Chapter 15. Troubleshooting and Maintaining Windows

This chapter covers a portion of the CompTIA A+ 220-701 objectives 2.2, 2.5, and 3.4, and CompTIA A+ 220-702 objectives 2.1, 2.3, and 2.4.

Everyone has seen or heard of a Windows error. And it’s not just Windows; every operating system will fail at some point—it’s just a matter of time. Windows has lots of different kinds of errors, from boot errors, to non-critical application errors, to complete failures of Windows known as stop errors. A good troubleshooter will be able to discern whether the problem is software or hardware related and will analyze and repair all of these problems. In an effort to aid the PC technician, Windows offers tools such as the Windows Repair Environment, Recovery Console, Advanced Boot Options menu, and the Microsoft Help and Support, formerly known as the Knowledge Base (MKSB), which we will refer to often in this chapter. The Help and Support website is chock full of articles about all kinds of problems you’ll see in the field; it can be accessed at http://support.microsoft.com. We’ll cover all these tools and much more throughout this chapter in an attempt to make you a well-rounded troubleshooter.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz allows you to assess whether you should read this entire chapter or simply jump to the “Exam Preparation Tasks” section for review. If you are in doubt, read the entire chapter. Table 15-1 outlines the major headings in this chapter and the corresponding “Do I Know This Already?” quiz questions. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Troubleshooting Scenarios.”

Table 15-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping

1. You have just installed an updated driver for your video card. You reboot the system and, for some reason, Windows will not start. What could you do to fix this problem?

a. Press F8 at boot and select the last known good configuration

b. Select Ctrl+Alt+Del at the BIOS screen

c. Create a boot disk on a floppy disk

d. Reboot the computer and hope it comes back up

2. You are working on a computer running the Windows Vista operating system. You get a boot error. What is an option you can use to recover your system to normal?

a. NTBACKUP

b. System Restore

c. ASR Disk

d. WinRE

3. You are working on a computer running the Windows XP operating system. You receive a boot error that the NTLDR is missing or corrupt. Which of the following could you use to restore the file?

a. Copy and paste from the CD

b. The Recovery Console

c. The NTBACKUP program

d. Use the advanced boot options

4. You have just set up a new user’s computer that is running the Windows XP operating system. This user wants to make sure that the computer’s system state can be restored in the event of a failure. What system recovery option would you want to set up?

a. Automated System Recovery

b. Emergency Repair Disk

c. There is not one

d. Complete PC Backup

5. You are contacted by a customer who needs some help. He has a computer running the Windows 2000 operating system. He wants to be able to boot the system if the operating systems fails. You instruct him to create an emergency repair disk. Where would you tell him to look?

a. MSCONFIG

b. NTBackup

c. System Properties

d. By typing RDISK at the run line

6. Which of the following gives you the ability to recover an operating system if you have a system boot failure? (Choose all that apply.)

a. WinRE

b. Last Known Good Configuration

c. Recovery Console

d. All of these options are correct

7. You are the technician for your company. You are in charge of maintaining all desktop computers. You need to keep your systems updated. Which of the following would you need to install to maintain these computers? (Choose all that apply.)

a. Install the latest service pack

b. Defragment your computer

c. Install all hotfixes

d. Install anti-virus updates

8. You have a user who is having problems with her PC. You inspect the computer and find that the computer is not running an up-to-date service pack. Where would you go to get the service pack?

a. openoffice.org

b. msn.com

c. update.microsoft.com

d. Your favorite search engine

9. Where would a user go in Windows XP to change settings regarding how updates are downloaded and installed?

a. Control PanelAutomatic Updates

b. Control PanelWindows UpdateChange Settings

c. Microsoft Update site

d. Control PanelUpdates

10. You are working as a desktop technician for your company. You have been asked to come up with a way to protect all users’ documents in case they are deleted. Which of the following should you do?

a. Create system restore points on all computers

b. Schedule backups

c. Save all data to a removable drive

d. Send all documents to a remote location

11. You are the desktop technician for your company. You have been asked to come up with a plan to minimize the downtime of users’ workstations in case of failure during working hours. What should you do to make this happen?

a. Create a NTBACKUP schedule

b. Perform a system state backup

c. Create an image backup of the system

d. Setup a system restore point

12. Which of the following are programs that you as a technician can use to create an image backup?

a. System Restore

b. NTBACKUP

c. Norton Ghost

d. Acronis True Image

Foundation Topics

Troubleshooting Windows

A damaged Windows installation prevents the computer from getting any work done. It is important for a technician to know how to recover an operating system by using the Advanced Boot Options menu and recovery environments, such as Windows Vista’s WinRE and Windows XP’s Recovery Console. A technician should also know how to restore a system using Windows Vista’s Complete PC Backup, and Windows XP’s Automated System Restore, as well as the System Restore utility. Understanding the tools provided in Windows for troubleshooting the operating system will help you pass the A+ Certification exams and solve plenty of real-world problems as well.

Recovering an Operating System

If Windows will not start properly, you have a variety of options you can use to get it working again:

• If the problem is caused by the most recent change to Windows, you can use the Last Known Good Configuration startup option to get things working again.

• If you are not sure of the problem, you can use Safe Mode or other advanced boot options to help diagnose the problem.

• If Windows will not boot, you can use the Windows Recovery Environment (WinRE) for Windows Vista, or the Recovery Console for Windows XP/2000 to fix the problem.

• If Windows will not boot and needs to be restored, there are various tools that can be implemented including Complete PC Backup (Vista), ASR System Restore (XP), and the Emergency Repair Disk (2000).

The following sections discuss these tools in detail.

Last Known Good Configuration, Safe Mode, and Other Advanced Boot Options

If you are unable to start Windows Vista/XP/2000 but don’t see an error message, the problem could be caused by a driver or startup program, video driver problems, or problems with the system kernel. Windows offers various advanced boot options to help you correct startup problems. To access these startup options, press the F8 key immediately after the computer starts up; this will bring up the Windows Advanced Boot Options menu (which you may also see referred to as advanced startup options) as shown in Figure 15-1.

Figure 15-1 Windows Vista Advanced Boot Options menu.

Windows Vista/XP/2000 offers the following startup options as part of the Advanced Boot Options menu:

• Safe Mode— Starts system with a minimal set of drivers; can be used to start System Restore or to load Windows GUI for diagnostics.

• Safe Mode with Networking— Starts system with a minimal set of drivers and enables network support.

• Safe Mode with Command Prompt— Starts system with a minimal set of drivers but loads command prompt instead of Windows GUI.

• Enable Boot Logging— Creates a ntbtlog.txt file.

• Enable low-resolution video (640 × 480)— Uses a standard VGA driver in place of a GPU-specific display driver, but uses all other drivers as normal. (This is called Enable VGA Mode in Windows XP/2000.)

• Last Known Good Configuration—Starts the system with the last configuration known to work; useful for solving problems caused by newly installed hardware or software.

• Directory Services Restore Mode— This is used to restore a domain controller’s active directory (Windows Server). Even though it is listed, it is not used in Windows Vista/XP/2000.

• Debugging Mode— This is an advanced diagnostics tool that enables the use of a debug program to examine the system kernel for troubleshooting.

