Alphabetical list of tools by file name

This page requires a browser capable of displaying frames.


Alphabetical list of tools by tool name

This page requires a browser capable of displaying frames.


Introduction to Support Tools

The Windows 2000 Support Tools help support personnel and network administrators manage their networks and troubleshoot problems. There are two groups of Windows 2000 support tools: those built into Windows 2000, and additional tools that you installed from the Support Tools folder of the Windows 2000 CD. This Help file provides information on the tools installed from the Windows 2000 CD, as well as a shortcuts for opening or running these tools. For information about the built-in support tools, click here.

Getting Help on tools

You can find Help for a tool by the tool name or by the name of the tool's executable (.exe) file.

To find Help for a tool

  • Click Tool Names on the button bar or List of tools by tool name on the Contents tab to display a list of tools by the tool name.
  • Click File Names on the button bar or List of tools by file name on the Contents tab to display a list of tools by the file name.
  • Click a category on the Contents tab and then click the tool's file name.
  • Use the Index tab to locate a tool by either tool name or file name.

Each tool is covered in a main Help topic. Links to associated topics covering syntax, examples, or other features of the tool are available in the tool's main Help topic. Tools with Windows interfaces may include a separate Help file available from the Help menu in the tool window. For command-line tools, Help is also available by typing {filename} /? at the command prompt.

An extensive Glossary is available from the Contents tab. Links to glossary definitions that appear as pop-up windows are formatted in underlined dark green text.

Understanding notation and terminology

The following topics cover the conventions for usage and notation that are observed in this document:

Procedural conventions

Notational conventions

Terminology conventions

This documentation assumes you are already familiar with Windows 2000. For more general information about Windows 2000, including keyboard equivalents to menu and mouse actions, see Windows 2000 Help.

Printing topics

When you print from HTML Help, a dialog box opens asking whether you want to print the selected topic or to print the selected heading and all subtopics. Printing the selected topic is recommended. If you print a heading and subtopics, you may encounter error messages and special formatting will be lost, but the topics will still print.

About the Windows 2000 Resource Kit

The Microsoft Windows 2000 Resource Kit contains valuable technical and performance information about Windows 2000, as well as many more tools that enhance and extend the operating system. For information about the Windows 2000 Resource Kit, see the Windows 2000 Resource Kit site on the World Wide Web.

See Related information on the Internet for links to other Internet sites related to Windows 2000 Support Tools and the Windows 2000 Resource Kit.


Built-in Support Tools

Windows 2000 includes numerous support tools built into the operating system. System administrators and support personnel use these built-in tools to diagnose and fix computer problems.

  • Safe mode

    • If you are unable to start your computer, you may be able to start it in safe mode, which uses default settings and no network connection.

    Safe mode startup options

  • Device Manager

    • Use Device Manager to view and make changes to your hardware configuration.

    Using Device Manager

  • Performance tool

    • Performance is actually two tools: System Monitor and Performance Logs and Alerts. Use System Monitor to collect and view information on hardware usage and system-service activity. Performance Logs and Alerts records performance data and enables you to set system alerts.

    Using Performance

  • Registry Editor

    • Configuration information for Windows 2000 is stored in a database called the registry. Most settings can be changed through other software, but experienced users might want to edit the registry directly.

    Using Regedt32.exe and Regedit.exe

  • Windows Report Tool

    • The Windows Report Tool is used by support personnel to help diagnose problems with your computer. You use this tool to fill out information about a problem and take a snapshot of your computer's current settings.

    Windows Report Tool overview

  • Windows Update

    • Use Windows Update to get online, up-to-date information about product updates and known issues. Includes answers to frequently asked questions.

    Using Windows Update

  • MS-DOS commands

    • Several MS-DOS commands are useful for monitoring and configuring your computer or network.

    Use Ipconfig to display TCP/IP network configuration values.

    Use Nbtstat to display protocol statistics and current TCP/IP connections.

    Use Netsh to configure and monitor Windows 2000 using a command-line, scripting interface.

    Use Nslookup to display information from domain name system (DNS) name servers.

    Use Pathping to determine which routers or links are causing network problems.

  • Network Monitor

    • Use Network Monitor to diagnose and troubleshoot network problems. Network Monitor runs on Windows 2000 Server only.

    For more information about Network Monitor, see Windows 2000 Server online Help.


Notational conventions

Convention | Meaning
bold | Characters that you type exactly as shown, including commands and switches. Menu names and menu commands are also bold.
italic | Variables for which you supply a specific value. For example, Filename.ext represents any valid file name.
Initial Capitals
(Filename.ext) 		Names of files should begin with an initial capital letter, for example, Filename.ext. Paths and folders can be uppercase, lowercase, or mixed, according to how they actually appear in a standard installation of the application or the operating system.
ALL CAPITALS | Used for acronyms.
Monospace type
 Examples of code.
[ ] (square brackets) | In syntax descriptions, square brackets enclose optional items. If you include the item, type only the information between them, not the square brackets themselves.
{choice1 | choice2} (braces) | In syntax descriptions, braces enclose items which require a choice, such as {yes | no}. Type only one of the choices, not the braces or the dividing line.
Menu | Command (menus) | In referring to menu choices, Edit | Paste, for example, means to select the Edit menu and then click Paste on it.

Introduction


Procedural conventions

  • Instructions for the mouse are written for the classic-style Windows desktop (the default configuration). If you have enabled the Active Desktop, use a single mouse click when a double-click is called for.
  • Procedures describing how to perform a task are preceded by a triangular bullet one-step procedure for a single step or numbers for multiple steps.
Convention | Meaning
type | An instruction to type information means to press the key or keys and then press the ENTER key.
select | An instruction to select information means to highlight folders, file names, text boxes, menu bars, and options, or to select options in a dialog box.
+ | A plus sign ( + ) between two or more key names indicates that you must press the keys at the same time; for example, <SMALL>ALT</SMALL> + <SMALL>TAB</SMALL>.
, | A comma ( , ) between two or more key names indicates that you must press each key consecutively; for example, <SMALL>ALT</SMALL>, F, X.
Menu | Command (menus) | In referring to menu choices, Edit | Paste, for example, means to select the Edit menu and then click Paste on it.
Note | Alerts you to supplementary information.
Caution | Alerts you to possible data loss, breaches of security, or other more serious problems.

Introduction


Terminology conventions

Term | Meaning
MS-DOS | Microsoft MS-DOS
command prompt | The point on the MS-DOS screen where you enter commands, typically designated by "C:\>" (or other characters indicating the current drive and folder). To reach the command prompt in Microsoft Windows 2000, click Start, point to Programs, point to Accessories, then click Command Prompt. If you have an enhanced keyboard, press the Windows logo key, and then the R key. Type cmd, and then click OK.
command-line application -or- console-based application | An application designed to run under MS-DOS or in an MS-DOS window, and which cannot run in a Windows 2000 window.
Windows-based application -or- GUI application | An application that must run in a Windows 2000 window. All such applications follow similar conventions for the arrangement of menus, dialog box styles, and keyboard and mouse use.
Systemroot | The folder in which Windows 2000 is installed.
CD_drive: | The drive letter for the CD-ROM drive, which might vary from computer to computer depending on what other hardware is installed.
tool -or- utility | Used synonymously to refer to application programs in the Support Tools.

Introduction


Related Information on the Internet

There are many Microsoft Internet sites that provide information and updates regarding Windows 2000, Windows NT, Windows 98, and the Windows 2000 Resource Kits.

If you have an Internet connection and a Web browser, you can click the following links to visit these sites.

Windows 2000 Resource Kits Web site

Windows 2000 Resource Kits

Windows Web sites

Windows

Windows 2000 Server

Windows NT Server

Windows NT 4.0 Workstation

Microsoft Support

Windows Hardware Compatibility List

Other Microsoft Web sites of interest

Microsoft Knowledge Base search

Microsoft Internet Explorer

Microsoft TechNet

MSDN Online: Essential Resources for Developers

NNTP Newsgroups (unofficial discussion area)

Updates to tools on the Internet

From the Microsoft FTP site, you can download updates to some Resource Kit tools and documentation, as well as the POSIX, Perl, and Regina REXX public domain source files.

Windows 2000 Resource Kit FTP site

Microsoft home page

For any other information about Microsoft products, point your browser to:

Microsoft home page


Dump Check (Dumpchk.exe)

This command-line debugging tool enables you to verify that a crash dump (user mode:user.dmp or kernel mode:memory.dmp) has been created correctly. It also provides options for performing some dump file analysis without using a debugger.

Dump Check syntax

Dump Check examples

Files required

  • Dumpchk.exe
  • Kdextx86.dll
  • Msdis110.dll


Task Killing Utility (Kill.exe)

Use this command-line tool to end one or more tasks or processes. Processes can be killed by the process ID number (PID), or by any part of the process name or the name of the window in which it is running (usually the title of the application's main window). To find the PID, use PuList, a tool included in the Microsoft® Windows® 2000 Resource Kit, or TList, another Windows 2000 Support Tool.

With Kill, you can also specify how the process is to be stopped: you can have Kill send it a command telling it to halt itself, or have Kill force the process to end.

Kill syntax

Using Kill

Kill examples

File required

  • Kill.exe


Memory Profiling Tool (Memsnap.exe)

This memory profiling tool takes a snapshot of the memory resources being consumed by all running processes and writes this information to a log file.

MemSnap logs system memory usage to a log file with the default name of Memsnap.log; however, any file name can be chosen by specifying it at the command line when starting the tool.

MemSnap syntax

MemSnap example output

File required

  • Memsnap.exe


Windows Installer Cleanup Utility (Msicuu.exe)

The Windows Installer Cleanup Utility allows you to safely remove Windows Installer settings from your computer in the event of a problem. If you experience installation problems, you can use this tool to remove registry entries before performing a re-install.

note-icon

Note

  • The command-line version of this tool is Windows Installer Zapper (Msizap.exe).

Only registry entries are removed. Files installed during installation must be removed manually or they will be overwritten during the re-installation process.

Although the Windows Installer is designed to be very robust, it can become damaged if:
  • Your computer's registry becomes corrupt
  • Someone inadvertently changes a registry setting used by Windows Installer, which in turn causes a problem.
  • The installation of a program that uses Windows Installer (for example, Microsoft® Office 2000) is interrupted
  • There are multiple instances of Setup running simultaneously, or an instance of Setup is blocked

You must have Administrator access privileges to use this tool.

Each product removed by this tool is recorded in a log file. The msicu.log file is located in the <winnt_OS_drive>:\Documents and Settings\<local_user>\Local Settings\Temp\ directory. To reach this file, you must change your Windows Explorer folder view settings to show hidden files and folders.

Files required

Msicuu.exe

Msizap.exe


Windows Installer Zapper (Msizap.exe)

Using this command-line tool, you can remove Windows Installer settings from your computer in the event of a problem. If you experience installation problems, you can use this tool to remove registry entries before performing a reinstall.

note-icon

Note

  • The Windows version of this tool is the Windows Installer Cleanup Utility (Msicuu.exe).

Only registry entries are removed. Files installed during installation must be removed manually or they will be overwritten during the reinstallation process.

Although the Windows Installer is designed to be very robust, it can become damaged if:
  • The registry is corrupted.
  • Someone inadvertently changes a registry setting used by Windows Installer, which in turn results in a problem.
  • The installation of a program that uses Windows Installer (for example, Microsoft® Office 2000) is interrupted.
  • There are multiple instances of Setup running simultaneously, or an instance of Setup is blocked.

You must have Administrator access privileges to use this tool.

caution-icon

Caution

  • Products installed by Windows Installer may fail to function after using this tool.

MsiZap syntax

File required

  • Msizap.exe


Poolmon (Poolmon.exe)

This tool monitors memory tags, including total paged and non-paged pool bytes. Poolmon is often used to help detect memory leaks.

note-icon

Note

  • Unlike most command-line tools, help for Poolmon is available after running poolmon.exe by typing "h" or "?".

Running Poolmon

Before running Poolmon, you must enable pool tagging on your computer. The easiest way to do this is to use Gflags.exe to edit the registry entry for you:
GUI method Command-line method
  1. Run the Global Flags Editor.
  2. Click Enable Pool Tagging
  3. Click Apply, and then click OK.
  4. Restart the computer. You are now ready to run Poolmon.
  1. Type:

    gflags -r +ptg

  2. Restart the computer. You are now ready to run Poolmon.

Poolmon syntax

Using Poolmon

Poolmon examples

Files required

  • Poolmon.exe
  • msdis110.dll
  • msvcp60.dll


Registry Console Tool (Reg.exe)

This tool enables you to add, change, delete, search, save, restore, and perform other operations on registry entries from the command prompt or a batch file. It can be used on both local and remote computers.

Important

The version of Reg.exe that is included in the Support Tools has been substantially updated. If you are using Reg.exe commands in existing batch files, be sure to check the syntax in your batch file against the new usage.

Caution

  • Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Control Panel or Microsoft Management Console (MMC) whenever possible.

Registry Console Tool commands

Reg.exe supports the following commands:

  • REG ADD

    Adds a new registry entry in the specified key.

    REG ADD syntax REG ADD examples
  • REG COMPARE

    Compares a registry entry with another registry entry on the current or remote computer.

    REG COMPARE syntax REG COMPARE examples
  • REG COPY

    Copies a registry entry to a new location in the registry of the current or remote computer.

    REG COPY syntax REG COPY examples
  • REG DELETE

    Deletes a registry entry, subkey, or keys.

    REG DELETE syntax REG DELETE examples
  • REG EXPORT

    Exports a registry entry to a file.

    REG EXPORT syntax REG EXPORT examples
  • REG IMPORT

    Imports a registry entry from a file.

    REG IMPORT syntax REG IMPORT examples
  • REG LOAD

    Temporarily loads a specified key or hive from a REG SAVE file into the root of the registry. It is used, for example, for purposes of viewing, troubleshooting, or editing the registry entries of a computer that is not configured properly or is not connected to the network.

    REG LOAD syntax REG LOAD examples
  • REG QUERY

    Returns information about the current entry or entries under a specified registry subkey, key or hive.

    REG QUERY syntax REG QUERY examples
  • REG RESTORE

    Restores a specified registry entry, subkey, key, or hive from a file created by REG SAVE.

    REG RESTORE syntax REG RESTORE examples
  • REG SAVE

    Copies a specified registry entry, subkey, key, or hive, to a specified file. Useful for backing up portions of the registry prior to making changes.

    REG SAVE syntax REG SAVE examples
  • REG UNLOAD

    Removes a specified key or hive that has previously been loaded using REG LOAD.

    REG UNLOAD syntax REG UNLOAD examples

File required

  • Reg.exe


Task List Viewer (Tlist.exe)

This command-line tool displays a list of tasks, or processes, currently running on the local computer. For each process it shows the process ID number, process name, and if the process has a window, the title of that window.

Once you have used TList to find the processes running on your computer, you can end one or more of those processes by using the Task Killing Utility.

Task List Viewer syntax

Examples of Task List Viewer output

File required

  • Tlist.exe


Windows 2000 Error and Event Messages Help (W2000msgs.chm)

This HTML Help file lists most of the error and system-information messages generated by Windows 2000, providing explanations of each message and suggestions on how to correct the problem. Some messages generated by applications or device drivers have been included as well.

Important

  • Windows 2000 Error and Event Messages Help is not intended as an exclusive reference. If, for example, you encounter a network error message, you can find information about it by typing net helpmsg and the message identification number at the command prompt.

Using Messages Help

Messages Help notes

File required

  • W2000msgs.chm

For more information

An Access database of event messages, Windows 2000 Events (W2000events.mdb), is provided in the Windows 2000 Resource Kit.


Application Compatibility Program (Apcompat.exe)

This program is designed to overcome the most common causes of application incompatibility with Windows 2000. You can use this tool with a Windows interface by running the Application Compatibility program, or you can run this program as a command-line tool.

To use the Application Compatibility program,

  1. Click Browse and specify the executable (.exe) file for the program you want to run.
  2. Specify any of the Application Compatibility settings, and then click OK.

Operating system version checking

While installing or running, some programs check which operating system version you are running. If the program is designed to run on only certain operating systems, and Windows 2000 is not one of them, you are prevented from installing or running the program.

If you encounter such a problem, try installing or running the program from the Application Compatibility program. Under Operating system, specify the operating system on which you previously ran the program.

When the program checks the version of the operating system, the operating system you specified is returned. If the program installs successfully, verify that the program also runs successfully.

If the original error occurs again, the program is incompatible and cannot be run on Windows 2000. Contact the maker or vendor of the program and inquire about an upgrade version.

Memory management conflicts

Some programs use memory in ways that can conflict with Windows 2000 improved memory management. If errors occur while running a program on Windows 2000 that did not occur on your previous operating system, try disabling the Heap Manager for the portion of memory reserved for the program.

Select the Disable Heap Manager on Windows 2000 check box. A program running with the Heap Manager disabled can avoid conflicts with Windows 2000 memory management, but also uses memory less efficiently.

Temp folder path incompatibility

Some programs allocate a limited number of characters to store the path and name of the Temp folder. If the number of characters used to identify the Temp folder on Windows 2000 is greater than the length allowed by a program, select the Use the pre-Windows 2000 temp path check box to specify a non-Windows 2000 Temp folder.

The specified program then uses \Temp for the Temp folder. If this folder does not exist, it is created.

Correct disk space detection

Some applications use a different data type than Windows 2000 to store the amount of free disk space available on your computer. This can result in an application determining that there is not enough disk space to run or perform an operation.

To resolve such a discrepancy in disk space detection, select the Correct disk space detection for 2-GB+ drives check box.

Store Application Compatibility settings

If you resolve a compatibility problem by using any of the options in Application Compatibility, you can make these settings permanent. Then you can run the specified application without using the Application Compatibility program.

To save the Application Compatibility settings for the specified application, select Make the above check box settings permanent. This saves the settings in the registry.

Application Compatibility syntax

Files required

  • Apcompat.exe


ClonePrincipal (Clonepr.dll)

This tool assists administrators in migrating users from Windows NT to Windows 2000 by creating clones of the Windows NT 4.0 users and groups in the new Windows 2000 environment.

Customers deploying Windows 2000 may want to migrate users incrementally to a new Windows 2000 environment without impacting their existing Windows NT 4.0 production environment. This allows users to be introduced gradually to Windows 2000 and allows them an emergency fall-back to their old account during the trial period. It enables administrators to consolidate multiple groups from different source domains into a single destination group and old resource domains into a single organizational unit. And it eliminates the need to update group memberships and access control lists (ACLs), preserving uninterrupted network access for users in the new domain structure.

ClonePrincipal must be run on a destination domain controller running Windows 2000.

ClonePrincipal performs tasks related to those performed by another Windows 2000 Support Tool, MoveTree, with the following differences:

  • ClonePrincipal is exclusively inter-forest; it copies security principals between forests only. MoveTree is exclusively intra-forest; it moves security principals within the same forest only. This means that for ClonePrincipal, the source domain can be Windows NT 4.0 or Windows 2000 (mixed or native mode), while MoveTree relies on a Windows 2000 source domain.
  • ClonePrincipal duplicates objects from the source domain in the target domain rather than moving them to it, so the source domain is unaffected. MoveTree moves objects, which means that the operations it performs destroy objects in the source domain. Both however, add the old security identifier (SID) to the SIDHistory.
  • ClonePrincipal does not maintain users' existing passwords, and MoveTree does.

To move users or groups within a Windows 2000 domain (for example, from one organizational unit to another), use Active Directory Users and Computers, a Microsoft Management Console snap-in that is part of the Windows 2000 operating system.

Detailed background on the processes and choices involved in migrating domains from Windows NT to Windows 2000 can be found in Planning Migration from Microsoft Windows NT to Microsoft Windows 2000 (Dommig.doc).

Files required

  • Clonepr.dll - Component Object Model (COM) object with methods to support ClonePrincipal operations.
  • Clonegg.vbs - Sample script that clones all the Global Groups in a domain.
  • Cloneggu.vbs - Sample script that clones all the Global Groups and Users in a domain.
  • Clonelg.vbs - Sample script that clones all the Local Groups in a domain.
  • Clonepr.vbs - Sample script that clones a single security principal.
  • Sidhist.vbs - Sample script that adds the SID of a source account to the SIDHistory of a destination account.

For more information

For more information about Active Directory, visit the Active Directory page on the Microsoft Windows 2000 Server Web site.


Planning Migration from Microsoft Windows NT to Microsoft Windows 2000 (Dommig.doc)

This paper outlines planning considerations and guides administrators through the planning process for migrating Windows NT 3.51 and Windows NT 4.0 domains to Windows 2000 in an enterprise environment. New Windows 2000 tools and technologies make migrating users and computers, while maintaining access to resources, a straightforward task.

The focus of this document is on planning an implementation of the Active Directory namespace through the upgrade of Windows NT domains; most of the Active Directory namespace planning should have already taken place.

For a tool that assists administrators in migrating users from Windows NT to Windows 2000, see ClonePrincipal (Clonepr.dll).

File required

  • Dommig.doc

For more information

For more information about Active Directory, visit the Active Directory page on the Microsoft Windows 2000 Server Web site.


Security Administration tools (SIDWalker)

This set of programs helps system administrators manage access-control policies on Windows 2000 and Windows NT systems. Access control is implemented by access control lists (ACLs). Every file in the NTFS file system and every registry key has a unique ACL, granting access rights to file resources to users and groups and defining what specific access rights each is granted. Each user and group is identified in the ACL by a security identifier (SID).

Modifying access control

The SIDWalker tools are designed to support a three-phase approach to modifying access control. Each phase of changing access control can take a day or longer to complete and verify and requires significant amounts of system resources and administrator time. The phases are:

  • Planning The administrator needs to determine what users have been granted access to resources (file shares, print shares, NTFS files, registry keys, and local group membership) on a particular computer.
  • Mapping Accounts Based on who has access to what resources on the system, the administrator can chose to delete old, unused security identifiers, or replace them with corresponding new SIDs, such as new security groups.
  • Converting ACLs Using the information from the planning and mapping phases, the third phase is the conversion of security identifiers found anywhere on a system to corresponding new SIDs.

Why use SIDWalker?

Administrators will find the SIDWalker tools most useful for the following operations:

  • Monitoring security access control on specific Windows 2000 and Windows NT systems.
  • General maintenance and clean-up of access control for Windows 2000 and Windows NT file systems.
  • Support in Windows 2000 for some intra-forest operations such as updating and cleaning up the ACLs of merged groups, and for certain inter-forest migration scenarios.

To migrate security principals from Windows NT 4.0 to Windows 2000 domains, use ClonePrincipal.

To move users or groups within a Windows 2000 domain (for example, from one organizational unit to another), use Active Directory Users and Computers, a Microsoft Management Console (MMC) snap-in that is part of the Windows 2000 operating system.

Detailed background on the processes and choices involved in migrating domains from Windows NT to Windows 2000 can be found in Planning Migration from Microsoft Windows NT to Microsoft Windows 2000 (Dommig.doc).

SIDWalker components

SIDWalker consists of three separate programs. Two of these, Showaccs and Sidwalk, are command-line tools for examining and changing access-control entries (ACEs). The third, Security Migration Editor, is a Microsoft Management Console (MMC) snap-in for editing mapping between old and new SIDs. The SIDWalker tools are designed to run independently of each other.

Using the SIDWalker tools

Showaccs (Showaccs.exe)

Sidwalk (Sidwalk.exe)

Security Migration Editor (Sidwalk.msc)

Access-control policy migration scenario

Files required

  • Showaccs.exe
  • Sidwalk.exe
  • Msvcrt50.dll

Showaccs.exe and Sidwalk.exe are stand-alone application programs that can run on either Windows 2000 or Windows NT 4.0. On Windows NT 4.0, they require Msvcrt50.dll, which is found in the \System32 directory of any Windows 2000 installation.

  • Sidwalk.msc
  • Sidwkr.dll

Sidwkr.dll is the snap-in file for Security Migration Editor. Security Migration Editor requires MMC, which is available for Windows 2000 or Windows NT 4.0. Sidwalk.msc is also provided as a saved MMC console shortcut.


ACL Diagnostics (Acldiag.exe)

This command-line tool helps diagnose and troubleshoot problems with permissions on Active Directory objects. It reads security attributes from access control lists (ACLs) and writes information in either readable or tab-delimited format. The latter can be uploaded into a text file for searches on particular permissions, users, or groups, or into a spreadsheet or database for reporting. The tool also provides some simple cleanup functionality.

With AclDiag, you can:

  • Compare the ACL on a directory services object to the permissions defined in the schema defaults.
  • Check or fix standard delegations performed using templates from the Delegation of Control wizard in the Active Directory Users and Computers snap-in, a Windows 2000 administrative tool.
  • Get effective permissions granted to a specific user or group, or to all users and groups that show up in the ACL.

AclDiag displays only the permissions of objects the user has the right to view. Because Group Policy objects are virtual objects that have no distinguished name, this tool cannot be used on them.

For general-purpose ACL reporting and setting from the command prompt, you can also use Dsacls.exe, another Windows 2000 Support Tool.

AclDiag syntax

AclDiag output

File required

  • Acldiag.exe

For more information

For more information about Active Directory, see the Active Directory page at the Microsoft Windows 2000 Server Web site.


Advanced Power Management Status (Apmstat.exe)

This command-line tool provides status information on Advanced Power Managment (APM) features. In Windows 2000, APM is primarily intended to support older notebook computers, while Advanced Configuration and Power Interface (ACPI) is the default power management scheme. ApmStat can run on any computer running Windows 2000, whether it uses APM or ACPI.

The output of ApmStat can be helpful in troubleshooting APM problems. The tool reports on APM-related registry entries written by Ntdetect.com (Startup Hardware Detector), and on APM BIOS problems.

ApmStat tells you whether a computer has multiple processors and whether it is running in ACPI mode.

Notes

  • In Windows 2000 Server, APM is disabled.
  • If Windows 2000 does not find a battery installed at startup, as is generally the case with desktop computers, stand-by status is not available. Only power-off status is enabled.

ApmStat syntax

Using Advanced Power Management on Windows 2000

File required

  • Apmstat.exe


Browser Status (Browstat.exe)

BrowStat is a general purpose, character-based browser diagnostic tool. Use BrowStat to find out whether a browser is running and to find active Microsoft Windows for Workgroups (WFW) browsers in Windows 2000 and Windows NT domains. This tool also provides information about the state of the browser in a workgroup, including the name of the master browser.

You can also find out which transports are on a computer by using the Browstat Dumpnet or Browstat DN command and examining the result. In this discussion, "transport" refers to the Windows 2000 or Windows NT device name (case-insensitive) for the specified transport, in one of the following formats:

\device\transport (For example: \device\Nbf_elnk1601)

\transport

transport

BrowStat syntax

Flags in BrowStat listings

BrowStat STATS example

BrowStat STATUS example

File required

  • Browstat.exe


Domain Controller Diagnostic Tool (Dcdiag.exe)

This utility analyzes the state of domain controllers in a forest or enterprise and reports any problems to assist in troubleshooting. As an end-user reporting program, DcDiag encapsulates detailed knowledge of how to identify abnormal behavior in the system.

DcDiag consists of a framework for executing tests and a series of tests to verify different functional areas of the system. This framework selects which domain controllers are tested according to scope directives from the user, such as enterprise, site, or single server.

Tests currently include:

  • Connectivity
  • Replications
  • Topology Integrity
  • Check NC Head Security Descriptors
  • Check Net Logon Rights
  • Locator Get Domain Controller
  • Intersite Health
  • Check Roles
  • Trust Verification

DcDiag is the equivalent for domain controller functions of NetDiag, another Windows 2000 Support Tool.

DcDiag syntax

File required

  • Dcdiag.exe

For more information

For more information about Active Directory, see the Active Directory page on the Microsoft Windows 2000 Server Web site.


Dependency Walker (Depends.exe)

This tool scans any 32-bit or 64-bit Windows module (including .exe, .dll, .ocx, and .sys, among others) and builds a hierarchical tree diagram of all dependent modules. For each module found, it lists all the functions that are exported by that module, and which of those functions are actually being called by other modules. Another view displays the minimum set of required files, along with detailed information about each file including a full path to the file, base address, version numbers, computer type, debug information, and more.

Dependency Walker is also very useful for troubleshooting system errors related to module load problems. During the module scan, this tool detects dozens of common application problems such as missing modules, invalid modules, import/export mismatches, circular dependency errors, and mismatched computer types of modules.

Dependency Walker is useful for developers, testers, system administrators, creators of setup scripts, and anyone else who needs to examine what dependencies are required to make a specific module load successfully.

Dependency Walker runs on Windows 95, Windows 98, Windows NT 3.51, Windows NT 4.0, and Windows 2000. It can process any 32-bit or 64-bit Windows modules, including ones designed for Windows CE. It can run as a graphical application or as a console application. New features in version 2.0 include C++ function name undecoration, detection of delay-load and dynamic dependencies, application profiling, user-definable search paths, and the ability to save results to several file formats.

Details on running Dependency Walker can be found in Dependency Walker 2.0 Help (Depends.hlp), a separate documentation file.

Using Dependency Walker

Files required

  • Depends.cnt
  • Depends.exe
  • Depends.hlp
  • Dwinject.dll


Gflags.exe

Global Flags Editor (Gflags.exe)

GFlags is a GUI utility that enables a developer or system administrator to edit the NtGlobalFlag settings for Windows 2000.

You can use GFlags to modify the current flags in use by the kernel or the flags used when a particular image file is launched. If you have administrative privileges, you can also use GFlags to modify the global registry settings that will be used the next time Windows 2000 starts.

The GlobalFlag registry entry consists of 32 bits that are used as switches to enable or disable several different advanced internal system diagnostics and troubleshooting tests. Only certain flags can be changed for each target. Changes to the kernel registry flags do not take effect until the next time Windows 2000 starts. GFlags only looks at global flags specific to a particular image file when you launch this tool under a debugger or by clicking the GFlags Launch button.

GFlags can also set the flag required for the kernel feature of Oh.exe, a Microsoft Windows 2000 Resource Kit tool which shows the handles of open windows.

Note

Running GFlags without arguments displays a dialog box that allows the user to modify the global flag settings.

Caution

You should use GFlags only in consultation with Microsoft Product Support Services. It is an optional component provided solely for troubleshooting purposes. Incorrect use of this tool might cause system boot failure, or might adversely impact performance. This tool makes modifications to your registry. Changing the registry can have unforeseen effects that can prevent you from starting your computer.

GFlags syntax

GFlags Example: Using Gflags and Poolmon to Troubleshoot a Memory Leak

Global Tags Values Reference

File required

  • Gflags.exe


System Information (Msinfo32.exe)

System Information retrieves and reports your system configuration information for your hardware, system components, and software environment. Support technicians require specific information about your computer when they are troubleshooting your configuration. You can use System Information to quickly find the data they need to resolve a system problem. You can also run System Information from the command line using options for loading, viewing, and saving configuration information.

Note

  • Msinfo32.exe is located in the \Program Files\Common Files\Microsoft Shared\MSInfo folder of the drive on which Windows 2000 is installed. To run System Information from the command line, you can also click Start, click Run, type msinfo32, and then click OK.

System Information syntax

System Information categories

System Information extensions

Related tools

File required

  • Msinfo32.exe

For more information

For more information about System Information, see System Information in Windows 2000 Help.


Network Connectivity Tester (Netdiag.exe)

This command-line diagnostic tool helps isolate networking and connectivity problems by performing a series of tests to determine the state of your network client and whether it is functional. These tests and the key network status information they expose give network administrators and support personnel a more direct means of identifying and isolating network problems. Moreover, because this tool does not require that parameters or switches be specified, support personnel and network administrators can focus on analyzing the output, rather than on training users how to use the tool.

Note

  • For best results, TCP/IP must be bound to one or more adapters before using this tool. In most cases, this will already be done.

Sample Scenario

An example of this tool's usefulness is a scenario where the user has a problem connecting to a network resource. Receiving only a "Network path not found" error message and no further assistance, the user has no idea where to start troubleshooting the problem.

Assuming that the reason for the failure in this case is that the WINS server is down, the solution can be found easily with Network Connectivity Tester. When executed in this scenario, the tool shows that the network adapter protocol, bindings, IP address, Default Gateway, and DNS tests succeed. The WINS ping test fails and reports that the WINS server could not be contacted. With this information the user knows that either the WINS server address is incorrect or that the WINS server is not responding for some unknown reason. Since the WINS address is also displayed as output, it can easily be verified for correctness. With the problem isolated, the Network Administrator can perform additional troubleshooting to determine why the WINS server is down.

Network Connectivity Tester features

  • The tool is command-line executable, which allows for easy scripting.
  • Ships as a Windows Management Instrumentation (WMI) Source Provider dynamic-link library (DLL) so MSINFO can be used as a GUI entry point.
  • Gathers static network information and tests network driver, protocol driver, send/receive capability, and well-known target accessibility.
  • Receives input and returns output that can be leveraged by other applications and services.
  • Runs on Windows 32-bit operating systems.
  • Can be used by network administrators in conjunction with the Scheduler Service to generate reports at regularly scheduled intervals.

Netdiag syntax

Netdiag sample output

Netdiag notes: Details about the tests executed

File required

  • Netdiag.exe


Point-to-Point Tunneling Protocol Ping Utilities (PPTP Ping)

Pptpclnt.exe and Pptpsrv.exe are tools that work in unison to verify that the required protocol and port for Point-to-Point Tunneling Protocol (PPTP) is being routed from a PPTP client to a PPTP server or vice-versa.

In order for a PPTP client to access a remote PPTP server, all routers in between the two hosts MUST allow traffic to pass through TCP port 1723 (PPTP) and must support protocol type 47. Protocol type 47 is the GRE (Generic Routing Encapsulation) protocol.

PPTP Ping runs on Windows 2000, Windows NT, and Windows 98, but not on Windows 95.

Note

  • This tool is not meant to test the functionality of a PPTP server or a PPTP client. It is meant to assure that the path between the two hosts is passing through TCP port 1723 and using the GRE protocol (type 47).

Using PPTP Ping

Troubleshooting PPTP Ping

Files required

  • Pptpclnt.exe
  • Pptpsrv.exe


SNMP Query Tool (Snmputilg.exe)

The SNMP Utility Tool (SNMPUtilG) is a graphical tool that complements the older command prompt SNMP browser tool (Snmputil.exe). System administrators can use either tool to obtain information from SNMP-manageable systems on the network.

You can use SNMPUtilG to perform the basic SNMP operations such as GET, GET-NEXT, and SET from a graphical interface. SNMPUtilG also supports saving SNMP data to the clipboard, as well as saving data to comma-delimited text files.

Caution

Even though many object identifier values are read-only by default, you should use the SNMP SET command with caution. Incorrect use of this tool might cause network name resolution or network connectivity problems adversely impacting performance.

Using the SNMP Query Tool

File required

  • Snmputilg.exe


Windows Report Tool (WinRep.exe)

The Windows Report Tool (WinRep) is an Internet-based problem reporting tool built into the Windows 2000 operating system. WinRep enables users to enter information about a computer problem, take a snapshot of their current configuration settings, and then upload the information to a help desk or support center.

When used by itself, WinRep gathers information from the user and the local computer and then prompts the user to save that information to a file on their computer.

However, WinRep can be programmed so that the user can upload the information through an intranet or the Intranet to a corporate help desk or service center.

Use command-line parameters to program WinRep for use on a client machine. You can create a shortcut to Winrep.exe and include the parameters, but the recommended method is to embed the command in a Web page that users displays when they want to report a problem. The parameters enable you to define:

  • A second Web page from which users can upload information after they have entered it and WinRep has gathered configuration settings.
  • The location where the information will be sent.
  • A list of files from the user's computer that can be included with the report.

Complete information on programming and deploying WinRep and setting up the backend server to receive problems is available in the Windows Report Tool Deployment Software Development Kit, which is part of the Microsoft Windows 2000 Resource Kit.

WinRep syntax

Related tools

Filed required

  • Winrep.exe
  • Br549.ocx


Distributed File System Utility (Dfsutil.exe)

This tool enables administrators to query and troubleshoot the Microsoft Distributed file system (Dfs) from the command prompt. It can be used to perform maintenance of a Dfs root and to clean up metadata left behind by orphaning or abandoning domain-based Dfs roots.

Distributed file system, a new feature of Windows 2000, makes it easier to access and manage files that are physically distributed across a network. With Dfs, you can make files distributed across multiple servers appear to users as if they reside in one place on the network. Users and applications no longer need to know and specify the actual physical location of files in order to access them: Dfs makes the physical storage of data transparent by mapping it to a logical representation.

Dfs does for servers and shares what file systems do for hard disks. File systems provide uniform named access to collections of sectors on disks; Dfs provides a uniform naming convention and mapping for collections of servers, shares, and files. Thus, Dfs makes it possible to organize file servers and their shares into a logical hierarchy, making it considerably easier to manage and use extensive information resources. In addition, Dfs is not limited to a single file protocol—it can support the mapping of servers, shares, and files, regardless of the file client being used, provided that the client supports the native server and share.

In the past, with the universal naming convention (UNC), a user or application was required to specify the physical server and share in order to access file information (that is, the user or application had to specify \\server\share\path\filename).

DfsUtil syntax

DfsUtil examples

File required

  • Dfsutil.exe

For more information

For more information about the Microsoft Distributed file system (Dfs), see the Microsoft Windows 2000 Server Distributed file system Web site.


DiskProbe (Dskprobe.exe)

DiskProbe is a sector editor for Windows 2000. It allows a user with local Administrator rights to directly edit, save, and copy data on the physical hard drive that is not accessible in any other way.

This tool can help you prepare for disk-based problems by saving critical disk structures before problems arise. Documenting and preserving these disk structures, such as the Master Boot Record (MBR) and boot sector, provides a fall-back in case of disk corruption. DiskProbe can also be used to resolve problems that you might encounter. With it, you can edit and repair these sectors on a byte-by-byte basis if corruption does occur.

You can use DiskProbe to replace the Master Boot Record, repair damaged partition table information, and repair or replace damaged Partition Boot Sectors or other file system data. The tool can also save Master Boot Records and Partition Boot Sectors as files. They can then be replaced if the sectors become damaged at a later time. These on-disk data structures are not accessible through the file system, and so are not saved by any backup programs currently available.

note-icon

Caution

Before you make changes with a low-level tool such as DiskProbe, make sure that a reliable, complete backup of the drive is available. Misuse of DiskProbe might make all data on the drive or volume permanently inaccessible.

DiskProbe and other sector editors function at a level "below" the file system, so the normal checks for maintaining disk consistency are not enforced. This tool gives the user direct access to every byte on the physical disk without regard to access privilege, which makes it possible to damage or permanently overwrite critical on-disk data structures.

Limitations

  • Administrators only
    Only users with local Administrator rights can use DiskProbe to access the physical disk. Other users can run DiskProbe, but in the Open Physical Drive dialog box, no physical drives will be listed.

  • DiskProbe on Windows 2000
    The version of DiskProbe included with the Windows 2000 Support Tools does not support all the disk-based features found in Windows 2000.
    • No FAT32 support
      Support for FAT32 boot sectors has not been included in this release of DiskProbe. While DiskProbe can display, edit, and search for sectors on a FAT32-formatted volume, it does not offer a FAT32 Boot Sector view to specifically show all of the BIOS parameter block (BPB) and extended BPB fields within the FAT32 boot sector. In order to edit the BPB and extended BPB in a FAT32 boot sector, you must use the Bytes view and carefully count the byte addresses to make sure you are editing the bytes in the correct BPB field. For more information about the fields in the FAT32 BPB and extended BPB, see the Windows 2000 Server Resource Kit.
    • No dynamic disk support
      Windows 2000 offers two types of disk configurations: basic disk and dynamic disk. The basic disk configuration uses the same disk structures found on all earlier versions of Windows NT, using primary partitions and logical volumes within extended partitions as containers of data. All disks are initially configured as basic disks. DiskProbe fully supports basic disks.

      Dynamic disk is new to Windows 2000. It uses a disk management database located at the end of the disk to manage the structure of disk volumes. Each physical disk has to be upgraded to use dynamic disk.

      DiskProbe cannot read the disk management database. That means users who upgrade their disks to dynamic disk will not be able to use all of the functionality of DiskProbe on those disks. While the upgrade to dynamic disk does not change the sectors themselves, nor the ability of DiskProbe to successfully read and write changes to sectors on disks, the ability of DiskProbe to navigate partitions to find boot sectors of particular volumes is impaired. Dynamic disk allows users to have as many volumes as they want without the limits imposed by the partition table, and disk volumes can be easily extended and spanned. None of these types of additions or changes are recorded in the partition table on dynamic disks, which inhibits DiskProbe’s ability to navigate between volumes, locate boot sectors, and identify the start and end sectors of individual volumes. For more information about basic and dynamic disks, see the Windows 2000 Server Resource Kit.
  • DiskProbe on Windows 95 and Windows 98
    DiskProbe runs under Windows 95 and Windows 98 but no physical drives are available. Windows 95 and Windows 98 use BIOS Interrupt 13 calls for disk access, and do not support the kernel mode calls necessary to access large physical drives. However, with Windows 95 and Windows 98 you can still open, edit, and save files as raw hex data.

Command prompt usage

Although it is a GUI tool, DiskProbe can also be run from the command prompt. Only the path and file name are supported as arguments, for example:

dskprobe c:\mydir\sector00.dsk

This example runs DiskProbe and opens Sector00.dsk in the c:\mydir folder.

After the program has been run, double-clicking a file with the .dsk extension will start DiskProbe and load the file.

Files required

  • Dskprobe.cnt
  • Dskprobe.exe
  • Dskprobe.hlp
  • Dskprtrb.doc
  • Mfc40.dll
  • Msvcrt40.dll

    • DiskProbe uses no configuration files. The only change it makes to the registry is to register the shell type and default file name extension (.dsk).


FileVer (Filever.exe)

This command-line tool examines the version resource structure of a file or a directory of files on either a local or remote computer and displays information on the versions of executable files such as .exe files and dynamic-link libraries DLLs.

FileVer is useful in determining the exact binary build of an installed component. Executable files typically have their file date and time modified to make them easy to identify as part of a major release; but hotfixes and Service Packs don't always follow this convention.

By identifying the actual version information, it is possible to track where a fix came from. This may be useful for customers who are requested by support personnel to identify hotfixes installed on their computers.

note-icon

Note

FileVer may not work against localized binaries.

FileVer syntax

File required

  • Filever.exe


Remote Storage Diagnostic Utility (Rsdiag.exe)

This command-line tool examines Remote Storage (HSM) databases and displays diagnostic information about jobs, managed volumes of the version of NTFS file system used in Windows 2000, removable media, and other Remote Storage information useful for system analysis. The Remote Storage Diagnostic Utility (RsDiag) can output each of the Remote Storage databases and property files in text format.

RsDiag works with the Remote Storage File Analysis Utility to help diagnose problems in the Remote Storage databases and, if necessary, recover lost data.

Remote Storage overview

Remote Storage makes it easy for you to extend disk space on your server computer without adding more hard disks. Remote Storage automatically copies eligible files on your local volumes to a tape library, then monitors the amount of space available on your local volumes.

File data is cached locally so that it can be accessed quickly as needed. When the amount of available space on a managed volume dips below the level you need, Remote Storage removes the content from the cached files, providing the disk space you need. When data is removed from a file, the disk space used by the file is reduced to zero. Data from cached files is not removed until more disk space is needed. When you need to open a file whose data has been removed, the data is recalled from remote storage.

Remote Storage Server

Remote Storage Server is a Windows 2000 storage management service designed to lower storage costs by trading latency for media cost. Based on established criteria, data can automatically be migrated from local volumes (primary storage) to a secondary type of directly attached storage, usually consisting of inexpensive media. Supported secondary storage in Windows 2000 includes jukeboxes of tape-based storage libraries.

When Remote Storage Server migrates files to secondary storage, it leaves a minimal attribute set, including an NTFS reparse point, on the primary storage so that migrated files can be recalled from secondary storage devices. The Windows 2000 graphical user interface (GUI) indicates that access to a remotely stored file incurs retrieval latency.

Remote Storage Server is beneficial in managing the cost associated with large quantities of data that must be accessible. It is one of several new features in Windows 2000 that are dedicated to lowering total cost of ownership associated with distributed computing.

RsDiag syntax

RsDiag database dump output

RsDiag job status output

RsDiag resource status output

RsDiag media status output

RsDiag version information output

Files required

  • Rsdiag.exe
  • Rstools.dll

For more information

For more information about Remote Storage Server, download the "Enterprise Class Storage in the Next Generation of Windows NT" document from the Microsoft Windows 2000 Server Web site.


Remote Storage File Analysis Utility (Rsdir.exe)

This command-line tool examines Remote Storage reparse points, displaying Remote Storage information for files in the current directory and its subdirectories. The Remote Storage File Analysis Utility (RsDir) displays information only for files located on volumes managed by Remote Storage.

RsDir works with the Remote Storage Diagnostic Utility to help diagnose problems in the Remote Storage databases and, if necessary, recover lost data.

Remote Storage overview

Remote Storage makes it easy for you to extend disk space on your server computer without adding more hard disks. Remote Storage automatically copies eligible files on your local volumes to a tape library, then monitors the amount of space available on your local volumes.

File data is cached locally so that it can be accessed quickly as needed. When the amount of available space on a managed volume dips below the level you need, Remote Storage automatically removes the content from the cached files, providing the disk space you need. When data is removed from a file, the disk space used by the file is reduced to zero. Data from cached files is not removed until more disk space is needed. When you need to open a file whose data has been removed, the data is automatically recalled from remote storage.

Remote Storage Server

Remote Storage Server is a Windows 2000 storage-management service designed to lower storage costs by trading latency for media cost. Based on established criteria, data can automatically be migrated from local volumes (primary storage) to a secondary type of directly attached storage, usually consisting of inexpensive media. Supported secondary storage in Windows 2000 includes jukeboxes of tape-based storage libraries.

When Remote Storage Server migrates files to secondary storage, it leaves a minimal attribute set, including a NTFS reparse point, on the primary storage so that migrated files can be recalled from secondary storage devices. The Windows 2000 graphical user interface (GUI) indicates that access to a remotely stored file incurs retrieval latency.

Remote Storage Server is beneficial in managing the cost associated with large quantities of data that must be accessible. It is one of several new features in Windows 2000 that are dedicated to lowering total cost of ownership associated with distributed computing.

RsDir syntax

RsDir output

RsDir examples

Files required

  • Rsdir.exe
  • Rstools.dll

For more information

For more information about Remote Storage Server, download the "Enterprise Class Storage in the Next Generation of Windows NT" document from the Microsoft Windows 2000 Server Web site.


