3/29/2003 -- In the previous article, we just stared examining the Installing, Configuring, and Administering Microsoft Windows 2000 Professional exam (70-210) from Microsoft.

As mentioned then, exam can be used as credit on both the MCSA and MCSE tracks, and consists of seven major objective categories:

• Installing Windows 2000 Professional
• Implementing and Conducting Administration of Resources
• Implementing, Managing, and Troubleshooting Hardware Devices and Drivers
• Monitoring and Optimizing System Performance and Reliability
• Configuring and Troubleshooting the Desktop Environment
• Implementing, Managing, and Troubleshooting Network Protocols and Services
• Configuring, Managing, and Troubleshooting Security

The complete list of objectives for this exam can be found at http://www.microsoft.com/traincert/exams/70-210.asp.

In this article, we'll finish up the second objective and delve into three and four, with one more article later on the last three. The focus of all these articles is examining the material necessary to know to pass this exam.

Objective #2: Implementing and Conducting Administration of Resources (Continued)

Configuring the File Systems
After a partition/volume has been formatted with a file system, it can be managed with the Computer Management Console -- an Microsoft Management Console (MMC) snap-in.

From the Disk Management portion of the Computer Management Console, you can format and delete partitions, as well as change drive letter assignments and bring up the properties for each volume. If the volume is formatted with NTFS, properties available only within that file system can be accessed on those volumes. The properties of a FAT volume consist of four tabs, whereas the properties of an NTFS volume consist of six tabs (adding Security and Quota).

You can start defragmentation (which is now available for all file systems) from the Computer Management Console. In addition, you can use the disk-scanning feature to determine the health of a hard disk.

FAT/FAT32 File Attributes
Which attributes you can assign to a file varies greatly depending on the file system you choose. In both the FAT and FAT32 file systems, your choices are limited to the following:

• Read-Only
• Hidden (from command-line listings and Explorer, if Explorer is configured to not show all files)
• Archive (included in the next differential or incremental backup)
• System

There is an interesting change between Windows NT 4.0 and Windows 2000 in the way the System attribute is displayed. In Windows NT 4.0, the System attribute was represented by a check box on the General tab of the Properties dialog box for a file. In Windows 2000, that check box does not appear, but the fact that the file is flagged as such is still displayed in the Explorer interface.

NOTE: Explorer recognizes that the System attribute is enabled for this file. In Windows 2000, there is no System check box.

NTFS File Attributes
In NTFS, you can assign the same file attributes you could in FAT/FAT32, but additional choices have been added. You can now perform the following tasks:

• Index the file for faster finding
• Compress the file
• Encrypt the file

Note that the distinction between the file systems does not end with the attributes available from the General tab. Although the General tab is the only tab available under FAT/FAT32, NTFS offers two additional tabs: Summary and Security.

The Summary tab merely allows you to enter or view information about the file's description and origin. Such information can include the author, subject, category, and comments.

The Security tab allows you to assign permissions for the file to individual users or groups or combinations thereof. NTFS offers five distinct rights, each of which you can specifically allow or deny:

• Full Control (everything the others provide, plus the ability to change permissions and take ownership)
• Modify (encompasses the Read and Execute permission and the Write permission, and offers the ability to delete)
• Read and Execute
• Read
• Write

Of crucial importance is the check box in the lower portion of the tab. It is chosen by default, which means permissions applied at one level will be inherited (propagated) by lower levels. By default, permissions accumulate. The exact opposite of normal operations is accomplished by using the Deny permission, which overrides all other accumulated permissions for that right.

NOTE: The No Access permission available in Windows NT does not exist in Windows 2000. Replacing it in functionality is the Deny permission, which can be applied to any specific right but not to all rights (as could No Access).

The Advanced tab contains a slew of additional rights that can be allowed or denied individually. To access them, go to the Advanced tab and double-click on a user or group. You can assign the following rights:

• Traverse Folder / Execute File
• List Folder / Read Data
• Read Attributes
• Read Extended Attributes
• Create Files / Write Data
• Create Folders / Append Data
• Write Attributes
• Write Extended Attributes
• Delete Subfolders and Files
• Delete
• Read Permissions
• Change Permissions
• Take Ownership

These attributes/permissions will be discussed in later articles as the topics apply. For now, it is important that you see two things: 1) None of these is available with any file system other than NTFS. 2) Not only do these attributes/permissions exist, but the ability to see and change them is a permission in and of itself-as noted by the bolded selections in the preceding list.

Finally, NTFS also allows for auditing and ownership-two other features that were completely overlooked in FAT and FAT32.

EXAM TIP: Picking a File System on the Certification Exam
There are three main issues for deciding which file system to choose on the exam. The first issue is dual-booting. Rule of thumb: Select a file system other than NTFS only when dual-booting is needed.

When the system will be dual-booting to DOS, Windows 95a, or OS/2, you must use the FAT file system. FAT is the only file system supported by both Windows 2000 and almost all other operating systems. If the question involves dual-booting with Windows 98 or Windows 95b and using large hard drive support (larger than 2GB), the answer is FAT32. Anytime the partition size is larger than 32GB, NTFS should be chosen over FAT32, if possible, due to size constraints.

NOTE: When Windows 95 is installed after Windows 2000, the 2000 installation must be repaired before 2000 will be accessible again. During the installation of Windows 95, it overwrites the boot sector on the hard drive. Using the Windows 2000 boot disks, however, you can repair the 2000 installation by investigating and fixing the boot sector.

The second issue that the test addresses is security. Security is supported on NTFS only. If the test requires that the solution support file-level security, NTFS is required. If the question deals with access via a network, however, remember that some share-level security can be set up. Share-level security works with FAT, FAT32, and NTFS.

Finally, the test requires you to know that FAT/FAT32 file systems can be automatically converted to NTFS with the CONVERT command, but NTFS file systems can't be converted to FAT. The partition would need to be backed up, deleted, and reformatted as FAT, and then the data would have to be restored.

Objective #3: Implementing, Managing, and Troubleshooting Hardware Devices and Drivers

3.1: Implement, Manage, and Troubleshoot Disk Devices

The Computer Management utility, within the Administrative Tools folder of the Control Panel, is divided into three sections: System Tools, Storage, and Services and Applications

The Storage component, which provides the basis for working with disk devices, is subdivided into four sections:

1. Disk Management
2. Disk Defragmenter
3. Logical Drives
4. Removable Storage

The following sections examine each of these components.

Disk Management
The heart of most disk operations resides in the Disk Management tool. You must be a member of the Administrators group to access this tool. Replacing the Disk Administrator from previous versions of Windows NT, Disk Management offers a plethora of information and options. Disk Management surpasses Disk Administrator in that it now allows for remote disk management, supports dynamic volumes (except on portable computers), offers wizards for many choices, and allows you to make a number of changes on-the-fly (without requiring a reboot to be active).

Start Disk Management can be started by itself by going to Start, Run, and then entering Diskmgmt.msc.

NOTE: Microsoft has changed its standard for storage significantly with the release of Windows 2000 by turning to dynamic storage. You must first convert the entire disk to dynamic storage, and then you can create and alter volumes without ever needing to shut down and restart the system for the changes to take effect.