• Disable automatic restart on system failure (Vista only)— Prevents Windows from automatically restarting if an error causes Windows to fail. Choose this option only if Windows is stuck in a loop where Windows fails, attempts to restart, and fails again.

• Disable driver signature enforcement (Vista only)— Allows drivers containing improper signatures to be installed.

• Start Windows Normally— This can be used to boot to regular Windows. This option is listed in case a user inadvertently presses F8, but does not want to use any of the Advanced Boot Options.

If Windows Vista fails to start properly and then restarts automatically, it will normally display the Windows Error Recovery screen, and give you the following options: Safe Mode, Safe Mode with Networking, Safe Mode with Command Prompt, Last Known Good Configuration, and Start Windows Normally. This means that Windows has acknowledged some sort of error or improper shut down and offers a truncated version of the Advanced Options Boot menu.

Table 15-2 lists typical problems and helps you select the correct startup option to use to solve the problem.

Table 15-2 Using the Windows Vista/XP/2000 Advanced Boot Options Menu

There is only a small window of time available to press F8; it’s right between the BIOS and when the normal operating system boots. Press F8 repeatedly right after the BIOS POST begins. It is important to note that the Last Known Good Configuration option will only be helpful before a successful logon occurs. After a user logs on, that becomes the last known good logon. It is recommended that you attempt to repair a computer with the Advanced Boot Options before using Windows Vista’s System Recovery Options, or Windows XP/2000’s Recovery Console.

Windows Recovery Environment (WinRE)

Windows Recovery Environment (WinRE) is a set of tools included in Windows Vista, Windows Server 2008, and other upcoming Windows operating systems. It takes the place of the Recovery Console used in Windows XP/2000. Also known as System Recovery Options, WinRE’s purpose is to recover Windows from errors that prevent it from booting. There are two possible ways to access WinRE:

• Option 1—Booting to the Windows Vista DVD

• Option 2—Booting to a special partition on the hard drive that has WinRE installed

The first option is more common with an individual computer that has Windows Vista installed; for example, if you performed a clean installation with the standard Windows Vista DVD and made no modifications to it. To start WinRE, make sure that the DVD drive is first in the boot order of the BIOS, boot to the Windows Vista DVD (as if you were starting the installation), choose your language settings and click Next, and then select Repair Your Computer, which you will find at the lower-left corner of the screen.

The second option is used by OEMs (original equipment manufacturers) so that users can access WinRE without having to search for, and boot off of, a Windows Vista DVD. These OEMs (computer builders and system integrators) will preinstall WinRE into a special partition on the hard drive, separate from the operating system, so that the user can boot into it at any time. Compare this to the older Recovery Console that was installed into the same partition as the operating system. To access WinRE that has been preinstalled, press F8 to bring up the Advanced Boot Options menu, highlight Repair Your Computer, and press Enter. If you don’t see “Repair your computer” in the Advanced Boot Options menu, then it wasn’t installed to the hard drive, and you will have to use option 1, booting from the Vista DVD. Note that you can still use option 1 even if WinRE was installed to the hard drive; for example, in a scenario where the hard drive installation of WinRE has failed.

Regardless of which option you selected, at this point a window named “System Recovery Options” should appear, prompting you to select an operating system to repair. Most users will only have one listed. Highlight the appropriate operating system in need of repair and click Next. That will display the options at your disposal as shown in Figure 15-2. Table 15-3 describes these options in more depth.

Figure 15-2 Windows Vista System Recovery Options Window.

Table 15-3 Description of the Windows Vista System Recovery Options

Recovery Console

The Windows Recovery Console is a special command-line interface that is designed for copying files and performing disk repairs. It is used by Windows XP and 2000. In Windows 2000, you can use the Recovery Console as an alternative to the Emergency Repair process, such as if you need to restore only one system file. Windows XP lacks the Emergency Repair provision, so understanding how to use the Recovery Console is even more important.

Use Recovery Console when the system cannot start from the hard disk because of missing or corrupted boot files, or when other types of missing system files prevent the computer from starting in Safe Mode.

To start Windows XP’s Recovery Console, you have two options:

• Option 1—Boot your system with the Windows XP CD and run the Recovery Console as a repair option.

• Option 2—While the system is working properly, install the Recovery Console from the Windows XP CD-ROM. It will appear automatically as a startup option when you restart your computer.

To start Recovery Console from the Windows XP CD, follow these steps:

Step 1. Boot the system from the Windows XP CD.

Step 2. When prompted, press R to start the Recovery Console. (In Windows 2000, you would press R for Repair, and then C for the Recovery Console.)

To log into Recovery Console:

Step 1. Select the installation to log into. (Do this by pressing the number that corresponds to the operating system.)

Step 2. Provide the administrator password for the system.

To copy Recovery Console from the Windows XP/2000 CD:

Step 1. While Windows is running, insert the Windows CD into the CD or DVD drive.

Step 2. Click Start, Run.

Step 3. In the Run prompt, type x:i386winnt32.exe /cmdcons where x is the drive letter for the CD or DVD drive.

Step 4. To confirm the installation, click Yes in the Windows Setup dialog box describing Recovery Console.

Step 5. Restart the computer. The next time that you start your computer, Microsoft Windows Recovery Console appears on the startup menu. Select it to start Recovery Console.

The Recovery Console contains some of the same commands that are available in the normal command-line interface, along with additional commands that are necessary only for repairing the installation.

Table 15-4 lists Recovery Console commands and uses.

Table 15-4 Recovery Console Commands

Using System Restore with Advanced Boot Options

If you cannot boot into Windows XP, try starting your computer using the Safe Mode option and then click the System Restore link. Click Restore My Computer to an Earlier Time, select a previous restore point, and click Next. This will return your system to a previous state.

You can also start a System Restore with Safe Mode with the Command Prompt option. If you are prompted to select an operating system, use the arrow keys to select the appropriate operating system for your computer, and then press Enter. Log on as an administrator or with an account that has administrator credentials. At the command prompt, type %systemroot%system32 estore strui.exe, and then press Enter. Follow the instructions that appear on the screen to restore your computer to a functional state.

For more information about System Restore, see “System Restore,” in Chapter 13.

Using Windows Vista’s Complete PC Backup

Complete PC Backup is the successor to Windows XP’s Automated System Recovery. It backs up an entire image of your system to the removable media of your choice, for example DVD. To create a backup of your PC with Vista’s Complete PC Backup, follow these steps:

Step 1. Start the Complete PC Backup by going to Start > All Programs > Accessories > System Tools > Backup Status and Configuration.

Step 2. Click the Complete PC Backup button.

Step 3. Select Create a Backup Now and follow the directions. Have media ready that can hold an image of your operating system, for example DVD-R. Be ready, this will be a sizeable image.

To restore a system from the backup, follow these steps:

Step 1. Insert the installation disc, and then restart the computer. (Make sure that the DVD drive is listed first in the BIOS boot order.)

Step 2. Press any key when prompted in order to boot off of the DVD.

Step 3. Choose your language settings and then click Next.

Step 4. Click Repair Your Computer.

Step 5. Select the operating system you want to repair (usually there will be only one), and then click Next.