WinDiff File and Directory Comparison (Windiff.exe)

WinDiff shows the differences between specified ASCII text files or folders of ASCII text files. This is particularly useful for program source code.

The display either shows a summary of the comparison status of a list of files (outline mode) or a detailed line-by-line comparison of one of the files (expanded mode).

You can run WinDiff like any other Windows-based application, using menu commands to choose files to compare and perform other actions. Or you can run WinDiff from the command prompt with switches.

WinDiff syntax

Comparing files with WinDiff

Running WinDiff with menu choices

File menu

Edit menu

Expand menu

View menu

Options menu

Outline mode display

Expanded mode display

Files required

  • Windiff.exe
  • Windiff.hlp
  • Gutils.dll


ADSI Edit

ADSI Edit is a Microsoft Management Console (MMC) snap-in that acts as a low-level editor for Active Directory. Using Active Directory Service Interfaces (ADSI), it provides a means to add, delete, and move objects within the directory services. The attributes of each object can be viewed, changed, and deleted.

ADSI Edit can also be useful for searching Active Directory. You can create a query and scope it to any level in the tree. The query is then created as a container which allows for continued browsing from the results and the results' children.

Caution

Adsiedit.msc (the MMC snap-in for ADSI Edit) automatically attempts to load the current domain to which the user is logged on. If the computer is installed in a workgroup or otherwise not logged onto a domain, an error that displays the message "The specified domain does not exist" will occur repeatedly.

To avoid problems in this situation, open Mmc.exe, add the ADSI Edit snap-in manually, make any connections that are appropriate for you with whatever credentials are necessary, and then save the console file. This gives you your own default console that works with ADSI Edit.

Files required

  • Adsiedit.dll
  • Adsiedit.msc

For more information

For more information about Active Directory, see the Active Directory page at the Microsoft Windows 2000 Server Web site.


DNS Server Troubleshooting Tool (Dnscmd.exe)

Dnscmd.exe is a command-line tool designed to assist administrators in Domain Name System (DNS) management.

DNScmd allows the administrator to view the properties of DNS servers, zones, and resource records. In addition DNScmd can be used to manually modify these properties, to create and delete zones and resource records, and to force replication events between DNS server physical memory and DNS databases and datafiles.

Note

DNScmd enhances the functionality of and replaces Dnsstat.exe, a tool included in versions of the Windows NT Resource Kit.

DNScmd syntax

DNScmd examples

File required

  • Dnscmd.exe


DsAcls (Dsacls.exe)

This tool facilitates management of access control lists (ACLs) for directory services. DsAcls enables you to query and manipulate security attributes on Active Directory objects. It is the command-line equivalent of the Security page on various Active Directory snap-in tools.

Along with Acldiag.exe: ACL Diagnostics, another Windows 2000 Support Tool, DsAcls provides security configuration and diagnosis functionality on Active Directory objects from the command prompt.

DsAcls syntax

Files required

  • Dsacls.exe

For more information

For more information about Active Directory, see the Active Directory page on the Microsoft Windows 2000 Server Web site.


DsaStat (Dsastat.exe)

This diagnostic tool compares and detects differences between naming contexts on domain controllers.

DsaStat can be used to compare two directory trees across replicas within the same domain or, in the case of a Global Catalog, across different domains. The tool retrieves capacity statistics such as megabytes per server, objects per server, and megabytes per object class, and performs comparisons of attributes of replicated objects.

The user specifies the targeted domain controllers and additional operational parameters from the command line or from an initialization file. DsaStat determines whether domain controllers in a domain have a consistent and accurate image of their own domain. In the case of Global Catalogs, DsaStat checks to see if the Global Catalog has a consistent image with domain controllers in other domains. As a complement to the replication-monitoring tools, Repadmin.exe and Replmon.exe: Active Directory Replication Monitor, DsaStat can be used to ensure that domain controllers are up to date with one another.

DsaStat syntax

DsaStat examples

File required

  • Dsastat.exe

For more information

For more information about Active Directory, see the Active Directory page on the Microsoft Windows 2000 Server Web site.


Kerberos Setup (Ksetup.exe)

KSetup is a command-line tool that configures Windows 2000 clients, either Server or Professional, to use an MIT Kerberos server.

The Windows 2000 client then uses an MIT-based Kerberos realm instead of a Windows 2000 domain. This provides a single sign-on to the MIT Key Distribution Center (KDC) and a local Windows 2000 client account.

KSetup is part of a group of tools, including KTpass and Trustdom, a tool included in the Microsoft® Windows® 2000 Resource Kit, that are used to configure Windows 2000 for MIT Kerberos interoperability.

KSetup is used to change the computer settings for locating MIT Kerberos realms. In MIT Kerberos based implementations this information is usually kept in the krb5.conf file. In Windows 2000 it is kept in the registry. This tools allows you to modify these setting. These settings are used by workstations to locate non-Windows Kerberos realms and by domain controllers to locate MIT Kerberos realms for cross-realm trust relationships.

KSetup initializes registry keys that the Kerberos Security Provider (KSP) uses to locate an MIT Kerberos Key Distribution Center (KDC) if the Windows 2000 computer is not a member of a Windows domain. After configuration, the Windows 2000 user can log on to accounts in the Kerberos realm.

The Kerberos v5 authentication protocol is the default for network authentication on computers with Windows 2000. Computers running Windows 2000 can participate in Kerberos realms that are not Windows 2000 domains. In this case, the KDC will not be on a Windows 2000 domain controller, so the DNS names for KDC servers must be stored in the client computer's registry. The Kerberos Security Support Provider (SSP) looks in the registry for the DNS domain name of the user's realm, and then resolves the name to an IP address by querying a DNS server.

Administrators can use KSetup to:

  • Set up a realm entry for an MIT Kerberos realm
    • Set up a list of KDCs for that realm
    • Set up a kpasswd server for that realm
  • Set up local account to Kerberos account mappings
  • Set the computer's password
  • Change a user's password in an MIT Kerberos realm

Note

  • Windows 2000 computers configured to use the Kerberos KDC are not members of a Windows NT domain.

KSetup syntax

KSetup examples

File required

  • Ksetup.exe

For more information

For more information about the Kerberos interoperability features of Windows 2000, see the Windows 2000 Server Security Services Web site and see the MIT Kerberos 5 (krb5 1.0) Interoperability document.


Kerberos Keytab Setup (Ktpass.exe)

KtPass is a command line configuration tool used to generate Kerberos keytab files, and set password and account name mappings for UNIX services that will use the Windows 2000 Kerberos Key Distribution Center (KDC). It is part of a group of tools, including KSetup and Trustdom, a tool included in the Microsoft® Windows® 2000 Resource Kit, that are used to configure Windows 2000 for MIT Kerberos interoperability.

Using this tool, an Administrator can configure a non-Windows 2000 Kerberos service as a security principal in the Windows 2000 Active Directory. KtPass configures the server principal name for the host or service in Active Directory™ and generates an MIT-style Kerberos "keytab "file containing the service’s shared secret key. The tool allows UNIX-based services that support Kerberos authentication to use the interoperability features provided by the Windows 2000 Kerberos KDC service.

Note

  • The keytab output file is used to replace or merge with the MIT Kerberos /etc/krb5.keytab file. MIT Kerberos-based services (non-interactive) use the keytab to log on and utilize Kerberos services.

KtPass syntax

KtPass examples

File required

  • Ktpass.exe

For more information

For more information about the Kerberos interoperability features of Windows 2000, see the Windows 2000 Server Security Services Web site and the MIT Kerberos 5 (krb5 1.0) Interoperability document.


Active Directory Administration Tool (Ldp.exe)

Ldp is a graphical tool that allows users to perform Lightweight Directory Access Protocol (LDAP) operations, such as connect, bind, search, modify, add, and delete, against any LDAP-compatible directory, such as Active Directory. LDAP is an Internet-standard wire protocol used by Active Directory.

In troubleshooting, Ldp can be used by administrators to view objects stored in Active Directory along with their metadata, such as security descriptors and replication metadata.

Files required

  • Ldp.doc
  • Ldp.exe

For more information

For more information about deploying and using Active Directory, visit the Microsoft Windows 2000 Server Web site.


Active Directory Object Manager (Movetree.exe)

The Active Directory Object Manager (MoveTree) is a command-line tool that allows administrators to move Active Directory objects such as organizational units and users between domains in a single forest. These types of operations would be performed to support domain consolidation or organizational restructuring operations.

MoveTree allows an organizational unit to be moved with all of the linked Group Policy objects in the old domain intact. The Group Policy object link is moved and continues to work, though clients receive their Group Policy settings from the Group Policy objects located in the old domain. In order to maintain peak performance, prior to executing the MoveTree command review all Group Policy objects that apply to a particular organizational unit, and note the Group Policy settings they contain. Then recreate those Group Policy objects, linked to the moved organizational unit in the new domain, with the desired settings. Make sure to remove the Group Policy objects linked from the old domain.

If during a MoveTree operation the process is paused or halted, any objects that have yet to be moved remain in an orphan container in the Lost And Found container in the source domain. The Lost And Found container can be viewed in the Active Directory Users and Computers snap-in (a Windows 2000 administrative tool) when the Advanced View menu option is selected. The orphan container is named using the globally unique identifier (GUID) of the parent container being moved and can be readily identified, as it will contain the objects that were selected for the MoveTree operation. For example, if an organizational unit called "Sales" was being moved, and it has an object GUID of {123-abc}, then if the MoveTree operation were halted, the tree structure would look like this:

Lost + Found
         {123-abc}
               Sales

MoveTree limitations

While MoveTree can move some Active Directory objects between domains, certain objects cannot be moved. There may also be associated data that exists externally to Active Directory that also cannot be moved between domains.

Local and Domain Global groups are not moved during a MoveTree operation. During a MoveTree operation, all security principals (user accounts, groups, and so on) maintain their security identity. This means that resources that were previously protected with ACLs do not have to have these ACLs reset. Provided that user and group memberships are maintained, security of access to resources is also maintained.

Universal groups are moved intact during a MoveTree operation. However, because of group membership rules, only empty Domain Local and Global groups can be moved. Therefore it is important to save and recreate the memberships of Domain Local and Global groups to maintain the existing resource access permissions.

Computer objects are not moved during a MoveTree operation. Use Netdom, another Windows 2000 Support Tool, to move computer accounts between domains and to join computers to domains.

Associated data that is not moved during a MoveTree operation includes policies, profiles, logon scripts, and users' personal data. Use additional scripts or management tools, such as the Remote Administration Scripts (included in the Windows 2000 Resource Kit), in conjunction with MoveTree to perform these additional steps.

The following objects cannot be moved:

  • system objects (identified by the objectClass being marked as systemOnly)
  • objects in the configuration or schema naming contexts
  • objects in the the special containers in the domain: Builtin, ForeignSecurityPrincipal, System, LostAndFound
  • domain controllers or any object whose parent is a domain controller
  • any object with the same name as an object that already exists in the target domain

Movetree may fail due to some of the following error conditions:

  • The source domain controller cannot transfer the RID role owner.
  • The source object is locked due to another operation in progress (for example, if another user is currently creating child objects under the source object that is selected for the move operation).
  • Either the source or destination domain have invalid credentials.
  • The destination knows the source object is deleted but the source does not (for example, the source object had been deleted on a different domain controller, but due to replication latency the source domain controller has not yet received the deletion event).
  • There is a failure at the destination domain controller (for example, Disk Full).
  • A Security Accounts Manager (SAM) constraint is met (for example, Duplicate SAM Account Name or source object password length does not meet the password restrictions in the target domain).
  • The source and destination have a schema mismatch.

MoveTree and ClonePrincipal

MoveTree performs tasks related to those performed by another Windows 2000 Support Tool, ClonePrincipal, with the following differences:

  • MoveTree is exclusively intra-forest; it moves security principals within the same forest only. ClonePrincipal is exclusively inter-forest; it copies security principals between forests only. This means that MoveTree relies on a Windows 2000 source domain, while for ClonePrincipal, the source domain can be Windows NT 4.0 or Windows 2000 (mixed or native mode).
  • MoveTree moves objects, which means that the operations it performs destroy objects in the source domain. ClonePrincipal duplicates objects from the source domain in the target domain rather than moving them to it, so the source domain is unaffected. Both however, add the old security identitifier (SID) to SIDHistory.
  • Movetree maintains users' existing passwords, while ClonePrincipal does not.
  • Movetree maintains the object’s GUID, while ClonePrincipal does not.

To move users or groups within a Windows 2000 domain (for example, from one organizational unit to another), use Active Directory Users and Computers, a Microsoft Management Console snap-in that is part of the Windows 2000 operating system.

Detailed background on the processes and choices involved in migrating domains from Windows NT to Windows 2000 can be found in Planning Migration from Microsoft Windows NT to Microsoft Windows 2000 (Dommig.doc).

MoveTree syntax

MoveTree examples

Files required

  • Movetree.dll
  • Movetree.exe

For more information

For more information about Active Directory, visit the Active Directory page on the Microsoft Windows 2000 Server Web site.


Windows 2000 Domain Manager (Netdom.exe)

This tool enables administrators to manage Windows 2000 domains and trust relationships from the command line.

Use NetDom to:

  • Join a Windows 2000 computer to a Windows NT 4.0 or Windows 2000 domain, and:
    • Provide an option to specify the organizational unit for the computer account.
    • Generate a random computer password for initial join.
  • Manage computer accounts for domain member workstations and member servers:
    • Add, Remove, Query.
    • Provide an option to specify the organizational unit for the computer account.
    • Provide an option to move an existing computer account for a member workstation from one domain to another and maintain the security descriptor on the computer account.
  • Establish (one or two-way) trust relationships between domains, including the following kinds of trust relationships:
    • from a Windows 2000 domain to an Windows NT 4.0 domain.
    • from a Windows 2000 domain to a Windows 2000 domain in another enterprise (an "uplevel" external trust).
    • between two W2K domains in an enterprise (a shortcut trust).
    • the Windows 2000 half of an interoperable Kerberos realm.
  • Verify and\or reset the secure channel for the following configurations:
    • Member Workstations and Servers
    • BDCs in a Windows NT 4.0 domain
    • Specific Windows 2000 replicas
  • Manage trust relationships between domains
    • View all trust relationships
    • Enumerate direct trust relationships
    • Enumerate all (direct and indirect) trust relationships

NetDom syntax

NetDom examples

File required

  • Netdom.exe


NlTest (Nltest.exe)

This command-line tool helps perform network administrative tasks such as:

  • getting a list of primary domain controllers (PDCs)
  • forcing a shutdown
  • querying and checking on the status of trust
  • testing trust relationships and the state of domain controller (DC) replication in a Windows domain
  • forcing a user-account database into sync on Windows NT 4.0 or earlier domain controllers (Windows 2000 domain controllers use a completely different mechanism for maintaining user accounts)

When the word "trust" is used in the context of Windows, it describes a relationship between two Windows domains. Each domain involved has either the role of being the trusting domain, or the trusted domain. For any given trust relationship, there is a single discreet communication channel between each domain controller in the trusting domain, and a domain controller in the trusted domain.

For example, if domain "A" trusts domain "B", then "B" is the trusted domain, and "A" is the trusting domain. In a another example suppose domain "I" trusts domain "J", and domain "J" trusts domain "I". In this example there are two distinct trust relationships between their domain controllers. Often this is called the "complete trust" mode, or a 2-way trust. Yet for secure channel diagnosis, it is best to think of these as two separate secure channels, between each domain controller in the trusting domain, and a domain controller in the trusted domain.

Trust relationships are not transitive. For example, suppose domain "X "trusts domain "Y" which in turn trusts domain "Z". This does not imply domain "X" trusts domain "Z". The reason for this is the administrator in each domain must grant explicit permission on either side of the trust relationship for it to take place.

Another form of trust relationship is sometimes referred to as an "implicit" trust. In a single domain model or in an environment where there are no "explicit" trust relationships between any two domains, the implicit trust relationship is active and functionally needed. This implicit trust exists between all Windows computers that are members of a domain and a domain controller in their domain. Explicit trust relationships are established through User Manager For Domains. Implicit trust relationships are established by becoming a member of a domain.

NlTest can be used to test the trust relationship between a Windows computer that is a member of a domain and a domain controller where its computer account resides. NlTest can also verify the trust between the BDCs in a domain and their PDC. In domains where an explicit trust has been defined, NlTest can test the trust relationship between all domain controllers in the trusting domain and a domain controller in the trusted domain.

These sessions of communication are called Secure Channels and are used to authenticate Windows computer accounts. They also are used to authenticate User Accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called Pass-Through Authentication, and it allows a Windows computer that has joined a domain to have access to the User Account Database in its domain and in any trusted domains.

For Windows 2000, NlTest no longer uses the Browser Service to enumerate domain controllers. Rather, the /dclist otpion calls the DsGetDomainControllerInfo API to get the list from the directory service.

All of these trust relationships, and domain synchronization can be monitored, tested, and verified by NlTest.

NlTest syntax

NlTest examples for Windows NT 4.0

NlTest examples for Windows 2000

File required

  • Nltest.exe


Remote Command Line (Remote.exe)

Remote allows you to run command-line programs on remote computers.

For example, when you are developing software, you can compile code with the processor and resources of a remote computer while you perform other tasks on your computer. You can also use Remote to distribute the processing requirements for a particular task across several computers.

To use Remote, first start the server end (by running remote /s) on the computer where you want to run the selected program. Next, connect to the server end from another computer (by running remote /c).

Remote does no security authorization, and will permit anyone with a remote client (remote /c) to connect to your remote server (remote /s). This leaves the account under which the remote server was run open to anyone who connects. By contrast, Rcmd.exe: Remote Command Service, a tool from the Microsoft® Windows® 2000 Resource Kits, authenticates all users with standard Windows 2000 user authentication procedures.

Note

  • Remote cannot be used to control graphical Windows-based applications.

Starting the server end of Remote

Starting the client end of Remote

Exiting Remote on the server computer

Exiting Remote on the client computer

Remote server example

Remote client example

Remote limitations

File required

  • Remote.exe


Replication Diagnostics Tool (Repadmin.exe)

This command-line tool assists administrators in diagnosing replication problems between Windows 2000 domain controllers.

During normal operation, the Knowledge Consistency Checker (KCC) manages the replication topology for each naming context held on domain controllers.

The Replicaton Diagnostics Tool (RepAdmin) allows the administrator to view the replication topology (sometimes referred to as RepsFrom and RepsTo) as seen from the perspective of each domain controller. In addition, RepAdmin can be used to manually create the replication topology (although in normal practice this should not be necessary), to force replication events between domain controllers and to view both the replication metadata and up-to-datedness vectors.

Note

  • During the normal course of operations, there is no need to manually create the replication topology. Incorrect use of this tool may adversely impact the replication topology. The primary use of this tool is to monitor replication so that problems such as offline servers or unavailable LAN/WAN connections can be identified.

RepAdmin syntax

RepAdmin examples

File required

  • Repadmin.exe

For more information

For information about Active Directory, see the Active Directory page on the Microsoft Windows 2000 Server Web site.


Active Directory Replication Monitor (Replmon.exe)

This tool enables administrators to view the low-level status of Active Directory replication, force synchronization between domain controllers, view the topology in a graphical format, and monitor the status and performance of domain controller replication through a graphical interface.

The tool works as a client of a COM object. You can use it to create your own applications or scripts written in Visual Basic Scripting Edition (VBScripts) to extract specific data out of Active Directory and act on it. For example, it also includes functions which are wrapped APIs to make it easy to script replication between domain controllers with just a few lines of VBScript code.

Iadstools.doc, included with the tool, provides information on calling functions in the IADsTools ActiveX DLL from a script.

Active Directory Replication Monitor features

ReplMon:

  • Displays whether or not the monitored server is a Global Catalog server, automatically discovers the directory partitions that the monitored server hosts, graphically displays this breakdown and shows the replication partners that are used for inbound replication for each directory partition. ReplMon distinguishes between direct replication partners, transitive replication partners, bridgehead servers, and servers removed from the network in the user interface. When a failure from a specific replication partner, this is reflected by a change in the icon used for the partner.
  • Records the history of replication status per-directory partition per-replication partner, allowing a granular history to be generated for what occurred between two domain controllers. This history can be viewed through ReplMon's user interface or can be viewed offline or remotely through a text editor.
  • For direct replication partners, a series of property pages displays the following for each partner: the name of the domain controller, its Globally Unique Identifier (GUID), the directory partition that it replicates to the monitored server, the transport used (RPC or SMTP and distinguishes between intra- and inter-site when Remote Procedure Call (RPC) is used), the time of the last successful and attempted replication events, Update Sequence Number (USN) values, and any special properties of the connection between the two servers.
  • Allows the administrator to generate a status report for the monitored server which includes: a listing of the directory partitions for the server, the status of each replication partners (direct and transitive) for each of the directory partitions, detail on which domain controllers the monitored server notifies when changes have been recorded, the status of any Group Policy objects, the domain controllers which hold the Flexible Single Master Operations (FSMO) roles, a snapshot of the performance counters on the computer, and the registry configuration of the server (including parameters for the Knowledge Consistency Checker (KCC), Active Directory, JET, and Lightweight Directory Access Protocol (LDAP). Additionally, the administrator can also choose to record (in the same report), the enterprise configuration which includes: each site, site link, site link bridge, subnet, and domain controller (regardless of domain) and the properties of each type of object just mentioned. For example, for the domain controller properties, this records the GUID that makes up the Domain Name System (DNS) record that is used in replication, the location of the computer account in Active Directory, the Inter-Site mail address (if it exists), the host name of the computer, and any special flags for the server (whether or not it is a Global Catalog server). This can be extremely helpful when troubleshooting an Active Directory replication problem.
  • Offers a Server wizard so that administrators can either browse for the server to monitor or explicitly enter it. The administrator can also create an .ini file which pre-defines the names of the servers to monitor which is then loaded by ReplMon to populate the user interface.
  • Displays a graphical view of the intra-site topology and, by using the context menu for a given domain controller in the view, allows the administrator to quickly display the properties of the server and any intra-site and inter-site connections that exist for that server.
  • Allows administrator to display the properties for the monitored server including: the server name, the Domain Name System (DNS) host name of the computer, the location of the computer account in Active Directory, preferred bridgehead status, any special flags for the server (for example, if it is the PDC Emulator for its domain or not), which computers it believes to hold the FSMO roles, the replication connections (ReplMon differentiates between administrator and automatically generated connection objects) and the reasons they were created, and the IP configuration of the monitored server.
  • In Automatic Update Mode, polls the server at an administrator-defined interval to get current statistics and replication state. This feature generates a history of changes for each monitored server and its replication partners and allows the administrator to see topology changes as they occur for each monitored server. In this mode, ReplMon also monitors the count of failed replication attempts for each replication partner. If the failure count meets or exceeds an administrator-defined value, it can write to the event log and send an e-mail notification to the administrator.
  • Allows administrators to trigger replication on a server with a specific replication partner, with all other domain controllers in the site, or all other domain controllers intra- and inter-site (replication partners are established by the data that they hold - not all domain controllers will be involved in this process depending on the domain controller being synchronized).
  • Allows administrators to trigger the Knowledge Consistency Checker on the monitored server to re-calculate the replication topology.
  • Allows administrators to display, on-demand, the Active Directory changes that have not yet replicated from a given replication partner.
  • Supports a mode that records the attributes that were replicated to the monitored server from its replication partners.
  • Allows administrators to display a list of the trust relationships maintained by the domain controller being monitored.
  • Can displays the metadata of an Active Directory objects' attributes which include: the attribute name, version number, the time the attribute was last changed, which domain controller last changed the attribute, and the USN on the monitored server and on the computer where the change was originally written.
  • Optionally logs all of its own activity.
  • Supports supplying alternate credentials to allow ReplMon to simultaneously monitor replication status of domain controllers from multiple forests.

Requirements

Active Directory Replication Monitor must be installed on a computer running Windows 2000 Professional or Server. The computer can be a domain controller, member server, member workstation, or standalone computer. In addition, ReplMon can be used to monitor domain controllers from different forests simultaneously.

Note

  • When installing ReplMon on localized builds of Windows 2000, the required Visual Basic controls may fail to register. This happens only if the Windows 2000 Support Tools are installed into a directory that contains extended characters. If this occurs, the work-around is to uninstall the Support Tools and then to install them into the default folder, \Program Files\Support Tools.

Using Active Directory Replication Monitor

Troubleshooting With Active Directory Replication Monitor

Files required

  • Comctl32.ocx
  • Comdlg32.ocx
  • Ctl3d32.dll
  • Iadstools.dll – component dynamic-link library (DLL) that hosts the functions used by Active Directory Replication Monitor (COM Object)
  • Iadstools.doc - documentation for IADsTools
  • Replmon.exe – main executable for Active Directory Replication Monitor (Visual Basic 5.0)
  • Tabctl32.ocx

For more information

For more information about deploying and using Active Directory, see the Microsoft Windows 2000 Server Web site.


Security Descriptor Check Utility (Sdcheck.exe)

This command-line tool displays the security descriptor for any object stored in Active Directory. The security descriptor contains the access-control lists (ACLs) defining the permissions that users have on objects stored in Active Directory.

To enable administrators to determine the effective access controls on an object, the Security Descriptor Check Utility (SDCheck) also displays the object hierarchy and any ACLs that are inherited by the object from its parent.

As changes are made to the ACLs of an object or its parent, these changes are propagated automatically by the Active Directory. SDCheck displays the security descriptor propagation metadata, so that administrators can monitor these changes with respect to propagation of inherited ACLs as well as replication of ACLs from other domain controllers.

As a complement to the replication monitoring tools (Repadmin.exe and Replmon.exe), SDCheck can be used to ensure that domain controllers are up-to-date with one another.

SDCheck syntax

SDCheck examples

File required

  • Sdcheck.exe


Active Directory Search Tool (Search.vbs)

This VBScript tool performs a search against an Lightweight Directory Access Protocol (LDAP) server. It can be used by an administrator or any user who wants to get information from Active Directory.

All search criteria are taken from the command line. However, certain properties of the search, such as the page size, can only be changed by modifying variable values in the script.

Search.vbs requires Windows Script Host (WSH). For WSH downloads, updates, and information, visit the Microsoft Windows Script Technologies Web site.

Active Directory Search Tool syntax

Active Directory Search Tool example


Winsock Remote Console (Wsremote.exe)

The Winsock Remote Console provides the ability to start a console application on the server and connect to it from the client using sockets or named pipes. This is an enhancement over Remote Command Line (Remote.exe), which allows only named-pipes connections.

Features of Winsock Remote Console

  • Enables you to choose the name of the named pipe or the TCP/IP port on which you would like to start the Winsock Remote Console server.
  • Protects your Winsock Remote Console server by requiring a user name and password before accepting a connection from a sockets client.
  • Temporarily prevents any sockets connections to the Winsock Remote Console server by locking the server from the server console.
  • Enables you to remotely bind a Winsock Remote Console server's port to a proxy server running Microsoft Proxy Server 2.0.

Caution

Running a Winsock Remote Console server on the Internet creates a TCP/IP socket server that might be accessible to any Internet user. It is recommended that you choose a random TCP/IP port and use a user name and password for any Winsock Remote Console session that runs on the Internet. If clients other than Winsock Remote Console clients try to connect to a Winsock Remote Console session, you will see the following on your console screen.

   CONNECT on socket: 216
   FROM ip: 10.20.20.20
   Auth: Bad Username or Password

If you see this on a Winsock Remote Console console that was left unattended, it is strongly recommended that you determine the origin of this request.

Winsock Remote Console System Requirements

Starting the Winsock Remote Console Server

Connecting the Client to the Winsock Remote Console Server (TCP/IP)

Connecting the Client to the Winsock Remote Console Server (Named Pipes)

Stopping the Winsock Remote Console Server (TCP/IP)

Unlocking the Server Console

Disconnecting the Winsock Remote Console Client (Server Running)

Winsock Remote Console Server Syntax

Winsock Remote Console Client Syntax

Files Required

  • Wsremote.exe

For more information

More information about the Server Proxy feature of Microsoft Proxy Server 2.0 can be found at the Microsoft Proxy Server Web site


Process Resource Monitor (Pmon.exe)

Process Resource Monitor (PMon) is a command-line tool that monitors process resource usage by tracking CPU and memory usage.

Pmon can be used to measure paged and non-paged pool usage and can be helpful in identifying kernel mode memory leaks.

PMon also provides a keyboard interface. Use the UP ARROW and DOWN ARROW keys to scroll up and down the list of currently running processes. Use ESC or q to quit PMon. Use any other key to have PMon refresh its display immediately.

To run PMon

One Step At the command prompt, type:

pmon

To quit PMon

One Step Press CTRL+C or click Close on the window menu of the command-prompt window.

PMon output format

PMon notes

File required

  • Pmon.exe


Process Viewer (Pviewer.exe)

Process Viewer is a Windows-based tool that displays information about a running process and allows you to stop (kill) processes and change process priority.

Note

  • Process Viewer is similar to Pview.exe, but also allows you to look at processes on remote computers.

Details of the Process Viewer screen

File required

  • Pviewer.exe


Glossary of terms

This page requires a browser capable of displaying frames.


AclDiag Output

The output format of AclDiag takes different forms according to the option with which it is run.

Security diagnosis

acldiag "DC=microsoft,DC=com"

Security Diagnosis for DC=microsoft,DC=com
Description

    Owner: {User | Group}

    [This object is configured to not inherit permissions from parent.]
    Permissions effective on the object:

        * {Deny | Allow {User | Group} Permission.
          (Inherited permission from appropriate parent object distinguished name)
      * ...

    Permissions inherited by subobjects:

        Inherit to All Subobjects:

            * {Deny | Allow {User | Group} Permission.
              (Inherited permission from appropriate parent object distinguished name)
            * ...

        Inherit to SubObject Type objects only:

            * {Deny | Allow {User | Group} Permission.
              (Inherited permission from appropriate parent object distinguished name)
            * ...

        ...

    [This object is configured to not inherit permissions from parent.]
    Auditing effective on this object:

        * Audit {Successful | Failed} Permissions
          attempts by {User | Group}.
        * ...

    Auditing inherited to sub objects:

        Inherit to all sub objects:

            * Audit {Successful | Failed} Permissions
              attempts by {User | Group}.
            * ...

        Inherit to subobject type only:

            * Audit {Successful | Failed} Permissions
              attempts by {User | Group}.
            * ...

Schema defaults diagnosis

acldiag "DC=microsoft,DC=com" /schema

Schema Defaults Diagnosis

    Schema defaults: {PRESENT | ABSENT | PARTIAL}
    Obtained       : {At CREATION | By INHERITANCE}

Delegation templates diagnosis

acldiag "DC=microsoft,DC=com" /chkdeleg

    Delegation Template 1 Description

            Status: {OK | NOT PRESENT/MISCONFIGURED}
            Applies on this object: {YES | NO}
            Inherited from parent : {YES | NO}

    Delegation Template 2 Description

    ...

Effective rights diagnosis

acldiag "DC=microsoft,DC=com" /geteffective:{User | Group}

    {User | Group} 1:
        Can Read {All | PropertyList} properties. (via Group membership)
        Can Write {All | PropertyList} properties. (via Group membership)
        Can Create {All | ObjectList} objects. (via Group membership)
        Can Delete {All | ObjectList} objects. (via Group membership)
        Can Delete this object. (via Group membership)
        Can Delete entire subtree. (via Group membership)
        Can List subobjects. (via Group membership)
        Can Read permissions. (via Group membership)
        Can Modify permissions. (via Group membership)
        Can Take/Change ownership. (via Group membership)

    {User | Group} 2:
        ...

AclDiag syntax

ACL Diagnostics (acldiag.exe)


AclDiag Syntax

acldiag "ObjectDN" [/chkdeleg] [/fixdeleg] [/geteffective:{User | Group}] [/schema] [/skip] [/tdo]

Parameters

ObjectDN
Specifies the distinguished name of a valid Active Directory object. Must be enclosed in quotation marks.
/chkdeleg
Checks whether the security on the object includes any of the delegation templates currently in use by the Delegation of Control wizard in the Active Directory Users and Computers snap-in, a Windows 2000 administrative tool.
/fixdeleg
Causes the tool to fix any delegations that have been applied to the object by the Delegation of Control wizard.
/geteffective:{user | group}
Prints out permissions of the specified user or group in a readable format. If you specify "*" for user or group, it prints the effective rights of all users and groups that show up on the access control list (ACL).
/schema
Checks whether the security on the object includes schema defaults.
/skip
Does not display the security description.
/tdo
Writes tab-delimited output instead of readable format. This is useful when the loading the information into databases or spreadsheets.

Example

To display all access permissions including any schema defaults on the microsoft.com domain:

C:\>acldiag "DC=microsoft,DC=com" /schema

AclDiag output

ACL Diagnostics (acldiag.exe)


ApmStat Syntax

apmstat [-v] [-?]

Parameters

apmstat
Without arguments, displays a basic report on Advanced Power Management status on the local computer.
-v
Displays a verbose report with more data about APM BIOS versions, address, and setup codes from the system description of the hardware tree in the registry, as entered by Ntdetect.com (Startup Hardware Detector).
-?
Displays this syntax listing.

Using Advanced Power Management on Windows 2000

Advanced Power Management Status (apmstat.exe)


Using Advanced Power Management in Windows 2000

Advanced Power Management (APM) is an older power management scheme based on an SMI/SMM (hidden hardware) BIOS approach. In APM, most of the functionality is in a computer-specific BIOS that is hidden from the operating system. APM was first widely supported on Windows 95.

Advanced Configuration and Power Interface (ACPI) is the new scheme for power management supported on Windows 98 and Windows 2000. Many computers support both APM and ACPI.

APM on Windows 2000 is intended primarily to support older notebook computers, although it can run on desktop computers. In general, it is preferable to disable APM on desktop computers.

On Windows 2000, APM supports only battery status, suspend, resume, and hibernate. Timer wakeup, wake on LAN, wake on ring, and other APM features are not supported.

APM and ACPI

ACPI should always be used if a computer has a working ACPI BIOS. Some useful features (timed wakeups, for example) are only available through ACPI on Windows 2000.

If no ACPI BIOS is available or if it doesn't work well, it might be better to use APM.

APM on desktop computers

In general, APM should be avoided on desktop computers because third-party video cards or other add-in cards might cause problems. There are some computers on which the APM BIOS causes instability all by itself. Both APM support (Ntapm.sys) in the Windows 2000 operating system and the APM BIOS itself should be turned off on such computers. Other computers, though, may be more reliable under Windows 2000 with APM support turned on, for example, those that have an APM BIOS that cannot be disabled.

Caution

APM should not be run on any computer that could be made unstable by it, because an unstable APM BIOS might cause loss of data.

Key components of APM

  • APM BIOS
    Placed in ROM or flash by the OEM. Does most of the work of powering things on and off, but is invisible to the operating system. The APM BIOS must be turned on for APM to work. If it is unstable, it might be necessary to turn the APM BIOS off in a hardware configuration screen, in addition to turning off Windows 2000 APM support. Timeouts in the APM BIOS should be off, or set as long as possible, so that the operating system rather than the APM BIOS can time things out. The APM BIOS is replaced by ACPI.
  • Ntdetect.com (Startup Hardware Detector)
    This operating system component searches to see if APM BIOS is present, and whether it is usable. It reports what it learns in the registry.
  • NtLdr
    Does a restart of APM on resume from hibernate, if APM was active before the hibernate.
  • Ntapm.sys
    The device driver that hooks the system and the APM BIOS together. Some system operations end up here for dispatch to the APM BIOS. APM BIOS events and status are polled from here. Note that when the APM BIOS presents an event (for example to suspend or power off) Ntapm.sys catches this, and then does an NtInitiatePowerAction call, which tells the operating system to perform an operation. At the very end, the power manager calls into the Hardware Abstraction Layer (HAL) which calls back into Ntapm.sys which in turn calls the APM BIOS. So, almost all of the power code in the operating system and driver stacks is the same between APM and ACPI.
  • Hal.dll
  • Apmbatt.sys
    Simulates a battery unit so the system battery status code can work.
  • Power Options control panel program
    Allows the user to enable or disable APM support on his or her computer. This is the preferred way (and the only supported way) to turn operating system APM support on or off.
  • Biosinfo.inf
    Lists computers on the auto-enable list and the disable list, and the BIOS detection sequences used to match them.

User interface elements of APM

  • The control panel includes a Power Options program. If APM is installed (enabled or disabled) there will be an APM tab in this program. You can turn APM on and off by selecting the box in this tab. This is the only recommended and supported way to turn APM off. Turning APM on is Plug and Play and on the fly, turning it off requires a reboot. If the tab is absent, the computer is either an ACPI computer or an APM-disabled computer.
  • If APM is turned on, there is a Stand by option under Shutdown in the logon dialog box invoked with CTRL-ALT-DELETE. There might also be a hibernate entry, but that is not related. (Hibernate can work even if neither APM nor ACPI are present.) Standby under APM has the same use as under ACPI.
  • If the battery display is turned on in the Power Options program of Control Panel, a battery status icon appears, and it works similarly to ACPI. Note that APM computers always report a single composite battery, regardless of how many are present. (The unified/composite number is used because this is thought to be more reliable on a wide range of APM BIOSs, and it is simpler.)
  • On most APM computers, pressing the power button or sleep button can put the computer on standby (suspend). Most computers require pressing the power button to resume, although some resume with a keyboard touch. Windows 2000 APM does not support custom power buttons.

Troubleshooting APM

  1. If the computer is a desktop computer, it is unlikely that it will run APM well. But you can get most of the value of APM by using hibernate, which requires neither APM nor ACPI to work.
  2. If the computer is a laptop or a desktop that must run APM, make sure the user has APM turned on, hibernate turned on, and the battery icon turned on.
  3. Make sure that the APM BIOS screen blanking is off, this will often make the system seem to behave badly when all that is wrong is that the screen is black. (Use a screen saver of BLANK to get the right effect.)
  4. Run Apmstat.exe. Its output will often reveal a common problem, such as trying to run APM on an multi-processor computer, for example.
  5. If Windows 2000 APM has been turned off, and the computer is still unstable, try turning off the APM BIOS itself in the computer's setup screen. Some computers work better with Windows 2000 APM turned on, since this puts them more in sync with their APM BIOSs.

While troubleshooting, keep in mind the following considerations:

  • Virtually all APM computers have some sort of computer setup/configuration screen, usually invoked at boot by pressing ESC, DEL, F1, F2, or F10. If you can get access to these screens, you can often improve system behavior by changing or disabling APM options.
  • Some APM BIOSs turn themselves off if you disable all their timers; in this case, it is best to set them all to some long timeout value.
  • Some APM BIOSs refuse to suspend if the kernel debugger is active on one of their COM ports.
  • Event Log
    If an APM_SETPOWER call fails (that is, a standby/suspend fails at the APM BIOS interface), Ntapm.sys writes a record into the system event log, and produces data that reports what happened in addition to the error code the APM BIOS returned. This information is sometimes helpful in determining if the computer refused to suspend due to activity (that the user isn't aware of) on a port.

ApmStat syntax

Advanced Power Management Status (Apmstat.exe)


Application Compatibility syntax

apcompat [-?] [-v version name] [-x program path] [-d] [-t] [-g] [-k]

Parameters

-?
Displays the syntax for the command line parameters.
-v version name
Specifies the name of the operating system you want to return to the specified program.
1
Returns the version WindowsNT4 SP3.
2
Returns the version WindowsNT4 SP4.
3
Returns the version WindowsNT4 SP5.
4
Returns the version Windows98.
5
Returns the version Windows95.
-x program path
Specifies the path and name of the executable (.exe) file for the program you want to run.
-d
Disables the Heap Manager for the portion of memory reserved for the specified program.
-t
Uses \Temp for the Temp folder when running the specified program.
-g
Corrects disk space detection.
-k
Stores the specified Application Compatibility settings.

Application Compatibility (Apcompat.exe)


Windows 2000 Support Tools: Alphabetical list of Tools

 Hold the cursor over the name of a tool for a brief description.

A

Acldiag.exe

Adsiedit.msc

Apcompat.exe

Apmstat.exe

B

Browstat.exe

C

Clonepr.dll

D

Dcdiag.exe

Depends.exe

Dfsutil.exe

Dnscmd.exe

Dommig.doc

Dsacls.exe

Dsastat.exe

Dskprobe.exe

Dumpchk.exe

E

No entries

F

Filever.exe

G

Gflags.exe

H, I, J

No entries

K

Kill.exe

Ksetup.exe

Ktpass.exe

L

Ldp.exe

M

Memsnap.exe

Movetree.exe

Msicuu.exe

Msinfo32.exe

Msizap.exe

N

Netdiag.exe

Netdom.exe

Nltest.exe

O

No entries

P

Pmon.exe

Poolmon.exe

PPTP Ping

Pviewer.exe

Q

No entries

R

Reg.exe

Remote.exe

Repadmin.exe

Replmon.exe

Rsdiag.exe

Rsdir.exe

S

Sdcheck.exe

Search.vbs

SIDWalker

Snmputilg.exe

T

Tlist.exe

U, V

No entries

W

W2000msgs.chm

Windiff.exe

Winrep.exe

Wsremote.exe

X, Y, Z

No entries


Alphabetical list of tools by file name

A B C D E F G H I J K L M
N O P Q R S T U V W X Y Z

List of tools by tool name


Windows 2000 Support Tools: Alphabetical list of Tools

 Hold the cursor over the name of a tool for a brief description.

A

ACL Diagnostics

Active Directory Administration Tool

Active Directory Diagnostic Tool

Active Directory Object Manager

Active Directory Replication Monitor

Active Directory Search Tool

ADSI Edit snap-in

Advanced Power Management Status

Application Compatibility Program

B

Browser Status

C

ClonePrincipal

D

Dependency Walker

DiskProbe

Distributed File System Utility

DNS Server Troubleshooting Tool

Domain Controller Diagnostic Tool

DsAcls

Dump Check

E

No entries

F

File and Directory Comparison

FileVer

G

Global Flags Editor

H, I, J

No entries

K

Kerberos Keytab Setup

Kerberos Setup

L

No entries

M

Memory Profiling Tool

Migration Planning document

N

Network Connectivity Tester

NlTest

O

No entries

P

Point-to-Point Tunneling Protocol Ping Utilities

Poolmon

Process Resource Monitor

Process Viewer

Q

No entries

R

Registry Console Tool

Remote Command Line

Remote Storage Diagnostic Utility

Remote Storage File Information Utility

Replication Diagnostics Tool

S

Security Administration Tools

Security Descriptor Check Utility

SNMP Query Tool

System Information

T

Task Killing Utility

Task List Viewer

U, V

No entries

W

WinDiff File and Directory Comparison

Windows 2000 Domain Manager

Windows 2000 Error and Event Messages Help

Windows Installer Cleanup Utility

Windows Installer Zapper

Windows Report Tool

Winsock Remote Console

X, Y, Z

No entries


Alphabetical list of tools by tool name

A B C D E F G H I J K L M
N O P Q R S T U V W X Y Z

List of tools by file name


Flags in BrowStat listings

AFP = AFP Server

BBR = Backup Browser

BDC = Backup Domain Controller

DFS = Distributed File System

DL = Dial-in Server

DMB = Domain Master Browser

MBR = Master Browser

MDC = Member Domain Controller

MFPN = Microsoft File and Print for Netware

NT = Windows NT

NV = Novell

OSF = OSF Server

 PBR = Potential Browser

PDC = Primary Domain Controller

PQ = Print Server

S = Server

SQL = SQL Server

SS = Windows NT Member Server

TS = Time Source

VMS = Vax VMS Server

W = Workstation

W95 = Windows 95

WFW = Windows for Workgroups

XN = Xenix
Browser Status (Browstat.exe)


BrowStat STATS example

C>BROWSTAT STATS
Browser statistics since 20:40:54.705 on 6/9/1993    Time statistics were last cleared
NumberOfServerEnumerations:    237
NumberOfDomainEnumerations:    235
NumberOfOtherEnumerations:    6
NumberOfMailslotWrites:    1974
NumberOfServerAnnouncements:    0
NumberOfDomainAnnouncements:    0
NumberOfElectionPackets:    27425
NumberOfGetBrowserServerListRequests:    0
NumberOfMissedGetBrowserServerListRequests:    0
NumberOfDroppedServerAnnouncements:    0
NumberOfDroppedMailslotDatagrams:    0
NumberOfFailedMailslotReceives:    0
NumberOfMasterAnnouncements:    0
NumberOfIllegalDatagrams:    0

Meaning:

NumberOfServerEnumerations: = Number of browse requests for servers

NumberOfDomainEnumerations: = Number of browse requests for domains

NumberOfOtherEnumerations: = Number of "other" browse requests

NumberOfMailslotWrites: = Number of mailslot writes received

NumberOfServerAnnouncements: = Number of server announcements received

NumberOfDomainAnnouncements: = Number of domain (workgroup) announcements received

NumberOfElectionPackets: = Number of browser election packets received

NumberOfGetBrowserServerListRequests: = Number of GetBrowserServerList requests received

NumberOfMissedGetBrowserServerListRequests: = Number of GetBrowserServerList requests missed

NumberOfDroppedServerAnnouncements: = Number of server announcements dropped

NumberOfDroppedMailslotDatagrams: = Number of mailslot writes dropped due to memory

NumberOfFailedMailslotReceives: = Number of mailslot writes dropped due to transport

NumberOfMasterAnnouncements: = Number of WAN master browser announcements

NumberOfIllegalDatagrams: = Number of illegal datagrams received

Browser Status (Browstat.exe)


BrowStat STATUS example

C>BROWSTAT STATUS NTLAN
Status for domain ntlan on transport \Device\Nbf_Lance01
    Master browser name is: MSTRBROWSER1
        Master browser is running build 1.511.1
    3 backup servers retrieved from master MSTRBROWSER1
        \\MYPC
        \\MSTRBROWSER1
        \\BACKUPSVR1
    There are 20 servers in domain ntlan on transport \Device\Nbf_Lance01
    There are 1074 domains in domain ntlan on transport \Device\Nbf_Lance01
Status for domain ntlan on transport \Device\Streams\NWNBLINK
    Master browser name is: MSTRBROWSER1
        Master browser is running build 1.511.1
    3 backup servers retrieved from master MSTRBROWSER1
        \\BACKUPSVR1
        \\MSTRBROWSER1
        \\MYPC DEBUG
    There are 8 servers in domain ntlan on transport \Device\Streams\NWNBLINK
    There are 36 domains in domain ntlan on transport \Device\Streams\NWNBLINK
Status for domain ntlan on transport \Device\Streams\NBT
    Master browser name is: MSTRBROWSER1
        Master browser is running build 1.511.1
    3 backup servers retrieved from master MSTRBROWSER1
        \\MSTRBROWSER1
        \\BACKUPSVR1
        \\MYPC
    There are 11 servers in domain ntlan on transport \Device\Streams\NBT
    There are 101 domains in domain ntlan on transport \Device\Streams\NBT

Browser Status (Browstat.exe)


BrowStat syntax

browstat options

Parameters

options
The whole word or abbreviation from the following list:

ELECT (EL) — Forces a master browser election on the domain that uses the transport specified.

