Master Operation) roles. This data tells administrators who the monitored server expects to perform these roles.

To view FSMO Roles

one step From the Action menu item, select Server, then Properties.

–Or–

one step Right-click a server in the left-pane view and select Properties.

On the FSMO Roles tab, the list of 5 roles with their respective owners is shown.


Graphically Displaying the Domain Controller Responsible for Inter-Site Topology

Along with viewing replication partners, an administrator can use Active Directory Replication Monitor to determine what domain controller is responsible for generating the inter-site topology connections. The information shown includes the site name as well as the individual server responsible for building inter-site topology connections.

To view inter-site topology generators

  1. From the Action menu, select Server, then Show Replication Topologies.
    –Or–
    Right-click a given server in the left-pane view and select Show Replication Topologies.
  2. From the View menu of the second window that appears, select Replication Topologies.
  3. Select InterSite Topology Generators for a graphical view of the data.


Displaying Attribute Meta-Data for Objects in the Directory

Attribute meta-data can be displayed for objects in the directory. The directory maintains various meta-data for each domain and server known to the enterprise.

To view attribute meta-data

  1. one step From the Action menu, select Server, then Show Meta-Data for Object.
    –Or–
    one step Right-click a given server in the left-pane view and select Show Meta-Data for Object.

    A credentials window opens.
  2. You may use the currently logged-on user or select Change to supply a new set of credentials. As authorized access in the ACLs of individual objects may vary for different users, this window enables the user to avoid logging in and logging out continually.

    A window opens with a text field.
  3. Enter a string in X.500 notation for the object you wish to view attributes on. For example, cn=Administrator,cn=Users,dc=microsoft,dc=com, would set the path for the Administrator container.


Graphically Displaying Replication Partners

Active Directory Replication Monitor provides administrators with the ability to graphically display replication partners within a site or between sites for each of the 3 Naming Contexts. The views available are for the Schema, Configuration and Domain. This graphical representation can assist in understanding how replication of the Active Directory is being accomplished and in detecting and troubleshooting broken replication.

To view replication partners

  1. From the Action menu, select Server, then Show Replication Topologies.
    –Or–
    Right-click a given server in the left-pane view and select Show Replication Topologies.
  2. From the View menu of the second window that appears, select Replication Topologies.

You can now view the replication topologies for the Schema, Configuration, or Domain.

Note The status bar notifies administrators when the server is being used to generate replication information.


Recalculating Replication Topology

Active Directory Replication Monitor gives administrators the ability to trigger the Knowledge Consistency Checker (KCC) into recalculating the replication topology. The KCC performs maintenance on the replication topology as well as other system-level information, such as server object properties.

one step From the Action menu item, select Server, then Check Replication Topology.

–Or–

one step Right-click a given server in the left-pane view and select Check Replication Topology.


Triggering a Manual Refresh of the Statistics for a Monitored Server

A manual refresh may be triggered in two ways:

one step From the View menu, select Refresh.

–Or–

one step When the application has focus, press the F5 key.

By triggering a refresh of statistics, Active Directory Replication Monitor will use the credentials supplied for each server (if applicable) and take a snapshot of the current state of replication and additional components (if configured). A progress bar at the bottom of the left pane displays the progress of updating the statistics.


Viewing Retired Domain Controllers as Replica Partners

By default, when a domain controller is removed from a domain, the server no longer appears in the list of replica partners. Active Directory Replication Monitor gives administrators the option of displaying retired domain controllers in the list of servers.

To view retired domain controllers

  1. From the View menu, select Options....
  2. On the General tab, check Show Expired Replication Partners and click OK.

Retired domain controllers now appear with a circular red 'X' over their icon.