Step 6. On the System Recovery Options menu, click Windows Complete PC Restore, and then follow the instructions. Insert the last DVD of the backup set when prompted to do so.

Using Automated System Recovery (ASR) (Windows XP)

Windows XP Professional does not include a true disaster-recovery backup program. However, the Automated System Recovery (ASR) option in NTBackup does enable you to restore the system state (user accounts, hard disk configuration, network configuration, video settings, hardware configuration, software settings, operating system boot files).

To create an ASR backup with NTBackup, follow these steps:

Step 1. Switch to Advanced Mode (if NTBackup starts in Wizard mode) and click the Automated System Recovery Wizard button (see Figure 15-3).

Figure 15-3 Preparing to start the ASR Wizard.

Step 2. The Automated System Recovery Preparation Wizard’s opening dialog appears. Click Next to continue.

Step 3. Specify where to store the backup, and click Next.

Step 4. Click Finish to complete the wizard. The backup starts. Provide a floppy disk when prompted to store configuration files.

The floppy disk created by the ASR Wizard contains three files that store information about storage devices (asr.sif), Plug and Play (PnP) information (asrpnp.sif), and a list of system state and critical files that were backed up (setup.log).

To restore a system with ASR, you need the following:

• The Windows XP Professional distribution CD

• The ASR backup

• The ASR floppy disk

• A supported floppy drive

If the computer does not have provision for a floppy drive connected to a floppy drive controller, there are a few USB floppy drives that are supported. The USB floppy drives that Microsoft supports for installing Windows XP (and for ASR) are listed in Microsoft Knowledge Base article 916196, available at http://support.microsoft.com.

Follow this procedure:

Step 1. Start the system with the Windows XP Professional CD.

Step 2. Press F2 when prompted to start Automated System Recovery.

Step 3. Insert the ASR floppy disk.

Step 4. Provide backup files when prompted.

After completing the ASR restore, you will need to reinstall your applications and restore your most recent backup to return your system to service.

Using the Emergency Repair Disk (Windows 2000)

Windows 2000 has a feature called Emergency Repair that can fix some startup problems. The Windows 2000 Emergency Repair Disk (ERD) is created with the Windows 2000 Backup program.

To run the Emergency Repair feature with Windows 2000, follow these steps:

Step 1. Start the system with the Windows CD; if the system can’t boot from the CD, use the Windows setup floppy disks to start the system and insert the CD when prompted.

Step 2. Select Repair when prompted, and then Emergency Repair.

Step 3. Choose Fast Repair when prompted. Fast repair performs all three options provided with Manual repair: Inspect Startup Environment; Verify System Files; and Inspect Boot Sector. Manual repair lets you select which of these to run.

Step 4. Insert the Emergency Repair Disk (ERD) (if available) when prompted. This disk contains a log file of the location and installed options for this copy of Windows.

Step 5. After the process replaces damaged or missing files, follow the prompts to remove the ERD and restart the system.

Diagnosing and Troubleshooting Other Problems

The ability to diagnose and troubleshoot problems depends upon a combination of technical skills and the ability to interact with clients. Often, a combination of what clients tell you (or don’t tell you) and your own detective skills are needed to solve a computer problem.

Identifying the Problem: User Interview

The client interview is the all-important first step in solving any computer trouble-shooting situation. During this interview, you need to determine the following facts:

• The software in use at the time of the problem

• The hardware in use at the time of the problem

• The task the customer was trying to perform at the time of the problem

• The environment in the office or work area at the time of the problem

• If new software or hardware has been added to the computer or network

• If any changes have been made to the system configuration

• If other users are having the same or similar problems

The number-one question you’re trying to answer is, “What changed since the last time it worked?” Sometimes the client can tell you what changed, and sometimes you must “ask” the computer what changed.

During the client interview, you need to ask questions to determine the following information:

• What hardware or software appears to have a problem?— The user might have an opinion about this, but don’t be unduly swayed by a statement such as “the printer’s broken”; the device or software the user believes to be at fault might simply reflect a problem coming from another source.

• What other hardware or software was in use at the time of the problem?— The user probably will answer these types of questions in terms of open applications, but you will also want to look at the taskbar and system tray in Windows for other programs or routines that are running. Pressing Ctrl+Alt+Del will bring up a task list in Windows that has the most complete information about programs and subroutines in memory. To determine the exact version of a Windows-based program in use, click Help, About. View the System properties sheet to determine the version of Windows in use.

• What task was the user trying to perform at the time of the problem?— Ask the questions needed to find out the specific issues involved. For example, “Printing” isn’t a sufficient answer. “Printing a five-page brochure from PageMaker to a laser printer” is better, but you’ll probably want the user to re-create the situation in an attempt to get all the information you need.

• Is the hardware or software on the user’s machine or accessed over the network?— If the network was involved, check with the network administrator to see if the network is currently working properly. If the hardware and software are not networked, your scope for troubleshooting is simpler.

• What were the specific symptoms of the problem?— Some users are very observant, but others might not be able to give you much help. Ask about the approximate time of the failure and about error messages, beeps, and unusual noises.

• Can the problem be reproduced?— Reproducible problems are easier to find than those that mysteriously “heal” themselves when you show up. Because power and environmental issues at the customer’s site can cause computer problems, try to reproduce the problem at the customer’s site before you move the computer to your test bench, where conditions are different.

• Does the problem repeat itself with a different combination of hardware and software, or does the problem go away when another combination of hardware and software is used?— For example, if the user can print from Microsoft Word but not from PageMaker, this means that the printer is working, but there might be a problem with configuration or data types used by different applications. If the user can’t print anything, there might be a general problem with the printer hardware or drivers.

Sometimes, the client interview alone will reveal the answer. More often, however, you’ll need to go to the client’s work area and evaluate the hardware and software that are involved.

Analyzing the Problem

Depending on the clues you receive in the initial interview, you should go to the client’s work area prepared to perform a variety of tests. You must look for four major issues when evaluating the customer’s environment:

• Event logs and services

• Symptoms and error codes (might require you to try to reproduce the problem)

• Power issues

• Interference sources

You can select from the tests listed in Table 15-5 based on your evaluation of the most likely sources of problems. You might need to perform several tests to rule out certain problems.

Table 15-5 Troubleshooting Tests and Requirements

Identifying the Problem: Logs and Services

If the client interview alone doesn’t point you in the right direction, check event logs and services.

Event Logs You can view event logs by running the Computer Management Console (Press Windows+R to open the Run prompt and type compmgmt.msc). Event logs are stored in branches of the Event Viewer. Look for Error messages (marked with a white X on a red circle) first, then Warnings (yellow triangle). Frequent errors or warnings that point to the same program or device can indicate a serious problem (see Figure 15-4).

Figure 15-4 Viewing an error message in the Application event log.

Services Many Windows features, such as printing, wireless networking, and others, depend upon services. To see if a needed service is running, open the Services and Applications node of the Computer Management Console and click Services. Check the Status column for the service needed (see Figure 15-5). To start a stopped service, right-click it and select Start. Alternatively, you could click the Start button on the tool bar, or double-click the service and click the Start button from the Properties window.