Accessing Properties
The Disk Management tool contains two frames. The top frame shows each volume, its file system, status, and capacity. Notice that the status also indicates whether the volume is a System or Boot volume. Contrary to naming logic, the System volume holds the files needed to boot the system (the boot files), and the Boot volume holds the files needed by Windows 2000 Professional (the system files).

The bottom frame shows each disk, including the CD-ROM and the volumes on it. You can right-click any volume and choose Properties from the pop-up menu. This will show the Properties dialog box, which offers six tabs of options for the disk. The six tabs are outlined here:

• The General tab lists the disk label, file system, and capacity (as well as used and free divisions). Clicking the Disk Cleanup command button deletes temporary files and other entities not essential to operation. You can also check boxes at the bottom of the tab to enable compression and indexing (only if the drive is NTFS). Compression can be done at any level from the drive down to a single file. NOTE: Disk Cleanup always prompts the user before removing anything, but defaults to removing downloaded program files, temporary Internet files, and temporary offline files. Other choices you can select include Recycle Bin, temporary (non-Internet) files, older compressed files, and catalog files used by the indexer.
• The Tools tab holds the ScanDisk utility (called Error-Checking here), Backup, and the Disk Defragmenter tool.Use Disk Cleanup and Disk Defragmenter to increase performance on a system that is running slow. NOTE: Windows 2000 includes a disk defragmenter. This option appeared in previous versions of the operating system but could never be selected because no such utility was included with the core operating system.
• The Hardware tab shows all disk devices: drives, floppies, DVD, CD-ROM, and so on. Two command buttons appear at the bottom: Troubleshoot and Properties. They allow you to interact with the devices. The Troubleshoot button brings up the Drives Troubleshooter utility within Windows 2000 Help and walks you through the most common problems. All the Troubleshooters (Drives Troubleshooter, Print Troubleshooter, Network Troubleshooter, etc.) are invaluable aids in systematically walking through common problems and solving them.
• The Sharing tab is used to share the drive. You can limit the number of users allowed concurrently, share the drive multiple times (New Share), set the permissions per share name (Permissions), and configure whether the drive is available for offline access (Caching). Each drive is automatically shared as an administrative share, and the dollar sign ($) is the last character in its name, making it "hidden."
• The Security tab, which allows you to configure permissions, appears only if the drive is NTFS. By default, Everyone has Full Control (including Modify, Read & Execute, List Folder Contents, Read, and Write). The Advanced button lets you work not only with the permissions, but with auditing and ownership, as well.
• The Quota tab, which appears only if the drive is NTFS, allows you to configure the storage limits for users. By default, quota management is disabled; you must enable it before you can set any other options. The Deny Disk Space to Users Exceeding Quota Limit check box prevents users from saving their files; when the option is not checked, users merely get a warning. With the last two options, you can specify what happens when a user exceeds the limit: The program can log events or give warnings. (You can configure these two values independently from one another.) If a user cannot save or update files, increase the disk quota for that user or free up space. User quotas can also cause two users to keep different answers to the amount of free space available on a drive. NOTE: If quotas are enabled after user accounts have already been in place, and users are currently exceeding the amount of the quota, warning messages will be generated the next time the users attempt to save and/or they will be prevented from using any additional space.

Interacting with the Drive
In addition to using Disk Management to look at a drive's properties, you can also perform the following functions by right-clicking on the drive and selecting the appropriate option from the pop-up menu:

• Open and explore the contents of the drive. If you choose Open, the display resembles what it would if you went through the My Computer icon on the desktop. If you choose Explore, the resulting screen resembles Windows Explorer.
• Change the drive letter and path. Not only can you change the letter used to access the drive to letters not currently used by other drives, you can add additional letters or paths and choose whether the new entities should be mounted in existing NTFS folders.
• Format the drive. This allows you to assign a volume label; choose between FAT, FAT32, and NTFS; do a quick format; and enable compression (only if NTFS is selected). NOTE: Formatting a drive deletes all the data on it. Converting a drive to NTFS (using the Convert.exe utility) does not delete the data.
• Delete the partition or logical drive. If you do this, all data is lost, and there is no means of recovery (short of resorting to backup tapes).
• Mark the partition as active (assuming there is more than one).
• If the drive selected is a CD-ROM, you can elect to eject the media.

Changing Disk Type
A final option available in Disk Management is the ability to upgrade a disk's drive type to dynamic. By default, every disk starts as the basic type but can be upgraded to dynamic (unless it is removable).

NOTE: Remember that you can convert FAT volumes to NTFS without losing data, but there is no way back. (You must format and lose all data.) Similarly, you can convert a disk's type from basic to dynamic, but there is no easy means of converting it back. Should you need to convert back for some reason, you must first delete the volumes and then use the Revert to Basic Disk command that becomes available.

The following are advantages of converting to dynamic disks:

• Existing partitions become simple volumes.
• All fault-tolerant volumes become dynamic volumes.

Of course, conversion also has its disadvantages and limitations:

• The disk cannot contain partitions or logical drives.
• The disk cannot be accessed by operating systems other than Windows 2000.
• Dynamic disks are not supported on portable computers.

To perform the upgrade, close all applications that could be accessing the disks and verify that there is a minimum of 1MB unallocated space on the disk. Although no data is actually affected, you should always make a backup before undertaking any major system change. Make the appropriate selection from the pop-up menu and move past several warnings that attempt to make certain you understand the ramifications of what you are doing. A reboot is required. After the reboot, each of the drives will be converted individually, and a second reboot will be needed. Before each reboot, you are prompted to confirm the action. When the system comes back up, the view will have changed from Primary and Logical partitions to one of Simple Volumes and unallocated space.

The pop-up menu for each volume contains the same choices it did before, but now has the following options, as well:

• Extend Volume. This option allows you to dynamically change the size of the volume (available only on NTFS volumes). If the volume was originally created on a basic disk, it cannot be extended. If the volume was first created on a dynamic disk, it can be extended.
• Add Mirror. With this option, you can enable fault tolerance via mirroring if more than one drive is installed.
• Reactivate Volume. This option is available only if the volume is not currently activated.
• Delete Volume. This option forces the loss of all data, and the space becomes unallocated.

The pop-up menu for unallocated space contains only one usable option: Create Volume. This option starts the Create Volume Wizard, which allows you to choose from one or more disks to create the volume. By default, the wizard attempts to use all available free space for the volume, but you can reduce the amount to any size you want.

The wizard allows you to assign a drive letter to the volume, leave it unassigned, or choose that it be mounted within an empty folder. A Format dialog box allows you to choose the file system to use, allocation unit size, and volume label. You can also specify whether to do a quick format and whether compression will be allowed (NTFS only). When the wizard is complete, you can see the formatting taking place within Disk Management.

When you choose to extend a volume, the Extend Volume Wizard appears, which again tries to take all the available unallocated space. One volume can constitute as many different simple volumes as desired

Disk Defragmenter
As mentioned earlier, the Disk Defragmenter utility is available on the Tools tab of the Properties dialog box for any volume. You can also access it directly from Computer Management.