Synchronizing Naming Contexts

An important feature of Active Directory Replication Monitor is the ability to synchronize Naming Contexts between two Domain Controllers or with all the Servers in the Site. Naming Contexts are the partitions of the Directory that hold objects and their attributes. It is imperative that these partitions contain the most up to date information about the objects in the domain and forest. Occasionally, for reasons such as server down or network problems, the synchronization of this data may not be entirely up to date. Replication Monitor provides you, as the administrator, with the option to manually bring this data to a current state.

To synchronize domain controllers:

one step From the Action menu item, select Replication Partner, then Synchronize Replica.

–Or–

one step Right-click a given server in the left-pane view and select Synchronize Replica.

To synchronize all servers in a Site:

one step From the Action menu item, select Naming Context, then Synchronize Naming Context with All Servers in Site.

–Or–

one step Right-click on a given Naming Context in the left-pane view and select Synchronize Naming Context with All Servers in Site.


Viewing the Topology of Replication Partners for a Given Naming Context

For each monitored server, a number of child nodes representing the Naming Contexts hosted are created in the left pane.

  1. Select the Naming Context node for which you want to view the topology.
  2. Right-click to get the context menu.
  3. Select Show KCC Replication Topology
    –Or–
    From the Action menu, select Show KCC Replication Topology.


Features of the Active Directory Replication Monitor Window

Context-sensitive Help Menus

ReplMon provides context-sensitive help menus. These menus provide administrators with instructions for using a particular part of the application. To use a menu, hold your mouse over a part of the window to determine if a menu is available for that part of the application. For example, move your mouse over the "Update Automatically" button without clicking the button. A menu appears with the current update mode and available functionality of the button.

Icons for Replication Partner Status

In ReplMon , icons enable administrators to determine replication status at a glance. Two states are currently implemented; up-to-date (successful) replication or not up-to-date replication.

  • A normal server icon indicates up-to-date replication.
  • A circular red 'X' over the icon of a server indicates that the server is not up-to-date in the Active Directory replication process.

Automatic detection of domain membership

ReplMon automatically detects what domain a client is in based on membership. This feature allows the application to display the appropriate options for a given administrator. This is done to ensure that all necessary tools are available to the administrator of a domain. Alternate credentials may be supplied in instances where more administrative privileges are needed.


SC Syntax

Command prompt Open command prompt now.

sc [ServerName] Command ServiceName [OptionName= OptionValue…]

Where:

ServerName
Specifies the name of the server if you are running the commands on a remote computer. The name must start with two backslash characters. If you are running the commands on the local computer, do not supply this parameter.
Command
Specifies one of the following SC commands:
Command | Description
config | Changes the configuration of a service (persistent).
Continue | Sends a CONTINUE control request to a service.
Control | Sends a control to a service.
Create | Creates a service (adds it to the registry).
Delete | Deletes a service (from the registry).
EnumDepend | Enumerates service dependencies.
GetDisplayName | Gets the display name for a service.
GetKeyName | Gets the name of the registry key for a service.
Interrogate | Sends an INTERROGATE control request to a service.
Pause | Sends a PAUSE control request to a service.
Qc | Queries configuration for the service. For detailed information, see the reference section, "SC QC."
Query | Queries the status for a service, or enumerates the status for types of services. For detailed information, see the reference section, "SC QUERY."
Start | Starts a service.
Stop | Sends a STOP request to a service.

The following commands don't require a service name: sc <server> <command> <option>
Command | Description
boot | (ok | bad) Indicates whether the last boot should be saved as the last-known-good boot configuration
Lock | Locks the Service Database
QueryLock | Queries the LockStatus for the SCManager Database

ServiceName
Specifies the name given to the service key in the registry. This is different from the display name that you see in the Service control panel application.
OptionName
The name of an optional command parameter. You can supply zero or more optional pairs of parameter names and values. For a list of available names, use the command sc command, where command is a valid command name, as listed for Command.
OptionValue
Specifies the value for the parameter named by OptionName. For a list of available values, use the command sc command, where command is a valid command name, as listed for Command.