Usage:

browstat elect transport domain

GETBLIST (GB) — Retrieves a list of the backup browsers on the domain with the specified transport.

Usage:

browstat getblist transport [[domain] refresh]

GETMASTER (GM) — Uses NetBIOS to retrieve the name of the browser master for a transport for a workgroup.

Usage:

browstat getmaster transport domain

GETPDC (GP) — Uses NetBIOS to retrieve the name of the primary domain controller for a transport for a workgroup.

Usage:

browstat getpdc transport domain

LISTWFW (WFW) — Finds Windows for Workgroups computers that are currently running the browser.

If you have a mixed workgroup-and-domain network, you can disable the browser in Windows for Workgroups.

Usage:

browstat listwfw domain

STATS (STS) — Dumps various useful browser statistics.

The \\server switch allows it to be pointed to a specific server.

Usage:

browstat stats [\\server] [clear]

See STATS example

STATUS (STA) — Dumps browser status for the specified workgroup on all local transports.

It also includes the build number of the browser master and how many servers are in the workgroup.

Usage:

browstat status [-v] workgroup

See STATUS example

TICKLE (TIC) — Stops the browser master for the specified workgroup on the specified transport.

It can be used to reset a computer that has been determined to be problematic.

Usage:

browstat tickle transport domain

VIEW (VW) — Retrieves the list of servers or domains for a specified server for a specified transport or workgroup.

Usage:

browstat view transport

browstat view transport domain | server [/DOMAIN]

browstat view transport server /DOMAIN domain

DUMPNET (DN) — Displays the list of transports bound to a browser.

Usage:

browstat dn

Browser Status (Browstat.exe)


DcDiag syntax

dcdiag /s:DomainController [/n:NamingContext] [/u:Domain\Username /p:{* | Password | ""}] [{/a | /e}] [{/q | /v}] [/i] [/f:LogFile] [/ferr:ErrLog] [/c [/skip:Test]] [/test:Test] [{/h | /?}]

Parameters

/s:DomainController
Uses DomainController as home server. This is a required parameter.
/n:NamingContext
Uses NamingContext as the naming context to test. Domains may be specified in NetBIOS, DNS or distinguished name form.
/u:Domain\Username /p:{* | Password | ""}
Uses Domain\Username credentials for binding, with Password as the password. "" is an empty or null password. * prompts for the password.
/a
Tests all the servers on this site.
/e
Tests all the servers in the entire enterprise. Overrides /a.
/q
(Quiet) Prints only error messages.
/v
(Verbose) Prints extended information.
/i
Ignores superfluous error messages.
/f:LogFile
Redirects all output to LogFile. /f: operates indepedently of /ferr:.
/ferr:ErrLog
Redirects fatal error output to a separate file ErrLog. /ferr: operates indepedently of /f:.
/c
(Comprensive) Runs all tests, including non-default tests. Optionally, can be used with /skip to skip specified tests. The following tests are not run by default:
Topology
CutoffServers
OutboundSecureChannels
/skip:Test
Skips the specified Test. Must be used with /c. Should not be run in the same command line with /test.
The only Test that cannot be skipped is Connectivity.
/test:Test
Runs only this test. The non-skippable test Connectivity is also run. Should not be run in the same command line with /skip. Valid tests are:
Connectivity
Tests whether domain controllers are DNS registered, pingeable, and have LDAP/RPC connectivity.
Replications
Checks for timely replication between domain controllers.
Topology
Checks that the generated topology is fully connected for all domain controllers.
CutoffServers
Checks for servers that won't receive replications because its partners are down.
NCSecDesc
Checks that the security descriptors on the naming context heads have appropriate permissions for replication.
NetLogons
Checks that the appropriate logon privileges allow replication to proceed.
LocatorGetDc
Checks whether each domain controller is advertising itself in the roles it should be capable of.
Intersite
Checks for failures that would prevent or temporarily hold up intersite replication.
RolesHeld
Checks that global role-holders are known, can be located, and are responding.
RidManager
Checks to see if RID master is accessable and to see if it contains the proper information.
MachineAccount
Checks to see if the machine account has the proper information.
Services
Checks to see if appropriate domain controller services are running.
OutboundSecureChannels
Checks that secure channels exist from all of the domain controllers in the domain to the domains specified by /testdomain:. /nositerestriction prevents the test from being limited to the domain controllers in the site.
ObjectsReplicated
Checks that Machine Account and DSA objects have replicated. Use /objectdn:dn with /n:nc to specify additional object to check.
{/h | /?}
Displays a syntax screen at the command prompt.

Domain Controller Diagnostic Tool (Dcdiag.exe)


Using Dependency Walker

When you first run Dependency Walker (Depends.exe), it registers itself with your system as a handler for all Win32 binaries. This causes a View Dependencies item to be added to the system's context menu. Then, when you right-click a Win32 module file in Windows Explorer, View Dependencies is displayed as one of the options.

Opening a file in Dependency Walker

To open a file in Dependency Walker, use one of four methods:

  • Right-click a module file in Windows Explorer and choose View Dependencies from the context menu. This requires that you configure Dependency Walker to handle certain file extensions. This can be done by choosing Handled File Extensions from Dependency Walker's View menu.
  • On the main menu in Dependency Walker, click File, and then click Open.
  • Drag and drop a file on top of the Dependency Walker's main window.
  • Run depends at the command prompt with the name of the file to be viewed as part of the command line.

Getting Help on Dependency Walker

To get Help on Dependency Walker while running the tool, use one of two methods:

    To open the table of contents of Dependency Walker Help:
  • On the main menu in Dependency Walker, click Help, and then click Help Topics.
  • To get help on the view that currently has focus, press F1.

Dependency Walker (Depends.exe)


DfsUtil examples

dfsutil /list example

This example shows dfsutil /list dumping the name of a Distributed file system (Dfs) root called "dfsft" in the a.com domain.

C:\UTILS>dfsutil /list:a.com
Getting DomDfs's in a.com
Connecting to DC NA-DC-01.a.com
Found 1 DomDfs's
dfsft

DFSUTIL completed successfully.

dfsutil /view example

This example dumps the Dfs configuration of the local computer for the fault-tolerant root "dfsft" in the a.com domain. Multiple servers back up the root and \apps shares (child nodes) in the \\a.com\dfsft DFS tree.

C:\UTILS> C:\UTILS>dfsutil /VIEW:DFSFT /DOMAIN:A.COM
Getting DomDfs metadata for DFSFT
Connecting to DC NA-DC-01.a.com
Volume information
Type is DomDfs
remoteServerName:[\\NA-DC-01\dfsft][\\NA-DC-01\dfsft][*]

\\A\dfsft    [(null)]
    \\NA-DC-01\dfsft
    \\ NA-DC-02\dfsft

\\A\dfsft\apps    [(null)]
    \\ NA-DC-01\apps
    \\ NA-DC-02\apps

Site information:
NA-DC-01
    Default-First-Site-Name
NA-DC-02
    Default-First-Site-Name

DFSUTIL completed successfully.

dfsutil /spcinfo example

C:\UTILS>DFSUTIL /SPCINFO
NtStatus=0x0, status=0x0
[*][SERVER5.a.com]
[*][A]
[*][a.com]
NtStatus=0x0, status=0x0
[+][A]
        [+SERVER3]
        [-SERVER4]
        [-SERVER2]
        [-SERVER6]
        [-SERVER5]
[+][a.com]
        [+SERVER5.a.com]
        [-SERVER3.a.com]
        [-SERVER4.a.com]
        [-SERVER6.a.com]
        [-SERVER2.a.com]

dfsutil /pktinfo example

C:\UTILS>dfsutil /pktinfo
--mup.sys--
3 entries...
Entry: \ntbuilds\release
ShortEntry: \ntbuilds\release
Expires in 0 seconds
UseCount: 7 Type:0x81 ( REFERRAL_SVC DFS )
   0:[\NTBUILDS\release][0x1]

Entry: \A\dfsft
ShortEntry: \A\dfsft
Expires in 0 seconds
UseCount: 0 Type:0x81 ( REFERRAL_SVC DFS )
   0:[\NA-DC-01\dfsft][0x0]
   1:[\NA-DC-01\dfsft][0x1]

Entry: \a.com\sysvol
ShortEntry: \a.com\sysvol
Expires in 0 seconds
UseCount: 0 Type:0x81 ( REFERRAL_SVC DFS )
   0:[\NA-DC-01.a.com\sysvol][0x0]
   1:[\NA-DC-01.a.com\sysvol][0x1]

DFSUTIL completed successfully.

dfsutil /pktflush example

The example below:

  1. Displays the existing Partition Knowledge Table (PKT) for \\NTBUILDS\release\usa\2011\x86 using /pktinfo switch.
  2. Flushes all client PKT’s using DFSFLUSHPKT ("EntryPath=[*]").
  3. Shows the empty PKT on the client using /pktinfo switch.

C:\UTILS>dfsutil /pktinfo
--mup.sys--
NtStatus=0x0, status=0x0
2 entries...
Entry: \ntbuilds\release
ShortEntry: \ntbuilds\release
   0:[\NTBUILDS\release][0x1]

Entry: \ntbuilds\release\usa\2011\x86
ShortEntry: \ntbuilds\release\usa\2011\x86
   0:[\2kbldx1\usa.2011.x86][0x1]
   1:[\ntrelic2\usa.2011.x86][0x0]
   2:[\2kbldx3\usa.2011.x86][0x0]
   3:[\2kbldx4\usa.2011.x86][0x0]
   4:[\2kbldx2\usa.2011.x86][0x0]

C:\UTILS>dfsutil /pktflush
EntryPath=[*]

C:\UTILS>dfsutil /pktinfo
--mup.sys--
NtStatus=0x0, status=0x0
0 entries...

dfsutil /dfsalt example

If a user connects to the path

C:\utils>dir \\ntbuilds\release\usa\2011\x86\fre.srv

which of the five possible servers did the client select? This command can crack open the clients’ PKT to display the result.

C:\utils>dfsutil /dfsalt:\\ntbuilds\release\usa\2011\x86\fre.srv [>>c:\dfsloadbal.txt]
\\ntbuilds\release\usa\2011\x86\fre.srv -> \\ntrelic2\usa.2011.x86\fre.srv

DfsUtil syntax

Distributed File System Utility (Dfsutil.exe)


DfsUtil syntax

dfsutil [options]

options parameters

/list:Domain [/dcname:DcName]
lists the Domain Distributed File Systems in Domain, which must be a fully qualified Active Directory domain name. This command displays the root or roots hosted on the computer or domain. The output of /list is the command-line equivalent of the Connect to existing Distributed File System (Dfs) root command in the Distributed File System Manager snap-in. This switch uses a level 200 NetDFSEnum API call.
/dcname:DcName
uses the directory service on a specific domain controller.
Example
/view:\\dfsname\dfsshare [/dcname:DcName] [/level:Level]
views the metadata in \\dfsname\dfsshare. This command dumps the Active Directory-based Partition Knowledge Table (PKT), showing each directory in the Dfs tree, the computers backing each directory and their Active Directory site location. You can pipe the output with the |more command or send it to a text file for large Dfs configurations. When specified with the optional [MachineName] parameter, DFSGETBLOB is useful for "walking" a specific domain controller's view of the Dfs configuration to check for inconsistencies in the Dfs namespace due to latency in Active Directory replication.
/dcname:DcName
uses the directory service on a specific domain controller.
/level:Level
specifies a level of viewing. A higher level shows more detail.
Example
/verify:\\dfsname\dfsshare [/dcname:DcName] [/level:Level]
verifies the metadata in dfsname\dfsshare
/dcname:DcName
uses the directory service on a specific domain controller.
/level:Level
specifies a level of verification. A higher level does more checks (which is good for Windows NT 4.0 distributed file systems).
/reinit:ServerName
reinitializes the Dfs root ServerName
/whatis:ServerName
reports what kind of root ServerName is.
/dfsalt:UNCPath
resolves the UNC path to a \\server\share. This lists the currently selected server to which a client is connected, when a folder is backed by more than one server.
Windows 95/98 and Windows NT 4.0 clients don't support the APIs that determine which server is selected when a folder in the Dfs tree is backed by more than one server. Windows 2000 clients display the referral list and the currently selected server in the Dfs tab of Windows Explorer. This command can also be useful for piping output to a text file for randomization tests.
Example
/unmap:\\dfsname\dfsshare /root:\\server\share
removes \\server\share from Dfs.
/dcname:DcName
uses the directory service on a specific domain controller.
/clean:ServerName
updates the registry of ServerName so that it is not a Dfs root. This cleans out Dfs-related entries.
/dclist:Domain
List the domain controllers in Domain
/dcname:DcName
uses the directory service on a specific domain controller.
/trusts:Domain
lists the Windows 2000 trusted domains of Domain.
/dcname:DcName
uses the directory service on a specific domain controller.
/all
lists all trusted domains regardless of type (Windows 2000 or Windows NT 4.0).
/? or /help
displays this syntax at the command line.

Client-side-only Options

/pktinfo [/dfs] [/level:Level]
shows the parts of the Dfs namespace cached by the client, the names of the servers participating in the Dfs share, the clients’ randomization order of the participating servers and the current "go to" server.
Dfs servers store the Dfs namespace and the servers backing up the namespace in a blob format in the registry (Standalone Dfs) or Active Directory (Domain Dfs). The Dfs blob was formally known as the Partition Knowledge Table (PKT). Dfs clients retrieve and cache each piece of the Dfs namespace for a period of time determined by the server. For Windows NT 4.0 Dfs, Dfs Servers send the list of servers backing a piece of the Dfs namespace in the same order. Clients randomize the list of servers to provide a degree of load balancing.
For Windows 2000 servers accessed by Windows 2000 Dfs clients, the scrambling and site preference takes place on the server.
/dfs
from Dfs.sys.
/level:Level
specifies a level of of detail to dump. A higher level dumps more details.
Example
/pktflush[:EntryToFlush]
flushes the local Partition Knowledge Table (PKT) cached by the client. If EntryToFlush is specified, flushes just the specified local PKT entry.
Dfs clients cache the portions of the Dfs namespace (PKT) for the duration of time specified in the Distributed File System Manager and referred to as the Time to Live (TTL). For Dfs 4.1, the PKT was cached for a hard coded 7 days. Windows 2000 servers use 1800 seconds (30 minutes) as the default TTL. All Microsoft Dfs clients delete the PKT for a given folder in the Dfs tree if not accessed by the TTL expiration or when the client is rebooted, whichever occurs first.
Windows 2000 computers support the Dfs tab in Explorer property sheet, which uses the NetDFSGetClientInfo() and NetDFSSetClientInfo() APIs to show the list of alternates paths residing in the volume and allows choosing another alternate (refresh PKT) without having to reboot or wait for TTL to expire.
Non-Windows 2000 Dfs clients must reboot or wait for the TTL for a cached portion of the Dfs tree to expire.
Example
/spcinfo [/all]
dumps the SPC table.
/all
dumps the SPC tables for all domains.
Example
/spcflush[:EntrytoFlush]
flushes the local SPC table. If EntryToFlush is specified, flushes just the specified SPC table entry.
/readreg
makes Mup.sys reread the registry.
/dfs
makes Dfs.sys reread the registry.

Distributed File System Utility (Dfsutil.exe)

DfsUtil examples


Dnscmd.exe /AgeAllRecords

Dnscmd /AgeAllRecords

The /AgeAllRecords command forces a timestamp and therefore aging on all records at the specified node on the specified DNS server. This is for backward compatibility between the current version of DNScmd and previous releases where aging and scavenging were not supported. If administrators want to force aging or scavenging on the records in those zones, they can use the command: dnscmd /AgeAllRecords <zonename> <tree> /f, and all the records in that zone will be timestamped. If none of the optional fields are specified, the command returns all records at the specified node. If a value of at least one of the optional fields is specified, then it enumerates only records corresponding to the value or values specified in the optional field or fields.

Syntax:

dnscmd ServerName /AgeAllRecords ZoneName NodeName [/Tree] [/f]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
A Fully Qualified Domain Name (FQDN) of a zone.
NodeName
A Fully Qualified Domain Name (FQDN) of a node or the node name relative to the ZoneName.
/Tree
Force aging on entire subtree of node or entire zone if node not given.
/f
Executes without asking for confirmation.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ClearCache

Dnscmd /ClearCache

The /ClearCache command clears the DNS server cache.

Syntax:

dnscmd ServerName /ClearCache

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /Config

Dnscmd /Config

The /Config command resets the properties of a DNS server if no zone is specified. If a zone name follows the /Config keyword, then the command resets the zone properties.

Usage:

dnscmd ServerName /Config [ZoneName |..AllZones] Property Value

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
The name of the zone to be configured. To reset a given property for all zones, specify ..AllZones. If ZoneName is not specified, DNScmd resets the properties of the server.
Property
The name of the property to be reset, from the following:
Server properties:
                /EnableRegistryBoot
                /RpcProtocol
                /LogLevel
                /EventlogLevel
                /NoRecursion
                /RecursionRetry
                /RecursionTimeout
                /ForwardingTimeout
                /IsSlave
                /MaxCacheTtl
                /DisableAutoReverseZones
                /CleanupInterval
                /AutoCacheUpdate
                /AllowUpdate
                /DisjointNets
                /RoundRobin
                /AddressAnswerLimit
                /BindSecondaries
                /WriteAuthority
                /StrictFileParsing
                /ScavengingInterval
 Zone properties:
                /SecureSecondaries
                /AllowUpdate
                /Aging
                /RefreshInterval Value
                /NoRefreshInterval Value
Value
A DWORD value; Use 0x prefix to indicate hex value.

Note

Some server and zone DWORD properties must be reset as part of a more complex operation.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /EnumRecords

Dnscmd /EnumRecords

The /EnumRecords command enumerates records at the specified node on the specified DNS server. If none of the optional fields is specified the command returns all records at the specified node. If a value of at least one of the optional fields is specified then it enumerates only records corresponding to the value or values specified in the optional field or fields.

Syntax:

dnscmd ServerName /EnumRecords ZoneName NodeName [DataOption] [ViewOption]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
A Fully Qualified Domain Name (FQDN) of a zone.
    Add /RootHints for roots-hints enumeration

    Add /Cache for cache enumeration

NodeName
A Fully Qualified Domain Name (FQDN) of a node.
DataOption
Can have the following values:
/Type RRType
Enumerates resource records of a specific type, such as A, NS, or SOA.
/Authority
Includes authoritative data.
/Glue
Includes glue data.
/Additional
Causes the output to include additional data when enumerating.
/Node
Causes the command to enumerate only resource records of the given node.
/Child
Causes the command to enumerate only record records not of the root.
ChildName
The domain name below which to start enumeration.
/StartChild ChildName
Starts enumeration after the specified child.
ViewOption
Can have the following values:
/Continue
On full buffer condition, continues enumerating to the end of the records. (default retrieves only the first buffer of data).
/Detail
Prints detailed record node information (default is view of records similar to zone file).

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /EnumZones

Dnscmd /EnumZones

The /EnumZones command enumerates zones on the specified DNS server. If no filters values are specified it enumerates all zones on that server. If a value of at least one filter is specified then it enumerates only zones corresponding to the value specified in the filters fields.

Syntax:

dnscmd ServerName /EnumZones [Filter1] [Filter2]

Parameters

ServerName
is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
[Filter1]
Can have the following values:
    /Primary
    /Secondary
    /Cache
    /Auto-Created

[Filter2]
Can have the following values:
    /Forward
    /Reverse

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


DNScmd examples

One Step /Info

The following command displays information about the status of the DNS server at the IP address 172.16.12.1:

dnscmd 172.16.12.1 /info

Output

DNS Server 172.16.12.1 Information:
C:\>dnscmd 172.16.12.1 /info
Query result:
Server info:
        ptr              = 00074718
        server name      = myserver.microsoft.com
        version          = C2000005
        DS container     = c
  Configuration:
        dwLogLevel               = 00000000
        dwDebugLevel             = 00000000
        dwRpcProtocol            = FFFFFFFF
        dwNameCheckFlag          = 00000002
        cAddressAnswerLimit      = 0
        dwRecursionRetry         = 3
        dwRecursionTimeout       = 15
        dwDsPollingInterval      = 300
  Configuration Flags:
        fBootMethod                  = 3
        fAdminConfigured             = 1
        fAllowUpdate                 = 1
        fDsAvailable                 = 1
        fAutoReverseZones            = 1
        fAutoCacheUpdate             = 0
        fSlave                       = 0
        fNoRecursion                 = 0
        fRoundRobin                  = 1
        fLocalNetPriority            = 1
        fStrictFileParsing           = 0
        fLooseWildcarding            = 0
        fBindSecondaries             = 1
        fWriteAuthorityNs            = 0
  Aging Configuration:
        ScavengingInterval           = 0
        DefaultAgingState            = 0
        DefaultRefreshInterval       = 168
        DefaultNoRefreshInterval     = 168
  ServerAddresses:
        Addr Count = 1
                Addr[0] => 172.16.12.1
  ListenAddresses:
        NULL IP Array.
  Forwarders:
        Addr Count = 1
                Addr[0] => 172.16.4.3
        forward timeout  = 5
        slave            = 0
Command completed successfully.

One Step /resetlistenaddresses

The following command specifies two servers to service DNS requests for the current computer.

dnscmd . /resetlistenaddresses 2 1.1.1.65 1.1.1.1

Output

ListenAddresses reset successful.
Command successfully completed.

One Step /resetforwarders

The following command specifies two forwarders for the local DNS server and sets the forwarders as slaves, with a timeout value of one second.

dnscmd localhost /resetforwarders 2 1.1.1.1 2.2.2.2 fslave 1

Output

Forwarders reset successful.

One Step /statistics

The following command displays the complete statistics data for the server with the IP address of 172.21.130.19.

dnscmd 172.21.130.19 /statistics

Output

DNS Server 172.21.130.19 statistics:

DNS Statistics
--------------
        Server start time    4/22/98 4:08:19 PM
        Stats last cleared   4/22/98 4:08:19 PM
        Seconds since clear 363

Queries and Responses:
----------------------
Total:
        Queries Received = 2
        Responses Sent   = 2
UDP:
        Queries Recvd    = 2
        Responses Sent   = 2
        Queries Sent     = 6
        Responses Recvd  = 3
TCP:
        Client Connects  = 0
        Queries Recvd    = 0
        Responses Sent   = 0
        Queries Sent     = 0
        Responses Recvd  = 0

Recursion:
----------
        Packets    = 1
        Lookups    = 2
        Questions  = 1
        Passes     = 3
        Forwards   = 2
        Sends      = 2
        Responses  = 0
        Timeouts   = 2
        Failures   = 0
        Incomplete = 0
TCP Recursion:
        Try      = 0
        Query    = 0
        Response = 0
Root Query:
        Query    = 1
        Response = 0

WINS Referrals:
---------------
Forward:
        Lookups   = 0
        Responses = 0
Reverse:
        Lookups   = 0
        Responses = 0

Secondary Zone Transfer:
------------------------
SOA Queries     = 1
SOA Responses   = 1
Notifies Recvd  = 0
AXFR Requests   = 0
AXFR Rejected   = 0
AXFR Failed     = 0
AXFR Successful = 0

Master Zone Transfer:
---------------------
Notifies Sent           = 3
AXFR Requests Recvd     = 0
AXFR Invalid Requests   = 0
AXFR Denied (Security)  = 0
AXFR Refused            = 0
AXFR Failed             = 0
AXFR Successful         = 0

Database:
---------
Nodes
  InUse    = 48
  Memory   = 3721
Records
  InUse    = 44
  Memory   = 5446
Database Total
  Memory   = 9167

RR Caching:
        Total      = 0
        Current    = 0
        Timeouts   = 0

Domain Nodes:
        Alloc      = 66
        Free       = 0
        NetAllocs  = 66
        Memory     = 3721

        Used       = 48
        Returned   = 0
        InUse      = 48

        Std Alloc  = 64
        Std Used   = 46
        Std Return = 0
        InFreeList = 18

Records:
        Alloc      = 263
        Free       = 0
        NetAllocs  = 263
        Memory     = 5446

        Used       = 45
        Returned   = 1
        InUse      = 44

        Std Alloc  = 254
        Std Used   = 36
        Std Return = 1
        InFreeList = 219

Packet Memory Usage:
--------------------
UDP Messages:
        Alloc      = 5
        Free       = 0
        NetAllocs  = 5
        Memory     = 6255
        Used       = 11
        Returned   = 9
        InUse      = 2
        InFreeList = 3

TCP Messages:
        Alloc      = 0
        Realloc    = 0
        Free       = 0
        NetAllocs  = 0
        Memory     = 0

Recursion Messages:
        Used       = 1
        Returned   = 1

Nbstat Memory Usage:
--------------------
Nbstat Buffers:
        Alloc      = 0
        Free       = 0
        NetAllocs  = 0
        Memory     = 0
        Used       = 0
        Returned   = 0
        InUse      = 0
        InFreeList = 0

Command successfully completed.

One Step /Zoneadd

The following command creates the zone microsoft.com as a secondary zone on the current computer, with the server at the address 172.16.12.1 specified as the primary server.

dnscmd . /zoneadd microsoft.com /secondary 172.16.12.1

Output

DNS Server . created zone microsoft.com:
Command completed successfully.

One Step /Enumrecords

The following command enumerates the records for the newly-created zone "test.microsoft.com".

dnscmd . /enumrecords /zone microsoft.com

Output

C:\>dnscmd . /enumrecords /zone microsoft.com
Returned records:
@        3600 NS        idaho.microsoft.com.
         3600 SOA       idaho.microsoft.com. admin.microsoft.com. 2 900 600 86400 3600
test    3600 CNAME     test.microsoft.com.
Command completed successfully.

Note: (THIS IS YOUR ZONE)  test    3600 CNAME     test.microsoft.com.

One Step /Enumzones

The following command enumerates the secondary zones for the current DNS server.

dnscmd . /enumzones /secondary

Output

C:\>dnscmd . /enumzones /secondary
Enumerated zone list:

        Zone Count = 1.

 microsoft.com                     2  file             Up=0

Command completed successfully.

One Step /Zonedelete

The following command deletes the zone microsoft.com from the current DNS server.

dnscmd . /zonedelete microsoft.com

Output

C:\>dnscmd . /zonedelete microsoft.com
Are you sure to you want to DeleteZone?(y/n) y

DNS Server . deleted zone microsoft.com:
        Status = 0 (0x00000000)
Command completed successfully.

DNScmd syntax

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /Info

Dnscmd /Info

The Info command provides the specified properties for the specified DNS server. If no properties are specified, then DNScmd lists all properties.

Usage:

dnscmd ServerName /Info [Property]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Property
The server property to view. Examples:
    BootMethod
    NoRecursion
    IsSlave
    AllowUpdate
    ScavengingInterval

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /NodeDelete

Dnscmd /NodeDelete

The /NodeDelete command deletes all records at a name from the specified zone, RootHints, or Cache at the specified DNS server.

Syntax:

dnscmd ServerName /NodeDelete Zone NodeName [/Tree] [/f]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Zone
Can be ZoneName or /RootHints or /Cache.
NodeName
A Fully Qualified Domain Name (FQDN) of a node (with a period '.' at the end) or node name relative to the ZoneName.
/Tree
If this optional field is specified then the command deletes entire subdomain. If this field is not specified then the subdomain is not deleted.
/f
If this optional field is specified the command executes without asking for confirmation.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /RecordAdd

Dnscmd /RecordAdd

The /RecordAdd command creates a record in the specified zone or RootHints on the specified DNS server.

Syntax:

dnscmd ServerName /RecordAdd Zone NodeName [/Aging] OwnerName [Ttl] RRType RRData

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Zone
May be a ZoneName or /RootHints.
NodeName
FQDN of a node (with a period '.' at the end); or node name relative to the ZoneName; or @ (at the root of the zone); or service name (for server only, for example ftp.tcp).
/Aging
Sets the aging for the record you create. By default, records created with /RecordAdd are not timestamped unless the /Aging switch is specified.
Ttl
An optional parameter that specifies Time-to-Live (TTL) for the created record. If the field is not specified then the TTl is specified in the SOA record for the zone.
RRtype and RRData
The RRData parameter may receive different sets of data values depending on the RRType of the record, as shown in the table below.
Set of allowed record types RRType | Set of allowed record data RRData
A | IPAddress
SOA | PrimSvr, Admin, Serial#, Refresh, Retry, Expire, MinTTL
NS,CNAME,MB,MD,PTR,MF,MG,MR | HostName | DomainName
MX,RT,AFSDB | Preference, ServerName
MINFO,RP | MailboxName, ErrMailboxName
TXT,X25,HINFO, ISDN | String [String]
SRV | Priority, Weight, Port, HostName
WKS | Protocol*, IPAddress, Service [Service]...]
AAAA | ipv6Address
WINS | MapFlag, LookupTimeout, CacheTimeout, IPAddress, [IPAddress]
WINSR | MapFlag LookupTimeout CacheTimeout RstDomainName

* The Protocol variable can have two values: UDP or TCP

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /RecordDelete

Dnscmd /RecordDelete

The /RecordDelete command deletes a record from the specified zone, RootHints, or Cache on the specified DNS server.

Syntax:

dnscmd ServerName /RecordDelete Zone OwnerName [Ttl] RRType RRData [/f]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Zone
May be ZoneName or /RootHints or Cache.
RRtype and RRData
The RRData parameter may receive different sets of data values depending on the RRType of the record, as shown in the following table.
Set of allowed record types RRType | Set of allowed record data RRData
A | IPAddress
NS,CNAME,MB,MD,PTR,MF,MG,MR | HostName | DomainName
MX,RT,AFSDB | Preference, ServerName
MINFO,RP | MailboxName, ErrMailboxName
TXT,X25,HINFO, ISDN | String [String]
SRV | Priority, Weight, Port, HostName
WKS | Protocol, IPAddress, Service [Service]...]
AAAA | ipv6Address
ATMA | ATM Address
WINS | MapFlag, LookupTimeout, CacheTimeout, IPAddress, [IPAddress]
WINSR | MapFlag LookupTimeout CacheTimeout RstDomainName
/F
Forces execution of command without asking for confirmation.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ResetForwarders

Dnscmd /ResetForwarders

The /ResetForwarders command resets/selects forwarders IP address or addresses.

Syntax:

dnscmd ServerName /ResetForwarders [IPAddress] ...] [ /[No]Slave ] [/TimeOut Time]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
IPAdress
An IP address where the DNS server forwards DNS queries that are unsolvable within its own databases. There can be a list of space-separated IP addresses. If no IP address is specified, then DNS server does not have forwarders.
[ /[No]Slave ]
Optionally allows you to specify whether the DNS server is a slave. If this parameter is not specified then the server is not a slave.
Time
Specifies the forwarding timeout. If no value is specified then the forwarding timeout is 5 seconds.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ResetListenAddresses

Dnscmd /ResetListenAddresses

The /ResetListenAddresses command resets or selects server IP addresses to serve DNS requests.

Syntax:

dnscmd ServerName /ResetListenAddresses [ListenAddress]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ListenAddress
An IP address belonging to the DNS server. More than one ListenAddress can be listed, separated by spaces. If no ListenAddress is specified, DNS server listens to all server IP addresses.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /Restart

Dnscmd /Restart

The /Restart command restarts the specified DNS server.

Syntax:

dnscmd ServerName /Restart

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /StartScavenging

Dnscmd /StartScavenging

The /StartScavenging command initiates scavenging on the specified server. Scavenging is a feature that provides for the removal of stale resource records that can accumulate in zone data.

Caution

By default, the aging and scavenging mechanism is disabled on Windows 2000 DNS servers. It should only be enabled when all parameters are fully understood. Otherwise, the server could accidentally be configured to delete records that should not be deleted. For more information, see your DNS server documentation.

Syntax:

dnscmd ServerName /StartScavenging

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /Statistics

Dnscmd /Statistics

The /Statistics command displays or clears server statistics data.

Usage:

dnscmd ServerName /Statistics [Filter|/Clear]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Filter
Displays a combination of desired statistics (Default=All). The following filters can be specified:
                00000001    -- Time
                00000002    -- Query
                00000004    -- Query2
                00000008    -- Recurse
                00000010    -- Master
                00000020    -- Secondary
                00000040    -- Wins
                00000100    -- Update
                00000200    -- SkwanSec
                00000400    -- Ds
                00010000    -- Memory
                00100000    -- PacketMem
                00040000    -- Dbase
                00080000    -- Records
                00200000    -- NbstatMem
/Clear
Clears the statistics data.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


DNScmd syntax

For command-line Help, type Dnscmd /?. For Help on a specific command, type Dnscmd command /?

Note

DNScmd uses the credentials of the currently logged-on user.

dnscmd ServerName Command [Command Parameters]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage. This variable can be replaced with one of the following objects:
.
Specifies the local computer. Connection is made using Local Procedure Call (LPC).
IP address, in the format xx.xx.xx.xx
Specifies a DNS server by IP address. Connection is made using Remote Procedure Call (RPC) over TCP/IP.
DNS Name
The Fully Qualified Domain name (FQDN) of the server to be administered. Connection is made using Remote Procedure Call (RPC) over TCP/IP.
NetBIOS name
The NetBios computer name of the server to be administered. Connection is made using Remote Procedure Call (RPC) over named pipes.
Command
One of the commands listed below.
Command Parameters
The optional parameters associated with some of the following commands.

DNSCMD Commands

/Info
Provides DNS server properties (see also /ZoneInfo).
/Config
Reset server or zone configuration.
/Statistics
Query/clear server statistics data.
/ClearCache
Clears the cache of the specified DNS server.
/WriteBackFile
Write back all zone or roothint datafile(s) for the specified zone.
/StartScavenging
Initiates server scavenging.
/ResetListenAddresses
Resets/selects server IP address(es) to serve DNS requests.
/ResetForwarders
Resets/selects forwarders IP address(es).
/EnumZones
Enumerates zones on the specified DNS server.
/ZoneInfo
Displays zone information.
/ZoneAdd
Creates a new zone on the specified DNS server.
/ZoneDelete
Deletes specified zone from the specified DNS server.
/ZonePause
Pauses the specified zone on the specified DNS server.
/ZoneResume
Resumes the specified zone on the specified DNS server.
/ZoneReload
Reloads the specified zone from its database (file or directory service) on the specified DNS server.
/ZoneWriteBack
Writes back the specified zone to the file on the specified DNS server.
/ZoneRefresh
Forces refresh of the specified secondary zone on the specified DNS server from its master.
/ZoneUpdateFromDs
Updates the specified DS integrated zone by data from DS on the specified DNS server.
/ZoneResetType
Changes a type (Primary/Secondary/DSintegrated) of the specified zone on the specified DNS server.
/ZoneResetSecondaries
Sets/resets a notify list for the specified zone on the specified server.
/ZoneResetScavengeServers
Reset scavenging servers for a zone.
/EnumRecords
Enumerate records at a name.
/RecordAdd
Creates a record in the specified zone or RootHints on the specified DNS server.
/RecordDelete
Deletes a record from the specified zone or RootHints on the specified DNS server.
/NodeDelete
Deletes all records at a name from the specified zone, RootHints or Cache at the specified DNS server.
/Restart
Restarts the specified DNS server.
/AgeAllRecords
Forces timestamp and aging on the records in a zone.
/?
Command-line help.

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /WriteBackFiles

Dnscmd /WriteBackfiles

The /WriteBackFiles command writes a data file for the specified zone. If zone name is not specified then the command writes to data files all dirty (out of date) zone or root-hint data file or files.

Syntax:

dnscmd ServerName /WriteBackFiles [ZoneName]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
A Fully Qualified Domain Name (FQDN) of a zone.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneAdd

Dnscmd /ZoneAdd

The /ZoneAdd command creates a new zone on the specified DNS server.

Syntax:

dnscmd ServerName /ZoneAdd [ZoneName] Property [Options]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
A Fully Qualified Domain Name (FQDN) of a zone.
Property
May have one of the following three values:
    /Primary /file filename

    /Secondary MasterIPaddress[MasterIPaddress] ...] [/file filename]

    /DsPrimary.

Parameters

/Primary
The standard (non-directory service integrated) primary zone.
/file <filename>
Specifies the zone’s file name (must be included for primary zones).
/Secondary
If a secondary zone is specified, at least one MasterIPaddress must be provided, or a space-separated list if there are more than one master for the created secondary zone.
/DsPrimary
Indicates that the new zone is primary directory service integrated.
Options
Can have the following values:
    /a AdminName
    The e-mail name of the zone administrator (primary zones only).
    /Load
    Loads existing file; if not specified, non-directory service primary creates default zone records

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneDelete

Dnscmd /ZoneDelete

The /ZoneDelete command deletes the specified zone from the specified DNS server, and from the directory service if the zone is directory service-integrated. If the /DsDel flag is not specified then the zone is deleted from the DNS server, but not from the directory service. If the /f flag is set, the command executes without asking for confirmation.

Syntax:

dnscmd ServerName /ZoneDelete ZoneName [/DsDel] [/f]

Parameters

ServerName
Is the name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
Is name of the zone to be deleted. If the zone is directory service-integrated, the /DSdel switch must also be specified.
/DSdel
specifies that the zone should be deleted from the directory service as well (required if the zone is directory service-integrated).
/F
Forces the command to execute without asking for confirmation.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneInfo

Dnscmd /ZoneInfo

The /ZoneInfo command provides the zone properties for the specified zone on the specified server.

Usage:

dnscmd ServerName /ZoneInfo ZoneName [Property]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
A Fully Qualified Domain Name (FQDN) of a zone.
Property
The zone property to view. Examples:
    AllowUpdate
    DsIntegrated
    Aging
    RefreshInterval
    NoRefreshInterval

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZonePause

Dnscmd /ZonePause

The /ZonePause command pauses the specified zone on the specified DNS server.

Syntax:

dnscmd ServerName /ZonePause ZoneName

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneRefresh

Dnscmd /ZoneRefresh

The /ZoneRefresh command forces refresh of the specified secondary zone on the specified DNS server from its master.

Syntax:

dnscmd ServerName /ZoneRefresh ZoneName

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneReload

Dnscmd /ZoneReload

The /ZoneReload command reloads the specified zone from its database (file or directory service) on the specified DNS server.

Syntax:

dnscmd ServerName /ZoneReload ZoneName

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneResetSecondaries

Dnscmd /ZoneResetSecondaries

The /ZoneResetSecondaries command sets or resets a notify list for the specified zone on the specified server.

Syntax:

dnscmd ServerName /ZoneResetSecondaries ZoneName [ /[No]Secure ] [NotifyIPAddress] ...]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
[ /[No]Secure ]
Specifies the zone as secure (/Secure), which allows access by secondaries in notify list only, or non-secure (/NoSecure). If the field is not specified the zone is non-secure.
NotifyIPAddress
The IP address of the secondaries to be notified. This can be a list of space-separated IP addresses.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneResetScavengeServers

Dnscmd /ZoneResetScavengeServers

The /ZoneResetScavengeServers command resets the servers for scavenging a zone. Scavenging is a feature that provides for the removal of stale resource records that can accumulate in zone data. This feature is only available for use with Active Directory-integrated zones.

Caution

By default, the aging and scavenging mechanism is disabled on Windows 2000 DNS servers. It should only be enabled when all parameters are fully understood. Otherwise, the server could accidentally be configured to delete records that should not be deleted. For more information, see your DNS server documentation.

Syntax:

dnscmd ServerName /ZoneResetScavengeServers ZoneName [ServerIPs]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
The name of the zone to be reconfigured.
ServerIPs
A list of one or more IP addresses of servers to scavenge the specified zone; if no addresses are given, all servers hosting this zone will be allowed to scavenge the zone.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneResetType

Dnscmd /ZoneResetType

The /ZoneResetType command changes a type (Primary/Secondary/DSintegrated) of the specified zone on the specified DNS server.

Syntax:

dnscmd ServerName /ZoneResetType ZoneName Property [Options]

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
Property
May have one of the following three values:
    /Primary /file filename

    /Secondary MasterIPaddress[MasterIPaddress] ...] [/file filename]

    /DsPrimary.

Where:

/Primary
The standard (not integrated with directory service) primary zone.
/file <filename>
Allows specification of the zone’s file name (required for primary zones).
/Secondary
If a secondary zone is specified, at least one MasterIPaddress must be provided, or a space-separated list if there are more than one Masters for the created secondary zone.
/DsPrimary
Indicates that the new zone is primary directory service integrated.
Options
May have the following three values:
/a AdminName
The e-mail name of the zone administrator.
/OverWrite_Mem
Overwrites DNS with data in directory service.
/OverWrite_Ds
Overwrites directory service with data in DNS.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneResume

Dnscmd /ZoneResume

The /ZoneResume command resumes the specified zone on the specified DNS server.

Syntax:

dnscmd ServerName /ZoneResume ZoneName

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneUpdateFromDs

Dnscmd /ZoneUpdateFromDs

The /ZoneUpdateFromDs command updates the specified directory service integrated zone by data from the directory service on the specified DNS server.

Syntax:

dnscmd ServerName /ZoneUpdateFromDs ZoneName

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


Dnscmd.exe /ZoneWriteBack

Dnscmd /ZoneWriteBack

The /ZoneWriteBack command writes back the specified zone to the file on the specified DNS server.

Syntax:

dnscmd ServerName /ZoneWriteBack ZoneName

Parameters

ServerName
The name of the DNS server the administrator is planning to manage, represented by one of the following:
  • local computer using LPC
  • IP address - RPC over TCP/IP
  • DNS name - RPC over TCP/IP
  • NetBIOS name - RPC over named pipes
ZoneName
A Fully Qualified Domain Name (FQDN) of a zone.

DNScmd syntax

DNScmd examples

DNS Server Troubleshooting Tool (Dnscmd.exe)


DsAcls syntax

dsacls object [/a] [/d {user | group}:permissions [...]] [/g {user | group}:permissions [...]] [/i:{p | s | t}] [/n] [/p:{y | n}] [/r {user | group} [...]] [/s [/t]] [/?]

Parameters

object
is the path to the directory services object on which to display or manipulate the ACLs.
This path must be a distinguished name (also known as RFC 1779 or x.500 format), for example, CN=Someone,OU=Software,OU=Engineering,DC=Microsoft,DC=Com.
A specific Active Directory can be denoted by adding \\servername\ before the object, for example, \\adserver\CN=Someone,OU=Software,OU=Engineering,DC=Microsoft,DC=Com.
dsacls object
run with no further options, displays the security on object.
/a
displays the ownership and auditing information as well as the permissions.
/d {user | group} :permissions
denies specified permissions to user or group. You can specify more than one user or group in a command. For user, group, and permissions syntax, see below.
/g {user | group} :permissions
grants specified permissions to user or group. You can specify more than one user or group in a command. For user, group, and permissions syntax, see below.
/i:{c | o | i | p}
specifies one of the following inheritance flags:
p = Propagate inheritable permissions one level only.
s = Subobjects only
t = This object and subobjects
/n
replaces the current access on the object, instead of editing it.
/p
marks the object as protected (y = yes) or not protected (n = no). If the /p option is not present, the current protection flag is maintained.
/r {user | group}
removes all permissions for the specified user or group. You can specify more than one user or group in a command. For user and groupsyntax, refer to these sections later in this topic.
/s
restores the security on the object to the default for that object class as defined in Active Directory schema.
/t
restores the security on the tree of objects to the default for each object class. This switch is valid only with the /s option.
/?
displays this syntax listing.

Syntax for {user | group}

User or group must be expressed in one of the following forms:

user@domain or domain\user

group@domain or domain\group

You can specify more than one user or group in a command.

Syntax for permissions

Permissions must be expressed in the following form:

[PermissionBits];[{Object | Property}];[InheritedObjectType]

PermissionBits can have the following values, concatenated together without spaces:

Generic Permissions
GR | Generic Read
GE | Generic Execute
GW | Generic Write
GA | Generic All
Specific Permissions
SD | Delete
DT | Delete an object and all of its children
RC | Read security information
WD | Change security information
WO | Change owner information
LC | List the children of an object
CC | Create child object If {Object | Property} is not specified to define a specific child-object type, this applies to all types of child objects; otherwise, it applies to the specified child-object type.
DC | Delete a child object If {Object | Property} is not specified to define a specific child-object type, this applies to all types of child objects; otherwise, it applies to the specified child-object type.
WS | Write to self object Meaningful only on Group objects and when {Object | Property} is filled in as "member".
RP | Read property If {Object | Property} is not specified to define a specific property, this applies to all properties of the object; otherwise, it applies to the specified property of the object.
WP | Write property If {Object | Property} is not specified to define a specific property, this applies to all properties of the object; otherwise, it applies to the specified property of the object.
CA | Control access right If {Object | Property} is not specified to define the specific extended right for control access, this applies to all meaningful control accesses on the object; otherwise, it applies to the specific extended right for that object.
LO | List the object access. Can be used to grant list access to a specific object if List Children (LC) is not granted to the parent as well. Can also be denied on specific objects to hide those objects if the user/group has LC on the parent. note-icon Note Active Directory does not enforce this permission by default; it has to be configured to start checking for this permission.

{Object | Property}
must be the display name of the object type or the property. For example, "user" is the display name for user objects and "telephone number" is the display name for telephone number property.

InheritedObjectType
must be the display name of the object type by which the permissions are expected to be inherited. The permissions must be Inherit Only.

Note

Permissions must be used only to define object-specific permissions that override the default permissions defined in the Active Directory schema for that object type. Use this with caution and only if you understand object-specific permissions.

Examples of valid permissions

SDRCWDWO;;user

Delete, read security information, change security information and change ownership permissions on objects of type "user".

CCDC;group;

Create child and delete child permissions to create or delete objects of type "group".

RPWP;telephonenumber;

Read property and write property permissions on telephone number property.