Figure 15-5 A Common Service in the Computer Management Window and its Properties Window.

The Properties window of the service also allows you to change the startup type as shown in Figure 15-5. There are three startup types. Sometimes you might need to set a service to Automatic, so that the service will start automatically every time the computer boots; many services are set this way by default. Or, you might want to set a service to Manual so that you have control over it. In other cases, you might want to set it to Disabled, for example, disabling the insecure Telnet service. This service is disabled by default in Windows Vista and XP, but you never know who or what may have enabled it.

Recording Symptoms and Error Codes

If you don’t find event logs useful, services are running properly, and your tests rule out power and interference, you must proceed to tests that focus on the hardware or software that appears to be the most likely cause of the problem.

Which test or diagnostic routine is the best one to start with? Before you perform any specific tests, review the clues you gathered from the client. Here’s an example: a document in Microsoft Word would print to a laser printer, but a project in Adobe InDesign would not.

Since all Windows-based programs use the same Windows printer driver, we can rule out the printer driver. Printer hardware or driver failures would prevent all software programs from printing; however, in this case, printing works from some programs but not others when the same printer and printer drivers are in use. Before you can solve this problem, you need more information about the printer. It’s time to use the printer’s self-test (a technique listed earlier in Table 15-5) for more information about the printer.

A laser printer’s self-test usually indicates the amount of RAM on board, the emulation (HP or PostScript), and firmware revisions. The amount of RAM on board is critical, because—as you learned in Chapter 11, “Printers”—laser printers are page printers: The whole page must fit into the laser printer’s RAM to be printed.

Thus, there are two variables to this printing problem: the size of the RAM in the printer and the size of the documents the user is trying to print. The self-test reveals the printer has only the standard amount of RAM (2MB) on board. This amount of RAM is adequate for text, but an elaborate page can overload it. A look at the InDesign document reveals that it has a large amount of graphic content, whereas the Microsoft Word document is standard-sized text only with a minimal use of bold and italic formatting.

Your theory is to add RAM to the printer, and it can print the brochure. If you don’t have a suitable RAM module, how can you prove it?

Because Microsoft Word printed a text-only document flawlessly, you might be able to convince your client from that fact alone that the printer isn’t “broken” but needs a RAM upgrade—or a workaround.

Devising a workaround that will help the printer work is good for client satisfaction and will prove that your theory is correct. Have the client adjust the graphics resolution of the printer from its default setting to a lower amount, such as from 1,200 dpi to 600 dpi or from 600 dpi to 300 dpi, and print the brochure again. If a lack of printer memory is the cause of the problem, reducing the brochure’s dots per inch for graphics objects will enable the brochure to print. The client will look at the lower print quality and if the client is not satisfied with the lower print quality caused by lower graphics resolution, at that point you can recommend the RAM upgrade. Point out the provision for RAM upgrades in the printer manual if necessary. Remember, you’re not selling anything, but solving problems.

If the printer will not print at all, other tests from Table 15-5 are appropriate, such as the I/O port loopback test or hardware resources check.

Checking Configurations and Device Manager

To check system configuration, use the following methods:

• To check integrated hardware, restart the system, start the BIOS configuration program, and examine the appropriate settings.

• To check Windows version, memory size, and processor speed, open the System properties sheet in Windows. The General tab lists this information.

• To check hardware resources, driver versions, and device status, open the Device Manager and open the properties sheet for any given device.

• To check program information, open the application program and use its Help, About option to view program version and service pack or update level.

For more information on using the BIOS setup program and device configurations in the BIOS, see Chapter 4, “BIOS.”

Common Problems

The following sections discuss how to deal with common computer problems including

• STOP (blue screen) errors

• Auto restart errors

• System lockups

• I/O device problems

• Application install or start/load problems

• Stalled print spooler

• Incorrect or incompatible print driver

STOP (Blue Screen) Errors

STOP errors (also known as blue screen of death or BSOD errors) can occur either during start up or after the system is running. The BSOD nickname is used because the background is normally blue (or sometimes black) with the error message in white text. Figure 15-6 displays a typical BSOD.

Figure 15-6 A typical STOP (BSOD) error. You can look up the error by name or by number.

BSOD errors can be caused by any of the following:

• Incompatible or defective hardware or software— Start the system in Safe Mode and uninstall the last hardware or software installed. Acquire updates before you reinstall the hardware or software. Exchange or test memory.

• Registry problems— Select Last Known Good Configuration as described earlier in this chapter and see if the system will start.

• Viruses— Scan for viruses and remove them if discovered.

• Miscellaneous causes— Check the Windows Event Viewer and check the System log. Research the BSOD with the Microsoft Knowledge Base.

To determine the exact cause of the error, you must

Step 1. Record the exact error message before restarting the computer.

Step 2. Research the error at Microsoft’s Knowledge Base (http://support.microsoft.com) if the BSOD keeps happening.

Auto Restart Errors

An Auto Restart error is a STOP/BSOD error that immediately reboots the computer. There is no difference between an Auto Restart error and a STOP/BSOD error itself. The difference is that a STOP/BSOD error triggers auto restart on systems that are configured to restart the computer when a STOP error occurs.

If a system needs to be available at all times and STOP/BSOD errors are rare, it might be preferable to configure the system to restart automatically (the default is to leave the system stopped until it is manually restarted). To change this option, follow these steps:

Step 1. Open the System Properties window.

Step 2. Click the Advanced tab.

Step 3. Click Settings under the Startup and Recovery section.

Step 4. To enable auto restart, click the empty checkbox for Automatically Restart under the System Failure section (see Figure 15-7). To disable auto restart if it is already enabled, clear this checkbox.

Figure 15-7 The Automatically Restart checkbox on the Startup and Recovery dialog determines whether a STOP error halts or restarts the system.

To enable diagnosis of a STOP/BSOD error when auto restart is enabled, make sure the Write an Event to the System Log option is enabled (refer to Figure 15-7). When a STOP error is saved to the System Log, it is listed with the type set as Information (not as Error, as you might expect). To find the event, search for events with the source listed as Save Dump. The STOP error will be listed thus:

The system has rebooted from a bugcheck. The bugcheck was (error number).

Look up the error number to find the solution.

When a stop error occurs, Windows will write debugging information to the hard drive for later analysis with programs like Dumpchk.exe; this debugging information is essentially the contents of RAM. The default setting in Windows XP is to only write a portion of the contents of RAM, known as a “Small memory dump”; this is written to %systemroot%Minidump as shown in Figure 15-7. Or you could configure Windows to do a Kernel memory dump, which is the default in Windows Vista. The Kernel memory dump is saved as the file %systemrootMEMORY.DMP which is larger than the minidump file. This is where the phrase “My computer just took a dump...” comes from! For more information on how to analyze the debugging information resulting from these stop errors, see the following link: http://support.microsoft.com/kb/315263.

System Lockups

System lockups can occur for a variety of reasons, including:

• Corrupted or outdated display, mouse, or DirectX drivers

• Overheating

• Memory configuration problems in the BIOS

A computer that won’t start except in VGA or Safe Mode or has frequent lockups or screen corruption when you move your mouse needs upgraded display, mouse, or DirectX drivers. However, as a workaround, you can reduce the video acceleration settings.