The concept is a simple one, but it is worthy of discussion. When files initially are saved on a drive, they take up contiguous allocation units. As the files grow, additional allocation units need to be used for the new data, but other files may have been written into the allocation units that would come next. Therefore, the new data is written to the next set of free units. As time goes on, it is possible for portions of an individual file to be stored in different areas all over the drive. This slows down processing because more areas of the disk must be read in read and write operations.

Disk Defragmenter is a utility that analyzes the amount of fragmentation and can rewrite files back to the disk in contiguous units, thus enhancing performance. Typically, if the fragmentation is low (less than approximately 5%), the amount of time it takes to do the fragmentation outweighs the benefit. Therefore, it is recommended that you not run the utility on such a disk.

When viewing the analysis, note that different colors are used to signify different entities:

• Fragmented files appear in red.
• Contiguous files appear in blue.
• System files appear in green.
• Free space appears in white.

Green entries are important because they are often marked in such a way that they cannot be moved. At the conclusion of a defragmentation session, no red should remain in the display; rather, blue and white should dominate the display.

The report will show any files that could not be defragmented; these are often temporary or cached files. Open files can also present a problem, and all applications, if possible, should be closed prior to running the defragmenter.

Logical Drives
Choosing the Logical Drives selection in Computer Management shows all drives, floppies, and removable media, in ascending order from A: to Z:. From here, you can right-click on the drive and choose only one option from the pop-up menu: Properties. The Properties dialog box shows only the General tab and the Security tab (if NTFS).

The General tab does not offer choices for the Cleanup command button, compression, or indexing. The only data shown is the volume label, type, file system, and capacity (including used and free space calculations).

Removable Storage
The Removable Storage component is subdivided into four additional items: Media Pools, Physical Locations, Work Queue, and Operator Requests. These subcomponents are examined in the following sections.

NOTE: You can use Removable Storage to manage libraries (multiple media sets), jukeboxes, and the like. There are two types of recognized libraries: standalone (where you manually change sets) and robotic (automated).

Removable Storage works in conjunction with Backup and other data-management programs. A more advanced form of Removable Storage is Remote Storage, which is not included with Windows 2000 Professional.

Media Pools
A media pool is a collection of removable media grouped into a single management policy. The Media Pools area is divided into Free, Import, Unrecognized, and Application-Specific. For example, you can group all floppy disks or tape disks into a category and then assign security permissions for who can use, modify, and control the devices.

Physical Locations
The Physical Locations item allows you to configure aspects of your removable media and drives. The number of tabs can differ per device, but commonly there are five:

• The General tab contains the name and description of the device. Additionally, you can specify an inventory method of None, Fast, or Full.
• The Media tab tells what type of media the device is (CD-R, CD-RW, and so on).
• The Components tab shows timeout variables and barcode settings.
• The Device Info tab gives read-only information about the manufacturer, model, serial number, and so on.
• The Security tab indicates who can use the device.

Offline media settings are located here as well, and you can configure security for them.

NOTE: Windows 2000 Professional ships with a DVD Player utility as well as the usual CD Player. Like the CD Player, when a disc is placed into a DVD drive and closed, the DVD Player automatically starts.

A DVD decoder is needed to play movies. The Hardware Compatibility List contains a list of all compatible decoders and device drivers.

You can access the DVD and CD-ROM properties via the Device Manager option in Computer Management, and configure them beneath the DVD/CD-ROM drives option there.

Work Queue
The Work Queue shows the status of media jobs. Right-click and choose Properties to configure the cleaning parameters for the queue. By default, completed requests and failed requests are deleted automatically from the queue. You can choose to keep them for a specified time, however. (The default is 72 hours.)

Operator Requests
Like the Work Queue, Operator Requests shows the status of current requests. Right-click and choose Properties to configure the cleaning parameters for the queue. By default, completed requests and failed requests are deleted automatically from the queue. However, you can choose to keep them for a specified time. (The default is 72 hours.)

3.2: Implement, Manage, and Troubleshoot Display Devices

The Device Manager component of Computer Management is the primary interface for interacting with the display adapter. To access it, expand Display Adapters, right-click on an individual one, and choose Properties from the pop-up menu. The Properties dialog box appears. The following are the three tabs of the adapter's Properties dialog box:

• General. This tab displays the device type, manufacturer, and location. It also includes text regarding whether the device is currently working properly, and a command button Troubleshooter to walk you through diagnostics.
• Driver. Access this tab to view information on the current driver and digital signer. Three command buttons allow you to see driver details, and uninstall or update the driver.
• Resources. This tab shows the system resources in use (I/O, IRQ, and so on) and whether there are conflicts.

Within Device Manager, you can also expand the Monitors tree: right-click on Shown Monitors, and choose Properties from the pop-up menu. This shows the General and Driver tabs discussed in the preceding list, but not Resources.

Working from the Desktop
Right-click on the desktop and choose Properties from the pop-up menu (or access the Display applet in Control Panel) to view the information on the Settings tab. You can click the Advanced command button on this tab to see five additional tabs.

The following five tabs appear in the monitor's Properties dialog box:

• General. This tab indicates the font size and whether rebooting is required for changes to take place.
• Adapter. This tab shows the adapter type and its properties (General, Driver, and Resources). (This information was described earlier.)
• Monitor. This tab specifies the monitor type and refresh frequency.
• Troubleshooting. From this tab, you can slow down the hardware acceleration. This is useful only if your software (such as old games) is incapable of keeping up with the speed of your hardware.
• Color Management. The options on this tab allow you to create a color profile to be associated strictly with this device. Color depths can differ per adapters (particularly in the case of legacy equipment); this option allows you to configure for that.

Working with Multiple Monitors
Windows 2000 Professional, like Windows 98, supports the use of more than one monitor for creating the output display. You can combine up to 10 monitors and divide the desktop display among them-even if each one has different resolution and color depth.

One monitor is the primary display that is used for the logon dialog box. Although this is the monitor that most programs default to when started, you can switch it to another one. You can use individual graphics adapters or a single adapter that handles multiple outputs.
To add monitors, follow these steps:

1. With the computer off, add the PCI or AGP video adapter, and connect the monitor(s) to the card.
2. Turn the system back on. The new monitors should be recognized by Plug and Play, and the drivers should be installed. If they are not, go to the Add/Remove Hardware Wizard and choose the Add a New Device option. From the list of Hardware Types, choose Display Adapters.
3. Go to the Settings tab of the Display Properties dialog box and choose the monitor you want for the primary display. Check the box labeled Extend My Windows Desktop onto This Monitor.
4. Click Apply, and then click OK.

3.3: Implement, Manage, and Troubleshoot Mobile Computer Hardware

When dealing with mobile computers and Windows 2000 Professional, you need to be aware of two issues: ACPI and card services. ACPI (Advanced Configuration and Power Interface) is a standard for supplying power management features of the hardware through the operating system. Together, ACPI and APM (Automatic Power Management) are used to turn off hard disk and monitor displays after timing out (defined periods of inactivity).