DsAcls (Dsacls.exe)


DsaStat examples

Consider a network with the following domains and servers:

  • Domain, with two domain controllers:
    DomainS1 (which is also a Global Catalog)
    DomainS2
    The distinguished name of the domain is DC=Domain,DC=com.
  • Child.Domain, a child domain of Domain, with one domain controller:
    ChildS1 (which is also a Global Catalog)
    The distinguished name of the domain is DC=Child,DC=Domain,DC=com.

Example one

To compare the number of objects in the directory for the domain Domain, run the following:

dsastat –s:DomainS1;DomainS2 –b:DC=Domain,DC=com –gcattrs:objectclass –p:999

This search merely keeps a count of the different types of objects in each of the replicas and then compares the count for each object class.

Example two

To perform a full comparison of each object in the domain Domain, run the following:

dsastat –s:DomainS1;DomainS2 –b:DC=Domain,DC=com –gcattrs:all –sort:true –t:false –p:16

This search does a full-content search and comparison of all the objects in the domain Domain. The default filter is "(objectclass=*)" and so all objects will be retrieved by this search. The objects are also sorted based on objectGUID to improve the performance of the comparison operation.

Example three

To perform a comparison of all users in the Sales organizational unit in the Domain domain, run the following:

dsastat –s:DomainS1;DomainS2 –b:OU=Sales,DC=Domain,DC=com –gcattrs:all –sort:true –t:false –p:16 –filter:"(&(objectclass=user)(!objectClass=computer))"

This example illustrates the specification of the base search path at a subtree of the domain, in this case the organizational unit names Sales. In addition, the filter specifies that the comparison is only concerned with user objects and not computer objects. Note that since computer objects are derived from user objects in the class hierarchy, a search filter specifying objectclass=user will return both user and computer objects.

Example four

To perform a comparison between a domain controller in the Child domain and a Global Catalog server in the domain Domain, run the following (note that the Global Catalog server DomainS1 in the domain Domain holds a partial replica of all objects from the domain Child):

dsastat –s:DomainS1:3268;ChildS1 -b:DC=Domain,DC=Domain,DC=com -gcattrs:objectclass –p:999

This search compares the Global Catalog on DomainS1 and checks to see if it has a consistent partial image of the domain Child. This search does not perform a full-content comparison, but simply checks that the object count is the same between the Global Catalog and the domain controller ChildS1 in the domain Child.

Example five

To perform a full-content comparison between a domain controller in the Child domain and a Global Catalog server in the domain Domain, run the following:

dsastat –s:DomainS1:3268;ChildS1 –b:DC=Child,DC=Domain,DC=com –gcattrs:auto –sort:true –t:false –p:16

This example performs a full-content comparison between all the objects that have been replicated to the Global Catalog. Specifying the auto option for -gcattrs ensures that only the attributes replicated to the Global Catalog are retrieved.

DsaStat (Dsastat.exe)

DsaStat syntax


DsaStat syntax

DsaStat command-line options can be used to minimize or focus your search or comparisons.

dsastat [/?] [-loglevel:option] [-output:option] [-f:filename] [-s:servername[portnumber][;servername[portnumber];...]] [-t:option] [-sort:option] [-p:entrynumber] [-b:searchpath] [-filter:ldapfilter] [-gcattrs:option[;option;...]]

Parameters

/?
displays help for DsaStat, along with the default options and parameter values.
-loglevel:option
specifies the extent of logging that is performed during execution. Valid option values are: INFO, TRACE, and DEBUG. The default option is INFO.
-output:option
specifies where the results of DsaStat are displayed. Valid option values are: SCREEN, FILE, or BOTH. If FILE is selected the output is saved to a file named Dsastat.log.nnnnn. The default option is SCREEN.
-f:filename
specifies the name of an initialization file to use for parameters if user does not specify the parameters on the command line.
-s:servername[portnumber][;servername[portnumber];...]
specifies the names of the servers on which the comparison will be performed. Separate each server name with a semicolon. The server name can be appended with the TCP/IP port number. If the port number is ":3268", the comparison will be performed against the global catalog of that server. The default port number is the default LDAP port (389).
-t:option
specifies whether to whether to perform a statistics comparison or a full-content comparison. Valid option values are TRUE (perform a statistical comparison) or FALSE (perform a full-content comparison). The default is TRUE, perform a statistical comparison. The statistical comparison merely counts the objects. It does not compare the attributes of the objects that have been retrieved from the domain controllers and it ignores the –gcattrs option. A full-content comparison retrieves every object with attribute values and performs a comparison of the attributes of the same object from different domain controllers.
-sort:option
determines whether the search operations are performed with sorting based on object GUID. Valid option values are TRUE (perform sorted queries) or FALSE (do not perform sorted queries). The default value is FALSE. Performing a sorted query by setting this option to TRUE has a negative impact on performance; however, it complements the full-content comparison because it ensures that objects are returned in nearly the same order from different servers and improves the performance of full-content comparison.
-p:entrynumber
sets page size for ldap_search operation. The valid range for entrynumber is from 1 to 999. The default value is 64. The number indicates the number of entries to be returned per page. If the directory objects are large (such as user objects with many of their attributes populated with values), it is advisable to use a smaller page size.
-b:searchpath
sets the Distinguished Name of the base search path. This allows DsaStat to perform the comparison against any subtree of the directory.
-filter:ldapfilter
sets LDAP filter used in the LDAP search operation. The filter must conform to LDAP search syntax as specified in RFC 2254. The default filter is "(objectclass=*)" .
-gcattrs:option[;option;...]
specifies attributes to be returned from search. This option is used only if the comparison option –t is set to FALSE. Valid option values are any LDAP attribute, objectclass when no attributes are requested, auto if only those attributes that are replicated to the Global Catalog are requested, and all when you want all attributes contained in an object are to be retrieved. If specific multiple LDAP attributes are requested, separate each LDAP value with a semicolon.

DsaStat (Dsastat.exe)

DsaStat examples


Dump Check examples

Dump Check displays the stop screen information, displays processor information, and checks the memory.dmp file for errors.

To check a memory.dmp file, run:

dumpcheck systemroot\memory.dmp

Output:

Filename . . . . . . .C:\WINNT\memory.dmp
Signature. . . . . . .PAGE
ValidDump. . . . . . .DUMP
MajorVersion . . . . .free system
MinorVersion . . . . .1877
DirectoryTableBase . .0x06f84000
PfnDataBase. . . . . .0x87f3f000
PsLoadedModuleList . .0x80465480
PsActiveProcessHead. .0x804654b0
MachineImageType . . .i386
NumberProcessors . . .1
BugCheckCode . . . . .0x00000050
BugCheckParameter1 . .0xe1eb83c1
BugCheckParameter2 . .0x00000001
BugCheckParameter3 . .0x00000000
BugCheckParameter4 . .0x00000001

ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x8043cea1

NumberOfRuns . . . . .0x3
NumberOfPages. . . . .0x7f9e
Run #1
  BasePage . . . . . .0x1
  PageCount. . . . . .0x9f
Run #2
  BasePage . . . . . .0x100
  PageCount. . . . . .0xeff
Run #3
  BasePage . . . . . .0x1000
  PageCount. . . . . .0x7000

**************
**************--> Validating the integrity of the PsLoadedModuleList
**************

**************
**************--> Performing a complete check (^C to end)
**************
**************
**************--> Validating all physical addresses
**************
**************
**************--> Validating all virtual addresses
**************
**************
**************--> This dump file is good!
**************

Dump Check syntax

Dump Check (Dumpchk.exe)


Dump Check syntax

dumpchk
[-v]
[-p]
[-c]
[-x]
[-e]
[-y]
[-?]
CrashDumpFile

Parameters

-v
Uses verbose mode.
-p
Prints crashdump header; performs no crash dump file validation.
-c
Performs a crash dump file validation.
-x
Performs extra file validation. Takes several minutes.
-e
Does a dump exam.
-y Path
Specifies the path to the symbol files.
-?
Displays Help
CrashDumpFile
Specifies the name of the crash dump file.

Dump Check examples

Dump Check (Dumpchk.exe)


FileVer syntax

Open command prompt now.

filever [/s] [/v] [/e] [/x] [/b] [/a] [/d] [[drive:][path][filename]]

Parameters

/s
Displays files in specified directory and all subdirectories.
/v
Lists verbose version information if available.
/e
Lists executables only.
/x
Displays short names generated for non-8.3 file names.
/b
Uses bare format (no dir listing).
/a
Specifies not to display file attributes.
/d
Specifies not to display file date and time.
/a
Specifies not to display file attributes.
Filever (Filever.exe)


GFlags example: Using GFlags and Poolmon to troubleshoot a memory leak

Poolmon, which is a Windows 2000 Support Tool used for debugging, can be used to monitor the memory tags. With Poolmon you can monitor total paged and non-paged pool bytes. Unless specific global flags are enabled using GFlags, Poolmon will not execute and instead will fail with the following error: "Query pooltags Failed c0000002".

To troubleshoot a memory leak with Gflags and Poolmon

  1. Run Gflags.Exe without arguments.

  2. Select Enable pool tagging from the list of options, click Apply, and then click Okay.

  3. Shutdown and restart the computer.

  4. Run Poolmon with the following command:
    poolmon.exe -b

Where -b sorts tags by max byte usage.

Example output

Memory: 16224K Avail: 4564K PageFlts: 31 InRam Krnl: 684K P: 680K
 Commit: 24140K Limit: 24952K Peak: 24932K  Pool N: 744K P: 2180K

 Tag  Type    Allocs          Frees         Diff   Bytes      Per Alloc
-----------------------------------------------------------------------

 CM   Paged    1283 (   0)    1002 (   0)    281 1377312 (     0) 4901
Strg  Paged   10385 (  10)    6658 (   4)   3727  317952 (   512)   85
 Fat  Paged    6662 (   8)    4971 (   6)   1691  174560 (   128)  103
MmSt  Paged     614 (   0)     441 (   0)    173   83456 (     0)  482

The columns show usage for each tag name. By monitoring periodically which tag's bytes are increasing in allocation without being freed up you may be able to identify a possible leakage.

GFlags syntax

Global Flags Editor (Gflags.exe)

Global tags values reference


GFlags syntax

gflag [-r [flag [maxdepth]] [-k [flag]] [-i ImageFileName [flag]] [-l flag commandline...]

Note

Starting GFlags without arguments starts the GUI. For either command-line or GUI changes, reboot for new settings to take effect.

Parameters

-r [flag] [maxdepth]
Displays current system registry settings.
  • If the switch is specified without flags, then current settings are displayed, not modified.
-k [flag]
Operates on kernel settings of running system.
  • If the switch is specified without flags, then current settings are displayed, not modified.
-i ImageFileName [flag]
Operates on settings for a specific image file.
  • If the flag specified for the –i switch is FFFFFFFF, then the registry entry for that image is deleted.
-l [flag commandline]
Launches a command line with a specific setting.
flag
Is one of the following:
  • A single hexadecimal number that specifies all 32-bits of the GlobalFlags value (for example 0x1234578).
  • One or more arguments beginning with a "+" or "-", where a + means to set the corresponding bit(s) in the GlobalFlags and a - means to clear the corresponding bit(s). The + or - character can be followed by a hexadecimal number or a three letter abbreviation for a Global Flag. Valid abbreviations are:

Valid Global Flag Abbreviations

Abbreviation | Description
kst | Create kernel mode stack trace database
ust | Create user mode stack trace database
dic | Debug Initial Command
dwl | Debug WINLOGON
dhc | Disable Heap Coalesce on Free
ddp | Disable kernel mode DbgPrint output
dps | Disable paging of kernel stacks
dpd | Disable protected DLL verification
ece | Enable Close Exception
d32 | Enable debugging of Win32 Subsystem
eel | Enable Exception Logging
hat | Enable Heap API Call Tracing
hfc | Enable heap free checking
hpc | Enable heap parameter checking
htg | Enable heap tagging
htd | Enable Heap Tagging By DLL
htc | Enable heap tail checking
hvc | Enable heap validation on call
ksl | Enable loading of kernel debugger symbols
eot | Enable Object Handle Type Tagging
pfc | Enable pool free checking
ptg | Enable pool tagging
ptc | Enable pool tail checking
otl | Maintain a list of objects for each type
hpa | Place heap allocations at ends of pages
sls | Show Loader Snaps
soe | Stop On Exception
shg | Stop on Hung GUI
idp | unused

Global Flags Editor (Gflags.exe)

GFlags example: Using Gflags and Poolmon to troubleshoot a memory leak

Global tags values reference


Global tags values reference

The following are global tags for Windows 2000:

Flag Name | 32 Bit Hex Value
FLG_STOP_ON_EXCEPTION | 0x00000001
FLG_SHOW_LDR_SNAPS | 0x00000002
FLG_DEBUG_INITIAL_COMMAND | 0x00000004
FLG_STOP_ON_HUNG_GUI | 0x00000008
FLG_HEAP_ENABLE_TAIL_CHECK | 0x00000010
FLG_HEAP_ENABLE_FREE_CHECK | 0x00000020
FLG_HEAP_VALIDATE_PARAMETERS | 0x00000040
FLG_HEAP_VALIDATE_ALL | 0x00000080
FLG_POOL_ENABLE_TAIL_CHECK | 0x00000100
FLG_POOL_ENABLE_FREE_CHECK | 0x00000200
FLG_POOL_ENABLE_TAGGING | 0x00000400
FLG_HEAP_ENABLE_TAGGING | 0x00000800
FLG_USER_STACK_TRACE_DB | 0x00001000
FLG_KERNEL_STACK_TRACE_DB | 0x00002000
FLG_MAINTAIN_OBJECT_TYPELIST | 0x00004000
FLG_HEAP_ENABLE_TAG_BY_DLL | 0x00008000
FLG_IGNORE_DEBUG_PRIV | 0x00010000
FLG_ENABLE_CSRDEBUG | 0x00020000
FLG_ENABLE_KDEBUG_SYMBOL_LOAD | 0x00040000
FLG_DISABLE_PAGE_KERNEL_STACKS | 0x00080000
FLG_HEAP_ENABLE_CALL_TRACING | 0x00100000
FLG_HEAP_DISABLE_COALESCING | 0x00200000
FLG_ENABLE_CLOSE_EXCEPTIONS | 0x00400000
FLG_ENABLE_EXCEPTION_LOGGING | 0x00800000
FLG_ENABLE_HANDLE_TYPE_TAGGING | 0x01000000
FLG_HEAP_PAGE_ALLOCS | 0x02000000
FLG_DEBUG_INITIAL_COMMAND_EX | 0x04000000
FLG_VALID_BITS | 0x07FFFFFF

These values are stored in the registry in the following location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
\Session Manager\GlobalFlag

The default value for GlobalFlag is 0, so Windows 2000 does not expend extra overhead in gathering pooltag information. If set to 0, all system registry global flag settings are disabled. For more information, see the definition of Ntexapi.h FLG_ in the Win32 Software Development Kit.

GFlags can also set the flag required for the kernel feature of Oh.exe, a Microsoft Windows 2000 Resource Kit tool that shows the handles of open windows.

GFlags syntax

GFlags example: Using Gflags and Poolmon to troubleshoot a memory leak

Global Flags Editor (Gflags.exe)


Glossary

A

ACE

ACL

ACS

Active Directory

ActiveX

Admission Control Service

API

associate

B

backup domain controller

basic input/output system

batch program

BDC

BIOS

browser

C

CDE

CGI

checked build

code page

COM

Common Gateway Interface

Component Object Model

CRC

Cyclical Redundancy Check

D

daemon

Dfs

DHCP

directory

directory service

distinguished name

Distributed File System

DLL

distinguished name

DNS

domain

domain controller

Domain Name System

Dynamic Host Configuration Protocol

dynamic-link library

E

environment variable

F

FAT

FAT32

fault tolerance

File Transfer Protocol

filter

Floating Single Master Operations

flow

forest

frame

FTP

FSMO

G

gateway

globally unique identifier

Group Policy

Group Policy object

GUI

GUID

H

HAL

handle

Hardware Abstraction Layer

heap

heap manager

hierarchical storage management

High-Performance File System

hive

HOSTS

HPFS

HSM

HTML

HTTP

Hypertext Markup Language

Hypertext Transfer Protocol

I

Internet Protocol

Internet Server Application Program Interface

IP

IP address

IPX/SPX

ISAPI

J

Jet

K

KCC

KDC

Kerberos

kernel

kernel mode

key

key distribution center

Knowledge Consistency Checker

Korn shell

ksh

L

LAN

local area network

LDAP

Lightweight Directory Access Protocol

M

MAC

Management Information Base

Master Boot Record

MBR

Media Access Control

MIB

Microsoft Management Console

mirror set

mixed mode

MMC

N

namespace

native mode

NetBEUI

NetBIOS

NTFS

NTLM

O

Object Linking and Embedding

ODBC

OLE

Open Database Connectivity

organizational unit

OU

P

packet

page fault

partition

partition table

path

PCMCIA

PDC

Performance Monitor

permissions

POP

POSIX

Post Office Protocol

primary domain controller

process

protocol

Q

QoS

Quality of Service

R

RAS

Reduced Instruction Set Computing

Regedit.exe

registry

Registry Editor

Remote Access Service

Remote Procedure Call

Remote Procedure Call service

replication

Request for Comments

Resource Reservation Protocol

RFC

ring transition

RISC

router

RPC

RPC service

RSVP

S

SAM

schema

script

SCSI

Security Accounts Manager

security descriptor

security identifier

Server Message Block

service

sh

shell

SID

Simple Mail Transport Protocol

Simple Network Management Protocol

site

Small Computer System Interface

SMB

SMTP

snap-in

SNMP

socket

SQL

status area

STDERR

STDIN

STDOUT

stripe set

stripe set with parity

Structured Query Language

subnet mask

symbol files

sysvol

T

TAPI

TCP/IP

TDI

Telephony API

telnet

thread

touch

Traffic Control

Transmission Control Protocol/Internet Protocol

Transport Driver Interface

transport protocol

tree

trust relationship

U

UDP

UNC

Unicode

Uniform Resource Locator

Universal Naming Convention

Universal Serial Bus

UNIX

update sequence number

URL

USB

User Datagram Protocol

user profile

USN

UUEncoding/Decoding

V

volume set

W

WAN

wc

wide area network

Windows Internet Name Service

Windows NTLM

WINS

word count

X

X.500

Y, Z

No entries


Glossary

A B C D E F G H I J K L M
N O P Q R S T U V W X Y Z
To copy or print a glossary definition from a popup window, select the text in the popup window using the left mouse button, right-click the selected text, and on the menu that appears click Copy or Print. In the Print dialog box under Page Range, click Selection.


Kill examples

The first step is to get the process name or ID from Tlist as show below.

TList sample output

C:\NTRESKIT>tlist

   0 System Process
   2 System
  25 smss.exe
  33 csrss.exe
  39 WINLOGON.EXE
  45 SERVICES.EXE
  48 LSASS.EXE
  74 SPOOLSS.EXE
  88 RPCSS.EXE
139 INV32CLI.EXE
168 RCONSVC.EXE
 180 atsvc.exe
193 WUSER32.EXE
 203 inetinfo.exe
 204 wnvirq32.exe
 245 cidaemon.exe
 259 NDDEAGNT.EXE
  69 EXPLORER.EXE      Program Manager
 275 systray.exe

Example: Killing the wnvirq32 process by using the process id

C:\NTRESKIT>kill 204
process #204 killed

Example: Killing the atsvc process by using the process name

C:\NTRESKIT>kill atsvc
process #180 [atsvc.exe] killed

Task Killing Utility (Kill.exe)

Using Kill

Kill syntax


Kill syntax

kill [/f] {process_id | pattern}

Parameters

/f
Forces the process to terminate, rather than allowing it to halt itself.
process_id
Specifies the ID number of the process to be ended.
pattern
Can be either a complete process name, or an expression using wildcards that will be compared to the process names and window titles of all current processes. For example, typing kill *help* will end all processes with process names or window titles that contain "help".

Task Killing Utility (Kill.exe)

Using Kill

Kill examples


Using Kill

To use Kill

  1. Find the process ID by using TList or another tool that displays process IDs.

  2. Execute Kill with the correct process ID and options. See "Kill syntax" for command-line usage.

Task Killing Utility (Kill.exe)

Kill syntax

Kill examples


KSetup examples

  • Use KSetup with no arguments to see the current settings.
  • Run the KSetup tool on a Windows 2000 workstation to configure the UNIX KDC server and realm the workstation should use. The following sets the UNIX realm and adds a KDC server:

    C:> ksetup /domain DOMAIN.MICROSOFT.COM

    C:> ksetup /addkdc DOMAIN.MICROSOFT.COM mitkdc.microsoft.com

  • Set the local computer account password, as follows:

    C:> ksetup /setcomputerpassword password

    note-icon

    Note

    • Restart the computer for the changes to take effect.

  • Use KSetup to configure a single sign-on to local workstation accounts. Define the account mappings; this maps local computer accounts to Kerberos principals. For example:

    C:> ksetup /mapuser user@DOMAIN.MICROSOFT.COM guest

    C:> ksetup /mapuser AllUsers *

    Note that the second command maps clients to local accounts of the same name.

Kerberos Setup (Ksetup.exe)

KSetup syntax


KSetup syntax

ksetup
[/SetRealm DnsDomainName]
[/MapUser Principal Account]
[/AddKdc RealmName KdcName]
[/DelKdc RealmName KdcName]
[/AddKpasswd Realmname KpasswdName]
[/DelKpasswd Realmname KpasswdName]
[/Server Servername]
[/SetComputerPassword Password]
[/Domain DomainName]
[/ChangePassword OldPasswd NewPasswd]
[/?] [/Help ]

Parameters

/SetRealm DnsDomainName
Sets the name of an RFC1510 Kerberos realm.
/MapUser KerbName LocalName
Maps the name of a Kerberos principal to an account (* = any/all).
/AddKdc Realmname Kdcname
Adds an additional KDC address for the given realm.
/DelKdc RealmName KdcName
Delete instance(s) of KDC address for the realm
/AddKpasswd Realmname KpasswdName
Adds Kpasswd server address for a realm
/DelKpasswd Realmname KpasswdName
Deletes Kpasswd server address for a realm
/Server servername
Specifies the name of a Windows 2000 computer to target changes.
/SetComputerPassword Passwd
Sets the local computer's password.
/Domain DnsDomainName
Uses this domain (blank for domain in your logged-on domain).
/ChangePassword OldPasswd NewPasswd
Changes logged-on user's password via Kpassword.
/? or /Help
Displays the usage screen.

Kerberos Setup (Ksetup.exe)

KSetup examples


KtPass examples

Generate a UNIX host keytab file, map the principal to the account, and set the host principal password.

C:> ktpass /princ host/host_DNS_name@NT_DNS_REALM_NAME /mapuser host_DNS_name$ /pass password /out unixmachine.keytab

Where:
  • hostname is the host DNS name (dns.microsoft.com).
  • NT-DNS-REALM-NAME is the uppercase name of the Windows 2000 domain (DOMAIN.MICROSOFT.COM).
  • hostname$ is the host DNS name with a dollar sign ($) appended; this is the account for the computer.
  • password is a complex password for the account.

Services running on UNIX systems can be configured with service instance accounts in Active Directory. This allows full interoperability. MIT Kerberos clients and servers on UNIX systems can authenticate using the Windows 2000 Kerberos server, and Windows 2000 clients can authenticate to Kerberos services that support GSS API.

Unlike Kerberos principal names, Windows 2000 account names do not have multiple parts. Because of this, it is not possible to directly create an account of the name sample/unix1.ntdomain.microsoft.com. Such a principal instance is created through the service principal name mappings.

  1. Use the Active Directory Management tool to create a user account for the UNIX service; for example, create an account with the name sampleUnix1.
  2. Use the KtPass tool to set up an identity mapping for the user account. Use this command:

    3. The format of the Kerberos service-instance name is: service/host.realm_name, for example:

    C:> ktpass /princ service-instance@REALM /mapuser account-name -pass password /out unixmachine.keytab

    In this case, an account is created with a meaningful name sampleUnix1, and a service principal name mapping is added for sample/unix1.microsoft.com. This is the purpose of using KtPass with the –princ and –mapuser switches.
    note-icon

    Note

    You cannot map multiple service instances to the same user account.

  3. Merge the keytab file with the /etc/krb5.keytab file on the UNIX host.

Kerberos Keytab Setup (Ktpass.exe)

KtPass syntax


KtPass syntax

ktpass /out filename /princ username [/mapuser] [/in filename] [/crpyto type] [/ptype type] [/keyno keynum] [/?]

Parameters

/out
Specifies the name of the Krb5 keytable file to be generated.

Note

This is the keytable you transfer to the UNIX computer and replace or merge with your existing keytable file, /etc/krb5.keytab.

/princ
Principal name in the form user@REALM. Example: "sample "or "host/unix.one.two.com"
/pass
Password to use for this principal name. Use "*" to prompt for the password.
/mapuser
Map the name of a Kerberos principal onto a local account (default: this is not done).
/mapOp
How the mapping attribute is set (default: add it):
  • add : add value (default)
  • set : set value
/DesOnly
Set account for des-only encryption (default:do)
/in
Keytab to read or digest.
/crypto [DES-CBC-CRC | DES-CBC-MD5]
Encryption type to use.
  • DES-CBC-CRC : default
  • DES-CBC-MD5 : more MIT-like
/ptype [KRB5_NT_PRINCIPAL | KRB5_NT_SRV_INST | KRB5_NT_SRV_HST]
Specify the principal type.
  • KRB5_NT_PRINCIPAL : general ptype (recommended); the name of the principal or for users
  • KRB5_NT_SRV_INST : user service instance
  • KRB5_NT_SRV_HST : host service instance
/kvno
Key Version Number (def:1)
/?
Displays the usage screen.

Kerberos Keytab Setup (Ktpass.exe)

KtPass examples


MemSnap example output

Process ID

Proc.Name

Wrkng.Set

PagedPool

NonPgdPl

Pagefile

Commit

Handles

Threads

0

(null)

16384

0

0

0

0

0

1

2

System

28672

0

0

36864

36864

154

26

21

smss.exe

204800

933

1224

167936

167936

31

6

26

csrss.exe

684032

36177

5096

1507328

1507328

302

10

35

winlogon.exe

0

24206

11392

1130496

1130496

52

4

41

services.exe

618496

15513

177716

1097728

1097728

214

13

44

lsass.exe

204800

13051

20624

1036288

1036288

108

12

71

spoolss.exe

32768

16090

709896

3166208

3166208

117

9

Memory Profiling Tool (Memsnap.exe)

MemSnap syntax


MemSnap syntax

memsnap [-t] [-g] [-?] [logfile]

Parameters

-t
Adds tagging information (time (Greenwich mean time (GMT)), date, computer name).
-g
Adds GDI and USER resource counts.
logfile
Specifies the name of the file where MemSnap writes its information (the default is Memsnap.log).

Memory Profiling Tool (Memsnap.exe)

MemSnap example output


MoveTree examples

These examples assume the following scenario:

In the Marketing domain, there is a server called "Server1" and an organizational unit (OU) called "Promotions". In the Sales domain, there is a server called "Server2". The desired operation is to move the "Promotions" organizational Unit from Marketing to Sales and rename the new OU "Sales Promotions".

Movetree /start example

This command performs a test run, and then, if no errors are encountered, performs the move operation. To move the Promotions organizational unit from the Marketing domain to the Sales domain and rename the Promotions organizational unit to Sales Promotions execute the following command:

movetree /start /s Server1.Marketing.Microsoft.Com /d Server2.Sales.Microsoft.com /sdn OU=Promotions,DC=Marketing,DC=Microsoft,DC=Com /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com

Movetree /startnocheck example

To perform the same operation as in the previous /start example without first performing /check, execute the following command:

movetree /startnocheck /s Server1.Marketing.Microsoft.Com /d Server2.Sales.Microsoft.Com /sdn OU=Promotions,DC=Sales,DC=Microsoft,DC=Com /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com

Movetree /continue example

To resume a failed MoveTree operation between Server 1 in the Marketing domain and Server2 in the Sales domain in which the objects were being moved into the "Sales Promotion" organizational unit, execute the following command.

movetree /continue /s Server1.Marketing.Microsoft.Com /d Server2.Sales.Microsoft.Com /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com

Movetree /check example

The following command tests the operation of moving the Promotions organizational unit from the Marketing domain to the Sales domain and renaming the Promotions organizational unit to Sales Promotions. It creates verbose output and runs under the credentials of Microsoft\administrator with the password "********".

movetree /check /s Server1.Marketing.Microsoft.Com /d Server2.Sales.Microsoft.Com /sdn OU=Promotions,DC=Sales,DC=Microsoft,DC=Com /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com /verbose /u Microsoft\administrator /p ********

Using MoveTree in a batch file

The operation in the /start command example could also be performed using a batch file:

movetree /check
 /s Server1.Marketing.Microsoft.Com
 /d Server2.Sales.Microsoft.Com
 /sdn OU=Promotions,DC=Marketing,DC=Microsoft,DC=Com
 /ddn OU=Sales Promotions,DC=Sales,DC=Microsoft,DC=Com
if errorlevel 0 goto start
goto exit
:start
movetree /start
 /s Server1.Marketing.Microsoft.Com
 /d Server2.Sales.Microsoft.Com
 /sdn OU=Promotions,DC=Marketing,DC=Microsoft,DC=Com
 /ddn OU=Sales Promotions ,DC=Sales,DC=Microsoft,DC=Com
:exit

Active Directory Object Manager (Movetree.exe)

MoveTree syntax


MoveTree syntax

movetree {/start | /startnocheck | /continue | /check} /s SrcDSA /d DstDSA /sdn SrcDN /ddn DstDN [/u [Domain\]Username /p Password] [/verbose] [{/? | /help}]

Parameters

/start
Initiates a MoveTree operation. This command includes a /check operation by default (to start a MoveTree operation with no check, use /startnocheck). MoveTree tries to continue the operation until it completes; if there is a network fault or if the destination domain controller becomes unavailable, MoveTree pauses the operation. If an operation has been paused, it may be continued using the /continue command.
/startnocheck
Starts a MoveTree operation with no /check.
/continue
Continues the execution of a previously paused or failed MoveTree operation. This allows the MoveTree operation to continue even if a network fault or a domain controller error has interrupted the initial operation. Specifying /sdn SrcDN is optional for this command.
/check
Performs a test run of the MoveTree operation, checking the whole tree without moving any objects. This enables the administrator to determine if there is sufficent disk space on the destination server, if there are any conflicts with object names or if there are any objects that could not be moved (such as Domain Local or Global groups). The administrator may then take remedial action before performing the actual move.

The /check command returns an error if any of the following conditions are met:

  • The user does not have the necessary permissions to create objects in the destination container.
  • The destination server does not have sufficient disk space to continue the operation.
  • A relative distinguished name conflict exists on the destination server.
  • There is a samAccountName conflict for any object that would be moved.
  • Any objects cannot be moved because they are built-in accounts or they are either a Domain Local or a Global group.
  • Any computer objects would be moved. To move computer accounts and join the computers to the domain, Use NetDom, another Windows 2000 Support Tool.
/s SrcDSA
Specifies the fully qualified primary DNS name of the source server in the domain from which the objects are being moved, for example, Server1.Marketing.Microsoft.Com. Required for all MoveTree commands.
/d DstDSA
Specifies the fully qualified primary DNS name of the destination server in the domain to which the objects are being moved to which the objects are being moved, for example, Server2.Sales.Microsoft.Com. Required for all MoveTree commands.
/sdn SrcDN
Specifies the distinguished name of the source sub-tree (the object being moved), for example, OU=Promotions,DC=Marketing,DC=Microsoft,DC=Com. Required for the /start, /startnocheck, and /check commands; optional for /continue.
/ddn DstDN
Specifies the distinguished name of the destination sub-tree (to which the object is being moved), for example, OU=Promotions,DC=Sales,DC=Microsoft,DC=Com. Required for all MoveTree commands.
/u [Domain\]Username /p Password
Runs MoveTree under the credentials of a valid Username and Password. Optionally, a Domain can be specified as well. If these optional arguments are not provided, MoveTree uses the credentials of the currently logged-on user.
/verbose
Runs MoveTree in verbose mode, which displays more details about the operation as it runs. Optional.
/? or /help
Displays this information on a command-line syntax screen.

MoveTree ErrorLevels

MoveTree returns ErrorLevel 0 for success and ErrorLevels 1 to 5 for different kinds of failure. These values can be used as a criterion for branching when the tool is used in a batch file; see Using MoveTree in a batch file in MoveTree examples.

Error Level | Meaning
0 | Success
1 | Error – command line syntax
2 | Error – directory conflict (duplicate names, insufficient privilege, name conflict, immovable object)
3 | Error - network error (DC unavailable)
4 | Error – system resource (Low VM, disk space)
5 | Error – internal processing error

Active Directory Object Manager (Movetree.exe)

MoveTree examples


System Information categories

System Information

Use the following categories to retreive system configuration information with System Information.

System Summary

General information about your computer and the version of Windows 2000 operating system installed. This summary includes the name and type of your system, the name of your Windows system directory, regional options, and statistics about physical and virtual memory.

Category parameter: | Item name:
SystemSummary | System Summary

Hardware Resources

Hardware-specific settings, namely DMA, IRQs, I/O addresses, and memory addresses. ResourcesConflicts identifies devices that are sharing resources or are in conflict. This helps identify problems with a device.

Category parameters: | Item name:
ResourcesConflicts ResourcesDMA ResourcesForcedHardware ResourcesIO ResourcesIRQs ResourcesMemory ResourcesPageFile | Conflicts/Sharing DMA Forced Hardware IO IRQs Memory Page Files

Components

Information about your Windows configuration, used to determine the status of your device drivers, networking, and multimedia software.

Category parameters: | Item name:
ComponentsMultimedia ComponentsMultimediaAudio ComponentsMultimediaVideo ComponentsMultimediaCDROM ComponentsMultimediaSound ComponentsDisplay ComponentsInfrared ComponentsInput ComponentsKeyboard ComponentsPointDev ComponentsModem ComponentsNetwork ComponentsNetAdapter ComponentsNetworkProtocol ComponentsNetBindings ComponentsNetworkWinSock ComponentsPorts ComponentsSerialPorts ComponentsParallelPorts ComponentsStorage ComponentsStorageDrives ComponentsStorageSCSI ComponentsPrinting ComponentsProblemDevices ComponentsUSB | Multimedia Audio Codecs Video Codecs CD-ROM Sound Device Display Infrared Input Keyboard Point Device Modem Network Adapter Protocol NetBindings WinSock Ports Serial Parallel Storage Drives SCSI Printing Problem Devices USB

Software Environment

A snapshot of the software loaded in computer memory. This information can be used to see if a process is still running or to check version information.

Category parameters: | Item name:
SWEnvDrivers SWEnvEnvVars SWEnvJobs SWEnvPrint SWEnvNetConn SWEnvRunningTasks SWEnvLoadedModules SWEnvServices SWEnvProgramGroup SWEnvStartupPrograms SWEnvOLEReg | Drivers Environment Variables Jobs Print Network Connections Running Tasks Loaded Modules Services Program Groups Startup Programs OLE Registration

Internet Explorer 5

Version, connectivity, cache, content, and security information about the Internet Explorer installed with Windows 2000.

Category parameters: | Item name:
IESummary IEFileVersions IEConnectivity IECache IECacheSummary IECacheObjectList IEContent IEContentSummary IEContentPersonalCertificates IEContentOtherPeopleCertificates IEContentPublishers IESecurity | Summary File Versions Connectivity Cache Summary List of Objects Content Summary Personal Certificates Other People Certificates Publishers Security
System Information (Msinfo32.exe)


System Information extensions

System Information uses a set of controls to collect and display system information from Windows 95, Windows 98, and Windows NT 4.0. You must install extensions (.ocx files) for these controls in order to open and view System Information files (.nfo files), or Windows Report Tool files (.cab files) from these other version of Windows.

To install the System Information extensions, run msinfosetup.exe from the \apps\msinfoext folder on the Resource Kit Companion CD, and then follow the instructions that appear on your screen. The extensions are installed in the \Program Files\Common Files\Microsoft Shared\MSInfo folder of the drive on which Windows 2000 is installed.

System Information (MSInfo32.exe)

Related tools

File required

  • Msinfo32.exe

For more information

For more information about MSInfo, see System Information in Windows 2000 Help.


System Information syntax

msinfo32 [/?] [/report filename] [/s filename] [/nfo filename] [/computer computername] [/categories +|-category name(s)]

Parameters

/?
Displays the syntax for the command-line parameters.
/report filename
Saves the system data for the specified categories to a text file.
/s filename
Saves the system data for the specified categories to a System Information file (NFO file).
/nfo filename
Saves the system data for the specified categories to a System Information file (NFO file).
/computer computername
Opens System Information in Windows 2000, connected to the specified computer.
/categories +|-categoryname(s)
Collects a subset of category information. Use with /report to specify the context for the text report. Use with /s to save specified categories of information in the NFO file. Only the categories you specify will be saved. For example:

C:\>msinfo32 /report my_sys.txt /categories +SWEnvDrivers+ComponentsNetAdapter

You can also save all but a specified category or categories. For example:

C:\>msinfo32 /report my_sys.txt /categories +All-SWEnvDrivers

System Information categories

System Information (Msinfo32.exe)


MsiZap syntax

msizap [*] [F] [R] [P] [A] [T product code] [!] [?]

Parameters

*
Removes all Windows Installer folders and registry keys; adjusts shared dynamic-link library (DLL) counts; stops Windows Installer service.
F
Removes all Windows Installer folders.
U
Removes %USERPROFILE%\msi, AppData\Microsoft\Installer folder.
R
Removes all Windows Installer registry keys.
P
Removes In-Progress key.
N
Removes Windows Installer products from Uninstall key.
V
Stops Windows Installer service.
T
Removes all info for given product code.
A
For any specified removal, just changes ACLs to Admin Full Control.
!
Forces "yes" response to any prompt.
?
Displays verbose help.

Windows Installer Zapper (Msizap.exe)


Netdiag sample output

E:\Program Files\Support Tools>netdiag

.........................................

    Computer Name: ginger
    DNS Host Name: ginger.dns.microsoft.com
    System info : Workstation 2000 (Build 2072)
    Processor : x86 Family 6 Model 5 Stepping 1, GenuineIntel
    List of installed hotfixes :
        Q147222

Netcard queries test . . . . . . . : Passed

Per interface results:

    Adapter : Local Area Connection

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : ginger.dns.microsoft.com
        IP Address . . . . . . . . : 157.54.162.163
        Subnet Mask. . . . . . . . : 255.255.252.0
        Default Gateway. . . . . . : 157.54.161.1
        Primary WINS Server. . . . : 157.55.254.223
        Secondary WINS Server. . . : 157.55.254.224
        Dns Servers. . . . . . . . : 157.55.254.218
                                     157.55.254.216

        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Passed

        NetBT name test. . . . . . : Passed

        WINS service test. . . . . : Passed

Global results:

Domain membership test . . . . . . : Passed

NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured.
        NetBT_Tcpip_{EF3D8BEA-884A-40FC-BB0C-1B59247CABB7}
    1 NetBt transport currently configured.

Autonet address test . . . . . . . : Passed

IP loopback ping test. . . . . . . : Passed

Default gateway test . . . . . . . : Passed

NetBT name test. . . . . . . . . . : Passed

Winsock test . . . . . . . . . . . : Passed

DNS test . . . . . . . . . . . . . : Passed

Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{EF3D8BEA-884A-40FC-BB0C-1B59247CABB7}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{EF3D8BEA-884A-40FC-BB0C-1B59247CABB7}
    The browser is bound to 1 NetBt transport.

DC discovery test. . . . . . . . . : Passed

DC list test . . . . . . . . . . . : Passed

Trust relationship test. . . . . . : Passed
    Secure channel for domain 'home' is to '\\skipper.corp.microsoft.com'.

Kerberos test. . . . . . . . . . . : Passed

LDAP test. . . . . . . . . . . . . : Passed

Bindings test. . . . . . . . . . . : Passed

WAN configuration test . . . . . . : Skipped
    No active remote access connections.

Modem diagnostics test . . . . . . : Passed

The command completed successfully

Network Connectivity Tester (Netdiag.exe)

Netdiag syntax

Netdiag notes: Details about the tests executed


Netdiag notes: Details about the tests executed

Network adapter

netdiag /test:Bindings

A. Enumerate network adapter configuration details for all installed network adapters, including network adapter description, physical address, and resources in use.

B. Verify LAN and WAN adapter driver status - initialized or error.

C. Sense if network adapter is attached to the network (NDIS Autosense).

WAN

netdiag /test:WAN

A. COM port in use and settings: data bits, stop bits, parity, baud rate, error checking, compression, LCP extensions, Unimodem support.

B. Sense if WAN link is up.

Bindings

netdiag /test:Bindings

A. Enumerate all network bindings, including binding failures.

Winsock

netdiag /test:Winsock

A. Enumerate Winsock layered service providers, including minimum and maximum version supported, vendor description, maximum number of sockets, and maximum UDP datagram size.

B. Ping Web Proxy Server, if present.

TCP/IP protocol and related services

General TCP/IP

netdiag /test:IPConfig

A. Configuration information: IP address, subnet mask, default gateway, autoconfiguration enabled, DHCP enabled, LMHOSTS enabled, host name, DNS servers, DNS domain, WINS servers, node type, NetBIOS scope ID, IP address forwarding (routing) enabled, WINS proxy enabled, NetBIOS resolution? (enabled, disabled, by way of DHCP), DNS for Windows name resolution, DHCP class ID, IP address security.

netdiag /test:DefGw

B. Enumerate Configured Default Gateways. Ping current default gateway address if present. If current default gateway not reachable, ping each gateway in the gateway list until success is achieved or the end of the list is reached.

DHCP

A. DHCP lease obtained, lease expires.

B. If Automatic Private IP Addressing (APIPA) address is in use, broadcast to determine if DHCP server is available, including time information so we know how long it took to get a response.

NETBT

netdiag /test:Netstat

A. Enumerate local and remote name cache (for example, nbtstat -c and nbtstat -n).

DNS server

netdiag /test:DNS

A. Ping DNS Server.

B. If server not available: log target address, status code and description.

C. Try next server, per search order, until the end of the list is reached.

D. Query DNS server on Port 53 for SOA record.

WINS server

netdiag /test:WINS

A. Ping WINS Server.

B. Test whether registration of a unique or group name specific to this diagnostic is successful.

C. Test whether name query of the above name is successful.

D. If server not available log target address, status code and description.

E. Try next server, per search order.

IPX protocol

netdiag /test:IPX

A. Get frame type, network ID, packetburst enabled, source routing enabled, RouterMTU.

Routing

netdiag /test:Route

A. Enumerate static routes and report if they are persistent. Note that this test will return "N/A" on Windows 95/98 platforms because it does not apply.

Netware

netdiag /test:Netware

A. Tree or bindery login, default context if tree login, server attached to on bootup (get nearest server reply information).

Distributed systems

A. RPC Tests - Perform an RPC bind and ack.

netdiag /test:DsGetDC

B. Find domain controller in your domain: domain controller name, IP address, domain name, domain GUID, tree name, domain controller site name, our site name, flags

C. Find PDC (Primary Domain Controller) in your domain: domain controller name, IP address, domain GUID, domain name, tree name, domain controller site name, our site name, flags

D. Find Windows 2000 domain controller in your domain: domain controller name, IP address, domain GUID, domain name, tree name, domain controller site name, our site name, flags

netdiag /test:DcList

E. List of domain controllers in domain

netdiag /test:Trust

F. Trust Relationship Test - Enumerate NTLM and Kerberos Trusts.

netdiag /test:Kerberos

G. Kerberos Test: Cached Tickets including server name, end time, and renew time. Note that this test will return "N/A" on Windows 95/98 and Windows NT 4.0 platforms because it does not apply.

netdiag /test:Ldap

H. LDAP Test Un-Authenticated LDAP call - Current time, server name, subschemaSubentry, settings. Note that this test will return "N/A" on Windows 95 and Windows NT 4.0 platforms because it does not apply.

I. NTLM Authenticated LDAP call

J. Authenticated LDAP call

K. IPSEC Test - Is IPSEC enabled?, Enumerate IPSEC policy settings. Note that this test will return "N/A" on Windows 95/98 and Windows NT 4.0 platforms because it does not apply.

Network Connectivity Tester (Netdiag.exe)

Netdiag syntax

Netdiag sample output


Netdiag syntax

Run command prompt.

netdiag [/q] [/v] [/l] [/debug] [/d:DomainName] [/fix] [/DcAccountEnum] [/test:testname] [/skip:testname]

Parameters

/q
Specifies quiet output (errors only).
/v
Specifies verbose output.
/l
Sends output to NetDiag.log; log file is created in the same directory where netdiag.exe was run.
/debug
Specifies even more verbose output; may take a few minutes to complete.
/d:DomainName
Finds a domain controller in the specified domain.
/fix
Fixes minor problems.
/DcAccountEnum
Enumerates domain controller computer accounts.
/test:TestName
Execute only listed test or tests. TCP/IP must be bound to one or more adapters before running any of the tests. Non-skippable tests will still be run. Valid tests are:
  • Autonet - Automatic Private IP Addressing (APIPA) address test
  • Bindings - Bindings test
  • Browser - Redir and Browser test
  • DcList - Domain controller list test
  • DefGw - Default gateway test
  • DNS - DNS test
  • DsGetDc - Domain controller discovery test
  • IpConfig - IP address configuration test
  • IpLoopBk - IP address loopback ping test
  • IPX - IPX test
  • Kerberos - Kerberos test
  • Ldap - LDAP test
  • Member - Domain membership test
  • Modem - Modem diagnostics test
  • NbtNm - NetBT name test
  • Ndis - Netcard queries test
  • NetBTTransports - NetBT transports test
  • Netstat - Netstat information test
  • Netware - Netware test
  • Route - Routing table test
  • Trust - Trust relationship test
  • WAN - WAN configuration test
  • WINS - WINS service test
  • Winsock - Winsock test
/skip:TestName
Skip the named test. Valid tests are:
  • Autonet - Automatic Private IP Addressing (APIPA) address test
  • Bindings - Bindings test
  • Browser - Redir and browser test
  • DcList - Domain controller list Test
  • DefGw - Default gateway Test
  • DNS - DNS Test
  • DsGetDc - Domain controller discovery test
  • IpConfig - IP address configuration test
  • IpLoopBk - IP address loopback ping test
  • IPX - IPX test
  • Kerberos - Kerberos test
  • Ldap - LDAP test
  • Modem - Modem diagnostics test
  • NbtNm - NetBT name test
  • Netstat - Netstat information test
  • Netware - Netware test
  • Route - Routing table test
  • Trust - Trust relationship test
  • WAN - WAN configuration test
  • WINS - WINS service test
  • Winsock - Winsock test

Network Connectivity Tester (Netdiag.exe)

Netdiag sample output

Netdiag notes: Details about the tests executed


NetDom examples

Sample workstation or member server operations

Adding a workstation or member server to a domain

Add the workstation mywksta to the Windows NT 4.0 domain microsoft:

NETDOM ADD /d:microsoft mywksta
/ud:mydomain\admin /pd:password

Add the workstation mywksta to the Windows 2000 domain devgroup.microsoft.com in the organizational unit (OU) Dsys/workstations:

NETDOM ADD /d:devgroup.microsoft.com
mywksta /OU:OU=Dsys,OU=Workstations,DC=microsoft,DC=com

Note

  • If /OU is not specified the account is created in the Computers container.