To do this in Windows Vista, access the Display Adapter Troubleshooter:

Step 1. Right-click the desktop and select Personalize.

Step 2. Click the Display Settings link at the bottom of the window.

Step 3. Click the Advanced Settings button.

Step 4. Select the Troubleshoot tab and click the Change settings button.

To access the Windows XP dialog shown in Figure 15-8:

Step 1. Open the Display Properties window.

Step 2. Click the Settings tab.

Step 3. Click the Advanced button.

Step 4. Click the Troubleshoot tab.

Figure 15-8 The Troubleshoot tab adjusts hardware acceleration settings, and can be used to determine whether display, mouse, or DirectX drivers need to be updated.

Use Table 15-6 to determine the best setting to use for the display problems you’re having with Windows Vista, XP, and 2000.

Table 15-6 Using Graphics Acceleration Settings to Troubleshoot Windows Vista, XP, and 2000

If you’re not sure which setting is the best for your problem, try this procedure:

Step 1. Start the computer.

Step 2. Open the Troubleshooting or Performance dialog box as described in the previous section.

Step 3. Slide the acceleration pointer one notch to the left from its current position.

Step 4. Click Apply, OK, and then OK again to close the Display Properties dialog box.

Step 5. Use your normal software and perform typical tasks.

Step 6. If the computer now performs acceptably (no more crashes), continue to use this setting until you can obtain and install updated drivers. If the computer continues to have problems, repeat Steps 2–5 and move the pointer one step to the left each time until the problems go away or until you can install updated drivers.

DxDiag

When it comes to making sure your devices are working properly, one of the most important is the video card, and a utility you can use to analyze and diagnose the video card is DxDiag. To run the DxDiag program, open the Run prompt and type dxdiag. First, the utility asks if you want it to check whether the corresponding drivers are digitally signed. A digitally signed driver means it is one that has been verified by Microsoft as compatible with the operating system. After the utility opens, you can find out what version of DirectX you are running. DirectX is a group of multimedia programs that enhance video and audio, including Direct3D, DirectDraw, DirectSound, and so on. With the DxDiag tool, you can view all the DirectX files that have been loaded, check their date, and discern whether any problems were found with the files. You can also find out information about your video and sound card, what level of acceleration they are set to, and test DirectX components such as DirectDraw and Direct3D. Windows Vista ships with DirectX version 10, whereas Windows XP currently can use up to DirectX 9.0c. However, DirectX 11 will have been released by the time this book is published. The latest DirectX features are important to video gamers and other multimedia professionals.

I/O Devices

Problems with I/O devices can be caused by Windows configuration issues, BIOS configuration issues (for ports built into the motherboard), cabling problems, and damage to the port itself.

Windows’s primary method of displaying I/O device configurations and problems is Windows Device Manager. Device Manager displays information about disabled I/O devices, I/O devices that cannot start or run, and other information (such as USB device and hub power, hardware resource usage such as IRQ, DMA, I/O port address, and memory address, power management and technical information such as PnP identification and others).

Windows cannot display information for ports and devices that have been disabled in the system BIOS. If a port that is physically present in the system is not visible in Device Manager, or if the port has reduced functionality (for example, a system with USB 2.0 ports lists only the USB 1.1-compatible standard USB host controller instead of listing both the standard and enhanced USB host controllers), you must adjust the system’s BIOS configuration. For details, see Chapter 4.

Driver Signing

Windows device driver files are digitally signed by Microsoft to ensure quality. The digital signature ensures that the file has met a certain level of testing, and that the file has not been altered. In Windows Vista, driver signing is configured automatically, and in Windows Vista and XP, only administrators can install unsigned drivers. In Windows XP, driver signing can be configured to either ignore device drivers that are not digitally signed, display a warning when Windows detects device drivers that are not digitally signed (the default behavior), or prevent installing device drivers without digital signatures. To configure driver signing in Windows XP, open the System Properties window, click the Hardware tab, and select Driver Signing.

Application Troubleshooting

Application troubleshooting involves dealing with applications that cannot be installed or cannot start.

If you can’t install an application, here are some reasons why—and some solutions:

• Not enough disk space on C: drive— Use the Custom Installation option, if available, to choose another drive, delete old files in the default Temp folder, or free up space by deleting .chk files created by ScanDisk or Chkdsk in the root folder.

• Computer doesn’t meet minimum requirements for RAM or CPU speed— Check for installation program switches to turn off speed and RAM checks, or, better still, upgrade the system to meet or exceed minimums.

• No more space available in root folder— A FAT16 drive with 256 entries in the root folder cannot create any more folders or files in the root. Install to another folder, or convert the drive to FAT32 or NTFS to eliminate this limitation. Keep in mind that a long file name (LFN) can use up multiple entries in the root folder.

• Application incompatible with version of Windows in use— Although most recent commercial applications are designed to be installed on several different Windows versions, some older commercial applications and some custom applications might not support a particular Windows version. If an update to a compatible version is available, update the application and try the installation again with an updated version. If no updated version is available, you can either use a different program or install a virtualization environment such as Microsoft’s Virtual PC, install an operating system supported by the application, and install the application itself. The virtualized operating system and application run in a window on the host PC.

Application Start or Load Failure

Applications might not start or load for several reasons, including

• Invalid working directory

• Missing or damaged shortcut

• System hardware, system configuration, or operating system version not compatible with program

• Program components not properly listed in system registry

If a program is configured to use a folder that isn’t available, the Invalid Working Directory error might be displayed. Use the appropriate solution from this list:

• Adjust the program’s operation to use a folder that is available using the program’s properties sheet.

• If the working folder is on a network drive, make sure the user is logged on the network.

• If the working folder is a removable-media drive, the user must insert the correct disk or CD-ROM before starting the program. Or, if the drive is present but has been assigned a different drive letter than it was originally assigned by Windows, use Disk Management to assign the correct drive letter.

If a program isn’t listed on the Start menu or the Windows desktop, it usually indicates that a shortcut was deleted or was never created. To add a desktop shortcut, follow these steps:

Step 1. Make sure desktop icons are visible. If they are not visible, right-click an empty part of the Windows desktop, select Arrange Icons By, and select Show Desktop Icons.

Step 2. Right-click an empty part of the Windows desktop and select New, Shortcut.

Step 3. You can enter the path to the program (such as C:WindowsSystem32mspaint.exe) or click the Browse button to locate the program for which you are making a shortcut. Click Next.

Step 4. The shortcut name created by Windows is displayed. To keep the name created by Windows, click Finish. You can also change the name as desired and click Finish. To create a new Start menu shortcut, see “Start Menu,” in Chapter 13

You might be able to enable troublesome programs to run by using the Program Compatibility Wizard, located in the Accessories menu, to select an older version of Windows to emulate for a particular program or to customize display settings. For more information about the Program Compatibility Wizard see “Application Compatibility,” in Chapter 13.

If the program is not listed as being compatible with your version of Windows, contact the vendor for patches, updates, or workarounds to make it work correctly.