To display help information for a command, use the following command prompt syntax:

sc [Command]

where Command has the values listed previously. The exception is the Query command, which causes SC to list the status of all running services. For help on the Query command, use the command sc and type y at the prompt, "Would you like to see help for the QUERY command?'


SIDWalker: Migrating Domains from Windows NT 4.0 to Windows 2000

Migrating Domains from Windows NT 4.0 to Windows 2000

SIDwalker can assist system administrators in migrating domain structures from Windows NT 4.0 to Windows 2000. Converting Windows NT 4.0 resource domains to organizational units (OUs) within Windows 2000 domains should result in a domain and OU structure that better reflects the organizational structure it serves. The new domains and OUs also offer administrators more granularity in delegating authority and can help eliminate redundant groups.

This topic describes how to migrate a backup domain controller (BDC) from an Windows NT 4.0 resource domain into a Windows 2000 domain with the goal of eliminating the resource domain.

Initial Assumptions

  • An Windows 2000 account domain, AcctDom, already exists as part of a domain tree.
  • An Windows NT 4.0 resource domain, ResDom, is used primarily for file and print servers. The resource domain administrator manages the server machine accounts, file shares, and printers. Local groups in the resource domain are used to grant access to shares and files. The local groups have as members, individual user accounts and global groups from one or more trusted master account domains. The resource domain servers are configured similarly as follows:
    • All servers in the resource domain are configured as BDCs; there are very few or no members servers.
    • BDCs are used for servers to simplify server administration:
      • Local group administration is done once on the primary domain controller (PDC) for the resource domain and replicated to all servers, thus avoiding having to manage local groups on each member server independent of other servers.
      • Each BDC (server) has trust information to directly handle pass-through authentication to trusted domains. Member servers would otherwise have to pass through authentication by sending the authentication request to their local domain controller (DC), which would then forward it to the trusted domain.
    • Many local groups are used for Servers to host multiple file shares as server resources. Each file share may have three local groups: share_FC, share_R, share_RW.
  • A resource domain can have anywhere from 10 to 30 BDCs. Each server can host multiple shares (commonly 10-20 shares, although no specific limit exists). Multiplying 30 shares by three local groups per share, an individual server may be using 90 local groups to grant access to those shares. If there are 10 servers in the resource domain, the domain could have more than 900 local groups for which to define access to server resources. For a larger domain of 30 servers, this figure would be some 2,700 local groups.

Migration Objectives

The objectives for migrating the Windows NT 4.0 NT4 ResDom into the Windows 2000 AcctDom are:

  • To migrate the servers from Windows NT 4.0 BDCs to Windows 2000 member servers in AcctDom with minimum interruption of service.
  • To create an OU for the resource domain in the Windows 2000 domain (OU=ResOU) for computer accounts and groups and delegate administration of those resources to the specific group of resource administrators who used to be the domain administrators for ResDom. Administrators of ResOU will only be able to create or manage machine accounts, not user accounts.
  • To move all the server computers from ResDom to be member servers in the ResOU/Computers container.
  • To move some of the local groups from the ResDom to be groups in the ResOU/Groups container. During this migration, to eliminate any redundant groups from other resource domains and try to combine access based on AcctDom global groups.
  • After all servers and groups from the ResDom are moved to the AcctDom, to delete the ResDom domain.

The sequence of steps for migrating the ResDom servers to AcctDom is:

  1. Upgrade the ResDom PDC to a Windows 2000 child domain of AcctDom.
  2. Create OU=ResOU in AcctDom with Computers and Groups folders
  3. Run Phase I of SIDwalker against ResDom server to get a list of all local groups (and potentially some user accounts) in ResDom.
  4. Use DSAdmin to move all local groups from ResDom to AcctDom/ResOU/Groups. The ResOU/Groups will have new security identifiers (SIDs) relative to the AcctDom, but the SID history will contain the ResDom\group SID.

    After moving the local groups from ResDom to AcctDom, delete the groups from all ResDom BDCs.