Windows 2000 uses ACPI for all power management, from shutdown when the system is low on battery power to startup at the touch of a keyboard key. You can configure the available options from the Power Options applet in Control Panel, which contains the following five tabs:

• Power Schemes. This tab allows you to choose the role of the machine. The default is often Home/Office Desk, but other choices include Portable/Laptop, Presentation, Always On, Minimal Power Management, and Max Battery. To save power, you can choose the timeframe in which to turn off the monitor and/or hard disks.
• Advanced. From this tab, you can choose whether power-related icons

  4.3: Manage and Troubleshoot the Use and Synchronization Offline Files

  There are two methods by which Windows 2000 implements synchronization for the purpose of aiding mobile users. The first method is by offering the Briefcase folder, which first came to be with Windows 95 and has been in every Microsoft operating system since. The second method is radically new and different; it involves creating "offline" versions of needed networked resources. Following is more detailed information on both options.

  The Briefcase
  The Briefcase icon can appear on the desktop of every new Windows 2000 Professional installation. In previous versions of the operating system, Briefcase was known as My Briefcase, and did appear on every desktop by default. Its intent is to provide a location to which you can copy and work on files, and then from which you can synchronize them with the originals (still in their appropriate locations).

  When the synchronization is performed (with Update All), characteristics of the files on the server are compared against the ones in the Briefcase. Because the files in Briefcase have a newer modified date and time than the ones on the server, the files in Briefcase are copied to the server. This same operation could be done in reverse. In that case, Update All brings newer copies from the server and places them in Briefcase. With the Briefcase feature, it is not possible to perform a line-by-line merge; Briefcase always synchronizes by copying the newest file (last modified date) to the location of the oldest file.

  Although it no longer appears on the desktop of new installations by default, it will still be there (and named My Briefcase) if you are upgrading from another operating system. To add the icon to a desktop that does not have it (or to add multiple Briefcases), right-click on the desktop and choose New, Briefcase from the pop-up menu. Multiple Briefcases can be beneficial if you take a particular set of files with you when visiting one location, another when visiting a second location, etc.

  Offline Storage and Synchronization
  Completely new to Windows 2000 is the capability to work with resources that are "online" (accessed through the network or other connection) and "offline" (replicated copies of the resource stored locally). When you select a networked resource, the first line in the left frame beneath the location of the resource shows whether it is currently online-meaning whether you are accessing it through the network or offline.

  The pop-up menu for the resource offers a selection entitled Make Available Offline. The item you choose to make available offline can be a folder, file, or even a mapped drive.Note that the ability to make the resource available offline is an option within Windows Explorer. The choice "Make Available Offline" will appear only if the computer was set up to use offline files.

  When you select the Make Available Offline choice, the Offline File Wizard starts, walking you through the steps of replicating this data locally. Synchronization between the copy and the original can be done manually (you choose File, Synchronize from Explorer) or automatically (you log on and log off).

  The last screen of the wizard offers two important check boxes:

  • You can have reminders pop up regularly when you are working offline to tell you that you are not connected to the network. This is the default action.
  • A shortcut can be added to the desktop for the offline material. By default, this option is not enabled; you reach the offline data the same way you would access the original data.

  If the object you want to make available offline is a folder, a confirmation dialog box will ask whether you want to make available just the contents of the folder, or if you want to make available all subfolders of the original folder as well.

  NOTE: On a Windows 2000 Server, an administrator can choose to disable offline access of folders if he or she does not want to make them available for security reasons. Choosing to make a file non-cacheable prevents it from being available for offline storage.

  By default, however, shared resources can be made available for offline access.

  As the files are replicated to a local location, the synchronization dialog box shows results and errors (if there are any).

  When you're working offline, an icon of a computer appears in the System Tray at the right end of the taskbar. Clicking on the icon will show the status of the network-whether or not you are connected to it. When you become connected to the network again, you can also click that icon in the System Tray to synchronize changes you've made back to the network. Your laptop is not always able to dynamically realize when a connection to the network has been made (hot docking), so you might need to suspend (warm docking) or reboot (cold docking) before the connection is truly established.

  If you reboot the system at a time when changes to the offline folders do not correspond with what is online, the icon in the System Tray will have a flashing exclamation mark on it. Click on the icon to bring up the dialog box. During the synchronization process, a Setup button appears at the bottom right of the box. Choosing this option takes you to the Synchronization Manager. The Synchronization Manager offers three tabs and is worth examining for its options:

  • Logon/Logoff. Allows you to configure whether synchronization should occur when you log on and/or log off, or whether you should always be prompted before you take any action. This can be configured independently for LAN connections, dial-up connections, VPNs, and so on. It can also be configured for Web pages as well as folders.
  • On Idle. Allows you to configure the items to be updated when the system is idle.
  • Scheduled. Allows you to define synchronization jobs. Clicking the Add button brings up the Scheduled Synchronization Wizard with which you can schedule jobs to run every day, every week, or by some other interval.

  Finally, by clicking the Settings button at the bottom of the Synchronization Manager window, you can access the options to configure when the reminders will appear and the amount of local disk space that can be used to store offline folders. The Advanced button allows you to configure the computer so that it can never be used offline (or deviations thereof).

  Two final items of note: First, the offline files and folders do consume hard drive space, so you need to allot for this appropriately. All offline content is stored beneath the %systemroot% directory in subdirectories of a hidden, system folder named CSC. Second, the Windows 2000 Professional Resource Kit contains a utility called the Offline Files Cache Mover (cachemov.exe) that can be used to move the cache.

  4.4: Optimize and Troubleshoot Performance of the Windows 2000 Professional Desktop

  Before you can optimize performance, you first must place it within a framework. First and foremost, optimal performance from a system is what you are always striving for. Optimal performance is attained when a system is running (processing, responding, and so on) as fast as it possibly can, given the resources available to it.

  Those "resources" are a combination of everything internal to the system (CPU, disk, and so on) and external determinants (such as network and modem). If you can point to any one item and say that it is holding up all the others, that one item is preventing the system from operating at optimal performance and is known as a bottleneck. For example, assume that a workstation is used to open and append lines to hundreds of document files or log files each day. If that workstation has 128MB RAM, a Pentium III processor, and an ultra-slow IDE hard drive, it's reasonable to think that the hard drive is the bottleneck and files could be opened faster throughout the day (thus increasing productivity) if a faster hard drive were installed.

  The primary tool for gathering usage information in Windows 2000 is the Performance tool that's located in the Administrative Tools folder of Control Panel.

  NOTE: The Performance Monitor (which existed in previous versions of Windows NT) has become the Performance snap-in for MMC (Microsoft Management Console).

  The Performance tool is divided into two sections: System Monitor and Performance Logs and Alerts. System Monitor allows you to gather real-time statistics about what the system is doing right now in chart format (the default), histogram format (similar to a bar chart), or report format. Performance Logs and Alerts let you record data to create and compare with a baseline (to get a long-term look at how the system is operating) or send administrative alerts when thresholds are reached.

  NOTE: Even if you're an analyst, it does you no good to turn on Performance Monitor to monitor system activity when a problem is detected if you have no "normal" baseline of activity against which to measure the problem.

  A baseline is a history of performance over time and is used to compare against current activity. Using it, you can see if it is normal for your processor to be 80% utilized, or determine that it is a current abnormality, etc.

  System Monitor
  Within the System Monitor, the workstation is divided into a number of different objects. The number of objects depends on how the workstation is configured: As more items are added to the workstation, more objects become available in System Monitor. For example, if the workstation is running the NWLink protocol, a number of NWLink-related objects will be present.