If a program worked previously but has stopped working, its software components might be damaged or erased. Reload the program if possible. If the program stopped working after another program was installed or removed, some .dll program components might have been replaced or disabled. You can use the Microsoft command-line tool Regsvr32 to re-register .dll files used by applications.

Print Spooler Stalled

Windows Vista/XP/2000 run the print spooler as a service. To restart it from the list of local services, use this procedure with Windows Vista/XP/2000:

Step 1. Open Computer Management

Step 2. Expand Services and Applications and click on Services.

Step 3. Scroll to the Print Spooler entry.

Step 4. Right click it and select Restart from the menu.

Incorrect/Incompatible Printer Driver

Gibberish printing can have several causes, but one of the most common is a corrupt or incompatible printer driver.

To install a new printer driver for an existing printer, you can use the New Printer Driver wizard (start it with the New Driver button on the printer properties sheet’s Advanced tab). This wizard displays Windows XP printer drivers for a wide variety of printers, and includes the option to load a driver from a driver disk or folder.

This method might not work for printers that use a setup program to install the driver, as is common with many inkjet printers. To install a new driver in these cases, download an updated driver from the vendor’s website, uncompress it as directed by the vendor, and run the setup program. You might need to turn off the printer before running setup, as most printers that use a setup program require that the driver be installed before turning on (or connecting) the printer.

If a printer continues to produce gibberish printing after updating the driver, check for cable or port damage.

Common Error Messages and Codes

The following sections discuss solutions for the most common error messages and codes that Windows might display.

Windows Vista Boot Errors

As you learned in Chapter 13, Windows Vista uses the bootmgr and BCD files during the startup process. If these files are corrupted or missing, you will see corresponding error messages.

• BOOTMGR is missing— This message is displayed if the bootmgr file is missing or corrupt. This black screen will probably also say “Press Ctrl+Alt+Del to restart,” however doing so will probably have the same results.

There are two ways to repair this error.

1. Boot to the System Recovery Options and select the Startup Repair option. This should automatically repair the system and require you to reboot.

2. Boot to the System Recovery Options and select the Command Prompt option. Type the command bootrec /fixboot as shown in Figure 15-9.

Figure 15-9 Repairing BOOTMGR.exe with Windows Vista’s WinRE Command Prompt.

• The Windows Boot Configuration Data file is missing required information— This message means that either the Windows Boot Manager (Bootmgr) entry is not present in the Boot Configuration Data (BCD) store or that the BootBCD file on the active partition is damaged or missing. Additional information you might see on the screen includes: File: BootBCD, and Status: 0xc0000034

The BCD store needs to be repaired or rebuilt. Hold on to your hats, there are three methods for repairing this error:

1. Boot to the System Recovery Options and select the Startup Repair option. This should automatically repair the system and require you to reboot. If not, move on to the second method.

2. Boot to the System Recovery Options and select the Command Prompt option. Type bootrec /rebuildbcd. At this point the bootrec.exe tool will either succeed or fail.

• If the Bootrec.exe tool runs successfully, it presents you with an installation path of a Windows directory. To add the entry to the BCD store, type Yes. A confirmation message appears that indicates the entry was added successfully.

• If the Bootrec.exe tool can’t locate any missing Windows installations, you’ll have to remove the BCD store, and then re-create it. To do this, type the following commands in the order in which they are presented. Press Enter after each command.

Bcdedit /export C:BCD_Backup
ren c:ootcd bcd.old
Bootrec /rebuildbcd

Methods one and two will usually work, but if they don’t there is a third method that is more in depth and requires rebuilding the BCD store manually. More information on this step by step process can be found at the following link: http://support.microsoft.com/kb/927391.

Windows XP/2000 Boot Errors

As you learned in Chapter 13, Windows XP and 2000 use the NTLDR, Boot.ini, NTDETECT.COM, and Ntoskrnl.exe files during the startup process. If these files are corrupted or missing, you will see corresponding error messages:

• NTDETECT failed— This message is displayed if the NTDETECT.COM file is missing or corrupted.

• NTLDR is missing— This message is displayed if the NTLDR file is missing or corrupted.

• Invalid boot.ini— This message is displayed if the boot.ini file is missing or corrupted. The system might boot anyway, particularly if there is only disk partition on the first hard disk. However, if the system is configured as a dual boot or if Windows is not installed on the first disk partition, you need to re-create or recopy the file to enable your system to boot.

To fix these problems, you can

• Reboot with the Windows CD, select Repair, and run the Recovery Console (XP/2000) and recopy the file from the CD or a backup.

• Reboot with the Windows CD, select Repair, and run the Emergency Repair option (Windows 2000).

• Perform a Repair installation of Windows.

Device/Service Startup Errors

The Windows Registry, System.ini, and Win.ini files are used for hardware and software configuration information for Windows. These configuration files refer to programs and protected-mode drivers that must be accessed during the boot process. If you see an error message such as “Device x referred to in System.ini/Win.ini/Registry” not found, the most likely cause is that the file being referred to has been removed from the system incorrectly. To avoid this problem, use the appropriate option to uninstall or remove undesired programs and/or devices:

• For hardware, use the Remove button in the Device Manager before you physically remove the hardware from the system. Using Remove removes Registry and .ini file entries for the device so it will not be referred to when the system is restarted.

• Open Programs and Features (Vista), or Add/Remove Programs (XP) in the Windows Control Panel, select the program you want to remove. This starts the uninstall program for applications and utilities listed on the menu.

• Use the program’s own uninstall option or a third-party uninstall program.

Any of these options should remove both the program and references to it in the Registry and other locations, such as System.ini or Win.ini.

If the program is removed by deleting its folder, leaving references in the Registry, System.ini, or Win.ini, use the error message to determine which file contains the reference.

In Windows the easiest way to remove a reference in System.ini, Win.ini, or any startup routine (including the Registry) is to use the MSConfig program (see “MSConfig.EXE,” in Chapter 13, for more information).

You can also manually edit the Windows Registry to remove references to a missing device. See Chapter 13 for information on Registry editors.

More Windows Errors and Error Reporting

Windows errors that are less serious than a STOP/BSOD error, such as a hung or crashed application, might display a pop-up dialog similar to the one shown in Figure 15-10 after the application has closed. Figure 15-11 shows a critical error (runaway loop) that caused an application to close. However, the operating system and other applications still function. Figure 15-12 displays a critical error known as a general protection fault (GPF), which also caused the application to fail.

Figure 15-10 An Internet Explorer Error.

Figure 15-11 A Critical Error.

Figure 15-12 A General Protection Fault (GPF).

As you can see, Windows Vista/XP/2000 can recover from these types of errors and continue to function. More information can be found about the error in the Event Viewer, and in the case of Figure 15-10, the error report information can be viewed just by clicking on the “click here” link within the error window. You also have the option of sending an error report to Microsoft, in the hopes of acquiring a solution or fix.

To enable/disable error reporting in Windows Vista, navigate to Control Panel, System and Maintenance, Problem Reports and Solutions, Change Settings, Advanced Settings. To find out if any new solutions are available, click the Check for new solutions link within Problem Reports and Solutions. For a computer to successfully utilize this program, it needs to have a working Internet connection.

To enable/disable error reporting in Windows XP, navigate to the Advanced tab in the System Properties window and click the Error Reporting button.