    At this point, users who authenticate using AcctDom accounts (and other domains in the Windows 2000 domain tree) will still be able to use resources in ResDom servers because the ResDom\group SIDs will show up in the access token for those clients. That is, NTLM pass-thru auth from a ResDom Windows NT 4.0 BDC to Windows 2000 AcctDom will return all the AcctDom/ResOU/group SIDs, plus the SID histories for ResDom\groups as ‘global’ groups for that user. Client connections to ResDom servers must be from accounts that are now part of the Windows 2000 domain tree or access is denied.

    Note: Since these are Local Group objects in the Windows 2000 domain, the ResOU/group SIDs and SID history will only be included in the group list if the AcctDom is not a mixed Windows NT 4.0/Windows 2000 domain. That is, AcctDom must be an all-Windows 2000 domain for local groups to ‘behave like’ global groups. If AcctDom is a mixed Windows NT 4.0/Windows 2000 domain, local groups moved from ResDom to AcctDom will behave as Windows NT 4.0 local groups for compatibility and are added to the access token only on a DC server in AcctDom.

    For example, if a ResDom group has a member from a trusted domain, DomX, and the group is moved to AcctDom, which does not trust DomX, clients will get access denied because the local groups now in the AcctDom (and domain tree Global Catalog) are not available to pass-thru authentication back to DomX.
  5. Run Phase II of SIDwalker to map all the ResDom local groups to Windows 2000 global groups. Options for the mapping are described below.
  6. For each of the Windows NT 4.0 BDCs from ResDom to upgrade to an Windows 2000 member server of AcctDom:
    • Upgrade the Windows NT 4.0 ResDom BDC to an Windows 2000 replica of ResDom.
    • Demote the BDC to a member server of ResDom.
    • Rejoin those computers to the ResDom.
    • Change the Domain membership from ResDom to AcctDom.
    • Run Phase III of SIDwalker to update all access-control lists (ACLs) for shares, files, Registry, printers on that member server.

Summary of SIDwalker Phases

Phase I: Resource Domain Principals

  • Build list of local security principals in the Resource Domain (ResDom) prior to merging/moving those principals to the AcctDom ResOU. Principals include (global) Groups, Local Groups, and any User accounts (if any) in the Resource domain. This is done on a server in resource domain before the accounts are moved to the account domain (and deleted from the resource domain.)

Phase II: Security Principal Mapping

  • Update the SID mapping file by mapping old-to-new principals used for input to Phase III on multiple server machines.
  • For each principal in the resource domain list, the mapping options are:
    • Ignore this principal (that is, don’t change the SID for mapping, as SID history is sufficient).
    • Delete this principal (if this SID shows up in an ACL, always remove the ACE).
    • Map to new group in AcctDom if the resource domain SID is in the SID history of a group in the Windows 2000 domain.
    • Map to a new group in AcctDom (this old local group maps to some other new global group).
    • Map to a new group in another domain in the Windows 2000 domain tree.

If the mapping option for all principals is to ignore the SID and depend on SID history, then there is no reason to use SIDwalker. The main reasons to use SIDwalker are:

  • To change authorization from resource-specific local groups to common global groups in the Account domain as part of merging the resource domain into the account domain
  • To delete all instances of stale account principals as part of moving the server to new domain

Phase III: Walking Resource Trees

  • Use the SID mapping file to update resource ACLs the following resource types:
    • Registry
    • NTFS files
    • File shares
    • Printer shares on the machine


TrustDom Syntax

command prompt Open command prompt now.

trustdom [[domain,]target_domain] [-list] [-untrust] [-both] [-localonly] [-downlevel] [-mit] [-parent] [-pw:password]