Joining a workstation or member server to a domain

Join mywksta to the devgroup.microsoft.com domain in the Dsys/workstations organizational unit.

NETDOM JOIN /d:devgroup.microsoft.com
mywksta /OU:OU=Dsys,OU=Workstations,DC=microsoft,DC=com

In addition to adding the computer account to the domain, the workstation is modified to contain the appropriate shared secret to complete the Join operation.

Removing a workstation or member server from a domain

To remove mywksta from the mydomain domain and have the workstation be part of a workgroup:

NETDOM REMOVE /d:mydomain mywksta
/ud:mydomain\admin /pd:password
Moving a workstation or member server from one domain to another

To move mywksta from its current domain into the mydomain domain:

NETDOM MOVE /d:mydomain mywksta
 /ud:mydomain\admin /pd:password

If the destination is a Windows 2000 domain, the SIDHistory for the workstation is updated, retaining the security permissions that the computer account had previously.

Resetting the secure channel for a workstation, member server, or Windows NT 4.0 BDC

To reset the secure channel secret maintained between mywksta and devgroup.microsoft.com (regardless of OU):

NETDOM RESET /d:devgroup.microsoft.com
 mywksta

To reset the secure channel between the Windows NT 4.0 PDC for Northamerica and the backup domain controller NABDC:

NETDOM RESET /d:Northamerica NABDC
Forcing a secure channel session between a member and a specific domain controller

Members may often establish secure channel sessions with non-local domain controllers. To force a secure channel session between a member and a specific domain controller, add the /Server option to the RESET command:

NETDOM RESET /d:devgroup.microsoft.com
mywksta /Server:mylocalbdc
Verifying a workstation or member server secure channel

To verify the secure channel secret maintained between mywksta and devgroup.microsoft.com:

NETDOM VERIFY /d:devgroup.microsoft.com
mywksta

Sample domain TRUST operations

Establishing a trust relationship

When used with the TRUST command, the /d:domain parameter always refers to the trusted domain.

To have the Windows NT 4.0 resource domain USA-Chicago trust the Windows NT 4.0 account domain Northamerica:

NETDOM TRUST /d:Northamerica USA-Chicago
/ADD /Ud:Northamerica\admin /Pd:*
/Uo:USA-Chicago\admin /Po:*

>Password for Northamerica\admin: xxxx
>Password for USA-Chicago\admin: yyyy

The user must have credentials for both domains. /Pd: can be used to specify the password for Northamerica\admin while /Po: can be used to specify the password for USA-Chicago\admin. If passwords are not provided on the command line, the user will be prompted for both.

The /TWOWAY option can be appended to specify a bidirectional trust:

NETDOM TRUST /d:marketing.microsoft.com
engineering.microsoft.com /ADD /TWOWAY
/Uo:admin@engineering.microsoft.com
/Ud:admin@marketing.microsoft.com
Establishing a trust relationship with a non-Windows Kerberos realm

To establish a one-way trust so that Northamerica trusts the non-Windows Kerberos realm ATHENA:

NETDOM TRUST /d:ATHENA Northamerica /ADD /PT:password /REALM

The /d option specifies the TRUSTED domain and /REALM indicates that this is a non-Windows Kerberos realm. The order of the domains is not important and credentials to the Windows 2000 domain can be supplied if needed. Note that verifying a specific trust relationship will usually require credentials unless the user has domain admin privileges on both domains.

To allow the Kerberos realm ATHENA to trust the Northamerica domain:

NETDOM TRUST /d:Northamerica ATHENA /ADD

To make the trust bi-directional, you can specify /TWOWAY.

Changing the trust from ATHENA to Northamerica to transitive (non-Windows Kerberos trusts are created non-transitive)

NETDOM TRUST Northamerica /d:ATHENA /TRANS:yes

Displaying the transitive state

NETDOM TRUST Northamerica /d:ATHENA /TRANS

The order of the two domains above is not important (either can be the non-Windows Kerberos domain).

Breaking a trust relationship

To undo the trust that USA-Chicago has for Northamerica,

NETDOM TRUST /d:Northamerica USA-Chicago /REMOVE

To break a two-way trust relationship

NETDOM TRUST /d:marketing.microsoft.com
 Engineering.microsoft.com /REMOVE /TWOWAY
  /Uo:admin@engineering.microsoft.com
  /Ud:admin@marketing.microsoft.com
Verifying a specific trust relationship

To verify the one-way trust that USA-Chicago has for Northamerica:

NETDOM TRUST /d:Northamerica USA-Chicago /VERIFY

To verify a two-way trust between the Northamerica and Europe domains:

NETDOM TRUST /d:Northamerica EUROPE /VERIFY /TWOWAY

The verify command checks that the appropriate shared secrets are synchronized between the two items involved in the trust.

Resetting a specific trust relationship

To reset the secure channel for the one-way trust between Northamerica and USA-Chicago:

NETDOM TRUST /d:Northamerica USA-Chicago
 /Ud:Northamerica\admin /RESET

The reset command synchronizes the appropriate shared secrets if they are not already synchronized.

Verifying Kerberos functionality

To verify Kerberos authentication between a workstation and a service located in domain devgroup.microsoft.com:

NETDOM TRUST /d:devgroup.microsoft.com
[workstation] /VERIFY /KERBEROS

If the workstation parameter is omitted, the current workstation is used.

The NETDOM TRUST command with the /Verify /Kerberos options attempts to get a session ticket for the Kerberos Admin service in the target domain. If successful, it can be concluded that all Kerberos operations (for example KDC referrals) are operating correctly between the workstation and the target domain.

Note

  • The operation can not be executed remotely; it must be run on the workstation being tested.

Sample domain QUERY operations

Viewing domain membership

List all the workstations in the domain Northamerica:

NETDOM QUERY /d:Northamerica WORKSTATION

List all of the Servers in Northamerica:

NETDOM QUERY /d:Northamerica SERVER

List all the domain controllers in the domain Northamerica:

NETDOM QUERY /d:Northamerica DC

List all of the OUs in devgroup.microsoft.com:

NETDOM QUERY /d:devgroup.microsoft.com OU

List the PDC for Northamerica:

NETDOM QUERY /d:Northamerica PDC

List the current PDC Emulator for devgroup.microsoft.com:

NETDOM QUERY /d:devgroup.microsoft.com FSMO
Secure channel batch repair

The QUERY command can be used in conjunction with the /Verify and /Reset options to perform these operations all together. The output of the QUERY command can be piped to the NETDOM VERIFY or NETDOM RESET command.

List all servers and verify secure channel secret:

NETDOM QUERY /d:Northamerica SERVER /VERIFY

List all workstations and reset any unsynchronized secure channel secrets:

NETDOM QUERY /d:Northamerica WORKSTATION /RESET
Viewing domain trusts

To view all the direct trust relationships for the domain Northamerica:

NETDOM QUERY /d:Northamerica
/Ud:Northamerica\admin DOMAIN /Direct

To view all the direct and indirect trust relationships for the domain Northamerica:

NETDOM QUERY /d:Northamerica
 /Ud:Northamerica\admin DOMAIN

To view all trust relationships and check their status:

NETDOM QUERY /d:devgroup.microsoft.com
DOMAIN /VERIFY

Sample domain TIME operations

Viewing domain controller time status

To verify the current time for all domain controllers in devgroup.microsoft.com:

NETDOM TIME /d:devgroup.microsoft.com

To verify the time for a specific server:

NETDOM TIME /d:devgroup.microsoft.com
dc1.devgroup.microsoft.com
Synchronizing time

The /Synch switch may be used to resynchronize a specified domain controller or all domain controllers that are out of synch:

NETDOM TIME /d:devgroup.microsoft.com /SYNCH

Specifying a domain controller:

NETDOM TIME /d:devgroup.microsoft.com
dc1.devgroup.microsoft.com /SYNCH
Renaming the domain name for a Windows NT 4.0 BDC

Changing the name of a Windows NT 4.0 domain is a complex process and requires:

  • Renaming the domain name on the Windows NT 4.0 PDC.
  • Modifying all Windows NT 4.0 BDCs.
  • Rejoining all Members (workstations and servers).
  • Deleting and Reestablishing all Trusts.

The following NETDOM syntax is provided to support the modifications necessary to rejoin a BDC to the renamed domain. (step 2 above):

NETDOM RENAME /d:newdomainname BDCServer

Windows 2000 Domain Manager (Netdom.exe)

NetDom syntax


NetDom syntax

netdom command object [/D:domain] [options]

Parameters

All commands and switches are case-insensitive.

command
Is one of the following:

Workstation and Member Server commands
ADD computer /D:domain [/Ud:User /Pd:{Password | *}] [/S:Server] [/OU:ou_path] [/DC]
Adds a workstation or server account (computer) to the domain.
HELP
Displays a command-line syntax screen.
HELP command
- Or -
command /help
Displays a more detailed command-line syntax screen for a particular command.
command | MORE
Displays the detailed command-line syntax screen for command one screen at a time.
HELP SYNTAX
Explains how to interpret the notation used in the syntax screens.
JOIN computer /D:domain [/OU:ou_path] [/Ud:User /Pd:{Password | *}] [/Uo:User /Po:{Password | *}] [/Reboot[:time_in_seconds]]
Joins a workstation or member server (computer) to a domain.
When joining a computer running Windows NT 4.0 or earlier to the domain, the operation is not transacted. Thus, a failure during the operation could leave the computer in an undetermined state with respect to the domain to which it is joined.
The act of joining a computer to a domain creates an account for the computer on the domain, if it does not already exist.
MOVE computer /D:domain [/OU:ou_path] [/Ud:User /Pd:{Password | *}] [/Uo:User /Po:{Password | *}] [/Reboot[:time_in_seconds]]
Moves a workstation or member server (computer) to a new domain.
When moving a computer running Windows NT 4.0 or earlier to the domain, the operation is not transacted. Thus, a failure during the operation could leave the computer in an undetermined state with respect to the domain to which it is moved.
When moving a computer to a new domain, the old computer account in the previous domain is not deleted. If the prior domain is a Windows 2000 domain, the old computer account is disabled.
The act of moving a computer to a new domain creates an account for the computer on the domain, if it does not already exist.
REMOVE computer /D:domain [/Ud:User /Pd:{Password | *}] [/Uo:User /Po:{Password | *}] [/Reboot[:time_in_seconds]]
Removes a workstation or member server (computer) from a domain.
RENAME computer [/D:domain] [/Reboot[:time_in_seconds]]
Renames a Windows NT 4.0 backup domain controller (computer). This can assist in Windows NT 4.0 domain renaming efforts.
RESET computer /D:domain [/S:Server] [/Uo:User /Po:{Password | *}]
Resets the secure connection between a workstation and a domain controller.
VERIFY computer /D:domain [/Uo:User /Po:{Password | *}]
Verifies the secure connection between a workstation and a domain controller.

Domain commands

QUERY /D:domain [/S:Server] [/Ud:User /Pd:{Password | *}] [/Verify] [/Reset] [/Direct] {WORKSTATION | SERVER | DC | OU | PDC | FSMO | TRUST}
Retrieves membership, trust, and other information from a domain.
WORKSTATION, SERVER, DC, and OU query the domain for the lists of, respectively, workstations, servers, domain controllers or organizational units under which the specified user can create a computer object.
PDC, FSMO, and TRUST query the domain for, respectively, the current primary domain controller, list of FSMO owners, or list of its trusts.
TIME computer /D:domain [/Ud:User /Pd:{Password | *}] [/Uo:User /Po:{Password | *}] [/Verify] [/Reset] [WORKSTATION] [SERVER]
Verifies or resets and synchronizes time within a domain.
WORKSTATION and SERVER verify or reset the time for, respectively, all the workstations or domain controllers in a domain.
TRUST trusting_domain_name /D:trusted_domain_name [/Ud:User] [/Pd:{Password | *}] [Uo:User] [/Po:{Password | *}] [/Verify] [/Reset] [/PasswordT:new_realm_trust_password] [/Add] [/Remove [/Force]] [/Twoway] [/Kerberos] [/Transitive[:{yes | no}]]
Establishes, verifies or resets a trust relationship between domains.

object

is the Active Directory object upon which the command is to work, and may be one of the following:

  • Workstation
  • Server
  • Domain Controller
  • Domain

Only certain objects are supported for each command:

Commands | Valid object(s) | Example
ADD | Name of Workstation or Standalone Server | Netdom ADD /D:reskit.ms.com mywksta
ADD | Name of Windows NT 4.0 Backup DomainController | Netdom ADD /D:reskit.ms.com mynt4dc /DC
JOIN | Name of Workstation or Standalone Server | Netdom JOIN /D:reskit.ms.com mywksta
MOVE | Name of Workstation or Standalone Server | Netdom MOVE /D:newdomain mywksta
REMOVE | Name of Workstation or Standalone Server | Netdom REMOVE /D:reskit.ms.com mywksta
RESET | Name of Workstation or Standalone Server | Netdom RESET /D:reskit.ms.com redmond
VERIFY | Name of Workstation or Standalone Server | Netdom VERIFY /D:resourcedom yourwksta
RENAME | Name of Backup Domain Controller | Netdom RENAME /D:newdomain BDC51
QUERY | Workstation, Server, DC, PDC, Domain, FSMO, OU | Netdom QUERY /D:reskit.ms.com DC
TIME | Name of a Domain | Netdom TIME /D:masterdom resourcedom
TRUST | Name of a Domain | Netdom TRUST /D:masterdom resourcedom
/D:domain
-Or-
/Domain:domain
Specifies the domain in which to create the computer account.
Can be an Windows NT version 4.0 NetBIOS name, or a Windows 2000 DNS server name. Regardless of the command, a domain should be provided. If the option is not specified, then the domain that the current computer belongs to is assumed.
For Workstation and Member Server commands, /D:domain refers to the domain which the workstation or member server currently belongs to, or should belong to, after the operation is completed. For domain commands, /D:domain always refers to the trusted domain.
/options

Options available for all commands

/Ud:[Domain\]User
-Or-
/UserD:[Domain\]User
User account used to make the connection with the domain specified by the /d argument. If this option is not specified, the current user account is used.
/Pd:{password | *}
-Or-
/PasswordD:{password | *}
Password of the user account specified with /Ud. If *, then password is prompted for.
/Uo:[Domain\]User
-Or-
/UserO:[Domain\]User
User account used to make the connection with the object on which the action is to be performed. If this option is not specified, the current user account is used.
/Po:[password | *]
-Or-
/PasswordO:{password | *}
Password of the user account specified with /Uo. If *, then password is prompted for.
/S:Server
-Or-
/Server:Server
Specifies a domain controller against which an operation should be performed. This option is useful for commands which otherwise may be performed using any domain controller in /D:domain.
/Verbose
By default, only the result of the operation is reported. For example:
success: mywksta joined to redmond domain

If the verbose operation is specified, then the output lists the success or failure of each transaction necessary to perform the operation. For example:

success: adding machine account for mywksta to mycompany domain
success: configuring lsa on mywksta
success: mywksta joined to mycompany domain

Additionally, NETDOM returns an errorlevel based on the success (0) or failure (1) of the operation.

/Help
Displays online help describing the syntax of this program.

Options available only for the ADD, JOIN, and MOVE commands

/OU:ou_path
Name of a destination organizational unit in /D:domain. This must be the full RFC 1779 distinguished name of the organizational unit.
/Reboot:[time_in_seconds]
-Or-
/Reb:[time_in_seconds]
Specifies that the computer being joined or moved should be shutdown and automatically rebooted after the operation has completed. If the number of seconds before reboot is not specified, the default value of 20 seconds is used.

The following message and a countdown timer are displayed on the workstation's screen prior to the reboot:

The system is shutting down. Please save
all work in progress and logoff. Any unsaved changes
will be lost. This shutdown was initiated because the
domain which this machine belongs to was changed by
nnn.

Where nnn is the name of the adminstrator entered with the /Uo parameter.

Options available only for the ADD command

/DC
creates a domain controller account. This allows the computer accounts for new Windows NT 4.0 Backup Domain Controllers (BDCs) and new Windows 2000 domain controllers to be pre-created. If installing a new Windows NT 4.0 BDC into an existing Windows 2000 domain, the computer account must be pre-created.

Options available only for the domain commands QUERY, TIME and TRUST

/Reset
-Or-
/Rese

When used in conjunction with the QUERY command, the /Reset option specifies that the secure channel secrets for all enumerated memberships or trusts (which are currently broken) be resynchronized. The /Reset switch implies the /Verify switch. Unless the user is an enterprise administrator, it may not be possible to reset all enumerated trusts or memberships.

When used in conjunction with the TIME command, the /Reset option synchronizes the clocks of those domain controllers which are not within the allowable skew range for the domain.

When used in conjunction with the TRUST command, the /Reset option resets the trust secret between trusted domains or between the domain controller and the workstation.

/Verify

When used in conjunction with the QUERY command, the /Verify option specifies that the secure channel secrets for all enumerated memberships or trusts should be verified in addition to being displayed. Unless the user is an enterprise administrator, it may not be possible to verify all secure channel secrets.

When used in conjunction with the TIME command, the /Verify option displays the synchronization status of all domain controllers within the domain.

When used in conjunction with the TRUST command, the /Verify option checks the secure channel secrets upon which a specific trust is based.

Options available only for the domain command QUERY

/Direct
Indicates that the query for trust relationships should only return direct trust relationships rather than direct and indirect ralationships. Available only when domain is specified as the object in a QUERY command.

Options available only for the domain command TIME.

/Synch
Automatically resynchronizes a specified domain controller or all domain controllers that are out of synch.

Options available only for the domain command TRUST

/Add
Specifies that a trust should be created.
/Add /Realm
Indicates that the trust is to be created to a non-Windows Kerberos realm. /Realm is valid only with the /Add option. The /PasswordT option is required.
/PasswordT
New trust password, valid only with the /Add or /Reset options and only if one of the domains specified is a non-Windows Kerberos realm. The trust password is set on the Windows domain only and thus credentials are not needed for the non-Windows domain.
/Remove
Specifies that a trust should be broken.
/Remove /Force
Removes both the trusted domain object and the cross-reference object for the specified domain from the forest. This is used to clean up decomission domains that are no longer in use and were not able to be removed using the Active Directory Installation wizard. This can occur if the domain controller for that that domain was disabled or damaged and there were no domain controllers or it was not possible to recover the domain controller from backup media.
/TwoWay
Specifies that a bi-directional trust relationship should be established rather than a one-way trust relationship.
/Kerberos
In conjunction with the /Verify option, /Kerberos specifies that the Kerberos protocol should be exercised between a workstation and a target domain.
/Transitive
Valid only for a non-Windows Kerberos realm. Non-Windows Kerberos trusts are created non-transitive. Specifying yes sets it to a transitive trust. Specifying no sets it to a non-transitive trust. If neither is specified, then the current transitivity state will be displayed.

Windows 2000 Domain Manager (Netdom.exe)

NetDom examples


NlTest examples for Windows NT 4.0

Example One

Suppose the RANDYMCD Domain trusts the ESS Domain, and a Windows 2000 Professional computer called RANDYMC3 is a member of the RANDYMCD Domain. NlTest can be used to show this trust relationship.

C:\>nltest /trusted_domains
Trusted domain list:
    ESS
The command completed successfully

Example Two

To determine the domain controllers in the RANDYMCD domain:

C:\>nltest /dclist:randymcd
List of DCs in Domain randymcd
    \\RANDYMC2 (PDC)
    \\RANDYMC1
The command completed successfully

Example Three

To determine the domain controllers in the ESS domain:

C:\>nltest /dclist:ess
List of DCs in Domain ess
    \\NET1 (PDC)
The command completed successfully

Example Four

Below are the secure channels between each domain controller in RANDYMCD and a domain controller in the ESS Domain.

C:\>nltest /server:randymc1 /sc_query:ess
Flags: 0
Connection Status = 0 0x0 NERR_Success
Trusted DC Name \\NET1
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully

C:\>nltest /server:randymc2 /sc_query:ess
Flags: 0
Connection Status = 0 0x0 NERR_Success
Trusted DC Name \\NET1
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully

Example Five

The Windows 2000 Professional computer or Windows NT Workstation that is a member of the RANDYMCD domain, has an implicit trust with a domain controller.

C:\>nltest /server:randymc3 /sc_query:randymcd
Flags: 0
Connection Status = 0 0x0 NERR_Success
Trusted DC Name \\RANDYMC2
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully

Example Six

To determine if a domain controller can authenticate a user account:

C:\>nltest /whowill:ESS bob
[20:58:55] Mail message 0 sent successfully (\MAILSLOT\NET\GETDC939)
[20:58:55] Response 0: S:\\NET1 D:ESS A:bob (Act found)
The command completed successfully
C:\>nltest /whowill:randymcd randymc
[21:26:13] Response 0: S:\\RANDYMC2 D:RANDYMCD A:randymc (Act found)
[21:26:15] Mail message 0 sent successfully (\MAILSLOT\NET\GETDC295)
The command completed successfully

Example Seven

NLTEST can be used to find a trusted domain that has a given user account.

C:\>nltest /finduser:sweppler
Domain Name: ESS
Trusted DC Name \\NET1
The command completed successfully

Example Eight

To verify the status of BDC synchronization:

C:\>nltest /bdc_query:randymcd
Server : \\RANDYMC1
        SyncState :  IN_SYNC
        ConnectionState : Status = 0 0x0 NERR_Success
The command completed successfully

NlTest (Nltest.exe)

NlTest syntax

NlTest examples for Windows 2000


NlTest examples for Windows 2000

Example One

To determine the trust relationships for the current domain.

C:\>nltest /trusted_domains
Trusted domain list:
    0: AAAAA (NT 4) (Direct)
    1: BBBBB bbbbb.zzzzz.microsoft.com (Windows 2000) (Forest: 30) (Direct)
    2: CCCCCCC-XXX (NT 4) (Direct)
    3: DDDDDDDDDDDD (NT 4) (Direct)
    4: EEEEEEEEEEEEEE (NT 4) (Direct)
    5: FFFFFFF (NT 4) (Direct)
    6: GGGGGGGGGGGG (NT 4) (Direct)
    7: HHHHHHHHHH (NT 4) (Direct)
    8: IIIIIIIIIIIII (NT 4) (Direct)
    9: JJJJJJ (NT 4) (Direct)
    10: kkkkkkkkk (NT 4) (Direct)
    11: LLLLLL (NT 4) (Direct)
    12: mmmmmmmmmmmm (NT 4) (Direct)
    13: NNN (NT 4) (Direct)
    14: OOOOOOO (NT 4) (Direct)
    15: PPPPPPP (NT 4) (Direct)
    16: QQQQ-YYYY (NT 4) (Direct)
    17: RRRRRR (NT 4) (Direct)
    18: SSSSSSSS (NT 4) (Direct)
    19: TTTTTTTTTTT (NT 4) (Direct)
    20: UUUUUUU (NT 4) (Direct)
    21: VVVVVVVVVVVV (NT 4) (Direct)
    22: WWWWWW (NT 4) (Direct)
    23: AAAAAAAAAAAA (NT 4) (Direct)
    24: BBBBBB (NT 4) (Direct)
    25: CCCCCCC ccccccc.zzzzz.microsoft.com (Windows 2000) (Forest: 30) (Direct)
    26: DDD-EEEEEE ddd-ddddddd.zzzzz.microsoft.com (Windows 2000) (Forest: 30) (Direct)

    27: EEEEEEEEEEEEEE (NT 4) (Direct)
    28: FFFFFFFFFF (NT 4) (Direct)
    29: GGGGGGG-GGG ggggggg-ggg.Microsoft.com (Windows 2000) (Direct)
    30: HHHHH hhhhh.microsoft.com (Windows 2000) (Forest Tree Root) (Primary Domain)
    31: IIIIIIII iiiiiiii.xxxxxxx.zzzzz.microsoft.com (Windows 2000) (Forest: 25)
The command completed successfully

Example Two

To determine the domain controllers in the current domain:

C:\>nltest /dclist:
Get list of DCs in domain '' from '\\AAAAA-BB-01.zzzzz.microsoft.com'.
        AAAAAA4.zzzzz.microsoft.com       [DS] Site: Red-Bldg26
        BBBBBB3.zzzzz.microsoft.com
    CCCCC-CC-07.zzzzz.microsoft.com       [DS] Site: CCC-Zzz-BldgA
    CCCCC-CC-08.zzzzz.microsoft.com [PDC] [DS] Site: Zzz-BldgB
        DDDDDD9.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
      EEEEEEE01.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
        FFFFFF5.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
        GGGGGG0.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
       HHHHHHHC.zzzzz.microsoft.com       [DS] Site: qqqqq
        IIIIII1.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
        JJJJJJ2.zzzzz.microsoft.com       [DS] Site: Zzz-BldgB
The command completed successfully

NlTest (Nltest.exe)

NlTest syntax

NlTest examples for Windows NT 4.0


NlTest syntax

nltest [option] ...

Parameters

Option can be any of the following (options are not case-sensitive):

/SERVER:ServerName
Remotes the NlTest command to the specified server. If this switch is not specified, the command is executed from the local computer.
/QUERY
Queries the local or ServerName server for a healthy secure channel to a domain controller, and the status of directory service replication with the primary domain controller (PDC). This can be very helpful in determining the general status of the Netlogon service.
/REPL
Forces partial synchronization of the local or ServerName backup domain controller (BDC).
/SYNC
Forces a full, immediate synchronization of the local or ServerName BDC.
/PDC_REPL
Forces a UAS change message from the local or ServerName PDC to all BDCs.
/SC_QUERY:DomainName
Queries and verifies the secure channel in the specified domain for a local or remote Windows 2000 computers. This can be executed for a PDC if an explicit trust relationship exists between two domains and the Trusted domain is specified.
/SC_RESET:DomainName
Resets the secure channel between the local or remote Windows 2000 computers. This can be executed for a PDC if an explicit trust relationship exists between two domains and the trusted domain is specified.
/SC_CHANGE_PWD:DomainName
Changes a secure channel password for DomainName (on ServerName, if specified with /SERVER:ServerName).
/DCLIST:DomainName
Lists all domain controllers, PDC and BDCs for a given domain.
/DCNAME:DomainName
Lists the primary domain controller for a given domain.
/DSGETDC:DomainName
Calls DsGetDcName /PDC /DS /DSP /GC /KDC /TIMESERV /GTIMESERV /NETBIOS /DNS /IP /FORCE /WRITABLE /AVOIDSELF /SITE:SiteName /ACCOUNT:AccountName /RET_DNS /RET_NETBIOS
Each of these flags maps to a particular flag bit passed to DsGetDcName. For more information, see the DsGetDcName documentation in the Platform SDK.
/DSDEREGDNS:DnsHostName
Deregisters DNS host records /DOM: /DOMGUID: /DSAGUID:
/DSGETSITE
Calls DsGetSiteName
/DSGETSITECOV
Calls DsGetDcSiteCoverage
/WHOWILL:DomainUser
Queries the domain and indicates which domain controller has the account in their local user account database. This is very useful in determining if a given domain controller contains the user account. If the user name specified is that of the currently logged on user, the user's current password is not sent to the domain controller. This is helpful in determining if duplicate accounts exist across several domains.
/FINDUSER:User
Queries explicit trusted domains for the user specified. This is very useful when determining what trusted domain controller or what trusted domain out of several trusted domains will authenticate a user's credentials when a domain name is not specified in the SMB packet. Many clients, such as Windows for Workgroups version 3.1 and the real-mode redirector in Windows 95, do not specify a domain name.
/TRANSPORT_NOTIFY
Notifies netlogon of new transport.
/BP
Forces a break point in Netlogon on ServerName.
/DBFLAG:HexFlags
Sets new debug flag. For most purposes, use 0x2000FFFF as the value for HexFlags. The entry in the Windows 2000 registry for debug flags is HKLM\System\CurrentControlSet\Services\Netlogon\Parameters\DBFlag.
/USER:UserName
Displays many of the attributes for the specified user account that are maintained in the user account database.

note-icon

Note

This switch does not work for Windows 2000 domain controllers. It does work for Windows NT 4.0 and earlier domain controllers, and for Windows 2000 and Windows NT 4.0 and earlier workstations and servers.

/TIME:HexLSL HexMSL
Converts Windows NT GMT time to ASCII.
HexLSL is a hex value for "least significant longword." HexMSL is a hex value for "most significant longword."
/LOGON_QUERY
Queries the cumulative number of logon attempts at the console, or over the network.
/PARENTDOMAIN
Gets the name of the parent domain of this computer.
/DOMAIN_TRUSTS
Queries for trusted domains (on ServerName, if specified with /SERVER:ServerName) /PRIMARY /FOREST /DIRECT_OUT /DIRECT_IN /ALL_TRUSTS /V.
/BDC_QUERY:DomainName
Queries for a list of backup domain controllers in the specified domain and displays their state of synchronization and replication status.
/SIM_SYNC:DomainName MachineName
Simulates full sync replication.
/LIST_DELTAS:FileName
Displays the contents of the change log file FileName, which list changes to the user account database. Netlogon.chg is the default name.
/SHUTDOWN:Reason [Seconds]
Shuts down local computer or ServerName for Reason, a string, after Seconds, an integer.
For a complete description, see the Platform SDK documentation for InitiateSystemShutdown.
/SHUTDOWN_ABORT
Terminates a system shutdown.
/?
Displays this syntax.

NlTest (Nltest.exe)

NlTest examples for Windows NT 4.0

NlTest examples for Windows 2000


Messages Help notes

When reviewing the help file message information, sometimes the only suggested user action is to obtain help from Microsoft product support or another technical support group. In that case, we suggest you verify that your hardware is on the Microsoft Hardware Compatibility List for your specific product or application. If it is not certified, please replace it with a certified component and retest.

Product Support suggestions

If the error still occurs, collect the following information and have it available when you contact your product support provider for help:

  • The type of hardware that you are using, including networking hardware, if applicable. Include BIOS revision number and any applied flash BIOS/firmware versions.

  • A list of all software (name and version) installed on the system, including service packs and upgrades.

  • The exact text and content of the message that appears on the screen. With messages that stop the box completely, also note the background and text colors (white letters on a black screen or white letters on a blue screen, for example.)

  • A description of actions you took immediately before the error occurred and what you were doing when the error occurred. If the error can be manually reproduced, that list of steps is critical.

  • A description of what happened after the error.

  • Did the system ever work correctly? If so, what has changed since the system last worked properly? (Hardware changes, configuration settings, applications installed, and other changes.)

  • Have your current and/or latest Emergency Repair Disk (ERD) as well as your initial ERD, if available. Also, have your last backup media handy in the event a recovery from system failure is unsuccessful.

Windows 2000 Error and Event Messages Help (W2000msgs.chm)

Using Messages Help


Using Messages Help

How messages in this Help file are organized

The messages in this file have been organized to reflect the Windows 2000 desktop. The messages appear in the Help file as follows:

  • Messages are normally followed by a description of the circumstances that might generate the message and, if appropriate or needed, by a suggested user action.

  • Variable names appear in italics.

  • Most status messages that require no user action are not documented.

How to search for messages

There are several ways to search for messages in the Messages Help file. On the Contents tab, double-click the Messages icon to present a hierarchical listing of topics grouped by application catagory or component as found on the Start menu. (Some additional topical groupings which are not application specific are also included.) This list includes:

  • In Alphabetical Order

  • Administrative Tools

  • Command Line Tools

  • Control Panel

  • Desktop

  • Dynamic Link Libraries

  • Event ID

  • Event Log

  • Help

  • Internet Information Services

  • Kernel

  • Logon

  • Setup

Click on a main component to see a list of the applications that are associated with that component. For example, if you want to find an error message for Dial-up Networking, double-click Accessories on the Contents page. Select Dial-Up Networking to view an alphabetical list of the messages for that application. Once you open a message, you can then use the browse buttons to display other messages in that component.

Click the In Alphabetical Order button to provide access to messages arranged alphabetically by the first letter of the first word of the message. Click on the letter that corresponds to the initial letter in the message. If you cannot find the message that appears on your screen in the alphabetical list, it might be because it begins with a replaceable parameter. Variable names, which are placeholders for the specific word or number that appears in the message, are used as substitutes for replaceable parameters. They appear in italics in the Help file. For example, if the Help file message reads, "number files were not found", the error message that appears on your screen will contain the actual number.

To view the messages that begin with a variable or a punctuation mark, click the In Alphabetical Order button, then the Symbol button. These messages are alphabetized by the variable name used to replace that parameter. The following is a list of all the variable names used in the Messages Help file as substitutes for replaceable parameters:

address | date | name | text
application | drive letter | number | time
code | file system | parameter | user name
command | filename | path |
computer name | group | systemroot |

  • Click the Event ID button to display ranges of event messages that are organized numerically. Click on the appropriate range to display the corresponding messages. The log in which a message appears is indicated at the end of each message string.

  • Click the Event Log button to display the three event logs: System, Security, and Application. The messages in each log are listed alphabetically.

Windows 2000 Error and Event Messages Help (W2000msgs.chm)

Messages Help notes


PMon output format

CPU CpuTime Mem
Usage 		Mem
Diff 		Page
Faults 		Flts
Diff 		Commit
Charge 		Usage
NonP 		Usage
Page 		Pri Hnd
Cnt 		Thd
Cnt 		Image
Name
CPU: CPU %

Identifies the percentage of total CPU usage associated with a particular process.

CpuTime

Expressed as a percentage of the elapsed time that a processor is busy executing a non-Idle thread. It can be viewed as the fraction of the time spent doing useful work. Each processor is assigned an Idle thread in the Idle process that consumes those unproductive processor cycles not used by any other threads.

MemUsage: Memory Usage

Identifies the total memory used.

Page Faults

Page faults/second is a count of the page faults in the processor. A page fault occurs when a process refers to a virtual memory page that is not in its working set in main memory. A page fault will not cause the page to be fetched from disk if that page is on the standby list, and hence already in main memory, or if it is in use by another process with which the page is shared.

Commit Charge

Displays the size of virtual memory (in bytes) that has been Committed (as opposed to simply reserved). Committed memory must have backing (that is, disk) storage available, or must be assured never to need disk storage (because main memory is large enough to hold it).

Usage NonP: Non-paged usage

The size of the non-paged pool, which is a system memory area where space is acquired by operating system components as they accomplish their appointed tasks. Non-paged pool pages cannot be paged out to the paging file, but instead remain in main memory as long as they are allocated.

Usage Page: Page Usage

The amount of the Page File instance in use.

Thd Cnt: Thread Count

Identifies the number of threads for the particular process.

Image Name

Identifies the executable file name or process associated with a particular item.

Process Resource Monitor (PMon.exe)

PMon notes


PMon notes

The Pmon.exe output screen updates every few seconds. An easy way to monitor Pmon.exe over time is to copy the screen to a Notepad file. Do this once an hour or so while you are running your test. This will make it easier to compare values.

Monitor the Commit numbers on the second row. Constantly increasing numbers over several hours will indicate a probable leak. Total Paged and Nonpaged bytes are the last two items on the second row. Also monitor the Commit Charge column. The process with the leak should have an increasing Commit Charge.

Output

Memory: 130484K Avail: 73872K PageFlts: 25 InRam Kernel: 5524K P:11448K

Commit: 87144K/ 53116K Limit: 250300K Peak: 113904K Pool N: 4352K P:15844K

CPU | Cpu Time | Mem Usage | Mem Diff | Page Faults | Flts Diff | Commit Charge | Usage | NonP | Pri Page | Hnd Cnt | Thd Cnt | Image Name
 |  | 19800 | 0 | 23075420 |  |  |  |  |  |  |  | File Cache
97 | 279:00:57 | 16 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 2 | Idle Process
0 | 0:02:42 | 200 | 0 | 3445 | 0 | 36 | 0 | 0 | 8 | 520 | 38 | System
0 | 0:00:00 | 200 | 0 | 2257 | 0 | 164 | 1 | 0 | 11 | 30 | 6 | smss.exe
1 | 0:00:05 | 1092 | 0 | 9287 | 0 | 1964 | 5 | 36 | 13 | 383 | 10 | csrss.exe
0 | 0:00:02 | 1080 | 0 | 7397 | 0 | 2376 | 12 | 21 | 13 | 65 | 3 | WINLOGON.EXE
0 | 0:00:24 | 3396 | 0 | 48089 | 2 | 1412 | 267 | 16 | 9 | 296 | 20 | SERVICES.EXE
0 | 0:00:02 | 1812 | 0 | 6590 | 0 | 1056 | 28 | 10 | 9 | 111 | 13 | LSASS.EXE
0 | 0:00:00 | 268 | 0 | 2457 | 0 | 2076 | 692 | 14 | 8 | 105 | 9 | SPOOLSS.EXE

Process Resource Monitor (PMon.exe)

PMon output format


Poolmon.exe examples

Poolmon examples

Example output

The columns show usage for each tag name. By monitoring periodically which tag's bytes are increasing in allocation without being freed up you may be able to identify a possible leakage.

Column name | Information displayed
Tag | is the 4-byte tag given to the pool allocation
Type | is paged or non-paged
Allocs | is count of all allocations
( ) | is difference in Allocs column from last update
Frees | is count of all frees
( ) | difference in Frees column from last update
Diff | is (Allocs - Frees)
Bytes | is the total bytes consumed in pool
( ) | difference in Bytes column from last update
Per Alloc | is (Bytes / Diff)
Memory: 16224K Avail: 4564K PageFlts: 31 InRam Krnl: 684K P: 680K
 Commit: 24140K Limit: 24952K Peak: 24932K  Pool N: 744K P: 2180K

 Tag  Type    Allocs          Frees         Diff   Bytes      Per Alloc
-----------------------------------------------------------------------

 CM   Paged    1283 (   0)    1002 (   0)    281 1377312 (     0) 4901
Strg  Paged   10385 (  10)    6658 (   4)   3727  317952 (   512)   85
 Fat  Paged    6662 (   8)    4971 (   6)   1691  174560 (   128)  103
MmSt  Paged     614 (   0)     441 (   0)    173   83456 (     0)  482

Example usage: detecting memory leakage

Consider a scenario where a memory leak is caused by an application or by a process that allocates memory for use, but does not free it up when finished. The result is that available memory is completely used over time, often causing the system to stop functioning properly.

It will probably take a few hours of generating data before you can make a determination about what is causing the problem. Starting your test will cause the counters to jump. It may take a while for the memory pools to reach a steady state.

  1. Run poolmon.exe.
  2. Press P until Poolmon comes up with the second column "type "showing the value "paged".
  3. Press B. This will sort the tag usage bytes from largest to smallest.
  4. Start your test, and leave it running.
  5. Save the information generated by Poolmon, either as a screenshot, or by pasting into Notepad.
  6. Press P until only "nonpaged" tags are displayed.
  7. Press B. This will sort the tag usage bytes from largest to smallest.
  8. Save the information generated by Poolmon, either as a screenshot, or by pasting into Notepad.
  9. Repeat these steps every half or so for two or more hours.

At the end of this time, you can analyze the tags to see which ones are continuing to increase in size. Stop your test and wait a few hours. See how much of the tag(s) you found were increasing in size have freed up. The ones that aren't freed up, or have continued to increase are likely culprits.

Poolmon (Poolmon.exe)

Using Poolmon

Poolmon syntax


Poolmon syntax

You can start Poolmon with or without options. All command-line switch sorting options are available after starting Poolmon.

poolmon [itag] [xtag] [switch]

Parameters

i tag
List only matching pool tag names; a tag name can include * and ?
x tag
List everything except matching pool tag names; a tag name can include * and ?
switch
t
Tag name. Sort tags alphabetically by tag name.
p
Pool type. Sorts tag list by non-paged. Once Poolmon starts use p again to cycle through other options.
a
Allocation. Sorts tags by allocation size.
f
Frees. Sorts tags by "frees" size.
d
Sorts tags by size difference between allocs and frees.
b
Max byte usage. Sorts tags by maximum byte usage.
m
Max byte allocation. Sorts tags by maximum byte allocation.
e
End totals. Toggles pool totals at the bottom of the data on and off. Default is OFF.
L
Lines. Toggles highlighting of changed lines on and off. Default is ON.

Poolmon (Poolmon.exe)

Using Poolmon

Poolmon examples


Using Poolmon

Poolmon displays pool tag information within a command window. Use the arrow keys or PAGE UP and PAGE DOWN keys to display all tag information returned by the tool.

Once you have started Poolmon, use the following keys to change how the information is displayed:

note-icon

Note

  • Sorting options can also be used as command-line flags when starting Poolmon.

General functions | Action
p | Page type: sorts tag list by paged, non-paged, or both. Press the key again to cycle through each option.
l | Lines: toggles highlighting of changed lines on and off.
e | End totals: toggles pool totals at the bottom of the data on and off.
h or ? | Help: displays Poolmon help. To exit help, press the ESC key.
q | Quit.
Sorting functions | Action
t | Tag name: sort tags alphabetically by tag name.
a | Allocation: sorts tags by allocation size.
f | Frees: sorts tags by "frees".
d | Difference: sorts tags by difference between allocs and frees.
b | Max byte usage: sorts tags by maximum byte usage.
m | Max byte allocation: sorts tags by maximum byte allocation.

Poolmon (Poolmon.exe)

Poolmon syntax

Poolmon examples


Troubleshooting PPTP Ping

PPTP Ping runs on Windows 2000, Windows NT, and Windows 98, but not on Windows 95.

Cannot Connect to PPTP Server

The error message you receive will help determine what part of the PPTP connection you should troubleshoot. When PPTP filtering is enabled you might receive one of the following error messages:

Error 678: There is no answer
Error 650: The Remote Access Server is not responding

If you receive one of these error messages, disable PPTP filtering and then attempt to ping the PPTP server. To disable PPTP filtering, type the following command on the PPTP server:

net stop raspptpf

You should now be able to ping the PPTP server over the Internet. If you still receive one of these error messages, the problem might not be a PPTP problem. Until you get replies from the server, you will need to troubleshoot this issue as a normal connectivity problem.

If pinging the PPTP server across the Internet successfully returns with replies, the ISP or internal corporate network might not allow Generic Routing Encapsulation (GRE) packets or PPTP packets to go across the firewall or router.

GRE packets are commonly used internally as messages between routers. For example, an ISP might use GRE to distribute routing messages between its sites. For security or other reasons, this ability can be turned off to the outside Internet. You can resolve this problem by ensuring that Protocol 47 is open at the router or firewall. This protocol is required for PPTP to work correctly. In addition to GRE Protocol 47, Port 1723 must be enabled at all routers or firewalls between the PPTP client and server.

An example of a GRE-blocked PPTP call in a trace is shown below. In this case, the ISP uses GRE internally, but does not allow the protocol to be sent to any outside interfaces.

1- 5.364   00 E8 TCP       ....S., len:

2- 5.614   E8 00 TCP       .A..S., len:

3- 5.614   00 E8 TCP       .A ., len: 0, seq: 168021101-168021101,
   ack:    460753,

4- 5.630   00 E8 TCP       .AP..., len: 156, seq: 168021101-168021256,
   ack:    460753,

5- 6.130   E8 00 TCP       .AP..., len:  156, seq:    460753-460908,
   ack:   168021257, win:

6- 6.145   00 E8 TCP       .AP..., len:  168, seq: 168021257-168021424,
   ack:    460909,

7- 6.520   E8 00 TCP       .AP..., len:   32, seq:    460909-460940,
   ack:    168021425, win:

8- 6.536   00 E8 TCP       .AP..., len:   24, seq: 168021425-168021448,
   ack:    460941,

9- 6.536   20 20 LCP       Config Req Packet, Ident = 0x00, Length = 17

10- 6.536  00 E8 LCP       Config Req Packet, Ident = 0x00, Length = 17

11- 6.833  E8 00 ICMP      Destination Unreachable: 198.140.211.122
   See frame 10

12- 6.942  E8 00 TCP       .A...., len:    0, seq:    460941-460941,
   ack:   168021449, win:

In frame 11, a reference states that the destination cannot be reached in frame 10. Looking closely at frame 10, you can see that this packet is actually a GRE packet:

+ FRAME: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
+ IP: ID = 0xECB3; Proto = 0x2F; Len: 53
+ GRE: ..KS............ Length: 21, Call ID: 0  <<<--Shows that this is a
                                                     GRE packet.
+ PPP: Link Control Protocol Frame (0xC021)
+ LCP: Config Req Packet, Ident = 0x00, Length = 17

The IP address in the IP portion of this frame shows the IP address of the device that will not allow GRE packets past its interface.

Note

  • Some ISPs or corporate firewalls will not allow incoming or outgoing GRE packets. In this case, you will see the same "Destination Host Unreachable" packets in the trace, but there will not be any packets that drill down to GRE.

Timeouts using PPTP

If you receive error 718, "the server has not responded", you might want to increase the number of attempts PPTP makes to transmit data.

You can make this change by editing the following registry entry.

Caution

  • Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Control Panel or Microsoft Management Console (MMC) whenever possible.

To increase PPTP data retransmissions

  1. Run Registry Editor (Regedt32.exe).

  2. Go to the following key in the registry:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Paramters

  3. On the Edit menu, click Add Value and create the following entry (if the entry already exists, double-click it to edit the value):

    Value Name: PPTPTcpMaxDataRetransmissions

    Data Type: REG_DWORD

    Value range: 0 - 0xFFFFFFFF

    Default value: 9h

By default, this value is 9h. You might want to increase this value to 18h. It is not recommended to increase this value beyond 27h.

Dialing the IP address and logging on to PPTP server

After each computer can connect to its ISP and ping the PPTP server, test logging on to the PPTP server.

Set up a Dial-Up Networking phone book entry to dial the IP address of the PPTP server. When you set up the phone book entry, enter the server IP address in place of a phone number. Dial using RASPPTPM.