Solving Disk Problems

Table 15-7 lists common disk problems and their solutions.

Table 15-7 Common Disk Problems and Their Solutions

Using Diagnostic Utilities and Tools

The following sections discuss diagnostic utilities and tools and when to use them.

Can’t Boot from Hard Disk

Boot sector viruses and magnetic errors can corrupt the master boot record (MBR), which is used by the BIOS’s bootstrap program to locate a bootable drive. A damaged MBR will prevent your system from starting from a bootable hard disk. To repair a damaged or corrupted MBR, you can use one of the following options:

• Windows Vista users can use the Command Prompt within WinRE (System Recovery Options) and type the command bootrec /fixmbr to repair the MBR. To repair the damaged Boot Manager program, the command would be bootrec /fixboot. For more information on this fix and other related fixes, see the following link: http://support.microsoft.com/kb/927392.

• Windows XP/2000 users can use the Recovery Console command Fixmbr on an NTFS-based drive. If the drive is FAT based, first use Fixboot, followed by Fixmbr. To rewrite the boot sector on a FAT-based drive, type Fixboot and press Enter. To repair the master boot record with an NTFS-based drive, type Fixmbr and press Enter. (If you boot from a different drive letter than the default Windows drive or a different hard disk than normal, you can specify the hard disk drive letter or drive number with these commands.)

Because damaged MBRs can be caused by a computer virus, you should test systems with an up-to-date antivirus program before using either of these commands. If a boot-sector virus is located by an antivirus program, the program’s own disk-repair options should be used first. Don’t forget that many BIOS programs come with the option to scan the boot sector for viruses. If you have this functionality in your motherboard’s BIOS, consider using it! If this is unsuccessful, you can use the appropriate repair tool to attempt to fix the MBR.

Using Task Manager

Windows Vista/XP/2000 can display the Windows Task Manager (see Figure 15-13) when you press Ctrl+Alt+Del (select Task Manager from the Windows Security dialog box).

Figure 15-13 The Windows XP version of the Windows Task Manager’s Applications (top left), Processes (top right), Performance (bottom left), and Networking (bottom right) tabs.

Use the Applications tab to determine if a program has stopped responding; you can shut down these programs. Use the Processes tab to see which processes are consuming the most memory. Use this dialog along with the System Configuration Utility (MSConfig) to help determine if you are loading unnecessary startup applications; MSConfig can disable them to free up memory (see “MSConfig.exe,” in Chapter 13, for details). If you are unable to shut down a program with the Applications tab, you can also shut down its processes with the Processes tab, but this is not recommended unless the program cannot be shut down in any other way.

Use the Performance tab to determine if you need to install more RAM memory or need to increase your paging file size. Use the Networking tab to monitor the performance of your network.

The top-level menu can be used to adjust the properties of the currently selected tab and to shut down the system.

Troubleshooting with Device Manager

If your computer has devices that are malfunctioning in a way that Device Manager can detect, or has devices that are disabled, they will be displayed as soon as you open Device Manager. For example, in Figure 15-14, the Ports (COM and LPT) category displays a malfunctioning port, COM 2, indicated by an exclamation mark (!) in a yellow circle. The parallel printer port, LPT1, has been disabled, as indicated by a red X. If the malfunctioning or disabled device is an I/O port, such as a serial, parallel, or USB port, any device attached to that port cannot work until the device is working properly.

Figure 15-14 Windows XP Device Manager displaying disabled and malfunctioning devices.

Not every problem with a device shows up in Device Manager, but most problems with resource conflicts or drivers will be displayed here.

To troubleshoot problems with a device in Device Manager, open its Properties sheet by double-clicking the device. Use the General tab shown in Figure 15-15 to display the device’s status and to troubleshoot a disabled or malfunctioning device. For information about other tabs in Device Manager, see “Device Manager,” in Chapter 13.

Figure 15-15 A problem device’s General properties. If the device’s General Properties sheet lacks a solution button, look up the Device Manager error code and take appropriate action manually.

When you have a malfunctioning device such as the one in Figure 15-15, you have several options for resolving the problem:

• Look up the Device Manager code to determine the problem and its solution (see Table 15-8 for a few examples).

Table 15-8 Example of Some Device Manager Codes and Solutions

• Click the Troubleshoot button (if any) shown on the device’s General Properties tab; the button’s name and usage depends upon the problem. Table 15-8 lists the codes, their meanings, and the solution button (if any).

• Manually change resources. If the nature of the problem is a resource conflict, you can click the Resources tab and change the settings and eliminate the conflict if possible. Most recent systems that use ACPI power management don’t permit manual resource changes in Device Manager and also override any changes you might make in the system BIOS setup program. On these systems, if resource conflicts take place, you might need to disable ACPI power management before you can solve resource conflicts.

• Manually update drivers. If the problem is a driver issue but an Update Driver button isn’t available, open the Driver tab and install a new driver for the device.

If the device has a conflict with another device, you might be able to change the settings in the device’s Properties page/Resources tab (see Figure 15-16). If the device is a legacy (non-PnP) device, you might need to shut down the system and reconfigure the card manually before you can use Device Manager to reset its configuration in Windows.

Figure 15-16 The parallel port’s current configuration (a) conflicts with another port. By selecting another configuration (b), the conflict is resolved.

You can also use the Device Manager to disable a device that is conflicting with another device. To disable a device, follow these steps:

Step 1. Click the plus (+) sign next to the device category containing the device.

Step 2. Right-click the device and select Disable.

or

Step 1. Right-click the device and select Properties.

Step 2. On the General tab, look for the Device Usage display at the bottom of the window. Click the menu and select Do Not Use This Device (disable). Refer to Figure 15-15. If you prefer to solve the problem with the device, click the Troubleshoot button.

Depending on the device, you might need to physically remove it from the system to resolve a conflict. To use the Device Manager to remove a device, follow these steps:

Step 1. Click the plus (+) sign next to the device category containing the device.

Step 2. Right-click the device and select Uninstall.

Step 3. Shut down the system and remove the physical device.

or

Step 1. Right-click the device and select Properties.

Step 2. Access the Driver tab, and click the Uninstall button.

Step 3. Shut down the system and remove the physical device.

Using System File Checker (SFC)

System File Checker (SFC) is a Windows Vista/XP/2000 utility that checks protected system files (files such as .DLL, .SYS, .OCX, and .EXE, as well as some font files used by the Windows desktop) and replaces incorrect versions or missing files with the correct files. Use SFC to fix problems with Internet Explorer or other built-in Windows programs caused by the installation of obsolete Windows system files, user error, deliberate erasure, virus or Trojan horse infections, and similar problems. To run SFC, open the command prompt and type SFC with the appropriate switch. A typical option is SFC /scannow, which scans all protected files immediately. Another is SFC /scanonce, which scans all protected files at the next boot. If SFC finds that some files are missing, you are prompted to reinsert your Windows distribution disc so the files can be copied to the DLL cache. Other options include /scanboot, which scans all protected files every time the system starts; /revert, which returns the scan setting to the default; and /purgecache and /cachesiz=x, which allow a user to delete the file cache and modify its size.