Where:

domain/target_domain
domains (flat or DNS names).
list
list all trust links of the specified target domain or local domain if none is specified) and exit (all other commands are ignored).
untrust
breaks the trust.
both
establishes a two way trust (bidirectional).
localonly
all operations (create/delete) are applied only for the trust objects on the first/local DC (use with care).
downlevel
creates a downlevel trust.
mit
creates MIT Kerberos trust (enables 'localonly').
parent
establishes a two way parent/child trust; set the parent bit in the trust object on the child machine.
pw:password
optional password to set on the object as CLEARTEXT only. Use '*' to enter password in no-echo mode.
debug
detailed messages about operation.
force
force application of the settings, even if they are illegal; e.g., setting a trust to a Windows 2000 computer without specifying 'downlevel'; (use with care).
/?
displays the usage screen.


(Untitled)

Checksums in WinDiff

For each file compared, a checksum is calculated. This is a 4-byte number derived from some combination of the values of all the bytes in the file in such a way that it is extremely unlikely that two files that are different will have the same checksum, while ensuring that files that are identical always have the same sum.

(The odds of two different files giving the same sum are about 1 in 4 billion, which is to say that you could compare 1 file a second for the next 100 years and only have about a 50/50 chance of seeing it happen.)


Comparing Files with WinDiff

Comparing Files Graphically

To compare files and display the results graphically, use Windiff.exe.

The results are initially displayed in outline mode. WinDiff lists the files that were compared and indicates whether they are identical or whether one file is newer than the other.

To view the differences in expanded mode, select the file from the display and click the Expand button. The parts that are common to both files are displayed on a white background. The parts that belong to the file listed on the left are displayed on a red background. The parts that belong to the file listed on the right are displayed on a yellow background. To return to outline mode, click the Outline button.

Comparing Files Via the Command Prompt

Open command prompt now. The following line shows WinDiff command prompt syntax:

windiff [path1] [path2]

where path1 and path2 indicate the files to be compared. WinDiff uses the following rules to determine what is to be compared:

  • If you invoke WinDiff without specifying path1 or path2, you can click Compare Files or Compare Directories from the File menu to specify the files to compare.
  • If you invoke WinDiff with a filename for path1, but nothing for path2, WinDiff compares the file with a file of the same name in the current directory.
  • If you invoke WinDiff with a directory name for path1, but nothing for path2, WinDiff compares the files in the specified directory with the files in the current directory.
  • If you invoke WinDiff specifying files for path1 and path2, WinDiff compares the two files.
  • If you invoke WinDiff specifying directories for path1 and path2, WinDiff compares the files in those directories.


WinDiff Edit Menu

Edit Menu

Edit Left File

Edit Right File

Edit Composite File

These commands allow a text editor to be invoked from WinDiff. You can edit either the left file, the right file, or the merged file.

Set Editor

allows you to select which editor is invoked.

%p

represents the path to edit (that is, the filename, which may be a name created by WinDiff).

%l

represents the line number.

The default is

notepad %p

If you use the Slick editor, you should set this to

s %p -#%l


WinDiff Expanded Mode Display

Expanded Mode Display

You can display the filenames or the expanded contents of the selected files. When you choose the Expand button, the contents of the files are expanded and the button label then changes to Outline. When you choose the Outline button, only the filenames are displayed. Files with the same name but different contents are displayed in red text. Identical files are displayed in black text.

To display the expanded contents of the files

  1. Select the files you want to compare.
  2. From the Expand menu, choose Both Files.
  3. From the View menu, choose Expand.
    – or –
    Choose the Expand button.

The left of the screen shows a pictorial view of the comparison. Blocks of color represent sections of the files. The left column of blocks represents the file on the left, the right column represents the file on the right.

Where blocks of lines match in the two files, these are shown as white blocks joined by a line connecting the block in each file. Lines that do not match are represented by a red block in the left file or a yellow block in the right file (with no connecting line).

The picture can be turned off by using the View menu.

Lines of text are displayed using the same colors. That is, lines that occur only in the left file are shown with a red background; lines that occur only in the right file are shown with a yellow background. Lines that are moved are shown with blue text against the appropriate background.