If Dial-Up Networking dials but does not connect to the PPTP server, try restarting the Remote Access Server service. To do so, follow these steps

To restart the Remote Access Server Service

  1. In Control Panel, double-click Services.

  2. Locate the Remote Access Server service. Stop the service and then start the service.

Confirming dial-in permissions

PPTP requires that the connecting user account have dial-in permissions. Use the Remote Access Admin tool to verify that the user account has the appropriate dial-in permissions.

If a domain is present, the user might need domain permissions to connect to certain resources on the network.

Troubleshooting protocol issues

PPTP can use the NetBEUI, IPX/SPX-compatible, and TCP/IP protocols. The NetBEUI protocol requires the least amount of configuration. Connecting to the PPTP server requires that the client and server have a network protocol in common. Once connected, the PPTP server can act as NetBIOS gateway to the rest of the local area network.

When you are using the TCP/IP protocol, each client needs a unique IP address. IP addresses can be statically assigned to clients, supplied from a pool of IP addresses, or from a DHCP server.

PPTP Ping can be useful in troubleshooting connectivity issues with TCP/IP.

Troubleshooting browsing issues

Avoid browsing My Network Places over a slow connection. Try connecting to the network resource directly. To do so, follow these steps:

To connect to a network resource directly

  1. Click Start, and then click Run.

  2. Type the following line, and then click OK:

    \\<server>\<share>

If you can connect using this method, the PPTP session is working properly and the issue is related to browsing.

Point-to-Point Tunneling Protocol Ping Utilities (PPTP Ping)

Using PPTP Ping


Using PPTP Ping

The following sections cover testing your PPTP connection and sample output.

PPTP Ping runs on Windows 2000, Windows NT, and Windows 98, but not on Windows 95.

Testing PPTP connectivity

For this example, assume there is a PPTP server on site A and a PPTP client on site B.

To test PPTP connectivity between site A and site B:

  1. Run Pptpsrv.exe on a computer on site A. This does not have to be the PPTP server.
  2. Run pptpclnt.exe [servername_or_IPaddress] on site B.
  3. When prompted by Pptpclnt.exe, type in some text to send to Pptpsrv.exe and then click Enter.

    4. You will see the text received at the host running Pptpsrv.exe.

    You will then see five GRE packets sent from Pptpclnt.exe and received at Pptpsrv.exe.

  4. Repeat steps 1-3, this time running pptpsrv.exe on a host on site B and Pptpclnt.exe on a host on site A. These can, of course, be the same hosts you just used.

Sample output: server side

pptpsrv

Now you must run pptpclnt.exe on remote machine

Waiting for inbound connection on TCP port 1723...
Inbound connection from client has completed successfully!

Data received from client:
---> abcdefghijklmnopqrstuvwxyz

Sending the message 'Reply from server' to the client

=====================================================
Connectivity test to TCP Port 1723 was susccessful!!!
Closing down socket...
=====================================================

Created socket for GRE protocol test

Listening on PROTOCOL 47 for incoming GRE packets...

Total GRE packets received = 1
Total GRE packets received = 2
Total GRE packets received = 3
Total GRE packets received = 4
Total GRE packets received = 5

======================================
GRE protocol test was successful!
======================================
Closing socket

Sample output: client side

pptpclnt jade

Initializing WinSock...
Obtaining host information...
Successfully resolved server's host information

======================================
Enter data to send to server (up to 255 chrs.), then hit enter:
-->abcdefghijklmnopqrstuvwxyz

Successfully connected to server using TCP port 1723 (PPTP)
Sending data to server jade.dns.microsoft.com

Waiting for a reply to the data which was just sent...
Received a reply.  Reply contains the following text:
---> Hello, there! This is a reply from the server.

=================================
Connectivity test to TCP Port 1723 was susccessful!!!
Closing down socket...
=================================

Creating a socket to test GRE protocol traffic...

Total GRE packets sent = 1
Total GRE packets sent = 2
Total GRE packets sent = 3
Total GRE packets sent = 4
Total GRE packets sent = 5

=====================================
Check server to see if the GRE packets were received successfully
=====================================
Closing down socket

Point-to-Point Tunneling Protocol Ping Utilities (PPTP Ping)

Troubleshooting PPTP Ping


Details of the Process Viewer screen

The Process Viewer dialog box contains the following elements:

Memory Detail
Click this button to see details about memory use for the selected process.
Kill Process
Click this button to stop the selected process.

note-icon

Caution

Do not attempt to kill processes required for running Windows 2000 or Windows NT. Make sure you understand which program owns a process before attempting to kill it.

Computer
Shows the name of the computer whose processes are currently displayed (default=local computer). To view the processes on a remote machine, type the UNC path to the computer in the space provided and then click the Connect button.
Process
The name of the process followed by the process ID number (in hexadecimal format) in parentheses.
Processor Time
Processor Time is expressed as a percentage of the elapsed time that a processor is busy executing a non-Idle thread. It can be viewed as the fraction of the time spent doing useful work. Each processor is assigned an Idle thread in the Idle process that consumes those unproductive processor cycles not used by any other threads.
Privileged Time
Privileged Time is the percentage of processor time spent in Privileged Mode in non-Idle threads. The Windows service layer, the Executive routines, and the Windows kernel execute in Privileged Mode. Device drivers for most devices other than graphics adapters and printers also execute in Privileged Mode. Unlike some early operating systems, Windows 2000 and Windows NT use process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows 2000 or Windows NT on behalf of your application may appear in other subsystem processes in addition to the Privileged Time in your process.
User Time
User Time is the percentage of processor time spent in User Mode in non-Idle threads. All application code and subsystem code execute in User Mode. The graphics engine, graphics device drivers, printer device drivers, and the window manager also execute in User Mode. Code executing in User Mode cannot damage the integrity of the Windows Executive, kernel, and device drivers. Unlike some early operating systems, Windows 2000 and Windows NT use process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows 2000 or Windows NT on behalf of your application might appear in other subsystem processes in addition to the Privileged Time in your process.
Process Memory Used
The current number of bytes in the Working Set of this process. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed, they will then be soft-faulted back into the Working Set before they leave main memory.
Process Priority
The current base priority of this process. Threads within a process can raise and lower their own base priority relative to the process's base priority.
Threads
Thread State is the current state of the thread. It is 0 for Initialized, 1 for Ready, 2 for Running, 3 for Standby, 4 for Terminated, 5 for Wait, 6 for Transition, 7 for Unknown. A Running thread is using a processor; a Standby thread is about to use one. A Ready thread wants to use a processor but is waiting for a processor because none are free. A thread in Transition is waiting for a resource in order to execute, such as waiting for its execution stack to be paged in from disk. A Waiting thread has no use for the processor because it is waiting for a peripheral operation to complete or a resource to become free.
Thread Priority
The current base priority of this thread. The system might raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it toward the base priority if the thread becomes compute bound.
Thread Information
Context Switches/sec is the rate of switches from one thread to another. Thread switches can occur either inside of a single process or across processes. A thread switch can be caused either by one thread asking another for information, or by a thread being preempted by another, higher-priority thread becoming ready to run.

Dynamic Priority is the current dynamic priority of this thread. The system can raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it towards the base priority if the thread becomes compute bound.

Process Viewer (Pviewer.exe)


REG ADD syntax

REG ADD [\\Machine\]Keyname [/v ValueName | /ve] [/t Type] [/s Separator] [/d Data] [/f]

Parameters

Machine
Specifies the name of a remote computer. (If omitted, the default is the current computer.) Do not use drive letters to specify remote computers. Use double backslashes, followed by the name of the computer. (For example, \\ZODIAC).
Keyname
Is in the format [Rootkey\]Key
Rootkey
Specifies the root key where the entry is located.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected root key.
/v Valuename
The name of the new value to add to the specified registry key. If valuename contains spaces, the string should be contained in quotation marks.
/ve
Adds the empty value name (no name).
/t type
Specifies the numeric or string data type to be used (default = REG_SZ). The following data types are recognized by Reg.exe:
Value | Meaning
REG_BINARY | Binary data in any form.
REG_DWORD | A 32-bit number.
REG_DWORD_LITTLE_ENDIAN A 32-bit number in little-endian format. This is equivalent to REG_DWORD.

In little-endian format, a multi-byte value is stored in memory from the lowest byte (the "little end") to the highest byte. For example, the value 0x12345678 is stored as (0x78 0x56 0x34 0x12) in little-endian format.

Windows 2000, Windows NT, Windows 95, and Windows 98 run on little-endian computer architectures. A user may connect to computers that have big-endian architectures, such as some UNIX systems.

REG_DWORD_BIG_ENDIAN A 32-bit number in big-endian format.

In big-endian format, a multi-byte value is stored in memory from the highest byte (the "big end") to the lowest byte. For example, the value 0x12345678 is stored as (0x12 0x34 0x56 0x78) in big-endian format.
REG_EXPAND_SZ | A null-terminated string that contains unexpanded references to environment variables (for example, "%PATH%").
REG_MULTI_SZ | An array of null-terminated strings, terminated by two null characters.
REG_NONE | No defined value type.
REG_SZ | A null-terminated string. It will be a Unicode or ANSI string, depending on whether you use the Unicode or ANSI functions.

/s Separator
Specifies one character that you use as the separator in your data string for REG_MULTI_SZ. If omitted, use "\o" as the separator.
/f
Allows you to overwrite the existing registry entry without prompts.
/d Data
Specifies the data to assign to the registry ValueName being added.

Registry Console Tool (Reg.exe)

REG ADD examples


REG ADD example

REG ADD examples

REG ADD \\ABC\HKLM\Software\MyCo\

Adds a key HKLM\Software\MyCo on remote computer ABC

REG ADD HKLM\Software\MyCo\ /v Data  /t  REG_BINARY  /d fe340ead

Adds a value (name: Data, type: REG_BINARY, data: fe340ead).

REG ADD HKLM\Software\MyCo\ /v MRU  /t REG_MULTI_SZ  /d FAX\0MAIL\0\0

Adds a value (name: MRU, type: REG_MULTI_SZ, data: FAX\0MAIL\0\0).

REG ADD HKLM\Software\MyCo\ /v Path /t REG_EXPAND_SZ  /d %"SystemRoot"%

Adds a value (name: Path, type: REG_EXPAND_SZ, data: %"SystemRoot"%).

Registry Console Tool (Reg.exe)

REG ADD syntax


REG COMPARE syntax

REG COMPARE [\\Machine\]Keyname1 [\\Machine\]Keyname2 [/v ValueName] | /ve] [/s] [Output]

Parameters

Machine
Specifies the name of a remote computer. (If omitted, the default is the current computer.) Do not use drive letters to specify remote computers. Use double backslashes, followed by the name of the computer. (For example, \\ZODIAC).
Keyname1, Keyname2
Are in the format [Rootkey\]Key
Rootkey
Specifies the root key where the entry is located.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected root key.
/V Valuename
Compares the value of the specified value name. If valuename contains spaces, the string should be contained in quotation marks.
/VE, /ve
Compares the value of the empty value name.
/S, /s
Compares all subkeys and values.
Output
Is one of the following:

    /OA,/oa

    Outputs all differences and matches

    /OD,/od

    Outputs only differences

    /OS,/os

    Outputs only matches

    /ON,/on

    No Output

Return Code:
0-Successful, the result compared is identical
1-Failed
2-Successful, the result compared is different

Registry Console Tool (Reg.exe)

REG COMPARE examples


REG COMPARE examples

REG COMPARE HKLM\Software\MyCo\MyApp  HKLM\Software\MyCo\SaveMyApp /nt

Compares all values under the key MyApp with SaveMyApp on the current computer.

REG COMPARE \\ZODIAC\HKLM\Software\mYcO  \\.  /S

Compares all subkeys and values under HKLM\Software\MyCo on ZODIAC with the same key on the current computer.

REG COMPARE \\Zodiac\HKLM\Software\MyCo\  HKLM\Software\MyCol1  /v Version

Compares all the "Version" value under HKLM\Software\MyCo on ZODIAC with the same value under HKLM\Software\MyColl on the current computer.

Registry Console Tool (Reg.exe)

REG COMPARE syntax


REG COPY syntax

REG COPY [\\Machine\]SourceKey [\\Machine\]DestinationKey [/s] [/f]

Parameters

Machine
Specifies the name of a remote computer. (If omitted, the default is the current computer.) Do not use drive letters to specify remote computers. Use double backslashes, followed by the name of the computer. (For example, \\ZODIAC).
SourceKey and DestinationKey
Are in the format [Rootkey\]Key
Rootkey
Specifies the root key where the entry is located.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected root key.
/s
Copies all subkeys and values.
/f
Forces the copy without prompt.

Registry Console Tool (Reg.exe)

REG COPY examples


REG COPY example

REG COPY examples

REG COPY HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp

Copies the key MyApp and all of its entries to SaveMyApp under MyCo.

REG COPY \\SAFARI\HKLM\Software\MyCo  \\ZODIAC\HKLM\Software\MyCo

Copies the entire hive MyCo on SAFARI to MyCo on ZODIAC.

REG COPY \\ZODIAC\HKLM\Software\MyCo  HKLM\Software\MyCo1

Copies all values under the key MyCo on ZODIAC to the key MyCo1 on the current computer.

Registry Console Tool (Reg.exe)

REG COPY syntax


REG DELETE syntax

REG DELETE [\\Machine\]Keyname [/v ValueName | /ve | /va] [/f]

Parameters

Machine
Specifies the name of a remote computer. (If omitted, the default is the current computer.) Do not use drive letters to specify remote computers. Use double backslashes, followed by the name of the computer. (For example, \\ZODIAC).
Keyname
Is in the format [Rootkey\]Key
Rootkey
Specifies the root key where the entry is located.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected root key.
/v Valuename
Deletes the value specified by valuename under this key. If valuename contains white spaces, the string should be contained in quotation marks.
/va
Deletes all values under this key.
/ve
Deletes the value of the empty value name (no name).
/f
Forces the deletion without prompts.

Registry Console Tool (Reg.exe)

REG DELETE examples


REG DELETE examples

REG DELETE HKLM\Software\MyCo\MyApp\Timeout

Deletes the Timeout registry entry.

REG DELETE \\Zodiac\HKLM\Software\MyCo /v MTU

Deletes the registry value MTU under MyCo on ZODIAC.

Registry Console Tool (Reg.exe)

REG DELETE syntax


REG EXPORT syntax

Note

  • Reg Export can be used on local computers only.

REG EXPORT Keyname Filename [/nt4]

Parameters

Keyname
Is in the format [Rootkey\]Key
Rootkey
Specifies the root key where the entry is located.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected Rootkey.
FileName
Specifies the name of the .reg file to which the key will be exported.
/nt4
Outputs .reg file in a Windows NT 4.0 format.

Registry Console Tool (Reg.exe)

REG EXPORT examples


REG EXPORT examples

REG EXPORT HKLM\Software\MyCo\MyApp  AppBkUp.reg  /nt4

Exports all subkeys and values of the key MyApp to the file AppBkup.reg in a Windows NT 4.0 .reg format.

REG EXPORT HKLM\Software\MyCo MyCoBkUp.reg

Exports the hive MyCo to the file MyCoBkUp.reg.

Registry Console Tool (Reg.exe)

REG EXPORT syntax


REG IMPORT syntax

REG IMPORT FileName

Parameters

FileName
Is the name of the .reg file to import.

Note

  • REG IMPORT can be used on local computers only.

Registry Console Tool (Reg.exe)

REG IMPORT examples


REG IMPORT example

REG IMPORT AppBkUp.reg

Imports registry entries from the file AppBkUp.reg.

Registry Console Tool (Reg.exe)

REG IMPORT syntax


REG LOAD syntax

REG LOAD [\\Machine\] KeyName FileName

Parameters

Machine
Specifies the name of a remote computer. (If omitted, the default is the current computer where the hive file is to be loaded.) Do not use drive letters to specify remote computers. Use double backslashes, followed by the name of the computer. (For example, \\ZODIAC).
Keyname
Specifies the temporary key to be created, in the format [Rootkey\]Key
Rootkey
Specifies the root key to contain the temporary key.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected root key where the hive file is to be loaded, creating a new temporary key containing the contents of the hive file. This key will be non-persistent, and will be deleted on the next reboot, or with the REG UNLOAD command.
FileName
Specifies the name of the hive file to be loaded, without an extension. This file must have been created with REG SAVE.

Registry Console Tool (Reg.exe)

REG LOAD examples


REG LOAD examples

REG LOAD HKLM\TempHive  TempHive.hiv

Loads the file TempHive.hiv to the Key HKLM\TempHive on the local computer.

REG LOAD \\ZODIAC\HKLM\TempHive.hiv  Back.hiv

Loads the file Back.hiv on ZODIAC to the key HKLM\TempHive on ZODIAC.

Registry Console Tool (Reg.exe)

REG LOAD syntax


REG QUERY syntax

REG QUERY [\\Machine\]KeyName [/v ValueName | /ve] [/s]

Parameters

Machine
Specifies the name of a remote computer. (If omitted, the default is the current computer.) Do not use drive letters to specify remote computers. Use double backslashes, followed by the name of the computer. (For example, \\ZODIAC).
Keyname
Is in the format [Rootkey\]Key
Rootkey
Specifies the root key where the entry is located.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected root key.
/v Valuename
Queries the value specified by valuename under this key. If valuename contains spaces, the string should be contained in quotation marks. (If omitted, all values under the key are queried).
/ve
Queries the empty value name (no name).
/s
Queries all subkeys and values under the specified key.

Registry Console Tool (Reg.exe)

REG QUERY examples


REG QUERY examples

REG QUERY HKLM\Software\Microsoft\ResKit\Setup /S

Displays all keys and entries in the Setup subkey on the local computer.

REG QUERY \\Zodiac\HKLM\Software\Microsoft\ResKit /V version

Displays the value of the registry value "version" on the computer \\Zodiac.

Registry Console Tool (Reg.exe)

REG QUERY syntax


REG RESTORE syntax

REG RESTORE [\\Machine\]KeyName FileName

Parameters

Machine
Specifies the name of a remote computer. (If omitted, the default is the current computer.) Do not use drive letters to specify remote computers. Use double backslashes, followed by the name of the computer. (For example, \\ZODIAC).
Keyname
Is in the format [Rootkey\]Key
Rootkey
Specifies the root key where the entry is located.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected root key.
FileName
Specifies the name of the hive file to be restored. This file must have been created with REG SAVE.

Registry Console Tool (Reg.exe)

REG RESTORE examples


REG RESTORE examples

REG RESTORE HKLM\Software\Microsoft\Reskit  NTRKBkUp.hiv

Restores the file NTRKBkUp.hiv overwriting the key Reskit.

REG RESTORE \\ZODIAC\HKLM\Software\Microsoft\Reskit  NTRKBkUp.hiv

Restores the file NTRKBkUp.hiv on ZODAC overwriting key Reskit on ZODIAC.

Registry Console Tool (Reg.exe)

REG RESTORE syntax


REG SAVE syntax

REG SAVE [\\Machine\]KeyName FileName

Parameters

Machine
Specifies the name of a remote computer. (If omitted, the default is the current computer). Do not use drive letters to specify remote computers. Use double backslashes, followed by the name of the computer. (For example, \\ZODIAC).
Keyname
Is in the format [Rootkey\]Key
Rootkey
Specifies the root key where the entry is located.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected Rootkey.
FileName
Specifies the name of the destination disk file to save. If no path is specified, this file is saved to the current directory of the calling file on local computers, or in the %SystemRoot%\system32 folder on remote computers.

Note

  • You can not save the HKLM\Security subkey. It is system protected.

Registry Console Tool (Reg.exe)

REG SAVE examples


REG SAVE examples

REG SAVE HKLM\Software\MyCo\MyApp AppBkUp.hiv

Saves the hive MyApp to the file AppBkUp.

REG SAVE \\ZODIAC\HKLM\Software\MyCo MyCoBkUp.hiv

Saves the hive MyCo on ZODIAC to the file MyCoBkUp.hiv.

Note

  • If no path is specified, REG SAVE saves the file to the current directory of the calling file on local computers, or in the %SystemRoot%\system32 folder on remote computers.

Registry Console Tool (Reg.exe)

REG SAVE syntax


REG UNLOAD syntax

REG UNLOAD [\\Machine\]KeyName

Parameters

Machine
Specifies the name of a remote computer. (If omitted, the default is the current computer). Do not use drive letters to specify remote computers. Use double backslashes, followed by the name of the computer. (For example, \\ZODIAC).
Keyname
Uses the format [Rootkey\]Key
Rootkey
Specifies the root key where the entry is located.

The root key can be abbreviated as follows:

Root key name | Abbreviation
HKEY_LOCAL_MACHINE | HKLM
HKEY_CURRENT_USER | HKCU
HKEY_CLASSES_ROOT | HKCR
HKEY_CURRENT_CONFIGURATION | HKCC

note-icon

Note

  • Only HKLM and HKCU are available on remote computers.

Key
Specifies the full name of a registry key under the selected Rootkey.

Note

  • You cannot unload a hive that was loaded by the system. Also, you cannot unload a hive if an application has an open handle to any subkey in the hive.

Registry Console Tool (Reg.exe)

REG UNLOAD examples


REG UNLOAD examples

REG UNLOAD HKLM\TempHive

Unloads the hive TempHive from HKLM.

REG UNLOAD \\ZODIAC\HKLM\TempHive

Unloads the hive TempHive from the computer ZODIAC.

Registry Console Tool (Reg.exe)

REG UNLOAD syntax


Remote client example

remote /c rajx86 brillig

If there is a remote /s "cmd" brillig started on the computer, this statement connects to a server session on the server named rajx86 with the ID brillig.

Remote Command Line (Remote.exe)

Starting the client end of Remote


Exiting Remote on the client computer

At the command prompt, type:

@q

This stops Remote on the client end, but leaves Remote running at the server.

Remote Command Line (Remote.exe)

Starting the client end of Remote


Starting the client end of Remote

Run command prompt.

At the command prompt on the client computer, type:

remote /c computername uniqueID [/f param] [/b param] [/l param]

Parameters

computername
Specifies the name of the computer on which the remote server is running.
uniqueID
For the /c switch, specifies the uniqueID of the remote server running on computername
/f param
Specifies a foreground color, such as yellow or black, for the remote command prompt.
/b param
Specifies a background color, such as "lblue" or "white", for the remote command prompt. In this case, "lblue" means light blue.
/l param
Specifies the number of lines to get for the client.

Remote Command Line (Remote.exe)

Remote client example

Exiting Remote on the client computer

Remote limitations


Remote limitations

Remote has some limitations:

  • Only non–MS-DOS programs using STDIN/STDOUT/STDERR for input/output will function when redirected across the network.
  • Programs that use the Win32 Console API will not work correctly.
  • MS-DOS programs will not work.
  • Generally, any programs that use on-screen character mode windows or cursor manipulation (such as screen-mode editors) will not work.

Remote Command Line (Remote.exe)


Remote server example

remote /s "i386kd -v" brillig /u administrators

This starts the kernel debugger with the -v switch, with only members of the administrators group allowed to connect.

To interact with this "cmd" from another computer, start the client end with this command, where rmtsrv is the remote server name:

remote /c rmtsrv brillig

Remote Command Line (Remote.exe)

Starting the server end of Remote


Exiting Remote on the server computer

At the command prompt, type:

@k

Remote Command Line (Remote.exe)

Starting the server end of Remote


Starting the server end of Remote

Run command prompt.

At the command prompt on the server computer, type:

remote /s "cmd" uniqueID [/u [domainname\]username] [/f param] [/b param]

Parameters

"cmd"
Specifies the text-mode executable name for the program that you want to control from another computer, enclosed in quotation marks with any optional parameters required.
uniqueID
For the /s switch, specifies a string to uniquely identify this session of Remote Server from other possible sessions on this computer.
/u [domainname\]username
Specifies a group or user that can connect. For example, remote /s cmd Rana /u administrators allows only members of the Administrators group to connect, and remote /s cmd Rana /u user allows only a user logged on as "user" to connect. If this is not specified, anyone can connect to the session.
/f param
Specifies a foreground color, such as yellow or black, for the remote command prompt.
/b param
Specifies a background color, such as "lblue" or "white", for the remote command prompt. In this example, "lblue" means light blue.

Remote Command Line (Remote.exe)

Remote server example

Exiting Remote on the server computer

Remote limitations


RepAdmin examples

Scenario

  • The domain is called microsoft.com
  • The domain distinguished name is dc=microsoft,dc=com
  • There are two servers, server1.microsoft.com and server2.microsoft.com, located in sites Building40 and Building26 respectively
  • In one set of examples, a user named Don Funk is added to the server server1.

Force a Knowledge Consistency Check on the server named server1

repadmin /kcc server1.microsoft.com
Consistency check on server1.microsoft.com successful.

Display the replication partners for server1

Note the objectGUID for both servers and the InvocationID for server1.

repadmin /showreps server1.microsoft.com
Building40\server1
DSA Options : IS_GC
objectGuid  : 414db079-1e28-4855-b225-c5bb9af6f50b
invocationID: 414db079-1e28-4855-b225-c5bb9af6f50b

==== INBOUND NEIGHBORS ======================================

CN=Schema,CN=Configuration,DC=microsoft,Dc=com
    Building26\server2 via RPC
        objectGuid: e55c6c85-85bb-459a-a0d2-020a44c3afe7
        Last attempt @ 1999-08-26 11:47.15 was successful.

CN=Configuration,DC=microsoft,Dc=com
    Building26\server2 via RPC
        objectGuid: e55c6c85-85bb-459a-a0d2-020a44c3afe7
        Last attempt @ 1999-08-26 12:02.30 was successful.

DC=microsoft,Dc=com
    Building26\server2 via RPC
        objectGuid: e55c6c85-85bb-459a-a0d2-020a44c3afe7
        Last attempt @ 1999-08-26 11:48.16 was successful.

==== OUTBOUND NEIGHBORS FOR CHANGE NOTIFICATIONS ============

CN=Schema,CN=Configuration,DC=microsoft,Dc=com
    Building26\server2 via RPC
        objectGuid: e55c6c85-85bb-459a-a0d2-020a44c3afe7

CN=Configuration,DC=microsoft,Dc=com
    Building26\server2 via RPC
        objectGuid: e55c6c85-85bb-459a-a0d2-020a44c3afe7

Force a replication event for the domain naming context dc=microsoft,dc=com on the server named server1 with its replication partner server2

repadmin /sync dc=microsoft,dc=com server1.microsoft.com e55c6c85-85bb-459a-a0d2-020a44c3afe7
Sync from e55c6c85-85bb-459a-a0d2-020a44c3afe7 to server1.microsoft.com completed successfully.

Force a replication event for the domain naming context dc=microsoft,dc=com on the server named server1 with all of its replication partners.

repadmin /syncall server1.microsoft.com dc=microsoft,dc=com
CALLBACK MESSAGE: SyncAll Finished.

SyncAll terminated with no errors.

Display the replication features supported on the server named server1

repadmin /bind server1.microsoft.com
Bind to server1.microsoft.com succeeded.

Extensions supported:
    BASE                        : yes
    ASYNCREPL                   : yes
    REMOVEAPI                   : yes
    MOVEREQ_V2                  : yes
    GETCHG_COMPRESS             : yes
    DCINFO_V1                   : yes
    STRONG_ENCRYPTION           : yes
    ADDENTRY_V2                 : yes
    KCC_EXECUTE                 : yes
    DCINFO_V2                   : yes
    DCINFO_VFFFFFFFF            : yes
    INSTANCE_TYPE_NOT_REQ_ON_MOD: yes
    GET_REPL_INFO               : yes
    ADD_SID_HISTORY             : yes
    POST_BETA3                  : yes
    RESTORE_USN_OPTIMIZATION    : yes

Site guid: 97c06da5-9863-4acb-976f-61ebf4b37228

In the next set of examples, a user named Don Funk is added to the server server1.

Display the replication metadata for the user object Don Funk on the server named server1

repadmin /showmeta "cn=Don Funk,ou=Marketing,dc=microsoft,dc=com" server1.microsoft.com

34 entries.

Loc.USN                      Originating DSA Org.USN       Org.Time/Date  Ver Attribute
=======                      =============== =======       =============  === =========
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 objectClass
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 cn
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 sn
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 description
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 givenName
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 instanceType
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 whenCreated
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 displayName
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 nTSecurityDescriptor
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 name
 173257                    Building40\server1  173257 1999-08-26 12:19.53    3 userAccountControl
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 codePage
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 countryCode
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 homeDirectory
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 homeDrive
 173255                    Building40\server1  173255 1999-08-26 12:19.52    2 dBCSPwd
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 scriptPath
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 logonHours
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 userWorkstations
 173255                    Building40\server1  173255 1999-08-26 12:19.52    2 unicodePwd
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 ntPwdHistory
 173255                    Building40\server1  173255 1999-08-26 12:19.52    2 pwdLastSet
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 primaryGroupID
 173255                    Building40\server1  173255 1999-08-26 12:19.52    1 supplementalCredentials
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 userParameters
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 profilePath
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 objectSid
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 comment
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 accountExpires
 173254                    Building40\server1  173254 1999-08-26 12:19.51    1 lmPwdHistory
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 sAMAccountName
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 sAMAccountType
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 userPrincipalName
 173253                    Building40\server1  173253 1999-08-26 12:19.51    1 objectCategory

Display the highest Update Sequence Number on the server server2

repadmin /showvector dc=microsoft,dc=com server2.microsoft.com
Building40\server1                    @ USN 173259
Building26\server2                    @ USN 51830

Determine if the server server2 is up to date to server1 with respect to the highest USN representing the creation of the user object "Don Funk"

Note that it is not up to date.

repadmin /propcheck dc=microsoft,dc=com 414db079-1e28-4855-b225-c5bb9af6f50b 173253 server2.microsoft.com
Building40\server1: yes (USN 173259)
Building26\server2: ** NO! ** (USN 173205)

Display the replication metadata for the user object Don Funk on the server named server2

Note that the object does not exist, indicating it has yet to replicate from server1 to server2.

repadmin /showmeta "cn=Don Funk,ou=Marketing,dc=microsoft,dc=com" server2.microsoft.com
DsReplicaGetInfo failed with status 8333 (0x208d):
    Directory object not found.

Determine what changes are due to be replicated from server1 to server2

Note that the outstanding change is the new user object Don Funk.

repadmin /getchanges dc=microsoft,dc=com server2.microsoft.com 414db079-1e28-485
Building starting position from destination server server2.microsoft.com

Source Neighbor:
dc=microsoft,dc=com
    Building40\server1 via RPC
        objectGuid: 414db079-1e28-4855-b225-c5bb9af6f50b
        Address: 414db079-1e28-4855-b225-c5bb9af6f50b._msdcs.microsoft.com
        ntdsDsa invocationId: 414db079-1e28-4855-b225-c5bb9af6f50b
        WRITEABLE DO_SCHEDULED_SYNCS COMPRESS_CHANGES NO_CHANGE_NOTIFICATIONS
        USNs: 173184/OU, 173184/PU
        Last attempt @ 1999-08-26 11:52.44 was successful.

Destination's Up To Dateness Vector:
4                                    @ USN 173205
b                                    @ USN 51754

==== SOURCE DSA: 414db079-1e28-4855-b225-c5bb9af6f50b._msdcs.microsoft.com ====

Objects returned: 1
(0) add CN=Don Funk,OU=Marketing,DC=microsoft,Dc=com
        1> parentGUID: 69fbe37a-abff-4eec-81ce-79017142405f
        1> objectGUID: 7099ec39-ac5c-4462-b2b4-3ae9670eb43a
        4> objectClass: top; person; organizationalPerson; user
        1> sn: Cook
        1> givenName: James
        1> instanceType: 4
        1> whenCreated: 19990826191951.0Z
        1> displayName: Don Funk
        1> nTSecurityDescriptor: <1380 byte blob>
        1> name: Don Funk
        1> userAccountControl: 512
        1> codePage: 0
        1> countryCode: 0
        1> pwdLastSet: 125801687928437500
        1> primaryGroupID: 513
        1> objectSid: <28 byte blob>
        1> accountExpires: 9223372036854775807
        1> sAMAccountName: jamesc
        1> sAMAccountType: 805306368
        1> userPrincipalName: jamesc@microsoft.com
        1> objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=microsoft,Dc=com

Force a replication event on server2 with its replication partners

repadmin /syncall server2.microsoft.com dc=microsoft,dc=com
CALLBACK MESSAGE: SyncAll Finished.

SyncAll terminated with no errors.

Determine what changes are due to be replicated from server1 to server2

Note that there are no outstanding changes.

repadmin /getchanges dc=microsoft,dc=com server2.microsoft.com 414db079-1e28-4855-b225-c5bb9af6f50b
Building starting position from destination server server2.microsoft.com

Source Neighbor:
dc=microsoft,dc=com
    Building40\server1 via RPC
        objectGuid: 414db079-1e28-4855-b225-c5bb9af6f50b
        Address: 414db079-1e28-4855-b225-c5bb9af6f50b._msdcs.microsoft.com
        ntdsDsa invocationId: 414db079-1e28-4855-b225-c5bb9af6f50b
        WRITEABLE DO_SCHEDULED_SYNCS COMPRESS_CHANGES NO_CHANGE_NOTIFICATIONS
        USNs: 173257/OU, 173257/PU
        Last attempt @ 1999-08-26 12:44.11 was successful.

Destination's Up To Dateness Vector:
4                                    @ USN 173277
b                                    @ USN 51810

==== SOURCE DSA: 414db079-1e28-4855-b225-c5bb9af6f50b._msdcs.microsoft.com ====

No changes.

Determine what changes have occurred over a period of time by using a cookie to save the state of the previous execution of /getchanges

repadmin /getchanges dc=microsoft,dc=com server2.microsoft.com /cookie:microsoft.txt
Using cookie from file microsoft.txt (132 bytes)

==== SOURCE DSA: server2.microsoft.com ====

No changes.
New cookie written to file microsoft.txt (132 bytes)

Display the replication metadata for the user object Don Funk on the server named server2

Note that the object has now been replicated and also observe the difference in the Originating USN and the Local USN.

repadmin /showmeta "cn=Don Funk,ou=Marketing,dc=microsoft,dc=com" server2.microsoft.com

34 entries.

Loc.USN                      Originating DSA Org.USN       Org.Time/Date  Ver Attribute
=======                      =============== =======       =============  === =========
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 objectClass
  51796                    Building26\server2   51796 1999-08-26 12:44.10    1 cn
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 sn
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 description
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 givenName
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 instanceType
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 whenCreated
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 displayName
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 nTSecurityDescriptor
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 name
  51796                    Building40\server1  173257 1999-08-26 12:19.53    3 userAccountControl
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 codePage
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 countryCode
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 homeDirectory
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 homeDrive
  51796                    Building40\server1  173255 1999-08-26 12:19.52    2 dBCSPwd
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 scriptPath
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 logonHours
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 userWorkstations
  51796                    Building40\server1  173255 1999-08-26 12:19.52    2 unicodePwd
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 ntPwdHistory
  51796                    Building40\server1  173255 1999-08-26 12:19.52    2 pwdLastSet
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 primaryGroupID
  51796                    Building40\server1  173255 1999-08-26 12:19.52    1 supplementalCredential
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 userParameters
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 profilePath
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 objectSid
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 comment
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 accountExpires
  51796                    Building40\server1  173254 1999-08-26 12:19.51    1 lmPwdHistory
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 sAMAccountName
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 sAMAccountType
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 userPrincipalName
  51796                    Building40\server1  173253 1999-08-26 12:19.51    1 objectCategory

Determine if the server server2 is up to date to server1 with respect to the highest USN representing the creation of the user object "Don Funk"

Note that it is up to date.

repadmin /propcheck dc=microsoft,dc=com 414db079-1e28-4855-b225-c5bb9af6f50b 173255 server2.microsoft.com
Building40\server1: yes (USN 173302)
Building26\server2: yes (USN 173277)

Display the InterSite Messaging Configuration for the IP Transports.
repadmin /showism "CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=microsoft,Dc=com" /verbose

==== TRANSPORT CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=microsoft,Dc=com

CONNECTIVITY INFORMATION FOR 2 SITES: ====

        0,    1
( 0) CN=Building26,CN=Sites,CN=Configuration,DC=microsoft,Dc=com
     0:0:0, 100:180:0

All DCs in site CN=Building26,CN=Sites,CN=Configuration,DC=microsoft,Dc=com (with trans & hosting NC) are bridgehead candidates.

Schedule between CN=Building26,CN=Sites,CN=Configuration,DC=microsoft,Dc=com and CN=Building26,CN=Sites,CN=Configuration,DC=microsoft,Dc=com (cost 0, interval 0):
        Connection is always available.
Schedule between CN=Building26,CN=Sites,CN=Configuration,DC=microsoft,Dc=com and CN=Building40,CN=Sites,CN=Configuration,DC=microsoft,Dc=com (cost 100, interval 180):
        day: 0123456789ab0123456789ab
        Sun: ff000000000000ffffffffff
        Mon: ff000000000000ffffffffff
        Tue: ff000000000000ffffffffff
        Wed: ff000000000000ffffffffff
        Thu: ff000000000000ffffffffff
        Fri: ff000000000000ffffffffff
        Sat: ff000000000000ffffffffff
( 1) CN=Building40,CN=Sites,CN=Configuration,DC=microsoft,Dc=com
     100:180:0, 0:0:0

All DCs in site CN=Building40,CN=Sites,CN=Configuration,DC=microsoft,Dc=com (with trans & hosting NC) are bridgehead candidates.

Schedule between CN=Building40,CN=Sites,CN=Configuration,DC=microsoft,Dc=com and CN=Building26,CN=Sites,CN=Configuration,DC=microsoft,Dc=com (cost 100, interval 180):
        day: 0123456789ab0123456789ab
        Sun: ff000000000000ffffffffff
        Mon: ff000000000000ffffffffff
        Tue: ff000000000000ffffffffff
        Wed: ff000000000000ffffffffff
        Thu: ff000000000000ffffffffff
        Fri: ff000000000000ffffffffff
        Sat: ff000000000000ffffffffff
Schedule between CN=Building40,CN=Sites,CN=Configuration,DC=microsoft,Dc=com and CN=Building40,CN=Sites,CN=Configuration,DC=microsoft,Dc=com (cost 0, interval 0):
        Connection is always available.

Display the connection objects for the server server2

repadmin /showconn server2.microsoft.com
Show Connection Objects
CN=Building26,CN=Sites,CN=Configuration,DC=microsoft,Dc=com:
        server2\febe8edf-85b6-4472-920a-1754c1401ac2
                enabledConnection: TRUE
                fromServer: Building40\server1
                TransportType: IP
                options: isGenerated overrideNotifyDefault
                 ReplicatesNC: CN=Configuration,DC=microsoft,Dc=com
                 ReplicatesNC: DC=microsoft,Dc=com
                whenChanged: 19990826193849.0Z
                whenCreated: 19990826193849.0Z

Display the replication signaure for the server server1

Note that the signature matches the invocationID for the server.

repadmin /showsig server1.microsoft.com
Building40\server1

414db079-1e28-4855-b225-c5bb9af6f50b (current)

No retired signatures.

Display any failed operations that have occurred on the server server2
repadmin /failcache server2.microsoft.com
==== KCC DSA CONNECTION FAILURES ============================
(none)

==== KCC DSA LINK FAILURES ==================================
(none)

Display the context handles for the replication process

repadmin /showctx server2.microsoft.com
6 open context handles.

NTDSAPI client @ 157.59.128.201 (PID 948) (Handle 0x5c925c8)
    bound, refs=1, last used 1999-08-26 10:23.09

Building40\server1 @ 157.59.128.242 (PID 256) (Handle 0x914e100)
    bound, refs=1, last used 1999-08-26 13:30.26

NTDSAPI client @ 127.0.0.1 (PID 1368) (Handle 0x5c92330)
    NOT bound, refs=0, last used 1999-08-26 13:41.52

NTDSAPI client @ 157.59.128.201 (PID 244) (Handle 0x5c5bd08)
    NOT bound, refs=0, last used 1999-08-26 13:43.27

NTDSAPI client @ 127.0.0.1 (PID 1420) (Handle 0x91b88e8)
    NOT bound, refs=0, last used 1999-08-26 13:44.40

NTDSAPI client @ 127.0.0.1 (PID 1356) (Handle 0x5c8e290)
    bound, refs=1, last used 1999-08-26 13:44.52

Replication Diagnostics Tool (Repadmin.exe)

RepAdmin syntax


RepAdmin syntax

repadmin command arguments [/u:[domain\]user /pw:{password|*}]

Parameters

command
Represents one of the commands listed below.
arguments
Specifies the arguments applying to command.
/u:[domain\]user
Specifies an optional user (from an optional domain) as the administrator. If the user name and password are not specified, RepAdmin uses the credentials of the currently logged-on user.
/pw:{password|*}
Specifies the password of the user specified by the /u: switch. If the user name and password are not specified, RepAdmin uses the credentials of the currently logged-on user.

Commands and arguments

These are the commands supported by RepAdmin, followed by the arguments for each one.

/sync Naming_Context Destination_DSA Source_DSA_UUID [/force] [/async] [/full] [/addref] [/allsources]
Starts a replication event for the specified naming context between the source and destination domain controllers. The source DSA UUID can be determined when viewing the replication partners with the repadmin /showreps command.
/force
Overrides the normal replication schedule.
/async
Starts the replication event, but RepAdmin does not wait for the replication event to complete.
/full
Forces a full replication of all objects from the destination DSA.
/syncall Destination_DSA [Naming_Context] [Flags]
/kcc [DSA] [/async]
/async
RepAdmin does not wait for the replication event to complete.
/bind [DSA]
/propcheck Naming_Context Originating_DSA_Invocation_ID Originating_USN [DSA_from_which_to_enumerate_host_DSAs]
/getchanges Naming_Context [Source_DSA] [/cookie:file]
- Or -
/getchanges Naming_Context [Destination_DSA] Source_DSA_UUID [/verbose] [/statistics]
/showreps [Naming_Context] [DSA [Source_DSA_UUID]] [/verbose] [/unreplicated] [/nocache]
Displays the replication partners (RepsFrom and RepsTo) for each naming context that is held on the specified domain controller. Enumerating each RepsFrom and each RepsTo for each domain controller can help the administrator to visualize the replication topology for each naming context. The output also indicates whether the domain controller is also a Global Catalog server.
/showvector Naming_Context [DSA] [/nocache]
Displays the up-to-datedness information for a specified naming context. This vector indicates how up to date a replica is with its replication partners.
/showmeta Object_DN [DSA] [/nocache]
Displays the replication metadata for any object stored in Active Directory such as attribute ID, version number, originating and local Update Sequence Number (USN), and originating DSA's GUID and date/time stamp. By comparing the replication metadata for the same object on different domain controllers, an administrator can determine whether replication has taken place.
/showtime [Windows_2000_Directory_Service_Time_Value]
With no arguments displays the current system time in both the directory service format and string format. The string format displays both the local and UTC time zones. Alternatively, Showtime accepts a directory service time value and converts it to string format for both the local and the UTC time zones.
/showmsg Win32_error_number
Takes as an argument the Win32 error number and displays the Win32 error text.
/showism [Transport_DN] [/verbose]
Must be executed locally.
/showsig [DSA]
/showconn [DSA] [{Container_DN | DSA_UUID}]
Default is local site.
/showcert [DSA]
/showctx [DSA] [/nocache]
/queue [DSA]
/failcache [DSA]

Terminology

In the command and argument listings, these terms are used:

Naming_Context
Refers to the naming contexts that are held on a domain controller, namely: the three read/write naming contexts domain, schema and configuration; and the optional read-only naming context, the Global Catalog. A naming context is specified by the distinguished name of its root, for example, DC=MyDomain,DC=Microsoft,DC=Com.
DSA
Directory System Agent. Refers to the name of a domain controller, for example, Server1.
UUID
Universally Unique Identifier. Refers to the 128-bit number used to identify objects stored in the directory, for example, fa1a9e6e-2e14-11d2-aa9b-bbfc0a30094c.
DN
X.500 distinguished name, for example, CN=Server1,CN=First Site,CN=Configuration,DC=Microsoft,DC=Com.

Replication Diagnostics Tool (Repadmin.exe)

RepAdmin examples


Troubleshooting with Active Directory Replication Monitor

Logging Active Directory Replication Monitor events

If any errors are encountered while running Active Directory Replication Monitor, the administrator can enable diagnostic debug logging of internal application events. In this mode, as the application progresses through its monitoring of servers, events are written to the application log. This can be helpful in determining the causes of problems.

To enable debug logging

  1. On the View menu, click Options…
  2. On the General tab, under Log Files, select the Enable Debug Logging check box.

The change takes place immediately. On the next refresh of statistics, events will be written to the event log or to a specified file.

Note

  • This option may fill the Application Log rapidly. Set log properties appropriately to accommodate possible event logging.

ReplMon Troubleshooting topics

Displaying Group Policy objects

Displaying performance statistics

Displaying attribute replication status

Generating a status report on a server

Main topics

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Displaying attribute replication status

After replication occurs, Active Directory Replication Monitor can display which attributes were replicated. This feature is useful in troubleshooting possible replication failures for given objects per directory partition.

To view attribute replication status

  1. On the View menu, click Options.
  2. Click the Status Logging tab.
  3. Under All Replicas, select the Display Changed Attributes when Replication Occurs check box.

The next time Active Directory Replication Monitor updates the statistics, each log file per-replication partner per-directory partition will be updated with any attributes that replicated as a part of the last cycle. In the event that no objects were replicated during the last event, no entries are recorded.

When a value is deleted, Active Directory Replication Monitor does not display this information. Only changed values are displayed. When this option is enabled, extended data from each directory replication partner must be read. This increases the time it takes for Active Directory Replication Monitor to refresh the statistics.

Troubleshooting with Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Displaying Group Policy objects

Active Directory Replication Monitor can list Group Policy objects on a domain controller with their associated version number. This data can assist administrators with troubleshooting. This feature allows an administrator to compare the current version of a Group Policy object with that of the version contained in the SysVol. The Group Policy objects can be viewed by the administrator on demand or through the built-in logging feature.

To view the current state of Group Policy objects

one step On the Action menu, point to Server, and then click Show Group Policy Object Status.

Administrators can then determine the status of an individual Group Policy object by comparing its version number with that of the version contained in SysVol, as well as by viewing its Sync Status.

To enable Group Policy object logging

  1. On the View menu, click Options.
  2. Click the Status Logging tab.
  3. Under Monitored Servers, select the Group Policy Objects check box.