  For each object, System Monitor has one or more counters-subsets of the overall object. Those counters may be one of two types: actual (a true number or an average) or a percentage (from 0 to 100). When looking at disk operations, for example, you can see how many reads are performed per second, which might be either a real number or the percent of time the disk is busy performing reads.

  When selecting counters, you want to avoid mixing and matching actual numbers and percentages in the same report or chart. Because the highest number a percentage counter can obtain is 100, and the highest number an actual counter can obtain is unlimited, the scale will be confusing, and you may not be able to interpret what you are seeing without confusion.

  If the workstation has more than one like item, the multiples are known as instances. For example, if you want to look at disk activity, you would view the object called PhysicalDisk. A good counter to choose would be %Disk Read Time. If you have more than one physical disk in the system, choose the instance (disk) that you want to monitor. One of the instances that will always appear when there are multiples is _Total. The _Total instance provides an aggregate measurement of all instances for a full system view.

  Sessions can be saved (default format is .htm) and viewed later, and can be configured via the Properties options. The following six tabs offer properties options:

  • General. Allows you to configure which view you are looking at, the update interval (default is one second), and the appearance.
  • Source. Lets you choose between current activity and logged files.
  • Data. Enables you to add and remove counters.
  • Graph. Lets you add titles, grids, and scale numbers.
  • Colors. Allows you to select the colors you want to use.
  • Fonts. Enables you to add styles and effects.

  Performance Logs and Alerts
  As opposed to real-time monitoring, this tool breaks into three sections: counter logs, trace logs and alterts.

  Counter logs allow you to automatically or manually record data on system usage, which you can then view with System Monitor, a spreadsheet, or any other tool.

  Trace logs are tied to events that are written when an activity (error) occurs. Alerts are messages sent when an administrator-defined threshold is reached (such as when the hard disk reaches 90% full). Trace logging can generate large amounts of data in a short time (file details and page faults quickly add up). Microsoft recommends trace logging of file details and page fault be limited to a maximum of two hours. Also, only one instance of each trace can be enabled at any time

  Most often, five areas tend to become bottlenecks: memory, processor, disk, network, and applications. The following sections examine each of these areas in detail.

  Memory
  Windows 2000 offers two types of memory: RAM and virtual memory. RAM is the physical (hardware) amount of memory installed by means of chips. Virtual memory can be comprised of RAM and the hard drive (paging file); it allows Windows 2000 to run more applications than it has physical RAM for. In an ideal situation, Windows 2000 would have enough RAM for all the applications currently running with a small amount of space to use for file caching. In other words, you can seldom go wrong by adding RAM, because it can improve disk performance by allowing you to hold more files in RAM, which allows for quicker access than from the hard drive. However, this will increase performance only when Windows 2000 has memory that isn't being used by applications.

  You can use a couple of utilities to identify memory problems. The first is the Performance tool. The object to monitor is Memory, and the counters to watch include the following:

  • Committed Bytes. This counter shows how much memory (virtual and physical) is in use. If this number always exceeds the physical RAM by more than a few megabytes, you probably don't have sufficient RAM. As the counter's value increases, the system will have to page memory in and out more frequently to keep the running programs with applications that are in memory.
  • Pages/Sec. This counter indicates how many pages per second are being moved to and from memory to satisfy requests. This number should be less than 100; a higher value can indicate that the system is probably RAM-starved. The counter won't drop to 0 even on a system that has plenty of RAM because some activity must always occur.

  You can also gather memory statistics by using Task Manager. Right-click on the taskbar and choose Task Manager from the pop-up menu, or hold down Ctrl+Shift and press Esc. The Performance tab shows current utilization and a graph of recent history. A bar-graph icon appears in the System Tray when Task Manager is running. This is an active link to the CPU Usage graph on the Performance tab and can be used to visually gauge CPU activity even when Task Manager is minimized.

  You can configure virtual memory parameters from the System applet in Control Panel. To access these settings, follow these steps:

  1. Double-click on the System applet in Control Panel.
  2. Choose the Advanced tab.
  3. In the Performance frame, click on the Performance Options button. A small dialog box appears inside the Virtual memory frame, showing the total paging file size for all drives.
  4. Click on the Change button. The Virtual Memory dialog box appears.

  The initial paging file size is the amount of contiguous space claimed at each boot. The paging file is dynamic and can always grow. However, if it grows into noncontiguous space, performance can be greatly degraded. It is, therefore, preferable to have the initial size set to a number larger than you expect the file size to grow to.

  The paging file can be moved to a disk not used as intensively by applications in order to increase performance. If there are multiple paging files (spread across multiple drives), you can select the _Total instance to look at combined usage data, or add a counter for each paging file.

  The recommended initial size is equal to RAM + (RAM/2). If the file reaches that maximum size, errors will occur because your system is unable to expand the paging file as needed. You can also choose to move the location of the paging file to another drive, or you can split it across multiple drives. Each option can be advantageous at times, as outlined here:

  • Moving the paging file to a drive not used by the system can increase response time because the system does not have to read OS files and the paging file from the same drive, and it can split the operations. This can be useful when RAM is limited.
  • Placing the paging file on more than one drive divides the amount of contiguous space needed across the array and reduces the amount needed on any one drive. For example, instead of requiring 200MB on the C: drive, the number can be dropped to 100MB if another 100MB is also stored on D:. This can be useful when hard drive free space is limited.

  To activate the changes you've made to the initial size or location, you must reboot.

  NOTE: If the amount of RAM you want to allot to the operating system is less than what is installed in your system, you must use the /MAXMEM switch in the BOOT.INI file. The parameter would follow the operating system specification in the [operating systems] section.

  Processor
  The Processor object in the Performance tool has three primary counters:

  • % Processor Time. This counter measures the total amount of processor time used on non-idle (LOW priority) threads. This includes both application processing and operating system processing.
  • % User Time. This counter reports the total amount of processor time used in non-idle threads of user applications (not including system operations).
  • % Privileged Time. This counter measures the total amount of processor time used in non-idle threads of the operating system. The % Privileged Time plus the % User Time is the same as the % Processor Time.

  When you are trying to determine whether processing is a bottleneck, it's important that you include all processors in the chart if you have more than one, or that you use the counters from the System object instead of the Processor object, because it summarizes the numbers.

  As a rule of thumb, you should upgrade the processor if it consistently reports utilization in excess of 80%. Utilization of 100% is not a problem, as long as it is spiked and inconsistent. If you never reach 100%, the full power of the processor is not being utilized, which is indicative of anything but a bottleneck.

  Disk
  The disk is as important a contributor-if not more important-than any other component in the system. Even if a system has a fast processor and a lot of memory, a drive that's performing poorly can bring the system to its knees.