The Expand menu allows you to choose whether to look at the left file, the right file, or (the default) a merge of the two files. This merged file contains all the lines that are in either file in the order in which they occur in that file.

Lines that are common to the two files are normally shown only once. (Moved lines are shown twice: once with a red background showing where the line was in the left file, and once with a yellow background showing where the line is in the right file.)

Lines are numbered. The numbering can be turned off to save screen space or can be shown based on the left file or shown based on the right file by using the Expand menu.


WinDiff Expand Menu

Expand Menu

Left File Only

shows only lines from left file (but colored to highlight changed lines).

Right File Only

shows only lines from right file (but colored to highlight changed lines).

Both Files (default)

shows a merge of both files. All the lines in the left file are shown in the order in which they occur in that file; the same is true for the right file. Lines that are only in the left file are shown in red. Lines that are only in the right file are shown in yellow.

Left Line Numbers (default)

shows line numbers, based on the left file.

Right Line Numbers

shows line numbers, based on the right file.

No Line Numbers

turns off line numbers.


WinDiff File Menu

File Menu

Compare Files

Displays a dialog box that allows you to select files to compare. It displays the standard Open File dialog box twice, once for each file.

Compare Directories

Displays a dialog box that allows you to select two folders to compare. unc names are allowed. The names can be absolute paths or paths relative to the current folder. The Include Subdirectories check box determines whether the comparison will include the trees, starting from the given paths, or only the folders named.

Abort

Dimmed unless an operation is in progress, then allows that operation to be terminated before completion.

Save File List

Allows you to save the outline mode data in a file. During the file comparison, a checksum is calculated for each file (which is useful if the network is not working). These can be recorded together with the filenames, if required.

Copy Files

Displays a dialog box for writing the listed files to a disk. WinDiff can copy any combination of the four categories (identical, and so on). If greater selectivity is required, then save the file list (without checksums), and edit the file into a .bat file to do the copying.

For a remote compare, this will compress the files before sending them across the network.

Print

Prints the file list or the expanded comparison.


WinDiff Options Menu

Options Menu

Ignore Blanks

Blanks are ignored in the expanded mode, so that lines that differ only in white space are shown as identical.

The next four options control which files (if any) are displayed in outline mode:

Show Identical Files

includes files that are identical in each path.

Show Left-only Files

includes files that occur only in the left path.

Show Right-only Files

includes files that occur only in the right path.

Show Different Files

includes files that occur in both paths, but that are not the same.


WinDiff Syntax

Open command prompt now.

The full WinDiff command-line syntax is:

windiff path1 [path2] [-D] [-O] [-N name] [-S [options] savefile]

Where:

path1
Compares files in path1 with files in current directory.
path1 path2
Compares files in path1 with files in path2.
-D
Compares one directory only.
-O
Outline view (no automatic expansion).
-N name
Send notification at end of comparison, with NET SEND name.
-S options
Save a list of all files, using the following options:
  • -s: Compares files that are the same in both paths.
  • -l: Compares only files in the first (left) path.
  • -r: Compares only files in the second (right) path.
  • -d: Compares two different files in both paths.

savefile
Name of text file to which comparison results are written.

Colors

red background = left file

yellow background = right file

blue text = moved line

black text = everything else


WinDiff View Menu

View Menu

Outline

sets outline mode, showing lists of files.

Expand

sets expanded mode, showing a comparison of two selected files.

Picture

shows picture (turning the picture off saves space on the screen).

Previous Change

skips to previous point of difference in the file.

Next Change

skips to next point of difference in the file.


Winschk.exe - Full Windows 2000 Resource Kit Only

Winschk.exe is not included in the Support Tools. It is available only in the full Microsoft® Windows 2000® Resource Kit.