Troubleshooting with Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Displaying performance statistics

Performance statistics play an essential part in determining possible inconsistencies in a domain. Active Directory Replication Monitor provides administrators with the ability to view this data either on demand or through the built-in logging feature. The counters available to Active Directory Replication Monitor are specific to Active Directory and are also available in System Monitor.

To view the current performance statistics

one step On the Action menu, click Server, and then click Show Current Performance Data.

To enable logging of performance statistics

  1. On the View menu, click Options
  2. Click the Status Logging tab.
  3. Under Monitored Servers, select the Performance Statistics check box.

Troubleshooting with Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Using Active Directory Replication Monitor

Using Active Directory Replication Monitor topics

Features of the Active Directory Replication Monitor window

Modifying user interface and logging options

Adding a server to the list of monitored servers

Automating the addition of domain controllers to the list of monitored servers

Saving the list of monitored servers to an .ini file

Synchronizing directory partitions

Displaying changes pending replication

Updating the status and statistics for monitored servers

Generating a status report on a server

Viewing the topology of replication partners

Recalculating replication topology

Displaying attribute meta-data for objects in the directory

Determining which domain controller owns an FSMO

Viewing retired domain controllers as replica partners

Viewing transitive replication partners

Viewing trust relationships

Main topics

Active Directory Replication Monitor (Replmon.exe)

Troubleshooting With Active Directory Replication Monitor


Adding a server to the list of monitored servers

To add a server to the list of monitored servers

  1. On the Edit menu, click Add Monitored Server.

    2. This presents a dialog box that enables you to either browse for the server to monitor or, if already known, to add the server explicitly. If you browse for the server, Active Directory Replication Monitor attempts to determine the domain of which the computer you are currently logged on to is a member.

    The domain name is used to find a domain controller from which a list of sites and domain controllers can be enumerated. If this can be automatically determined, it is filled in automatically. If you need to supply alternate credentials to access Active Directory in a given domain, select the Use Alternate Credentials to get Site List check box and supply the credentials by clicking the Change button.

    Note

    • When you are prompted to supply alternate credentials, the password does not carry over to the second page of the wizard, so you must re-enter it. These credentials are only used to enumerate sites and domain controller names in Active Directory – they are not cached for use when monitoring specific servers. This is to avoid caching the password in the user interface.

  2. Click one of the two following options:
    • If you know the name of the server, click Add the server explicitly by name.
    • If you need to browse for the server, click Search the directory for the server to add.
  3. Click Next.
    • If you chose to add the server explicitly, the first two sections of the next page of the wizard will be grayed out and the third enabled so that you can enter the name of the server. This can be in the form of fully qualified domain name or NetBIOS name. If you are not an administrator in the domain of the selected server, select the Use Alternate Credentials check box and supply the credentials by pressing the Change button. These credentials are cached for only the selected server for use when updating statistics for that computer.
    • If you chose to browse for the server, the first section of the next page of the wizard displays the list of sites and each domain controller (regardless of domain) within that site. If a site was selected when the Add Monitored Server wizard was invoked, the second option lists just the domain controllers in the Site selected. Otherwise, this section is disabled. The third section is enabled, just as in the explicit case, if you choose to enter the name explicitly. If either of the first two options are used, a server must be selected. If you are not an administrator in the domain of the selected server, select the Use Alternate Credentials check box and supply the credentials by pressing the Change button. These credentials are cached for only the selected server for use when updating statistics for that computer.
  4. Click Finish.

When the server is located, several events occur:

  • If the domain controller is a Global Catalog server, this is recorded and the icon for the server will have an icon that reflects a globe.
  • The directory partitions for the server are enumerated, and the server is queried for the status of each replication partner that has replicated data to the monitored server. If the server is a Global Catalog server, there may be more than three directory partitions displayed.
  • Log files are started automatically for each of the replication partners so that statistics can be tracked at a per-replication partner/per-directory partition level.
  • If you have chosen to enable monitoring of performance statistics and status of Group Policy objects, the server will be queried for the status of both of these and a log will be started to record this data.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Automating the addition of domain controllers to the list of monitored servers

To automatically populate the Active Directory Replication Monitor with monitored servers, the administrator can create a text file that contains a list of server names and use the Open Script option to load the servers into the monitored servers list. By default, Replication Monitor does not populate the list view with servers to be monitored.

To create an .ini script

  1. Open a text editor, such as Notepad.
  2. Add the name of the server or servers to be monitored each on its own line (followed by a carriage return).
  3. Save the file as an *.ini file in the Program Files\Active Directory Replication Monitor folder.

To load an .ini script

  1. On the File menu, click Open Script.
  2. Select the .ini file with the list of servers to be monitored.

If the logged-on user does not have sufficient permissions to add the server to the view, the entries in the .ini file may include alternate credentials. To accomplish this, follow each server name with a comma and then an Windows NTLM-style logon. Do not include spaces between the server name and the comma or between the comma and the credentials.

Here is an example of providing alternate credentials in the format ServerName,Domain\Administrator:

Win2000Srv01,DomainName\Admin
Win2000Srv02,DomainName\Admin

If these alternate credentials are specified, a dialog box opens asking for a password to make the connection to the server(s). By default, the locally logged-on user credentials are passed when alternate credentials are not provided in the .ini file.

Additionally, you may specify the .ini as a parameter to the application when it starts to automatically load the monitored servers. This is accomplished by using the /script parameter. For example, modify the shortcut for ReplMon to use the /script parameter specifying the .ini file:

"C:\Program Files\Support Tools\replmon.exe" /script:c:\inifiles\srvlist.ini

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Determining which domain controllers own an FSMO

Active Directory Replication Monitor can display a monitored server's knowledge of which domain controllers hold Flexible Single Master Operation (FSMO) roles. This data tells administrators which domain controller the monitored server expects to perform these roles.

To view FSMO roles

one step On the Action menu, point to Server, and then click Properties.

–Or–

one step Right-click a server in the left pane and then click Properties.

On the FSMO Roles tab, the list of five roles with their respective owners is shown.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Saving the list of monitored servers to an .ini file

Active Directory Replication Monitor (ReplMon) can save a list of monitored servers for future use with the Open Script function. This functionality aids in reducing the amount of time it takes to add servers for monitoring. This file is in the form of an .ini script and the servers are written to the script file in the order in which they appear within the application.

To save the current list of servers monitored to an .ini script

  1. Add all servers to be saved in the .ini file using the Edit menu or by right-clicking Monitored Servers.
  2. On the File menu, click Save Monitored List As.
  3. Save the file as an .ini file in the Program Files\Active Directory Replication Monitor folder.

    4. If alternate credentials are supplied for a given server, the Windows NT 4.0-style name (domain\user name) is written to the .ini file. The password is not written to the file and must be supplied when reloaded into ReplMon.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Displaying attribute meta-data for objects in the directory

Attribute meta-data can be displayed for objects in the directory. The directory maintains various meta-data for each domain and server known to the enterprise.

To view attribute meta-data

  1. On the Action menu, point to Server, and then click Show Meta-Data for Active Directory Object.

    –or–

    Right-click a given server in the left pane and click Show Meta-Data for Active Directory Object. This opens a credentials window.

  2. You may use the currently logged-on user or select Change to supply a new set of credentials. As authorized access in the ACLs of individual objects can vary for different users, this window enables the user to avoid logging in and logging out continually. This opens a window with a text field.
  3. Enter a string in X.500 notation for the object you want to view attributes on. For example, cn=Administrator,cn=Users,dc=microsoft,dc=com, would set the path for the Administrator container.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Modifying user interface and logging options

Active Directory Replication Monitor provides a series of options that allows the administrator to specify additional data to record when replication status is updated, enable options that allow notification of replication failure, and to modify the presentation of replication status in the user interface.

To display the Options dialog

one step On the View menu, click Options.

General property page

Auto Generate File Names for Log Files

By default, the log file name that is used for tracking each replication partner (per directory partition) is generated by using the name of the monitored server followed by a "-" (dash), followed by the directory partition name, followed by a "-" (dash), followed by the name of the replication partner. Selecting this option will override this behavior and prompt the administrator for a log file name for each replication partner (per directory partition). For the log files that are maintained for server-specific data, the file name is constructed with the name of the site that the monitored server resides in, followed by a "-", followed by the name of the monitored server. This behavior cannot be modified.

Default Path For Replication Status Logs

Active Directory Replication Monitor places the log files, by default, in the Active Directory Replication Monitor installation directory. This option can be used to modify the default path where all log files will be recorded.

Show Retired Replication Partners

Once a domain controller is demoted, changes that originated on this server still remain in Active Directory on other domain controllers in the enterprise. Use this option to distinguish these replication partners in the user interface. The names of the servers identified in the user interface and in ReplMon reports will be prefixed with "** DELETED SERVER"

Show Transitive Replication Partners and Extended Data

Domain controllers do not always replicate with every other domain controller that is available. When a domain controller replicates data from a domain controller and that change originated on another machine that it doesn't directly replicate with, these changes were "transitively" replicated. By default, Active Directory Replication Monitor does not display these replication partners, but the user interface can optionally display these by enabling this option. This option is also required to be enabled when the administrator wants to view un-replicated objects from other domain controllers.

Enable Debug Logging

This option enables logging of Active Directory Replication Monitor processes and writes the output to the event log or a specified path. This can be beneficial in troubleshooting if ReplMon was unable to perform a specified function. When specifying the log file path, do not include the file name. The filename replmon.log will automatically be appended to the path. For example, if the administrator enters c:\logfiles as the debug log path, ReplMon will look for c:\logfiles\replmon.log.

Notify when Replication Fails After this Number of Attempts

If enabled, this option determines when an administrator is notified when Replmon determines that any monitored server has failed to replicate from any direct replication partner. After enabling this option, the administrator should specify how many failures need to occur before action is taken and select from the two available options of notifications:

  • ReplMon can write and event to the event log that details the monitored server that has failed to replicate inbound changes from a direct replication partner, the directory partition that is effected, the time of the last attempted replication, the number of failures at the time of the report, and the name of the direct replication partner.
  • Alternatively, ReplMon sends mail to the administrator when the same requirement is met. After the mail is sent on the initial detection of failure, additional messages will not be sent unless replication is re-established, in which case, an e-mail will be sent with this information. This option requires that a Microsoft mail client and Collaboration Data Objects (CDO) for Windows 2000 be installed on the same computer running ReplMon. Even though this option is enabled, it is not actually invoked unless ReplMon is running in automatic update mode. ReplMon will display the Exchange profile dialog and prompt for credentials (if necessary) when automatic update mode is enabled.

Status Logging property page

Group Policy objects

When this option is enabled, when the replication status of a monitored server is updated, Active Directory Replication Monitor also records a listing of the Group Policy objects that exist on the domain controller and the version numbers of both the component in Active Directory and in SYSVOL.

Performance Statistics

When this option is enabled, when the replication status of a monitored server is updated, Active Directory Replication Monitor also records a snapshot of the performance counters specified in the list box associated with this option.

Display Changed Attributes When Replication Occurs

When this option is enabled, as the replication status is updated on a per-directory partition, per-replication partner basis, any changes (except deletions) that were replicated to the monitored server from the replication partner (either directly or transitively) are recorded in the history log for the replication partner. This can be helpful in tracking where particular changes have replicated.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Displaying changes pending replication

Each domain controller keeps record of the last changes received from other domain controllers (via the update sequence number (USN) of the replication partner). When changes have occurred on the replication partner and the Active Directory replication process has not propagated those changes to the monitored server, this option can be used to show what objects have changed and need to be replicated to the monitored server. This is done on a per-directory partition level.

To view unreplicated objects

  1. Expand the monitored server to display the list of directory partitions.
  2. Expand and select the replication partner within the directory partition that you want to determine the un-replicated changes for. Only objects that have changed within the directory partition will be displayed. This procedure would need to be repeated for each directory partition if required.
  3. Right-click a replication partner (either direct or transitive) and click Check Current USN and Un-replicated Objects.

    -Or-

    On the Action menu, click Replication Partner, and then click Check Current USN and Un-replicated Objects

If any changed objects were detected, these are displayed in another window (which supports exporting the data to a text file). If no changes were detected, a message box is displayed that informs you of the current USN on the replication partner and that all changes have replicated to the monitored server.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Recalculating replication topology

Active Directory Replication Monitor gives administrators the ability to trigger the Knowledge Consistency Checker (KCC) into recalculating the replication topology. The KCC performs maintenance on the replication topology as well as other system-level information, such as server object properties.

Select the monitored server in the left pane to perform the action on (this refers to the server object beneath the site that the server resides in) and then either:

one step On the Action menu, point to Server, and then click Check Replication Topology.

–Or–

one step Right-click a given server in the left pane and then click Check Replication Topology.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Viewing retired domain controllers as replica partners

By default, when a domain controller is removed from a domain, the server no longer appears in the list of replica partners. Active Directory Replication Monitor gives administrators the option of displaying retired domain controllers in the list of servers.

To view retired domain controllers

  1. On the View menu, click Options.
  2. On the General tab, select the Show Retired Replication Partners check box.

Retired domain controllers now appear with a name that begins with "** DELETED SERVER".

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Generating a status report on a server

Active Directory Replication Monitor provides administrators with the ability to generate status reports for individual servers throughout a forest, and optionally to report on the enterprise configuration. The data recorded is valuable in troubleshooting possible replication errors in a forest or domain.

Caution

When a log is generated, you can name the log file and save it with Save As. If you accidentally give the new log file the same name as an existing log file, ReplMon does not append the new information to the old or warn you that you are replacing the existing file. It simply overwrites the existing log file.

To create a status report for a server

  1. Right-click on the monitored server you want to generate a report for.
  2. Click Generate Status Report.
  3. In the Save As dialog, provide a name and location for the file (you may choose to use the server name as the name for the file)
  4. Choose the Report Options that pertain to the needed information in the status report.

Available report options

Most data will automatically be written to the report file. However, the following sections are optional:

For the selected server only

  • Connections generated by the Knowledge Consistency Checker (KCC) and the reasons those connections were created.

    By default, the KCC checks NTDS connection objects every 15 minutes to verify the topology. This option can provide an administrator with a better understanding of their network topology and its internal generation.

  • Current FSMO (Flexible Single Master Operations) owners

Additional information that can be recorded

  • Server/domain controller configuration data
  • Extended site configuration
  • Computer account data
  • Site link and site link bridge configuration
  • Inter-site transport configuration
  • Subnets

    These provide an administrator with an output of any custom defined subnets for the server. Subnets are used to group high-availability networks for replication purposes.

  • Active Directory replication parameters (general)

    These parameters are general values with regard to replication extracted from the registry.

Using Active Directory Replication Monitor

Troubleshooting with Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Synchronizing directory partitions

An important feature of Active Directory Replication Monitor is the ability to synchronize directory partitions between two domain controllers or with all the servers in the site. Directory partitions are the subtrees of objects in Active Directory that are the unit of replication between domain controllers. It is imperative that these partitions contain the most up-to-date information about the objects in the domain and forest. Occasionally, for reasons such as network problems or if a server is down, the synchronization of this data may not be entirely up-to-date. Replication Monitor provides you, as the administrator, with the option to manually bring this data to a current state.

To synchronize the monitored server with a specific replication partner

  1. Expand the monitored server to display the list of directory partitions.
  2. Expand the directory partition that needs to be synchronized to display the replication partners.
  3. Only replication with direct partners can be initiated using this method. Right-click a direct replication partner, and then click Synchronize with this Replication Partner.

    -or-

    On the Action menu, point to Replication Partner, and then click Synchronize with this Replication Partner

To synchronize all directory partitions for a monitored server with all other servers in a Site

  1. Highlight the server for which to have all directory partitions synchronized.
  2. On the Action menu, point to Server, and then click Synchronize Each Directory Partition with All Servers.

-or-

  1. Right-click a given monitored server icon.
  2. Click Synchronize Each Directory Partition with All Servers.

To synchronize a single directory partition on a monitored server with all other domain controllers in a site

  1. Highlight the directory partition to be synchronized with all servers.
  2. On the Action menu, point to Naming Context, and then click Synchronize This Directory Partition with All Servers.

-or-

  1. Right-click a single Naming Context.
  2. Click Synchronize This Directory Partition with All Servers.

Note

  • There is a difference between Synchronize This Directory Partition with All Servers and Synchronize Each Directory Partition with All Servers. When selecting a server and performing a synchronization, you are bringing all listed Directory Partitions up to date for the given server. Individually selecting a single Directory Partition synchronizes only that portion of Active Directory.
  • Also, when initiating replication for a directory partition, a dialog is displayed that allows the administrator to specify additional parameters for the synchronization. One of these is to include domain controllers from other sites in the replication process. This can be used to bring a directory partition up to date with respect to all other domain controllers regardless of location.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Viewing the topology of replication partners

Choosing the option to view the intra-site topology creates a graphical view of all the domain controllers in the site, regardless of domain. The replication connections are displayed on demand by using the context (right-click) menu of the servers displayed.

To create the intra-site replication topology view

  1. Select the monitored server in the left pane (directly beneath the site that it resides in) that you want to use as the source to view the topology.
  2. Right-click to display the context menu, and then click Show Replication Topologies

    –or–

    On the Action menu, point to Server, and then click Show Replication Topologies.

To display the server ring

one step On the View menu, click Connection Objects. This displays the servers in the site in a ring topology.

To display the replication connections for a given server

  1. Right-click the server displayed to get the context menu.
  2. Click Show Intra-Site Connections to display connections to other servers within the site or click Show Inter-Site Connections to show connections to bridgehead servers in remote sites.

The status bar notifies administrators when the server is being used to generate replication information.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Viewing transitive replication partners

By default, Active Directory Replication Monitor shows only those servers with which it directly replicates. However, changes get replicated to the monitored server transitively through other computers. The administrator can enable an option that shows servers that have received changes through other replication partners.

To view transitive replication partners

  1. On the View menu, click Options.
  2. On the General tab, select the Show Transitive Replication Partners and Extended Data check box.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Viewing trust relationships

Active Directory Replication Monitor provides administrators with the ability to view trust relationships configured throughout the forest. This functionality tells an administrator the NetBIOS name contained in the trust, the domain name, the direction of the trust, and the type of trust.

To view established trust relationships

one step Right-click any monitored server and click Show Trust Relationships.

This displays a window containing any currently configured trust relationships.

The following tables present possible values for Direction of Trust and Types of Trusts that may be encountered within Replication Monitor.

Direction of Trust
DISABLED
TRUSTING
TRUSTED
TWO_WAY_TRUST
UNKNOWN

Types of Trusts
DOWNLEVEL
UPLEVEL
MIT
DCE
UNKNOWN

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Features of the Active Directory Replication Monitor window

Context-sensitive menus

All objects visible in the left pane of the Active Directory Replication Monitor (ReplMon) support context-sensitive (right-click) menus for quick access to actions that can be performed on the node selected.

Details view

The right pane displays data relevant to the node you select in the left pane of the ReplMon application.

  • If a monitored server is selected, the history of the date and time that each status refresh was initiated, along with Group Policy objects and performance statistics (if those options are enabled), are displayed. ReplMon also records other pertinent data regarding changes to the domain controller status in this view.
  • The history of replication status is recorded each time a refresh interval is encountered. This provides a way to view the progression of events up to the most recent replication interval. If a direct replication partner is selected, when the last replication attempt was successful, ReplMon records the time the refresh was initiated, the time of the last successful replication between the monitored server and the replication partner, and the highest USN value on the replication partner for which the monitored server has received changes. Times are expressed in local time determined by the machine where ReplMon is running. If ReplMon detects a failure, this information is expanded to include the time of the last attempted replication, the number of failures since the last successful replication, the error message associated with the last replication failure, and any other relevant messages associated with the error.
  • If a transitive replication partner is selected, the time that the refresh was initiated is recorded along with the USN of the replication partner (reflecting the value of the last originating change that the monitored server has received).

To disable the details view in the right pane

one step On the View menu, click Details View.

The right pane of the Active Directory Replication Monitor window is disabled.

Icons for replication partner status

In ReplMon, icons enable administrators to determine replication status at a glance.

A normal server icon represents a monitored server. If the monitored server is a Global Catalog server, the server icon appears with a globe to the upper right.

A book icon is used to represent directory partitions.

For replication partners:

  • If the replication partner is a direct replication partner and the last replication attempt was successful, an icon representing two domain controllers on a network is used.
  • If the replication partner is a direct replication partner and the last replication attempt failed, an icon representing two domain controllers on a network with a red "X" is used.
  • If the replication partner is a bridgehead server, an icon representing a phone connection is used. If the last replication attempt failed, an icon representing two domain controllers on a network with a red "X" is used to denote the failure.
  • For transitive replication partners, a single computer icon is used.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


Updating the status and statistics for monitored servers

Update all listed servers by pressing the F5 key or by selecting Refresh from the View menu item. To enable automatic refresh of the replication status for all monitored servers, select the Update Automatically button and enter a value between 1 and 60. Depending on the number of servers present in the list view, this may take an extended period to complete. For the automatic refresh mode, Active Directory Replication Monitor defaults to 5-minute intervals. To update a single server or a number of servers in succession, you may choose to do so by completing the steps below.

To update the statistics on a single server

  1. Right-click the server to be updated.
  2. Click Update Status (only for this server).
  3. Monitor the status bar to verify when the update has completed.

When a refresh of statistics is triggered, Active Directory Replication Monitor uses the credentials supplied for each server (if applicable) and takes a snapshot of the current state of replication and additional components (if configured). Once this action is complete, you can view the log in the details view for any changes.

Using Active Directory Replication Monitor

Active Directory Replication Monitor (Replmon.exe)


RsDiag database dump output

RsDiag can display diagnostic information about the database.

To display this information, type:

   rsdiag /d

Engine database

The Engine database contains three tables, which are enumerated in the first section of the dump performed by rsdiag /d.

The Segment Table is the mapping of the placeholder to a particular location in secondary storage where the data for the placeholder exists. The purpose of the Segment Table is to map the BAG identifier and Location to the correct piece of media in Secondary Storage.

The Media Table is the mapping of the media identifier to an external media name. This table is needed to associate an internal identifier with an external media name that is used by the media management subsystem.

The BAG Information Table contains global information about each BAG. There is only one entry for each BAG.

Segment Table Schema
Short Name | Long Name | Description
BagId | BAG ID | The GUID that uniquely identifies this BAG
StartLoc | BAG Segment Start Location | The starting position within the BAG that this segment represents
SegLen | Bag Segment Length | The length of this segment of the BAG. This length could be for the entire BAG or for only a portion of the BAG.
LocType | Location Type | Indicates whether this location is a media location or a logical redirection to another BAG and location
PrimPos | Primary Location Position Specifier | For media locations, this is a media identifier. For logical redirections, this is a BAG identifier.
SecPos | Secondary Location Position Specifier | For media locations, a starting location on media. For logical redirections, a BAG start location
IDB SeqNum |  | Database sequence number, indicating the sequence in which this record was originally added to the database

Segment Table dump example

00000  BagId = {b010419f-fb1b-11d1-a1ba-00a0c9190447}, StartLoc = 3072, SegLen = 52224, LocType = 0, PrimPos = {b0104199-fb1b-11d1-a1ba-00a0c9190447}, SecPos = 0  (IDB SeqNum =      1)
Media Information Table Schema
Short Name | Long Name | Description
Id | Media ID |
NtmsId |  | Media handle of the media identifier for the Media Service. This is a Removable Storage Management (RSM) Media ID.
StoragePoolId | Storage Pool ID | Unique Storage pool identifier
IDB SeqNum |  | Database sequence number, indicating the sequence in which this record was originally added to the database

Media Table dump example

00000  id = {b0104199-fb1b-11d1-a1ba-00a0c9190447} ntmsId = {da96022d-fb19-11d1-a1ba-00a0c9190447} StoragePoolId = {e5390a42-fb19-11d1-a1ba-00a0c9190447} (IDB SeqNum =      1)
Bag Information Table Schema
Short Name | Long Name | Description
Type |  | Record Type
BagId | BAG ID | A GUID created when the BAG is initially created
BirthDate | BAG Birthdate | The date and time the BAG was created
Len | Original BAG Length | Actual length of the BAG at create time
Type | BAG Type | Not currently used
VolId | Volume ID | Represents the managed volume from which the data in this BAG was originally taken
DeletedAmount | Deleted BAG amount | Amount of space within the BAG that has been deleted. Currently unused.
RemoteDataSet | Remote Data Set Number | The unique ID used on media to identify this session
IDB SeqNum |  | Database sequence number, indicating the sequence in which this record was originally added to the database

Bag Information dump example

00000 , Type = 2 BagId = {b010419f-fb1b-11d1-a1ba-00a0c9190447}, BirthDate = 06/03/1998 20:42:20, Len = 47051200, Type = 0, VolId = {9db6f302-fb1b-11d1-a1ba-00a0c9190447}, DeletedAmount = 0, RemoteDataSet = 1 (IDB SeqNum =      1)

File System Agent database

The primary File System Agent (FSA) database is the Premigration List. The premigration list contains an entry for each file which has been premigrated.

Premigration List Schema
Short Name | Description
AccessTime | The last time this file was accessed
BagID | The BAG ID which contains migrated data for this file
BagOffset | The offset into the BAG referenced in BagID where this data resides
FileId | File ID
Waiting for Close | Not currently used
Offset | Not currently used
Path | The path of this file. This information may be compressed.
Size | Amount of data premigrated
RecallTime | The last time a recall attempt was made
File USN | The update sequence number (USN) for this file

Premigration List dump example

00000  AccessTime = 03/30/1998 20:52:46 BagId = {b01043e7-fb1b-11d1-a1ba-00a0c9190447}, BagOffset = 56320, FileId = 1000000 Waiting for close = FALSE, Offset = 0, Path = \dir0\test1.tst, Size = 1000000 RecallTime = 01/01/1601 00:00:00, File USN = 589408

Remote Storage Diagnostic Utility (RsDiag.exe)

RsDiag syntax


RsDiag job status output

The Remote Storage Diagnostic Utility (RsDiag) can display information about job status.

To display information about all jobs, type:

   rsdiag /j

To display extended information about a particular job, type:

   rsdiag /j jobname

rsdiag /j output

The /j switch displays the following information about each job:

Job Status
Name | Description
Name | Job name
RunID | The number of times this job has been run
IsActive | True if the job is running. False if not
IsUsers | OK if the job was created by a user. False if the job was created automatically
Done | OK if the job is finished. False if not
DoneOK | OK if the job has finished with no error condition. False if not
MaxSess | Always 1

rsdiag /j example

Name                              RunId     IsActive  IsUsers   Done      DoneOk  MaxSess
Manage                            00000002  False     False     Ok        Ok      0000001
RemoteStorageJob_H_QuickUnmanage  00000001  False     Ok        Ok        Ok      0000001
RemoteStorageJob_G_CopyFiles      00000001  False     Ok        Ok        Ok      0000001

rsdiag /j jobname output

A job runs on one or more resources. Executing a job requires one or more phases of activity for each resource. A phase may perform multiple actions, although typically only one is performed. For example, the Manage job will scan each managed drive and premigrate any valid files it finds. When the managed job is dumped using rsdiag /j jobname, it displays two phases and two actions for each resource (managed drive) it finds. The first phase is the Scan phase, and the action it takes is also called Scan. The second phase is the Data Transfer phase, and the action it takes is called Pre-migrate. See the Long Job Show Example below for an example of a dump of the Manage job.

The rsdiag /j jobname command shows information about each resource, phase, and action the job contains.

The following information is displayed once for each job:

Name | Description
Name | Job name
Identifier | Unique identifier for this job
Hsm Identifier | Remote Storage Server identifier
Run Identifier | The number of times this job has been run
MaxSess | Always 1
Is User Defined | OK if the job was created by a user. False if the job was automatically created
Is Active | True if the job is running. False if not
Did Finish | OK if the job is finished. False if not
Did Finish Ok | OK if the job has finished with no error condition. False if not

The following information is displayed once for each resource that was acted upon by a job:

Name | Description
Resource Name | The name of the volume this job runs on
State | The current state of the job. Valid states are: Active Cancelled Canceling Done Failed Idle Paused Pausing Resuming Skipped Starting
Starting Path | The path in which the job started
Current Path | The current path on which the job executes
Start Time | The time the job started
Stop Time | The time the job stopped
Sub-Run Id | Number of times this sub-job has run

The following information is displayed for each phase of a job running on a resource:

Name | Description
Phase Name | The name of this phase. Valid names are: All - This phase contains all the valid items Scan - This is a scan phase File Update - RSFSA is updating files Data Transfer - The engine is transferring files
State | The current state of the job. Valid states are: Active Cancelled Canceling Done Failed Idle Paused Pausing Resuming Skipped Starting
Media State | The state of the media on which this job executes. Valid states are: Idle Unavailable Mounting Mounted Transferring Transferred Dismounting Dismounted
Priority | The job priority. The only valid priority is "Normal".
Start Time | The time this phase started
Stop Time | The time this phase ended
Elapsed Time | The elapsed time between start time and stop time, minus any pauses
Items | Number of items, typically files, acted upon in this phase
Size | Total size in bytes of all the items acted upon in this phase
Skipped Items | Number of items skipped in this phase
Skipped Size | Total size of all the times skipped in this phase

The following information is displayed for each action in a phase:

Name | Description
Action Name | The name of the action
Items | Number of items, typically files, acted upon in this action
Size | Total size in bytes of all the items acted upon in this action
Skipped Items | Number of items skipped in this action
Skipped Size | Total size of all the times skipped in this action

rsdiag /j jobname example

Showing <manage> ...
  Name             : Manage
  Identifier       : {58c24333-05fa-11d2-a1c0-00a0c9190447}
  Hsm Identifier   : {58c24331-05fa-11d2-a1c0-00a0c9190447}
  Run Identifier   : 1
  Max Sessions     : 1
  Is User Defined  : False
  Is Active        : False
  Did Finish       : Ok
  Did Finish Ok    : Ok

    Resource Name    : BANANAFISH\NTFS\G:
    State            : Done
    Starting Path    : \
    Current Path     :
    Start Time       : 06/17/1998 16:06:44
    Stop Time        : 06/17/1998 16:30:11
    Sub-Run Id       : 0

      Phase Name       : Scan
      State            : Done
      Media State      : Idle
      Priority         : Normal
      Start Time       : 06/17/1998 16:06:47
      Stop Time        : 06/17/1998 16:30:11
      Elapsed Time     : 0 days, 00:18:16
      Items            : 902
      Size             : 900081920
      Skipped Items    : 0
      Skipped Size     : 0

      Phase Name       : Data Transfer
      State            : Done
      Media State      : Transferred
      Priority         : Normal
      Start Time       : 06/17/1998 16:06:48
      Stop Time        : 06/17/1998 16:30:11
      Elapsed Time     : 0 days, 00:23:22
      Items            : 900
      Size             : 900000000
      Skipped Items    : 2
      Skipped Size     : 81920

      Action Name      : Scan
      Items            : 902
      Size             : 900081920
      Skipped Items    : 0
      Skipped Size     : 0

      Action Name      : Premigrate
      Items            : 900
      Size             : 900000000
      Skipped Items    : 2
      Skipped Size     : 81920

Remote Storage Diagnostic Utility (RsDiag.exe)

RsDiag syntax


RsDiag media status output

RsDiag can display information about media.

To display all media, type:

   rsdiag /s

Following are the fields included in the output:

Name | Description
Description | Name given to media by Remote Storage
Name | Name given to media by Removable Storage
Media ID | Identifier given to media by Remote Storage
RSM ID | Identifier given to media by Removable Storage
Media Type | Enumeration of media type
Last update | Last time media was written to
Last error | Last Error media returned
Recall Only | True - media is recall only. False - media is read/write
Capacity | Total number of bytes media will hold
Free Bytes | Total number of unused bytes on media
Next Data Set | Next Data Set to be written to
Recreate | Whether or not this media has been recreated

rsdiag /s example

Showing:  <RS-V-SCOOBY-1>
    Description  	:  RS-V-SCOOBY-1
    Name         	:  RS-V-SCOOBY-1
    Media ID     	:  {43e00ce7-8a56-11d2-9681-00a0c905f098}
    RSM ID       	:  {0878a2e0-8a56-11d2-9681-00a0c905f098}
    Media type   	:  4
    Last update  	:  12/03/1998 16:21:53
    Last error   	:  Ok
    Recall only  	:  FALSE
    Capacity     	:  20113227776
    Free Bytes   	:  19654164480
    Next Data Set	:  87
    Recreate     	:  FALSE

Remote Storage Diagnostic Utility (RsDiag.exe)

RsDiag syntax


RsDiag resource status output

RsDiag can display information about resources.

To display the manageable volumes on server, type:

   rsdiag /m

To display all resources, type:

   rsdiag /v

To display a particular resource, type:

   rsdiag /v driveletter

These switches display a list of information for the specified resource. In addition to general information about the resource, such as the logical name and desired free space, it contains one or more rules, and automatic truncate information. The rules consist of information about files to include or exclude from management. A rule contains criteria, which describe file information to include in this action. For example, a rule may describe an action to take on all files matching "*.txt" and that are migrated.

The automatic truncate information describes what Remote Storage will do when disk space limitations require that premigrated files be truncated.

Following are the fields included in the list:

Name | Description
Logical name | Logical name of this resource
Identifier | Unique identifier of this resource
Serial Number | Volume serial number
File System Name | Type of file system
Name (Label) | Drive label
User Friendly name | Drive letter
Sticky name | Windows 2000 sticky name
Path | Current path mapped to this resource
UNC Path | UNC path of this resource
Alternate Path | Alternate path of this resource
Old Path | The original path to this resource
Db Path | The path to the pre-migration list database that contains information about this resource
Is Managed | True if this is a managed resource. False if not
Is Active | True if this is an active resource. False if not
Is Available | True if this resource is available. False if not
Managing Hsm | The unique identifier of the server that is managing this resource
Desired Free | The desired percentage of free space
Actual Free | The actual percentage of free space
Total | The total capacity of this resource in bytes
Free | The total free space in bytes
premigrated | The total amount of data, in bytes, that has been premigrated. This does not reflect deleted data.
Truncated | The total amount of data, in bytes, that has been truncated. This does not reflect deleted data.
Manageable Size | The minimum file size in bytes to manage
Manageable Time | The minimum file age in days to manage

The following information is displayed for each rule:

Name | Description
Rule Path | The path this rule will be applied to
Name | The rule name. This is a standard wildcard type file name describing what type of files this rule applies to.
Search Name | The search name of this rule
Is Include | True if this rule describes files to be included in management, False if the rule describes files to be excluded from management
Is User Defined | True if this is a user-defined rule. False if not
Is In SubDirs | True if subdirectories of the path specified in Rule Path are to be included
Criterium Name | Criteria which must be met for this rule to be applied. Valid criteria are Always, Manageable, Migrated, and Premigrated
Is Ignored | True if this criterium is ignored. False if not
Is Negated | True if this criterium is negated. False if not

The following automatic truncation information is displayed:

Name | Description
Keep Recall Time | Not currently used
Run Interval | Amount of time in milliseconds between automatic truncate jobs

After the automatic truncate information, the phase information for the automatic truncate job is displayed. See the phase information detailed in RsDiag job status output for a full description.

Remote Storage Diagnostic Utility (RsDiag.exe)

RsDiag syntax


RsDiag syntax

rsdiag [/c jobname] [/d filetype fullpath&filename] [/e errorcode] [/i] [/j [jobname]] [/m] [/r [/f]] [/s] [/t] [/v [driveletter]] [/x queuedrecall] [/w fullpath&filename]

Parameters

/c jobname
Cancels the specified job. You can get the names of jobs with the /j switch.
/d filetype fullpath&filename
Converts the database diagnostic information to a text file.
filetype specifies which kind of source file to output in text format. Must be one of the following:
e Engine database
f File System Agent database
a File System Agent collection
n Engine collection
s Sub System collection
fullpath&filename must include the full path to and name of the text file for the dump.
/e errorcode
Shows error information for HRESULT or WIN32 error codes. errorcode can be entered either in decimal or hexadecimal. The default is decimal. For hexadecimal error codes, add 0x to the begining of the code number, for example, 0x81000005.
/i
Displays version information for the files.
/j [jobname]
If no job is specified, displays job information for all jobs.
With jobname, displays extended job information for the specified job.
/m
Displays volumes which are eligible for management.
/r [/f]
Displays recalls currently queued on the Remote Storage server's internal recall queue, listing each recall by file name and showing the logical size of the file. With /f, displays extended information including the state of the recall, the user that initiated the recall, and the file offset on the media.
/s
Displays information on the physical storage media.
/t
Reloads the trace files. This causes the trace registry settings to be reread for all services, File System Agent (FSA), HSM, and RMS. The services do not need to be reset after.
/v [driveletter]
Without arguments, displays volume information.
With driveletter, it displays extended information for the specified volume.
/x queuedrecall
Cancels the specified recall on the Remote Storage server's internal recall queue. Recalls are listed with the /r switch.
/w fullpath&filename
Shows the name of the physical storage medium on which of the most current version of the specified file resides, and the data set of which the file is a member. fullpath&filename must be the entire path and file name of the file to locate.

Remote Storage Diagnostic Utility (RsDiag.exe)

RsDiag database dump output

RsDiag job status output

RsDiag resource status output

RsDiag media status output

RsDiag version information output


RsDiag version information output

The Remote Storage Diagnostic Utility (RsDiag) can display version information about Remote Storage components.

To display component information, type:

   rsdiag /i

The following fields are included in the output:

Name | Description
Title | Component title
Registry Name | Component title in registry
Identifier | Unique identifier of this resource
DB Version | Component's database version
Build Version | Remote Storage build number
NT Version | Windows version
NT Build | Windows build number
DB Path | Path to the component's collection file

rsdiag /i example

  RsTest
    Build        :  391

  FSA
    RegistryName   :  Remote_Storage_File_System_Agent
    Identifier     :  {349763e3-8a50-11d2-9681-00a0c905f098}
    Db Version     :  1
    Build Version  :  386
    NT Version     :  5.00
    NT Build       :  1934
    DbPath         :  D:\WINNT\system32\RemoteStorage\RsFsa.col

  HSM
    RegistryName   :  Remote_Storage_Engine
    Identifier     :  {51a17b12-8a50-11d2-9681-00a0c905f098}
    Db Version     :  2
    Build Version  :  386
    NT Version     :  5.00
    NT Build       :  1934
    DbPath         :  D:\WINNT\system32\RemoteStorage\RsEng.col

  RMS
    RegistryName   :  Remote_Storage_Subsystem
    Identifier     :  {3f577494-8a50-11d2-9681-00a0c905f098}
    Db Version     :  2
    Build Version  :  386
    NT Version     :  5.00
    NT Build       :  1934
    DbPath         :  D:\WINNT\system32\RemoteStorage\RsSub.col

Remote Storage Diagnostic Utility (RsDiag.exe)

RsDiag syntax


RsDir examples

File Status Dump example

Running RsDir on a directory called "\test" containing two files, test71.tst and test72.tst, produces the following output.

rsdir \test

trunc  A Z 1000000 0 03/30/1998 20:55:12 0001000000000196 test71.tst
premig     1000000 1000000 03/30/1998 20:55:12 0001000000000197 test72.tst

Full File Status Dump example

Running RsDir with the /f switch on a file called "test59.tst" produces the following output.

rsdir /f test59.tst

name               =  test59.tst
status             =  truncated
attributes         =  A      Z
logical size       =  1000000
physical size      =  0
access time        =  03/30/1998 20:55:08
modify time        =  03/30/1998 20:55:08
file id            =  281474976711050
hsm id                =  {e5390a41-fb19-11d1-a1ba-00a0c9190447}
bag id                =  {b01043e7-fb1b-11d1-a1ba-00a0c9190447}
file start            =  360221696
file size             =  1000448
data start            =  246
data size             =  1000000
file version id       =  125357649080000000
verification type     =  1
verification data     =  22621
recall count          =  0
data stream start     =  0
data stream size      =  1000000
data stream           =  0
data stream CRC type  =  1
data stream CRC       =  4257568424
migration time     =  06/03/1998 21:22:15
last recall time   =  01/01/1601 00:00:00

Remote Storage File Analysis Utility (RsDir.exe)

RsDir syntax

RsDir output


ResDir output

RsDir output

RsDir displays the status of files using the following parameters:

Property | Description
Status | Trunc: This file is truncated. Premigr: This file is premigrated. Mount: This file contains a reparse point not created by Remote Storage. Normal: This file is not managed by Remote Storage.
Attributes | File attributes: A Archive C Compressed E Encrypted D Directory H Hidden O Offline R Read Only S System File X Has extended attributes Z Sparse File
Logical | The logical size of this file
Physical | The physical size of this file. This will be 0 for a truncated file.
AccessTime | The last time this file was accessed
FileId | The file ID
Name | The name of the file

RsDir /f output

When run with the /f switch, RsDir lists additional properties in its output.

Property | Description
Name | The name of the file
Status | Trunc: This file is truncated. Premigr: This file is premigrated. Mount: This file contains a reparse point not created by Remote Storage. Normal: This file is not managed by Remote Storage.
Attributes | File attributes: A Archive C Compressed E Encrypted D Directory H Hidden O Offline R Read Only S System File X Has extended attributes Z Sparse File
Logical Size | The logical size of this file
Physical Size | The physical size of this file. This will be 0 for a truncated file.
Access Time | The last time this file was accessed
Modify Time | The last time this file was modified
FileId | The file ID
HSM Id | HSM Unique Identifier of owner of this data
BAG Id | Unique Identifier of the BAG this data is in
File Start | Offset from the beginning of the BAG for all the data in Remote Storage for this segment
File Size | Size of all the data in Remote Storage for this segment
Data Start | Offset from the beginning of the File Data of the data representing this segment
Data Size | Size of this segment within the File Data
File Version ID | Special Key used to determine changes to premigrated files or placeholders
Verification Id | Type of algorithm used to generate the Verification Data
Verification Data | Data used to validate the data in remote storage
Recall Count | Number of times this portion of the stream has been placed back on local storage
Data Stream Start | Position within the Stream ID that the data in remote storage represents
Data Stream Size | Amount of data within StreamID that the data in remote storage represents
Data Stream | Simple ID that represents the named stream this data is from. 0 is the unnamed stream
Data Stream CRC Type | Type of algorithm used to generate the CRC on the stream
Data Stream CRC | CRC of the stream indicated by Stream ID, Stream Location, and Stream Size
Migration Time | Migration Time of the data
Last Recall Time | Last recall time of the data

Remote Storage File Analysis Utility (RsDir.exe)

RsDir syntax

RsDir examples


RsDir syntax

rsdir [file_or_directory] [/s] [/f]

Parameters

without arguments
Displays file status settings for the current directory. You can use this to determine which files within the directory have Remote Storage reparse points.
file_or_directory
Displays file status settings for the specified file or directory. For a specific file, this tells you whether or not the file has migrated into Remote Storage.
/s
Displays file information for the current or specified directory and its subdirectories.
/f
Displays extended file information.