  Disks objects are divided into physical disks and logical disks. The physical disk is the actual hard disk, including any individual partitions it contains. The LogicalDisk object represents individual drive partitions on a physical disk. The PhysicalDisk and LogicalDisk objects are almost identical, each having the following five counters:

  • Avg. Disk Sec/Transfer. This counter shows the average amount of time needed for disk I/O to complete. You can use the counter with the Memory object's Pages/Sec counter to determine whether paging is excessive.
  • Current Disk Queue Length. This counter represents the number of requests for disk I/O that are waiting to be serviced; generally, it should be less than two. Consistently high numbers indicate that the disk is being overused or should be upgraded to a faster access disk.
  • Disk Bytes/Sec. This counter indicates the rate at which data is transferred during disk I/O. The higher the value, the more efficient the performance.
  • Avg. Disk Bytes/Transfer. This counter shows the average number of bytes of data that are transferred during disk I/O. As with Disk Bytes/Sec, the larger the value, the more efficient the disk transfer.
  • %Disk Time. This counter represents the amount of time spent servicing disk I/O requests or a measurement of how busy Windows 2000 believes the drive to be. A consistently high number indicates that the disk is heavily used.

  Network
  Network activity is one of the most difficult components of system activity to monitor and analyze. You can use certain network-related objects and counters to determine the performance of network-related processes on the computer itself. These include Server, Redirector, and entries for the protocols installed on the computer.

  As additional network services are installed (such as RAS, DHCP, and WINS), objects and counters relating to those services are added to the Performance tool. Protocol counters include Bytes Total/Sec, Datagrams/Sec, and Frames/Sec. In general, a high value is desired; it indicates a high rate of throughput for network activity. When values are too high, however, it can indicate excessive generation of traffic, such as excessive frames due to browser broadcasts.

  NOTE: TCP/IP counters are fully enabled only if the SNMP (Simple Network Management Protocol) service agent is installed on the computer.

  You can monitor the workstation service on a computer by charting Redirector object counters. One counter of interest is Redirector>Network Errors/Sec. This counter indicates the number of errors detected by the workstation service as it attempts to direct frames onto the network. The higher this number goes, the more serious the problem may be. Use Network Monitor to observe and detect network traffic as a whole, especially to and from this computer.

  Two other Redirector counters are Redirector>Reads Denied/Sec and Redirector>Writes Denied/Sec. If this number rises significantly, it could mean that the server with which this computer is communicating might be having difficulty handling the number of network requests for resources it is receiving. You want to monitor activity on that server to pinpoint the problem and find a solution.

  Application
  For every application that is run and every service that is loaded, a process is created-a process that can be monitored. Each process is considered an instance in this case, and for each Process object instance, several counters can be charted.

  One counter, %Processor Time, can be tracked for each process instance. It enables you to determine which specific process is driving the processor to higher-than-normal usage.

  Another useful process counter is Process>Working Set. This counter tracks the amount of RAM required by the process and can be used to help determine when additional RAM is necessary. For example, if paging appears to be excessive, you might monitor the working sets of the processes suspected of causing the increased paging.

  Task Manager
  Task Manager is one of the most overlooked utilities of Windows 2000. It does not appear anywhere on the Start menu options, but you can bring it up in one of three ways:

  1. Press Ctrl+Alt+Del and choose Task Manager from the Windows Security Dialog box; or,
  2. Right-click on the taskbar and choose Task Manager from the popup menu; or,
  3. Hold down the Ctrl+Shift keys and press Esc.

  The utility has three tabs: Applications, Processes, and Performance. The Applications tab shows applications that the current user is running (not those started by Task Scheduler) and lets you start new ones, switch between them, or end them. The Performance tab shows memory and CPU utilization and a number of statistics. Among the statistics found on this tab are the amount of Physical and Kernel memory, as well as what is currently available.

  The Processes tab is a Pandora's box of possibilities. Here, it shows all running processes-those the current user is interacting with as well as the system, the Task Scheduler, and anything else. The columns can change, but the most common after the name are:

  • PID. The Process ID number. This number can be used by some applications to interact directly with the process (as in running kill from the command line, etc.).
  • CPU. The percentage of CPU utilization the process is currently using. Adding all the entries together will always total 100%, as the System Idle Process always adjusts for any non-usage.
  • CPU Time. The actual amount of processor time.
  • Mem Usage. The amount of memory the process is utilizing.

  You can highlight any of the processes and click on the End Process button to stop a process from running. It is also possible to right-click on a process and see four choices on a popup menu:

  • End Process
  • End Process Tree. Not just the process, but all processes associated with it.
  • Debug. Usually not available, but when it is, it allows interaction with the process.
  • Set Priority. The dangerous one (more on why below).

  Almost all processes start at Normal priority, which means they compete for the attention of the processor equally with other processes. Once a program has been started, there is only one way to change its priority without adding additional utilities: through the Task Manager. The six priorities, from lowest to highest, are as follows:

  • Low. For applications that need to complete sometime, but you don't want them interfering with other applications. On a numerical scale from 0 to 31, this equates to a base priority of 4.
  • BelowNormal. A new entry with Windows 2000 for applications not needing to drop all the way down to Low. This equates to a base priority of 6.
  • Normal. The default priority for most applications. This equates to a base priority of 8.
  • AboveNormal. A new entry for Windows 2000 for applications that don't need to boost all the way to High. This equates to a base priority of 10.
  • High. For applications that must complete soon when you don't want other applications to interfere with the applications' performance. This equates to a base priority of 13.
  • Realtime. For applications that must have the processor's attention to handle time-critical tasks. Only a member of the Administrators group can run applications at this priority. This equates to a base priority of 24.

  If you decide to change the priority of an application, you'll be warned that changing the priority of an application may make it unstable. You can generally ignore this option when changing the priority to Low, BelowNormal, AboveNormal or High, but you should heed this warning when changing applications to the Realtime priority. Realtime means that the processor gives precedence to this process over all others-over security processes, over spooling, over everything-and is sure to make the system unstable.

  Task Manager changes the priority only for that instance of the running application. The next time the process is started, priorities revert back to that of the base (typically Normal).

  The START Command
  The START command is a command-line utility that allows you to specify every possible option for starting a program. The START command has the following format:

  START ["title"] [/Dpath] [/I] [/MIN | /MAX] [/SEPARATE | /SHARED] [/LOW | /NORMAL | /HIGH | /REALTIME | /ABOVENORMAL | /BELOWNORMAL] [/WAIT] [/B] Program [Program arguments]

  Of importance here are only the priority options and the /SEPARATE option, which starts a 16-bit Windows applications in a separate memory space. This will protect it from being interfered with by other errant 16-bit Windows applications. This option is ignored if the application isn't a 16-bit Windows application.
  The opposite of /SEPARATE is /SHARED, which starts a 16-bit Windows application in a shared memory space (the default). This option is ignored if the application isn't a 16-bit Windows application.

  To put it in perspective, you can start a process at a priority other than its base by using the START utility at the command line. Once a process is running, the only way to change its priority is through Task Manager.

  4.5: Manage Hardware Profiles

  Most desktop computers should have only one hardware profile, because the hardware connected to them will not deviate greatly from one day to the next. The hardware connected to laptop/mobile computers can differ greatly from day to day, however, based on whether they are sitting in a docking station at the office, being used by a manager at home in the evening, or being used by a salesman making a presentation to a customer in the field.

  Just as user profiles allow you to configure different parameters for multiple users, hardware profiles allow you to configure different parameters for different hardware-accessible possibilities the system may encounter. In brief, hardware profiles offer a way to create and maintain different hardware configurations (including which services and devices are used) for different computing scenarios.

  If a system has multiple hardware profiles, a menu of the choices will appear during the boot process (after you are prompted to press the spacebar for the Last Known Good Configuration).