Maintaining Windows

To keep a Windows installation healthy, it’s important to maintain it by installing service packs, hotfixes, and creating image backups that can be used to restore the system to operation quickly. The following sections discuss these issues.

Installing Service Packs and Hotfixes

Currently, there are two service packs for Windows Vista. Service Pack 2 is the most recent as of the writing of this book. Service Pack 2 can be installed automatically via Windows Update, by downloading Service Pack 2 for manual installation, or by ordering a CD. Currently, there are three service packs for Windows XP. Service Pack 3 is the most recent. Hotfixes are updates that can be installed to a computer while the user is working on other things. They are usually installed one at a time, unlike Service Packs, which are groups of updates that should be installed while the user is not working on the computer.

To download and install a service pack for Windows, follow these steps:

Step 1. Determine whether the system has any service packs installed. You should perform this check even if you have just installed Windows, because you can install Windows with service packs included, and newer Windows DVD/CDs will contain a service pack. Right-click Computer/My Computer and select Properties to find out the current service pack. The command winver.exe can also be used in the Command Prompt to discern this information. Figure 15-17 illustrates a Windows XP system with Service Pack 2 installed.

Figure 15-17 This Windows XP system has Service Pack 2 installed.

Step 2. Go to the website containing the service pack needed.

Step 3. Read the release notes for the service pack to see if it will cause any problems for your particular configuration, such as problems with networking, winmodems, CD mastering software, and so forth. Take the necessary actions as noted. (Some might require changes before you perform the service pack installation; others might take place afterward.)

Step 4. Click the link to start the download; you might need to select the correct language for the service pack first.

Step 5. Shut down real-time virus checkers such as Norton Anti-Virus’s Auto-Protect.

Step 6. Select Express Installation if you want to install the service pack on only one computer (this requires an Internet connection during the entire process); select Network Installation to download the entire service pack for use on multiple computers.

Follow steps 7a and 8a to perform a Network Installation.

Follow steps 7b and 8b to perform an Express Installation.

Step 7a. Select a location to store the file with Network Installation.

Step 7b. Open the file from its current location to start the installation process with Express Installation.

Step 8a. Open the file you downloaded in step 7a to perform a Network Installation of the service pack.

Step 8b. Follow the prompts to complete an Express Installation of the service pack.

Step 9. You should update your system backup disk and back up your files before you install the service pack, and select the option to archive existing Windows files during the service pack installation.

Step 10. Restart the system when prompted.

Service packs are very large because they contain hundreds of updates and hotfixes. Hotfixes, which are solutions for specific problems experienced only by users with certain combinations of hardware and software, can also be downloaded individually. Once a hotfix is deemed safe for all users, it will usually be distributed via Windows Update or Microsoft Update. However, it can also be downloaded manually or requested by the user. Hotfixes are listed as part of Knowledge Base articles about specific problems. See http://support.microsoft.com for the Knowledge Base.

At one time, it was necessary to call Microsoft to request hotfixes that were not available for automatic downloading. Now, Microsoft provides a link on Knowledge Base pages where you can make the request. Enter the information desired and your email address, and a link to the requested hotfix will be emailed to you.

Using Windows Update and Microsoft Update

To install additional updates for Windows through Windows Update, follow these steps:

Step 1. Click Start, All Programs, Windows Update.

Step 2. Windows Vista will open the Window Update window where you can click the Install updates button. Windows XP will open a web page where you can select Express or Custom installation of updates. Follow the prompts to install the latest version of the Windows Update software if necessary.

Step 3. The system (or web page) will automatically scan for updates. Updates are divided into the following categories:

• Critical Updates and Service Packs— These include the latest service pack and other security and stability updates. Some updates must be installed individually; others can be installed as a group.

• Windows Updates— Recommended updates to fix noncritical problems certain users might encounter; also adds features and updates to features bundled into Windows.

• Driver Updates— Updated device drivers for installed hardware.

Step 4. Whether you have selected an Express install or if you selected updates desired, they are downloaded to your system and installed. You might need to restart your computer to complete the update process.

If you use Microsoft Office or other Microsoft applications as well as Microsoft Windows, Windows Update will offer to install Microsoft Update, which provides a common update mechanism for both Windows and other Microsoft products. Once you install Microsoft Update, it runs automatically whenever you run Windows Update. Keep in mind that Microsoft Office uses service packs as well. For example, currently the latest service pack for Office 2003 is SP3; Office 2007 is SP2.

Performing Scheduled Backup and Restore

To help ensure that documents are backed up on a timely basis, you might prefer to set up specific times to back up documents. You can use the Task Scheduler in Windows Vista (Start > All Programs > Accessories > System Tools > Task Scheduler), or the Scheduled Tasks wizard in Windows XP (Start, Control Panel, Scheduled Tasks) to enable NTBackup to run automatically. If you use a third-party backup program, it might use Scheduled Tasks, or it might use its own scheduler.

Image Backups

Windows Vista’s Backup Status and Configuration has the ability to backup an image of your system, but Windows XP cannot do this. This is one reason to consider alternatives to Windows XP’s NTBackup. An image backup backs up your entire system disk partition, including your Windows installation, programs, utilities, data files and settings, and can also be used to back up other disk partitions.

Early image backup programs could only be used to make image backups for complete restoration in case of a hard disk crash or failure. For this reason, image backups are sometimes referred to as disaster recovery backups, and the process of restoring an image is sometimes called a bare metal restore, because it can usually be done by booting the system with a restore floppy disk or CD set and using the image backup program’s restore component to re-create disk partitions and restore the entire contents of the disk. After rebooting, the system is back to its as-imaged condition.

Modern image backup programs such as recent versions of Norton Ghost and Acronis True Image also make it possible to restore individual files and folders and to create incremental backups, enabling the image backup program to work as both an image and file/folder backup.

Image backups enable you to restore a system to operation without the need to perform separate reinstallations of Windows and applications, and can also be used to protect a test or experimental installation from being corrupted by beta or pre-release software. The time required to restore an image is a small fraction of what it would take to reinstall Windows and applications.

Exam Preparation Tasks

Review All the Key Topics

Review the most important topics in the chapter, noted with the key topics icon in the outer margin of the page. Table 15-9 lists a reference of these key topics and the page numbers on which each is found.

Table 15-9 Key Topics for Chapter 15

Complete the Tables and Lists from Memory

Print a copy of Appendix B, “Memory Tables,” (found on the CD), or at least the section for this chapter, and complete the tables and lists from memory. Appendix C, “Memory Tables Answer Key,” also on the CD, includes completed tables and lists to check your work.

Definitions of Key Terms

Define the following key terms from this chapter, and check your answers in the glossary.

Advanced Boot Options menu,

Last Known Good Configuration,

Windows Recovery Environment (WinRE),

Recovery Console,

Hotfix,

Mast Boot Record,

Fragmentation

Troubleshooting Scenario

You are a technician for your company. You have been having problems with a user’s computer hard drive. The user is losing her data. You need to come up with a solution that will keep the user’s documents from being deleted. You do not have a network server to store the user’s data. What should you do to prevent this from happening?

Refer to Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Troubleshooting Scenarios,” for the answer.