Remote Storage File Analysis Utility (RsDir.exe)

RsDir output

RsDir examples


SDCheck examples

Displaying the summary security information for an object

In this example, no changes have been applied to the user object, Someone, or the parent organization unit, Sales, since their initial creation (Note the metadata version number).

c:\sdcheck sprocket someone@microsoft.com

Microsoft(R) Windows (R) 2000 Operating System
Security Descriptor Check Utility - build(2015)

Input:  someone@microsoft.com
Object: CN=Someone,OU=Sales,DC=microsoft,DC=com
Domain: microsoft.com
Domain: DC=microsoft,DC=com
Server: sprocket

*** Warning: No values returned for dSCorePropagationData on CN=Someone,OU=Sales,DC=microsoft,DC=com
*** Warning: No values returned for dSCorePropagationData on OU=Sales,DC=microsoft,DC=com
*** Warning: No values returned for dSCorePropagationData on DC=microsoft,DC=com

Object:   CN=Someone,OU=Sales,DC=microsoft,DC=com
Classes:  top person organizationalPerson user
SD:       1012 bytes
Metadata: 04/15/1999 14:53:04 @ SPROCKET.microsoft.com ver: 1

  Object:   OU=Sales,DC=microsoft,DC=com
  Classes:  top organizationalUnit
  SD:       424 bytes
  Metadata: 04/15/1999 14:54:13 @ SPROCKET.microsoft.com ver: 1

    Object:   DC=microsoft,DC=com
    Classes:  top domain domainDNS
    SD:       496 bytes
    Metadata: 04/15/1999 14:51:32 @ SPROCKET.microsoft.com ver: 4

Checking ACL inheritance ...
    Parent: 2 - DC=microsoft,DC=com
    Child:  1 - OU=Sales,DC=microsoft,DC=com

Checking ACL inheritance ...
    Parent: 1 - OU=Sales,DC=microsoft,DC=com
    Child:  0 - CN=Someone,OU=Sales,DC=microsoft,DC=com

Displaying the security descriptor for an object

Note that in this example, two additional access-control lists (ACLs) have been added. This can be identified by the version number increase for the security metadata. One ACL denies read/write access to members of the Accounts Payable group, and the other ACL audits read/write attempts by the Administrator.

c:\sdcheck sprocket someone@microsoft.com -dumpSD

Microsoft(R) Windows (R) 2000 Operating System
Security Descriptor Check Utility - build(2015)

Input:  someone@microsoft.com
Object: CN=Someone,OU=Sales,DC=microsoft,DC=com
Domain: microsoft.com
Domain: DC=microsoft,DC=com
Server: sprocket

*** Warning: No values returned for dSCorePropagationData on OU=Sales,DC=microsoft,DC=com
*** Warning: No values returned for dSCorePropagationData on DC=microsoft,DC=com

Object:   CN=Someone,OU=Sales,DC=microsoft,DC=com
Classes:  top person organizationalPerson user
SD:       1072 bytes
Metadata: 04/15/1999 14:59:08 @ SPROCKET.microsoft.com ver: 3
History:  04/15/1999 14:59:00 flags(0x1) SD propagation
          04/15/1999 14:59:08 flags(0x1) SD propagation

  Object:   OU=Sales,DC=microsoft,DC=com
  Classes:  top organizationalUnit
  SD:       424 bytes
  Metadata: 04/15/1999 14:54:13 @ SPROCKET.microsoft.com ver: 1

    Object:   DC=microsoft,DC=com
    Classes:  top domain domainDNS
    SD:       496 bytes
    Metadata: 04/15/1999 14:51:32 @ SPROCKET.microsoft.com ver: 4

Checking ACL inheritance ...
    Parent: 2 - DC=microsoft,DC=com
    Child:  1 - OU=Sales,DC=microsoft,DC=com

Checking ACL inheritance ...
    Parent: 1 - OU=Sales,DC=microsoft,DC=com
    Child:  0 - CN=Someone,OU=Sales,DC=microsoft,DC=com

SD for CN=Someone,OU=Sales,DC=microsoft,DC=com
SD Revision: 1
SD Control:  0x8c14
        SE_DACL_PRESENT
        SE_SACL_PRESENT
        SE_DACL_AUTO_INHERITED
        SE_SACL_AUTO_INHERITED
        SE_SELF_RELATIVE
Owner: microsoft\Domain Admins S-1-5-21-640924683-4221571012-3872390550-512
Group: microsoft\Domain Users S-1-5-21-640924683-4221571012-3872390550-513
DACL:
    Revision      4
    Size:         944 bytes
    # Aces:       24
    Ace[0]
        Ace Type:  0x1 - ACCESS_DENIED_ACE_TYPE
        Ace Size:  36 bytes
        Ace Flags: 0x0
        Ace Mask:  0x000200bc
            READ_CONTROL
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_LIST_OBJECT
        Ace Sid:   microsoft\Accounts Payable S-1-5-21-640924683-4221571012-3872390550-1130
    Ace[1]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  24 bytes
        Ace Flags: 0x0
        Ace Mask:  0x000f01ff
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   BUILTIN\Account Operators S-1-5-32-548
    Ace[2]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  20 bytes
        Ace Flags: 0x0
        Ace Mask:  0x00020000
            READ_CONTROL
        Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[3]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  36 bytes
        Ace Flags: 0x0
        Ace Mask:  0x000f01ff
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   microsoft\Domain Admins S-1-5-21-640924683-4221571012-3872390550-512
    Ace[4]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  20 bytes
        Ace Flags: 0x0
        Ace Mask:  0x00020094
            READ_CONTROL
            ACTRL_DS_LIST
            ACTRL_DS_READ_PROP
            ACTRL_DS_LIST_OBJECT
        Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[5]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  20 bytes
        Ace Flags: 0x0
        Ace Mask:  0x000f01ff
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   NT AUTHORITY\SYSTEM S-1-5-18
    Ace[6]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Public Information
        Object Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[7]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Web Information
        Object Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[8]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Personal Information
        Object Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[9]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - General Information
        Object Ace Sid:   NT AUTHORITY\Authenticated Users S-1-5-11
    Ace[10]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr - userCertificate
        Object Ace Sid:   microsoft\Cert Publishers S-1-5-21-640924683-4221571012-3872390550-517
    Ace[11]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000100
            ACTRL_DS_CONTROL_ACCESS
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Change Password
        Object Ace Sid:   Everyone S-1-1-0
    Ace[12]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Logon Information
        Object Ace Sid:   microsoft\RAS and IAS Servers S-1-5-21-640924683-4221571012-3872390550-553
    Ace[13]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Modify Group Membership
        Object Ace Sid:   microsoft\RAS and IAS Servers S-1-5-21-640924683-4221571012-3872390550-553
    Ace[14]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Account Restrictions
        Object Ace Sid:   microsoft\RAS and IAS Servers S-1-5-21-640924683-4221571012-3872390550-553
    Ace[15]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  56 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000010
            ACTRL_DS_READ_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Modify Remote Access Information
        Object Ace Sid:   microsoft\RAS and IAS Servers S-1-5-21-640924683-4221571012-3872390550-553
    Ace[16]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Web Information
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[17]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Phone and Mail Options
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[18]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Attr set - Personal Information
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[19]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000100
            ACTRL_DS_CONTROL_ACCESS
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Receive As
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[20]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000100
            ACTRL_DS_CONTROL_ACCESS
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Send As
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[21]
        Ace Type:  0x5 - ACCESS_ALLOWED_OBJECT_ACE_TYPE
        Ace Size:  40 bytes
        Ace Flags: 0x0
        Object Ace Mask:  0x00000100
            ACTRL_DS_CONTROL_ACCESS
        Object Ace Flags: 0x1
            ACE_OBJECT_TYPE_PRESENT
        Object Ace Type:  Control right - Change Password
        Object Ace Sid:   NT AUTHORITY\SELF S-1-5-10
    Ace[22]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  24 bytes
        Ace Flags: 0x12
            CONTAINER_INHERIT_ACE
            INHERITED_ACE
        Ace Mask:  0x000f01bd
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   BUILTIN\Administrators S-1-5-32-544
    Ace[23]
        Ace Type:  0x0 - ACCESS_ALLOWED_ACE_TYPE
        Ace Size:  36 bytes
        Ace Flags: 0x12
            CONTAINER_INHERIT_ACE
            INHERITED_ACE
        Ace Mask:  0x000f01ff
            DELETE
            READ_CONTROL
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_LIST
            ACTRL_DS_SELF
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_LIST_OBJECT
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   microsoft\Enterprise Admins S-1-5-21-640924683-4221571012-3872390550-519
SACL:
    Revision      2
    Size:         52 bytes
    # Aces:       2
    Ace[0]
        Ace Type:  0x2 - SYSTEM_AUDIT_ACE_TYPE
        Ace Size:  24 bytes
        Ace Flags: 0x82
            CONTAINER_INHERIT_ACE
        Ace Mask:  0x00000030
            ACTRL_DS_READ_PROP
            ACTRL_DS_WRITE_PROP
        Ace Sid:   BUILTIN\Administrators S-1-5-32-544
    Ace[1]
        Ace Type:  0x2 - SYSTEM_AUDIT_ACE_TYPE
        Ace Size:  20 bytes
        Ace Flags: 0xd2
            CONTAINER_INHERIT_ACE
            INHERITED_ACE
        Ace Mask:  0x000d016b
            DELETE
            WRITE_DAC
            WRITE_OWNER
            ACTRL_DS_CREATE_CHILD
            ACTRL_DS_DELETE_CHILD
            ACTRL_DS_SELF
            ACTRL_DS_WRITE_PROP
            ACTRL_DS_DELETE_TREE
            ACTRL_DS_CONTROL_ACCESS
        Ace Sid:   Everyone S-1-1-0

Determining if the security descriptor is being inherited correctly

In this example, an inheritable ACL was added to the domain object dc=microsoft,dc=com, denying read and write access to the members of the Finance group. Note that the metadata version number for the domain object; dc=microsoft,dc=com has been incremented, however the ACL has yet to propagate to the Sales object.

c:\sdcheck sprocket someone@microsoft.com

Microsoft(R) Windows (R) 2000 Operating System
Security Descriptor Check Utility - build(2015)

Input:  someone@microsoft.com
Object: CN=Someone,OU=Sales,DC=microsoft,DC=com
Domain: microsoft.com
Domain: DC=microsoft,DC=com
Server: sprocket

*** Warning: No values returned for dSCorePropagationData on DC=microsoft,DC=com

Object:   CN=Someone,OU=Sales,DC=microsoft,DC=com
Classes:  top person organizationalPerson user
SD:       1108 bytes
Metadata: 04/15/1999 14:59:08 @ SPROCKET.microsoft.com ver: 3
History:  04/15/1999 14:59:00 flags(0x1) SD propagation
          04/15/1999 14:59:08 flags(0x1) SD propagation
          04/15/1999 15:13:22 flags(0x1) SD propagation

  Object:   OU=Sales,DC=microsoft,DC=com
  Classes:  top organizationalUnit
  SD:       460 bytes
  Metadata: 04/15/1999 14:54:13 @ SPROCKET.microsoft.com ver: 1
  History:  04/15/1999 15:13:21 flags(0x1) SD propagation

    Object:   DC=microsoft,DC=com
    Classes:  top domain domainDNS
    SD:       532 bytes
    Metadata: 04/15/1999 15:13:21 @ SPROCKET.microsoft.com ver: 5

Checking ACL inheritance ...
    Parent: 2 - DC=microsoft,DC=com
    Child:  1 - OU=Sales,DC=microsoft,DC=com
*** Error: Parent ACE [0] specific Mask [0x4] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x8] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x10] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x20] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x80] not found1 in child
*** Error: Parent ACE [0] specific Mask [0x20000] not found1 in child

Checking ACL inheritance ...
    Parent: 1 - OU=Sales,DC=microsoft,DC=com
    Child:  0 - CN=Someone,OU=Sales,DC=microsoft,DC=com

Determining if changes to the security descriptor are being replicated from one domain controller to another

In this example, changes to the security descriptor were performed against the same object on a different domain controller. Note the security metadata, the version number has been incremented and that the name of the domain controller which originated the updated security descriptor is different; in this example wombat.microsoft.com.

c:\sdcheck sprocket someone@microsoft.com

Microsoft(R) Windows (R) 2000 Operating System
Security Descriptor Check Utility - build(2015)

Input:  someone@microsoft.com
Object: CN=Someone,OU=Sales,DC=microsoft,DC=com
Domain: microsoft.com
Domain: DC=microsoft,DC=com
Server: sprocket

*** Warning: No values returned for dSCorePropagationData on DC=microsoft,DC=com

Object:   CN=Someone,OU=Sales,DC=microsoft,DC=com
Classes:  top person organizationalPerson user
SD:       1144 bytes
Metadata: 04/15/1999 17:26:52 @ WOMBAT.microsoft.com ver: 4
History:  04/15/1999 14:59:00 flags(0x1) SD propagation
          04/15/1999 14:59:08 flags(0x1) SD propagation
          04/15/1999 15:13:22 flags(0x1) SD propagation

  Object:   OU=Sales,DC=microsoft,DC=com
  Classes:  top organizationalUnit
  SD:       460 bytes
  Metadata: 04/15/1999 14:54:13 @ SPROCKET.microsoft.com ver: 1
  History:  04/15/1999 15:13:21 flags(0x1) SD propagation

    Object:   DC=microsoft,DC=com
    Classes:  top domain domainDNS
    SD:       532 bytes
    Metadata: 04/15/1999 15:13:21 @ SPROCKET.microsoft.com ver: 5

Checking ACL inheritance ...
    Parent: 2 - DC=microsoft,DC=com
    Child:  1 - OU=Sales,DC=microsoft,DC=com

Checking ACL inheritance ...
    Parent: 1 - OU=Sales,DC=microsoft,DC=com
    Child:  0 - CN=Someone,OU=Sales,DC=microsoft,DC=com

Security Descriptor Check Utility (Sdcheck.exe)

SDCheck syntax


SDCheck syntax

sdcheck Server Object [-dumpSD] [-dumpAll] [-debug] [[-domain: DomainName] -user: UserName -password: Password] [/?]

Parameters

Server
Specifies the name of the domain controller on which to perform the query. The name may be either the DNS name or the NetBIOS name of the domain controller.
Object
Specifies the name of the object on which you want to determine the access-control list (ACL) entries. The name can be either the logon name (for example, MICROSOFT\someone), the fully distinguished name (for example, cn=Someone, ou=Sales,dc=microsoft,dc=com) or the user principal name (for example, someone@microsoft.com).
-dumpSD
Displays only the security descriptor for the selected object.
-dumpALL
Displays the security descriptor for the selected object along with all security descriptors inherited from parent containers. This allows administrators to determine the inheritance of security descriptors from parent objects through the object hierarchy.
-debug
Displays internal debugging information for the Security Descriptor Check Utility.
-domain: DomainName
Specifies the domain name of UserName in either DNS or NetBIOS format. Used to specify credentials other other than the current user's.
-user: UserName
Specifies the name of a user other than the current one, in the form of either the logon name or user principal name. If a user principal name is specified, then a domain name is not required.
-password: Password
Specifies the name of UserName. Used to specify credentials other other than the current user's.
/?
Displays Security Descriptor Check Utility syntax on the command line.

Security Descriptor Check Utility (Sdcheck.exe)

SDCheck examples


Active Directory Search Tool example

Input

search.vbs LDAP://DC=DomainDomain,DC=Domain,DC=Com /C:ObjectClass=User /S:SubTree /Q

Output

ADsPath1 = LDAP://CN=User1,CN=Users,DC=DomainDomain,DC=Domain,DC=Com

ADsPath2 = LDAP://CN=User2,CN=Users,DC=DomainDomain,DC=Domain,DC=Com

ADsPath3 = LDAP://CN=User3,CN=Users,DC=DomainDomain,DC=Domain,DC=Com

ADsPath4 = LDAP://CN=User4,CN=Users,DC=DomainDomain,DC=Domain,DC=Com

Active Directory Search Tool

Active Directory Search Tool syntax


Active Directory Search Tool syntax

search.vbs adspath [/C:criteria] [/P:properties] [/S:scope]
[/O: outputfile] [/U:username] [/W:password] [/Q]

Parameters

adspath
Specifies the AdsPath of the root of the search (mandatory).
criteria
Specifies the criteria of the search (Default = "ObjectCategory=*").
properties
Specifies the properties to be retrieved (default = AdsPath).
scope
Specifies the scope of the search (default = OneLevel).
username and password
Specifies the user name and password of the current user.
/Q
Suppresses all output messages.
outputfile
Specifies the output file name.

note-icon

Notes

  • Only the adspath parameter is mandatory. The default criteria is ObjectCategory =* (all classes), the default property to be retrieved is AdsPath, and the default scope is OneLevel. The default of username and password are those of the current user.
  • This script only works with an Lightweight Directory Access Protocol (LDAP) provider.

Active Directory Search Tool

Active Directory Search Tool example


Access-control policy migration scenario (SIDWalker)

Access-control policy migration scenario

The following example is a scenario requiring migration of access control policies:

All of the files for a project on a file server have an access control list (ACL) that grants the group ProjectTeam read/write access to the project files.

ProjectTeam is a security group that has a unique security identity in the Windows 2000 account directory. If the project changes and ProjectTeam merges into a larger project team, the administrator might want to change the access permissions on the project files. The read/write access-control rights granted to the original ProjectTeam can be replaced by access rights granted to a NewProjectTeam group. NewProjectTeam can be defined in a different domain and project file server. The computer on which the project file server runs can move from the current domain to a new domain for the larger project. In changing situations like this, SIDwalker can facilitate managing and updating security access policies on the servers involved.

Security Administration tools (SIDWalker)

Using the SIDWalker tools


Showaccs (Showaccs.exe)

Showaccs is a command-line program that enables users to examine the access control lists (ACLs) on the registry, file system, and file and print shares, and to look at membership in local groups. Showaccs command options support looking at specific areas of Windows 2000, such as specific file-system directories, or examining the entire system.

The output file of Showaccs is a comma-separated text file, called the access-profile file, showing all the object-specific access rights on the system. The access-profile file can be reviewed and analyzed using a text editor or imported into a spreadsheet or database management program.

Showaccs also creates a mapping file that lists the security principals (users and groups) that show up somewhere in ACLs. The mapping file can be input to the Security Migration Editor Microsoft Management Console (MMC) snap-in for account mapping.

Showaccs syntax

showaccs access_profile_file [/f [path]] [/r] [/s] [/p] [/g] [/m [map_file_path]] [/nobuiltins] [/?]

Parameters

access_profile_file
Specifies the path of the .csv file to be generated.
/f [path]
Shows access rights for all NTFS files or, optionally, for those in the directory tree of the specified path.
/r
Shows access rights for the registry.
/s
Shows access rights for file shares.
/p
Shows access rights for printer shares.
/g
Shows access rights for local groups.
/m [map_file_path]
Generates a map file, optionally in the directory specified by map_file_path.
/nobuiltins
Omits access rights for built-in groups.
/?
(or showaccs with no switch) Displays a usage screen.

Security Administration tools (SIDWalker)

Using the SIDWalker tools


Sidwalk (Sidwalk.exe)

Sidwalk is a command-line program that takes a mapping file as input and scans all the access control lists in the registry, file system, file and print shares, and local group membership. Sidwalk uses the mapping information in the mapping file to either delete or replace every occurrence of an old security identifier (SID) with the corresponding new SID. The same mapping file can be used for Sidwalk conversion on multiple computers.

Sidwalk syntax

sidwalk profile_file [profile_file …] [/t] [/f [path]] [/r] [/s] [/p] [/g] [/l file] [/?]

Parameters

profile_file
Specifies the path and file name of one or more .csv mapping files to be used for input.
/t
Conducts a test/dry run.
/f [path]
Scans all NTFS file system files or, optionally, only those on the directory tree of the specified path.
/r
Scans the registry.
/s
Scans file shares.
/p
Scans printer shares.
/g
Scans local groups.
/l file
Generates a Converter log file with file as the filename and path.
/?
(or sidwalk with no switch) Displays a usage screen.

Security Administration tools (SIDWalker)

Using the SIDWalker tools


Security Migration Editor (Sidwalk.msc)

The Security Migration Editor is a Microsoft Management Console (MMC) snap-in that provides a graphical user interface (GUI) for mapping old security identifiers (SIDs) listed in a mapping file created by Showaccs to new security identifiers. The "migration" referred to is from old SIDs to corresponding new SIDs, which are mapped by selecting from the list of user and group accounts in target domains or computers. The snap-in also gives options to ignore or delete these SIDs as they show up in access-control lists (ACLs). The Security Migration Editor updates the mapping file, which is then used as input to Sidwalk.

Installing Security Migration Editor

Before running the Security Migration Editor snap-in, it must be initialized from the command prompt with the command:

regsvr32 sidwkr.dll

This initializes the class libraries used by the snap-in.

Using Security Migration Editor

To use the snap-in, add it to the MMC. Security Migration Editor can also be started from the command prompt with the command:

sidwalk.msc

Further instructions on using snap-ins can be found in Help for the MMC.

Security Administration tools (SIDWalker)

Using the SIDWalker tools


Using the SIDwalker tools

Showaccs and Sidwalk can be run as scheduled batch jobs. They must be run locally on the computer where the access permissions are to be changed. Both programs use Windows NT security APIs (supported on Windows NT 4.0 and Windows 2000) to examine every access control list (ACL) on every object on the system. They are very CPU and I/O intensive programs: plan to run them when system use is otherwise very light and expect significant resource use.

Showaccs can examine the registry in approximately five minutes. Walking through the entire registry or file system, however, might require many hours, depending on the size of the file system and the scope of analysis. Examining every ACL on every file and converting security identifiers (SIDs) on a large file system of roughly 50 gigabytes (GB) can take two or more hours with 100 percent CPU utilization.

Security Migration Editor does not have to run on the same computer on which Showaccs or Sidwalk run. An administrator can schedule Showaccs to run remotely on one server in the network, transfer the resulting files to a local workstation for analysis and update using Security Migration Editor, then copy the mapping file back to one or more target systems and run Sidwalk on them.

Security Administration tools (SIDWalker)


Using the SNMP Query Tool

You can run the SNMP Query Tool from the Start menu (where it is called SNMP Query Utility) or from the command prompt or Run line (by typing snmputilg).

The tool starts with the loopback address 127.0.0.1, the object identifier .1.3.6.1.2.1, and the "public" community selected. These values can be changed to select another system by IP address, select another object identifier farther down the tree, or select another community as necessary.

If another system IP address is selected, that system must be running the SNMP service. The target system must also be configured to allow access from the network address from which the tool is run. By default, Windows 2000 allows access from all other IP addresses.

If another community is selected, the community must exist and READ privileges must be granted to that community. You can verify and add communities using the SNMP Service. The ability to configure community permissions exists only in systems running Windows 2000 or Windows NT version 4.0 Service Pack 4. The ability to restrict access by IP address exists in all versions of Windows 2000 and Windows NT.

The SNMP Function to Execute drop-down box is used to select the desired operation, followed by selecting the Execute Command button. Functions include:

  • GET the value of the current object identifier

  • GET the NEXT value after the current object identifier (this is the default)

  • GET the NEXT 20 values after the current object identifier

  • GET all values from object identifier down (WALK the tree)

  • WALK the tree from WINS values down

  • WALK the tree from DHCP values down

  • WALK the tree from LANMAN values down

  • WALK the tree from MIB-II down (Internet MIB)

The results are listed on the screen.

The results can be cleared, saved, or updated from the Context menu, which is selected by right-clicking the mouse. From the Context menu you may:

  • Copy one or more records to the clipboard.

  • Clear contents of the list view now.

  • Clear list view after executing each command.

  • Requery the currently selected record.

  • Dump all records to a comma-delimited text file

  • Edit (SET) the value of this object identifier.

Caution

Even though many object identifier values are read-only by default, you should use the SNMP SET command with caution. Incorrect use of this tool might cause network name resolution or network connectivity problems that can adversely impact performance.

SNMP Query Tool (Snmputilg.exe)


Examples of Task List Viewer output

Example 1: Output without options

Example 2: Output with the pid option

Example 3: Output with the pattern option

Example 4: Output with the -m pattern option

Example 5: Output with the -p processname option

Example 6: Output with the -s option

Example 7: Output with the -t option

Example 1

Output from running tlist without options. For each process, the process ID, process name, and window title (if any) are shown.

E:\Program Files\Support Tools>tlist

   0 System Process
   8 System
 156 smss.exe
 184 csrss.exe
 208 winlogon.exe      NetDDE Agent
 240 services.exe
 252 lsass.exe         OleMainThreadWndName
 392 svchost.exe
 448 SPOOLSV.EXE
 484 msdtc.exe
 588 tcpsvcs.exe
 608 svchost.exe       SENS
 628 llssrv.exe
 716 mstask.exe        SYSTEM AGENT COM WINDOW
 760 snmp.exe
 836 termsrv.exe
 944 tlntsvr.exe
1068 wins.exe
1104 dfssvc.exe
1128 dns.exe
1148 inetinfo.exe      OleMainThreadWndName
1468 csrss.exe
1504 winlogon.exe
1524 csrss.exe
1548 winlogon.exe
1460 explorer.exe      Program Manager
1632 svchost.exe       ModemDeviceChange
 696 cmd.exe           C:\WINNT\System32\cmd.exe - tlist
 892 notepad.exe       Untitled - Notepad
 652 notepad.exe       foo.txt - Notepad
 440 tlist.exe

Example 2

Output from running tlist with the pid option using 156 as the PID.

E:\Program Files\Support Tools>tlist 156

 156 smss.exe
   CWD:     C:\WINNT\
   CmdLine: \SystemRoot\System32\smss.exe
   VirtualSize:     4476 KB   PeakVirtualSize:     5896 KB
   WorkingSetSize:   388 KB   PeakWorkingSetSize:  1908 KB
   NumberOfThreads: 6
    152 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
    160 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
    164 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
    148 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
    172 Win32StartAddr:0x000005b3 LastErr:0x00000000 State:Waiting
    176 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
     5.0.1997.1 shp  0x48580000  smss.exe
     5.0.2003.1 shp  0x77f80000  ntdll.dll

Example 3

Output from running tlist with the pattern option using csr* as the pattern.

E:\Program Files\Support Tools>tlist csr*

 184 csrss.exe
   CWD:     C:\WINNT\system32\
   CmdLine: C:\WINNT\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
   VirtualSize:    16668 KB   PeakVirtualSize:    20700 KB
   WorkingSetSize:  1884 KB   PeakWorkingSetSize:  1884 KB
   NumberOfThreads: 12
    188 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
    192 Win32StartAddr:0x00000000 LastErr:0x000005b4 State:Waiting
    196 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
    200 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
    204 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
    212 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
    220 Win32StartAddr:0x00000000 LastErr:0xf000b12e State:Waiting
    224 Win32StartAddr:0x00000000 LastErr:0xf000b12e State:Waiting
    256 Win32StartAddr:0x00000000 LastErr:0xf000b12e State:Waiting
    500 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
   1452 Win32StartAddr:0x00000000 LastErr:0x00000006 State:Waiting
   1456 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
     5.0.1995.1 shp  0x5ffe0000  csrss.exe
     5.0.2003.1 shp  0x77f80000  ntdll.dll
     5.0.1995.1 shp  0x5ff80000  CSRSRV.dll
     5.0.1980.1 shp  0x5ff90000  basesrv.dll
     5.0.2003.1 shp  0x5ffa0000  winsrv.dll
     5.0.1995.1 shp  0x77e60000  USER32.dll
     5.0.2003.1 shp  0x77ed0000  KERNEL32.DLL
     5.0.1999.1 shp  0x77e20000  GDI32.DLL
1468 csrss.exe
   CWD:     C:\WINNT\system32\
   CmdLine: C:\WINNT\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
   VirtualSize:     7704 KB   PeakVirtualSize:    11800 KB
   WorkingSetSize:   856 KB   PeakWorkingSetSize:   868 KB
   NumberOfThreads: 6
   1476 Win32StartAddr:0x00000000 LastErr:0x000000b7 State:Waiting
   1480 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
   1492 Win32StartAddr:0x000010e6 LastErr:0x00000000 State:Waiting
   1496 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
   1500 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
   1512 Win32StartAddr:0x00001081 LastErr:0x00000000 State:Waiting
     5.0.1995.1 shp  0x5ffe0000  csrss.exe
     5.0.2003.1 shp  0x77f80000  ntdll.dll
     5.0.1995.1 shp  0x5ff80000  CSRSRV.dll
     5.0.1980.1 shp  0x5ff90000  basesrv.dll
     5.0.2003.1 shp  0x5ffa0000  winsrv.dll
     5.0.1995.1 shp  0x77e60000  USER32.dll
     5.0.2003.1 shp  0x77ed0000  KERNEL32.DLL
     5.0.1999.1 shp  0x77e20000  GDI32.DLL
1524 csrss.exe
   CWD:     C:\WINNT\system32\
   CmdLine: C:\WINNT\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
   VirtualSize:     7704 KB   PeakVirtualSize:    11800 KB
   WorkingSetSize:   856 KB   PeakWorkingSetSize:   868 KB
   NumberOfThreads: 6
   1528 Win32StartAddr:0x00000000 LastErr:0x000000b7 State:Waiting
   1532 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
   1536 Win32StartAddr:0x000010e7 LastErr:0x00000000 State:Waiting
   1540 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
   1544 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting
   1552 Win32StartAddr:0x0000109e LastErr:0x00000000 State:Waiting
     5.0.1995.1 shp  0x5ffe0000  csrss.exe
     5.0.2003.1 shp  0x77f80000  ntdll.dll
     5.0.1995.1 shp  0x5ff80000  CSRSRV.dll
     5.0.1980.1 shp  0x5ff90000  basesrv.dll
     5.0.2003.1 shp  0x5ffa0000  winsrv.dll
     5.0.1995.1 shp  0x77e60000  USER32.dll
     5.0.2003.1 shp  0x77ed0000  KERNEL32.DLL
     5.0.1999.1 shp  0x77e20000  GDI32.DLL

Example 4

Output from running tlist with the -m pattern option using csr* as the pattern.

E:\Program Files\Support Tools>tlist -m csr*

CSRSRV.dll -  184 csrss.exe
CSRSRV.dll - 1468 csrss.exe
CSRSRV.dll - 1524 csrss.exe

Example 5

Output from running tlist with the -p processname option using the processname csrss.exe, which returns the PID 184.

E:\Program Files\Support Tools>tlist -p csrss.exe

184

Example 6

Output from running tlist with the -s option.

E:\Program Files\Support Tools>tlist -s

   0 System Process
   8 System
 156 smss.exe
 184 csrss.exe       Title:
 208 winlogon.exe    Title: NetDDE Agent
 240 services.exe    Svcs:  Alerter,Browser,Dhcp,dmserver,Dnscache,Eventlog,lanm
anserver,LanmanWorkstation,LmHosts,Messenger,NWCWorkstation,PlugPlay,ProtectedSt
orage,seclogon,TrkWks,W32Time,Wmi
 252 lsass.exe       Svcs:  Netlogon,NtLmSsp,PolicyAgent,SamSs
 392 svchost.exe     Svcs:  RpcSs
 448 SPOOLSV.EXE     Svcs:  Spooler
 484 msdtc.exe       Svcs:  MSDTC
 588 tcpsvcs.exe     Svcs:  DHCPServer,SimpTcp
 608 svchost.exe     Svcs:  EventSystem,IAS,Netman,NtmsSvc,RasMan,SENS
 628 llssrv.exe      Svcs:  LicenseService
 716 mstask.exe      Svcs:  Schedule
 760 snmp.exe        Svcs:  SNMP
 836 termsrv.exe     Svcs:  TermService
 944 tlntsvr.exe     Svcs:  TlntSvr
1068 wins.exe        Svcs:  WINS
1104 dfssvc.exe      Svcs:  Dfs
1128 dns.exe         Svcs:  DNS
1148 inetinfo.exe    Svcs:  IISADMIN,MSFTPSVC,SMTPSVC,W3SVC
1468 csrss.exe
1504 winlogon.exe
1524 csrss.exe
1548 winlogon.exe
1460 explorer.exe    Title: Program Manager
1632 svchost.exe     Svcs:  TapiSrv
 696 cmd.exe         Title: C:\WINNT\System32\cmd.exe - tlist -s
 892 notepad.exe     Title: tlist_ex.txt - Notepad
 652 notepad.exe     Title: foo.txt - Notepad
 528 tlist.exe

Example 7

Output from running tlist with the -t option.

E:\Program Files\Support Tools>tlist -t

System Process (0)
System (8)
  smss.exe (156)
    csrss.exe (184)
    winlogon.exe (208) NetDDE Agent
      services.exe (240)
        svchost.exe (392)
        SPOOLSV.EXE (448)
        msdtc.exe (484)
        tcpsvcs.exe (588)
        svchost.exe (608) SENS
        llssrv.exe (628)
        mstask.exe (716) SYSTEM AGENT COM WINDOW
        snmp.exe (760)
        termsrv.exe (836)
        tlntsvr.exe (944)
        wins.exe (1068)
        dfssvc.exe (1104)
        dns.exe (1128)
        inetinfo.exe (1148) OleMainThreadWndName
        svchost.exe (1632) ModemDeviceChange
      lsass.exe (252) OleMainThreadWndName
    csrss.exe (1468)
    winlogon.exe (1504)
    csrss.exe (1524)
    winlogon.exe (1548)
explorer.exe (1460) Program Manager
  cmd.exe (696) C:\WINNT\System32\cmd.exe - tlist -t
    tlist.exe (1628)
  notepad.exe (892) Untitled - Notepad

Task List Viewer (TList.exe)

Task List Viewer syntax


Task List Viewer syntax

tlist [pid] [pattern] [-m pattern] [-p processname] [-s] [-t]

Parameters

tlist
Without arguments, lists running processes with their process ID, process name, and window title (if any).
pid
Lists detailed module information for the task specified by pid (process ID).
pattern
Lists detailed module information for the processes whose task names and the window titles match pattern; pattern (for example, A*) can be a complete task name or a regular expression.
-m pattern
Lists all tasks that have DLL modules loaded in them matching the given pattern name. The pattern (for example, A*) can be a complete task name or a regular expression. TList matches this pattern against the task names and the window titles.
-p processname
Returns the PID of the specified process or -1 if this process doesn't exist. If multiple instances of the process are running, only the instance with the first PID value is returned.
-s
Shows services active in each process.
-t
Prints task tree. This switch displays output based on which processes are children/parents of which other processes.

Once you have used TList to find the processes running on your computer, you can end one or more of those processes by using the Task Killing Utility.

Task List Viewer (TList.exe)

Examples of Task List Viewer output


Checksums in WinDiff

For each file compared, a checksum is calculated. This is a 4-byte number derived from some combination of the values of all the bytes in the file in such a way that it is extremely unlikely that two files that are different will have the same checksum, while ensuring that files that are identical always have the same sum.

The odds of two different files giving the same sum are about 1 in 4 billion, which is to say that you could compare 1 file a second for the next 100 years and only have about a 50/50 chance of seeing it happen.

WinDiff File and Directory Comparison (Windiff.exe)


Comparing files with WinDiff

Comparing files graphically

To compare files and display the results graphically, use Windiff.exe.

The results are initially displayed in outline mode. WinDiff lists the files that were compared and indicates whether they are identical or whether one file is newer than the other.

To view the differences in expanded mode, select the file from the display and click the Expand button. The parts that are common to both files are displayed on a white background. The parts that belong to the file listed on the left are displayed on a red background. The parts that belong to the file listed on the right are displayed on a yellow background. To return to outline mode, click the Outline button.

Comparing files via the command prompt

Run command prompt.

The following line shows WinDiff command prompt syntax:

windiff [path1] [path2]

where path1 and path2 indicate the files to be compared. WinDiff uses the following rules to determine what is to be compared:

  • If you invoke WinDiff without specifying path1 or path2, you can click Compare Files or Compare Directories from the File menu to specify the files to compare.
  • If you invoke WinDiff with a file name for path1, but nothing for path2, WinDiff compares the file with a file of the same name in the current directory.
  • If you invoke WinDiff with a directory name for path1, but nothing for path2, WinDiff compares the files in the specified directory with the files in the current directory.
  • If you invoke WinDiff specifying files for path1 and path2, WinDiff compares the two files.
  • If you invoke WinDiff specifying directories for path1 and path2, WinDiff compares the files in those directories.

WinDiff File and Directory Comparison (Windiff.exe)


WinDiff Edit menu

Edit menu

Edit Left File

Edit Right File

Edit Composite File

These commands allow a text editor to be invoked from WinDiff. You can edit either the left file, the right file, or the merged file.

Set Editor

Enables you to select which editor is invoked.

%p

Represents the path to edit (that is, the file name, which may be a name created by WinDiff).

%l

Represents the line number.

The default is

notepad %p

If you use the Slick editor, you should set this to

s %p -#%l

WinDiff File and Directory Comparison (Windiff.exe)


WinDiff Expanded mode display

Expanded mode display

You can display the file names or the expanded contents of the selected files. When you choose the Expand button, the contents of the files are expanded and the button label then changes to Outline. When you choose the Outline button, only the file names are displayed. Files with the same name but different contents are displayed in red text. Identical files are displayed in black text.

To display the expanded contents of the files

  1. Select the files you want to compare.
  2. On the Expand menu, click Both Files.
  3. On the View menu, click Expand.

    - Or -

    Click the Expand button.

The left of the screen shows a pictorial view of the comparison. Blocks of color represent sections of the files. The left column of blocks represents the file on the left, the right column represents the file on the right.

Where blocks of lines match in the two files, these are shown as white blocks joined by a line connecting the block in each file. Lines that do not match are represented by a red block in the left file or a yellow block in the right file (with no connecting line).

The picture can be turned off by using the View menu.

Lines of text are displayed using the same colors. That is, lines that occur only in the left file are shown with a red background; lines that occur only in the right file are shown with a yellow background. Lines that are moved are shown with blue text against the appropriate background.

The Expand menu allows you to choose whether to look at the left file, the right file, or (the default) a merge of the two files. This merged file contains all the lines that are in either file in the order in which they occur in that file.

Lines that are common to the two files are normally shown only once. (Moved lines are shown twice: once with a red background showing where the line was in the left file, and once with a yellow background showing where the line is in the right file.)

Lines are numbered. The numbering can be turned off to save screen space or can be shown based on the left file or shown based on the right file by using the Expand menu.

WinDiff File and Directory Comparison (Windiff.exe)


WinDiff Expand menu

Expand menu

Left File Only

Shows only lines from left file (but colored to highlight changed lines).

Right File Only

Shows only lines from right file (but colored to highlight changed lines).

Both Files (default)

Shows a merge of both files. All the lines in the left file are shown in the order in which they occur in that file; the same is true for the right file. Lines that are only in the left file are shown in red. Lines that are only in the right file are shown in yellow.

Left Line Numbers (default)

Shows line numbers, based on the left file.

Right Line Numbers

Shows line numbers, based on the right file.

No Line Numbers

Turns off line numbers.

WinDiff File and Directory Comparison (Windiff.exe)


WinDiff File menu

File menu

Compare Files

Displays a dialog box that allows you to select files to compare. It displays the standard Open File dialog box twice, once for each file.

Compare Directories

Displays a dialog box that allows you to select two folders to compare. UNC names are allowed. The names can be absolute paths or paths relative to the current folder. The Include Subdirectories check box determines whether the comparison will include the trees, starting from the given paths, or only the folders named.

Abort

Dimmed unless an operation is in progress, then allows that operation to be terminated before completion.

Save File List

Allows you to save the outline mode data in a file. During the file comparison, a checksum is calculated for each file (which is useful if the network is not working). These can be recorded together with the filenames, if required.

Copy Files

Displays a dialog box for writing the listed files to a disk. WinDiff can copy any combination of the four categories (identical, and so on). If greater selectivity is required, then save the file list (without checksums), and edit the file into a .bat file to do the copying.

For a remote compare, this will compress the files before sending them across the network.

Print

Prints the file list or the expanded comparison.

WinDiff File and Directory Comparison (Windiff.exe)


Running WinDiff with menu choices

To compare two files with WinDiff

  1. On the File menu, click Compare Files.

  2. In the Select First File dialog box, specify a file name for the first file in the comparison. Then select the other file to compare in the Select Second File dialog box.

To compare folders with WinDiff

  1. On the File menu, click Compare Directories.

  2. In the Select Directories dialog box, specify two folder names and, if you want, select the Include Subdirectories check box.

WinDiff File and Directory Comparison (Windiff.exe)


WinDiff Options menu

Options menu

Ignore Blanks

Blanks are ignored in expanded mode, so that lines that differ only in white space are shown as identical.

The next four options control which files (if any) are displayed in outline mode:

Show Identical Files

Includes files that are identical in each path.

Show Left-only Files

Includes files that occur only in the left path.

Show Right-only Files

Includes files that occur only in the right path.

Show Different Files

Includes files that occur in both paths, but that are not the same.

WinDiff File and Directory Comparison (Windiff.exe)


WinDiff outline mode display

Outline mode display

In outline mode, the display shows one file per line with the files listed in alphabetical order, except files that are contained in sub-folders, which appear after all files in higher folders. The paths shown are all relative to the root path given when the comparison is invoked.

For example:

windiff c:\temp d:\progs\new

returns the following type of results:

.\myfile.txt         identical
.\hisfile.txt        files differ
.\newest\myfile.txt  only in C:\TEMP
.\newest\x.x         only in D:\PROGS\NEW
.\oldest\file        identical

The full paths for this example are:

.\myfile.txt         c:\temp\myfile.txt and d:\progs\new\myfile.txt
.\hisfile.txt        c:\temp\hisfile.txt and d:\progs\new\hisfile.txt
.\newest\myfile.txt  c:\temp\newest\myfile.txt
.\newest\x.x         d:\progs\new\newest\x.x
.\oldest\file        c:\temp\oldest\file and d:\progs\new\oldest\file

Status Indicators

The status of a file can be one of the following:

  • Identical
    The files are identical, including white space.
  • Files Differ or Different Sizes
    The two files differ, but possibly only in white space.
  • Only In path
    The file exists only in one folder or the other, specified by path.
  • Files Differ? (Left Unreadable)
    The file in the left path existed, but could not be read. There are many possible reasons. Some of the common ones are Network Error and Access Denied.
  • Files Differ? (Right Unreadable)
    The file in the right path existed, but could not be read. The file in the left path was successfully read.
  • Unreadable files are treated differently (highlighted in red, for example.)

Viewing Files Based on Status

Using the Options menu, you can display or suppress files based on their status category. The categories are:
  • Identical
  • Differ (including unreadable)
  • Left only
  • Right only

note-icon

Note

  • A common source of confusion is a blank display caused when only files in categories turned off from the Options menu are found. For example, all the files are identical but files in the Identical category are not being displayed.

WinDiff File and Directory Comparison (Windiff.exe)


WinDiff syntax

windiff path1 [path2] [-D] [-O] [-N name] [-S [options] savefile] [-F [options] comp_savefile]

Parameters

path1
Compares files in path1 with files in current directory.
path1 path2
Compares files in path1 with files in path2.
-D
Compares one directory only.
-O
Outline view (no automatic expansion).
-N name
Send notification at end of comparison, with NET SEND name.
-S options
Save a list of all files, using the following options:
  • -s: Compares files that are the same in both paths.
  • -l: Compares only files in the first (left) path.
  • -r: Compares only files in the second (right) path.
  • -d: Compares two different files in both paths.

savefile
Name of text file to which comparison results are written.
-F options
Save composite file, using the following options:
  • -i: Saves files that are the same in both paths.
  • -l: Saves only files in the first (left) path.
  • -r: Saves only files in the second (right) path.
  • -f: Saves only files moved-left.
  • -g: Saves only files moved-right.
  • -s: Saves only files similar-left.
  • -a: Saves only files that are similar-right.

comp_savefile
Name of composite file to be saved.

Colors

red background = left file

yellow background = right file

blue text = moved line

black text = everything else

WinDiff File and Directory Comparison (Windiff.exe)


WinDiff View Menu

View Menu

Outline

Sets outline mode, showing lists of files.

Expand

Sets expanded mode, showing a comparison of two selected files.

Picture

Shows picture (turning the picture off saves space on the screen).

Previous Change

Skips to previous point of difference in the file.

Next Change

Skips to next point of difference in the file.

WinDiff File and Directory Comparison (Windiff.exe)


WinRep syntax

winrep.exe [target.htm] [report.cab] [/UNISQL] [/categories: category string] [/files: (file1) (file2) (file3)]

Parameters

target.htm
Specifies the Web page that is displayed when the user is creating the report. If no target page is given, WinRep displays the Save As dialog when the user clicks the Next button, enabling the user to save the report locally or to a server.
report.cab
Specifies the cabinet file to which the report will be posted. If no file is specified, WinRep creates a new file.
/UNISQL
Specifies that WinRep will issue a Unicode SQL query to the Help desk SQL Server. If not used, WinRep issues a standard non-Unicode SQL query.
/categories: category string
Specifies which categories are included in the report. Use "+all" to add all categories, "+category" to add the category and its children, and "-category" to remove a category.

For example, /categories:+all-Components-SystemSummary generates a report with all categories except Components and System Summary. For a list of categories, see MSInfo.

/Files: (file1) (file2) (file3)
Specifies the files to be uploaded with the report.

Windows Report Tool (Winrep.exe)


Winsock Remote Console Client Syntax

Run command prompt.

wsremote /c ServerName UniqueId [/l #_Lines_to_get][/f Color] [/b Color] [/i] [/u Username] [/P Password]

Parameters

/c
Starts this Winsock Remote Console (WSRemote) session as a server.
ServerName
Specifies the IP address, DNS name, or NetBIOS name of the server you are connecting to.
UniqueId
Specifies the port number that was specified when starting the WSRemote server.
/l #_Lines_to_Get
Retrieves only the specified number of lines from the WSRemote.
/f color
Specifies the foreground console color (for example, yellow or black).
/b color
Specifies the background console color (for example, blue or white).
/n
Connects to a WSRemote or Remote.exe server using named pipes instead of IP sockets.
/u Username
Specifies the user name needed to connect to the WSRemote server from a WSRemote client (over IP sockets).
/p Password
Specifies the password needed to connect to the WSRemote server from a WSRemote client (over IP sockets).

Winsock Remote Console (Wsremote.exe)


Connecting the client to the Winsock Remote Console Server using named pipes

Run command prompt.

To connect a Winsock Remote Console (WSRemote) client to a WSRemote server over named pipes using pipe 8080

  1. Open a command prompt.
  2. Change directory to the directory that contains the file Wsremote.exe.
  3. Enter the following command: (Note the /n for named pipes)

    wsremote /s cmd 8080 /n

Winsock Remote Console (Wsremote.exe)


Connecting the client to the Winsock Remote Console Server using TCP/IP sockets

Run command prompt.

To connect a Winsock Remote Console (WSRemote) client to a WSRemote server over TCP/IP using port 8080 with no user name and password

  1. Open a command prompt.
  2. Change directory to the directory that contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /c dns_name_or_ip_address_of_server 8080

To connect a WSRemote client to a WSRemote server over TCP/IP using port 8080 with user name and password security

  1. Open a command prompt.
  2. Change directory to the directory that contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /c dns_name_or_ip_address 8080 /u username /p password

Winsock Remote Console (Wsremote.exe)


Disconnecting the Winsock Remote Console Client from the Winsock Remote Console Server (leaving the server running)

Run command prompt.

To disconnect from the Winsock Remote Console server while leaving the server running

One Step Type @q in the Winsock Remote Console client console.

Winsock Remote Console (Wsremote.exe)


Winsock Remote Console Server syntax

Run command prompt.

wsremote /s Program UniqueId _or_PortNumber [/f Color] [/b Color] [/i] [/u Username] [/p Password]

Parameters

/s
Starts this Winsock Remote Console (WSRemote) session as a server.
Program
Specifies the console based program you want to run.
UniqueId_or_PortNumber
Specifies the TCP port number where you will start the remote server.
/f Color
Specifies the foreground console color (for example, yellow or black).
/b Color
Specifies the background console color (for example, blue or white).
/i
Turns on IP Blocking. No clients can connect via IP sockets until the console is unlocked.
/u Username
Specifies the user name needed to connect to the WSRemote server from a WSRemote client (over IP sockets).
/p Password
Specifies the password needed to connect to the WSRemote server from a WSRemote client (over IP sockets).

Winsock Remote Console (Wsremote.exe)


Starting the Winsock Remote Console Server

Run command prompt.

To start a Winsock Remote Console (WSRemote) server that runs a command prompt and listens on port 8080 with no user name or password

  1. Open a command prompt.
  2. Change directory to the directory which contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /s cmd 8080

To start a WSRemote server that runs a command prompt and listens on port 8080 with user name and password security

  1. Open a command prompt.
  2. Change directory to the directory which contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /s cmd 8080 /u username /p password

To start a WSRemote server that runs a command prompt and listens on port 8080 with user name and password security, and will not accept any initial incoming connections

  1. Open a command prompt.
  2. Change directory to the directory which contains the file Wsremote.exe.
  3. Enter the following command:
    wsremote /s cmd 8080 /u username /p password /i

    Now no WSRemote clients can connect without someone on the server unlocking the WSRemote session from the server console. See Unlocking the server console.

Winsock Remote Console (Wsremote.exe)


Stopping the Winsock Remote Console Server

Run command prompt.

To stop the Winsock Remote Console server from the server's console

One Step Type @k in the Winsock Remote Console server console.

Winsock Remote Console (Wsremote.exe)


System requirements for Winsock Remote Console

To use Winsock Remote Console, you must have the following components installed:

  • Windows 2000 Server or Windows 2000 Professional
  • The TCP/IP protocol

Winsock Remote Console (Wsremote.exe)


Unlocking the server console

Run command prompt.

To allow or disallow Winsock Remote Console to accept incoming IP sockets connection to the Winsock Remote Console server

One Step Type @l in the Winsock Remote Console server console.

If IP sessions are previously blocked, Winsock Remote Console displays the following message:

   **LOCK: IP Sessions Now Allowed

If IP sessions are previously un-blocked, Winsock Remote Console displays the following:

   **LOCK: No IP Sessions Allowed

Winsock Remote Console (Wsremote.exe)