  By default, you have a number of seconds in which to make a choice from the menu. If you do not make a choice in the allotted time, the default profile is used.

  To create a hardware profile, double-click on the System applet in Control Panel. From the five tabs that appear, choose Hardware. Select the bottom command button, Hardware Profiles.

  To create a new hardware profile, follow these steps:

  1. Choose an existing or original profile from the Available Hardware Profiles list box, and then choose Copy.
  2. Enter the name of the new profile and click OK.
  3. Use the arrow buttons to the right of the profile list to determine the order preference of the profiles. This determines which order Windows 2000 uses to load the profiles during system startup.
  4. Click the Properties button to indicate whether the computer is a portable, to specify its docking state, and to indicate whether this profile should always be included as an option during boot. Then click OK.
  5. Specify what should be done during startup. If you want Windows 2000 to display a list of profiles at startup that you make a selection from, choose Wait Until I Select a Hardware Profile. With that option selected, Windows 2000 does not continue with the startup operation until a profile is selected.
  6. If you don't want to wait indefinitely, set a timeout value for how long you have to select a profile before Windows 2000 selects the first profile in the list. This is the default operation; 30 seconds is the standard. If you set the timeout value to 0, Windows 2000 simply boots with the highest-order profile on startup.

  After you have created different profiles, you need to identify which services to enable and disable for each profile. You do this through the Services applet in the Administrative Tools folder of Control Panel.

  To define a separate operation for a specific service in a hardware profile, follow these steps:

  1. Select the service/device from the list and double-click on it.
  2. Choose the Log On tab. This shows the different hardware profiles for the system.
  3. Double-click on the profile in the list to toggle between Enabled and Disabled, or use the command buttons at the bottom.
  4. Click OK, and then close the applet.

  When you start Windows 2000 and choose a hardware profile, the services start as configured here.

  4.6: Recover System State Data and User Data

  Except for the occasional sadist, no one looks forward to system disasters that force him to rebuild his computer systems and data. Unfortunately, almost every component used to store files and data has a mean-to-failure ratio associated with it. Devices do fail. And when they do, data can be lost.

  The best insurance policy you have against devastating loss when a failure occurs is a backup of the data that you can turn to when the system is rebuilt. Windows 2000 includes a number of tools and features you can use to prepare for a failure and recover from one. These tools and features are the subjects of the next few sections.

  Windows Backup
  The Windows 2000 Backup and Recovery Tool combines several utilities. To access this tool, choose Start, Programs, Accessories, System Tools, Backup.

  Backing Up
  The Backup Wizard walks you through the creation of a backup job. Alternatively, you can choose the Backup tab and avoid the wizard altogether (but you can only access jobs that are already created). The wizard first asks what you want to back up. You can choose from three options: All files, Selected files, Only System State data.

  NOTE: Windows 2000 uses the term "System State data" to refer to all the components the operating system needs to function. The "System State data" on Windows 2000 Professional is much smaller (a subset) than the "System State data" needed on Windows 2000 Server. On Professional, this includes Boot files, the Registry, and COM+ database files. You can only backup System State data locally and not on a remote computer.

  After you specify what you want to back up, you must specify where you want to back up to. By default, the backup location is a file named Backup.bkf, which can be located anywhere (A: drive, C: drive, tape, network and so on). This is a radical departure from earlier versions in which the only accepted location was a tape.
  The wizard's confirmation screen shows you your selections. It also contains an Advanced button. If you click the Advanced button, you can configure such settings as whether Remote Storage files should be included and the type of backup you want to perform. Five backup type choices are available:

  • Normal. A full backup of all files, regardless of the state of the archive bit (the default). After the files are backed up, the archive bit is turned off.
  • Copy. A full backup of all files, regardless of the state of the archive bit. The archive bit is left in its current state.
  • Incremental. Only the files for which the archive bit is currently turned on. After the files are backed up, the archive bit is turned off.
  • Differential. Only the files for which the archive bit is currently turned on. The archive bit is left in its current state.
  • Daily. Only those files with today's date, regardless of archive bit status.

  Including System State data in a backup forces the backup to either be Normal or Copy.

  A good backup regimen utilizes at least two of the preceding types. You must be careful how you mix and match them, however. For example, you might want to do a full (normal) backup every Sunday and an incremental backup Monday through Saturday. The incremental will back up only files that changed on Monday for Monday's backup, the files that changed on Tuesday for Tuesday's backup, and so on. If the system crashes on Saturday (prior to the backup), you must first restore last Sunday's full backup, then the incrementals for Monday, Tuesday, Wednesday, Thursday, and Friday to get your system back.
  As another scenario, if you did a full (normal) backup every Sunday and a differential backup Monday through Saturday, you would need only two tapes to do the restore. If the system crashes on Saturday (prior to the backup), you must first restore last Sunday's full, then the differential for Friday. Each differential done throughout the week takes longer to complete, because it holds successively more data, but the number of tapes and time needed for restore operations is greatly reduced.

  The next screen of the wizard offers choices for verifying data after backup and utilizing hardware compression (if available). The following screen offers the choices to append the backup to the media location or overwrite all existing files there. The default is to append.

  The next-to-last screen asks for a label for the backup and for the media. The final screen allows you to specify whether the backup should take place now or be scheduled for later. After the backup runs, you can view a report of the operations in the log file.

  You can also perform backups from the command line by using the ntbackup.exe executable. You cannot restore files from the command line with this utility, however. Among the options:

  /A is used to perform an append.
  /F is used to identify the disk path and file name.
  /HC:{on|off} toggles hardware compression on or off.
  /J is used to signify the job name.
  /M has to be followed by a backup type name: copy, daily, differential, incremental, or normal.
  /N is used to signify a new tape name and cannot be used in conjunction with /A.
  /P is used to signify the medial pool name.
  /T is followed by the tape name
  /V:{yes|no} toggles whether or not to do verification after the completion of the backup

  Restoring
  Just as the Backup Wizard helps you create backup jobs, the Restore Wizard helps you simplify configuration tasks. You can restore an individual file, an entire backup set, or any combination of the two. Specify what you want to restore, and you then see a summation screen with an Advanced button. By clicking this button you can choose to restore the data to one of these locations: Original location, Alternate location, Single folder.

  Next, choose whether the files you are restoring should overwrite existing files in all cases, replace the disk files only if the disk files are older, or not replace any existing files at all (the default). Choose whether to restore any special files (security, removable storage and so on), if applicable. Then the job begins.

  Emergency Repair Disk
  The Windows 2000 Backup and Recovery Tool also allows you to do graphically what previous versions of the operating system required you to do from the command line: create an ERD (emergency repair disk). As the name implies, this is a disk you can use to repair a portion of the system in the event of a failure.
  When you choose this option, the tab changes to the Backup tab, and a prompt tells you to install a blank, formatted floppy disk. A check box inquires whether you want to save the Registry as well. (The default is no.) If you do not choose to save the Registry, the following files are placed on the floppy disk:

  • Setup.Log
  • Config.Nt
  • Autoexec.Nt

  This doesn't leave you much to work with. The disk is not bootable and contains only three minor configuration utilities.