WinsCl Notes

When using WinsCl, keep the following points in mind:

  • Addresses of WINS should be given in dotted decimal notation.
  • A version number is 64 bits long. When you are prompted for the version number, enter it in decimal with the high word first followed by the low word. The two words should be separated by a space. For example, 0 9567.
  • Many commands such as PULLT, PUSHT, SI, PRR, etc. are run in the background. A return status of SUCCESS indicates that the command has been queued to WINS for execution. It does not mean that WINS has successfully run the command.
  • WinsCl is case sensitive. So, for example, BOB is different from bob or Bob (when used as input to RN, QN, DN, etc.)
  • The scope, if given, should be in domain name form, as explained in RFC 883. For example, netbios.com.
  • Whenever a pull (or a push) replication is done, the local WINS server will send a request for it to the remote WINS server only if the remote WINS server is either listed in the registry under the Wins\Parameters\Pull (or Push) subkey or if the RplOnlyWCnfPnrs value entry in the Wins\Parameters subkey is either nonexistent or set to 0. Likewise, the remote WINS server will accept the request only if the WINS server making the request is either listed under the Wins\Parameters\Push (or Pull) subkey or if the RplOnlyWCnfPnrs value entry in the Wins\Parameters subkey is either nonexistent or is set to 0. The two WINS servers look up the values of these above subkeys and value entries in their local registries.


WinsCl Options

You can use the following options with WinsCl:

Option | Full name | Explanation
RN | Register Name | Allows you to register unique/multihomed/normal group/Internet group names.
QN | Query Name | Allows you to query any name in the WINS database.
DN | Delete Name | Deletes a name. This action permanently erases the name from the WINS database.
GV | Get Version Counter Value | Gets the current value of the version counter used to stamp records with version numbers.
GM Get Mappings This option gets the configuration intervals being used by WINS. These intervals are in seconds. It also retrieves the priority class and the number of query threads in WINS. The owner ID to address to version number mappings used by the replicator to determine how up-to-date the WINS database is relative to other WINS servers is also retrieved. This command works only with WINS used with Windows NT 3.51.
Note Owner ID is a number corresponding to a WINS address. This number is stored with a record in the WINS database, and identifies the owner of the record.
GMO | Get Mappings (Windows NT 3.5 WINS) | This option is the same as Get Mappings except that this version applies only to WINS used with Windows NT 3.5.
GST | Get Statistics | This option allows you to get the various time-stamps and statistics maintained by WINS. This option applies only to WINS used with Windows NT 3.51.
GSTO | Get Statistics (Windows NT 3.5 WINS) | This option is the same as Get Statistics except that this option applies only to WINS used with Windows NT 3.5.
PUSHT Push Trigger This option allows you to instruct the connected WINS server to send a push trigger to another WINS server. The local WINS server sends a push trigger to the remote WINS server only if one of the following conditions is true:
  • The remote WINS server is listed under the Wins\Parameters\Push subkey in the registry.
  • The RplOnlyWCnfPnrs value entry in the Wins\Parameters subkey in the registry is not present or has a value of 0.
Likewise, the remote WINS accepts this trigger only if the local WINS satisfies one of the following conditions:
  • It is listed under the Wins\Parameters\Pull subkey in its registry.
  • The RplOnlyWCnfPnrs value in the Wins\Parameters subkey in its registry is not present or has a value of 0.
Once the trigger is sent and accepted, the remote WINS server, depending on whether or not its database is out of sync with the database of the connected WINS server, may or may not pull records from the local WINS server.
PULLT Pull Trigger This option allows you to instruct the connected WINS server to send a pull trigger to another WINS server. The local WINS server sends a pull trigger to the remote WINS server only if its database is out of sync with the database of the remote WINS server, and if (and only if) one of the following conditions is true:
  • The remote WINS server is listed in the registry under the Wins\Parameters\Pull subkey.
  • The RplOnlyWCnfPnrs registry value entry in the Wins\Parameters subkey is either not present or has a value of 0.
Likewise, the remote WINS server accepts this trigger only if one of the following conditions is true:
  • The local WINS server is listed under the Wins\Parameters\Push subkey in its registry.
  • The RplOnlyWCnfPnrs value entry in the Wins\Parameters subkey in its registry is either not present or has a value of 0.
SI | Statically Initialize WINS | This option allows you to statically initialize WINS from a file which has records in the format used in an LMHOSTS file.
CC Consistency Checking This option allows you to initiate consistency checking on WINS. Consistency checking results in a WINS server communicating with other WINS servers to check the consistency of its database.
Warning This operation results in high overhead on the WINS server and can also use up the entire network bandwidth (if a full replication is done). If you have a large database, you should run this command at a time when network traffic is minimal.
SC | Scavenge Records | This option is used to instruct WINS to scavenge records. This means that records that are old enough are released, and appropriate records are made extinct. Extinct records that need to be deleted are deleted, and replica records that need to be verified are verified.
DRR | Delete All or a Range of Records | This option is used to delete records by specifying a range of version numbers. You can also delete all records in a WINS database. Only the records owned by the selected WINS server are deleted. Other information about the WINS service, such as the highest version number pulled, is not deleted.
PRR Pull All or a Range of Records This option is used to pull a range of records from remote WINS. The range is a range of version numbers. If the range being pulled overlaps records of the remote WINS that already exist in the WINS database, the pre-existing records are deleted before the new ones are pulled. This command is used to pull records that were never replicated and have no chance of being replicated unless their version number becomes greater than the highest value the local WINS has allocated for remote WINS. Replication only takes place after the appropriate Registry value has been checked.
See also Pull Trigger
GRBN Get Records by Name This option retrieves one or more records starting with a string. The names of records are alphabetically sorted in the WINS database.
Note Names with 0x1B in the 16th byte are an exception. They are stored with the 1st and 16th byte transposed.
You can choose to search the database from the beginning or from the end. If, for example, you want to retrieve 100 names starting with the letter Z, you can specify that WINS should search from the end of the database. This will cause less overhead on WINS.
GRBV | Get Records by Version Number | This option retrieves records from the local WINS database in the specified range of version numbers.
BK | Back Up WINS Database | This option performs a backup of the WINS database to a directory on the same WINS computer.
RSO Restore WINS Database prior to Windows NT 4.0 This option restores the WINS database from the directory to which it was backed up.
Note The WINS database is created by WINS prior to Windows NT 4.0. Also, make sure that WINS is not running when you run this command.
RS Restore WINS Database This option restores the WINS database from the directory to which it was backed up.
Note The WINS database is created by WINS in Windows NT 4.0 or Windows 2000. Also, make sure that WINS is not running when you run this command.
RC | Reset WINS Counters | This option resets the WINS counters displayed via Get Statistics (or Get Statistics (Windows NT 3.5 WINS) for Windows NT 3.5 WINS) to 0.
CR Count Records in Database This option counts the number of records for an owner in the WINS database. The owner is identified by the address. You can count either all or a specific range of records.
Note This can be a high overhead operation.
SDB Search Database This option searches the database for a record with a particular name or address.
Note This can be a high overhead operation.
GD | Get Domain Names | This option allows you to get the list of domain names registered in the WINS database. These are the 1B names (0x1B in the 16th byte) registered by the PDCs (primary domain controllers) of the domains.
DW | Delete WINS | This option deletes all the information relevant to a WINS server (identified by its address) from the database of the connected WINS server, including all records belonging to the WINS server and administrative information. When the connected WINS is specified for deletion, all of its records are deleted. Other information, such as highest version number of records in the database, is not removed.
CW | Connect to WINS | This option allows you to connect to a remote WINS server.
MENU | Show Menu | This option displays the list of commands available.
NOMENU | No Menu | This option hides the list of commands. This may be desirable if you don't want to clutter the output when a script is driving WinsCl.
EX | Exit Tool | This option allows you to exit WinsCl.