  If you check the box to include the Registry in the backup, the floppy disk contains the preceding files plus the following:

  • SECURITY._
  • SOFTWARE._
  • SYSTEM._
  • DEFAULT._
  • SAM._
  • Ntuser.dat
  • UsrClass.dat

  The user profile (Ntuser.dat) is for the default user; the files with the ._ extension are compressed files from the Registry. The compression utility used is Expand.Exe, which offers you the flexibility of restoring any or all files from any Microsoft operating system, including this utility (Windows 95/98, Windows NT, and so on). Because this floppy contains key Registry files, it is important that you label it appropriately and store it in a safe location, away from users who should not have access to it.

  NOTE: During the process of creating the floppy, the Registry files are also backed up (in uncompressed state) to %systemroot%\repair\RegBack. As before, the floppy is not bootable, and you must bring the system up to a point (booted) where the floppy can be accessed before it is of any use.

  Schedule Jobs
  The last tab of the Windows 2000 Backup and Recovery Tool allows you to schedule jobs to run routinely. A calendar allows you to see dates and schedule jobs for those dates.

  Double-click on a job and select the Properties button. From the dialog box that appears, you can configure the task, its schedule, and settings.

  Safe Mode
  If, when you boot, Windows 2000 will not come all the way up (it hangs or is otherwise corrupt), you can often solve the problem by booting into Safe Mode. Safe Mode is a concept borrowed from Windows 95 wherein you can bring up a part of the operating system by bypassing the settings, drivers, or parameters that may be causing it trouble during a normal boot. The goal of Safe Mode is to provide an interface with which you are able to fix the problems that occur during a normal boot and then reboot in normal mode.

  To access Safe Mode, you must press F8 when the operating system menu is displayed during the boot process. A menu of Safe Mode choices will then appear. Select the mode you want to boot into:

  • Safe Mode. VGA monitor, Microsoft mouse drivers, basic drivers for keyboard (storage system services, no networking)
  • Safe Mode with Networking. Same as Safe Mode only with networking
  • Safe Mode with Command Prompt. Same as Safe Mode only without the interface and drivers/services associated with it
  • Enable Boot Logging. Creates ntbtlog.txt in the root directory during any boot - normal attempted
  • Enable VGA Mode. Normal boot with only basic video drivers
  • Last Known Good Configuration. Uses the last backup of the Registry to bypass
    corruption caused during the previous session. The Last Known Good is chosen during boot by pressing the spacebar. This can be useful if a user installs a driver that prevents the system from starting - you resort to the previous configuration by invoking the Last Known Good.
  • Debugging Mode. Sends information through the serial port for interpretation/troubleshooting at another computer
  • Boot Normally. Bypasses any of the options here
  • Return to OS Choices Menu. Gives you an out in case you pressed F8 by accident

  You need to keep a couple of rules in mind when booting in different modes:

  • If problems don't exist when you boot to Safe Mode but do exist when booting to normal mode, the problem is not with basic services/drivers.
  • If the system hangs when you load drivers, the log file can show you the last driver it attempted to load, which is usually the cause of the problem.
  • If you can't solve the problem with Safe Mode, restore the Registry from the emergency repair disk to a state known to be good. Bear in mind that doing so will lose all changes that have occurred since the last ERD was made.

  Recovery Console
  The Recovery Console is a command-line utility used for troubleshooting. From it, you can format drives, stop and start services, and interact with files. The latter is extremely important because many boot/command-line utilities bring you into a position where you can interact with files stored on FAT or FAT32, but not NTFS. The Recovery Console can work with files stored on all three file systems.

  The Recovery Console is not installed on a system by default. To install it, use the following steps:

  1. Place the Windows 2000 Professional CD in the system.
  2. From a command prompt, change to the i386 directory of the CD.
  3. Type winnt32 /cmdcons.
  4. A prompt appears, alerting you to the fact that 7MB of hard drive space is required and asking if you want to continue. Click Yes.

  Upon successful completion of the installation, the Recovery Console (Microsoft Windows 2000 Recovery Console) is added as a menu choice at the bottom of the startup menu. To access it, you must choose it from the list at startup. If more than one installation of Windows 2000 or Windows NT exists on the system, another boot menu will appear, asking which you want to boot into, and you must make a selection to continue.

  To perform this task, you must give the administrator password. You will then arrive at a command prompt. You can give a number of commands from this prompt, two of which are worth special attention: EXIT restarts the computer, and HELP lists the commands you can give. The following is a list of the other commands available, most of which will be familiar to administrators who ever worked with MS-DOS.

  • ATTRIB Shows the current attributes of a file or folder, and lets you change them.
  • BATCH Runs the commands within an ASCII text ffile.
  • CD Used without parameters, it shows the current directory. Used with parameters, it changes to the directory specified.
  • CHDIR Works the same as CD.
  • CHKDSK Checks the disk for errors.
  • CLS Clears the screen.
  • COPY Allows you to copy a file (or files, if used with wildcards) from one location to another.
  • DEL Deletes a file.
  • DELTREE Recursively deletes files and directories.
  • DIR Shows the contents of the current directory.
  • DISABLE Allows you to stop a service/driver.
  • DISKPART Shows the partitions on the drive and lets you manage them.
  • EXPAND Extracts compressed files.
  • ENABLE Allows you to start a service/driver.
  • FIXBOOT Writes a new boot sector.
  • FIXMBR Checks and fixes (if possible) the master boot record.
  • FORMAT Allows you to format a floppy or partition.
  • LISTSVC Shows the services/drivers on the system.
  • LOGON Lets you log on to Windows 2000.
  • MAP Shows the maps currently created.
  • MD Makes a new folder/directory.
  • MKDIR Works the same as MD.
  • MORE Shows only one screen of a text file at a time.
  • RD Removes a directory or folder.
  • REN Renames a file or folder.
  • RENAME Works the same as REN.
  • RMDIR Works the same as RD.
  • SYSTEMROOT Works like CD but takes you to the system root of whichever OS installation you are logged on to.
  • TYPE Displays the contents of an ASCII text file.

  During the installation of the Recovery Console, a folder named Cmdcons is created in the root directory to hold the executable files and drivers it needs. A file named Cmldr, with attributes of System, Hidden, and Read-Only, is also placed in the root directory.

  If you want to delete the Recovery Console (to prevent users from playing around, for example), you can do so by deleting the Cmldr file and the Cmdcons folder, and removing the entry from the Boot.ini file.
  

  More to Come...
  That's it for now...we've finished the second objective, and covered three and fourt. Next time, the final three objective categories -- "Configuring and Troubleshooting the Desktop Environment," "Implementing, Managing, and Troubleshooting Network Protocols and Services," and "Implementing, Monitoring, and Troubleshooting Security" -- will be examined; completing the coverage of what you need to know to pass this exam.

  Questions? Comments? Post 'em below!

  ---

  Emmett Dulaney is the author of several books on Linux, Unix, and certification. He is a former partner in Mercury Technical Solutions, and can be reached at .

  ---

  More articles by Emmett Dulaney:
  

  • Novell’s "Newest" Linux Desktop Move
    
  • Conquering Network+
    
  • Ubuntu: Getting Back to Linux Basics  
    
  • Novell's CLE 9 Exam: The Brass Ring?
    

  ---